diff --git a/.claude/rules/tests.md b/.claude/rules/tests.md
index 681557c689..2701f17264 100644
--- a/.claude/rules/tests.md
+++ b/.claude/rules/tests.md
@@ -27,6 +27,11 @@ This exists because inside a **git worktree** any `bunx` call creates a partial
 
 ## Test traps
 
+- **Never start an executable the test just made and then rename or delete it.** macOS checks every new executable in
+  `syspolicyd` after it starts; a check that found the file gone crashed `syspolicyd` five times in ten minutes on
+  2026-10-14 and froze the whole Mac (WindowServer watchdog). Make a test program once with `persistentFixture` from
+  `src/utils/test/persistent-fixture.ts` (kept, never renamed or deleted), and after the first run of such a test check
+  that `pgrep -x syspolicyd` still prints the same pid.
 - **Rewriting untested code: a characterization test first.** Pin the current behaviour, prove the test passes on the old code, then rewrite. When the test fails after the rewrite, assume the rewrite is wrong. Change a test only for an intended behaviour change, and say in the commit what changed and why.
 - **Red today, green yesterday, no relevant commit: check the calendar.** A dated fixture crosses a window when one input still resolves against the real clock: `--since=N days ago` for git, `find -mtime`, `date -v-7d`. Derive every cutoff from the injected `now`.
 - **`bun test --timeout` bounds a test body only.** A hang at module scope (an import that never settles) blocks forever. The signal is the wrapper's `[test] suite complete` line missing. Do not grep bun's own "Ran N tests across M files": it prints once per process, and `bun run test` runs two.
diff --git a/.claude/skills/babysit/SKILL.md b/.claude/skills/babysit/SKILL.md
index 552a85bc57..59441a3552 100644
--- a/.claude/skills/babysit/SKILL.md
+++ b/.claude/skills/babysit/SKILL.md
@@ -42,6 +42,20 @@ Write it to `/tmp/cc/<project>/<session>/babysit/run.json` at the start; the scr
 | `post` | ask | Post the round summary and replies after the push (review-loop step 4), or hold them in the vault. |
 | `report` | vault note | Optionally also a bus message: `{ "session": "grok-dev", "to": "grokbot-developer" }`. |
 | `stopAfter` | the user's words | A phase or round to stop at. Stop there even if everything is green. |
+| `vault` | `<run>/vault` | The notes folder of this run: reply files, summaries, the rendered ledger. Set it. |
+| `judge` | `Claude` | The name the round summary credits as judge ("… from <worker> judged by <judge>"). |
+| `worktrees` | `<run>/worktrees` | Parent of the per-PR worker worktrees `bs-<N>`. |
+
+**Codex model: Sol unless a finding needs Astra.** A large PR is not a hard PR: its findings are mostly Medium and Low
+fixes that Sol handles. Use `gpt-6-astra` only when the user names it for a PR, when a Sol worker missed the same
+finding twice after the judge's correction, or for a finding that crosses systems (process lifecycle, concurrency,
+kernel or OS APIs, a stacked chain that must stay consistent). Steering the same session keeps its model, so decide
+again at each round: an Astra session that finished its hard finding hands the next round to a Sol session. On
+2026-10-14 the overnight run gave Astra every large PR by size: 47 of the 62 worker rounds, and $903 of the $924
+API-equivalent spend of the `bs-*` workers (an Astra worker cost $201 to $217 for about 20 turns; the Sol worker $21
+for 25 turns; `tools ai-spend workers --backend codex --by model,name`).
+
+Every script below takes `--run <run dir>` (or `BABYSIT_RUN`) and reads this card through `scripts/run.ts`.
 
 ## 2. Mode: a worktree per worker, or the unified branch
 
@@ -76,15 +90,42 @@ the stop point. After the confirmation period, state the plan in one line and pr
    the hidden channels, `expand` every thread (the L1 table can scramble files). Keep each thread's `threadId`.
 4. Read the source at every cited line before you brief: a stale or wrong finding is briefed as such, so the worker
    does not "fix" it.
-5. **Round policy.** review-loop decides what gets fixed in each round (rounds 1 and 2: every valid finding; later
-   rounds: critical and high). When the user's own words ask for a fix the policy would only answer ("fix the open
-   threads"), the user's words win; say so in the plan.
+5. **Round policy** (Martin, 2026-10-17 12:16; it replaces "fix every finding in every round", because eve opened
+   new Medium and Low findings on every push of #536 for 28 rounds). The executable rule is `scripts/policy.ts`;
+   `fill-brief.ts` derives it from the round, GitHub's changed-file count and `--dedicated-review`. Both brief
+   templates and judging use that generated policy. Count the PR's fix rounds; a follow-up PR starts at round 1.
+   - A PR with more than 100 changed files: rounds 1 to 3 fix every valid finding, Medium and Low included. From
+     round 4, fix only Critical and High.
+   - A PR with 100 changed files or fewer: rounds 1 and 2 fix every valid finding. From round 3, fix only Critical
+     and High.
+   - In the rounds that fix only Critical and High, a Medium or Low finding gets a reply (valid or not, and why).
+     It is not fixed in that PR, and its thread stays OPEN: resolve only a thread that was acted on (fixed, or
+     rejected with a cited file:line). Record a policy deferral with the reply transport's supported
+     `"verdict": "belongs-elsewhere"` and explain the policy in the reply; do not add unsupported schema fields. `integrate.ts` keeps it in the summary but partitions it into a separate
+     `post-replies.ts --no-resolve` batch, never the batch that resolves threads (Martin, 2026-10-17 12:45).
+   - **A valid security finding is always fixed**, at any severity and in any round (Martin, 2026-10-17 12:45:
+     "security valid always"). Read the reviewer's category (`🔒 Security`), not only its severity.
+   - **A dedicated code review the user asks for** (an independent worker review such as `review-brief.ts` on Astra
+     or Sol) is fixed in full: every valid finding, Medium and Low included, whatever round the PR is in. Fix it
+     yourself or steer the PR's fixing worker, then judge it as any round (Martin, 2026-10-17 13:05).
+   - Inside the fix-everything rounds, a deferral is not accepted ("nothing is a follow up or out of scope", Martin,
+     2026-10-17), and every file a valid fix needs is in scope. A `no-change` or rejection needs a cited file:line
+     that proves the finding wrong.
+   - **Merge bar:** when the last round's Critical and High findings are fixed and judged, merge without waiting
+     for eve to review that last fix. The PR still needs at least one CodeRabbit review, green CI and a reply on
+     every thread.
 6. Scope: `git fetch origin <pr branch>`, then `bun .claude/skills/babysit/scripts/pr-scope.ts <N> --compare HEAD`.
    It lists the PR's files, the test file of each one (a sibling `.test.ts`, or a neighbour test that imports it),
-   and whether unified differs from the PR branch per file. That list is the outer bound. The brief allows the files
-   the findings cite plus their tests, and any other PR file a fix provably needs. Missing a test file in the scope
+   and whether unified differs from the PR branch per file. That list is the starting context, not a scope limit.
+   The brief allows every file a valid fix needs, including files outside the original PR diff; explain those files
+   in the reply. Missing a test file in the scope
    put Grok's tests in the wrong file on 2026-10-14.
-7. Baseline the cost: `tools grok usage --json --fresh` (the SuperGrok weekly percentage) for Grok workers. Every
+7. **Worktree** (worktree mode): `bun .claude/skills/babysit/scripts/setup-wt.ts --run <dir> --pr <N>`. Detached at
+   the PR head, `bun install --ignore-scripts` plus the repo's patches, the test wrapper's install stamp (else
+   `scripts/test.ts` reinstalls everything inside the worker's sandbox), native files linked to the main checkout's
+   twins (`link-native.ts`: on 2026-10-14 a stuck syspolicyd hung every NEW native binary at `_dyld_start`), nested
+   app `node_modules` linked. About 7 s with a warm bun cache.
+8. Baseline the cost: `tools grok usage --json --fresh` (the SuperGrok weekly percentage) for Grok workers. Every
    worker turn is booked in the cost ledger with its ai-spend price, login and label, and its report (Codex: the
    `turn_completed` bus event and `status --json` `cost`) ends with one line: API-equivalent, billed, and a Claude
    Opus/Sonnet estimate for the same tokens. The API-credit
@@ -94,7 +135,17 @@ the stop point. After the confirmation period, state the plan in one line and pr
 
 ## 4. Brief and dispatch
 
-Fill [references/brief-template.md](references/brief-template.md) per PR (the findings pasted in full, the scope,
+A Codex worker's sandbox has no network, so `tools github review` and `gh` fail inside it (2026-10-16: two round 2
+fixers stopped before their first edit). Before every spawn or steer of a round, run
+`bun .claude/skills/babysit/scripts/fetch-threads.ts --run <dir> --pr <N> --round <R>`: it writes the threads (listed
+and expanded, with Thread IDs), the review bodies and the bot PR comments into the worktree, and the brief points there.
+
+Two brief forms. **Self-fetch** (the default since 2026-10-14):
+`bun .claude/skills/babysit/scripts/fill-brief.ts --run <dir> --pr <N> --round <R> --model "<label>" --scopes "<a, b>"
+[--swift] [--judge <findings.md>]` fills [references/brief-self-fetch.md](references/brief-self-fetch.md): the worker
+lists and expands the threads itself with `tools github review`, fixes, commits once and writes the reply file; the
+lead's judge findings on an earlier commit ride along with `--judge`. **Pasted findings**: fill
+[references/brief-template.md](references/brief-template.md) per PR (the findings pasted in full, the scope,
 the verify commands, the commit subject `fix(<scopes>): #<N> followup - <what>`, the reply-JSON shape, the bus
 lines, the stop point). The handoff-to readiness gate applies: self-contained, a verify command the sandbox can
 run, explicit negative constraints, a named checkpoint, a deliverable the sandbox can write.
@@ -121,6 +172,28 @@ How each backend commits (measured 2026-10-14 with probe workers in linked workt
   escalation that the approval driver (step 5) accepts when it matches the brief. The brief therefore tells a Codex
   worker to run `git add -- <paths>` and `git commit` as two separate commands, never chained with `&&`.
 
+### The run ledger: log every prompt, turn, verdict and push
+
+Every run keeps `<run dir>/ledger.jsonl` ([scripts/ledger.ts](scripts/ledger.ts)), one event per line, so the user can
+audit afterwards what each worker was told and what it answered, not only the outcome. Append as you go, never
+reconstruct at the end:
+
+- `spawn` and `steer`: the full prompt text (`--file <brief>`), with `--worker`, `--model`, `--pr`, `--round`.
+- `turn`: the worker's final message when a turn ends (`lastText` of `tools codex wait --json`, Grok's report).
+- `judge`: `--meta '{"verdict":"…","evidence":"…"}'`, plus refusals you overruled and the findings you fed back.
+- `correction`, `push` (`range`), `post`, `decision`, `incident`, `note`.
+
+`bun .claude/skills/babysit/scripts/ledger.ts append --run <dir> --kind steer --pr 501 --round 2 --worker bs-gk
+--model gpt-6-astra --file steer.md`; import `appendEvent` when a script of the run already does the step (the
+integrate script logs `push` and `post` itself). The Markdown is built on demand, never kept by hand:
+`ledger.ts render --run <dir> --out <vault run folder>/<date>-<topic>-Ledger.md` (an overview table per PR, then each
+PR's events in time order, prompts and final messages folded into `<details>`). Render it into the vault with every
+report.
+
+A later round is a `steer` into the SAME worker thread: the worker keeps its context and its prompt cache. The same
+PR's next round gets a delta (what the judge decided, what to fix); a new PR for an idle worker gets only the new
+PR's facts (worktree, branch, round policy, thread command) plus "same rules as your first brief".
+
 ## 5. Watch while they work
 
 Three Monitors, all with `timeout_ms: 1800000`, each re-armed as the very next tool call after its expiry notice
@@ -129,28 +202,67 @@ Three Monitors, all with `timeout_ms: 1800000`, each re-armed as the very next t
 1. The lead's bus: `tools agents login --agent-main --agent-name lead --format monitor --hide-worker-steps
    --session <s>`. Worker mail, Codex turn and approval events.
 2. The workers: `bun .claude/skills/babysit/scripts/watch-workers.ts grok:<name> codex:<name> …`. One line per turn
-   start and end, tool call, question and stall (3 minutes silent while running).
+   start and end, shell command, question and stall (3 minutes silent while running); file reads and greps are only
+   counted at the turn end (`--tools all` prints them too).
 3. Codex approvals: `bun .claude/skills/babysit/scripts/approve-codex.ts --run <run.json> --name <name>`. The daemon
    itself accepts read-only commands (since 886b44308); this driver approves the brief's file edits, `git add` of
    scope files, the one commit with the brief's subject, and the brief's verify commands, including their one
    sandbox escalation for loopback tests. Everything else prints `NEEDS LEAD`; decide it yourself. Deny rituals
-   (`tools say`), pushes, and anything outside scope.
+   (`tools say`), pushes, and unrelated file changes. Add every file a valid fix needs to the worker's scope before
+   approving it.
 
 Two-way proof: once per new worker, send a ping on the bus (`--to grok_pr<N>` or `--to codex_<name>`) and see the
 reply arrive (Sol answered in 20 s, Grok in 59 s). During the confirmation period do it for every worker.
 
+Waiting on a Codex turn: `bun .claude/skills/babysit/scripts/wait-turn.ts --run <dir> --worker <name> --thread <id>
+--pr <N> --round <R>` with Bash `run_in_background`; the harness wakes the lead when the turn ends, and the worker's
+final message lands in the ledger. Never poll. First steer with `scripts/steer.ts` (same flags plus `--file`), which logs
+the prompt and the pre-delivery answering-turn fence. A live wait needs that steer record for the worker, PR and
+round; an earlier finished turn never answers it, while a new reply that finished before the wait starts still counts.
+`bun .claude/skills/babysit/scripts/round-ready.ts --run <dir> <N>…` says which PRs the reviewer bot has
+re-reviewed at their current head, so their next round can start; add `--wait <minutes>` under Bash `run_in_background`
+to block until eve (or every bot `--bots` names) reviewed each head (exit 0) or the deadline passes (exit 3). Never
+write a one-off waiter that greps its output. To be woken on every change instead, run
+`bun .claude/skills/babysit/scripts/watch-reviews.ts --run <dir> <N>…` as a Monitor (`timeout_ms: 1800000`, re-arm
+on expiry): it prints a PR's line only when its head, any reviewer's latest review of that head, its open threads or
+the PR comments by others change. Watch every reviewer, never eve alone, and keep the PRs merged in the last 24 hours
+on the list: a review can arrive after the merge (2026-10-14: #502, #503 and #505 each got findings after theirs).
+🛑 An event with new open threads is work, also on a merged PR and also when it says APPROVED: read the threads
+(`audit-reviews.ts <N> --bodies`) the same turn. On 2026-10-14 an event showed three new threads on merged #502 and
+sat unread for 70 minutes.
+
+🛑 Kill a process only after its working folder is proven to be one of the run's own worktrees
+(`lsof -a -d cwd -p <pid>`). A name match is not proof: on 2026-10-14 the lead killed another session's pre-commit
+hook, believing it was a worker's.
+
 ## 6. Judge each worker commit (fable-judge, inline)
 
-[references/judging.md](references/judging.md) is the checklist. In short: the diff is the truth, not the report;
+🛑 Invoke the `fable-judge` skill for every round, before the push, and read the worker's summary, its reply file and
+the full diff together ([references/judging.md](references/judging.md) is the checklist, the rule comes first there):
+`bun .claude/skills/babysit/scripts/judge-pack.ts --wt <worktree> --range origin/<branch>..HEAD --replies <reply json>
+--report <worker-final file> --out <file>` puts the claims, the flagged refusals and deferrals, and the diff (tests first) in one file.
+Checks plus planted regressions are not a judgement; the code itself is judged. In short: the diff is the truth, not the report;
 rerun every claimed check yourself; plant the old code back to prove each new test fails without the fix; check the
 fix against the module's documented contracts and its callers (the #511 defect hid in a caller); check scope, one
 commit, nothing staged that is not the worker's; check the ready-to-post replies against the final code. Verdict per
 PR: VERIFIED, VERIFIED WITH CAVEATS, or REFUTED, with evidence.
 
+Judge against the same derived round policy from `scripts/policy.ts` that `fill-brief.ts` put in the brief.
+Every required finding is fixed in its PR before the push; a valid security finding and every valid finding in a
+dedicated user review are always required, including Medium and Low. Other Medium/Low findings deferred by the
+ordinary later-round policy get explained replies and remain OPEN. Verify that integrate partitions those replies
+into its no-resolve batch. If a required fix needs a file outside the original diff, change it in this PR and explain
+it in the reply; scope never excuses a required fix. A Swift change the worker could not run is not judged until the
+lead ran its tests: `swift-typecheck.ts` proves it compiles, and #501 round 2 typechecked clean yet broke a test.
+
 ## 7. Correct, integrate, push
 
 At most **one correction commit** per PR per round, for what is wrong or below the bar (a defect, a test in the wrong
-place, a misleading reply). None when the judge found nothing; say so. Then
+place, a misleading reply). None when the judge found nothing; say so. Worktree mode, one command for the rest:
+`bun .claude/skills/babysit/scripts/integrate.ts --run <dir> --pr <N> --round <R>` runs the gates, pushes the judged
+SHA (never HEAD at push time: a worker steered into its next round may commit meanwhile), copies the reply file to the
+vault with the judge, renders and posts the round summary once (a `.posted` marker stops a rerun from posting twice),
+then posts the thread replies, resolves acted-on items, leaves policy-deferred threads OPEN, and logs `push` and `post`. Details:
 [references/integrate.md](references/integrate.md):
 
 - worktree mode: the correction goes on the worker's worktree; verify there; push `HEAD:refs/heads/<pr-branch>`;
@@ -158,6 +270,13 @@ place, a misleading reply). None when the judge found nothing; say so. Then
 - unified mode: correction on unified; cherry-pick both onto a scratch worktree of the PR branch; resolve context
   conflicts by keeping the PR branch's side plus the worker's change; verify; push.
 
+Every conflict, in any step, is resolved through `bun .claude/skills/babysit/scripts/conflicts.ts`: `resolve <file>
+<ours|theirs|both|base> ...` (one side per block, in file order), or edit the file yourself and run `check <file> ...`,
+which fails on a leftover conflict marker and on a JSON file that does not parse. Run `check` before `cherry-pick
+--continue` or `rebase --continue`, and before you copy a resolved file into another checkout. Never resolve with an
+inline `bun -e` script: on 2026-10-14 one returned the pick names as text, wrote the word `ours` into both plugin
+manifests (d9687720a), and the genesis-tools plugin did not load in any new session for 12 hours.
+
 Gates before each push: the test files of the scope (not the PR's whole suite: a test that launches a real
 browser or app, such as the chrome-devtools headless tests, makes a 1.4 GB app copy per launch, so run it only when
 the fix touches that path, and report it as NOT RUN otherwise), `bunx tsgo --noEmit`, Biome on the changed files,
@@ -169,6 +288,80 @@ add the correction to the affected items and to `alsoInPush`, set every item's `
 (fable-judge)"`, and render `round-summary.ts --range <old head>..<new head> --cwd <pr worktree>`. Post per review-loop
 step 4 only when `post` is true.
 
+## 7a. A PR short of three rounds: an independent review round
+
+A round counts only when it fixed or answered real findings. When the reviewer bot has nothing left on a PR that
+still needs rounds, or a PR merged with fewer than three, run an independent read-only review: `bun
+.claude/skills/babysit/scripts/review-brief.ts --run <dir> --pr <N> --wt <worktree> [--post-merge] [--swift]`, then
+`steer.ts` with the printed file to a worker that did NOT fix this PR (Sol; Astra only for a risky cross-system PR,
+by the model rule in step 1). Judge its findings like a bot's. Before a merge they become the next fix round (`fill-brief --judge <review
+file> --dedicated-review`); after a merge they go to a follow-up PR from master (2026-10-14: #518 carried #509's after-merge findings).
+Never count a reply-only round, or a label, as a fix round: on 2026-10-14 the report said "#500 merged after 3
+rounds" when GitHub showed two round summaries.
+
+## 7b. Optional: land a PR in master (only with the user's explicit approval)
+
+Off unless the user approves it in their own words for this run ("drive the PRs into master after 3 rounds"), and
+only for PRs the run owns: never another session's PR, never the integration branch. Ask once, early, and keep
+running review rounds while the question is open: a missing answer never blocks a round, it only means no merge.
+
+A PR lands when all hold: at least 3 review rounds done; every finding required by the derived policy is fixed
+and judged (including every valid security finding and all dedicated-review findings); at least one CodeRabbit
+review; a reply on every thread; CI green on the landing tree; its base is master or a parent the run merges first
+(a PR stacked on another session's branch waits for that branch). Merge without waiting for eve to review the last
+judged fix. Policy-deferred Medium/Low threads may remain OPEN. Then the review-loop landing recipe, which
+`bun .claude/skills/babysit/scripts/land.ts --run <dir> --pr <N> --merge` runs as one command (without `--merge` it
+only prepares and prints the squash; every git call is an argument array, because a hand-typed
+`--force-with-lease=$B:c1a…` in zsh read `:c` as a modifier and pushed without the lease):
+
+0. Optional, only when asked for a PR: a commit limit (for example "10 commits max" for a handed-over PR). It is not
+   a rule for every PR. Regroup a longer history into thematic commits with exactly the same final tree
+   (`git diff <old head> <new head>` prints nothing), reset to the PR's fork point (`git merge-base HEAD origin/master`),
+   never to a moved `origin/master`; then `land.ts … --max-commits <n> --head <regrouped sha>` refuses more than
+   asked. Contiguous segments regroup without a conflict through `git commit-tree "<segment end>^{tree}" -p <prev>`;
+   `--head` refuses a regroup whose tree differs from the PR head's. Add `--squash` when the user asked to squash-merge.
+1. Squash the review commits (the `#<N> followup` ones on top of the feature commits) into one
+   `fix(<scopes>): #<N> followup - address PR review (<k> commits)` whose body lists each squashed subject; prove the
+   tree is identical (`git rev-parse HEAD^{tree}` before and after) and run `bun scripts/git/check-commits.ts
+   origin/master..HEAD`.
+2. Push with `--force-with-lease=<branch>:<old head>`. An identical tree on a green head needs no new CI run
+   (review-loop 4e); a rebase that resolved a conflict is new code: rerun CI and judge it. Do not wait for eve to
+   review the last judged fix; the CodeRabbit-review and per-thread-reply requirements still hold.
+3. `git fetch origin <branch>` in the main checkout (`tools github merge` compares against the local remote ref and
+   refuses a "moved" branch otherwise), then `tools github merge --rebase <N>`. Stacks merge bottom-up; the tool
+   retargets dependents.
+4. Log a `note` event with the merge SHA, and list every PR that did not land with its reason in the report.
+
+A PR that conflicts with master, or whose parent was just squash-merged, is restacked first:
+`bun .claude/skills/babysit/scripts/restack.ts --wt <worktree> --onto origin/master [--upstream <fork point>]`. It runs
+with hooks and rerere off (a hook froze on a stuck syspolicyd; rerere hid a conflict behind an old resolution),
+resolves only the plugin version files (the higher version wins), and aborts on any code conflict: that one goes to
+the worker who knows the PR, as a merge-prep steer that authorizes the rebase. `--upstream` is the commit the branch
+forked from on its parent (a child stacked on a parent that kept growing forked before the parent's later commits;
+find it with `git merge-base <child> <old parent head>`). Check with `git range-diff`, run the area tests, give a
+child that changes plugin files a version above its new base, then push with `--force-with-lease`. A restack is new
+code: rerun CI and judge it before the merge; eve need not re-review the last judged fix. Keep at least one
+CodeRabbit review and a reply on every thread. When the restack carries a fix round too, push it with
+`integrate.ts … --restacked-from <old head>`: the lease is that old head, and the gates check only the PR's own commits.
+
+## 7c. Disk: watch it, reclaim /tmp safely
+
+A night of worktrees, Swift builds and test runs fills a disk. Start `bun .claude/skills/babysit/scripts/df-watch.ts
+--below-gb 5` with Bash `run_in_background` at the start of a run: it exits (and wakes you) only when free space drops
+below the threshold. Then, and only with the user's standing permission for /tmp cleanup:
+
+1. `bun .claude/skills/babysit/scripts/tmp-reclaim.ts --run <dir>` (dry run): lists the candidates in /tmp, $TMPDIR and
+   each `/tmp/cc/<project>/<session>` folder, writes a plan file, deletes nothing. It skips live sessions (any agent
+   transcript changed in the last 12 h, the run folder, `--protect`), system and daemon entries, anything holding a
+   socket, a FIFO or a `.git`, open files (it stops if lsof gives no listing), anything changed in the last 6 h,
+   symlinks, other users' and other devices' entries.
+2. Read the list. Then `--apply --plan <file>` within 30 minutes: only the planned entries, each re-checked (same
+   inode, still old, still closed), moved into a scratch folder in the same root and deleted there. The result is a
+   `note` in the run ledger.
+
+Never delete a worktree this way (it refuses `.git` anyway): worktrees go through step 8's release. Machine caches
+outside /tmp (uv, SwiftPM, a repo's `.build`) are a separate, user-approved decision, not this script's.
+
 ## 8. Clean up after every round, automatically
 
 Do not wait to be asked. When a round's pushes and unified picks are done:
@@ -197,6 +390,19 @@ after, and the API credits when step 3.7 read them), monitoring facts (turns, to
 approvals), and what to change before the next run. Label the Claude figure an estimate: the same tokens on another
 tokenizer, without the cache writes Claude would also bill.
 
+Before every round report and before the final one, run `bun .claude/skills/babysit/scripts/audit-reviews.ts --run
+<dir> <every open PR and every PR merged in the last 24 hours>`. It lists every reviewer (bots and people), every
+open, unanswered or silently resolved thread, PR comments, findings kept in a review body ("outside diff range"), and
+everything that arrived after a merge; it exits 1 while any of those needs work. A merged PR's late finding becomes a
+follow-up commit on a branch from master, with a reply on the thread naming it. Never write "every thread answered" or
+"clean at merge" without a fresh exit 0, or a list of what is still open.
+
+A CodeRabbit thread that WE resolved without a reply is not a gap: post-replies resolves a fixed CodeRabbit thread
+silently on purpose, because a thread reply spends CodeRabbit's hourly chat budget, and the round summary comment
+carries the answer. The audit counts those apart ("resolved by us with the answer in the round summary"). Answer by
+hand only a thread the reviewer resolved itself with no answer anywhere (2026-10-14: five #515 threads were answered
+by hand for nothing).
+
 ## 10. Bugs in the harness: fix them, after the user confirms
 
 A defect in handoff-to, agents-talk, `tools codex`, `tools grok`, `tools claude worker` or `tools agents` that broke a
diff --git a/.claude/skills/babysit/references/brief-self-fetch.md b/.claude/skills/babysit/references/brief-self-fetch.md
new file mode 100644
index 0000000000..b4b42f4633
--- /dev/null
+++ b/.claude/skills/babysit/references/brief-self-fetch.md
@@ -0,0 +1,107 @@
+# Review round {{ROUND}} of PR #{{PR}}: fix the open review threads in one commit, and draft the replies
+
+You are a worker in a review loop. You fix the findings; the lead (a Claude session) judges your commit afterwards,
+reruns your checks, and pushes. Quality is judged, not speed.
+
+## Where you are
+
+- Worktree: `{{CWD}}`, detached at the head of PR #{{PR}}'s branch `{{BRANCH}}` (base `{{BASE}}`). Stay on this
+  commit: no branches, no checkout of other commits. It is a throwaway worktree; `node_modules` is installed.
+- Read `CLAUDE.md` first, then the area rule files it names for every file you touch (`.claude/rules/*.md`).
+- PR #{{PR}}: "{{TITLE}}".
+- Change every file the fix needs in this PR, including files outside the original diff and their tests. Explain
+  the added files in the reply. Apply the derived round policy below to decide which valid findings require changes.
+- Git reads that can run a configured converter take the off switches, or each one waits for the lead's approval:
+  `git diff|show|log --no-textconv --no-ext-diff …`, `git blame|grep --no-textconv …`.
+- Commit subject: `fix({{SCOPES}}): #{{PR}} followup - <what the round fixes, short>`. The commit-msg hook checks the
+  scopes; if it prints a corrected subject, commit with that.
+
+## 1. Read the open threads (read-only)
+
+- The lead fetched them for you, because a sandboxed worker has no network: `.claude/work/babysit/{{PR}}-r{{ROUND}}-threads.md`
+  (every unresolved thread, listed with its Thread ID and then expanded), `{{PR}}-r{{ROUND}}-review-bodies.md` and
+  `{{PR}}-r{{ROUND}}-pr-comments.md` in the same folder. Work from those files and do not call GitHub. Only when the
+  files are missing and your shell has network, fetch them yourself as below.
+- `tools github review {{PR}} --llm -u -s bs-{{PR}}-r{{ROUND}}` lists every unresolved thread from every reviewer
+  (eve-bot-lovinka, coderabbitai, humans). Never filter by reviewer.
+- Expand EVERY listed thread: `tools github review expand t1,t2,… -s bs-{{PR}}-r{{ROUND}}` (no PR number in this
+  form; the L1 table can name the wrong file, the expanded text is the truth). Keep each thread's Thread ID.
+- Also read review bodies and PR comments that the command prints under "PR comments" / review summaries: CodeRabbit
+  hides "outside diff range" and nitpick findings there. Treat each as a finding without a thread (no threadId).
+- {{ROUND_POLICY}}
+
+## 2. Fix
+
+1. For each finding, read the current source at the cited lines BEFORE you judge it. A finding is a claim with a
+   timestamp. One verdict per finding: `fixed`, `rejected` (cite the file:line that disproves it), `already-done`
+   (name the commit), or `no-change` (only when a cited file:line proves the finding wrong). For valid findings deferred
+   by the derived policy, use `belongs-elsewhere` (the reply schema's deferral verdict), explain the policy, and keep
+   the thread OPEN. Do not add fields the installed reply schema does not support.
+2. Fix the valid findings selected by the derived round policy at the root. Respect each module's documented contracts and its callers. Add or extend a test
+   that fails without the fix, in an existing test file next to the code. Do not create a new test file unless the
+   code has none.
+3. Verify, and keep the real output of each command. Prefix every check with `timeout 600`, and never run
+   `bun install` (the worktree is installed; its native binaries are linked to trusted copies). A check that hangs
+   with 0 CPU time is a machine problem: record it as NOT RUN with the reason, and carry on with the round.
+{{VERIFY}}
+4. Commit exactly ONCE, only your own changes, as two separate commands (never chained with `&&`):
+   `git add -- <each changed file, exact path>`, then `git commit -m "<subject>" -- <the same paths>`.
+   Never `git add -A`/`.`/`-a`; never stash, reset, restore, rebase, pull, amend, push, or touch another worktree or
+   branch. If nothing needs a change (every finding rejected or already done), do not commit; say so.
+
+## 3. Reply file (no posting)
+
+Write `{{CWD}}/.claude/work/babysit/{{PR}}-r{{ROUND}}-replies.json` (create the folder; git ignores it), one item per
+finding, including rejected ones:
+
+```json
+{
+  "pr": {{PR}},
+  "round": {{ROUND}},
+  "model": "{{MODEL_LABEL}}",
+  "intro": "Round {{ROUND}}. N open threads (eve X, CodeRabbit Y). A fixed, B rejected with evidence, C already done.",
+  "items": [
+    {
+      "ref": "t1",
+      "threadId": "<Thread ID from expand; omit only for a finding without a thread>",
+      "reviewer": "<eve-bot-lovinka | coderabbitai | login>",
+      "where": "<file>:<line>",
+      "title": "<one-line title of the defect>",
+      "context": "<what was flagged and why it matters>",
+      "verdict": "fixed",
+      "commits": ["<your commit, 9-char short SHA>"],
+      "codeBefore": { "lang": "ts", "code": "<1 to 8 lines>" },
+      "codeAfter": { "lang": "ts", "code": "<1 to 8 lines>" },
+      "howFixed": "<what the change does, and the test that proves it>",
+      "confidence": 90,
+      "reply": "<text for the thread: plain sentences, bare SHAs, never the characters ://>"
+    }
+  ]
+}
+```
+
+`fixed`/`partly-fixed` need `commits` and `howFixed`; `codeBefore`/`codeAfter` go together, only when code changed.
+Then check it renders: `bun ~/.claude/skills/review-loop/scripts/round-summary.ts <reply file> --repo {{REPO}} --out {{CWD}}/.claude/work/babysit/{{PR}}-r{{ROUND}}-summary.md`
+(exit 2 = invalid JSON: fix and render again).
+
+Post NOTHING to GitHub: no `gh pr comment`, no `gh api` writes, no `tools github review ... respond|resolve|reply`.
+
+## Stop and report
+
+- Do steps 1 to 3, then STOP with your final report. Do not start another PR.
+- A failing test, a compile error or a lint hit that your own change caused is part of the work, not a reason to
+  stop: fix it and rerun until the checks pass. Stop early only when you cannot make progress, and give the
+  concrete blocker. (On 2026-10-15 three Grok workers ended their turns at the first compile error with the fix
+  already named in their OPEN line, and each needed a second steer.)
+- A fix that needs a file outside the PR's original diff changes that file in this PR, and the reply explains why.
+  The same applies to necessary new files, dependencies and public-interface changes: update the callers and tests
+  the fix needs. Scope never excuses a required fix. Only the derived round policy permits a deferral; valid security
+  findings and findings from a dedicated user review are always fixed in this PR.
+- Do NOT spawn subagents or delegate.
+- Do NOT build, install, launch, relaunch or quit the user's apps. Never run `tools macos permissions build`,
+  `src/macos/index.ts`, `scripts/native/*` or anything else that writes `~/Applications/*.app` or restarts a running
+  app: it replaces the user's installed app with this PR's code and relaunches its windows (on 2026-10-14 a worker
+  did exactly that). Swift is checked with `swift build` and `swift test` inside the package folder only.
+- Final report, in order: the thread count you found per reviewer, one line per finding (ref, verdict, where), your
+  commit SHA with `git show --stat <sha>`, every verify command with its real exit code and the last lines of its
+  output, then the RESULT / AT / CHANGED / VERIFY / OPEN lines.
diff --git a/.claude/skills/babysit/references/brief-template.md b/.claude/skills/babysit/references/brief-template.md
index f33725ef11..ddcf7e3296 100644
--- a/.claude/skills/babysit/references/brief-template.md
+++ b/.claude/skills/babysit/references/brief-template.md
@@ -19,8 +19,11 @@ afterwards. Work carefully; quality is judged, not speed.
   - unified mode: the main checkout on `feat/<date>-enhancements-unified`. Other sessions edit and commit here at the
     same time: files you did not change are theirs. {{LATER_CHANGES_NOTE}}
 - Read `CLAUDE.md` first, then the area rules it names for the files you touch.
-- PR #{{PR}}, "{{TITLE}}", `{{BRANCH}}` into `{{BASE}}`. You may change ONLY these files:
+- PR #{{PR}}, "{{TITLE}}", `{{BRANCH}}` into `{{BASE}}`. Start with these files:
 {{SCOPE}}
+- {{ROUND_POLICY}}
+- Use the policy generated by `fill-brief.ts` (shared rule: `scripts/policy.ts`); do not invent a separate round rule.
+  Change every file a required fix needs, including files outside the original diff, and explain added files in the reply.
 - Commit subject: `{{SUBJECT}}`
 
 ## Verify
@@ -51,8 +54,10 @@ Codex variant:
 
 1. For each finding, read the current source at the cited lines BEFORE you judge it. A finding is a claim with a
    timestamp, not a fact. One verdict per finding: `fixed`, `rejected` (cite the file:line that disproves it),
-   `already-done`, or `no-change` (real, but not worth a change; say why).
-2. Fix the valid ones at the root, and respect the module's documented contracts (what a function promises to throw
+   `already-done`, or `no-change` (only when a cited file:line proves the finding wrong). A valid finding deferred
+   by the derived policy uses `belongs-elsewhere` (the reply schema's deferral verdict), an explained reply, and an
+   OPEN thread. Do not add fields the installed reply schema does not support.
+2. Fix the valid findings selected by the derived round policy at the root, and respect the module's documented contracts (what a function promises to throw
    or return) and its callers. Add or extend a test that fails without the fix, in the test files listed above. Do
    NOT create a new test file.
 3. Verify with the commands above and keep their real output.
@@ -102,8 +107,9 @@ Codex variant:
 ## Stop and report
 
