zelari-code 2.37.0 → 2.37.2

package/dist/cli/main.bundled.js

@@ -3482,10 +3482,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path100) {
-  if (!path100)
+function getElementAtPath(obj, path101) {
+  if (!path101)
     return obj;
-  return path100.reduce((acc, key) => acc?.[key], obj);
+  return path101.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -3813,11 +3813,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path100, issues) {
+function prefixIssues(path101, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path100);
+    iss.path.unshift(path101);
     return iss;
   });
 }
@@ -4035,16 +4035,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path100 = []) => {
+  const processError = (error52, path101 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path100, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path101, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path100, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path101, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path100, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path101, ...issue2.path]);
       } else {
-        const fullpath = [...path100, ...issue2.path];
+        const fullpath = [...path101, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -4071,17 +4071,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path100 = []) => {
+  const processError = (error52, path101 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path100, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path101, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path100, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path101, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path100, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path101, ...issue2.path]);
       } else {
-        const fullpath = [...path100, ...issue2.path];
+        const fullpath = [...path101, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -4113,8 +4113,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path100 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path100) {
+  const path101 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path101) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -17617,13 +17617,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path100 = ref.slice(1).split("/").filter(Boolean);
-  if (path100.length === 0) {
+  const path101 = ref.slice(1).split("/").filter(Boolean);
+  if (path101.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path100[0] === defsKey) {
-    const key = path100[1];
+  if (path101[0] === defsKey) {
+    const key = path101[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -18457,17 +18457,17 @@ var init_newlines = __esm({
 });
 
 // packages/core/dist/core/tools/builtin/fileEvents.js
-function fileReadEvent(path100, snapshotId) {
-  return { kind: "file.read", actor: { type: "tool" }, data: { path: path100, snapshotId } };
+function fileReadEvent(path101, snapshotId) {
+  return { kind: "file.read", actor: { type: "tool" }, data: { path: path101, snapshotId } };
 }
-function fileAppliedEvent(path100, snapshotId, bytes) {
-  return { kind: "file.applied", actor: { type: "tool" }, data: { path: path100, snapshotId, bytes } };
+function fileAppliedEvent(path101, snapshotId, bytes) {
+  return { kind: "file.applied", actor: { type: "tool" }, data: { path: path101, snapshotId, bytes } };
 }
-function fileRejectedEvent(path100, reason, hint) {
+function fileRejectedEvent(path101, reason, hint) {
   return {
     kind: "file.rejected",
     actor: { type: "tool" },
-    data: hint === void 0 ? { path: path100, reason } : { path: path100, reason, hint }
+    data: hint === void 0 ? { path: path101, reason } : { path: path101, reason, hint }
   };
 }
 function reReadHint(reject) {
@@ -20336,11 +20336,11 @@ var init_tools = __esm({
           if (!ctx.addDocument)
             return "Knowledge vault tool not available.";
           const title = args["title"] || "New Document";
-          const path100 = args["path"] || `notes/${title.toLowerCase().replace(/[^a-z0-9]+/g, "-")}`;
+          const path101 = args["path"] || `notes/${title.toLowerCase().replace(/[^a-z0-9]+/g, "-")}`;
           const content = args["content"] || "";
           const tags = args["tags"] || [];
           ctx.addDocument({
-            path: path100,
+            path: path101,
             title,
             content,
             format: "markdown",
@@ -20349,7 +20349,7 @@ var init_tools = __esm({
             workspaceId: ctx.workspaceId
           });
           ctx.addActivity("vault", "created document", title);
-          return `Document "${title}" created at "${path100}".`;
+          return `Document "${title}" created at "${path101}".`;
         }
       }
     ];
@@ -22036,7 +22036,20 @@ function evaluateKrakenCompletionGate(mode) {
     };
   }
 }
-function buildKrakenRepairPrompt(gate) {
+function excerptEntries(excerpts) {
+  if (!excerpts) return [];
+  return excerpts instanceof Map ? [...excerpts.entries()] : Object.entries(excerpts);
+}
+function excerptBlock(name, raw) {
+  const trimmed = raw.trim();
+  const truncated = trimmed.length > REPAIR_FAIL_EXCERPT_CAP;
+  const tail2 = truncated ? trimmed.slice(trimmed.length - REPAIR_FAIL_EXCERPT_CAP) : trimmed;
+  const lines = [`Failure excerpt (tail, capped ${REPAIR_FAIL_EXCERPT_CAP} chars) \u2014 ${name}:`];
+  if (truncated) lines.push(`\u2026[truncated ${trimmed.length - REPAIR_FAIL_EXCERPT_CAP} chars]`);
+  lines.push(tail2, "");
+  return lines;
+}
+function buildKrakenRepairPrompt(gate, excerpts) {
   const lines = [
     `The BUILD turn is ending, but the required checks from kraken_select are not all satisfied (passed ${gate.passed}/${gate.total}).`,
     ""
@@ -22053,6 +22066,36 @@ function buildKrakenRepairPrompt(gate) {
     for (const check2 of gate.unknownChecks) lines.push(`- ${check2}`);
     lines.push("");
   }
+  const entries = excerptEntries(excerpts);
+  if (entries.length > 0) {
+    const byName = new Map(entries);
+    const used = /* @__PURE__ */ new Set();
+    const blocks = [];
+    let emitted = 0;
+    for (const check2 of [...gate.failedChecks, ...gate.unknownChecks]) {
+      if (emitted >= MAX_REPAIR_EXCERPTS) break;
+      const raw = byName.get(check2);
+      if (raw === void 0 || used.has(check2)) continue;
+      used.add(check2);
+      blocks.push(excerptBlock(check2, raw));
+      emitted += 1;
+    }
+    let leadInPushed = false;
+    for (const [name, raw] of entries) {
+      if (emitted >= MAX_REPAIR_EXCERPTS) break;
+      if (used.has(name)) continue;
+      if (!leadInPushed) {
+        blocks.push([
+          "DETERMINISTIC check failures with captured output (criteria pack / task contract):",
+          ""
+        ]);
+        leadInPushed = true;
+      }
+      blocks.push(excerptBlock(name, raw));
+      emitted += 1;
+    }
+    for (const block of blocks) lines.push(...block);
+  }
   lines.push(
     "Recover this turn:",
     "1. The approach selection is settled \u2014 do NOT call kraken_select again.",
@@ -22063,7 +22106,7 @@ function buildKrakenRepairPrompt(gate) {
   );
   return lines.join("\n");
 }
-var OPEN_GATE;
+var OPEN_GATE, REPAIR_FAIL_EXCERPT_CAP, MAX_REPAIR_EXCERPTS;
 var init_completionGate = __esm({
   "src/cli/kraken/completionGate.ts"() {
     "use strict";
@@ -22076,6 +22119,8 @@ var init_completionGate = __esm({
       failedChecks: [],
       unknownChecks: []
     };
+    REPAIR_FAIL_EXCERPT_CAP = 2e3;
+    MAX_REPAIR_EXCERPTS = 5;
   }
 });
 
@@ -25174,16 +25219,16 @@ function runRetentionFromEnv() {
     maxTotalBytes: Number.isFinite(parseMb) && parseMb > 0 ? Math.round(parseMb * 1024 * 1024) : DEFAULT_RUN_RETENTION_MAX_MB * 1024 * 1024
   };
 }
-async function dirSize(path100) {
+async function dirSize(path101) {
   let total = 0;
   let entries;
   try {
-    entries = await readdir(path100, { withFileTypes: true });
+    entries = await readdir(path101, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child = join3(path100, entry.name);
+    const child = join3(path101, entry.name);
     if (entry.isDirectory())
       total += await dirSize(child);
     else {
@@ -25210,19 +25255,19 @@ async function enforceRunRetention(runsDir, options = {}) {
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
-    const path100 = join3(runsDir, entry.name);
+    const path101 = join3(runsDir, entry.name);
     let startedAt = 0;
     let endedAt;
     let completed = false;
     try {
-      const manifest = JSON.parse(await readFile(join3(path100, "manifest.json"), "utf8"));
+      const manifest = JSON.parse(await readFile(join3(path101, "manifest.json"), "utf8"));
       startedAt = manifest.startedAt ?? 0;
       endedAt = manifest.endedAt;
       completed = Boolean(endedAt) && manifest.status !== "running";
     } catch {
       completed = false;
     }
-    infos.push({ name: entry.name, path: path100, startedAt, endedAt, completed, bytes: await dirSize(path100) });
+    infos.push({ name: entry.name, path: path101, startedAt, endedAt, completed, bytes: await dirSize(path101) });
   }
   const remove = async (info) => {
     await rm(info.path, { recursive: true, force: true });
@@ -25709,12 +25754,12 @@ var init_engine = __esm({
        * content digest) and the returned ref carries the event seq when the
        * emitter resolved one.
        */
-      async fsEvidence(observation, path100, sha256, content, extra = {}) {
+      async fsEvidence(observation, path101, sha256, content, extra = {}) {
         const digest = sha256 && content !== void 0 ? sha256(content) : void 0;
-        const seq = await this.emitEvidence({ observation, path: path100, ...extra, ...digest ? { digest } : {} });
+        const seq = await this.emitEvidence({ observation, path: path101, ...extra, ...digest ? { digest } : {} });
         return {
           tier: "fs-observation",
-          ref: path100,
+          ref: path101,
           capturedAt: Date.now(),
           ...digest ? { digest } : {},
           ...seq !== void 0 ? { seq } : {}
@@ -27184,11 +27229,14 @@ var init_contractCompiler = __esm({
 var verificationBridge_exports = {};
 __export(verificationBridge_exports, {
   STRICT_DONE_EXIT_CODE: () => STRICT_DONE_EXIT_CODE,
+  allowUnverified: () => allowUnverified,
   anchorSelectionEvidence: () => anchorSelectionEvidence,
   evaluateStrictBuildGate: () => evaluateStrictBuildGate,
   evaluateStrictBuildGateFromSession: () => evaluateStrictBuildGateFromSession,
   krakenResultsToContract: () => krakenResultsToContract,
   matchNoteToToolTrace: () => matchNoteToToolTrace,
+  missionClaimExitCode: () => missionClaimExitCode,
+  repairExcerptsFromEvaluation: () => repairExcerptsFromEvaluation,
   strictDoneEnabled: () => strictDoneEnabled,
   strictEnvOverlay: () => strictEnvOverlay,
   strictGateEventPayload: () => strictGateEventPayload,
@@ -27224,20 +27272,20 @@ function criterionId(check2, index) {
 function normalize3(text) {
   return text.toLowerCase().replace(/\s+/g, " ").trim();
 }
-function matchResult(check2, byNormalized) {
-  const norm = normalize3(check2);
-  const direct = byNormalized.get(norm);
-  if (direct) return direct;
-  for (const key of byNormalized.keys()) {
-    if (key.length >= 8 && (key.includes(norm) || norm.includes(key))) {
-      return byNormalized.get(key);
-    }
+function matchResult(check2, byNormalized, byId, id3) {
+  if (byId && id3) {
+    const byCriterion = byId.get(id3);
+    if (byCriterion) return byCriterion;
   }
-  return void 0;
+  return byNormalized.get(normalize3(check2));
 }
 function krakenResultsToContract(requiredChecks, results, now = Date.now()) {
   const byNormalized = /* @__PURE__ */ new Map();
-  for (const r of results ?? []) byNormalized.set(normalize3(r.check), r);
+  const byId = /* @__PURE__ */ new Map();
+  for (const r of results ?? []) {
+    byNormalized.set(normalize3(r.check), r);
+    if (r.criterionId) byId.set(r.criterionId, r);
+  }
   const criteria = [];
   const verifications = [];
   requiredChecks.forEach((check2, i) => {
@@ -27247,12 +27295,12 @@ function krakenResultsToContract(requiredChecks, results, now = Date.now()) {
       text: check2,
       source: "kraken-selection",
       required: true,
-      check: { kind: "none", reason: "verified by verify tentacle report" }
+      check: { kind: "none", reason: "verify tentacle proposal \u2014 runtime evidence required" }
     });
-    const reported = matchResult(check2, byNormalized);
+    const reported = matchResult(check2, byNormalized, byId, id3);
     const evidence = reported?.note && reported.note.trim().length > 0 ? [
       {
-        tier: "tool-output",
+        tier: "verifier-llm",
         ref: reported.note.trim().slice(0, 500),
         capturedAt: now
       }
@@ -27299,12 +27347,12 @@ async function anchorSelectionEvidence(results, emit, toolTrace) {
   for (const r of results) {
     for (const ev of r.evidence) {
       if (ev.seq !== void 0) continue;
-      if (ev.tier === "verifier-llm" || ev.tier === "human") continue;
+      if (ev.tier === "human") continue;
       try {
         const match = toolTrace && toolTrace.length > 0 ? matchNoteToToolTrace(ev.ref, toolTrace) : null;
         if (match) {
           const digest = sha256Hex2(match.output);
-          const appended2 = await emit({
+          const appended = await emit({
             kind: "verification.evidence",
             actor: { type: "system", role: "verification" },
             data: {
@@ -27320,16 +27368,17 @@ async function anchorSelectionEvidence(results, emit, toolTrace) {
               ...match.command ? { command: match.command } : {}
             }
           });
-          const toolSeq = appended2 && typeof appended2 === "object" && "seq" in appended2 ? Number(appended2.seq) : NaN;
+          const toolSeq = appended && typeof appended === "object" && "seq" in appended ? Number(appended.seq) : NaN;
           if (Number.isFinite(toolSeq) && toolSeq > 0) {
             ev.seq = toolSeq;
             ev.digest = digest;
+            ev.tier = "tool-output";
             ev.ref = `${match.tool}${match.command ? ` ${match.command}` : ""} \u2192 ${match.ok ? "ok" : "error"} @seq`;
             counts.toolResultAnchored += 1;
           }
           continue;
         }
-        const appended = await emit({
+        await emit({
           kind: "verification.evidence",
           actor: { type: "system", role: "verification" },
           data: {
@@ -27337,14 +27386,11 @@ async function anchorSelectionEvidence(results, emit, toolTrace) {
             provenance: "note-fallback",
             criterionId: r.criterionId,
             ref: ev.ref,
-            tier: ev.tier
+            tier: ev.tier,
+            anchored: false
           }
         });
-        const seq = appended && typeof appended === "object" && "seq" in appended ? Number(appended.seq) : NaN;
-        if (Number.isFinite(seq) && seq > 0) {
-          ev.seq = seq;
-          counts.noteFallback += 1;
-        }
+        counts.noteFallback += 1;
       } catch {
       }
     }
@@ -27358,7 +27404,8 @@ async function evaluateStrictBuildGate(mode, options = {}) {
   const selectionAvailable = gate.selectionUsed && gate.total > 0;
   const scopeContract = options.taskContract ?? activeContractScope()?.contract;
   const contractPlan = scopeContract ? compileVerificationCriteria(scopeContract) : [];
-  if (!selectionAvailable && !nativeOn && contractPlan.length === 0 || !strictOn && !nativeOn) {
+  const nothingBindable = !selectionAvailable && !nativeOn && contractPlan.length === 0;
+  if (!strictOn && !nativeOn) {
     return {
       gate,
       strict: false,
@@ -27368,6 +27415,17 @@ async function evaluateStrictBuildGate(mode, options = {}) {
       summary: gate.blocked ? `blocked: ${gate.failedChecks.length} failed, ${gate.unknownChecks.length} unknown` : "open"
     };
   }
+  if (nothingBindable) {
+    return {
+      gate,
+      strict: true,
+      unverified: true,
+      evaluation: null,
+      native: null,
+      blocked: true,
+      summary: "unverified (strict on: no criteria \u2014 pack off/unbound, no selection contract, no task contract)"
+    };
+  }
   const checks = selectionAvailable ? krakenRequiredChecks() : [];
   const contract = selectionAvailable ? krakenResultsToContract(checks, getKrakenCheckResults()) : { criteria: [], results: [] };
   const anchoring = await anchorSelectionEvidence(
@@ -27389,6 +27447,19 @@ async function evaluateStrictBuildGate(mode, options = {}) {
   const allCriteria = [...contract.criteria, ...native?.criteria ?? [], ...compiled?.criteria ?? []];
   const allResults = [...contract.results, ...native?.results ?? [], ...compiled?.results ?? []];
   if (allCriteria.length === 0) {
+    if (strictOn) {
+      return {
+        gate,
+        strict: true,
+        unverified: true,
+        evaluation: null,
+        native,
+        compiled,
+        results: allResults,
+        blocked: true,
+        summary: "unverified (strict on: native pack bound no command, no selection contract)"
+      };
+    }
     return {
       gate,
       strict: false,
@@ -27414,14 +27485,51 @@ async function evaluateStrictBuildGate(mode, options = {}) {
     summary: blocked ? `blocked (strict ${evaluation?.verdict ?? "n/a"}): ${legacyPart}evidence ${evaluation?.evidenceComplete ? "complete" : "incomplete"}` : `open (strict PASS): ${evaluation?.satisfied.length ?? 0}/${allCriteria.length} criteria pass with evidence`
   };
 }
-function strictGateExitCode(evaluation) {
-  return evaluation.strict && evaluation.blocked ? STRICT_DONE_EXIT_CODE : 0;
+function repairExcerptsFromEvaluation(evaluation) {
+  const excerpts = /* @__PURE__ */ new Map();
+  const nameById = /* @__PURE__ */ new Map();
+  for (const c of [...evaluation.native?.criteria ?? [], ...evaluation.compiled?.criteria ?? []]) {
+    nameById.set(c.id, c.text);
+  }
+  try {
+    krakenRequiredChecks().forEach((text, i) => {
+      if (!nameById.has(criterionId(text, i))) nameById.set(criterionId(text, i), text);
+    });
+  } catch {
+  }
+  for (const r of evaluation.results ?? []) {
+    if (r.status === "pass") continue;
+    const detail = r.detail?.trim();
+    if (!detail) continue;
+    excerpts.set(nameById.get(r.criterionId) ?? r.criterionId, detail);
+  }
+  return excerpts;
+}
+function allowUnverified(env = process.env) {
+  const v = env.ZELARI_ALLOW_UNVERIFIED?.toLowerCase();
+  return v === "1" || v === "true" || v === "yes" || v === "on";
+}
+function strictGateExitCode(evaluation, env = process.env) {
+  if (evaluation.strict && evaluation.blocked) {
+    if (evaluation.unverified && allowUnverified(env)) return 0;
+    return STRICT_DONE_EXIT_CODE;
+  }
+  return 0;
+}
+function missionClaimExitCode(evidenceCount, env = process.env) {
+  if (evidenceCount < 0) return 0;
+  if (evidenceCount > 0) return 0;
+  if (allowUnverified(env)) return 0;
+  return STRICT_DONE_EXIT_CODE;
 }
 function strictGateEventPayload(evaluation) {
   return {
     engine: evaluation.native ? "kraken-legacy+completion-policy+criteria-pack" : "kraken-legacy+completion-policy",
     strict: evaluation.strict,
     verdict: evaluation.evaluation?.verdict ?? (evaluation.blocked ? "BLOCKED" : "PASS"),
+    // M1.2: UNVERIFIED marker — strict on, nothing evaluable. Present only
+    // when true so historical payloads stay byte-identical.
+    ...evaluation.unverified ? { unverified: true } : {},
     legacy: {
       total: evaluation.gate.total,
       passed: evaluation.gate.passed,
@@ -31734,11 +31842,11 @@ var init_synthesisAudit = __esm({
 import { existsSync as existsSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join5 } from "node:path";
 function loadNfrSpec(zelariRoot) {
-  const path100 = join5(zelariRoot, "nfr-spec.json");
-  if (!existsSync10(path100))
+  const path101 = join5(zelariRoot, "nfr-spec.json");
+  if (!existsSync10(path101))
     return null;
   try {
-    const raw = JSON.parse(readFileSync9(path100, "utf8"));
+    const raw = JSON.parse(readFileSync9(path101, "utf8"));
     if (raw.version !== 1 || !Array.isArray(raw.targets))
       return null;
     return raw;
@@ -34139,9 +34247,9 @@ var init_types9 = __esm({
 import { readFileSync as readFileSync14 } from "node:fs";
 import { join as join11 } from "node:path";
 function readLessonsDeduped(zelariRoot) {
-  const path100 = join11(zelariRoot, LESSONS_FILE);
+  const path101 = join11(zelariRoot, LESSONS_FILE);
   try {
-    const raw = readFileSync14(path100, "utf8");
+    const raw = readFileSync14(path101, "utf8");
     const byId = /* @__PURE__ */ new Map();
     for (const line of raw.split(/\r?\n/)) {
       if (!line.trim())
@@ -34242,8 +34350,8 @@ function keywordsFrom(check2, signature) {
   return [.../* @__PURE__ */ new Set([...fromId, ...words])].slice(0, 12);
 }
 function writeLesson(zelariRoot, lesson) {
-  const path100 = join12(zelariRoot, LESSONS_FILE);
-  appendFileSync(path100, `${JSON.stringify(lesson)}
+  const path101 = join12(zelariRoot, LESSONS_FILE);
+  appendFileSync(path101, `${JSON.stringify(lesson)}
 `, "utf8");
 }
 function findSimilar(lessons, signature) {
@@ -36211,9 +36319,9 @@ function findCycle(nodes) {
     if (color.get(start) !== WHITE)
       continue;
     const stack = [[start, 0]];
-    const path100 = [];
+    const path101 = [];
     color.set(start, GRAY);
-    path100.push(start);
+    path101.push(start);
     while (stack.length > 0) {
       const top = stack[stack.length - 1];
       const [id3, idx] = top;
@@ -36226,17 +36334,17 @@ function findCycle(nodes) {
           continue;
         const c = color.get(dep);
         if (c === GRAY) {
-          const at = path100.indexOf(dep);
-          return [...path100.slice(at), dep];
+          const at = path101.indexOf(dep);
+          return [...path101.slice(at), dep];
         }
         if (c === WHITE) {
           color.set(dep, GRAY);
-          path100.push(dep);
+          path101.push(dep);
           stack.push([dep, 0]);
         }
       } else {
         color.set(id3, BLACK);
-        path100.pop();
+        path101.pop();
         stack.pop();
       }
     }
@@ -37156,8 +37264,8 @@ var init_runner = __esm({
           failed: [...this.tentaclesById.values()].filter((r) => r.status === "error"),
           pending: []
         };
-        const path100 = await this.host.saveSnapshot(snapshot, ".zelari/kraken/snapshots");
-        this.host.log(`checkpoint: ${label ?? "auto"} \u2192 ${path100}`);
+        const path101 = await this.host.saveSnapshot(snapshot, ".zelari/kraken/snapshots");
+        this.host.log(`checkpoint: ${label ?? "auto"} \u2192 ${path101}`);
         return snapshot;
       }
       callLog(msg, data) {
@@ -38308,7 +38416,7 @@ var CORE_VERSION;
 var init_version = __esm({
   "packages/core/dist/version.js"() {
     "use strict";
-    CORE_VERSION = "2.37.0";
+    CORE_VERSION = "2.37.2";
   }
 });
 
