truecourse 0.7.0-next.4 → 0.7.0-next.5

package/cli.mjs

@@ -973,7 +973,7 @@ var require_command = __commonJS({
     var EventEmitter2 = __require("node:events").EventEmitter;
     var childProcess = __require("node:child_process");
     var path80 = __require("node:path");
-    var fs70 = __require("node:fs");
+    var fs71 = __require("node:fs");
     var process2 = __require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -1906,10 +1906,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
           const localBin = path80.resolve(baseDir, baseName);
-          if (fs70.existsSync(localBin)) return localBin;
+          if (fs71.existsSync(localBin)) return localBin;
           if (sourceExt.includes(path80.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext2) => fs70.existsSync(`${localBin}${ext2}`)
+            (ext2) => fs71.existsSync(`${localBin}${ext2}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -1921,7 +1921,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs70.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs71.realpathSync(this._scriptPath);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
@@ -17088,8 +17088,8 @@ function getMaxParameters(filePath) {
   }
   return 5;
 }
-function isBootstrapEntry(functionName, filePath) {
-  return LANGUAGE_CONFIGS.some((c2) => c2.bootstrap.functionNames.includes(functionName) && c2.bootstrap.filePattern.test(filePath));
+function isBootstrapEntry(functionName2, filePath) {
+  return LANGUAGE_CONFIGS.some((c2) => c2.bootstrap.functionNames.includes(functionName2) && c2.bootstrap.filePattern.test(filePath));
 }
 function getLanguageConfig(language) {
   const config2 = LANGUAGE_CONFIGS.find((c2) => c2.name === language);
@@ -21824,9 +21824,6 @@ function buildCSharpSymbolIndex(files, rootPath) {
 }
 function contributeCSharpEdges(files, rootPath) {
   const index = buildCSharpSymbolIndex(files, rootPath);
-  if (index.stats.ambiguousRefs > 0) {
-    console.warn(`[TrueCourse] C# symbol index: ${index.stats.ambiguousRefs} ambiguous type reference(s) skipped (same type name visible from multiple namespaces)`);
-  }
   return index.edges;
 }
 var TYPE_DECL_KINDS;
@@ -27155,12 +27152,9 @@ var init_lsp_client = __esm({
         this.process.stdout.on("data", (chunk3) => this.onData(chunk3));
         this.process.stderr.on("data", (chunk3) => {
         });
-        this.process.on("error", (err) => {
-          for (const pending of this.pendingRequests.values()) {
-            pending.reject(err);
-          }
-          this.pendingRequests.clear();
-        });
+        this.process.on("error", (err) => this.rejectAllPending(err));
+        this.process.stdin.on("error", (err) => this.rejectAllPending(new Error(`${this.config.name} LSP stdin error: ${err.message}`)));
+        this.process.on("exit", (code, signal) => this.rejectAllPending(new Error(`${this.config.name} LSP server exited (${signal ?? `code ${code}`}) before responding`)));
         const initResult = await this.sendRequest("initialize", {
           processId: process.pid,
           capabilities: {
@@ -27339,17 +27333,33 @@ var init_lsp_client = __esm({
       // -------------------------------------------------------------------------
       // Internal: JSON-RPC transport
       // -------------------------------------------------------------------------
+      /** Reject and clear every in-flight request — used when the server dies. */
+      rejectAllPending(err) {
+        if (this.pendingRequests.size === 0)
+          return;
+        for (const pending of this.pendingRequests.values())
+          pending.reject(err);
+        this.pendingRequests.clear();
+      }
       sendRequest(method, params) {
         return new Promise((resolve12, reject) => {
           const id = ++this.requestId;
           this.pendingRequests.set(id, { resolve: resolve12, reject });
           const msg = { jsonrpc: "2.0", id, method, params };
-          this.process.stdin.write(encodeMessage(msg));
+          try {
+            this.process.stdin.write(encodeMessage(msg));
+          } catch (err) {
+            this.pendingRequests.delete(id);
+            reject(err instanceof Error ? err : new Error(String(err)));
+          }
         });
       }
       sendNotification(method, params) {
         const msg = { jsonrpc: "2.0", method, params };
-        this.process.stdin.write(encodeMessage(msg));
+        try {
+          this.process.stdin.write(encodeMessage(msg));
+        } catch {
+        }
       }
       onData(chunk3) {
         this.buffer = Buffer.concat([this.buffer, chunk3]);
@@ -37834,7 +37844,8 @@ var init_deterministic4 = __esm({
         description: "Function parameter is never referenced in the function body \u2014 remove it or prefix with `_`.",
         enabled: true,
         severity: "low",
-        type: "deterministic"
+        type: "deterministic",
+        engine: "roslyn-host"
       },
       {
         key: "code-quality/deterministic/hardcoded-url",
@@ -49118,6 +49129,94 @@ var init_production_debug_enabled = __esm({
 });
 
 // packages/analyzer/dist/rules/security/visitors/javascript/insecure-random.js
+function isSecuritySensitiveName(name) {
+  const lower = name.toLowerCase();
+  return SECURITY_KEYWORDS.some((kw) => lower.includes(kw));
+}
+function securityContextName(callNode) {
+  let parent = callNode.parent;
+  while (parent) {
+    switch (parent.type) {
+      case "variable_declarator":
+        return leafName(parent.childForFieldName("name"));
+      case "assignment_expression":
+      case "augmented_assignment_expression":
+        return leafName(parent.childForFieldName("left"));
+      case "pair":
+        return leafName(parent.childForFieldName("key"));
+      case "public_field_definition":
+      case "field_definition":
+        return leafName(parent.childForFieldName("property") ?? parent.childForFieldName("name"));
+      // The value is returned from the enclosing function (e.g.
+      // `function generateToken() { return Math.random()... }`) — the
+      // function name is the security context.
+      case "return_statement":
+        return enclosingFunctionName(parent);
+      // Expression-bodied arrow returns the value directly, e.g.
+      // `const genToken = () => Math.random()...`.
+      case "arrow_function":
+        return functionName(parent);
+      // Structural boundaries: the random value is discarded or otherwise
+      // not bound to a name.
+      case "expression_statement":
+      case "statement_block":
+      case "if_statement":
+      case "for_statement":
+      case "for_in_statement":
+      case "while_statement":
+      case "do_statement":
+      case "switch_statement":
+      case "function_declaration":
+      case "function_expression":
+      case "method_definition":
+        return null;
+    }
+    parent = parent.parent;
+  }
+  return null;
+}
+function enclosingFunctionName(node2) {
+  let p2 = node2.parent;
+  while (p2) {
+    if (p2.type === "function_declaration" || p2.type === "generator_function_declaration" || p2.type === "method_definition" || p2.type === "arrow_function" || p2.type === "function_expression") {
+      return functionName(p2);
+    }
+    p2 = p2.parent;
+  }
+  return null;
+}
+function functionName(fn) {
+  const nameField = fn.childForFieldName("name");
+  if (nameField)
+    return leafName(nameField);
+  const p2 = fn.parent;
+  if (!p2)
+    return null;
+  if (p2.type === "variable_declarator")
+    return leafName(p2.childForFieldName("name"));
+  if (p2.type === "pair")
+    return leafName(p2.childForFieldName("key"));
+  if (p2.type === "assignment_expression")
+    return leafName(p2.childForFieldName("left"));
+  if (p2.type === "public_field_definition" || p2.type === "field_definition") {
+    return leafName(p2.childForFieldName("property") ?? p2.childForFieldName("name"));
+  }
+  return null;
+}
+function leafName(node2) {
+  if (!node2)
+    return null;
+  if (node2.type === "identifier" || node2.type === "property_identifier" || node2.type === "shorthand_property_identifier") {
+    return node2.text;
+  }
+  if (node2.type === "member_expression") {
+    return node2.childForFieldName("property")?.text ?? null;
+  }
+  if (node2.type === "string") {
+    return node2.text.slice(1, -1);
+  }
+  return node2.text;
+}
 function isFixtureOrTestFile(filePath) {
   const lower = filePath.toLowerCase();
   return /[\\/]seeds?[\\/]/.test(lower) || /[\\/](?:seed|seeds)\.(?:ts|tsx|js|jsx|mts|cts|mjs|cjs)$/.test(lower) || /\.seed\.(?:ts|tsx|js|jsx|mts|cts|mjs|cjs)$/.test(lower) || /[\\/]__tests__[\\/]/.test(lower) || /\.(?:test|spec)\.(?:ts|tsx|js|jsx|mts|cts|mjs|cjs)$/.test(lower);
@@ -49148,19 +49247,9 @@ var init_insecure_random = __esm({
               if (/\.length\b/.test(parentText))
                 return null;
             }
-            let parent = node2.parent;
-            while (parent) {
-              const parentText = parent.text.toLowerCase();
-              if (SECURITY_KEYWORDS.some((kw) => parentText.includes(kw))) {
-                const immediateParent = node2.parent;
-                if (immediateParent?.type === "binary_expression" && /\.length\b/.test(immediateParent.text)) {
-                  return null;
-                }
-                return makeViolation(this.ruleKey, node2, filePath, "high", "Insecure random number generator", "Math.random() is not cryptographically secure. Do not use it for tokens, keys, or secrets.", sourceCode, "Use crypto.randomBytes() or crypto.randomUUID() instead.");
-              }
-              if (parent.type === "expression_statement" || parent.type === "variable_declaration" || parent.type === "assignment_expression" || parent.type === "lexical_declaration")
-                break;
-              parent = parent.parent;
+            const contextName = securityContextName(node2);
+            if (contextName && isSecuritySensitiveName(contextName)) {
+              return makeViolation(this.ruleKey, node2, filePath, "high", "Insecure random number generator", "Math.random() is not cryptographically secure. Do not use it for tokens, keys, or secrets.", sourceCode, "Use crypto.randomBytes() or crypto.randomUUID() instead.");
             }
           }
         }
@@ -49589,6 +49678,11 @@ var init_unverified_cross_origin_message = __esm({
         }
         if (methodName3 !== "addEventListener")
           return null;
+        if (fn.type === "member_expression") {
+          const receiver = fn.childForFieldName("object")?.text ?? "";
+          if (receiver !== "window" && receiver !== "self" && receiver !== "globalThis")
+            return null;
+        }
         const args = node2.childForFieldName("arguments");
         if (!args)
           return null;
@@ -50071,7 +50165,11 @@ var init_timing_attack_comparison = __esm({
           return null;
         const leftLeaf = leafIdentifier(left);
         const rightLeaf = leafIdentifier(right);
-        if (SENSITIVE_COMPARISON_PATTERNS.test(leftLeaf) || SENSITIVE_COMPARISON_PATTERNS.test(rightLeaf)) {
+        const leftIsLiteral = left.type === "string" || left.type === "template_string";
+        const rightIsLiteral = right.type === "string" || right.type === "template_string";
+        const leftMatches = !leftIsLiteral && SENSITIVE_COMPARISON_PATTERNS.test(leftLeaf);
+        const rightMatches = !rightIsLiteral && SENSITIVE_COMPARISON_PATTERNS.test(rightLeaf);
+        if (leftMatches || rightMatches) {
           if (sourceCode.includes("timingSafeEqual"))
             return null;
           return makeViolation(this.ruleKey, node2, filePath, "medium", "Timing attack via string comparison", `Using ${operator.text} to compare what may be a secret/token. This is vulnerable to timing attacks.`, sourceCode, "Use crypto.timingSafeEqual() for comparing secrets and tokens.");
@@ -50658,6 +50756,14 @@ var init_mixed_http_methods = __esm({
 });
 
 // packages/analyzer/dist/rules/security/visitors/javascript/process-signaling.js
+function isOwnedProcessPid(node2) {
+  if (node2.type !== "member_expression")
+    return false;
+  if (node2.childForFieldName("property")?.text !== "pid")
+    return false;
+  const obj = node2.childForFieldName("object");
+  return obj?.type === "member_expression" && obj.childForFieldName("property")?.text === "process";
+}
 var processSignalingVisitor;
 var init_process_signaling = __esm({
   "packages/analyzer/dist/rules/security/visitors/javascript/process-signaling.js"() {
@@ -50685,6 +50791,8 @@ var init_process_signaling = __esm({
         const pidArg = args.namedChildren[0];
         if (!pidArg)
           return null;
+        if (isOwnedProcessPid(pidArg))
+          return null;
         if (pidArg.type !== "number") {
           return makeViolation(this.ruleKey, node2, filePath, "high", "Sending signals to arbitrary processes", "process.kill() called with a non-literal PID. If the PID is user-controlled, this enables process manipulation.", sourceCode, "Validate and sanitize the PID before passing it to process.kill().");
         }
@@ -52038,8 +52146,8 @@ var init_sql_injection2 = __esm({
         if (!firstArg)
           return null;
         if (firstArg.type === "string" && firstArg.text.startsWith("f")) {
-          const hasInterpolation2 = firstArg.namedChildren.some((c2) => c2.type === "interpolation");
-          if (hasInterpolation2) {
+          const hasInterpolation = firstArg.namedChildren.some((c2) => c2.type === "interpolation");
+          if (hasInterpolation) {
             const queryText = firstArg.text;
             if (/:[a-z_]\w*|%s|%\(\w+\)s/.test(queryText))
               return null;
@@ -52549,17 +52657,17 @@ var init_eval_usage2 = __esm({
             funcName = attr.text;
           const receiver = fn.childForFieldName("object");
           if (receiver) {
-            let leafName2 = null;
+            let leafName3 = null;
             if (receiver.type === "identifier") {
-              leafName2 = receiver.text;
+              leafName3 = receiver.text;
             } else if (receiver.type === "attribute") {
               const attrChild = receiver.childForFieldName("attribute");
               if (attrChild) {
-                leafName2 = attrChild.text.replace(/^_+/, "");
+                leafName3 = attrChild.text.replace(/^_+/, "");
               }
             }
-            if (leafName2 && SAFE_METHOD_RECEIVERS.has(leafName2)) {
-              const expectedSources = SAFE_RECEIVER_IMPORT_SOURCES[leafName2];
+            if (leafName3 && SAFE_METHOD_RECEIVERS.has(leafName3)) {
+              const expectedSources = SAFE_RECEIVER_IMPORT_SOURCES[leafName3];
               if (expectedSources) {
                 const sources = getPythonImportSources(node2);
                 for (const src of sources) {
@@ -56531,6 +56639,12 @@ var init_exclusions = __esm({
       /^https?:\/\/(?!hooks\.slack\.com|[a-z0-9]+\.webhook\.office\.com)/,
       // Docker / container image references
       /^(?:docker|ghcr|quay|gcr|ecr)\.io\//,
+      // PostHog public project API key (phc_…) — intentionally client-exposed,
+      // embedded in frontend code to send analytics events. Its 40+ char base62
+      // body collides with the generic Cohere-token shape, but it is not a
+      // private credential. Private PostHog keys use the phx_/phs_ prefixes and
+      // are deliberately NOT allowlisted here.
+      /^phc_[A-Za-z0-9]{30,}$/,
       // Common config patterns that aren't secrets
       /^\*+$/,
       // All asterisks (masked values)
@@ -58346,10 +58460,33 @@ var init_secret_scanner = __esm({
 });
 
 // packages/analyzer/dist/rules/security/visitors/universal.js
+function hasPasswordToken(text4) {
+  const lower = text4.toLowerCase();
+  return lower.includes("password") || lower.includes("passwd");
+}
+function isPasswordHashingContext(node2) {
+  let stmt = node2.parent;
+  while (stmt && !STATEMENT_NODE_TYPES2.has(stmt.type) && !FUNCTION_NODE_TYPES3.has(stmt.type)) {
+    stmt = stmt.parent;
+  }
+  if (stmt && STATEMENT_NODE_TYPES2.has(stmt.type) && hasPasswordToken(stmt.text))
+    return true;
+  let fnNode = node2.parent;
+  while (fnNode && !FUNCTION_NODE_TYPES3.has(fnNode.type))
+    fnNode = fnNode.parent;
+  if (fnNode) {
+    const nameNode = fnNode.childForFieldName("name");
+    const paramsNode = fnNode.childForFieldName("parameters") ?? fnNode.childForFieldName("parameter_list");
+    const signature = `${nameNode?.text ?? ""} ${paramsNode?.text ?? ""}`;
+    if (hasPasswordToken(signature))
+      return true;
+  }
+  return false;
+}
 function stripCommentMarkers(text4) {
   return text4.replace(/^\/{2,3}\s?/, "").replace(/^\/\*\s?/, "").replace(/\s?\*\/$/, "").replace(/^\s*\*\s?/gm, "").replace(/^#\s?/gm, "").trim();
 }
-var STRING_NODE_TYPES, hardcodedSecretVisitor, IPV4_REGEX, EXCLUDED_IPS, hardcodedIpVisitor, CLEARTEXT_PROTOCOLS, LOCALHOST_PREFIXES, clearTextProtocolVisitor, BIP39_COMMON_WORDS, hardcodedBlockchainMnemonicVisitor, DB_URL_PATTERN, DB_PASSWORD_KV_PATTERNS, NON_LITERAL_PASSWORD_SEGMENT, PLACEHOLDER_PASSWORDS, hardcodedDatabasePasswordVisitor, ldapUnauthenticatedVisitor, passwordStoredPlaintextVisitor, HASH_FUNCTIONS_NEEDING_SALT, unpredictableSaltMissingVisitor, sensitiveFileVisitor, hardcodedSecretInCommentVisitor, SECURITY_UNIVERSAL_VISITORS;
+var STRING_NODE_TYPES, hardcodedSecretVisitor, IPV4_REGEX, EXCLUDED_IPS, hardcodedIpVisitor, CLEARTEXT_PROTOCOLS, LOCALHOST_PREFIXES, clearTextProtocolVisitor, BIP39_COMMON_WORDS, hardcodedBlockchainMnemonicVisitor, DB_URL_PATTERN, DB_PASSWORD_KV_PATTERNS, NON_LITERAL_PASSWORD_SEGMENT, PLACEHOLDER_PASSWORDS, hardcodedDatabasePasswordVisitor, ldapUnauthenticatedVisitor, passwordStoredPlaintextVisitor, HASH_FUNCTIONS_NEEDING_SALT, STATEMENT_NODE_TYPES2, FUNCTION_NODE_TYPES3, unpredictableSaltMissingVisitor, sensitiveFileVisitor, hardcodedSecretInCommentVisitor, SECURITY_UNIVERSAL_VISITORS;
 var init_universal = __esm({
   "packages/analyzer/dist/rules/security/visitors/universal.js"() {
     "use strict";
@@ -59529,6 +59666,29 @@ var init_universal = __esm({
       "sha256",
       "sha512"
     ]);
+    STATEMENT_NODE_TYPES2 = /* @__PURE__ */ new Set([
+      "expression_statement",
+      "return_statement",
+      "lexical_declaration",
+      "variable_declaration",
+      "variable_declarator",
+      "local_declaration_statement",
+      "assignment",
+      "augmented_assignment",
+      "assignment_expression",
+      "augmented_assignment_expression"
+    ]);
+    FUNCTION_NODE_TYPES3 = /* @__PURE__ */ new Set([
+      "function_declaration",
+      "function_expression",
+      "arrow_function",
+      "generator_function_declaration",
+      "method_definition",
+      "function_definition",
+      "method_declaration",
+      "local_function_statement",
+      "constructor_declaration"
+    ]);
     unpredictableSaltMissingVisitor = {
       ruleKey: "security/deterministic/unpredictable-salt-missing",
       nodeTypes: ["call_expression", "call", "invocation_expression"],
@@ -59546,21 +59706,12 @@ var init_universal = __esm({
         }
         if (!HASH_FUNCTIONS_NEEDING_SALT.has(methodName3))
           return null;
-        let parent = node2.parent;
-        while (parent) {
-          const parentText = parent.text.toLowerCase();
-          if (parentText.includes("password") || parentText.includes("passwd")) {
-            const args = node2.childForFieldName("arguments");
-            if (args && args.namedChildren.length < 2) {
-              return makeViolation(this.ruleKey, node2, filePath, "high", "Missing salt in hash", `${methodName3}() called without a salt in a password context. This allows rainbow table attacks.`, sourceCode, "Use a password hashing function like bcrypt, argon2, or PBKDF2 which handle salting automatically.");
-            }
-            return null;
-          }
-          if (parent.type === "function_declaration" || parent.type === "function_definition" || parent.type === "method_definition" || parent.type === "program" || parent.type === "method_declaration" || parent.type === "compilation_unit")
-            break;
-          parent = parent.parent;
-        }
-        return null;
+        const args = node2.childForFieldName("arguments");
+        if (!args || args.namedChildren.length >= 2)
+          return null;
+        if (!isPasswordHashingContext(node2))
+          return null;
+        return makeViolation(this.ruleKey, node2, filePath, "high", "Missing salt in hash", `${methodName3}() called without a salt in a password context. This allows rainbow table attacks.`, sourceCode, "Use a password hashing function like bcrypt, argon2, or PBKDF2 which handle salting automatically.");
       }
     };
     sensitiveFileVisitor = {
@@ -59653,7 +59804,7 @@ function isLiteralNode(n) {
   }
   return false;
 }
-var JS_LANGUAGES, TS_LANGUAGES, COMPARISON_OPERATORS, CONSTANT_LITERALS, TERMINAL_TYPES, VALID_TYPEOF_VALUES, LITERAL_TYPES, ARRAY_METHODS_REQUIRING_RETURN, PRIMITIVE_TYPES, PURE_ARRAY_METHODS, KNOWN_ARG_ORDERS, VOID_RETURNING_METHODS, VOID_RETURNING_GLOBALS, NON_CONSTRUCTORS, PROTOTYPE_BUILTINS, NON_CALLABLE_GLOBALS, READ_ONLY_GLOBALS, RESTRICTED_NAMES, THROWABLE_TYPES;
+var JS_LANGUAGES, TS_LANGUAGES, COMPARISON_OPERATORS, CONSTANT_LITERALS, TERMINAL_TYPES, VALID_TYPEOF_VALUES, LITERAL_TYPES, ARRAY_METHODS_REQUIRING_RETURN, PRIMITIVE_TYPES, PURE_ARRAY_METHODS, SOCKET_IO_RECEIVERS, KNOWN_ARG_ORDERS, VOID_RETURNING_METHODS, VOID_RETURNING_GLOBALS, NON_CONSTRUCTORS, PROTOTYPE_BUILTINS, NON_CALLABLE_GLOBALS, READ_ONLY_GLOBALS, RESTRICTED_NAMES, THROWABLE_TYPES;
 var init_helpers2 = __esm({
   "packages/analyzer/dist/rules/bugs/visitors/javascript/_helpers.js"() {
     "use strict";
@@ -59711,6 +59862,7 @@ var init_helpers2 = __esm({
       "reduce",
       "reduceRight"
     ]);
+    SOCKET_IO_RECEIVERS = /* @__PURE__ */ new Set(["socket", "sockets"]);
     KNOWN_ARG_ORDERS = [
       { fn: "startsWith", params: [["prefix", "str", "string", "start", "needle", "search"]] },
       { fn: "endsWith", params: [["suffix", "str", "string", "end", "needle", "search"]] },
@@ -60347,6 +60499,15 @@ var init_loss_of_precision = __esm({
         const num = Number(text4);
         if (!Number.isFinite(num))
           return null;
+        const parent = node2.parent;
+        if (parent?.type === "arguments") {
+          const call = parent.parent;
+          if (call?.type === "call_expression") {
+            const fn = call.childForFieldName("function");
+            if (fn?.type === "identifier" && fn.text === "BigInt")
+              return null;
+          }
+        }
         if (!Number.isSafeInteger(num)) {
           return makeViolation(this.ruleKey, node2, filePath, "high", "Loss of precision", `\`${text4}\` exceeds Number.MAX_SAFE_INTEGER and will lose precision at runtime.`, sourceCode, `Use BigInt (\`${text4}n\`) or restructure to avoid large integer literals.`);
         }
@@ -62618,6 +62779,17 @@ var init_useless_increment = __esm({
 });
 
 // packages/analyzer/dist/rules/bugs/visitors/javascript/ignored-return-value.js
+function receiverBaseName(obj) {
+  if (!obj)
+    return null;
+  if (obj.type === "identifier")
+    return obj.text.toLowerCase();
+  if (obj.type === "member_expression") {
+    const prop = obj.childForFieldName("property");
+    return prop ? prop.text.toLowerCase() : null;
+  }
+  return null;
+}
 var ignoredReturnValueVisitor;
 var init_ignored_return_value = __esm({
   "packages/analyzer/dist/rules/bugs/visitors/javascript/ignored-return-value.js"() {
@@ -62638,6 +62810,11 @@ var init_ignored_return_value = __esm({
         const prop = fn.childForFieldName("property");
         if (!prop || !PURE_ARRAY_METHODS.has(prop.text))
           return null;
+        if (prop.text === "join") {
+          const base2 = receiverBaseName(fn.childForFieldName("object"));
+          if (base2 && SOCKET_IO_RECEIVERS.has(base2))
+            return null;
+        }
         return makeViolation(this.ruleKey, expr, filePath, "high", "Ignored return value", `The return value of \`.${prop.text}()\` is ignored \u2014 this method does not mutate the array in place; the result must be used.`, sourceCode, `Assign the result: \`const result = arr.${prop.text}(...)\`.`);
       }
     };
@@ -63299,7 +63476,12 @@ var init_global_this_usage = __esm({
         let current = node2.parent;
         while (current) {
           const t2 = current.type;
-          if (t2 === "function_declaration" || t2 === "function" || t2 === "method_definition" || t2 === "class_declaration" || t2 === "class") {
+          if (t2 === "function_declaration" || t2 === "function" || // Modern tree-sitter-javascript names a `function () {}` expression
+          // `function_expression` (only the legacy grammar used bare `function`).
+          // Without it, `this` inside any function-expression callback / IIFE /
+          // prototype-assigned method walks up to program scope and is wrongly
+          // reported as a global reference.
+          t2 === "function_expression" || t2 === "generator_function" || t2 === "generator_function_declaration" || t2 === "method_definition" || t2 === "class_declaration" || t2 === "class") {
             return null;
           }
           if (t2 === "arrow_function") {
@@ -65965,6 +66147,9 @@ var init_missing_await = __esm({
           return null;
         if (!isInsideAsyncFunction(node2))
           return null;
+        const declaredName = node2.childForFieldName("name");
+        if (declaredName?.type === "identifier" && /Promise$/.test(declaredName.text))
+          return null;
         const isPromise = typeQuery.isPromiseLike(filePath, value.startPosition.row, value.startPosition.column, value.endPosition.row, value.endPosition.column);
         if (!isPromise)
           return null;
@@ -66541,25 +66726,26 @@ var init_unbound_method = __esm({
         let classBody = node2.parent;
         while (classBody && classBody.type !== "class_body")
           classBody = classBody.parent;
-        if (classBody) {
-          for (const member of classBody.namedChildren) {
-            if (member.type === "public_field_definition" || member.type === "field_definition") {
-              const nameNode = member.children.find((c2) => c2.type === "property_identifier" || c2.type === "private_property_identifier");
-              if (nameNode?.text !== methodName3)
-                continue;
-              const value = member.childForFieldName("value");
-              if (value?.type === "arrow_function" || value?.type === "function_expression")
-                return null;
-              if (value)
-                return null;
-              const typeAnnot = member.namedChildren.find((c2) => c2.type === "type_annotation");
-              const typeChild = typeAnnot?.namedChildren[0];
-              if (typeChild && typeChild.type !== "function_type" && typeChild.type !== "constructor_type") {
-                return null;
-              }
-            }
+        if (!classBody)
+          return null;
+        let resolvesToMethod = false;
+        for (const member of classBody.namedChildren) {
+          if (member.type === "method_definition") {
+            const nameNode = member.childForFieldName("name");
+            if (nameNode?.text !== methodName3)
+              continue;
+            const isAccessor = member.children.some((c2) => (c2.text === "get" || c2.text === "set") && c2.type !== "property_identifier");
+            resolvesToMethod = !isAccessor;
+            break;
+          }
+          if (member.type === "public_field_definition" || member.type === "field_definition") {
+            const nameNode = member.children.find((c2) => c2.type === "property_identifier" || c2.type === "private_property_identifier");
+            if (nameNode?.text === methodName3)
+              return null;
           }
         }
+        if (!resolvesToMethod)
+          return null;
         return makeViolation(this.ruleKey, node2, filePath, "high", "Unbound method reference", `\`this.${methodName3}\` is used as a value without binding \u2014 \`this\` will be lost when called as a callback.`, sourceCode, "Use `this.method.bind(this)`, an arrow wrapper `() => this.method()`, or declare as an arrow function property.");
       }
     };
@@ -66662,7 +66848,7 @@ var init_missing_error_boundary = __esm({
       visit(node2, filePath, sourceCode) {
         if (!sourceCode.includes("React") && !sourceCode.includes("react") && !sourceCode.includes("jsx"))
           return null;
-        const hasAsyncData = /(?<![.\w])useQuery\b/.test(sourceCode) || /(?<![.\w])useSWR\b/.test(sourceCode) || /\buseSuspenseQuery\b/.test(sourceCode) || /\buseSuspenseInfiniteQuery\b/.test(sourceCode) || /\bSuspense\b/.test(sourceCode);
+        const hasAsyncData = /(?<![.\w])useQuery\b/.test(sourceCode) || /(?<![.\w])useSWR\b/.test(sourceCode) || /\buseSuspenseQuery\b/.test(sourceCode) || /\buseSuspenseInfiniteQuery\b/.test(sourceCode);
         if (!hasAsyncData)
           return null;
         if (/\bErrorBoundary\b/.test(sourceCode))
@@ -79487,6 +79673,9 @@ var init_star_import = __esm({
           if (sourceText === "zod" || sourceText.startsWith("@react-email/") || sourceText.startsWith("fumadocs-ui/") || sourceText.startsWith("fumadocs-core/")) {
             return null;
           }
+          if (sourceText === "semver" || sourceText.startsWith("@sentry/")) {
+            return null;
+          }
           if (sourceText.startsWith("./") || sourceText.startsWith("../"))
             return null;
           const nsImport = node2.namedChildren.find((c2) => c2.type === "import_clause")?.namedChildren.find((cc) => cc.type === "namespace_import");
@@ -81055,14 +81244,20 @@ var init_expression_complexity = __esm({
         if (!expr)
           return null;
         let target = expr;
-        while (target.type === "parenthesized_expression" && target.namedChildren[0]) {
+        while ((target.type === "parenthesized_expression" || target.type === "as_expression" || target.type === "satisfies_expression" || target.type === "non_null_expression") && target.namedChildren[0]) {
           target = target.namedChildren[0];
         }
+        if (target.type === "object" || target.type === "array")
+          return null;
         if (target.type === "arrow_function" || target.type === "function_expression" || target.type === "function_declaration" || target.type === "generator_function" || target.type === "generator_function_declaration")
           return null;
         if (target.type === "jsx_element" || target.type === "jsx_fragment" || target.type === "jsx_self_closing_element")
           return null;
         let operatorCount = 0;
+        let hasLogical = false;
+        let hasArithmetic = false;
+        const LOGICAL_OPS = /* @__PURE__ */ new Set(["&&", "||", "??"]);
+        const ARITHMETIC_OPS3 = /* @__PURE__ */ new Set(["+", "-", "*", "/", "%", "**", "&", "|", "^", "<<", ">>", ">>>"]);
         const BINARY_TYPES = /* @__PURE__ */ new Set(["binary_expression", "logical_expression"]);
         const FUNCTION_BOUNDARY_TYPES3 = /* @__PURE__ */ new Set([
           "function_declaration",
@@ -81075,6 +81270,13 @@ var init_expression_complexity = __esm({
         function countOps(n) {
           if (BINARY_TYPES.has(n.type)) {
             operatorCount++;
+            const op = n.childForFieldName("operator")?.text;
+            if (op) {
+              if (LOGICAL_OPS.has(op))
+                hasLogical = true;
+              else if (ARITHMETIC_OPS3.has(op))
+                hasArithmetic = true;
+            }
           }
           for (let i = 0; i < n.childCount; i++) {
             const child = n.child(i);
@@ -81087,6 +81289,8 @@ var init_expression_complexity = __esm({
         }
         countOps(expr);
         if (operatorCount > 5) {
+          if (hasLogical && !hasArithmetic)
+            return null;
           return makeViolation(this.ruleKey, node2, filePath, "medium", "Complex expression", `Expression has ${operatorCount} binary/logical operators (max 5). Break it into named variables for readability.`, sourceCode, "Split the expression into smaller, named intermediate variables.");
         }
         return null;
@@ -81911,12 +82115,73 @@ var init_strict_equality = __esm({
   }
 });
 