 - This turn: steps 1 to 6, then STOP with your final report.
-- STOP early and report if a fix needs a file outside the list, a new file other than the reply file and summary, a
-  new dependency, or a change to a public interface other code uses.
+- If a valid fix needs another file, a new dependency or a public-interface change, include it in this PR, update
+  the affected callers and tests, and explain the added files in the reply. Scope never excuses a required fix.
+  Only the derived round policy permits deferral; security findings and dedicated user reviews are always fixed.
 - Do NOT spawn subagents or delegate to another agent.
 - Final report, in this order: the rendered summary, each thread's ready-to-post reply (ref, then text), your commit
   SHA with `git show --stat <sha>`, every verify command with its real output, then the RESULT / AT / CHANGED /
diff --git a/.claude/skills/babysit/references/integrate.md b/.claude/skills/babysit/references/integrate.md
index ff341d4f8f..b2114b639e 100644
--- a/.claude/skills/babysit/references/integrate.md
+++ b/.claude/skills/babysit/references/integrate.md
@@ -26,9 +26,25 @@ bash scripts/ci/placeholder-check.sh
 git push origin HEAD:refs/heads/<pr-branch>        # a rejected push: fetch, rebase onto origin/<pr-branch>, re-gate
 ```
 
-Then in the main checkout (unified branch): `git cherry-pick <worker sha> <correction sha>`, exact paths only if a
-conflict needs hand-editing. A version-only conflict in `.claude-plugin/marketplace.json` or
-`plugins/genesis-tools/.claude-plugin/plugin.json` keeps the higher version.
+The hooks are the gates (Biome, tsgo, the subject rules, the personal-data probe): workers commit and the lead pushes
+WITH them. The one exception is a stuck syspolicyd (one core at 100%), when the first launch of any new executable
+hangs: a hook copy, a worktree's own `biome`, a fresh Swift test bundle. Prove it first with a brand-new two-line
+`#!/bin/sh` script that does not return (`newExecutablesStall()` in `versions.ts` does exactly that). Only then: run
+Biome from the main checkout's `node_modules/.bin/biome` on the worktree files, authorize the worker's commit with
+`git -c hook.pre-commit.enabled=false -c hook.commit-msg.enabled=false commit`, check its subject with
+`check-commits.ts`, and push with `integrate.ts … --no-push-hooks`. The scripts honour that flag only while the probe
+still stalls, so the switch ends by itself when syspolicyd recovers. Swift tests wait: record them as NOT RUN, but
+`bun .claude/skills/babysit/scripts/swift-typecheck.ts --package <dir>` still proves the Swift code compiles (every
+target through `swiftc` alone, no binary launched; GenesisKit takes about two minutes). Use it also when another
+session holds the one Swift build slot. Hooks set in config ignore `core.hooksPath`: a by-hand replay (rebase,
+cherry-pick, worktree add, which run no gate hook) uses `-c hook.<event>.enabled=false` per event, as `HOOKS_OFF` does.
+
+Then in the main checkout (unified branch):
+`bun .claude/skills/babysit/scripts/pick-unified.ts --branch <unified> <worker sha> <correction sha>`. It skips a
+commit already there, resolves a version-only conflict in `.claude-plugin/marketplace.json` or
+`plugins/genesis-tools/.claude-plugin/plugin.json` to the higher version, and aborts and lists any other conflict.
+Give the listed ones to a free worker in a scratch worktree detached at the unified head (resolve keeping both sides,
+`cherry-pick -x` each), check its tests and Biome, then fast-forward unified to it if unified has not moved.
 
 ## Unified mode
 
@@ -47,6 +63,11 @@ resolved it: it goes into the report (#511's import line, 2026-10-14).
 
 ## After the push
 
+The worker's scope and reply disposition come from `scripts/policy.ts`, as rendered by `fill-brief.ts`.
+A deferred ordinary later-round Medium/Low item carries the supported reply verdict `"belongs-elsewhere"` and
+an explanation of the policy deferral: it stays in the summary, but `integrate.ts` posts it in a separate `--no-resolve` batch.
+Only acted-on items enter the resolving batch. Security findings and dedicated user reviews are always fixed.
+
 - `git log --oneline origin/<pr-branch>..HEAD` must be empty, and the push line names the old and new head.
 - Fetch new threads before you post anything (review-loop: `new-threads.ts`), because the bots answer the push.
 - The vault copy of the reply file names the PR-branch SHAs; render the summary with `--range <old>..<new>
diff --git a/.claude/skills/babysit/references/judging.md b/.claude/skills/babysit/references/judging.md
index 43bcac355d..4e7594bc33 100644
--- a/.claude/skills/babysit/references/judging.md
+++ b/.claude/skills/babysit/references/judging.md
@@ -3,6 +3,13 @@
 The stance is fable-judge's: a report is a set of claims, not evidence. Judge every commit as if a stranger wrote
 it, and give the verdict with the evidence. Inline, never delegated: the verdict is the product of this loop.
 
+🛑 **Rule: invoke the `fable-judge` skill and read the whole thing before every push** (Martin, 2026-10-14). Checks
+and planted regressions alone are not a judgement: on the first overnight run four commits (one of 807 lines) went
+out with green checks and plants but no line-by-line read. The judge reads, side by side, the worker's summary
+report, its reply file (every verdict and every reply text it wants posted) and the FULL diff, tests and sources:
+`judge-pack` prints all three in one file. Then it judges the code itself (repo rules in `.claude/rules/code.md` and
+`tools.md`, contracts, duplication, type safety, scope), the claims against the code, and every refusal.
+
 ## Checklist, in order
 
 1. **The diff is the truth.** `git show --stat <sha>` and the full diff. One commit, only scope files, nothing staged
@@ -10,10 +17,24 @@ it, and give the verdict with the evidence. Inline, never delegated: the verdict
 2. **Rerun every check the worker claims**, in your own shell: the brief's test command, `bunx tsgo --noEmit`, Biome
    on the changed files, Swift tests when Swift changed. A worker's sandbox can fail where yours passes (Sol's
    loopback tests) and the other way round; your run is the one that counts. Compare counts with the report.
-3. **Planted regression for every new or changed test.** Put the pre-fix version of the fixed source back (copy the
-   fixed file aside first, `git show <base>:<path> > <path>`, run the test, copy the fixed file back; the shell guard
-   blocks `git checkout --` for this). A test that still passes proves nothing. Do it in the PR worktree, never in the
-   shared main checkout.
+   - The worker's own tests are not the regression check. Also run every test class that exercises the changed
+     source files (`rg -l <TypeName> Tests/`), or the whole package (`swift test --filter GenesisKitTests` matches
+     every class in the module), and compare any failure against the base head before blaming either side. On
+     2026-10-14 #510's round 2 passed its Clicky and Flow filters, yet it broke the master test
+     `FlowFocusRuntimeTests.testForwardedWritesFailBeforeAcknowledgementAndConfigurationRollsBack`, which the full
+     module run found a round later.
+3. **Planted regression for every new or changed test.** Put the pre-fix version of the fixed source back and run the
+   test: `bun .claude/skills/babysit/scripts/plant.ts --wt <worktree> --file <path>… --test "<test paths>"` (Swift:
+   `--swift-package src/macos/GenesisKit --swift-filter <Class/test>`). It backs up first, restores in a `finally`,
+   proves the worktree unchanged, and exits 0 only when the planted run fails and the fixed run passes. A test that
+   still passes proves nothing. Do it in the PR worktree, never in the shared main checkout. Do not hand-write the
+   loop: on 2026-10-14 two shell versions failed silently (an unsplit zsh variable, a `shift` that broke the backups)
+   and one left the pre-fix code in two worktrees.
+   - A plant that stops the COMPILE proves only that the test calls the new code, not that it catches the fault. Plant
+     a behaviour fault instead (flip the fail-closed branch, drop the check) and see the assertion fail.
+   - Run the new test by its own name (`swift test --filter <Class>/<testName>`, `bun scripts/test.ts <file> -t
+     <name>`), never by the file name: on 2026-10-14 `--filter SnapshotDispatchTests` ran 30 tests from that class
+     and skipped the new test in `CursorFeedbackTests` in the same file, so a fail-open plant "passed".
 4. **Contracts and callers.** Read the module's doc comments for what a function promises (errors it throws, values
    it returns) and grep its callers. On 2026-10-14 Sol's fix threw a raw error from a function documented to throw
    only `CdpLaunchError`; `browse.ts` rethrew anything else, so a user would have seen a stack trace. The tests were
@@ -26,6 +47,26 @@ it, and give the verdict with the evidence. Inline, never delegated: the verdict
 7. **The ready-to-post replies.** Each reply must be true of the final code after your correction: file names,
    counts, behaviour. Grok's said "the table is in prs.test.ts" after the move; such a line is corrected in the vault
    copy, not posted as is.
+   - **Every refusal and deferral is judged against the derived round policy in `scripts/policy.ts`.** A valid
+     security finding or a dedicated user review is always fixed in full. Other Medium/Low findings in ordinary
+     later rounds receive replies and stay OPEN; verify their policy explanation and the no-resolve posting batch.
+     A deferral permitted by that policy is accepted. A `rejected` needs the file:line that disproves the
+     finding. For a finding the derived policy requires fixing, a `no-change` or "follow-up" whose fix belongs in this PR (it is small, it is about this PR's change,
+     or it is not code at all, like a wrong PR description) is not accepted: do it in this round. On 2026-10-14 a
+     worker answered "the PR description calls login-io.ts a new file" with no-change; the fix was a one-line body
+     edit.
+   - **Removed test lines are guilty until explained.** List them (`judge-pack` puts the test diff first); a deleted
+     or loosened assertion must be replaced by a stronger one, or it is a weakened check.
+9. **A spy on the logger must read what the logger writes.** `SafeJSON.stringify(spy.mock.calls)` turns an `Error`
+   argument into `{}`, so a "the secret is not logged" test passes on the leaking code (2026-10-14, the Grok auth
+   reader logged `{ err }`; the first test was green before the fix). Map each argument the way pino does (an Error's
+   message, an object's values) before asserting, and plant the old line to prove the test fails.
+10. **A plant must remove the whole fix.** When a fix has two parts (a ticket bump AND a guard), planting only one can
+   pass because the other still covers it. That proves the test tests the part you left, not that it is weak: plant
+   the other part too before you call a test useless (#501 round 1).
+11. **Plants run the tests the commit changed.** Plant each fixed source and run the test files the worker's commit
+   touched (`git show --stat`), not the source's folder: on 2026-10-14 two plants "passed" only because the folder
+   held none of the new tests.
 8. **Cherry-pickability** (unified mode): test-pick onto the PR branch before you correct, so the correction can avoid
    the conflicting lines.
 
diff --git a/.claude/skills/babysit/scripts/approve-codex.ts b/.claude/skills/babysit/scripts/approve-codex.ts
index 9becdbeaab..f434eaa34b 100644
--- a/.claude/skills/babysit/scripts/approve-codex.ts
+++ b/.claude/skills/babysit/scripts/approve-codex.ts
@@ -9,14 +9,18 @@
  * subject, exact configured verification commands, and creation of the babysit scratch folder.
  * Configure the full round-summary command as a verify entry when it should be approved. Everything else waits:
  * chaining, redirection, expansion, sandbox escalations (their request shows the reason, not the command), rituals.
+ * One exception to the chaining rule: a chain (`;`, `&&`, `||`, `|`) whose every command only reads (`readOnlyChain`):
+ * an independent reviewer asked the lead for 4 such chains in its first 2 minutes (2026-10-15, GenesisPlayground #93).
  *
  * Usage: bun .claude/skills/babysit/scripts/approve-codex.ts --run <run.json> --name <codex session>
  */
-import { readFileSync } from "node:fs";
-import { isAbsolute, relative, resolve, sep } from "node:path";
+import { lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { strictShellWords } from "@app/codex/lib/bus-approval";
 import { execTool } from "@genesiscz/utils/cli";
 import { SafeJSON } from "@genesiscz/utils/json";
+import { reviewScratch } from "./run";
 
 export interface RunEntry {
     name: string;
@@ -24,6 +28,10 @@ export interface RunEntry {
     scope: string[];
     subject: string;
     verify: string[];
+    role?: string;
+    pr?: number;
+    /** A second scratch folder outside the worktree: a reviewer's probe folder, which its brief names. */
+    scratch?: string;
 }
 
 const inScope = (entry: RunEntry, path: string) => {
@@ -39,15 +47,627 @@ const inScope = (entry: RunEntry, path: string) => {
     return entry.scope.some((allowed) => target === resolve(root, allowed)) || target.startsWith(scratch + sep);
 };
 
-/** Unwrap only an exactly parsed invocation of a known system shell. */
+/** Follow existing targets, or resolve the nearest existing parent before an editor creates missing directories. */
+function canonicalWriteTarget(target: string): string {
+    let ancestor = target;
+    const suffix: string[] = [];
+    for (;;) {
+        try {
+            // Unlike existsSync, lstat sees dangling symlinks: realpath must then fail, never treat one as a new file.
+            lstatSync(ancestor);
+        } catch (error) {
+            const parent = dirname(ancestor);
+            if (!(error instanceof Error && "code" in error && error.code === "ENOENT") || parent === ancestor) {
+                throw error;
+            }
+            suffix.unshift(basename(ancestor));
+            ancestor = parent;
+            continue;
+        }
+        const canonical = realpathSync(ancestor);
+        if (suffix.length > 0 && !statSync(ancestor).isDirectory()) {
+            throw new Error("write parent is not a directory");
+        }
+        return join(canonical, ...suffix);
+    }
+}
+
+/** Resolve the final command's log destination after its preceding directory changes. */
+const inScratch = (entry: RunEntry, command: string, path: string) => {
+    const segments = chainSegments(command);
+    if (!segments?.length) {
+        return false;
+    }
+
+    const cwd = segments.length === 1 ? entry.cwd : readOnlyCwd(entry, segments.slice(0, -1).join(" && "));
+    if (!cwd || (segments.length > 1 && /[;|\n]/.test(command))) {
+        return false;
+    }
+
+    try {
+        const target = isAbsolute(path) ? path : `${cwd}/${path}`;
+        // Shell redirection cannot create directories; preserve that stricter prerequisite.
+        realpathSync(dirname(target));
+        const canonical = canonicalWriteTarget(target);
+        try {
+            if (lstatSync(target).isSymbolicLink() || !statSync(target).isFile()) {
+                return false;
+            }
+        } catch (error) {
+            if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) {
+                return false;
+            }
+        }
+
+        const scratch = join(realpathSync(entry.cwd), ".claude/work/babysit");
+        const roots = [scratch, ...(entry.scratch ? [realpathSync(entry.scratch)] : [])];
+        return roots.some((allowed) => canonical.startsWith(allowed + sep));
+    } catch {
+        // Missing or unreadable destination directories cannot be approved.
+        return false;
+    }
+};
+
+const SHELLS = ["/bin/sh", "/bin/bash", "/bin/zsh", "/usr/bin/sh", "/usr/bin/bash", "/usr/bin/zsh"];
+
+/**
+ * Unwrap only an exactly parsed invocation of a known system shell. Codex wraps a command that holds a single quote in
+ * double quotes with backslash escapes (`/bin/zsh -lc "sed -n '1,9p' a; rg '\\.md' b"`), which the strict parser
+ * refuses; that form is unwrapped when nothing in it expands (no unescaped `$` or backquote), so its reads chain
+ * through `readOnlyChain` instead of waking the lead (2026-10-15: 4 of 6 reviewer requests in one minute).
+ */
 export function innerCommand(command: string): string {
     const words = strictShellWords(command);
-    const shells = ["/bin/sh", "/bin/bash", "/bin/zsh", "/usr/bin/sh", "/usr/bin/bash", "/usr/bin/zsh"];
-    return words?.length === 3 && shells.includes(words[0]) && ["-c", "-lc"].includes(words[1]) ? words[2] : command;
+
+    if (words?.length === 3 && SHELLS.includes(words[0]) && ["-c", "-lc"].includes(words[1])) {
+        return words[2];
+    }
+
+    const quoted = /^(\S+) (-c|-lc) "([\s\S]*)"$/.exec(command);
+
+    if (!quoted || !SHELLS.includes(quoted[1])) {
+        return command;
+    }
+
+    let inner = "";
+
+    for (let index = 0; index < quoted[3].length; index++) {
+        const char = quoted[3][index];
+
+        if (char === "\\" && index + 1 < quoted[3].length && '\\"$`'.includes(quoted[3][index + 1])) {
+            inner += quoted[3][index + 1];
+            index++;
+            continue;
+        }
+
+        if (char === "$" || char === "`" || char === '"') {
+            return command;
+        }
+
+        inner += char;
+    }
+
+    return inner;
+}
+
+/** Closed long-option sets also refuse getopt's abbreviated executable options. */
+const longOptionsAllowed = (args: string[], allowed: string) => {
+    const names = new Set(allowed.split(" "));
+    // Check even after --: a preceding value-taking flag may consume it instead of ending option parsing.
+    return args.every((arg) => arg === "--" || !arg.startsWith("--") || names.has(arg.split("=", 1)[0]));
+};
+
+/** Each program a reader may run in a chain, with a check of its arguments: it reads, writes nothing, runs no code. */
+const READERS: Record<string, (args: string[]) => boolean> = {
+    pwd: () => true,
+    ls: () => true,
+    cat: () => true,
+    head: () => true,
+    tail: (args) => !args.some((arg) => /^-[a-zA-Z]*[fF]/.test(arg) || arg === "--follow"),
+    wc: () => true,
+    nl: () => true,
+    cut: () => true,
+    tr: () => true,
+    // -z/-Z run decompressors; -C writes a magic database. Long options are closed against abbreviations.
+    file: (args) =>
+        !args.some((arg) => /^-[^-]*[zZC]/.test(arg)) &&
+        longOptionsAllowed(
+            args,
+            "--brief --mime --mime-type --mime-encoding --keep-going --dereference --no-dereference --separator --files-from --magic-file --exclude --exclude-quiet --no-pad --raw --special-files --help --version"
+        ),
+    // zsh stat -A/-H stores results in shell arrays/hashes, which can change later command resolution.
+    stat: (args) => !args.some((arg) => /^-[^-]*[AH]/.test(arg)),
+    basename: () => true,
+    dirname: () => true,
+    realpath: () => true,
+    echo: () => true,
+    // Shell printf -v assigns a variable; %n conversions also assign through a format operand.
+    printf: (args) => {
+        const format = args[0] === "--" ? args[1] : args[0];
+        return (
+            format !== undefined &&
+            !format.startsWith("-") &&
+            !/%(?:\d+\$)?[-+ #0']*(?:\d+|\*)?(?:\.(?:\d+|\*))?[hlLjzt]*n/.test(format)
+        );
+    },
+    true: () => true,
+    test: () => true,
+    diff: () => true,
+    jq: () => true,
+    grep: () => true,
+    uniq: uniqReader,
+    // Unknown long options require the lead, including --compress-program and every accepted abbreviation.
+    sort: (args) =>
+        !args.some((arg) => /^-[^-]*o/.test(arg)) &&
+        longOptionsAllowed(
+            args,
+            "--ignore-leading-blanks --dictionary-order --ignore-case --general-numeric-sort --ignore-nonprinting --month-sort --human-numeric-sort --numeric-sort --random-sort --random-source --reverse --sort --version-sort --check --merge --key --stable --unique --field-separator --zero-terminated --buffer-size --temporary-directory --parallel --batch-size --files0-from --debug --help --version"
+        ),
+    rg: (args) =>
+        !args.some(
+            (arg) => /^--(?:pre|hostname-bin)(?:=|$)/.test(arg) || arg === "--search-zip" || /^-[^-]*z/.test(arg)
+        ),
+    find: (args) =>
+        !args.some((arg) =>
+            ["-exec", "-execdir", "-ok", "-okdir", "-delete", "-fprint", "-fprint0", "-fprintf", "-fls"].includes(arg)
+        ),
+    // Only `sed -n <range>p <files>`: a second script (`-e 'w <file>'`, `-f`, `-i`) could write, and passed before
+    // (found by a Sol reviewer of #536 on 2026-10-16, which proved a file written through an approved "read").
+    sed: (args) =>
+        args[0] === "-n" &&
+        args.length >= 2 &&
+        /^(\d+|\$)(,(\d+|\$))?p$/.test(args[1]) &&
+        args.slice(2).every((arg) => !arg.startsWith("-")),
+    git: (args) =>
+        [
+            "diff",
+            "log",
+            "show",
+            "status",
+            "rev-parse",
+            "ls-files",
+            "ls-tree",
+            "blame",
+            "merge-base",
+            "cat-file",
+            "grep",
+            "shortlog",
+            "describe",
+        ].includes(args[0] ?? "") &&
+        (args[0] !== "cat-file" ||
+            longOptionsAllowed(
+                args.slice(1),
+                "--batch --batch-check --batch-command --buffer --follow-symlinks --unordered --allow-unknown-type --use-mailmap --no-use-mailmap --help"
+            )) &&
+        (!["diff", "show", "log", "blame", "grep"].includes(args[0]) ||
+            args.slice(1, args.indexOf("--") < 0 ? undefined : args.indexOf("--")).includes("--no-textconv")) &&
+        (!["diff", "show", "log"].includes(args[0]) ||
+            args.slice(1, args.indexOf("--") < 0 ? undefined : args.indexOf("--")).includes("--no-ext-diff")) &&
+        !args.some(
+            (arg) =>
+                // Git accepts unique long-option prefixes, which can re-enable execution after the no-* flags.
+                (arg.startsWith("--") &&
+                    arg.length > 2 &&
+                    ["--output", "--ext-diff", "--textconv", "--open-files-in-pager"].some((option) =>
+                        option.startsWith(arg.split("=", 1)[0])
+                    )) ||
+                // `-O<cmd>` attached runs the command as git grep's pager (a #536 reviewer's probe, 2026-10-16).
+                arg.startsWith("-O")
+        ),
+    gh: (args) =>
+        (args[0] === "pr" &&
+            ["view", "diff", "checks", "list"].includes(args[1] ?? "") &&
+            !args.some((arg) => /^--web(?:=|$)/.test(arg) || /^-[^-]*w/.test(arg))) ||
+        (args[0] === "api" &&
+            !args.some((arg) => /^(-X|--method|-f|-F|--field|--raw-field|--input|--cache)/.test(arg))),
+    tools: toolsReader,
+    "./tools": toolsReader,
+};
+
+/** Parse the portable option prefix; after the first operand (or --), even dash words are operands. */
+function uniqReader(args: string[]): boolean {
+    let operands = 0;
+    let options = true;
+    const numbers = new Set(["--skip-fields", "--skip-chars", "--check-chars"]);
+    const switches = new Set([
+        "--count",
+        "--repeated",
+        "--unique",
+        "--ignore-case",
+        "--zero-terminated",
+        "--help",
+        "--version",
+    ]);
+    for (let index = 0; index < args.length; index++) {
+        const arg = args[index];
+        if (options && arg === "--") {
+            options = false;
+            continue;
+        }
+
+        if (options && arg.startsWith("--")) {
+            const [name, inline] = arg.split(/=(.*)/s, 2);
+            if (numbers.has(name)) {
+                if (!/^\d+$/.test(inline ?? args[++index] ?? "")) {
+                    return false;
+                }
+            } else if (name === "--all-repeated" || name === "--group") {
+                const methods =
+                    name === "--group" ? ["separate", "prepend", "append", "both"] : ["none", "prepend", "separate"];
+                if (inline !== undefined && !methods.includes(inline)) {
+                    return false;
+                }
+            } else if (!switches.has(name) || inline !== undefined) {
+                return false;
+            }
+            continue;
+        }
+
+        if (options && arg.startsWith("-") && arg !== "-") {
+            for (let offset = 1; offset < arg.length; offset++) {
+                const option = arg[offset];
+                if ("fsw".includes(option)) {
+                    if (!/^\d+$/.test(arg.slice(offset + 1) || args[++index] || "")) {
+                        return false;
+                    }
+                    break;
+                }
+                if (!"cdiuzD".includes(option)) {
+                    return false;
+                }
+            }
+            continue;
+        }
+
+        // BSD uniq stops parsing options at its first operand; assuming GNU permutation could approve an output file.
+        options = false;
+        if (++operands > 1) {
+            return false;
+        }
+    }
+    return true;
+}
+
+/** Named review reads and their complete flag grammar; every other operation asks the lead. */
+function toolsReader(args: string[]): boolean {
+    if (args[0] === "ts") {
+        return (
+            ["skeleton", "duplicates", "refactors"].includes(args[1] ?? "") &&
+            !args.some((arg) => arg === "--recommend" || arg.startsWith("--recommend="))
+        );
+    }
+
+    if (args[0] !== "github" || args[1] !== "review") {
+        return false;
+    }
+
+    const [operation, ...rest] = args.slice(2);
+    if (operation === "sessions") {
+        return rest.length === 0;
+    }
+
+    const values = new Set(["-s", "--session"]);
+    const switches = new Set<string>();
+    if (operation === "expand") {
+        if (!/^t\d+(?:,t\d+)*$/.test(rest.shift() ?? "")) {
+            return false;
+        }
+        values.add("--repo");
+    } else if (operation !== "summary") {
+        if (!/^\d+$/.test(operation ?? "")) {
+            return false;
+        }
+        for (const value of ["--repo", "-a", "--author"]) {
+            values.add(value);
+        }
+        for (const option of [
+            "-u",
+            "--unresolved-only",
+            "-g",
+            "--group-by-file",
+            "-j",
+            "--json",
+            "--llm",
+            "-v",
+            "--verbose",
+            "--no-pr-comments",
+        ]) {
+            switches.add(option);
+        }
+    }
+
+    for (let index = 0; index < rest.length; index++) {
+        const [option, inline] = rest[index].split(/=(.*)/s, 2);
+        if (switches.has(option) && inline === undefined) {
+            continue;
+        }
+
+        if (!values.has(option)) {
+            return false;
+        }
+
+        const value = inline ?? rest[++index];
+        if (!value || value.startsWith("-")) {
+            return false;
+        }
+    }
+
+    return true;
+}
+
+/**
+ * Splits a chain on unquoted `;`, `&&`, `||`, `|` and newlines. Null when it holds anything else that is not a plain
+ * word: a redirection, a background `&`, a command substitution or a variable (each can write, or run code).
+ */
+export function chainSegments(command: string): string[] | null {
+    const segments: string[] = [];
+    let current = "";
+    let quote: "'" | '"' | null = null;
+
+    for (let index = 0; index < command.length; index++) {
+        const char = command[index];
+
+        if (quote) {
+            current += char;
+
+            if (char === quote) {
+                quote = null;
+            }
+
+            continue;
+        }
+
+        if (char === "'" || char === '"') {
+            quote = char;
+            current += char;
+            continue;
+        }
+
+        const pair = command.slice(index, index + 2);
+
+        if (pair === "&&" || pair === "||") {
+            segments.push(current);
+            current = "";
+            index++;
+            continue;
+        }
+
+        if (char === ";" || char === "|" || char === "\n") {
+            segments.push(current);
+            current = "";
+            continue;
+        }
+
+        if (char === "&" || char === ">" || char === "<" || char === "`" || char === "$") {
+            return null;
+        }
+
+        current += char;
+    }
+
+    if (quote) {
+        return null;
+    }
+
+    segments.push(current);
+    return segments.map((segment) => segment.trim()).filter((segment) => segment.length > 0);
+}
+
+const SHELL_KEYWORDS = new Set(["if", "then", "else", "elif"]);
+
+/** A chain of commands that only read: each one a known reader with arguments it cannot write or execute with. */
+export function readOnlyChain(entry: RunEntry, command: string): boolean {
+    return readOnlyCwd(entry, command) !== null;
+}
+
+function readOnlyCwd(entry: RunEntry, command: string): string | null {
+    const segments = chainSegments(command);
+
+    if (!segments || segments.length === 0) {
+        return null;
+    }
+
+    let cwd = entry.cwd;
+    let logicalCwd = entry.cwd;
+    const accepted = segments.every((segment) => {
+        // `test ! -f X || cat X` opens every worker's first command; the negation reads nothing, but the strict
+        // parser refuses a bare `!`, so it is dropped before parsing (only right after `test`).
+        const parsed = strictShellWords(segment.replace(/^test ! /, "test "));
+
+        if (!parsed || parsed.length === 0) {
+            return false;
+        }
+
+        // `if test -f X; then cat X; fi` splits into `if test …`, `then cat …` and `fi`: the keywords run nothing
+        // themselves, so the reader after each one decides (a Sol reviewer's first command, 2026-10-15).
+        if (parsed[0] === "fi") {
+            return parsed.length === 1;
+        }
+
+        const words = SHELL_KEYWORDS.has(parsed[0]) ? parsed.slice(1) : parsed;
+
+        if (words.length === 0) {
+            return false;
+        }
+
+        if (words[0] === "cd") {
+            if (
+                words.length !== 2 ||
+                /[;|\n]/.test(command) ||
+                segments.some((part) => /^(if|then|else|elif)\b/.test(part))
+            ) {
+                return false;
+            }
+
+            try {
+                const logicalTarget = resolve(logicalCwd, words[1]);
+                const target = realpathSync(logicalTarget);
+                const root = realpathSync(entry.cwd);
+                if (!statSync(target).isDirectory() || !(target + sep).startsWith(root + sep)) {
+                    return false;
+                }
+                cwd = target;
+                logicalCwd = logicalTarget;
+                return true;
+            } catch {
+                return false;
+            }
+        }
+
+        if (words[0].includes("/")) {
+            try {
+                const executable = realpathSync(isAbsolute(words[0]) ? words[0] : `${cwd}/${words[0]}`);
+                const trusted = realpathSync(resolve(import.meta.dir, "../../../../tools"));
+                return executable === trusted && toolsReader(words.slice(1));
+            } catch {
+                return false;
+            }
+        }
+
+        const check = READERS[words[0]];
+        return check !== undefined && check(words.slice(1));
+    });
+    return accepted ? cwd : null;
+}
+
+/**
+ * The briefs' own test command, `timeout <seconds> bun scripts/test.ts <test files>`: every file a `.test.ts(x)` path
+ * inside the worktree. A reviewer runs it once per area, and each one woke the lead (2026-10-16: 6 of the first 15
+ * NEEDS LEAD lines of five Sol reviewers). It runs inside the worker's sandbox like any other approved command.
+ */
+export function testRunCommand(entry: RunEntry, words: string[]): boolean {
+    const rest = words[0] === "timeout" && /^\d+$/.test(words[1] ?? "") ? words.slice(2) : words;
+
+    if (rest[0] !== "bun" || rest[1] !== "scripts/test.ts" || rest.length < 3) {
+        return false;
+    }
+
+    const root = resolve(entry.cwd);
+    return rest.slice(2).every((path) => {
+        const local = relative(root, resolve(root, path));
+        return /\.test\.tsx?$/.test(path) && !isAbsolute(local) && !local.startsWith("..") && !/[*?[\]]/.test(path);
+    });
+}
+
+const MAIN_CLI = (() => {
+    const common = Bun.spawnSync(
+        [
+            "git",
+            "-C",
+            resolve(import.meta.dir, "../../../.."),
+            "rev-parse",
+            "--path-format=absolute",
+            "--git-common-dir",
+        ],
+        { stdout: "pipe", stderr: "pipe" }
+    );
+    return common.exitCode === 0
+        ? resolve(dirname(common.stdout.toString().trim()), "plugins/genesis-tools/skills/fable-replace/scripts/cli.ts")
+        : null;
+})();
+const CACHE_ROOT = join(homedir(), ".codex/plugins/cache/genesis-tools/genesis-tools");
+const FABLE_ENV = new Set(["GENESIS_TOOLS_HOME", "TMPDIR", "FABLE_REPLACE_HOME"]);
+
+/** Compare canonical paths, never a worker-controlled suffix. Temp paths stay untrusted even through symlinks. */
+function trustedFableCli(entry: RunEntry, path: string): boolean {
+    const candidate = resolve(entry.cwd, path);
+    const forbidden = (value: string) =>
+        /^\/(?:private\/)?tmp(?:\/|$)/.test(value) || /\/\.claude\/work(?:\/|$)/.test(value);
+    if (forbidden(candidate)) {
+        return false;
+    }
+
+    try {
+        const canonical = realpathSync(candidate);
+        if (forbidden(canonical)) {
+            return false;
+        }
+
+        if (MAIN_CLI && canonical === realpathSync(MAIN_CLI)) {
+            return true;
+        }
+
+        const cache = realpathSync(CACHE_ROOT);
+        const local = relative(cache, canonical);
+        return /^\d+(?:\.\d+)*\/skills\/fable-replace\/scripts\/cli\.ts$/.test(local);
+    } catch {
+        // Missing or unreadable tools cannot be trusted.
+        return false;
+    }
+}
+
+/** Only literal invocations of the trusted editor, with one closed quoted heredoc and scoped edits. */
+export function fableReplaceCommand(entry: RunEntry, command: string): boolean {
+    const match = /^([^\n]+) <<'([A-Za-z0-9_]+)'\n([\s\S]*)\n\2\n?$/.exec(command);
+    if (!match || match[3].split("\n").includes(match[2]) || match[3].trimStart().startsWith("[")) {
+        return false;
+    }
+
+    const prefix = strictShellWords(match[1]);
+    if (!prefix || prefix.length < 2 || prefix[prefix.length - 2] !== "bun") {
+        return false;
+    }
+
+    const cli = prefix.at(-1) ?? "";
+    if (!trustedFableCli(entry, cli)) {
+        return false;
+    }
+
+    const envOk = prefix.slice(0, -2).every((pair) => {
+        const equals = pair.indexOf("=");
+        const [key, value] = [pair.slice(0, equals), pair.slice(equals + 1)];
+        return (
+            equals > 0 && FABLE_ENV.has(key) && /^\/(private\/)?tmp\/cc\/[\w./-]+$/.test(value) && !value.includes("..")
+        );
+    });
+    const lines = match[3].split("\n");
+    // Moves can also rewrite importers. All such operations require the lead, even with a scoped destination.
+    if (lines.some((line) => line.startsWith("<<<") && /(?:^|\s)(?:move|to=|imports=|renameTo=)/.test(line.slice(3)))) {
+        return false;
+    }
+
+    const targets = lines.filter((line) => line.startsWith("@@")).map((line) => line.slice(2).trim());
+    return (
+        envOk &&
+        targets.length > 0 &&
+        targets.every((path) => {
+            if (/[\x60$]/.test(path) || !inScope(entry, path)) {
+                return false;
+            }
+            try {
+                const canonical = canonicalWriteTarget(resolve(entry.cwd, path));
+                // Project the physical target back onto the logical root so /tmp aliases and scoped absolute paths
+                // keep their meaning, without trusting a symlink's destination as a new allowed root.
+                return inScope(entry, relative(realpathSync(entry.cwd), canonical));
+            } catch {
+                // Dangling links, loops, unreadable paths and non-directory parents cannot be approved.
+                return false;
+            }
+        })
+    );
 }
 
 /** Whether a command approval is one the brief allows. Pure, so it can be replayed on a past session's requests. */
 export function allowedCommand(entry: RunEntry, command: string): boolean {
+    if (readOnlyChain(entry, command) || fableReplaceCommand(entry, command)) {
+        return true;
+    }
+
+    // A check whose output goes to the scratch folder (`<check> > .claude/work/babysit/x.log 2>&1`), or that runs
+    // under `timeout <s>`, is the same check: the fixers write every verify log there (2026-10-16, #537 round 1).
+    const logged = /^(.*\S)\s+>\s*(.+?)\s+2>&1$/.exec(command);
+    const destination = logged ? strictShellWords(logged[2]) : null;
+
+    if (logged && destination?.length === 1 && inScratch(entry, logged[1], destination[0]) && !/[<>]/.test(logged[1])) {
+        return allowedCommand(entry, logged[1]);
+    }
+
+    const timed = /^timeout \d+ (.+)$/s.exec(command);
+
+    if (timed && !timed[1].startsWith("timeout ") && allowedCommand(entry, timed[1])) {
+        return true;
+    }
+
     const words = strictShellWords(command);
 
     if (!words || words.length === 0) {
@@ -67,10 +687,26 @@ export function allowedCommand(entry: RunEntry, command: string): boolean {
         );
     }
 
-    if (words.length === 3 && words[0] === "mkdir" && words[1] === "-p" && words[2] === ".claude/work/babysit") {
+    // The babysit scratch folder, relative or as its absolute path (reviewers write the absolute one from the brief).
+    if (
+        words.length === 3 &&
+        words[0] === "mkdir" &&
+        words[1] === "-p" &&
+        resolve(entry.cwd, words[2]) === resolve(entry.cwd, ".claude/work/babysit")
+    ) {
+        return true;
+    }
+
+    if (testRunCommand(entry, words)) {
         return true;
     }
 
+    // Biome on files of the scope, with or without --write (the brief's format step).
+    if (words[0] === "bunx" && words[1] === "biome" && words[2] === "check") {
+        const rest = words.slice(3).filter((word) => word !== "--write");
+        return rest.length > 0 && rest.every((path) => !path.startsWith("-") && inScope(entry, path));
+    }
+
     return entry.verify.some((verify) => {
         const allowed = strictShellWords(verify);
         return allowed?.length === words.length && allowed.every((word, index) => word === words[index]);
@@ -111,6 +747,8 @@ export function decide(entry: RunEntry, request: ApprovalRequest): { ok: boolean
     return { ok: isCommand && sameCwd && command !== null && allowedCommand(entry, command), label: detail };
 }
 
+const STATUS_FAILURE_LIMIT = 10;
+
 export async function watchApprovals({
     entry,
     exec = execTool,
@@ -129,6 +767,9 @@ export async function watchApprovals({
     const seen = new Set<string>();
     const failures = new Map<string, number>();
     const deadline = now() + timeoutMs;
+    // After a worker's turn ended, `codex status` failed with empty stderr on every poll until the deadline (2026-10-14
+    // #516 round 4): say what failed, and hand over to the lead instead of printing it every 1.5 s for 30 minutes.
+    let statusFailures = 0;
     const options = () => ({ cwd: entry.cwd, timeout: Math.max(1, Math.min(30_000, deadline - now())) });
     while (now() < deadline) {
         const status = await exec(["codex", "status", "--name", entry.name, "--json"], options());
@@ -136,13 +777,25 @@ export async function watchApprovals({
         try {
             if (status.success && !status.timedOut) {
                 meta = SafeJSON.parse(status.stdout, { strict: true });
+                statusFailures = 0;
             } else {
-                console.error("[approver] status failed: " + status.stderr);
+                statusFailures += 1;
+                const said = (status.stderr.trim() || status.stdout.trim() || "no output").replace(/\s+/g, " ");
+                console.error(
+                    `[approver] status failed (exit ${status.exitCode}${status.timedOut ? ", timed out" : ""}): ${said.slice(0, 200)}`
+                );
             }
         } catch (error) {
             console.error("[approver] invalid status: " + String(error));
         }
 
+        if (statusFailures >= STATUS_FAILURE_LIMIT) {
+            console.error(
+                `[approver] NEEDS LEAD: codex status failed ${statusFailures} times in a row for ${entry.name}; stopped`
+            );
+            return;
+        }
+
         if (meta?.status === "closed") {
             console.log("[approver] session " + entry.name + " closed");
             return;
@@ -211,7 +864,10 @@ async function main(): Promise<void> {
         process.exit(2);
     }
 
-    await watchApprovals({ entry });
+    // A reviewer writes its probes and logs to the folder review-brief names; the driver approves those writes too.
+    const scratch =
+        entry.scratch ?? (entry.role === "review" && entry.pr ? reviewScratch(dirname(runPath), entry.pr) : undefined);
+    await watchApprovals({ entry: { ...entry, scratch } });
 }
 
 if (import.meta.main) {
diff --git a/.claude/skills/babysit/scripts/audit-reviews.ts b/.claude/skills/babysit/scripts/audit-reviews.ts
new file mode 100644
index 0000000000..bf5238870a
--- /dev/null
+++ b/.claude/skills/babysit/scripts/audit-reviews.ts
@@ -0,0 +1,263 @@
+#!/usr/bin/env bun
+/**
+ * Every reviewer's voice on a PR, not only eve's: all reviews by any bot or person, every review thread with its
+ * author and whether anyone answered it, every PR comment that is not ours, and every finding a review keeps in its
+ * body instead of a thread. It marks what came after the merge, what is still open, and what nobody answered, so a
+ * merged PR's late review and a second bot's finding are never missed (2026-10-14: #505 got 3 eve findings after its
+ * merge, and the round tooling watched eve and CodeRabbit only).
+ *
+ *   bun audit-reviews.ts --run <dir> 498 502 503 … [--bodies]
+ *
+ * --bodies prints the text (first 1200 characters) under each flagged item, and lists every thread that the reviewer
+ * resolved itself without a reply: CodeRabbit resolves its own threads when it believes a later commit fixed them,
+ * fixed or not. A thread WE resolved without a reply is the review loop's design, not a gap: post-replies resolves a
+ * fixed CodeRabbit thread silently because a reply spends CodeRabbit's hourly chat budget, and the round summary
+ * comment carries the answer (2026-10-14: five such threads on #515 were answered by hand for nothing).
+ *
+ * --ack-body <review-id> (repeatable) acknowledges the body findings of that exact review after they have been
+ * fixed and answered. The audit prints review IDs even without --bodies. Other bodies and late activity still block.
+ * Exit 1 for open/unanswered threads, unacknowledged outside-diff bodies, or activity after a merge.
+ */
+import { env } from "@genesiscz/utils/env";
+import { SafeJSON } from "@genesiscz/utils/json";
+import { has, loadRun } from "./run";
+
+interface Comment {
+    author?: { login: string };
+    createdAt: string;
+    body: string;
+}
+
+interface Thread {
+    id: string;
+    isResolved: boolean;
+    resolvedBy?: { login: string } | null;
+    path: string;
+    line?: number;
+    comments: { nodes: Comment[] };
+}
+
+interface Review extends Comment {
+    id: string;
+    state: string;
+    commit?: { oid: string };
+}
+
+interface Pr {
+    title: string;
+    state: string;
+    mergedAt?: string;
+    headRefOid: string;
+    reviews: { nodes: Review[]; pageInfo: { hasNextPage: boolean } };
+    reviewThreads: { nodes: Thread[]; pageInfo: { hasNextPage: boolean } };
+    comments: { nodes: Comment[]; pageInfo: { hasNextPage: boolean } };
+    timelineItems: { nodes: Array<{ createdAt?: string }> };
+}
+
+const run = loadRun();
+const [owner, name] = run.repo.split("/");
+const prs = process.argv.slice(2).filter((a, i, all) => /^\d+$/.test(a) && !all[i - 1]?.startsWith("--"));
+const acknowledgedBodies = new Set<string>();
+for (const [i, arg] of process.argv.entries()) {
+    if (arg !== "--ack-body") {
+        continue;
+    }
+
+    const id = process.argv[i + 1];
+    if (!id || id.startsWith("--")) {
+        throw new Error("--ack-body requires an exact review ID from this audit");
+    }
+
+    acknowledgedBodies.add(id);
+}
+const page = "pageInfo{hasNextPage}";
+const query = `query($n:Int!){viewer{login} repository(owner:"${owner}",name:"${name}"){pullRequest(number:$n){
+ title state mergedAt headRefOid
+ reviews(first:100){${page} nodes{id author{login} state createdAt:submittedAt body commit{oid}}}
+ reviewThreads(first:100){${page} nodes{id isResolved resolvedBy{login} path line comments(first:50){nodes{author{login} createdAt body}}}}
+ comments(first:100){${page} nodes{author{login} createdAt body}}
+ timelineItems(last:1,itemTypes:[HEAD_REF_FORCE_PUSHED_EVENT]){nodes{... on HeadRefForcePushedEvent{createdAt}}}}}}`;
+
+const local = (iso: string) =>
+    new Date(iso).toLocaleString("cs-CZ", {
+        timeZone: "Europe/Prague",
+        day: "numeric",
+        month: "numeric",
+        hour: "2-digit",
+        minute: "2-digit",
+    });
+const firstLine = (body: string) =>
+    body
+        .replace(/<[^>]+>/g, " ")
+        .split("\n")
+        .map((line) => line.replace(/[*_`#>]/g, "").trim())
+        .find((line) => line.length > 3)
+        ?.slice(0, 110) ?? "";
+const bodies = has("--bodies");
+const body = (text: string) =>
+    bodies
+        ? `\n${text
+              .replace(/<details>[\s\S]*?<\/details>/g, "")
+              .replace(/<[^>]+>/g, "")
+              .trim()
+              .slice(0, 1200)
+              .replace(/^/gm, "      | ")}`
+        : "";
+let problems = 0;
+
+for (const n of prs) {
+    const p = Bun.spawnSync(["gh", "api", "graphql", "-f", `query=${query}`, "-F", `n=${n}`], {
+        stdout: "pipe",
+        stderr: "pipe",
+        env: env.getProcessEnv(),
+    });
+
+    if (p.exitCode !== 0) {
+        console.log(`#${n} ERR ${p.stderr.toString().slice(0, 160)}`);
+        problems++;
+        continue;
+    }
+
+    const data = SafeJSON.parse(p.stdout.toString(), { strict: true }) as {
+        data: { viewer: { login: string }; repository: { pullRequest: Pr } };
+    };
+    const me = data.data.viewer.login;
+    const pr = data.data.repository.pullRequest;
+    const merged = pr.mergedAt ? Date.parse(pr.mergedAt) : undefined;
+    const late = (iso: string) => merged !== undefined && Date.parse(iso) > merged;
+    const flags: string[] = [];
+    console.log(
+        `#${n} ${pr.state}${pr.mergedAt ? ` ${local(pr.mergedAt)}` : ""} head ${pr.headRefOid.slice(0, 9)} ${pr.title.slice(0, 70)}`
+    );
+
+    for (const kind of ["reviews", "reviewThreads", "comments"] as const) {
+        if (pr[kind].pageInfo.hasNextPage) {
+            problems++;
+            flags.push(`⚠ more than 100 ${kind}: this audit read only the first 100`);
+        }
+    }
+
+    const byReviewer = new Map<string, Review[]>();
+
+    for (const review of pr.reviews.nodes) {
+        const who = review.author?.login ?? "?";
+
+        if (who !== me) {
+            byReviewer.set(who, [...(byReviewer.get(who) ?? []), review]);
+        }
+    }
+
+    const reviewers = [...byReviewer].map(([who, list]) => {
+        const last = list.at(-1);
+        // GitHub moves an earlier review onto the new head after a patch-identical force-push (round-ready.ts).
+        const forcedAt = pr.timelineItems.nodes.at(-1)?.createdAt ?? "";
+        const atHead = list.some((r) => r.commit?.oid === pr.headRefOid && r.createdAt > forcedAt);
+        return `${who} ${list.length}× last ${last?.state} ${last ? local(last.createdAt) : ""}${atHead ? " @head" : ""}`;
+    });
+    console.log(`  reviewers: ${reviewers.join(" · ") || "none"}`);
+
+    let outstandingBodies = 0;
+    for (const [who, list] of byReviewer) {
+        for (const review of list) {
+            // Findings a review keeps in its body: CodeRabbit's "outside the diff" and nitpick blocks, a bot's
+            // summary that names actionable items. They have no thread, so the round tooling never sees them.
+            const actionable = Number(/Actionable comments posted:\s*(\d+)/.exec(review.body)?.[1] ?? 0);
+            const outside = /Outside diff range|outside the diff/i.test(review.body);
+
+            if (outside) {
+                const acknowledged = acknowledgedBodies.has(review.id);
+                if (!acknowledged) {
+                    outstandingBodies++;
+                }
+
+                flags.push(
+                    `⚠ ${who} review ${local(review.createdAt)} [${review.id}] has findings outside the diff (no thread; ${acknowledged ? "acknowledged" : "needs work"})${bodies ? `\n${review.body.slice(review.body.search(/Outside diff range|outside the diff/i), review.body.search(/Outside diff range|outside the diff/i) + 1500).replace(/^/gm, "      | ")}` : ""}`
+                );
+            }
+
+            if (late(review.createdAt) && (review.state !== "APPROVED" || actionable > 0 || outside)) {
+                flags.push(
+                    `⚠ after merge: ${who} ${review.state} ${local(review.createdAt)} ${firstLine(review.body)}${body(review.body)}`
+                );
+            }
+        }
+    }
+
+    let open = 0;
+    let unanswered = 0;
+    let resolvedSilently = 0;
+    let resolvedByUs = 0;
+
+    for (const thread of pr.reviewThreads.nodes) {
+        const [first, ...rest] = thread.comments.nodes;
+        const who = first?.author?.login ?? "?";
+        const answered = rest.some((c) => c.author?.login !== who);
+        const where = `${thread.path}:${thread.line ?? "?"}${bodies ? ` [${thread.id}]` : ""}`;
+
+        if (!thread.isResolved) {
+            open++;
+        }
+
+        if (!answered) {
+            if (thread.isResolved && thread.resolvedBy?.login === me) {
+                resolvedByUs++;
+            } else if (thread.isResolved) {
+                resolvedSilently++;
+
+                if (bodies) {
+                    flags.push(
+                        `❗ resolved without a reply, by ${who} ${where}: ${firstLine(first?.body ?? "")}${body(first?.body ?? "")}`
+                    );
+                }
+            } else {
+                unanswered++;
+                flags.push(
+                    `⚠ unanswered open thread by ${who} ${where}: ${firstLine(first?.body ?? "")}${body(first?.body ?? "")}`
+                );
+            }
+        }
+
+        if (first && late(first.createdAt)) {
+            flags.push(
+                `⚠ after merge: thread by ${who} ${local(first.createdAt)} ${where} ${answered ? "(answered)" : "(NO reply)"}`
+            );
+        }
+
+        const lastWord = thread.comments.nodes.at(-1);
+
+        if (answered && lastWord && lastWord.author?.login !== me && lastWord.author?.login !== who) {
+            flags.push(`❗ ${where}: the last word is from ${lastWord.author?.login}, not from us or ${who}`);
+        }
+    }
+
+    console.log(
+        `  threads: ${pr.reviewThreads.nodes.length} (open ${open}, unanswered ${unanswered}, resolved by the reviewer without a reply ${resolvedSilently}, resolved by us with the answer in the round summary ${resolvedByUs})`
+    );
+
+    const others = pr.comments.nodes.filter((c) => c.author?.login !== me);
+    const counts = new Map<string, number>();
+
+    for (const comment of others) {
+        const who = comment.author?.login ?? "?";
+        counts.set(who, (counts.get(who) ?? 0) + 1);
+
+        if (late(comment.createdAt)) {
+            flags.push(`⚠ after merge: comment by ${who} ${local(comment.createdAt)} ${firstLine(comment.body)}`);
+        }
+    }
+
+    console.log(`  comments by others: ${[...counts].map(([who, count]) => `${who} ${count}`).join(" · ") || "none"}`);
+
+    for (const line of flags) {
+        console.log(`  ${line}`);
+    }
+
+    problems +=
+        open +
+        unanswered +
+        resolvedSilently +
+        outstandingBodies +
+        flags.filter((line) => line.includes("after merge")).length;
+}
+
+process.exit(problems > 0 ? 1 : 0);
diff --git a/.claude/skills/babysit/scripts/conflicts.ts b/.claude/skills/babysit/scripts/conflicts.ts
new file mode 100644
index 0000000000..54803643fa
--- /dev/null
+++ b/.claude/skills/babysit/scripts/conflicts.ts
@@ -0,0 +1,202 @@
+#!/usr/bin/env bun
+/**
+ * Resolve git conflict blocks and check the result, so no conflict in the babysit flow is resolved by an inline
+ * script again. On 2026-10-14 an inline resolver returned any string pick as the replacement text, so the picks
+ * ["ours", "ours"] wrote the word `ours` into both plugin manifests (d9687720a); nothing parsed them, and the
+ * genesis-tools plugin did not load in any new session for 12 hours. Here a pick is a side (`{ side: "ours" }`) or
+ * explicit text (`{ text: "…" }`), never a bare string, and every resolution is checked before it is written.
+ *
+ *   bun conflicts.ts resolve <file> <ours|theirs|both|base> [...]   # one side per conflict block, in file order
+ *   bun conflicts.ts check <file> [...]                             # no conflict marker left, and JSON files parse
+ *
+ * Paths are relative to the current folder (the worktree). For text no side gives, edit the file, then run `check`.
+ * `base` needs the diff3 form: `git checkout --conflict=diff3 -- <file>` recreates it. Exit 0 when every file is clean,
+ * 1 naming each problem, 2 on a usage error.
+ */
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { jsonProblem } from "../../../../scripts/ci/check-json";
+
+export type ConflictSide = "ours" | "theirs" | "both" | "base";
+export type ConflictPick = { side: ConflictSide } | { text: string };
+
+const SIDES: readonly ConflictSide[] = ["ours", "theirs", "both", "base"];
+
+function isSide(word: string): word is ConflictSide {
+    return SIDES.some((side) => side === word);
+}
+const START = /^<{7}(?:\s|$)/;
+const BASE = /^\|{7}(?:\s|$)/;
+const MIDDLE = /^={7}\s*$/;
+const END = /^>{7}(?:\s|$)/;
+
+interface Block {
+    ours: string[];
+    base: string[] | null;
+    theirs: string[];
+    section: "ours" | "base" | "theirs";
+}
+
+function chosen(block: Block, pick: ConflictPick, number: number): string {
+    if (typeof pick !== "object" || pick === null) {
+        throw new Error(`pick ${number} is ${typeof pick}: a pick is { side } or { text }, never a bare string`);
+    }
+
+    if ("text" in pick) {
+        return pick.text;
+    }
+
+    switch (pick.side) {
+        case "ours":
+            return block.ours.join("");
+        case "theirs":
+            return block.theirs.join("");
+        case "both":
+            return block.ours.join("") + block.theirs.join("");
+        case "base":
+            if (block.base === null) {
+                throw new Error(
+                    `conflict block ${number} has no base section (git checkout --conflict=diff3 -- <file>)`
+                );
+            }
+
+            return block.base.join("");
+        default:
+            throw new Error(`pick ${number} names no side: ${String(pick.side)}`);
+    }
+}
+
+/** The text with each conflict block replaced by its pick, in file order. Throws unless every block is closed and
+ * there is exactly one pick per block. */
+export function resolveConflictText(text: string, picks: ConflictPick[]): string {
+    const out: string[] = [];
+    let block: Block | null = null;
+    let count = 0;
+
+    for (const line of text.split(/(?<=\n)/)) {
+        if (!block) {
+            if (START.test(line)) {
+                block = { ours: [], base: null, theirs: [], section: "ours" };
+            } else {
+                out.push(line);
+            }
+
+            continue;
+        }
+
+        if (block.section === "ours" && BASE.test(line)) {
+            block.base = [];
+            block.section = "base";
+            continue;
+        }
+
+        if (block.section !== "theirs" && MIDDLE.test(line)) {
+            block.section = "theirs";
+            continue;
+        }
+
+        if (block.section === "theirs" && END.test(line)) {
+            count++;
+            const pick = picks[count - 1];
+
+            if (pick === undefined) {
+                throw new Error(`conflict block ${count} has no pick (${picks.length} given)`);
+            }
+
+            out.push(chosen(block, pick, count));
+            block = null;
+            continue;
+        }
+
+        if (block.section === "base") {
+            block.base?.push(line);
+        } else {
+            block[block.section].push(line);
+        }
+    }
+
+    if (block) {
+        throw new Error(`conflict block ${count + 1} is not closed`);
+    }
+
+    if (count !== picks.length) {
+        throw new Error(`${picks.length} pick(s) for ${count} conflict block(s)`);
+    }
+
+    return out.join("");
+}
+
+/** 1-based numbers of the lines that still start or end a conflict block. */
+export function markerLines(text: string): number[] {
+    return text.split("\n").flatMap((line, index) => (START.test(line) || END.test(line) ? [index + 1] : []));
+}
+
+/** What is wrong with each resolved file: a conflict marker left in it, or JSON that does not parse. */
+export function resolutionProblems(files: string[], read: (file: string) => string): string[] {
+    return files.flatMap((file) => {
+        const text = read(file);
+        const problems = markerLines(text).map((line) => `${file}:${line}: conflict marker left`);
+        const json = /\.jsonc?$/.test(file) ? jsonProblem(file, text) : null;
+        return json ? [...problems, `${file}: ${json}`] : problems;
+    });
+}
+
+function fail(problems: string[]): never {
+    for (const problem of problems) {
+        console.error(`✖ ${problem}`);
+    }
+
+    process.exit(1);
+}
+
+function main(): void {
+    const [command, ...rest] = process.argv.slice(2);
+    const read = (file: string) => readFileSync(file, "utf8");
+
+    if (command === "resolve" && rest.length >= 2) {
+        const [file = "", ...sides] = rest;
+
+        const picks = sides.filter(isSide).map((side) => ({ side }));
+
+        if (picks.length !== sides.length) {
+            console.error(`✖ a pick is one of ${SIDES.join(", ")}; for other text edit ${file}, then run check`);
+            process.exit(2);
+        }
+
+        let resolved = "";
+
+        try {
+            resolved = resolveConflictText(read(file), picks);
+        } catch (error) {
+            fail([`${file}: ${error instanceof Error ? error.message : String(error)}`]);
+        }
+
+        const problems = resolutionProblems([file], () => resolved);
+
+        if (problems.length > 0) {
+            fail([...problems, `${file} left as it was`]);
+        }
+
+        writeFileSync(file, resolved);
+        console.log(`✔ ${file}: ${sides.length} block(s) resolved; stage it with git add -- ${file}`);
+        return;
+    }
+
+    if (command === "check" && rest.length > 0) {
+        const missing = rest.filter((file) => !existsSync(file)).map((file) => `${file}: not found`);
+        const problems = [...missing, ...resolutionProblems(rest.filter(existsSync), read)];
+
+        if (problems.length > 0) {
+            fail(problems);
+        }
+
+        console.log(`✔ ${rest.length} file(s): no conflict marker, JSON parses`);
+        return;
+    }
+
+    console.error("usage: conflicts.ts resolve <file> <ours|theirs|both|base> [...] | check <file> [...]");
+    process.exit(2);
+}
+
+if (import.meta.main) {
+    main();
+}
diff --git a/.claude/skills/babysit/scripts/df-watch.ts b/.claude/skills/babysit/scripts/df-watch.ts
new file mode 100644
index 0000000000..a64a2c02f8
--- /dev/null
+++ b/.claude/skills/babysit/scripts/df-watch.ts
@@ -0,0 +1,83 @@
+#!/usr/bin/env bun
+/**
+ * Check free disk every 5 minutes and exit when it drops below the threshold, waking the lead once.
+ * Exits 0 for low space, 124 when its finite lifetime expires, 1 for an unreadable query and 2 for invalid options.
+ *
+ *   bun df-watch.ts [--below-gb 5] [--volume /System/Volumes/Data] [--for 30]
+ * --for is the maximum lifetime in minutes, including each bounded df query and the last sleep.
+ */
+import { flag, has } from "./run";
+
+const belowGb = Number(flag("--below-gb") ?? 5);
+const rawLifetime = flag("--for");
+const lifetimeMinutes = Number(rawLifetime ?? 30);
+const deadline = Date.now() + lifetimeMinutes * 60_000;
+const volume = flag("--volume") ?? (process.platform === "darwin" ? "/System/Volumes/Data" : "/");
+if (
+    !Number.isFinite(belowGb) ||
+    belowGb < 0 ||
+    !Number.isFinite(lifetimeMinutes) ||
+    lifetimeMinutes < 0 ||
+    !Number.isFinite(deadline) ||
+    (has("--for") && (rawLifetime === undefined || rawLifetime.trim() === ""))
+) {
+    console.error("df-watch: --below-gb and --for must be finite nonnegative numbers");
+    process.exit(2);
+}
+
+const stamp = () => new Date().toLocaleTimeString("cs-CZ", { timeZone: "Europe/Prague" });
+function expired(): never {
+    console.log(`${stamp()} disk watch expired after ${lifetimeMinutes} min`);
+    process.exit(124);
+}
+
+function freeGb(): number {
+    const result = Bun.spawnSync(["df", "-k", volume], {
+        stdout: "pipe",
+        stderr: "pipe",
+        timeout: Math.max(1, Math.min(30_000, deadline - Date.now())),
+    });
+    if (result.exitCode !== 0) {
+        throw new Error(`df exited ${result.exitCode}: ${result.stderr.toString().trim().slice(0, 160)}`);
+    }
+
+    const columns = result.stdout.toString().trim().split("\n").at(-1)?.split(/\s+/) ?? [];
+    const free = Number(columns[3]) / 1024 / 1024;
+    if (!Number.isFinite(free) || free < 0) {
+        throw new Error(`df gave no number for ${volume}`);
+    }
+    return free;
+}
+
+let first = true;
+while (Date.now() < deadline) {
+    let free: number;
+    try {
+        free = freeGb();
+    } catch (error) {
+        if (Date.now() >= deadline) {
+            expired();
+        }
+        console.log(`${stamp()} ${String(error)}: stopping so the lead notices`);
+        process.exit(1);
+    }
+
+    if (Date.now() >= deadline) {
+        expired();
+    }
+
+    if (first) {
+        console.log(
+            `${stamp()} watching ${volume}: ${free.toFixed(1)} GB free, wake below ${belowGb} GB; lifetime ${lifetimeMinutes} min`
+        );
+        first = false;
+    }
+
+    if (free < belowGb) {
+        console.log(`${stamp()} LOW DISK: ${free.toFixed(2)} GB free (threshold ${belowGb} GB)`);
+        process.exit(0);
+    }
+
+    await Bun.sleep(Math.min(300_000, Math.max(0, deadline - Date.now())));
+}
+expired();
diff --git a/.claude/skills/babysit/scripts/fetch-threads.ts b/.claude/skills/babysit/scripts/fetch-threads.ts
new file mode 100644
index 0000000000..fcafeb950f
--- /dev/null
+++ b/.claude/skills/babysit/scripts/fetch-threads.ts
@@ -0,0 +1,116 @@
+#!/usr/bin/env bun
+/**
+ * Fetch one PR round's review input into the worker's worktree, for a worker whose sandbox has no network.
+ * A Codex worker's `tools github review` and `gh` fail there (getaddrinfo ENOTFOUND api.github.com): on
+ * 2026-10-16 two round 2 fixers stopped before their first edit. The lead runs this before the spawn or steer;
+ * the brief then points at the files.
+ *
+ *   bun fetch-threads.ts --run <dir> --pr 533 --round 2 [--wt <dir>]
+ *
+ * Writes, under `<worktree>/.claude/work/babysit/`:
+ *   <pr>-r<round>-threads.md       every unresolved thread (any reviewer), listed and then expanded, with Thread IDs
+ *   <pr>-r<round>-review-bodies.md every review body (CodeRabbit keeps "Outside diff range" and other findings there)
+ *   <pr>-r<round>-pr-comments.md   PR comments with authors, except our round summaries and named bot notices
+ */
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { execTool } from "@genesiscz/utils/cli";
+import { SafeJSON } from "@genesiscz/utils/json";
+import { flag, loadRun, worktreeFor } from "./run";
+
+/** The `t<n>` refs a `tools github review --llm` listing names, each once, in numeric order. */
+export function threadRefs(listing: string): string[] {
+    const refs = new Set(listing.match(/\bt\d+\b/g) ?? []);
+    return [...refs].sort((a, b) => Number(a.slice(1)) - Number(b.slice(1)));
+}
+
+async function reviewRead(args: string[], cwd: string): Promise<string> {
+    const result = await execTool(args, { cwd, timeout: 120_000 });
+    if (!result.success) {
+        throw new Error("review read exited " + result.exitCode + ": " + result.stderr.toString().slice(0, 300));
+    }
+    return result.stdout.toString();
+}
+
+function capture(cmd: string[], cwd: string): string {
+    const p = Bun.spawnSync(cmd, { cwd, stdout: "pipe", stderr: "pipe", timeout: 120_000 });
+
+    if (p.exitCode !== 0) {
+        throw new Error(`${cmd.slice(0, 4).join(" ")} exited ${p.exitCode}: ${p.stderr.toString().slice(0, 300)}`);
+    }
+
+    return p.stdout.toString();
+}
+
+interface Review {
+    user: { login: string };
+    commit_id: string;
+    state: string;
+    body: string;
+}
+
+interface IssueComment {
+    user: { login: string };
+    created_at: string;
+    body: string;
+}
+
+if (import.meta.main) {
+    const run = loadRun();
+    const pr = flag("--pr") ?? "";
+    const round = flag("--round") ?? "1";
+    const wt = flag("--wt") ?? worktreeFor(run, pr);
+    const dir = join(wt, ".claude/work/babysit");
+    const session = `lead-${pr}-r${round}`;
+    mkdirSync(dir, { recursive: true });
+
+    const listing = await reviewRead(
+        ["github", "review", pr, "--repo", run.repo, "--llm", "-u", "-s", session],
+        run.main
+    );
+    const refs = threadRefs(listing);
+    const expanded =
+        refs.length > 0
+            ? await reviewRead(["github", "review", "expand", refs.join(","), "-s", session], run.main)
+            : "";
+    writeFileSync(join(dir, `${pr}-r${round}-threads.md`), `${listing}\n## Expanded\n\n${expanded}`);
+
+    const reviews = SafeJSON.parse(
+        capture(["gh", "api", `repos/${run.repo}/pulls/${pr}/reviews?per_page=100`, "--paginate", "--slurp"], run.main),
+        { strict: true }
+    ).flat() as Review[];
+    const bodies = reviews
+        .filter((review) => review.body.trim() !== "")
+        .map((r) => `### review by ${r.user.login} on ${r.commit_id.slice(0, 9)} (${r.state})\n${r.body}\n`);
+    writeFileSync(join(dir, `${pr}-r${round}-review-bodies.md`), bodies.join("\n"));
+
+    const comments = SafeJSON.parse(
+        capture(
+            ["gh", "api", `repos/${run.repo}/issues/${pr}/comments?per_page=100`, "--paginate", "--slurp"],
+            run.main
+        ),
+        { strict: true }
+    ).flat() as IssueComment[];
+    const me = capture(["gh", "api", "user", "--jq", ".login"], run.main).trim();
+    const commentBodies = comments
+        .filter((comment) => {
+            const { body, user } = comment;
+            if (user.login === me && /^# Review fixes(?:\s|$)/.test(body.trimStart())) {
+                return false;
+            }
+            const codeRabbit = ["coderabbitai", "coderabbitai[bot]"].includes(user.login);
+            const rateNotice = body.includes(
+                "<!-- This is an auto-generated comment: rate limited by coderabbit.ai -->"
+            );
+            const replyNotice =
+                body.includes("<!-- This is an auto-generated reply by CodeRabbit -->") &&
+                (body.includes("Review rate limited.") || body.includes("<summary>✅ Action performed</summary>"));
+            return !(codeRabbit && (rateNotice || replyNotice));
+        })
+        .map((c) => `### comment by ${c.user.login} at ${c.created_at}\n${c.body}\n`);
+    writeFileSync(join(dir, `${pr}-r${round}-pr-comments.md`), commentBodies.join("\n"));
+
+    console.log(
+        `✔ #${pr} round ${round}: ${refs.length} threads, ${bodies.length} review bodies, ${commentBodies.length} PR comments in ${dir}`
+    );
+}
diff --git a/.claude/skills/babysit/scripts/fill-brief.ts b/.claude/skills/babysit/scripts/fill-brief.ts
new file mode 100644
index 0000000000..259a42aa47
--- /dev/null
+++ b/.claude/skills/babysit/scripts/fill-brief.ts
@@ -0,0 +1,95 @@
+#!/usr/bin/env bun
+/**
+ * Fill references/brief-self-fetch.md for one PR round: the worker fetches and expands the threads itself, fixes
+ * them in one commit and writes the reply file. Use it for a worker's FIRST brief; a later round of the same worker
+ * is a short steer (SKILL.md, "The run ledger").
+ *
+ *   bun fill-brief.ts --run <dir> --pr 499 --round 1 --model "GPT-6 Astra" --scopes "GenesisKit, markdown"
+ *                     [--swift] [--judge <findings.md>] [--dedicated-review] [--out <file>]
+ */
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { SafeJSON } from "@genesiscz/utils/json";
+import { roundPolicy } from "./policy";
+import { flag, has, loadRun, worktreeFor } from "./run";
+
+const run = loadRun();
+const pr = flag("--pr") ?? "";
+const round = Number(flag("--round") ?? "1");
+const judgeFile = flag("--judge");
+const view = Bun.spawnSync(
+    ["gh", "pr", "view", pr, "--repo", run.repo, "--json", "title,headRefName,baseRefName,changedFiles"],
+    {
+        stdout: "pipe",
+        stderr: "pipe",
+    }
+);
+
+if (!pr || view.exitCode !== 0) {
+    console.error(`cannot read PR ${pr || "(none)"}: ${view.stderr.toString().slice(0, 200)}`);
+    process.exit(2);
+}
+
+const meta = SafeJSON.parse(view.stdout.toString(), { strict: true }) as {
+    title: string;
+    headRefName: string;
+    baseRefName: string;
+    changedFiles: number;
+};
+const policy = roundPolicy({ round, changedFiles: meta.changedFiles, dedicatedReview: has("--dedicated-review") }).text;
+// Another repository's run card names its own checks: GenesisTools' commands do not exist there (2026-10-14,
+// GenesisPlayground #94 round 2 got `bun scripts/test.ts` and lint-rules in its brief).
+const verify = run.verify ? run.verify.map((line) => `   - ${line}`).join("\n") : defaultVerify();
+
+function defaultVerify(): string {
+    return [
+        "   - `bun scripts/test.ts <the test file of every file you changed>` (never bare `bun test`; it must end with `[test] suite complete`)",
+        "   - `./node_modules/@typescript/native-preview-darwin-arm64/lib/tsgo --noEmit` (not `bunx tsgo`: it hangs in /tmp worktrees)",
+        "   - `bunx biome check <each changed file>`",
+        "   - `bun run lint:rules` and `bun scripts/ci/check-tool-commands.ts`",
+        ...(has("--swift") && codexWorker()
+            ? [
+                  "   - Swift: write the change and its test, but do NOT run `swift build` or `swift test`: the Codex sandbox cannot write clang's module cache (`~/.cache/clang/ModuleCache`), so every attempt fails. Read the area rule files for the package first. Name the Swift tests you added in your report; the lead builds and runs them after your commit.",
+              ]
+            : []),
+        ...(has("--swift") && !codexWorker()
+            ? [
+                  `   - Swift: from the folder with Package.swift, use the kernel-locked slot for BOTH commands: \`bun ${join(import.meta.dir, "swift-slot.ts")} --wait-minutes 40 -- swift build\`, then \`bun ${join(import.meta.dir, "swift-slot.ts")} --wait-minutes 40 -- swift test --filter <the suites you touched>\`. Read the package area rules first. Never launch, quit or touch running apps or windows; no screenshots of the screen. Never run a heavy Swift command outside the slot.`,
+              ]
+            : []),
+    ].join("\n");
+}
+/** Codex workers (GPT models) run in a sandbox that cannot build Swift (2026-10-16: #533 round 1 stopped on it). */
+function codexWorker(): boolean {
+    return /gpt|sol|astra|luna|codex/i.test(flag("--model") ?? "GPT-6.1 Sol");
+}
+
+const judgeSection = judgeFile
+    ? `## The lead's judge findings on your earlier commit (fix these in this round too)\n\n${readFileSync(judgeFile, "utf8").trim()}\n\nTreat each like a review finding: fix it, test it where behaviour changes, and add one reply item per finding with no threadId and reviewer "lead".\n\n`
+    : "";
+const text = readFileSync(join(import.meta.dir, "../references/brief-self-fetch.md"), "utf8")
+    .replaceAll("{{ROUND}}", String(round))
+    .replaceAll("{{PR}}", pr)
+    .replaceAll("{{REPO}}", run.repo)
+    // --wt for a worktree not named after its PR (2026-10-14: #517 lived in bs-hooks, the brief said bs-517, and
+    // the worker rightly stopped to ask).
+    .replaceAll("{{CWD}}", flag("--wt") ?? worktreeFor(run, pr))
+    .replaceAll("{{BRANCH}}", meta.headRefName)
+    .replaceAll("{{BASE}}", meta.baseRefName)
+    .replaceAll("{{TITLE}}", meta.title)
+    .replaceAll("{{SCOPES}}", flag("--scopes") ?? "tools")
+    .replaceAll("{{MODEL_LABEL}}", flag("--model") ?? "GPT-6.1 Sol")
+    .replaceAll("{{ROUND_POLICY}}", policy)
+    .replaceAll("{{VERIFY}}", verify)
+    .replace("## 2. Fix", `${judgeSection}## 2. Fix`)
+    // Another repository (run.json `verify`) has no GenesisTools install in its worktree.
+    .replace("; `node_modules` is installed.", run.verify ? "." : "; `node_modules` is installed.");
+
+if (text.includes("{{")) {
+    console.error(`unfilled placeholder left: ${text.match(/\{\{[A-Z_]+\}\}/)?.[0]}`);
+    process.exit(2);
+}
+
+const out = flag("--out") ?? join(run.dir, `brief-${pr}-r${round}.md`);
+writeFileSync(out, text);
+console.log(out);
diff --git a/.claude/skills/babysit/scripts/integrate.ts b/.claude/skills/babysit/scripts/integrate.ts
new file mode 100644
index 0000000000..3ff41eb778
--- /dev/null
+++ b/.claude/skills/babysit/scripts/integrate.ts
@@ -0,0 +1,511 @@
+#!/usr/bin/env bun
+/**
+ * One PR round, after the lead has judged the worker commit(s) in the PR's worktree:
+ * gates → fast-forward push of the judged SHA → reply file to the vault with the judge → round summary comment (once)
+ * → thread replies + resolve. Logs `push` and `post` to the run ledger.
+ *
+ *   bun integrate.ts --run <dir> --pr 508 --round 1 [--wt <dir>] [--replies <json>] [--session bs-508-r1]
+ *                    [--sha-map old=new,…] [--range a..b] [--skip-gates] [--post | --no-post] [--dry] [--no-push-hooks]
+ *                    [--restacked-from <old head>]
+ *
+ * --restacked-from: HEAD was rebased on purpose (restack.ts, merge prep). The push is then forced with a lease on that
+ * exact old head, and refused when the remote moved since; the gates check only the PR's own commits after the restack.
+ */
+import {
+    existsSync,
+    lstatSync,
+    mkdirSync,
+    mkdtempSync,
+    readdirSync,
+    readFileSync,
+    realpathSync,
+    rmSync,
+    symlinkSync,
+    writeFileSync,
+} from "node:fs";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { env } from "@genesiscz/utils/env";
+import { SafeJSON } from "@genesiscz/utils/json";
+import { appendEvent } from "./ledger";
+import { isDeferredReply } from "./policy";
+import { probeAddedLines } from "./probe";
+import { flag, has, loadRun, worktreeFor } from "./run";
+import { ensureConfigHooks, HOOKS_OFF, newExecutablesStall } from "./versions";
+
+/** The guards `.githooks/pre-push` runs, label first. Keep this list in step with the hook. */
+export const PRE_PUSH_GUARDS: string[][] = [
+    ["lint:dashboard", "bun", "run", "lint:dashboard"],
+    ["typecheck:all", "bun", "run", "typecheck:all"],
+    ["logging-guard", "bash", "scripts/ci/logging-guard.sh"],
+    ["ai-credentials-guard", "bash", "scripts/ci/ai-credentials-guard.sh"],
+    ["pid-safety-guard", "bash", "scripts/ci/pid-safety-guard.sh"],
+    ["package-boundaries", "bun", "scripts/ci/check-package-boundaries.ts"],
+    ["plugin-standalone", "bun", "scripts/ci/check-plugin-standalone.ts"],
+    ["tool-commands", "bun", "scripts/ci/check-tool-commands.ts", "--strict"],
+    ["jev-instrumentation", "bun", "scripts/ci/jev-instrumentation-guard.ts"],
+    ["entrypoint-imports", "bun", "scripts/ci/entrypoint-import-guard.ts"],
+];
+
+export function postingExitCode(posted: number, followups: Array<{ code: number }>): number {
+    return posted === 0 && followups.every((reply) => reply.code === 0) ? 0 : 1;
+}
+
+interface ReplyItem {
+    ref?: string;
+    threadId?: string;
+    verdict?: string;
+    reply?: string;
+}
+
+export function earlierVerdicts(options: { vault: string; pr: string; round: string }): Map<string, string> {
+    const result = new Map<string, string>();
+    const current = /^(\d+)([a-z]?)$/.exec(options.round);
+    if (!current) {
+        throw new Error("invalid reply round: " + options.round);
+    }
+    const currentRound = Number(current[1]);
+    const currentSuffix = current[2];
+    const names = readdirSync(options.vault)
+        .flatMap((name) => {
+            const match = /^(\d+)-r(\d+)([a-z]?)-replies\.json$/.exec(name);
+            if (!match || match[1] !== options.pr) {
+                return [];
+            }
+            const round = Number(match[2]);
+            const suffix = match[3];
+            return round < currentRound || (round === currentRound && suffix < currentSuffix)
+                ? [{ name, round, suffix }]
+                : [];
+        })
+        .sort((a, b) => a.round - b.round || a.suffix.localeCompare(b.suffix));
+    for (const { name } of names) {
+        const previous = SafeJSON.parse(readFileSync(join(options.vault, name), "utf8"), { strict: true }) as {
+            items?: ReplyItem[];
+        };
+        for (const item of previous.items ?? []) {
+            if (item.threadId && item.verdict) {
+                result.set(item.threadId, item.verdict);
+            }
+        }
+    }
+    return result;
+}
+
+/** A separate Git checkout pins every tracked gate input while the worker continues its next round. */
+function gateSnapshot(options: { wt: string; sha: string; runDir: string }): string {
+    const snapshots = join(options.runDir, "gate-snapshots");
+    mkdirSync(snapshots, { recursive: true });
+    const snapshot = mkdtempSync(join(snapshots, options.sha.slice(0, 9) + "-"));
+    // A full checkout per round filled the run folder; the gates are done (passed or exited) when the process ends.
+    process.on("exit", () => rmSync(snapshot, { recursive: true, force: true }));
+    for (const args of [
+        ["clone", "--shared", "--no-checkout", "--quiet", options.wt, snapshot],
+        ["-C", snapshot, "checkout", "--quiet", "--detach", options.sha],
+    ]) {
+        const result = Bun.spawnSync(["git", ...HOOKS_OFF, ...args], {
+            cwd: options.wt,
+            stdout: "pipe",
+            stderr: "pipe",
+            env: env.getProcessEnv(),
+            timeout: 60_000,
+        });
+        if (result.exitCode !== 0) {
+            throw new Error(`gate snapshot failed: ${result.stderr.toString()}`);
+        }
+    }
+
+    const workerRoot = realpathSync(options.wt);
+    // Keep assessed dependency binaries; redirect workspace-package links to the pinned source, never the worker.
+    const linkDependencies = (source: string, destination: string) => {
+        mkdirSync(destination, { recursive: true });
+        for (const name of readdirSync(source)) {
+            const input = join(source, name);
+            const output = join(destination, name);
+            if ((name.startsWith("@") || name === ".bin") && lstatSync(input).isDirectory()) {
+                linkDependencies(input, output);
+                continue;
+            }
+
+            const target = realpathSync(input);
+            const local = relative(workerRoot, target);
+            const workspace =
+                !isAbsolute(local) &&
+                local !== ".." &&
+                !local.startsWith(".." + sep) &&
+                local !== "node_modules" &&
+                !local.startsWith("node_modules" + sep);
+            symlinkSync(workspace ? resolve(snapshot, local) : target, output);
+        }
+    };
+    const modules = join(options.wt, "node_modules");
+    if (existsSync(modules)) {
+        linkDependencies(modules, join(snapshot, "node_modules"));
+    }
+
+    console.log(`gates: pinned ${options.sha} in ${snapshot}`);
+    return snapshot;
+}
+
+async function main(): Promise<void> {
+    const run = loadRun();
+    // This repository's gates (tsgo, lint-rules, check-tool-commands, check-commits) exist only in GenesisTools. Another
+    // repository's run card skips them by itself: GenesisPlayground #94 round 1 ran `bunx tsgo` in a Swift app, printed the
+    // compiler's help and stopped the push (2026-10-15).
+    const skipGates = has("--skip-gates") || run.repo !== "genesiscz/GenesisTools";
+    const pr = flag("--pr") ?? "";
+    const round = flag("--round") ?? "1";
+    const wt = resolve(flag("--wt") ?? worktreeFor(run, pr));
+    const session = flag("--session") ?? `bs-${pr}-r${round}`;
+    const repliesIn = flag("--replies") ?? join(wt, ".claude/work/babysit", `${pr}-r${round}-replies.json`);
+    const shaMap = Object.fromEntries(
+        (flag("--sha-map") ?? "")
+            .split(",")
+            .filter(Boolean)
+            .map((pair): [string, string] => {
+                const [from = "", to = ""] = pair.split("=");
+                return [from, to];
+            })
+    );
+    const dry = has("--dry");
+
+    let executionRoot = wt;
+    function exec(cmd: string[], opts: { cwd?: string; quiet?: boolean } = {}): { code: number; out: string } {
+        const p = Bun.spawnSync(cmd, {
+            cwd: opts.cwd ?? executionRoot,
+            stdout: "pipe",
+            stderr: "pipe",
+            env: env.getProcessEnv(),
+        });
+        const out = `${p.stdout.toString()}${p.stderr.toString()}`;
+
+        if (!opts.quiet) {
+            console.log(`$ ${cmd.join(" ").slice(0, 140)} → exit ${p.exitCode}`);
+        }
+
+        return { code: p.exitCode ?? 1, out };
+    }
+
+    function must(cmd: string[], label: string, cwd?: string): string {
+        const r = exec(cmd, { cwd });
+
+        if (r.code !== 0) {
+            console.log(`✖ ${label} failed:\n${r.out.split("\n").slice(-25).join("\n")}`);
+            process.exit(1);
+        }
+
+        return r.out;
+    }
+
+    const view = must(["gh", "pr", "view", pr, "--repo", run.repo, "--json", "headRefName,baseRefName"], "pr view");
+    const { headRefName: branch, baseRefName } = SafeJSON.parse(view, { strict: true }) as {
+        headRefName: string;
+        baseRefName: string;
+    };
+    must(["git", "fetch", "-q", "origin", branch, baseRefName], "fetch");
+    const oldHead = must(["git", "rev-parse", `origin/${branch}`], "rev-parse").trim();
+    const newHead = must(["git", "rev-parse", "HEAD"], "rev-parse HEAD").trim();
+    const restackedFrom = flag("--restacked-from");
+
+    if (restackedFrom) {
+        // 2026-10-14: #500, #517 and #510 were restacked for landing and integrate refused them as "someone pushed", so the
+        // lead pushed by hand. The lease is the old head the lead rebased from: anything newer on the remote is refused.
+        const from = must(
+            ["git", "rev-parse", "--verify", `${restackedFrom}^{commit}`],
+            "rev-parse --restacked-from"
+        ).trim();
+
+        if (from !== oldHead) {
+            console.log(
+                `✖ origin/${branch} is ${oldHead.slice(0, 9)}, not the restacked-from ${from.slice(0, 9)}: someone pushed`
+            );
+            process.exit(1);
+        }
+    } else if (exec(["git", "merge-base", "--is-ancestor", oldHead, newHead], { quiet: true }).code !== 0) {
+        console.log(