@@ -40767,9 +40875,9 @@ function spillToolOutput(fullText, meta3) {
     const rnd = randomBytes3(3).toString("hex");
     const safeTool = (meta3?.toolName ?? "tool").replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 32);
     const file2 = `${stamp}-${safeTool}-${hash3}-${rnd}.txt`;
-    const path100 = join14(dir, file2);
-    writeFileSync12(path100, fullText, "utf8");
-    return path100;
+    const path101 = join14(dir, file2);
+    writeFileSync12(path101, fullText, "utf8");
+    return path101;
   } catch {
     return null;
   }
@@ -40815,10 +40923,10 @@ function truncateToolResult(text, capOrOpts = TOOL_RESULT_LINE_CAP) {
 ${tail2}`;
   }
   if (doSpill) {
-    const path100 = spillToolOutput(text, { toolName: opts.toolName });
-    if (path100) {
+    const path101 = spillToolOutput(text, { toolName: opts.toolName });
+    if (path101) {
       const spillNote = `
-\u2026 [full output spilled to: ${path100} \u2014 re-read with read_file if you need the complete text] \u2026`;
+\u2026 [full output spilled to: ${path101} \u2014 re-read with read_file if you need the complete text] \u2026`;
       if (preview.includes("] \u2026\n")) {
         preview = preview.replace("] \u2026\n", `] \u2026${spillNote}
 `);
@@ -41589,28 +41697,28 @@ var init_storage = __esm({
     VALID_SCALARS = /^(true|false|null|~)$/i;
     Storage = class {
       /** Read a Markdown file with frontmatter. Throws if not found. */
-      read(path100) {
-        if (!existsSync19(path100)) {
-          throw new Error(`File not found: ${path100}`);
+      read(path101) {
+        if (!existsSync19(path101)) {
+          throw new Error(`File not found: ${path101}`);
         }
-        const md = readFileSync17(path100, "utf8");
+        const md = readFileSync17(path101, "utf8");
         return parseFrontmatter(md);
       }
       /** Read a Markdown file; returns null if not found. */
-      readIfExists(path100) {
-        if (!existsSync19(path100)) return null;
-        return this.read(path100);
+      readIfExists(path101) {
+        if (!existsSync19(path101)) return null;
+        return this.read(path101);
       }
       /**
        * Write a Markdown file atomically (tmp + rename). Creates parent dirs.
        * The meta object is serialized as YAML frontmatter; body as Markdown.
        */
-      write(path100, meta3, body) {
-        mkdirSync10(dirname2(path100), { recursive: true });
-        const tmp = path100 + ".tmp-" + process.pid;
+      write(path101, meta3, body) {
+        mkdirSync10(dirname2(path101), { recursive: true });
+        const tmp = path101 + ".tmp-" + process.pid;
         const md = serializeFrontmatter(meta3, body);
         writeFileSync14(tmp, md, "utf8");
-        renameSync2(tmp, path100);
+        renameSync2(tmp, path101);
       }
       /** List all .md files in a directory (non-recursive). */
       listMarkdown(dir) {
@@ -41721,8 +41829,8 @@ function nextPlanTaskId(store6) {
   return `t${store6.counter}`;
 }
 function writePlanTaskArtifact(rootDir, task) {
-  const path100 = join17(rootDir, "plan-tasks", `${task.id}.md`);
-  mkdirSync11(dirname3(path100), { recursive: true });
+  const path101 = join17(rootDir, "plan-tasks", `${task.id}.md`);
+  mkdirSync11(dirname3(path101), { recursive: true });
   const meta3 = {
     kind: "task",
     id: task.id,
@@ -41743,7 +41851,7 @@ function writePlanTaskArtifact(rootDir, task) {
     task.notes?.trim() ? task.notes.trim() : "_(no notes)_",
     ""
   ].filter((l) => l !== null).join("\n");
-  new Storage().write(path100, meta3, body);
+  new Storage().write(path101, meta3, body);
 }
 function loadHandle(rootDir) {
   const jsonPath = join17(rootDir, "plan.json");
@@ -48175,6 +48283,7 @@ function frozenProfile(input) {
   Object.freeze(input.buildRecovery);
   Object.freeze(input.sampling);
   Object.freeze(input.compaction);
+  if (input.stream) Object.freeze(input.stream);
   return Object.freeze(input);
 }
 function resolveHarnessProfile(model, providerId) {
@@ -48247,6 +48356,18 @@ var init_capabilities = __esm({
       buildRecovery: { forceToolChoice: true, maxForcedTurns: 1 },
       sampling: { temperature: 0.7 },
       compaction: { ...SHARED_COMPACTION },
+      // Copied from Grok Build (`~/.grok/config.toml` + user-guide):
+      //   inference_idle_timeout_secs = 600
+      //   max_retries = 8
+      //   xAI SDK timeout = 3600s on reasoning models
+      // grok-4.6 xhigh reasons with hidden tokens + SSE keep-alives and no
+      // content for minutes; a 5-min useful-token idle kills BUILD.
+      stream: {
+        idleMs: 6e5,
+        firstTokenIdleMs: 6e5,
+        maxMs: 36e5,
+        maxRetries: 8
+      },
       profile: "grok"
     });
     MINIMAX_M3_CAPS = frozenProfile({
@@ -50871,18 +50992,40 @@ var openai_compatible_exports = {};
 __export(openai_compatible_exports, {
   PROVIDER_CONNECT_TIMEOUT_MS: () => PROVIDER_CONNECT_TIMEOUT_MS,
   PROVIDER_ENDPOINTS: () => PROVIDER_ENDPOINTS,
+  PROVIDER_FIRST_TOKEN_IDLE_MS: () => PROVIDER_FIRST_TOKEN_IDLE_MS,
   PROVIDER_STREAM_IDLE_MS: () => PROVIDER_STREAM_IDLE_MS,
   PROVIDER_STREAM_MAX_MS: () => PROVIDER_STREAM_MAX_MS,
   dataUriFromImage: () => dataUriFromImage,
+  glmModelLooksVision: () => glmModelLooksVision,
+  isGlmCodingEndpoint: () => isGlmCodingEndpoint,
+  isTextOnlyContentRejection: () => isTextOnlyContentRejection,
   modelSupportsVision: () => modelSupportsVision,
   openaiCompatibleProvider: () => openaiCompatibleProvider,
   parseCachedPromptTokens: () => parseCachedPromptTokens,
   providerConfigFor: () => providerConfigFor,
   providerFromEnv: () => providerFromEnv,
   readChunkWithTimeout: () => readChunkWithTimeout,
+  resetTextOnlyVisionMemory: () => resetTextOnlyVisionMemory,
   resolveActiveProvider: () => resolveActiveProvider2,
-  resolveBaseUrl: () => resolveBaseUrl
-});
+  resolveBaseUrl: () => resolveBaseUrl,
+  resolveStreamTimeouts: () => resolveStreamTimeouts
+});
+function resolveStreamTimeouts(capabilities) {
+  const envIdle = process.env.ZELARI_PROVIDER_STREAM_IDLE_MS ?? process.env.ZELARI_PROVIDER_TIMEOUT_MS;
+  const envFirst = process.env.ZELARI_PROVIDER_FIRST_TOKEN_IDLE_MS;
+  const envMax = process.env.ZELARI_PROVIDER_STREAM_MAX_MS;
+  const envRetries = process.env.ZELARI_PROVIDER_MAX_RETRIES;
+  const idleMs = envIdle ? PROVIDER_STREAM_IDLE_MS : capabilities.stream?.idleMs ?? PROVIDER_STREAM_IDLE_MS;
+  const firstRaw = envFirst ? PROVIDER_FIRST_TOKEN_IDLE_MS : capabilities.stream?.firstTokenIdleMs ?? PROVIDER_FIRST_TOKEN_IDLE_MS;
+  const maxMs = envMax ? PROVIDER_STREAM_MAX_MS : capabilities.stream?.maxMs ?? PROVIDER_STREAM_MAX_MS;
+  const maxRetries = envRetries ? MAX_RETRIES : capabilities.stream?.maxRetries ?? MAX_RETRIES;
+  return {
+    idleMs,
+    firstTokenIdleMs: Math.max(firstRaw, idleMs),
+    maxMs,
+    maxRetries
+  };
+}
 function abortableSleep(ms, signal) {
   return new Promise((resolve9) => {
     if (signal?.aborted) return resolve9();
@@ -50901,6 +51044,12 @@ function isTimeoutAbortMessage(msg) {
   const m = msg.toLowerCase();
   return m.includes("aborted due to timeout") || m.includes("timeout") || m.includes("the operation was aborted");
 }
+function formatStreamIdleError(elapsedMs, budgetMs, kind2) {
+  const elapsedS = Math.max(1, Math.round(elapsedMs / 1e3));
+  const budgetS = Math.max(1, Math.round(budgetMs / 1e3));
+  const why = kind2 === "keep-alive" ? "no content tokens \u2014 keep-alive frames don't count" : "no tokens";
+  return `Provider stream idle for ${elapsedS}s of ${budgetS}s (${why}). The model/gateway stalled \u2014 try again or switch model. Override with ZELARI_PROVIDER_STREAM_IDLE_MS or ZELARI_PROVIDER_FIRST_TOKEN_IDLE_MS.`;
+}
 async function readChunkWithTimeout(reader, opts) {
   if (opts.signal?.aborted) {
     throw new Error("aborted");
@@ -50914,9 +51063,7 @@ async function readChunkWithTimeout(reader, opts) {
   }
   const idleElapsed = now - opts.lastUsefulAt();
   if (idleElapsed >= opts.idleMs) {
-    throw new Error(
-      `Provider stream idle for ${Math.round(idleElapsed / 1e3)}s (no content tokens \u2014 keep-alive frames don't count). The model/gateway stalled \u2014 try again or switch model. Override with ZELARI_PROVIDER_STREAM_IDLE_MS.`
-    );
+    throw new Error(formatStreamIdleError(idleElapsed, opts.idleMs, "keep-alive"));
   }
   const waitMs = Math.min(opts.idleMs - idleElapsed, remaining);
   let idleTimer;
@@ -50926,11 +51073,8 @@ async function readChunkWithTimeout(reader, opts) {
       reader.read(),
       new Promise((_, reject) => {
         idleTimer = setTimeout(() => {
-          reject(
-            new Error(
-              `Provider stream idle for ${Math.round(waitMs / 1e3)}s (no tokens). The model/gateway stalled \u2014 try again or switch model. Override with ZELARI_PROVIDER_STREAM_IDLE_MS.`
-            )
-          );
+          const elapsed = Date.now() - opts.lastUsefulAt();
+          reject(new Error(formatStreamIdleError(elapsed, opts.idleMs, "silence")));
         }, waitMs);
         if (opts.signal) {
           onAbort = () => reject(new Error("aborted"));
@@ -50952,9 +51096,52 @@ function backoffDelay(attempt, retryAfterHeader) {
   }
   return Math.min(BACKOFF_BASE_MS * 2 ** attempt, BACKOFF_CAP_MS);
 }
-function modelSupportsVision(_model) {
-  const force = process.env.ZELARI_VISION;
-  return !(force === "0" || force === "false" || force === "off");
+function visionMemoryKey(model, probe) {
+  return `${probe?.providerId ?? ""}::${model}::${probe?.baseUrl ?? ""}`;
+}
+function resetTextOnlyVisionMemory() {
+  textOnlyVisionMemory.clear();
+}
+function isGlmCodingEndpoint(baseUrl) {
+  if (!baseUrl) return false;
+  return /\/coding(\/|$)/i.test(baseUrl);
+}
+function glmModelLooksVision(model) {
+  const n = model.trim().toLowerCase();
+  if (!n) return false;
+  if (/(?:^|[-_/.])(?:vl|vision)(?:[-_/.]|$)/.test(n)) return true;
+  return /^glm[-_.]?[\w.]*v(?:-|$)/.test(n);
+}
+function glmModelIsTextOnly(model) {
+  const n = model.trim().toLowerCase();
+  if (!n.startsWith("glm")) return false;
+  return !glmModelLooksVision(n);
+}
+function isTextOnlyContentRejection(status, body) {
+  if (status !== 400) return false;
+  if (!/messages\.content\.type/i.test(body)) return false;
+  return /allowed values/i.test(body) || /\[\s*['"]text['"]\s*\]/.test(body) || /取值范围/.test(body) || /is invalid/i.test(body);
+}
+function messagesHaveImageUrl(messages) {
+  for (const m of messages) {
+    const content = m.content;
+    if (!Array.isArray(content)) continue;
+    for (const part of content) {
+      if (part && typeof part === "object" && part.type === "image_url") {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function modelSupportsVision(model, probe) {
+  const force = (process.env.ZELARI_VISION ?? "").trim().toLowerCase();
+  if (force === "0" || force === "false" || force === "off") return false;
+  if (force === "1" || force === "true" || force === "on") return true;
+  if (textOnlyVisionMemory.has(visionMemoryKey(model, probe))) return false;
+  if (isGlmCodingEndpoint(probe?.baseUrl)) return false;
+  if (glmModelIsTextOnly(model)) return false;
+  return true;
 }
 function dataUriFromImage(img) {
   return `data:${img.mime};base64,${img.dataBase64}`;
@@ -51074,29 +51261,38 @@ function positiveEnvInt(name) {
 function openaiCompatibleProvider(config2) {
   return async function* (params) {
     const capabilities = capabilitiesFor(params.model, config2.providerId);
-    const vision = modelSupportsVision(params.model);
+    const streamTimeouts = resolveStreamTimeouts(capabilities);
+    const visionProbe = {
+      providerId: config2.providerId,
+      baseUrl: config2.baseUrl
+    };
+    let vision = modelSupportsVision(params.model, visionProbe);
     const msgsIn = params.messages;
-    let toolRunImages = [];
-    const messages = msgsIn.flatMap((m, i) => {
-      const cacheable = !(m.role === "user" && m.images && m.images.length > 0);
-      if (cacheable) {
-        const cached2 = messageMappingCache.get(m);
-        if (cached2) return [cached2];
-      }
-      const mapped = mapAgentMessage(m, vision);
-      if (cacheable) messageMappingCache.set(m, mapped);
-      if (m.role === "tool") {
-        if (m.images && m.images.length > 0) toolRunImages.push(...m.images);
-        const next = msgsIn[i + 1];
-        const runEnds = !next || next.role !== "tool";
-        if (runEnds && vision && toolRunImages.length > 0) {
-          const followUp = imagesFollowUpMessage(toolRunImages);
-          toolRunImages = [];
-          return [mapped, followUp];
-        }
-      }
-      return [mapped];
-    });
+    const wireMessages = (visionFlag) => {
+      let toolRunImages = [];
+      return msgsIn.flatMap((m, i) => {
+        const cacheable = visionFlag && !(m.role === "user" && m.images && m.images.length > 0);
+        if (cacheable) {
+          const cached2 = messageMappingCache.get(m);
+          if (cached2) return [cached2];
+        }
+        const mapped = mapAgentMessage(m, visionFlag);
+        if (cacheable) messageMappingCache.set(m, mapped);
+        if (m.role === "tool") {
+          if (m.images && m.images.length > 0) toolRunImages.push(...m.images);
+          const next = msgsIn[i + 1];
+          const runEnds = !next || next.role !== "tool";
+          if (runEnds && visionFlag && toolRunImages.length > 0) {
+            const followUp = imagesFollowUpMessage(toolRunImages);
+            toolRunImages = [];
+            return [mapped, followUp];
+          }
+          if (runEnds) toolRunImages = [];
+        }
+        return [mapped];
+      });
+    };
+    let messages = wireMessages(vision);
     const generation = params.generation;
     const body = {
       // Use `params.model` (per-call override from AgentHarness, e.g. for
@@ -51146,6 +51342,7 @@ function openaiCompatibleProvider(config2) {
       const recoveryAttempt = generation?.recoveryAttempt ?? 1;
       const forceRecoveryTool = generation?.toolChoice === "required" && capabilities.buildRecovery.forceToolChoice && recoveryAttempt <= capabilities.buildRecovery.maxForcedTurns;
       body.tool_choice = forceRecoveryTool ? "required" : "auto";
+      if (config2.providerId === "glm") body.tool_stream = true;
     }
     const headers3 = {
       "Content-Type": "application/json",
@@ -51160,7 +51357,7 @@ function openaiCompatibleProvider(config2) {
     let response;
     let lastErrText = "";
     let lastStatus = 0;
-    for (let attempt = 0; attempt <= MAX_RETRIES; attempt += 1) {
+    for (let attempt = 0; attempt <= streamTimeouts.maxRetries; attempt += 1) {
       if (params.signal?.aborted) {
         yield { kind: "error", message: "aborted" };
         return;
@@ -51201,7 +51398,7 @@ function openaiCompatibleProvider(config2) {
           yield { kind: "error", message: "aborted" };
           return;
         }
-        const maxAttempts = isTimeoutAbortMessage(lastErrText) ? Math.min(1, MAX_RETRIES) : MAX_RETRIES;
+        const maxAttempts = isTimeoutAbortMessage(lastErrText) ? Math.min(1, streamTimeouts.maxRetries) : streamTimeouts.maxRetries;
         if (attempt < maxAttempts) {
           await abortableSleep(backoffDelay(attempt, null), params.signal);
           continue;
@@ -51212,7 +51409,14 @@ function openaiCompatibleProvider(config2) {
       if (response.ok && response.body) break;
       lastStatus = response.status;
       lastErrText = await response.text().catch(() => "");
-      if (!RETRYABLE_STATUSES.has(response.status) || attempt >= MAX_RETRIES) break;
+      if (vision && isTextOnlyContentRejection(lastStatus, lastErrText) && messagesHaveImageUrl(messages)) {
+        textOnlyVisionMemory.add(visionMemoryKey(params.model, visionProbe));
+        vision = false;
+        messages = wireMessages(false);
+        body.messages = messages;
+        continue;
+      }
+      if (!RETRYABLE_STATUSES.has(response.status) || attempt >= streamTimeouts.maxRetries) break;
       const retryAfter = response.headers.get("retry-after");
       await abortableSleep(backoffDelay(attempt, retryAfter), params.signal);
     }
@@ -51258,17 +51462,19 @@ function openaiCompatibleProvider(config2) {
       }
       toolCallAccumulator.clear();
     };
-    const streamDeadline = Date.now() + PROVIDER_STREAM_MAX_MS;
+    const streamDeadline = Date.now() + streamTimeouts.maxMs;
     let lastUsefulAt = Date.now();
+    let emittedUseful = false;
     const markUseful = () => {
       lastUsefulAt = Date.now();
+      emittedUseful = true;
     };
     try {
       while (true) {
         let chunk;
         try {
           chunk = await readChunkWithTimeout(reader, {
-            idleMs: PROVIDER_STREAM_IDLE_MS,
+            idleMs: emittedUseful ? streamTimeouts.idleMs : streamTimeouts.firstTokenIdleMs,
             deadlineMs: streamDeadline,
             signal: params.signal,
             lastUsefulAt: () => lastUsefulAt
@@ -51323,17 +51529,33 @@ function openaiCompatibleProvider(config2) {
                 }
               };
             }
-            if (typeof delta?.content === "string" && delta.content.length > 0) {
+            const content = delta?.content;
+            if (typeof content === "string" && content.length > 0) {
               markUseful();
-              yield { kind: "text", delta: delta.content };
+              yield { kind: "text", delta: content };
+            } else if (Array.isArray(content)) {
+              for (const part of content) {
+                if (!part || typeof part !== "object") continue;
+                const p3 = part;
+                const text = typeof p3.text === "string" ? p3.text : "";
+                if (!text) continue;
+                markUseful();
+                const partType = typeof p3.type === "string" ? p3.type : "text";
+                yield {
+                  kind: partType === "reasoning" || partType === "thinking" ? "thinking" : "text",
+                  delta: text
+                };
+              }
             }
-            const reasoning = delta?.reasoning_content ?? delta?.reasoning;
-            if (typeof reasoning === "string" && reasoning.length > 0) {
+            const reasoningRaw = delta?.reasoning_content ?? delta?.reasoning ?? delta?.thinking;
+            const reasoning = typeof reasoningRaw === "string" ? reasoningRaw : reasoningRaw && typeof reasoningRaw === "object" && typeof reasoningRaw.text === "string" ? reasoningRaw.text : reasoningRaw && typeof reasoningRaw === "object" && typeof reasoningRaw.content === "string" ? reasoningRaw.content : "";
+            if (reasoning.length > 0) {
               markUseful();
               yield { kind: "thinking", delta: reasoning };
             }
             const details = delta?.reasoning_details;
-            if (Array.isArray(details)) {
+            if (Array.isArray(details) && details.length > 0) {
+              markUseful();
               for (const d of details) {
                 if (!d || typeof d !== "object") continue;
                 const t = d.text;
@@ -51353,6 +51575,7 @@ function openaiCompatibleProvider(config2) {
               }
             }
             if (Array.isArray(delta?.tool_calls)) {
+              markUseful();
               for (const tc of delta.tool_calls) {
                 const idx = tc.index ?? 0;
                 const existing = toolCallAccumulator.get(idx) ?? {
@@ -51419,7 +51642,7 @@ async function providerConfigFor(providerId) {
     ...extraFromStored(providerId)
   };
 }
-var RETRYABLE_STATUSES, MAX_RETRIES, BACKOFF_BASE_MS, BACKOFF_CAP_MS, PROVIDER_CONNECT_TIMEOUT_MS, PROVIDER_STREAM_IDLE_MS, PROVIDER_STREAM_MAX_MS, PROVIDER_ENDPOINTS, messageMappingCache;
+var RETRYABLE_STATUSES, MAX_RETRIES, BACKOFF_BASE_MS, BACKOFF_CAP_MS, PROVIDER_CONNECT_TIMEOUT_MS, PROVIDER_STREAM_IDLE_MS, PROVIDER_FIRST_TOKEN_IDLE_MS, PROVIDER_STREAM_MAX_MS, textOnlyVisionMemory, PROVIDER_ENDPOINTS, messageMappingCache;
 var init_openai_compatible = __esm({
   "src/cli/provider/openai-compatible.ts"() {
     "use strict";
@@ -51445,11 +51668,17 @@ var init_openai_compatible = __esm({
       const n = raw ? Number.parseInt(raw, 10) : 3e5;
       return Number.isFinite(n) && n >= 15e3 ? n : 3e5;
     })();
+    PROVIDER_FIRST_TOKEN_IDLE_MS = (() => {
+      const raw = process.env.ZELARI_PROVIDER_FIRST_TOKEN_IDLE_MS;
+      const n = raw ? Number.parseInt(raw, 10) : 6e5;
+      return Number.isFinite(n) && n >= 15e3 ? n : 6e5;
+    })();
     PROVIDER_STREAM_MAX_MS = (() => {
       const raw = process.env.ZELARI_PROVIDER_STREAM_MAX_MS;
       const n = raw ? Number.parseInt(raw, 10) : 18e5;
       return Number.isFinite(n) && n >= 6e4 ? n : 18e5;
     })();
+    textOnlyVisionMemory = /* @__PURE__ */ new Set();
     PROVIDER_ENDPOINTS = {
       "openai-compatible": "https://api.x.ai/v1",
       "minimax": "https://api.minimax.io/v1",
@@ -52074,21 +52303,21 @@ function normalizeAuth(auth) {
   return "agent";
 }
 function readSecrets() {
-  const path100 = getSshSecretsPath();
-  if (!existsSync30(path100)) return {};
+  const path101 = getSshSecretsPath();
+  if (!existsSync30(path101)) return {};
   try {
-    return JSON.parse(readFileSync22(path100, "utf8"));
+    return JSON.parse(readFileSync22(path101, "utf8"));
   } catch {
     return {};
   }
 }
 function writeSecrets(data) {
-  const path100 = getSshSecretsPath();
-  mkdirSync13(dirname4(path100), { recursive: true });
-  writeFileSync16(path100, `${JSON.stringify(data, null, 2)}
+  const path101 = getSshSecretsPath();
+  mkdirSync13(dirname4(path101), { recursive: true });
+  writeFileSync16(path101, `${JSON.stringify(data, null, 2)}
 `, "utf8");
   try {
-    chmodSync(path100, 384);
+    chmodSync(path101, 384);
   } catch {
   }
 }
@@ -52117,10 +52346,10 @@ function deleteSshPassword(id3) {
   writeSecrets({ passwords });
 }
 function readStore2() {
-  const path100 = getSshTargetsPath();
-  if (!existsSync30(path100)) return [];
+  const path101 = getSshTargetsPath();
+  if (!existsSync30(path101)) return [];
   try {
-    const parsed = JSON.parse(readFileSync22(path100, "utf8"));
+    const parsed = JSON.parse(readFileSync22(path101, "utf8"));
     const list = Array.isArray(parsed.targets) ? parsed.targets : [];
     return list.filter(
       (t) => t && typeof t.id === "string" && typeof t.host === "string" && typeof t.user === "string"
@@ -52135,11 +52364,11 @@ function readStore2() {
   }
 }
 function writeStore2(targets) {
-  const path100 = getSshTargetsPath();
-  mkdirSync13(dirname4(path100), { recursive: true });
+  const path101 = getSshTargetsPath();
+  mkdirSync13(dirname4(path101), { recursive: true });
   const clean = targets.map(({ hasPassword: _hp, ...t }) => t);
   writeFileSync16(
-    path100,
+    path101,
     `${JSON.stringify({ targets: clean }, null, 2)}
 `,
     "utf8"
@@ -52385,11 +52614,11 @@ function formatSshTargetsForPrompt() {
   ];
   for (const t of targets) {
     const tags = t.tags?.length ? ` tags=[${t.tags.join(",")}]` : "";
-    const path100 = t.defaultRemotePath ? ` remotePath=${t.defaultRemotePath}` : "";
+    const path101 = t.defaultRemotePath ? ` remotePath=${t.defaultRemotePath}` : "";
     const allow = t.allowedCommands?.length ? ` allowed=${t.allowedCommands.join("|")}` : " allowed=status-only";
     const auth = t.auth === "password" ? " auth=password" : t.auth === "keyPath" ? " auth=key" : " auth=agent";
     lines.push(
-      `- id=${t.id} name=${t.name} ${t.user}@${t.host}:${t.port ?? 22}${auth}${path100}${tags}${allow}`
+      `- id=${t.id} name=${t.name} ${t.user}@${t.host}:${t.port ?? 22}${auth}${path101}${tags}${allow}`
     );
   }
   return lines.join("\n");
@@ -57289,6 +57518,8 @@ function parseHeadlessFlags(argv) {
       missionStrict = true;
     } else if (arg === "--no-mission-strict") {
       missionStrict = false;
+    } else if (arg === "--allow-unverified") {
+      process.env.ZELARI_ALLOW_UNVERIFIED = "1";
     } else if (arg === "--kraken-graph") {
       krakenGraph = argv[i + 1];
       i++;
@@ -57402,6 +57633,7 @@ __export(headlessSpine_exports, {
   seedHeadlessModelHistory: () => seedHeadlessModelHistory,
   sessionStartedEvent: () => sessionStartedEvent
 });
+import path67 from "node:path";
 function sessionStartedEvent(handle) {
   return {
     type: "session_started",
@@ -57413,6 +57645,20 @@ function resolveHeadlessProfileId(mode, explicit) {
   if (explicit) return resolveProfile(explicit).id;
   return defaultProfileForMode(mode ?? "kraken");
 }
+async function countVerificationEvidenceInLog(mirror, sessionId2) {
+  if (mirror.status !== "active" && mirror.status !== "closed") return -1;
+  try {
+    await mirror.flush().catch(() => void 0);
+    const report = await readSessionLog(path67.join(mirror.sessionsDir, sessionId2, "events.jsonl"));
+    return report.events.filter((e) => e.kind === "verification.evidence").length;
+  } catch (err) {
+    process.stderr.write(
+      `[zelari-code] verification-evidence count unavailable (${err instanceof Error ? err.message : String(err)}) \u2014 event-back gate skipped
+`
+    );
+    return -1;
+  }
+}
 async function openHeadlessSpine(opts) {
   const profileId = resolveHeadlessProfileId(opts.mode, opts.profile);
   let profileTools = [];
@@ -57484,6 +57730,9 @@ async function openHeadlessSpine(opts) {
     lastVerificationRun() {
       return spine.lastVerificationRun();
     },
+    countVerificationEvidence() {
+      return countVerificationEvidenceInLog(spine, opts.sessionId);
+    },
     missionPhase(phase2, note) {
       spine.missionPhase(phase2, note);
     },
@@ -57591,6 +57840,7 @@ var init_headlessSpine = __esm({
     init_dist();
     init_session();
     init_mission2();
+    init_session();
     init_runtime();
     init_sessionSpine();
     init_budgetRuntime();
@@ -58194,7 +58444,7 @@ var init_planDetect = __esm({
 // src/cli/memory/legacyImport.ts
 import { createHash as createHash18 } from "node:crypto";
 import { promises as fs27 } from "node:fs";
-import * as path67 from "node:path";
+import * as path68 from "node:path";
 function sourceId(fact, line) {
   return `jsonl:${fact.id ?? createHash18("sha256").update(line).digest("hex")}`;
 }
@@ -58212,7 +58462,7 @@ function timestamp(value) {
 }
 async function importLegacyMemoryLog(backend, service) {
   const result = { found: 0, imported: 0, skipped: 0, corrupt: 0 };
-  const logPath = path67.join(path67.dirname(backend.databasePath), "log.jsonl");
+  const logPath = path68.join(path68.dirname(backend.databasePath), "log.jsonl");
   let raw;
   try {
     raw = await fs27.readFile(logPath, "utf8");
@@ -58395,7 +58645,7 @@ var init_sqliteCodec = __esm({
 // src/cli/memory/sqliteRpc.ts
 import { existsSync as existsSync36 } from "node:fs";
 import { fileURLToPath as fileURLToPath2, pathToFileURL as pathToFileURL2 } from "node:url";
-import * as path68 from "node:path";
+import * as path69 from "node:path";
 import { Worker } from "node:worker_threads";
 function isBusy(error51) {
   const candidate = error51;
@@ -58404,10 +58654,10 @@ function isBusy(error51) {
   );
 }
 function resolveWorkerUrl() {
-  const here = path68.dirname(fileURLToPath2(import.meta.url));
-  const direct = path68.join(here, "sqliteWorker.mjs");
+  const here = path69.dirname(fileURLToPath2(import.meta.url));
+  const direct = path69.join(here, "sqliteWorker.mjs");
   if (existsSync36(direct)) return pathToFileURL2(direct);
-  return pathToFileURL2(path68.join(here, "memory", "sqliteWorker.mjs"));
+  return pathToFileURL2(path69.join(here, "memory", "sqliteWorker.mjs"));
 }
 var SqliteWorkerRpc;
 var init_sqliteRpc = __esm({
@@ -58696,7 +58946,7 @@ WHERE NOT EXISTS (SELECT 1 FROM memory_fts f WHERE f.node_id = n.id);
 // src/cli/memory/sqliteBackend.ts
 import { createHash as createHash19, randomUUID as randomUUID6 } from "node:crypto";
 import { promises as fs28 } from "node:fs";
-import * as path69 from "node:path";
+import * as path70 from "node:path";
 function boundedLimit(value, fallback = 50) {
   return Math.max(1, Math.min(Math.floor(value ?? fallback), 1e5));
 }
@@ -58758,16 +59008,16 @@ VALUES (${Array.from({ length: 19 }, () => "?").join(",")})`;
         try {
           resolved = await fs28.realpath(projectRoot);
         } catch {
-          resolved = path69.resolve(projectRoot);
+          resolved = path70.resolve(projectRoot);
         }
         if (this.initialized && resolved === this.projectRoot) return;
         if (this.initialized) await this.close();
         const filename = this.options.filename ?? "memory.db";
-        if (path69.basename(filename) !== filename || filename === "." || filename === "..") {
+        if (path70.basename(filename) !== filename || filename === "." || filename === "..") {
           throw new Error("SQLite memory filename must not contain a path.");
         }
-        const zelariDirectory = path69.join(resolved, ".zelari");
-        const directory = path69.join(zelariDirectory, "memory");
+        const zelariDirectory = path70.join(resolved, ".zelari");
+        const directory = path70.join(zelariDirectory, "memory");
         for (const candidate of [zelariDirectory, directory]) {
           let stat8;
           try {
@@ -58786,12 +59036,12 @@ VALUES (${Array.from({ length: 19 }, () => "?").join(",")})`;
           }
         }
         const canonicalDirectory = await fs28.realpath(directory);
-        const relativeDirectory = path69.relative(resolved, canonicalDirectory);
-        if (relativeDirectory.startsWith("..") || path69.isAbsolute(relativeDirectory)) {
+        const relativeDirectory = path70.relative(resolved, canonicalDirectory);
+        if (relativeDirectory.startsWith("..") || path70.isAbsolute(relativeDirectory)) {
           throw new Error("SQLite memory directory resolves outside the active project.");
         }
         this.projectRoot = resolved;
-        this.databasePath = path69.join(canonicalDirectory, filename);
+        this.databasePath = path70.join(canonicalDirectory, filename);
         const opened = await this.rpc.open({
           dbPath: this.databasePath,
           schemaSql: SQLITE_MEMORY_BASE_SCHEMA,
@@ -59324,7 +59574,7 @@ __export(serviceFactory_exports, {
 });
 import { createHash as createHash20 } from "node:crypto";
 import { promises as fs29 } from "node:fs";
-import * as path70 from "node:path";
+import * as path71 from "node:path";
 function isMemoryV2Enabled(env = process.env) {
   if (env.ZELARI_MEMORY === "0") return false;
   if (env.ZELARI_MEMORY_BACKEND === "file" || env.ZELARI_MEMORY_BACKEND === "jsonl") return false;
@@ -59345,7 +59595,7 @@ async function canonicalProjectId(projectRoot) {
   try {
     canonical = await fs29.realpath(projectRoot);
   } catch {
-    canonical = path70.resolve(projectRoot);
+    canonical = path71.resolve(projectRoot);
   }
   canonical = canonical.replace(/\\/g, "/").replace(/\/$/, "");
   if (process.platform === "win32") canonical = canonical.toLocaleLowerCase("en-US");
@@ -60047,8 +60297,8 @@ function readPlan(ctx) {
     } catch {
     }
   }
-  const path100 = workspaceFile(ctx.rootDir, "plan");
-  const doc = ctx.storage.readIfExists(path100);
+  const path101 = workspaceFile(ctx.rootDir, "plan");
+  const doc = ctx.storage.readIfExists(path101);
   if (!doc) return { phases: [], tasks: [], milestones: [] };
   const meta3 = doc.meta;
   return {
@@ -60229,7 +60479,7 @@ function addMilestoneRecord(ctx, summary, input) {
     dueDate: input.dueDate,
     targetVersion: version2
   });
-  const path100 = join31(ctx.rootDir, "milestones", `${id3}.md`);
+  const path101 = join31(ctx.rootDir, "milestones", `${id3}.md`);
   const meta3 = {
     kind: "milestone",
     id: id3,
@@ -60246,7 +60496,7 @@ function addMilestoneRecord(ctx, summary, input) {
     `Target version: ${version2}`,
     ""
   ].join("\n");
-  ctx.storage.write(path100, meta3, body);
+  ctx.storage.write(path101, meta3, body);
   return { id: id3, created: true };
 }
 function readPlanSummary(ctx) {
@@ -60450,7 +60700,7 @@ function addIdeaStub(ctx) {
         const tags = args["tags"] ?? [];
         const category = args["category"] ?? "General";
         const id3 = `${nextAdrId(ctx)}-${slugify3(title)}`;
-        const path100 = workspaceArtifact(ctx.rootDir, "decisions", id3);
+        const path101 = workspaceArtifact(ctx.rootDir, "decisions", id3);
         const meta3 = {
           kind: "adr",
           status: "proposed",
@@ -60476,7 +60726,7 @@ function addIdeaStub(ctx) {
           ...consequences.map((c) => `- ${c}`),
           ""
         ].join("\n");
-        ctx.storage.write(path100, meta3, body);
+        ctx.storage.write(path101, meta3, body);
         return `ADR ${id3} created: "${title}". Status: proposed. Promote to accepted via /update ADR or manual edit.`;
       });
     }
@@ -60558,14 +60808,14 @@ function createDocumentStub(ctx) {
           ctx.storage.write(risksPath, riskMeta, content);
           return `Document "${title}" created at risks.md (workspace root).`;
         }
-        const path100 = workspaceArtifact(ctx.rootDir, "docs", slug);
+        const path101 = workspaceArtifact(ctx.rootDir, "docs", slug);
         const meta3 = {
           kind: "doc",
           id: slug,
           date: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
           tags
         };
-        ctx.storage.write(path100, meta3, content);
+        ctx.storage.write(path101, meta3, content);
         return `Document "${title}" created at docs/${slug}.md.`;
       });
     }
@@ -61190,10 +61440,10 @@ function getUserMcpPath() {
 function getProjectMcpPath(projectRoot) {
   return join32(projectRoot, ".zelari", "mcp.json");
 }
-function readFile9(path100) {
-  if (!existsSync42(path100)) return {};
+function readFile9(path101) {
+  if (!existsSync42(path101)) return {};
   try {
-    const parsed = JSON.parse(readFileSync30(path100, "utf8"));
+    const parsed = JSON.parse(readFileSync30(path101, "utf8"));
     const out = {};
     for (const [name, cfg] of Object.entries(parsed.mcpServers ?? {})) {
       const hasCommand = !!cfg && typeof cfg.command === "string" && !!cfg.command.trim();
@@ -61215,10 +61465,10 @@ function readFile9(path100) {
     return {};
   }
 }
-function writeFile3(path100, servers) {
-  mkdirSync17(dirname9(path100), { recursive: true });
+function writeFile3(path101, servers) {
+  mkdirSync17(dirname9(path101), { recursive: true });
   const body = { mcpServers: servers };
-  writeFileSync19(path100, `${JSON.stringify(body, null, 2)}
+  writeFileSync19(path101, `${JSON.stringify(body, null, 2)}
 `, "utf8");
 }
 function listMcpServers(projectRoot) {
@@ -61256,9 +61506,9 @@ function upsertMcpServer(opts) {
       error: "either command (stdio) or url (http) is required"
     };
   }
-  let path100;
+  let path101;
   if (opts.scope === "user") {
-    path100 = getUserMcpPath();
+    path101 = getUserMcpPath();
   } else {
     const root = opts.projectRoot?.trim();
     if (!root) {
@@ -61267,9 +61517,9 @@ function upsertMcpServer(opts) {
         error: "projectRoot required for project scope (Open Folder first)"
       };
     }
-    path100 = getProjectMcpPath(root);
+    path101 = getProjectMcpPath(root);
   }
-  const current = readFile9(path100);
+  const current = readFile9(path101);
   current[name] = {
     command: hasCommand ? opts.config.command.trim() : void 0,
     args: opts.config.args,
@@ -61280,21 +61530,21 @@ function upsertMcpServer(opts) {
     serial: opts.config.serial,
     enabled: opts.config.enabled !== false
   };
-  writeFile3(path100, current);
-  return { ok: true, path: path100 };
+  writeFile3(path101, current);
+  return { ok: true, path: path101 };
 }
 function removeMcpServer(opts) {
-  const path100 = opts.scope === "user" ? getUserMcpPath() : opts.projectRoot ? getProjectMcpPath(opts.projectRoot) : null;
-  if (!path100) {
+  const path101 = opts.scope === "user" ? getUserMcpPath() : opts.projectRoot ? getProjectMcpPath(opts.projectRoot) : null;
+  if (!path101) {
     return { ok: false, error: "projectRoot required for project scope" };
   }
-  const current = readFile9(path100);
+  const current = readFile9(path101);
   if (!(opts.name in current)) {
-    return { ok: false, error: `Server "${opts.name}" not found in ${path100}` };
+    return { ok: false, error: `Server "${opts.name}" not found in ${path101}` };
   }
   delete current[opts.name];
-  writeFile3(path100, current);
-  return { ok: true, path: path100 };
+  writeFile3(path101, current);
+  return { ok: true, path: path101 };
 }
 var init_mcpConfigIo = __esm({
   "src/cli/mcp/mcpConfigIo.ts"() {
@@ -61765,10 +62015,10 @@ import { createHash as createHash21 } from "node:crypto";
 import { join as join34 } from "node:path";
 import { readFile as readFile10 } from "node:fs/promises";
 async function readPackageJson3(projectRoot) {
-  const path100 = join34(projectRoot, "package.json");
-  if (!existsSync44(path100)) return null;
+  const path101 = join34(projectRoot, "package.json");
+  if (!existsSync44(path101)) return null;
   try {
-    return JSON.parse(await readFile10(path100, "utf8"));
+    return JSON.parse(await readFile10(path101, "utf8"));
   } catch {
     return null;
   }
@@ -61850,9 +62100,9 @@ async function genBuild(ctx) {
   ].join("\n");
 }
 async function genOpenQuestions(ctx) {
-  const path100 = join34(ctx.rootDir, "risks.md");
-  if (!existsSync44(path100)) return "_No open questions._";
-  const content = readFileSync32(path100, "utf8");
+  const path101 = join34(ctx.rootDir, "risks.md");
+  if (!existsSync44(path101)) return "_No open questions._";
+  const content = readFileSync32(path101, "utf8");
   const lines = content.split("\n");
   const questions = [];
   let currentTitle = "";
@@ -62126,9 +62376,9 @@ function versionKey(value) {
 function firstString2(v) {
   return typeof v === "string" && v.trim().length > 0 ? v : null;
 }
-function readFileSyncSafe(path100) {
+function readFileSyncSafe(path101) {
   try {
-    return readFileSync33(path100, "utf8");
+    return readFileSync33(path101, "utf8");
   } catch {
     return null;
   }
@@ -62376,7 +62626,7 @@ __export(evidenceFromSpine_exports, {
   evidenceRefsFromEventLines: () => evidenceRefsFromEventLines
 });
 import { existsSync as existsSync47, readFileSync as readFileSync35 } from "node:fs";
-import path71 from "node:path";
+import path72 from "node:path";
 function asRecord2(v) {
   return v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
 }
@@ -62414,7 +62664,7 @@ function evidenceRefsFromEventLines(lines) {
 }
 function collectSessionEvidenceRefs(sessionId2) {
   try {
-    const file2 = path71.join(sessionsDir(), sessionId2, "events.jsonl");
+    const file2 = path72.join(sessionsDir(), sessionId2, "events.jsonl");
     if (!existsSync47(file2)) return [];
     return evidenceRefsFromEventLines(readFileSync35(file2, "utf8").split("\n"));
   } catch {
@@ -62664,8 +62914,8 @@ async function runPostCouncilHook(ctx, options) {
           sources: scope.sources
         } : void 0
       });
-      const path100 = writeCouncilCompletion(ctx.rootDir, completion);
-      completionHook = { ran: true, path: path100, completion };
+      const path101 = writeCouncilCompletion(ctx.rootDir, completion);
+      completionHook = { ran: true, path: path101, completion };
     } catch (err) {
       completionHook = {
         ran: true,
@@ -62710,7 +62960,7 @@ import {
   writeFileSync as writeFileSync22,
   mkdirSync as mkdirSync18
 } from "node:fs";
-import path72 from "node:path";
+import path73 from "node:path";
 var FeedbackStore;
 var init_councilFeedback = __esm({
   "src/cli/councilFeedback.ts"() {
@@ -62827,7 +63077,7 @@ var init_councilFeedback = __esm({
         }
       }
       save() {
-        mkdirSync18(path72.dirname(this.file), { recursive: true });
+        mkdirSync18(path73.dirname(this.file), { recursive: true });
         writeFileSync22(
           this.file,
           JSON.stringify({ entries: this.entries }, null, 2),
@@ -62902,12 +63152,12 @@ __export(ledger_exports, {
   readLedger: () => readLedger
 });
 import { appendFileSync as appendFileSync4, existsSync as existsSync50, mkdirSync as mkdirSync19, readFileSync as readFileSync38 } from "node:fs";
-import path73 from "node:path";
+import path74 from "node:path";
 function evolutionMode(env = process.env) {
   return env[EVOLUTION_ENV] === "shadow" ? "shadow" : "0";
 }
 function ledgerPath(cwd) {
-  return path73.join(cwd, LEDGER_REL);
+  return path74.join(cwd, LEDGER_REL);
 }
 function appendLedgerEntry(cwd, entry) {
   if (evolutionMode() === "0") {
@@ -62915,7 +63165,7 @@ function appendLedgerEntry(cwd, entry) {
   }
   try {
     const file2 = ledgerPath(cwd);
-    mkdirSync19(path73.dirname(file2), { recursive: true });
+    mkdirSync19(path74.dirname(file2), { recursive: true });
     appendFileSync4(file2, `${JSON.stringify(entry)}
 `, "utf8");
     return { written: true, path: file2 };
@@ -63016,7 +63266,7 @@ var init_ledger = __esm({
   "src/cli/evolution/ledger.ts"() {
     "use strict";
     EVOLUTION_ENV = "ZELARI_EVOLUTION";
-    LEDGER_REL = path73.join(".zelari", "evolution", "ledger.jsonl");
+    LEDGER_REL = path74.join(".zelari", "evolution", "ledger.jsonl");
     TIER_WEIGHTS = {
       build: 1,
       "tool-output": 1,
@@ -63158,7 +63408,7 @@ __export(fileBackend_exports, {
 });
 import { randomUUID as randomUUID7 } from "node:crypto";
 import { promises as fs31 } from "node:fs";
-import * as path74 from "node:path";
+import * as path75 from "node:path";
 function tokenize2(text) {
   return text.toLowerCase().split(/[^\p{L}\p{N}]+/u).filter((t) => t.length >= 3);
 }
@@ -63211,8 +63461,8 @@ var init_fileBackend = __esm({
       logPath = "";
       memoryDir = "";
       async init(projectRoot) {
-        this.memoryDir = path74.join(projectRoot, ".zelari", "memory");
-        this.logPath = path74.join(this.memoryDir, "log.jsonl");
+        this.memoryDir = path75.join(projectRoot, ".zelari", "memory");
+        this.logPath = path75.join(this.memoryDir, "log.jsonl");
         await fs31.mkdir(this.memoryDir, { recursive: true });
       }
       async add(content, metadata2 = {}, graph) {
@@ -63285,12 +63535,12 @@ var init_fileBackend = __esm({
 