-// packages/analyzer/dist/rules/code-quality/visitors/javascript/commented-out-code.js
-var commentedOutCodeVisitor;
+// packages/analyzer/dist/rules/code-quality/visitors/_shared/commented-out-code.js
+function stripLineMarker(line) {
+  return line.replace(/^\s*(?:\/\/+|#+)\s?/, "").replace(/^\s*\*\/?\s?/, "").replace(/\*\/\s*$/, "").trim();
+}
+function looksLikeProse(line) {
+  const words = line.match(/[A-Za-z][A-Za-z'-]+/g) ?? [];
+  const codePunct = (line.match(/[;{}()=<>[\]]/g) ?? []).length;
+  return words.length >= 4 && codePunct <= 1;
+}
+function looksLikeCode(line, opts) {
+  if (/[;{}]\s*$/.test(line))
+    return true;
+  if (opts.colonTerminates && /:\s*$/.test(line))
+    return true;
+  if (/=>/.test(line))
+    return true;
+  if (/^[\w.]+\s*\([^)]*\)\s*;?\s*$/.test(line))
+    return true;
+  if (/^[\w.[\]]+\s*=\s*[^=].*$/.test(line) && !/==/.test(line))
+    return true;
+  return false;
+}
+function isCommentedOutCode(inner, opts) {
+  let code = 0;
+  let prose = 0;
+  for (const raw of inner.split("\n")) {
+    const line = stripLineMarker(raw);
+    if (line.length === 0)
+      continue;
+    if (looksLikeProse(line))
+      prose++;
+    else if (looksLikeCode(line, opts))
+      code++;
+  }
+  return code > 0 && code >= prose;
+}
+function lineCommentRunInner(node2, opts) {
+  const isRunLine = (n) => n != null && n.type === "comment" && opts.isLineComment(n.text);
+  if (!isRunLine(node2))
+    return null;
+  const prev = node2.previousSibling;
+  if (isRunLine(prev) && prev.startPosition.row === node2.startPosition.row - 1)
+    return null;
+  const lines = [opts.strip(node2.text)];
+  let cur = node2.nextSibling;
+  let lastRow = node2.startPosition.row;
+  while (isRunLine(cur) && cur.startPosition.row === lastRow + 1) {
+    lines.push(opts.strip(cur.text));
+    lastRow = cur.startPosition.row;
+    cur = cur.nextSibling;
+  }
+  return lines.join("\n");
+}
 var init_commented_out_code = __esm({
+  "packages/analyzer/dist/rules/code-quality/visitors/_shared/commented-out-code.js"() {
+    "use strict";
+  }
+});
+
+// packages/analyzer/dist/rules/code-quality/visitors/javascript/commented-out-code.js
+var isLineComment, commentedOutCodeVisitor;
+var init_commented_out_code2 = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/javascript/commented-out-code.js"() {
     "use strict";
     init_types2();
+    init_commented_out_code();
+    isLineComment = (t2) => t2.startsWith("//");
     commentedOutCodeVisitor = {
       ruleKey: "code-quality/deterministic/commented-out-code",
       languages: ["typescript", "tsx", "javascript"],
@@ -81925,21 +82190,19 @@ var init_commented_out_code = __esm({
         const text4 = node2.text;
         if (text4.startsWith("/**"))
           return null;
-        let inner = text4;
-        if (inner.startsWith("//"))
-          inner = inner.slice(2).trim();
-        else if (inner.startsWith("/*"))
-          inner = inner.slice(2, -2).trim();
-        if (inner.length < 10)
-          return null;
-        const codePatterns = [
-          /^\s*(const|let|var|function|return|if|for|while|import|export|class|throw|try|catch)\s/,
-          /[;{}]\s*$/,
-          /=>/,
-          /\w+\(.*\)\s*[;{]?\s*$/
-        ];
-        const matchCount = codePatterns.filter((p2) => p2.test(inner)).length;
-        if (matchCount >= 2) {
+        let inner;
+        if (isLineComment(text4)) {
+          inner = lineCommentRunInner(node2, { isLineComment, strip: (t2) => t2.replace(/^\/\/+/, "") });
+          if (inner === null)
+            return null;
+        } else if (text4.startsWith("/*")) {
+          inner = text4.slice(2, -2);
+        } else {
+          return null;
+        }
+        if (inner.trim().length < 10)
+          return null;
+        if (isCommentedOutCode(inner, {})) {
           return makeViolation(this.ruleKey, node2, filePath, "low", "Commented-out code", "This comment appears to contain commented-out code. Remove it or track it in version control.", sourceCode, "Delete the commented-out code. If needed, it can be recovered from version control.");
         }
         return null;
@@ -82720,6 +82983,11 @@ var init_for_in_without_filter = __esm({
                 return true;
             }
           }
+          if (n.type === "member_expression") {
+            const prop = n.childForFieldName("property");
+            if (prop?.text === "hasOwnProperty" || prop?.text === "hasOwn")
+              return true;
+          }
           if (n.type === "string" && (n.text.includes("hasOwnProperty") || n.text.includes("hasOwn")))
             return true;
           for (let i = 0; i < n.childCount; i++) {
@@ -84087,6 +84355,10 @@ var init_selector_parameter = __esm({
       languages: ["typescript", "tsx", "javascript"],
       nodeTypes: JS_FUNCTION_TYPES,
       visit(node2, filePath, sourceCode) {
+        const fnParent = node2.parent;
+        if ((node2.type === "arrow_function" || node2.type === "function_expression") && (fnParent?.type === "arguments" || fnParent?.type === "jsx_expression")) {
+          return null;
+        }
         const params = node2.childForFieldName("parameters");
         if (!params)
           return null;
@@ -86169,6 +86441,15 @@ var init_meaningless_void_operator = __esm({
 });
 
 // packages/analyzer/dist/rules/code-quality/visitors/javascript/test-with-hardcoded-timeout.js
+function isTestFile(filePath) {
+  const norm = filePath.replace(/\\/g, "/");
+  const base2 = norm.slice(norm.lastIndexOf("/") + 1);
+  if (/\.(test|spec)\.[cm]?[jt]sx?$/i.test(base2))
+    return true;
+  if (/(^|\/)__tests?__\//.test(norm))
+    return true;
+  return false;
+}
 var testWithHardcodedTimeoutVisitor;
 var init_test_with_hardcoded_timeout = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/javascript/test-with-hardcoded-timeout.js"() {
@@ -86179,7 +86460,7 @@ var init_test_with_hardcoded_timeout = __esm({
       languages: ["typescript", "tsx", "javascript"],
       nodeTypes: ["call_expression"],
       visit(node2, filePath, sourceCode) {
-        if (!filePath.includes("test") && !filePath.includes("spec") && !filePath.includes(".test.") && !filePath.includes(".spec."))
+        if (!isTestFile(filePath))
           return null;
         const fn = node2.childForFieldName("function");
         if (!fn)
@@ -87539,8 +87820,8 @@ var init_test_empty_file = __esm({
       nodeTypes: ["program"],
       visit(node2, filePath, sourceCode) {
         const lowerPath = filePath.toLowerCase();
-        const isTestFile5 = lowerPath.includes(".test.") || lowerPath.includes(".spec.") || lowerPath.includes("__tests__");
-        if (!isTestFile5)
+        const isTestFile6 = lowerPath.includes(".test.") || lowerPath.includes(".spec.") || lowerPath.includes("__tests__");
+        if (!isTestFile6)
           return null;
         if (hasTestFunction(node2))
           return null;
@@ -91246,7 +91527,7 @@ var init_javascript5 = __esm({
     init_useless_computed_key();
     init_useless_concat();
     init_strict_equality();
-    init_commented_out_code();
+    init_commented_out_code2();
     init_inverted_boolean();
     init_prefer_single_boolean_return();
     init_prefer_immediate_return();
@@ -92413,30 +92694,27 @@ var init_unused_variable2 = __esm({
 });
 
 // packages/analyzer/dist/rules/code-quality/visitors/python/commented-out-code.js
-var pythonCommentedOutCodeVisitor;
-var init_commented_out_code2 = __esm({
+var isLineComment2, pythonCommentedOutCodeVisitor;
+var init_commented_out_code3 = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/python/commented-out-code.js"() {
     "use strict";
     init_types2();
+    init_commented_out_code();
+    isLineComment2 = (t2) => t2.startsWith("#");
     pythonCommentedOutCodeVisitor = {
       ruleKey: "code-quality/deterministic/commented-out-code",
       languages: ["python"],
       nodeTypes: ["comment"],
       visit(node2, filePath, sourceCode) {
         const text4 = node2.text;
-        if (!text4.startsWith("#"))
+        if (!isLineComment2(text4))
           return null;
-        const inner = text4.slice(1).trim();
-        if (inner.length < 10)
+        const inner = lineCommentRunInner(node2, { isLineComment: isLineComment2, strip: (t2) => t2.replace(/^#+/, "") });
+        if (inner === null)
           return null;
-        const codePatterns = [
-          /\b(def|class|import|from|return|if|for|while|try|except|with|raise|print)\b/,
-          /[;:]\s*$/,
-          /\w+\(.*\)/,
-          /=\s*\w/
-        ];
-        const matchCount = codePatterns.filter((p2) => p2.test(inner)).length;
-        if (matchCount >= 2) {
+        if (inner.trim().length < 10)
+          return null;
+        if (isCommentedOutCode(inner, { colonTerminates: true })) {
           return makeViolation(this.ruleKey, node2, filePath, "low", "Commented-out code", "This comment appears to contain commented-out code. Remove it or track it in version control.", sourceCode, "Delete the commented-out code. If needed, it can be recovered from version control.");
         }
         return null;
@@ -101429,8 +101707,8 @@ var init_test_not_discoverable = __esm({
           return null;
         const className = classNameNode.text;
         const isTestClass = className.startsWith("Test") || className.endsWith("Test") || className.endsWith("Tests");
-        const isTestFile5 = isPythonTestFile(filePath);
-        if (!isTestClass && !isTestFile5)
+        const isTestFile6 = isPythonTestFile(filePath);
+        if (!isTestClass && !isTestFile6)
           return null;
         const body = node2.childForFieldName("body");
         if (!body)
@@ -103199,7 +103477,7 @@ var init_python7 = __esm({
     init_no_debugger2();
     init_require_await2();
     init_unused_variable2();
-    init_commented_out_code2();
+    init_commented_out_code3();
     init_abstract_class_without_abstract_method();
     init_and_or_ternary();
     init_assert_in_production();
@@ -105147,7 +105425,12 @@ var init_result = __esm({
       durationMs: external_exports.number().nonnegative(),
       /** Present on `fail` / `error`. */
       failure: GuardFailureDetailSchema.optional(),
-      /** Repo-relative pointer into `evidence/`; present on `fail` / `error`. */
+      /**
+       * Repo-relative pointer into `evidence/`; present on every EXECUTED outcome —
+       * `pass` (the run transcript proving what ran) as well as `fail` / `error`.
+       * Absent on non-executed `stale` / `orphaned`, and on pre-2026-07-08 runs whose
+       * passes were never given a bundle (optional keeps those parsing + rendering).
+       */
       evidencePath: external_exports.string().optional(),
       /**
        * Present when the bound section moved: the section kept its text but now
@@ -105725,7 +106008,18 @@ function withLanguageSupport(rules, visitors) {
         continue;
       }
       if (rule.engine === "roslyn-host" || rule.engine === "roslyn-workspace") {
-        support[language] = language === "csharp" ? { status: "supported" } : { status: "not-applicable", reason: "C# semantic rule (Roslyn host); no equivalent in this language" };
+        if (language === "csharp") {
+          support[language] = { status: "supported" };
+          continue;
+        }
+        const hasExplicitForLang = explicitFamilies.get(rule.key)?.has(language) ?? false;
+        const universalExcludesLang2 = universalExcludedFamilies.get(rule.key)?.has(language) ?? false;
+        const hasUniversalForLang = universalRuleKeys.has(rule.key) && UNIVERSAL_VISITOR_FAMILIES.includes(language) && !universalExcludesLang2;
+        if (hasExplicitForLang || hasUniversalForLang) {
+          support[language] = { status: "supported" };
+          continue;
+        }
+        support[language] = { status: "not-applicable", reason: "C# semantic rule (Roslyn host); no equivalent in this language" };
         continue;
       }
       const hasExplicit = explicitFamilies.get(rule.key)?.has(language) ?? false;
@@ -114484,6 +114778,12 @@ function walkCSharp(node2, visit) {
       walkCSharp(child, visit);
   }
 }
+function isCSharpTestPath(filePath) {
+  return filePath.split(/[\\/]/).some((segment) => {
+    const s = segment.toLowerCase();
+    return /\.tests?$/.test(s) || s.endsWith(".testbase") || s.endsWith("testapp");
+  });
+}
 var FUNCTION_BOUNDARY_TYPES;
 var init_csharp_helpers = __esm({
   "packages/analyzer/dist/rules/_shared/csharp-helpers.js"() {
@@ -115898,7 +116198,7 @@ function isTypeConstantAccess(node2) {
   const receiver = lastSegment(node2.childForFieldName("expression")?.text ?? "");
   return /^[A-Z]/.test(receiver);
 }
-function leafName(node2) {
+function leafName2(node2) {
   if (node2.type === "identifier")
     return node2.text;
   if (node2.type === "member_access_expression")
@@ -115934,8 +116234,8 @@ var init_timing_attack_comparison2 = __esm({
           return null;
         if (isTypeConstantAccess(left) || isTypeConstantAccess(right))
           return null;
-        const leftLeaf = leafName(left);
-        const rightLeaf = leafName(right);
+        const leftLeaf = leafName2(left);
+        const rightLeaf = leafName2(right);
         if (leftLeaf === "Length" || rightLeaf === "Length")
           return null;
         if (ENUM_CONSTANT_PATTERN2.test(leftLeaf) || ENUM_CONSTANT_PATTERN2.test(rightLeaf))
@@ -115954,7 +116254,7 @@ var init_timing_attack_comparison2 = __esm({
 });
 
 // packages/analyzer/dist/rules/security/visitors/csharp/insecure-random.js
-function isTestFile(filePath) {
+function isTestFile2(filePath) {
   const fileName = filePath.replace(/^.*[\\/]/, "");
   return /Tests?\.cs$/i.test(fileName) || /(?:TestSetup|TestFixture|Fixtures?|FunctionalTests|IntegrationTests|UnitTests|TestHelpers?)/.test(fileName);
 }
@@ -115996,7 +116296,7 @@ var init_insecure_random3 = __esm({
       languages: ["csharp"],
       nodeTypes: ["object_creation_expression", "member_access_expression"],
       visit(node2, filePath, sourceCode) {
-        if (isTestFile(filePath))
+        if (isTestFile2(filePath))
           return null;
         if (node2.type === "object_creation_expression") {
           if (getCreatedTypeName(node2) !== "Random")
@@ -118467,11 +118767,14 @@ var init_empty_catch3 = __esm({
               const stmt = tryStatements[0];
               if (/\b(Parse|TryParse|Deserialize)\s*[<(]/.test(stmt.text))
                 return null;
-              const expr = stmt.namedChildren[0];
-              if (expr?.type === "invocation_expression" && BEST_EFFORT_METHODS.has(getCSharpMethodName(expr))) {
+              let expr = stmt.namedChildren[0];
+              if (expr?.type === "await_expression")
+                expr = expr.namedChildren[0];
+              const isBestEffort = (name) => BEST_EFFORT_METHODS.has(name.replace(/Async$/, ""));
+              if (expr?.type === "invocation_expression" && isBestEffort(getCSharpMethodName(expr))) {
                 return null;
               }
-              if (expr?.type === "conditional_access_expression" && BEST_EFFORT_METHODS.has((expr.text.match(/\.(\w+)\s*\([^()]*\)\s*$/) ?? [])[1] ?? "")) {
+              if (expr?.type === "conditional_access_expression" && isBestEffort((expr.text.match(/\.(\w+)\s*\([^()]*\)\s*$/) ?? [])[1] ?? "")) {
                 return null;
               }
             }
@@ -118535,6 +118838,8 @@ var init_self_assignment3 = __esm({
       languages: ["csharp"],
       nodeTypes: ["assignment_expression"],
       visit(node2, filePath, sourceCode) {
+        if (node2.parent?.type === "initializer_expression")
+          return null;
         const left = node2.childForFieldName("left");
         const right = node2.childForFieldName("right");
         const operator = node2.childForFieldName("operator");
@@ -119542,7 +119847,7 @@ var init_infinite_recursion2 = __esm({
           return null;
         if (node2.type === "property_declaration") {
           const arrow = node2.childForFieldName("value");
-          const arrowExpr = arrow?.namedChildren[0];
+          const arrowExpr = arrow?.type === "arrow_expression_clause" ? arrow.namedChildren[0] : null;
           if (arrowExpr?.type === "identifier" && arrowExpr.text === name) {
             return makeViolation(this.ruleKey, node2, filePath, "critical", "Infinite recursion", `Property \`${name}\` returns itself \u2014 reading it recurses until StackOverflowException.`, sourceCode, "Return the backing field (or use an auto-property) instead of the property itself.");
           }
@@ -121607,8 +121912,11 @@ var init_useless_finally2 = __esm({
 });
 
 // packages/analyzer/dist/rules/bugs/visitors/csharp/fstring-missing-placeholders.js
-function hasInterpolation(node2) {
-  return node2.namedChildren.some((c2) => c2?.type === "interpolation");
+function hasRealHole(node2) {
+  if (node2.namedChildren.some((c2) => c2?.type === "interpolation"))
+    return true;
+  const stripped = node2.text.replace(/\{\{/g, "").replace(/\}\}/g, "");
+  return stripped.includes("{");
 }
 var csharpFstringMissingPlaceholdersVisitor;
 var init_fstring_missing_placeholders2 = __esm({
@@ -121620,7 +121928,7 @@ var init_fstring_missing_placeholders2 = __esm({
       languages: ["csharp"],
       nodeTypes: ["interpolated_string_expression"],
       visit(node2, filePath, sourceCode) {
-        if (hasInterpolation(node2))
+        if (hasRealHole(node2))
           return null;
         let top = node2;
         while (top.parent?.type === "binary_expression" && top.parent.childForFieldName("operator")?.text === "+") {
@@ -121631,7 +121939,7 @@ var init_fstring_missing_placeholders2 = __esm({
           const walk20 = (n) => {
             if (siblingHasHoles)
               return;
-            if (n.type === "interpolated_string_expression" && n.id !== node2.id && hasInterpolation(n)) {
+            if (n.type === "interpolated_string_expression" && n.id !== node2.id && hasRealHole(n)) {
               siblingHasHoles = true;
               return;
             }
@@ -123111,6 +123419,32 @@ var init_chained_orderby_loses_ordering = __esm({
 });
 
 // packages/analyzer/dist/rules/bugs/visitors/csharp/check-against-value-being-assigned.js
+function enclosingTypeDecl(node2) {
+  let p2 = node2.parent;
+  while (p2) {
+    if (p2.type === "class_declaration" || p2.type === "struct_declaration" || p2.type === "record_declaration") {
+      return p2;
+    }
+    p2 = p2.parent;
+  }
+  return null;
+}
+function selfMemberName(target) {
+  if (target.type === "identifier")
+    return target.text;
+  if (target.type === "member_access_expression") {
+    const obj = target.childForFieldName("expression");
+    if (obj?.type === "this")
+      return target.childForFieldName("name")?.text ?? null;
+  }
+  return null;
+}
+function enclosingTypeHasProperty(typeDecl, name) {
+  const body = typeDecl.childForFieldName("body") ?? typeDecl.namedChildren.find((c2) => c2?.type === "declaration_list");
+  if (!body)
+    return false;
+  return body.namedChildren.some((m) => m?.type === "property_declaration" && m.childForFieldName("name")?.text === name);
+}
 function singleStatement(consequence) {
   if (consequence.type === "block") {
     const stmts = consequence.namedChildren.filter((c2) => c2?.type !== "comment");
@@ -123158,6 +123492,12 @@ var init_check_against_value_being_assigned = __esm({
         const sameBA = condLeft.text === value.text && condRight.text === target.text;
         if (!sameAB && !sameBA)
           return null;
+        const selfName = selfMemberName(target);
+        if (selfName) {
+          const typeDecl = enclosingTypeDecl(node2);
+          if (typeDecl && enclosingTypeHasProperty(typeDecl, selfName))
+            return null;
+        }
         return makeViolation(this.ruleKey, node2, filePath, "low", "Redundant check against the value being assigned", `\`if (${condition.text}) ${assign.text};\` guards a plain assignment with a check against the same value \u2014 assigning unconditionally has the identical effect.`, sourceCode, "Remove the guard and assign unconditionally, or fix the condition if a different check was intended.");
       }
     };
@@ -123647,7 +123987,8 @@ var init_redundant_base_call = __esm({
         const receiver = node2.childForFieldName("expression");
         if (receiver?.type !== "base" && receiver?.text !== "base")
           return null;
-        const memberName3 = node2.childForFieldName("name")?.text;
+        const nameNode = node2.childForFieldName("name");
+        const memberName3 = nameNode?.type === "generic_name" ? nameNode.namedChildren.find((c2) => c2?.type === "identifier")?.text : nameNode?.text;
         if (!memberName3)
           return null;
         const typeDecl = enclosingType(node2);
@@ -123982,6 +124323,19 @@ function baseEntryName(entry) {
   }
   return null;
 }
+function baseEntryArity(entry) {
+  const generic = entry.type === "generic_name" ? entry : entry.type === "qualified_name" ? entry.childForFieldName("name") : null;
+  if (generic?.type !== "generic_name")
+    return 0;
+  const args = generic.namedChildren.find((c2) => c2?.type === "type_argument_list");
+  return args ? args.namedChildren.filter((c2) => c2 != null).length : 0;
+}
+function declaredArity(node2) {
+  const params = node2.childForFieldName("type_parameters");
+  if (!params)
+    return 0;
+  return params.namedChildren.filter((c2) => c2?.type === "type_parameter").length;
+}
 var csharpRecursiveTypeInheritanceVisitor;
 var init_recursive_type_inheritance = __esm({
   "packages/analyzer/dist/rules/bugs/visitors/csharp/recursive-type-inheritance.js"() {
@@ -124003,6 +124357,8 @@ var init_recursive_type_inheritance = __esm({
           return null;
         if (baseEntryName(firstBase) !== typeName2)
           return null;
+        if (baseEntryArity(firstBase) !== declaredArity(node2))
+          return null;
         return makeViolation(this.ruleKey, firstBase, filePath, "high", "Recursive type inheritance", `\`${typeName2}\` lists itself as its own base type, producing a nonsensical recursive inheritance chain.`, sourceCode, "Remove the self reference from the base list.");
       }
     };
@@ -126230,6 +126586,20 @@ function isCSharpGeneratedSource(filePath, sourceCode) {
     return true;
   return sourceCode.slice(0, 600).includes("<auto-generated");
 }
+function isCSharpEfMigration(node2) {
+  const cls = getCSharpEnclosingClass(node2);
+  if (!cls)
+    return false;
+  const baseList = cls.namedChildren.find((c2) => c2?.type === "base_list");
+  if (!baseList)
+    return false;
+  return baseList.namedChildren.some((base2) => {
+    if (!base2)
+      return false;
+    const simple = base2.text.split(".").pop() ?? base2.text;
+    return simple === "Migration";
+  });
+}
 function isCSharpPrivateMember(node2) {
   const accessibility = [];
   for (const child of node2.children) {
@@ -128793,17 +129163,13 @@ var init_collapsible_if3 = __esm({
 });
 