+            `✖ HEAD ${newHead.slice(0, 9)} does not contain origin/${branch} ${oldHead.slice(0, 9)}: someone pushed; rebase first`
+        );
+        process.exit(1);
+    }
+
+    // A restack replays the base's commits too: gate only the PR's own commits on top of its base.
+    const gateFrom = restackedFrom
+        ? must(["git", "merge-base", `origin/${baseRefName}`, newHead], "merge-base").trim()
+        : oldHead;
+
+    const dirty = must(["git", "status", "--short", "--untracked-files=no"], "status").trim();
+
+    if (dirty) {
+        console.log(`✖ worktree has uncommitted changes:\n${dirty}`);
+        process.exit(1);
+    }
+
+    if (oldHead !== newHead) {
+        executionRoot = gateSnapshot({ wt, sha: newHead, runDir: run.dir });
+    }
+
+    if (!skipGates && oldHead !== newHead) {
+        const tsgo = join(executionRoot, "node_modules/@typescript/native-preview-darwin-arm64/lib/tsgo");
+        must(existsSync(tsgo) ? [tsgo, "--noEmit"] : ["bunx", "tsgo", "--noEmit"], "tsgo");
+        // Biome by its exit code over the round's changed files: judging it by the tail of its output let a formatting
+        // error through to the pre-push hook (2026-10-14, #502 round 6). The main checkout's binary is already assessed.
+        const changed = must(
+            ["git", "diff", "--name-only", "-z", "--diff-filter=d", `${gateFrom}..${newHead}`],
+            "changed files"
+        )
+            .split("\0")
+            .filter((file) => /\.(ts|tsx|js|jsx|json)$/.test(file));
+
+        if (changed.length > 0) {
+            const biome = join(run.main, "node_modules/.bin/biome");
+            must(
+                [
+                    existsSync(biome) ? biome : "bunx",
+                    ...(existsSync(biome) ? [] : ["biome"]),
+                    "check",
+                    "--no-errors-on-unmatched",
+                    ...changed,
+                ],
+                "biome"
+            );
+        }
+
+        must(["bun", "run", "lint:rules"], "lint-rules");
+        // The pre-push hook's CI guards, with the same flags (.githooks/pre-push): a judged round that passes a
+        // weaker local check is refused at the push (2026-10-16: tool-commands --strict and pid-safety-guard
+        // refused #533, #536 and #537 after integrate's own gates had passed).
+        for (const [label, ...cmd] of PRE_PUSH_GUARDS) {
+            must(cmd, label);
+        }
+        must(["bash", "scripts/ci/placeholder-check.sh"], "placeholder-check");
+        const commits = must(["bun", "scripts/git/check-commits.ts", `${gateFrom}..${newHead}`], "check-commits");
+
+        if (!/0 with a subject to fix/.test(commits)) {
+            console.log(`✖ check-commits:\n${commits}`);
+            process.exit(1);
+        }
+    }
+
+    // --skip-gates (another repository's PR) skips the repository rules above, but never the personal-data probe: it runs
+    // on the target worktree and blocks only a hit in a line this push adds (probe.ts).
+    if (skipGates && oldHead !== newHead && !probeAddedLines({ wt: executionRoot, from: gateFrom, to: newHead })) {
+        process.exit(1);
+    }
+
+    executionRoot = wt;
+    if (oldHead !== newHead && !dry) {
+        // Push the SHA that was judged and gated, never HEAD at push time: a worker steered into its next round in the
+        // same worktree can commit while the gates run (2026-10-14, #502 round 3 → 4).
+        // --no-push-hooks counts only while new executables really stall (versions.ts): the gates above ran the hook's
+        // probe, typecheck and repo rules, but its Biome check is then the lead's job.
+        console.log(`hooks: ${ensureConfigHooks(run.main)}`);
+        const stalled = has("--no-push-hooks") && !skipGates && (await newExecutablesStall());
+
+        if (has("--no-push-hooks") && !stalled) {
+            console.log("= --no-push-hooks ignored: new executables start normally, so the push hooks run");
+        }
+
+        const hooks = stalled ? HOOKS_OFF : [];
+        const lease = restackedFrom ? [`--force-with-lease=refs/heads/${branch}:${oldHead}`] : [];
+        must(["git", ...hooks, "push", ...lease, "origin", `${newHead}:refs/heads/${branch}`], "push");
+        const pushed = `${oldHead.slice(0, 9)}${restackedFrom ? "..." : ".."}${newHead.slice(0, 9)}`;
+        console.log(`✔ pushed ${branch} ${pushed}${restackedFrom ? " (forced, restack)" : ""}`);
+        appendEvent(run.dir, {
+            kind: "push",
+            pr: Number(pr),
+            round: Number(round),
+            meta: { branch, range: pushed, ...(restackedFrom ? { forced: `lease on ${oldHead.slice(0, 9)}` } : {}) },
+        });
+    } else {
+        console.log(oldHead === newHead ? "no new commits: nothing to push" : "dry: push skipped");
+    }
+
+    if (!existsSync(repliesIn)) {
+        console.log(`no reply file at ${repliesIn}: nothing to post`);
+        process.exit(0);
+    }
+
+    mkdirSync(run.vault, { recursive: true });
+    let text = readFileSync(repliesIn, "utf8");
+
+    for (const [from, to] of Object.entries(shaMap)) {
+        text = text.replaceAll(from, to);
+    }
+
+    const data = SafeJSON.parse(text, { strict: true }) as {
+        judge?: string;
+        items?: Array<{
+            model?: unknown;
+            ref?: unknown;
+            threadId?: unknown;
+            reviewer?: unknown;
+            verdict?: unknown;
+            deferred?: unknown;
+        }>;
+    };
+    data.judge = run.judge;
+    const deferred = (data.items ?? []).filter(isDeferredReply);
+    for (const item of deferred) {
+        // The installed reply schema predates the policy and rejects extra fields. Its supported refusal verdict
+        // carries the deferral and makes CodeRabbit post the reply instead of silently resolving it.
+        item.verdict = "belongs-elsewhere";
+        delete item.deferred;
+        if (typeof item.threadId !== "string" || !item.threadId || typeof item.ref !== "string" || !item.ref) {
+            throw new Error("a deferred reply needs its stable threadId and session ref; nothing posted");
+        }
+    }
+
+    for (const item of data.items ?? []) {
+        if (typeof item.model === "string" && item.model.startsWith(run.judge)) {
+            delete item.model;
+        }
+
+        // A finding from the lead's own or an independent review has no GitHub thread. A `ref` on it made post-replies
+        // answer `t1` of a review session that has no such thread (2026-10-14, #519 round 2); the summary still names it.
+        if (item.reviewer === "lead" && !item.threadId && item.ref !== undefined) {
+            delete item.ref;
+        }
+    }
+
+    // Named from the PR and round, never from the worker's file name: a reply file called `524-r2.json` made the summary
+    // overwrite it, the posted marker point at the summary itself, and the round's summary and replies go unposted
+    // (2026-10-15, #524 round 2).
+    const replies = join(run.vault, `${pr}-r${round}-replies.json`);
+    writeFileSync(replies, `${SafeJSON.stringify(data, null, 2)}\n`);
+    const resolvingReplies = deferred.length ? join(run.vault, `${pr}-r${round}-resolvable.json`) : replies;
+    const deferredReplies = join(run.vault, `${pr}-r${round}-deferred.json`);
+    if (deferred.length) {
+        writeFileSync(
+            resolvingReplies,
+            SafeJSON.stringify({ ...data, items: (data.items ?? []).filter((item) => !isDeferredReply(item)) }, null, 2)
+        );
+        writeFileSync(deferredReplies, SafeJSON.stringify({ ...data, items: deferred }, null, 2));
+    }
+    const summary = join(run.vault, `${pr}-r${round}-summary.md`);
+    const range = flag("--range") ?? (oldHead !== newHead ? `${gateFrom}..${newHead}` : undefined);
+    must(
+        [
+            "bun",
+            join(run.reviewLoopScripts, "round-summary.ts"),
+            replies,
+            "--repo",
+            run.repo,
+            ...(range ? ["--range", range, "--cwd", wt] : []),
+            "--out",
+            summary,
+        ],
+        "round-summary",
+        run.vault
+    );
+
+    // Check authorization immediately before the first public mutation, after saving the reviewable files.
+    if (has("--no-post") || dry || !(run.post === true || has("--post"))) {
+        console.log(`held (posting not authorized or disabled): ${summary}`);
+        process.exit(0);
+    }
+
+    // A rerun (a killed push, a retry) must not post the round's summary twice (2026-10-14: #503 got two).
+    const postedMarker = summary.replace(/\.md$/, ".posted");
+
+    if (existsSync(postedMarker)) {
+        console.log(`summary already posted (${postedMarker}): skipped`);
+    } else {
+        must(["gh", "pr", "comment", pr, "--repo", run.repo, "--body-file", summary], "summary comment", run.vault);
+        writeFileSync(postedMarker, `${new Date().toISOString()}\n`);
+    }
+
+    const deferredPosted = deferred.length
+        ? exec(
+              [
+                  "bun",
+                  join(run.reviewLoopScripts, "post-replies.ts"),
+                  session,
+                  deferredReplies,
+                  "--phase",
+                  "final",
+                  "--no-resolve",
+                  "--delay-ms",
+                  "3000",
+                  "--cwd",
+                  wt,
+              ],
+              { cwd: run.vault }
+          )
+        : { code: 0, out: "" };
+    if (deferred.length) {
+        console.log(deferredPosted.out);
+    }
+    const posted = exec(
+        [
+            "bun",
+            join(run.reviewLoopScripts, "post-replies.ts"),
+            session,
+            resolvingReplies,
+            "--phase",
+            "final",
+            "--resolve-after-s",
+            "20",
+            "--delay-ms",
+            "3000",
+            "--cwd",
+            wt,
+        ],
+        { cwd: run.vault }
+    );
+    console.log(posted.out.split("\n").slice(-12).join("\n"));
+
+    // post-replies counts a thread this run already answered as done, so a later round that FIXES a thread an earlier
+    // round deferred or refused never reaches the thread (2026-10-14, #502 t4-t7). Reply to those threads directly.
+    const earlier = earlierVerdicts({ vault: run.vault, pr, round });
+    const followups: Array<{ threadId: string; code: number; out: string }> = [];
+
+    for (const item of (data.items ?? []) as ReplyItem[]) {
+        const before = item.threadId ? earlier.get(item.threadId) : undefined;
+
+        if (!item.threadId || item.verdict !== "fixed" || !before || before === "fixed" || !item.reply) {
+            continue;
+        }
+
+        const mutation = `mutation($id:ID!,$body:String!){addPullRequestReviewThreadReply(input:{pullRequestReviewThreadId:$id,body:$body}){comment{id}}}`;
+        const reply = exec(
+            [
+                "gh",
+                "api",
+                "graphql",
+                "-f",
+                `query=${mutation}`,
+                "-F",
+                `id=${item.threadId}`,
+                "-F",
+                `body=Round ${round} update: ${item.reply}`,
+            ],
+            { quiet: true }
+        );
+        followups.push({ threadId: item.threadId, ...reply });
+        console.log(
+            `${reply.code === 0 ? "✔" : "⚠"} follow-up on ${item.ref ?? item.threadId} (was ${before}, now fixed)`
+        );
+    }
+    console.log(posted.code === 0 ? `✔ #${pr} round ${round} posted` : `⚠ #${pr} post-replies exit ${posted.code}`);
+    appendEvent(run.dir, {
+        kind: "post",
+        pr: Number(pr),
+        round: Number(round),
+        text: readFileSync(summary, "utf8"),
+        meta: {
+            replies,
+            exitCode: postingExitCode(posted.code, [...followups, deferredPosted]),
+            postRepliesExitCode: posted.code,
+            followups,
+            postReplies: posted.out
+                .split("\n")
+                .filter((l) => l.startsWith("final:"))
+                .join(" "),
+        },
+    });
+
+    process.exitCode = postingExitCode(posted.code, [...followups, deferredPosted]);
+}
+
+if (import.meta.main) {
+    await main();
+}
diff --git a/.claude/skills/babysit/scripts/judge-pack.ts b/.claude/skills/babysit/scripts/judge-pack.ts
new file mode 100644
index 0000000000..0d30d146c6
--- /dev/null
+++ b/.claude/skills/babysit/scripts/judge-pack.ts
@@ -0,0 +1,121 @@
+#!/usr/bin/env bun
+/**
+ * Everything the judge reads for one worker round, in one file: the worker's claims (each reply item with its
+ * verdict and the reply text it wants posted), the refusals and deferrals flagged, then the full diff with the test
+ * files first (removed assertions are guilty until explained). Read it whole before the push (judging.md).
+ *
+ *   bun judge-pack.ts --wt <worktree> --range <a>..<b> --replies <json> [--report <worker-final.txt>] [--out <file>]
+ */
+import { readFileSync, writeFileSync } from "node:fs";
+import { SafeJSON } from "@genesiscz/utils/json";
+import { flag } from "./run";
+
+interface ReplyItem {
+    ref?: string;
+    verdict: string;
+    where: string;
+    title: string;
+    context: string;
+    howFixed?: string;
+    reply: string;
+    commits?: string[];
+    confidence?: number;
+}
+
+const wt = flag("--wt") ?? ".";
+const range = flag("--range") ?? "HEAD~1..HEAD";
+const repliesPath = flag("--replies");
+const out: string[] = [];
+const report = flag("--report");
+out.push(
+    "# Worker final report",
+    "",
+    report ? readFileSync(report, "utf8") : "⚠ Worker report missing: rerun with --report <file> before judging.",
+    ""
+);
+const git = (args: string[]): string => {
+    const result = Bun.spawnSync(["git", "-C", wt, ...args], { stdout: "pipe", stderr: "pipe" });
+
+    if (result.exitCode !== 0) {
+        throw new Error(`git ${args.join(" ")} failed (exit ${result.exitCode}): ${result.stderr.toString().trim()}`);
+    }
+
+    return result.stdout.toString();
+};
+
+if (repliesPath) {
+    const r = SafeJSON.parse(readFileSync(repliesPath, "utf8"), { strict: true }) as {
+        pr: number;
+        round: number;
+        model: string;
+        intro: string;
+        items: ReplyItem[];
+    };
+    out.push(`# Claims: PR #${r.pr} round ${r.round} by ${r.model}`, "", r.intro, "");
+    const flagged: string[] = [];
+
+    for (const i of r.items) {
+        const refusal = i.verdict !== "fixed";
+        out.push(
+            `## ${i.ref ?? "(no thread)"} ${i.verdict} ${i.where}${refusal ? "  ⚠ REFUSAL/DEFERRAL: check it" : ""}`,
+            `- title: ${i.title}`,
+            `- context: ${i.context}`
+        );
+
+        if (i.howFixed) {
+            out.push(`- howFixed: ${i.howFixed}`);
+        }
+
+        out.push(
+            `- reply: ${i.reply}`,
+            `- commits: ${(i.commits ?? []).join(", ") || "-"}  confidence ${i.confidence}`,
+            ""
+        );
+
+        if (refusal) {
+            flagged.push(`${i.ref ?? "-"} ${i.verdict} ${i.where}: ${i.title}`);
+        }
+
+        if (/follow.?up|later|separate PR|out of scope|future/i.test(`${i.reply} ${i.howFixed ?? ""}`)) {
+            flagged.push(`${i.ref ?? "-"} mentions a deferral: ${i.where}`);
+        }
+    }
+
+    out.push("# Refusals and deferrals to judge", ...(flagged.length ? flagged.map((x) => `- ${x}`) : ["- none"]), "");
+}
+
+out.push(
+    `# Diff ${range}`,
+    "",
+    "```",
+    git(["log", "--format=%h %s", range]),
+    git(["diff", "--stat", range]),
+    "```",
+    ""
+);
+const files = git(["diff", "--name-only", "-z", range]).split("\0").filter(Boolean);
+const tests = files.filter((f) => /(\.test\.tsx?|Tests?\.swift|__tests__)/.test(f));
+const sources = files.filter((f) => !tests.includes(f));
+
+for (const [title, group] of [
+    ["Tests (look for weakened or deleted assertions)", tests],
+    ["Sources", sources],
+] as const) {
+    out.push(`## ${title}`, "", "```diff");
+
+    for (const f of group) {
+        out.push(git(["diff", range, "--", f]));
+    }
+
+    out.push("```", "");
+}
+
+const text = out.join("\n");
+const target = flag("--out");
+
+if (target) {
+    writeFileSync(target, text);
+    console.log(`${target}: ${text.split("\n").length} lines`);
+} else {
+    process.stdout.write(text);
+}
diff --git a/.claude/skills/babysit/scripts/land.ts b/.claude/skills/babysit/scripts/land.ts
new file mode 100644
index 0000000000..d42079ab75
--- /dev/null
+++ b/.claude/skills/babysit/scripts/land.ts
@@ -0,0 +1,311 @@
+#!/usr/bin/env bun
+/**
+ * The landing recipe (SKILL.md step 7b) as one command, for a PR whose landing Martin approved and whose gates the
+ * lead checked: squash the top `#<N> followup` commits into one, prove the tree identical, check the subjects, then
+ * with --merge run the personal-data probe, push with a lease, wait for GitHub to see the new head and merge with
+ * `tools github merge --rebase`. Every git call is an argument array: a hand-typed `--force-with-lease=$B:c1a…`
+ * in zsh read `:c` as a modifier and pushed without the lease (2026-10-14, #502).
+ *
+ *   bun land.ts --run <dir> --pr <N> [--wt <dir>] [--merge] [--no-push-hooks] [--max-commits <n>] [--head <sha>]
+ *               [--squash]
+ *
+ * --head: start from a prepared regroup (thematic commits made by hand, step 0 of the recipe) instead of the PR's
+ * remote head. Its tree must equal the remote head's tree, and the push lease is still the remote head. Without it
+ * the script checked out origin/<branch> and threw a regroup away (2026-10-15, #499). --squash merges with
+ * `tools github merge --squash` instead of `--rebase`, for a PR the user asked to squash.
+ *
+ * Without --merge it only prepares and prints the squash in the worktree (detached, nothing pushed). Either way it
+ * moves the worktree's HEAD, so never run it on a worktree a worker is still using (2026-10-14: a dry run landed a
+ * squash commit under a worker that was restoring its head).
+ */
+import { execTool } from "@genesiscz/utils/cli";
+import { env } from "@genesiscz/utils/env";
+import { SafeJSON } from "@genesiscz/utils/json";
+import { appendEvent } from "./ledger";
+import { probeAddedLines } from "./probe";
+import { flag, has, loadRun, worktreeFor } from "./run";
+import { ensureConfigHooks, HOOKS_OFF, newExecutablesStall, prepGit } from "./versions";
+
+export function recordLandingPush(options: {
+    run: string;
+    pr: number;
+    branch: string;
+    oldHead: string;
+    newHead: string;
+    result: { code: number; out: string };
+}): void {
+    if (options.result.code !== 0) {
+        throw new Error("push failed: " + options.result.out);
+    }
+
+    appendEvent(options.run, {
+        kind: "push",
+        pr: options.pr,
+        text: "Landing push to " + options.branch,
+        meta: { branch: options.branch, from: options.oldHead, to: options.newHead, source: "land.ts" },
+    });
+}
+
+async function main(): Promise<void> {
+    const run = loadRun();
+    const genesisTools = run.repo === "genesiscz/GenesisTools";
+    const pr = Number(flag("--pr"));
+
+    if (!Number.isInteger(pr) || pr <= 0) {
+        console.error("usage: land.ts --run <dir> --pr <N> [--wt <dir>] [--merge] [--no-push-hooks]");
+        process.exit(2);
+    }
+
+    const wt = flag("--wt") ?? worktreeFor(run, pr);
+    const git = prepGit(wt);
+    const main = prepGit(run.main);
+
+    function must(result: { code: number; out: string }, what: string): string {
+        if (result.code !== 0) {
+            console.error(`✖ ${what}: ${result.out.trim().slice(0, 400)}`);
+            process.exit(1);
+        }
+
+        return result.out.trim();
+    }
+
+    let githubDeadline = Date.now() + 30_000;
+    function spawnIn(cwd: string, cmd: string[]): { code: number; out: string; timedOut: boolean } {
+        const github = cmd[0] === "gh";
+        if (github && Date.now() >= githubDeadline) {
+            return { code: 124, out: "GitHub read deadline expired; not merging", timedOut: true };
+        }
+        const p = Bun.spawnSync(cmd, {
+            cwd,
+            stdout: "pipe",
+            stderr: "pipe",
+            env: env.getProcessEnv(),
+            timeout: github ? Math.max(1, githubDeadline - Date.now()) : 600_000,
+            killSignal: "SIGKILL",
+        });
+        const timedOut = github && (Date.now() >= githubDeadline || p.signalCode === "SIGKILL");
+        return {
+            code: timedOut ? 124 : (p.exitCode ?? 1),
+            out: timedOut
+                ? "GitHub read deadline expired; not merging"
+                : `${p.stdout.toString()}${p.stderr.toString()}`,
+            timedOut,
+        };
+    }
+
+    const dirty = must(git(["status", "--porcelain", "--untracked-files=no"]), "worktree status");
+    if (dirty) {
+        console.error(
+            `✖ worktree has uncommitted tracked or staged changes; leaving HEAD and index untouched:\n${dirty}`
+        );
+        process.exit(1);
+    }
+
+    const view = must(
+        spawnIn(run.main, [
+            "gh",
+            "pr",
+            "view",
+            String(pr),
+            "--json",
+            "headRefName,baseRefName,state",
+            "--repo",
+            run.repo,
+        ]),
+        "gh pr view"
+    );
+    const {
+        headRefName: branch,
+        baseRefName: base,
+        state,
+    } = SafeJSON.parse(view, { strict: true }) as {
+        headRefName: string;
+        baseRefName: string;
+        state: string;
+    };
+
+    if (state !== "OPEN") {
+        console.error(`✖ #${pr} is ${state}`);
+        process.exit(1);
+    }
+
+    must(git(["fetch", "-q", "origin", base, branch]), "fetch");
+    const prepared = flag("--head");
+    must(git(["checkout", "-q", "--detach", prepared ?? `origin/${branch}`]), "checkout");
+    const oldHead = must(git(["rev-parse", `origin/${branch}`]), "rev-parse");
+    const tree = must(git(["rev-parse", `origin/${branch}^{tree}`]), "tree");
+
+    if (prepared && must(git(["rev-parse", "HEAD^{tree}"]), "tree") !== tree) {
+        console.error(`✖ --head ${prepared} has another tree than origin/${branch}; a regroup must keep the tree`);
+        process.exit(1);
+    }
+
+    // The review commits are the contiguous `#N followup` commits on top of the feature commits.
+    const marker = new RegExp(`#${pr} followup\\b`);
+    const commits = must(git(["log", "--format=%H%x09%s", `origin/${base}..HEAD`]), "log")
+        .split("\n")
+        .filter(Boolean)
+        .map((line) => ({ sha: line.slice(0, 40), subject: line.slice(41) }));
+    const review = commits
+        .slice(
+            0,
+            Math.max(
+                0,
+                commits.findIndex((c) => !marker.test(c.subject))
+            )
+        )
+        .reverse();
+    const reviewAll = review.length === 0 && commits.length > 0 && commits.every((c) => marker.test(c.subject));
+
+    if (reviewAll) {
+        console.error(`✖ every commit of #${pr} is a followup: no feature commit to squash onto`);
+        process.exit(1);
+    }
+
+    if (review.length >= 2) {
+        const scopes = [...new Set(review.flatMap((c) => /^\w+\(([^)]+)\)/.exec(c.subject)?.[1].split(/,\s*/) ?? []))];
+        const message = [
+            `fix(${scopes.join(", ")}): #${pr} followup - address PR review (${review.length} commits)`,
+            "",
+            ...review.map((c) => `- ${c.sha.slice(0, 9)} ${c.subject}`),
+            "",
+        ].join("\n");
+
+        const stalled = await newExecutablesStall();
+        if (stalled) {
+            console.log("squash commit hooks disabled: new executables stall");
+        } else {
+            console.log(`hooks: ${ensureConfigHooks(wt)}`);
+        }
+
+        must(git(["reset", "-q", "--soft", `${review[0].sha}~1`]), "reset --soft");
+        const commit = ["commit", "-q", "-m", message];
+        must(stalled ? git(commit) : spawnIn(wt, ["git", ...commit]), "commit");
+
+        if (must(git(["rev-parse", "HEAD^{tree}"]), "tree") !== tree) {
+            console.error("✖ the squash changed the tree; nothing pushed");
+            process.exit(1);
+        }
+
+        console.log(
+            `✔ squashed ${review.length} review commits into ${must(git(["rev-parse", "--short", "HEAD"]), "")}`
+        );
+    } else {
+        console.log(`= ${review.length} review commit(s): nothing to squash`);
+    }
+
+    if (genesisTools) {
+        must(spawnIn(wt, ["bun", "scripts/git/check-commits.ts", `origin/${base}..HEAD`]), "check-commits");
+    } else {
+        for (const command of run.verify ?? []) {
+            must(spawnIn(wt, ["/bin/sh", "-c", command]), "run-card verify");
+        }
+    }
+
+    // Optional, only when a commit limit was asked for this PR (--max-commits <n>): there is no default limit. Regroup a
+    // longer history into thematic commits with the same final tree first; this script never invents groups.
+    const maxCommits = flag("--max-commits");
+
+    if (maxCommits !== undefined) {
+        const count = Number(must(git(["rev-list", "--count", `origin/${base}..HEAD`]), "count"));
+
+        if (count > Number(maxCommits)) {
+            console.error(`✖ #${pr} has ${count} commits after the review squash; --max-commits is ${maxCommits}.`);
+            process.exit(1);
+        }
+    }
+
+    const newHead = must(git(["rev-parse", "HEAD"]), "rev-parse");
+    if (!genesisTools && newHead !== oldHead && !probeAddedLines({ wt, from: oldHead, to: newHead })) {
+        process.exit(1);
+    }
+
+    if (!has("--merge")) {
+        console.log(
+            `dry: #${pr} would push ${newHead.slice(0, 9)} over ${oldHead.slice(0, 9)} and merge with ${has("--squash") ? "--squash" : "--rebase"}`
+        );
+        process.exit(0);
+    }
+
+    if (newHead !== oldHead) {
+        if (genesisTools) {
+            must(spawnIn(wt, ["bash", "scripts/ci/placeholder-check.sh"]), "placeholder-check");
+        }
+        console.log(`hooks: ${ensureConfigHooks(run.main)}`);
+        const stalled = has("--no-push-hooks") && (await newExecutablesStall());
+
+        if (has("--no-push-hooks") && !stalled) {
+            console.log("= --no-push-hooks ignored: new executables start normally, so the push hooks run");
+        }
+
+        const hooks = stalled ? HOOKS_OFF : [];
+        const push = spawnIn(wt, [
+            "git",
+            ...hooks,
+            "push",
+            "-q",
+            `--force-with-lease=refs/heads/${branch}:${oldHead}`,
+            "origin",
+            `${newHead}:refs/heads/${branch}`,
+        ]);
+        must(push, "push");
+        recordLandingPush({ run: run.dir, pr, branch, oldHead, newHead, result: push });
+        console.log(`✔ pushed ${branch} ${oldHead.slice(0, 9)}..${newHead.slice(0, 9)}`);
+    }
+
+    // `tools github merge` compares against the local remote ref and against what GitHub reports.
+    must(main(["fetch", "-q", "origin", base, branch]), "fetch in the main checkout");
+    const deadline = Date.now() + 120_000;
+    githubDeadline = deadline;
+
+    while (true) {
+        const head = spawnIn(run.main, [
+            "gh",
+            "pr",
+            "view",
+            String(pr),
+            "--json",
+            "headRefOid",
+            "--jq",
+            ".headRefOid",
+            "--repo",
+            run.repo,
+        ]);
+
+        if (head.timedOut || Date.now() >= deadline) {
+            console.error(`✖ GitHub still reports ${head.out.trim().slice(0, 9)} for #${pr} after 120 s; not merging`);
+            process.exit(1);
+        }
+
+        must(head, "GitHub head read");
+        if (head.out.trim() === newHead) {
+            break;
+        }
+
+        await Bun.sleep(Math.min(5_000, Math.max(0, deadline - Date.now())));
+    }
+
+    const method = has("--squash") ? "--squash" : "--rebase";
+    const merged = await execTool(["github", "merge", method, String(pr), "--repo", run.repo], {
+        cwd: run.main,
+        timeout: 600_000,
+    });
+    console.log(merged.stdout.trim().split("\n").slice(-8).join("\n"));
+
+    if (!merged.success) {
+        console.error(`✖ merge failed: ${merged.stderr.trim().slice(-400)}`);
+        process.exit(1);
+    }
+
+    const sha = /sha:\s+([0-9a-f]{40})/.exec(merged.stdout)?.[1];
+    appendEvent(run.dir, {
+        kind: "note",
+        pr,
+        text: `Merged into ${base} ${sha?.slice(0, 9) ?? "(sha not printed)"} by land.ts (${review.length} review commits squashed, tree identical).`,
+    });
+    console.log(`✔ #${pr} merged into ${base} ${sha?.slice(0, 9) ?? ""}`);
+}
+
+if (import.meta.main) {
+    await main();
+}
diff --git a/.claude/skills/babysit/scripts/ledger.ts b/.claude/skills/babysit/scripts/ledger.ts
new file mode 100644
index 0000000000..446a652ee8
--- /dev/null
+++ b/.claude/skills/babysit/scripts/ledger.ts
@@ -0,0 +1,236 @@
+#!/usr/bin/env bun
+/**
+ * The babysit run ledger: one JSONL event per line, appended as the run goes, rendered to Markdown on demand.
+ * Everything a reader needs to audit a run sits in it: every prompt a worker got (spawn and steer, full text),
+ * each worker turn's final message, the judge's verdict and findings, corrections, pushes and posts.
+ * (Martin, 2026-10-14: "all the steers, the agent's final messages, the prompts / inputs / judge rounds".)
+ *
+ *   bun ledger.ts append --run <dir> --kind <kind> [--pr N] [--round N] [--worker name] [--model m]
+ *                        [--text "…" | --file <path>] [--meta '{"k":"v"}'] [--at <ISO time>]
+ *   bun ledger.ts render --run <dir> [--out <file.md>] [--pr N]
+ *
+ * Kinds: spawn, steer, turn (a worker turn ended: its final message), judge (verdict + findings), correction,
+ * push, post, decision, incident, note. The ledger is `<run>/ledger.jsonl`; text is stored whole, the Markdown
+ * folds long text into <details> so the page stays readable.
+ */
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { SafeJSON } from "@genesiscz/utils/json";
+
+export const LEDGER_KINDS = [
+    "spawn",
+    "steer",
+    "turn",
+    "judge",
+    "correction",
+    "push",
+    "post",
+    "decision",
+    "incident",
+    "note",
+] as const;
+export type LedgerKind = (typeof LEDGER_KINDS)[number];
+
+export interface LedgerEvent {
+    at: string;
+    kind: LedgerKind;
+    pr?: number;
+    round?: number;
+    worker?: string;
+    model?: string;
+    text?: string;
+    meta?: Record<string, unknown>;
+}
+
+export function ledgerPath(run: string): string {
+    return join(run, "ledger.jsonl");
+}
+
+export function appendEvent(run: string, event: Omit<LedgerEvent, "at"> & { at?: string }): LedgerEvent {
+    mkdirSync(run, { recursive: true });
+    const full: LedgerEvent = { at: event.at ?? new Date().toISOString(), ...event } as LedgerEvent;
+    appendFileSync(ledgerPath(run), `${SafeJSON.stringify(full, { strict: true })}\n`);
+    return full;
+}
+
+export function readEvents(run: string): LedgerEvent[] {
+    const path = ledgerPath(run);
+
+    if (!existsSync(path)) {
+        return [];
+    }
+
+    const events: LedgerEvent[] = [];
+
+    for (const line of readFileSync(path, "utf8").split("\n")) {
+        if (!line.trim()) {
+            continue;
+        }
+
+        try {
+            events.push(SafeJSON.parse(line, { strict: true }) as LedgerEvent);
+        } catch {
+            events.push({ at: "", kind: "note", text: `(unreadable ledger line) ${line.slice(0, 200)}` });
+        }
+    }
+
+    return events.sort((a, b) => a.at.localeCompare(b.at));
+}
+
+const LOCAL = new Intl.DateTimeFormat("cs-CZ", {
+    timeZone: "Europe/Prague",
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit",
+});
+const ICON: Record<LedgerKind, string> = {
+    spawn: "🚀",
+    steer: "➡️",
+    turn: "🗣️",
+    judge: "⚖️",
+    correction: "🔧",
+    push: "⬆️",
+    post: "💬",
+    decision: "❓",
+    incident: "🛑",
+    note: "📝",
+};
+
+function fold(text: string, summary: string): string[] {
+    if (text.length <= 600 && text.split("\n").length <= 8) {
+        return ["", text.trim(), ""];
+    }
+
+    return [
+        "",
+        `<details><summary>${summary} (${text.split("\n").length} lines)</summary>`,
+        "",
+        "````text",
+        text.trim(),
+        "````",
+        "",
+        "</details>",
+        "",
+    ];
+}
+
+function renderEvent(e: LedgerEvent): string[] {
+    const out: string[] = [];
+    const who = [e.worker, e.model].filter(Boolean).join(", ");
+    const date = new Date(e.at);
+    const time = Number.isNaN(date.getTime()) ? "unknown time" : LOCAL.format(date);
+    const head = `### ${ICON[e.kind]} ${time} ${e.kind}${e.round !== undefined ? ` · round ${e.round}` : ""}${who ? ` · ${who}` : ""}`;
+    out.push(head);
+    if (e.meta && Object.keys(e.meta).length) {
+        out.push(
+            "",
+            ...Object.entries(e.meta).map(
+                ([k, v]) => `- **${k}**: ${typeof v === "string" ? v : SafeJSON.stringify(v, { strict: true })}`
+            )
+        );
+    }
+
+    if (e.text) {
+        out.push(
+            ...fold(
+                e.text,
+                e.kind === "steer" || e.kind === "spawn"
+                    ? "prompt"
+                    : e.kind === "turn"
+                      ? "worker's final message"
+                      : "text"
+            )
+        );
+    } else {
+        out.push("");
+    }
+    return out;
+}
+
+export function renderMarkdown(events: LedgerEvent[], options: { title?: string; pr?: number } = {}): string {
+    const shown = options.pr === undefined ? events : events.filter((e) => e.pr === options.pr || e.pr === undefined);
+    const prs = [...new Set(shown.map((e) => e.pr).filter((p): p is number => p !== undefined))].sort((a, b) => a - b);
+    const out: string[] = [`# ${options.title ?? "Babysit run ledger"}`, ""];
+
+    out.push(
+        "## Overview",
+        "",
+        "| PR | Rounds pushed | Last verdict | Steers | Worker turns |",
+        "|---|---|---|---|---|"
+    );
+    for (const pr of prs) {
+        const mine = shown.filter((e) => e.pr === pr);
+        const pushes = mine.filter((e) => e.kind === "push").map((e) => `r${e.round ?? "?"}`);
+        const lastJudge = [...mine].reverse().find((e) => e.kind === "judge");
+        out.push(
+            `| #${pr} | ${pushes.join(", ") || "-"} | ${String(lastJudge?.meta?.verdict ?? "-")} | ${mine.filter((e) => e.kind === "steer" || e.kind === "spawn").length} | ${mine.filter((e) => e.kind === "turn").length} |`
+        );
+    }
+
+    out.push("");
+
+    const general = shown.filter((e) => e.pr === undefined);
+    if (general.length) {
+        out.push("## Run-wide events", "");
+        for (const e of general) {
+            out.push(...renderEvent(e));
+        }
+    }
+
+    for (const pr of prs) {
+        out.push(`## PR #${pr}`, "");
+        for (const e of shown.filter((x) => x.pr === pr)) {
+            out.push(...renderEvent(e));
+        }
+    }
+
+    return `${out.join("\n").replace(/\n{3,}/g, "\n\n")}\n`;
+}
+
+if (import.meta.main) {
+    const [verb, ...rest] = process.argv.slice(2);
+    const arg = (n: string) => {
+        const i = rest.indexOf(n);
+        return i >= 0 ? rest[i + 1] : undefined;
+    };
+    const run = arg("--run");
+
+    if (!run || (verb !== "append" && verb !== "render")) {
+        console.error("usage: ledger.ts append|render --run <dir> …  (see the header)");
+        process.exit(2);
+    }
+
+    if (verb === "append") {
+        const kind = arg("--kind") as LedgerKind | undefined;
+
+        if (!kind || !LEDGER_KINDS.includes(kind)) {
+            console.error(`--kind must be one of: ${LEDGER_KINDS.join(", ")}`);
+            process.exit(2);
+        }
+
+        const file = arg("--file");
+        const meta = arg("--meta");
+        const event = appendEvent(run, {
+            kind,
+            ...(arg("--at") ? { at: arg("--at") } : {}),
+            ...(arg("--pr") ? { pr: Number(arg("--pr")) } : {}),
+            ...(arg("--round") ? { round: Number(arg("--round")) } : {}),
+            ...(arg("--worker") ? { worker: arg("--worker") } : {}),
+            ...(arg("--model") ? { model: arg("--model") } : {}),
+            ...(file ? { text: readFileSync(file, "utf8") } : arg("--text") ? { text: arg("--text") } : {}),
+            ...(meta ? { meta: SafeJSON.parse(meta, { strict: true }) as Record<string, unknown> } : {}),
+        });
+        console.log(`ledger: ${event.kind}${event.pr ? ` #${event.pr}` : ""} at ${event.at}`);
+    } else {
+        const pr = arg("--pr");
+        const md = renderMarkdown(readEvents(run), { ...(pr ? { pr: Number(pr) } : {}) });
+        const target = arg("--out");
+
+        if (target) {
+            writeFileSync(target, md);
+            console.log(`${target}: ${md.split("\n").length} lines`);
+        } else {
+            process.stdout.write(md);
+        }
+    }
+}
diff --git a/.claude/skills/babysit/scripts/link-native.ts b/.claude/skills/babysit/scripts/link-native.ts
new file mode 100644
index 0000000000..cf16374129
--- /dev/null
+++ b/.claude/skills/babysit/scripts/link-native.ts
@@ -0,0 +1,103 @@
+#!/usr/bin/env bun
+/**
+ * Point each native file (Mach-O executable, .node, .dylib) in a worktree's node_modules at the main checkout's
+ * byte-identical twin with a symlink. On 2026-10-14 syspolicyd sat at 100% CPU and blocked the first exec or dlopen
+ * of every NEW native file, so a fresh worktree's tsgo, biome and native add-ons hung at _dyld_start; the main
+ * checkout's copies had been assessed before and ran at once. Harmless when syspolicyd is healthy.
+ *
+ *   bun link-native.ts --main <checkout> <worktree> [...]
+ */
+import { lstatSync, readdirSync, readFileSync, rmSync, symlinkSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+
+const MACHO_MAGIC = new Set(["cffaedfe", "cefaedfe", "cafebabe", "bebafeca"]);
+
+function isNative(path: string, mode: number, size: number): boolean {
+    if (!(mode & 0o111) && !/\.(node|dylib|so)$/.test(path)) {
+        return false;
+    }
+
+    if (size <= 4096) {
+        return false;
+    }
+
+    try {
+        return MACHO_MAGIC.has(readFileSync(path).subarray(0, 4).toString("hex"));
+    } catch {
+        return false;
+    }
+}
+
+export function linkNativeFiles(options: { worktree: string; main: string }): { linked: number; differ: number } {
+    const worktree = resolve(options.worktree);
+    const main = resolve(options.main);
+    let linked = 0;
+    let differ = 0;
+    const stack = [join(worktree, "node_modules")];
+
+    while (stack.length) {
+        const dir = stack.pop() as string;
+        let names: string[] = [];
+
+        try {
+            names = readdirSync(dir);
+        } catch {
+            continue;
+        }
+
+        for (const name of names) {
+            const path = join(dir, name);
+            const st = lstatSync(path);
+
+            if (st.isSymbolicLink()) {
+                continue;
+            }
+
+            if (st.isDirectory()) {
+                stack.push(path);
+                continue;
+            }
+
+            if (!st.isFile() || !isNative(path, st.mode, st.size)) {
+                continue;
+            }
+
+            const twin = join(main, relative(worktree, path));
+
+            try {
+                if (!readFileSync(twin).equals(readFileSync(path))) {
+                    differ++;
+                    continue;
+                }
+            } catch {
+                differ++;
+                continue;
+            }
+
+            rmSync(path);
+            symlinkSync(twin, path);
+            linked++;
+        }
+    }
+
+    return { linked, differ };
+}
+
+if (import.meta.main) {
+    const args = process.argv.slice(2);
+    const mainIndex = args.indexOf("--main");
+
+    if (mainIndex < 0 || !args[mainIndex + 1]) {
+        console.error("usage: link-native.ts --main <checkout> <worktree> [...]");
+        process.exit(2);
+    }
+
+    const main = args[mainIndex + 1];
+
+    for (const worktree of args.filter((_, i) => i !== mainIndex && i !== mainIndex + 1)) {
+        const { linked, differ } = linkNativeFiles({ worktree, main });
+        console.log(
+            `${worktree}: linked ${linked} native files to the main checkout, ${differ} differ or have no twin`
+        );
+    }
+}
diff --git a/.claude/skills/babysit/scripts/pick-unified.ts b/.claude/skills/babysit/scripts/pick-unified.ts
new file mode 100644
index 0000000000..7e7bfcfc74
--- /dev/null
+++ b/.claude/skills/babysit/scripts/pick-unified.ts
@@ -0,0 +1,107 @@
+#!/usr/bin/env bun
+/**
+ * Carry judged round commits onto the integration branch, in order, in the checkout that has it. A commit already
+ * there (same patch) is skipped; a conflict in only the plugin version files resolves to the higher version; any other
+ * conflict aborts that one pick and is listed, for a worker in a scratch worktree of the branch (versions.ts).
+ *
+ *   bun pick-unified.ts --branch <integration branch> [--repo <checkout>] <sha> [<sha> ...]
+ *
+ * Refuses to start unless <checkout> is on <branch> with a clean tree. Exit 1 when any pick conflicted.
+ */
+import { flag } from "./run";
+import { conflictedFiles, type GitRun, prepGit, resolveVersionConflicts } from "./versions";
+
+export function continueVersionPick(git: GitRun): { code: number; out: string; skipped?: boolean } {
+    const continued = git(["cherry-pick", "--continue"]);
+    if (continued.code === 0) {
+        return continued;
+    }
+
+    // Only a live single-pick state with no conflicts and an empty index can be skipped.
+    const state = git(["rev-parse", "--verify", "CHERRY_PICK_HEAD"]);
+    const unmerged = git(["ls-files", "-u"]);
+    const index = git(["diff", "--cached", "--quiet", "HEAD", "--"]);
+    if (state.code !== 0 || unmerged.code !== 0 || unmerged.out.trim() || index.code !== 0) {
+        return continued;
+    }
+
+    const skipped = git(["cherry-pick", "--skip"]);
+    return skipped.code === 0
+        ? { ...skipped, skipped: true }
+        : { code: skipped.code, out: continued.out + skipped.out };
+}
+
+function main(): void {
+    const branch = flag("--branch") ?? "";
+    const repo = flag("--repo") ?? process.cwd();
+    const shas = process.argv.slice(2).filter((arg, i, all) => !arg.startsWith("--") && !all[i - 1]?.startsWith("--"));
+
+    if (!branch || shas.length === 0) {
+        console.error("usage: pick-unified.ts --branch <integration branch> [--repo <checkout>] <sha> [<sha> ...]");
+        process.exit(2);
+    }
+
+    const git = prepGit(repo);
+
+    if (git(["rev-parse", "--abbrev-ref", "HEAD"]).out.trim() !== branch) {
+        console.error(`✖ ${repo} is not on ${branch}`);
+        process.exit(1);
+    }
+
+    let conflicts = 0;
+
+    for (const sha of shas) {
+        if (git(["status", "--porcelain", "--untracked-files=no"]).out.trim()) {
+            console.error("✖ the working tree is not clean; stopping");
+            process.exit(1);
+        }
+
+        const subject = git(["log", "-1", "--format=%s", sha]).out.trim().slice(0, 90);
+
+        if (
+            git(["cherry", "HEAD", sha, `${sha}~1`])
+                .out.trim()
+                .startsWith("-")
+        ) {
+            console.log(`= ${sha} already on ${branch}: ${subject}`);
+            continue;
+        }
+
+        if (git(["cherry-pick", "-x", sha]).code === 0) {
+            console.log(`✔ ${sha} → ${git(["rev-parse", "--short", "HEAD"]).out.trim()}: ${subject}`);
+            continue;
+        }
+
+        const conflicted = conflictedFiles(git);
+
+        if (resolveVersionConflicts(git, conflicted)) {
+            const result = continueVersionPick(git);
+            if (result.code !== 0) {
+                console.error("\u2716 " + sha + " continuation failed; pick preserved: " + result.out.trim());
+                process.exit(1);
+            }
+
+            console.log(
+                result.skipped
+                    ? "= " + sha + " empty after the version resolution, skipped: " + subject
+                    : "\u2714 " +
+                          sha +
+                          " \u2192 " +
+                          git(["rev-parse", "--short", "HEAD"]).out.trim() +
+                          " (version files): " +
+                          subject
+            );
+            continue;
+        }
+
+        git(["cherry-pick", "--abort"]);
+        conflicts++;
+        console.log(`✖ ${sha} CONFLICT [${conflicted.join(", ")}]: ${subject}`);
+    }
+
+    process.exit(conflicts > 0 ? 1 : 0);
+}
+
+if (import.meta.main) {
+    main();
+}
diff --git a/.claude/skills/babysit/scripts/plant.ts b/.claude/skills/babysit/scripts/plant.ts
new file mode 100644
index 0000000000..93de5f8470
--- /dev/null
+++ b/.claude/skills/babysit/scripts/plant.ts
@@ -0,0 +1,198 @@
+#!/usr/bin/env bun
+/**
+ * The planted-regression check for a fix round: put the pre-fix version of the fixed sources back, run the tests (they
+ * must FAIL), restore the fixed files, run them again (they must PASS), and prove the worktree is as it was.
+ *
+ *   bun plant.ts --wt <worktree> --file <path> [--file <path>…] [--from HEAD~1] --test "<test paths>"
+ *   bun plant.ts --wt <worktree> --file <path> --swift-package <dir> --swift-filter <Class[/test]>
+ *
+ * Exit 0 only when the planted run failed and the fixed run passed. Hand-written plant loops went wrong twice on
+ * 2026-10-14: an unsplit zsh variable ran no test at all, and a `shift` in a shell function sent every backup to a
+ * bad path while the old version was still written, which left the pre-fix code in two worktrees.
+ */
+import { copyFileSync, mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { stripVTControlCharacters } from "node:util";
+import { env } from "@genesiscz/utils/env";
+
+function flags(name: string): string[] {
+    const found: string[] = [];
+
+    for (let i = 2; i < process.argv.length; i++) {
+        if (process.argv[i] === name && process.argv[i + 1] !== undefined) {
+            found.push(process.argv[i + 1]);
+        }
+    }
+
+    return found;
+}
+
+function exec(cmd: string[], cwd: string): { code: number; out: string } {
+    const p = Bun.spawnSync(cmd, { cwd, stdout: "pipe", stderr: "pipe", env: env.getProcessEnv() });
+    return { code: p.exitCode ?? 1, out: `${p.stdout.toString()}${p.stderr.toString()}` };
+}
+
+function counts(out: string) {
+    const text = stripVTControlCharacters(out);
+    const bun = [...text.matchAll(/^\s*(\d+) (pass|fail)\s*$/gm)];
+    const swift = [...text.matchAll(/Executed (\d+) tests?, with (?:\d+ tests? skipped and )?(\d+) failures?[^\n]*/g)];
+    return {
+        text,
+        bun,
+        swift,
+        pass: bun.reduce((total, match) => total + (match[2] === "pass" ? Number(match[1]) : 0), 0),
+        fail: bun.reduce((total, match) => total + (match[2] === "fail" ? Number(match[1]) : 0), 0),
+    };
+}
+
+/** The pass and fail counts a test run printed (bun or the final XCTest total). */
+export function summarize(out: string): string {
+    const parsed = counts(out);
+    if (parsed.bun.length > 0) {
+        return parsed.bun.map((match) => match[1] + " " + match[2]).join(" ");
+    }
+
+    return parsed.swift.at(-1)?.[0] ?? "no test count";
+}
+
+function loadFailure(result: { code: number; out: string }): boolean {
+    const parsed = counts(result.out);
+    return (
+        result.code !== 0 &&
+        parsed.pass === 0 &&
+        !parsed.swift.some((match) => Number(match[1]) > 0) &&
+        /Unhandled error between tests|SyntaxError|error:.*(?:Cannot find|Could not resolve|No matching export)/i.test(
+            parsed.text
+        )
+    );
+}
+
+export function testEvidence(result: { code: number; out: string }, failing: boolean): boolean {
+    const { code, out } = result;
+    const parsed = counts(out);
+    if (failing) {
+        return (
+            code !== 0 &&
+            !loadFailure(result) &&
+            (parsed.fail > 0 || parsed.swift.some((match) => Number(match[1]) > 0 && Number(match[2]) > 0))
+        );
+    }
+
+    // A test may log an expected compiler/import error. Completed counts decide; no counts cannot pass.
+    if (code !== 0) {
+        return false;
+    }
+
+    if (parsed.bun.length > 0) {
+        return parsed.pass > 0 && parsed.fail === 0 && parsed.text.includes("[test] suite complete (exit 0)");
+    }
+
+    return parsed.swift.some((match) => Number(match[1]) > 0) && parsed.swift.every((match) => Number(match[2]) === 0);
+}
+
+if (import.meta.main) {
+    const wt = flags("--wt")[0];
+    const files = flags("--file");
+    const from = flags("--from")[0] ?? "HEAD~1";
+    const tests = (flags("--test")[0] ?? "").split(/\s+/).filter(Boolean);
+    const swiftPackage = flags("--swift-package")[0];
+    const swiftFilter = flags("--swift-filter")[0];
+
+    if (!wt || files.length === 0 || (tests.length === 0 && !(swiftPackage && swiftFilter))) {
+        console.error(
+            'usage: plant.ts --wt <dir> --file <path>… [--from HEAD~1] (--test "<paths>" | --swift-package <dir> --swift-filter <f>)'
+        );
+        process.exit(2);
+    }
+
+    const runTests = (): { code: number; out: string } =>
+        swiftPackage && swiftFilter
+            ? exec(
+                  [
+                      "bun",
+                      join(import.meta.dir, "swift-slot.ts"),
+                      "--wait-minutes",
+                      "40",
+                      "--run-minutes",
+                      "60",
+                      "--",
+                      "swift",
+                      "test",
+                      "--filter",
+                      swiftFilter,
+                  ],
+                  join(wt, swiftPackage)
+              )
+            : exec(["bun", "scripts/test.ts", ...tests], wt);
+
+    const before = exec(["git", "status", "--short", "--untracked-files=no"], wt).out;
+    const backup = mkdtempSync(join(env.get("TMPDIR") ?? "/tmp", "babysit-plant-"));
+    const old = new Map<string, string>();
+
+    // Read every old version and back up every fixed file BEFORE writing anything: a miss stops with nothing changed.
+    for (const [i, file] of files.entries()) {
+        const shown = exec(["git", "show", `${from}:${file}`], wt);
+
+        if (shown.code !== 0) {
+            console.error(`✖ git show ${from}:${file} failed, nothing planted: ${shown.out.trim().slice(0, 200)}`);
+            process.exit(1);
+        }
+
+        old.set(file, shown.out);
+        mkdirSync(join(backup, String(i)), { recursive: true });
+        copyFileSync(join(wt, file), join(backup, String(i), "fixed"));
+    }
+
+    let planted: { code: number; out: string };
+
+    try {
+        for (const [file, text] of old) {
+            writeFileSync(join(wt, file), text);
+        }
+
+        planted = runTests();
+    } finally {
+        for (const [i, file] of files.entries()) {
+            copyFileSync(join(backup, String(i), "fixed"), join(wt, file));
+        }
+    }
+
+    const after = exec(["git", "status", "--short", "--untracked-files=no"], wt).out;
+
+    if (after !== before) {
+        console.error(`✖ the worktree differs after the restore; the fixed copies are in ${backup}\n${after}`);
+        process.exit(1);
+    }
+
+    const fixed = runTests();
+    await Bun.write(join(backup, "planted.log"), planted.out);
+    await Bun.write(join(backup, "fixed.log"), fixed.out);
+    console.log(`planted (${from}): exit ${planted.code} · ${summarize(planted.out)}`);
+
+    for (const line of planted.out
+        .split("\n")
+        .filter((l) => /^\(fail\)|error: -\[/.test(l))
+        .slice(0, 6)) {
+        console.log(`  ${line.slice(0, 160)}`);
+    }
+
+    console.log(`fixed: exit ${fixed.code} · ${summarize(fixed.out)}`);
+    console.log(`worktree restored as it was · logs in ${backup}`);
+
+    if (loadFailure(planted)) {
+        console.log("✖ the plant broke the test's import, plant a behaviour fault instead");
+        process.exit(1);
+    }
+
+    if (!testEvidence(planted, true)) {
+        console.log("✖ the planted run has no failing-test evidence");
+        process.exit(1);
+    }
+
+    if (!testEvidence(fixed, false)) {
+        console.log("✖ the fixed run has no completed passing-test evidence");
+        process.exit(1);
+    }
+
+    console.log("✔ the tests catch the fault and pass on the fix");
+}
diff --git a/.claude/skills/babysit/scripts/policy.ts b/.claude/skills/babysit/scripts/policy.ts
new file mode 100644
index 0000000000..d81b2543f7
--- /dev/null
+++ b/.claude/skills/babysit/scripts/policy.ts
@@ -0,0 +1,28 @@
+/** One policy for generated worker briefs, judging and reply disposition. Dedicated user reviews are fixed in full. */
+export function roundPolicy(options: { round: number; changedFiles: number; dedicatedReview?: boolean }) {
+    const { round, changedFiles, dedicatedReview = false } = options;
+    if (!Number.isSafeInteger(round) || round < 1 || !Number.isSafeInteger(changedFiles) || changedFiles < 0) {
+        throw new Error("round and changed-file count must be finite integers (round >= 1, files >= 0)");
+    }
+    const throughRound = changedFiles > 100 ? 3 : 2;
+    const fixAll = dedicatedReview || round <= throughRound;
+    const text = [
+        `Round ${round} (${changedFiles} changed files${dedicatedReview ? ", dedicated user review" : ""}): ` +
+            (fixAll ? "fix EVERY valid finding, critical, high, medium and low." : "fix Critical and High findings."),
+        "A valid security finding is always fixed, at any severity and in any round; use the reviewer's Security category.",
+        fixAll
+            ? "Fix every valid finding in this PR, including every file it needs; no deferral is accepted."
+            : 'Other valid Medium/Low findings get an explained reply and stay OPEN. Use verdict "belongs-elsewhere" for the reply transport and explain the policy deferral; integrate posts them with --no-resolve.',
+        "A rejection or no-change needs a cited file:line proving the finding wrong.",
+    ].join(" ");
+    return { fixAll, throughRound, text };
+}
+
+export function shouldFixFinding(policy: { fixAll: boolean }, severity: string, security = false): boolean {
+    return policy.fixAll || security || /^(critical|high)$/i.test(severity);
+}
+
+/** Deferred replies are never included in the batch that resolves threads, regardless of reviewer. */
+export function isDeferredReply(item: { verdict?: unknown; deferred?: unknown }): boolean {
+    return item.deferred === true || item.verdict === "deferred" || item.verdict === "belongs-elsewhere";
+}
diff --git a/.claude/skills/babysit/scripts/probe.ts b/.claude/skills/babysit/scripts/probe.ts
new file mode 100644
index 0000000000..75f6fd3917
--- /dev/null
+++ b/.claude/skills/babysit/scripts/probe.ts
@@ -0,0 +1,197 @@
+/**
+ * The personal-data probe for a push whose full gates do not apply (another repository's PR, `integrate --skip-gates`).
+ * The probe must run before every push, but such a repository can carry older hits that are not the round's doing
+ * (2026-10-14, GenesisPlayground #94: 83 older hits in 34 files). So this runs this checkout's probe on the target
+ * worktree and fails only on a hit in a line the pushed range adds. It prints file and line, never the matched text.
+ */
+
+import { join } from "node:path";
+import { env } from "@genesiscz/utils/env";
+import { SafeJSON } from "@genesiscz/utils/json";
+
+/** Git's core.quotePath=true spelling, matched against known filenames rather than guessing where a path ends. */
+function quotedPath(file: string): string {
+    const escapes: Record<number, string> = {
+        7: "\\a",
+        8: "\\b",
+        9: "\\t",
+        10: "\\n",
+        11: "\\v",
+        12: "\\f",
+        13: "\\r",
+        34: '\\"',
+        92: "\\\\",
+    };
+    return (
+        '"' +
+        [...Buffer.from(file)]
+            .map(
+                (byte) =>
+                    escapes[byte] ??
+                    (byte < 32 || byte >= 127 ? "\\" + byte.toString(8).padStart(3, "0") : String.fromCharCode(byte))
+            )
+            .join("") +
+        '"'
+    );
+}
+
+function probeHits(output: string, files?: readonly string[]): Array<{ file: string; line: number } | null> {
+    const paths = new Map<string, Set<string>>();
+    for (const file of files ?? []) {
+        for (const spelling of [file, quotedPath(file)]) {
+            const matches = paths.get(spelling) ?? new Set<string>();
+            matches.add(file);
+            paths.set(spelling, matches);
+        }
+    }
+    return output
+        .split("\n")
+        .filter((line) => /^ {4}.+/.test(line))
+        .map((line) => {
+            const record = line.slice(4);
+            const candidates = [...record.matchAll(/:(\d+):/g)].flatMap((hit) => {
+                const spelling = record.slice(0, hit.index);
+                const matches = files === undefined ? [spelling] : [...(paths.get(spelling) ?? [])];
+                return matches.map((file) => ({ file, line: Number(hit[1]) }));
+            });
+            return candidates.length === 1 &&
+                (files !== undefined || !candidates[0].file.startsWith('"')) &&
+                Number.isSafeInteger(candidates[0].line) &&
+                candidates[0].line > 0
+                ? candidates[0]
+                : null;
+        });
+}
+
+/** `path:line` for every probe hit that falls on a line `diffU0` (`git diff -U0 a..b`) adds. */
+export function hitsInAddedLines(probeOutput: string, diffU0: string, files?: readonly string[]): string[] {
+    const hits = new Map<string, Set<number>>();
+
+    const parsed = probeHits(probeOutput, files);
+    for (const hit of parsed) {
+        if (!hit) {
+            continue;
+        }
+        const lines = hits.get(hit.file) ?? new Set<number>();
+        lines.add(hit.line);
+        hits.set(hit.file, lines);
+    }
+
+    const found: string[] = parsed.includes(null) ? ["unparseable probe hit"] : [];
+    let file = "";
+
+    for (const line of diffU0.split("\n")) {
+        const header = /^\+\+\+ (.+)$/.exec(line);
+
+        if (header) {
+            let name = header[1].replace(/\t$/, "");
+            if (files) {
+                const matches = files.filter((path) => name === "b/" + path || name === quotedPath("b/" + path));
+                file = matches.length === 1 ? matches[0] : "";
+                if (!file && name !== "/dev/null") {
+                    found.push("unparseable diff path");
+                }
+                continue;
+            }
+            if (name.startsWith('"')) {
+                try {
+                    name = SafeJSON.parse(name, { strict: true });
+                } catch {
+                    found.push("unparseable diff path");
+                    continue;
+                }
+            }
+            file = name.startsWith("b/") ? name.slice(2) : "";
+            if (!file && name !== "/dev/null") {
+                found.push("unparseable diff path");
+            }
+            continue;
+        }
+
+        const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(line);
+
+        if (!hunk) {
+            continue;
+        }
+
+        const start = Number(hunk[1]);
+        const count = hunk[2] === undefined ? 1 : Number(hunk[2]);
+
+        for (let n = start; n < start + count; n++) {
+            if (hits.get(file)?.has(n)) {
+                found.push(`${file}:${n}`);
+            }
+        }
+    }
+
+    return found;
+}
+
+/** Runs the probe on `wt` and reports; returns false when the push must not happen. */
+export function probeAddedLines({ wt, from, to }: { wt: string; from: string; to: string }): boolean {
+    const script = join(import.meta.dir, "../../../../scripts/ci/placeholder-check.sh");
+    const probe = Bun.spawnSync(["bash", script, wt], { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv() });
+    const out = `${probe.stdout.toString()}${probe.stderr.toString()}`;
+
+    if (probe.exitCode === 0) {
+        console.log("✔ personal-data probe: no hit");
+        return true;
+    }
+
+    const older = probeHits(out).length;
+
+    if (probe.exitCode !== 1 || older === 0) {
+        console.log(`✖ personal-data probe exit ${probe.exitCode} with no hit list: it checked nothing`);
+        return false;
+    }
+
+    const tracked = Bun.spawnSync(["git", "ls-files", "-z", "--cached"], {
+        cwd: wt,
+        stdout: "pipe",
+        stderr: "pipe",
+        env: env.getProcessEnv(),
+    });
+    if (tracked.exitCode !== 0) {
+        console.log("✖ personal-data probe: cannot associate hits with tracked filenames");
+        return false;
+    }
+    const files = [...new Set(tracked.stdout.toString().split("\0").filter(Boolean))];
+    const diff = Bun.spawnSync(
+        [
+            "git",
+            "-c",
+            "core.quotePath=true",
+            "diff",
+            "--src-prefix=a/",
+            "--dst-prefix=b/",
+            "--no-color",
+            "--no-ext-diff",
+            "--no-textconv",
+            "--text",
+            "--no-renames",
+            "-U0",
+            `${from}..${to}`,
+        ],
+        {
+            cwd: wt,
+            stdout: "pipe",
+            stderr: "pipe",
+            env: env.getProcessEnv(),
+        }
+    );
+
+    if (diff.exitCode !== 0) {
+        console.log(`✖ git diff ${from}..${to} failed: ${diff.stderr.toString().slice(0, 200)}`);
+        return false;
+    }
+
+    const added = hitsInAddedLines(out, diff.stdout.toString(), files);
+
+    if (added.length > 0) {
+        console.log(`✖ personal-data probe: ${added.length} hit(s) in lines this push adds: ${added.join(", ")}`);
+        return false;
+    }
+
+    console.log(`✔ personal-data probe: ${older} older hit(s), none in a line this push adds`);
+    return true;
+}
diff --git a/.claude/skills/babysit/scripts/restack.ts b/.claude/skills/babysit/scripts/restack.ts
new file mode 100644
index 0000000000..bcb30d0b69
--- /dev/null
+++ b/.claude/skills/babysit/scripts/restack.ts
@@ -0,0 +1,51 @@
+#!/usr/bin/env bun
+/**
+ * Rebase a PR worktree onto a new base for merge prep, with hooks and rerere off. Conflicts in the plugin version
+ * files resolve to the higher version; any other conflict aborts the rebase and is reported, because resolving real
+ * code belongs to a worker or the lead, not to a script (versions.ts).
+ *
+ *   bun restack.ts --wt <worktree> --onto <ref> [--upstream <old base commit>]
+ *
+ * `--upstream` drops the commits a squash-merged parent already brought in (`git rebase --onto <ref> <upstream>`).
+ * Nothing is pushed: check the result, run the area tests, then push with --force-with-lease.
+ */
+import { flag } from "./run";
+import { conflictedFiles, prepGit, resolveVersionConflicts } from "./versions";
+
+const wt = flag("--wt") ?? "";
+const onto = flag("--onto") ?? "";
+const upstream = flag("--upstream");
+
+if (!wt || !onto) {
+    console.error("usage: restack.ts --wt <worktree> --onto <ref> [--upstream <old base commit>]");
+    process.exit(2);
+}
+
+const git = prepGit(wt);
+
+if (git(["status", "--porcelain", "--untracked-files=no"]).out.trim()) {
+    console.error("✖ the worktree has uncommitted changes");
+    process.exit(1);
+}
+
+let step = git(["rebase", "-q", ...(upstream ? ["--onto", onto, upstream] : [onto])]);
+let resolved = 0;
+
+while (step.code !== 0) {
+    const conflicted = conflictedFiles(git);
+
+    if (!resolveVersionConflicts(git, conflicted)) {
+        git(["rebase", "--abort"]);
+        console.log(
+            `✖ conflict outside the version files, rebase aborted: ${conflicted.join(" ") || step.out.slice(0, 300)}`
+        );
+        process.exit(1);
+    }
+
+    resolved += conflicted.length;
+    step = git(["rebase", "--continue"]);
+}
+
+const head = git(["rev-parse", "--short", "HEAD"]).out.trim();
+const count = git(["rev-list", "--count", `${onto}..HEAD`]).out.trim();
+console.log(`✔ rebased onto ${onto}: ${count} commits, head ${head}, ${resolved} version-file conflict(s) resolved`);
diff --git a/.claude/skills/babysit/scripts/review-brief.ts b/.claude/skills/babysit/scripts/review-brief.ts
new file mode 100644
index 0000000000..f0469ac96a
--- /dev/null
+++ b/.claude/skills/babysit/scripts/review-brief.ts
@@ -0,0 +1,101 @@
+#!/usr/bin/env bun
+/**
+ * The brief for an independent read-only review round: when the reviewer bot has nothing left on a PR that still
+ * needs rounds, or a PR merged with fewer than three. Its findings become the next fix round (`fill-brief --judge`)
+ * or, after a merge, a follow-up PR. Writes `<run>/steer-review-<pr>.md` and prints the path for steer.ts.
+ *
+ *   bun review-brief.ts --run <dir> --pr 517 --wt <worktree> [--base master] [--post-merge] [--swift] [--fresh]
+ *
+ * `--fresh`: a PR opened minutes ago, reviewed next to the bots (the first round of a newly cut PR).
+ *
+ * Hand-edited copies of this text sent a reviewer to another PR's description (2026-10-14: a sed pass left
+ * `gh pr view 504` in the #498 and #500 briefs), so every PR reference comes from one value here.
+ */
+
+import { join } from "node:path";
+import { SafeJSON } from "@genesiscz/utils/json";
+import { flag, has, loadRun, reviewScratch } from "./run";
+
+export interface ReviewBriefInput {
+    pr: number;
+    title: string;
+    wt: string;
+    base: string;
+    scratch: string;
+    postMerge: boolean;
+    swift: boolean;
+    /** A PR opened minutes ago: the bots review it at the same time, so there are no earlier threads yet. */
+    fresh?: boolean;
+}
+
+export function reviewBrief({ pr, title, wt, base, scratch, postMerge, swift, fresh }: ReviewBriefInput): string {
+    const why = postMerge
+        ? `PR #${pr} ("${title}") merged into master with fewer than three review rounds. This is an independent review of the MERGED code; your findings become a follow-up PR.`
+        : fresh
+          ? `PR #${pr} ("${title}") was just opened, and the reviewer bots read it at the same time as you. The lead wants an independent review next to theirs; your findings join the bots' threads in the first fix round.`
+          : `The reviewer bot found nothing more to fix on PR #${pr} ("${title}"), so the lead wants an independent review. Your findings become the next fix round.`;
+    const read = postMerge
+        ? `It is detached at current master, which contains the PR. Read what the PR changed with \`gh pr diff ${pr}\`, then read the CURRENT version of each touched file in this folder (later PRs may have changed them).`
+        : `Base: \`origin/${base}\`. Read the diff with \`git diff --no-textconv --no-ext-diff origin/${base}...HEAD\` (git diff, show and log need both flags, blame and grep need \`--no-textconv\`, or the read waits for the lead), then read the touched files in full where needed.`;
+    const lines = [
+        `## Independent review of PR #${pr} (read-only)`,
+        "",
+        `${why} Quality over count: only REAL defects (wrong behaviour, a missed case, a broken contract, a data-loss or security risk, a test that does not test what it claims, a broken repository rule). No style, naming or "consider" notes. "No findings" is a good and acceptable result: do not invent one.`,
+        "",
+        `- Working folder: \`${wt}\` (cd there first). ${read} Read the area rule files (\`.claude/rules/*.md\`) for those files, and the PR description: \`gh pr view ${pr} --json body --jq .body\`.`,
+        fresh
+            ? `- The PR has no answered threads yet. Do not wait for the bots and do not read their threads: review the code on your own.`
+            : `- Earlier review threads were already answered; read them with \`tools github review ${pr} --llm\` so you do not report a finding that was fixed or deliberately declined (a declined one is fair game only with new evidence).`,
+        `- Check every claim: run the relevant tests (\`timeout 600 bun scripts/test.ts <test files>\`) or a small read-only probe under \`${scratch}\`, and paste the real output. A finding without evidence is a guess; say so.`,
+        ...(swift
+            ? [
+                  "- Swift: do not run `swift build` or `swift test` (the lead runs them); a Swift claim needs a code quote as evidence.",
+              ]
+            : []),
+        `- Write \`${join(wt, ".claude/work/babysit", `${pr}-review.md`)}\` (create the folder): one section per finding with severity (Critical, High, Medium, Low), file:line, the defect, the evidence, why it matters, and the smallest fix. End with a one-line verdict.`,
+        "- Change NO source file, commit nothing, post nothing to GitHub. Do NOT run `git checkout`, `git switch`, `bun install` or the hook installer. No app builds, installs, launches or relaunches. Another reviewer may read this same folder, so write only your own review file.",
+        "",
+        "Then stop with a report: the finding count by severity and the review file path, then RESULT / AT / CHANGED / VERIFY / OPEN.",
+    ];
+    return `${lines.join("\n")}\n`;
+}
+
+if (import.meta.main) {
+    const run = loadRun();
+    const pr = Number(flag("--pr"));
+    const wt = flag("--wt");
+
+    if (!Number.isInteger(pr) || pr <= 0 || !wt) {
+        console.error(
+            "usage: review-brief.ts --run <dir> --pr <N> --wt <worktree> [--base master] [--post-merge] [--swift] [--fresh]"
+        );
+        process.exit(2);
+    }
+
+    const view = Bun.spawnSync(["gh", "pr", "view", String(pr), "--repo", run.repo, "--json", "title"], {
+        stdout: "pipe",
+        stderr: "pipe",
+    });
+
+    if (view.exitCode !== 0) {
+        console.error(`✖ gh pr view ${pr}: ${view.stderr.toString().trim()}`);
+        process.exit(1);
+    }
+
+    const { title } = SafeJSON.parse(view.stdout.toString(), { strict: true }) as { title: string };
+    const out = join(run.dir, `steer-review-${pr}.md`);
+    await Bun.write(
+        out,
+        reviewBrief({
+            pr,
+            title,
+            wt,
+            base: flag("--base") ?? "master",
+            scratch: reviewScratch(run.dir, pr),
+            postMerge: has("--post-merge"),
+            swift: has("--swift"),
+            fresh: has("--fresh"),
+        })
+    );
+    console.log(out);
+}
diff --git a/.claude/skills/babysit/scripts/round-ready.ts b/.claude/skills/babysit/scripts/round-ready.ts
new file mode 100644
index 0000000000..817cfcd1a9
--- /dev/null
+++ b/.claude/skills/babysit/scripts/round-ready.ts
@@ -0,0 +1,252 @@
+#!/usr/bin/env bun
+/**
+ * Per PR: the head, whether each reviewer reviewed that head, the unresolved threads per author, and the PR comments
+ * per author that are not ours. Every reviewer counts by default, not only eve: a second bot's review or a comment
+ * from a person is a reason to look as much as eve's (Martin, 2026-10-14). `--bots` narrows the list.
+ * A PR is ready for its next round when the reviewer bot has reviewed the current head.
+ *
+ *   bun round-ready.ts --run <dir> 499 504 …   [--bots eve-bot-lovinka,coderabbitai] [--wait <minutes>]
+ *
+ * `--wait` blocks, one read every 2 minutes, until each PR's head is reviewed by eve (or by every bot `--bots` names),
+ * then prints the lines and exits 0; at the deadline it prints the last lines and exits 3. Use it instead of a one-off
+ * waiter that greps this output: one such waiter matched "eve@head yes", a form this script never prints, and sat out
+ * its whole 90 minutes while eve had reviewed the head after 6 (2026-10-14, GenesisPlayground #94).
+ */
+import { createHash } from "node:crypto";
+import { SafeJSON } from "@genesiscz/utils/json";
+import { flag, loadRun } from "./run";
+
+interface Activity {
+    id: string;
+    updatedAt: string;
+    author?: { login: string };
+}
+
+interface Review extends Activity {
+    commit?: { oid: string };
+    submittedAt: string;
+    state: string;
+}
+
+interface Thread {
+    id: string;
+    isResolved: boolean;
+    comments: { nodes: Array<{ author?: { login: string } }> };
+    latest: { nodes: Activity[] };
+}
+
+interface Connection<T> {
+    nodes: T[];
+    pageInfo: { hasNextPage: boolean; endCursor: string | null };
+}
+
+interface Pr {
+    headRefOid: string;
+    reviewThreads: Connection<Thread>;
+    comments: Connection<Activity>;
+    reviews: Connection<Review>;
+    timelineItems: { nodes: Array<{ createdAt?: string }> };
+}
+
+interface Response {
+    data?: { viewer: { login: string }; repository: { pullRequest: Pr } };
+    errors?: Array<{ message: string }>;
+}
+
+const run = loadRun();
+const [owner, name] = run.repo.split("/");
+const only = flag("--bots")?.split(",");
+const prs = process.argv.slice(2).filter((a, i, all) => /^\d+$/.test(a) && !all[i - 1]?.startsWith("--"));
+const waitMinutes = Number(flag("--wait") ?? 0);
+const deadline = Date.now() + (waitMinutes > 0 ? waitMinutes * 60_000 : 120_000);
+if (!Number.isFinite(waitMinutes) || waitMinutes < 0 || !Number.isFinite(deadline)) {
+    console.error("--wait must be a finite nonnegative duration in minutes");
+    process.exit(2);
+}
+const required = only ?? ["eve-bot-lovinka"];
+const pageInfo = "pageInfo{hasNextPage endCursor}";
+const query = `query($n:Int!,$threadsCursor:String,$commentsCursor:String,$reviewsCursor:String){viewer{login} repository(owner:"${owner}",name:"${name}"){pullRequest(number:$n){headRefOid
+ reviewThreads(first:100,after:$threadsCursor){${pageInfo} nodes{id isResolved comments(first:1){nodes{author{login}}} latest:comments(last:1){nodes{id updatedAt}}}}
+ comments(first:100,after:$commentsCursor){${pageInfo} nodes{id updatedAt author{login}}}
+ reviews(first:100,after:$reviewsCursor){${pageInfo} nodes{id updatedAt author{login} commit{oid} submittedAt state}}
+ timelineItems(last:1,itemTypes:[HEAD_REF_FORCE_PUSHED_EVENT]){nodes{... on HeadRefForcePushedEvent{createdAt}}}}}}`;
+
+/** Read every connection; an incomplete or inconsistent snapshot is an error, never a ready head. */
+function readAll(n: string, deadline: number): { me: string; pr: Pr } {
+    const cursors = new Map<string, string>();
+    const visited = new Map<string, Set<string>>();
+    const finished = new Set<string>();
+    const threads: Thread[] = [];
+    const comments: Activity[] = [];
+    const reviews: Review[] = [];
+    let first: Response["data"];
+    const append = <T>(key: string, connection: Connection<T>, output: T[]) => {
+        if (finished.has(key)) {
+            return;
+        }
+
+        if (!connection?.pageInfo || !Array.isArray(connection.nodes)) {
+            throw new Error(`missing ${key} page information`);
+        }
+
+        output.push(...connection.nodes);
+        if (!connection.pageInfo.hasNextPage) {
+            finished.add(key);
+            return;
+        }
+
+        const cursor = connection.pageInfo.endCursor;
+        const seen = visited.get(key) ?? new Set<string>();
+        if (!cursor || seen.has(cursor)) {
+            throw new Error(`invalid ${key} pagination cursor`);
+        }
+
+        seen.add(cursor);
+        visited.set(key, seen);
+        cursors.set(key, cursor);
+    };
+
+    while (finished.size < 3) {
+        if (Date.now() >= deadline) {
+            throw new Error("review pagination timed out");
+        }
+
+        const p = Bun.spawnSync(
+            [
+                "gh",
+                "api",
+                "graphql",
+                "-f",
+                `query=${query}`,
+                "-F",
+                `n=${n}`,
+                ...[...cursors].flatMap(([key, cursor]) => ["-f", `${key}Cursor=${cursor}`]),
+            ],
+            {
+                stdout: "pipe",
+                stderr: "pipe",
+                timeout: Math.max(1, Math.min(30_000, deadline - Date.now())),
+                killSignal: "SIGKILL",
+            }
+        );
+        if (Date.now() >= deadline) {
+            throw new Error("review wait deadline expired");
+        }
+
+        if (p.exitCode !== 0) {
+            throw new Error(p.stderr.toString().slice(0, 120) || `review read exited ${p.exitCode}`);
+        }
+
+        const response = SafeJSON.parse(p.stdout.toString(), { strict: true }) as Response;
+        if (!response.data || response.errors?.length) {
+            throw new Error(response.errors?.map((error) => error.message).join("; ") || "missing review data");
+        }
+
+        first ??= response.data;
+        const pr = response.data.repository.pullRequest;
+        if (!pr || pr.headRefOid !== first.repository.pullRequest.headRefOid) {
+            throw new Error("PR head changed during review pagination");
+        }
+
+        append("threads", pr.reviewThreads, threads);
+        append("comments", pr.comments, comments);
+        append("reviews", pr.reviews, reviews);
+    }
+
+    if (!first) {
+        throw new Error("missing review snapshot");
+    }
+
+    const pr = first.repository.pullRequest;
+    pr.reviewThreads.nodes = threads;
+    pr.comments.nodes = comments;
+    pr.reviews.nodes = reviews;
+    return { me: first.viewer.login, pr };
+}
+
+/** One line per PR, and whether every required reviewer has reviewed its head. */
+function readPr(n: string, deadline: number): { line: string; ready: boolean } {
+    let snapshot: ReturnType<typeof readAll>;
+    try {
+        snapshot = readAll(n, deadline);
+    } catch (error) {
+        return { line: `#${n} ERR ${String(error).slice(0, 160)}`, ready: false };
+    }
+
+    const { me, pr } = snapshot;
+    const open: Record<string, number> = {};
+
+    for (const thread of pr.reviewThreads.nodes) {
+        if (!thread.isResolved) {
+            const author = thread.comments.nodes[0]?.author?.login ?? "?";
+            open[author] = (open[author] ?? 0) + 1;
+        }
+    }
+
+    // eve first, then every other reviewer in the order they first reviewed.
+    const reviewers = [...new Set(["eve-bot-lovinka", ...pr.reviews.nodes.map((r) => r.author?.login ?? "?")])].filter(
+        (login) => login !== me && (only ? only.includes(login) : true)
+    );
+    const comments: Record<string, number> = {};
+
+    for (const comment of pr.comments.nodes) {
+        const author = comment.author?.login ?? "?";
+
+        if (author !== me) {
+            comments[author] = (comments[author] ?? 0) + 1;
+        }
+    }
+
+    const reviewedHead = new Set<string>();
+    const atHead = reviewers.map((bot) => {
+        // The LATEST review of the head: eve can approve a head and later withhold the approval on it (#503,
+        // 2026-10-14: APPROVED 04:48Z, then COMMENTED "approval withheld" 04:53Z), and the first match hid that.
+        // After a force-push GitHub reports an earlier review on the NEW head commit when the patch matches, so
+        // commit equality is not proof the reviewer saw this tree (2026-10-14: #500 and #517 showed eve@head
+        // APPROVED from before their rebase). A review counts only when it is newer than the last force-push.
+        const forcedAt = pr.timelineItems.nodes.at(-1)?.createdAt ?? "";
+        const review = pr.reviews.nodes.findLast(
+            (r) => r.author?.login === bot && r.commit?.oid === pr.headRefOid && r.submittedAt > forcedAt
+        );
+        if (review) {
+            reviewedHead.add(bot);
+        }
+
+        return `${bot.split("-")[0]}@head ${review ? `${review.state}@${review.submittedAt.slice(11, 16)}Z` : "no"}`;
+    });
+    // Counts alone hide new activity in capped windows and reviews of older heads.
+    const activity = createHash("sha256")
+        .update(
+            SafeJSON.stringify({
+                threads: pr.reviewThreads.nodes,
+                comments: pr.comments.nodes.filter((comment) => comment.author?.login !== me),
+                reviews: pr.reviews.nodes.filter((review) => review.author?.login !== me),
+                forced: pr.timelineItems.nodes,
+            })
+        )
+        .digest("hex")
+        .slice(0, 16);
+    return {
+        line: `#${n} head ${pr.headRefOid.slice(0, 9)} ${atHead.join(" ")} open ${SafeJSON.stringify(open, { strict: true })} comments ${SafeJSON.stringify(comments, { strict: true })} activity ${activity}`,
+        ready: required.every((bot) => reviewedHead.has(bot)),
+    };
+}
+
+let results = prs.map((pr) => readPr(pr, deadline));
+while (waitMinutes > 0 && !results.every((r) => r.ready) && Date.now() < deadline) {
+    await Bun.sleep(Math.min(120_000, Math.max(0, deadline - Date.now())));
+    if (Date.now() >= deadline) {
+        break;
+    }
+
+    results = prs.map((pr) => readPr(pr, deadline));
+}
+
+for (const result of results) {
+    console.log(result.line);
+}
+
+if (waitMinutes > 0 && (Date.now() >= deadline || !results.every((r) => r.ready))) {
+    console.log(`not every head reviewed by ${required.join(", ")} after ${waitMinutes} min`);
+    process.exit(3);
+}
diff --git a/.claude/skills/babysit/scripts/run.ts b/.claude/skills/babysit/scripts/run.ts
new file mode 100644
index 0000000000..7972f25f4c
--- /dev/null
+++ b/.claude/skills/babysit/scripts/run.ts
@@ -0,0 +1,123 @@
+/**
+ * The run card every babysit script reads: `<run dir>/run.json`, written by the lead at the start of a run.
+ * The run dir comes from `--run <dir>` or `BABYSIT_RUN`. Only `vault` and `judge` have no sensible default.
+ *
+ *   { "vault": "<notes folder of this run>", "judge": "Claude Opus 5.5", "repo": "owner/name",
+ *     "worktrees": "<dir>", "reviewLoopScripts": "<dir>", "prs": [...], ... }
+ */
+
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+import { env } from "@genesiscz/utils/env";
+import { SafeJSON } from "@genesiscz/utils/json";
+
+export interface RunCard {
+    /** The run folder: run.json, ledger.jsonl, briefs, logs. */
+    dir: string;
+    /** owner/name of the GitHub repository. */
+    repo: string;
+    /** The main checkout (the parent of the git common dir). */
+    main: string;
+    /** Where reply files, summaries and the rendered ledger go. */
+    vault: string;
+    /** The name the round summary credits as judge. */
+    judge: string;
+    /** Parent folder of the per-PR worker worktrees (`bs-<N>`). */
+    worktrees: string;
+    reviewLoopScripts: string;
+    /** Publication requires true or an explicit --post; absent permission means ask. */
+    post?: boolean | "ask";
+    /**
+     * The brief's verify bullets for a repository whose checks are not GenesisTools' (run.json `verify`, one string
+     * per bullet). Unset: fill-brief writes GenesisTools' test, tsgo, Biome and lint-rules commands.
+     */
+    verify?: string[];
+}
+
+export function flag(name: string): string | undefined {
+    const i = process.argv.indexOf(name);
+    return i >= 0 ? process.argv[i + 1] : undefined;
+}
+
+export function has(name: string): boolean {
+    return process.argv.includes(name);
+}
+
+function capture(cmd: string[], cwd?: string): string {
+    const p = Bun.spawnSync(cmd, { cwd, stdout: "pipe", stderr: "pipe", env: env.getProcessEnv() });
+    return p.exitCode === 0 ? p.stdout.toString().trim() : "";
+}
+
+/**
+ * `--run` names the run folder; the path of its run.json is accepted too. A folder that does not exist, or a path to
+ * any other file, is an error: the fallbacks in `loadRun` would quietly answer for the current checkout's repository
+ * (2026-10-14: `--run <dir>/run.json` made round-ready report GenesisTools #94, a closed PR, for GenesisPlayground #94).
+ */
+export function runPaths(given: string): { runDir: string; cardPath: string } {
+    const path = resolve(given);
+    if (basename(path) === "run.json") {
+        if (!existsSync(path)) {
+            throw new Error(`no run card at ${path}`);
+        }
+
+        return { runDir: dirname(path), cardPath: path };
+    }
+
+    if (!existsSync(path) || !statSync(path).isDirectory()) {