 // src/cli/traceStore.ts
 import { promises as fs32 } from "node:fs";
-import * as path75 from "node:path";
+import * as path76 from "node:path";
 function traceDir(projectRoot) {
-  return path75.join(projectRoot, ".zelari", "trace");
+  return path76.join(projectRoot, ".zelari", "trace");
 }
 function tracePath(projectRoot, missionId) {
-  return path75.join(traceDir(projectRoot), `${missionId}.json`);
+  return path76.join(traceDir(projectRoot), `${missionId}.json`);
 }
 async function saveTrace(projectRoot, missionId, entries) {
   const dir = traceDir(projectRoot);
@@ -63332,7 +63582,7 @@ __export(zelariMission_exports, {
 });
 import { randomUUID as randomUUID8 } from "node:crypto";
 import { promises as fs33 } from "node:fs";
-import * as path76 from "node:path";
+import * as path77 from "node:path";
 function resolveMaxIterations(env = process.env) {
   const raw = env.ZELARI_MISSION_MAX_ITER;
   const n = raw ? Number.parseInt(raw, 10) : DEFAULT_MAX_ITER;
@@ -63375,10 +63625,10 @@ function isMissionAutoStart(env = process.env) {
   return env.ZELARI_MISSION_AUTO === "1";
 }
 async function writeMissionState(projectRoot, state3) {
-  const dir = path76.join(projectRoot, ".zelari");
+  const dir = path77.join(projectRoot, ".zelari");
   await fs33.mkdir(dir, { recursive: true });
   await fs33.writeFile(
-    path76.join(dir, "mission-state.json"),
+    path77.join(dir, "mission-state.json"),
     JSON.stringify(state3, null, 2) + "\n",
     "utf8"
   );
@@ -63392,7 +63642,7 @@ async function writeMissionState(projectRoot, state3) {
 async function loadMissionState(projectRoot) {
   try {
     const raw = await fs33.readFile(
-      path76.join(projectRoot, ".zelari", "mission-state.json"),
+      path77.join(projectRoot, ".zelari", "mission-state.json"),
       "utf8"
     );
     const parsed = JSON.parse(raw);
@@ -64151,7 +64401,7 @@ function safeSocketPath(socketPath) {
   return socketPath.trim();
 }
 function startPermissionBroker(socketPath, handlers, opts) {
-  const path100 = safeSocketPath(socketPath);
+  const path101 = safeSocketPath(socketPath);
   const requestTimeoutMs = opts?.requestTimeoutMs ?? PERMISSION_BROKER_DEFAULT_TIMEOUT_MS;
   const sockets = /* @__PURE__ */ new Set();
   const server = createServer2((socket) => {
@@ -64251,10 +64501,10 @@ function startPermissionBroker(socketPath, handlers, opts) {
   return new Promise((resolve9, reject) => {
     const onError = (err) => reject(err);
     server.once("error", onError);
-    server.listen(path100, () => {
+    server.listen(path101, () => {
       server.removeListener("error", onError);
       resolve9({
-        socketPath: path100,
+        socketPath: path101,
         stop: () => new Promise((res) => {
           for (const s of sockets) s.destroy();
           sockets.clear();
@@ -64265,7 +64515,7 @@ function startPermissionBroker(socketPath, handlers, opts) {
             if (done) return;
             done = true;
             if (process.platform !== "win32") {
-              unlink(path100, () => res());
+              unlink(path101, () => res());
             } else {
               res();
             }
@@ -64278,11 +64528,11 @@ function startPermissionBroker(socketPath, handlers, opts) {
   });
 }
 function requestBrokerAsk(socketPath, ask, opts) {
-  const path100 = safeSocketPath(socketPath);
+  const path101 = safeSocketPath(socketPath);
   const requestTimeoutMs = opts?.requestTimeoutMs ?? PERMISSION_BROKER_DEFAULT_TIMEOUT_MS;
   const connectTimeoutMs = opts?.connectTimeoutMs ?? PERMISSION_BROKER_DEFAULT_CONNECT_TIMEOUT_MS;
   return new Promise((resolve9, reject) => {
-    const socket = connect(path100);
+    const socket = connect(path101);
     let buffer = "";
     let settled = false;
     const settle = (fn) => {
@@ -64297,7 +64547,7 @@ function requestBrokerAsk(socketPath, ask, opts) {
       settle(
         () => reject(
           new Error(
-            `permission broker unavailable at "${path100}" (connect timed out after ${connectTimeoutMs}ms)`
+            `permission broker unavailable at "${path101}" (connect timed out after ${connectTimeoutMs}ms)`
           )
         )
       );
@@ -65486,7 +65736,7 @@ var init_prereqChecks = __esm({
 