 // packages/analyzer/dist/rules/code-quality/visitors/csharp/commented-out-code.js
-var CODE_PATTERNS, csharpCommentedOutCodeVisitor;
-var init_commented_out_code3 = __esm({
+var isLineComment3, csharpCommentedOutCodeVisitor;
+var init_commented_out_code4 = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/csharp/commented-out-code.js"() {
     "use strict";
     init_types2();
-    CODE_PATTERNS = [
-      /^\s*(var|int|string|bool|double|decimal|long|float|return|if|for|foreach|while|using|throw|try|catch|switch|await|new|public|private|protected|internal|static)\s/,
-      /[;{}]\s*$/,
-      /=>/,
-      /\w+\(.*\)\s*[;{]?\s*$/
-    ];
+    init_commented_out_code();
+    isLineComment3 = (t2) => t2.startsWith("//") && !t2.startsWith("///");
     csharpCommentedOutCodeVisitor = {
       ruleKey: "code-quality/deterministic/commented-out-code",
       languages: ["csharp"],
@@ -128812,15 +129178,19 @@ var init_commented_out_code3 = __esm({
         const text4 = node2.text;
         if (text4.startsWith("///") || text4.startsWith("/**"))
           return null;
-        let inner = text4;
-        if (inner.startsWith("//"))
-          inner = inner.slice(2).trim();
-        else if (inner.startsWith("/*"))
-          inner = inner.slice(2, -2).trim();
-        if (inner.length < 10)
+        let inner;
+        if (isLineComment3(text4)) {
+          inner = lineCommentRunInner(node2, { isLineComment: isLineComment3, strip: (t2) => t2.replace(/^\/\/+/, "") });
+          if (inner === null)
+            return null;
+        } else if (text4.startsWith("/*")) {
+          inner = text4.slice(2, -2);
+        } else {
           return null;
-        const matchCount = CODE_PATTERNS.filter((p2) => p2.test(inner)).length;
-        if (matchCount >= 2) {
+        }
+        if (inner.trim().length < 10)
+          return null;
+        if (isCommentedOutCode(inner, {})) {
           return makeViolation(this.ruleKey, node2, filePath, "low", "Commented-out code", "This comment appears to contain commented-out code. Remove it or track it in version control.", sourceCode, "Delete the commented-out code. If needed, it can be recovered from version control.");
         }
         return null;
@@ -129528,6 +129898,13 @@ function csharpEmptyBodyIsIntentional(node2, body) {
   }
   if (isCSharpNoOpCallbackPosition(node2))
     return true;
+  let enclosingType3 = node2.parent;
+  while (enclosingType3 && enclosingType3.type !== "class_declaration" && enclosingType3.type !== "struct_declaration" && enclosingType3.type !== "record_declaration" && enclosingType3.type !== "record_struct_declaration") {
+    enclosingType3 = enclosingType3.parent;
+  }
+  const typeName2 = enclosingType3?.childForFieldName("name")?.text;
+  if (typeName2 && /^(Null|Noop|NoOp|Empty)[A-Z0-9]/.test(typeName2))
+    return true;
   if (node2.type === "method_declaration") {
     if (hasCSharpModifier(node2, "virtual") || hasCSharpModifier(node2, "override") || hasCSharpModifier(node2, "partial"))
       return true;
@@ -129805,6 +130182,7 @@ var init_hardcoded_url2 = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/csharp/hardcoded-url.js"() {
     "use strict";
     init_types2();
+    init_csharp_helpers();
     NAMESPACE_URI_HOSTS = /w3\.org|schema\.org|xmlns|openxmlformats|xmlsoap|purl\.org|tempuri\.org|schemas\.microsoft\.com|tools\.ietf\.org|datatracker\.ietf\.org|rfc-editor\.org/;
     STABLE_API_HOSTS = /googleapis\.com|maps\.google|api\.stripe\.com|api\.twilio\.com|api\.sendgrid\.com|api\.github\.com|cdn\.|fonts\.googleapis|cloudflare|unpkg\.com|cdnjs\.cloudflare|jsdelivr\.net|nuget\.org/;
     PLACEHOLDER_NAME = /default|placeholder|example|sample|template|fallback|demo|test|mock|stub|dummy/;
@@ -129816,6 +130194,8 @@ var init_hardcoded_url2 = __esm({
         const text4 = node2.text;
         if (!/https?:\/\/[a-zA-Z0-9]/.test(text4))
           return null;
+        if (isCSharpTestPath(filePath))
+          return null;
         if (text4.includes("example.com") || text4.includes("localhost") || text4.includes("127.0.0.1") || text4.includes("placeholder"))
           return null;
         if (NAMESPACE_URI_HOSTS.test(text4))
@@ -129836,6 +130216,42 @@ var init_hardcoded_url2 = __esm({
 });
 
 // packages/analyzer/dist/rules/code-quality/visitors/csharp/identical-functions.js
+function isTrivialExpr(e) {
+  switch (e.type) {
+    case "integer_literal":
+    case "real_literal":
+    case "boolean_literal":
+    case "string_literal":
+    case "verbatim_string_literal":
+    case "null_literal":
+    case "character_literal":
+    case "identifier":
+    case "this_expression":
+    case "default_expression":
+    case "member_access_expression":
+      return true;
+    case "invocation_expression": {
+      const args = e.childForFieldName("arguments");
+      if (!args)
+        return true;
+      return args.namedChildren.every((a) => {
+        if (a?.type !== "argument")
+          return true;
+        const value = a.namedChildren.find((c2) => c2 && c2.type !== "name_colon");
+        return !value || isTrivialExpr(value);
+      });
+    }
+    default:
+      return false;
+  }
+}
+function isTrivialReturnBody(body) {
+  const stmts = body.namedChildren.filter((c2) => c2 && c2.type !== "comment");
+  if (stmts.length !== 1 || stmts[0]?.type !== "return_statement")
+    return false;
+  const expr = stmts[0].namedChildren.find((c2) => c2 && c2.type !== "comment");
+  return !expr || isTrivialExpr(expr);
+}
 var COMPARED_TYPES, csharpIdenticalFunctionsVisitor;
 var init_identical_functions2 = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/csharp/identical-functions.js"() {
@@ -129854,7 +130270,7 @@ var init_identical_functions2 = __esm({
             const body = n.childForFieldName("body");
             if (body && body.type === "block" && body.namedChildCount > 0) {
               const onlyThrow = body.namedChildCount === 1 && body.namedChildren[0]?.type === "throw_statement";
-              if (!onlyThrow) {
+              if (!onlyThrow && !isTrivialReturnBody(body)) {
                 const normalized = body.text.replace(/\s+/g, " ").trim();
                 bodies.push({ body: normalized, fnNode: n });
               }
@@ -130044,6 +130460,8 @@ var init_magic_number2 = __esm({
           return null;
         if (parentType === "argument" && parent.parent?.type === "bracketed_argument_list")
           return null;
+        if (parentType === "argument" && parent.childForFieldName("name"))
+          return null;
         if (parentType === "binary_expression" && TIME_FACTORS2.has(val)) {
           const op = parent.childForFieldName("operator");
           if (op?.text === "*") {
@@ -130365,6 +130783,8 @@ var init_no_extraneous_class2 = __esm({
           return null;
         if (node2.namedChildren.some((c2) => c2?.type === "base_list"))
           return null;
+        if (node2.namedChildren.some((c2) => c2?.type === "attribute_list"))
+          return null;
         const body = node2.childForFieldName("body");
         if (!body)
           return null;
@@ -130623,7 +131043,8 @@ var init_redundant_jump3 = __esm({
         if (!grandparent)
           return null;
         if (node2.type === "return_statement") {
-          if (node2.namedChildren.length > 0)
+          const hasExpression = node2.children.some((c2) => c2 != null && c2.type !== "return" && c2.type !== ";");
+          if (hasExpression)
             return null;
           if (!isCSharpFunctionBoundary(grandparent.type))
             return null;
@@ -131988,6 +132409,8 @@ var init_too_many_lines3 = __esm({
         const bodyNode = getCSharpFunctionBody(node2);
         if (!bodyNode)
           return null;
+        if (isCSharpGeneratedSource(filePath, sourceCode) || isCSharpEfMigration(node2))
+          return null;
         const lineCount = bodyNode.endPosition.row - bodyNode.startPosition.row + 1;
         if (lineCount > 50) {
           const name = getCSharpFunctionName(node2);
@@ -132635,93 +133058,6 @@ var init_unused_collection2 = __esm({
   }
 });
 
-// packages/analyzer/dist/rules/code-quality/visitors/csharp/unused-function-parameter.js
-var csharpUnusedFunctionParameterVisitor;
-var init_unused_function_parameter2 = __esm({
-  "packages/analyzer/dist/rules/code-quality/visitors/csharp/unused-function-parameter.js"() {
-    "use strict";
-    init_types2();
-    init_csharp_helpers();
-    csharpUnusedFunctionParameterVisitor = {
-      ruleKey: "code-quality/deterministic/unused-function-parameter",
-      languages: ["csharp"],
-      nodeTypes: ["method_declaration", "constructor_declaration", "local_function_statement"],
-      visit(node2, filePath, sourceCode) {
-        const params = node2.childForFieldName("parameters");
-        if (!params || params.namedChildCount === 0)
-          return null;
-        const body = node2.childForFieldName("body");
-        if (!body)
-          return null;
-        if (body.type === "block" && body.namedChildCount === 0)
-          return null;
-        if (/NotImplementedException|NotSupportedException/.test(body.text))
-          return null;
-        if (body.type === "block" && body.namedChildCount === 1 && body.namedChildren[0]?.type === "return_statement" && /Task\.CompletedTask|Task\.FromResult|ValueTask\.CompletedTask/.test(body.namedChildren[0].text)) {
-          return null;
-        }
-        if (node2.type === "method_declaration") {
-          for (const mod of ["override", "virtual", "abstract", "partial", "extern"]) {
-            if (hasCSharpModifier(node2, mod))
-              return null;
-          }
-          if (node2.namedChildren.some((c2) => c2?.type === "explicit_interface_specifier"))
-            return null;
-          if (node2.childForFieldName("name")?.text === "Main")
-            return null;
-        }
-        const paramList = [];
-        for (const param of params.namedChildren) {
-          if (!param || param.type !== "parameter")
-            continue;
-          if (param.children.some((c2) => c2?.type === "this" || c2?.type === "modifier" && c2.text === "this"))
-            continue;
-          if (param.childForFieldName("type")?.text === "CancellationToken")
-            continue;
-          const nameNode = param.childForFieldName("name");
-          if (nameNode?.type === "identifier")
-            paramList.push({ name: nameNode.text, node: param });
-        }
-        if (paramList.length === 0)
-          return null;
-        if (paramList.length === 2) {
-          const first2 = params.namedChildren.find((c2) => c2?.type === "parameter");
-          const firstType = first2?.childForFieldName("type")?.text;
-          const secondType = paramList[1] ? paramList[1].node.childForFieldName("type")?.text : void 0;
-          if ((firstType === "object" || firstType === "object?") && secondType?.endsWith("EventArgs"))
-            return null;
-        }
-        const used = /* @__PURE__ */ new Set();
-        function collectReads(n) {
-          if (n.type === "identifier") {
-            const parent = n.parent;
-            const isMemberName = parent && (parent.type === "member_access_expression" || parent.type === "qualified_name" || parent.type === "member_binding_expression") && parent.childForFieldName("name")?.id === n.id;
-            if (!isMemberName)
-              used.add(n.text);
-          }
-          for (let i = 0; i < n.namedChildCount; i++) {
-            const child = n.namedChild(i);
-            if (child)
-              collectReads(child);
-          }
-        }
-        collectReads(body);
-        const initializer = node2.namedChildren.find((c2) => c2?.type === "constructor_initializer");
-        if (initializer)
-          collectReads(initializer);
-        for (const { name, node: paramNode } of paramList) {
-          if (name.startsWith("_"))
-            continue;
-          if (!used.has(name)) {
-            return makeViolation(this.ruleKey, paramNode, filePath, "low", `Unused parameter \`${name}\``, `Parameter \`${name}\` is never used in the method body. Remove it or rename it to \`_\` if the signature is fixed.`, sourceCode, `Remove unused parameter \`${name}\` or rename it to \`_${name}\`.`);
-          }
-        }
-        return null;
-      }
-    };
-  }
-});
-
 // packages/analyzer/dist/rules/code-quality/visitors/csharp/unused-private-member.js
 var csharpUnusedPrivateMemberVisitor;
 var init_unused_private_member2 = __esm({
@@ -132746,6 +133082,8 @@ var init_unused_private_member2 = __esm({
         for (const member of body.namedChildren) {
           if (!member)
             continue;
+          if (member.namedChildren.some((c2) => c2?.type === "explicit_interface_specifier"))
+            continue;
           if (!isCSharpPrivateMember(member))
             continue;
           if (getCSharpDeclAttributeNames(member).length > 0)
@@ -133143,8 +133481,17 @@ var init_abstract_class_public_constructor = __esm({
 });
 
 // packages/analyzer/dist/rules/code-quality/visitors/csharp/abstract-class-without-abstract-members.js
-function hasAbstractMember(body) {
-  return body.namedChildren.some((c2) => c2 && MEMBER_TYPES2.has(c2.type) && hasCSharpModifier(c2, "abstract"));
+function hasMemberWithModifier(body, modifier) {
+  return body.namedChildren.some((c2) => c2 != null && MEMBER_TYPES2.has(c2.type) && hasCSharpModifier(c2, modifier));
+}
+function hasProtectedConstructor(body) {
+  return body.namedChildren.some((c2) => c2?.type === "constructor_declaration" && hasCSharpModifier(c2, "protected"));
+}
+function hasBaseList(classDecl) {
+  return classDecl.namedChildren.some((c2) => c2?.type === "base_list");
+}
+function hasExtensionSignal(classDecl, body) {
+  return hasMemberWithModifier(body, "abstract") || hasMemberWithModifier(body, "virtual") || hasMemberWithModifier(body, "override") || hasProtectedConstructor(body) || hasBaseList(classDecl);
 }
 var MEMBER_TYPES2, csharpAbstractClassWithoutAbstractMembersVisitor;
 var init_abstract_class_without_abstract_members = __esm({
@@ -133156,6 +133503,7 @@ var init_abstract_class_without_abstract_members = __esm({
       "method_declaration",
       "property_declaration",
       "event_declaration",
+      "event_field_declaration",
       "indexer_declaration"
     ]);
     csharpAbstractClassWithoutAbstractMembersVisitor = {
@@ -133170,10 +133518,10 @@ var init_abstract_class_without_abstract_members = __esm({
         const body = node2.childForFieldName("body");
         if (!body)
           return null;
-        if (hasAbstractMember(body))
+        if (hasExtensionSignal(node2, body))
           return null;
         const name = node2.childForFieldName("name")?.text ?? "class";
-        return makeViolation(this.ruleKey, node2, filePath, "low", "Abstract class without abstract members", `Abstract class \`${name}\` declares no abstract members, so it should be a concrete base class or an interface instead.`, sourceCode, "Add abstract members, drop the `abstract` modifier, or convert the type to an interface.");
+        return makeViolation(this.ruleKey, node2, filePath, "low", "Abstract class without abstract members", `Abstract class \`${name}\` declares no abstract members and no other reason to be abstract (no virtual/override member, no protected constructor, no base type), so it should be a concrete class or a static holder instead.`, sourceCode, "Add abstract members, drop the `abstract` modifier, or convert the type to an interface.");
       }
     };
   }
@@ -134091,6 +134439,8 @@ var init_static_holder_type_has_constructor = __esm({
           return null;
         if (hasCSharpModifier(node2, "abstract"))
           return null;
+        if (node2.namedChildren.some((c2) => c2?.type === "base_list"))
+          return null;
         const body = node2.namedChildren.find((c2) => c2?.type === "declaration_list");
         if (!body)
           return null;
@@ -135974,6 +136324,15 @@ var init_extension_method_on_object = __esm({
 });
 
 // packages/analyzer/dist/rules/code-quality/visitors/csharp/generic-parameter-not-inferable.js
+function isInterfaceMember(method) {
+  let current = method.parent;
+  while (current) {
+    if (TYPE_DECL_TYPES2.has(current.type))
+      return current.type === "interface_declaration";
+    current = current.parent;
+  }
+  return false;
+}
 function identifiersIn2(node2) {
   const used = /* @__PURE__ */ new Set();
   if (!node2)
@@ -135995,14 +136354,23 @@ function parameterTypeIdentifiers(method) {
     for (const id of identifiersIn2(param.childForFieldName("type")))
       used.add(id);
   }
+  for (const id of identifiersIn2(params.childForFieldName("type")))
+    used.add(id);
   return used;
 }
-var csharpGenericParameterNotInferableVisitor;
+var TYPE_DECL_TYPES2, csharpGenericParameterNotInferableVisitor;
 var init_generic_parameter_not_inferable = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/csharp/generic-parameter-not-inferable.js"() {
     "use strict";
     init_types2();
     init_csharp_helpers();
+    TYPE_DECL_TYPES2 = /* @__PURE__ */ new Set([
+      "interface_declaration",
+      "class_declaration",
+      "struct_declaration",
+      "record_declaration",
+      "record_struct_declaration"
+    ]);
     csharpGenericParameterNotInferableVisitor = {
       ruleKey: "code-quality/deterministic/generic-parameter-not-inferable",
       languages: ["csharp"],
@@ -136011,6 +136379,8 @@ var init_generic_parameter_not_inferable = __esm({
         const typeParams = node2.namedChildren.find((c2) => c2?.type === "type_parameter_list");
         if (!typeParams)
           return null;
+        if (isInterfaceMember(node2))
+          return null;
         const usedInParams = parameterTypeIdentifiers(node2);
         const nameNode = node2.childForFieldName("name");
         const usedInReturn = /* @__PURE__ */ new Set();
@@ -136022,15 +136392,13 @@ var init_generic_parameter_not_inferable = __esm({
           for (const id of identifiersIn2(child))
             usedInReturn.add(id);
         }
-        const usedInBody = identifiersIn2(node2.childForFieldName("body"));
         for (const tp of typeParams.namedChildren) {
           if (tp?.type !== "type_parameter")
             continue;
           const name = tp.namedChildren.find((c2) => c2?.type === "identifier")?.text;
           if (!name)
             continue;
-          const usedElsewhere = usedInReturn.has(name) || usedInBody.has(name);
-          if (!usedInParams.has(name) && usedElsewhere) {
+          if (!usedInParams.has(name) && usedInReturn.has(name)) {
             return makeViolation(this.ruleKey, tp, filePath, "low", "Type parameter not inferable", `Type parameter \`${name}\` appears in no method parameter, so callers must always specify it explicitly.`, sourceCode, `Use \`${name}\` in a parameter type, or accept that callers must specify it and consider a non-generic design.`);
           }
         }
@@ -136143,6 +136511,9 @@ var init_native_method_not_wrapped = __esm({
 });
 
 // packages/analyzer/dist/rules/code-quality/visitors/csharp/nested-generic-parameter.js
+function genericBaseName2(generic) {
+  return generic.namedChildren.find((c2) => c2?.type === "identifier")?.text ?? "";
+}
 function asGenericName(typeNode) {
   if (!typeNode)
     return null;
@@ -136158,16 +136529,19 @@ function hasNestedGeneric(typeNode) {
   const generic = asGenericName(typeNode);
   if (!generic)
     return false;
+  if (DELEGATE_OR_EXPRESSION_GENERICS.has(genericBaseName2(generic)))
+    return false;
   const args = generic.namedChildren.find((c2) => c2?.type === "type_argument_list");
   if (!args)
     return false;
   return args.namedChildren.some((arg) => asGenericName(arg) !== null);
 }
-var csharpNestedGenericParameterVisitor;
+var DELEGATE_OR_EXPRESSION_GENERICS, csharpNestedGenericParameterVisitor;
 var init_nested_generic_parameter = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/csharp/nested-generic-parameter.js"() {
     "use strict";
     init_types2();
+    DELEGATE_OR_EXPRESSION_GENERICS = /* @__PURE__ */ new Set(["Func", "Action", "Predicate", "Expression"]);
     csharpNestedGenericParameterVisitor = {
       ruleKey: "code-quality/deterministic/nested-generic-parameter",
       languages: ["csharp"],
@@ -136287,6 +136661,39 @@ function enclosingTypeBody(node2) {
   const body = node2.parent;
   return body?.type === "declaration_list" ? body : null;
 }
+function isZeroArgCallTo(expr, getName) {
+  if (expr?.type !== "invocation_expression")
+    return false;
+  const fn = expr.childForFieldName("function") ?? expr.namedChildren[0];
+  const fnText = fn?.text;
+  if (fnText !== getName && fnText !== `this.${getName}`)
+    return false;
+  const args = expr.childForFieldName("arguments") ?? expr.namedChildren.find((c2) => c2?.type === "argument_list");
+  const argCount = args?.namedChildren.filter((c2) => c2?.type === "argument").length ?? 0;
+  return argCount === 0;
+}
+function getterDelegatesTo(prop, getName) {
+  const propArrow = prop.namedChildren.find((c2) => c2?.type === "arrow_expression_clause");
+  if (propArrow)
+    return isZeroArgCallTo(propArrow.namedChildren.find(Boolean), getName);
+  const accessorList = prop.namedChildren.find((c2) => c2?.type === "accessor_list");
+  if (!accessorList)
+    return false;
+  const getter = accessorList.namedChildren.find((a) => a?.type === "accessor_declaration" && a.children.some((c2) => c2?.text === "get"));
+  if (!getter)
+    return false;
+  const getArrow = getter.namedChildren.find((c2) => c2?.type === "arrow_expression_clause");
+  if (getArrow)
+    return isZeroArgCallTo(getArrow.namedChildren.find(Boolean), getName);
+  const block = getter.namedChildren.find((c2) => c2?.type === "block");
+  if (block) {
+    const stmts = block.namedChildren.filter((c2) => c2?.type !== "comment");
+    if (stmts.length === 1 && stmts[0]?.type === "return_statement") {
+      return isZeroArgCallTo(stmts[0].namedChildren.find(Boolean), getName);
+    }
+  }
+  return false;
+}
 var csharpPropertyNameMatchesGetMethodVisitor;
 var init_property_name_matches_get_method = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/csharp/property-name-matches-get-method.js"() {
@@ -136314,6 +136721,8 @@ var init_property_name_matches_get_method = __esm({
         });
         if (!hasGetMethod)
           return null;
+        if (getterDelegatesTo(node2, target))
+          return null;
         return makeViolation(this.ruleKey, node2, filePath, "low", "Property name matches a Get method", `Property \`${propName}\` coexists with a parameterless \`${target}()\` method \u2014 a confusing duplication of how the value is exposed.`, sourceCode, `Keep one accessor: either the property \`${propName}\` or the method \`${target}\`, not both.`);
       }
     };
@@ -136321,6 +136730,50 @@ var init_property_name_matches_get_method = __esm({
 });
 
 // packages/analyzer/dist/rules/code-quality/visitors/csharp/public-const-versioning-hazard.js
+function constFieldNames(fieldDecl) {
+  const names = [];
+  const varDecl = fieldDecl.namedChildren.find((c2) => c2?.type === "variable_declaration");
+  if (!varDecl)
+    return names;
+  for (const vd of varDecl.namedChildren) {
+    if (vd?.type !== "variable_declarator")
+      continue;
+    const n = vd.childForFieldName("name")?.text ?? vd.namedChildren.find((c2) => c2?.type === "identifier")?.text;
+    if (n)
+      names.push(n);
+  }
+  return names;
+}
+function referencedBySiblingConst(node2, names) {
+  let root2 = node2;
+  while (root2.parent)
+    root2 = root2.parent;
+  let found = false;
+  const scan3 = (n) => {
+    if (found)
+      return;
+    if (n.type === "field_declaration" && n.id !== node2.id && hasCSharpModifier(n, "const")) {
+      const varDecl = n.namedChildren.find((c2) => c2?.type === "variable_declaration");
+      if (varDecl) {
+        for (const vd of varDecl.namedChildren) {
+          if (vd?.type !== "variable_declarator")
+            continue;
+          const declaredName = vd.childForFieldName("name");
+          walkCSharp(vd, (id) => {
+            if (id.type === "identifier" && id.id !== declaredName?.id && names.includes(id.text)) {
+              found = true;
+            }
+          });
+        }
+      }
+    }
+    for (const c2 of n.namedChildren)
+      if (c2)
+        scan3(c2);
+  };
+  scan3(root2);
+  return found;
+}
 var csharpPublicConstVersioningHazardVisitor;
 var init_public_const_versioning_hazard = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/csharp/public-const-versioning-hazard.js"() {
@@ -136336,6 +136789,9 @@ var init_public_const_versioning_hazard = __esm({
           return null;
         if (!hasCSharpModifier(node2, "public") && !hasCSharpModifier(node2, "protected"))
           return null;
+        const names = constFieldNames(node2);
+        if (names.length > 0 && referencedBySiblingConst(node2, names))
+          return null;
         return makeViolation(this.ruleKey, node2, filePath, "low", "Public constant versioning hazard", "A `public const` value is inlined into consumers at compile time and will not update unless they recompile \u2014 prefer `static readonly`.", sourceCode, "Replace the `public const` with a `public static readonly` field.");
       }
     };
@@ -137011,12 +137467,12 @@ var init_missing_access_modifier = __esm({
           return null;
         if (node2.parent?.parent?.type === "interface_declaration")
           return null;
+        if (node2.namedChildren.some((c2) => c2?.type === "explicit_interface_specifier"))
+          return null;
         if (node2.type === "method_declaration") {
           const nm = node2.childForFieldName("name");
           if (nm?.type === "qualified_name" || (nm?.text ?? "").includes("."))
             return null;
-          if (node2.namedChildren.some((c2) => c2?.type === "explicit_interface_specifier"))
-            return null;
         }
         if (node2.type === "constructor_declaration" && mods.includes("static"))
           return null;
@@ -137080,7 +137536,7 @@ function topLevelTypeIdentifiers(root2) {
         const body = m.namedChildren.find((c2) => c2?.type === "declaration_list");
         if (body)
           collectFrom(body);
-      } else if (TYPE_DECL_TYPES2.has(m.type)) {
+      } else if (TYPE_DECL_TYPES3.has(m.type)) {
         const id = m.childForFieldName("name");
         if (id)
           out.push(id);
@@ -137093,6 +137549,8 @@ function topLevelTypeIdentifiers(root2) {
 function nameMatches(fileName, typeName2) {
   if (fileName === typeName2)
     return true;
+  if (typeName2 === `${fileName}Attribute`)
+    return true;
   const brace = fileName.indexOf("{");
   if (brace > 0 && fileName.slice(0, brace) === typeName2)
     return true;
@@ -137101,12 +137559,12 @@ function nameMatches(fileName, typeName2) {
     return true;
   return false;
 }
-var TYPE_DECL_TYPES2, csharpFilenameTypeMismatchVisitor;
+var TYPE_DECL_TYPES3, csharpFilenameTypeMismatchVisitor;
 var init_csharp_filename_type_mismatch = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/csharp/csharp-filename-type-mismatch.js"() {
     "use strict";
     init_types2();
-    TYPE_DECL_TYPES2 = /* @__PURE__ */ new Set([
+    TYPE_DECL_TYPES3 = /* @__PURE__ */ new Set([
       "class_declaration",
       "struct_declaration",
       "interface_declaration",
@@ -137120,13 +137578,18 @@ var init_csharp_filename_type_mismatch = __esm({
       nodeTypes: ["compilation_unit"],
       visit(node2, filePath, sourceCode) {
         const base2 = filePath.split("/").pop() ?? "";
-        const fileName = base2.replace(/\.[^.]*$/, "");
+        const lower = base2.toLowerCase();
+        const compoundExt = [".cshtml.cs", ".razor.cs"].find((ext2) => lower.endsWith(ext2));
+        const fileName = compoundExt ? base2.slice(0, base2.length - compoundExt.length) : base2.replace(/\.[^.]*$/, "");
         if (!fileName)
           return null;
+        const migrationName = fileName.match(/^\d{14}_(.+)$/)?.[1];
+        const candidateNames2 = migrationName ? [fileName, migrationName] : [fileName];
         const identifiers = topLevelTypeIdentifiers(node2);
         if (identifiers.length === 0)
           return null;
-        if (identifiers.some((id) => nameMatches(fileName, id.text)))
+        const matches = (id) => candidateNames2.some((fn) => nameMatches(fn, id.text)) || compoundExt !== void 0 && id.text === `${fileName}Model`;
+        if (identifiers.some(matches))
           return null;
         const first2 = identifiers[0];
         return makeViolation(this.ruleKey, first2, filePath, "low", "File name does not match a contained type", `File '${fileName}' declares type '${first2.text}' but no top-level type matches the file name; name the file after a type so it is easy to locate.`, sourceCode, `Rename the file after a contained type, e.g. ${first2.text}.cs.`);
@@ -137579,7 +138042,7 @@ var init_csharp6 = __esm({
     init_cognitive_complexity3();
     init_collapsible_else_if2();
     init_collapsible_if3();
-    init_commented_out_code3();
+    init_commented_out_code4();
     init_comparison_of_constant2();
     init_console_log2();
     init_contradictory_boolean_expression2();
@@ -137662,7 +138125,6 @@ var init_csharp6 = __esm({
     init_unnecessary_namespace_qualifier2();
     init_unsafe_any_usage2();
     init_unused_collection2();
-    init_unused_function_parameter2();
     init_unused_private_member2();
     init_unused_private_method2();
     init_unused_private_nested_class2();
@@ -137921,7 +138383,6 @@ var init_csharp6 = __esm({
       csharpUnnecessaryNamespaceQualifierVisitor,
       csharpUnsafeAnyUsageVisitor,
       csharpUnusedCollectionVisitor,
-      csharpUnusedFunctionParameterVisitor,
       csharpUnusedPrivateMemberVisitor,
       csharpUnusedPrivateMethodVisitor,
       csharpUnusedPrivateNestedClassVisitor,
@@ -140103,6 +140564,11 @@ function allElementsConstant(creation) {
     return false;
   return elements.every((e) => LITERAL_TYPES6.has(e.type));
 }
+function isGeneratedOrMigrationFile(filePath) {
+  if (/(^|[\\/])Migrations[\\/]/.test(filePath))
+    return true;
+  return /\.(designer|g|g\.i|generated)\.cs$/i.test(filePath);
+}
 var LITERAL_TYPES6, csharpConstantArrayArgumentVisitor;
 var init_constant_array_argument = __esm({
   "packages/analyzer/dist/rules/performance/visitors/csharp/constant-array-argument.js"() {
@@ -140123,6 +140589,8 @@ var init_constant_array_argument = __esm({
       languages: ["csharp"],
       nodeTypes: ["array_creation_expression", "implicit_array_creation_expression"],
       visit(node2, filePath, sourceCode) {
+        if (isGeneratedOrMigrationFile(filePath))
+          return null;
         if (node2.parent?.type !== "argument")
           return null;
         if (!getCSharpEnclosingFunction(node2))
@@ -140911,7 +141379,36 @@ var init_missing_finally_cleanup2 = __esm({
 });
 