+        throw new Error(`run dir ${path} is not a folder: pass the folder that holds run.json`);
+    }
+
+    return { runDir: path, cardPath: join(path, "run.json") };
+}
+
+export function loadRun(dir = flag("--run") ?? env.get("BABYSIT_RUN")): RunCard {
+    if (!dir) {
+        console.error("no run dir: pass --run <dir> or set BABYSIT_RUN");
+        process.exit(2);
+    }
+
+    let paths: { runDir: string; cardPath: string };
+    try {
+        paths = runPaths(dir);
+    } catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exit(2);
+    }
+
+    const { runDir, cardPath } = paths;
+    if (!existsSync(cardPath)) {
+        console.error(`no run.json in ${runDir}: the repo, checkout and vault come from the current checkout`);
+    }
+
+    const card: Record<string, unknown> = existsSync(cardPath)
+        ? (SafeJSON.parse(readFileSync(cardPath, "utf8")) as Record<string, unknown>)
+        : {};
+    const text = (key: string): string | undefined =>
+        typeof card[key] === "string" ? (card[key] as string) : undefined;
+    const commonDir = capture(["git", "rev-parse", "--path-format=absolute", "--git-common-dir"]);
+
+    return {
+        dir: runDir,
+        repo: text("repo") ?? capture(["gh", "repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"]),
+        main: text("main") ?? (commonDir ? dirname(commonDir) : process.cwd()),
+        vault: text("vault") ?? join(runDir, "vault"),
+        judge: text("judge") ?? "Claude",
+        post: typeof card.post === "boolean" ? card.post : "ask",
+        worktrees: text("worktrees") ?? join(runDir, "worktrees"),
+        reviewLoopScripts: text("reviewLoopScripts") ?? join(homedir(), ".claude/skills/review-loop/scripts"),
+        verify:
+            Array.isArray(card.verify) && card.verify.every((line) => typeof line === "string")
+                ? (card.verify as string[])
+                : undefined,
+    };
+}
+
+export function worktreeFor(run: RunCard, pr: string | number): string {
+    return join(run.worktrees, `bs-${pr}`);
+}
+
+/** A reviewer's probe folder, beside the run folder: its brief names it and the approval driver accepts writes there. */
+export function reviewScratch(runDir: string, pr: string | number): string {
+    return join(runDir, "..", `review-${pr}`);
+}
diff --git a/.claude/skills/babysit/scripts/scripts.test.ts b/.claude/skills/babysit/scripts/scripts.test.ts
index 4867760c22..1e91f603ed 100644
--- a/.claude/skills/babysit/scripts/scripts.test.ts
+++ b/.claude/skills/babysit/scripts/scripts.test.ts
@@ -1,27 +1,272 @@
 import { describe, expect, spyOn, test } from "bun:test";
 import * as fs from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { homedir, tmpdir } from "node:os";
+import { dirname, join } from "node:path";
 import type { execTool } from "@genesiscz/utils/cli";
 import { toolsEntrypoint } from "@genesiscz/utils/cli/tools";
+import { env } from "@genesiscz/utils/env";
+import { waitForPath } from "@genesiscz/utils/fs";
 import { SafeJSON } from "@genesiscz/utils/json";
-import { allowedCommand, decide, type RunEntry, watchApprovals } from "./approve-codex";
-import { pump } from "./watch-workers";
+import { isProcessAlive } from "@genesiscz/utils/process-alive";
+import {
+    allowedCommand,
+    chainSegments,
+    decide,
+    fableReplaceCommand,
+    innerCommand,
+    type RunEntry,
+    readOnlyChain,
+    watchApprovals,
+} from "./approve-codex";
+import { type ConflictPick, resolutionProblems, resolveConflictText } from "./conflicts";
+import { threadRefs } from "./fetch-threads";
+import { earlierVerdicts, PRE_PUSH_GUARDS, postingExitCode } from "./integrate";
+import { recordLandingPush } from "./land";
+import { appendEvent, readEvents, renderMarkdown } from "./ledger";
+import { continueVersionPick } from "./pick-unified";
+import { summarize, testEvidence } from "./plant";
+import { hitsInAddedLines, probeAddedLines } from "./probe";
+import { reviewBrief } from "./review-brief";
+import { loadRun, runPaths } from "./run";
+import { trySwiftSlot } from "./swift-slot";
+import { parseSwiftTargets, typecheckPackage } from "./swift-typecheck";
+import { openPaths } from "./tmp-reclaim";
+import {
+    conflictedFiles,
+    higherVersionSide,
+    newExecutablesStall,
+    prepGit,
+    resolveVersionConflicts,
+    resolveVersionText,
+} from "./versions";
+import { createTaskLookup, pump } from "./watch-workers";
+
+const mainCheckout = dirname(
+    Bun.spawnSync(["git", "rev-parse", "--path-format=absolute", "--git-common-dir"], {
+        stdout: "pipe",
+        stderr: "pipe",
+        env: process.env,
+    })
+        .stdout.toString()
+        .trim()
+);
+const trustedCli = join(mainCheckout, "plugins/genesis-tools/skills/fable-replace/scripts/cli.ts");
+
+const approvalRoot = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-approval-root-")));
+fs.mkdirSync(join(approvalRoot, ".claude/work/babysit"), { recursive: true });
 
 const entry: RunEntry = {
     name: "fixture",
-    cwd: "/fixture",
+    cwd: approvalRoot,
     scope: ["src/a.ts", "src/with space.ts"],
     subject: "fix(tools): #1 followup - subject",
     verify: ["bunx biome check src/a.ts"],
 };
 
+describe("read-only chains", () => {
+    test("a chain of readers is approved without the lead", () => {
+        for (const command of [
+            "pwd; git status --short; git rev-parse --path-format=absolute --git-common-dir; wc -l CLAUDE.md",
+            "git diff --no-textconv --no-ext-diff --stat origin/master...HEAD; rg --files .claude/rules",
+            "rg --files Genesis -g CLAUDE.md | rg 'rules/'",
+            "gh pr view 93 --json body --jq .body",
+            "sed -n '40,80p' src/a.ts && git log --no-textconv --no-ext-diff --oneline -5",
+            "tools github review 93 --llm",
+            "git diff --no-textconv --no-ext-diff --stat origin/master...HEAD; if test -f /x/AGENTS.md; then cat /x/AGENTS.md; fi",
+        ]) {
+            expect(readOnlyChain(entry, command)).toBe(true);
+            expect(allowedCommand(entry, command)).toBe(true);
+        }
+    });
+
+    test("anything that can write or run code still asks the lead", () => {
+        for (const command of [
+            "git diff > out.patch",
+            "cat a.ts | tee b.ts",
+            "rg x --pre ./run.sh",
+            "find . -name '*.ts' -delete",
+            "sed -i 's/a/b/' src/a.ts",
+            "sed -n '1w out' src/a.ts",
+            "git diff --output=x.patch",
+            "git checkout -- src/a.ts",
+            "gh api repos/o/r/issues/1/comments -f body=hi",
+            "tools github review 93 respond t1 ok",
+            "echo $(rm -rf x)",
+            "sort -o a.txt b.txt",
+            "uniq in.txt out.txt",
+            "sleep 1 &",
+            "cd /etc && cat passwd",
+            "bun scripts/test.ts src/a.test.ts",
+            "if test -f a; then rm a; fi",
+            "then",
+            "fi x",
+        ]) {
+            expect(readOnlyChain(entry, command)).toBe(false);
+        }
+    });
+
+    test("a double-quoted shell wrapper with escapes unwraps when nothing in it expands", () => {
+        const wrapped = String.raw`/bin/zsh -lc "sed -n '530,580p' a.ts; rg --heading -n '\\.md|Markdown' areas.json | head -20"`;
+        expect(innerCommand(wrapped)).toBe(
+            String.raw`sed -n '530,580p' a.ts; rg --heading -n '\.md|Markdown' areas.json | head -20`
+        );
+        expect(readOnlyChain(entry, innerCommand(wrapped))).toBe(true);
+        expect(innerCommand(`/bin/zsh -lc "echo $HOME"`)).toBe(`/bin/zsh -lc "echo $HOME"`);
+        expect(innerCommand('/bin/zsh -lc "echo `id`"')).toBe('/bin/zsh -lc "echo `id`"');
+        expect(innerCommand(`/usr/local/bin/fish -c "ls"`)).toBe(`/usr/local/bin/fish -c "ls"`);
+    });
+
+    test("separators inside quotes do not split a command", () => {
+        expect(chainSegments("rg 'a;b|c' src && pwd")).toEqual(["rg 'a;b|c' src", "pwd"]);
+        expect(chainSegments("echo 'x > y'")).toEqual(["echo 'x > y'"]);
+        expect(chainSegments("cat a 2>&1")).toBeNull();
+    });
+});
+
+describe("fetch-threads", () => {
+    test("reads each thread ref once, in numeric order", () => {
+        expect(threadRefs("t10 a\nt2 b\nt1 c\nsee t2 again; not5 or at3x")).toEqual(["t1", "t2", "t10"]);
+        expect(threadRefs("Stats: 0 threads")).toEqual([]);
+    });
+});
+
+describe("integrate's gates", () => {
+    test("run every guard of the pre-push hook with the same arguments", () => {
+        const hook = fs.readFileSync(join(import.meta.dir, "../../../../.githooks/pre-push"), "utf8");
+        const fromHook = [...hook.matchAll(/^run_guard (\S+) (.+)$/gm)].map((m) => [m[1], ...m[2].trim().split(/\s+/)]);
+        expect(fromHook.length).toBeGreaterThan(5);
+        expect(PRE_PUSH_GUARDS).toEqual([
+            ["lint:dashboard", "bun", "run", "lint:dashboard"],
+            ["typecheck:all", "bun", "run", "typecheck:all"],
+            ...fromHook,
+        ]);
+    });
+});
+
+describe("negated tests", () => {
+    test("a test ! guard before a read", () => {
+        expect(readOnlyChain(entry, "test ! -f /x/AGENTS.md || cat /x/AGENTS.md")).toBe(true);
+        expect(readOnlyChain(entry, "! rm x")).toBe(false);
+        expect(readOnlyChain(entry, "test ! -f x || rm x")).toBe(false);
+    });
+});
+
+describe("fixer checks", () => {
+    test("a verify command under timeout or logged to the scratch folder is the same command", () => {
+        const configured = entry.verify[0];
+        expect(allowedCommand(entry, `timeout 600 ${configured}`)).toBe(true);
+        expect(allowedCommand(entry, `timeout 600 ${configured} > .claude/work/babysit/r1.log 2>&1`)).toBe(true);
+        expect(
+            allowedCommand(entry, "timeout 600 bun scripts/test.ts src/a.test.ts > .claude/work/babysit/t.log 2>&1")
+        ).toBe(true);
+        expect(allowedCommand(entry, "bunx biome check --write src/a.ts")).toBe(true);
+        for (const command of [
+            `${configured} > src/a.ts 2>&1`,
+            `${configured} > /tmp/x.log 2>&1`,
+            `timeout 600 timeout 600 ${configured}`,
+            "bunx biome check --write src/outside.ts",
+            "bunx biome check --config-path x src/a.ts",
+        ]) {
+            expect({ command, ok: allowedCommand(entry, command) }).toEqual({ command, ok: false });
+        }
+    });
+});
+
+describe("fixer edits through fable-replace", () => {
+    const cli = trustedCli;
+    const spec = (target: string) => `@@ ${target}\n<<<\nold\n===\nnew\n>>>`;
+    test("approved only when every target is in scope", () => {
+        expect(allowedCommand(entry, `bun ${cli} <<'FR'\n${spec("src/a.ts")}\nFR`)).toBe(true);
+        expect(
+            allowedCommand(entry, `GENESIS_TOOLS_HOME=/tmp/cc/p/s/fr bun ${cli} <<'FR'\n${spec("src/a.ts")}\nFR`)
+        ).toBe(true);
+        for (const command of [
+            `bun ${cli} <<'FR'\n${spec("src/outside.ts")}\nFR`,
+            `bun ${cli} <<'FR'\n${spec("src/a.ts")}\n${spec("../other/b.ts")}\nFR`,
+            `HOME=/tmp/cc/x bun ${cli} <<'FR'\n${spec("src/a.ts")}\nFR`,
+            `TMPDIR=/Users/x bun ${cli} <<'FR'\n${spec("src/a.ts")}\nFR`,
+            `bun /tmp/evil/cli.ts <<'FR'\n${spec("src/a.ts")}\nFR`,
+            `bun ${cli} <<'FR'\n${spec("src/a.ts")}\nFR\nrm -rf src`,
+            `TMPDIR=/tmp/cc/p/s/x$(touch\${IFS}/tmp/cc/p/s/owned) bun ${cli} <<'FR'\n${spec("src/a.ts")}\nFR`,
+            `GENESIS_TOOLS_HOME=/tmp/cc/p/s/\`id\` bun ${cli} <<'FR'\n${spec("src/a.ts")}\nFR`,
+        ]) {
+            expect({ command, ok: allowedCommand(entry, command) }).toEqual({ command, ok: false });
+        }
+    });
+});
+
+describe("reviewer probe folder", () => {
+    test("a reviewer's logged check may write to its own probe folder, never a sibling or a parent", () => {
+        const probeRoot = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-reviewer-probe-")));
+        const reviewer: RunEntry = { ...entry, role: "review", pr: 5, scratch: probeRoot };
+        const check = "timeout 600 bun scripts/test.ts src/a.test.ts";
+        expect(allowedCommand(reviewer, `${check} > ${probeRoot}/t.log 2>&1`)).toBe(true);
+        for (const destination of [
+            "/tmp/cc/p/s/review-50/t.log",
+            "/tmp/cc/p/s/review-5/../t.log",
+            "/tmp/cc/p/s/t.log",
+        ]) {
+            expect({ destination, ok: allowedCommand(reviewer, `${check} > ${destination} 2>&1`) }).toEqual({
+                destination,
+                ok: false,
+            });
+        }
+        expect(allowedCommand(entry, `${check} > ${probeRoot}/t.log 2>&1`)).toBe(false);
+    });
+});
+
+describe("reviewer reads", () => {
+    test("the scratch folder by its absolute path, and the ts readers", () => {
+        expect(allowedCommand(entry, `mkdir -p ${entry.cwd}/.claude/work/babysit`)).toBe(true);
+        expect(allowedCommand(entry, "mkdir -p /tmp/elsewhere")).toBe(false);
+        expect(
+            readOnlyChain(
+                { ...entry, cwd: join(import.meta.dir, "../../../..") },
+                "./tools ts skeleton src/a.ts --top-level"
+            )
+        ).toBe(true);
+        expect(readOnlyChain(entry, "tools ts duplicates src --recommend")).toBe(false);
+        expect(readOnlyChain(entry, "./tools github review 5 --respond x")).toBe(false);
+    });
+});
+
+describe("sed stays a reader", () => {
+    test("a second script after the range is refused", () => {
+        expect(readOnlyChain(entry, "sed -n 1,9p src/a.ts")).toBe(true);
+        for (const command of [
+            "sed -n 1p -e 'w /tmp/x' src/a.ts",
+            "sed -n 1p -i src/a.ts",
+            "sed -n 1p -f s.sed a",
+            "git grep -O'touch /tmp/x; cat' name -- a.md",
+            "git grep -Otouch name",
+        ]) {
+            expect({ command, ok: readOnlyChain(entry, command) }).toEqual({ command, ok: false });
+        }
+    });
+});
+
 describe("brief approval boundary", () => {
+    test("the briefs' test command runs test files inside the worktree only", () => {
+        expect(allowedCommand(entry, "timeout 600 bun scripts/test.ts src/a.test.ts src/ui/b.test.tsx")).toBe(true);
+        expect(allowedCommand(entry, "bun scripts/test.ts src/a.test.ts")).toBe(true);
+        for (const command of [
+            "timeout 600 bun scripts/test.ts",
+            "timeout 600 bun scripts/test.ts src/a.ts",
+            "timeout 600 bun scripts/test.ts ../other/a.test.ts",
+            "timeout 600 bun scripts/test.ts /etc/a.test.ts",
+            "timeout 600 bun scripts/test.ts src/a.test.ts --preload evil.ts",
+            "timeout 600 bun other.ts src/a.test.ts",
+        ]) {
+            expect({ command, ok: allowedCommand(entry, command) }).toEqual({ command, ok: false });
+        }
+    });
+
     test("verification requires the entire configured command", () => {
         expect(allowedCommand(entry, "bunx biome check src/a.ts")).toBe(true);
+        // Biome with --write on a file of the scope is the brief's format step, allowed since 2026-10-16.
+        expect(allowedCommand(entry, "bunx biome check src/a.ts --write")).toBe(true);
         for (const command of [
             "bunx biome check --write src/outside.ts",
-            "bunx biome check src/a.ts --write",
             "bunx biome check src/a.tsx",
             "bunx biome check src/a.ts src/outside.ts",
             'bunx biome check "$(touch owned)"',
@@ -45,8 +290,8 @@ describe("brief approval boundary", () => {
         expect(
             decide(entry, {
                 method: "item/fileChange/requestApproval",
-                detail: "edit /fixture/src/a.ts",
-                paths: ["/fixture/src/a.ts"],
+                detail: `edit ${entry.cwd}/src/a.ts`,
+                paths: [join(entry.cwd, "src/a.ts")],
             }).ok
         ).toBe(true);
         expect(allowedCommand(entry, "git add -- 'src/with space.ts'")).toBe(true);
@@ -210,6 +455,9 @@ test("monitor drains large stderr, preserves its label, and returns failures", a
             lastAt: 0,
             running: true,
             stallSaid: false,
+            hiddenTools: 0,
+            seen: new Set<string>(),
+            seenTurn: -1,
         };
         const code = await pump(
             worker,
@@ -252,5 +500,4653 @@ test("babysit control scripts use checkout-local executors", () => {
     expect(approval).toContain("exec = execTool");
     expect(watch).not.toContain('["tools"');
     expect(watch).toContain("toolsEntrypoint()");
+    // A run card for another repository points run.main at a checkout with no ./tools (2026-10-14, GenesisPlayground).
+    for (const name of ["steer.ts", "wait-turn.ts"]) {
+        const source = fs.readFileSync(join(import.meta.dir, name), "utf8");
+        expect(source).not.toContain('"./tools"');
+        expect(source).toContain(name === "steer.ts" ? 'await execTool(["codex", "steer"' : "toolsEntrypoint()");
+    }
     expect(toolsEntrypoint()).toBe(join(import.meta.dir, "../../../../tools"));
 });
+
+describe("merge-prep version conflicts", () => {
+    const manifest = (version: string) => `{\n    "name": "genesis-tools",\n    "version": "${version}"\n}\n`;
+
+    test("prepGit turns off hooks set in config, which ignore core.hooksPath", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-hooks-"));
+        const git = prepGit(dir);
+        const marker = join(dir, "hook-ran");
+
+        git(["init", "-q"]);
+        fs.appendFileSync(
+            join(dir, ".git", "config"),
+            `[hook "genesis-tools-pre-commit"]\n\tcommand = touch ${marker}\n\tevent = pre-commit\n`
+        );
+        fs.writeFileSync(join(dir, "a"), "a\n");
+        git(["add", "a"]);
+        expect(git(["-c", "user.name=t", "-c", "user.email=t@example.com", "commit", "-qm", "m"]).code).toBe(0);
+        expect(fs.existsSync(marker)).toBe(false);
+
+        // Positive control: the same commit without the switches runs the hook.
+        fs.writeFileSync(join(dir, "a"), "b\n");
+        Bun.spawnSync(["git", "-C", dir, "add", "a"], { env: process.env });
+        Bun.spawnSync(["git", "-C", dir, "-c", "user.name=t", "-c", "user.email=t@example.com", "commit", "-qm", "n"], {
+            env: process.env,
+        });
+        expect(fs.existsSync(marker)).toBe(true);
+    });
+
+    test("the higher version wins on either side, numerically", () => {
+        expect(higherVersionSide(manifest("1.0.96"), manifest("1.0.82"))).toBe("--ours");
+        expect(higherVersionSide(manifest("1.0.82"), manifest("1.0.96"))).toBe("--theirs");
+        expect(higherVersionSide(manifest("1.0.100"), manifest("1.0.99"))).toBe("--ours");
+    });
+
+    test("a version-only conflict resolves to the higher version; a code conflict is left alone", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-versions-"));
+        const git = prepGit(dir);
+        const file = "plugins/genesis-tools/.claude-plugin/plugin.json";
+        const write = (path: string, text: string) => {
+            fs.mkdirSync(join(dir, path, ".."), { recursive: true });
+            fs.writeFileSync(join(dir, path), text);
+        };
+        const commit = (message: string) => {
+            git(["add", "-A"]);
+            git(["-c", "user.name=t", "-c", "user.email=t@example.com", "commit", "-qm", message]);
+        };
+
+        git(["init", "-q", "-b", "main"]);
+        const mergedManifest = (version: string, skills: string) =>
+            SafeJSON.stringify(
+                { version, name: "fixture", description: "fixture", commands: [], hooks: {}, skills },
+                null,
+                4
+            ) + "\n";
+        write(file, mergedManifest("1.0.80", "./old-skills/"));
+        write("src/a.ts", "export const a = 1;\n");
+        commit("base");
+        git(["checkout", "-qb", "child"]);
+        write(file, mergedManifest("1.0.81", "./new-skills/"));
+        commit("child bump");
+        git(["checkout", "-q", "main"]);
+        write(file, mergedManifest("1.0.96", "./old-skills/"));
+        commit("main bump");
+
+        expect(git(["cherry-pick", "child"]).code).not.toBe(0);
+        expect(resolveVersionConflicts(git, conflictedFiles(git))).toBe(true);
+        expect(fs.readFileSync(join(dir, file), "utf8")).toContain('"1.0.96"');
+        expect(fs.readFileSync(join(dir, file), "utf8")).toContain('"./new-skills/"');
+        git(["cherry-pick", "--skip"]);
+
+        git(["checkout", "-qb", "code", "child"]);
+        write("src/a.ts", "export const a = 2;\n");
+        commit("code change");
+        git(["checkout", "-q", "main"]);
+        write("src/a.ts", "export const a = 3;\n");
+        commit("main code change");
+
+        expect(git(["cherry-pick", "code"]).code).not.toBe(0);
+        const conflicted = conflictedFiles(git);
+        expect(conflicted).toContain("src/a.ts");
+        expect(resolveVersionConflicts(git, conflicted)).toBe(false);
+        expect(fs.readFileSync(join(dir, "src/a.ts"), "utf8")).toContain("<<<<<<<");
+    });
+});
+
+test("the probe for another repository's push fails only on a hit in a line the push adds", () => {
+    // The probe's hit list: two files, one hit each (the matched text is fixture filler).
+    const probe = ["✗ placeholder-check: 2 line(s)", "    docs/OLD.md:4:filler", "    src/a.swift:12:filler"].join(
+        "\n"
+    );
+    // A diff that adds lines 10-13 of src/a.swift and line 9 of docs/OLD.md.
+    const diff = [
+        "diff --git a/src/a.swift b/src/a.swift",
+        "+++ b/src/a.swift",
+        "@@ -9,0 +10,4 @@ func f() {",
+        "+line",
+        "diff --git a/docs/OLD.md b/docs/OLD.md",
+        "+++ b/docs/OLD.md",
+        "@@ -9 +9 @@",
+        "+line",
+    ].join("\n");
+    expect(hitsInAddedLines(probe, diff)).toEqual(["src/a.swift:12"]);
+    // The same hits with a diff that adds nothing near them: an older hit does not block the push.
+    expect(hitsInAddedLines(probe, "+++ b/src/a.swift\n@@ -1,0 +2,3 @@\n+x")).toEqual([]);
+});
+
+test("a run card for another repository supplies its own verify bullets", () => {
+    const dir = fs.mkdtempSync(join(tmpdir(), "babysit-run-"));
+    fs.writeFileSync(
+        join(dir, "run.json"),
+        SafeJSON.stringify({ repo: "owner/other", verify: ["swift typecheck only"] })
+    );
+    expect(loadRun(dir).verify).toEqual(["swift typecheck only"]);
+    // No list (or a list that is not all strings): fill-brief falls back to this repository's commands.
+    fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "owner/other", verify: [1] }));
+    expect(loadRun(dir).verify).toBeUndefined();
+});
+describe("independent review brief", () => {
+    test("every PR reference in the brief is the one PR", () => {
+        for (const postMerge of [false, true]) {
+            const text = reviewBrief({
+                pr: 498,
+                title: "fixture title",
+                wt: "/fixture/wt",
+                base: "master",
+                scratch: "/fixture/scratch",
+                postMerge,
+                swift: true,
+            });
+            const numbers = [...text.matchAll(/(?:#|gh pr (?:view|diff) |review )(\d+)|\/(\d+)-review\.md/g)].map(
+                (m) => m[1] ?? m[2]
+            );
+            expect(numbers.length).toBeGreaterThanOrEqual(postMerge ? 5 : 4);
+            expect(new Set(numbers)).toEqual(new Set(["498"]));
+            expect(text).toContain(
+                postMerge ? "gh pr diff 498" : "git diff --no-textconv --no-ext-diff origin/master...HEAD"
+            );
+        }
+    });
+
+    test("a fresh PR's brief says the bots review next to it, not that they found nothing", () => {
+        const input = { pr: 498, title: "t", wt: "/w", base: "master", scratch: "/s", postMerge: false, swift: false };
+        const fresh = reviewBrief({ ...input, fresh: true });
+        expect(fresh).toContain("was just opened");
+        expect(fresh).not.toContain("found nothing more");
+        expect(fresh).not.toContain("already answered");
+        expect(reviewBrief(input)).toContain("found nothing more");
+    });
+});
+describe("planted-regression summary", () => {
+    test("reads bun counts and the XCTest total, and says so when there is none", () => {
+        expect(summarize("x\n 53 pass\n 3 fail\nRan 56 tests")).toBe("53 pass 3 fail");
+        expect(
+            summarize(
+                "Executed 2 tests, with 1 failure (0 unexpected) in 0.1 (0.1) seconds\nExecuted 158 tests, with 0 failures (0 unexpected) in 10.1 (10.2) seconds"
+            )
+        ).toBe("Executed 158 tests, with 0 failures (0 unexpected) in 10.1 (10.2) seconds");
+        expect(summarize("bun test v1.4.2")).toBe("no test count");
+    });
+});
+
+// d9687720a (2026-10-14): an inline resolver returned any string pick as text, so ["ours", "ours"] wrote the word
+// `ours` into both plugin manifests and the plugin did not load for 12 hours.
+describe("conflict resolution helper", () => {
+    const two = [
+        "{\n",
+        "<<<<<<< HEAD\n",
+        '    "version": "1.0.101",\n',
+        "=======\n",
+        '    "version": "1.0.99",\n',
+        ">>>>>>> pick\n",
+        '    "name": "genesis-tools",\n',
+        "<<<<<<< HEAD\n",
+        '    "a": 1\n',
+        "||||||| base\n",
+        '    "a": 0\n',
+        "=======\n",
+        '    "a": 2\n',
+        ">>>>>>> pick\n",
+        "}\n",
+    ].join("");
+    const picks = (...sides: Array<"ours" | "theirs" | "both" | "base">): ConflictPick[] =>
+        sides.map((side) => ({ side }));
+
+    test("a pick is a side or explicit text, so a side's name is never written into the file", () => {
+        expect(resolveConflictText(two, picks("ours", "theirs"))).toBe(
+            '{\n    "version": "1.0.101",\n    "name": "genesis-tools",\n    "a": 2\n}\n'
+        );
+        expect(resolveConflictText(two, picks("theirs", "base"))).toBe(
+            '{\n    "version": "1.0.99",\n    "name": "genesis-tools",\n    "a": 0\n}\n'
+        );
+        expect(resolveConflictText(two, [{ text: "" }, { side: "ours" }])).toBe(
+            '{\n    "name": "genesis-tools",\n    "a": 1\n}\n'
+        );
+        // The d9687720a call, made the way its untyped inline script made it.
+        expect(() => Reflect.apply(resolveConflictText, null, [two, ["ours", "ours"]])).toThrow("never a bare string");
+    });
+
+    test("one pick per block, every block closed, and base only from the diff3 form", () => {
+        expect(() => resolveConflictText(two, picks("ours"))).toThrow("conflict block 2 has no pick (1 given)");
+        expect(() => resolveConflictText(two, picks("ours", "ours", "ours"))).toThrow(
+            "3 pick(s) for 2 conflict block(s)"
+        );
+        expect(() => resolveConflictText("<<<<<<< HEAD\na\n=======\n", picks("ours"))).toThrow("is not closed");
+        expect(() => resolveConflictText(two, picks("base", "ours"))).toThrow("conflict block 1 has no base section");
+        expect(resolveConflictText(two, picks("both", "ours"))).toContain('"1.0.101",\n    "version": "1.0.99",\n');
+    });
+
+    test("the check names a conflict marker left and a JSON file that does not parse, and nothing else", () => {
+        const files: Record<string, string> = {
+            "src/a.ts": "export const a = 1;\n<<<<<<< HEAD\n",
+            ".claude-plugin/marketplace.json": '{\nours    "description": "Skills"\n}\n',
+            "plugins/p/.claude-plugin/plugin.json": '{ "version": "1.0.101" }\n',
+            "docs/a.md": "Title\n=======\n",
+        };
+
+        expect(resolutionProblems(Object.keys(files), (file) => files[file] ?? "")).toEqual([
+            "src/a.ts:2: conflict marker left",
+            expect.stringContaining(".claude-plugin/marketplace.json: JSON Parse error"),
+        ]);
+    });
+
+    test("the version resolver refuses a side whose manifest does not parse", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-broken-manifest-"));
+        const git = prepGit(dir);
+        const file = ".claude-plugin/marketplace.json";
+        const manifest = (version: string) => `{\n    "name": "genesis-tools",\n    "version": "${version}"\n}\n`;
+        const commit = (text: string, message: string) => {
+            fs.mkdirSync(join(dir, ".claude-plugin"), { recursive: true });
+            fs.writeFileSync(join(dir, file), text);
+            git(["add", "-A"]);
+            git(["-c", "user.name=t", "-c", "user.email=t@example.com", "commit", "-qm", message]);
+        };
+
+        git(["init", "-q", "-b", "main"]);
+        commit(manifest("1.0.80"), "base");
+        git(["checkout", "-qb", "child"]);
+        commit(manifest("1.0.81"), "child bump");
+        git(["checkout", "-q", "main"]);
+        // The higher version is on the side that already carries the stray word, as unified did after d9687720a.
+        commit(manifest("1.0.96").replace('    "name"', 'ours    "name"'), "broken bump");
+
+        expect(git(["cherry-pick", "child"]).code).not.toBe(0);
+        expect(resolveVersionConflicts(git, conflictedFiles(git))).toBe(false);
+        git(["cherry-pick", "--abort"]);
+    });
+});
+
+test("a status that keeps failing names the exit and the output, then hands over to the lead", async () => {
+    const messages: string[] = [];
+    const output = spyOn(console, "log").mockImplementation((value) => messages.push(String(value)));
+    const errors = spyOn(console, "error").mockImplementation((value) => messages.push(String(value)));
+    let time = 0;
+    const exec: typeof execTool = async () => ({
+        success: false,
+        exitCode: 1,
+        stderr: "",
+        stdout: "no session named fixture\n",
+    });
+
+    try {
+        await watchApprovals({
+            entry,
+            exec,
+            now: () => time,
+            sleep: async (ms) => {
+                time += ms;
+            },
+            timeoutMs: 1_000,
+            pollMs: 5,
+        });
+        expect(messages[0]).toBe("[approver] status failed (exit 1): no session named fixture");
+        expect(messages.filter((line) => line.startsWith("[approver] status failed"))).toHaveLength(10);
+        expect(messages.at(-1)).toBe(
+            "[approver] NEEDS LEAD: codex status failed 10 times in a row for fixture; stopped"
+        );
+        expect(time).toBe(45);
+    } finally {
+        output.mockRestore();
+        errors.mockRestore();
+    }
+});
+
+test("--run takes the run folder or its run.json, and refuses anything that would fall back to another repo", () => {
+    const dir = fs.mkdtempSync(join(tmpdir(), "babysit-run-"));
+    try {
+        const card = join(dir, "run.json");
+        fs.writeFileSync(card, SafeJSON.stringify({ repo: "example/playground" }));
+        expect(runPaths(dir)).toEqual({ runDir: dir, cardPath: card });
+        expect(runPaths(card)).toEqual({ runDir: dir, cardPath: card });
+        expect(() => runPaths(join(dir, "missing"))).toThrow("is not a folder");
+        expect(() => runPaths(join(dir, "missing", "run.json"))).toThrow("no run card");
+        fs.writeFileSync(join(dir, "notes.md"), "x");
+        expect(() => runPaths(join(dir, "notes.md"))).toThrow("is not a folder");
+    } finally {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+});
+
+describe("round 1 regression guards", () => {
+    test("version resolution preserves merged fields and rejects mixed conflicts", () => {
+        const text =
+            '{\n<<<<<<< HEAD\n    "version": "1.0.96",\n=======\n    "version": "1.0.81",\n>>>>>>> child\n    "skills": "./new-skills/"\n}\n';
+        expect(resolveVersionText(text)).toBe('{\n    "version": "1.0.96",\n    "skills": "./new-skills/"\n}\n');
+        expect(
+            resolveVersionText(text.replace('    "version": "1.0.81",', '    "version": "1.0.81",\n    "hooks": {}'))
+        ).toBeNull();
+        expect(
+            resolveVersionText(text.replace("=======", '||||||| base\n    "version": "1.0.80",\n======='))
+        ).toContain('"1.0.96"');
+        expect(resolveVersionText(text.replace(">>>>>>> child", ">>>>>>> child\n<<<<<<< unclosed"))).toBeNull();
+    });
+
+    test("an older hit never hides an added hit in a space path or an unparseable hit", () => {
+        const original = Bun.spawnSync;
+        const diff = "+++ b/docs/New Guide.md\n@@ -0,0 +1 @@\n+fixture\n";
+        let output = "    docs/old.md:4:fixture\n    docs/New Guide.md:1:fixture\n";
+        const spawn = spyOn(Bun, "spawnSync").mockImplementation((command, options) =>
+            original(
+                [
+                    process.execPath,
+                    "-e",
+                    command[0] === "bash"
+                        ? "console.log(" + SafeJSON.stringify(output) + "); process.exit(1)"
+                        : command.includes("ls-files")
+                          ? "process.stdout.write('docs/old.md\\0docs/New Guide.md\\0')"
+                          : "console.log(" + SafeJSON.stringify(diff) + ")",
+                ],
+                options
+            )
+        );
+        try {
+            expect(hitsInAddedLines(output, diff)).toEqual(["docs/New Guide.md:1"]);
+            expect(hitsInAddedLines('    "docs/New\\tGuide.md":1:fixture', diff)).toEqual(["unparseable probe hit"]);
+            expect(probeAddedLines({ wt: ".", from: "a", to: "b" })).toBe(false);
+            output = "    docs/old.md:4:fixture\n    malformed hit\n";
+            expect(probeAddedLines({ wt: ".", from: "a", to: "b" })).toBe(false);
+            output = "    docs/old.md:4:fixture\n";
+            expect(probeAddedLines({ wt: ".", from: "a", to: "b" })).toBe(true);
+            expect(
+                hitsInAddedLines("    docs/New Guide.md:1:fixture", '+++ "b/docs/New Guide.md"\n@@ -0,0 +1 @@')
+            ).toEqual(["docs/New Guide.md:1"]);
+        } finally {
+            spawn.mockRestore();
+        }
+    });
+
+    test("lsof must return a complete successful listing before reclamation", () => {
+        const original = Bun.spawnSync;
+        let code = 1;
+        let listing = "p123\nn/fixture/open\n";
+        const spawn = spyOn(Bun, "spawnSync").mockImplementation((_command, options) =>
+            original(
+                [
+                    process.execPath,
+                    "-e",
+                    "console.log(" + SafeJSON.stringify(listing) + "); process.exit(" + code + ")",
+                ],
+                options
+            )
+        );
+        try {
+            expect(() => openPaths()).toThrow("listing incomplete");
+            code = 0;
+            expect(openPaths()).toEqual(["/fixture/open"]);
+            listing = "";
+            expect(() => openPaths()).toThrow("listing incomplete");
+        } finally {
+            spawn.mockRestore();
+        }
+    });
+
+    test("executable probes remain on disk after success and timeout", async () => {
+        const original = Bun.spawn;
+        const files: string[] = [];
+        let slow = false;
+        // Run the existing interpreter, avoiding a new executable's OS approval during the test.
+        const spawn = spyOn(Bun, "spawn").mockImplementation((command, options) => {
+            files.push(String(command[0]));
+            return original(
+                slow ? [process.execPath, "-e", "await Bun.sleep(10000)"] : ["/bin/sh", String(command[0])],
+                options
+            );
+        });
+        try {
+            expect(await newExecutablesStall(1000)).toBe(false);
+            slow = true;
+            expect(await newExecutablesStall(5)).toBe(true);
+            for (const file of files) {
+                expect(fs.readFileSync(file, "utf8")).toBe("#!/bin/sh\nexit 0\n");
+            }
+            expect(files).toHaveLength(2);
+        } finally {
+            spawn.mockRestore();
+        }
+    });
+
+    test("posting failure remains a failure even when other replies succeed", () => {
+        expect(postingExitCode(1, [{ code: 0 }])).toBe(1);
+        expect(postingExitCode(0, [{ code: 1 }, { code: 0 }])).toBe(1);
+        expect(postingExitCode(0, [{ code: 0 }])).toBe(0);
+    });
+
+    test("plants require executed failures and completed passing runs", () => {
+        const failed = "(fail) regression\n 0 pass\n 1 fail\n[test] suite complete (exit 1)";
+        const passed = " 1 pass\n 0 fail\n[test] suite complete (exit 0)";
+        expect(testEvidence({ code: 1, out: failed }, true)).toBe(true);
+        expect(testEvidence({ code: 0, out: passed }, false)).toBe(true);
+        for (const out of ["error: No matching export", "0 pass\n0 fail\n[test] suite complete (exit 1)"]) {
+            expect(testEvidence({ code: 1, out }, true)).toBe(false);
+        }
+        expect(testEvidence({ code: 1, out: failed.replace("[test] suite complete (exit 1)", "") }, true)).toBe(true);
+        expect(testEvidence({ code: 1, out: "1 fail\n[test] suite complete (exit 1)" }, true)).toBe(true);
+        expect(testEvidence({ code: 0, out: passed.replace("[test] suite complete (exit 0)", "") }, false)).toBe(false);
+        expect(testEvidence({ code: 0, out: "0 pass\n0 fail\n[test] suite complete (exit 0)" }, false)).toBe(false);
+        expect(testEvidence({ code: 1, out: "Executed 2 tests, with 1 failure" }, true)).toBe(true);
+        expect(testEvidence({ code: 0, out: "Executed 2 tests, with 0 failures" }, false)).toBe(true);
+    });
+
+    test("judge pack includes the worker report next to the claims and diff", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-judge-"));
+        const report = join(dir, "report.txt");
+        fs.writeFileSync(report, "VERIFY: fixture check passed\nOPEN: fixture concern\n");
+        const result = Bun.spawnSync(
+            [process.execPath, join(import.meta.dir, "judge-pack.ts"), "--range", "HEAD..HEAD", "--report", report],
+            { stdout: "pipe", stderr: "pipe", env: process.env }
+        );
+        expect(result.exitCode).toBe(0);
+        expect(result.stdout.toString()).toContain("VERIFY: fixture check passed");
+        expect(result.stdout.toString()).toContain("OPEN: fixture concern");
+        expect(result.stdout.toString()).toContain("# Diff HEAD..HEAD");
+    });
+});
+
+describe("round 2 regression guards", () => {
+    test("log redirects approve one literal scratch path and reject shell execution", () => {
+        for (const destination of [
+            ".claude/work/babysit/x;touch${IFS}/tmp/babysit-owned",
+            ".claude/work/babysit/x;pwd",
+            ".claude/work/babysit/$(pwd)",
+            ".claude/work/babysit/\x60pwd\x60".replaceAll("\\x60", String.fromCharCode(96)),
+            ".claude/work/babysit/x|pwd",
+            ".claude/work/babysit/x&pwd",
+            ".claude/work/babysit/x\npwd",
+            ".claude/work/babysit/*",
+            ".claude/work/babysit/x outside",
+            "'../outside.log'",
+        ]) {
+            expect(allowedCommand(entry, "pwd > " + destination + " 2>&1")).toBe(false);
+        }
+        expect(allowedCommand(entry, "pwd > .claude/work/babysit/x.log 2>&1")).toBe(true);
+        expect(
+            allowedCommand(entry, "timeout 600 bunx biome check src/a.ts > '.claude/work/babysit/with space.log' 2>&1")
+        ).toBe(true);
+        expect(allowedCommand(entry, "touch outside > .claude/work/babysit/x.log 2>&1")).toBe(false);
+    });
+
+    test("Swift slot has one owner for concurrent stale-file contenders and releases on exit", async () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-slot-"));
+        const lock = join(dir, "slot.lock");
+        fs.writeFileSync(lock, "99999999");
+        const module = join(import.meta.dir, "swift-slot.ts");
+        const code =
+            "const { trySwiftSlot } = await import(" +
+            SafeJSON.stringify(module) +
+            "); const release = trySwiftSlot(" +
+            SafeJSON.stringify(lock) +
+            '); console.log(release ? "held" : "busy"); if (release) { for await (const _ of Bun.stdin.stream()) { break; } }';
+        const children = [0, 1].map(() =>
+            Bun.spawn([process.execPath, "-e", code], {
+                stdin: "pipe",
+                stdout: "pipe",
+                stderr: "pipe",
+                env: process.env,
+            })
+        );
+        try {
+            const results = await Promise.all(
+                children.map(async (child) => {
+                    const first = await child.stdout.getReader().read();
+                    return new TextDecoder().decode(first.value).trim();
+                })
+            );
+            expect(results.sort()).toEqual(["busy", "held"]);
+            expect(trySwiftSlot(lock)).toBeNull();
+        } finally {
+            for (const child of children) {
+                child.stdin.end("release\n");
+            }
+            await Promise.all(children.map((child) => child.exited));
+        }
+        const release = trySwiftSlot(lock);
+        expect(release).not.toBeNull();
+        release?.();
+        release?.();
+        expect(fs.readFileSync(lock, "utf8")).toBe("99999999");
+        // The old unlink/read race cannot arise: missing files are created and no PID file is read.
+        const fresh = trySwiftSlot(join(dir, "missing.lock"));
+        expect(fresh).not.toBeNull();
+        fresh?.();
+    });
+
+    test("standalone Swift library, executable and test commands share the package identity", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-swift-"));
+        const pkg = join(dir, "Fixture-Kit");
+        fs.mkdirSync(pkg);
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        fs.writeFileSync(
+            join(pkg, "Package.swift"),
+            'let package = Package(name: "Fixture", targets: [.target(name: "Kit"), .executableTarget(name: "App"), .testTarget(name: "KitTests")])'
+        );
+        for (const target of ["Sources/Kit", "Sources/App", "Tests/KitTests"]) {
+            fs.mkdirSync(join(pkg, target), { recursive: true });
+            fs.writeFileSync(
+                join(pkg, target, "Fixture.swift"),
+                target.startsWith("Tests/") ? "@testable import App\n" : "package func fixture() {}\n"
+            );
+        }
+        const original = Bun.spawnSync;
+        const success = original([process.execPath, "-e", ""], { stdout: "pipe", stderr: "pipe", env: process.env });
+        const commands: string[][] = [];
+        const spawn = spyOn(Bun, "spawnSync").mockImplementation((command) => {
+            const words = Array.from(command, String);
+            if (words[0] === "xcrun" && words[1] === "swiftc") {
+                commands.push(words);
+                const moduleName = words[words.indexOf("-module-name") + 1];
+                if (words.includes("-emit-module") && words.includes("-enable-testing")) {
+                    fs.writeFileSync(words[words.indexOf("-emit-module-path") + 1], "fresh " + moduleName);
+                }
+                const appModule = join(dir, "out", "App.swiftmodule");
+                const good =
+                    words.includes("-package-name") &&
+                    words[words.indexOf("-package-name") + 1] === "fixture_kit" &&
+                    (moduleName !== "KitTests" ||
+                        (fs.existsSync(appModule) && fs.readFileSync(appModule, "utf8") === "fresh App"));
+                return {
+                    ...success,
+                    exitCode: good ? 0 : 1,
+                    stderr: Buffer.from(good ? "" : "fixture.swift:1: error: package name required"),
+                };
+            }
+            return { ...success, stdout: Buffer.from(dir) };
+        });
+        const argv = process.argv;
+        process.argv = [
+            process.execPath,
+            "swift-typecheck.ts",
+            "--package",
+            pkg,
+            "--run",
+            dir,
+            "--out",
+            join(dir, "out"),
+            "--deps",
+            dir,
+        ];
+        try {
+            expect(typecheckPackage()).toBe(0);
+            expect(commands).toHaveLength(3);
+            expect(commands.filter((words) => words.includes("-emit-module"))).toHaveLength(2);
+            expect(commands.filter((words) => words.includes("-typecheck"))).toHaveLength(1);
+            const app = commands.find((words) => words.includes("App"));
+            expect(app).toContain("-enable-testing");
+            expect(fs.readFileSync(join(pkg, "Tests/KitTests/Fixture.swift"), "utf8")).toContain(
+                "@testable import App"
+            );
+        } finally {
+            spawn.mockRestore();
+            process.argv = argv;
+        }
+    });
+
+    test("worker attribution parses unchanged ledgers once, and refreshes changed or removed ledgers", () => {
+        const dirs = [0, 1].map(() => fs.mkdtempSync(join(tmpdir(), "babysit-task-")));
+        appendEvent(dirs[0], { kind: "spawn", worker: "worker", pr: 1, round: 1, at: "2026-01-01T00:00:00Z" });
+        appendEvent(dirs[1], { kind: "steer", worker: "worker", pr: 2, round: 2, at: "2026-01-01T01:00:00Z" });
+        let reads = 0;
+        const lookup = createTaskLookup({
+            dirs,
+            read: (dir) => {
+                reads++;
+                return readEvents(dir);
+            },
+        });
+        for (let n = 0; n < 100; n++) {
+            expect(lookup("worker")).toBe(" #2 r2");
+            expect(lookup("missing")).toBe("");
+        }
+        expect(reads).toBe(2);
+        appendEvent(dirs[0], { kind: "steer", worker: "worker", pr: 3, round: 1, at: "2026-01-01T02:00:00Z" });
+        expect(lookup("worker")).toBe(" #3 r1");
+        expect(reads).toBe(3);
+        fs.renameSync(join(dirs[0], "ledger.jsonl"), join(dirs[0], "saved.jsonl"));
+        expect(lookup("worker")).toBe(" #2 r2");
+        expect(reads).toBe(3);
+    });
+
+    test("failed continuations never skip nonempty picks or hide skip failures", () => {
+        let empty = false;
+        let continuation = 1;
+        let skip = 0;
+        let state = 0;
+        let unmerged = "";
+        const calls: string[] = [];
+        const git = (args: string[]) => {
+            calls.push(args.join(" "));
+            if (args[1] === "--continue") {
+                return { code: continuation, out: "commit failed" };
+            }
+            if (args[1] === "--skip") {
+                return { code: skip, out: "skip diagnostic" };
+            }
+            if (args[0] === "rev-parse") {
+                return { code: state, out: "fixture-sha" };
+            }
+            if (args[0] === "ls-files") {
+                return { code: 0, out: unmerged };
+            }
+            return { code: empty ? 0 : 1, out: "" };
+        };
+        expect(continueVersionPick(git)).toEqual({ code: 1, out: "commit failed" });
+        expect(calls).not.toContain("cherry-pick --skip");
+        empty = true;
+        expect(continueVersionPick(git).skipped).toBe(true);
+        skip = 1;
+        expect(continueVersionPick(git)).toEqual({ code: 1, out: "commit failedskip diagnostic" });
+        calls.length = 0;
+        state = 1;
+        expect(continueVersionPick(git).code).toBe(1);
+        expect(calls).not.toContain("cherry-pick --skip");
+        state = 0;
+        unmerged = "unmerged fixture";
+        expect(continueVersionPick(git).code).toBe(1);
+        expect(calls).not.toContain("cherry-pick --skip");
+        continuation = 0;
+        calls.length = 0;
+        expect(continueVersionPick(git).code).toBe(0);
+        expect(calls).toEqual(["cherry-pick --continue"]);
+    });
+
+    test("landing push is recorded before any later merge failure, and failed pushes record nothing", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-land-"));
+        const options = {
+            run: dir,
+            pr: 536,
+            branch: "fixture",
+            oldHead: "before",
+            newHead: "after",
+            result: { code: 0, out: "pushed" },
+        };
+        recordLandingPush(options);
+        expect(readEvents(dir)).toMatchObject([
+            { kind: "push", pr: 536, meta: { branch: "fixture", from: "before", to: "after", source: "land.ts" } },
+        ]);
+        expect(() => recordLandingPush({ ...options, result: { code: 1, out: "push rejected" } })).toThrow(
+            "push rejected"
+        );
+        expect(readEvents(dir)).toHaveLength(1);
+    });
+});
+
+describe("round 3 approval boundaries", () => {
+    const spec = "@@ src/a.ts\n<<<\nold\n===\nnew\n>>>";
+    const invocation = (body: string) => "bun " + trustedCli + " <<'FR'\n" + body + "\nFR";
+
+    test("GitHub review reads use complete allowlisted flags and subcommands", () => {
+        for (const command of [
+            "./tools github review 5 --resolve-thread -t PRRT_fixture",
+            "./tools github review 5 -r fixed -t PRRT_fixture",
+            "./tools github review comment 5 --body text --file src/a.ts --line 1 --now",
+            "tools github review 5 --respond=fixed --thread-id=PRRT_fixture",
+            "tools github review 5 --worktree",
+            "tools github review 5 --save",
+            "tools github review summary --resolve",
+            "tools github review expand t1 -s fixture --resolve-thread",
+            "tools github review 5 --unknown",
+            "tools github review 5 --repo",
+        ]) {
+            expect(allowedCommand(entry, command)).toBe(false);
+        }
+        for (const command of [
+            "tools github review 5 --llm -u -s fixture --repo fixture/repo",
+            "tools github review 5 --json --session=fixture --author=reviewer",
+            "tools github review expand t1,t2 --session fixture",
+            "tools github review summary -s fixture",
+            "tools github review sessions",
+        ]) {
+            expect(allowedCommand(entry, command)).toBe(true);
+        }
+    });
+
+    test("fable moves and destination-writing modifiers always require the lead", () => {
+        for (const marker of [
+            "<<< move to=src/outside.ts lines=1-1",
+            "<<<move to=src/outside.ts lines=1-1",
+            "<<< move to=src/a.ts symbol=fixture imports=fix",
+            "<<< optional move to=src/outside.ts lines=1-1",
+            "<<< to=src/outside.ts move lines=1-1",
+            "<<< renameTo=src/outside.ts",
+        ]) {
+            const command = invocation("@@ src/a.ts\n" + marker + "\n>>>");
+            expect(fableReplaceCommand(entry, command)).toBe(false);
+            expect(allowedCommand(entry, command)).toBe(false);
+        }
+        const json = '[\n/*\n@@ src/a.ts\n*/\n{"file":"src/outside.ts","createWith":"fixture"}\n]';
+        expect(fableReplaceCommand(entry, invocation(json))).toBe(false);
+        expect(fableReplaceCommand(entry, invocation(spec))).toBe(true);
+    });
+
+    test("Git readers require disabling flags before paths, without later re-enabling converters", () => {
+        for (const verb of ["diff", "show", "log", "blame", "grep"]) {
+            const safe =
+                "git " + verb + " --no-textconv" + (["diff", "show", "log"].includes(verb) ? " --no-ext-diff" : "");
+            expect(allowedCommand(entry, "git " + verb + " fixture")).toBe(false);
+            expect(allowedCommand(entry, safe)).toBe(true);
+            expect(allowedCommand(entry, safe + " --textconv")).toBe(false);
+            expect(allowedCommand(entry, safe + " --textconv=true")).toBe(false);
+            expect(allowedCommand(entry, "git " + verb + " -- --no-textconv --no-ext-diff")).toBe(false);
+        }
+        expect(allowedCommand(entry, "git diff --no-textconv")).toBe(false);
+        expect(allowedCommand(entry, "git diff --no-textconv --no-ext-diff --ext-diff=true")).toBe(false);
+    });
+
+    test("an approved Git read never reaches a configured text converter", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-converter-"));
+        const git = prepGit(dir);
+        expect(git(["init", "-q"]).code).toBe(0);
+        const marker = join(dir, "converter-ran");
+        fs.appendFileSync(join(dir, ".git/config"), '\n[diff "fixture"]\n\ttextconv = /usr/bin/touch ' + marker + "\n");
+        fs.writeFileSync(join(dir, ".gitattributes"), "*.txt diff=fixture\n");
+        fs.writeFileSync(join(dir, "fixture.txt"), "before\n");
+        expect(git(["add", "--", ".gitattributes", "fixture.txt"]).code).toBe(0);
+        fs.writeFileSync(join(dir, "fixture.txt"), "after\n");
+        // Positive fixture control proves this repository really has an executable text converter.
+        expect(git(["diff"]).code).toBe(0);
+        expect(fs.existsSync(marker)).toBe(true);
+        fs.renameSync(marker, join(dir, "positive-control"));
+        const worker = { ...entry, cwd: dir };
+        const unsafe = "git diff -- fixture.txt";
+        expect(allowedCommand(worker, unsafe)).toBe(false);
+        if (allowedCommand(worker, unsafe)) {
+            git(["diff", "--", "fixture.txt"]);
+        }
+        const safe = "git diff --no-textconv --no-ext-diff -- fixture.txt";
+        expect(allowedCommand(worker, safe)).toBe(true);
+        expect(git(["diff", "--no-textconv", "--no-ext-diff", "--", "fixture.txt"]).code).toBe(0);
+        expect(fs.existsSync(marker)).toBe(false);
+    });
+
+    test("fable heredoc terminators and shell expansions never reach command execution", () => {
+        const normal = invocation(spec);
+        expect(fableReplaceCommand(entry, normal)).toBe(true);
+        const bad = [
+            "FABLE_REPLACE_HOME=/tmp/cc/p/s/journal TMPDIR=/tmp/cc/p/s/$(true>/tmp/cc/p/s/env-expansion-proof) " +
+                normal,
+            "TMPDIR=/tmp/cc/p/s/x$(touch\x24{IFS}/tmp/cc/p/s/owned) " + normal,
+            "bun " + trustedCli + " <<'FR'\n" + spec + "\nFR\ntrue > /tmp/cc/p/s/heredoc-proof\nFR",
+            "bun " + trustedCli.replace("/plugins/", "/$(true)/plugins/") + " <<'FR'\n" + spec + "\nFR",
+        ];
+        const execute = spyOn(Bun, "spawnSync").mockImplementation(() => {
+            throw new Error("unauthorized execution reached");
+        });
+        try {
+            for (const command of bad) {
+                const decision = decide(entry, {
+                    method: "item/commandExecution/requestApproval",
+                    cwd: entry.cwd,
+                    command,
+                });
+                if (decision.ok) {
+                    Bun.spawnSync(["/bin/zsh", "-c", command], { env: process.env });
+                }
+                expect(decision.ok).toBe(false);
+            }
+            expect(execute).not.toHaveBeenCalled();
+        } finally {
+            execute.mockRestore();
+        }
+    });
+
+    test("fable CLI trust rejects worker copies and symlinks while accepting approver-owned tools", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-cli-"));
+        const fake = join(dir, ".claude/work/babysit/plugins/genesis-tools/skills/fable-replace/scripts/cli.ts");
+        fs.mkdirSync(dirname(fake), { recursive: true });
+        fs.writeFileSync(fake, "throw new Error('worker-written script executed');\n");
+        const command = (cli: string) => "bun " + cli + " <<'FR'\n" + spec + "\nFR";
+        expect(allowedCommand(entry, command(trustedCli))).toBe(true);
+        const cached = join(
+            homedir(),
+            ".codex/plugins/cache/genesis-tools/genesis-tools/1.0.107/skills/fable-replace/scripts/cli.ts"
+        );
+        if (fs.existsSync(cached)) {
+            expect(allowedCommand(entry, command(cached))).toBe(true);
+        }
+        const symlink = join(
+            dir,
+            ".claude/work/babysit/link/plugins/genesis-tools/skills/fable-replace/scripts/cli.ts"
+        );
+        fs.mkdirSync(dirname(symlink), { recursive: true });
+        fs.symlinkSync(trustedCli, symlink);
+        const execute = spyOn(Bun, "spawnSync").mockImplementation(() => {
+            throw new Error("worker script reached execution");
+        });
+        try {
+            for (const cli of [fake, symlink]) {
+                const decision = decide(entry, {
+                    method: "item/commandExecution/requestApproval",
+                    cwd: entry.cwd,
+                    command: command(cli),
+                });
+                if (decision.ok) {
+                    Bun.spawnSync(["/bin/zsh", "-c", command(cli)], { env: process.env });
+                }
+                expect(decision.ok).toBe(false);
+            }
+            expect(execute).not.toHaveBeenCalled();
+        } finally {
+            execute.mockRestore();
+        }
+    });
+});
+
+describe("round 5 carried findings", () => {
+    const workerFor = (backend: "grok" | "codex") => ({
+        backend,
+        name: "fixture",
+        label: backend + ":fixture",
+        lastAt: 0,
+        running: true,
+        stallSaid: false,
+        hiddenTools: 0,
+        seen: new Set<string>(),
+        seenTurn: 1,
+    });
+    const feed = (lines: string[]) => [
+        process.execPath,
+        "-e",
+        "process.stdout.write(" + SafeJSON.stringify(lines.join("\n") + "\n") + ")",
+    ];
+
+    test("Codex displays repeated commands within and across turns", async () => {
+        const output: string[] = [];
+        const log = spyOn(console, "log").mockImplementation((value) => output.push(String(value)));
+        const worker = workerFor("codex");
+        const tool = "\u{1f527} exec_command echo fixture";
+        try {
+            expect(
+                await pump(
+                    worker,
+                    feed(["\u25B6 turn 1", tool, tool, "\u2714 turn 1", "\u25B6 turn 2", tool, "\u2714 turn 2"])
+                )
+            ).toBe(0);
+            expect(output.filter((line) => line.includes("tool exec_command echo fixture"))).toHaveLength(3);
+            // A restarted session-long --tail 0 feed contains new events, even if their text repeats.
+            expect(await pump(worker, feed(["\u25B6 turn 3", tool, "\u2714 turn 3"]))).toBe(0);
+            expect(output.filter((line) => line.includes("tool exec_command echo fixture"))).toHaveLength(4);
+        } finally {
+            log.mockRestore();
+        }
+    });
+
+    test("Grok deduplicates replayed positions, preserving equal calls and new turns", async () => {
+        const output: string[] = [];
+        const log = spyOn(console, "log").mockImplementation((value) => output.push(String(value)));
+        const worker = workerFor("grok");
+        const tool = "\u{1f527} exec_command echo fixture";
+        const partial = ["\u25B6 turn 1", tool, "\u{1f527} read_file fixture", tool];
+        const complete = [...partial, tool, "\u2714 turn 1"];
+        try {
+            expect(await pump(worker, feed(partial))).toBe(0);
+            expect(output.filter((line) => line.includes("tool exec_command echo fixture"))).toHaveLength(2);
+            expect(worker.hiddenTools).toBe(1);
+            expect(await pump(worker, feed(complete))).toBe(0);
+            expect(output.filter((line) => line.includes("tool exec_command echo fixture"))).toHaveLength(3);
+            expect(worker.hiddenTools).toBe(1);
+            const afterComplete = output.length;
+            expect(await pump(worker, feed(complete))).toBe(0);
+            expect(output).toHaveLength(afterComplete);
+            expect(worker.hiddenTools).toBe(1);
+            worker.seenTurn = 2;
+            expect(await pump(worker, feed(["\u25B6 turn 2", tool, tool, "\u2714 turn 2"]))).toBe(0);
+            expect(output.filter((line) => line.includes("tool exec_command echo fixture"))).toHaveLength(5);
+        } finally {
+            log.mockRestore();
+        }
+    });
+
+    test("judge pack rejects invalid refs and worktrees without overwriting an existing pack", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-judge-errors-"));
+        const out = join(dir, "pack.md");
+        const script = join(import.meta.dir, "judge-pack.ts");
+        fs.writeFileSync(out, "existing approved pack\n");
+        for (const args of [
+            ["--range", "missing-fixture-ref..HEAD"],
+            ["--wt", join(dir, "missing"), "--range", "HEAD..HEAD"],
+        ]) {
+            const result = Bun.spawnSync([process.execPath, script, ...args, "--out", out], {
+                stdout: "pipe",
+                stderr: "pipe",
+                env: process.env,
+            });
+            expect(result.exitCode).not.toBe(0);
+            expect(result.stderr.toString()).toContain("git log");
+            expect(result.stderr.toString()).toContain("failed (exit");
+            expect(result.stdout.toString()).toBe("");
+            expect(fs.readFileSync(out, "utf8")).toBe("existing approved pack\n");
+        }
+    });
+
+    test("judge pack stops at any failed Git stage, including a per-file diff", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-judge-stages-"));
+        const script = join(import.meta.dir, "judge-pack.ts");
+        for (const stage of ["log", "--stat", "--name-only", "per-file"]) {
+            const preload = join(dir, stage + ".ts");
+            const out = join(dir, stage + ".md");
+            const mock = [
+                "const spawn = Bun.spawnSync;",
+                "Bun.spawnSync = (args, options) => {",
+                "  const stage = " + SafeJSON.stringify(stage) + ";",
+                "  if (args[0] === 'git') {",
+                "    const fail = stage === 'per-file' ? args[3] === 'diff' && args.includes('--') : args.includes(stage);",
+                "    if (fail) return spawn([process.execPath, '-e', 'console.error(\"fixture Git read failed\");process.exit(42)'], options);",
+                "    if (stage === 'per-file' && args.includes('--name-only')) return spawn([process.execPath, '-e', 'console.log(\"fixture.ts\")'], options);",
+                "  }",
+                "  return spawn(args, options);",
+                "};",
+            ].join("\n");
+            fs.writeFileSync(preload, mock);
+            fs.writeFileSync(out, "existing approved pack\n");
+            const result = Bun.spawnSync(
+                [process.execPath, "--preload", preload, script, "--range", "HEAD..HEAD", "--out", out],
+                { stdout: "pipe", stderr: "pipe", env: process.env }
+            );
+            expect(result.exitCode).not.toBe(0);
+            expect(result.stderr.toString()).toContain("failed (exit 42)");
+            expect(result.stderr.toString()).toContain("fixture Git read failed");
+            expect(result.stdout.toString()).toBe("");
+            expect(fs.readFileSync(out, "utf8")).toBe("existing approved pack\n");
+        }
+    });
+});
+
+test("generated worker briefs follow the size, round and dedicated-review policy", () => {
+    const dir = fs.mkdtempSync(join(tmpdir(), "babysit-policy-"));
+    const preload = join(dir, "github-fixture.ts");
+    fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+    const fixture = SafeJSON.stringify({
+        title: "Fixture review",
+        headRefName: "fixture",
+        baseRefName: "main",
+        changedFiles: 63,
+    });
+    fs.writeFileSync(
+        preload,
+        [
+            "const spawn = Bun.spawnSync;",
+            "Bun.spawnSync = (args, options) => args[0] === 'gh'",
+            " ? spawn([process.execPath, '-e', " +
+                SafeJSON.stringify("console.log(" + SafeJSON.stringify(fixture) + ")") +
+                "], options)",
+            " : spawn(args, options);",
+        ].join("\n")
+    );
+    for (const [changedFiles, round, dedicated, all] of [
+        [63, 1, false, true],
+        [63, 2, false, true],
+        [63, 3, false, false],
+        [120, 3, false, true],
+        [120, 4, false, false],
+        [120, 32, true, true],
+    ] as const) {
+        const metadata = { title: "Fixture review", headRefName: "fixture", baseRefName: "main", changedFiles };
+        fs.writeFileSync(
+            preload,
+            "Bun.spawnSync=(args)=>({exitCode:0,stdout:Buffer.from(JSON.stringify(" +
+                SafeJSON.stringify(metadata) +
+                ")),stderr:Buffer.alloc(0)});"
+        );
+        const target = join(dir, "brief-" + round + ".md");
+        const result = Bun.spawnSync(
+            [
+                process.execPath,
+                "--preload",
+                preload,
+                join(import.meta.dir, "fill-brief.ts"),
+                "--run",
+                dir,
+                "--pr",
+                "536",
+                "--round",
+                String(round),
+                ...(dedicated ? ["--dedicated-review"] : []),
+                "--wt",
+                dir,
+                "--out",
+                target,
+            ],
+            { stdout: "pipe", stderr: "pipe", env: process.env }
+        );
+        expect(result.exitCode).toBe(0);
+        const brief = fs.readFileSync(target, "utf8");
+        expect(brief).toContain(all ? "fix EVERY valid finding" : "fix Critical and High");
+        expect(brief).toContain("A valid security finding is always fixed");
+        expect(brief).toContain("Change every file the fix needs in this PR");
+        if (!all) {
+            expect(brief).toContain("deferred");
+            expect(brief).toContain("OPEN");
+            expect(brief).not.toContain("never defer");
+        }
+        expect(brief).not.toContain("not worth a change");
+        expect(brief).not.toContain("You may change only the PR's own files");
+        expect(brief).not.toContain("do NOT fix that one");
+    }
+});
+
+describe("round 6 regressions", () => {
+    test("the Grok watch loop follows the active log with finished-turn metadata", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-active-turn-"));
+        const script = join(import.meta.dir, "watch-workers.ts");
+        const cli = join(import.meta.dir, "../../../../src/utils/cli/index.ts");
+        const paths = join(import.meta.dir, "../../../../src/utils/grok/worker-paths.ts");
+        for (const [index, meta, active] of [
+            [0, { running: true, turns: 0, activeTurn: { turn: 1 } }, 1],
+            [1, { running: true, turns: 0 }, 1],
+            [2, { running: true, turns: 3, activeTurn: { turn: 7 } }, 7],
+        ] as const) {
+            const preload = join(dir, "preload-" + index + ".ts");
+            const logFile = join(dir, "turn-" + active + ".jsonl");
+            fs.writeFileSync(logFile, "fixture\n");
+            const feed = "\u{1f527} run_terminal_command echo fixture\n\u{1f4ac} Continue?\n\u2714 turn complete\n";
+            fs.writeFileSync(
+                preload,
+                [
+                    "import { mock } from 'bun:test';",
+                    "import * as cli from " + SafeJSON.stringify(cli) + ";",
+                    "import * as paths from " + SafeJSON.stringify(paths) + ";",
+                    "const originalCli = {...cli}; const originalPaths = {...paths}; let reads = 0;",
+                    "mock.module(" + SafeJSON.stringify(cli) + ", () => ({...originalCli, execTool: async (args) => {",
+                    "  if (args[0] !== 'grok' || args[1] !== 'status') throw new Error('unexpected tool execution');",
+                    "  const meta = reads++ === 0 ? " +
+                        SafeJSON.stringify(meta) +
+                        " : {running:false, turns:" +
+                        active +
+                        ",lastTurn:{turn:" +
+                        active +
+                        ",exitCode:0}};",
+                    "  return {success:true,exitCode:0,stderr:'',stdout:JSON.stringify(meta)};",
+                    "}}));",
+                    "mock.module(" +
+                        SafeJSON.stringify(paths) +
+                        ", () => ({...originalPaths, turnLogPath: (_name, turn) => " +
+                        SafeJSON.stringify(dir + "/turn-") +
+                        " + turn + '.jsonl'}));",
+                    "const spawn = Bun.spawn;",
+                    "Bun.spawn = (args, options) => {",
+                    "  if (!args.includes('grok') || !args.includes('tail')) throw new Error('unexpected child execution');",
+                    "  return spawn([process.execPath, '-e', " +
+                        SafeJSON.stringify("process.stdout.write(" + SafeJSON.stringify(feed) + ")") +
+                        "], {...options,env:process.env});",
+                    "};",
+                    "let elapsed = 0; const initial = Date.now(); Date.now = () => initial + elapsed;",
+                    "Bun.sleep = async (ms) => { elapsed += ms; if (ms === 3000) process.exit(0); };",
+                ].join("\n")
+            );
+            const result = Bun.spawnSync([process.execPath, "--preload", preload, script, "grok:fixture"], {
+                stdout: "pipe",
+                stderr: "pipe",
+                env: process.env,
+                timeout: 5000,
+            });
+            expect({ code: result.exitCode, stderr: result.stderr.toString() }).toEqual({ code: 0, stderr: "" });
+            const out = result.stdout.toString();
+            expect(out).toContain("turn " + active + " RUNNING");
+            expect(out).toContain("tool run_terminal_command echo fixture");
+            expect(out).toContain("QUESTION Continue?");
+            expect(out).toContain("turn " + active + " ENDED exit=0");
+            expect(out).not.toContain("log unavailable");
+        }
+    });
+
+    test("plant evidence accepts parsed failures without a wrapper marker and any failing XCTest count", () => {
+        for (const out of [
+            "(fail) fixture one\n(fail) fixture two\n240 pass\n2 fail\n",
+            "Executed 1 test, with 3 failures in 0.1 seconds\nExecuted 0 tests, with 0 failures\ntrailer\n",
+            "\x1b[31m 240 pass\x1b[0m\n\x1b[31m 2 fail\x1b[0m\n(fail) fixture\n",
+        ]) {
+            expect(testEvidence({ code: 1, out }, true)).toBe(true);
+            expect(testEvidence({ code: 0, out }, true)).toBe(false);
+        }
+        for (const out of [
+            "Unhandled error between tests\nSyntaxError: No matching export\n0 pass\n1 fail\n[test] suite complete (exit 1)",
+            "SyntaxError: Unexpected token\n0 pass\n1 fail\n",
+        ]) {
+            expect(testEvidence({ code: 1, out }, true)).toBe(false);
+        }
+    });
+
+    test("plant CLI distinguishes import breakage from a caught behavior fault and restores the source", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-plant-evidence-"));
+        const source = join(dir, "source.ts");
+        const preload = join(dir, "preload.ts");
+        const script = join(import.meta.dir, "plant.ts");
+        const loadFailure =
+            "Unhandled error between tests\nSyntaxError: No matching export\n0 pass\n1 fail\n[test] suite complete (exit 1)";
+        for (const [mode, failed] of [
+            ["load", loadFailure],
+            ["behavior", "(fail) fixture\n240 pass\n2 fail\n"],
+        ]) {
+            fs.writeFileSync(source, "fixed\n");
+            fs.writeFileSync(
+                preload,
+                [
+                    "import { readFileSync } from 'node:fs'; const spawn = Bun.spawnSync;",
+                    "Bun.spawnSync = (args, options) => {",
+                    "  if (args[0] === 'git') return spawn([process.execPath,'-e',args[1] === 'show' ? 'console.log(\"old\")' : 'void 0'], options);",
+                    "  if (args[0] !== 'bun' || args[1] !== 'scripts/test.ts') throw new Error('unexpected command');",
+                    "  const planted = readFileSync(" + SafeJSON.stringify(source) + ", 'utf8').trim() === 'old';",
+                    "  const out = planted ? " +
+                        SafeJSON.stringify(failed) +
+                        " : '1 pass\\n0 fail\\n[test] suite complete (exit 0)';",
+                    "  return spawn([process.execPath,'-e','console.log(' + JSON.stringify(out) + ');process.exit(' + (planted ? 1 : 0) + ')'], options);",
+                    "};",
+                ].join("\n")
+            );
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    script,
+                    "--wt",
+                    dir,
+                    "--file",
+                    "source.ts",
+                    "--test",
+                    "fixture.test.ts",
+                ],
+                { stdout: "pipe", stderr: "pipe", env: process.env, timeout: 5000 }
+            );
+            const out = result.stdout.toString();
+            expect(fs.readFileSync(source, "utf8")).toBe("fixed\n");
+            if (mode === "load") {
+                expect(result.exitCode).toBe(1);
+                expect(out).toContain("the plant broke the test's import, plant a behaviour fault instead");
+                expect(out).not.toContain("\u2714 the tests catch the fault");
+            } else {
+                expect({ code: result.exitCode, stderr: result.stderr.toString() }).toEqual({ code: 0, stderr: "" });
+                expect(out).toContain("\u2714 the tests catch the fault and pass on the fix");
+            }
+        }
+    });
+});
+
+describe("round 6 judge log regressions", () => {
+    test("XCTest totals with skipped tests provide failing and passing evidence", () => {
+        // Inline total copied from real-logs/xctest-fail-with-skipped.log; runtime never reads the work folder.
+        const total = "\t Executed 25 tests, with 1 test skipped and 1 failure (0 unexpected) in 2.120 (2.165) seconds";
+        const trailer =
+            "\n\u25C7 Test run started.\n\u2714 Test run with 0 tests in 0 suites passed after 0.001 seconds.";
+        expect(summarize(total + trailer)).toBe(total.trim());
+        expect(testEvidence({ code: 1, out: total + trailer }, true)).toBe(true);
+        expect(testEvidence({ code: 0, out: total + trailer }, false)).toBe(false);
+        for (const skipped of ["1 test skipped", "2 tests skipped"]) {
+            const passed = total.replace("1 test skipped", skipped).replace("1 failure", "0 failures");
+            expect(testEvidence({ code: 0, out: passed + trailer }, false)).toBe(true);
+            expect(testEvidence({ code: 1, out: passed + trailer }, true)).toBe(false);
+        }
+    });
+
+    test("completed Bun counts take precedence over a logged SyntaxError fixture", () => {
+        // Relevant lines copied from real-logs/bun-pass-with-syntaxerror-fixture.log.
+        const out = [
+            "WARN: [cmux-install] invalid installation manifest",
+            '      "type": "SyntaxError",',
+            "          SyntaxError: Unexpected token 'b', \"{broken\" is not valid JSON",
+            " 944 pass",
+            " 6 skip",
+            " 0 fail",
+            " 3115 expect() calls",
+            "Ran 950 tests across 114 files. [19.68s]",
+            "[test] suite complete (exit 0)",
+        ].join("\n");
+        expect(testEvidence({ code: 0, out }, false)).toBe(true);
+        expect(testEvidence({ code: 1, out }, true)).toBe(false);
+        expect(testEvidence({ code: 0, out: out.replace("944 pass", "0 pass") }, false)).toBe(false);
+        expect(testEvidence({ code: 0, out: "SyntaxError: Unexpected token" }, false)).toBe(false);
+    });
+
+    test("only whole Bun summary lines count, never test names or inline prose", () => {
+        // Summary lines copied from real-logs/bun-pass-with-syntaxerror-fixture.log.
+        const totals =
+            " 944 pass\n 6 skip\n 0 fail\n 3115 expect() calls\nRan 950 tests across 114 files. [19.68s]\n[test] suite complete (exit 0)";
+        const out = "(pass) retries 3 fail before recovering\n" + totals;
+        expect(summarize(out)).toBe("944 pass 0 fail");
+        expect(testEvidence({ code: 0, out }, false)).toBe(true);
+        expect(testEvidence({ code: 1, out }, true)).toBe(false);
+        for (const name of ["(pass) retries 3 fail before recovering", "exit 1 \u00B7 240 pass 2 fail"]) {
+            expect(summarize(name)).toBe("no test count");
+            expect(testEvidence({ code: 1, out: name }, true)).toBe(false);
+        }
+    });
+
+    test("ANSI-colored whole summary lines must be stripped before counting", () => {
+        const failed = "\u001b[32m 7 pass\u001b[0m\n\u001b[31m 1 fail\u001b[0m\n(fail) fixture\n";
+        expect(summarize(failed)).toBe("7 pass 1 fail");
+        expect(testEvidence({ code: 1, out: failed }, true)).toBe(true);
+        const passed = "\u001b[32m 7 pass\u001b[0m\n\u001b[32m 0 fail\u001b[0m\n[test] suite complete (exit 0)";
+        expect(summarize(passed)).toBe("7 pass 0 fail");
+        expect(testEvidence({ code: 0, out: passed }, false)).toBe(true);
+    });
+});
+
+describe("round 7 review regressions", () => {
+    function reclaimFixture() {
+        const dir = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-reclaim-")));
+        const root = join(dir, "tmp");
+        const run = join(dir, "run");
+        const home = join(dir, "home");
+        for (const folder of [root, run, home]) {
+            fs.mkdirSync(folder);
+        }
+        const native = join(home, ".grok", "sessions");
+        const managed = join(home, "managed", "sessions");
+        const preload = join(dir, "preload.ts");
+        const sessionModule = join(import.meta.dir, "../../../../src/utils/providers/session-paths.ts");
+        fs.writeFileSync(
+            preload,
+            [
+                "import {mock} from 'bun:test'; import * as fs from 'node:fs';",
+                "const original = {...fs};",
+                "mock.module('node:fs', () => ({...original, realpathSync: (p) => p === '/tmp' ? " +
+                    SafeJSON.stringify(root) +
+                    " : original.realpathSync(p)}));",
+                "mock.module(" +
+                    SafeJSON.stringify(sessionModule) +
+                    ", () => ({nativeSessionRoots: (kind) => kind === 'grok' ? " +
+                    SafeJSON.stringify([native, managed]) +
+                    " : [], nativeTranscriptMaxDepth: () => 4}));",
+                "const spawn = Bun.spawnSync; Bun.spawnSync = (args, opts) => {",
+                "if (args[0] !== 'lsof') throw new Error('unexpected command');",
+                "return {exitCode:0,stdout:Buffer.from('p1\\nn/unrelated-fixture-file'),stderr:Buffer.alloc(0)}; };",
+            ].join("\n")
+        );
+        const execute = (args: string[]) =>
+            Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "tmp-reclaim.ts"),
+                    "--run",
+                    run,
+                    ...args,
+                ],
+                {
+                    stdout: "pipe",
+                    stderr: "pipe",
+                    timeout: 5000,
+                    env: { ...env.getProcessEnv(), HOME: home, TMPDIR: root },
+                }
+            );
+        return { dir, root, run, native, managed, execute };
+    }
+
+    test("reclaim protects Grok directory identities from native and managed provider roots", () => {
+        const s = reclaimFixture();
+        const ids = ["55555555-5555-4555-8555-555555555555", "66666666-6666-4666-8666-666666666666"];
+        for (const [index, top] of [s.native, s.managed].entries()) {
+            const transcript = join(top, "fixture-cwd", ids[index]);
+            fs.mkdirSync(transcript, { recursive: true });
+            fs.writeFileSync(join(transcript, "chat_history.jsonl"), "{}\n");
+            fs.mkdirSync(join(s.root, "scratch-" + ids[index].slice(0, 8)));
+        }
+        const dead = join(s.root, "dead-scratch");
+        fs.mkdirSync(dead);
+        const result = s.execute(["--min-age-hours", "0"]);
+        expect({ code: result.exitCode, err: result.stderr.toString() }).toEqual({ code: 0, err: "" });
+        const planPath = /plan: (.+)/.exec(result.stdout.toString())?.[1] ?? "";
+        const plan = SafeJSON.parse(fs.readFileSync(planPath, "utf8"), { strict: true });
+        expect(plan.candidates.map((candidate: { path: string }) => candidate.path)).toEqual([dead]);
+        expect(result.stdout.toString()).toContain('"live-session":2');
+    });
+
+    test("reclaim apply rejects traversal, symlink ancestors and unplanned shapes before deletion", () => {
+        const s = reclaimFixture();
+        const outside = join(s.dir, "outside");
+        fs.mkdirSync(outside);
+        fs.mkdirSync(join(outside, "victim"));
+        fs.symlinkSync(outside, join(s.root, "linked"));
+        fs.mkdirSync(join(s.root, "deep", "victim"), { recursive: true });
+        fs.mkdirSync(join(s.root, "cc", "project", "session"), { recursive: true });
+        // A session-shaped path whose project folder is a symlink: the shape passes, only the symlink check stops it.
+        fs.mkdirSync(join(outside, "project", "session"), { recursive: true });
+        fs.symlinkSync(join(outside, "project"), join(s.root, "cc", "linked-project"));
+        const ordinary = join(s.root, "ordinary");
+        fs.mkdirSync(ordinary);
+        const paths = [
+            s.root + "/../outside/victim",
+            join(s.root, "linked", "victim"),
+            join(s.root, "deep", "victim"),
+            ordinary,
+            join(s.root, "cc", "project", "session"),
+            join(s.root, "cc", "linked-project", "session"),
+        ];
+        const plan = join(s.dir, "plan.json");
+        fs.writeFileSync(
+            plan,
+            SafeJSON.stringify({
+                createdAt: Date.now(),
+                minAgeHours: 0,
+                candidates: paths.map((path) => ({ path, ino: fs.lstatSync(path).ino, bytes: 0, newest: 0 })),
+            })
+        );
+        const result = s.execute(["--apply", "--plan", plan]);
+        expect({ code: result.exitCode, err: result.stderr.toString() }).toEqual({ code: 0, err: "" });
+        expect(fs.existsSync(join(outside, "victim"))).toBe(true);
+        expect(fs.existsSync(join(s.root, "deep", "victim"))).toBe(true);
+        expect(fs.existsSync(ordinary)).toBe(false);
+        expect(fs.existsSync(join(s.root, "cc", "project", "session"))).toBe(false);
+        expect(fs.existsSync(join(outside, "project", "session"))).toBe(true);
+        expect(result.stdout.toString()).toContain('"invalid-path":4');
+    });
+
+    test("production babysit environment access uses the facade and honors a scoped run override", async () => {
+        for (const name of new Bun.Glob("*.ts").scanSync({ cwd: import.meta.dir })) {
+            if (!name.endsWith(".test.ts")) {
+                expect(fs.readFileSync(join(import.meta.dir, name), "utf8")).not.toMatch(/\b(?:process|Bun)\.env\b/);
+            }
+        }
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-env-"));
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        const argv = process.argv;
+        process.argv = [process.execPath, "fixture.ts"];
+        try {
+            await env.testing.withOverrides({ BABYSIT_RUN: dir }, async () => expect(loadRun().dir).toBe(dir));
+        } finally {
+            process.argv = argv;
+        }
+    });
+
+    test("turn waits bound the child and preserve inner and supervisor timeout outcomes", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-wait-deadline-"));
+        appendEvent(dir, { kind: "steer", worker: "fixture", meta: { sentAt: 1000 } });
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        const preload = join(dir, "preload.ts");
+        for (const mode of ["done", "timeout", "supervisor"]) {
+            fs.writeFileSync(
+                preload,
+                [
+                    "const spawn = Bun.spawnSync; Bun.sleep = async () => {};",
+                    "Bun.spawnSync = (args, opts) => {",
+                    "if (args[0] === 'git') return spawn([process.execPath,'-e','void 0'],opts);",