 // src/cli/plugins/prefs.ts
 import { existsSync as existsSync53, readFileSync as readFileSync40, writeFileSync as writeFileSync23, mkdirSync as mkdirSync20 } from "node:fs";
-import path82 from "node:path";
+import path83 from "node:path";
 function getPluginPrefsPath() {
   return pluginsPrefsPath();
 }
@@ -65509,7 +65759,7 @@ function getPluginPrefs() {
 }
 function writePluginPrefs(prefs) {
   const file2 = getPluginPrefsPath();
-  mkdirSync20(path82.dirname(file2), { recursive: true });
+  mkdirSync20(path83.dirname(file2), { recursive: true });
   writeFileSync23(file2, JSON.stringify(prefs, null, 2), {
     encoding: "utf-8",
     mode: 384
@@ -65547,7 +65797,7 @@ __export(registry_exports, {
   isBinaryOnPath: () => isBinaryOnPath
 });
 import { existsSync as existsSync54 } from "node:fs";
-import path83 from "node:path";
+import path84 from "node:path";
 function detectLocalBin(bin) {
   return (cwd) => {
     try {
@@ -65565,7 +65815,7 @@ function isBinaryOnPath(bin, opts = {}) {
   const platform = opts.platform ?? process.platform;
   const exists = opts.exists ?? existsSync54;
   const pathEnv = opts.pathEnv ?? process.env.PATH ?? "";
-  const pathMod = platform === "win32" ? path83.win32 : path83.posix;
+  const pathMod = platform === "win32" ? path84.win32 : path84.posix;
   const sep4 = platform === "win32" ? ";" : ":";
   const dirs = pathEnv.split(sep4).filter((d) => d.length > 0);
   const candidates = [bin];
@@ -66670,7 +66920,7 @@ var init_policy = __esm({
 