 // packages/analyzer/dist/rules/reliability/visitors/csharp/unsafe-json-parse.js
-var JSON_PARSERS, csharpUnsafeJsonParseVisitor;
+function bodyDeclaresMember(body, name) {
+  for (const member of body.namedChildren) {
+    if (!member)
+      continue;
+    if (member.type === "property_declaration") {
+      if (member.childForFieldName("name")?.text === name)
+        return true;
+    } else if (member.type === "field_declaration") {
+      const decl = member.namedChildren.find((c2) => c2?.type === "variable_declaration");
+      for (const d3 of decl?.namedChildren ?? []) {
+        if (d3?.type === "variable_declarator" && d3.childForFieldName("name")?.text === name)
+          return true;
+      }
+    }
+  }
+  return false;
+}
+function enclosingTypeDeclaresMember(node2, name) {
+  let current = node2.parent;
+  while (current) {
+    if (TYPE_DECLS2.has(current.type)) {
+      const body = current.childForFieldName("body");
+      if (body && bodyDeclaresMember(body, name))
+        return true;
+    }
+    current = current.parent;
+  }
+  return false;
+}
+var JSON_PARSERS, TYPE_DECLS2, csharpUnsafeJsonParseVisitor;
 var init_unsafe_json_parse3 = __esm({
   "packages/analyzer/dist/rules/reliability/visitors/csharp/unsafe-json-parse.js"() {
     "use strict";
@@ -140926,15 +141423,25 @@ var init_unsafe_json_parse3 = __esm({
       JsonDocument: /* @__PURE__ */ new Set(["Parse", "ParseAsync"]),
       JsonNode: /* @__PURE__ */ new Set(["Parse"])
     };
+    TYPE_DECLS2 = /* @__PURE__ */ new Set([
+      "class_declaration",
+      "struct_declaration",
+      "record_declaration",
+      "record_struct_declaration"
+    ]);
     csharpUnsafeJsonParseVisitor = {
       ruleKey: "reliability/deterministic/unsafe-json-parse",
       languages: ["csharp"],
       nodeTypes: ["invocation_expression"],
       visit(node2, filePath, sourceCode) {
-        const receiver = simpleTypeName5(getCSharpReceiver(node2));
+        const rawReceiver = getCSharpReceiver(node2);
+        const receiver = simpleTypeName5(rawReceiver);
         const method = getCSharpMethodName(node2);
         if (!JSON_PARSERS[receiver]?.has(method))
           return null;
+        const bareReceiver = rawReceiver.startsWith("this.") ? rawReceiver.slice(5) : rawReceiver;
+        if (!bareReceiver.includes(".") && enclosingTypeDeclaresMember(node2, bareReceiver))
+          return null;
         const firstArg = getCSharpArguments(node2)[0];
         if (firstArg?.type === "invocation_expression") {
           const innerReceiver = simpleTypeName5(getCSharpReceiver(firstArg));
@@ -142641,18 +143148,10 @@ var init_logger_field_naming = __esm({
     csharpLoggerFieldNamingVisitor = {
       ruleKey: "style/deterministic/logger-field-naming",
       languages: ["csharp"],
-      nodeTypes: ["field_declaration", "property_declaration"],
+      nodeTypes: ["field_declaration"],
       visit(node2, filePath, sourceCode) {
         if (isAutoGeneratedCSharpFile(sourceCode))
           return null;
-        if (node2.type === "property_declaration") {
-          if (!isLoggerType(node2.childForFieldName("type")))
-            return null;
-          const name = node2.childForFieldName("name");
-          if (!name || ACCEPTED.test(name.text))
-            return null;
-          return makeViolation(this.ruleKey, name, filePath, "low", "Logger does not follow the naming convention", `Logger '${name.text}' does not follow the convention for logger members (camelCase, optionally _-prefixed).`, sourceCode, `Rename the logger to a camelCase name such as '_logger'.`);
-        }
         const declaration = node2.namedChildren.find((c2) => c2?.type === "variable_declaration");
         if (!declaration)
           return null;
@@ -143460,15 +143959,28 @@ function isNestedInType(node2) {
   const parent = node2.parent;
   if (parent?.type !== "declaration_list")
     return false;
-  return parent.parent != null && TYPE_DECL_TYPES3.has(parent.parent.type);
+  return parent.parent != null && TYPE_DECL_TYPES4.has(parent.parent.type);
 }
-var TYPE_DECL_TYPES3, csharpNestedTypePubliclyVisibleVisitor;
+function isConstantContainer(node2) {
+  if (node2.type !== "class_declaration")
+    return false;
+  if (!hasCSharpModifier(node2, "static"))
+    return false;
+  const body = node2.childForFieldName("body");
+  if (!body)
+    return false;
+  const members = body.namedChildren.filter((c2) => c2 && c2.type !== "comment");
+  if (members.length === 0)
+    return false;
+  return members.every((m) => m?.type === "field_declaration" && (hasCSharpModifier(m, "const") || hasCSharpModifier(m, "static") && hasCSharpModifier(m, "readonly")));
+}
+var TYPE_DECL_TYPES4, csharpNestedTypePubliclyVisibleVisitor;
 var init_nested_type_publicly_visible = __esm({
   "packages/analyzer/dist/rules/architecture/visitors/csharp/nested-type-publicly-visible.js"() {
     "use strict";
     init_types2();
     init_csharp_helpers();
-    TYPE_DECL_TYPES3 = /* @__PURE__ */ new Set([
+    TYPE_DECL_TYPES4 = /* @__PURE__ */ new Set([
       "class_declaration",
       "struct_declaration",
       "interface_declaration",
@@ -143486,6 +143998,8 @@ var init_nested_type_publicly_visible = __esm({
           return null;
         if (getCSharpAttributeNames(node2).length > 0)
           return null;
+        if (isConstantContainer(node2))
+          return null;
         const name = node2.childForFieldName("name")?.text ?? "type";
         return makeViolation(this.ruleKey, node2, filePath, "low", "Publicly visible nested type", `Nested type '${name}' is publicly visible, exposing an implementation detail of its containing type.`, sourceCode, `Make '${name}' private or internal, or lift it out to its own top-level type if it is a real part of the API.`);
       }
@@ -143573,6 +144087,8 @@ var init_type_outside_namespace = __esm({
 
 // packages/analyzer/dist/rules/architecture/visitors/csharp/_uri-helpers.js
 function nameLooksLikeUri(name) {
+  if (PREPOSITION_BEFORE_URI.test(name))
+    return false;
   if (URI_NAME_PATTERN.test(name))
     return true;
   return /(Url|Uri|Endpoint|Webhook)$/.test(name);
@@ -143580,11 +144096,12 @@ function nameLooksLikeUri(name) {
 function isStringType(typeNode) {
   return typeNode?.type === "predefined_type" && typeNode.text === "string";
 }
-var URI_NAME_PATTERN;
+var URI_NAME_PATTERN, PREPOSITION_BEFORE_URI;
 var init_uri_helpers = __esm({
   "packages/analyzer/dist/rules/architecture/visitors/csharp/_uri-helpers.js"() {
     "use strict";
     URI_NAME_PATTERN = /(^|[^a-z])(url|uri|uris|urls|endpoint|endpoints|webhook|webhookurl|callbackurl|redirecturi|redirecturl|hreflink|baseurl|baseaddress)$/i;
+    PREPOSITION_BEFORE_URI = /(In|As|Of|At|By|Within)(Url|Uri|Uris|Urls|Endpoint|Endpoints|Webhook)$/;
   }
 });
 
@@ -143622,13 +144139,22 @@ var init_uri_parameter_as_string = __esm({
 });
 
 // packages/analyzer/dist/rules/architecture/visitors/csharp/uri-property-as-string.js
-var csharpUriPropertyAsStringVisitor;
+function initializerProvesNotUri(valueNode) {
+  if (!valueNode || !isCSharpStringNode(valueNode))
+    return false;
+  const text4 = getCSharpStringText(valueNode);
+  if (text4 == null || text4.length === 0)
+    return false;
+  return !text4.includes("://");
+}
+var BINDING_ATTRIBUTES, csharpUriPropertyAsStringVisitor;
 var init_uri_property_as_string = __esm({
   "packages/analyzer/dist/rules/architecture/visitors/csharp/uri-property-as-string.js"() {
     "use strict";
     init_types2();
     init_csharp_helpers();
     init_uri_helpers();
+    BINDING_ATTRIBUTES = /* @__PURE__ */ new Set(["BindProperty", "FromQuery", "FromRoute", "FromForm", "ModelBinder"]);
     csharpUriPropertyAsStringVisitor = {
       ruleKey: "architecture/deterministic/uri-property-as-string",
       languages: ["csharp"],
@@ -143641,6 +144167,10 @@ var init_uri_property_as_string = __esm({
         const name = node2.childForFieldName("name")?.text;
         if (!name || !nameLooksLikeUri(name))
           return null;
+        if (getCSharpAttributeNames(node2).some((a) => BINDING_ATTRIBUTES.has(a)))
+          return null;
+        if (initializerProvesNotUri(node2.childForFieldName("value")))
+          return null;
         return makeViolation(this.ruleKey, node2.childForFieldName("type"), filePath, "low", "URI property typed as string", `Property '${name}' holds a URI but is typed as string; use System.Uri to get parsing and validation.`, sourceCode, `Change the type of '${name}' from string to System.Uri.`);
       }
     };
@@ -143678,6 +144208,21 @@ function isModelType(classDecl) {
   const name = classDecl.childForFieldName("name")?.text ?? "";
   return MODEL_NAME_SUFFIX.test(name);
 }
+function isServerConstructed(classDecl, body) {
+  for (const member of body.namedChildren) {
+    if (member?.type === "constructor_declaration") {
+      const params = member.childForFieldName("parameters");
+      if (params && params.namedChildCount > 0)
+        return true;
+    }
+    if (member?.type === "method_declaration" && hasCSharpModifier(member, "static")) {
+      const mName = member.childForFieldName("name")?.text ?? "";
+      if (mName === "Create" || mName.startsWith("From"))
+        return true;
+    }
+  }
+  return false;
+}
 function flaggablePropertyType(typeNode) {
   if (typeNode?.type !== "predefined_type")
     return null;
@@ -143690,7 +144235,7 @@ var init_value_type_action_param_under_posting = __esm({
     "use strict";
     init_types2();
     init_csharp_helpers();
-    MODEL_NAME_SUFFIX = /(Request|Dto|DTO|Model|ViewModel|Input|Form|Command|Query|Payload)$/;
+    MODEL_NAME_SUFFIX = /(Request|Input|Form|Command|Query|Payload)$/;
     SCALAR_VALUE_TYPES = /* @__PURE__ */ new Set(["int", "long", "short", "byte", "uint", "ulong", "ushort", "sbyte", "decimal", "double", "float", "bool", "char"]);
     csharpValueTypeActionParamUnderPostingVisitor = {
       ruleKey: "architecture/deterministic/value-type-action-param-under-posting",
@@ -143702,6 +144247,8 @@ var init_value_type_action_param_under_posting = __esm({
         const body = node2.childForFieldName("body");
         if (!body)
           return null;
+        if (isServerConstructed(node2, body))
+          return null;
         for (const member of body.namedChildren) {
           if (member?.type !== "property_declaration")
             continue;
@@ -143729,6 +144276,22 @@ var init_value_type_action_param_under_posting = __esm({
 });
 
 // packages/analyzer/dist/rules/architecture/visitors/csharp/action-missing-producesresponsetype.js
+function excludedFromApiExplorer(node2) {
+  for (const child of node2.children) {
+    if (child?.type !== "attribute_list")
+      continue;
+    for (const attr of child.namedChildren) {
+      if (attr?.type !== "attribute")
+        continue;
+      const name = (attr.childForFieldName("name")?.text ?? "").split(".").pop();
+      if (name !== "ApiExplorerSettings")
+        continue;
+      if (/\bIgnoreApi\s*=\s*true\b/i.test(attr.text))
+        return true;
+    }
+  }
+  return false;
+}
 function attributeNames7(node2) {
   const names = [];
   for (const child of node2.children) {
@@ -143776,6 +144339,8 @@ var init_action_missing_producesresponsetype = __esm({
         const classAttrs = attributeNames7(cls);
         if (classAttrs.some((a) => a.startsWith("ProducesResponseType") || a === "ProducesDefaultResponseType"))
           return null;
+        if (excludedFromApiExplorer(node2) || excludedFromApiExplorer(cls))
+          return null;
         const name = node2.childForFieldName("name");
         return makeViolation(this.ruleKey, name ?? node2, filePath, "low", "Controller action has no [ProducesResponseType]", `Action '${name?.text ?? ""}' declares no [ProducesResponseType]; its response shapes and status codes are missing from the API description.`, sourceCode, "Annotate the action with [ProducesResponseType] for each status code it can return.");
       }
@@ -145718,52 +146283,96 @@ var init_pyproject_checker = __esm({
 // packages/analyzer/dist/roslyn-host-client.js
 import { spawn as spawn4 } from "child_process";
 import { existsSync as existsSync10 } from "fs";
+import { tmpdir } from "os";
 import { dirname as dirname9, resolve as resolve9 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 function resolveRoslynHostBinary() {
   const override = process.env[HOST_BINARY_ENV];
   if (override)
     return existsSync10(override) ? override : null;
-  const here = dirname9(fileURLToPath5(import.meta.url));
-  const rel = "tools/csharp-roslyn-host/bin/Release/net8.0/csharp-roslyn-host";
-  for (const up of ["../../..", "../../../..", "../../../../.."]) {
-    const candidate = resolve9(here, up, rel);
-    if (existsSync10(candidate))
-      return candidate;
+  const rels = [
+    "roslyn-host/csharp-roslyn-host.dll",
+    "tools/csharp-roslyn-host/bin/Release/net8.0/csharp-roslyn-host"
+  ];
+  let dir = dirname9(fileURLToPath5(import.meta.url));
+  for (let i = 0; i < 12; i++) {
+    for (const rel of rels) {
+      const candidate = resolve9(dir, rel);
+      if (existsSync10(candidate))
+        return candidate;
+    }
+    const parent = dirname9(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
   }
   return null;
 }
 function invokeHost(bin, request) {
   return new Promise((resolvePromise, reject) => {
-    const child = spawn4(bin, [], { stdio: ["pipe", "pipe", "pipe"] });
+    const viaDotnet = bin.endsWith(".dll");
+    const cmd = viaDotnet ? "dotnet" : bin;
+    const args = viaDotnet ? [bin] : [];
+    const child = spawn4(cmd, args, { stdio: ["pipe", "pipe", "pipe"], cwd: tmpdir() });
     let stdout = "";
     let stderr = "";
+    let settled = false;
+    const fail4 = (err) => {
+      if (settled)
+        return;
+      settled = true;
+      reject(err);
+    };
+    const succeed = (violations) => {
+      if (settled)
+        return;
+      settled = true;
+      resolvePromise(violations);
+    };
     child.stdout.setEncoding("utf8");
     child.stderr.setEncoding("utf8");
     child.stdout.on("data", (d3) => stdout += d3);
     child.stderr.on("data", (d3) => stderr += d3);
-    child.on("error", (e) => reject(new RoslynHostUnavailableError(`Failed to start the Roslyn host (${bin}): ${e.message}. Is the .NET runtime installed?`)));
-    child.on("close", () => {
-      const line = stdout.split("\n").find((l) => l.trim());
-      if (!line) {
-        reject(new Error(`Roslyn host produced no output.${stderr ? ` stderr: ${stderr}` : ""}`));
+    child.on("error", (e) => fail4(new RoslynHostUnavailableError(`Failed to start the Roslyn host (${viaDotnet ? `dotnet ${bin}` : bin}): ${e.message}. Is the .NET runtime installed?`)));
+    child.stdin.on("error", () => {
+    });
+    child.on("close", (code, signalName) => {
+      if (code !== 0 || signalName) {
+        const reason = stderr.trim() || stdout.trim() || "(no output)";
+        fail4(new RoslynHostUnavailableError(`The Roslyn host exited ${signalName ? `via ${signalName}` : `with code ${code}`} before responding. Is a compatible .NET runtime installed? Host output: ${reason}`));
+        return;
+      }
+      const lines = stdout.split("\n").map((l) => l.trim()).filter(Boolean);
+      if (lines.length === 0) {
+        fail4(new Error(`Roslyn host produced no output.${stderr ? ` stderr: ${stderr}` : ""}`));
         return;
       }
       let resp;
-      try {
-        resp = JSON.parse(line);
-      } catch {
-        reject(new Error(`Roslyn host returned invalid JSON: ${line}`));
+      for (const l of lines) {
+        try {
+          const parsed = JSON.parse(l);
+          if (parsed && typeof parsed.ok === "boolean") {
+            resp = parsed;
+            break;
+          }
+        } catch {
+        }
+      }
+      if (!resp) {
+        fail4(new Error(`Roslyn host returned invalid JSON: ${lines[0]}`));
         return;
       }
       if (!resp.ok) {
-        reject(new Error(`Roslyn host error: ${resp.error ?? "unknown"}`));
+        fail4(new Error(`Roslyn host error: ${resp.error ?? "unknown"}`));
         return;
       }
-      resolvePromise(resp.violations ?? []);
+      succeed(resp.violations ?? []);
     });
-    child.stdin.write(JSON.stringify(request) + "\n");
-    child.stdin.end();
+    try {
+      child.stdin.write(JSON.stringify(request) + "\n");
+      child.stdin.end();
+    } catch {
+    }
   });
 }
 function runRoslynWorkspace(projectPath, rules) {
@@ -146568,7 +147177,7 @@ var init_flow_service = __esm({
 });
 
 // packages/core/dist/progress.js
-function buildAnalysisSteps(enabledCategories, enableLlmRules) {
+function buildAnalysisSteps(enabledCategories, enableLlmRules, hasCSharp) {
   const steps = [
     { key: "parse", label: "Parsing repository" }
   ];
@@ -146579,6 +147188,9 @@ function buildAnalysisSteps(enabledCategories, enableLlmRules) {
   for (const domain of activeDomains) {
     steps.push({ key: domain, label: `${DOMAIN_LABELS[domain]} checks` });
   }
+  if (hasCSharp) {
+    steps.push({ key: "csharp", label: "C# semantic analysis" });
+  }
   steps.push({ key: "persist", label: "Saving results" });
   return steps;
 }
@@ -146621,6 +147233,23 @@ var init_progress = __esm({
           this.emit();
         }
       }
+      /**
+       * Insert a step at runtime, just before `persist`, if it isn't already there.
+       * Used for phases we can't declare up front — e.g. the C# semantic tier only
+       * exists when the repo actually has C#, which isn't known until files are read.
+       * No-op if the key already exists.
+       */
+      ensureStep(key4, label) {
+        if (this.steps.some((s) => s.key === key4))
+          return;
+        const persistIdx = this.steps.findIndex((s) => s.key === "persist");
+        const step = { key: key4, label, status: "pending" };
+        if (persistIdx === -1)
+          this.steps.push(step);
+        else
+          this.steps.splice(persistIdx, 0, step);
+        this.emit();
+      }
       setStatus(key4, status, detail) {
         const step = this.steps.find((s) => s.key === key4);
         if (step) {
@@ -146694,7 +147323,7 @@ var require_windows = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/windows.js"(exports, module) {
     module.exports = isexe;
     isexe.sync = sync;
-    var fs70 = __require("fs");
+    var fs71 = __require("fs");
     function checkPathExt(path80, options) {
       var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;
       if (!pathext) {
@@ -146719,12 +147348,12 @@ var require_windows = __commonJS({
       return checkPathExt(path80, options);
     }
     function isexe(path80, options, cb) {
-      fs70.stat(path80, function(er, stat) {
+      fs71.stat(path80, function(er, stat) {
         cb(er, er ? false : checkStat(stat, path80, options));
       });
     }
     function sync(path80, options) {
-      return checkStat(fs70.statSync(path80), path80, options);
+      return checkStat(fs71.statSync(path80), path80, options);
     }
   }
 });
@@ -146734,14 +147363,14 @@ var require_mode = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/mode.js"(exports, module) {
     module.exports = isexe;
     isexe.sync = sync;
-    var fs70 = __require("fs");
+    var fs71 = __require("fs");
     function isexe(path80, options, cb) {
-      fs70.stat(path80, function(er, stat) {
+      fs71.stat(path80, function(er, stat) {
         cb(er, er ? false : checkStat(stat, options));
       });
     }
     function sync(path80, options) {
-      return checkStat(fs70.statSync(path80), options);
+      return checkStat(fs71.statSync(path80), options);
     }
     function checkStat(stat, options) {
       return stat.isFile() && checkMode(stat, options);
@@ -146765,7 +147394,7 @@ var require_mode = __commonJS({
 // node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js
 var require_isexe = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js"(exports, module) {
-    var fs70 = __require("fs");
+    var fs71 = __require("fs");
     var core2;
     if (process.platform === "win32" || global.TESTING_WINDOWS) {
       core2 = require_windows();
@@ -147029,16 +147658,16 @@ var require_shebang_command = __commonJS({
 var require_readShebang = __commonJS({
   "node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/readShebang.js"(exports, module) {
     "use strict";
-    var fs70 = __require("fs");
+    var fs71 = __require("fs");
     var shebangCommand = require_shebang_command();
     function readShebang(command) {
       const size = 150;
       const buffer = Buffer.alloc(size);
       let fd;
       try {
-        fd = fs70.openSync(command, "r");
-        fs70.readSync(fd, buffer, 0, size, 0);
-        fs70.closeSync(fd);
+        fd = fs71.openSync(command, "r");
+        fs71.readSync(fd, buffer, 0, size, 0);
+        fs71.closeSync(fd);
       } catch (e) {
       }
       return shebangCommand(buffer.toString());
@@ -147442,7 +148071,7 @@ var require_package = __commonJS({
 // node_modules/.pnpm/dotenv@16.6.1/node_modules/dotenv/lib/main.js
 var require_main = __commonJS({
   "node_modules/.pnpm/dotenv@16.6.1/node_modules/dotenv/lib/main.js"(exports, module) {
-    var fs70 = __require("fs");
+    var fs71 = __require("fs");
     var path80 = __require("path");
     var os15 = __require("os");
     var crypto6 = __require("crypto");
@@ -147551,7 +148180,7 @@ var require_main = __commonJS({
       if (options && options.path && options.path.length > 0) {
         if (Array.isArray(options.path)) {
           for (const filepath of options.path) {
-            if (fs70.existsSync(filepath)) {
+            if (fs71.existsSync(filepath)) {
               possibleVaultPath = filepath.endsWith(".vault") ? filepath : `${filepath}.vault`;
             }
           }
@@ -147561,7 +148190,7 @@ var require_main = __commonJS({
       } else {
         possibleVaultPath = path80.resolve(process.cwd(), ".env.vault");
       }
-      if (fs70.existsSync(possibleVaultPath)) {
+      if (fs71.existsSync(possibleVaultPath)) {
         return possibleVaultPath;
       }
       return null;
@@ -147610,7 +148239,7 @@ var require_main = __commonJS({
       const parsedAll = {};
       for (const path81 of optionPaths) {
         try {
-          const parsed = DotenvModule.parse(fs70.readFileSync(path81, { encoding }));
+          const parsed = DotenvModule.parse(fs71.readFileSync(path81, { encoding }));
           DotenvModule.populate(parsedAll, parsed, options);
         } catch (e) {
           if (debug2) {
@@ -148446,7 +149075,7 @@ var init_schemas2 = __esm({
 // packages/core/dist/services/llm/cli-provider.js
 import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join10 } from "node:path";
-import { tmpdir } from "node:os";
+import { tmpdir as tmpdir2 } from "node:os";
 import { randomUUID as randomUUID4 } from "node:crypto";
 var import_cross_spawn, BaseCLIProvider, ClaudeCodeProvider;
 var init_cli_provider = __esm({
@@ -148516,7 +149145,7 @@ var init_cli_provider = __esm({
       constructor(transport) {
         this.transport = transport;
         if (process.env.TRUECOURSE_CLI_DEBUG) {
-          this.debugDir = join10(tmpdir(), "truecourse-cli-debug");
+          this.debugDir = join10(tmpdir2(), "truecourse-cli-debug");
           mkdirSync2(this.debugDir, { recursive: true });
           log.info(`[CLI] Debug output: ${this.debugDir}`);
         }
@@ -148629,8 +149258,13 @@ var init_cli_provider = __esm({
               unregisterChildProcess(this._repoId, child);
             reject(new Error(`[CLI] Failed to spawn ${this.binaryName}: ${err.message}`));
           });
-          child.stdin.write(prompt);
-          child.stdin.end();
+          child.stdin.on("error", () => {
+          });
+          try {
+            child.stdin.write(prompt);
+            child.stdin.end();
+          } catch {
+          }
         });
       }
       /** Extract usage data from CLI JSON envelope if present. */
@@ -149191,7 +149825,7 @@ var init_provider = __esm({
 });
 