+                    "if (!args.includes('wait') || args[args.indexOf('--timeout')+1] !== '5' || opts.timeout !== 35000) throw new Error('wait lacks absolute/supervisor deadline');",
+                    "const result = spawn([process.execPath,'-e','void 0'],opts);",
+                    "return {...result,exitCode:" +
+                        (mode === "done" ? 0 : 124) +
+                        ",signalCode:" +
+                        (mode === "supervisor" ? "'SIGTERM'" : "undefined") +
+                        ",stdout:Buffer.from(JSON.stringify({outcome:'" +
+                        (mode === "done" ? "done" : "timeout") +
+                        "',lastText:'fixture done'}))}; };",
+                ].join("\n")
+            );
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "wait-turn.ts"),
+                    "--run",
+                    dir,
+                    "--worker",
+                    "fixture",
+                    "--timeout",
+                    "5",
+                ],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+            );
+            expect(result.exitCode, result.stderr.toString()).toBe(mode === "done" ? 0 : 124);
+            const event = readEvents(dir).at(-1);
+            expect(event?.meta?.exit).toBe(mode === "done" ? 0 : 124);
+            expect(event?.meta?.outcome).toBe(mode === "done" ? "done" : "timeout");
+            if (mode === "supervisor") {
+                expect(event?.meta?.error).toBe("wait supervisor deadline expired");
+            }
+        }
+    });
+
+    test("run-wide ledger events retain full text, metadata and attribution like per-PR events", () => {
+        const text = Array.from({ length: 12 }, (_, i) => "audit line " + i + " " + "detail ".repeat(12)).join("\n");
+        const event = {
+            at: "2026-01-01T00:00:00Z",
+            kind: "decision" as const,
+            round: 3,
+            worker: "fixture",
+            model: "fixture-model",
+            meta: { verdict: "fixed", details: { reason: "fixture" } },
+            text,
+        };
+        const general = renderMarkdown([event]);
+        const perPr = renderMarkdown([{ ...event, pr: 1 }]);
+        expect(general).toContain(text.trim());
+        expect(general).toContain("<details><summary>text");
+        expect(general).toContain("**verdict**: fixed");
+        expect(general).toContain('"reason":"fixture"');
+        expect(general).toContain("round 3 · fixture, fixture-model");
+        expect(general.split("## Run-wide events\n\n")[1]).toBe(perPr.split("## PR #1\n\n")[1]);
+    });
+
+    test("integration uses the latest numeric prior round and explicit suffix order", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-earlier-"));
+        const write = (round: string, verdict: string) =>
+            fs.writeFileSync(
+                join(dir, "1-r" + round + "-replies.json"),
+                SafeJSON.stringify({ items: [{ threadId: "thread", verdict }] })
+            );
+        write("9", "rejected");
+        write("10", "fixed");
+        expect(earlierVerdicts({ vault: dir, pr: "1", round: "11" }).get("thread")).toBe("fixed");
+        write("10a", "rejected");
+        write("10b", "fixed");
+        expect(earlierVerdicts({ vault: dir, pr: "1", round: "10a" }).get("thread")).toBe("fixed");
+        expect(earlierVerdicts({ vault: dir, pr: "1", round: "10b" }).get("thread")).toBe("rejected");
+        expect(earlierVerdicts({ vault: dir, pr: "1", round: "11" }).get("thread")).toBe("fixed");
+        write("10", "rejected");
+        write("9", "fixed");
+        fs.unlinkSync(join(dir, "1-r10a-replies.json"));
+        fs.unlinkSync(join(dir, "1-r10b-replies.json"));
+        expect(earlierVerdicts({ vault: dir, pr: "1", round: "11" }).get("thread")).toBe("rejected");
+        expect(earlierVerdicts({ vault: dir, pr: "2", round: "11" }).size).toBe(0);
+    });
+});
+
+describe("round 7 additional review regressions", () => {
+    test("review prefetch uses bounded shared tool reads and propagates listing and expansion failures", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-prefetch-"));
+        const wt = join(dir, "worktree");
+        fs.mkdirSync(wt);
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        const preload = join(dir, "preload.ts");
+        const cli = join(import.meta.dir, "../../../../src/utils/cli/index.ts");
+        for (const failure of ["none", "listing", "expand"]) {
+            fs.writeFileSync(
+                preload,
+                [
+                    "import {mock} from 'bun:test'; import * as cli from " +
+                        SafeJSON.stringify(cli) +
+                        "; const original = {...cli};",
+                    "mock.module(" + SafeJSON.stringify(cli) + ",()=>({...original,execTool:async(args,opts)=>{",
+                    "if (args[0] !== 'github' || args[1] !== 'review' || !(opts.timeout > 0) || opts.cwd !== " +
+                        SafeJSON.stringify(dir) +
+                        ") throw new Error('wrong shared tool execution');",
+                    "const expand = args[2] === 'expand'; const fail = " +
+                        SafeJSON.stringify(failure) +
+                        " === (expand ? 'expand' : 'listing');",
+                    "return {success:!fail,exitCode:fail?9:0,stderr:fail?'fixture read failed':'',stdout:expand?'Thread ID: fixture-thread':'t1 fixture thread'}; }}));",
+                    "Bun.spawnSync = (args) => { if (args[0] !== 'git' && args[0] !== 'gh') throw new Error('bare tools execution'); return {exitCode:0,stdout:Buffer.from(args[0] === 'gh' ? '[]' : ''),stderr:Buffer.alloc(0)}; };",
+                ].join("\n")
+            );
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "fetch-threads.ts"),
+                    "--run",
+                    dir,
+                    "--wt",
+                    wt,
+                    "--pr",
+                    "1",
+                    "--round",
+                    "7",
+                ],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+            );
+            if (failure === "none") {
+                expect(result.exitCode, result.stderr.toString()).toBe(0);
+                const saved = fs.readFileSync(join(wt, ".claude/work/babysit/1-r7-threads.md"), "utf8");
+                expect(saved).toContain("t1 fixture thread");
+                expect(saved).toContain("Thread ID: fixture-thread");
+            } else {
+                expect(result.exitCode).not.toBe(0);
+                expect(result.stderr.toString()).toContain("fixture read failed");
+            }
+        }
+    });
+
+    test("a review audit fails closed for every truncated connection, including an unseen unresolved thread", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-audit-pages-"));
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        const preload = join(dir, "preload.ts");
+        const comment = (login: string) => ({ author: { login }, createdAt: "2026-01-01T00:00:00Z", body: "fixture" });
+        const threads = Array.from({ length: 101 }, (_, i) => ({
+            id: "thread-" + i,
+            isResolved: i < 100,
+            resolvedBy: { login: "fixture-lead" },
+            path: "fixture.ts",
+            comments: {
+                nodes: i < 100 ? [comment("fixture-reviewer"), comment("fixture-lead")] : [comment("fixture-reviewer")],
+            },
+        }));
+        for (const mode of ["reviewThreads", "reviews", "comments", "complete", "unresolved"]) {
+            const pullRequest = {
+                title: "fixture",
+                state: "OPEN",
+                headRefOid: "000000000",
+                reviews: { nodes: [], pageInfo: { hasNextPage: mode === "reviews" } },
+                comments: { nodes: [], pageInfo: { hasNextPage: mode === "comments" } },
+                reviewThreads: {
+                    nodes: mode === "unresolved" ? threads : threads.slice(0, 100),
+                    pageInfo: { hasNextPage: mode === "reviewThreads" },
+                },
+                timelineItems: { nodes: [] },
+            };
+            const payload = SafeJSON.stringify({
+                data: { viewer: { login: "fixture-lead" }, repository: { pullRequest } },
+            });
+            fs.writeFileSync(
+                preload,
+                "Bun.spawnSync = (args) => { if (args[0] !== 'git' && args[0] !== 'gh') throw new Error('unexpected execution'); return {exitCode:0,stdout:Buffer.from(args[0] === 'gh' ? " +
+                    SafeJSON.stringify(payload) +
+                    " : ''),stderr:Buffer.alloc(0)}; };\n"
+            );
+            const result = Bun.spawnSync(
+                [process.execPath, "--preload", preload, join(import.meta.dir, "audit-reviews.ts"), "--run", dir, "1"],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+            );
+            expect(result.exitCode, result.stderr.toString()).toBe(mode === "complete" ? 0 : 1);
+            if (["reviews", "comments", "reviewThreads"].includes(mode)) {
+                expect(result.stdout.toString()).toContain("more than 100 " + mode);
+            }
+            if (mode === "unresolved") {
+                expect(result.stdout.toString()).toContain("open 1, unanswered 1");
+            }
+        }
+    });
+});
+
+describe("round 8 review regressions", () => {
+    test("reclaim refreshes lsof before every rename and stops closed if that refresh fails", () => {
+        for (const mode of ["open", "failure"]) {
+            const dir = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-open-refresh-")));
+            const root = join(dir, "tmp");
+            const run = join(dir, "run");
+            for (const folder of [root, run, join(root, "fixture-first"), join(root, "fixture-second")]) {
+                fs.mkdirSync(folder);
+            }
+            const first = join(root, "fixture-first");
+            const second = join(root, "fixture-second");
+            fs.writeFileSync(join(second, "held.txt"), "fixture");
+            const plan = join(dir, "plan.json");
+            const moves = join(dir, "moves.txt");
+            const preload = join(dir, "preload.ts");
+            fs.writeFileSync(
+                plan,
+                SafeJSON.stringify({
+                    createdAt: Date.now(),
+                    minAgeHours: 0,
+                    candidates: [first, second].map((path) => ({
+                        path,
+                        ino: fs.lstatSync(path).ino,
+                        bytes: 0,
+                        newest: 0,
+                    })),
+                })
+            );
+            const providers = join(import.meta.dir, "../../../../src/utils/providers/session-paths.ts");
+            fs.writeFileSync(
+                preload,
+                [
+                    "import {mock} from 'bun:test'; import * as fs from 'node:fs'; const original = {...fs};",
+                    "mock.module('node:fs',()=>({...original,realpathSync:(p)=>p === '/tmp'?" +
+                        SafeJSON.stringify(root) +
+                        ":original.realpathSync(p),renameSync:(from,to)=>{original.appendFileSync(" +
+                        SafeJSON.stringify(moves) +
+                        ",from+'\\n');return original.renameSync(from,to);}}));",
+                    "mock.module(" +
+                        SafeJSON.stringify(providers) +
+                        ",()=>({nativeSessionRoots:()=>[],nativeTranscriptMaxDepth:()=>4}));",
+                    "let reads=0; Bun.spawnSync=(args)=>{if(args[0] !== 'lsof') throw new Error('unexpected command'); reads++;",
+                    "const failure=reads >= 3 && " + SafeJSON.stringify(mode) + " === 'failure';",
+                    "const open=reads >= 3 ? " +
+                        SafeJSON.stringify(second + "/held.txt") +
+                        " : '/unrelated-fixture-file';",
+                    "return {exitCode:failure?1:0,stdout:Buffer.from('p1\\nn'+open+'\\n'),stderr:Buffer.alloc(0)};};",
+                ].join("\n")
+            );
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "tmp-reclaim.ts"),
+                    "--apply",
+                    "--plan",
+                    plan,
+                    "--run",
+                    run,
+                ],
+                { stdout: "pipe", stderr: "pipe", env: { ...env.getProcessEnv(), TMPDIR: root }, timeout: 5000 }
+            );
+            expect(result.exitCode).toBe(mode === "open" ? 0 : 1);
+            expect(fs.existsSync(first)).toBe(false);
+            expect(fs.existsSync(second)).toBe(true);
+            expect(fs.readFileSync(moves, "utf8").trim().split("\n")).toEqual([first]);
+            expect(fs.readdirSync(root).filter((name) => name.startsWith(".tmp-reclaim-"))).toEqual([]);
+            if (mode === "open") {
+                expect(result.stdout.toString()).toContain('"open-file":1');
+            } else {
+                expect(result.stderr.toString()).toContain("lsof listing incomplete");
+            }
+        }
+    });
+
+    test("steering delivers the same prompt that was logged when caller and main directories differ", () => {
+        const dir = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-steer-path-")));
+        const caller = join(dir, "caller");
+        const main = join(dir, "main");
+        fs.mkdirSync(caller);
+        fs.mkdirSync(main);
+        const name = "brief with space.md";
+        const prompt = join(caller, name);
+        fs.writeFileSync(prompt, "correct caller prompt");
+        fs.writeFileSync(join(main, name), "different main prompt");
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main }));
+        const preload = join(dir, "preload.ts");
+        const received = join(dir, "received.json");
+        fs.writeFileSync(
+            preload,
+            [
+                "import {mock} from 'bun:test';import {readFileSync,writeFileSync} from 'node:fs'; import {resolve} from 'node:path';",
+                "mock.module(" +
+                    SafeJSON.stringify(join(import.meta.dir, "../../../../src/ai/commands/agent/wait.ts")) +
+                    ",()=>({readTurnBaseline:async()=>null}));",
+                "Bun.spawnSync=(args,opts)=>{if(args[0] === 'git') return {exitCode:0,stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)};",
+                "if(!args.includes('steer')) throw new Error('unexpected command');const file=args[args.indexOf('--prompt-file')+1];",
+                "writeFileSync(" +
+                    SafeJSON.stringify(received) +
+                    ",JSON.stringify({file,text:readFileSync(resolve(opts.cwd,file),'utf8')}));return {exitCode:0,stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)};};",
+                "mock.module(" +
+                    SafeJSON.stringify(join(import.meta.dir, "../../../../src/utils/cli/index.ts")) +
+                    ",()=>({execTool:async(args,opts)=>{const p=Bun.spawnSync(args,opts);return {success:p.exitCode===0,exitCode:p.exitCode,stdout:'',stderr:''};}}));",
+            ].join("\n")
+        );
+        for (const file of [name, prompt]) {
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "steer.ts"),
+                    "--run",
+                    dir,
+                    "--worker",
+                    "fixture",
+                    "--file",
+                    file,
+                ],
+                { cwd: caller, stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+            );
+            expect(result.exitCode, result.stderr.toString()).toBe(0);
+            expect(SafeJSON.parse(fs.readFileSync(received, "utf8"), { strict: true })).toEqual({
+                file: prompt,
+                text: "correct caller prompt",
+            });
+            expect(readEvents(dir).at(-1)?.text).toBe("correct caller prompt");
+        }
+    });
+});
+
+describe("round 10 review regressions", () => {
+    test("explicit protected paths shield ancestor candidates through canonical, alias and relative spellings", () => {
+        for (const spelling of ["canonical", "alias", "relative", "exact"]) {
+            const dir = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-protected-path-")));
+            const root = join(dir, "tmp");
+            const run = join(dir, "run");
+            const candidate = join(root, "candidate-box");
+            const neighbor = join(root, "candidate-box-other");
+            const session = join(root, "session-feedbeef");
+            // A folder named like the protected id in the cwd must not turn the id into a path protection only.
+            const sameName = join(root, "feedbeef");
+            for (const folder of [root, run, candidate, join(candidate, "keep"), neighbor, session, sameName]) {
+                fs.mkdirSync(folder);
+            }
+            const protectedPath =
+                spelling === "alias"
+                    ? "/tmp/candidate-box/keep"
+                    : spelling === "relative"
+                      ? "candidate-box/keep"
+                      : spelling === "exact"
+                        ? candidate
+                        : join(candidate, "keep");
+            const preload = join(dir, "preload.ts");
+            const providers = join(import.meta.dir, "../../../../src/utils/providers/session-paths.ts");
+            fs.writeFileSync(
+                preload,
+                [
+                    "import {mock} from 'bun:test'; import * as fs from 'node:fs'; const original={...fs};",
+                    "mock.module('node:fs',()=>({...original,realpathSync:(p)=>p === '/tmp'?" +
+                        SafeJSON.stringify(root) +
+                        ":original.realpathSync(p)}));",
+                    "mock.module(" +
+                        SafeJSON.stringify(providers) +
+                        ",()=>({nativeSessionRoots:()=>[],nativeTranscriptMaxDepth:()=>4}));",
+                    "Bun.spawnSync=(args)=>{if(args[0] !== 'lsof') throw new Error('unexpected command');return {exitCode:0,stdout:Buffer.from('p1\\nn/unrelated-fixture-file'),stderr:Buffer.alloc(0)};};",
+                ].join("\n")
+            );
+            const execute = (args: string[]) =>
+                Bun.spawnSync(
+                    [
+                        process.execPath,
+                        "--preload",
+                        preload,
+                        join(import.meta.dir, "tmp-reclaim.ts"),
+                        "--run",
+                        run,
+                        "--protect",
+                        protectedPath,
+                        "--protect",
+                        "feedbeef",
+                        ...args,
+                    ],
+                    {
+                        cwd: root,
+                        stdout: "pipe",
+                        stderr: "pipe",
+                        env: { ...env.getProcessEnv(), TMPDIR: root },
+                        timeout: 5000,
+                    }
+                );
+            const dry = execute(["--min-age-hours", "0"]);
+            expect(dry.exitCode, dry.stderr.toString()).toBe(0);
+            const dryPlan = /plan: (.+)/.exec(dry.stdout.toString())?.[1] ?? "";
+            const planned = SafeJSON.parse(fs.readFileSync(dryPlan, "utf8"), { strict: true });
+            expect(planned.candidates.map((c: { path: string }) => c.path)).toEqual([neighbor]);
+            const plan = join(dir, "apply.json");
+            fs.writeFileSync(
+                plan,
+                SafeJSON.stringify({
+                    createdAt: Date.now(),
+                    minAgeHours: 0,
+                    candidates: [candidate, neighbor, session].map((path) => ({
+                        path,
+                        ino: fs.lstatSync(path).ino,
+                        bytes: 0,
+                        newest: 0,
+                    })),
+                })
+            );
+            const applied = execute(["--apply", "--plan", plan]);
+            expect(applied.exitCode, applied.stderr.toString()).toBe(0);
+            expect(fs.existsSync(join(candidate, "keep"))).toBe(true);
+            expect(fs.existsSync(session)).toBe(true);
+            expect(fs.existsSync(neighbor)).toBe(false);
+        }
+    });
+
+    test("saved waits retain done, failed, stalled and timeout statuses and reject malformed reports", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-saved-wait-"));
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        const preload = join(dir, "preload.ts");
+        fs.writeFileSync(
+            preload,
+            "Bun.spawnSync=(args)=>{if(args[0] !== 'git') throw new Error('saved waits must not launch workers');return {exitCode:0,stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)};};\n"
+        );
+        const reports = [
+            {
+                raw: SafeJSON.stringify({ outcome: "done", error: null, lastText: "fixture done" }),
+                code: 0,
+                outcome: "done",
+            },
+            {
+                raw: SafeJSON.stringify({ outcome: "stalled", error: null, lastText: "fixture stalled" }),
+                code: 3,
+                outcome: "stalled",
+            },
+            {
+                raw: SafeJSON.stringify({ outcome: "timeout", error: null, lastText: "fixture timeout" }),
+                code: 124,
+                outcome: "timeout",
+            },
+            {
+                raw: SafeJSON.stringify({ outcome: "done", error: "fixture failed", lastText: "" }),
+                code: 4,
+                outcome: "done",
+            },
+            ...[
+                "{broken",
+                "{}",
+                "null",
+                "[]",
+                '{"outcome":"unknown"}',
+                '{"outcome":"done","error":false}',
+                '{"outcome":"done","lastText":7}',
+            ].map((raw) => ({ raw, code: 1, outcome: "error" })),
+        ];
+        for (const [index, report] of reports.entries()) {
+            const saved = join(dir, "wait-" + index + ".json");
+            fs.writeFileSync(saved, report.raw);
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "wait-turn.ts"),
+                    "--run",
+                    dir,
+                    "--worker",
+                    "fixture",
+                    "--from-file",
+                    saved,
+                ],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+            );
+            expect(result.exitCode, result.stderr.toString()).toBe(report.code);
+            const event = readEvents(dir).at(-1);
+            expect(event?.meta?.exit).toBe(report.code);
+            expect(event?.meta?.outcome).toBe(report.outcome);
+        }
+    });
+
+    test("a recovered ledger line and invalid timestamp render with an explicit unknown time", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-ledger-recovery-"));
+        appendEvent(dir, { kind: "note", at: "2026-01-01T00:00:00Z", text: "valid before" });
+        fs.appendFileSync(join(dir, "ledger.jsonl"), "{truncated append\n");
+        appendEvent(dir, { kind: "note", at: "not-a-time", text: "invalid timestamp survives" });
+        appendEvent(dir, { kind: "note", at: "2026-01-01T00:01:00Z", text: "valid after" });
+        const events = readEvents(dir);
+        const rendered = renderMarkdown(events);
+        expect(rendered).toContain("(unreadable ledger line) {truncated append");
+        expect(rendered).toContain("unknown time");
+        expect(rendered).toContain("invalid timestamp survives");
+        expect(rendered).toContain("valid before");
+        expect(rendered).toContain("valid after");
+        expect(rendered).toContain("01:00:00");
+        expect(renderMarkdown([{ at: "", kind: "note", pr: 1, text: "per-PR recovered note" }])).toContain(
+            "unknown time"
+        );
+    });
+
+    test("the audit fails reviewer-resolved unanswered threads but exempts our own documented resolutions", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-silent-resolution-"));
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        const preload = join(dir, "preload.ts");
+        const comment = (login: string) => ({
+            author: { login },
+            createdAt: "2026-01-01T00:00:00Z",
+            body: "fixture finding",
+        });
+        for (const mode of ["silent", "ours", "answered"]) {
+            const thread = {
+                id: "fixture-thread",
+                isResolved: true,
+                resolvedBy: { login: mode === "ours" ? "fixture-lead" : "fixture-reviewer" },
+                path: "fixture.ts",
+                comments: {
+                    nodes:
+                        mode === "answered"
+                            ? [comment("fixture-reviewer"), comment("fixture-lead")]
+                            : [comment("fixture-reviewer")],
+                },
+            };
+            const pullRequest = {
+                title: "fixture",
+                state: "OPEN",
+                headRefOid: "000000000",
+                reviews: { nodes: [], pageInfo: { hasNextPage: false } },
+                comments: { nodes: [], pageInfo: { hasNextPage: false } },
+                reviewThreads: { nodes: [thread], pageInfo: { hasNextPage: false } },
+                timelineItems: { nodes: [] },
+            };
+            const payload = SafeJSON.stringify({
+                data: { viewer: { login: "fixture-lead" }, repository: { pullRequest } },
+            });
+            fs.writeFileSync(
+                preload,
+                "Bun.spawnSync=(args)=>{if(args[0] !== 'git' && args[0] !== 'gh') throw new Error('unexpected command');return {exitCode:0,stdout:Buffer.from(args[0] === 'gh'?" +
+                    SafeJSON.stringify(payload) +
+                    ":''),stderr:Buffer.alloc(0)};};\n"
+            );
+            for (const flags of [[], ["--bodies"]]) {
+                const result = Bun.spawnSync(
+                    [
+                        process.execPath,
+                        "--preload",
+                        preload,
+                        join(import.meta.dir, "audit-reviews.ts"),
+                        "--run",
+                        dir,
+                        "1",
+                        ...flags,
+                    ],
+                    { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+                );
+                expect(result.exitCode, result.stderr.toString()).toBe(mode === "silent" ? 1 : 0);
+            }
+        }
+    });
+});
+
+describe("round 18 review regressions", () => {
+    test("uniq parses valued options and counts every operand including dash-prefixed outputs", () => {
+        for (const command of [
+            "uniq -- in.txt -out.txt",
+            "uniq in.txt out.txt",
+            "uniq in.txt -c",
+            "uniq -f 2 -- in.txt -out.txt",
+            "uniq -f2 -s 1 in.txt out.txt",
+            "uniq --skip-fields=2 --skip-chars 1 in.txt out.txt",
+            "uniq -f in.txt",
+        ]) {
+            expect(readOnlyChain(entry, command), command).toBe(false);
+            expect(allowedCommand(entry, command), command).toBe(false);
+            expect(
+                decide(entry, { method: "item/commandExecution/requestApproval", command, cwd: entry.cwd }).ok,
+                command
+            ).toBe(false);
+        }
+        for (const command of [
+            "uniq -c in.txt",
+            "uniq -f 2 -s 1 -w4 in.txt",
+            "uniq -cf2 in.txt",
+            "uniq --skip-fields=2 --skip-chars 1 --check-chars=4 in.txt",
+            "uniq -- -input.txt",
+            "uniq -c",
+        ]) {
+            expect(readOnlyChain(entry, command), command).toBe(true);
+        }
+    });
+
+    test("both Swift plant runs use the shared slot with a bounded acquisition deadline", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-swift-plant-slot-"));
+        const source = join(dir, "source.ts");
+        fs.writeFileSync(source, "fixed\n");
+        fs.mkdirSync(join(dir, "Package"));
+        const calls = join(dir, "calls.jsonl");
+        const preload = join(dir, "preload.ts");
+        fs.writeFileSync(
+            preload,
+            [
+                "import {appendFileSync,readFileSync} from 'node:fs';const source=" + SafeJSON.stringify(source) + ";",
+                "const result=(code,out='')=>({exitCode:code,stdout:Buffer.from(out),stderr:Buffer.alloc(0)});",
+                "Bun.spawnSync=(args,opts)=>{if(args[0] === 'git') return result(0,args[1] === 'show'?'old\\n':'');",
+                "if(!args.includes('swift') || !args.includes('test')) throw new Error('unexpected command');appendFileSync(" +
+                    SafeJSON.stringify(calls) +
+                    ",JSON.stringify({args,cwd:opts.cwd})+'\\n');const failed=readFileSync(source,'utf8') === 'old\\n';return result(failed?1:0,'Executed 1 test, with '+(failed?1:0)+' failures (0 unexpected)\\n');};",
+            ].join("\n")
+        );
+        const result = Bun.spawnSync(
+            [
+                process.execPath,
+                "--preload",
+                preload,
+                join(import.meta.dir, "plant.ts"),
+                "--wt",
+                dir,
+                "--file",
+                "source.ts",
+                "--swift-package",
+                "Package",
+                "--swift-filter",
+                "FixtureSuite",
+            ],
+            { stdout: "pipe", stderr: "pipe", env: { ...env.getProcessEnv(), TMPDIR: dir }, timeout: 5000 }
+        );
+        expect(result.exitCode, result.stdout.toString() + result.stderr.toString()).toBe(0);
+        const recorded = fs
+            .readFileSync(calls, "utf8")
+            .trim()
+            .split("\n")
+            .map((line) => SafeJSON.parse(line, { strict: true }));
+        expect(recorded).toHaveLength(2);
+        for (const call of recorded) {
+            expect(call).toEqual({
+                args: [
+                    "bun",
+                    join(import.meta.dir, "swift-slot.ts"),
+                    "--wait-minutes",
+                    "40",
+                    "--run-minutes",
+                    "60",
+                    "--",
+                    "swift",
+                    "test",
+                    "--filter",
+                    "FixtureSuite",
+                ],
+                cwd: join(dir, "Package"),
+            });
+        }
+        expect(fs.readFileSync(source, "utf8")).toBe("fixed\n");
+    });
+
+    test("review watcher bounds each child by its remaining lifetime and reports expiry", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-review-watch-limit-"));
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        for (const mode of ["hung", "updates", "failure", "invalid"]) {
+            const preload = join(dir, "preload.ts");
+            const facts = join(dir, "facts.json");
+            fs.writeFileSync(
+                preload,
+                [
+                    "import {writeFileSync} from 'node:fs';const mode=" +
+                        SafeJSON.stringify(mode) +
+                        ";let now=0;const timeouts=[];Date.now=()=>now;",
+                    "Bun.sleep=async(ms)=>{now+=ms;if(now>1000) throw new Error('fixture missed deadline');};",
+                    "Bun.spawnSync=(args,opts)=>{if(args[0] === 'git') return {exitCode:0,stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)};if(args[0] !== 'bun' || !args[1].endsWith('round-ready.ts')) throw new Error('unexpected command');timeouts.push(opts.timeout??null);if(mode === 'hung') now+=opts.timeout??301;return {exitCode:['failure','hung'].includes(mode)?1:0,stdout:Buffer.from(mode === 'updates'?'#1 '+(timeouts.length<3?'same':'new')+'\\n':''),stderr:Buffer.from('fixture query failed')};};",
+                    "process.on('exit',()=>writeFileSync(" +
+                        SafeJSON.stringify(facts) +
+                        ",JSON.stringify({timeouts,now})));",
+                ].join("\n")
+            );
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "watch-reviews.ts"),
+                    "--run",
+                    dir,
+                    "--for",
+                    mode === "invalid" ? "Infinity" : "0.005",
+                    "--every",
+                    "0.1",
+                    "1",
+                ],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+            );
+            expect(result.exitCode, result.stdout.toString() + result.stderr.toString()).toBe(
+                mode === "invalid" ? 2 : 124
+            );
+            const seen = SafeJSON.parse(fs.readFileSync(facts, "utf8"), { strict: true }) as {
+                timeouts: number[];
+                now: number;
+            };
+            expect(seen.timeouts).toEqual(mode === "invalid" ? [] : mode === "hung" ? [300] : [300, 200, 100]);
+            if (mode !== "invalid") {
+                expect(result.stdout.toString()).toContain("expired");
+                expect(seen.now).toBe(300);
+            }
+            if (mode === "updates") {
+                expect(result.stdout.toString().match(/#1 same/g)).toHaveLength(1);
+                expect(result.stdout.toString()).toContain("#1 new");
+            }
+            if (mode === "failure") {
+                expect(result.stdout.toString()).toContain("round-ready failed");
+            }
+        }
+    });
+
+    test("a signalled Swift supervisor retains its slot while its child remains alive", async () => {
+        for (const signal of ["SIGTERM", "SIGINT"] as const) {
+            const dir = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-slot-signal-")));
+            const ready = join(dir, "ready");
+            const received = join(dir, "received");
+            const probe = join(dir, "probe");
+            const alive = join(dir, "alive");
+            const release = join(dir, "release");
+            const ended = join(dir, "ended");
+            const preload = join(dir, "preload.ts");
+            const processes = join(import.meta.dir, "../../../../src/utils/process/processes.ts");
+            fs.writeFileSync(
+                preload,
+                "import {mock} from 'bun:test';mock.module(" +
+                    SafeJSON.stringify(processes) +
+                    ",()=>({listProcesses:()=>[]}));"
+            );
+            const childCode = [
+                "import {writeFileSync} from 'node:fs';import {waitForPath} from " +
+                    SafeJSON.stringify(join(import.meta.dir, "../../../../src/utils/fs/watcher.ts")) +
+                    ";",
+                ...["SIGTERM", "SIGINT"].map(
+                    (sig) =>
+                        "process.on('" +
+                        sig +
+                        "',()=>writeFileSync(" +
+                        SafeJSON.stringify(received) +
+                        ",'" +
+                        sig +
+                        "'));"
+                ),
+                "writeFileSync(" +
+                    SafeJSON.stringify(ready) +
+                    ",'ready');await waitForPath(" +
+                    SafeJSON.stringify(probe) +
+                    ",{timeoutMs:4000});writeFileSync(" +
+                    SafeJSON.stringify(alive) +
+                    ",'child alive after supervisor signal');await waitForPath(" +
+                    SafeJSON.stringify(release) +
+                    ",{timeoutMs:4000});writeFileSync(" +
+                    SafeJSON.stringify(ended) +
+                    ",'exited');process.exit(0);",
+            ].join("\n");
+            const supervisor = Bun.spawn(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "swift-slot.ts"),
+                    "--wait-minutes",
+                    "1",
+                    "--",
+                    process.execPath,
+                    "-e",
+                    childCode,
+                ],
+                { stdin: "ignore", stdout: "ignore", stderr: "pipe", env: { ...env.getProcessEnv(), TMPDIR: dir } }
+            );
+            try {
+                expect(await waitForPath(ready, { timeoutMs: 3000 })).toBe(true);
+                supervisor.kill(signal);
+                const controller = new AbortController();
+                try {
+                    await Promise.race([
+                        supervisor.exited,
+                        waitForPath(received, { timeoutMs: 2500, signal: controller.signal }),
+                    ]);
+                } finally {
+                    controller.abort();
+                }
+                fs.writeFileSync(probe, "probe");
+                expect(await waitForPath(alive, { timeoutMs: 2000 })).toBe(true);
+                expect(fs.existsSync(ended)).toBe(false);
+                const contenderCode =
+                    "import {trySwiftSlot} from " +
+                    SafeJSON.stringify(join(import.meta.dir, "swift-slot.ts")) +
+                    ";const release=trySwiftSlot(" +
+                    SafeJSON.stringify(join(dir, "genesis-swift-slot.lock")) +
+                    ");console.log(release?'held':'busy');release?.();";
+                const contender = Bun.spawnSync([process.execPath, "-e", contenderCode], {
+                    stdout: "pipe",
+                    stderr: "pipe",
+                    env: env.getProcessEnv(),
+                    timeout: 3000,
+                });
+                expect(contender.exitCode, contender.stderr.toString()).toBe(0);
+                expect(contender.stdout.toString().trim()).toBe("busy");
+                expect(fs.readFileSync(received, "utf8")).toBe(signal);
+                expect(supervisor.exitCode).toBeNull();
+                fs.writeFileSync(release, "release");
+                expect(await supervisor.exited).toBe(signal === "SIGTERM" ? 143 : 130);
+            } finally {
+                fs.writeFileSync(probe, "cleanup");
+                fs.writeFileSync(release, "cleanup");
+                await waitForPath(ended, { timeoutMs: 4500 });
+                if (supervisor.exitCode === null) {
+                    supervisor.kill("SIGKILL");
+                }
+                await supervisor.exited;
+            }
+            const reacquired = trySwiftSlot(join(dir, "genesis-swift-slot.lock"));
+            expect(reacquired).not.toBeNull();
+            reacquired?.();
+        }
+    }, 15000);
+});
+
+describe("round 17 review regressions", () => {
+    test("landing refuses staged, unstaged and unreadable status before moving HEAD", () => {
+        for (const mode of ["staged", "unstaged", "status-error", "clean"]) {
+            const dir = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-landing-dirty-")));
+            const wt = join(dir, "worker");
+            fs.mkdirSync(wt);
+            const git = (...args: string[]) => {
+                const result = Bun.spawnSync(["git", "-c", "core.hooksPath=/dev/null", ...args], {
+                    cwd: wt,
+                    stdout: "pipe",
+                    stderr: "pipe",
+                    env: env.getProcessEnv(),
+                });
+                expect(result.exitCode, result.stderr.toString()).toBe(0);
+                return result.stdout.toString();
+            };
+            git("init", "-q");
+            git("config", "user.name", "Fixture");
+            git("config", "user.email", "fixture@example.com");
+            fs.writeFileSync(join(wt, "local.txt"), "base\n");
+            git("add", "--", "local.txt");
+            git("commit", "-qm", "base");
+            git("update-ref", "refs/remotes/origin/main", git("rev-parse", "HEAD").trim());
+            for (const [i, message] of [
+                "feat(tools): fixture",
+                "fix(tools): #1 followup - first",
+                "fix(tools): #1 followup - second",
+            ].entries()) {
+                fs.writeFileSync(join(wt, "feature.txt"), String(i));
+                git("add", "--", "feature.txt");
+                git("commit", "-qm", message);
+            }
+            git("update-ref", "refs/remotes/origin/pr-head", git("rev-parse", "HEAD").trim());
+            if (mode === "staged") {
+                fs.writeFileSync(join(wt, "local.txt"), "staged work\n");
+                git("add", "--", "local.txt");
+                fs.appendFileSync(join(wt, "local.txt"), "unstaged work\n");
+            } else if (mode === "unstaged") {
+                fs.writeFileSync(join(wt, "local.txt"), "unstaged work\n");
+            }
+            const before = {
+                head: git("rev-parse", "HEAD"),
+                branch: git("symbolic-ref", "HEAD"),
+                index: git("diff", "--cached", "--binary"),
+                working: git("diff", "--binary"),
+                text: fs.readFileSync(join(wt, "local.txt"), "utf8"),
+            };
+            fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "genesiscz/GenesisTools", main: wt }));
+            const moved = join(dir, "moves.txt");
+            const preload = join(dir, "preload.ts");
+            fs.writeFileSync(
+                preload,
+                [
+                    "import {appendFileSync} from 'node:fs';const spawn=Bun.spawnSync;const mode=" +
+                        SafeJSON.stringify(mode) +
+                        ";",
+                    "const result=(code,out='')=>({exitCode:code,stdout:Buffer.from(out),stderr:Buffer.alloc(0)});",
+                    'Bun.spawnSync=(args,opts)=>{if(args[0] === \'gh\') {if(args[1] !== \'pr\' || args[2] !== \'view\') throw new Error(\'no GitHub writes\');return result(0,\'{"headRefName":"pr-head","baseRefName":"main","state":"OPEN"}\');}',
+                    "if(args[0] === 'git') {if(args.includes('fetch')) return result(0);if(args.includes('status') && mode === 'status-error') return result(2,'fixture status failed');if(args.some(arg=>['checkout','reset','commit'].includes(arg))) appendFileSync(" +
+                        SafeJSON.stringify(moved) +
+                        ",'move\\n');if(args.includes('push')) throw new Error('no push');return spawn(args,opts);}",
+                    "if(args[0] === 'bun' && args[1] === 'scripts/git/check-commits.ts') return result(0);throw new Error('unexpected command');};",
+                ].join("\n")
+            );
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "land.ts"),
+                    "--run",
+                    dir,
+                    "--wt",
+                    wt,
+                    "--pr",
+                    "1",
+                ],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 10000 }
+            );
+            expect(result.exitCode, result.stdout.toString() + result.stderr.toString()).toBe(mode === "clean" ? 0 : 1);
+            if (mode === "clean") {
+                expect(result.stdout.toString()).toContain("dry:");
+            } else {
+                expect(result.stderr.toString()).toContain(mode === "status-error" ? "status" : "uncommitted");
+                expect(fs.existsSync(moved)).toBe(false);
+                expect(git("rev-parse", "HEAD")).toBe(before.head);
+                expect(git("symbolic-ref", "HEAD")).toBe(before.branch);
+                expect(git("diff", "--cached", "--binary")).toBe(before.index);
+                expect(git("diff", "--binary")).toBe(before.working);
+                expect(fs.readFileSync(join(wt, "local.txt"), "utf8")).toBe(before.text);
+            }
+        }
+    });
+
+    test("integration Biome accepts ignored-only JSON changes and still refuses real lint errors", () => {
+        for (const mode of ["ignored", "lint-error"]) {
+            const dir = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-integrate-unmatched-")));
+            const wt = join(dir, "worker");
+            fs.mkdirSync(wt);
+            const git = (...args: string[]) => {
+                const result = Bun.spawnSync(["git", "-c", "core.hooksPath=/dev/null", ...args], {
+                    cwd: wt,
+                    stdout: "pipe",
+                    stderr: "pipe",
+                    env: env.getProcessEnv(),
+                });
+                expect(result.exitCode, result.stderr.toString()).toBe(0);
+                return result.stdout.toString().trim();
+            };
+            git("init", "-q");
+            git("config", "user.name", "Fixture");
+            git("config", "user.email", "fixture@example.com");
+            fs.copyFileSync(join(import.meta.dir, "../../../../biome.json"), join(wt, "biome.json"));
+            fs.mkdirSync(join(wt, ".claude-plugin"));
+            fs.mkdirSync(join(wt, "src"));
+            fs.writeFileSync(join(wt, ".claude-plugin/plugin.json"), '{"version":"1.0.0"}\n');
+            fs.writeFileSync(join(wt, "src/fixture.ts"), 'export const fixture = "valid";\n');
+            git("add", "--", "biome.json", ".claude-plugin/plugin.json", "src/fixture.ts");
+            git("commit", "-qm", "base");
+            git("update-ref", "refs/remotes/origin/pr-head", git("rev-parse", "HEAD"));
+            const changed = mode === "ignored" ? ".claude-plugin/plugin.json" : "src/fixture.ts";
+            fs.writeFileSync(
+                join(wt, changed),
+                mode === "ignored" ? '{"version":"1.0.1"}\n' : "export const fixture = JSON.stringify({});\n"
+            );
+            git("add", "--", changed);
+            git("commit", "-qm", "fixture round");
+            fs.symlinkSync(join(import.meta.dir, "../../../../node_modules"), join(wt, "node_modules"));
+            fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "genesiscz/GenesisTools", main: wt }));
+            const preload = join(dir, "preload.ts");
+            fs.writeFileSync(
+                preload,
+                [
+                    "const spawn=Bun.spawnSync;const result=(code,out='')=>({exitCode:code,stdout:Buffer.from(out),stderr:Buffer.alloc(0)});",
+                    "Bun.spawnSync=(args,opts)=>{if(args[0] === 'gh') {if(args[1] !== 'pr' || args[2] !== 'view') throw new Error('no GitHub writes');return result(0,'{\"headRefName\":\"pr-head\",\"baseRefName\":\"main\"}');}",
+                    "if(args[0] === 'git') {if(args.includes('fetch')) return result(0);if(args.includes('push')) throw new Error('no pushes');return spawn(args,opts);}",
+                    "if(args[0].endsWith('/biome') || (args[0] === 'bunx' && args[1] === 'biome')) return spawn(args,opts);",
+                    "return result(0,args.includes('scripts/git/check-commits.ts')?'0 with a subject to fix':'');};",
+                ].join("\n")
+            );
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "integrate.ts"),
+                    "--run",
+                    dir,
+                    "--wt",
+                    wt,
+                    "--pr",
+                    "1",
+                    "--dry",
+                ],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 10000 }
+            );
+            expect(result.exitCode, result.stdout.toString() + result.stderr.toString()).toBe(
+                mode === "ignored" ? 0 : 1
+            );
+            expect(result.stdout.toString()).toContain(mode === "ignored" ? "dry: push skipped" : "biome failed");
+            if (mode === "lint-error") {
+                expect(result.stdout.toString()).toContain("noRestrictedGlobals");
+            }
+        }
+    });
+});
+
+describe("round 16 review regressions", () => {
+    test("disk watcher expires, bounds df and still reports low space and query failures", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-df-expiry-"));
+        for (const mode of ["expiry", "default", "blocked", "low", "failure", "invalid", "bad-lifetime"]) {
+            const preload = join(dir, "preload.ts");
+            const facts = join(dir, "facts.json");
+            fs.writeFileSync(
+                preload,
+                [
+                    "import {writeFileSync} from 'node:fs';const mode=" +
+                        SafeJSON.stringify(mode) +
+                        ";let now=0;const calls=[],sleeps=[];",
+                    "Date.now=()=>now;const lifetime=mode === 'default'?1800000:60;",
+                    "Bun.sleep=async(ms)=>{sleeps.push(ms);now+=ms;if(now>lifetime+1) throw new Error('fixture: watcher missed its deadline');};",
+                    "Bun.spawnSync=(args,opts)=>{if(args[0] !== 'df') throw new Error('unexpected command');calls.push(opts.timeout??null);if(mode === 'blocked') now+=opts.timeout??1000;return {exitCode:mode === 'failure'||mode === 'blocked'?1:0,stderr:Buffer.from('fixture df error'),stdout:Buffer.from(mode === 'invalid'?'bad output':'Filesystem 1K-blocks Used Available Capacity Mounted\\nfixture 100 0 '+(mode === 'low'?1048576:104857600)+' 0% /\\n')};};",
+                    "process.on('exit',()=>writeFileSync(" +
+                        SafeJSON.stringify(facts) +
+                        ",JSON.stringify({calls,sleeps,now})));",
+                ].join("\n")
+            );
+            const flags = mode === "default" ? [] : ["--for", mode === "bad-lifetime" ? "Infinity" : "0.001"];
+            const result = Bun.spawnSync(
+                [process.execPath, "--preload", preload, join(import.meta.dir, "df-watch.ts"), ...flags],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+            );
+            const expected = ["expiry", "default", "blocked"].includes(mode)
+                ? 124
+                : mode === "low"
+                  ? 0
+                  : mode === "bad-lifetime"
+                    ? 2
+                    : 1;
+            expect(result.exitCode, result.stdout.toString() + result.stderr.toString()).toBe(expected);
+            const seen = SafeJSON.parse(fs.readFileSync(facts, "utf8"), { strict: true }) as {
+                calls: number[];
+                sleeps: number[];
+                now: number;
+            };
+            if (mode === "bad-lifetime") {
+                expect(seen.calls).toEqual([]);
+                continue;
+            }
+            expect(seen.calls.length).toBeGreaterThan(0);
+            expect(seen.calls.every((timeout) => timeout > 0 && timeout <= 30000)).toBe(true);
+            if (mode === "expiry") {
+                expect(seen.calls).toEqual([60]);
+                expect(seen.sleeps).toEqual([60]);
+                expect(result.stdout.toString()).toContain("expired");
+            }
+            if (mode === "low") {
+                expect(result.stdout.toString()).toContain("LOW DISK");
+                expect(seen.sleeps).toEqual([]);
+            }
+        }
+    });
+});
+
+describe("round 15 review regressions", () => {
+    test("reader variable assignments and other write options require the lead", async () => {
+        const commands = [
+            "printf -v PATH /tmp/worker-bin; cat src/a.ts",
+            "printf -vPATH /tmp/worker-bin; cat src/a.ts",
+            "printf '%n' PATH; cat src/a.ts",
+            "printf '%10n' PATH; cat src/a.ts",
+            "stat -A PATH src/a.ts; cat src/a.ts",
+            "stat -H PATH src/a.ts; cat src/a.ts",
+            "gh api repos/fixture/repo --cache 1h",
+            "tools ts duplicates src --recommend=true",
+        ];
+        const messages: string[] = [];
+        const output = spyOn(console, "log").mockImplementation((line) => messages.push(String(line)));
+        const errors = spyOn(console, "error").mockImplementation(() => {});
+        try {
+            for (const command of commands) {
+                expect(readOnlyChain(entry, command), command).toBe(false);
+                let time = 0;
+                const exec: typeof execTool = async (args) => {
+                    if (args[1] === "approve") {
+                        throw new Error("unsafe approval reached");
+                    }
+                    return {
+                        success: true,
+                        exitCode: 0,
+                        stderr: "",
+                        stdout: SafeJSON.stringify({
+                            pendingApprovals: {
+                                write: {
+                                    method: "item/commandExecution/requestApproval",
+                                    cwd: entry.cwd,
+                                    command,
+                                    detail: "sandbox escalation: " + command,
+                                },
+                            },
+                        }),
+                    };
+                };
+                const start = messages.length;
+                await watchApprovals({
+                    entry,
+                    exec,
+                    now: () => time,
+                    sleep: async (ms) => {
+                        time += ms;
+                    },
+                    pollMs: 5,
+                    timeoutMs: 10,
+                });
+                expect(
+                    messages.slice(start).some((line) => line.includes("NEEDS LEAD #write")),
+                    command
+                ).toBe(true);
+            }
+            for (const command of [
+                "printf '%s\\n' hello",
+                "printf -- '%d' 3",
+                "stat -f '%N' src/a.ts",
+                "gh api repos/fixture/repo",
+                "tools ts duplicates src",
+            ]) {
+                expect(readOnlyChain(entry, command), command).toBe(true);
+            }
+        } finally {
+            output.mockRestore();
+            errors.mockRestore();
+        }
+    });
+
+    test("generated non-Codex Swift briefs use the kernel slot for build and test", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-swift-brief-"));
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        const preload = join(dir, "preload.ts");
+        fs.writeFileSync(
+            preload,
+            "Bun.spawnSync=(args)=>{if(args[0] !== 'gh' && args[0] !== 'git') throw new Error('unexpected command');return {exitCode:0,stdout:Buffer.from(args[0] === 'gh'?'" +
+                SafeJSON.stringify({
+                    title: "Fixture",
+                    headRefName: "fixture",
+                    baseRefName: "main",
+                    changedFiles: 63,
+                }) +
+                "':''),stderr:Buffer.alloc(0)};};"
+        );
+        for (const model of ["Grok", "GPT-6.1 Sol"]) {
+            const out = join(dir, "brief.md");
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "fill-brief.ts"),
+                    "--run",
+                    dir,
+                    "--pr",
+                    "1",
+                    "--model",
+                    model,
+                    "--swift",
+                    "--out",
+                    out,
+                ],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+            );
+            expect(result.exitCode, result.stderr.toString()).toBe(0);
+            const brief = fs.readFileSync(out, "utf8");
+            if (model === "Grok") {
+                expect(brief).toContain("swift-slot.ts --wait-minutes 40 -- swift build");
+                expect(brief).toContain("swift-slot.ts --wait-minutes 40 -- swift test --filter");
+                expect(brief).not.toContain("while ps");
+            } else {
+                expect(brief).toContain("do NOT run `swift build` or `swift test`");
+            }
+        }
+    });
+
+    test("reclaim rejects invalid CLI and plan age thresholds before scanning or deleting", () => {
+        const dir = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-age-input-")));
+        const root = join(dir, "tmp");
+        const run = join(dir, "run");
+        const candidate = join(root, "fixture-candidate");
+        fs.mkdirSync(candidate, { recursive: true });
+        fs.mkdirSync(run);
+        fs.writeFileSync(join(candidate, "keep"), "fixture");
+        const providers = join(import.meta.dir, "../../../../src/utils/providers/session-paths.ts");
+        const preload = join(dir, "preload.ts");
+        const scanned = join(dir, "scanned");
+        fs.writeFileSync(
+            preload,
+            [
+                "import {mock} from 'bun:test';import * as fs from 'node:fs';const original={...fs};",
+                "mock.module('node:fs',()=>({...original,realpathSync:(p)=>p === '/tmp'?" +
+                    SafeJSON.stringify(root) +
+                    ":original.realpathSync(p),renameSync:()=>{throw new Error('unsafe rename reached');}}));",
+                "mock.module(" +
+                    SafeJSON.stringify(providers) +
+                    ",()=>({nativeSessionRoots:()=>[],nativeTranscriptMaxDepth:()=>4}));",
+                "Bun.spawnSync=()=>{original.writeFileSync(" +
+                    SafeJSON.stringify(scanned) +
+                    ",'scanned');return {exitCode:0,stdout:Buffer.from('p1\\nn/unrelated-fixture-file\\n'),stderr:Buffer.alloc(0)};};",
+            ].join("\n")
+        );
+        const execute = (args: string[]) =>
+            Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "tmp-reclaim.ts"),
+                    "--run",
+                    run,
+                    ...args,
+                ],
+                { stdout: "pipe", stderr: "pipe", env: { ...env.getProcessEnv(), TMPDIR: root }, timeout: 5000 }
+            );
+        for (const option of ["--min-age-hours", "--live-hours"]) {
+            for (const value of ["six", "NaN", "Infinity", "-1", ""]) {
+                const result = execute([option, value]);
+                expect(result.exitCode, option + " " + value).not.toBe(0);
+                expect(result.stderr.toString()).toContain("finite nonnegative");
+                expect(fs.existsSync(scanned)).toBe(false);
+            }
+        }
+        const plan = join(dir, "plan.json");
+        for (const age of [null, "6", -1, "six"]) {
+            fs.writeFileSync(
+                plan,
+                SafeJSON.stringify({
+                    createdAt: Date.now(),
+                    minAgeHours: age,
+                    candidates: [{ path: candidate, ino: fs.lstatSync(candidate).ino, bytes: 0, newest: 0 }],
+                })
+            );
+            const result = execute(["--apply", "--plan", plan]);
+            expect(result.exitCode, String(age)).not.toBe(0);
+            expect(result.stderr.toString()).toContain("finite nonnegative");
+            expect(fs.existsSync(scanned)).toBe(false);
+            expect(fs.readFileSync(join(candidate, "keep"), "utf8")).toBe("fixture");
+        }
+        const valid = execute(["--min-age-hours", "0", "--live-hours", "0"]);
+        expect(valid.exitCode, valid.stderr.toString()).toBe(0);
+        expect(fs.existsSync(scanned)).toBe(true);
+    });
+
+    test("integration gates read the captured commit even when the worker advances", () => {
+        for (const mode of ["broken", "lint:dashboard", "typecheck:all", "correct"]) {
+            const dir = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-integrate-snapshot-")));
+            const realWt = join(dir, "worker");
+            const wt = join(dir, "worker-alias");
+            fs.mkdirSync(realWt);
+            fs.symlinkSync(realWt, wt);
+            const git = (...args: string[]) => {
+                const result = Bun.spawnSync(["git", "-c", "core.hooksPath=/dev/null", ...args], {
+                    cwd: wt,
+                    stdout: "pipe",
+                    stderr: "pipe",
+                    env: env.getProcessEnv(),
+                });
+                expect(result.exitCode, result.stderr.toString()).toBe(0);
+                return result.stdout.toString().trim();
+            };
+            git("init", "-q");
+            git("config", "user.name", "Fixture");
+            git("config", "user.email", "fixture@example.com");
+            fs.writeFileSync(join(wt, "evidence.txt"), "base");
+            fs.mkdirSync(join(wt, "src/utils"), { recursive: true });
+            fs.writeFileSync(join(wt, "src/utils/fixture.ts"), "export const fixture = 1;\n");
+            git("add", "--", "evidence.txt", "src/utils/fixture.ts");
+            git("commit", "-qm", "base");
+            const base = git("rev-parse", "HEAD");
+            git("update-ref", "refs/remotes/origin/pr-head", base);
+            fs.writeFileSync(join(wt, "evidence.txt"), mode);
+            fs.writeFileSync(join(wt, "src/café.ts"), "export const accented = 1;\n");
+            git("config", "core.quotePath", "true");
+            git("add", "--", "evidence.txt", "src/café.ts");
+            git("commit", "-qm", "judged");
+            const judged = git("rev-parse", "HEAD");
+            const modules = join(wt, "node_modules");
+            fs.mkdirSync(join(modules, "@fixture"), { recursive: true });
+            fs.symlinkSync("../../src/utils", join(modules, "@fixture/utils"));
+            const installed = join(dir, "installed");
+            fs.mkdirSync(installed);
+            fs.writeFileSync(join(installed, "fixture.txt"), "trusted dependency");
+            fs.symlinkSync(installed, join(modules, "fixture-dependency"));
+            fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "genesiscz/GenesisTools", main: wt }));
+            const preload = join(dir, "preload.ts");
+            const gateCwd = join(dir, "gate-cwd.txt");
+            fs.writeFileSync(
+                preload,
+                [
+                    "import * as fs from 'node:fs';const spawn=Bun.spawnSync;const wt=" + SafeJSON.stringify(wt) + ";",
+                    "const result=(code,out='')=>({exitCode:code,stdout:Buffer.from(out),stderr:Buffer.alloc(0)});",
+                    "Bun.spawnSync=(args,opts)=>{if(args[0] === 'gh') {if(args[1] !== 'pr' || args[2] !== 'view') throw new Error('no GitHub writes');return result(0,'{\"headRefName\":\"pr-head\",\"baseRefName\":\"main\"}');}",
+                    "if(args[0] === 'git') {if(args.includes('fetch')) return result(0);if(args.includes('push')) throw new Error('no pushes');return spawn(args,opts);}",
+                    "if(args.includes('--noEmit')) {fs.writeFileSync(wt+'/evidence.txt','fixed later');fs.writeFileSync(wt+'/src/utils/fixture.ts','export const fixture = 2;\\n');for(const cmd of [['add','--','evidence.txt'],['commit','-qm','next round']]) {const p=spawn(['git','-c','core.hooksPath=/dev/null',...cmd],{cwd:wt,stdout:'pipe',stderr:'pipe'});if(p.exitCode) throw new Error('fixture commit failed');}fs.writeFileSync(" +
+                        SafeJSON.stringify(gateCwd) +
+                        ",JSON.stringify({cwd:opts.cwd,evidence:fs.readFileSync(opts.cwd+'/evidence.txt','utf8'),utils:fs.realpathSync(opts.cwd+'/node_modules/@fixture/utils'),utilsText:fs.readFileSync(opts.cwd+'/node_modules/@fixture/utils/fixture.ts','utf8'),dependency:fs.realpathSync(opts.cwd+'/node_modules/fixture-dependency')}));return result(fs.readFileSync(opts.cwd+'/evidence.txt','utf8') === 'broken'?1:0,'fixture typecheck');}",
+                    "if(args.includes('check') && args.includes('--no-errors-on-unmatched')) {fs.writeFileSync(" +
+                        SafeJSON.stringify(gateCwd + ".biome") +
+                        ",JSON.stringify(args));return result(0);}",
+                    "if(args[1] === 'run' && ['lint:dashboard','typecheck:all'].includes(args[2])) {fs.appendFileSync(" +
+                        SafeJSON.stringify(gateCwd + ".gates") +
+                        ",JSON.stringify({gate:args[2],cwd:opts.cwd,evidence:fs.readFileSync(opts.cwd+'/evidence.txt','utf8')})+'\\n');return result(args[2] === " +
+                        SafeJSON.stringify(mode) +
+                        "?1:0,'fixture replacement gate');}",
+                    "return result(0,args.includes('scripts/git/check-commits.ts')?'0 with a subject to fix':'');};",
+                ].join("\n")
+            );
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "integrate.ts"),
+                    "--run",
+                    dir,
+                    "--wt",
+                    wt,
+                    "--pr",
+                    "1",
+                    "--dry",
+                ],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 10000 }
+            );
+            expect(result.exitCode, result.stdout.toString() + result.stderr.toString()).toBe(
+                mode === "correct" ? 0 : 1
+            );
+            if (mode !== "correct") {
+                expect(result.stdout.toString()).toContain(`${mode === "broken" ? "tsgo" : mode} failed`);
+            } else {
+                expect(result.stdout.toString()).toContain("dry: push skipped");
+            }
+            // Read while the gate ran: the snapshot is removed when integrate exits.
+            const seen = SafeJSON.parse(fs.readFileSync(gateCwd, "utf8"), { strict: true }) as {
+                cwd: string;
+                evidence: string;
+                utils: string;
+                utilsText: string;
+                dependency: string;
+            };
+            expect(seen.cwd).not.toBe(wt);
+            expect(seen.evidence).toBe(mode);
+            if (mode !== "broken") {
+                expect(fs.existsSync(gateCwd + ".biome")).toBe(true);
+                expect(SafeJSON.parse(fs.readFileSync(gateCwd + ".biome", "utf8"), { strict: true })).toContain(
+                    "src/café.ts"
+                );
+                const gates = fs
+                    .readFileSync(gateCwd + ".gates", "utf8")
+                    .trim()
+                    .split("\n")
+                    .map((line) => SafeJSON.parse(line, { strict: true }));
+                expect(gates).toEqual(
+                    (mode === "lint:dashboard" ? ["lint:dashboard"] : ["lint:dashboard", "typecheck:all"]).map(
+                        (gate) => ({ gate, cwd: seen.cwd, evidence: mode })
+                    )
+                );
+            }
+            expect(seen.utils).toBe(join(seen.cwd, "src/utils"));
+            expect(seen.utilsText).toBe("export const fixture = 1;\n");
+            expect(seen.dependency).toBe(installed);
+            expect(fs.existsSync(seen.cwd)).toBe(false);
+            expect(git("rev-parse", "HEAD")).not.toBe(judged);
+        }
+    });
+});
+
+describe("round 14 review regressions", () => {
+    test("native linking resolves relative checkout roots before storing symlink targets", () => {
+        for (const relativePaths of [true, false]) {
+            const dir = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-native-relative-")));
+            const main = join(dir, "main");
+            const worker = join(dir, "worker");
+            const suffix = "node_modules/fixture/nested/binding.node";
+            const payload = Buffer.alloc(8192);
+            Buffer.from("cffaedfe", "hex").copy(payload);
+            for (const checkout of [main, worker]) {
+                fs.mkdirSync(join(checkout, "node_modules/fixture/nested"), { recursive: true });
+                fs.writeFileSync(join(checkout, suffix), payload);
+            }
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    join(import.meta.dir, "link-native.ts"),
+                    "--main",
+                    relativePaths ? "." : main,
+                    relativePaths ? "../worker" : worker,
+                ],
+                { cwd: main, stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+            );
+            expect(result.exitCode, result.stderr.toString()).toBe(0);
+            expect(result.stdout.toString()).toContain("linked 1 native files");
+            expect(fs.lstatSync(join(worker, suffix)).isSymbolicLink()).toBe(true);
+            expect(fs.readlinkSync(join(worker, suffix))).toBe(join(main, suffix));
+            expect(fs.readFileSync(join(worker, suffix))).toEqual(payload);
+        }
+    });
+
+    test("review snapshots see activity after 100 threads, comments and reviews", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-review-pages-"));
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        const preload = join(dir, "preload.ts");
+        const author = { login: "fixture-reviewer" };
+        const thread = (i: number) => ({
+            id: "thread-" + i,
+            isResolved: true,
+            comments: { nodes: [{ author }] },
+            latest: { nodes: [{ id: "reply-" + i, updatedAt: "2026-01-01T00:00:00Z" }] },
+        });
+        const comment = (i: number) => ({ id: "comment-" + i, author, updatedAt: "2026-01-01T00:00:00Z" });
+        const review = (i: number) => ({
+            id: "review-" + i,
+            author,
+            commit: { oid: "old-head" },
+            submittedAt: "2026-01-01T00:00:00Z",
+            updatedAt: "2026-01-01T00:00:00Z",
+            state: "COMMENTED",
+        });
+        const snapshots: string[] = [];
+        for (const mode of ["before", "thread", "comment", "review", "unreadable-page"]) {
+            const threads = Array.from({ length: 101 }, (_, i) => thread(i));
+            if (mode === "thread") {
+                threads[100].isResolved = false;
+            }
+            const comments = Array.from({ length: 101 }, (_, i) => comment(i));
+            if (mode === "comment") {
+                comments.push(comment(101));
+            }
+            const reviews = Array.from({ length: 101 }, (_, i) => review(i));
+            if (mode === "review") {
+                reviews.push(review(101));
+            }
+            const fixture = { threads, comments, reviews, mode };
+            fs.writeFileSync(
+                preload,
+                [
+                    "const fixture=" + SafeJSON.stringify(fixture) + ";",
+                    "Bun.spawnSync=(args)=>{if(args[0] === 'git') return {exitCode:0,stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)};if(args[0] !== 'gh') throw new Error('unexpected command');",
+                    "const query=args.find(arg=>arg.startsWith('query=')).slice(6);const cursor=(name)=>args.find(arg=>arg.startsWith(name+'='))?.split('=').slice(1).join('=');",
+                    "const connection=(name,values)=>{const offset=Number(cursor(name+'Cursor')??0);if(offset && fixture.mode === 'unreadable-page') throw new Error('fixture pagination failure');let selected=values.slice(offset,offset+100);if(!query.includes('pageInfo')) selected=name === 'threads'?values.slice(0,100):values.slice(-100);return {nodes:selected,pageInfo:{hasNextPage:offset+100<values.length,endCursor:String(offset+100)}};};",
+                    "const pr={headRefOid:'fixture-head',reviewThreads:connection('threads',fixture.threads),comments:connection('comments',fixture.comments),reviews:connection('reviews',fixture.reviews),timelineItems:{nodes:[]}};",
+                    "return {exitCode:0,stdout:Buffer.from(JSON.stringify({data:{viewer:{login:'fixture-lead'},repository:{pullRequest:pr}}})),stderr:Buffer.alloc(0)};};",
+                ].join("\n")
+            );
+            const result = Bun.spawnSync(
+                [process.execPath, "--preload", preload, join(import.meta.dir, "round-ready.ts"), "--run", dir, "1"],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+            );
+            expect(result.exitCode, result.stderr.toString()).toBe(0);
+            const line = result.stdout.toString().trim();
+            if (mode === "unreadable-page") {
+                expect(line).toContain("ERR");
+                continue;
+            }
+            expect(line).not.toContain("ERR");
+            if (mode === "before") {
+                expect(line).toContain('comments {"fixture-reviewer":101}');
+            } else {
+                expect(line, mode).not.toBe(snapshots[0]);
+            }
+            if (mode === "thread") {
+                expect(line).toContain('open {"fixture-reviewer":1}');
+            }
+            snapshots.push(line);
+        }
+    });
+});
+
+describe("round 13 reader execution regressions", () => {
+    test("Git reader abbreviations cannot override no-execution flags", () => {
+        for (const command of [
+            "git diff --no-textconv --no-ext-diff --textc HEAD",
+            "git show --no-textconv --no-ext-diff --ext-d HEAD",
+            "git grep --no-textconv --open-files-in=worker-program needle",
+        ]) {
+            expect(readOnlyChain(entry, command), command).toBe(false);
+        }
+    });
+
+    test("reader options that launch programs require the lead, including escalation requests", async () => {
+        const commands = [
+            "sort -S 1K --compress-program=/worker/probe large-file",
+            "sort -S 1K --compress-program /worker/probe large-file",
+            "sort --compress-prog=/worker/probe large-file",
+            "sort --comp=/worker/probe large-file",
+            "sort -k -- --compress-program=/worker/probe large-file",
+            "rg -e -- --pre=/worker/probe source.ts",
+            "file -m -- -z archive.gz",
+            "file -z archive.gz",
+            "file -bZ archive.gz",
+            "file --uncompress archive.gz",
+            "file --uncompress-nobuffer archive.gz",
+            "file --uncomp archive.gz",
+            "rg -z needle archive.gz",
+            "rg -nz needle archive.gz",
+            "rg --search-zip needle archive.gz",
+            "rg --hostname-bin /worker/probe --hyperlink-format default needle file",
+            "rg --hostname-bin=/worker/probe needle file",
+            "git cat-file --filters HEAD:src/a.ts",
+            "git cat-file --filt HEAD:src/a.ts",
+            "git cat-file --textc HEAD:src/a.ts",
+            "gh pr view 1 --web",
+            "gh pr list -w",
+            "gh pr checks 1 --web",
+        ];
+        const messages: string[] = [];
+        const output = spyOn(console, "log").mockImplementation((value) => messages.push(String(value)));
+        const errors = spyOn(console, "error").mockImplementation(() => {});
+        try {
+            for (const command of commands) {
+                let time = 0;
+                let approvals = 0;
+                const request = {
+                    method: "item/commandExecution/requestApproval",
+                    command,
+                    cwd: entry.cwd,
+                    detail: "sandbox escalation: " + command,
+                    sandbox_permissions: "require_escalated",
+                };
+                expect(readOnlyChain(entry, command), command).toBe(false);
+                expect(allowedCommand(entry, command), command).toBe(false);
+                expect(decide(entry, request).ok, command).toBe(false);
+                const exec: typeof execTool = async (args) => {
+                    if (args[1] === "approve") {
+                        approvals++;
+                        throw new Error("unsafe approval reached");
+                    }
+                    return {
+                        success: true,
+                        exitCode: 0,
+                        stderr: "",
+                        stdout: SafeJSON.stringify({ pendingApprovals: { security: request } }),
+                    };
+                };
+                const start = messages.length;
+                await watchApprovals({
+                    entry,
+                    exec,
+                    now: () => time,
+                    sleep: async (ms) => {
+                        time += ms;
+                    },
+                    timeoutMs: 10,
+                    pollMs: 5,
+                });
+                expect(approvals, command).toBe(0);
+                expect(
+                    messages.slice(start).some((line) => line.includes("NEEDS LEAD #security")),
+                    command
+                ).toBe(true);
+            }
+        } finally {
+            output.mockRestore();
+            errors.mockRestore();
+        }
+    });
+
+    test("ordinary reader options and option terminators remain approved", () => {
+        for (const command of [
+            "sort -S 1K -u large-file",
+            "sort --numeric-sort --reverse file",
+            "sort --key=2 --stable file",
+            "sort -- source.ts",
+            "file --brief archive.gz",
+            "file -b source.ts",
+            "rg -n needle source.ts",
+            "rg --no-search-zip needle source.ts",
+            "git cat-file -p HEAD:src/a.ts",
+            "gh pr view 1 --json body",
+            "gh pr list --limit 5",
+        ]) {
+            expect(readOnlyChain(entry, command), command).toBe(true);
+        }
+    });
+});
+
+describe("round 12 review regressions", () => {
+    test("reclaim refuses incomplete metadata scans during planning and apply", () => {
+        for (const code of ["EACCES", "EIO", "ENOENT", "healthy"]) {
+            const dir = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-stat-safety-")));
+            const root = join(dir, "tmp");
+            const run = join(dir, "run");
+            const candidate = join(root, "fixture-candidate");
+            const neighbor = join(root, "fixture-neighbor");
+            fs.mkdirSync(candidate, { recursive: true });
+            fs.mkdirSync(neighbor);
+            fs.mkdirSync(run);
+            const unreadable = join(candidate, "entry");
+            fs.writeFileSync(unreadable, "keep");
+            const moves = join(dir, "moves.txt");
+            const preload = join(dir, "preload.ts");
+            const providers = join(import.meta.dir, "../../../../src/utils/providers/session-paths.ts");
+            fs.writeFileSync(
+                preload,
+                [
+                    "import {mock} from 'bun:test'; import * as fs from 'node:fs'; const original={...fs};",
+                    "const target=" + SafeJSON.stringify(unreadable) + ",code=" + SafeJSON.stringify(code) + ";",
+                    "mock.module('node:fs',()=>({...original,realpathSync:(p)=>p === '/tmp'?" +
+                        SafeJSON.stringify(root) +
+                        ":original.realpathSync(p),",
+                    "lstatSync:(p,...args)=>{if(p === target && code !== 'healthy') throw Object.assign(new Error('fixture stat error'),{code});return original.lstatSync(p,...args);},",
+                    "renameSync:(from,to)=>{original.appendFileSync(" +
+                        SafeJSON.stringify(moves) +
+                        ",from+'\\n');if(from === " +
+                        SafeJSON.stringify(candidate) +
+                        " && code !== 'healthy') throw new Error('unsafe rename reached');return original.renameSync(from,to);}}));",
+                    "mock.module(" +
+                        SafeJSON.stringify(providers) +
+                        ",()=>({nativeSessionRoots:()=>[],nativeTranscriptMaxDepth:()=>4}));",
+                    "Bun.spawnSync=(args)=>{if(args[0] !== 'lsof') throw new Error('unexpected command');return {exitCode:0,stdout:Buffer.from('p1\\nn/unrelated-fixture-file\\n'),stderr:Buffer.alloc(0)};};",
+                ].join("\n")
+            );
+            const execute = (args: string[]) =>
+                Bun.spawnSync(
+                    [
+                        process.execPath,
+                        "--preload",
+                        preload,
+                        join(import.meta.dir, "tmp-reclaim.ts"),
+                        "--run",
+                        run,
+                        ...args,
+                    ],
+                    { stdout: "pipe", stderr: "pipe", env: { ...env.getProcessEnv(), TMPDIR: root }, timeout: 5000 }
+                );
+            const dry = execute(["--min-age-hours", "0"]);
+            expect(dry.exitCode, dry.stderr.toString()).toBe(0);
+            const planPath = /plan: (.+)/.exec(dry.stdout.toString())?.[1] ?? "";
+            const planned = SafeJSON.parse(fs.readFileSync(planPath, "utf8"), { strict: true });
+            expect(planned.candidates.map((c: { path: string }) => c.path).sort()).toEqual(
+                (code === "healthy" ? [candidate, neighbor] : [neighbor]).sort()
+            );
+            const plan = join(dir, "apply.json");
+            fs.writeFileSync(
+                plan,
+                SafeJSON.stringify({
+                    createdAt: Date.now(),
+                    minAgeHours: 0,
+                    candidates: [candidate, neighbor].map((path) => ({
+                        path,
+                        ino: fs.lstatSync(path).ino,
+                        bytes: 0,
+                        newest: 0,
+                    })),
+                })
+            );
+            const applied = execute(["--apply", "--plan", plan]);
+            expect(applied.exitCode, applied.stderr.toString()).toBe(0);
+            expect(fs.readFileSync(moves, "utf8").trim().split("\n")).toEqual(
+                code === "healthy" ? [candidate, neighbor] : [neighbor]
+            );
+            expect(fs.existsSync(candidate)).toBe(code !== "healthy");
+            expect(fs.existsSync(neighbor)).toBe(false);
+            if (code !== "healthy") {
+                expect(applied.stdout.toString()).toContain('"unreadable":1');
+            }
+        }
+    });
+
+    test("audit blocks outside-diff review bodies until each exact review is acknowledged", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-body-audit-"));
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        const preload = join(dir, "preload.ts");
+        const reviews = ["fixture-review-a", "fixture-review-b"].map((id) => ({
+            id,
+            author: { login: "fixture-reviewer" },
+            createdAt: "2026-01-01T00:00:00Z",
+            state: "COMMENTED",
+            body: "Outside diff range comments: 1\nA fixture finding.",
+            commit: { oid: "fixture-head" },
+        }));
+        for (const late of [false, true]) {
+            const pullRequest = {
+                title: "fixture",
+                state: late ? "MERGED" : "OPEN",
+                mergedAt: late ? "2025-12-31T00:00:00Z" : null,
+                headRefOid: "fixture-head",
+                reviews: { nodes: reviews, pageInfo: { hasNextPage: false } },
+                comments: { nodes: [], pageInfo: { hasNextPage: false } },
+                reviewThreads: { nodes: [], pageInfo: { hasNextPage: false } },
+                timelineItems: { nodes: [] },
+            };
+            const payload = SafeJSON.stringify({
+                data: { viewer: { login: "fixture-lead" }, repository: { pullRequest } },
+            });
+            fs.writeFileSync(
+                preload,
+                "Bun.spawnSync=(args)=>{if(args[0] !== 'git' && args[0] !== 'gh') throw new Error('unexpected command');return {exitCode:0,stdout:Buffer.from(args[0] === 'gh'?" +
+                    SafeJSON.stringify(payload) +
+                    ":''),stderr:Buffer.alloc(0)};};"
+            );
+            for (const ack of [[], ["wrong-review"], ["fixture-review-a"], ["fixture-review-a", "fixture-review-b"]]) {
+                const result = Bun.spawnSync(
+                    [
+                        process.execPath,
+                        "--preload",
+                        preload,
+                        join(import.meta.dir, "audit-reviews.ts"),
+                        "--run",
+                        dir,
+                        "1",
+                        ...ack.flatMap((id) => ["--ack-body", id]),
+                    ],
+                    { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+                );
+                expect(result.exitCode, result.stdout.toString() + result.stderr.toString()).toBe(
+                    !late && ack.length === 2 ? 0 : 1
+                );
+                expect(result.stdout.toString()).toContain("fixture-review-a");
+                expect(result.stdout.toString()).toContain("fixture-review-b");