 // src/cli/orchestration/facts.ts
 import { promises as fs43 } from "node:fs";
-import path87 from "node:path";
+import path88 from "node:path";
 async function collectRepoFileCount(root = process.cwd()) {
   try {
     await fs43.readdir(root);
@@ -66690,7 +66940,7 @@ async function collectRepoFileCount(root = process.cwd()) {
       }
       for (const e of entries) {
         if (e.isDirectory()) {
-          if (!SKIP_DIRS.has(e.name)) queue.push(path87.join(dir, e.name));
+          if (!SKIP_DIRS.has(e.name)) queue.push(path88.join(dir, e.name));
         } else if (e.isFile()) {
           count++;
           if (count > MAX_WALK_FILES) return count;
@@ -66788,7 +67038,7 @@ var init_streamScrub = __esm({
 });
 
 // src/cli/harnessState.ts
-import path88 from "node:path";
+import path89 from "node:path";
 function asString4(v) {
   return typeof v === "string" ? v : "";
 }
@@ -66963,7 +67213,7 @@ function contractFor(t) {
   };
 }
 async function readHarnessState(sessionDir) {
-  const report = await readSessionLog(path88.join(sessionDir, "events.jsonl"));
+  const report = await readSessionLog(path89.join(sessionDir, "events.jsonl"));
   return deriveHarnessState(report.events);
 }
 var init_harnessState = __esm({
@@ -66974,12 +67224,12 @@ var init_harnessState = __esm({
 });
 
 // src/cli/headless/harnessStateEmit.ts
-import path89 from "node:path";
+import path90 from "node:path";
 async function emitHarnessStateEvent(opts) {
   if (opts.output !== "json") return;
   try {
     const sessionsDir2 = resolveSessionsDir({ workspaceRoot: opts.workspaceRoot });
-    const state3 = await readHarnessState(path89.join(sessionsDir2, opts.spine.sessionId));
+    const state3 = await readHarnessState(path90.join(sessionsDir2, opts.spine.sessionId));
     opts.emitEvent({ type: "harness_state", ...state3 });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -67536,13 +67786,13 @@ var init_verifierLifecycle = __esm({
 
 // src/cli/extensions/sandboxedFs.ts
 import { promises as fsp } from "node:fs";
-import path90 from "node:path";
+import path91 from "node:path";
 function errText(prefix, p3, err) {
   const msg = err instanceof Error ? err.message : String(err);
   return `[extension-fs] ${prefix} "${p3}": ${msg}`;
 }
 function bindSandboxedFs(root) {
-  const resolvedRoot = path90.resolve(root);
+  const resolvedRoot = path91.resolve(root);
   return {
     root: resolvedRoot,
     async readFile(relativePath) {
@@ -67558,7 +67808,7 @@ function bindSandboxedFs(root) {
       try {
         const target = resolveSandboxedPath(relativePath, { root: resolvedRoot });
         verifyContainment(target, { root: resolvedRoot });
-        await fsp.mkdir(path90.dirname(target), { recursive: true });
+        await fsp.mkdir(path91.dirname(target), { recursive: true });
         await fsp.writeFile(target, data, "utf8");
         return typedOk({ path: target });
       } catch (err) {
@@ -67743,7 +67993,7 @@ var init_loader = __esm({
 
 // src/cli/headless/runOneTurn.ts
 import { promises as fs44 } from "node:fs";
-import path91 from "node:path";
+import path92 from "node:path";
 function planModeFromOpts(opts) {
   return (opts.phase ?? "build") === "plan";
 }
@@ -68221,11 +68471,14 @@ async function runOneTurn(opts, provider, model, providerStream, extras) {
         return null;
       }
     },
-    emit: (input) => spine.appendEvent(input)
+    // F3 seam adapter (same as the gate sites below): the core engine reads
+    // the anchor as `out.seq`, while the spine resolves the seq NUMBER. A bare
+    // number here leaves the review evidence unanchored on the spine.
+    emit: async (input) => ({ seq: await spine.appendEvent(input) })
   };
   const strictEnv = strictEnvOverlay(opts);
   if (pass.finalReason === "completed" && pass.exitCode === 0 && isKrakenMode(opts.mode) && (isKrakenSelectionEnabled() || nativePackEnabled()) && !planModeFromOpts(opts)) {
-    const strictGate = await evaluateStrictBuildGate("build", { emit: (input) => spine.appendEvent(input), cwd, env: strictEnv });
+    const strictGate = await evaluateStrictBuildGate("build", { emit: async (input) => ({ seq: await spine.appendEvent(input) }), cwd, env: strictEnv });
     await runAdvisoryVerifierReview(strictGate, verifierReviewDeps).catch(() => void 0);
     const gate = strictGate.gate;
     const verificationPayload = strictGateEventPayload(strictGate);
@@ -68235,7 +68488,7 @@ async function runOneTurn(opts, provider, model, providerStream, extras) {
     }
     await writeProofSafe(strictGate, { surface: "kraken", sessionId: spine.sessionId }, cwd);
     if (strictGate.blocked) {
-      const repairPrompt = buildKrakenRepairPrompt(gate);
+      const repairPrompt = buildKrakenRepairPrompt(gate, repairExcerptsFromEvaluation(strictGate));
       if (opts.output === "json") {
         emitEvent({
           type: "log",
@@ -68260,7 +68513,7 @@ async function runOneTurn(opts, provider, model, providerStream, extras) {
         successfulWrites: pass.successfulWrites + repair.successfulWrites,
         emittedWrites: pass.emittedWrites + repair.emittedWrites
       };
-      const after = await evaluateStrictBuildGate("build", { emit: (input) => spine.appendEvent(input), cwd, env: strictEnv });
+      const after = await evaluateStrictBuildGate("build", { emit: async (input) => ({ seq: await spine.appendEvent(input) }), cwd, env: strictEnv });
       await runAdvisoryVerifierReview(after, verifierReviewDeps).catch(() => void 0);
       const afterPayload = strictGateEventPayload(after);
       spine.verificationRun(afterPayload);
@@ -68310,7 +68563,7 @@ async function runOneTurn(opts, provider, model, providerStream, extras) {
       if (json3) {
         if (opts.exportSessionPath === "-") process.stdout.write(json3 + "\n");
         else {
-          await fs44.mkdir(path91.dirname(opts.exportSessionPath), { recursive: true }).catch(() => void 0);
+          await fs44.mkdir(path92.dirname(opts.exportSessionPath), { recursive: true }).catch(() => void 0);
           await fs44.writeFile(opts.exportSessionPath, json3, "utf8");
         }
       }
@@ -69359,9 +69612,9 @@ __export(triggerLock_exports, {
   releaseLock: () => releaseLock
 });
 import { promises as fs45 } from "node:fs";
-import * as path92 from "node:path";
+import * as path93 from "node:path";
 function lockPath(projectRoot) {
-  return path92.join(projectRoot, ".zelari", "trigger.lock");
+  return path93.join(projectRoot, ".zelari", "trigger.lock");
 }
 function isPidAlive(pid) {
   try {
@@ -69374,7 +69627,7 @@ function isPidAlive(pid) {
 }
 async function acquireLock(projectRoot, now = () => /* @__PURE__ */ new Date()) {
   const lp = lockPath(projectRoot);
-  const dir = path92.dirname(lp);
+  const dir = path93.dirname(lp);
   await fs45.mkdir(dir, { recursive: true });
   try {
     const raw = await fs45.readFile(lp, "utf8");
@@ -69406,7 +69659,7 @@ var init_triggerLock = __esm({
 
 // src/cli/runHeadless.ts
 import { promises as fs46 } from "node:fs";
-import path93 from "node:path";
+import path94 from "node:path";
 import { randomUUID as randomUUID10 } from "node:crypto";
 async function runHeadless(opts) {
   resetTaskSpawnCount();
@@ -69650,7 +69903,7 @@ async function runHeadlessKrakenGraph(opts, provider, model) {
   try {
     let preflightGraph;
     if (opts.runPlan && opts.runPlan.trim() !== "") {
-      const planPath = path93.join(cwd, ".zelari", "radio", `plan-${opts.runPlan}.json`);
+      const planPath = path94.join(cwd, ".zelari", "radio", `plan-${opts.runPlan}.json`);
       log(`loading pre-flight plan: ${planPath}`);
       let raw;
       try {
@@ -69693,8 +69946,8 @@ async function runHeadlessKrakenGraph(opts, provider, model) {
     log(formatKrakenGraphAscii2(graph));
     if (opts.planOnly) {
       const planId = randomUUID10();
-      const planDir = path93.join(cwd, ".zelari", "radio");
-      const planPath = path93.join(planDir, `plan-${planId}.json`);
+      const planDir = path94.join(cwd, ".zelari", "radio");
+      const planPath = path94.join(planDir, `plan-${planId}.json`);
       await fs46.mkdir(planDir, { recursive: true });
       await fs46.writeFile(
         planPath,
@@ -70085,7 +70338,7 @@ async function runHeadlessCouncilBody(opts, provider, model, providerStream, ext
       if (json3) {
         if (opts.exportSessionPath === "-") process.stdout.write(json3 + "\n");
         else {
-          await fs46.mkdir(path93.dirname(opts.exportSessionPath), { recursive: true }).catch(() => void 0);
+          await fs46.mkdir(path94.dirname(opts.exportSessionPath), { recursive: true }).catch(() => void 0);
           await fs46.writeFile(opts.exportSessionPath, json3, "utf8");
         }
       }
@@ -70508,6 +70761,22 @@ ${ragContext}` : slicePrompt;
       if (missionGate.blocked) {
         exitCode = strictGateExitCode(missionGate);
         spine.missionPhase("verification", "mission-strict-blocked");
+      } else if (
+        // M2.1/R4b: an open strict gate is not enough — the success claim must
+        // be event-backed: zero `verification.evidence` events in the spine
+        // means narration-only done → strict exit code. Same overlay seam as
+        // the gate above (H10-fix1) so --allow-unverified /
+        // ZELARI_ALLOW_UNVERIFIED=1 waives mission-side too. `opts.phase` is
+        // the only phase/mode discriminant on this site: `--phase plan`
+        // missions are design-only (no verification expected), so the gate
+        // applies unconditionally to build-phase claims.
+        opts.phase !== "plan" && missionClaimExitCode(await spine.countVerificationEvidence(), strictEnvOverlay(opts)) !== 0
+      ) {
+        exitCode = STRICT_DONE_EXIT_CODE;
+        spine.missionPhase("verification", "mission-event-back-missing");
+        process.stderr.write(
+          "[zelari-code --headless] mission success claim has zero verification.evidence events (narration-only done) \u2014 exit 4 (waive with --allow-unverified / ZELARI_ALLOW_UNVERIFIED=1)\n"
+        );
       } else {
         exitCode = 0;
         spine.missionPhase("done", "mission-success");
@@ -70541,7 +70810,7 @@ ${ragContext}` : slicePrompt;
         if (json3) {
           if (opts.exportSessionPath === "-") process.stdout.write(json3 + "\n");
           else {
-            await fs46.mkdir(path93.dirname(opts.exportSessionPath), { recursive: true }).catch(() => void 0);
+            await fs46.mkdir(path94.dirname(opts.exportSessionPath), { recursive: true }).catch(() => void 0);
             await fs46.writeFile(opts.exportSessionPath, json3, "utf8");
           }
         }
@@ -71166,7 +71435,7 @@ function upsertSkill(opts) {
     }
     dir = getProjectSkillsDir(root);
   }
-  const path100 = skillFilePath(dir, name);
+  const path101 = skillFilePath(dir, name);
   const content = serializeSkillMd({
     name,
     description,
@@ -71175,13 +71444,13 @@ function upsertSkill(opts) {
     tools: opts.tools,
     cost: opts.cost
   });
-  const parsed = parseSkillMd(content, path100);
+  const parsed = parseSkillMd(content, path101);
   if (!parsed) {
     return { ok: false, error: "Generated SKILL.md failed validation" };
   }
-  mkdirSync23(dirname13(path100), { recursive: true });
-  writeFileSync25(path100, content, "utf8");
-  return { ok: true, path: path100 };
+  mkdirSync23(dirname13(path101), { recursive: true });
+  writeFileSync25(path101, content, "utf8");
+  return { ok: true, path: path101 };
 }
 function removeSkill(opts) {
   const name = opts.name.trim().toLowerCase();
@@ -71199,8 +71468,8 @@ function removeSkill(opts) {
     dir = getProjectSkillsDir(root);
   }
   const skillDir = join46(dir, name);
-  const path100 = skillFilePath(dir, name);
-  if (!existsSync59(path100) && !existsSync59(skillDir)) {
+  const path101 = skillFilePath(dir, name);
+  if (!existsSync59(path101) && !existsSync59(skillDir)) {
     return { ok: false, error: `Skill "${name}" not found in ${dir}` };
   }
   try {
@@ -71211,7 +71480,7 @@ function removeSkill(opts) {
       error: err instanceof Error ? err.message : String(err)
     };
   }
-  return { ok: true, path: path100 };
+  return { ok: true, path: path101 };
 }
 var NAME_RE, BUILTIN_SKILL_MODULES, builtinsLoaded;
 var init_skillConfigIo = __esm({
@@ -71332,7 +71601,7 @@ var init_jsonApi = __esm({
 });
 