 // packages/core/dist/services/llm/context-router.js
-function isTestFile2(filePath) {
+function isTestFile3(filePath) {
   return TEST_PATTERNS.some((p2) => filePath.includes(p2));
 }
 function matchesFileFilter(fa, filter2, fileContent) {
@@ -149226,7 +149860,7 @@ function matchesFileFilter(fa, filter2, fileContent) {
       return false;
   }
   if (filter2.isTestFile !== void 0) {
-    if (filter2.isTestFile !== isTestFile2(fa.filePath))
+    if (filter2.isTestFile !== isTestFile3(fa.filePath))
       return false;
   }
   if (filter2.languages) {
@@ -150043,7 +150677,7 @@ function findCSharpProjectFiles(repoPath) {
           continue;
         walk20(path16.join(dir, e.name), depth + 1);
       } else if (e.isFile()) {
-        if (e.name.endsWith(".sln"))
+        if (e.name.endsWith(".sln") || e.name.endsWith(".slnx"))
           solutions.push(path16.join(dir, e.name));
         else if (e.name.endsWith(".csproj"))
           projects.push(path16.join(dir, e.name));
@@ -150306,6 +150940,29 @@ async function runViolationPipeline(input) {
       }
     }
   }
+  {
+    const detByDomain = /* @__PURE__ */ new Map();
+    for (const v of allCodeViolations) {
+      const d3 = v.ruleKey.split("/")[0];
+      detByDomain.set(d3, (detByDomain.get(d3) ?? 0) + 1);
+    }
+    const archDet = serviceViolationResults.length + moduleViolationResults.length + methodViolationResults.length;
+    if (archDet > 0)
+      detByDomain.set("architecture", (detByDomain.get("architecture") ?? 0) + archDet);
+    for (const domain of DOMAIN_ORDER) {
+      const count = detByDomain.get(domain) ?? 0;
+      tracker?.done(domain, count > 0 ? `${count} violations` : "Clean");
+    }
+  }
+  const detViolationCount = allCodeViolations.length;
+  let csharpStepActive = false;
+  const startCsharpStep = (detail) => {
+    if (!csharpStepActive) {
+      tracker?.ensureStep("csharp", "C# semantic analysis");
+      csharpStepActive = true;
+    }
+    tracker?.start("csharp", detail);
+  };
   const enabledHostRules = enabledCodeRules.filter((r) => r.engine === "roslyn-host");
   if (enabledHostRules.length > 0) {
     const csharpFiles = [];
@@ -150319,6 +150976,7 @@ async function runViolationPipeline(input) {
         csharpFiles.push({ path: key4, text: fc.content });
     }
     if (csharpFiles.length > 0) {
+      startCsharpStep(`Analyzing ${csharpFiles.length} C# files\u2026`);
       const ruleByKey = new Map(enabledHostRules.map((r) => [r.key, r]));
       const hostViolations = await runRoslynHost(csharpFiles, enabledHostRules.map((r) => r.key));
       for (const v of hostViolations) {
@@ -150345,19 +151003,20 @@ async function runViolationPipeline(input) {
   if (enabledWorkspaceRules.length > 0 && filesToScan.some((f2) => detectLanguage(f2.filePath) === "csharp")) {
     const projectFiles = findCSharpProjectFiles(repoPath);
     if (projectFiles.length === 0) {
-      log.info("[Pipeline] C# present but no .csproj/.sln found \u2014 project-aware C# rules skipped");
+      log.info("[Pipeline] C# present but no .csproj/.sln/.slnx found \u2014 project-aware C# rules skipped");
     } else {
       const ruleByKey = new Map(enabledWorkspaceRules.map((r) => [r.key, r]));
       const ruleKeys = enabledWorkspaceRules.map((r) => r.key);
-      for (const projectFile of projectFiles) {
+      for (const [pi, projectFile] of projectFiles.entries()) {
+        startCsharpStep(projectFiles.length > 1 ? `Loading project ${pi + 1}/${projectFiles.length}: ${path16.basename(projectFile)}\u2026` : `Loading project ${path16.basename(projectFile)}\u2026`);
         let wsViolations;
         try {
           wsViolations = await runRoslynWorkspace(projectFile, ruleKeys);
         } catch (err) {
+          tracker?.error("csharp", `Project load failed: ${path16.basename(projectFile)}`);
           if (err instanceof RoslynHostUnavailableError)
             throw err;
-          log.warn(`[Pipeline] Project-aware C# rules skipped for ${path16.basename(projectFile)}: ${err.message}. Restore the project (\`dotnet restore\`) for full C# coverage.`);
-          continue;
+          throw new Error(`Project-aware C# analysis failed for ${path16.basename(projectFile)}: ${err.message}. Restore the project (\`dotnet restore\`) and ensure its pinned .NET SDK is installed.`);
         }
         for (const v of wsViolations) {
           const rule = ruleByKey.get(v.ruleKey);
@@ -150389,6 +151048,10 @@ async function runViolationPipeline(input) {
       }
     }
   }
+  if (csharpStepActive) {
+    const csharpFindings = allCodeViolations.length - detViolationCount;
+    tracker?.done("csharp", csharpFindings > 0 ? `${csharpFindings} violations` : "Clean");
+  }
   log.info(`[Pipeline] Code scan: ${allCodeViolations.length} violations from ${filesToScan.length} files (${enabledCodeRules.length} det rules, ${enabledLlmCodeRules.length} LLM rules)`);
   if (enabledCodeRules.some((r) => r.key === "bugs/deterministic/invalid-pyproject-toml")) {
     const pyprojectPath = path16.join(repoPath, "pyproject.toml");
@@ -150434,10 +151097,6 @@ async function runViolationPipeline(input) {
   }
   const totalDet = [...violationsByDomain.values()].reduce((a, b) => a + b, 0);
   log.info(`[Pipeline] Totals: ${DOMAIN_ORDER.filter((d3) => violationsByDomain.has(d3)).map((d3) => `${d3}=${violationsByDomain.get(d3)}`).join(", ")} (${totalDet})`);
-  for (const domain of DOMAIN_ORDER) {
-    const count = violationsByDomain.get(domain) ?? 0;
-    tracker?.done(domain, count > 0 ? `${count} violations` : "Clean");
-  }
   onProgress?.({ step: "analyzing", percent: 84, detail: "Code checks done" });
   const prevLlmCodeByFile = /* @__PURE__ */ new Map();
   for (const cv of previousActiveCodeViolations) {
@@ -161703,7 +162362,7 @@ var require_form_data = __commonJS({
     var http = __require("http");
     var https = __require("https");
     var parseUrl = __require("url").parse;
-    var fs70 = __require("fs");
+    var fs71 = __require("fs");
     var Stream = __require("stream").Stream;
     var crypto6 = __require("crypto");
     var mime = require_mime_types();
@@ -161770,7 +162429,7 @@ var require_form_data = __commonJS({
         if (value.end != void 0 && value.end != Infinity && value.start != void 0) {
           callback(null, value.end + 1 - (value.start ? value.start : 0));
         } else {
-          fs70.stat(value.path, function(err, stat) {
+          fs71.stat(value.path, function(err, stat) {
             if (err) {
               callback(err);
               return;
@@ -162388,8 +163047,8 @@ var require_node2 = __commonJS({
           }
           break;
         case "FILE":
-          var fs70 = __require("fs");
-          stream2 = new fs70.SyncWriteStream(fd2, { autoClose: false });
+          var fs71 = __require("fs");
+          stream2 = new fs71.SyncWriteStream(fd2, { autoClose: false });
           stream2._type = "fs";
           break;
         case "PIPE":
@@ -167488,21 +168147,21 @@ function node(getModule) {
     if (lineMatch) {
       let object;
       let method;
-      let functionName;
+      let functionName2;
       let typeName2;
       let methodName3;
       if (lineMatch[1]) {
-        functionName = lineMatch[1];
-        let methodStart = functionName.lastIndexOf(".");
-        if (functionName[methodStart - 1] === ".") {
+        functionName2 = lineMatch[1];
+        let methodStart = functionName2.lastIndexOf(".");
+        if (functionName2[methodStart - 1] === ".") {
           methodStart--;
         }
         if (methodStart > 0) {
-          object = functionName.slice(0, methodStart);
-          method = functionName.slice(methodStart + 1);
+          object = functionName2.slice(0, methodStart);
+          method = functionName2.slice(methodStart + 1);
           const objectEnd = object.indexOf(".Module");
           if (objectEnd > 0) {
-            functionName = functionName.slice(objectEnd + 1);
+            functionName2 = functionName2.slice(objectEnd + 1);
             object = object.slice(0, objectEnd);
           }
         }
@@ -167514,11 +168173,11 @@ function node(getModule) {
       }
       if (method === "<anonymous>") {
         methodName3 = void 0;
-        functionName = void 0;
+        functionName2 = void 0;
       }
-      if (functionName === void 0) {
+      if (functionName2 === void 0) {
         methodName3 = methodName3 || UNKNOWN_FUNCTION;
-        functionName = typeName2 ? `${typeName2}.${methodName3}` : methodName3;
+        functionName2 = typeName2 ? `${typeName2}.${methodName3}` : methodName3;
       }
       let filename = lineMatch[2]?.startsWith("file://") ? lineMatch[2].slice(7) : lineMatch[2];
       const isNative = lineMatch[5] === "native";
@@ -167531,7 +168190,7 @@ function node(getModule) {
       return {
         filename: filename ? decodeURI(filename) : void 0,
         module: getModule ? getModule(filename) : void 0,
-        function: functionName,
+        function: functionName2,
         lineno: _parseIntOrUndefined(lineMatch[3]),
         colno: _parseIntOrUndefined(lineMatch[4]),
         in_app: filenameIsInApp(filename || "", isNative),
@@ -170369,7 +171028,7 @@ function readToolVersion() {
   if (cachedVersion)
     return cachedVersion;
   if (true) {
-    cachedVersion = "0.7.0-next.4";
+    cachedVersion = "0.7.0-next.5";
     return cachedVersion;
   }
   try {
@@ -172775,13 +173434,13 @@ var init_pexprs_toFailure = __esm({
       return new Failure(this, "a Unicode [" + this.categoryOrProp + "] character", "description");
     };
     Alt.prototype.toFailure = function(grammar2) {
-      const fs70 = this.terms.map((t2) => t2.toFailure(grammar2));
-      const description = "(" + fs70.join(" or ") + ")";
+      const fs71 = this.terms.map((t2) => t2.toFailure(grammar2));
+      const description = "(" + fs71.join(" or ") + ")";
       return new Failure(this, description, "description");
     };
     Seq.prototype.toFailure = function(grammar2) {
-      const fs70 = this.factors.map((f2) => f2.toFailure(grammar2));
-      const description = "(" + fs70.join(" ") + ")";
+      const fs71 = this.factors.map((f2) => f2.toFailure(grammar2));
+      const description = "(" + fs71.join(" ") + ")";
       return new Failure(this, description, "description");
     };
     Iter.prototype.toFailure = function(grammar2) {
@@ -174618,9 +175277,9 @@ function buildGrammar2(match4, namespace, optOhmGrammarForTesting, options) {
         decl.withSuperGrammar(namespace[superGrammarName]);
       }
     },
-    Rule_define(n, fs70, d3, _2, b) {
+    Rule_define(n, fs71, d3, _2, b) {
       currentRuleName = n.visit();
-      currentRuleFormals = fs70.children.map((c2) => c2.visit())[0] || [];
+      currentRuleFormals = fs71.children.map((c2) => c2.visit())[0] || [];
       if (!decl.defaultStartRule && decl.ensureSuperGrammar() !== Grammar.ProtoBuiltInRules) {
         decl.withDefaultStartRule(currentRuleName);
       }
@@ -174629,9 +175288,9 @@ function buildGrammar2(match4, namespace, optOhmGrammarForTesting, options) {
       const source = this.source.trimmed();
       return decl.define(currentRuleName, currentRuleFormals, body, description, source);
     },
-    Rule_override(n, fs70, _2, b) {
+    Rule_override(n, fs71, _2, b) {
       currentRuleName = n.visit();
-      currentRuleFormals = fs70.children.map((c2) => c2.visit())[0] || [];
+      currentRuleFormals = fs71.children.map((c2) => c2.visit())[0] || [];
       const source = this.source.trimmed();
       decl.ensureSuperGrammarRuleForOverriding(currentRuleName, source);
       overriding = true;
@@ -174639,9 +175298,9 @@ function buildGrammar2(match4, namespace, optOhmGrammarForTesting, options) {
       overriding = false;
       return decl.override(currentRuleName, currentRuleFormals, body, null, source);
     },
-    Rule_extend(n, fs70, _2, b) {
+    Rule_extend(n, fs71, _2, b) {
       currentRuleName = n.visit();
-      currentRuleFormals = fs70.children.map((c2) => c2.visit())[0] || [];
+      currentRuleFormals = fs71.children.map((c2) => c2.visit())[0] || [];
       const body = b.visit();
       const source = this.source.trimmed();
       return decl.extend(currentRuleName, currentRuleFormals, body, null, source);
@@ -174668,8 +175327,8 @@ function buildGrammar2(match4, namespace, optOhmGrammarForTesting, options) {
         return builder.alt(...args).withSource(this.source);
       }
     },
-    Formals(opointy, fs70, cpointy) {
-      return fs70.visit();
+    Formals(opointy, fs71, cpointy) {
+      return fs71.visit();
     },
     Params(opointy, ps, cpointy) {
       return ps.visit();
@@ -174831,8 +175490,8 @@ function initPrototypeParser(grammar2) {
         formals: optFormals.children.map((c2) => c2.parse())[0] || []
       };
     },
-    Formals(oparen, fs70, cparen) {
-      return fs70.asIteration().children.map((c2) => c2.parse());
+    Formals(oparen, fs71, cparen) {
+      return fs71.asIteration().children.map((c2) => c2.parse());
     },
     name(first2, rest) {
       return this.sourceString;
@@ -178280,9 +178939,9 @@ var init_conformance = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/source-walker.js
-import fs30 from "node:fs";
+import fs31 from "node:fs";
 import path33 from "node:path";
-function isTestFile3(filePath) {
+function isTestFile4(filePath) {
   const parts = filePath.replace(/\\/g, "/").split("/");
   const fileName = parts[parts.length - 1] ?? "";
   if (/\.(test|spec)\.[mc]?[jt]sx?$/.test(fileName))
@@ -178299,7 +178958,7 @@ async function eachParsedSource(rootDir, visit) {
   const walk20 = (dir) => {
     let entries;
     try {
-      entries = fs30.readdirSync(dir, { withFileTypes: true });
+      entries = fs31.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -178315,14 +178974,14 @@ async function eachParsedSource(rootDir, visit) {
       }
       if (!entry.isFile())
         continue;
-      if (isTestFile3(full))
+      if (isTestFile4(full))
         continue;
       const lang = EXT_TO_LANG[path33.extname(entry.name)];
       if (!lang)
         continue;
       let source;
       try {
-        source = fs30.readFileSync(full, "utf-8");
+        source = fs31.readFileSync(full, "utf-8");
       } catch {
         continue;
       }
@@ -178433,19 +179092,19 @@ function readCsharpString(node2, source) {
   }
   if (node2.type === "interpolated_string_expression") {
     let text4 = "";
-    let hasInterpolation2 = false;
+    let hasInterpolation = false;
     for (let i = 0; i < node2.namedChildCount; i++) {
       const c2 = node2.namedChild(i);
       if (!c2)
         continue;
       if (c2.type === "interpolation") {
         text4 += " /*INTERP*/ ";
-        hasInterpolation2 = true;
+        hasInterpolation = true;
       } else {
         text4 += source.slice(c2.startIndex, c2.endIndex);
       }
     }
-    return { text: text4, hasInterpolation: hasInterpolation2 };
+    return { text: text4, hasInterpolation };
   }
   if (node2.type === "binary_expression") {
     const op = node2.childForFieldName("operator");
@@ -180410,7 +181069,7 @@ var init_operation_aspnet = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/file-based-routes.js
-import fs31 from "node:fs";
+import fs32 from "node:fs";
 import path34 from "node:path";
 async function extractFileBasedRoutesFromDir(rootDir) {
   await initParsers();
@@ -180429,7 +181088,7 @@ function findDirs(rootDir, wantedRel) {
   const visit = (dir) => {
     let entries;
     try {
-      entries = fs31.readdirSync(dir, { withFileTypes: true });
+      entries = fs32.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -180455,7 +181114,7 @@ function findDirs(rootDir, wantedRel) {
 function walkRoot(rootAbs, root2, out) {
   const tcIgnore = loadTcIgnore(rootAbs);
   const visit = (dir) => {
-    for (const entry of fs31.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs32.readdirSync(dir, { withFileTypes: true })) {
       if (entry.name === "node_modules" || entry.name === ".git")
         continue;
       const full = path34.join(dir, entry.name);
@@ -180480,7 +181139,7 @@ function walkRoot(rootAbs, root2, out) {
       const url = deriveUrl(relUnderRoot, root2);
       if (url === null)
         continue;
-      const source = fs31.readFileSync(full, "utf-8");
+      const source = fs32.readFileSync(full, "utf-8");
       const lang = ext2 === ".tsx" ? "tsx" : ext2 === ".ts" ? "typescript" : "javascript";
       let tree;
       try {
@@ -180620,7 +181279,7 @@ var init_file_based_routes = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/mount-graph.js
-import fs32 from "node:fs";
+import fs33 from "node:fs";
 import path35 from "node:path";
 function analyzeRouterFile(filePath, source, tree) {
   const declarations = [];
@@ -180771,7 +181430,7 @@ function resolveImportPath(fromFile, spec) {
   ];
   for (const c2 of candidates) {
     const abs = path35.resolve(baseDir, c2);
-    if (fs32.existsSync(abs) && fs32.statSync(abs).isFile())
+    if (fs33.existsSync(abs) && fs33.statSync(abs).isFile())
       return abs;
   }
   return null;
@@ -180956,7 +181615,7 @@ var init_mount_graph = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/auth-presence.js
-import fs33 from "node:fs";
+import fs34 from "node:fs";
 import path36 from "node:path";
 async function detectAuthPresence(rootDir) {
   await initParsers();
@@ -180967,7 +181626,7 @@ async function detectAuthPresence(rootDir) {
   const scanned = [];
   const tcIgnore = loadTcIgnore(rootDir);
   const visit = (dir) => {
-    for (const entry of fs33.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs34.readdirSync(dir, { withFileTypes: true })) {
       if (entry.name === "node_modules" || entry.name === ".git")
         continue;
       const full = path36.join(dir, entry.name);
@@ -180982,7 +181641,7 @@ async function detectAuthPresence(rootDir) {
       const ext2 = path36.extname(entry.name);
       if (!TS_EXT2.has(ext2))
         continue;
-      const source = fs33.readFileSync(full, "utf-8");
+      const source = fs34.readFileSync(full, "utf-8");
       const lang = ext2 === ".tsx" ? "tsx" : ext2 === ".ts" ? "typescript" : "javascript";
       let tree;
       try {
@@ -181075,7 +181734,7 @@ function resolveImportPath2(importingFile, sourceStr) {
       candidates.push(path36.join(baseRaw, `index${ext2}`));
   }
   for (const c2 of candidates) {
-    if (fs33.existsSync(c2) && fs33.statSync(c2).isFile())
+    if (fs34.existsSync(c2) && fs34.statSync(c2).isFile())
       return c2;
   }
   return null;
@@ -181167,7 +181826,7 @@ var init_auth_presence = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/idempotency-presence.js
-import fs34 from "node:fs";
+import fs35 from "node:fs";
 import path37 from "node:path";
 function routeKey(filePath, declarationLine) {
   return `${filePath}::${declarationLine}`;
@@ -181180,7 +181839,7 @@ async function detectIdempotencyPresence(rootDir, requestHeader) {
   const scanned = [];
   const tcIgnore = loadTcIgnore(rootDir);
   const visit = (dir) => {
-    for (const entry of fs34.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs35.readdirSync(dir, { withFileTypes: true })) {
       if (entry.name === "node_modules" || entry.name === ".git")
         continue;
       const full = path37.join(dir, entry.name);
@@ -181195,7 +181854,7 @@ async function detectIdempotencyPresence(rootDir, requestHeader) {
       const ext2 = path37.extname(entry.name);
       if (!TS_EXT3.has(ext2))
         continue;
-      const source = fs34.readFileSync(full, "utf-8");
+      const source = fs35.readFileSync(full, "utf-8");
       const lang = ext2 === ".tsx" ? "tsx" : ext2 === ".ts" ? "typescript" : "javascript";
       let tree;
       try {
@@ -181426,7 +182085,7 @@ function resolveImportPath3(importingFile, sourceStr) {
       candidates.push(path37.join(baseRaw, `index${ext2}`));
   }
   for (const c2 of candidates) {
-    if (fs34.existsSync(c2) && fs34.statSync(c2).isFile())
+    if (fs35.existsSync(c2) && fs35.statSync(c2).isFile())
       return c2;
   }
   return null;
@@ -182448,14 +183107,14 @@ function getSqlText(node2, source) {
   return { text: source.slice(node2.startIndex, node2.endIndex), hasInterpolation: false };
 }
 function extractFromSqlSource(sqlNode, filePath, source) {
-  const { text: text4, hasInterpolation: hasInterpolation2 } = getSqlText(sqlNode, source);
-  return buildQueriesFromSqlText(text4, hasInterpolation2, {
+  const { text: text4, hasInterpolation } = getSqlText(sqlNode, source);
+  return buildQueriesFromSqlText(text4, hasInterpolation, {
     filePath,
     lineStart: sqlNode.startPosition.row + 1,
     lineEnd: sqlNode.endPosition.row + 1
   });
 }
-function buildQueriesFromSqlText(text4, hasInterpolation2, loc, adapterName = "raw-sql") {
+function buildQueriesFromSqlText(text4, hasInterpolation, loc, adapterName = "raw-sql") {
   if (!text4 || !/\bSELECT\b/i.test(text4))
     return [];
   const blocks = splitSelectBlocks(text4);
@@ -182474,7 +183133,7 @@ function buildQueriesFromSqlText(text4, hasInterpolation2, loc, adapterName = "r
       else
         unparseable.push({ reason: "unrecognised SQL predicate", raw: piece });
     }
-    if (hasInterpolation2) {
+    if (hasInterpolation) {
       unparseable.push({ reason: "string-interpolation substitution skipped", raw: "${...}" });
     }
     out.push({
@@ -182836,7 +183495,7 @@ function pySqlText(node2, source) {
 function readPyStringNode(node2, source) {
   if (node2.type === "concatenated_string") {
     let text5 = "";
-    let hasInterpolation3 = false;
+    let hasInterpolation2 = false;
     for (let i = 0; i < node2.namedChildCount; i++) {
       const c2 = node2.namedChild(i);
       if (!c2)
@@ -182844,15 +183503,15 @@ function readPyStringNode(node2, source) {
       const part = readPyStringNode(c2, source);
       if (part) {
         text5 += part.text;
-        hasInterpolation3 = hasInterpolation3 || part.hasInterpolation;
+        hasInterpolation2 = hasInterpolation2 || part.hasInterpolation;
       }
     }
-    return { text: text5, hasInterpolation: hasInterpolation3 };
+    return { text: text5, hasInterpolation: hasInterpolation2 };
   }
   if (node2.type !== "string")
     return null;
   let text4 = "";
-  let hasInterpolation2 = false;
+  let hasInterpolation = false;
   for (let i = 0; i < node2.namedChildCount; i++) {
     const c2 = node2.namedChild(i);
     if (!c2)
@@ -182861,10 +183520,10 @@ function readPyStringNode(node2, source) {
       text4 += source.slice(c2.startIndex, c2.endIndex);
     else if (c2.type === "interpolation") {
       text4 += " /*INTERP*/ ";
-      hasInterpolation2 = true;
+      hasInterpolation = true;
     }
   }
-  return { text: text4, hasInterpolation: hasInterpolation2 };
+  return { text: text4, hasInterpolation };
 }
 var SQL_HOST_METHODS, SQL_TAG_NAMES, COL, VAL, PY_SQL_EXEC_METHODS;
 var init_raw_sql = __esm({
@@ -184811,7 +185470,7 @@ var init_minimatch = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/manifests.js
-import fs35 from "node:fs";
+import fs36 from "node:fs";
 import path39 from "node:path";
 function collectDependencies(rootDir) {
   const out = [];
@@ -184819,7 +185478,7 @@ function collectDependencies(rootDir) {
   const visit = (dir) => {
     let entries;
     try {
-      entries = fs35.readdirSync(dir, { withFileTypes: true });
+      entries = fs36.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -184857,7 +185516,7 @@ function collectDependencies(rootDir) {
 function readPackageJson(filePath) {
   let pkg;
   try {
-    pkg = JSON.parse(fs35.readFileSync(filePath, "utf-8"));
+    pkg = JSON.parse(fs36.readFileSync(filePath, "utf-8"));
   } catch {
     return [];
   }
@@ -184882,7 +185541,7 @@ function pyDistName(spec) {
 function readRequirements(filePath) {
   let text4;
   try {
-    text4 = fs35.readFileSync(filePath, "utf-8");
+    text4 = fs36.readFileSync(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -184897,7 +185556,7 @@ function readRequirements(filePath) {
 function readPyproject(filePath) {
   let text4;
   try {
-    text4 = fs35.readFileSync(filePath, "utf-8");
+    text4 = fs36.readFileSync(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -184922,7 +185581,7 @@ function readPyproject(filePath) {
 function readSetupPy(filePath) {
   let text4;
   try {
-    text4 = fs35.readFileSync(filePath, "utf-8");
+    text4 = fs36.readFileSync(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -184940,7 +185599,7 @@ function readSetupPy(filePath) {
 function readXmlPackageTags(filePath, tag, idAttr, versionAttr, field) {
   let text4;
   try {
-    text4 = fs35.readFileSync(filePath, "utf-8");
+    text4 = fs36.readFileSync(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -184992,7 +185651,7 @@ var init_manifests = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/forbidden/index.js
-import fs36 from "node:fs";
+import fs37 from "node:fs";
 import path40 from "node:path";
 function detectForbiddenFiles(rootDir, pattern) {
   const out = [];
@@ -185000,7 +185659,7 @@ function detectForbiddenFiles(rootDir, pattern) {
   const visit = (dir) => {
     let entries;
     try {
-      entries = fs36.readdirSync(dir, { withFileTypes: true });
+      entries = fs37.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -185237,7 +185896,7 @@ function detectFlagInConfigFiles(rootDir, name) {
   const visit = (dir) => {
     let entries;
     try {
-      entries = fs36.readdirSync(dir, { withFileTypes: true });
+      entries = fs37.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -185256,7 +185915,7 @@ function detectFlagInConfigFiles(rootDir, name) {
         continue;
       let source;
       try {
-        source = fs36.readFileSync(full, "utf-8");
+        source = fs37.readFileSync(full, "utf-8");
       } catch {
         continue;
       }
@@ -188315,7 +188974,7 @@ var init_emission_facts = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/entity-schema/index.js
-import fs37 from "node:fs";
+import fs38 from "node:fs";
 import path41 from "node:path";
 async function extractEntitiesFromDir(rootDir) {
   const tcIgnore = loadTcIgnore(rootDir);
@@ -188323,7 +188982,7 @@ async function extractEntitiesFromDir(rootDir) {
   const walk20 = (dir) => {
     let entries;
     try {
-      entries = fs37.readdirSync(dir, { withFileTypes: true });
+      entries = fs38.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -188336,7 +188995,7 @@ async function extractEntitiesFromDir(rootDir) {
       if (e.isDirectory())
         walk20(full);
       else if (e.isFile() && e.name.endsWith(".prisma")) {
-        out.push(...parsePrismaModels(full, fs37.readFileSync(full, "utf-8")));
+        out.push(...parsePrismaModels(full, fs38.readFileSync(full, "utf-8")));
       }
     }
   };
@@ -189958,7 +190617,7 @@ var init_characteristic_imports = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/architecture/shared/config-files.js
-import fs38 from "node:fs";
+import fs39 from "node:fs";
 import path42 from "node:path";
 function collectFileIndex(rootDir) {
   const files = [];
@@ -189967,7 +190626,7 @@ function collectFileIndex(rootDir) {
   const visit = (dir) => {
     let entries;
     try {
-      entries = fs38.readdirSync(dir, { withFileTypes: true });
+      entries = fs39.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -189993,7 +190652,7 @@ function collectFileIndex(rootDir) {
         return cache3.get(relPath);
       let text4;
       try {
-        text4 = fs38.readFileSync(path42.join(rootDir, relPath), "utf-8");
+        text4 = fs39.readFileSync(path42.join(rootDir, relPath), "utf-8");
       } catch {
         text4 = null;
       }
@@ -190450,9 +191109,9 @@ __export(extractor_exports, {
   extractValidationRulesFromDir: () => extractValidationRulesFromDir,
   getArchitectureDetector: () => getArchitectureDetector
 });
-import fs39 from "node:fs";
+import fs40 from "node:fs";
 import path44 from "node:path";
-function isTestFile4(filePath) {
+function isTestFile5(filePath) {
   const parts = filePath.replace(/\\/g, "/").split("/");
   const fileName = parts[parts.length - 1];
   if (/\.(test|spec)\.(t|j)sx?$/.test(fileName))
@@ -190467,7 +191126,7 @@ async function extractOperationsFromDir(rootDir) {
   const fileAnalyses = [];
   const tcIgnore = loadTcIgnore(rootDir);
   const visit = (dir) => {
-    for (const entry of fs39.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs40.readdirSync(dir, { withFileTypes: true })) {
       if (entry.name === "node_modules" || entry.name === ".git")
         continue;
       const full = path44.join(dir, entry.name);
@@ -190482,9 +191141,9 @@ async function extractOperationsFromDir(rootDir) {
       const ext2 = path44.extname(entry.name);
       if (!TS_EXT4.has(ext2))
         continue;
-      if (isTestFile4(full))
+      if (isTestFile5(full))
         continue;
-      const source = fs39.readFileSync(full, "utf-8");
+      const source = fs40.readFileSync(full, "utf-8");
       const lang = ext2 === ".ts" || ext2 === ".tsx" ? ext2 === ".tsx" ? "tsx" : "typescript" : "javascript";
       let tree;
       try {
@@ -192934,17 +193593,17 @@ var init_symbol_index = __esm({
 });
 
 // packages/contract-verifier/dist/verify.js
-import fs40 from "node:fs";
+import fs41 from "node:fs";
 import path46 from "node:path";
 async function verify(opts) {
   const specFiles = [];
   walkTcFiles(opts.contractsDir, (filePath) => {
-    specFiles.push({ path: filePath, source: fs40.readFileSync(filePath, "utf-8") });
+    specFiles.push({ path: filePath, source: fs41.readFileSync(filePath, "utf-8") });
   }, opts.includeInferred ?? false);
   const baseFiles = [];
-  if (opts.baseContractsDir && fs40.existsSync(opts.baseContractsDir)) {
+  if (opts.baseContractsDir && fs41.existsSync(opts.baseContractsDir)) {
     walkTcFiles(opts.baseContractsDir, (filePath) => {
-      const source = fs40.readFileSync(filePath, "utf-8");
+      const source = fs41.readFileSync(filePath, "utf-8");
       baseFiles.push(parseTcFile(filePath, source));
     }, opts.includeInferred ?? false);
   }
@@ -193334,7 +193993,7 @@ async function verify(opts) {
   };
 }
 function walkTcFiles(rootDir, visit, includeInferred) {
-  for (const entry of fs40.readdirSync(rootDir, { withFileTypes: true })) {
+  for (const entry of fs41.readdirSync(rootDir, { withFileTypes: true })) {
     const full = path46.join(rootDir, entry.name);
     if (entry.isDirectory()) {
       if (!includeInferred && entry.name === "_inferred")
@@ -193629,7 +194288,7 @@ var init_serialize = __esm({
 });
 
 // packages/contract-verifier/dist/infer/index.js
-import fs41 from "node:fs";
+import fs42 from "node:fs";
 import path48 from "node:path";
 async function infer(opts) {
   const authored = loadAuthored(opts.contractsDir);
@@ -193657,7 +194316,7 @@ async function infer(opts) {
 function loadAuthored(contractsDir) {
   const files = [];
   walkAuthoredTcFiles(contractsDir, (filePath) => {
-    files.push({ path: filePath, source: fs41.readFileSync(filePath, "utf-8") });
+    files.push({ path: filePath, source: fs42.readFileSync(filePath, "utf-8") });
   });
   return parseAndResolve(files).index;
 }
@@ -194342,21 +195001,21 @@ function writeInferred(contractsDir, decisions, options = {}) {
       proposed.push(filePath);
       continue;
     }
-    fs41.mkdirSync(path48.dirname(filePath), { recursive: true });
-    const existing = fs41.existsSync(filePath) ? fs41.readFileSync(filePath, "utf-8") : null;
+    fs42.mkdirSync(path48.dirname(filePath), { recursive: true });
+    const existing = fs42.existsSync(filePath) ? fs42.readFileSync(filePath, "utf-8") : null;
     if (existing === r.tcSource)
       continue;
-    fs41.writeFileSync(filePath, r.tcSource);
+    fs42.writeFileSync(filePath, r.tcSource);
     written.push(filePath);
   }
-  if (!options.dryRun && fs41.existsSync(root2))
+  if (!options.dryRun && fs42.existsSync(root2))
     pruneStale(root2, live);
   return { written, proposed };
 }
 function walkAuthoredTcFiles(rootDir, visit) {
-  if (!fs41.existsSync(rootDir))
+  if (!fs42.existsSync(rootDir))
     return;
-  for (const entry of fs41.readdirSync(rootDir, { withFileTypes: true })) {
+  for (const entry of fs42.readdirSync(rootDir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
       if (entry.name === INFERRED_DIR)
         continue;
@@ -194372,22 +195031,22 @@ function toRelCode(codeDir, fp) {
 }
 function pruneStale(root2, live) {
   const visit = (dir) => {
-    if (!fs41.existsSync(dir))
+    if (!fs42.existsSync(dir))
       return false;
     let dirEmpty = true;
-    for (const entry of fs41.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs42.readdirSync(dir, { withFileTypes: true })) {
       const full = path48.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (visit(full)) {
           try {
-            fs41.rmdirSync(full);
+            fs42.rmdirSync(full);
           } catch {
           }
         } else {
           dirEmpty = false;
         }
       } else if (entry.isFile() && entry.name.endsWith(".tc") && !live.has(full)) {
-        fs41.unlinkSync(full);
+        fs42.unlinkSync(full);
       } else {
         dirEmpty = false;
       }
@@ -194553,6 +195212,7 @@ async function runAdd(options = {}) {
 // tools/cli/src/commands/analyze.ts
 init_dist4();
 init_transport();
+import fs17 from "node:fs";
 import path21 from "node:path";
 