+                if (ack.length === 2) {
+                    expect(result.stdout.toString()).toContain("acknowledged");
+                }
+            }
+        }
+    });
+});
+
+describe("round 11 review regressions", () => {
+    test("thread prefetch keeps the run-card repository for listing, expansion, bodies and comments", () => {
+        const dir = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-prefetch-repo-")));
+        const wt = join(dir, "worktree");
+        fs.mkdirSync(wt);
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/selected", main: dir }));
+        const preload = join(dir, "preload.ts");
+        const cli = join(import.meta.dir, "../../../../src/utils/cli/index.ts");
+        fs.writeFileSync(
+            preload,
+            [
+                "import {mock} from 'bun:test'; import * as cli from " +
+                    SafeJSON.stringify(cli) +
+                    "; const original={...cli};let sessionRepo='';",
+                "mock.module(" + SafeJSON.stringify(cli) + ",()=>({...original,execTool:async(args)=>{",
+                "if(args[0] !== 'github' || args[1] !== 'review') throw new Error('unexpected tool');",
+                "if(args[2] === 'expand') return {success:true,exitCode:0,stderr:'',stdout:'Thread ID: '+(sessionRepo === 'fixture/selected'?'selected-thread':'unrelated-thread')};",
+                "sessionRepo=args.includes('--repo')?args[args.indexOf('--repo')+1]:'fixture/default';",
+                "return {success:true,exitCode:0,stderr:'',stdout:'t1 '+sessionRepo};}}));",
+                "Bun.spawnSync=(args)=>{if(args[0] === 'git') return {exitCode:0,stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)};",
+                "if(args[0] === 'gh' && args[2] === 'user') return {exitCode:0,stdout:Buffer.from('fixture-lead'),stderr:Buffer.alloc(0)};",
+                "if(args[0] !== 'gh' || !args[2].startsWith('repos/fixture/selected/')) throw new Error('wrong API repository');return {exitCode:0,stdout:Buffer.from('[]'),stderr:Buffer.alloc(0)};};",
+            ].join("\n")
+        );
+        const result = Bun.spawnSync(
+            [
+                process.execPath,
+                "--preload",
+                preload,
+                join(import.meta.dir, "fetch-threads.ts"),
+                "--run",
+                dir,
+                "--wt",
+                wt,
+                "--pr",
+                "1",
+                "--round",
+                "11",
+            ],
+            { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+        );
+        expect(result.exitCode, result.stderr.toString()).toBe(0);
+        const saved = fs.readFileSync(join(wt, ".claude/work/babysit/1-r11-threads.md"), "utf8");
+        expect(saved).toContain("t1 fixture/selected");
+        expect(saved).toContain("Thread ID: selected-thread");
+        expect(saved).not.toContain("unrelated-thread");
+    });
+
+    test("setup preserves clean detached worker commits, permits published heads and refuses unverifiable ancestry", () => {
+        for (const mode of ["unpublished", "equal", "behind", "unverifiable", "restacked"]) {
+            const dir = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-setup-history-")));
+            const worktrees = join(dir, "workers");
+            const wt = join(worktrees, "bs-1");
+            fs.mkdirSync(wt, { recursive: true });
+            const git = (...args: string[]) => {
+                const result = Bun.spawnSync(["git", "-c", "core.hooksPath=/dev/null", ...args], {
+                    cwd: wt,
+                    stdout: "pipe",
+                    stderr: "pipe",
+                    env: env.getProcessEnv(),
+                });
+                expect(result.exitCode, result.stderr.toString()).toBe(0);
+                return result.stdout.toString().trim();
+            };
+            git("init", "-q");
+            git("config", "user.name", "Fixture");
+            git("config", "user.email", "fixture@example.com");
+            fs.writeFileSync(join(wt, "fixture.txt"), "base\n");
+            git("add", "--", "fixture.txt");
+            git("commit", "-qm", "fixture base");
+            const base = git("rev-parse", "HEAD");
+            fs.writeFileSync(join(wt, "fixture.txt"), "worker fix\n");
+            git("add", "--", "fixture.txt");
+            git("commit", "-qm", "fixture worker fix");
+            const worker = git("rev-parse", "HEAD");
+            let remote = mode === "unpublished" ? base : worker;
+            if (mode === "restacked") {
+                // The PR head was rebased onto a moved base: the worker's patch is there, its commit is not.
+                git("checkout", "-q", "--detach", base);
+                fs.writeFileSync(join(wt, "other.txt"), "base moved\n");
+                git("add", "--", "other.txt");
+                git("commit", "-qm", "fixture base moved");
+                fs.writeFileSync(join(wt, "fixture.txt"), "worker fix\n");
+                git("add", "--", "fixture.txt");
+                git("commit", "-qm", "fixture worker fix");
+                remote = git("rev-parse", "HEAD");
+            }
+            if (mode !== "unverifiable") {
+                git("update-ref", "refs/remotes/origin/pr-head", remote);
+            }
+            git("checkout", "-q", "--detach", mode === "behind" ? base : worker);
+            const before = git("rev-parse", "HEAD");
+            expect(git("status", "--porcelain", "--untracked-files=no")).toBe("");
+            fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: wt, worktrees }));
+            const checkoutCalls = join(dir, "checkouts.txt");
+            const installCalls = join(dir, "installs.txt");
+            const preload = join(dir, "preload.ts");
+            fs.writeFileSync(
+                preload,
+                [
+                    "import {appendFileSync} from 'node:fs';const spawn=Bun.spawnSync;",
+                    "Bun.spawnSync=(args,opts)=>{",
+                    "if(args[0] === 'git' && (args.includes('fetch') || args.includes('--git-common-dir'))) return {exitCode:0,stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)};",
+                    "if(args[0] === 'git') {if(args.includes('checkout')) appendFileSync(" +
+                        SafeJSON.stringify(checkoutCalls) +
+                        ",'checkout\\n');return spawn(args,opts);}",
+                    "if(args[0] === 'bun' && args[1] === 'install') {appendFileSync(" +
+                        SafeJSON.stringify(installCalls) +
+                        ",'intercepted, not installed\\n');process.exit(0);}",
+                    "throw new Error('unexpected command');};",
+                ].join("\n")
+            );
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "setup-wt.ts"),
+                    "--run",
+                    dir,
+                    "--pr",
+                    "1",
+                    "--branch",
+                    "pr-head",
+                ],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+            );
+            const refuse = mode === "unpublished" || mode === "unverifiable";
+            expect(result.exitCode, result.stderr.toString()).toBe(refuse ? 1 : 0);
+            expect(git("rev-parse", "HEAD")).toBe(refuse ? before : remote);
+            expect(fs.existsSync(checkoutCalls)).toBe(!refuse);
+            expect(fs.existsSync(installCalls)).toBe(!refuse);
+            if (mode === "unpublished") {
+                expect(result.stderr.toString()).toContain("unpublished");
+            } else if (mode === "unverifiable") {
+                expect(result.stderr.toString()).toContain("cannot verify");
+            }
+        }
+    });
+});
+
+describe("round 19 review regressions", () => {
+    test("relative executables follow every cd and never run a scratch-local tools", () => {
+        const root = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-approval-cd-")));
+        const scratch = join(root, ".claude/work/babysit");
+        const outside = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-approval-outside-")));
+        fs.mkdirSync(join(scratch, "nested"), { recursive: true });
+        fs.writeFileSync(join(scratch, "tools"), "worker executable (never executed)");
+        fs.symlinkSync(outside, join(root, "escape"));
+        const worker = { ...entry, cwd: root };
+        for (const command of [
+            "cd .claude/work/babysit && ./tools github review sessions",
+            "cd .claude/work && cd babysit && ./tools github review sessions",
+            "cd escape && cat fixture",
+            "cd missing && cat fixture",
+            "cd .claude/work/babysit || ./tools github review sessions",
+        ]) {
+            expect(allowedCommand(worker, command), command).toBe(false);
+        }
+        expect(readOnlyChain(worker, "cd .claude/work && cd babysit && pwd")).toBe(true);
+        const checkout = fs.realpathSync(join(import.meta.dir, "../../../.."));
+        expect(readOnlyChain({ ...entry, cwd: checkout }, "./tools github review sessions")).toBe(true);
+    });
+
+    test("log redirections resolve the runtime directory and canonical destination", () => {
+        const root = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-approval-log-")));
+        const scratch = join(root, ".claude/work/babysit");
+        const outside = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-log-outside-")));
+        fs.mkdirSync(join(scratch, "nested"), { recursive: true });
+        fs.mkdirSync(join(root, "sub/.claude/work/babysit"), { recursive: true });
+        fs.writeFileSync(join(outside, "keep.log"), "keep");
+        fs.symlinkSync(join(outside, "keep.log"), join(scratch, "linked.log"));
+        fs.symlinkSync(outside, join(scratch, "linked-dir"));
+        fs.symlinkSync(join(outside, "missing.log"), join(scratch, "dangling.log"));
+        const worker = { ...entry, cwd: root };
+        for (const command of [
+            "pwd > .claude/work/babysit/linked.log 2>&1",
+            "pwd > .claude/work/babysit/linked-dir/new.log 2>&1",
+            "pwd > .claude/work/babysit/dangling.log 2>&1",
+            "pwd > .claude/work/babysit/missing/new.log 2>&1",
+            "cd sub && pwd > .claude/work/babysit/new.log 2>&1",
+            "'cd' sub | pwd > ../.claude/work/babysit/new.log 2>&1",
+        ]) {
+            expect(allowedCommand(worker, command), command).toBe(false);
+        }
+        expect(allowedCommand(worker, "pwd > .claude/work/babysit/new.log 2>&1")).toBe(true);
+        expect(allowedCommand(worker, "cd .claude/work && cd babysit && pwd > nested/new.log 2>&1")).toBe(true);
+        const reviewer = { ...worker, scratch: outside };
+        expect(allowedCommand(reviewer, `pwd > ${outside}/probe.log 2>&1`)).toBe(true);
+        expect(fs.readFileSync(join(outside, "keep.log"), "utf8")).toBe("keep");
+    });
+
+    test("integration replaces the dashboard lint and complete typecheck push gates", () => {
+        expect(PRE_PUSH_GUARDS).toContainEqual(["lint:dashboard", "bun", "run", "lint:dashboard"]);
+        expect(PRE_PUSH_GUARDS).toContainEqual(["typecheck:all", "bun", "run", "typecheck:all"]);
+    });
+
+    test("the prescribed judge pack includes the saved worker report", () => {
+        const skill = fs.readFileSync(join(import.meta.dir, "../SKILL.md"), "utf8");
+        const invocation = /`bun \.claude\/skills\/babysit\/scripts\/judge-pack\.ts ([^`]+)`/.exec(skill);
+        expect(invocation).not.toBeNull();
+        expect(invocation?.[1]).toContain("--report <worker-final file>");
+    });
+});
+
+describe("round 20 readiness deadline", () => {
+    test("a real child read is killed when the shared wait budget expires", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-ready-child-deadline-"));
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        const preload = join(dir, "preload.ts");
+        const evidence = join(dir, "child.json");
+        fs.writeFileSync(
+            preload,
+            [
+                "import * as fs from 'node:fs';const spawn=Bun.spawnSync;",
+                "Bun.spawnSync=(args,opts)=>{if(args[0] === 'git')return {exitCode:0,stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)};if(args[0] !== 'gh')throw new Error('unexpected child');",
+                "const result=spawn([process.execPath,'-e','await Bun.sleep(1000)'],opts);fs.writeFileSync(" +
+                    SafeJSON.stringify(evidence) +
+                    ",JSON.stringify({timeout:opts.timeout,signal:result.signalCode}));return result;};",
+            ].join("\n")
+        );
+        const result = Bun.spawnSync(
+            [
+                process.execPath,
+                "--preload",
+                preload,
+                join(import.meta.dir, "round-ready.ts"),
+                "--run",
+                dir,
+                "1",
+                "--wait",
+                "0.005",
+            ],
+            { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+        );
+        expect(result.exitCode, result.stderr.toString()).toBe(3);
+        const child = SafeJSON.parse(fs.readFileSync(evidence, "utf8"), { strict: true }) as {
+            timeout: number;
+            signal: string;
+        };
+        expect(child.timeout).toBeGreaterThan(0);
+        expect(child.timeout).toBeLessThanOrEqual(300);
+        expect(child.signal).toBe("SIGKILL");
+        expect(result.stdout.toString()).toContain("not every head reviewed");
+    });
+
+    test("all PRs, pages and subprocesses share the finite wait deadline", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-ready-deadline-"));
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        const preload = join(dir, "preload.ts");
+        const evidence = join(dir, "evidence.json");
+        for (const mode of ["hung", "pages", "sleep", "late-ready", "ready", "-1", "Infinity", "NaN", "1e308"]) {
+            const invalid = ["-1", "Infinity", "NaN", "1e308"].includes(mode);
+            fs.writeFileSync(
+                preload,
+                [
+                    "import * as fs from 'node:fs';let now=0;const calls=[];Date.now=()=>now;Bun.sleep=async(ms)=>{now+=ms;};",
+                    "const mode=" +
+                        SafeJSON.stringify(mode) +
+                        ";process.on('exit',()=>fs.writeFileSync(" +
+                        SafeJSON.stringify(evidence) +
+                        ",JSON.stringify({now,calls})));",
+                    "Bun.spawnSync=(args,opts)=>{if(args[0] === 'git')return {exitCode:0,stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)};if(args[0] !== 'gh')throw new Error('unexpected child');calls.push({timeout:opts.timeout,killSignal:opts.killSignal});",
+                    "const cost=mode === 'pages'?70:mode === 'hung'?1000:mode === 'late-ready'?120:0;now+=Math.min(cost,opts.timeout??cost);const timed=cost>(opts.timeout??Infinity);",
+                    "const connection=(nodes=[])=>({nodes,pageInfo:{hasNextPage:mode === 'pages',endCursor:String(calls.length)}});const reviews=['ready','late-ready'].includes(mode)?[{id:'r',author:{login:'eve-bot-lovinka'},commit:{oid:'fixture-head'},submittedAt:'2026-01-01T00:00:00Z',updatedAt:'2026-01-01T00:00:00Z',state:'APPROVED'}]:[];",
+                    "const pr={headRefOid:'fixture-head',reviewThreads:connection(),comments:connection(),reviews:connection(reviews),timelineItems:{nodes:[]}};return {exitCode:timed?124:0,stdout:Buffer.from(JSON.stringify({data:{viewer:{login:'fixture-lead'},repository:{pullRequest:pr}}})),stderr:Buffer.from(timed?'read timed out':'')};};",
+                ].join("\n")
+            );
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "round-ready.ts"),
+                    "--run",
+                    dir,
+                    "1",
+                    "2",
+                    "--wait",
+                    invalid ? mode : "0.002",
+                ],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+            );
+            expect(result.exitCode, mode + result.stderr.toString()).toBe(invalid ? 2 : mode === "ready" ? 0 : 3);
+            const seen = SafeJSON.parse(fs.readFileSync(evidence, "utf8"), { strict: true }) as {
+                now: number;
+                calls: Array<{ timeout: number; killSignal: string }>;
+            };
+            if (invalid) {
+                expect(seen.calls, mode).toEqual([]);
+                expect(result.stderr.toString()).toContain("finite nonnegative");
+            } else if (mode === "ready") {
+                expect(seen.calls.map((call) => call.timeout)).toEqual([120, 120]);
+                expect(seen.now).toBe(0);
+            } else {
+                expect(seen.now, mode).toBe(120);
+                expect(
+                    seen.calls.map((call) => call.timeout),
+                    mode
+                ).toEqual(mode === "pages" ? [120, 50] : mode === "sleep" ? [120, 120] : [120]);
+                expect(seen.calls.every((call) => call.killSignal === "SIGKILL")).toBe(true);
+                expect(result.stdout.toString()).toContain("not every head reviewed");
+            }
+        }
+    });
+});
+
+describe("round 21 review regressions", () => {
+    test("Swift targets compile after local dependencies and reject invalid graphs", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-swift-order-"));
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        for (const folder of ["Sources/App", "Sources/Support", "Tests/AppTests"]) {
+            fs.mkdirSync(join(dir, folder), { recursive: true });
+            fs.writeFileSync(join(dir, folder, "Fixture.swift"), "// compiler is mocked\n");
+        }
+        const original = Bun.spawnSync;
+        const success = original([process.execPath, "-e", ""], { stdout: "pipe", stderr: "pipe" });
+        const modules: string[] = [];
+        const spawn = spyOn(Bun, "spawnSync").mockImplementation((args) => {
+            const words = Array.from(args, String);
+            if (words[0] === "xcrun" && words[1] === "swiftc") {
+                modules.push(words[words.indexOf("-module-name") + 1]);
+            }
+            return { ...success, stdout: Buffer.from(dir) };
+        });
+        const argv = process.argv;
+        process.argv = [
+            process.execPath,
+            "swift-typecheck.ts",
+            "--package",
+            dir,
+            "--run",
+            dir,
+            "--out",
+            join(dir, "out"),
+            "--deps",
+            dir,
+        ];
+        try {
+            fs.writeFileSync(
+                join(dir, "Package.swift"),
+                `let package = Package(targets: [
+                .testTarget(name: "AppTests", dependencies: [.target(name: "App")]),
+                .executableTarget(name: "App", dependencies: ["Support", "GenesisKit", .byName(name: "ExternalByName"), .product(name: "External", package: "external")]),
+                .target(name: "Support")])`
+            );
+            expect(typecheckPackage()).toBe(0);
+            expect(modules).toEqual(["Support", "App", "AppTests"]);
+            for (const [dependencies, error] of [
+                ['[.target(name: "Missing")]', "unknown local dependency"],
+                ['["App"]', "cycle"],
+            ]) {
+                modules.length = 0;
+                fs.writeFileSync(
+                    join(dir, "Package.swift"),
+                    `let package = Package(targets: [.target(name: "App", dependencies: ${dependencies})])`
+                );
+                expect(() => typecheckPackage()).toThrow(error);
+                expect(modules).toEqual([]);
+            }
+        } finally {
+            process.argv = argv;
+            spawn.mockRestore();
+        }
+    });
+});
+
+describe("round 21 delivery and lifetime regressions", () => {
+    test("landing bounds real GitHub children by the remaining wait budget", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-land-deadline-"));
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        const preload = join(dir, "preload.ts");
+        const evidence = join(dir, "reads.json");
+        fs.writeFileSync(
+            preload,
+            [
+                "import * as fs from 'node:fs';const spawn=Bun.spawnSync;let armed=false,clockReads=0,now=0;const reads=[];",
+                "Date.now=()=>{if(armed){clockReads++;now=clockReads===1?0:Math.max(now,119900);}return now;};Bun.sleep=async(ms)=>{now+=ms;};process.on('exit',()=>fs.writeFileSync(" +
+                    SafeJSON.stringify(evidence) +
+                    ",JSON.stringify(reads)));",
+                "const ok=(out='')=>({exitCode:0,stdout:Buffer.from(out),stderr:Buffer.alloc(0)});Bun.spawnSync=(args,opts)=>{if(args[0] === 'git'){if(args.includes('fetch') && opts.cwd === " +
+                    SafeJSON.stringify(dir) +
+                    ")armed=true;if(args.includes('rev-parse'))return ok('fixture-head');if(args.includes('log'))return ok('');return ok();}",
+                'if(args[0] === \'gh\'){reads.push({timeout:opts.timeout});if(args.includes(\'headRefName,baseRefName,state\'))return ok(\'{"headRefName":"fixture","baseRefName":"main","state":"OPEN"}\');const result=spawn([process.execPath,\'-e\',\'await Bun.sleep(1000)\'],opts);reads.at(-1).signal=result.signalCode;now=Math.max(now,120000);return result;}return ok();};',
+            ].join("\n")
+        );
+        const result = Bun.spawnSync(
+            [
+                process.execPath,
+                "--preload",
+                preload,
+                join(import.meta.dir, "land.ts"),
+                "--run",
+                dir,
+                "--wt",
+                join(dir, "worker"),
+                "--pr",
+                "1",
+                "--merge",
+            ],
+            { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+        );
+        expect(result.exitCode, result.stdout.toString() + result.stderr.toString()).toBe(1);
+        expect(result.stderr.toString()).toContain("after 120 s; not merging");
+        const reads = SafeJSON.parse(fs.readFileSync(evidence, "utf8"), { strict: true }) as Array<{
+            timeout: number;
+            signal?: string;
+        }>;
+        expect(reads).toHaveLength(2);
+        expect(reads[0].timeout).toBeGreaterThan(0);
+        expect(reads[1]).toEqual({ timeout: 100, signal: "SIGKILL" });
+    });
+
+    test("reclaim refuses invalid plan timestamps before any scan or deletion", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-plan-time-"));
+        const root = join(dir, "tmp");
+        fs.mkdirSync(root);
+        const scanned = join(dir, "scanned");
+        const plan = join(dir, "plan.json");
+        const preload = join(dir, "preload.ts");
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir, prs: [] }));
+        fs.writeFileSync(
+            preload,
+            [
+                "import {mock} from 'bun:test';import * as fs from 'node:fs';import {SafeJSON} from " +
+                    SafeJSON.stringify(join(import.meta.dir, "../../../../src/utils/json")) +
+                    ";const parse=SafeJSON.parse.bind(SafeJSON);SafeJSON.parse=(...args)=>{const value=parse(...args);if(value?.createdAt === 'fixture-NaN')value.createdAt=NaN;return value;};const original={...fs};",
+                "mock.module('node:fs',()=>({...original,realpathSync:(p)=>p === '/tmp'?" +
+                    SafeJSON.stringify(root) +
+                    ":original.realpathSync(p),renameSync:()=>{throw new Error('deletion reached');}}));",
+                "mock.module(" +
+                    SafeJSON.stringify(join(import.meta.dir, "../../../../src/utils/providers/session-paths.ts")) +
+                    ",()=>({nativeSessionRoots:()=>[],nativeTranscriptMaxDepth:()=>4}));Bun.spawnSync=()=>{original.writeFileSync(" +
+                    SafeJSON.stringify(scanned) +
+                    ",'scan');return {exitCode:0,stdout:Buffer.from('p1\\nn/unrelated-fixture\\n'),stderr:Buffer.alloc(0)};};",
+            ].join("\n")
+        );
+        for (const createdAt of [
+            undefined,
+            String(Date.now()),
+            "fixture-NaN",
+            Date.now() + 86_400_000,
+            Date.now() - 31 * 60_000,
+        ]) {
+            fs.writeFileSync(plan, SafeJSON.stringify({ createdAt, minAgeHours: 0, candidates: [] }));
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "tmp-reclaim.ts"),
+                    "--run",
+                    dir,
+                    "--apply",
+                    "--plan",
+                    plan,
+                ],
+                { stdout: "pipe", stderr: "pipe", env: { ...env.getProcessEnv(), TMPDIR: root }, timeout: 5000 }
+            );
+            expect(result.exitCode, String(createdAt) + result.stderr.toString()).toBe(2);
+            expect(fs.existsSync(scanned)).toBe(false);
+        }
+        fs.writeFileSync(plan, SafeJSON.stringify({ createdAt: Date.now(), minAgeHours: 0, candidates: [] }));
+        const valid = Bun.spawnSync(
+            [
+                process.execPath,
+                "--preload",
+                preload,
+                join(import.meta.dir, "tmp-reclaim.ts"),
+                "--run",
+                dir,
+                "--apply",
+                "--plan",
+                plan,
+            ],
+            { stdout: "pipe", stderr: "pipe", env: { ...env.getProcessEnv(), TMPDIR: root }, timeout: 5000 }
+        );
+        expect(valid.exitCode, valid.stderr.toString()).toBe(0);
+        expect(fs.existsSync(scanned)).toBe(true);
+    });
+
+    test("steering uses the bounded shared executor and preserves failed-delivery evidence and exit codes", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-steer-executor-"));
+        const file = join(dir, "prompt.md");
+        fs.writeFileSync(file, "fixture prompt");
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        const preload = join(dir, "preload.ts"),
+            evidence = join(dir, "delivery.json");
+        for (const code of [0, 7, 124]) {
+            fs.writeFileSync(
+                preload,
+                [
+                    "import {mock} from 'bun:test';import * as fs from 'node:fs';const record=(args,opts,via)=>fs.writeFileSync(" +
+                        SafeJSON.stringify(evidence) +
+                        ",JSON.stringify({args,cwd:opts.cwd,timeout:opts.timeout,via}));",
+                    "mock.module(" +
+                        SafeJSON.stringify(join(import.meta.dir, "../../../../src/ai/commands/agent/wait.ts")) +
+                        ",()=>({readTurnBaseline:async()=>null}));",
+                    "mock.module(" +
+                        SafeJSON.stringify(join(import.meta.dir, "../../../../src/utils/cli/index.ts")) +
+                        ",()=>({execTool:async(args,opts)=>{record(args,opts,'shared');return {success:" +
+                        String(code === 0) +
+                        ",exitCode:" +
+                        code +
+                        ",timedOut:" +
+                        String(code === 124) +
+                        ",stdout:'',stderr:'fixture delivery failure'};}}));",
+                    "Bun.spawnSync=(args,opts)=>{if(args.includes('steer'))record(args,opts,'direct');return {exitCode:0,stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)};};",
+                ].join("\n")
+            );
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "steer.ts"),
+                    "--run",
+                    dir,
+                    "--worker",
+                    "fixture",
+                    "--file",
+                    file,
+                ],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+            );
+            expect(result.exitCode, result.stderr.toString()).toBe(code);
+            const seen = SafeJSON.parse(fs.readFileSync(evidence, "utf8"), { strict: true }) as {
+                args: string[];
+                cwd: string;
+                timeout: number;
+                via: string;
+            };
+            expect(seen.via).toBe("shared");
+            expect(seen.cwd).toBe(dir);
+            expect(seen.timeout).toBeGreaterThan(0);
+            expect(Number.isFinite(seen.timeout)).toBe(true);
+            expect(seen.args).toEqual(["codex", "steer", "--name", "fixture", "--prompt-file", file]);
+            const events = readEvents(dir);
+            expect(events.at(code === 0 ? -1 : -2)?.text).toBe("fixture prompt");
+            if (code !== 0) {
+                expect(events.at(-1)?.text).toContain("steer NOT delivered");
+            }
+        }
+    });
+});
+
+describe("round 22 judge pack paths", () => {
+    test("committed accented and tab filenames retain their complete patches", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-pack-paths-"));
+        const git = (...args: string[]) => {
+            const result = Bun.spawnSync(["git", "-c", "core.hooksPath=/dev/null", ...args], {
+                cwd: dir,
+                stdout: "pipe",
+                stderr: "pipe",
+                env: env.getProcessEnv(),
+            });
+            expect(result.exitCode, result.stderr.toString()).toBe(0);
+            return result.stdout.toString().trim();
+        };
+        git("init", "-q");
+        git("config", "user.name", "Fixture");
+        git("config", "user.email", "fixture@example.com");
+        git("config", "core.quotePath", "true");
+        const names = ["café.ts", "with\ttab.ts", "plain.test.ts"];
+        for (const [i, name] of names.entries()) {
+            fs.writeFileSync(join(dir, name), `export const marker${i} = "before";\n`);
+        }
+        git("add", "--", ...names);
+        git("commit", "-qm", "fixture before");
+        for (const [i, name] of names.entries()) {
+            fs.writeFileSync(join(dir, name), `export const marker${i} = "after";\n`);
+        }
+        git("add", "--", ...names);
+        git("commit", "-qm", "fixture after");
+        const result = Bun.spawnSync(
+            [process.execPath, join(import.meta.dir, "judge-pack.ts"), "--wt", dir, "--range", "HEAD~1..HEAD"],
+            {
+                stdout: "pipe",
+                stderr: "pipe",
+                env: env.getProcessEnv(),
+                timeout: 5000,
+            }
+        );
+        expect(result.exitCode, result.stderr.toString()).toBe(0);
+        const pack = result.stdout.toString();
+        for (const i of names.keys()) {
+            expect(pack, names[i]).toContain(`-export const marker${i} = "before";`);
+            expect(pack, names[i]).toContain(`+export const marker${i} = "after";`);
+        }
+        expect(pack.indexOf('+export const marker2 = "after";')).toBeLessThan(
+            pack.indexOf('+export const marker0 = "after";')
+        );
+    });
+});
+
+describe("round 22 external Swift products", () => {
+    test("real app manifests parse without running Swift or any subprocess", () => {
+        const spawn = spyOn(Bun, "spawnSync").mockImplementation(() => {
+            throw new Error("manifest parsing must not run subprocesses");
+        });
+        try {
+            for (const [manifest, expected] of [
+                ["src/macos/GenesisTools/Package.swift", ["GenesisTools", "GenesisToolsTests"]],
+                ["src/macos/GenesisWidgetPreview/Package.swift", ["GenesisWidgetPreview"]],
+            ] as const) {
+                const text = fs.readFileSync(join(import.meta.dir, "../../../..", manifest), "utf8");
+                expect(parseSwiftTargets(text).map((target) => target.name)).toEqual([...expected]);
+            }
+            const targets = parseSwiftTargets(`let package = Package(targets: [
+                .executableTarget(name: "App", dependencies: ["GenesisKit", .byName(name: "External"), "Support"]),
+                .target(name: "Support")])`);
+            expect(targets.map((target) => target.name)).toEqual(["Support", "App"]);
+            expect(() =>
+                parseSwiftTargets(
+                    'let package = Package(targets: [.target(name: "A", dependencies: ["B"]), .target(name: "B", dependencies: ["A"])])'
+                )
+            ).toThrow("cycle");
+            expect(() =>
+                parseSwiftTargets(
+                    'let package = Package(targets: [.target(name: "A", dependencies: [.target(name: "Missing")])])'
+                )
+            ).toThrow("unknown local dependency");
+            expect(spawn).not.toHaveBeenCalled();
+        } finally {
+            spawn.mockRestore();
+        }
+    });
+});
+
+describe("round 23 landing squash hooks", () => {
+    test.each(["normal", "stall", "reject"])("squash commit respects config hooks: %s", (mode) => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-land-hooks-"));
+        const git = (...args: string[]) => {
+            const p = Bun.spawnSync(["git", "-c", "core.hooksPath=/dev/null", ...args], {
+                cwd: dir,
+                stdout: "pipe",
+                stderr: "pipe",
+                env: env.getProcessEnv(),
+            });
+            expect(p.exitCode, p.stderr.toString()).toBe(0);
+            return p.stdout.toString().trim();
+        };
+        git("init", "-q");
+        git("config", "user.name", "Fixture");
+        git("config", "user.email", "fixture@example.com");
+        const file = join(dir, "fixture.txt");
+        const commit = (text: string, subject: string) => {
+            fs.writeFileSync(file, text);
+            git("add", "--", "fixture.txt");
+            git("commit", "-qm", subject);
+            return git("rev-parse", "HEAD");
+        };
+        const base = commit("base", "base");
+        const feature = commit("feature", "feat(tools): fixture feature");
+        commit("round one", "fix(tools): #1 followup - first");
+        const oldHead = commit("round two", "fix(tools): #1 followup - second");
+        const tree = git("rev-parse", "HEAD^{tree}");
+        git("update-ref", "refs/remotes/origin/main", base);
+        git("update-ref", "refs/remotes/origin/fixture", oldHead);
+        git("config", "hook.fixture-pre.event", "pre-commit");
+        git(
+            "config",
+            "hook.fixture-pre.command",
+            "printf 'pre-commit\\n' >> hook-marker" + (mode === "reject" ? "; exit 23" : "")
+        );
+        git("config", "hook.fixture-message.event", "commit-msg");
+        git("config", "hook.fixture-message.command", "printf 'commit-msg\\n' >> hook-marker");
+        expect(git("hook", "list", "pre-commit")).toContain("fixture-pre");
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "genesiscz/GenesisTools", main: dir }));
+        const preload = join(dir, "preload.ts");
+        const versions = join(import.meta.dir, "versions.ts");
+        fs.writeFileSync(
+            preload,
+            [
+                "import {mock} from 'bun:test';import * as versions from " +
+                    SafeJSON.stringify(versions) +
+                    ";const original={...versions};mock.module(" +
+                    SafeJSON.stringify(versions) +
+                    ",()=>({...original,newExecutablesStall:async()=>" +
+                    String(mode === "stall") +
+                    "}));",
+                "const spawn=Bun.spawnSync;const ok=(out='')=>({exitCode:0,stdout:Buffer.from(out),stderr:Buffer.alloc(0)});Bun.spawnSync=(args,opts)=>{if(args[0] === 'gh'){if(args[1] !== 'pr' || args[2] !== 'view')throw new Error('no GitHub writes');return ok('{\"headRefName\":\"fixture\",\"baseRefName\":\"main\",\"state\":\"OPEN\"}');}if(args[0] === 'git'){if(args.includes('fetch'))return ok();if(args.includes('push'))throw new Error('no pushes');return spawn(args,opts);}if(args[0] === 'bun' && args[1] === 'scripts/git/check-commits.ts')return ok();throw new Error('unexpected command');};",
+            ].join("\n")
+        );
+        const result = Bun.spawnSync(
+            [
+                process.execPath,
+                "--preload",
+                preload,
+                join(import.meta.dir, "land.ts"),
+                "--run",
+                dir,
+                "--wt",
+                dir,
+                "--pr",
+                "1",
+            ],
+            {
+                stdout: "pipe",
+                stderr: "pipe",
+                env: env.getProcessEnv(),
+                timeout: 5000,
+            }
+        );
+        expect(result.exitCode, result.stdout.toString() + result.stderr.toString()).toBe(mode === "reject" ? 1 : 0);
+        const marker = join(dir, "hook-marker");
+        if (mode === "stall") {
+            expect(fs.existsSync(marker)).toBe(false);
+            expect(result.stdout.toString()).toContain("squash commit hooks disabled: new executables stall");
+        } else {
+            expect(fs.readFileSync(marker, "utf8")).toBe(
+                mode === "reject" ? "pre-commit\n" : "pre-commit\ncommit-msg\n"
+            );
+        }
+        expect(git("rev-parse", "HEAD")).not.toBe(oldHead);
+        expect(git("rev-parse", "HEAD^{tree}")).toBe(mode === "reject" ? git("rev-parse", feature + "^{tree}") : tree);
+        expect(git("log", "-1", "--format=%s")).toBe(
+            mode === "reject"
+                ? "feat(tools): fixture feature"
+                : "fix(tools): #1 followup - address PR review (2 commits)"
+        );
+    });
+});
+
+describe("round 24 verification boundaries", () => {
+    test("unsupported Swift target lists fail and whitespace declarations still compile", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-empty-targets-"));
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        fs.mkdirSync(join(dir, "Sources/Kit"), { recursive: true });
+        fs.writeFileSync(join(dir, "Sources/Kit/Fixture.swift"), "// mocked compiler fixture\n");
+        const success = Bun.spawnSync([process.execPath, "-e", ""], {
+            stdout: "pipe",
+            stderr: "pipe",
+            env: env.getProcessEnv(),
+        });
+        const commands: string[][] = [];
+        const spawn = spyOn(Bun, "spawnSync").mockImplementation((args) => {
+            commands.push(Array.from(args, String));
+            return { ...success, stdout: Buffer.from(dir) };
+        });
+        const errors: string[] = [];
+        const error = spyOn(console, "error").mockImplementation((text) => {
+            errors.push(String(text));
+        });
+        const argv = process.argv;
+        process.argv = [
+            process.execPath,
+            "swift-typecheck.ts",
+            "--package",
+            dir,
+            "--run",
+            dir,
+            "--out",
+            join(dir, "out"),
+            "--deps",
+            dir,
+        ];
+        try {
+            for (const manifest of [
+                'let targets = makeTargets(); let package = Package(name: "Fixture", targets: targets)',
+                'let package = Package(name: "Fixture", targets: [])',
+            ]) {
+                fs.writeFileSync(join(dir, "Package.swift"), manifest);
+                expect(typecheckPackage()).toBe(1);
+                expect(errors.at(-1)).toContain("no supported targets");
+                expect(commands).toEqual([]);
+            }
+            const manifest = 'let package = Package(targets: [.target \n (name: "Kit")])';
+            expect(parseSwiftTargets(manifest).map((target) => target.name)).toEqual(["Kit"]);
+            fs.writeFileSync(join(dir, "Package.swift"), manifest);
+            expect(typecheckPackage()).toBe(0);
+            expect(commands.filter((args) => args.includes("swiftc"))).toHaveLength(1);
+        } finally {
+            process.argv = argv;
+            spawn.mockRestore();
+            error.mockRestore();
+        }
+    });
+
+    test("landing polls and merges the run-card repository for both merge methods", () => {
+        for (const method of ["--rebase", "--squash"]) {
+            const dir = fs.mkdtempSync(join(tmpdir(), "babysit-land-repo-"));
+            fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/selected", main: dir }));
+            const preload = join(dir, "preload.ts"),
+                evidence = join(dir, "calls.json");
+            fs.writeFileSync(
+                preload,
+                [
+                    "import {mock} from 'bun:test';import * as fs from 'node:fs';const views=[];let merge;process.on('exit',()=>fs.writeFileSync(" +
+                        SafeJSON.stringify(evidence) +
+                        ",JSON.stringify({views,merge})));",
+                    "mock.module(" +
+                        SafeJSON.stringify(join(import.meta.dir, "../../../../src/utils/cli/index.ts")) +
+                        ",()=>({execTool:async(args)=>{merge=args;return {success:true,exitCode:0,stdout:'sha: '+ 'a'.repeat(40),stderr:''};}}));",
+                    "const ok=(out='')=>({exitCode:0,stdout:Buffer.from(out),stderr:Buffer.alloc(0)});Bun.spawnSync=(args)=>{if(args[0] === 'gh'){views.push(args);return ok(args.includes('headRefOid')?'fixture-head':'{\"headRefName\":\"fixture\",\"baseRefName\":\"main\",\"state\":\"OPEN\"}');}if(args[0] === 'git'){if(args.includes('push'))throw new Error('no pushes');return ok(args.includes('rev-parse')?'fixture-head':'');}if(args[0] === 'bun' && args[1] === 'scripts/git/check-commits.ts')return ok();throw new Error('unexpected command');};",
+                ].join("\n")
+            );
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "land.ts"),
+                    "--run",
+                    dir,
+                    "--wt",
+                    dir,
+                    "--pr",
+                    "1",
+                    "--merge",
+                    ...(method === "--squash" ? ["--squash"] : []),
+                ],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+            );
+            expect(result.exitCode, result.stdout.toString() + result.stderr.toString()).toBe(0);
+            const calls = SafeJSON.parse(fs.readFileSync(evidence, "utf8"), { strict: true }) as {
+                views: string[][];
+                merge: string[];
+            };
+            expect(calls.views).toHaveLength(2);
+            for (const args of calls.views) {
+                expect(args[args.indexOf("--repo") + 1]).toBe("fixture/selected");
+            }
+            expect(calls.merge).toEqual(["github", "merge", method, "1", "--repo", "fixture/selected"]);
+        }
+    });
+});
+
+describe("round 25 review input and execution bounds", () => {
+    test("prefetch retains human and bot findings with authors, excluding only own summaries and named noise", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-comment-input-"));
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        const comments = [
+            ["fixture-human", "human finding retained"],
+            ["review-service", "bot finding retained"],
+            ["fixture-lead", "# Review fixes\nour summary omitted"],
+            ["another-human", "# Review fixes\nother summary retained"],
+            ["fixture-lead", "our ordinary finding retained"],
+            [
+                "coderabbitai[bot]",
+                "<!-- This is an auto-generated comment: rate limited by coderabbit.ai -->\nrate notice omitted",
+            ],
+            [
+                "coderabbitai[bot]",
+                "<!-- This is an auto-generated reply by CodeRabbit -->\n<details><summary>✅ Action performed</summary>\naction notice omitted</details>",
+            ],
+            ["coderabbitai[bot]", "coderabbit finding retained"],
+        ].map(([login, body]) => ({ user: { login }, body, created_at: "2026-01-01T00:00:00Z" }));
+        const preload = join(dir, "preload.ts");
+        fs.writeFileSync(
+            preload,
+            [
+                "import {mock} from 'bun:test';mock.module(" +
+                    SafeJSON.stringify(join(import.meta.dir, "../../../../src/utils/cli/index.ts")) +
+                    ",()=>({execTool:async()=>({success:true,exitCode:0,stdout:'Stats: 0 threads',stderr:''})}));",
+                "Bun.spawnSync=(args)=>{const out=args.includes('user')?'fixture-lead':args.some(a=>a.includes('/comments?'))?" +
+                    SafeJSON.stringify(SafeJSON.stringify([comments])) +
+                    ":'[]';return {exitCode:0,stdout:Buffer.from(out),stderr:Buffer.alloc(0)};};",
+            ].join("\n")
+        );
+        const result = Bun.spawnSync(
+            [
+                process.execPath,
+                "--preload",
+                preload,
+                join(import.meta.dir, "fetch-threads.ts"),
+                "--run",
+                dir,
+                "--wt",
+                dir,
+                "--pr",
+                "1",
+                "--round",
+                "1",
+            ],
+            { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+        );
+        expect(result.exitCode, result.stderr.toString()).toBe(0);
+        const body = fs.readFileSync(join(dir, ".claude/work/babysit/1-r1-pr-comments.md"), "utf8");
+        for (const [author, text] of [
+            ["fixture-human", "human finding retained"],
+            ["review-service", "bot finding retained"],
+            ["another-human", "other summary retained"],
+            ["fixture-lead", "our ordinary finding retained"],
+            ["coderabbitai[bot]", "coderabbit finding retained"],
+        ]) {
+            expect(body).toContain("### comment by " + author + " at ");
+            expect(body).toContain(text);
+        }
+        for (const text of ["our summary omitted", "rate notice omitted", "action notice omitted"]) {
+            expect(body).not.toContain(text);
+        }
+    });
+
+    test("a run deadline kills and reaps the real child before a second waiter acquires the slot", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-slot-runtime-"));
+        const preload = join(dir, "preload.ts"),
+            evidence = join(dir, "child.json");
+        fs.writeFileSync(
+            preload,
+            [
+                "import {mock} from 'bun:test';import * as fs from 'node:fs';mock.module(" +
+                    SafeJSON.stringify(join(import.meta.dir, "../../../../src/utils/process/processes.ts")) +
+                    ",()=>({listProcesses:()=>[]}));const spawn=Bun.spawn;",
+                "Bun.spawn=(...args)=>{const child=spawn(...args);fs.writeFileSync(" +
+                    SafeJSON.stringify(evidence) +
+                    ",JSON.stringify({pid:child.pid}));child.exited.then(()=>fs.writeFileSync(" +
+                    SafeJSON.stringify(evidence) +
+                    ",JSON.stringify({pid:child.pid,signal:child.signalCode})));return child;};",
+            ].join("\n")
+        );
+        const run = (minutes: string, code: string) =>
+            Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "swift-slot.ts"),
+                    "--wait-minutes",
+                    "1",
+                    "--run-minutes",
+                    minutes,
+                    "--",
+                    process.execPath,
+                    "-e",
+                    code,
+                ],
+                { stdout: "pipe", stderr: "pipe", env: { ...env.getProcessEnv(), TMPDIR: dir }, timeout: 4000 }
+            );
+        const first = run("0.005", "await Bun.sleep(1500)");
+        expect(first.exitCode, first.stderr.toString()).toBe(124);
+        expect(first.stderr.toString()).toContain("run deadline");
+        const child = SafeJSON.parse(fs.readFileSync(evidence, "utf8"), { strict: true }) as {
+            pid: number;
+            signal: string;
+        };
+        expect(child.signal).toBe("SIGKILL");
+        expect(isProcessAlive(child.pid)).toBe(false);
+        const second = run("1", "console.log('second waiter acquired')");
+        expect(second.exitCode, second.stderr.toString()).toBe(0);
+        expect(second.stdout.toString()).toContain("second waiter acquired");
+        const acquired = trySwiftSlot(join(dir, "genesis-swift-slot.lock"));
+        expect(acquired).not.toBeNull();
+        acquired?.();
+    }, 10000);
+});
+
+describe("round 26 posting and answering-turn fences", () => {
+    test("integration publishes only with explicit authorization, and no-post always wins", () => {
+        for (const fixture of [
+            { post: true, flags: [], allowed: true },
+            { post: false, flags: [], allowed: false },
+            { post: "ask", flags: [], allowed: false },
+            { post: undefined, flags: [], allowed: false },
+            { post: true, flags: ["--no-post"], allowed: false },
+            { post: false, flags: ["--post"], allowed: true },
+            { post: undefined, flags: ["--post"], allowed: true },
+            { post: true, flags: ["--post", "--no-post"], allowed: false },
+        ]) {
+            const dir = fs.mkdtempSync(join(tmpdir(), "babysit-post-permission-"));
+            fs.writeFileSync(
+                join(dir, "run.json"),
+                SafeJSON.stringify({
+                    repo: "fixture/repo",
+                    main: dir,
+                    post: fixture.post,
+                    reviewLoopScripts: join(dir, "scripts"),
+                })
+            );
+            fs.writeFileSync(
+                join(dir, "replies.json"),
+                SafeJSON.stringify({ pr: 1, round: 1, model: "fixture", intro: "fixture", items: [] })
+            );
+            const preload = join(dir, "preload.ts"),
+                callsFile = join(dir, "calls.json");
+            fs.writeFileSync(
+                preload,
+                [
+                    "import * as fs from 'node:fs';const mutations=[];process.on('exit',()=>fs.writeFileSync(" +
+                        SafeJSON.stringify(callsFile) +
+                        ",JSON.stringify(mutations)));const ok=(out='')=>({exitCode:0,stdout:Buffer.from(out),stderr:Buffer.alloc(0)});",
+                    "Bun.spawnSync=(args)=>{if(args[0] === 'git'){if(args.includes('push'))throw new Error('no pushes');return ok(args.includes('rev-parse')?'fixture-head':'');}if(args[0] === 'gh'){if(args[1] === 'pr' && args[2] === 'view')return ok(JSON.stringify({headRefName:'fixture',baseRefName:'main'}));mutations.push(args);return ok();}if(args.some(a=>a.endsWith('round-summary.ts'))){fs.writeFileSync(args[args.indexOf('--out')+1],'fixture summary');return ok();}if(args.some(a=>a.endsWith('post-replies.ts'))){mutations.push(args);return ok();}throw new Error('unexpected command');};",
+                ].join("\n")
+            );
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "integrate.ts"),
+                    "--run",
+                    dir,
+                    "--wt",
+                    dir,
+                    "--pr",
+                    "1",
+                    "--round",
+                    "1",
+                    "--replies",
+                    join(dir, "replies.json"),
+                    ...fixture.flags,
+                ],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+            );
+            expect(result.exitCode, result.stdout.toString() + result.stderr.toString()).toBe(0);
+            const calls = SafeJSON.parse(fs.readFileSync(callsFile, "utf8"), { strict: true }) as string[][];
+            expect(calls.length > 0, SafeJSON.stringify(fixture)).toBe(fixture.allowed);
+            expect(fs.existsSync(join(dir, "vault/1-r1-replies.json"))).toBe(true);
+            expect(fs.existsSync(join(dir, "vault/1-r1-summary.md"))).toBe(true);
+            if (!fixture.allowed) {
+                expect(result.stdout.toString()).toContain("held");
+            }
+        }
+    });
+
+    test("a steer fence excludes the previous finished turn and accepts a reply finished before waiting", () => {
+        for (const mode of ["previous", "fast"]) {
+            const dir = fs.mkdtempSync(join(tmpdir(), "babysit-answer-fence-"));
+            fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+            const prompt = join(dir, "prompt.md");
+            fs.writeFileSync(prompt, "new round");
+            const preload = join(dir, "preload.ts");
+            fs.writeFileSync(
+                preload,
+                [
+                    "import {mock} from 'bun:test';import {turnAnswers} from " +
+                        SafeJSON.stringify(join(import.meta.dir, "../../../../src/utils/ai/transcripts/turn-wait.ts")) +
+                        ";Date.now=()=>1000;Bun.sleep=async()=>{};",
+                    "mock.module(" +
+                        SafeJSON.stringify(join(import.meta.dir, "../../../../src/ai/commands/agent/wait.ts")) +
+                        ",()=>({readTurnBaseline:async()=>({sessionId:'fixture-thread',turnStartedAt:1000,transcriptBytes:100})}));",
+                    "mock.module(" +
+                        SafeJSON.stringify(join(import.meta.dir, "../../../../src/utils/cli/index.ts")) +
+                        ",()=>({execTool:async()=>({success:true,exitCode:0,stdout:'',stderr:''})}));",
+                    "Bun.spawnSync=(args)=>{if(args[0] === 'git')return {exitCode:0,stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)};if(!args.includes('wait'))throw new Error('unexpected child');const number=(flag)=>args.includes(flag)?Number(args[args.indexOf(flag)+1]):undefined;const window={turnStartedAfter:number('--sent-at'),turnNewerThan:number('--baseline-turn-started-at'),openedFromByte:number('--baseline-transcript-bytes')};const fast=" +
+                        String(mode === "fast") +
+                        ";const answers=turnAnswers(fast?2000:1000,window,fast?200:0);return {exitCode:answers?0:124,stdout:Buffer.from(JSON.stringify({outcome:answers?'done':'timeout',lastText:answers?(fast?'new round reply':'previous finished reply'):''})),stderr:Buffer.alloc(0)};};",
+                ].join("\n")
+            );
+            const steer = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "steer.ts"),
+                    "--run",
+                    dir,
+                    "--worker",
+                    "fixture",
+                    "--pr",
+                    "1",
+                    "--round",
+                    "2",
+                    "--file",
+                    prompt,
+                ],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+            );
+            expect(steer.exitCode, steer.stderr.toString()).toBe(0);
+            const sent = readEvents(dir).at(-1);
+            expect(sent?.meta?.sentAt).toBe(1000);
+            expect(sent?.meta?.baselineTurnStartedAt).toBe(1000);
+            expect(sent?.meta?.baselineTranscriptBytes).toBe(100);
+            const waited = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "wait-turn.ts"),
+                    "--run",
+                    dir,
+                    "--worker",
+                    "fixture",
+                    "--thread",
+                    "fixture-thread",
+                    "--pr",
+                    "1",
+                    "--round",
+                    "2",
+                    "--timeout",
+                    "1",
+                ],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+            );
+            expect(waited.exitCode, waited.stderr.toString()).toBe(mode === "fast" ? 0 : 124);
+            const reply = readEvents(dir).at(-1);
+            expect(reply?.text).not.toContain("previous finished reply");
+            if (mode === "fast") {
+                expect(reply?.text).toBe("new round reply");
+            }
+        }
+    });
+});
+
+test("live turn waits refuse an absent fence or a different baseline session before reading a reply", () => {
+    for (const mode of ["absent", "mismatch"]) {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-wait-missing-fence-"));
+        fs.writeFileSync(join(dir, "run.json"), SafeJSON.stringify({ repo: "fixture/repo", main: dir }));
+        if (mode === "mismatch") {
+            appendEvent(dir, { kind: "steer", worker: "fixture", meta: { sentAt: 1000, sessionId: "another-thread" } });
+        }
+        const preload = join(dir, "preload.ts");
+        fs.writeFileSync(
+            preload,
+            "Bun.spawnSync=(args)=>{if(args.includes('wait'))throw new Error('must not read an unfenced reply');return {exitCode:0,stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)};};"
+        );
+        const result = Bun.spawnSync(
+            [
+                process.execPath,
+                "--preload",
+                preload,
+                join(import.meta.dir, "wait-turn.ts"),
+                "--run",
+                dir,
+                "--worker",
+                "fixture",
+                "--thread",
+                "fixture-thread",
+            ],
+            { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+        );
+        expect(result.exitCode).toBe(2);
+        expect(result.stderr.toString()).toContain(mode === "absent" ? "no answering-turn fence" : "--thread differs");
+        expect(readEvents(dir).some((event) => event.kind === "turn")).toBe(false);
+    }
+});
+
+describe("round 27 canonical fable edit targets", () => {
+    test.each(["file link", "parent link", "new nested escape", "unscoped local link", "dangling link", "link loop"])(
+        "refuses %s before approving an edit",
+        (mode) => {
+            const root = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-edit-canonical-")));
+            const outside = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-edit-outside-")));
+            const scratch = join(root, ".claude/work/babysit");
+            fs.mkdirSync(scratch, { recursive: true });
+            fs.writeFileSync(join(outside, "fixture.ts"), "old");
+            fs.writeFileSync(join(root, "unscoped.ts"), "old");
+            const link = join(scratch, "target");
+            fs.symlinkSync(
+                mode === "unscoped local link"
+                    ? join(root, "unscoped.ts")
+                    : mode === "dangling link"
+                      ? join(outside, "missing.ts")
+                      : mode === "link loop"
+                        ? link
+                        : mode === "file link"
+                          ? join(outside, "fixture.ts")
+                          : outside,
+                link
+            );
+            const target =
+                mode === "parent link"
+                    ? link + "/fixture.ts"
+                    : mode === "new nested escape"
+                      ? link + "/new/deep/fixture.ts"
+                      : link;
+            const command = `bun ${trustedCli} <<'FR'\n@@ ${target}\n<<<\nold\n===\nnew\n>>>\nFR`;
+            const worker = { ...entry, cwd: root };
+            try {
+                expect(allowedCommand(worker, command), mode).toBe(false);
+                const decision = decide(worker, {
+                    method: "item/commandExecution/requestApproval",
+                    cwd: worker.cwd,
+                    command,
+                });
+                expect(decision.ok).toBe(false);
+                expect(fs.readFileSync(join(outside, "fixture.ts"), "utf8")).toBe("old");
+            } finally {
+                fs.rmSync(root, { recursive: true, force: true });
+                fs.rmSync(outside, { recursive: true, force: true });
+            }
+        }
+    );
+
+    test("approves ordinary and new in-scope targets through a symlinked worktree root", () => {
+        const dir = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-edit-positive-")));
+        const root = join(dir, "real-worktree");
+        const alias = join(dir, "worktree-alias");
+        fs.mkdirSync(join(root, "src"), { recursive: true });
+        fs.writeFileSync(join(root, "src/a.ts"), "old");
+        fs.symlinkSync(root, alias);
+        const worker = { ...entry, cwd: alias, scope: ["src/a.ts", "src/new/deep/file.ts"] };
+        try {
+            for (const target of ["src/a.ts", "src/new/deep/file.ts", ".claude/work/babysit/new/deep/file.ts"]) {
+                const operation = target === "src/a.ts" ? "<<<\nold\n===\nnew\n>>>" : "<<< create\nfixture\n>>>";
+                const command = `bun ${trustedCli} <<'FR'\n@@ ${target}\n${operation}\nFR`;
+                expect(allowedCommand(worker, command), target).toBe(true);
+            }
+        } finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+});
+
+describe("round 31 exclusive reclaim quarantines", () => {
+    test.each(["directory", "symlink"])("preserves a pre-existing %s at the old quarantine name", (mode) => {
+        const dir = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "babysit-private-quarantine-")));
+        const roots = [join(dir, "tmp"), join(dir, "user-tmp")];
+        const outside = join(dir, "outside");
+        for (const folder of [...roots, outside]) {
+            fs.mkdirSync(folder);
+        }
+        fs.writeFileSync(join(outside, "keep.txt"), "external contents");
+        const candidates = [
+            join(roots[0], "fixture-first"),
+            join(roots[0], "fixture-second"),
+            join(roots[1], "fixture-third"),
+        ];
+        for (const file of candidates) {
+            fs.writeFileSync(file, "planned contents");
+        }
+        const plan = join(dir, "plan.json");
+        fs.writeFileSync(
+            plan,
+            SafeJSON.stringify({
+                createdAt: Date.now(),
+                minAgeHours: 0,
+                candidates: candidates.map((path) => ({ path, ino: fs.lstatSync(path).ino, bytes: 0, newest: 0 })),
+            })
+        );
+        const evidence = join(dir, "evidence.json");
+        const preload = join(dir, "preload.ts");
+        fs.writeFileSync(
+            preload,
+            [
+                "import {mock} from 'bun:test';import * as fs from 'node:fs';import {join,dirname} from 'node:path';const original={...fs};",
+                "const roots=" +
+                    SafeJSON.stringify(roots) +
+                    ", outside=" +
+                    SafeJSON.stringify(outside) +
+                    ", mode=" +
+                    SafeJSON.stringify(mode) +
+                    ";",
+                "const old=roots.map(root=>{const path=join(root,'.tmp-reclaim-'+process.pid);if(mode==='symlink')original.symlinkSync(outside,path);else {original.mkdirSync(path);original.writeFileSync(join(path,'keep.txt'),'pre-existing contents');}return {path,ino:original.lstatSync(path).ino};});",
+                "const created=[],moves=[],cleanups=[];const save=()=>original.writeFileSync(" +
+                    SafeJSON.stringify(evidence) +
+                    ",JSON.stringify({old,created,moves,cleanups}));save();",
+                "mock.module('node:fs',()=>({...original,realpathSync:p=>p==='/tmp'?roots[0]:original.realpathSync(p),mkdtempSync:prefix=>{const path=original.mkdtempSync(prefix);created.push({path,mode:original.lstatSync(path).mode&511});save();return path;},renameSync:(from,to)=>{moves.push({from,to,mode:original.lstatSync(dirname(to)).mode&511});save();return original.renameSync(from,to);},rmSync:(path,opts)=>{cleanups.push(path);save();return original.rmSync(path,opts);}}));",
+                "mock.module(" +
+                    SafeJSON.stringify(join(import.meta.dir, "../../../../src/utils/providers/session-paths.ts")) +
+                    ",()=>({nativeSessionRoots:()=>[],nativeTranscriptMaxDepth:()=>4}));",
+                "Bun.spawnSync=args=>{if(args[0]!=='lsof')throw new Error('unexpected command');return {exitCode:0,stdout:Buffer.from('p1\\nn/unrelated-fixture\\n'),stderr:Buffer.alloc(0)};};",
+            ].join("\n")
+        );
+        try {
+            const result = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "tmp-reclaim.ts"),
+                    "--apply",
+                    "--plan",
+                    plan,
+                ],
+                {
+                    stdout: "pipe",
+                    stderr: "pipe",
+                    env: { ...env.getProcessEnv(), TMPDIR: roots[1] },
+                    timeout: 5000,
+                }
+            );
+            expect(result.exitCode, result.stderr.toString()).toBe(0);
+            const seen = SafeJSON.parse(fs.readFileSync(evidence, "utf8"), { strict: true }) as {
+                old: Array<{ path: string; ino: number }>;
+                created: Array<{ path: string; mode: number }>;
+                moves: Array<{ from: string; to: string; mode: number }>;
+                cleanups: string[];
+            };
+            for (const old of seen.old) {
+                expect(fs.existsSync(old.path), "pre-existing quarantine must survive").toBe(true);
+                expect(fs.lstatSync(old.path).ino).toBe(old.ino);
+                expect(fs.lstatSync(old.path).isSymbolicLink()).toBe(mode === "symlink");
+                expect(fs.readFileSync(join(old.path, "keep.txt"), "utf8")).toBe(
+                    mode === "symlink" ? "external contents" : "pre-existing contents"
+                );
+            }
+            expect(fs.readdirSync(outside)).toEqual(["keep.txt"]);
+            expect(seen.created).toHaveLength(2);
+            expect(seen.created.map((folder) => dirname(folder.path)).sort()).toEqual([...roots].sort());
+            expect(seen.created.every((folder) => folder.mode === 0o700)).toBe(true);
+            expect(seen.moves.map((move) => move.from)).toEqual(candidates);
+            for (const move of seen.moves) {
+                expect(seen.created.map((folder) => folder.path)).toContain(dirname(move.to));
+                expect(dirname(dirname(move.to))).toBe(dirname(move.from));
+                expect(move.mode).toBe(0o700);
+                expect(fs.existsSync(move.from)).toBe(false);
+                expect(fs.existsSync(move.to)).toBe(false);
+            }
+            expect(seen.cleanups.sort()).toEqual(seen.created.map((folder) => folder.path).sort());
+            expect(seen.created.every((folder) => !fs.existsSync(folder.path))).toBe(true);
+            expect(result.stdout.toString()).toContain("removed 3 of 3 planned entries");
+        } finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+});
+
+describe("round 32 dedicated review regressions", () => {
+    test.each(["new", "noprefix", "colon", "ambiguous", "unicode", "old", "old-colon"])(
+        "personal-data probe associates real filenames: %s",
+        async (mode) => {
+            const dir = fs.mkdtempSync(join(tmpdir(), "babysit-probe-paths-"));
+            const repo = join(dir, "repo");
+            fs.mkdirSync(repo);
+            const markers = join(dir, "markers.txt"),
+                config = join(dir, "gitconfig");
+            fs.writeFileSync(markers, "fixture\tINVENTED_PRIVACY_NEEDLE\n");
+            fs.writeFileSync(config, mode === "noprefix" ? "[diff]\n noprefix = true\n" : "");
+            await env.testing.withOverrides(
+                { GIT_CONFIG_GLOBAL: config, GIT_CONFIG_NOSYSTEM: "1", PLACEHOLDER_MARKERS_FILE: markers },
+                async () => {
+                    const git = (args: string[], stdin?: string) => {
+                        const p = Bun.spawnSync(["git", ...args], {
+                            cwd: repo,
+                            env: env.getProcessEnv(),
+                            stdout: "pipe",
+                            stderr: "pipe",
+                            ...(stdin !== undefined ? { stdin: Buffer.from(stdin) } : {}),
+                        });
+                        expect(p.exitCode, p.stderr.toString()).toBe(0);
+                        return p.stdout.toString().trim();
+                    };
+                    git(["init", "-q"]);
+                    const file = ["colon", "ambiguous", "old-colon"].includes(mode)
+                        ? "fixture:1:secret.txt"
+                        : mode === "unicode"
+                          ? "café.txt"
+                          : "fixture.txt";
+                    fs.writeFileSync(join(repo, file), "ordinary\nINVENTED_PRIVACY_NEEDLE\n");
+                    git(["add", "--", file]);
+                    const from = mode.startsWith("old")
+                        ? git(["write-tree"])
+                        : git(["hash-object", "-w", "-t", "tree", "--stdin"], "");
+                    if (mode.startsWith("old")) {
+                        fs.appendFileSync(join(repo, file), "new ordinary line\n");
+                    }
+                    if (mode === "ambiguous") {
+                        fs.writeFileSync(join(repo, "fixture"), "ordinary\n");
+                    }
+                    git(["add", "--all"]);
+                    const to = git(["write-tree"]);
+                    expect(probeAddedLines({ wt: repo, from, to })).toBe(mode.startsWith("old"));
+                }
+            );
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    );
+
+    test.each(["free", "lock", "external", "acquired-late"])(
+        "Swift queue deadline fences %s before spawning",
+        async (mode) => {
+            const dir = fs.mkdtempSync(join(tmpdir(), "babysit-slot-queue-"));
+            const preload = join(dir, "preload.ts");
+            fs.writeFileSync(
+                preload,
+                "import {mock} from 'bun:test';const start=Date.now();mock.module(" +
+                    SafeJSON.stringify(join(import.meta.dir, "../../../../src/utils/process/processes.ts")) +
+                    ",()=>({listProcesses:()=> " +
+                    String(mode === "external") +
+                    " && Date.now()-start<400 ? [{name:'swift-test'}] : []}));" +
+                    (mode === "acquired-late"
+                        ? "const fs=await import('node:fs');const original={...fs};Date.now=()=>1000;mock.module('node:fs',()=>({...original,openSync:(...args)=>{const fd=original.openSync(...args);Date.now=()=>2000;return fd;}}));"
+                        : "")
+            );
+            let release = mode === "lock" ? trySwiftSlot(join(dir, "genesis-swift-slot.lock")) : null;
+            const timer = setTimeout(() => {
+                release?.();
+                release = null;
+            }, 400);
+            const started = Date.now();
+            const child = Bun.spawn(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "swift-slot.ts"),
+                    "--wait-minutes",
+                    mode === "free" ? "1" : "0.0025",
+                    "--",
+                    process.execPath,
+                    "-e",
+                    "console.log('CHILD_STARTED')",
+                ],
+                {
+                    env: { ...env.getProcessEnv(), TMPDIR: dir },
+                    stdout: "pipe",
+                    stderr: "pipe",
+                    timeout: 1500,
+                }
+            );
+            try {
+                const code = await child.exited;
+                const out = await new Response(child.stdout).text();
+                expect(code).toBe(mode === "free" ? 0 : 124);
+                expect(out.includes("CHILD_STARTED")).toBe(mode === "free");
+                expect(Date.now() - started).toBeLessThan(1000);
+            } finally {
+                clearTimeout(timer);
+                release?.();
+                if (child.exitCode === null) {
+                    child.kill("SIGKILL");
+                }
+                await child.exited;
+            }
+            const next = trySwiftSlot(join(dir, "genesis-swift-slot.lock"));
+            expect(next).not.toBeNull();
+            next?.();
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    );
+});
+
+describe("round 32 policy and landing routing", () => {
+    test("late security and dedicated reviews are always fixed, with one shared policy", async () => {
+        const { roundPolicy, shouldFixFinding } = await import("./policy");
+        const late = roundPolicy({ round: 32, changedFiles: 63 });
+        expect(shouldFixFinding(late, "Low", true)).toBe(true);
+        expect(shouldFixFinding(late, "High")).toBe(true);
+        expect(shouldFixFinding(late, "Medium")).toBe(false);
+        expect(shouldFixFinding(roundPolicy({ round: 32, changedFiles: 120, dedicatedReview: true }), "Low")).toBe(
+            true
+        );
+        expect(roundPolicy({ round: 3, changedFiles: 100 }).fixAll).toBe(false);
+        expect(roundPolicy({ round: 3, changedFiles: 101 }).fixAll).toBe(true);
+        for (const template of ["brief-self-fetch.md", "brief-template.md"]) {
+            const text = fs.readFileSync(join(import.meta.dir, "../references", template), "utf8");
+            expect(text).toContain("{{ROUND_POLICY}}");
+            expect(text).not.toContain("never defer");
+        }
+        const skill = fs.readFileSync(join(import.meta.dir, "../SKILL.md"), "utf8");
+        expect(skill).not.toContain("the reviewer bot reviewed\nthe CURRENT head");
+        expect(skill).toContain("Merge without waiting for eve");
+        expect(skill).toContain("Judge against the same derived round policy");
+    });
+
+    test("integration posts deferred items only in the no-resolve batch", () => {
+        const dir = fs.mkdtempSync(join(tmpdir(), "babysit-deferred-post-"));
+        fs.writeFileSync(
+            join(dir, "run.json"),
+            SafeJSON.stringify({ repo: "fixture/repo", main: dir, post: true, reviewLoopScripts: join(dir, "scripts") })
+        );
+        fs.writeFileSync(
+            join(dir, "replies.json"),
+            SafeJSON.stringify({
+                pr: 1,
+                round: 32,
+                model: "fixture",
+                intro: "fixture",
+                items: [
+                    {
+                        ref: "t1",
+                        threadId: "fixed-thread",
+                        reviewer: "eve-bot-lovinka",
+                        verdict: "fixed",
+                        reply: "fixed",
+                    },
+                    {
+                        ref: "t2",
+                        threadId: "open-thread",
+                        reviewer: "coderabbitai",
+                        verdict: "belongs-elsewhere",
+                        deferred: true,
+                        reply: "valid Medium, deferred under policy; stays OPEN",
+                    },
+                ],
+            })
+        );
+        const preload = join(dir, "preload.ts"),
+            evidence = join(dir, "batches.json");
+        fs.writeFileSync(
+            preload,
+            [
+                "import * as fs from 'node:fs';const batches=[];process.on('exit',()=>fs.writeFileSync(" +
+                    SafeJSON.stringify(evidence) +
+                    ",JSON.stringify(batches)));const ok=(out='')=>({exitCode:0,stdout:Buffer.from(out),stderr:Buffer.alloc(0)});",
+                "Bun.spawnSync=(args)=>{if(args[0]==='git'){if(args.includes('push'))throw new Error('no pushes');return ok(args.includes('rev-parse')?'fixture-head':'');}if(args[0]==='gh'){if(args.includes('graphql'))throw new Error('unexpected direct mutation');return ok(JSON.stringify({headRefName:'fixture',baseRefName:'main'}));}if(args[1]?.endsWith('round-summary.ts')){fs.writeFileSync(args[args.indexOf('--out')+1],'summary');return ok();}if(args[1]?.endsWith('post-replies.ts')){const data=JSON.parse(fs.readFileSync(args[3],'utf8'));batches.push({args,ids:data.items.map(i=>i.threadId)});return ok();}throw new Error('unexpected command');};",
+            ].join("\n")
+        );
+        const p = Bun.spawnSync(
+            [
+                process.execPath,
+                "--preload",
+                preload,
+                join(import.meta.dir, "integrate.ts"),
+                "--run",
+                dir,
+                "--wt",
+                dir,
+                "--pr",
+                "1",
+                "--round",
+                "32",
+                "--replies",
+                join(dir, "replies.json"),
+            ],
+            { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+        );
+        expect(p.exitCode, p.stderr.toString()).toBe(0);
+        const batches = SafeJSON.parse(fs.readFileSync(evidence, "utf8"), { strict: true }) as Array<{
+            args: string[];
+            ids: string[];
+        }>;
+        expect(batches).toHaveLength(2);
+        expect(batches.find((batch) => batch.ids.includes("open-thread"))?.args).toContain("--no-resolve");
+        expect(batches.find((batch) => !batch.args.includes("--no-resolve"))?.ids).toEqual(["fixed-thread"]);
+        expect(batches.find((batch) => batch.args.includes("--no-resolve"))?.ids).toEqual(["open-thread"]);
+        const all = SafeJSON.parse(fs.readFileSync(join(dir, "vault/1-r32-replies.json"), "utf8"), { strict: true });
+        expect(all.items).toHaveLength(2);
+        expect(all.items.every((item: Record<string, unknown>) => !("deferred" in item))).toBe(true);
+    });
+
+    test.each(["prepare", "merge", "probe-blocks", "verify-fails"])(
+        "other-repository landing uses run-card gates: %s",
+        (mode) => {
+            const dir = fs.mkdtempSync(join(tmpdir(), "babysit-other-land-"));
+            const old = "a".repeat(40),
+                head = mode === "prepare" ? old : "b".repeat(40);
+            fs.writeFileSync(
+                join(dir, "run.json"),
+                SafeJSON.stringify({
+                    repo: "fixture/other",
+                    main: dir,
+                    verify: [mode === "verify-fails" ? "exit 7" : "printf fixture-pass"],
+                })
+            );
+            const preload = join(dir, "preload.ts"),
+                evidence = join(dir, "evidence.json");
+            fs.writeFileSync(
+                preload,
+                [
+                    "import {mock} from 'bun:test';import * as fs from 'node:fs';import * as versions from " +
+                        SafeJSON.stringify(join(import.meta.dir, "versions.ts")) +
+                        ";const original={...versions};const calls=[],probes=[],merges=[];process.on('exit',()=>fs.writeFileSync(" +
+                        SafeJSON.stringify(evidence) +
+                        ",JSON.stringify({calls,probes,merges})));",
+                    "mock.module(" +
+                        SafeJSON.stringify(join(import.meta.dir, "versions.ts")) +
+                        ",()=>({...original,ensureConfigHooks:()=> 'fixture hooks'}));",
+                    "mock.module(" +
+                        SafeJSON.stringify(join(import.meta.dir, "probe.ts")) +
+                        ",()=>({probeAddedLines:input=>{probes.push(input);return " +
+                        String(mode !== "probe-blocks") +
+                        ";}}));",
+                    "mock.module(" +
+                        SafeJSON.stringify(join(import.meta.dir, "../../../../src/utils/cli/index.ts")) +
+                        ",()=>({execTool:async(args)=>{merges.push(args);return {success:true,stdout:'sha: '+ 'b'.repeat(40),stderr:'',exitCode:0};}}));",
+                    "const spawn=Bun.spawnSync,ok=(out='')=>({exitCode:0,stdout:Buffer.from(out),stderr:Buffer.alloc(0)});Bun.spawnSync=(args,opts)=>{calls.push(args);if(args[0]==='/bin/sh')return spawn(args,opts);if(args[0]==='gh')return ok(args.includes('headRefOid')?" +
+                        SafeJSON.stringify(head) +
+                        ":JSON.stringify({headRefName:'fixture',baseRefName:'main',state:'OPEN'}));if(args[0]==='git'){if(args.includes('rev-parse'))return ok(args.at(-1)==='origin/fixture'?" +
+                        SafeJSON.stringify(old) +
+                        ":" +
+                        SafeJSON.stringify(head) +
+                        ");return ok();}throw new Error('GenesisTools-only gate reached: '+args.join(' '));};",
+                ].join("\n")
+            );
+            const p = Bun.spawnSync(
+                [
+                    process.execPath,
+                    "--preload",
+                    preload,
+                    join(import.meta.dir, "land.ts"),
+                    "--run",
+                    dir,
+                    "--wt",
+                    dir,
+                    "--pr",
+                    "1",
+                    ...(mode === "prepare" ? [] : ["--merge"]),
+                ],
+                { stdout: "pipe", stderr: "pipe", env: env.getProcessEnv(), timeout: 5000 }
+            );
+            expect(p.exitCode, p.stderr.toString()).toBe(["probe-blocks", "verify-fails"].includes(mode) ? 1 : 0);
+            const seen = SafeJSON.parse(fs.readFileSync(evidence, "utf8"), { strict: true }) as {
+                calls: string[][];
+                probes: Array<{ wt: string; from: string; to: string }>;
+                merges: string[][];
+            };
+            expect(
+                seen.calls.some(
+                    (args) =>
+                        args.includes("scripts/git/check-commits.ts") ||
+                        args.includes("scripts/ci/placeholder-check.sh")
+                )
+            ).toBe(false);
+            expect(seen.calls.some((args) => args[0] === "/bin/sh")).toBe(true);
+            expect(seen.probes).toEqual(
+                ["prepare", "verify-fails"].includes(mode) ? [] : [{ wt: dir, from: old, to: head }]
+            );
+            const pushes = seen.calls.filter((args) => args.includes("push"));
+            expect(pushes).toHaveLength(mode === "merge" ? 1 : 0);
+            if (mode === "merge") {
+                expect(pushes[0]).toContain("--force-with-lease=refs/heads/fixture:" + old);
+                expect(pushes[0]).toContain(head + ":refs/heads/fixture");
+                expect(seen.merges).toHaveLength(1);
+            } else {
+                expect(seen.merges).toEqual([]);
+            }
+        }
+    );
+});
diff --git a/.claude/skills/babysit/scripts/setup-wt.ts b/.claude/skills/babysit/scripts/setup-wt.ts
new file mode 100644
index 0000000000..9ef1fbb26e
--- /dev/null
+++ b/.claude/skills/babysit/scripts/setup-wt.ts
@@ -0,0 +1,138 @@
+#!/usr/bin/env bun
+/**
+ * A worker worktree for one PR, ready to test without a full install:
+ * detached at the PR head; dependencies installed with --ignore-scripts plus the repo's patches; the test wrapper's
+ * install stamp written (else `scripts/test.ts` runs a full `bun install`); native files linked to the main checkout's
+ * already-assessed copies (link-native.ts); nested app node_modules linked to the main checkout's.
+ *
+ *   bun setup-wt.ts --run <dir> --pr 499 [--branch <head branch>]
+ *
+ * An existing worktree moves to the fetched PR head only when clean and its HEAD is reachable from that head, or
+ * every commit it holds is in that head by patch (a restack).
+ * Unpublished, divergent or unverifiable history stops for an explicit recovery decision; no worker commit is discarded.
+ */
+import { existsSync, mkdirSync, symlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { env } from "@genesiscz/utils/env";
+import { SafeJSON } from "@genesiscz/utils/json";
+import { linkNativeFiles } from "./link-native";
+import { flag, loadRun, worktreeFor } from "./run";
+import { ensureConfigHooks, HOOKS_OFF } from "./versions";
+
+const run = loadRun();
+const pr = flag("--pr") ?? "";
+const branch =
+    flag("--branch") ??
+    (
+        SafeJSON.parse(
+            Bun.spawnSync(["gh", "pr", "view", pr, "--repo", run.repo, "--json", "headRefName"], {
+                stdout: "pipe",
+            }).stdout.toString(),
+            { strict: true }
+        ) as { headRefName: string }
+    ).headRefName;
+const wt = worktreeFor(run, pr);
+const logs = join(run.dir, "logs");
+mkdirSync(logs, { recursive: true });
+const log: string[] = [];