 // src/cli/memory/mcpAdapter.ts
-import * as path94 from "node:path";
+import * as path95 from "node:path";
 var id2, projectId, source, SearchSchema, AddSchema, LinkSchema, RetractSchema, MEMORY_MCP_TOOLS, MemoryMcpAdapter;
 var init_mcpAdapter = __esm({
   "src/cli/memory/mcpAdapter.ts"() {
@@ -71502,8 +71771,8 @@ var init_mcpAdapter = __esm({
         this.takeWrite();
         const externalFile = args.source?.file;
         if (externalFile) {
-          const normalized = path94.normalize(externalFile);
-          if (path94.isAbsolute(normalized) || normalized === ".." || normalized.startsWith(`..${path94.sep}`)) {
+          const normalized = path95.normalize(externalFile);
+          if (path95.isAbsolute(normalized) || normalized === ".." || normalized.startsWith(`..${path95.sep}`)) {
             throw new Error("source.file must be project-relative and cannot escape the project");
           }
         }
@@ -72030,12 +72299,12 @@ function ensureHome() {
   }
 }
 function loadCompanionConfig() {
-  const path100 = getCompanionConfigPath();
-  if (!existsSync60(path100)) {
+  const path101 = getCompanionConfigPath();
+  if (!existsSync60(path101)) {
     return { projects: [] };
   }
   try {
-    const raw = JSON.parse(readFileSync45(path100, "utf8"));
+    const raw = JSON.parse(readFileSync45(path101, "utf8"));
     const projects = Array.isArray(raw.projects) ? raw.projects.filter(
       (p3) => p3 && typeof p3.path === "string" && p3.path.trim() && typeof (p3.id ?? p3.name) === "string"
     ).map((p3) => ({
@@ -72073,16 +72342,16 @@ function loadOrCreateToken(explicit) {
     return { token: explicit.trim(), created: false };
   }
   ensureHome();
-  const path100 = getCompanionTokenPath();
-  if (existsSync60(path100)) {
-    const t = readFileSync45(path100, "utf8").trim();
+  const path101 = getCompanionTokenPath();
+  if (existsSync60(path101)) {
+    const t = readFileSync45(path101, "utf8").trim();
     if (t) return { token: t, created: false };
   }
   const token = randomBytes7(24).toString("base64url");
-  writeFileSync26(path100, token + "\n", "utf8");
+  writeFileSync26(path101, token + "\n", "utf8");
   try {
     const fs48 = __require("node:fs");
-    fs48.chmodSync?.(path100, 384);
+    fs48.chmodSync?.(path101, 384);
   } catch {
   }
   return { token, created: true };
@@ -72107,17 +72376,17 @@ function mergeProjects(cfg, extraPaths) {
     byId.set(p3.id, p3);
   }
   for (const raw of extraPaths) {
-    const path100 = raw.trim();
-    if (!path100) continue;
-    let id3 = slugFromPath(path100);
+    const path101 = raw.trim();
+    if (!path101) continue;
+    let id3 = slugFromPath(path101);
     let n = 2;
-    while (byId.has(id3) && byId.get(id3).path !== path100) {
-      id3 = `${slugFromPath(path100)}-${n++}`;
+    while (byId.has(id3) && byId.get(id3).path !== path101) {
+      id3 = `${slugFromPath(path101)}-${n++}`;
     }
     byId.set(id3, {
       id: id3,
-      name: slugFromPath(path100),
-      path: path100
+      name: slugFromPath(path101),
+      path: path101
     });
   }
   return [...byId.values()];
@@ -72360,7 +72629,7 @@ var init_askUserBridge = __esm({
 
 // src/cli/serve/spineLockSweep.ts
 import { promises as fs47 } from "node:fs";
-import path95 from "node:path";
+import path96 from "node:path";
 async function sweepOrphanSpineLocks(sessionsDir2, options = {}) {
   const dir = sessionsDir2 ?? resolveSessionsDir();
   const onSwept = options.onSwept ?? ((sessionId2, reason) => {
@@ -72378,7 +72647,7 @@ async function sweepOrphanSpineLocks(sessionsDir2, options = {}) {
     return result;
   }
   for (const sessionId2 of entries) {
-    const lockPath2 = path95.join(dir, sessionId2, "writer.lock");
+    const lockPath2 = path96.join(dir, sessionId2, "writer.lock");
     try {
       const raw = await fs47.readFile(lockPath2, "utf-8");
       let lockInfo = {};
@@ -73375,9 +73644,9 @@ async function runCompanionServe(opts = {}) {
       return;
     }
     const url2 = parseUrl(req);
-    const path100 = url2.pathname.replace(/\/+$/, "") || "/";
+    const path101 = url2.pathname.replace(/\/+$/, "") || "/";
     try {
-      if (req.method === "GET" && (path100 === "/health" || path100 === "/v1/health")) {
+      if (req.method === "GET" && (path101 === "/health" || path101 === "/v1/health")) {
         sendJson2(res, 200, {
           ok: true,
           service: "zelari-companion",
@@ -73389,18 +73658,18 @@ async function runCompanionServe(opts = {}) {
         });
         return;
       }
-      if (path100.startsWith("/v1")) {
+      if (path101.startsWith("/v1")) {
         if (!tokenMatches(token, getBearer(req))) {
           sendJson2(res, 401, { ok: false, error: "unauthorized" });
           return;
         }
       }
-      if (req.method === "GET" && path100 === "/v1/config") {
+      if (req.method === "GET" && path101 === "/v1/config") {
         const snap = buildDesktopConfigSnapshot();
         sendJson2(res, 200, { ok: true, ...snap });
         return;
       }
-      if (req.method === "GET" && path100 === "/v1/projects") {
+      if (req.method === "GET" && path101 === "/v1/projects") {
         sendJson2(res, 200, {
           ok: true,
           projects: projects.map((p3) => ({
@@ -73411,7 +73680,7 @@ async function runCompanionServe(opts = {}) {
         });
         return;
       }
-      if (req.method === "GET" && path100 === "/v1/runs") {
+      if (req.method === "GET" && path101 === "/v1/runs") {
         sendJson2(res, 200, {
           ok: true,
           active: runs.getActive(),
@@ -73429,7 +73698,7 @@ async function runCompanionServe(opts = {}) {
         });
         return;
       }
-      if (req.method === "POST" && path100 === "/v1/runs") {
+      if (req.method === "POST" && path101 === "/v1/runs") {
         const raw = await readBody(req);
         let body = {};
         try {
@@ -73477,7 +73746,7 @@ async function runCompanionServe(opts = {}) {
         });
         return;
       }
-      const eventsMatch = /^\/v1\/runs\/([^/]+)\/events$/.exec(path100);
+      const eventsMatch = /^\/v1\/runs\/([^/]+)\/events$/.exec(path101);
       if (req.method === "GET" && eventsMatch) {
         const runId = eventsMatch[1];
         const run = runs.getRun(runId);
@@ -73542,7 +73811,7 @@ async function runCompanionServe(opts = {}) {
         }, 500);
         return;
       }
-      const cancelMatch = /^\/v1\/runs\/([^/]+)\/cancel$/.exec(path100);
+      const cancelMatch = /^\/v1\/runs\/([^/]+)\/cancel$/.exec(path101);
       if (req.method === "POST" && cancelMatch) {
         const runId = cancelMatch[1];
         const result = runs.cancel(runId);
@@ -73553,7 +73822,7 @@ async function runCompanionServe(opts = {}) {
         sendJson2(res, 200, { ok: true, cancelled: runId });
         return;
       }
-      const steerMatch = /^\/v1\/runs\/([^/]+)\/steer$/.exec(path100);
+      const steerMatch = /^\/v1\/runs\/([^/]+)\/steer$/.exec(path101);
       if (req.method === "POST" && steerMatch) {
         const runId = steerMatch[1];
         const raw = await readBody(req);
@@ -73722,11 +73991,11 @@ import { execSync as execSync2 } from "node:child_process";
 import { existsSync as existsSync62, readFileSync as readFileSync46, readlinkSync, statSync as statSync10 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-import path96 from "node:path";
+import path97 from "node:path";
 function findPackageRoot(start) {
   let dir = start;
   for (let i = 0; i < 6; i += 1) {
-    const candidate = path96.join(dir, "package.json");
+    const candidate = path97.join(dir, "package.json");
     if (existsSync62(candidate)) {
       try {
         const pkg = JSON.parse(readFileSync46(candidate, "utf8"));
@@ -73734,11 +74003,11 @@ function findPackageRoot(start) {
       } catch {
       }
     }
-    const parent = path96.dirname(dir);
+    const parent = path97.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return path96.resolve(__dirname3, "..", "..", "..");
+  return path97.resolve(__dirname3, "..", "..", "..");
 }
 function tryExec(cmd) {
   try {
@@ -73752,7 +74021,7 @@ function tryExec(cmd) {
 }
 function readPackageJson4() {
   try {
-    const pkgPath = path96.join(packageRoot, "package.json");
+    const pkgPath = path97.join(packageRoot, "package.json");
     return JSON.parse(readFileSync46(pkgPath, "utf8"));
   } catch {
     return null;
@@ -73764,7 +74033,7 @@ function getGlobalPrefix() {
   return (process.env.npm_config_prefix || process.env.NPM_CONFIG_PREFIX || "").trim();
 }
 function isSourceCheckout() {
-  return existsSync62(path96.join(packageRoot, "src", "cli", "main.ts")) && existsSync62(path96.join(packageRoot, "apps", "desktop", "package.json"));
+  return existsSync62(path97.join(packageRoot, "src", "cli", "main.ts")) && existsSync62(path97.join(packageRoot, "apps", "desktop", "package.json"));
 }
 function checkShim(pkgName) {
   const prefix = getGlobalPrefix();
@@ -73773,9 +74042,9 @@ function checkShim(pkgName) {
   }
   const isWin = process.platform === "win32";
   const shimName = isWin ? "zelari-code.cmd" : "zelari-code";
-  const shimPath = path96.join(prefix, shimName);
+  const shimPath = path97.join(prefix, shimName);
   if (!existsSync62(shimPath)) {
-    const localBin = path96.join(packageRoot, "bin", "zelari-code.js");
+    const localBin = path97.join(packageRoot, "bin", "zelari-code.js");
     if (isSourceCheckout() && existsSync62(localBin)) {
       return WARN(
         `global shim not found at ${shimPath}
@@ -73809,8 +74078,8 @@ function checkShim(pkgName) {
          fix:  npm install -g ${pkgName}@latest --force`
       );
     }
-    const resolved = path96.resolve(path96.dirname(shimPath), target);
-    const expected = path96.join(
+    const resolved = path97.resolve(path97.dirname(shimPath), target);
+    const expected = path97.join(
       prefix,
       "node_modules",
       pkgName,
@@ -73852,7 +74121,7 @@ function checkNode(pkg) {
   return OK(`node ${raw} (engines.node ${enginesNode ?? ">= 20.0.0"})`);
 }
 function checkBundle() {
-  const bundle = path96.join(packageRoot, "dist", "cli", "main.bundled.js");
+  const bundle = path97.join(packageRoot, "dist", "cli", "main.bundled.js");
   if (!existsSync62(bundle)) {
     return FAIL(
       `dist/cli/main.bundled.js missing at ${bundle}
@@ -73873,7 +74142,7 @@ function checkRuntimeDeps() {
   const missing = [];
   for (const dep of required2) {
     try {
-      const localReq = createRequire3(path96.join(packageRoot, "package.json"));
+      const localReq = createRequire3(path97.join(packageRoot, "package.json"));
       localReq.resolve(dep);
     } catch {
       missing.push(dep);
@@ -74150,7 +74419,7 @@ var init_doctor = __esm({
     init_metrics3();
     init_contextGrowthSummary();
     require3 = createRequire3(import.meta.url);
-    __dirname3 = path96.dirname(fileURLToPath3(import.meta.url));
+    __dirname3 = path97.dirname(fileURLToPath3(import.meta.url));
     packageRoot = findPackageRoot(__dirname3);
     OK = (message) => ({
       ok: true,
@@ -74259,7 +74528,7 @@ __export(userSettings_exports, {
   settingsOverrides: () => settingsOverrides
 });
 import { existsSync as existsSync63, readFileSync as readFileSync47 } from "node:fs";
-import path97 from "node:path";
+import path98 from "node:path";
 function parseBool(raw) {
   const v = raw.trim().toLowerCase();
   if (["1", "true", "yes", "on"].includes(v)) return true;
@@ -74326,8 +74595,8 @@ function envValueFor(key, env) {
 function resolveUserSettings(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
   const env = opts.env ?? process.env;
-  const userPath = path97.join(zelariHome(), SETTINGS_FILE_NAME);
-  const projectPath = path97.join(cwd, ".zelari", SETTINGS_FILE_NAME);
+  const userPath = path98.join(zelariHome(), SETTINGS_FILE_NAME);
+  const projectPath = path98.join(cwd, ".zelari", SETTINGS_FILE_NAME);
   const warnings = [];
   const userLayer = loadFileLayer(userPath, "user", warnings);
   const projectLayer = loadFileLayer(projectPath, "project", warnings);
@@ -74541,7 +74810,7 @@ __export(inspectSession_exports, {
   renderInspectReport: () => renderInspectReport,
   runInspectSession: () => runInspectSession
 });
-import path98 from "node:path";
+import path99 from "node:path";
 import { existsSync as existsSync64 } from "node:fs";
 function formatLimit(limit) {
   return `${Math.round(limit / 1e3)}k`;
@@ -74575,8 +74844,8 @@ function renderInspectReport(state3) {
 }
 async function runInspectSession(opts) {
   const sessionsDir2 = resolveSessionsDir({ workspaceRoot: opts.cwd ?? process.cwd() });
-  const sessionDir = path98.join(sessionsDir2, opts.sessionId);
-  const eventsPath = path98.join(sessionDir, "events.jsonl");
+  const sessionDir = path99.join(sessionsDir2, opts.sessionId);
+  const eventsPath = path99.join(sessionDir, "events.jsonl");
   if (!existsSync64(sessionDir)) {
     console.error(`zelari-code inspect: no session directory at ${sessionDir}`);
     return 1;
@@ -74610,14 +74879,14 @@ __export(inspect_exports, {
   collectInspectReport: () => collectInspectReport,
   runInspect: () => runInspect
 });
-import path99 from "node:path";
+import path100 from "node:path";
 import { existsSync as existsSync65, readFileSync as readFileSync48, readdirSync as readdirSync13 } from "node:fs";
 async function collectInspectReport(cwd = process.cwd()) {
   ensureBuiltinSkillsLoadedSync();
   const snap = listSkillsSnapshot(cwd);
   const mcp = listMcpServers(cwd);
-  const userMcpPath = path99.join(zelariHome(), "mcp.json");
-  const projectMcpPath = path99.join(cwd, ".zelari", "mcp.json");
+  const userMcpPath = path100.join(zelariHome(), "mcp.json");
+  const projectMcpPath = path100.join(cwd, ".zelari", "mcp.json");
   const globalHooks = globalHooksDir();
   const projectHooks = projectHooksDir(cwd);
   const projectTrusted = isFolderTrusted(cwd);
@@ -74645,9 +74914,9 @@ async function collectInspectReport(cwd = process.cwd()) {
     configSources: [
       { path: userMcpPath, exists: existsSync65(userMcpPath) },
       { path: projectMcpPath, exists: existsSync65(projectMcpPath) },
-      { path: path99.join(zelariHome(), "provider.json"), exists: existsSync65(path99.join(zelariHome(), "provider.json")) },
-      { path: path99.join(cwd, ".zelari", "AGENTS.md"), exists: existsSync65(path99.join(cwd, ".zelari", "AGENTS.md")) },
-      { path: path99.join(cwd, "AGENTS.md"), exists: existsSync65(path99.join(cwd, "AGENTS.md")) }
+      { path: path100.join(zelariHome(), "provider.json"), exists: existsSync65(path100.join(zelariHome(), "provider.json")) },
+      { path: path100.join(cwd, ".zelari", "AGENTS.md"), exists: existsSync65(path100.join(cwd, ".zelari", "AGENTS.md")) },
+      { path: path100.join(cwd, "AGENTS.md"), exists: existsSync65(path100.join(cwd, "AGENTS.md")) }
     ],
     skills: {
       total: snap.skills.length,
@@ -74687,8 +74956,8 @@ function listJsonFiles(dir) {
 }
 function findAgentsMd(cwd) {
   const candidates = [
-    path99.join(cwd, "AGENTS.md"),
-    path99.join(cwd, ".zelari", "AGENTS.md")
+    path100.join(cwd, "AGENTS.md"),
+    path100.join(cwd, ".zelari", "AGENTS.md")
   ];
   const found = [];
   for (const c of candidates) {
@@ -78441,7 +78710,10 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il turno continua dopo
             progressRuntime.observe(event);
             if (event.type === "agent_end") {
               let krakenSuppressFinish = false;
-              const krakenSpineEmit = (input) => writerRef.current?.spine?.appendEvent(input) ?? Promise.resolve(null);
+              const krakenSpineEmit = async (input) => {
+                const seq = await (writerRef.current?.spine?.appendEvent(input) ?? Promise.resolve(null));
+                return { seq };
+              };
               const writeProofSafe2 = (gate) => writeCompletionProof(gate, { meta: { surface: "kraken", sessionId: sessionId2 } }).then(
                 () => void 0,
                 () => void 0
@@ -78455,7 +78727,9 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il turno continua dopo
                 if (krakenGate.blocked) {
                   krakenRepairEnqueued = true;
                   markRepairTriggered();
-                  harness2.enqueue(buildKrakenRepairPrompt(krakenGate));
+                  harness2.enqueue(
+                    buildKrakenRepairPrompt(krakenGate, repairExcerptsFromEvaluation(strictGate))
+                  );
                   appendSystem(
                     setMessages,
                     formatStrictBlockExplanation(strictGate),
@@ -79949,10 +80223,10 @@ init_ledger();
 