 // packages/core/dist/commands/analyze-in-process.js
@@ -194842,6 +195502,30 @@ async function resolveOrInitProject() {
   ensureRepoTruecourseDir(repoDir);
   return registerProject(repoDir);
 }
+function repoHasCSharp(root2) {
+  const SKIP = /* @__PURE__ */ new Set(["node_modules", "bin", "obj", ".git", ".truecourse", "dist", ".vs"]);
+  let budget = 2e4;
+  const stack2 = [root2];
+  while (stack2.length > 0) {
+    if (budget-- <= 0) return false;
+    const dir = stack2.pop();
+    let entries;
+    try {
+      entries = fs17.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const e of entries) {
+      if (e.isDirectory()) {
+        if (SKIP.has(e.name) || e.name.startsWith(".")) continue;
+        stack2.push(path21.join(dir, e.name));
+      } else if (e.name.endsWith(".cs")) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
 var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 var PRE_LLM_STEPS = /* @__PURE__ */ new Set(["parse", "scan"]);
 var spinnerFrame = 0;
@@ -194980,7 +195664,7 @@ async function runAnalyze(options = {}) {
   if (wipeLegacyPostgresData()) {
     O2.info("Legacy Postgres data wiped. Re-analyze to repopulate.");
   }
-  const stepDefs = buildAnalysisSteps(enabledCategories, enableLlmRules);
+  const stepDefs = buildAnalysisSteps(enabledCategories, enableLlmRules, repoHasCSharp(project.path));
   const tracker = new StepTracker((payload) => {
     if (payload.steps) renderSteps(payload.steps);
   }, stepDefs);
@@ -195054,7 +195738,7 @@ async function runAnalyzeDiff(options = {}) {
   const enableLlmRules = llmDecision.enabled;
   if (enableLlmRules) await preflightClaudeOrExit();
   renderPhase = enableLlmRules ? "pre-llm" : "all";
-  const stepDefs = buildAnalysisSteps(enabledCategories, enableLlmRules);
+  const stepDefs = buildAnalysisSteps(enabledCategories, enableLlmRules, repoHasCSharp(project.path));
   const tracker = new StepTracker((payload) => {
     if (payload.steps) renderSteps(payload.steps);
   }, stepDefs);
@@ -195117,24 +195801,24 @@ init_paths();
 init_registry();
 init_helpers();
 import { spawn as spawn7 } from "node:child_process";
-import fs21 from "node:fs";
+import fs22 from "node:fs";
 import path26 from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 
 // tools/cli/src/commands/service/macos.ts
-import fs18 from "node:fs";
+import fs19 from "node:fs";
 import path22 from "node:path";
 import os5 from "node:os";
 import { execSync } from "node:child_process";
 
 // tools/cli/src/commands/service/env.ts
-import fs17 from "node:fs";
+import fs18 from "node:fs";
 function parseEnvFile(filePath) {
   const vars = {};
-  if (!fs17.existsSync(filePath)) {
+  if (!fs18.existsSync(filePath)) {
     return vars;
   }
-  const content = fs17.readFileSync(filePath, "utf-8");
+  const content = fs18.readFileSync(filePath, "utf-8");
   for (const line of content.split("\n")) {
     const trimmed2 = line.trim();
     if (!trimmed2 || trimmed2.startsWith("#")) continue;
@@ -195205,10 +195889,10 @@ var MacOSService = class {
     }
     envVars.TRUECOURSE_LOG_DIR = path22.dirname(logPath);
     envVars.TRUECOURSE_HOME = path22.join(os5.homedir(), ".truecourse");
-    fs18.mkdirSync(PLIST_DIR, { recursive: true });
-    fs18.mkdirSync(path22.dirname(logPath), { recursive: true });
+    fs19.mkdirSync(PLIST_DIR, { recursive: true });
+    fs19.mkdirSync(path22.dirname(logPath), { recursive: true });
     const plist = buildPlist(serverPath, logPath, envVars);
-    fs18.writeFileSync(PLIST_PATH, plist, "utf-8");
+    fs19.writeFileSync(PLIST_PATH, plist, "utf-8");
     execSync(`launchctl load -w "${PLIST_PATH}"`, { stdio: "pipe" });
   }
   async uninstall() {
@@ -195216,12 +195900,12 @@ var MacOSService = class {
       execSync(`launchctl unload "${PLIST_PATH}"`, { stdio: "pipe" });
     } catch {
     }
-    if (fs18.existsSync(PLIST_PATH)) {
-      fs18.unlinkSync(PLIST_PATH);
+    if (fs19.existsSync(PLIST_PATH)) {
+      fs19.unlinkSync(PLIST_PATH);
     }
   }
   async start() {
-    if (!fs18.existsSync(PLIST_PATH)) {
+    if (!fs19.existsSync(PLIST_PATH)) {
       throw new Error("Service is not installed. Run 'truecourse service install' first.");
     }
     execSync(`launchctl load -w "${PLIST_PATH}"`, { stdio: "pipe" });
@@ -195251,12 +195935,12 @@ var MacOSService = class {
     }
   }
   async isInstalled() {
-    return fs18.existsSync(PLIST_PATH);
+    return fs19.existsSync(PLIST_PATH);
   }
 };
 
 // tools/cli/src/commands/service/linux.ts
-import fs19 from "node:fs";
+import fs20 from "node:fs";
 import path23 from "node:path";
 import os6 from "node:os";
 import { execSync as execSync2 } from "node:child_process";
@@ -195288,10 +195972,10 @@ WantedBy=default.target
 }
 var LinuxService = class {
   async install(serverPath, logPath) {
-    fs19.mkdirSync(UNIT_DIR, { recursive: true });
-    fs19.mkdirSync(path23.dirname(logPath), { recursive: true });
+    fs20.mkdirSync(UNIT_DIR, { recursive: true });
+    fs20.mkdirSync(path23.dirname(logPath), { recursive: true });
     const unit = buildUnitFile(serverPath, logPath);
-    fs19.writeFileSync(UNIT_PATH, unit, "utf-8");
+    fs20.writeFileSync(UNIT_PATH, unit, "utf-8");
     execSync2("systemctl --user daemon-reload", { stdio: "pipe" });
     execSync2(`systemctl --user enable ${SERVICE_NAME}`, { stdio: "pipe" });
   }
@@ -195304,8 +195988,8 @@ var LinuxService = class {
       execSync2(`systemctl --user disable ${SERVICE_NAME}`, { stdio: "pipe" });
     } catch {
     }
-    if (fs19.existsSync(UNIT_PATH)) {
-      fs19.unlinkSync(UNIT_PATH);
+    if (fs20.existsSync(UNIT_PATH)) {
+      fs20.unlinkSync(UNIT_PATH);
     }
     try {
       execSync2("systemctl --user daemon-reload", { stdio: "pipe" });
@@ -195334,7 +196018,7 @@ var LinuxService = class {
     }
   }
   async isInstalled() {
-    return fs19.existsSync(UNIT_PATH);
+    return fs20.existsSync(UNIT_PATH);
   }
 };
 
@@ -195444,7 +196128,7 @@ function getPlatform() {
 }
 
 // tools/cli/src/commands/service/logs.ts
-import fs20 from "node:fs";
+import fs21 from "node:fs";
 import path25 from "node:path";
 import os8 from "node:os";
 var MAX_LOG_SIZE2 = 10 * 1024 * 1024;
@@ -195462,32 +196146,32 @@ function getLogPath() {
   return path25.join(getLogDir(), "dashboard.log");
 }
 function existingLogFiles(logDir) {
-  if (!fs20.existsSync(logDir)) return [];
-  return fs20.readdirSync(logDir).filter((name) => /\.log$/.test(name)).sort().map((name) => path25.join(logDir, name));
+  if (!fs21.existsSync(logDir)) return [];
+  return fs21.readdirSync(logDir).filter((name) => /\.log$/.test(name)).sort().map((name) => path25.join(logDir, name));
 }
 function rotateOne(logFile) {
-  if (!fs20.existsSync(logFile)) return;
-  if (fs20.statSync(logFile).size < MAX_LOG_SIZE2) return;
+  if (!fs21.existsSync(logFile)) return;
+  if (fs21.statSync(logFile).size < MAX_LOG_SIZE2) return;
   for (let i = MAX_LOG_FILES2; i >= 1; i--) {
     const older = `${logFile}.${i}`;
     if (i === MAX_LOG_FILES2) {
-      if (fs20.existsSync(older)) fs20.unlinkSync(older);
+      if (fs21.existsSync(older)) fs21.unlinkSync(older);
     } else {
       const newer = `${logFile}.${i + 1}`;
-      if (fs20.existsSync(older)) fs20.renameSync(older, newer);
+      if (fs21.existsSync(older)) fs21.renameSync(older, newer);
     }
   }
-  fs20.renameSync(logFile, `${logFile}.1`);
+  fs21.renameSync(logFile, `${logFile}.1`);
 }
 function rotateLogs(logDir) {
   for (const name of ROTATABLE_LOG_NAMES) {
     rotateOne(path25.join(logDir, name));
   }
-  if (!fs20.existsSync(logDir)) return;
+  if (!fs21.existsSync(logDir)) return;
   for (const file of existingLogFiles(logDir)) rotateOne(file);
 }
 function readLastLines(filePath, maxLines) {
-  const content = fs20.readFileSync(filePath, "utf-8");
+  const content = fs21.readFileSync(filePath, "utf-8");
   const lines = content.split("\n");
   if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
   return lines.slice(-maxLines).join("\n");
@@ -195515,17 +196199,17 @@ function tailLogs() {
   }
   dumpLogTails(logDir);
   const sizes = /* @__PURE__ */ new Map();
-  for (const file of files) sizes.set(file, fs20.statSync(file).size);
+  for (const file of files) sizes.set(file, fs21.statSync(file).size);
   const watch = (file) => {
-    fs20.watchFile(file, { interval: POLL_INTERVAL_MS }, () => {
+    fs21.watchFile(file, { interval: POLL_INTERVAL_MS }, () => {
       try {
-        const newSize = fs20.statSync(file).size;
+        const newSize = fs21.statSync(file).size;
         const lastSize = sizes.get(file) ?? 0;
         if (newSize > lastSize) {
-          const fd = fs20.openSync(file, "r");
+          const fd = fs21.openSync(file, "r");
           const buf = Buffer.alloc(newSize - lastSize);
-          fs20.readSync(fd, buf, 0, buf.length, lastSize);
-          fs20.closeSync(fd);
+          fs21.readSync(fd, buf, 0, buf.length, lastSize);
+          fs21.closeSync(fd);
           const tag = `[${path25.basename(file)}] `;
           const text4 = buf.toString("utf-8");
           const tagged = text4.split("\n").map((line, i, arr) => i === arr.length - 1 && line === "" ? "" : tag + line).join("\n");
@@ -195540,7 +196224,7 @@ function tailLogs() {
   };
   for (const file of files) watch(file);
   const cleanup = () => {
-    for (const file of files) fs20.unwatchFile(file);
+    for (const file of files) fs21.unwatchFile(file);
     process.exit(0);
   };
   process.on("SIGINT", cleanup);
@@ -195556,7 +196240,7 @@ function resolveServerEntry() {
     // Source build output: tools/cli/dist → ../../../../dist/server.mjs
     path26.resolve(__dirname2, "..", "..", "..", "..", "dist", "server.mjs")
   ];
-  return candidates.find((p2) => fs21.existsSync(p2)) ?? null;
+  return candidates.find((p2) => fs22.existsSync(p2)) ?? null;
 }
 async function waitForHealth(url, timeoutMs = 3e4) {
   const start = Date.now();
@@ -195684,7 +196368,7 @@ async function runDashboard(options = {}) {
     );
     process.exit(1);
   }
-  const configured = fs21.existsSync(getConfigPath());
+  const configured = fs22.existsSync(getConfigPath());
   const needsDecision = !configured || options.reconfigure;
   let runMode;
   if (options.mode) {
@@ -196180,7 +196864,7 @@ async function runRulesReset({ ruleKey }) {
 
 // tools/cli/src/commands/contracts.ts
 init_dist4();
-import fs67 from "node:fs";
+import fs68 from "node:fs";
 import path73 from "node:path";
 
 // packages/spec-consolidator/dist/types.js
@@ -196414,7 +197098,7 @@ var CuratedCorpusSchema = external_exports.object({
 });
 
 // packages/spec-consolidator/dist/corpus-store.js
-import fs22 from "node:fs";
+import fs23 from "node:fs";
 import path27 from "node:path";
 var CORPUS_FILE = "corpus.json";
 function corpusFilePath(repoRoot5) {
@@ -196422,10 +197106,10 @@ function corpusFilePath(repoRoot5) {
 }
 function readCorpus(repoRoot5) {
   const file = corpusFilePath(repoRoot5);
-  if (!fs22.existsSync(file))
+  if (!fs23.existsSync(file))
     return null;
   try {
-    const raw = JSON.parse(fs22.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs23.readFileSync(file, "utf-8"));
     return CuratedCorpusSchema.parse(raw);
   } catch {
     return null;
@@ -196433,7 +197117,7 @@ function readCorpus(repoRoot5) {
 }
 function writeCorpus(repoRoot5, input) {
   const file = corpusFilePath(repoRoot5);
-  fs22.mkdirSync(path27.dirname(file), { recursive: true });
+  fs23.mkdirSync(path27.dirname(file), { recursive: true });
   const payload = {
     version: 3,
     // Caller may pass the timestamp it stamped on the in-memory corpus so the
@@ -196444,16 +197128,16 @@ function writeCorpus(repoRoot5, input) {
     relations: input.relations,
     skippedDocs: input.skippedDocs ?? []
   };
-  fs22.writeFileSync(file, JSON.stringify(payload, null, 2) + "\n");
+  fs23.writeFileSync(file, JSON.stringify(payload, null, 2) + "\n");
 }
 
 // packages/spec-consolidator/dist/area-tagger.js
 init_zod();
 import { createHash as createHash3 } from "node:crypto";
-import fs24 from "node:fs";
+import fs25 from "node:fs";
 
 // packages/llm/dist/cache-store.js
-import fs23 from "node:fs";
+import fs24 from "node:fs";
 import path28 from "node:path";
 var FileKvCacheStore = class {
   file(scope, cacheName, key4) {
@@ -196461,18 +197145,18 @@ var FileKvCacheStore = class {
   }
   async get(scope, cacheName, key4) {
     const file = this.file(scope, cacheName, key4);
-    if (!fs23.existsSync(file))
+    if (!fs24.existsSync(file))
       return null;
     try {
-      return JSON.parse(fs23.readFileSync(file, "utf-8"));
+      return JSON.parse(fs24.readFileSync(file, "utf-8"));
     } catch {
       return null;
     }
   }
   async set(scope, cacheName, key4, value) {
     const file = this.file(scope, cacheName, key4);
-    fs23.mkdirSync(path28.dirname(file), { recursive: true });
-    fs23.writeFileSync(file, JSON.stringify(value, null, 2));
+    fs24.mkdirSync(path28.dirname(file), { recursive: true });
+    fs24.writeFileSync(file, JSON.stringify(value, null, 2));
   }
 };
 var active6 = new FileKvCacheStore();
@@ -196554,7 +197238,7 @@ function docBody(doc) {
     return doc.content;
   if (doc.absPath) {
     try {
-      return fs24.readFileSync(doc.absPath, "utf-8");
+      return fs25.readFileSync(doc.absPath, "utf-8");
     } catch {
     }
   }
@@ -197159,7 +197843,7 @@ function spawnRelationRunner(opts = {}) {
 // packages/spec-consolidator/dist/overlap-detector.js
 init_zod();
 import { createHash as createHash7 } from "node:crypto";
-import fs25 from "node:fs";
+import fs26 from "node:fs";
 init_transport();
 var DEFAULT_MAX_PAIRS_PER_AREA = 60;
 async function flagOverlaps(repoRoot5, areas, docs, opts = {}) {
@@ -197340,7 +198024,7 @@ function docBody2(doc) {
     return doc.content;
   if (doc.absPath) {
     try {
-      return fs25.readFileSync(doc.absPath, "utf-8");
+      return fs26.readFileSync(doc.absPath, "utf-8");
     } catch {
     }
   }
@@ -197432,14 +198116,14 @@ async function writeCache3(scope, cacheKey, verdict) {
 
 // packages/spec-consolidator/dist/curate.js
 init_dist5();
-import fs28 from "node:fs";
+import fs29 from "node:fs";
 import path31 from "node:path";
 
 // packages/spec-consolidator/dist/discovery.js
 init_dist5();
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import fs26 from "node:fs";
+import fs27 from "node:fs";
 import path30 from "node:path";
 var SKIP_DIR_PROBE = "__tc_skipdir_probe__.md";
 var PREVIEW_LINE_LIMIT = 200;
@@ -197451,7 +198135,7 @@ function discoverDocs(rootDir, opts = {}) {
   const visit = (dir) => {
     let entries;
     try {
-      entries = fs26.readdirSync(dir, { withFileTypes: true });
+      entries = fs27.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -197490,8 +198174,8 @@ function makeCandidate(absPath, rootDir, previewLines, opts) {
   let content;
   let stat;
   try {
-    content = fs26.readFileSync(absPath, "utf-8");
-    stat = fs26.statSync(absPath);
+    content = fs27.readFileSync(absPath, "utf-8");
+    stat = fs27.statSync(absPath);
   } catch {
     return null;
   }
@@ -197559,7 +198243,7 @@ function looksLikePrd(content) {
 // packages/spec-consolidator/dist/relevance-filter.js
 init_zod();
 import { createHash as createHash9 } from "node:crypto";
-import fs27 from "node:fs";
+import fs28 from "node:fs";
 init_transport();
 function prefilterDocs(docs, manualIncludes = []) {
   const manualSet = new Set(manualIncludes);
@@ -197683,7 +198367,7 @@ function docBody3(doc) {
     return doc.content;
   if (doc.absPath) {
     try {
-      return fs27.readFileSync(doc.absPath, "utf-8");
+      return fs28.readFileSync(doc.absPath, "utf-8");
     } catch {
     }
   }
@@ -197944,10 +198628,10 @@ var EMPTY_DECISIONS = {
 };
 function readCorpusDecisions(repoRoot5) {
   const file = path31.join(repoRoot5, ".truecourse", "specs", "decisions.json");
-  if (!fs28.existsSync(file))
+  if (!fs29.existsSync(file))
     return EMPTY_DECISIONS;
   try {
-    const raw = JSON.parse(fs28.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs29.readFileSync(file, "utf-8"));
     return DecisionsFileSchema.parse(raw);
   } catch {
     return EMPTY_DECISIONS;
@@ -197955,7 +198639,7 @@ function readCorpusDecisions(repoRoot5) {
 }
 
 // packages/spec-consolidator/dist/orchestrator.js
-import fs29 from "node:fs";
+import fs30 from "node:fs";
 import path32 from "node:path";
 var EMPTY_DECISIONS2 = {
   version: 1,
@@ -197969,10 +198653,10 @@ function decisionsPath(repoRoot5) {
 }
 function readDecisions(repoRoot5) {
   const file = decisionsPath(repoRoot5);
-  if (!fs29.existsSync(file))
+  if (!fs30.existsSync(file))
     return EMPTY_DECISIONS2;
   try {
-    const raw = JSON.parse(fs29.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs30.readFileSync(file, "utf-8"));
     return DecisionsFileSchema.parse(raw);
   } catch {
     return EMPTY_DECISIONS2;
@@ -197980,8 +198664,8 @@ function readDecisions(repoRoot5) {
 }
 function writeDecisions(repoRoot5, decisions) {
   const file = decisionsPath(repoRoot5);
-  fs29.mkdirSync(path32.dirname(file), { recursive: true });
-  fs29.writeFileSync(file, JSON.stringify(decisions, null, 2) + "\n");
+  fs30.mkdirSync(path32.dirname(file), { recursive: true });
+  fs30.writeFileSync(file, JSON.stringify(decisions, null, 2) + "\n");
 }
 
 // packages/contract-extractor/dist/corpus-diff.js
@@ -198133,7 +198817,7 @@ function validateMerged(artifacts) {
 }
 
 // packages/contract-extractor/dist/writer.js
-import fs42 from "node:fs";
+import fs43 from "node:fs";
 import path49 from "node:path";
 
 // packages/contract-extractor/dist/identity.js
@@ -198170,14 +198854,14 @@ function writeContracts(repoRoot5, artifacts, options = {}) {
       proposed.push(req.filePath);
       continue;
     }
-    fs42.mkdirSync(path49.dirname(req.filePath), { recursive: true });
-    const existing = fs42.existsSync(req.filePath) ? fs42.readFileSync(req.filePath, "utf-8") : null;
+    fs43.mkdirSync(path49.dirname(req.filePath), { recursive: true });
+    const existing = fs43.existsSync(req.filePath) ? fs43.readFileSync(req.filePath, "utf-8") : null;
     if (existing === req.tcSource)
       continue;
-    fs42.writeFileSync(req.filePath, req.tcSource);
+    fs43.writeFileSync(req.filePath, req.tcSource);
     written.push(req.filePath);
   }
-  if (options.prune && !options.dryRun && fs42.existsSync(root2)) {
+  if (options.prune && !options.dryRun && fs43.existsSync(root2)) {
     const live = new Set(requests.map((r) => r.filePath));
     pruneStale2(root2, live);
   }
@@ -198243,16 +198927,16 @@ function inferKindDomain2(artifact) {
 }
 function pruneStale2(root2, live) {
   const visit = (dir) => {
-    if (!fs42.existsSync(dir))
+    if (!fs43.existsSync(dir))
       return false;
     let dirEmpty = true;
-    for (const entry of fs42.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs43.readdirSync(dir, { withFileTypes: true })) {
       const full = path49.join(dir, entry.name);
       if (entry.isDirectory()) {
         const childEmpty = visit(full);
         if (childEmpty) {
           try {
-            fs42.rmdirSync(full);
+            fs43.rmdirSync(full);
           } catch {
           }
         } else {
@@ -198260,7 +198944,7 @@ function pruneStale2(root2, live) {
         }
       } else if (entry.isFile()) {
         if (entry.name.endsWith(".tc") && !live.has(full)) {
-          fs42.unlinkSync(full);
+          fs43.unlinkSync(full);
         } else {
           dirEmpty = false;
         }
@@ -201192,7 +201876,7 @@ async function assembleArtifacts(ranked, slices, opts = {}) {
 }
 
 // packages/contract-extractor/dist/corpus-reader.js
-import fs43 from "node:fs";
+import fs44 from "node:fs";
 import path50 from "node:path";
 function hasCorpusSpec(repoRoot5) {
   return readCorpus(repoRoot5) !== null;
@@ -201290,7 +201974,7 @@ function orderByPrecedence(docs, areaId, relations) {
 }
 function defaultResolveContent(repoRoot5, ref) {
   try {
-    return fs43.readFileSync(path50.join(repoRoot5, ref), "utf-8");
+    return fs44.readFileSync(path50.join(repoRoot5, ref), "utf-8");
   } catch {
     return null;
   }
@@ -201431,7 +202115,7 @@ init_transport();
 init_dist8();
 
 // packages/contract-extractor/dist/manifest.js
-import fs44 from "node:fs";
+import fs45 from "node:fs";
 import path51 from "node:path";
 import { createHash as createHash12 } from "node:crypto";
 var MANIFEST_REL = path51.join(".truecourse", "contracts", "manifest.json");
@@ -201450,7 +202134,7 @@ function manifestPath(repoRoot5) {
 }
 function readManifest(repoRoot5) {
   try {
-    const raw = JSON.parse(fs44.readFileSync(manifestPath(repoRoot5), "utf-8"));
+    const raw = JSON.parse(fs45.readFileSync(manifestPath(repoRoot5), "utf-8"));
     if (raw && raw.version === 1 && raw.areas)
       return raw;
   } catch {
@@ -201459,8 +202143,8 @@ function readManifest(repoRoot5) {
 }
 function writeManifest(repoRoot5, manifest) {
   const file = manifestPath(repoRoot5);
-  fs44.mkdirSync(path51.dirname(file), { recursive: true });
-  fs44.writeFileSync(file, JSON.stringify(manifest, null, 2) + "\n");
+  fs45.mkdirSync(path51.dirname(file), { recursive: true });
+  fs45.writeFileSync(file, JSON.stringify(manifest, null, 2) + "\n");
 }
 function classifyAreas(areas, manifest) {
   const prev = manifest?.areas ?? {};
@@ -201919,7 +202603,7 @@ function spawnGenerateRunner(opts = {}) {
 
 // packages/core/dist/config/llm-models.js
 init_paths();
-import fs45 from "node:fs";
+import fs46 from "node:fs";
 var STAGE_DEFAULTS = {
   "spec.relevance": "haiku",
   // Area tagging is load-bearing (wrong tags → wrong generate inputs) and Haiku
@@ -201967,10 +202651,10 @@ function stageEnvVar(stageId) {
 }
 function readConfigSync(repoDir) {
   const file = getRepoConfigPath(repoDir);
-  if (!fs45.existsSync(file))
+  if (!fs46.existsSync(file))
     return {};
   try {
-    return JSON.parse(fs45.readFileSync(file, "utf-8"));
+    return JSON.parse(fs46.readFileSync(file, "utf-8"));
   } catch {
     return {};
   }
@@ -202043,7 +202727,7 @@ function describeStageResolutions(repoDir = resolveRepoDir(process.cwd())) {
 init_transport();
 
 // packages/core/dist/lib/llm-call-log.js
-import fs46 from "node:fs";
+import fs47 from "node:fs";
 import path52 from "node:path";
 import { randomUUID as randomUUID26 } from "node:crypto";
 function truthyEnv(v) {
@@ -202065,20 +202749,20 @@ function createLlmCallLogger(repoRoot5, label = "scan") {
   if (!log2 && !dump2)
     return null;
   const logDir = path52.join(repoRoot5, ".truecourse", "logs");
-  fs46.mkdirSync(logDir, { recursive: true });
+  fs47.mkdirSync(logDir, { recursive: true });
   const runId = `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}_${randomUUID26().slice(0, 8)}`;
   const callsPath = path52.join(logDir, `llm-${label}-${runId}.jsonl`);
   const summaryPath = path52.join(logDir, `llm-${label}-${runId}.summary.json`);
   const ioDir = dump2 ? path52.join(logDir, `llm-${label}-${runId}.io`) : null;
   if (ioDir)
-    fs46.mkdirSync(ioDir, { recursive: true });
+    fs47.mkdirSync(ioDir, { recursive: true });
   const createdAt = Date.now();
   const records = [];
   let seq2 = 0;
   let finished = false;
   let fd = null;
   try {
-    fd = fs46.openSync(callsPath, "a");
+    fd = fs47.openSync(callsPath, "a");
   } catch {
     fd = null;
   }
@@ -202088,14 +202772,14 @@ function createLlmCallLogger(repoRoot5, label = "scan") {
     records.push(metrics);
     if (fd !== null) {
       try {
-        fs46.writeSync(fd, JSON.stringify(metrics) + "\n");
+        fs47.writeSync(fd, JSON.stringify(metrics) + "\n");
       } catch {
       }
     }
     if (ioDir) {
       const fname = `${String(seq2).padStart(5, "0")}-${sanitize3(rec.id) || rec.stage}.json`;
       try {
-        fs46.writeFileSync(path52.join(ioDir, fname), JSON.stringify({
+        fs47.writeFileSync(path52.join(ioDir, fname), JSON.stringify({
           stage: rec.stage,
           model: rec.model,
           ok: rec.ok,
@@ -202125,13 +202809,13 @@ function createLlmCallLogger(repoRoot5, label = "scan") {
       process.removeListener(sig, h);
     if (fd !== null) {
       try {
-        fs46.closeSync(fd);
+        fs47.closeSync(fd);
       } catch {
       }
     }
     const summary = summarizeLlmCalls(records, elapsedMs);
     try {
-      fs46.writeFileSync(summaryPath, JSON.stringify(summary, null, 2));
+      fs47.writeFileSync(summaryPath, JSON.stringify(summary, null, 2));
     } catch {
     }
     printSummary(summary, callsPath, ioDir);
@@ -202261,7 +202945,7 @@ import crypto5 from "node:crypto";
 