+
+function step(cmd: string[], cwd: string, label: string): void {
+    const p = Bun.spawnSync(cmd, { cwd, stdout: "pipe", stderr: "pipe", env: env.getProcessEnv() });
+    log.push(`$ ${cmd.join(" ")} → ${p.exitCode}`, p.stdout.toString(), p.stderr.toString());
+
+    if (p.exitCode !== 0) {
+        writeFileSync(join(logs, `setup-${pr}.log`), log.join("\n"));
+        console.error(`✖ ${label} failed (log: ${join(logs, `setup-${pr}.log`)})`);
+        process.exit(1);
+    }
+}
+
+if (!pr || !branch) {
+    console.error("usage: setup-wt.ts --run <dir> --pr <N> [--branch <head branch>]");
+    process.exit(2);
+}
+
+step(["git", "fetch", "-q", "origin", branch], run.main, "fetch");
+// The repo's hooks would lock or index the throwaway worktree; it gets none.
+if (existsSync(wt)) {
+    const dirty = Bun.spawnSync(["git", "status", "--porcelain", "--untracked-files=no"], { cwd: wt, stdout: "pipe" });
+
+    if (dirty.exitCode !== 0 || dirty.stdout.toString().trim() !== "") {
+        console.error(`✖ ${wt} has tracked changes (or is no worktree): commit or move them, then run again`);
+        process.exit(1);
+    }
+
+    const published = Bun.spawnSync(["git", "merge-base", "--is-ancestor", "HEAD", `origin/${branch}`], {
+        cwd: wt,
+        stdout: "pipe",
+        stderr: "pipe",
+        env: env.getProcessEnv(),
+        timeout: 30_000,
+    });
+    // A restack (rebase plus force-push) leaves the old HEAD off the new head's ancestry while every one of its
+    // commits is there by patch; `git cherry` marks such commits "-", and one "+" means real unpublished work.
+    const cherry =
+        published.exitCode === 1
+            ? Bun.spawnSync(["git", "cherry", `origin/${branch}`, "HEAD"], {
+                  cwd: wt,
+                  stdout: "pipe",
+                  stderr: "pipe",
+                  env: env.getProcessEnv(),
+                  timeout: 30_000,
+              })
+            : null;
+    const restacked =
+        cherry?.exitCode === 0 &&
+        !cherry.stdout
+            .toString()
+            .split("\n")
+            .some((line) => line.startsWith("+"));
+
+    if (published.exitCode !== 0 && !restacked) {
+        const reason =
+            published.exitCode === 1
+                ? "has unpublished or divergent commits relative to origin/" + branch
+                : "cannot verify HEAD is published in origin/" + branch;
+        console.error("✖ " + wt + " " + reason + "; preserve or recover that HEAD before running setup again");
+        if (published.stderr.length > 0) {
+            console.error(published.stderr.toString().trim());
+        }
+        process.exit(1);
+    }
+
+    step(["git", ...HOOKS_OFF, "checkout", "-q", "--detach", `origin/${branch}`], wt, "checkout the new head");
+} else {
+    step(["git", ...HOOKS_OFF, "worktree", "add", "-q", "--detach", wt, `origin/${branch}`], run.main, "worktree add");
+}
+step(["bun", "install", "--ignore-scripts"], wt, "bun install");
+console.log(`hooks: ${ensureConfigHooks(run.main)}`);
+
+if (existsSync(join(wt, "scripts/apply-patches.ts"))) {
+    step(["bun", "scripts/apply-patches.ts"], wt, "apply-patches");
+}
+
+const testDeps = join(wt, "scripts/test-deps.ts");
+
+if (existsSync(testDeps)) {
+    const { lockStamp, STAMP_FILE } = (await import(testDeps)) as {
+        lockStamp: (root: string) => string;
+        STAMP_FILE: string;
+    };
+    writeFileSync(join(wt, "node_modules", STAMP_FILE), lockStamp(wt));
+}
+
+const native = linkNativeFiles({ worktree: wt, main: run.main });
+
+for (const nested of ["apps/eve"]) {
+    const target = join(run.main, nested, "node_modules");
+
+    if (existsSync(join(wt, nested)) && !existsSync(join(wt, nested, "node_modules")) && existsSync(target)) {
+        symlinkSync(target, join(wt, nested, "node_modules"));
+    }
+}
+
+writeFileSync(join(logs, `setup-${pr}.log`), log.join("\n"));
+const head = Bun.spawnSync(["git", "rev-parse", "--short", "HEAD"], { cwd: wt, stdout: "pipe" })
+    .stdout.toString()
+    .trim();
+console.log(`ready bs-${pr} at ${head} (${branch}); native files linked ${native.linked}, differ ${native.differ}`);
diff --git a/.claude/skills/babysit/scripts/steer.ts b/.claude/skills/babysit/scripts/steer.ts
new file mode 100644
index 0000000000..146c98ef82
--- /dev/null
+++ b/.claude/skills/babysit/scripts/steer.ts
@@ -0,0 +1,61 @@
+#!/usr/bin/env bun
+/**
+ * Steer a Codex worker and log the full prompt to the run ledger in one step. A later round is always a steer into
+ * the same thread (the worker keeps its context and cache), never a new spawn.
+ *
+ *   bun steer.ts --run <dir> --worker <name> --file <prompt.md> [--model m] [--pr N] [--round N]
+ */
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { readTurnBaseline } from "@app/ai/commands/agent/wait";
+import { execTool } from "@genesiscz/utils/cli";
+import { appendEvent } from "./ledger";
+import { flag, loadRun } from "./run";
+
+const run = loadRun();
+const worker = flag("--worker") ?? "";
+const prompt = flag("--file") ?? "";
+
+if (!worker || !prompt) {
+    console.error("usage: steer.ts --run <dir> --worker <name> --file <prompt.md> [--model m] [--pr N] [--round N]");
+    process.exit(2);
+}
+
+const file = resolve(prompt);
+const pr = flag("--pr") ? { pr: Number(flag("--pr")) } : {};
+const round = flag("--round") ? { round: Number(flag("--round")) } : {};
+const baseline = await readTurnBaseline("codex", worker, false);
+const sentAt = Date.now();
+// Logged BEFORE the delivery: the worker's turn starts while `codex steer` still runs, and watch-workers names a
+// worker's PR from its latest steer, so a steer logged afterwards labelled the new turn with the old PR (2026-10-14).
+appendEvent(run.dir, {
+    kind: "steer",
+    worker,
+    model: flag("--model"),
+    ...pr,
+    ...round,
+    text: readFileSync(file, "utf8"),
+    meta: {
+        sentAt,
+        sessionId: baseline?.sessionId,
+        baselineTurnStartedAt: baseline?.turnStartedAt ?? undefined,
+        baselineTranscriptBytes: baseline?.transcriptBytes,
+    },
+});
+const p = await execTool(["codex", "steer", "--name", worker, "--prompt-file", file], {
+    cwd: run.main,
+    timeout: 30_000,
+});
+const ok = p.success && !p.timedOut;
+
+if (!ok) {
+    appendEvent(run.dir, {
+        kind: "note",
+        worker,
+        ...pr,
+        ...round,
+        text: `steer NOT delivered: ${p.stderr.toString().slice(0, 300)}`,
+    });
+}
+console.log(`steer ${worker} exit=${p.exitCode}`);
+process.exit(ok ? 0 : p.exitCode || 1);
diff --git a/.claude/skills/babysit/scripts/swift-slot.ts b/.claude/skills/babysit/scripts/swift-slot.ts
new file mode 100644
index 0000000000..5ac24fad11
--- /dev/null
+++ b/.claude/skills/babysit/scripts/swift-slot.ts
@@ -0,0 +1,161 @@
+#!/usr/bin/env bun
+/**
+ * Run one heavy Swift command in the Mac's single Swift slot.
+ *
+ *   bun swift-slot.ts [--wait-minutes 40] [--run-minutes 60] -- swift test --package-path src/macos/GenesisKit --filter Foo
+ *
+ * --wait-minutes bounds queueing; --run-minutes separately bounds the child after it acquires the slot.
+ *
+ * A process check alone races: two waiters that poll the process list both see a free slot in the same second and
+ * start together (two judge runs on 2026-10-15). So the slot is a kernel file lock, and the holder also
+ * waits until no Swift build of another session (one that does not use this lock) is running. The kernel releases
+ * ownership when the holder exits, without deleting the lock file. Exits with the command's status, 124 on timeout.
+ */
+import { dlopen, FFIType } from "bun:ffi";
+import { closeSync, openSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { killProcessGroup } from "@genesiscz/utils/process/killWithEscalation";
+import { listProcesses } from "@genesiscz/utils/process/processes";
+
+const LOCK = join(tmpdir(), "genesis-swift-slot.lock");
+const SWIFT = new Set(["swift-build", "swift-test", "swift-package", "swift-frontend", "xctest"]);
+
+async function main(): Promise<void> {
+    const args = process.argv.slice(2);
+    // `bun swift-slot.ts -- swift …` reaches here without the `--`: bun takes a separator that directly follows the
+    // script as its own. So the command is everything after `--` when one is left, else everything after the options.
+    let waitMinutes = 40;
+    let runMinutes = 60;
+    let offset = 0;
+    while (["--wait-minutes", "--run-minutes"].includes(args[offset])) {
+        const minutes = Number(args[offset + 1]);
+        if (args[offset] === "--wait-minutes") {
+            waitMinutes = minutes;
+        } else {
+            runMinutes = minutes;
+        }
+        offset += 2;
+    }
+    const command = args.slice(offset + (args[offset] === "--" ? 1 : 0));
+
+    if (
+        command.length === 0 ||
+        !Number.isFinite(waitMinutes) ||
+        waitMinutes < 0 ||
+        !Number.isFinite(Date.now() + waitMinutes * 60_000) ||
+        !Number.isFinite(runMinutes) ||
+        runMinutes < 0 ||
+        !Number.isFinite(Date.now() + runMinutes * 60_000)
+    ) {
+        console.error(
+            "usage: bun swift-slot.ts [--wait-minutes N] [--run-minutes N] -- <command…> (finite nonnegative minutes)"
+        );
+        process.exit(2);
+    }
+
+    let release: (() => void) | null = null;
+
+    /** A Swift build of any session, read from the kernel's process table (the process layer, no `ps`). */
+    function swiftRunning(): boolean {
+        return listProcesses().some((entry) => SWIFT.has(entry.name));
+    }
+
+    const deadline = Date.now() + waitMinutes * 60_000;
+
+    process.on("exit", () => release?.());
+    function checkQueueDeadline(): void {
+        if (Date.now() >= deadline) {
+            console.error(`swift-slot: queue deadline expired after ${waitMinutes} min`);
+            process.exit(124);
+        }
+    }
+
+    checkQueueDeadline();
+    release = trySwiftSlot(LOCK);
+    checkQueueDeadline();
+    while (!release) {
+        checkQueueDeadline();
+        await Bun.sleep(Math.min(5000, Math.max(0, deadline - Date.now())));
+        checkQueueDeadline();
+        release = trySwiftSlot(LOCK);
+        // Even an acquisition that returns after expiry must release its lock, without starting the child.
+        checkQueueDeadline();
+    }
+
+    let forwardSignal = (signal: "SIGINT" | "SIGTERM"): void => {
+        // No child while waiting for another session: exit releases only our own slot.
+        process.exit(signal === "SIGINT" ? 130 : 143);
+    };
+    for (const signal of ["SIGINT", "SIGTERM"] as const) {
+        process.on(signal, () => forwardSignal(signal));
+    }
+
+    while (swiftRunning()) {
+        checkQueueDeadline();
+        await Bun.sleep(Math.min(10_000, Math.max(0, deadline - Date.now())));
+        checkQueueDeadline();
+    }
+
+    checkQueueDeadline();
+    const child = Bun.spawn(command, { stdio: ["inherit", "inherit", "inherit"], detached: true });
+    let interruptedExit: number | null = null;
+    let forceKill: ReturnType<typeof setTimeout> | undefined;
+    forwardSignal = (signal) => {
+        if (interruptedExit !== null) {
+            return;
+        }
+        interruptedExit = signal === "SIGINT" ? 130 : 143;
+        killProcessGroup(child, signal, "Swift slot child");
+        forceKill = setTimeout(() => killProcessGroup(child, "SIGKILL", "Swift slot child"), 5000);
+        forceKill.unref();
+    };
+    const runDeadline = Date.now() + runMinutes * 60_000;
+    let timedOut = false;
+    let runTimer: ReturnType<typeof setTimeout> | undefined;
+    const checkRunDeadline = () => {
+        const remaining = runDeadline - Date.now();
+        if (remaining > 0) {
+            runTimer = setTimeout(checkRunDeadline, Math.min(remaining, 2_147_483_647));
+            runTimer.unref();
+            return;
+        }
+        timedOut = true;
+        console.error(`swift-slot: run deadline exceeded after ${runMinutes} min; killing child group`);
+        killProcessGroup(child, "SIGKILL", "Swift slot run deadline");
+    };
+    checkRunDeadline();
+    const code = await child.exited;
+    clearTimeout(forceKill);
+    clearTimeout(runTimer);
+    // Only now may the exit handler release the lock: forwarding a signal does not mean the child has stopped.
+    process.exit(timedOut ? 124 : (interruptedExit ?? code));
+}
+
+/** Kernel ownership survives concurrent contenders and is released on process exit. Never unlink the lock inode. */
+export function trySwiftSlot(lock: string): (() => void) | null {
+    const libc = dlopen(process.platform === "darwin" ? "libSystem.B.dylib" : "libc.so.6", {
+        flock: { args: [FFIType.i32, FFIType.i32], returns: FFIType.i32 },
+    });
+    const fd = openSync(lock, "a+");
+
+    // LOCK_EX | LOCK_NB on macOS and Linux. A dead owner has no kernel lock to steal.
+    if (libc.symbols.flock(fd, 2 | 4) !== 0) {
+        closeSync(fd);
+        libc.close();
+        return null;
+    }
+
+    let released = false;
+    return () => {
+        if (!released) {
+            released = true;
+            closeSync(fd);
+            libc.close();
+        }
+    };
+}
+
+if (import.meta.main) {
+    await main();
+}
diff --git a/.claude/skills/babysit/scripts/swift-typecheck.ts b/.claude/skills/babysit/scripts/swift-typecheck.ts
new file mode 100644
index 0000000000..f982ddc9ee
--- /dev/null
+++ b/.claude/skills/babysit/scripts/swift-typecheck.ts
@@ -0,0 +1,260 @@
+#!/usr/bin/env bun
+/**
+ * Typecheck a SwiftPM package with `swiftc` alone: every library and executable target emits its module, and test
+ * targets are typechecked against those fresh modules. No binary is produced or launched, so it works while syspolicyd is stuck (a
+ * fresh build output or test bundle hangs at its first launch then) and while another session holds the one Swift
+ * build slot. It proves the code compiles, not that tests pass: run the tests when a build is allowed.
+ *
+ *   bun swift-typecheck.ts --package <dir> [--deps <dir with prebuilt .swiftmodule files>] [--out <dir>]
+ *
+ * External package products are not built here: `--deps` points at a build that has them (default: the package's
+ * twin in the main checkout, `<main>/<same relative path>/.build/arm64-apple-macosx/debug/Modules`). Measured
+ * 2026-10-14: GenesisKit 113 s plus its tests 23 s; ax-tool and SnapshotSupport in under a minute.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { basename, join, relative, resolve } from "node:path";
+import { flag, loadRun } from "./run";
+
+interface TargetDependency {
+    name: string;
+    local: boolean;
+}
+
+interface Target {
+    kind: "target" | "executableTarget" | "testTarget";
+    name: string;
+    path: string;
+    resources: boolean;
+    dependencies: TargetDependency[];
+}
+
+export function swiftCompilerCommand(options: { pkg: string; triple: string; args: string[] }): string[] {
+    const identity = basename(resolve(options.pkg))
+        .toLowerCase()
+        .replace(/[^a-z0-9_]/g, "_");
+    return ["xcrun", "swiftc", "-target", options.triple, "-package-name", identity, ...options.args];
+}
+
+export function parseSwiftTargets(manifest: string): Target[] {
+    function closing(text: string, start: number): number {
+        const end = text[start] === "(" ? ")" : "]";
+        let depth = 1;
+        let quoted = false;
+        for (let i = start + 1; i < text.length; i++) {
+            if (quoted && text[i] === "\\") {
+                i++;
+                continue;
+            }
+            if (text[i] === '"') {
+                quoted = !quoted;
+            }
+            if (quoted) {
+                continue;
+            }
+            if (text.slice(i, i + 2) === "//") {
+                const newline = text.indexOf("\n", i + 2);
+                i = newline < 0 ? text.length : newline;
+                continue;
+            }
+            if (text[i] === text[start]) {
+                depth++;
+            } else if (text[i] === end && --depth === 0) {
+                return i;
+            }
+        }
+        throw new Error("unclosed Swift target declaration");
+    }
+
+    function dependencies(body: string): TargetDependency[] {
+        const declaration = /\bdependencies\s*:\s*\[/.exec(body);
+        if (!declaration) {
+            return [];
+        }
+        const start = declaration.index + declaration[0].length - 1;
+        const text = body.slice(start + 1, closing(body, start));
+        const names: TargetDependency[] = [];
+        for (let i = 0; i < text.length; ) {
+            const rest = text.slice(i);
+            const skip = /^(?:[\s,]+|\/\/[^\n]*(?:\n|$))/.exec(rest);
+            if (skip) {
+                i += skip[0].length;
+                continue;
+            }
+            const literal = /^"([^"]+)"/.exec(rest);
+            if (literal) {
+                names.push({ name: literal[1], local: false });
+                i += literal[0].length;
+                continue;
+            }
+            const call = /^\.(target|byName|product)\s*\(/.exec(rest);
+            if (!call) {
+                throw new Error("unsupported Swift target dependency: " + rest.slice(0, 80));
+            }
+            const open = i + call[0].length - 1;
+            const end = closing(text, open);
+            const name = /\bname\s*:\s*"([^"]+)"/.exec(text.slice(open + 1, end));
+            if (!name) {
+                throw new Error("Swift target dependency has no name");
+            }
+            if (call[1] !== "product") {
+                names.push({ name: name[1], local: call[1] === "target" });
+            }
+            i = end + 1;
+        }
+        return names;
+    }
+
+    function targets(): Target[] {
+        const found: Target[] = [];
+        const re = /\.(target|executableTarget|testTarget)\s*\(\s*name:\s*"([^"]+)"/g;
+
+        for (let m = re.exec(manifest); m; m = re.exec(manifest)) {
+            const kind = m[1] as Target["kind"];
+            const end = closing(manifest, manifest.indexOf("(", m.index));
+            const body = manifest.slice(m.index + m[0].length, end);
+            re.lastIndex = end + 1;
+            const path = /path:\s*"([^"]+)"/.exec(body)?.[1] ?? join(kind === "testTarget" ? "Tests" : "Sources", m[2]);
+            found.push({
+                kind,
+                name: m[2],
+                path,
+                resources: /resources:/.test(body),
+                dependencies: dependencies(body),
+            });
+        }
+
+        const byName = new Map(found.map((target) => [target.name, target]));
+        const visiting = new Set<string>();
+        const visited = new Set<string>();
+        const ordered: Target[] = [];
+        const visit = (name: string) => {
+            const target = byName.get(name);
+            if (!target) {
+                throw new Error("unknown local dependency: " + name);
+            }
+            if (visiting.has(name)) {
+                throw new Error("Swift target dependency cycle: " + name);
+            }
+            if (visited.has(name)) {
+                return;
+            }
+            visiting.add(name);
+            for (const dependency of target.dependencies) {
+                if (byName.has(dependency.name)) {
+                    visit(dependency.name);
+                } else if (dependency.local) {
+                    throw new Error("unknown local dependency: " + dependency.name);
+                }
+            }
+            visiting.delete(name);
+            visited.add(name);
+            ordered.push(target);
+        };
+        found.forEach((target) => {
+            visit(target.name);
+        });
+        return ordered;
+    }
+
+    return targets();
+}
+
+export function typecheckPackage(): number {
+    const pkg = resolve(flag("--package") ?? ".");
+    const manifest = readFileSync(join(pkg, "Package.swift"), "utf8");
+    const orderedTargets = parseSwiftTargets(manifest);
+    if (orderedTargets.length === 0) {
+        console.error("swift-typecheck: no supported targets found in Package.swift; no sources were checked");
+        return 1;
+    }
+    const version = /\.macOS\(\.v(\d+)(?:_(\d+))?\)/.exec(manifest);
+    const triple = `arm64-apple-macos${version ? `${version[1]}${version[2] ? `.${version[2]}` : ""}` : "14"}`;
+    const out = resolve(
+        flag("--out") ?? join(loadRun().dir, "swift-typecheck", relative("/", pkg).replaceAll("/", "_"))
+    );
+    const main = loadRun().main;
+    const deps =
+        flag("--deps") ?? join(main, relative(gitRoot(pkg), pkg), ".build", "arm64-apple-macosx", "debug", "Modules");
+
+    function gitRoot(dir: string): string {
+        const p = Bun.spawnSync(["git", "-C", dir, "rev-parse", "--show-toplevel"], { stdout: "pipe", stderr: "pipe" });
+        return p.stdout.toString().trim() || dir;
+    }
+
+    function swiftFiles(dir: string): string[] {
+        return [...new Bun.Glob("**/*.swift").scanSync({ cwd: join(pkg, dir), absolute: true })].sort();
+    }
+
+    function swiftc(args: string[]): { code: number; errors: string[] } {
+        const p = Bun.spawnSync(swiftCompilerCommand({ pkg, triple, args }), {
+            cwd: pkg,
+            stdout: "pipe",
+            stderr: "pipe",
+        });
+        const text = `${p.stdout.toString()}${p.stderr.toString()}`;
+        return { code: p.exitCode ?? 1, errors: [...new Set(text.split("\n").filter((l) => /^\S.*error:/.test(l)))] };
+    }
+
+    mkdirSync(out, { recursive: true });
+    // SwiftPM generates `Bundle.module` for a target with resources; a plain swiftc run needs a stand-in.
+    const shim = join(out, "ResourceBundleShim.swift");
+    writeFileSync(shim, "import Foundation\nextension Bundle { static var module: Bundle { .main } }\n");
+    const platform = Bun.spawnSync(["xcrun", "--show-sdk-platform-path"], { stdout: "pipe" }).stdout.toString().trim();
+    const includes = ["-I", out, ...(existsSync(deps) ? ["-I", deps] : [])];
+    let failed = 0;
+
+    for (const target of orderedTargets) {
+        const files = swiftFiles(target.path);
+        const started = performance.now();
+        const result =
+            target.kind !== "testTarget"
+                ? swiftc([
+                      "-emit-module",
+                      ...(target.kind === "target" || !files.some((file) => basename(file) === "main.swift")
+                          ? ["-parse-as-library"]
+                          : []),
+                      "-enable-testing",
+                      "-module-name",
+                      target.name.replaceAll("-", "_"),
+                      "-emit-module-path",
+                      join(out, `${target.name}.swiftmodule`),
+                      ...includes,
+                      ...files,
+                      ...(target.resources ? [shim] : []),
+                  ])
+                : swiftc([
+                      "-typecheck",
+                      "-module-name",
+                      target.name.replaceAll("-", "_"),
+                      ...includes,
+                      ...(target.kind === "testTarget"
+                          ? [
+                                "-I",
+                                join(platform, "Developer/usr/lib"),
+                                "-F",
+                                join(platform, "Developer/Library/Frameworks"),
+                            ]
+                          : []),
+                      ...files,
+                  ]);
+        const seconds = ((performance.now() - started) / 1000).toFixed(0);
+
+        if (result.code === 0) {
+            console.log(`✔ ${target.kind} ${target.name}: ${files.length} files, ${seconds} s`);
+            continue;
+        }
+
+        failed++;
+        console.log(`✖ ${target.kind} ${target.name}: ${result.errors.length} error(s), ${seconds} s`);
+
+        for (const error of result.errors.slice(0, 10)) {
+            console.log(`    ${error.slice(0, 220)}`);
+        }
+    }
+
+    return failed > 0 ? 1 : 0;
+}
+
+if (import.meta.main) {
+    process.exitCode = typecheckPackage();
+}
diff --git a/.claude/skills/babysit/scripts/tmp-reclaim.ts b/.claude/skills/babysit/scripts/tmp-reclaim.ts
new file mode 100644
index 0000000000..1ecf70f4bd
--- /dev/null
+++ b/.claude/skills/babysit/scripts/tmp-reclaim.ts
@@ -0,0 +1,480 @@
+#!/usr/bin/env bun
+/**
+ * Reclaim disk from /tmp and $TMPDIR only, safely enough to run unattended next to live agent sessions.
+ * (Martin, 2026-10-14: "a SAFE bun script ... which removes anything from the /tmp/ or $TMPDIR/ that can reclaim
+ * your space - just dont forget about the live sessions"; first run freed 10.1 GB.)
+ *
+ * Two phases. A dry run (the default) lists the candidates and writes a plan file. `--apply --plan <file>` removes
+ * ONLY what that plan names, only when the plan is at most 30 minutes old, and re-checks every entry first: it must
+ * still be the same inode, still old enough, and still not open. A removal is a rename into a scratch folder in the
+ * same root, then a delete of that folder, so a half-deleted tree never sits at its old path.
+ *
+ * Candidates are the top-level entries of /tmp and $TMPDIR, plus each `/tmp/cc/<project>/<session>` folder (agent
+ * scratch). An entry is NEVER a candidate when:
+ * - it names a live session: an agent transcript (~/.claude/projects, ~/.codex/sessions, ~/.grok) changed in the
+ *   last --live-hours (default 12), the run card's session, or a `--protect <id>`;
+ * - it is, contains, or lies within a canonical `--protect <path>`;
+ * - it is a system or service entry (com.apple.*, launchd, tmux-*, ssh-*, the Claude harness folders, sockets);
+ * - anything inside it is a socket or a FIFO (a live service), or a `.git` (a repository or worktree: remove those
+ *   with `git worktree remove` / the worktree-lock release, never by deleting files);
+ * - a running process holds a file open inside it (lsof is refreshed before every removal; a failed listing stops apply);
+ * - anything inside it changed in the last --min-age-hours (default 6; newest mtime or ctime in the tree);
+ * - it is a symlink, belongs to another user, or lives on another device;
+ * - its tree could not be scanned within the time budget.
+ *
+ *   bun tmp-reclaim.ts [--run <dir>] [--min-age-hours 6] [--live-hours 12] [--protect <id|path> ...]
+ *   bun tmp-reclaim.ts --apply --plan <plan.json> [--run <dir>]
+ */
+import {
+    existsSync,
+    lstatSync,
+    mkdirSync,
+    mkdtempSync,
+    readdirSync,
+    readFileSync,
+    realpathSync,
+    renameSync,
+    rmSync,
+    writeFileSync,
+} from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { env } from "@genesiscz/utils/env";
+import { SafeJSON } from "@genesiscz/utils/json";
+import { nativeSessionRoots, nativeTranscriptMaxDepth } from "@genesiscz/utils/providers/session-paths";
+import { appendEvent } from "./ledger";
+import { flag, has } from "./run";
+
+interface Candidate {
+    path: string;
+    ino: number;
+    bytes: number;
+    newest: number;
+}
+
+interface Plan {
+    createdAt: number;
+    minAgeHours: number;
+    candidates: Candidate[];
+}
+
+const PLAN_MAX_AGE_MS = 30 * 60_000;
+const SCAN_BUDGET_MS = 20_000;
+const SYSTEM_PREFIXES = [
+    "com.apple.",
+    "launchd",
+    "tmux-",
+    "ssh-",
+    "claude-",
+    "cc-socks",
+    "powerlog",
+    ".X",
+    ".tmp-reclaim-",
+];
+function validAge(value: unknown, label: string): number {
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+        throw new Error(`${label} must be a finite nonnegative number of hours`);
+    }
+    return value;
+}
+
+function ageFlag(name: string, fallback: number): number {
+    const raw = flag(name);
+    if (has(name) && (raw === undefined || raw.trim() === "")) {
+        throw new Error(`${name} must be a finite nonnegative number of hours`);
+    }
+    return validAge(Number(raw ?? fallback), name);
+}
+
+let minAgeHours = ageFlag("--min-age-hours", 6);
+const liveHours = ageFlag("--live-hours", 12);
+const runDir = flag("--run") ?? env.get("BABYSIT_RUN");
+const uid = process.getuid?.() ?? -1;
+const roots = [...new Set(["/tmp", env.get("TMPDIR") ?? "/tmp"].map((root) => realpathSync(root)))];
+
+interface Protection {
+    ids: string[];
+    paths: string[];
+}
+
+function canonicalProtection(path: string): string {
+    const tail: string[] = [];
+    let current = resolve(path);
+    while (!existsSync(current)) {
+        const parent = dirname(current);
+        if (parent === current) {
+            throw new Error("cannot canonicalize protected path: " + path);
+        }
+        tail.unshift(basename(current));
+        current = parent;
+    }
+    return join(realpathSync(current), ...tail);
+}
+
+function containsPath(parent: string, child: string): boolean {
+    const suffix = relative(parent, child);
+    return suffix === "" || (suffix !== ".." && !suffix.startsWith("../") && !isAbsolute(suffix));
+}
+
+function protectedEntries(): Protection {
+    const explicit = process.argv.flatMap((a, i) => (process.argv[i - 1] === "--protect" ? [a] : []));
+    const paths: string[] = [];
+    const ids: string[] = [];
+    for (const value of explicit) {
+        // A bare word stays an id (matched anywhere in a path) even when a file of that name sits in the cwd,
+        // so a session id that happens to name a local file never loses its wider protection.
+        if (isAbsolute(value) || value.includes("/")) {
+            paths.push(canonicalProtection(value));
+        } else {
+            ids.push(value);
+            if (existsSync(value)) {
+                paths.push(canonicalProtection(value));
+            }
+        }
+    }
+    const cutoff = Date.now() - liveHours * 3_600_000;
+    const transcriptDirs = (["claude", "codex", "grok"] as const).flatMap((kind) =>
+        nativeSessionRoots(kind).map((top) => ({ kind, top, depthLimit: nativeTranscriptMaxDepth(kind) }))
+    );
+
+    for (const { kind, top, depthLimit } of transcriptDirs) {
+        const stack: Array<{ dir: string; depth: number }> = [{ dir: top, depth: 0 }];
+
+        while (stack.length) {
+            const { dir, depth } = stack.pop() as { dir: string; depth: number };
+            let names: string[] = [];
+
+            try {
+                names = readdirSync(dir);
+            } catch {
+                continue;
+            }
+
+            for (const name of names) {
+                const path = join(dir, name);
+                let st: ReturnType<typeof lstatSync>;
+
+                try {
+                    st = lstatSync(path);
+                } catch {
+                    continue;
+                }
+
+                if (st.isDirectory() && depth < depthLimit) {
+                    stack.push({ dir: path, depth: depth + 1 });
+                } else if (st.isFile() && st.mtimeMs >= cutoff) {
+                    // Grok stores chat_history/updates inside the UUID directory; other providers name the file.
+                    const identity = kind === "grok" ? basename(dirname(path)) : name;
+                    const id = /([0-9a-f]{8})-?[0-9a-f-]{20,}/i.exec(identity)?.[1];
+
+                    if (id) {
+                        ids.push(id.toLowerCase());
+                    }
+                }
+            }
+        }
+    }
+
+    return { ids: [...new Set(ids)], paths: [...new Set(paths)] };
+}
+
+export function openPaths(): string[] {
+    // lint-rules-ignore: a deletion guard needs every open AND mapped file (lsof's mem rows), which the process layer does not read
+    const p = Bun.spawnSync(["lsof", "-n", "-Fn", "-w"], { stdout: "pipe", stderr: "pipe" });
+    const out = p.stdout.toString();
+
+    if (p.exitCode !== 0 || p.stderr.length > 0 || !out.includes("\nn/")) {
+        throw new Error(`lsof listing incomplete (exit ${p.exitCode}): refusing to judge what is open`);
+    }
+
+    return out
+        .split("\n")
+        .filter((line) => line.startsWith("n/"))
+        .map((line) => line.slice(1));
+}
+
+/** Newest change time and size of a tree, symlinks not followed; null when the tree must not be touched. */
+function scan(path: string, rootDev: number): { newest: number; bytes: number } | { refuse: string } {
+    const deadline = Date.now() + SCAN_BUDGET_MS;
+    let newest = 0;
+    let bytes = 0;
+    const stack = [path];
+
+    while (stack.length) {
+        if (Date.now() > deadline) {
+            return { refuse: "too-big-to-scan" };
+        }
+
+        const p = stack.pop() as string;
+        let st: ReturnType<typeof lstatSync>;
+
+        try {
+            st = lstatSync(p);
+        } catch {
+            return { refuse: "unreadable" };
+        }
+
+        if (st.dev !== rootDev) {
+            return { refuse: "other-device" };
+        }
+
+        if (st.isSocket() || st.isFIFO()) {
+            return { refuse: "socket" };
+        }
+
+        if (basename(p) === ".git") {
+            return { refuse: "git-checkout" };
+        }
+
+        newest = Math.max(newest, st.mtimeMs, st.ctimeMs);
+        bytes += st.isFile() ? st.blocks * 512 : 0;
+
+        if (st.isDirectory()) {
+            try {
+                for (const name of readdirSync(p)) {
+                    stack.push(join(p, name));
+                }
+            } catch {
+                return { refuse: "unreadable" };
+            }
+        }
+    }
+
+    return { newest, bytes };
+}
+
+function judge(path: string, protection: Protection, open: string[]): Candidate | string {
+    const name = basename(path);
+    let st: ReturnType<typeof lstatSync>;
+
+    try {
+        st = lstatSync(path);
+    } catch {
+        return "gone";
+    }
+
+    if (st.isSymbolicLink()) {
+        return "symlink";
+    }
+
+    if (st.uid !== uid) {
+        return "other-user";
+    }
+
+    // A per-user macOS daemon keeps its scratch in $TMPDIR under its own name (mobiletimerd, studentd).
+    if (SYSTEM_PREFIXES.some((prefix) => name.startsWith(prefix)) || /^[a-z]+d$/.test(name)) {
+        return "system";
+    }
+
+    const run = runDir && existsSync(runDir) ? realpathSync(runDir) : null;
+
+    if (
+        protection.ids.some((id) => path.toLowerCase().includes(id.toLowerCase())) ||
+        protection.paths.some(
+            (protectedPath) => containsPath(path, protectedPath) || containsPath(protectedPath, path)
+        ) ||
+        (run && (run === path || run.startsWith(`${path}/`)))
+    ) {
+        return "live-session";
+    }
+
+    if (open.some((o) => o === path || o.startsWith(`${path}/`))) {
+        return "open-file";
+    }
+
+    const root = roots.find((r) => path.startsWith(`${r}/`)) ?? path;
+    const tree = scan(path, lstatSync(root).dev);
+
+    if ("refuse" in tree) {
+        return tree.refuse;
+    }
+
+    if (Date.now() - tree.newest < minAgeHours * 3_600_000) {
+        return "recent";
+    }
+
+    return { path, ino: st.ino, bytes: tree.bytes, newest: tree.newest };
+}
+
+/** Only canonical paths (realpath equal, so no symlink anywhere in them) with the planner's shapes may be reclaimed. */
+function candidateRoot(path: string): string | null {
+    if (typeof path !== "string" || resolve(path) !== path) {
+        return null;
+    }
+
+    const root = roots.find((r) => path.startsWith(r + "/"));
+    if (!root) {
+        return null;
+    }
+
+    const parts = relative(root, path).split("/");
+    const session = root === roots[0] && parts.length === 3 && parts[0] === "cc";
+    if ((!session && (parts.length !== 1 || parts[0] === "cc")) || realpathSync(path) !== path) {
+        return null;
+    }
+
+    return root;
+}
+
+function entries(): string[] {
+    const out: string[] = [];
+
+    for (const root of roots) {
+        for (const name of readdirSync(root)) {
+            const path = join(root, name);
+
+            // Agent scratch is judged per session folder, so one live session does not shield every dead one.
+            if (path === join(roots[0] ?? "/tmp", "cc")) {
+                if (!lstatSync(path).isDirectory() || lstatSync(path).isSymbolicLink()) {
+                    continue;
+                }
+
+                for (const project of readdirSync(path)) {
+                    const projectPath = join(path, project);
+
+                    if (lstatSync(projectPath).isDirectory()) {
+                        out.push(...readdirSync(projectPath).map((session) => join(projectPath, session)));
+                    }
+                }
+
+                continue;
+            }
+
+            out.push(path);
+        }
+    }
+
+    return out;
+}
+
+const gb = (bytes: number) => `${(bytes / 1e9).toFixed(2)} GB`;
+
+function main(): void {
+    if (!has("--apply")) {
+        const protection = protectedEntries();
+        const open = openPaths();
+        const candidates: Candidate[] = [];
+        const skipped: Record<string, number> = {};
+
+        for (const path of entries()) {
+            const verdict = judge(path, protection, open);
+
+            if (typeof verdict === "string") {
+                skipped[verdict] = (skipped[verdict] ?? 0) + 1;
+            } else {
+                candidates.push(verdict);
+            }
+        }
+
+        candidates.sort((a, b) => b.bytes - a.bytes);
+
+        for (const c of candidates.slice(0, 40)) {
+            const age = ((Date.now() - c.newest) / 3_600_000).toFixed(1);
+            console.log(`${(c.bytes / 1e6).toFixed(0).padStart(7)} MB  ${age.padStart(6)} h  ${c.path}`);
+        }
+
+        const total = candidates.reduce((sum, c) => sum + c.bytes, 0);
+        const planDir = runDir ? join(runDir, "logs") : join(roots[0] ?? "/tmp", "cc");
+        mkdirSync(planDir, { recursive: true });
+        const planPath = join(planDir, `tmp-reclaim-plan-${Date.now()}.json`);
+        const plan: Plan = { createdAt: Date.now(), minAgeHours, candidates };
+        writeFileSync(planPath, SafeJSON.stringify(plan, null, 2));
+        console.log(
+            `${candidates.length} candidates, ${gb(total)}; protected ids ${protection.ids.length}, paths ${protection.paths.length}; skipped ${SafeJSON.stringify(skipped)}`
+        );
+        console.log(`plan: ${planPath}\napply it within 30 minutes: bun tmp-reclaim.ts --apply --plan ${planPath}`);
+        process.exit(0);
+    }
+
+    const planPath = flag("--plan");
+
+    if (!planPath || !existsSync(planPath)) {
+        console.error("✖ --apply needs --plan <file> from a dry run");
+        process.exit(2);
+    }
+
+    const plan = SafeJSON.parse(readFileSync(planPath, "utf8"), { strict: true }) as Plan;
+
+    const age = Date.now() - plan.createdAt;
+    if (
+        typeof plan.createdAt !== "number" ||
+        !Number.isFinite(plan.createdAt) ||
+        !Number.isFinite(age) ||
+        age < 0 ||
+        age > PLAN_MAX_AGE_MS
+    ) {
+        console.error("✖ the plan needs a finite numeric createdAt within the last 30 minutes: run the dry run again");
+        process.exit(2);
+    }
+
+    // The dry run decided with its own threshold; the re-check uses the same one.
+    minAgeHours = validAge(plan.minAgeHours, "plan.minAgeHours");
+
+    const protection = protectedEntries();
+    const open = openPaths();
+    let freed = 0;
+    let removed = 0;
+    const refused: Record<string, number> = {};
+
+    // Only these exclusively created, private (0700) directories belong to this run.
+    const quarantines = new Map<string, string>();
+    try {
+        for (const planned of plan.candidates) {
+            let root: string | null = null;
+            try {
+                root = candidateRoot(planned.path);
+            } catch {
+                // A vanished or unreadable path is no longer a candidate either.
+            }
+
+            if (!root) {
+                refused["invalid-path"] = (refused["invalid-path"] ?? 0) + 1;
+                continue;
+            }
+
+            const now = judge(planned.path, protection, open);
+
+            if (typeof now === "string" || now.ino !== planned.ino) {
+                const why = typeof now === "string" ? now : "replaced";
+                refused[why] = (refused[why] ?? 0) + 1;
+                continue;
+            }
+
+            // Scanning earlier candidates may take minutes. Refresh immediately before the irreversible move.
+            // A failed listing throws and stops apply; an old snapshot cannot authorize a deletion.
+            const freshOpen = openPaths();
+            if (freshOpen.some((path) => path === planned.path || path.startsWith(planned.path + "/"))) {
+                refused["open-file"] = (refused["open-file"] ?? 0) + 1;
+                continue;
+            }
+
+            let trash = quarantines.get(root);
+            if (!trash) {
+                trash = mkdtempSync(join(root, ".tmp-reclaim-"));
+                quarantines.set(root, trash);
+            }
+
+            try {
+                renameSync(planned.path, join(trash, `${removed}-${basename(planned.path)}`));
+                removed++;
+                freed += now.bytes;
+            } catch (error) {
+                console.error(`could not move ${planned.path}: ${String(error)}`);
+            }
+        }
+    } finally {
+        for (const trash of quarantines.values()) {
+            rmSync(trash, { recursive: true, force: true });
+        }
+    }
+
+    const summary = `removed ${removed} of ${plan.candidates.length} planned entries, about ${gb(freed)}; refused at apply ${SafeJSON.stringify(refused)}`;
+    console.log(summary);
+
+    if (runDir) {
+        appendEvent(runDir, { kind: "note", text: `tmp-reclaim: ${summary} (plan ${planPath})` });
+    }
+}
+
+if (import.meta.main) {
+    main();
+}
diff --git a/.claude/skills/babysit/scripts/versions.ts b/.claude/skills/babysit/scripts/versions.ts
new file mode 100644
index 0000000000..5afb5d83f6
--- /dev/null
+++ b/.claude/skills/babysit/scripts/versions.ts
@@ -0,0 +1,199 @@
+/**
+ * Merge-prep git for restack.ts and pick-unified.ts: the only conflicts a script may resolve are the plugin version
+ * files, and they resolve to the HIGHER version (a stacked child can fork before its parent's later bumps, so "the
+ * replayed side" can be a downgrade). Every other conflict belongs to a worker or the lead.
+ */
+
+import { existsSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { env } from "@genesiscz/utils/env";
+import { resolutionProblems } from "./conflicts";
+
+export const VERSION_FILES = new Set([
+    ".claude-plugin/marketplace.json",
+    "plugins/genesis-tools/.claude-plugin/plugin.json",
+]);
+
+export type GitRun = (args: string[]) => { code: number; out: string };
+
+const HOOK_EVENTS = [
+    "pre-commit",
+    "commit-msg",
+    "post-commit",
+    "post-checkout",
+    "pre-push",
+    "post-merge",
+    "post-rewrite",
+];
+
+/**
+ * Git options that turn every hook off. `core.hooksPath=/dev/null` alone stops only the hooks directory: hooks set in
+ * config (`[hook "<name>"] command/event`, git 2.48+) ignore it, and 84dcc30a1 moved this repo's hooks there
+ * (measured 2026-10-14 on git 2.55: only `hook.<event>.enabled=false` or `hook.<name>.enabled=false` stopped one).
+ */
+export const HOOKS_OFF = [
+    "-c",
+    "core.hooksPath=/dev/null",
+    ...HOOK_EVENTS.flatMap((event) => [
+        "-c",
+        `hook.${event}.enabled=false`,
+        "-c",
+        `hook.genesis-tools-${event}.enabled=false`,
+    ]),
+];
+
+/**
+ * The hooks run the gates (Biome, tsgo, the commit subject rules, the personal-data probe), so turning them off for a
+ * commit or a push is allowed only while this returns true: a brand-new two-line script does not start within the
+ * timeout. That is the signature of a stuck syspolicyd, which froze the first exec of every new file from 04:57 to
+ * 06:05 on 2026-10-14 (hook copies, a worktree's biome, fresh test bundles). Once it recovers, the hooks run again.
+ */
+export async function newExecutablesStall(timeoutMs = 5_000): Promise<boolean> {
+    const dir = mkdtempSync(join(tmpdir(), "babysit-exec-probe-"));
+    const file = join(dir, "probe");
+    writeFileSync(file, "#!/bin/sh\nexit 0\n", { mode: 0o755 });
+    const proc = Bun.spawn([file], { stdout: "ignore", stderr: "ignore" });
+    const started = await Promise.race([proc.exited.then(() => true), Bun.sleep(timeoutMs).then(() => false)]);
+
+    if (!started) {
+        // A process frozen in exec still takes a signal; never wait for it.
+        proc.kill();
+    }
+
+    // syspolicyd may still be checking this executable after the child exits or is signalled. Keep it.
+    return !started;
+}
+
+/**
+ * The repo's hooks run as config hooks through their interpreter only while `core.hooksPath` is unset
+ * (`scripts/git/install-hooks.ts`). An install or a checkout on a branch with the older `prepare` sets it back to
+ * `.githooks`, git then executes each worktree's new hook copy directly, and a stuck syspolicyd froze every such
+ * first run (2026-10-14: commits from three sessions hung at their pre-commit hook). Before a commit or a push this
+ * puts the config hooks back with the repo's own installer, which Martin allowed the babysit to run.
+ */
+export function ensureConfigHooks(main: string): string {
+    const listed = Bun.spawnSync(["git", "hook", "list", "pre-commit"], {
+        cwd: main,
+        stdout: "pipe",
+        stderr: "pipe",
+        env: env.getProcessEnv(),
+    });
+
+    if (!listed.stdout.toString().includes("hook from hookdir")) {
+        return "config hooks in place";
+    }
+
+    const installer = join(main, "scripts/git/install-hooks.ts");
+
+    if (!existsSync(installer)) {
+        return "⚠ git runs the hook folder, and this checkout has no installer";
+    }
+
+    const fixed = Bun.spawnSync(["bun", installer], {
+        cwd: main,
+        stdout: "pipe",
+        stderr: "pipe",
+        env: env.getProcessEnv(),
+    });
+    return fixed.exitCode === 0
+        ? "⚠ core.hooksPath was set again: the installer put the config hooks back"
+        : `⚠ the hook installer failed: ${fixed.stderr.toString().trim().slice(0, 200)}`;
+}
+
+/** Hooks off for the mechanical replays (rebase, cherry-pick, worktree add), which run no gate hook anyway: only
+ * post-checkout and post-rewrite fire there, and a post-checkout hook froze for minutes on a stuck syspolicyd. Rerere
+ * off too (a remembered resolution
+ * staged itself, hiding the conflict and an old version number). */
+export function prepGit(cwd: string): GitRun {
+    return (args) => {
+        const p = Bun.spawnSync(["git", ...HOOKS_OFF, "-c", "rerere.enabled=false", ...args], {
+            cwd,
+            stdout: "pipe",
+            stderr: "pipe",
+            env: { ...env.getProcessEnv(), GIT_EDITOR: "true" },
+        });
+        return { code: p.exitCode ?? 1, out: `${p.stdout.toString()}${p.stderr.toString()}` };
+    };
+}
+
+export function conflictedFiles(git: GitRun): string[] {
+    return git(["diff", "--name-only", "--diff-filter=U"]).out.split("\n").filter(Boolean);
+}
+
+function versionOf(json: string): number[] {
+    return (/"version":\s*"(\d+)\.(\d+)\.(\d+)"/.exec(json)?.slice(1) ?? ["0", "0", "0"]).map(Number);
+}
+
+export function higherVersionSide(ours: string, theirs: string): "--ours" | "--theirs" {
+    const [a, b] = [versionOf(ours), versionOf(theirs)];
+    const i = a.findIndex((n, index) => n !== b[index]);
+    return i >= 0 && (a[i] ?? 0) > (b[i] ?? 0) ? "--ours" : "--theirs";
+}
+
+/** Resolve only version lines in the already-merged working text. Validate every file before writing any. */
+export function resolveVersionConflicts(git: GitRun, conflicted: string[]): boolean {
+    if (conflicted.length === 0 || conflicted.some((file) => !VERSION_FILES.has(file))) {
+        return false;
+    }
+
+    const top = git(["rev-parse", "--show-toplevel"]);
+
+    if (top.code !== 0) {
+        return false;
+    }
+
+    const root = top.out.trim();
+    const resolved = new Map<string, string>();
+
+    for (const file of conflicted) {
+        const text = resolveVersionText(readFileSync(join(root, file), "utf8"));
+
+        if (text === null) {
+            return false;
+        }
+
+        resolved.set(file, text);
+    }
+
+    const problems = resolutionProblems(conflicted, (file) => resolved.get(file) ?? "");
+
+    if (problems.length > 0) {
+        for (const problem of problems) {
+            console.error(`✖ ${problem}`);
+        }
+
+        return false;
+    }
+
+    for (const [file, text] of resolved) {
+        writeFileSync(join(root, file), text);
+
+        if (git(["add", "--", file]).code !== 0) {
+            return false;
+        }
+    }
+
+    return true;
+}
+
+export function resolveVersionText(text: string): string | null {
+    let count = 0;
+    let valid = true;
+    const versionLine = /^([ \t]*"version"[ \t]*:[ \t]*")(\d+\.\d+\.\d+)(",?[ \t]*\r?\n?)$/;
+    const resolved = text.replace(
+        /^<<<<<<<[^\n]*\n([\s\S]*?)^=======[ \t]*\r?\n([\s\S]*?)^>>>>>>>[^\n]*(?:\n|$)/gm,
+        (_block, left: string, right: string) => {
+            count++;
+            const [ours, base] = left.split(/^\|{7}[^\n]*\n/m);
+            const a = versionLine.exec(ours);
+            const b = versionLine.exec(right);
+            if (!a || !b || a[1] !== b[1] || a[3] !== b[3] || (base !== undefined && !versionLine.test(base))) {
+                valid = false;
+                return _block;
+            }
+            return higherVersionSide(ours, right) === "--ours" ? ours : right;
+        }
+    );
+    return valid && count > 0 && !/^(?:<{7}|={7}|>{7}|\|{7})(?:\s|$)/m.test(resolved) ? resolved : null;
+}
diff --git a/.claude/skills/babysit/scripts/wait-turn.ts b/.claude/skills/babysit/scripts/wait-turn.ts
new file mode 100644
index 0000000000..e81203be4e
--- /dev/null
+++ b/.claude/skills/babysit/scripts/wait-turn.ts
@@ -0,0 +1,172 @@
+#!/usr/bin/env bun
+/**
+ * Wait for a Codex worker's current turn to end (run it with Bash run_in_background: the harness wakes the lead when
+ * it exits), save the `tools codex wait --json` result, and log the worker's final message to the run ledger.
+ *
+ *   bun wait-turn.ts --run <dir> --worker <name> --thread <id> [--pr N] [--round N] [--model m] [--timeout 3600]
+ *   bun wait-turn.ts --run <dir> --worker <name> --from-file <wait.json> …   (log a result saved earlier)
+ */
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { toolsEntrypoint } from "@genesiscz/utils/cli/tools";
+import { env } from "@genesiscz/utils/env";
+import { SafeJSON } from "@genesiscz/utils/json";
+import { appendEvent, readEvents } from "./ledger";
+import { flag, loadRun } from "./run";
+
+const run = loadRun();
+const worker = flag("--worker") ?? "";
+const pr = flag("--pr");
+const round = flag("--round");
+const fromFile = flag("--from-file");
+let raw = "";
+let exitCode = 0;
+let stderr = "";
+
+if (fromFile) {
+    raw = readFileSync(fromFile, "utf8");
+} else {
+    const timeoutSeconds = Number(flag("--timeout") ?? 3600);
+    if (!Number.isFinite(timeoutSeconds) || timeoutSeconds <= 0) {
+        console.error("--timeout must be a positive finite number of seconds");
+        process.exit(2);
+    }
+
+    const steer = readEvents(run.dir).findLast(
+        (event) =>
+            event.kind === "steer" &&
+            event.worker === worker &&
+            (pr === undefined || event.pr === Number(pr)) &&
+            (round === undefined || event.round === Number(round))
+    );
+    const fence = steer?.meta;
+    const finite = (value: unknown): value is number =>
+        typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+    if (
+        !fence ||
+        !finite(fence.sentAt) ||
+        (fence.baselineTurnStartedAt !== undefined && !finite(fence.baselineTurnStartedAt)) ||
+        (fence.baselineTranscriptBytes !== undefined && !finite(fence.baselineTranscriptBytes))
+    ) {
+        console.error("no answering-turn fence: use steer.ts before waiting, or import a saved --from-file report");
+        process.exit(2);
+    }
+    const thread = flag("--thread");
+    if (
+        fence.sessionId !== undefined &&
+        (typeof fence.sessionId !== "string" || (thread && thread !== fence.sessionId))
+    ) {
+        console.error("--thread differs from the pre-steer session baseline");
+        process.exit(2);
+    }
+    try {
+        const p = Bun.spawnSync(
+            [
+                toolsEntrypoint(),
+                "codex",
+                "wait",
+                thread ?? (typeof fence.sessionId === "string" ? fence.sessionId : worker),
+                "--next",
+                "--sent-at",
+                String(fence.sentAt),
+                ...(fence.baselineTurnStartedAt !== undefined
+                    ? ["--baseline-turn-started-at", String(fence.baselineTurnStartedAt)]
+                    : []),
+                ...(fence.baselineTranscriptBytes !== undefined
+                    ? ["--baseline-transcript-bytes", String(fence.baselineTranscriptBytes)]
+                    : []),
+                "--stall-timeout",
+                "1800",
+                "--timeout",
+                String(timeoutSeconds),
+                "--json",
+            ],
+            {
+                cwd: run.main,
+                stdout: "pipe",
+                stderr: "pipe",
+                env: env.getProcessEnv(),
+                timeout: (timeoutSeconds + 30) * 1000,
+            }
+        );
+        raw = p.stdout.toString();
+        exitCode = p.signalCode ? 124 : (p.exitCode ?? 1);
+        stderr = p.stderr.toString();
+        if (p.signalCode) {
+            raw = SafeJSON.stringify({ outcome: "timeout", error: "wait supervisor deadline expired" });
+        }
+    } catch (error) {
+        exitCode = 1;
+        raw = SafeJSON.stringify({ outcome: "error", error: String(error) });
+    }
+}
+
+const logs = join(run.dir, "logs");
+mkdirSync(logs, { recursive: true });
+const file = fromFile ?? join(logs, `wait-${worker}-${pr}r${round}-${Date.now()}.json`);
+
+if (!fromFile) {
+    writeFileSync(file, raw);
+}
+
+let text = "";
+let failure: string | null = null;
+let meta: Record<string, unknown> = { exit: exitCode, file };
+
+try {
+    const value: unknown = SafeJSON.parse(raw, { strict: true });
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("wait report must be an object");
+    }
+    const result = value as Record<string, unknown>;
+    if (
+        (result.error != null && typeof result.error !== "string") ||
+        (result.lastText !== undefined && typeof result.lastText !== "string")
+    ) {
+        throw new Error("wait report error and lastText must be strings when present");
+    }
+    text = typeof result.lastText === "string" ? result.lastText : "";
+    failure = typeof result.error === "string" ? result.error : null;
+    if (fromFile) {
+        if (result.outcome !== "done" && result.outcome !== "stalled" && result.outcome !== "timeout") {
+            throw new Error("saved wait report has no valid outcome");
+        }
+        // Match codex wait: timeout/stall take precedence, and a failed completed turn exits 4.
+        exitCode = result.outcome === "timeout" ? 124 : result.outcome === "stalled" ? 3 : failure ? 4 : 0;
+    } else if (failure && exitCode === 0) {
+        exitCode = 4;
+    }
+    meta = {
+        ...meta,
+        exit: exitCode,
+        outcome: result.outcome,
+        state: result.state,
+        ...(failure ? { error: failure } : {}),
+    };
+} catch (error) {
+    exitCode = exitCode || 1;
+    failure = "invalid wait report: " + (error instanceof Error ? error.message : String(error));
+    text = "(invalid wait report) " + stderr.slice(0, 500);
+    meta = { ...meta, exit: exitCode, outcome: "error", error: failure };
+}
+
+appendEvent(run.dir, {
+    kind: "turn",
+    worker,
+    model: flag("--model"),
+    ...(pr ? { pr: Number(pr) } : {}),
+    ...(round ? { round: Number(round) } : {}),
+    text,
+    meta,
+});
+const result = text.match(/RESULT:\s*(.+)/)?.[1] ?? "";
+
+if (failure) {
+    console.log(`✖ ${worker} #${pr} r${round} turn FAILED (exit ${exitCode}): ${failure} → ${file}`);
+    console.log("  inspect the wait report before retrying the steer or moving the brief to another worker");
+} else {
+    console.log(`${worker} #${pr} r${round} turn ended exit=${exitCode} ${result.slice(0, 120)} → ${file}`);
+}
+
+// Imported waits use the validated result status; live waits retain the supervising process status.
+process.exitCode = exitCode;
diff --git a/.claude/skills/babysit/scripts/watch-reviews.ts b/.claude/skills/babysit/scripts/watch-reviews.ts
new file mode 100644
index 0000000000..e640286712
--- /dev/null
+++ b/.claude/skills/babysit/scripts/watch-reviews.ts
@@ -0,0 +1,70 @@
+#!/usr/bin/env bun
+/**
+ * A Monitor source for every reviewer: every `--every` seconds it runs round-ready.ts and prints a PR's line only
+ * when its head, any reviewer's review of that head, its open threads or the PR comments by others changed, so each
+ * event is one PR worth looking at. No reviewer is filtered out: on 2026-10-14 this dropped CodeRabbit from the key,
+ * and only eve's state could wake the lead.
+ * Ends after `--for` minutes (a Claude Code Monitor dies at 30 minutes anyway; re-arm it with the same command).
+ *
+ *   bun watch-reviews.ts --run <dir> [--every 120] [--for 30] <N> [<N> ...]
+ *
+ * Start it as `bun <path>` in the Monitor command, not through a wrapper script's shebang: a zsh wrapper started
+ * that way delivered no event for 25 minutes on 2026-10-14, the same loop under `zsh <path>` delivered at once.
+ */
+import { join } from "node:path";
+import { env } from "@genesiscz/utils/env";
+import { flag, loadRun } from "./run";
+
+const run = loadRun();
+const every = Number(flag("--every") ?? 120) * 1000;
+const lifetimeMinutes = Number(flag("--for") ?? 30);
+const deadline = Date.now() + lifetimeMinutes * 60_000;
+if (
+    !Number.isFinite(deadline) ||
+    !Number.isFinite(lifetimeMinutes) ||
+    lifetimeMinutes < 0 ||
+    !Number.isFinite(every) ||
+    every < 100
+) {
+    console.error("watch-reviews: --for must be finite and nonnegative; --every must be at least 0.1 seconds");
+    process.exit(2);
+}
+const prs = process.argv.slice(2).filter((a, i, all) => /^\d+$/.test(a) && !all[i - 1]?.startsWith("--"));
+const seen = new Map<string, string>();
+
+if (prs.length === 0) {
+    console.error("usage: watch-reviews.ts --run <dir> [--every 120] [--for 30] <N> [<N> ...]");
+    process.exit(2);
+}
+
+while (Date.now() < deadline) {
+    const p = Bun.spawnSync(["bun", join(import.meta.dir, "round-ready.ts"), "--run", run.dir, ...prs], {
+        cwd: run.main,
+        stdout: "pipe",
+        stderr: "pipe",
+        env: env.getProcessEnv(),
+        timeout: Math.max(1, deadline - Date.now()),
+        killSignal: "SIGKILL",
+    });
+
+    if (Date.now() >= deadline) {
+        break;
+    }
+
+    for (const line of p.stdout.toString().split("\n").filter(Boolean)) {
+        const pr = line.split(" ")[0];
+
+        if (seen.get(pr) !== line) {
+            seen.set(pr, line);
+            console.log(line);
+        }
+    }
+
+    if (p.exitCode !== 0) {
+        console.log(`round-ready failed (exit ${p.exitCode}): ${p.stderr.toString().trim().slice(0, 200)}`);
+    }
+
+    await Bun.sleep(Math.min(every, Math.max(0, deadline - Date.now())));
+}
+console.log(`review watch expired after ${lifetimeMinutes} min`);
+process.exit(124);
diff --git a/.claude/skills/babysit/scripts/watch-workers.ts b/.claude/skills/babysit/scripts/watch-workers.ts
index 0c2aa40d88..14fe7b8754 100644
--- a/.claude/skills/babysit/scripts/watch-workers.ts
+++ b/.claude/skills/babysit/scripts/watch-workers.ts
@@ -7,26 +7,124 @@
  * path ignores `--tail` and stops at the end of a turn, so a restart replayed the whole history (2026-10-14).
  * Grok has one stream per turn: the script polls `tools grok status` and tails each running turn.
  *
- * Usage: bun .claude/skills/babysit/scripts/watch-workers.ts grok:bs-512-grok codex:bs-511-sol [--stall-s 180]
+ * Usage: bun .claude/skills/babysit/scripts/watch-workers.ts grok:bs-512-grok codex:bs-511-sol [--stall-s 180] [--run <dir>]…
+ *        [--tools all|commands|none]
+ *
+ * --tools sets which tool calls print: `commands` (the default) prints shell commands only, where a commit, a push or an
+ * install shows, and counts the rest at the end of the turn; `all` prints every call. One Grok round printed 40 file
+ * reads and greps in its first five minutes, and eight workers at once buried the turn ends and stalls (2026-10-15).
+ *
+ * With --run, each line also names the PR and round the worker was last steered to (from the run's ledger): a worker
+ * keeps its first PR's name across later PRs, so "bs-compress turn 13" read as the compress PR taking 13 turns when
+ * it was #516 round 3 (2026-10-14).
  */
+import { existsSync, statSync } from "node:fs";
 import { execTool } from "@genesiscz/utils/cli";
 import { toolsEntrypoint } from "@genesiscz/utils/cli/tools";
+import { turnLogPath } from "@genesiscz/utils/grok/worker-paths";
 import { SafeJSON } from "@genesiscz/utils/json";
+import { type LedgerEvent, ledgerPath, readEvents } from "./ledger";
 
 const args = process.argv.slice(2);
 const stallIndex = args.indexOf("--stall-s");
 const STALL_MS = (stallIndex >= 0 ? Number(args[stallIndex + 1]) : 180) * 1000;
+const toolsIndex = args.indexOf("--tools");
+const TOOLS = toolsIndex >= 0 ? args[toolsIndex + 1] : "commands";
+
+if (!["all", "commands", "none"].includes(TOOLS)) {
+    console.error(`--tools takes all, commands or none, got ${TOOLS}`);
+    process.exit(2);
+}
+
+/** Shell tool names across backends: Grok `run_terminal_command`, Codex `exec_command` / `shell` / `exec`. */
+const SHELL_TOOL = /^(run_terminal_command|exec_command|shell|exec|bash)\b/i;
 const workers = args
     .filter((arg) => /^(grok|codex):/.test(arg))
     .map((spec) => {
         const [backend, name] = spec.split(":") as ["grok" | "codex", string];
-        return { backend, name, label: `${backend}:${name}`, lastAt: Date.now(), running: false, stallSaid: false };
+        return {
+            backend,
+            name,
+            label: `${backend}:${name}`,
+            lastAt: Date.now(),
+            running: false,
+            stallSaid: false,
+            hiddenTools: 0,
+            seen: new Set<string>(),
+            seenTurn: -1,
+        };
     });
 type Worker = (typeof workers)[number];
 
-const say = (w: Worker, text: string) => console.log(`[${w.label}] ${text.replace(/\s+/g, " ").slice(0, 220)}`);
+// --run may repeat: a worker steered from another repository's run (GenesisPlayground) logs into that run's ledger,
+// and a watcher reading one ledger kept naming its first PR and round (2026-10-14, bs-gp "#94 r1" on round 2).
+const runDirs = args.filter((_, i) => args[i - 1] === "--run");
+
+/** Parse each ledger only when its metadata changes, and keep only its latest task per worker. */
+export function createTaskLookup({
+    dirs,
+    read = readEvents,
+}: {
+    dirs: string[];
+    read?: typeof readEvents;
+}): (name: string) => string {
+    const cache = new Map<string, { stamp: string; tasks: Map<string, LedgerEvent> }>();
+    return (name) => {
+        let latest: LedgerEvent | undefined;
+
+        for (const dir of dirs) {
+            let stamp = "";
+
+            try {
+                const stat = statSync(ledgerPath(dir));
+                stamp = [stat.ino, stat.size, stat.mtimeMs, stat.ctimeMs].join(":");
+            } catch (error) {
+                if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") {
+                    throw error;
+                }
+            }
+
+            let cached = cache.get(dir);
+            if (!cached || cached.stamp !== stamp) {
+                const tasks = new Map<string, LedgerEvent>();
+
+                for (const event of stamp ? read(dir) : []) {
+                    if (event.worker && (event.kind === "steer" || event.kind === "spawn")) {
+                        const previous = tasks.get(event.worker);
+                        if (!previous || previous.at <= event.at) {
+                            tasks.set(event.worker, event);
+                        }
+                    }
+                }
+
+                cached = { stamp, tasks };
+                cache.set(dir, cached);
+            }
+
+            const task = cached.tasks.get(name);
+            if (task && (!latest || latest.at <= task.at)) {
+                latest = task;
+            }
+        }
+
+        return latest?.pr ? " #" + latest.pr + (latest.round ? " r" + latest.round : "") : "";
+    };
+}
+
+const currentTask = createTaskLookup({ dirs: runDirs });
+const say = (w: Worker, text: string) =>
+    console.log(`[${w.label}${currentTask(w.name)}] ${text.replace(/\s+/g, " ").slice(0, 220)}`);
+
 const MARKERS = /^(▶|✔|✖|⏸|■|⚠|🛑|❓)/u;
 
+/** The count of the tool calls `--tools` kept quiet, once per turn end. */
+function flushHidden(w: Worker): void {
+    if (w.hiddenTools > 0) {
+        say(w, `${w.hiddenTools} more tool call(s) not printed (--tools ${TOOLS})`);
+        w.hiddenTools = 0;
+    }
+}
+
 export async function pump(w: Worker, cmd: string[], timeoutMs = 1_800_000): Promise<number> {
     const child = Bun.spawn(cmd, { cwd: process.cwd(), stdout: "pipe", stderr: "pipe", detached: true });
     let expired = false;
@@ -48,6 +146,8 @@ export async function pump(w: Worker, cmd: string[], timeoutMs = 1_800_000): Pro
     try {
         const decoder = new TextDecoder();
         let buf = "";
+        let offset = 0;
+        const turn = w.seenTurn;
 
         for await (const chunk of child.stdout) {
             buf += decoder.decode(chunk, { stream: true });
@@ -58,6 +158,17 @@ export async function pump(w: Worker, cmd: string[], timeoutMs = 1_800_000): Pro
                 buf = buf.slice(nl + 1);
                 nl = buf.indexOf("\n");
 
+                // Grok tails replay a turn from its start. Position identifies an event; display text does not.
+                const identity = `${turn}:${offset++}`;
+
+                if (w.backend === "grok") {
+                    if (w.seen.has(identity)) {
+                        continue;
+                    }
+
+                    w.seen.add(identity);
+                }
+
                 if (!line.trim()) {
                     continue;
                 }
@@ -65,8 +176,27 @@ export async function pump(w: Worker, cmd: string[], timeoutMs = 1_800_000): Pro
                 w.lastAt = Date.now();
                 w.stallSaid = false;
 
+                // A session-long Codex tail spans idle time between turns: only a started turn can stall
+                // (2026-10-14: an idle worker raised "STALL: no event for 308 s").
+                if (/^▶ turn\b/u.test(line)) {
+                    w.running = true;
+                } else if (/^(✔|✖|⏸|■) turn\b/u.test(line)) {
+                    w.running = false;
+
+                    // A Grok tail also replays finished turns' end lines; watchGrok prints the count at the real end.
+                    if (w.backend === "codex") {
+                        flushHidden(w);
+                    }
+                }
+
                 if (line.startsWith("🔧")) {
-                    say(w, `tool ${line.slice(2).trim()}`);
+                    const call = line.slice(2).trim();
+
+                    if (TOOLS === "all" || (TOOLS === "commands" && SHELL_TOOL.test(call))) {
+                        say(w, `tool ${call}`);
+                    } else {
+                        w.hiddenTools++;
+                    }
                 } else if (line.startsWith("↩") && line.includes("FAILED")) {
                     say(w, line);
                 } else if (MARKERS.test(line)) {
@@ -98,7 +228,11 @@ async function grokStatus(w: Worker): Promise<{ running: boolean; turns: number;
 
     try {
         const meta = SafeJSON.parse(result.stdout.toString(), { strict: true });
-        return { running: Boolean(meta.running), turns: meta.turns ?? 0, exitCode: meta.lastTurn?.exitCode };
+        const running = Boolean(meta.running);
+        const completed = Number.isInteger(meta.turns) && meta.turns >= 0 ? meta.turns : 0;
+        const active = meta.activeTurn?.turn;
+        const turns = running ? (Number.isInteger(active) && active > 0 ? active : completed + 1) : completed;
+        return { running, turns, exitCode: meta.lastTurn?.exitCode };
     } catch {
         return null;
     }
@@ -110,7 +244,30 @@ async function watchGrok(w: Worker): Promise<void> {
 
         if (status?.running) {
             w.running = true;
-            say(w, `turn ${status.turns} RUNNING`);
+
+            // The set retains turn/position identities across tail restarts, including earlier turns.
+            // While a new turn has no log yet the tail reads the finished turn and ends at once, so this branch runs
+            // on every poll: the RUNNING line prints once per turn, not once per poll.
+            if (status.turns !== w.seenTurn) {
+                w.seenTurn = status.turns;
+                say(w, `turn ${status.turns} RUNNING`);
+            }
+
+            // The tail follows the newest log file. Until the running turn has written its own, that is the turn
+            // before it, which the tail replays and ends at once (#521 turns 2 to 4, 2026-10-15). Wait for the turn's
+            // own file, with a deadline.
+            const deadline = Date.now() + 60_000;
+
+            while (!existsSync(turnLogPath(w.name, status.turns)) && Date.now() < deadline) {
+                await Bun.sleep(1000);
+            }
+
+            if (!existsSync(turnLogPath(w.name, status.turns))) {
+                say(w, `turn ${status.turns} log unavailable after 60 s`);
+                await Bun.sleep(3000);
+                continue;
+            }
+
             await pump(w, [
                 process.execPath,
                 "run",
@@ -125,7 +282,13 @@ async function watchGrok(w: Worker): Promise<void> {
                 "none",
             ]);
             const end = await grokStatus(w);
-            say(w, `turn ${end?.turns ?? "?"} ENDED exit=${end?.exitCode ?? "?"}`);
+
+            // Preserve counts while a partial tail restarts; replayed positions are skipped by pump.
+            if (!end?.running) {
+                flushHidden(w);
+                say(w, `turn ${end?.turns ?? "?"} ENDED exit=${end?.exitCode ?? "?"}`);
+            }
+
             w.running = false;
         }
 
diff --git a/.claude/skills/performance/SKILL.md b/.claude/skills/performance/SKILL.md
index 32c856af2b..dcc794fc96 100644
--- a/.claude/skills/performance/SKILL.md
+++ b/.claude/skills/performance/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: performance
-description: Measuring and improving CPU, I/O and latency in the GenesisTools Bun/TypeScript code — CLI tools, the usage daemon, the hub server, session discovery and listing, file walking and reading, JSON parsing, bun:ffi and native code. Use it whenever a tool, command, daemon tick or server door is slow or burns CPU, before and after any change meant to make something faster, when you profile, benchmark, A/B or compare two ways of doing something, when you consider bun:ffi, TinyCC, a C helper or a cache, and when you write a performance number into a commit, note or ledger — even when the user only says "this is slow", "why does it take 1 s", "can we make it faster", "is FFI faster", "measure it", or asks whether a cache would show stale data. For SwiftUI/AppKit app performance use the swift skill; this one covers the Bun side it calls.
+description: Measuring and improving CPU, I/O and latency in the GenesisTools Bun/TypeScript code — CLI tools, the usage daemon, the hub server, session discovery and listing, file walking and reading, JSON parsing, bun:ffi and native code. Use it whenever a tool, command, daemon tick or server door is slow or burns CPU, before and after any change meant to make something faster, when you profile, benchmark, A/B or compare two ways of doing something, when you consider bun:ffi, TinyCC, a C helper or a cache, when code spawns ps, lsof or pgrep, when a test starts an executable, when a CI run is red, slow or hangs, and when you write a performance number into a commit, note or ledger — even when the user only says "this is slow", "why does it take 1 s", "can we make it faster", "is FFI faster", "measure it", or asks whether a cache would show stale data. For SwiftUI/AppKit app performance use the swift skill; this one covers the Bun side it calls.
 ---
 
 # Performance work in GenesisTools (Bun / TypeScript)
@@ -46,6 +46,11 @@ measured. So the rule of this skill is simple: no change, and no claim, without
 - **Bun 1.3.13 is still supported.** A Bun 1.4-only API (for example `Bun.JSONL`) may appear in a benchmark arm,
   never in shipped code.
 - **Diagnostics never mutate** (repository rule). A benchmark reads live data; it never rewrites it.
+- **No new `ps`, `lsof` or `pgrep` spawn.** Ask `@genesiscz/utils/process`; the lint rule `no-process-tool-spawn`
+  fails a new spawn, and the platform fallback is the layer's decision, never the caller's. Skip a row you cannot
+  read, and never treat a failed read as "gone". `references/ffi-and-native.md` sections 3b and 3c.
+- **A test never makes an executable per run.** Executing a file that a test just made, then renaming or deleting
+  it, crashed syspolicyd and froze the Mac on 2026-10-14. Use `persistentFixture`. `references/tests-and-ci.md`.
 
 ## Which tool answers which question
 
@@ -61,6 +66,9 @@ measured. So the rule of this skill is simple: no change, and no claim, without
   anything that must hand full JS objects back.
 - "Is JSON parsing the cost?" → `references/json.md`.
 - "How do I walk or read files cheaply?" → `references/filesystem.md`.
+- "Which call sites still spawn, and at what cost?" → `bun scripts/benchmarks/process/call-sites-bench.ts --runs 3
+  --compare` (cold and warm CPU per site, spawned children included).
+- "Did CI really pass, and why is it red?" → `references/tests-and-ci.md` (a green job can carry failing tests).
 
 ## Measured facts to start from (2026-10-12, this Mac)
 
@@ -74,6 +82,8 @@ measured. So the rule of this skill is simple: no change, and no claim, without
 - `JSON.parse` of 137 MB of transcript lines: 112 ms. comment-json (the old `SafeJSON.parse` default): 1,026 to
   1,261 ms. `SafeJSON.parse` now tries `JSON.parse` first.
 - The usage daemon's own row build: 1,180 ms before the identity cache, 423 ms after.
+- 62 `ps`, `lsof` and `pgrep` call sites (2026-10-14, #516): total cold CPU 3,446 → 1,467 ms; the `lsof` sites
+  fell 90 to 99% (bundle pruning 371 → 29 ms, `tools port <port>` 245 → 12 ms).
 
 Every number above has its method and commit in `references/` and in the ledger.
 
@@ -82,11 +92,14 @@ Every number above has its method and commit in `references/` and in the ledger.
 - `references/profiling.md`: `tools ts profile`, `bun --cpu-prof`, `sample`, the repository profiler, and the
   traps in each (wall-sampled JS thread, await gaps, `bun test` ignoring `--cpu-prof`).
 - `references/measuring.md`: the benchmark harness, fresh-process cold/warm samples, interleaving, blocks, the
-  old-commit scratch worktree, controls, and how to report a result.
+  old-commit scratch worktree, controls, how to report a result, and a stand-in arm that skipped the module load.
+- `references/tests-and-ci.md`: persistent fixtures for tests that start an executable, the Linux container check
+  (any SHA through git alternates), a green CI job that carries failing tests, and the Linux worker hang.
 - `references/filesystem.md`: `fastWalk`, `readFirstLines` / `readLastLines`, sync vs async fs, stat costs, APFS
   and FSEvents facts, and what was rejected.
 - `references/ffi-and-native.md`: `bun:ffi` rules (the `ptr()` trap), `defineSystemLibrary`, the shared
-  `libSystem` binding, `defineNativeLibrary` (clang cache, TinyCC limits), and when native code pays.
+  `libSystem` binding, process data from the kernel and the lessons of moving 62 call sites onto it,
+  `defineNativeLibrary` (clang cache, TinyCC limits), and when native code pays.
 - `references/json.md`: what `JSON.parse` costs, the `SafeJSON` change, `Bun.JSONL`, simdjson through FFI (full
   parse, field pick, tape plus key cache) and why `SafeJSON.parse(..., { ffi: true })` would lose.
 - `references/caching-and-freshness.md`: the never-staler rule in practice, `FileIdentityCache`, persisted
diff --git a/.claude/skills/performance/references/ffi-and-native.md b/.claude/skills/performance/references/ffi-and-native.md
index 56c5077142..b1cb38a597 100644
--- a/.claude/skills/performance/references/ffi-and-native.md
+++ b/.claude/skills/performance/references/ffi-and-native.md
@@ -86,6 +86,77 @@ socket info; `src/utils/process/socket-owner.ts`).
 - Check the struct layout at start-up against your own row and fall back to the spawn if it looks wrong; a layout
   change in a future macOS then costs speed, not correctness.
 
+## 3c. Moving call sites onto the process layer (#516, 2026-10-14 22:43)
+
+62 call sites spawned `ps`, `lsof` or `pgrep` (`scripts/benchmarks/process/call-sites.ts`). After the move: total
+cold CPU 3,446 → 1,467 ms, 8 sites still spawn once each (other users' data, one cache-retirement `lsof`). The
+`lsof` sites fell 90 to 99% (bundle pruning 371 → 29 ms, `tools port <port>` 245 → 12 ms). Ledger entry
+"2026-10-14 02:40" in `.claude/docs/performance.md`.
+
+- **A new spawn is a lint error.** `no-process-tool-spawn` in `scripts/ci/lint-rules.ts` (db5f3983d) also catches an
+  absolute program path, the `{ cmd }` form, an env prefix and a program passed before its argv (d2c2b8dff). The
+  existing spawns sit in a baseline that `lint-rules --update-process-baseline` rewrites and never raises (e6c34af56).
+- **The platform fallback is the layer's decision, never the caller's.** A call site asks
+  `@genesiscz/utils/process` one question; the layer picks the kernel read on macOS, `/proc` on Linux, CIM on
+  Windows, and the one spawn when a self-check fails (90ba3b431). A caller that branches on `process.platform` to
+  spawn `ps` is the defect this migration removed.
+- **Skip what you cannot read.** Every Mac has rows the kernel will not describe: `kernel_task`, a binary that an
+  upgrade deleted, root's `login` on a terminal (its command line is withheld). Two migrated sites turned ONE such
+  row into "unknown" for the whole answer: the retired-bundle prune never ran (b0e9238ae), and the cmux agent check
+  always said "running" (877454d42). No test caught either; the judge pass did. Say "skip what you cannot read" in
+  every migration brief.
+- **A failed read is not proof that a process is gone.** The readers answer null on EACCES, a failed `sysctl` or a
+  `ps` timeout too. Before null frees anything (a worktree lock, a pidfile), ask `isProcessAlive` (only ESRCH means
+  gone; a recycled pid reads as alive, which keeps the lock): e4b96508d, then 4d8e6b1f5. The plugin cannot import
+  `@genesiscz`, so it keeps a byte-identical copy in `plugins/genesis-tools/lib/process-alive.ts`;
+  `scripts/ci/pid-safety-guard.sh` allows the signal-0 probe only in files of that name, and it greps comments too.
+- **Costs the move added at first, each found by measuring:** `devname()` per row (0.5 ms a call, 52 ms for 104 rows)
+  became a per-device cache plus one `/dev` scan (1.1 ms for 143 devices); `childPids` read the whole table (10 to 21
+  ms) until `proc_listchildpids` (1.1 ms); a terminal's processes came from the whole table until
+  `sysctl(KERN_PROC_TTY)` (2.6 ms cold) (217e4857c). Other users' rows cost one `ps -A -o pid=,rss=,time=` (about 25
+  ms) instead of a command column (about 55 ms) (4750efac4), and one `ps` instead of one per 60 pids (f8ee72cb4).
+- **Test fixtures must answer through `processFixture`.** The layer reads listeners and tables from
+  `exec.processReader`, never from a raw `exec` answer, so a test that fakes `netstat` output through plain `exec`
+  reads the real machine and finds nothing (b4f698373, a Windows case from #519).
+- **A spawn count is a per-platform claim.** "Looking up pid 1 spawns `ps` twice" is true on macOS only (launchd is
+  root's, so its argv needs the setuid `ps`); Linux reads `/proc/1/cmdline` and spawns nothing. Keep such a control
+  in its own `test.skipIf(process.platform !== "darwin")` (fd0486ee0).
+- **Two reads of a live table race.** A process the suite started or ended between the table read and a filtered
+  read failed a comparison once in a full-suite run (18,719 tests), then passed 5 of 5 alone. Compare up to three
+  fresh pairs; a real disagreement repeats in all three (9d0d0f824).
+
+## 3d. Proving a moved call site works as before (2026-10-15 00:53)
+
+The #516 verification compared every site's CALLER decision, old tree against new, on real processes, on macOS and
+in the Linux CI image. Raw output equality hid real regressions and showed false ones, so judge the decision (the name
+shown, the pids acted on, the kill check, the label, the CPU). It found 13 regressions after the tests passed. The
+facts it measured:
+
+- **`ps -o comm=` on macOS is argv[0]**, not the executable path: 934 of 934 of this user's processes. The resolved path
+  (`proc_pidpath`) names a hard-linked launcher (`gt-hub`) `bun`, which broke the dev dashboard's kill check (the
+  listed name must be in the command line) and every label rule written against bare names.
+- **`ps -o %cpu=` on macOS is recent usage**: the sum of each non-idle thread's `pth_cpu_usage`
+  (`PROC_PIDLISTTHREADS` then `PROC_PIDTHREADINFO`), 931 of 931 equal, about 6 ms of CPU for all of this user's
+  processes. CPU time over the process's life is a different number (a cmux at 1.8% read 6.2%); Linux `ps` does print
+  the lifetime figure.
+- **Other users on macOS:** only root reads another user's argv (`sysctl_procargsx` returns EINVAL), so only the setuid
+  `ps` prints their `comm=`. `comm=` makes `ps -A` read every process's arguments (48 ms against 24), but `ps` drops
+  unselected users before it reads any: `ps -u <other users> -o pid=,rss=,time=,comm=` costs 16.5 ms for their 322
+  processes, less than `-A` without names (85e6b257d). Select by `-u` (effective user, as the kernel table's `uid`);
+  `-U` (real user) misses setuid processes such as `login`. A uid with no login name fails the whole call: fall back
+  to `-A`. Never `ps -p a,b`: any list of 2 to 60 pids cost about 75 ms, one pid 1 ms. Without root, the executable
+  path matches `ps comm` for 92% of other users' processes; no path rule recovers a custom argv[0] (Core Audio
+  driver hosts) or tells `login` from `/usr/bin/login`.
+- **Linux:** `ps -o comm=` is the 15-byte kernel name. Use the executable's file name only when the name is at that
+  limit: `python3` started through a `python3.13` symlink is `python3` to `ps`. `/proc/<pid>/exe` appends
+  ` (deleted)` after an upgrade; `ps` never shows it. `os.userInfo().username` is `$USER` in Bun (`unknown` without it).
+- **Open files on Linux** come from `/proc/<pid>/{fd,cwd,root,exe,maps}`, matched by device and inode as `lsof` does;
+  by path, a hard link to the file is missed (the unsafe direction for a delete).
+- **A `ps lstart` string read in a shell** follows the locale and `TZ`; pin that shell to `LC_ALL=C TZ=UTC` and format
+  in UTC. `Intl` throws on a POSIX `TZ`.
+- **Measure old against new in the same minute, alternating,** with the logger built first: `tools` builds it in
+  `setBaseBinding` (14.6 ms) before any action, so a bare benchmark child charges it to the first module that logs.
+
 ## 4. `defineNativeLibrary`: our own C, compiled once
 