 // src/cli/evolution/proposals.ts
 import { existsSync as existsSync51, readFileSync as readFileSync39 } from "node:fs";
-import path77 from "node:path";
-var PROPOSALS_REL = path77.join(".zelari", "evolution", "proposals.jsonl");
+import path78 from "node:path";
+var PROPOSALS_REL = path78.join(".zelari", "evolution", "proposals.jsonl");
 function proposalsPath(cwd) {
-  return path77.join(cwd, PROPOSALS_REL);
+  return path78.join(cwd, PROPOSALS_REL);
 }
 function readProposalStore(cwd) {
   const file2 = proposalsPath(cwd);
@@ -81062,11 +81336,11 @@ function handleCacheStats(ctx) {
 init_messageHelpers();
 init_serviceFactory();
 import { promises as fs35 } from "node:fs";
-import * as path79 from "node:path";
+import * as path80 from "node:path";
 
 // src/cli/memory/promotion.ts
 import { promises as fs34 } from "node:fs";
-import * as path78 from "node:path";
+import * as path79 from "node:path";
 var START = "<!-- zelari:memory-promotions:start -->";
 var END = "<!-- zelari:memory-promotions:end -->";
 var DURABLE_KINDS = /* @__PURE__ */ new Set(["fact", "decision", "constraint", "preference", "procedure"]);
@@ -81077,13 +81351,13 @@ function lineFor(node) {
 }
 async function promoteMemoryToAgentsMd(projectRoot, node) {
   if (node.status !== "active") {
-    return { added: false, path: path78.join(projectRoot, "AGENTS.md"), reason: `memory is ${node.status}` };
+    return { added: false, path: path79.join(projectRoot, "AGENTS.md"), reason: `memory is ${node.status}` };
   }
   if (!DURABLE_KINDS.has(node.kind)) {
-    return { added: false, path: path78.join(projectRoot, "AGENTS.md"), reason: `${node.kind} is not a durable instruction kind` };
+    return { added: false, path: path79.join(projectRoot, "AGENTS.md"), reason: `${node.kind} is not a durable instruction kind` };
   }
-  const root = await fs34.realpath(projectRoot).catch(() => path78.resolve(projectRoot));
-  const target = path78.join(root, "AGENTS.md");
+  const root = await fs34.realpath(projectRoot).catch(() => path79.resolve(projectRoot));
+  const target = path79.join(root, "AGENTS.md");
   try {
     const stat8 = await fs34.lstat(target);
     if (stat8.isSymbolicLink() || !stat8.isFile()) throw new Error("AGENTS.md must be a regular project file.");
@@ -81148,22 +81422,22 @@ function sourceLine(source2) {
   return entries.length ? entries.map(([key, value]) => `${key}=${value}`).join(" \xB7 ") : "unknown";
 }
 function isInside(root, target) {
-  const relative6 = path79.relative(root, target);
-  return relative6 === "" || !relative6.startsWith("..") && !path79.isAbsolute(relative6);
+  const relative6 = path80.relative(root, target);
+  return relative6 === "" || !relative6.startsWith("..") && !path80.isAbsolute(relative6);
 }
 async function safeExportPath(cwd, requested) {
-  const lexicalRoot = path79.resolve(cwd);
+  const lexicalRoot = path80.resolve(cwd);
   const root = await fs35.realpath(lexicalRoot).catch(() => lexicalRoot);
-  const fallback = path79.join(root, ".zelari", "memory", `export-${Date.now()}.json`);
-  const target = requested?.trim() ? path79.resolve(root, requested.trim()) : fallback;
+  const fallback = path80.join(root, ".zelari", "memory", `export-${Date.now()}.json`);
+  const target = requested?.trim() ? path80.resolve(root, requested.trim()) : fallback;
   if (!isInside(root, target)) {
     throw new Error("Export path must stay inside the active project.");
   }
-  const parent = path79.dirname(target);
-  const relativeParent = path79.relative(root, parent);
+  const parent = path80.dirname(target);
+  const relativeParent = path80.relative(root, parent);
   let cursor = root;
-  for (const segment of relativeParent.split(path79.sep).filter(Boolean)) {
-    cursor = path79.join(cursor, segment);
+  for (const segment of relativeParent.split(path80.sep).filter(Boolean)) {
+    cursor = path80.join(cursor, segment);
     try {
       const stat8 = await fs35.lstat(cursor);
       if (stat8.isSymbolicLink()) {
@@ -81335,9 +81609,9 @@ ${message}` : message
       }
       case "export": {
         const target = await safeExportPath(ctx.cwd, args.join(" ").trim() || void 0);
-        await fs35.mkdir(path79.dirname(target), { recursive: true });
-        const root = await fs35.realpath(ctx.cwd).catch(() => path79.resolve(ctx.cwd));
-        const realParent = await fs35.realpath(path79.dirname(target));
+        await fs35.mkdir(path80.dirname(target), { recursive: true });
+        const root = await fs35.realpath(ctx.cwd).catch(() => path80.resolve(ctx.cwd));
+        const realParent = await fs35.realpath(path80.dirname(target));
         if (!isInside(root, realParent)) {
           throw new Error("Export path resolves outside the active project.");
         }
@@ -81552,7 +81826,7 @@ import { promises as fs37 } from "node:fs";
 init_zod();
 init_taskTool();
 import { promises as fs36 } from "node:fs";
-import path80 from "node:path";
+import path81 from "node:path";
 import { randomBytes as randomBytes6 } from "node:crypto";
 var CsvFanoutArgsSchema = external_exports.object({
   csv_path: external_exports.string().min(1),
@@ -81646,8 +81920,8 @@ function resolveMaxConcurrency(env = process.env) {
 }
 async function runCsvFanout(args, deps, opts) {
   const start = Date.now();
-  const absCsv = path80.isAbsolute(args.csv_path) ? args.csv_path : path80.join(opts.parentCwd, args.csv_path);
-  const absOut = path80.isAbsolute(args.output_csv_path) ? args.output_csv_path : path80.join(opts.parentCwd, args.output_csv_path);
+  const absCsv = path81.isAbsolute(args.csv_path) ? args.csv_path : path81.join(opts.parentCwd, args.csv_path);
+  const absOut = path81.isAbsolute(args.output_csv_path) ? args.output_csv_path : path81.join(opts.parentCwd, args.output_csv_path);
   const { headers: headers3, rows } = await readCsv(absCsv);
   if (headers3.length === 0) {
     throw new Error(`kraken_csv_fanout: ${absCsv} is empty`);
@@ -81703,7 +81977,7 @@ async function runCsvFanout(args, deps, opts) {
         errored += 1;
         errors.push(`${row[args.id_column] ?? i}: ${res.error}`);
       }
-      await fs36.mkdir(path80.dirname(absOut), { recursive: true });
+      await fs36.mkdir(path81.dirname(absOut), { recursive: true });
       await queueWrite(serializeCsv(outHeaders, outputRecords));
     }
   }
@@ -81898,7 +82172,7 @@ function splitArgs(s) {
 // src/cli/slashHandlers/krakenWorkbench.ts
 init_messageHelpers();
 import { promises as fs38 } from "node:fs";
-import path81 from "node:path";
+import path82 from "node:path";
 
 // src/cli/kraken/workbenchView.ts
 var EMPTY = {
@@ -82015,14 +82289,14 @@ function formatWorkbenchForTerminal(p3) {
 
 // src/cli/slashHandlers/krakenWorkbench.ts
 async function handleKrakenWorkbench(ctx) {
-  const dir = path81.join(ctx.cwd, ".zelari", "radio");
+  const dir = path82.join(ctx.cwd, ".zelari", "radio");
   let latest = null;
   let latestMtime = 0;
   try {
     const files = await fs38.readdir(dir);
     for (const f of files) {
       if (!f.startsWith("workbench-") || !f.endsWith(".md")) continue;
-      const full = path81.join(dir, f);
+      const full = path82.join(dir, f);
       const stat8 = await fs38.stat(full);
       if (stat8.mtimeMs > latestMtime) {
         latestMtime = stat8.mtimeMs;
@@ -82039,10 +82313,10 @@ async function handleKrakenWorkbench(ctx) {
   const parsed = parseWorkbench(content);
   const rendered = formatWorkbenchForTerminal(parsed);
   if (!rendered.trim()) {
-    appendSystem(ctx.setMessages, `[kraken workbench] ${path81.basename(latest)}: (no nodes / no events yet)`);
+    appendSystem(ctx.setMessages, `[kraken workbench] ${path82.basename(latest)}: (no nodes / no events yet)`);
     return;
   }
-  appendSystem(ctx.setMessages, `[kraken workbench] ${path81.basename(latest)}:
+  appendSystem(ctx.setMessages, `[kraken workbench] ${path82.basename(latest)}:
 ${rendered}`);
 }
 