 // packages/guard-runner/dist/recipe.js
 init_zod();
-import fs47 from "node:fs";
+import fs48 from "node:fs";
 import path53 from "node:path";
 import crypto3 from "node:crypto";
 var RecipeSchema = external_exports.object({
@@ -202281,11 +202965,11 @@ var FINGERPRINT_INPUTS = [
 var RecipeError = class extends Error {
 };
 function loadRecipe(repoRoot5, recipeFile) {
-  if (!fs47.existsSync(recipeFile))
+  if (!fs48.existsSync(recipeFile))
     return null;
   let parsed;
   try {
-    parsed = JSON.parse(fs47.readFileSync(recipeFile, "utf-8"));
+    parsed = JSON.parse(fs48.readFileSync(recipeFile, "utf-8"));
   } catch (e) {
     throw new RecipeError(`recipe.json is not valid JSON: ${e instanceof Error ? e.message : e}`);
   }
@@ -202299,11 +202983,11 @@ function computeRecipeFingerprint(repoRoot5) {
   const hash = crypto3.createHash("sha256");
   for (const rel of FINGERPRINT_INPUTS) {
     const abs = path53.join(repoRoot5, rel);
-    if (!fs47.existsSync(abs) || !fs47.statSync(abs).isFile())
+    if (!fs48.existsSync(abs) || !fs48.statSync(abs).isFile())
       continue;
     hash.update(rel);
     hash.update("\0");
-    hash.update(fs47.readFileSync(abs));
+    hash.update(fs48.readFileSync(abs));
     hash.update("\0");
   }
   return `sha256:${hash.digest("hex")}`;
@@ -202315,7 +202999,7 @@ function resolveEntry(repoRoot5, entry) {
     if (path53.isAbsolute(arg))
       return arg;
     const abs = path53.resolve(repoRoot5, arg);
-    return fs47.existsSync(abs) && fs47.statSync(abs).isFile() ? abs : arg;
+    return fs48.existsSync(abs) && fs48.statSync(abs).isFile() ? abs : arg;
   });
   return [resolvedCommand, ...resolvedRest];
 }
@@ -202329,8 +203013,8 @@ function resolveOnHostPath(command) {
     for (const ext2 of exts) {
       const candidate = path53.join(dir, command + ext2);
       try {
-        if (fs47.statSync(candidate).isFile()) {
-          fs47.accessSync(candidate, fs47.constants.X_OK);
+        if (fs48.statSync(candidate).isFile()) {
+          fs48.accessSync(candidate, fs48.constants.X_OK);
           return candidate;
         }
       } catch {
@@ -202341,7 +203025,7 @@ function resolveOnHostPath(command) {
 }
 
 // packages/guard-runner/dist/scenario-loader.js
-import fs49 from "node:fs";
+import fs50 from "node:fs";
 import path55 from "node:path";
 
 // node_modules/.pnpm/js-yaml@4.1.1/node_modules/js-yaml/dist/js-yaml.mjs
@@ -204973,7 +205657,7 @@ init_dist5();
 
 // packages/guard-runner/dist/store.js
 init_dist5();
-import fs48 from "node:fs";
+import fs49 from "node:fs";
 import path54 from "node:path";
 var TRUECOURSE_DIR3 = ".truecourse";
 var GUARD_DIR = "guard";
@@ -205029,10 +205713,10 @@ function sanitizeSegment(segment) {
   return segment.replace(/[^a-zA-Z0-9._-]/g, "_");
 }
 function atomicWriteJson2(targetPath, data) {
-  fs48.mkdirSync(path54.dirname(targetPath), { recursive: true });
+  fs49.mkdirSync(path54.dirname(targetPath), { recursive: true });
   const tmp = `${targetPath}.tmp-${process.pid}-${Date.now()}`;
-  fs48.writeFileSync(tmp, JSON.stringify(data, null, 2));
-  fs48.renameSync(tmp, targetPath);
+  fs49.writeFileSync(tmp, JSON.stringify(data, null, 2));
+  fs49.renameSync(tmp, targetPath);
 }
 function writeGuardLatest(repoRoot5, latest) {
   const target = guardLatestPath(repoRoot5);
@@ -205064,10 +205748,10 @@ function readGuardResult(repoRoot5) {
   return readJsonOr(guardResultPath(repoRoot5), GuardGenerateReportSchema, null);
 }
 function readJsonOr(file, schema2, fallback) {
-  if (!fs48.existsSync(file))
+  if (!fs49.existsSync(file))
     return fallback;
   try {
-    const parsed = schema2.safeParse(JSON.parse(fs48.readFileSync(file, "utf-8")));
+    const parsed = schema2.safeParse(JSON.parse(fs49.readFileSync(file, "utf-8")));
     return parsed.success ? parsed.data : fallback;
   } catch {
     return fallback;
@@ -205076,10 +205760,10 @@ function readJsonOr(file, schema2, fallback) {
 
 // packages/guard-runner/dist/scenario-loader.js
 function collectScenarioFiles(dir) {
-  if (!fs49.existsSync(dir))
+  if (!fs50.existsSync(dir))
     return [];
   const out = [];
-  for (const entry of fs49.readdirSync(dir, { withFileTypes: true })) {
+  for (const entry of fs50.readdirSync(dir, { withFileTypes: true })) {
     const full = path55.join(dir, entry.name);
     if (entry.isDirectory())
       out.push(...collectScenarioFiles(full));
@@ -205096,7 +205780,7 @@ function loadScenarios(repoRoot5) {
     const rel = path55.relative(repoRoot5, file);
     let doc;
     try {
-      doc = jsYaml.load(fs49.readFileSync(file, "utf-8"));
+      doc = jsYaml.load(fs50.readFileSync(file, "utf-8"));
     } catch (e) {
       errors.push({ file: rel, message: `YAML parse error: ${e instanceof Error ? e.message : e}` });
       continue;
@@ -205160,11 +205844,11 @@ ${err.message}`;
 }
 
 // packages/guard-runner/dist/preflight.js
-import fs51 from "node:fs";
+import fs52 from "node:fs";
 import path57 from "node:path";
 
 // packages/guard-runner/dist/sandbox.js
-import fs50 from "node:fs";
+import fs51 from "node:fs";
 import os11 from "node:os";
 import path56 from "node:path";
 var DETERMINISM_PINS = {
@@ -205176,13 +205860,13 @@ var DETERMINISM_PINS = {
 var SandboxError = class extends Error {
 };
 function createSandbox(opts = {}) {
-  const root2 = fs50.mkdtempSync(path56.join(os11.tmpdir(), "tc-guard-"));
+  const root2 = fs51.mkdtempSync(path56.join(os11.tmpdir(), "tc-guard-"));
   const cwd = path56.join(root2, "work");
   const home = path56.join(root2, "home");
   const tmp = path56.join(root2, "tmp");
-  fs50.mkdirSync(cwd, { recursive: true });
-  fs50.mkdirSync(home, { recursive: true });
-  fs50.mkdirSync(tmp, { recursive: true });
+  fs51.mkdirSync(cwd, { recursive: true });
+  fs51.mkdirSync(home, { recursive: true });
+  fs51.mkdirSync(tmp, { recursive: true });
   const xdg = {
     XDG_CONFIG_HOME: path56.join(home, ".config"),
     XDG_CACHE_HOME: path56.join(home, ".cache"),
@@ -205191,7 +205875,7 @@ function createSandbox(opts = {}) {
     XDG_RUNTIME_DIR: path56.join(home, "run")
   };
   for (const dir of Object.values(xdg))
-    fs50.mkdirSync(dir, { recursive: true });
+    fs51.mkdirSync(dir, { recursive: true });
   const env = {
     // PATH: programs must resolve node/git; the only host value that passes through.
     PATH: process.env.PATH ?? "",
@@ -205214,7 +205898,7 @@ function createSandbox(opts = {}) {
     root: root2,
     env,
     cleanup() {
-      fs50.rmSync(root2, { recursive: true, force: true });
+      fs51.rmSync(root2, { recursive: true, force: true });
     }
   };
 }
@@ -205224,14 +205908,14 @@ function seedFiles(cwd, files) {
     if (target !== cwd && !target.startsWith(cwd + path56.sep)) {
       throw new SandboxError(`setup.files path escapes the sandbox: ${rel}`);
     }
-    fs50.mkdirSync(path56.dirname(target), { recursive: true });
-    fs50.writeFileSync(target, content);
+    fs51.mkdirSync(path56.dirname(target), { recursive: true });
+    fs51.writeFileSync(target, content);
   }
 }
 function listSandboxFiles(dir) {
   const out = [];
   const walk20 = (current) => {
-    for (const entry of fs50.readdirSync(current, { withFileTypes: true })) {
+    for (const entry of fs51.readdirSync(current, { withFileTypes: true })) {
       const full = path56.join(current, entry.name);
       if (entry.isDirectory())
         walk20(full);
@@ -205239,7 +205923,7 @@ function listSandboxFiles(dir) {
         out.push(path56.relative(dir, full));
     }
   };
-  if (fs50.existsSync(dir))
+  if (fs51.existsSync(dir))
     walk20(dir);
   return out.sort();
 }
@@ -205382,10 +206066,10 @@ function missingEntryScript(repoRoot5, entry) {
   }
   for (const arg of candidates) {
     const resolved = path57.isAbsolute(arg) ? arg : path57.resolve(repoRoot5, arg);
-    if (fs51.existsSync(resolved))
+    if (fs52.existsSync(resolved))
       continue;
     const parent = path57.dirname(resolved);
-    const siblings = fs51.existsSync(parent) ? fs51.readdirSync(parent).sort() : null;
+    const siblings = fs52.existsSync(parent) ? fs52.readdirSync(parent).sort() : null;
     return {
       arg,
       resolved,
@@ -205420,7 +206104,7 @@ function formatEntryPreflightError(opts) {
 
 // packages/guard-runner/dist/capabilities/git.js
 import { spawnSync as spawnSync2 } from "node:child_process";
-import fs52 from "node:fs";
+import fs53 from "node:fs";
 import path58 from "node:path";
 var GIT_IDENTITY = {
   GIT_AUTHOR_NAME: "TrueCourse Guard",
@@ -205457,7 +206141,7 @@ function requireFiles(files, ctx) {
     if (target !== ctx.cwd && !target.startsWith(ctx.cwd + path58.sep)) {
       throw new CapabilityError("git", `path escapes the sandbox: ${rel}`);
     }
-    if (!fs52.existsSync(target)) {
+    if (!fs53.existsSync(target)) {
       throw new CapabilityError("git", `declared file does not exist in the sandbox: ${rel} (seed it via setup.files or an earlier commit)`);
     }
   }
@@ -205545,7 +206229,7 @@ function normalize7(text4, normalizers, ctx) {
 }
 
 // packages/guard-runner/dist/expect.js
-import fs53 from "node:fs";
+import fs54 from "node:fs";
 import path59 from "node:path";
 function evaluateExpect(params) {
   const { expect } = params;
@@ -205618,7 +206302,7 @@ function matchStream(subject, matcher, value) {
 }
 function matchFile3(rel, matcher, sandboxCwd, normalizeText) {
   const target = path59.resolve(sandboxCwd, rel);
-  const exists2 = fs53.existsSync(target) && fs53.statSync(target).isFile();
+  const exists2 = fs54.existsSync(target) && fs54.statSync(target).isFile();
   if (matcher.exists === true || matcher.absent === false) {
     if (!exists2)
       return fileMiss(rel, "to exist", "missing");
@@ -205630,7 +206314,7 @@ function matchFile3(rel, matcher, sandboxCwd, normalizeText) {
   if (matcher.equals !== void 0 || matcher.contains !== void 0) {
     if (!exists2)
       return fileMiss(rel, "to exist for a content check", "missing");
-    const content = normalizeText(fs53.readFileSync(target, "utf-8"));
+    const content = normalizeText(fs54.readFileSync(target, "utf-8"));
     if (matcher.equals !== void 0 && content !== matcher.equals) {
       return {
         subject: "files",
@@ -205660,12 +206344,12 @@ function fileMiss(rel, expectedPhrase, actualState) {
 }
 
 // packages/guard-runner/dist/evidence.js
-import fs54 from "node:fs";
+import fs55 from "node:fs";
 import path60 from "node:path";
 function writeEvidence(params) {
   const dir = evidenceScenarioDir(params.repoRoot, params.runId, params.scenarioId);
-  fs54.mkdirSync(dir, { recursive: true });
-  const failing = params.steps.find((s) => s.index === params.failingStep);
+  fs55.mkdirSync(dir, { recursive: true });
+  const focus = params.failingStep != null ? params.steps.find((s) => s.index === params.failingStep) : params.steps[params.steps.length - 1];
   const invocation = {
     scenarioId: params.scenarioId,
     title: params.title,
@@ -205685,11 +206369,11 @@ function writeEvidence(params) {
     }))
   };
   writeFile(dir, "invocation.json", JSON.stringify(invocation, null, 2));
-  if (failing) {
-    writeFile(dir, "stdout.raw.txt", failing.rawStdout);
-    writeFile(dir, "stdout.txt", failing.normStdout);
-    writeFile(dir, "stderr.raw.txt", failing.rawStderr);
-    writeFile(dir, "stderr.txt", failing.normStderr);
+  if (focus) {
+    writeFile(dir, "stdout.raw.txt", focus.rawStdout);
+    writeFile(dir, "stdout.txt", focus.normStdout);
+    writeFile(dir, "stderr.raw.txt", focus.rawStderr);
+    writeFile(dir, "stderr.txt", focus.normStderr);
   }
   const diffLines = [];
   if (params.outcome === "fail" && params.mismatch) {
@@ -205697,8 +206381,10 @@ function writeEvidence(params) {
     diffLines.push(`expected: ${params.mismatch.expected}`);
     diffLines.push(`actual:   ${params.mismatch.actual}`, "");
     diffLines.push(...params.mismatch.detail);
-  } else if (params.infraMessage) {
+  } else if (params.outcome === "error" && params.infraMessage) {
     diffLines.push(`step ${params.failingStep} \u2014 infrastructure error`, "", params.infraMessage);
+  } else if (params.outcome === "pass") {
+    diffLines.push(`all ${params.steps.length} step${params.steps.length === 1 ? "" : "s"} met their expectations`);
   }
   writeFile(dir, "diff.txt", diffLines.join("\n") + "\n");
   writeFile(dir, "files.txt", listSandboxFiles(params.sandboxCwd).join("\n") + "\n");
@@ -205743,7 +206429,7 @@ function indent(text4) {
   return body.split("\n").map((l) => `     ${l}`).join("\n");
 }
 function writeFile(dir, name, content) {
-  fs54.writeFileSync(path60.join(dir, name), content);
+  fs55.writeFileSync(path60.join(dir, name), content);
 }
 
 // packages/guard-runner/dist/run-scenario.js
@@ -205812,7 +206498,7 @@ async function runScenario(scenario, ctx) {
         if (capture.spawnError || capture.timedOut) {
           const infra = capture.timedOut ? `step timed out after ${ctx.stepTimeoutMs}ms` : `failed to spawn: ${capture.spawnError}`;
           records.push(toRecord(stepIndex, argv, step.stdin, repeat3, iteration, capture, normText));
-          const evidencePath = writeEvidence({
+          const evidencePath2 = writeEvidence({
             repoRoot: ctx.repoRoot,
             runId: ctx.runId,
             scenarioId: scenario.id,
@@ -205830,7 +206516,7 @@ async function runScenario(scenario, ctx) {
             outcome: "error",
             durationMs: Date.now() - start,
             failure: { step: stepIndex, expected: "the step to run", actual: infra },
-            evidencePath
+            evidencePath: evidencePath2
           };
         }
         const normStdout = normText(capture.stdout);
@@ -205845,7 +206531,7 @@ async function runScenario(scenario, ctx) {
         });
         if (mismatch) {
           records.push(toRecord(stepIndex, argv, step.stdin, repeat3, iteration, capture, normText));
-          const evidencePath = writeEvidence({
+          const evidencePath2 = writeEvidence({
             repoRoot: ctx.repoRoot,
             runId: ctx.runId,
             scenarioId: scenario.id,
@@ -205867,7 +206553,7 @@ async function runScenario(scenario, ctx) {
               expected: mismatch.expected,
               actual: mismatch.actual
             },
-            evidencePath
+            evidencePath: evidencePath2
           };
         }
       }
@@ -205875,7 +206561,18 @@ async function runScenario(scenario, ctx) {
         records.push(toRecord(stepIndex, argv, step.stdin, repeat3, repeat3, lastCapture, normText));
       }
     }
-    return { ...base2, outcome: "pass", durationMs: Date.now() - start };
+    const evidencePath = ctx.capturePassEvidence ? writeEvidence({
+      repoRoot: ctx.repoRoot,
+      runId: ctx.runId,
+      scenarioId: scenario.id,
+      title: scenario.title,
+      binds: scenario.binds,
+      outcome: "pass",
+      steps: records,
+      sandboxCwd: sandbox.cwd,
+      envPins: ENV_PINS
+    }) : void 0;
+    return { ...base2, outcome: "pass", durationMs: Date.now() - start, ...evidencePath ? { evidencePath } : {} };
   } finally {
     sandbox.cleanup();
   }
@@ -205900,7 +206597,7 @@ function toRecord(index, argv, stdin, repeat3, iterationsRun, capture, normText)
 
 // packages/guard-runner/dist/doc-index.js
 init_zod();
-import fs55 from "node:fs";
+import fs56 from "node:fs";
 import path62 from "node:path";
 
 // packages/guard-runner/dist/section-index.js
@@ -206063,10 +206760,10 @@ function resolveBinding(index, anchor, fingerprint2) {
 var CorpusShape = external_exports.object({ docs: external_exports.array(external_exports.object({ ref: external_exports.string() }).passthrough()).optional() }).passthrough();
 function corpusKeptDocs(repoRoot5) {
   const file = path62.join(repoRoot5, ".truecourse", "specs", "corpus.json");
-  if (!fs55.existsSync(file))
+  if (!fs56.existsSync(file))
     return [];
   try {
-    const parsed = CorpusShape.safeParse(JSON.parse(fs55.readFileSync(file, "utf-8")));
+    const parsed = CorpusShape.safeParse(JSON.parse(fs56.readFileSync(file, "utf-8")));
     if (!parsed.success)
       return [];
     return (parsed.data.docs ?? []).map((d3) => d3.ref);
@@ -206082,24 +206779,24 @@ function indexRepoDocs(repoRoot5, boundDocs) {
   const missing = /* @__PURE__ */ new Set();
   for (const doc of wanted) {
     const abs = path62.resolve(repoRoot5, doc);
-    if (!fs55.existsSync(abs) || !fs55.statSync(abs).isFile()) {
+    if (!fs56.existsSync(abs) || !fs56.statSync(abs).isFile()) {
       missing.add(doc);
       continue;
     }
-    indexes.set(doc, buildDocSectionIndex(doc, fs55.readFileSync(abs, "utf-8")));
+    indexes.set(doc, buildDocSectionIndex(doc, fs56.readFileSync(abs, "utf-8")));
   }
   return { indexes, missing };
 }
 
 // packages/guard-runner/dist/manifest.js
 init_dist5();
-import fs56 from "node:fs";
+import fs57 from "node:fs";
 function readManifest2(repoRoot5) {
   const file = manifestPath2(repoRoot5);
-  if (!fs56.existsSync(file))
+  if (!fs57.existsSync(file))
     return null;
   try {
-    const parsed = GuardManifestSchema.safeParse(JSON.parse(fs56.readFileSync(file, "utf-8")));
+    const parsed = GuardManifestSchema.safeParse(JSON.parse(fs57.readFileSync(file, "utf-8")));
     return parsed.success ? parsed.data : null;
   } catch {
     return null;
@@ -206168,13 +206865,15 @@ async function runGuard(opts) {
     settled += 1;
     opts.onScenarioSettled?.(settled, selected.length, result);
   }
+  const capturePassEvidence = opts.persist !== false;
   const executed = await mapWithConcurrency(executable, concurrency, async ({ scenario, resolution }) => {
     const outcome = await runScenario(scenario, {
       repoRoot: repoRoot5,
       runId,
       resolvedEntry,
       recipeEnv: loaded.recipe.env,
-      stepTimeoutMs
+      stepTimeoutMs,
+      capturePassEvidence
     });
     const result = resolution.kind === "remap" ? { ...outcome, remappedTo: resolution.section.anchor } : outcome;
     settled += 1;
@@ -206273,13 +206972,13 @@ async function mapWithConcurrency(items, limit, fn) {
 
 // packages/guard-runner/dist/decisions.js
 init_dist5();
-import fs57 from "node:fs";
+import fs58 from "node:fs";
 function readGuardDecisions(repoRoot5) {
   const file = guardDecisionsPath(repoRoot5);
-  if (!fs57.existsSync(file))
+  if (!fs58.existsSync(file))
     return EMPTY_GUARD_DECISIONS;
   try {
-    const parsed = GuardDecisionsSchema.safeParse(JSON.parse(fs57.readFileSync(file, "utf-8")));
+    const parsed = GuardDecisionsSchema.safeParse(JSON.parse(fs58.readFileSync(file, "utf-8")));
     return parsed.success ? parsed.data : EMPTY_GUARD_DECISIONS;
   } catch {
     return EMPTY_GUARD_DECISIONS;
@@ -206291,7 +206990,7 @@ init_dist5();
 
 // packages/guard-generator/dist/section-plan.js
 init_zod();
-import fs58 from "node:fs";
+import fs59 from "node:fs";
 import path63 from "node:path";
 import { createHash as createHash15 } from "node:crypto";
 init_dist5();
@@ -206609,10 +207308,10 @@ var CorpusShape2 = external_exports.object({
 function readCorpusAreaTags(repoRoot5) {
   const file = path63.join(repoRoot5, ".truecourse", "specs", "corpus.json");
   const map2 = /* @__PURE__ */ new Map();
-  if (!fs58.existsSync(file))
+  if (!fs59.existsSync(file))
     return map2;
   try {
-    const parsed = CorpusShape2.safeParse(JSON.parse(fs58.readFileSync(file, "utf-8")));
+    const parsed = CorpusShape2.safeParse(JSON.parse(fs59.readFileSync(file, "utf-8")));
     if (!parsed.success)
       return map2;
     for (const d3 of parsed.data.docs ?? [])
@@ -206631,17 +207330,17 @@ function generationInputsHash(fingerprint2, recipeFingerprint) {
   ].join("\0")).digest("hex");
 }
 function hasGuardUniverse(repoRoot5) {
-  return fs58.existsSync(path63.join(repoRoot5, ".truecourse", "specs", "corpus.json"));
+  return fs59.existsSync(path63.join(repoRoot5, ".truecourse", "specs", "corpus.json"));
 }
 function planGuardWork(repoRoot5, recipeFingerprint) {
   const recipeFp = recipeFingerprint ?? computeRecipeFingerprint(repoRoot5);
-  const recipeMissing = !fs58.existsSync(recipePath(repoRoot5));
+  const recipeMissing = !fs59.existsSync(recipePath(repoRoot5));
   const hasUniverse = hasGuardUniverse(repoRoot5);
   const { indexes } = indexRepoDocs(repoRoot5, []);
   const areaTags = readCorpusAreaTags(repoRoot5);
   const sections = [];
   for (const [doc, index] of indexes) {
-    const texts = extractSectionTexts(doc, fs58.readFileSync(path63.resolve(repoRoot5, doc), "utf-8"));
+    const texts = extractSectionTexts(doc, fs59.readFileSync(path63.resolve(repoRoot5, doc), "utf-8"));
     for (const s of index.sections) {
       const t2 = texts.get(s.anchor);
       sections.push({
@@ -206686,7 +207385,7 @@ function collectWorkDocs(repoRoot5, plan) {
   }
   return [...byDoc].map(([doc, sections]) => ({
     doc,
-    content: fs58.readFileSync(path63.resolve(repoRoot5, doc), "utf-8"),
+    content: fs59.readFileSync(path63.resolve(repoRoot5, doc), "utf-8"),
     sections
   }));
 }
@@ -207073,7 +207772,7 @@ function truncate3(text4) {
 }
 
 // packages/guard-generator/dist/recipe-discovery.js
-import fs59 from "node:fs";
+import fs60 from "node:fs";
 import os13 from "node:os";
 import path65 from "node:path";
 import { createHash as createHash18 } from "node:crypto";
@@ -207129,8 +207828,8 @@ async function discoverRecipe(repoRoot5, runner) {
     ...proposal.env ? { env: proposal.env } : {}
   };
   const target = recipePath(repoRoot5);
-  fs59.mkdirSync(path65.dirname(target), { recursive: true });
-  fs59.writeFileSync(target, JSON.stringify(recipe, null, 2) + "\n");
+  fs60.mkdirSync(path65.dirname(target), { recursive: true });
+  fs60.writeFileSync(target, JSON.stringify(recipe, null, 2) + "\n");
   return {
     status: "discovered",
     recipe,
@@ -207161,13 +207860,13 @@ async function proposeRecipeWithReask(input, runner) {
 }
 function readDiscoveryInputs(repoRoot5) {
   const pkgPath = path65.join(repoRoot5, "package.json");
-  const packageJson = fs59.existsSync(pkgPath) ? fs59.readFileSync(pkgPath, "utf-8") : "(no package.json)";
-  const presentInputs = DISCOVERY_INPUTS.filter((f2) => fs59.existsSync(path65.join(repoRoot5, f2)));
+  const packageJson = fs60.existsSync(pkgPath) ? fs60.readFileSync(pkgPath, "utf-8") : "(no package.json)";
+  const presentInputs = DISCOVERY_INPUTS.filter((f2) => fs60.existsSync(path65.join(repoRoot5, f2)));
   return { packageJson, presentInputs };
 }
 async function probeEntry(repoRoot5, entry) {
   const resolved = resolveEntry(repoRoot5, entry);
-  const cwd = fs59.mkdtempSync(path65.join(os13.tmpdir(), "tc-guard-probe-"));
+  const cwd = fs60.mkdtempSync(path65.join(os13.tmpdir(), "tc-guard-probe-"));
   try {
     for (const args of [["--help"], []]) {
       const capture = await executeStep({
@@ -207184,7 +207883,7 @@ async function probeEntry(repoRoot5, entry) {
       reason: `entrypoint ${JSON.stringify(entry)} did not answer to \`--help\` or a bare invocation`
     };
   } finally {
-    fs59.rmSync(cwd, { recursive: true, force: true });
+    fs60.rmSync(cwd, { recursive: true, force: true });
   }
 }
 
@@ -207231,7 +207930,7 @@ async function birthValidate(repoRoot5, candidates, opts = {}) {
 }
 
 // packages/guard-generator/dist/serialize.js
-import fs60 from "node:fs";
+import fs61 from "node:fs";
 import path66 from "node:path";
 init_dist5();
 function anchorLeaf(anchor) {
@@ -207274,15 +207973,15 @@ function scenarioFileIndex(repoRoot5) {
   const root2 = scenariosDir(repoRoot5);
   const map2 = /* @__PURE__ */ new Map();
   const walk20 = (dir) => {
-    if (!fs60.existsSync(dir))
+    if (!fs61.existsSync(dir))
       return;
-    for (const entry of fs60.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs61.readdirSync(dir, { withFileTypes: true })) {
       const full = path66.join(dir, entry.name);
       if (entry.isDirectory())
         walk20(full);
       else if (entry.isFile() && /\.ya?ml$/i.test(entry.name)) {
         try {
-          const doc = jsYaml.load(fs60.readFileSync(full, "utf-8"));
+          const doc = jsYaml.load(fs61.readFileSync(full, "utf-8"));
           if (doc && typeof doc.id === "string")
             map2.set(doc.id, full);
         } catch {
@@ -207301,17 +208000,17 @@ function serializeScenarioYaml(scenario) {
 }
 function writeScenarioFile(repoRoot5, slug2, scenario) {
   const dir = path66.join(scenariosDir(repoRoot5), slug2);
-  fs60.mkdirSync(dir, { recursive: true });
+  fs61.mkdirSync(dir, { recursive: true });
   const file = path66.join(dir, `${scenario.id}.yaml`);
-  fs60.writeFileSync(file, serializeScenarioYaml(scenario));
+  fs61.writeFileSync(file, serializeScenarioYaml(scenario));
   return path66.relative(repoRoot5, file);
 }
 function deleteScenarioFiles(repoRoot5, ids) {
   const index = scenarioFileIndex(repoRoot5);
   for (const id of ids) {
     const file = index.get(id);
-    if (file && fs60.existsSync(file))
-      fs60.rmSync(file);
+    if (file && fs61.existsSync(file))
+      fs61.rmSync(file);
   }
 }
 
@@ -208016,7 +208715,7 @@ init_context_router();
 
 // packages/core/dist/services/llm/model-prices.js
 init_paths();
-import fs61 from "node:fs";
+import fs62 from "node:fs";
 import path67 from "node:path";
 var OPENROUTER_URL = "https://openrouter.ai/api/v1/models";
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -208037,7 +208736,7 @@ function cacheFilePath() {
 }
 function readCache7() {
   try {
-    const t2 = JSON.parse(fs61.readFileSync(cacheFilePath(), "utf-8"));
+    const t2 = JSON.parse(fs62.readFileSync(cacheFilePath(), "utf-8"));
     if (t2 && t2.tiers && t2.byId && typeof t2.fetchedAt === "number")
       return t2;
   } catch {
@@ -208046,8 +208745,8 @@ function readCache7() {
 }
 function writeCache7(t2) {
   try {
-    fs61.mkdirSync(path67.dirname(cacheFilePath()), { recursive: true });
-    fs61.writeFileSync(cacheFilePath(), JSON.stringify(t2));
+    fs62.mkdirSync(path67.dirname(cacheFilePath()), { recursive: true });
+    fs62.writeFileSync(cacheFilePath(), JSON.stringify(t2));
   } catch {
   }
 }
@@ -208426,7 +209125,7 @@ function changedSubject(total, changed, noun) {
 
 // packages/core/dist/commands/spec-in-process.js
 init_dist8();
-import fs66 from "node:fs";
+import fs67 from "node:fs";
 import path72 from "node:path";
 init_git();
 import { createHash as createHash20, randomUUID as randomUUID27 } from "node:crypto";
@@ -208434,7 +209133,7 @@ import { createHash as createHash20, randomUUID as randomUUID27 } from "node:cry
 // packages/core/dist/lib/verify-store.js
 init_atomic_write();
 init_analysis_store();
-import fs62 from "node:fs";
+import fs63 from "node:fs";
 import path68 from "node:path";
 
 // packages/core/dist/types/verify-snapshot.js
@@ -208533,7 +209232,7 @@ var FileVerifyStore = class {
     const file = verifyLatestPath(repoPath);
     let mtime;
     try {
-      mtime = fs62.statSync(file).mtimeMs;
+      mtime = fs63.statSync(file).mtimeMs;
     } catch (err) {
       if (err.code === "ENOENT") {
         latestCache2.delete(repoPath);
@@ -208544,7 +209243,7 @@ var FileVerifyStore = class {
     const cached = latestCache2.get(repoPath);
     if (cached && cached.mtime === mtime)
       return cached.data;
-    const data = JSON.parse(fs62.readFileSync(file, "utf-8"));
+    const data = JSON.parse(fs63.readFileSync(file, "utf-8"));
     latestCache2.set(repoPath, { mtime, data });
     return data;
   }
@@ -208554,7 +209253,7 @@ var FileVerifyStore = class {
   }
   async deleteVerifyLatest(repoPath) {
     try {
-      fs62.unlinkSync(verifyLatestPath(repoPath));
+      fs63.unlinkSync(verifyLatestPath(repoPath));
     } catch (err) {
       if (err.code !== "ENOENT")
         throw err;
@@ -208568,21 +209267,21 @@ var FileVerifyStore = class {
   }
   async readVerifyRun(repoPath, filename) {
     const file = verifyRunPath(repoPath, filename);
-    if (!fs62.existsSync(file))
+    if (!fs63.existsSync(file))
       return null;
-    return JSON.parse(fs62.readFileSync(file, "utf-8"));
+    return JSON.parse(fs63.readFileSync(file, "utf-8"));
   }
   async listVerifyRuns(repoPath) {
     const dir = runsDir(repoPath);
-    if (!fs62.existsSync(dir))
+    if (!fs63.existsSync(dir))
       return [];
-    return fs62.readdirSync(dir).filter((n) => n.endsWith(".json")).sort();
+    return fs63.readdirSync(dir).filter((n) => n.endsWith(".json")).sort();
   }
   async readVerifyHistory(repoPath) {
     const file = verifyHistoryPath(repoPath);
-    if (!fs62.existsSync(file))
+    if (!fs63.existsSync(file))
       return { runs: [] };
-    return JSON.parse(fs62.readFileSync(file, "utf-8"));
+    return JSON.parse(fs63.readFileSync(file, "utf-8"));
   }
   async appendVerifyHistory(repoPath, entry) {
     const history = await this.readVerifyHistory(repoPath);
@@ -208595,7 +209294,7 @@ var FileVerifyStore = class {
     if (!entry)
       return false;
     try {
-      fs62.unlinkSync(verifyRunPath(repoPath, entry.filename));
+      fs63.unlinkSync(verifyRunPath(repoPath, entry.filename));
     } catch (err) {
       if (err.code !== "ENOENT")
         throw err;
@@ -208617,16 +209316,16 @@ var FileVerifyStore = class {
   }
   async readVerifyDiff(repoPath, scope) {
     const file = verifyDiffPath(repoPath, scope);
-    if (!fs62.existsSync(file))
+    if (!fs63.existsSync(file))
       return null;
-    return JSON.parse(fs62.readFileSync(file, "utf-8"));
+    return JSON.parse(fs63.readFileSync(file, "utf-8"));
   }
   async writeVerifyDiff(repoPath, diff, scope) {
     atomicWriteJson(verifyDiffPath(repoPath, scope), diff);
   }
   async deleteVerifyDiff(repoPath, scope) {
     try {
-      fs62.unlinkSync(verifyDiffPath(repoPath, scope));
+      fs63.unlinkSync(verifyDiffPath(repoPath, scope));
     } catch (err) {
       if (err.code !== "ENOENT")
         throw err;
@@ -208660,7 +209359,7 @@ async function repoRef(repoRoot5, commitOverride) {
 }
 
 // packages/core/dist/lib/contract-store.js
-import fs63 from "node:fs";
+import fs64 from "node:fs";
 import path69 from "node:path";
 var KIND_REL = {
   contracts: [".truecourse", "contracts"],
@@ -208671,7 +209370,7 @@ function countTcFiles(dir) {
   let n = 0;
   let entries;
   try {
-    entries = fs63.readdirSync(dir, { withFileTypes: true });
+    entries = fs64.readdirSync(dir, { withFileTypes: true });
   } catch {
     return 0;
   }
@@ -208688,7 +209387,7 @@ function walkTcRel(dir, excludeInferred) {
   const walk20 = (rel) => {
     let entries;
     try {
-      entries = fs63.readdirSync(path69.join(dir, rel), { withFileTypes: true });
+      entries = fs64.readdirSync(path69.join(dir, rel), { withFileTypes: true });
     } catch {
       return;
     }
@@ -208726,13 +209425,13 @@ var FileContractStore = class {
   }
   async loadContracts(ref, kind) {
     const dir = path69.join(ref.repoKey, ...KIND_REL[kind]);
-    if (!fs63.existsSync(dir))
+    if (!fs64.existsSync(dir))
       return null;
     return { dir, cleanup: async () => {
     } };
   }
   async hasContracts(ref, kind) {
-    return fs63.existsSync(path69.join(ref.repoKey, ...KIND_REL[kind]));
+    return fs64.existsSync(path69.join(ref.repoKey, ...KIND_REL[kind]));
   }
   // The file impl reads the live repo tree, which is whatever is checked out —
   // there is no per-commit history, so `commitSha` is ignored (OSS is latest).
@@ -208741,21 +209440,21 @@ var FileContractStore = class {
   }
   async readContractFile(repoKey, kind, relPath, _commitSha) {
     const dest = safeResolve(path69.join(repoKey, ...KIND_REL[kind]), relPath);
-    if (!dest || !fs63.existsSync(dest) || !fs63.statSync(dest).isFile())
+    if (!dest || !fs64.existsSync(dest) || !fs64.statSync(dest).isFile())
       return null;
-    return fs63.readFileSync(dest, "utf-8");
+    return fs64.readFileSync(dest, "utf-8");
   }
   async putContractFile(ref, kind, relPath, content) {
     const dest = safeResolve(path69.join(ref.repoKey, ...KIND_REL[kind]), relPath);
     if (!dest)
       throw new Error(`[contract-store] unsafe contract path: ${relPath}`);
-    fs63.mkdirSync(path69.dirname(dest), { recursive: true });
-    fs63.writeFileSync(dest, content);
+    fs64.mkdirSync(path69.dirname(dest), { recursive: true });
+    fs64.writeFileSync(dest, content);
   }
   async deleteContractFile(ref, kind, relPath) {
     const dest = safeResolve(path69.join(ref.repoKey, ...KIND_REL[kind]), relPath);
     if (dest)
-      fs63.rmSync(dest, { force: true });
+      fs64.rmSync(dest, { force: true });
   }
   // OSS/local has no workspace concept (mirrors the spec store). Writing throws
   // (fail loud — a caller that reached here is mis-wired); reads are empty so an
@@ -208782,7 +209481,7 @@ var loadWorkspaceContracts = (ref, kind) => active8.loadWorkspaceContracts(ref,
 var contractsMaterializeInPlace = () => active8.materializesInPlace;
 
 // packages/core/dist/lib/spec-store.js
-import fs64 from "node:fs";
+import fs65 from "node:fs";
 import path70 from "node:path";
 function specPath(repoKey, artifact) {
   return path70.join(repoKey, ".truecourse", "specs", `${artifact}.json`);
@@ -208798,18 +209497,18 @@ var FileSpecStore = class {
       throw new Error(PR_DECISIONS_FILE_ERROR);
     }
     const file = specPath(ref.repoKey, artifact);
-    fs64.mkdirSync(path70.dirname(file), { recursive: true });
-    fs64.writeFileSync(file, JSON.stringify(json2, null, 2) + "\n", "utf-8");
+    fs65.mkdirSync(path70.dirname(file), { recursive: true });
+    fs65.writeFileSync(file, JSON.stringify(json2, null, 2) + "\n", "utf-8");
   }
   async loadSpec(ref, artifact) {
     if (artifact === "decisions" && isPrDecisionsRef(ref.commitSha)) {
       throw new Error(PR_DECISIONS_FILE_ERROR);
     }
     const file = specPath(ref.repoKey, artifact);
-    if (!fs64.existsSync(file))
+    if (!fs65.existsSync(file))
       return null;
     try {
-      return JSON.parse(fs64.readFileSync(file, "utf-8"));
+      return JSON.parse(fs65.readFileSync(file, "utf-8"));
     } catch {
       return null;
     }
@@ -208819,8 +209518,8 @@ var FileSpecStore = class {
       throw new Error(PR_DECISIONS_FILE_ERROR);
     }
     const file = specPath(ref.repoKey, artifact);
-    if (fs64.existsSync(file))
-      fs64.rmSync(file);
+    if (fs65.existsSync(file))
+      fs65.rmSync(file);
   }
   // The file impl is single-document-per-repo, so "latest" === read the file.
   async loadLatest(repoKey, artifact) {
@@ -208847,7 +209546,7 @@ var loadLatestSpec = (repoKey, artifact) => active9.loadLatest(repoKey, artifact
 var specsMaterializeInPlace = () => active9.materializesInPlace;
 
 // packages/core/dist/lib/inferred-action-store.js
-import fs65 from "node:fs";
+import fs66 from "node:fs";
 import path71 from "node:path";
 function actionsFile(repoKey) {
   return path71.join(repoKey, ".truecourse", "specs", "inferred-actions.json");
@@ -208855,15 +209554,15 @@ function actionsFile(repoKey) {
 var FileInferredActionStore = class {
   read(repoKey) {
     try {
-      return JSON.parse(fs65.readFileSync(actionsFile(repoKey), "utf-8"));
+      return JSON.parse(fs66.readFileSync(actionsFile(repoKey), "utf-8"));
     } catch {
       return [];
     }
   }
   write(repoKey, actions) {
     const file = actionsFile(repoKey);
-    fs65.mkdirSync(path71.dirname(file), { recursive: true });
-    fs65.writeFileSync(file, JSON.stringify(actions, null, 2) + "\n", "utf-8");
+    fs66.mkdirSync(path71.dirname(file), { recursive: true });
+    fs66.writeFileSync(file, JSON.stringify(actions, null, 2) + "\n", "utf-8");
   }
   async setAction(repoKey, action) {
     const next = this.read(repoKey).filter((a) => !(a.kind === action.kind && a.identity === action.identity));
@@ -208998,7 +209697,7 @@ function generatedMarkerPath(repoRoot5) {
 }
 function stampGeneratedMarker(repoRoot5, summary) {
   const file = generatedMarkerPath(repoRoot5);
-  fs66.mkdirSync(path72.dirname(file), { recursive: true });
+  fs67.mkdirSync(path72.dirname(file), { recursive: true });
   const body = {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     written: summary?.written ?? 0,
@@ -209006,7 +209705,7 @@ function stampGeneratedMarker(repoRoot5, summary) {
     validationIssues: summary?.validationIssues ?? [],
     enumerateFailures: summary?.enumerateFailures ?? []
   };
-  fs66.writeFileSync(file, JSON.stringify(body, null, 2) + "\n");
+  fs67.writeFileSync(file, JSON.stringify(body, null, 2) + "\n");
 }
 function resolveCurateModels(repoRoot5) {
   return {
@@ -209131,19 +209830,19 @@ async function curateInProcess(repoRoot5, options = {}) {
 }
 function buildPriorContracts(repoRoot5) {
   const dir = path72.join(repoRoot5, ".truecourse", "contracts");
-  if (!fs66.existsSync(dir))
+  if (!fs67.existsSync(dir))
     return void 0;
   const targets = [];
   const bodyByKey = /* @__PURE__ */ new Map();
   const walk20 = (d3) => {
-    for (const e of fs66.readdirSync(d3, { withFileTypes: true })) {
+    for (const e of fs67.readdirSync(d3, { withFileTypes: true })) {
       if (e.isDirectory()) {
         if (e.name === "_inferred")
           continue;
         walk20(path72.join(d3, e.name));
       } else if (e.name.endsWith(".tc")) {
         const abs = path72.join(d3, e.name);
-        const src = fs66.readFileSync(abs, "utf-8");
+        const src = fs67.readFileSync(abs, "utf-8");
         try {
           const file = parser_ohm_exports.parseTcFile(path72.relative(dir, abs), src);
           for (const key4 of resolver_exports.resolve([file]).index.keys()) {
@@ -209316,7 +210015,7 @@ async function withContracts(repoRoot5, options, tracker, fn) {
   try {
     let recorded;
     if (options.contractsDir) {
-      if (!fs66.existsSync(options.contractsDir)) {
+      if (!fs67.existsSync(options.contractsDir)) {
         const err = new Error(`Contracts directory not found at ${options.contractsDir}. Run \`truecourse contracts generate\` first.`);
         tracker?.error("load", err.message);
         throw err;
@@ -209405,7 +210104,7 @@ async function verifyInProcess(repoRoot5, options = {}) {
         bySeverity: summary.bySeverity
       });
       await deleteVerifyDiff(storeKey);
-      fs66.rmSync(legacyVerifyStatePath(repoRoot5), { force: true });
+      fs67.rmSync(legacyVerifyStatePath(repoRoot5), { force: true });
     }
     const state = {
       verifiedAt,
@@ -209623,7 +210322,7 @@ async function persistInferred(repoRoot5, options, contractsDir, codeDir, starte
 }
 function autodetectCodeDir(repoRoot5) {
   const codeSubdir = path72.join(repoRoot5, "code");
-  if (fs66.existsSync(codeSubdir) && fs66.statSync(codeSubdir).isDirectory()) {
+  if (fs67.existsSync(codeSubdir) && fs67.statSync(codeSubdir).isDirectory()) {
     return codeSubdir;
   }
   return repoRoot5;
@@ -209944,7 +210643,7 @@ async function runContractsGenerate(options = {}) {
 async function runContractsList(options = {}) {
   const repoRoot5 = options.cwd ?? process.cwd();
   const contractsDir = path73.join(repoRoot5, ".truecourse", "contracts");
-  if (!fs67.existsSync(contractsDir)) {
+  if (!fs68.existsSync(contractsDir)) {
     O2.info("No contracts found. Run `truecourse contracts generate` first.");
     return;
   }
@@ -209952,12 +210651,12 @@ async function runContractsList(options = {}) {
   const fileNodes = [];
   let parseErrors = 0;
   const visit = (dir) => {
-    for (const entry of fs67.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs68.readdirSync(dir, { withFileTypes: true })) {
       const full = path73.join(dir, entry.name);
       if (entry.isDirectory()) visit(full);
       else if (entry.isFile() && entry.name.endsWith(".tc")) {
         try {
-          fileNodes.push(parserOhm.parseTcFile(full, fs67.readFileSync(full, "utf-8")));
+          fileNodes.push(parserOhm.parseTcFile(full, fs68.readFileSync(full, "utf-8")));
         } catch {
           parseErrors += 1;
         }
@@ -209997,7 +210696,7 @@ async function runContractsList(options = {}) {
 async function runContractsValidate(options = {}) {
   const repoRoot5 = options.cwd ?? process.cwd();
   const contractsDir = path73.join(repoRoot5, ".truecourse", "contracts");
-  if (!fs67.existsSync(contractsDir)) {
+  if (!fs68.existsSync(contractsDir)) {
     O2.error("No .truecourse/contracts/ directory found.");
     process.exit(1);
   }
@@ -210005,12 +210704,12 @@ async function runContractsValidate(options = {}) {
   const fileNodes = [];
   const issues = [];
   const visit = (dir) => {
-    for (const entry of fs67.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs68.readdirSync(dir, { withFileTypes: true })) {
       const full = path73.join(dir, entry.name);
       if (entry.isDirectory()) visit(full);
       else if (entry.isFile() && entry.name.endsWith(".tc")) {
         try {
-          fileNodes.push(parserOhm.parseTcFile(full, fs67.readFileSync(full, "utf-8")));
+          fileNodes.push(parserOhm.parseTcFile(full, fs68.readFileSync(full, "utf-8")));
         } catch (e) {
           issues.push(`${path73.relative(repoRoot5, full)}: parse error: ${e instanceof Error ? e.message : e}`);
         }
@@ -210253,7 +210952,7 @@ async function runInfer(opts = {}) {
 
 // tools/cli/src/commands/spec-conflicts.ts
 init_dist4();
-import fs68 from "node:fs";
+import fs69 from "node:fs";
 import path75 from "node:path";
 var root = (opts) => opts.cwd ?? process.cwd();
 var base = (ref) => ref.split("/").pop() ?? ref;
@@ -210301,7 +211000,7 @@ async function runSpecConflictsList(opts = {}) {
 function excerpt(repoRoot5, ref, note, max = 20) {
   let text4;
   try {
-    text4 = fs68.readFileSync(path75.join(repoRoot5, ref), "utf-8");
+    text4 = fs69.readFileSync(path75.join(repoRoot5, ref), "utf-8");
   } catch {
     return `    (could not read ${ref})`;
   }
@@ -211249,7 +211948,7 @@ async function runConfigLlmShow(options = {}) {
 
 // tools/cli/src/commands/hooks.ts
 import { execSync as execSync4 } from "node:child_process";
-import fs69 from "node:fs";
+import fs70 from "node:fs";
 import path79 from "node:path";
 init_dist4();
 init_paths();
@@ -211285,11 +211984,11 @@ function findGitDir(from) {
   let dir = from;
   while (true) {
     const gitPath = path79.join(dir, ".git");
-    if (fs69.existsSync(gitPath)) {
-      const stat = fs69.statSync(gitPath);
+    if (fs70.existsSync(gitPath)) {
+      const stat = fs70.statSync(gitPath);
       if (stat.isDirectory()) return gitPath;
       if (stat.isFile()) {
-        const content = fs69.readFileSync(gitPath, "utf-8").trim();
+        const content = fs70.readFileSync(gitPath, "utf-8").trim();
         const match4 = content.match(/^gitdir:\s*(.+)$/);
         if (match4) return path79.resolve(dir, match4[1]);
       }
@@ -211302,7 +212001,7 @@ function findGitDir(from) {
 function findProjectRoot(from) {
   let dir = from;
   while (true) {
-    if (fs69.existsSync(path79.join(dir, ".git"))) return dir;
+    if (fs70.existsSync(path79.join(dir, ".git"))) return dir;
     const parent = path79.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -211310,10 +212009,10 @@ function findProjectRoot(from) {
 }
 function loadConfig(projectRoot) {
   const configPath = path79.join(projectRoot, ".truecourse", "hooks.yaml");
-  if (!fs69.existsSync(configPath)) return null;
+  if (!fs70.existsSync(configPath)) return null;
   let parsed;
   try {
-    const raw = fs69.readFileSync(configPath, "utf-8");
+    const raw = fs70.readFileSync(configPath, "utf-8");
     parsed = jsYaml.load(raw) || {};
   } catch (err) {
     console.error(`Error parsing ${configPath}: ${err.message}`);
@@ -211365,10 +212064,10 @@ async function runHooksInstall() {
     console.log(INSTALL_WARNING);
   }
   const hooksDir = path79.join(gitDir, "hooks");
-  fs69.mkdirSync(hooksDir, { recursive: true });
+  fs70.mkdirSync(hooksDir, { recursive: true });
   const hookPath = path79.join(hooksDir, "pre-commit");
-  if (fs69.existsSync(hookPath)) {
-    const existing = fs69.readFileSync(hookPath, "utf-8");
+  if (fs70.existsSync(hookPath)) {
+    const existing = fs70.readFileSync(hookPath, "utf-8");
     if (!existing.includes(HOOK_IDENTIFIER)) {
       console.error(
         "Error: A pre-commit hook already exists and was not installed by TrueCourse."
@@ -211378,16 +212077,16 @@ async function runHooksInstall() {
       process.exit(1);
     }
   }
-  fs69.writeFileSync(hookPath, HOOK_SCRIPT, { mode: 493 });
+  fs70.writeFileSync(hookPath, HOOK_SCRIPT, { mode: 493 });
   console.log("TrueCourse pre-commit hook installed.");
   console.log(`  ${hookPath}`);
   const projectRoot = findProjectRoot(process.cwd());
   if (projectRoot) {
     const cfgDir = path79.join(projectRoot, ".truecourse");
     const cfgPath = path79.join(cfgDir, "hooks.yaml");
-    if (!fs69.existsSync(cfgPath)) {
-      fs69.mkdirSync(cfgDir, { recursive: true });
-      fs69.writeFileSync(cfgPath, HOOKS_YAML_TEMPLATE);
+    if (!fs70.existsSync(cfgPath)) {
+      fs70.mkdirSync(cfgDir, { recursive: true });
+      fs70.writeFileSync(cfgPath, HOOKS_YAML_TEMPLATE);
       console.log(`  ${cfgPath} (starter config \u2014 edit to customize, commit to share with the team)`);
     }
   }
@@ -211399,16 +212098,16 @@ function runHooksUninstall() {
     process.exit(1);
   }
   const hookPath = path79.join(gitDir, "hooks", "pre-commit");
-  if (!fs69.existsSync(hookPath)) {
+  if (!fs70.existsSync(hookPath)) {
     console.log("No pre-commit hook installed.");
     return;
   }
-  const content = fs69.readFileSync(hookPath, "utf-8");
+  const content = fs70.readFileSync(hookPath, "utf-8");
   if (!content.includes(HOOK_IDENTIFIER)) {
     console.error("Error: The pre-commit hook was not installed by TrueCourse. Leaving it in place.");
     process.exit(1);
   }
-  fs69.unlinkSync(hookPath);
+  fs70.unlinkSync(hookPath);
   console.log("TrueCourse pre-commit hook removed.");
 }
 function runHooksStatus() {
@@ -211418,7 +212117,7 @@ function runHooksStatus() {
     process.exit(1);
   }
   const hookPath = path79.join(gitDir, "hooks", "pre-commit");
-  const installed = fs69.existsSync(hookPath) && fs69.readFileSync(hookPath, "utf-8").includes(HOOK_IDENTIFIER);
+  const installed = fs70.existsSync(hookPath) && fs70.readFileSync(hookPath, "utf-8").includes(HOOK_IDENTIFIER);
   if (installed) {
     console.log("TrueCourse pre-commit hook: installed");
     console.log(`  ${hookPath}`);
@@ -211527,7 +212226,13 @@ async function runHooksRun() {
 
 // tools/cli/src/index.ts
 var program2 = new Command();
-program2.name("truecourse").version("0.7.0-next.4").description("TrueCourse CLI \u2014 analyze your repository and open the dashboard");
+program2.name("truecourse").version("0.7.0-next.5").description("TrueCourse CLI \u2014 analyze your repository and open the dashboard");
+function warnDiscontinued(command) {
+  process.stderr.write(
+    `\u26A0 \`${command}\` is discontinued in favor of \`truecourse guard\` \u2014 see the README. Planned removal: 0.8.
+`
+  );
+}
 var dashboardCmd = program2.command("dashboard").description("Start the TrueCourse dashboard and open it in your browser").option("--reconfigure", "Re-prompt for console vs background service mode").option("--service", "Run as a background service (skips mode prompt)").option("--console", "Run in this terminal (skips mode prompt)").action(async (options) => {
   if (options.service && options.console) {
     console.error("error: --service and --console are mutually exclusive");
@@ -211581,14 +212286,17 @@ program2.command("list").description("List violations from the latest analysis")
     });
   }
 });
-var contractsCmd = program2.command("contracts").description("Manage spec-driven contract artifacts");
+var contractsCmd = program2.command("contracts", { hidden: true }).description("Manage spec-driven contract artifacts");
 contractsCmd.command("generate").description("Generate .tc artifacts from the curated corpus (corpus.json)").option("--diff", "Dry run \u2014 show what would change without writing").option("-y, --yes", "Skip the pre-flight LLM cost-estimate confirmation").option("--llm-transport <mode>", "How to reach the LLM: 'cli' (spawn claude -p, default) or 'agent' (filesystem mailbox)").option("--io <dir>", "Mailbox dir for --llm-transport agent (request/response files)").action(async (options) => {
+  warnDiscontinued("contracts");
   await runContractsGenerate({ diff: !!options.diff, yes: !!options.yes, llm: options.llmTransport, io: options.io });
 });
 contractsCmd.command("list").description("List the .tc artifacts in this repo (kind \xB7 identity \xB7 location)").option("--inferred", "Only inferred artifacts (reverse-engineered, in _inferred/)").option("--authored", "Only authored artifacts (exclude _inferred/)").action(async (options) => {
+  warnDiscontinued("contracts");
   await runContractsList({ inferred: !!options.inferred, authored: !!options.authored });
 });
 contractsCmd.command("validate").description("Parse and resolve all .tc files, report any issues").action(async () => {
+  warnDiscontinued("contracts");
   await runContractsValidate();
 });
 var specCmd = program2.command("spec").description("Curate scattered docs into a corpus of areas and doc relations");
@@ -211652,17 +212360,20 @@ docsCmd.command("exclude <path...>").description("Force-exclude one or more kept
 docsCmd.command("unexclude <path>").description("Remove a force-exclude override").action(async (docPath) => {
   await runSpecDocsUnexclude(docPath);
 });
-program2.command("verify").description("Compare code against the canonical TC contracts").option("--code-dir <path>", "Override the code directory (default: auto-detect)").option("--diff", "Diff current drifts against the committed LATEST baseline").option("--stash", "Pre-approve stashing pending changes (verify committed state)").option("--no-stash", "Verify the working tree as-is without stashing").action(async (options) => {
+program2.command("verify", { hidden: true }).description("Compare code against the canonical TC contracts").option("--code-dir <path>", "Override the code directory (default: auto-detect)").option("--diff", "Diff current drifts against the committed LATEST baseline").option("--stash", "Pre-approve stashing pending changes (verify committed state)").option("--no-stash", "Verify the working tree as-is without stashing").action(async (options) => {
+  warnDiscontinued("verify");
   await runVerify({ codeDir: options.codeDir, diff: options.diff, stash: options.stash });
 });
-program2.command("infer").description("Reverse-engineer undocumented decisions from code into inferred contracts").option("--code-dir <path>", "Override the code directory (default: auto-detect)").option("--dry-run", "Report what would be written without touching disk").action(async (options) => {
+program2.command("infer", { hidden: true }).description("Reverse-engineer undocumented decisions from code into inferred contracts").option("--code-dir <path>", "Override the code directory (default: auto-detect)").option("--dry-run", "Report what would be written without touching disk").action(async (options) => {
+  warnDiscontinued("infer");
   await runInfer({ codeDir: options.codeDir, dryRun: options.dryRun });
 });
-var driftsCmd = program2.command("drifts").description("Inspect drifts from the latest verify");
+var driftsCmd = program2.command("drifts", { hidden: true }).description("Inspect drifts from the latest verify");
 driftsCmd.command("list").description("List drifts from the latest verify (paginated)").option("--limit <n>", "Number of drifts to show (default: 20)", parseInt).option("--offset <n>", "Skip first N drifts", parseInt).option("--all", "Show all drifts").option(
   "--severity <list>",
   "Comma-separated severities to include (critical,high,medium,low,info)"
 ).action(async (options) => {
+  warnDiscontinued("drifts");
   await runDriftsList({
     limit: options.all ? Infinity : options.limit ?? 20,
     offset: options.offset ?? 0,