@@ -82350,14 +82624,14 @@ ${result.output.split("\n").slice(-8).join("\n")}` : "";
 init_messageHelpers();
 init_paths();
 import { promises as fs39 } from "node:fs";
-import path84 from "node:path";
+import path85 from "node:path";
 async function handlePromoteMember(ctx, memberId) {
   try {
     const { promoteMember: promoteMember2 } = await Promise.resolve().then(() => (init_council(), council_exports));
     const { skill, markdown } = promoteMember2(memberId);
     const skillDir = skillsDir();
     await fs39.mkdir(skillDir, { recursive: true });
-    const filePath = path84.join(skillDir, `${skill.id}.md`);
+    const filePath = path85.join(skillDir, `${skill.id}.md`);
     const previous = await fs39.readFile(filePath, "utf8").catch(() => null);
     const { createHash: createHash24 } = await import("node:crypto");
     const sha = (s) => createHash24("sha256").update(s, "utf8").digest("hex");
@@ -82383,7 +82657,7 @@ ${lineage}
 // src/cli/branchManager.ts
 init_paths();
 import { promises as fs40, existsSync as existsSync55, readFileSync as readFileSync41, writeFileSync as writeFileSync24, mkdirSync as mkdirSync21, statSync as statSync7, rmSync as rmSync3 } from "node:fs";
-import path85 from "node:path";
+import path86 from "node:path";
 var META_FILENAME = "meta.json";
 var SESSIONS_SUBDIR = "sessions";
 function getBranchesBaseDir() {
@@ -82393,13 +82667,13 @@ function getSessionsBaseDir() {
   return sessionsDir();
 }
 function branchPathFor(name, baseDir) {
-  return path85.join(baseDir, name);
+  return path86.join(baseDir, name);
 }
 function metaPathFor(name, baseDir) {
-  return path85.join(baseDir, name, META_FILENAME);
+  return path86.join(baseDir, name, META_FILENAME);
 }
 function sessionsPathFor(name, baseDir) {
-  return path85.join(baseDir, name, SESSIONS_SUBDIR);
+  return path86.join(baseDir, name, SESSIONS_SUBDIR);
 }
 function readBranchMeta(name, baseDir) {
   const metaPath = metaPathFor(name, baseDir);
@@ -82424,7 +82698,7 @@ function readBranchMeta(name, baseDir) {
 }
 function writeBranchMeta(name, baseDir, meta3) {
   const metaPath = metaPathFor(name, baseDir);
-  mkdirSync21(path85.dirname(metaPath), { recursive: true });
+  mkdirSync21(path86.dirname(metaPath), { recursive: true });
   writeFileSync24(metaPath, JSON.stringify(meta3, null, 2), "utf-8");
 }
 async function countSessions(name, baseDir) {
@@ -82475,14 +82749,14 @@ async function createBranch(name, fromSessionId, baseDir = getBranchesBaseDir(),
   if (branchExists(name, baseDir)) {
     throw new BranchAlreadyExistsError(name);
   }
-  const sourcePath = path85.join(sessionsBaseDir, `${fromSessionId}.jsonl`);
+  const sourcePath = path86.join(sessionsBaseDir, `${fromSessionId}.jsonl`);
   if (!existsSync55(sourcePath)) {
     throw new SessionNotFoundError(`Source session "${fromSessionId}" not found at ${sourcePath}`);
   }
   const branchPath = branchPathFor(name, baseDir);
   const branchSessionsPath = sessionsPathFor(name, baseDir);
   mkdirSync21(branchSessionsPath, { recursive: true });
-  const destPath = path85.join(branchSessionsPath, `${fromSessionId}.jsonl`);
+  const destPath = path86.join(branchSessionsPath, `${fromSessionId}.jsonl`);
   await fs40.copyFile(sourcePath, destPath);
   const meta3 = {
     name,
@@ -82586,14 +82860,14 @@ async function handleBranchCheckout(ctx, branchName) {
 // src/cli/slashHandlers/workspace.ts
 init_messageHelpers();
 import { promises as fs41 } from "node:fs";
-import path86 from "node:path";
+import path87 from "node:path";
 async function handleWorkspaceShow(ctx, what) {
   try {
-    const zelari = path86.join(process.cwd(), ".zelari");
+    const zelari = path87.join(process.cwd(), ".zelari");
     let content;
     switch (what) {
       case "plan": {
-        const planPath = path86.join(zelari, "plan.md");
+        const planPath = path87.join(zelari, "plan.md");
         try {
           content = await fs41.readFile(planPath, "utf-8");
         } catch {
@@ -82602,7 +82876,7 @@ async function handleWorkspaceShow(ctx, what) {
         break;
       }
       case "decisions": {
-        const decisionsDir = path86.join(zelari, "decisions");
+        const decisionsDir = path87.join(zelari, "decisions");
         try {
           const files = (await fs41.readdir(decisionsDir)).filter((f) => f.endsWith(".md")).sort();
           if (files.length === 0) {
@@ -82612,7 +82886,7 @@ async function handleWorkspaceShow(ctx, what) {
 `];
             const { parseFrontmatter: parseFrontmatter2 } = await Promise.resolve().then(() => (init_storage(), storage_exports));
             for (const f of files) {
-              const raw = await fs41.readFile(path86.join(decisionsDir, f), "utf-8");
+              const raw = await fs41.readFile(path87.join(decisionsDir, f), "utf-8");
               const { meta: meta3, body } = parseFrontmatter2(raw);
               const title = meta3.title ?? body.split("\n")[0]?.replace(/^#\s*/, "").trim() ?? f;
               lines.push(`- **${f.replace(/\.md$/, "")}** [${meta3.status ?? "unknown"}] ${title}`);
@@ -82625,7 +82899,7 @@ async function handleWorkspaceShow(ctx, what) {
         break;
       }
       case "risks": {
-        const risksPath = path86.join(zelari, "risks.md");
+        const risksPath = path87.join(zelari, "risks.md");
         try {
           content = await fs41.readFile(risksPath, "utf-8");
         } catch {
@@ -82634,7 +82908,7 @@ async function handleWorkspaceShow(ctx, what) {
         break;
       }
       case "agents": {
-        const agentsPath = path86.join(process.cwd(), "AGENTS.MD");
+        const agentsPath = path87.join(process.cwd(), "AGENTS.MD");
         try {
           content = await fs41.readFile(agentsPath, "utf-8");
         } catch {
@@ -82643,7 +82917,7 @@ async function handleWorkspaceShow(ctx, what) {
         break;
       }
       case "docs": {
-        const docsDir = path86.join(zelari, "docs");
+        const docsDir = path87.join(zelari, "docs");
         try {
           const files = (await fs41.readdir(docsDir)).filter((f) => f.endsWith(".md")).sort();
           content = files.length ? `# Docs (${files.length})
@@ -82685,7 +82959,7 @@ async function handleWorkspaceReset(ctx, force) {
     return;
   }
   try {
-    const target = path86.join(process.cwd(), ".zelari");
+    const target = path87.join(process.cwd(), ".zelari");
     await fs41.rm(target, { recursive: true, force: true });
     appendSystem(ctx.setMessages, "[workspace] .zelari/ removed");
   } catch (err) {
@@ -84569,8 +84843,8 @@ function normalizeDraft(raw, sourceUrl, provider, model) {
   let name = String(o.name ?? "").trim().toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64);
   if (!name || !/^[a-z0-9][a-z0-9-]{0,63}$/.test(name)) {
     try {
-      const path100 = new URL(sourceUrl).pathname.split("/").filter(Boolean).pop()?.replace(/\.[a-z0-9]+$/i, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48);
-      name = path100 && /^[a-z0-9]/.test(path100) ? path100 : "imported-skill";
+      const path101 = new URL(sourceUrl).pathname.split("/").filter(Boolean).pop()?.replace(/\.[a-z0-9]+$/i, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48);
+      name = path101 && /^[a-z0-9]/.test(path101) ? path101 : "imported-skill";
     } catch {
       name = "imported-skill";
     }
@@ -84983,7 +85257,7 @@ proposals: npm run evolve:propose \u2014 decisions in npm run evolve:decide (P1:
   }
   if (argv.includes("--help") || argv.includes("-h")) {
     console.log(
-      "zelari-code \u2014 AI Council coding agent CLI.\n\nUsage: zelari-code [options]\n\nOptions:\n  --version, -v       Print version and exit\n  --help, -h          Print this help and exit\n  --doctor [--json]   Diagnose install health (shim, bundle, PATH, deps,\n                      node/git/bash in the agent shell)\n  --inspect [--json]  Unified project inspection (config, skills, MCP,\n                      hooks, plugins, AGENTS.md, trust status)\n  --trust [path]      Trust the cwd (or path) so project MCP + hooks load\n  --fix-path          Add the npm global prefix to the user PATH\n                      (Windows only; fixes 'command not found' after install)\n  --fix-budget        Set recommended ZELARI_MAX_TOOL_LOOP_HARD=180,\n                      ZELARI_MAX_TOOL_LOOP_ITERATIONS=60, ZELARI_CONTEXT_LIMIT=400000\n                      at User scope (prevents the agent stopping mid-task)\n  --permission-mcp <socket>  MCP stdio server for external agent permission prompts\n                      (spawned by claude --permission-prompt-tool)\n  --memory-mcp       Optional MCP stdio server for project memory\n    --cwd <path>      Trusted project root (requires ZELARI_MEMORY_MCP=1)\n    --client-id <id>  Stable local owner identity for private memories\n  --memory-json <json>  Read-only project-memory bridge for Zelari Desktop\n  --skip-checks       Skip the boot-time prerequisite check\n                      (alias for ZELARI_SKIP_PREFLIGHT=1)\n  --no-wizard         Skip the first-run wizard\n  --reset-config      Re-run the wizard (clears provider.json on commit)\n  --headless          Run a single task without mounting the TUI\n    --task <text>       Task prompt (required in headless mode)\n    --output json|plain Output format (default: json)\n    --mode kraken|council|zelari  Dispatch mode (default: kraken; agent=alias)\n                      zelari/mission mode auto-scopes slices from open tasks in .zelari/plan.json\n    --council          Alias for --mode council\n    --phase plan|build  Work phase (default: build)\n    --provider <id>    Provider override (default: active)\n    --model <id>       Model override (default: provider default)\n    --profile <id>     Capability profile (minimal/v1|kraken/v1|council/v1|mission/v1)\n    --resume <id>      Continue a 2.0 spine session\n    --resume-mission   Resume .zelari/mission-state.json (not the spine)\n    --export-session <path>  Write zelari-session-export/1 after the run\n    --strict-done      Evidence-based BUILD completion gate\n    --task-file <path>  Read the task prompt from a file (Windows argv cap)\n    --once             Single-cycle run (cron/git-hook triggers, ADR-0014)\n    --kraken-graph <goal>  Plan + execute a Kraken task graph\n                      (variant: --kraken-graph-file <path>; kill-switch\n                      ZELARI_KRAKEN_GRAPH=0)\n    --plan-only        Serialize the graph plan to .zelari/radio/ and exit 0\n    --run-plan <id>    Execute a pre-built .zelari/radio/plan-<id>.json\n    --gauntlet         Host-driven gauntlet loop (builder/critic tentacles)\n  --session-export <id>  Print a portable 2.0 session export (no LLM)\n  serve               Companion host for Android/remote clients (Tailscale)\n    --bind <ip>       Listen address (default: 127.0.0.1; use Tailscale IP)\n    --port <n>        Port (default: 7421)\n    --token <secret>  Bearer token (default: ~/.zelari-code/companion.token)\n    --project <path>  Allowlisted project root (repeatable)\n    --save-projects   Persist --project list to companion.json\n  --serve-harness     Long-lived harness kernel for hosts (NDJSON JSON-RPC\n                      on stdin/stdout; Desktop/companion transport)\n  --print-config      Print provider/model config as JSON (no secrets)\n  --print-settings    Print zelari.config.json values + the origin of\n                      each (default < user < project < env)\n  --permissions <p>   Permission preset: strict | standard | yolo \u2014 changes\n                      category DEFAULTS only (env vars and policy files win)\n  --evolve-status     Evolution ledger stats (read-only; ADR-0036; the\n                      ledger is written only when ZELARI_EVOLUTION=shadow)\n  --plugins-status    JSON status of optional plugins (Playwright, eslint, \u2026)\n  --plugins-install <id>  Install plugin (playwright also fetches Chromium)\n    --cwd <path>       Workspace for -D installs (default: process.cwd())\n  --set-config        Persist provider/model/endpoint\n    --provider <id>    Set active provider\n    --model <id>       Set model for that provider\n    --endpoint <url>   Custom OpenAI-compatible base URL\n    --endpoint-clear   Remove custom endpoint override\n    --thinking <spec>  Thinking effort (auto|off|low|medium|high|budget:N)\n  --set-key           Store an API key (never printed back)\n    --provider <id>    Provider id (required)\n    --key <secret>     API key (required)\n  --login-oauth       Start subscription OAuth (grok, chatgpt, anthropic)\n    --provider <id>    grok | chatgpt | anthropic\n    --code <paste>    Anthropic magic-link code (CODE#STATE)\n    --no-browser      Do not open the system browser\n  --refresh-oauth     Force-refresh an OAuth access token\n    --provider <id>    grok | chatgpt | anthropic\n  --logout-oauth      Clear stored OAuth credentials\n    --provider <id>    grok | chatgpt | anthropic\n  --discover-models   Refresh model list for a provider\n    --provider <id>    Provider (default: active)\n  --print-mcp         Print MCP server config (user + project)\n    --cwd <path>      Project root for .zelari/mcp.json\n  --set-mcp           Add/update an MCP server entry\n    --name <id>       Server name (required)\n    --command <bin>   Executable for stdio servers\n    --url <endpoint>  Streamable HTTP endpoint (e.g. UE 5.8 editor)\n    --args <json>     JSON array of args (stdio, optional)\n    --timeout <ms>    Per-server request timeout (http, optional)\n    --scope user|project  Default: user\n    --enabled true|false  Default: true\n    --cwd <path>      Required when scope=project\n  --set-mcp-preset    Install a named MCP preset (e.g. cua)\n    --preset cua      Cua Driver desktop computer-use (MCP)\n    --preset unreal-mcp  Unreal Engine 5.8+ editor (MCP over HTTP)\n    --scope user|project  Default: user\n    --cwd <path>      Required when scope=project\n  --remove-mcp        Remove an MCP server entry\n    --name <id> --scope user|project [--cwd <path>]\n  --print-skills      Print skills (builtin + user + project)\n    --cwd <path>      Project root for .zelari/skills\n  --set-skill         Add/update a SKILL.md skill\n    --name <id>       Skill id (required)\n    --description <t> One-line description (required)\n    --body <text>     Markdown instructions (required)\n    --category <c>    plan|refactor|debug|review|test|docs|ops|git|db|maint\n    --tools <csv>     Comma-separated required tools (optional)\n    --cost <l>        low|medium|high (default: medium)\n    --scope user|project  Default: user\n    --cwd <path>      Required when scope=project\n  --remove-skill      Remove a user/project SKILL.md\n    --name <id> --scope user|project [--cwd <path>]\n  --generate-skill-from-url  Fetch URL + draft skill via model (JSON)\n    --url <https://...>  Required\n    --provider <id>   Override active provider\n    --model <name>    Override model for the selected provider\n  --print-ssh-targets Print SSH deploy/monitor targets\n  --set-ssh-target    Upsert target (--json '{...}' or flags)\n  --remove-ssh-target --id <id>\n  --test-ssh-target   --id <id>  (BatchMode ssh true)\n  --print-ssh-pubkey  --path <private-or-.pub>  (display public key)\n\nEnvironment:\n  ZELARI_NO_WIZARD=1    Skip the first-run wizard\n  ZELARI_SKIP_PREFLIGHT=1  Skip the boot prerequisite check\n  ZELARI_NO_PLUGIN_PROMPT=1  Skip the boot plugin-install prompt\n  ZELARI_MEMORY_MCP=1  Enable the optional external memory MCP server\n  ANATHEMA_DEV=1        Disable background update check + preflight\n"
+      "zelari-code \u2014 AI Council coding agent CLI.\n\nUsage: zelari-code [options]\n\nOptions:\n  --version, -v       Print version and exit\n  --help, -h          Print this help and exit\n  --doctor [--json]   Diagnose install health (shim, bundle, PATH, deps,\n                      node/git/bash in the agent shell)\n  --inspect [--json]  Unified project inspection (config, skills, MCP,\n                      hooks, plugins, AGENTS.md, trust status)\n  --trust [path]      Trust the cwd (or path) so project MCP + hooks load\n  --fix-path          Add the npm global prefix to the user PATH\n                      (Windows only; fixes 'command not found' after install)\n  --fix-budget        Set recommended ZELARI_MAX_TOOL_LOOP_HARD=180,\n                      ZELARI_MAX_TOOL_LOOP_ITERATIONS=60, ZELARI_CONTEXT_LIMIT=400000\n                      at User scope (prevents the agent stopping mid-task)\n  --permission-mcp <socket>  MCP stdio server for external agent permission prompts\n                      (spawned by claude --permission-prompt-tool)\n  --memory-mcp       Optional MCP stdio server for project memory\n    --cwd <path>      Trusted project root (requires ZELARI_MEMORY_MCP=1)\n    --client-id <id>  Stable local owner identity for private memories\n  --memory-json <json>  Read-only project-memory bridge for Zelari Desktop\n  --skip-checks       Skip the boot-time prerequisite check\n                      (alias for ZELARI_SKIP_PREFLIGHT=1)\n  --no-wizard         Skip the first-run wizard\n  --reset-config      Re-run the wizard (clears provider.json on commit)\n  --headless          Run a single task without mounting the TUI\n    --task <text>       Task prompt (required in headless mode)\n    --output json|plain Output format (default: json)\n    --mode kraken|council|zelari  Dispatch mode (default: kraken; agent=alias)\n                      zelari/mission mode auto-scopes slices from open tasks in .zelari/plan.json\n    --council          Alias for --mode council\n    --phase plan|build  Work phase (default: build)\n    --provider <id>    Provider override (default: active)\n    --model <id>       Model override (default: provider default)\n    --profile <id>     Capability profile (minimal/v1|kraken/v1|council/v1|mission/v1)\n    --resume <id>      Continue a 2.0 spine session\n    --resume-mission   Resume .zelari/mission-state.json (not the spine)\n    --export-session <path>  Write zelari-session-export/1 after the run\n    --strict-done      Evidence-based BUILD completion gate\n    --allow-unverified  Exit 0 when strict is ON but nothing could be verified (M1.2)\n    --task-file <path>  Read the task prompt from a file (Windows argv cap)\n    --once             Single-cycle run (cron/git-hook triggers, ADR-0014)\n    --kraken-graph <goal>  Plan + execute a Kraken task graph\n                      (variant: --kraken-graph-file <path>; kill-switch\n                      ZELARI_KRAKEN_GRAPH=0)\n    --plan-only        Serialize the graph plan to .zelari/radio/ and exit 0\n    --run-plan <id>    Execute a pre-built .zelari/radio/plan-<id>.json\n    --gauntlet         Host-driven gauntlet loop (builder/critic tentacles)\n  --session-export <id>  Print a portable 2.0 session export (no LLM)\n  serve               Companion host for Android/remote clients (Tailscale)\n    --bind <ip>       Listen address (default: 127.0.0.1; use Tailscale IP)\n    --port <n>        Port (default: 7421)\n    --token <secret>  Bearer token (default: ~/.zelari-code/companion.token)\n    --project <path>  Allowlisted project root (repeatable)\n    --save-projects   Persist --project list to companion.json\n  --serve-harness     Long-lived harness kernel for hosts (NDJSON JSON-RPC\n                      on stdin/stdout; Desktop/companion transport)\n  --print-config      Print provider/model config as JSON (no secrets)\n  --print-settings    Print zelari.config.json values + the origin of\n                      each (default < user < project < env)\n  --permissions <p>   Permission preset: strict | standard | yolo \u2014 changes\n                      category DEFAULTS only (env vars and policy files win)\n  --evolve-status     Evolution ledger stats (read-only; ADR-0036; the\n                      ledger is written only when ZELARI_EVOLUTION=shadow)\n  --plugins-status    JSON status of optional plugins (Playwright, eslint, \u2026)\n  --plugins-install <id>  Install plugin (playwright also fetches Chromium)\n    --cwd <path>       Workspace for -D installs (default: process.cwd())\n  --set-config        Persist provider/model/endpoint\n    --provider <id>    Set active provider\n    --model <id>       Set model for that provider\n    --endpoint <url>   Custom OpenAI-compatible base URL\n    --endpoint-clear   Remove custom endpoint override\n    --thinking <spec>  Thinking effort (auto|off|low|medium|high|budget:N)\n  --set-key           Store an API key (never printed back)\n    --provider <id>    Provider id (required)\n    --key <secret>     API key (required)\n  --login-oauth       Start subscription OAuth (grok, chatgpt, anthropic)\n    --provider <id>    grok | chatgpt | anthropic\n    --code <paste>    Anthropic magic-link code (CODE#STATE)\n    --no-browser      Do not open the system browser\n  --refresh-oauth     Force-refresh an OAuth access token\n    --provider <id>    grok | chatgpt | anthropic\n  --logout-oauth      Clear stored OAuth credentials\n    --provider <id>    grok | chatgpt | anthropic\n  --discover-models   Refresh model list for a provider\n    --provider <id>    Provider (default: active)\n  --print-mcp         Print MCP server config (user + project)\n    --cwd <path>      Project root for .zelari/mcp.json\n  --set-mcp           Add/update an MCP server entry\n    --name <id>       Server name (required)\n    --command <bin>   Executable for stdio servers\n    --url <endpoint>  Streamable HTTP endpoint (e.g. UE 5.8 editor)\n    --args <json>     JSON array of args (stdio, optional)\n    --timeout <ms>    Per-server request timeout (http, optional)\n    --scope user|project  Default: user\n    --enabled true|false  Default: true\n    --cwd <path>      Required when scope=project\n  --set-mcp-preset    Install a named MCP preset (e.g. cua)\n    --preset cua      Cua Driver desktop computer-use (MCP)\n    --preset unreal-mcp  Unreal Engine 5.8+ editor (MCP over HTTP)\n    --scope user|project  Default: user\n    --cwd <path>      Required when scope=project\n  --remove-mcp        Remove an MCP server entry\n    --name <id> --scope user|project [--cwd <path>]\n  --print-skills      Print skills (builtin + user + project)\n    --cwd <path>      Project root for .zelari/skills\n  --set-skill         Add/update a SKILL.md skill\n    --name <id>       Skill id (required)\n    --description <t> One-line description (required)\n    --body <text>     Markdown instructions (required)\n    --category <c>    plan|refactor|debug|review|test|docs|ops|git|db|maint\n    --tools <csv>     Comma-separated required tools (optional)\n    --cost <l>        low|medium|high (default: medium)\n    --scope user|project  Default: user\n    --cwd <path>      Required when scope=project\n  --remove-skill      Remove a user/project SKILL.md\n    --name <id> --scope user|project [--cwd <path>]\n  --generate-skill-from-url  Fetch URL + draft skill via model (JSON)\n    --url <https://...>  Required\n    --provider <id>   Override active provider\n    --model <name>    Override model for the selected provider\n  --print-ssh-targets Print SSH deploy/monitor targets\n  --set-ssh-target    Upsert target (--json '{...}' or flags)\n  --remove-ssh-target --id <id>\n  --test-ssh-target   --id <id>  (BatchMode ssh true)\n  --print-ssh-pubkey  --path <private-or-.pub>  (display public key)\n\nEnvironment:\n  ZELARI_NO_WIZARD=1    Skip the first-run wizard\n  ZELARI_SKIP_PREFLIGHT=1  Skip the boot prerequisite check\n  ZELARI_NO_PLUGIN_PROMPT=1  Skip the boot plugin-install prompt\n  ZELARI_MEMORY_MCP=1  Enable the optional external memory MCP server\n  ANATHEMA_DEV=1        Disable background update check + preflight\n"
     );
     process.exit(0);
   }