 ```ts
diff --git a/.claude/skills/performance/references/measuring.md b/.claude/skills/performance/references/measuring.md
index 852f56d46d..c5514aab01 100644
--- a/.claude/skills/performance/references/measuring.md
+++ b/.claude/skills/performance/references/measuring.md
@@ -1,7 +1,7 @@
 # Measuring: benchmarks and A/B
 
 Contents: 1. what to measure · 2. the harness · 3. a benchmark pair · 4. A/B against an older commit ·
-5. ordering · 6. controls · 7. reporting.
+5. ordering · 6. controls · 7. reporting · 8. shell traps · 9. stand-in arms.
 
 ## 1. What to measure
 
@@ -98,3 +98,12 @@ BAABBA blocks of 4, load 37, 630 rows in both arms, 747458e06 → 2082e48f9." Th
   of git's usage message. Look at the output once before you count it.
 - **Count the real input.** A vault "with 25 changes" (`git status`, folded) was 3,416 entries with `-uall`, which
   is what the code under test reads.
+
+## 9. A stand-in arm must load what the real arm loads (2026-10-14 22:43)
+
+The call-site benchmark (`scripts/benchmarks/process/call-sites-bench.ts`) first measured ten sites unfairly. Their
+"before" was a stand-in that ran the spawn alone, while the "after" called the real function, which also imported
+the site's module (about 20 ms, the same before and after). The fix: the cold run starts with the site's module
+already loaded, and the baseline was recorded again at the old commit with that child (a6e2c3a7b). The total "before"
+fell from 4,693 to 3,446 ms of CPU, so the first comparison had charged the migration for module loads. When one
+arm is a stand-in, give it every import the real arm pays, or preload them in both.
diff --git a/.claude/skills/performance/references/profiling.md b/.claude/skills/performance/references/profiling.md
index d81092d641..84a01c2586 100644
--- a/.claude/skills/performance/references/profiling.md
+++ b/.claude/skills/performance/references/profiling.md
@@ -77,6 +77,13 @@ busy. Bun's own frames have no symbols (they show as `???` in the Bun binary); `
 those per library. On 2026-10-12 this showed 44% of a fresh session list's busy samples in `__openat_nocancel` on
 "Bun Pool" threads: async file opens, invisible to the JS profile.
 
+The same tool reads a native app's stall. A stack that sits in someone else's request is a cost the app pays for a
+caller it does not control: on 2026-10-15 the Genesis Markdown viewer, with 100 tabs open (about 880 accessibility
+elements), held its main thread 785 ms inside `NSHostingView.accessibilityHitTest`, answering an outside
+accessibility client's `CopyElementAtPosition` (HangWatch stack, `~/.genesis/logs/hangs/stack-md-2026-10-15-000841.txt`).
+Every window manager, screen reader and `tools control see` pays that per query, so the number of views on screen is a
+performance budget, not only a layout one. Count a window's elements before blaming a click handler.
+
 ## 5. The repository profiler (production phases)
 
 `import { profiler } from "@genesiscz/utils/profile"`, one `const prof = profiler.scope("<scope>")` per module,
diff --git a/.claude/skills/performance/references/tests-and-ci.md b/.claude/skills/performance/references/tests-and-ci.md
new file mode 100644
index 0000000000..edd3d9c97f
--- /dev/null
+++ b/.claude/skills/performance/references/tests-and-ci.md
@@ -0,0 +1,93 @@
+# Tests and CI: executables in tests, a Linux check, and reading a run
+
+Contents: 1. tests that start an executable · 2. checking Linux without CI · 3. a green run is not a passing
+suite · 4. the Linux worker hang.
+
+Written 2026-10-14 22:43, from the #516 work (process layer) and the master fixes after it.
+
+## 1. Tests that start an executable
+
+- On 2026-10-14 the Mac froze at 20:06 (WindowServer watchdog) after syspolicyd crashed five times on executables
+  that tests had just made and then renamed or deleted: a copy of bun per run, and fake tools inside the per-run temp
+  root that is removed after every green run. Analysis: `<notes vault>/GenesisTools/2026-10-14-MacFreeze-Syspolicyd.md`.
+  The swift skill holds the syspolicyd side.
+- **Rule: a test that executes a file gets it from `persistentFixture(name, key, create)`**
+  (`src/utils/test/persistent-fixture.ts`, 7ed611df5). The file is made once per key in `<real temp>/gt-test-fixtures/`,
+  next to the per-run root and outside its cleanup, and nothing renames or deletes it. The key is the content: the
+  source's path, size and mtime for a binary copy, the body for a script. Concurrent runs hard-link a draft into
+  place, so the loser of a race uses the winner's file instead of overwriting one that may be running.
+- A fake tool inside a run folder is a symlink to the persistent script; removing the folder removes only the link.
+- A test whose whole point is a move ("a moved executable keeps its inode") runs on macOS only with `RUN_LIVE=1`.
+  Linux has no syspolicyd and runs it every time.
+- On macOS the real temp folder is the per-user `/var/folders/.../T`, not `/tmp`. When macOS cleans it, the next run
+  makes each fixture once again; a run never makes one per run. Check `find "$TMPDIR/gt-test-fixtures" -type f` to
+  see which fixtures exist (2026-10-14 22:49: three files, all from one run at 21:27, reused since).
+- Proof that it reuses: both changed test files run twice in the Linux container (section 2), 70 pass in each round,
+  and round 2 listed the same three fixture inodes as round 1.
+
+## 2. Checking Linux without CI
+
+CI runs the suite on ubuntu only, and every push buys a paid bot review. A Linux-only failure (a macOS-only binary in
+an argv, a spawn count, a `/proc` read) is cheaper to reproduce in a container first.
+
+- Image `gt-ci-linux:git255` in OrbStack (start it with `orb start` after a reboot): `oven/bun:1.4.2`, git 2.55 built
+  from source, ripgrep, procps, lsof, psmisc, user `bun`.
+- Git: mount the main repo's `.git` read-only at `/src.git`. In the container, `git init` an empty repo, write
+  `/src.git/objects` into `.git/objects/info/alternates`, then `git checkout <sha>`. Any commit in the host object
+  store checks out, with no branch needed. Only committed work is visible, so commit (a temporary commit is fine).
+- Dependencies: `bun install --frozen-lockfile` inside the container, with a named cache volume so it takes about a
+  minute. Give parallel containers different volumes.
+- **The container is not CI.** The full suite at master cc39e1171 failed 52 tests there (the personal-data probe tests,
+  CDP browser launches, tmux sessions and more) that CI's run of the same commit does not fail. So a full-suite run in
+  the container proves nothing alone: run the base SHA in the same container and compare the sorted `(fail)` lists.
+  The daemon fix c977a1b00 had 51: the base's 52 minus "run log meta", and nothing new (2026-10-14 22:52).
+- Run the old SHA and the fixed SHA with the same test file: the old one must fail and the fixed one pass.
+  Measured 2026-10-14: `src/utils/process-identity.test.ts` 1 fail at 9d0d0f824, 0 at fd0486ee0;
+  `src/daemon/lib/runner.test.ts` 1 fail at cc39e1171 (ENOENT on `/usr/sbin/taskpolicy`), 0 at 21670ffff.
+
+```bash
+# run-pairs.sh, mounted at /run.sh: for each <sha>:<test file>, check out, install, run
+for pair in "$@"; do
+    sha=${pair%%:*}; file=${pair#*:}; dir=/home/bun/repo-$sha
+    git init -q "$dir" && cd "$dir" || exit 2
+    echo /src.git/objects > .git/objects/info/alternates
+    git checkout -q "$sha" || continue
+    bun install --frozen-lockfile > "/out/install-$sha.log" 2>&1
+    bun scripts/test.ts "$file" > "/out/test-$sha.log" 2>&1
+    echo "$sha $file test exit $?" >> /out/summary.txt
+done
+```
+
+```bash
+docker run -d --rm --name gt-linux-check --cpuset-cpus 0-3 --memory 6g \
+  -v <main checkout>/.git:/src.git:ro \
+  -v <scratch>/run-pairs.sh:/run.sh:ro \
+  -v <scratch>/out:/out \
+  -v gt-bun-cache-c:/home/bun/.bun/install/cache \
+  gt-ci-linux:git255 bash /run.sh <old sha>:<test file> <new sha>:<test file>
+docker wait gt-linux-check; cat <scratch>/out/summary.txt
+```
+
+## 3. A green run is not a passing suite
+
+- The test step is `continue-on-error: true`, so a failing test does not fail the job. Only two steps make it red: a
+  missing `[test] suite complete` line (a hang or a timeout) and the per-file runtime ceiling
+  (`scripts/ci/test-runtime-guard.ts`, about 6% of the summed file time: 25 s, 33 s and 34 s on three runs).
+- Read the failures from the log, never from the check's colour:
+  `gh run view <id> --log > run.log`, then `rg -o "\(fail\) .{0,100}" run.log | sort -u`. The step that made a job
+  red: `gh run view <id> --json jobs --jq '.jobs[].steps[] | select(.conclusion=="failure") | .name'`.
+- Measured 2026-10-14: master's run at 171e40678 was green while two tests failed on every run: a missing
+  `./storage/atomic-file` export in `src/utils/package.json` (fixed on master in cc39e1171) and the daemon's
+  `/usr/sbin/taskpolicy` argv on Linux (fixed in 21670ffff, branch `fix/2026-10-14-daemon-taskpolicy-linux`).
+
+## 4. The Linux worker hang
+
+- Signature: 20 to 40 s timeouts in unrelated files, starting right after `killed 1 dangling process`, a different set
+  of files on each run, and the job red from the per-file ceiling. Measured 2026-10-14: master at db889dd20 timed out
+  five `notify.test.ts` tests; master at cc39e1171 timed out tests in five other files; the re-run of that same
+  commit had no timeout at all. A set of timed-out files that changes with no related code change is the hang, not a
+  defect in those files.
+- bun prints `killed N dangling process` at a LATER file, so the log blames the wrong one. The repository variable
+  `TEST_WORKER_LOG=1` (set 2026-10-14 19:34) makes every CI run write the worker log and put its report
+  (`bun scripts/test-worker-log.ts`) into the job summary: the report names the file that left the process.
+- `gh run rerun <id> --failed` gets a second sample without a push, so it costs no paid review.
diff --git a/.claude/skills/swift/SKILL.md b/.claude/skills/swift/SKILL.md
index 97e2dc67b6..d0f6c04c1f 100644
--- a/.claude/skills/swift/SKILL.md
+++ b/.claude/skills/swift/SKILL.md
@@ -64,6 +64,13 @@ For the exact window-only recording and contact-sheet recipe, use
 [recording-animations.md](references/recording-animations.md). It keeps actions inside the capture
 interval and distinguishes window isolation, Retina detail, callback timing and video sampling.
 
+## Camera, Vision and screen overlays
+
+For camera frames, Vision pose cost, overlay panels the WindowServer has to composite, panels kept out of
+screen captures, and dragging a panel by its body, read [camera-and-vision.md](references/camera-and-vision.md).
+Window moves your own code makes, and tests that touch the system (defaults suites, executables they create), are
+in [gotchas.md](references/gotchas.md).
+
 ## Measuring
 
 Instruments, what each answers and the traps in reading them: [references/measuring.md](references/measuring.md).
diff --git a/.claude/skills/swift/references/camera-and-vision.md b/.claude/skills/swift/references/camera-and-vision.md
new file mode 100644
index 0000000000..8cb9b83faf
--- /dev/null
+++ b/.claude/skills/swift/references/camera-and-vision.md
@@ -0,0 +1,39 @@
+# Camera, Vision and on-screen effects (PostureWatcher, 2026-10-14)
+
+Lessons from making GenesisKit's camera, pose and screen-effect pieces cheap and correct on a real Mac with three
+displays. Each line has the number that proved it and the commit.
+
+## Camera frames
+- Ask the video output for the size you analyse. The Studio Display camera has no 640 x 480 preset and delivered
+  1920 x 1080, so every Vision request ran on 6.75 times the pixels: PostureWatcher took 22% of a core against a 3%
+  budget. The output now asks for the active format scaled to 640 px on its longest side, keeping the aspect ratio
+  (1d1c60be0). Check the delivered size in a saved frame, not the preset you asked for.
+- Analyse only as often as the decision needs. Balanced watches a slouch at 4 frames a second instead of 10; the
+  confirm delay still sees the recovery in time, and Responsive keeps 10 (313121c48).
+- A wrong baseline costs CPU too: a calibration taken while the pose engine found no shoulders kept the state at
+  "slouching" for hours, so the effect stayed up and Genesis sat near 20% of a core. Name the fix in the UI ("Shoulders
+  not found", "Recalibrate to use shoulders", GenesisPlayground 9f6431a8, 8b00ff69) instead of tuning thresholds.
+
+## Vision pose results
+- A cached result is not a sighting. Merging the last 3D shoulders into throttled frames kept `hasPerson` true after
+  the user left, and with no nose the scorer read a full head drop instead of "away". Cached joints count only on a
+  frame with a confident 2D joint or face of its own (afbf2ebd6, test `testCachedShouldersDoNotKeepAPersonWhoLeft`).
+- 2D body pose misses shoulders often (close to the camera, loose clothes); test with real frames. Genesis saves the
+  exact analysed frames plus the pose sample with `genesis://posture/capture?label=<name>` (GenesisPlayground
+  a057c1ee). Frames of the user's face stay out of git: they live in `src/macos/GenesisKit/Tests/PostureShots/`, which
+  only the local `.git/info/exclude` hides, so stage exact paths.
+
+## Screen-effect panels
+- A clear window still costs WindowServer a blend of everything under it. Transparent drew only a message pill but put
+  a clear panel over every display (2560 x 1440, 3440 x 1440, 2056 x 1329): WindowServer measured 104% with the
+  effect running against 74.5% paused; with a 720 x 96 panel at the pill's place, 92.5% against 75.5% (one-off
+  readings on a busy machine; the baseline alone moved between 64% and 83%) (f3dd3ff79). Size an overlay window to
+  what it draws.
+- Effect panels use `sharingType = .none`, so screenshots and window captures never show them. Verify placement with
+  window bounds from `CGWindowListCopyWindowInfo`.
+- A draggable overlay moves in its own `mouseDragged`, from each event's location, and saves on mouse-up.
+  `performDrag(with:)` moved the panel only on the first drag of a show, and a standalone repro missed its targets
+  (381, 81, 381 for 500, 200, 500) (5a700ebd1, 941db1c37). The ux skill's ledger has the full story.
+- A unit test that gives a controller a `UserDefaults(suiteName:)` writes a real plist into ~/Library/Preferences.
+  Remove the domain in a teardown block (`removePersistentDomain`); macOS still leaves an empty 42-byte file
+  (9a11d77bd).
diff --git a/.claude/skills/swift/references/genesistools.md b/.claude/skills/swift/references/genesistools.md
index 171f5d1b64..330fe57b3b 100644
--- a/.claude/skills/swift/references/genesistools.md
+++ b/.claude/skills/swift/references/genesistools.md
@@ -70,6 +70,13 @@ GenesisTools checkout.
   `WKWebView.takeSnapshot`. Two apps run the viewer: GenesisTools (`--markdown`, relaunch with `open -g -n
   ~/Applications/GenesisTools.app --args --markdown <file> --no-focus` after `bun run app`) and Genesis Markdown.app
   (`GENESIS_KIT_PATH=<GenesisTools>/src/macos/GenesisKit bun scripts/install.ts` in GenesisPlayground; it relaunches
-  the viewer only if it was open).
+  the viewer only if it was open). ⚠️ It stops the viewer with `pkill` (SIGTERM, no save prompt), and Genesis.app
+  with it: unsaved drafts in the viewer are lost. Ask before installing while the user has the viewer open.
+- File tree bench (2026-10-14): `MARKDOWN_TREE_BENCH=<folder> [MARKDOWN_TREE_BENCH_NOTE=<note>]
+  [MARKDOWN_TREE_BENCH_SECTIONS=<n>] [MARKDOWN_TREE_BENCH_MARK=<file>] swift test --filter MarkdownTreeLagBench`:
+  24 tabs, the tree rooted at the folder, then unrelated publishes (the preview's section), tree scroll steps and tab
+  selections, each with busy time, longest pass and the bodies that ran. `MARK` appears when the publish loop starts,
+  so `sample <pid>` from the shell can attach to it.
 - Open (2026-10-13): warm spare web view and keep-until-rendered tab swap; the documents model's redundant publishes
-  on select; the repository panel's derived lists into a model.
+  on select; the repository panel's derived lists into a model. Still open 2026-10-14: every documents-model publish
+  re-runs the window, pane, toolbar, status bar, path bar and tree bodies (about 11 ms per publish with 24 tabs).
diff --git a/.claude/skills/swift/references/gotchas.md b/.claude/skills/swift/references/gotchas.md
index b89bd892af..0e8d1e0fa0 100644
--- a/.claude/skills/swift/references/gotchas.md
+++ b/.claude/skills/swift/references/gotchas.md
@@ -104,6 +104,20 @@
   belongs to a Codex session; edit there only when Martin says so, commit only your paths.
 - **placeholder-check blocks a push** on internal repo names in fixtures; replace them in a new
   commit (no history rewrite).
+- **Wait for a free Swift slot by process name, never by command line.** `until ! pgrep -f 'swift-(build|test)|xctest'`
+  waited forever on 2026-10-15: the `zsh -c` running the loop carries that pattern in its own command line, so
+  `pgrep -f` matches the waiting shell itself. `pgrep -x swift-build` is not enough either: the same day a running
+  `swift build` showed the process name `swift-package` (pid 6576), `pgrep -x swift-build` printed nothing, and a
+  worker started its build beside it. Match the executable path, which the waiting shell never has:
+  `while ps -axo comm= | grep -Eq '/(swift-build|swift-test|swift-package|swift-frontend|xctest)$'; do sleep 20; done`.
+  `swift-frontend` also catches an Xcode build of another session, which uses the same CPU.
+  Two waiters that poll the process list can still start together in the same second (two judge runs on
+  2026-10-15). Run the command through `bun .claude/skills/babysit/scripts/swift-slot.ts -- swift test …`: it takes
+  a kernel `flock` on a persistent lock inode, then waits for other sessions' Swift processes. Never unlink the
+  lock file: the kernel releases ownership when the holder closes its descriptor or exits; there is no dead-PID takeover.
+- **Display-driven tests fail while the screen is locked.** After the display sleeps or the screen locks, tests that
+  wait for a display frame (edge panels, transcript scroll) fail with no code change, and `screencapture -l` cannot
+  read a window (2026-10-15 07:05). Rerun them after the screen wakes before you call a change broken.
 
 ## Animated panel verification
 
@@ -263,3 +277,116 @@ Keep measured findings separate from hypotheses; faster CPU numbers alone do not
   offset one run-loop turn later and check it again a moment after (`MarkdownFileTreeView.applyPendingPlaceScroll`).
 - **A context menu opened by automation closes within seconds if nothing picks an item.** Run the right-click,
   `see --scope menu` and the press back-to-back (tools control #530, 2026-10-15).
+## ScreenCaptureKit recording — 2026-10-14 03:33
+
+- **replayd (ScreenCaptureKit's daemon) groups its clients by executable PATH.** When any process started from a path
+  exits, every live stream of every other process from that same path stops with -3805 (connection interrupted). It
+  fires at the second process's exit, not at its `stopCapture`, and also when that process only listed windows. Two
+  `tools control capture record` runs therefore cut each other short until each recorder re-ran from its own disk
+  clone (8648526b3 on #502, `native/ax-tool/SnapshotSupport/RecorderExecutable.swift`). A hard link to the same file
+  is not a fix: it made `stopCapture` hang. A 40-line probe without ax-tool reproduced it 7 of 7 from one path and
+  0 of 6 from a copy.
+- **`SCStreamFrameInfo.contentRect` is in points, the frame's pixel buffer is in pixels.** Using the rect as pixels
+  crops a Retina frame to its top-left quarter and scales that up 2x. Multiply by `scaleFactor` (from the same info
+  dictionary) before cropping.
+- **A sheet's window stream holds its whole parent window, shrunk to the sheet's size** (a 400x560 sheet arrived as
+  the 440x760 parent at 0.737). Painting it into the sheet's frame draws a second, smaller parent. When the parent is
+  also recorded, its own stream already shows the sheet; when the sheet is recorded alone, cut it out of the parent at
+  the sheet's frame (dd532721a).
+
+## A window's content sizes the whole tree on every update — 2026-10-14 16:35
+
+- `window.contentView = NSHostingView(rootView:)` keeps the default `sizingOptions`, so every SwiftUI update makes
+  AppKit ask the hosting view for its min, max and intrinsic size, and SwiftUI lays out every subview to answer. In the
+  markdown viewer that was 59% of the main thread's layout for one changed string, and 600 to 1200 ms stalls on a click
+  with 24 tabs. Set `sizingOptions = []` and the window's `minSize` (performance.md, third markdown pass).
+- **`String.count` walks every character.** A path loop that compares `folder.count > root.count` at each level of
+  each entry is quadratic in path length and slower still on accented names (grapheme breaking). Compare
+  `utf8.count`, cut at a `/` found in the UTF-8 view, and compute fixed lengths once (2026-10-14, git tree marks:
+  117 → 31 ms per call).
+
+## Window moves, plants that pass, and tests that touch the system — 2026-10-14 22:41
+
+- **A programmatic `setFrame(_:display:)` posts no move notification inside the call.** A flag set around the call
+  (`placing = true; setFrame…; placing = false`) to tell your own moves from the user's drag guards nothing: the
+  `didMoveNotification` of your own move can come later, when the flag is already off. Remember the frame you placed
+  and treat a move as the user's only when the window is more than a point away from it (AppKit rounds the origin to
+  whole pixels, and a centred default can sit on a half point). The draggable posture message, ba3f99f4c.
+- **A plant that passes is a finding, not a formality.** Removing that flag broke no test, and the probe behind it
+  showed the flag never worked. When a planted regression passes, find out whether the test is weak or the code is
+  dead before you move on.
+- **A test that calls a helper directly cannot catch the removal of its call site.** `trustedJoints` was tested as a
+  static function, so deleting the one line in `process` that applies it passed every test (#514, afbf2ebd6). Test
+  through the path that runs it, or say in the review that the call site is covered by reading only.
+- **SwiftUI `onChange` can miss a change the body already saw.** A tab click changed the value and re-ran the body,
+  and no `onChange` followed, so the old tab's page stayed on screen (ca64b32e0). Let the body start the work for a
+  value that is neither current nor pending instead of driving it from `onChange` alone.
+- **Never start an executable a test just made and then rename or delete it.** macOS scans every new executable in
+  `syspolicyd` after it starts; a scan that finds the file gone crashed `syspolicyd` five times in ten minutes, launchd
+  stopped restarting it, a permission check never answered, and the WindowServer watchdog froze the Mac (2026-10-14
+  20:06). Build a test program once and keep it (`src/utils/test/persistent-fixture.ts`), and check that `syspolicyd`
+  keeps its pid (`pgrep -x syspolicyd`) across the first run of such a test.
+- **A new command-line flag needs a test through the parser that runs live.** `act --allow-outside` passed 13
+  event-factory tests and failed at its first live call: ax-tool keeps a list of flags per command
+  (`WorkflowArguments.swift`), and the new flag was not on it, so it was refused as unknown before anything ran
+  (85d5d6967, fixed in 586f5b391). Add one parse test per new flag, and prove the path with a call that cannot
+  dispatch (an invalid snapshot token must be the refusal, not the flag).
+- **`UserDefaults(suiteName:)` in a test writes a real plist** in `~/Library/Preferences`. `removePersistentDomain`
+  empties it but leaves a 42-byte file. Give test suites one prefix (`genesiskit-tests-…`) and remove them in a
+  teardown block (9a11d77bd).
+
+## Dialogs: modal loops, title bar insets, cut text — 2026-10-15 00:50
+
+- **`NSAlert.runModal()` inside a `DispatchQueue.main` block stops every timer queued on the main queue.** The
+  queue is serial and busy with the block that runs the modal loop, so `DispatchQueue.main.asyncAfter` never
+  fires until the alert closes. The vault and account approval windows had a 170 s "deny by itself" deadline that
+  never ran; the caller's own 180 s timeout killed the window with no audit line, and the caller asked again. Fix:
+  a non-modal panel (GenesisKit `ApprovalPanelPresenter`) and the deadline as a cancellable `DispatchWorkItem`.
+- **`NSHostingController` in a `.fullSizeContentView` window insets its content by the hidden title bar.** The
+  first approval panel had an empty 28 pt band on top. `.ignoresSafeArea()` on the root view; the strip still
+  drags through `.titlebarZone()`. `controller.sizingOptions = [.preferredContentSize]` makes the panel follow the
+  view, so a disclosure grows and shrinks it.
+- **A `Text` in a `Grid` cut a path in the middle at one line while the window had room for two.** The grid measured
+  the row once at one line. `.fixedSize(horizontal: false, vertical: true)` with the `lineLimit` you want.
+- **Five controls in one row of a 480 pt dialog cut the default button's title** ("Allow with…") and wrapped a
+  countdown. Give a choice (a remember picker) its own row; `.fixedSize()` on the default button and the countdown.
+- **Render a dialog for review without showing it:** `NSHostingView` in a borderless `NSWindow` that is never ordered
+  front, then `cacheDisplay(in:to:)`. Unlike `ImageRenderer`, it draws AppKit-backed controls (buttons, pop-up
+  menus). `VaultUnlockTests.testRenderTheVaultWindowWhenAsked` does it behind `APPROVAL_SNAPSHOT_DIR`.
+
+## Dead clicks and accessibility cost in a big SwiftUI window — 2026-10-15 01:07
+
+- **Log presses and actions, not just presses.** To diagnose "clicks do nothing", override the window's
+  `sendEvent` and log every left down and up with the hit view, `clickCount`, key, active, modal and sheet state, and
+  log the action each control runs. A press with no action after it is a click SwiftUI dropped; a press that never
+  arrives is a window or event-routing problem (markdown viewer: f7eaab043, 5c8691e5b).
+- **One click handler per control.** A `Button` with an `.onTapGesture` on the same view, under a parent
+  `.onTapGesture(count: 2)`, gives SwiftUI three gestures to arbitrate for one click; the viewer's tabs had exactly
+  that when its clicks went dead with 100 tabs (cause not proven).
+- **Accessibility hit tests scale with the number of views.** With 100 tabs (about 880 accessibility elements), one
+  `NSHostingView.accessibilityHitTest` from an outside AX client held the main thread 785 ms (HangWatch stack,
+  2026-10-15 00:08). Every AX client (window managers, `tools control see`) pays it. Keep long strips lazy or capped.
+
+## SwiftUI rows in tests, a tree's stale listings, and far scrolls — 2026-10-15 06:35
+
+- **In-process accessibility cannot see SwiftUI list rows.** `accessibilityChildren()` walked from the list's
+  `NSScrollView` never reaches them, and an xctest process has no accessibility windows (`tools control see --app
+  <xctest pid>` answers "no AX windows"). To check which rows are on screen, render the scroll view
+  (`cacheDisplay(in:to:)`) and read it with Vision (`TreeDrawnText` in GenesisKitTests). A narrow column cuts a name
+  in the middle ("2026-10-15-…osals.sol3.md"): match its two ends.
+- **A test can show the real window for a recording without taking focus.** `orderFrontRegardless()` from xctest
+  never activates; write `window.windowNumber` to a file and run `tools control capture record --window-ids <n>`
+  (`MarkdownSidebarRevealDemoTests`). The same test on the old and the new code gives a before and after video.
+- **A file tree that caches folder listings must watch them.** Without a watcher a folder stays as its first read
+  showed it. A note another app wrote later had no row, so "Show in Sidebar" found nothing and did nothing, silently
+  (2026-10-15, note written 05:30:49, reveal 05:33:14). One FSEvents stream over the root; re-read only folders
+  already listed, off the main thread, and rebuild only when the listing changed. A reveal also re-reads a folder
+  whose listing lacks the file.
+- **An animated `scrollTo` to a far row of a `LazyVStack` does not glide.** Recorded at 15 fps: it lands on an
+  estimate, waits about half a second, then jumps to the row. `NSClipView.animator().setBoundsOrigin` on a SwiftUI
+  `ScrollView` did not animate at all, and a position computed from the row index overshot. What works: scroll
+  without animation so the row sits at the nearer edge (`Transaction.disablesAnimations`), wait a moment for the
+  list to lay it out, then animate the last stretch to the centre.
+- **Driving a background app's context menu with `tools control` is not safe yet.** `AXShowMenu` on a SwiftUI tab
+  blocked 2 s and opened the parent's menu first; the menu rows were not in `see --scope menu`; a coordinate click
+  into the open menu closed it without choosing. Trigger the code path from a test instead.
diff --git a/.claude/skills/swift/references/performance.md b/.claude/skills/swift/references/performance.md
index da3172a79e..19c2658d01 100644
--- a/.claude/skills/swift/references/performance.md
+++ b/.claude/skills/swift/references/performance.md
@@ -332,3 +332,88 @@ events, ms of CPU per event, two interleaved rounds each:
   avoid height changes after appear); a Stack Overflow answer (72070486) explains that a table asking each row for its
   height re-runs row bodies, so give rows a fixed height. Public case studies (kean.blog, troz.net) moved big lists to
   AppKit tables but published no per-row numbers.
+## Third pass on the markdown viewer: the file tree "laggy" (2026-10-14 16:35)
+
+Bench: `MarkdownTreeLagBenchTests` (genesistools.md), 24 tabs, the vault folder of the report, a hosted 1900×1150
+window, load average 15 to 25. Stall reports from the real app showed 509 to 1268 ms on the main thread, all layout.
+
+### A window root's hosting view must not size itself
+- An `NSHostingView` with the default `sizingOptions` derives the window's min, max and intrinsic size from SwiftUI.
+  On every update it sizes the WHOLE tree again (`NSHostingView.invalidateSizeConstraintsIfNecessary` →
+  `minSize()` → `ViewGraph.sizeThatFits`): 1258 of 2133 layout samples for an update that changed one string. Set
+  `sizingOptions = []` on a window's content and give the window an explicit `minSize` (the hub found the same in
+  2026-09, `HubGlass`). **Measured:** 20 unrelated publishes 1104 to 1187 ms busy → 232 ms; the longest pass of a tab
+  switch 621 to 827 ms → 112 to 156 ms.
+- A frame-owned panel already did this; a plain `window.contentView = NSHostingView(rootView:)` is the trap. Build the
+  content through one factory so tests host the same view the window does (`contentView(model:)`).
+- The sizing it drops is real: the content held the window at 603 pt, 743 with three sidebars open. Measure that
+  minimum per state with the standard sizing once, state it as a formula (`MarkdownWindowMinimum`), set
+  `contentMinSize` when its inputs change and grow a narrower window, and test the formula against the measurement.
+
+### A row list inside a view that observes a big model
+- A tree view that observes a 30-property model walks its `ForEach` on every publish. `.equatable()` on each row skips
+  the row's body, but the list still builds every visible row value. Move the list into an `Equatable` child that
+  takes values (rows, selection, style, pulse, git marks) and compare those. **Measured (60 publishes):** 1214 ms →
+  654 to 816 ms busy.
+- Tabs the same: each tab observed the model, so one publish ran all 24 tab bodies (480 for 20 publishes). A tab now
+  gets `active`, `preview` and its fill as values and observes only its document: 0 tab bodies for an unrelated
+  publish, and only the changed tabs on a selection.
+
+### Derived git marks off the main thread
+- The file tree's marks (`GitTreeDecorationsModel.update`) were built from the whole repository status on the main
+  thread, twice per refresh, plus two dictionary comparisons: 24% of the main thread in the tab-switch bench on a vault
+  with 1,825 status entries, at every start, git change and move of the tree's root. Build and compare them on a
+  utility queue and publish the result with a ticket. The folder walks also asked `String.count` per level of every
+  entry; cutting at the last "/" in UTF-8 made one call 2.6 to 8.5 times faster (117 → 31 ms, debug), parity equal
+  on three roots of the real vault.
+
+### Count row construction, not only bodies
+- A body probe (`tree.row`) cannot see a list that rebuilds its rows and then skips every body. A probe in the row's
+  `init` (`tree.rowItem`) counts it, and it exists in the old code too, so a regression test can fail on the old
+  version (`MarkdownWindowPublishCostTests`: 9 rows built and 9 tab bodies for 3 publishes before, 0 after).
+
+## Fourth pass on the markdown viewer: bridged paths, N² tabs, web views on the click (2026-10-15 06:32)
+
+Evidence: 38 stalls over 500 ms in one night (`~/.genesis/logs/hangs/stack-md-*.txt`). Each holds ONE sample taken as
+the stall ended, so it names the pass (layout, a web view init, `setFrame`) and not its cause. The causes came from
+the bench (`MarkdownTreeLagBenchTests`, now with `MARKDOWN_TREE_BENCH_TABS`, `MARKDOWN_TREE_BENCH_WRAP` and a
+select-phase mark file for `sample`).
+
+### Bridged strings in a model
+- `URL.path`, `lastPathComponent` and Foundation listings return NSString-backed Strings when the path holds a
+  non-ASCII letter ("Č"). `==`, hashing and searching walk them through CoreFoundation a character at a time
+  (`_CFStringCheckAndGetCharacterAtIndex`, `_foreignIndex` in the stalls). Make a path native once where it enters a
+  model (`String.nativeUTF8`, `makeContiguousUTF8()`). 636 vault paths: find one 0.42 → 0.02 ms, Set 1.42 → 0.36 ms.
+- A computed `id { url.path }` builds that bridged string on every read; store it in `init`.
+- `model.selected` (a search by id) asked once per tab made a tab bar pass N². Read it once per body.
+- **Measured** (100 tabs, Wrap Tabs, debug, two interleaved rounds): 20 unrelated publishes 869 / 859 → 350 / 285 ms
+  busy; 10 tab switches 1788 / 2420 → 1500 / 1259 ms.
+
+### A web view per click
+- The spare page is consumed by the first new pane and refilled 1.5 s later, so a burst of opened tabs built one
+  `WKWebView` per pane on the main thread (580 to 1799 ms each). A page leaving the window now becomes the spare
+  (`MarkdownWebSpare.recycle` from `dismantleNSView`). Reset what a pane sets only when it has one (marks, line
+  highlight, column width); the render-tag check compares equality, so the old tag cannot confirm a new render.
+
+### A value the reader changes while scrolling
+- The page reports the heading on screen as the reader scrolls. As a `@Published` of the window-wide model, each
+  report re-ran every body that observes the model (nine views). Give such a value its own `ObservableObject`, observed
+  only by the view that shows it, and keep a forwarding property so the writers do not change (`MarkdownSectionSpy`).
+- A body that parses the whole document (the outline) runs on every publish of a model it observes. Cache the result
+  per text (`MarkdownOutlineCache`); comparing a string with the one it came from is cheap.
+- **Measured** (100 tabs, outline open, a 164 KB note, debug, two rounds): 20 heading changes 1685 / 928 → 293 / 301
+  ms busy, the longest pass 490 / 47 → 10 / 12 ms; tab switches 2372 / 1917 → 1176 / 1160 ms.
+
+### A SwiftUI animation costs the whole graph it lives in
+- Each frame of a SwiftUI animation re-renders the hosting view's graph, not just the view that moves. The viewer's
+  0.14 s opacity fade of the old page (`GenRenderSwap`) re-rendered the whole window each frame: about 130 ms of main
+  thread per tab switch, more than the switch itself.
+- For a fade over a big window, let Core Animation draw it: change the content at once and add a `CATransition`
+  (`.fade`) to the hosting view's layer in the same transaction (`GenRenderSwap(fade: .layer)`). Core Animation files
+  a transition under `kCATransition` whatever key it is given.
+- Measure at the user's pace: switches 0.1 s apart overlap their fades and hide the cost. **Measured** (100 tabs,
+  10 switches 0.5 s apart, debug, busy ms): SwiftUI fade 2238 / 2208, no fade 938 / 901, Core Animation fade 925 / 925.
+
+### Check the build configuration first
+- The installed app at 04:01 was a DEBUG build (`start:debug`; same size as the worktree's debug product, no release
+  product there). Before profiling a user's lag, compare the installed binary with the build products.
diff --git a/.claude/skills/ux/references/checklist.md b/.claude/skills/ux/references/checklist.md
index 7cdc9dd3d9..28a2f092a6 100644
--- a/.claude/skills/ux/references/checklist.md
+++ b/.claude/skills/ux/references/checklist.md
@@ -16,6 +16,18 @@ Walk it for every view you change. Each line exists because it was missed at lea
 - Items that can be acted on can be acted on in place: tick a task, expand an answer, create a new one.
   Opening another window is the exception, not the default.
 
+## Windows and overlays (Martin, 2026-10-14)
+- No `isMovableByWindowBackground` on a window with SwiftUI content: the hosting view counts as background
+  everywhere, so a held press on any control turns into a window drag and can leave SwiftUI waiting for a mouse-up.
+  Drag regions are explicit: `.titlebarZone()` or a dedicated AppKit drag view.
+- A custom AppKit view that can become first responder (a divider, a splitter) does so only with keyboard navigation
+  on, and never draws the default focus ring over content.
+- Anything that appears over the user's work by itself (a nag, a HUD, a pill) has a setting to turn it off and can be
+  dragged away; it keeps its place per display and comes back fully on screen.
+- A movable overlay tracks the drag in its own `mouseDragged` from each event's location and saves on mouse-up;
+  `performDrag(with:)` moved a panel only on the first drag of a show.
+- ⌘W closes the current tab; on a window with no tabs left it closes the window.
+
 ## Layout
 - Equal, intentional insets on all four sides; controls aligned in one column; descriptions under titles.
 - Panels size to their content up to a maximum; no large empty band above a composer. When something opens inside
diff --git a/.claude/skills/ux/references/findings.md b/.claude/skills/ux/references/findings.md
index ac2d6f6ac6..54640d8af8 100644
--- a/.claude/skills/ux/references/findings.md
+++ b/.claude/skills/ux/references/findings.md
@@ -3,6 +3,66 @@
 Newest first. Each entry: date, symptom as the user saw it, cause, fix, commit. Generic lessons go to
 checklist.md or motion.md as well.
 
+- 2026-10-15 00:50 — **The vault approval window (GenesisTools.app `vault.unlock`).**
+  - *"This can be probably nicer": one block of text with full paths, the raw command, two UUIDs and five buttons
+    in a row.* It was an `NSAlert`. Now a SwiftUI panel (GenesisKit Permissions/ApprovalDialog.swift): the reason
+    first, four facts (session by its name, program from its project folder, folder, secret), the rest under
+    Details, a remember choice, Deny and "Allow with Touch ID".
+  - *The same window came back every three minutes.* The modal loop held the main queue, so the deadline never fired
+    (see the swift gotchas), and a refusal was not final for the calling process. Both fixed; the account gate
+    window had the same loop and moved to the same panel.
+  - *"It wanted Touch ID and then the password two times, always."* The app read a keychain item another binary
+    (bun) created. The app now keeps its own copy, stamped with the source item's modification date.
+  - *The first SwiftUI version cut "Allow with Touch ID", wrapped the countdown, left an empty band on top and cut
+    the script path.* See the swift gotchas, "Dialogs".
+  - *A remembered approval was too broad.* `bun run <script>` was read as no script, so "always" covered every
+    `bun run`; a relative script matched from any folder. The program is now the absolute script.
+  - Unified d48b6131b, 12bf77b14, 64b3a6186. Shots: GenesisTools.native/Approvals/Screenshot/.
+
+- 2026-10-15 01:07 — **The markdown viewer's dead clicks came back with 100 tabs open (cause not proven yet).**
+  - *After an agent session opened many notes, Martin's tab clicks did nothing.* The window-background drag of
+    a1e436652 was already off. The press log showed every tab press arriving at the hosting view, key and active, no
+    modal, no sheet, CPU 9.7%, no hang logged then. So the presses arrived and SwiftUI did not act on them.
+  - *Suspects, unproven:* three click layers on one tab (the tab's `Button`, an `.onTapGesture` on the tab, and an
+    `.onTapGesture(count: 2)` on the whole tab bar), and a 2.5 s press-and-drag in the web view just before.
+  - *The log could not tell a dropped click from a slow one*, so it now also writes `tab action select <title>
+    via=button|tap`, `tab action close` and `tab bar double click` (5c8691e5b). A press with no action line after it
+    is a click SwiftUI dropped. Read: `log show --predicate 'subsystem == "genesiskit" && category == "markdown.input"'`.
+  - *With 100 tabs one accessibility hit test froze the main thread for 785 ms* (swift skill gotchas).
+  - *A background click is no test here:* `tools control --background` on the inactive viewer arrived with key and
+    active false, and macOS may spend that first click on activation. Without the user's focus, read the app's own log.
+
+- 2026-10-14 22:43 — **Markdown viewer dead clicks, PostureWatcher's message, and the agent's own live-test mistakes.**
+  - *Holding a tab moved the window a little; from then on no click in the viewer did anything (tabs, toolbar)
+    until a restart, while accessibility presses still worked.* The window had `isMovableByWindowBackground = true`.
+    An `NSHostingView` answers `mouseDownCanMoveWindow` for its whole area, so AppKit cannot tell a tab from
+    background: the held press became a window drag, the drag took the mouse-up, and SwiftUI kept waiting for it.
+    Reproduced only with a real press-and-drag (the window moved 16 x 8 pt, then a toolbar click and a tab click did
+    nothing). A diagnostic click log (f7eaab043, category `markdown.input`) showed every press reaching the hosting
+    view, key and active, no modal, no sheet. Fix: background dragging off; the title strip still drags through
+    `TitlebarZoneView` (a1e436652).
+  - *A blue, full-height 6 pt bar at the file sidebar's edge.* The divider became first responder while keyboard
+    navigation (`AppleKeyboardUIMode`) was off and drew its focus ring. It takes focus only with keyboard navigation
+    on (c9c23b851).
+  - *⌘W did nothing while File › Close Tab worked.* `performKeyEquivalent` now handles ⌘W by key code (208c968c5);
+    closing the last tab keeps the window for a new note, a second ⌘W closes it (6341a5e62).
+  - *A tab click showed the previous tab's page.* `GenRenderSwap`'s `.onChange` sometimes did not fire on a real
+    click; the body catches a missed switch (ca64b32e0, 0bfba27ca).
+  - *PostureWatcher's "Sit up straight" sat in front of the work with no way to move it* ("maybe it can be movable
+    like the camera window"). It is draggable with Transparent, one place per display (e3d832ff6). The first version
+    handed the press to the window server (`performDrag(with:)`): live, only the first drag of each show moved it.
+    A standalone non-activating panel with three scripted drags to x = 500, 200, 500 ended at 381, 81, 381 with
+    `performDrag` and exactly on target with the view's own `mouseDragged` tracking (5a700ebd1). The drag reads each
+    event's location, not `NSEvent.mouseLocation`, so a drag delivered in the background moves it too (941db1c37).
+  - *Every screenshot of that message came out empty.* The effect panels use `sharingType = .none`, so
+    `screencapture -R` showed the windows behind and a window capture came out white. Proof of placement is the
+    window's bounds (`CGWindowListCopyWindowInfo`) and the saved value, not a picture.
+  - *The agent's live tests disturbed the user* (rules now in live-testing.md): an own CGEvent poster took Martin's
+    pointer for about a second per drag, and one drag that started on empty screen landed in the windows behind the
+    target (ChatGPT, Brave); `lldb` attached to the running viewer plus a polling loop without a sleep froze the Mac
+    (18:33); a ⌘W sent through System Events may have reached another front app; the viewer instance that later went
+    dead held 11 extra off-screen 30-39 px windows, probably menus left open by System Events menu reads (unproven).
+
 - 2026-10-13 18:18 — **Second pass on Martin's 15-item review, the transcript, the PRs view.**
   - *"X new" scrolled down but not to the bottom.* The pill's own click counted as the reader's, so rows that
     measured during the glide were not followed. The pill now chases the end for 2 s (eae978b26).
@@ -98,3 +158,8 @@ checklist.md or motion.md as well.
 - 2026-10-15 — **A create menu must say where the item lands.** "New file or folder in Design or …" left the target
   unclear. One possible folder: "New File in Notes…". Two (the open note's folder and the root): "New File in…"
   and "New Folder in…" submenus that list both by name.
+- 2026-10-15 — **"Show in Sidebar" did nothing on a note another session had just written.** The file tree never
+  re-read a folder after its first listing, so the new note had no row and the reveal had nothing to scroll to; the
+  user saw no feedback at all. Fix: the tree watches its root (FSEvents) and a reveal re-reads a folder that lacks the
+  file; the reveal jumps a far row to the nearer edge, glides the last stretch and pulses the row. Before and after
+  recordings in the notes vault's `GenesisTools.native/MarkdownViewer/Screenshots/2026-10-15-0618-*`.
diff --git a/.claude/skills/ux/references/live-testing.md b/.claude/skills/ux/references/live-testing.md
index bdd49a8c6f..835da6d66b 100644
--- a/.claude/skills/ux/references/live-testing.md
+++ b/.claude/skills/ux/references/live-testing.md
@@ -22,3 +22,24 @@
 ## Watching
 - `tools hub dev monitor` under the Monitor tool; filter out timers another stream owns, keep stalls/crashes.
 - A stall that hits every process at once with a load average of 30+ is the machine, not your view.
+
+## Input on the user's screen (Martin, 2026-10-14)
+- Every press, drag, key and pointer move goes through `tools control` with `--background`: window-addressed events,
+  the animated blue cursor shows what happens (`--note` labels it), the hardware pointer and the keyboard focus stay
+  with the user. Never an own `CGEvent` poster on the HID tap, never System Events keystrokes or menu clicks. If
+  `tools control` lacks the action, ask for it instead of falling back (2026-10-14: `act --action drag --to` refuses
+  a destination outside the snapshot window, so a window cannot be dragged yet).
+- Read the target's frame right before the press. A press on empty screen lands in whatever window is behind.
+- Reproduce a click bug the way the user clicked: a real press, hold and small drag differs from an accessibility
+  press (the viewer's dead clicks needed the hold). Keep it inside the app under test.
+- Never attach a debugger to the user's running app, and never poll in a loop without a sleep: both froze the Mac.
+  For "clicks do nothing", ship a diagnostic build that logs every mouse down and up with the hit view and the
+  window's key, active, modal and sheet state, then read `log show --predicate 'subsystem == "genesiskit"'`.
+- A window with `sharingType = .none` (screen-effect panels, the camera bubble) is invisible to every capture; check
+  its bounds with `CGWindowListCopyWindowInfo` instead of trusting an empty screenshot.
+- Turn back off whatever you turned on for a test (a setting, a preview) and say so in the report.
+- A click delivered in the background to an inactive window is no proof that clicks work or fail: it arrives with
+  key and active false, and macOS may use it to activate the window only. Prove a dead-click bug from the app's own
+  press and action log, or with the window key while the user agrees to give up focus.
+- A window whose text changes live (a "saved 1 min ago" status) makes `tools control act` refuse as stale. Pass the
+  row's `--target-key <stableKey> --revalidate-scope element` from the same `see`.
diff --git a/.githooks/pre-commit b/.githooks/pre-commit
index 6cd8ee4757..a41f28f1c1 100755
--- a/.githooks/pre-commit
+++ b/.githooks/pre-commit
@@ -14,48 +14,54 @@ set -e
 # partial `git commit <paths>` runs the hook against a temporary index and must keep doing so.
 unset GIT_DIR
 
-# Biome's --staged flag only SELECTS staged files; --write fixes them in the
-# working tree and leaves the index alone. Until 2026-09-02 this hook believed
-# biome re-staged its fixes, so a commit carried the unfixed copy and CI's
-# biome step went red on an import order the hook had already corrected
-# (PR #346, run 33681440922). So the index is formatted on its own: every
-# staged blob biome touched goes through biome on stdin and the result is
-# written back as a blob. The commit gets biome(staged copy) and nothing else.
-# A bare `git add` here would also sweep in the file's unstaged hunks and
-# whatever an editor or a parallel agent wrote while biome was running.
+# Biome's --staged flag selects working files, so format the index separately.
+# Each staged blob gets its original full path in a temporary mirror of the
+# configuration hierarchy. Exact-basename overrides and JSONC parser defaults
+# then match, and Biome writes real file bytes without console substitutions.
+# Never use --stdin-file-path as a source of blob bytes: Biome 2.5.11's console
+# changes ✔ ✖ ⚠ ℹ into √ × ! i. Never stage the live working copy either: that
+# would sweep in unstaged hunks or an editor's concurrent writes.
 biome_staged() {
     bunx biome check --write --staged --no-errors-on-unmatched
 
-    fixed=$(mktemp)
+    staged_mirror=$(mktemp -d)
+    trap 'rm -rf "$staged_mirror"' EXIT
+    repo_root=$(git rev-parse --show-toplevel)
+    # Use existing assessed binaries; the mirror never installs dependencies.
+    if [ -d "$repo_root/node_modules" ]; then
+        ln -s "$repo_root/node_modules" "$staged_mirror/node_modules"
+    fi
     git diff --cached --name-only --diff-filter=d --relative | while IFS= read -r f; do
         [ -n "$f" ] || continue
-        # Neither biome nor anyone else touched it: the index is already right.
-        # A file that differs only by its own unstaged hunks gets one biome run
-        # below and comes out with the same blob, so nothing is written.
         git diff --quiet -- "$f" && continue
         entry=$(git ls-files --stage --full-name -- "$f")
         mode=$(printf '%s\n' "$entry" | cut -d' ' -f1)
         full=$(printf '%s\n' "$entry" | cut -f2)
         case "$mode" in 100644|100755) ;; *) continue ;; esac
-        # A binary blob (git: a NUL early in the file, numstat prints "-  -")
-        # is nothing biome can take, so its index entry is left as it is.
-        # Files outside biome's includes come back unchanged with exit 0. Any
-        # other failure, a parse error in the staged copy or a broken config,
-        # aborts the commit through set -e.
         case "$(git diff --cached --numstat -- "$f")" in -*) continue ;; esac
-        git show ":./$f" | bunx biome check --write --stdin-file-path="$f" > "$fixed"
-        # biome prints NOTHING (exit 0, a files/missingHandler note on stderr) for a path it has no handler for that
-        # is not on disk: a Swift or Markdown file staged and then moved or deleted. Writing that back committed the
-        # file empty (2026-10-13). Empty output for a non-empty staged blob is never a format result, so the staged
-        # blob stays.
-        if [ ! -s "$fixed" ] && [ "$(git cat-file -s ":./$f")" -gt 0 ]; then
-            continue
+        mkdir -p "$staged_mirror/$(dirname "$full")"
+        config_dir=$(dirname "$full")
+        while :; do
+            for config in biome.json biome.jsonc .editorconfig; do
+                if [ -f "$repo_root/$config_dir/$config" ]; then
+                    cp "$repo_root/$config_dir/$config" "$staged_mirror/$config_dir/$config"
+                fi
+            done
+            [ "$config_dir" != . ] || break
+            config_dir=$(dirname "$config_dir")
+        done
+        target="$staged_mirror/$full"
+        git show ":./$f" > "$target"
+        # VCS ignores do not apply in this temporary tree, but configuration includes still do.
+        if ! (cd "$(dirname "$target")" && bunx biome check --write --no-errors-on-unmatched --vcs-enabled=false "./$(basename "$target")") > /dev/null; then
+            exit 1
         fi
-        blob=$(git hash-object -w -- "$fixed")
+        blob=$(git hash-object -w -- "$target")
         case "$entry" in *" $blob "*) continue ;; esac
         git update-index --cacheinfo "$mode,$blob,$full"
     done
-    rm -f "$fixed"
+    rm -rf "$staged_mirror"
+    trap - EXIT
 }
 
 echo "▶ biome check --write --staged..."
@@ -69,6 +75,17 @@ if git diff --cached --name-only --diff-filter=d | grep -q '^src/claude-history-
     cd ../..
 fi
 
+# Biome reads only the root's JSON files, so a nested manifest that does not parse passed this hook with "Checked 0
+# files": d9687720a (2026-10-14) wrote the word `ours` into both plugin manifests and the plugin did not load for 12 h.
+echo "▶ staged JSON files parse..."
+bun scripts/ci/check-json.ts --staged
+
+# Biome's unsafe noUnusedImports fix deletes the comment above each import it removes, often the file header,
+# and says only "Fixed N files": on 2026-10-14 a sweep lost a 27-line header that way. The shell guard blocks
+# `biome --unsafe`; this catches the same loss from any other tool. GT_ALLOW_LOST_COMMENTS=1 lets a deliberate one pass.
+echo "▶ no comment deleted with an import..."
+bun scripts/ci/check-lost-comments.ts --staged
+
 echo "▶ tsgo --noEmit (failing on staged files only)..."
 # tsgo has no per-file mode (types cross files), so the whole project is checked
 # but only errors in STAGED files block the commit. Unstaged breakage — e.g. a
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 98bc595b6f..9fb84f4d8a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -524,6 +524,12 @@ jobs:
         timeout-minutes: 1
         run: bun scripts/ci/check-plugin-standalone.ts
 
+      # Biome reads only the root's JSON files, so a nested manifest that does not parse passed every gate
+      # (d9687720a, 2026-10-14: the genesis-tools plugin failed to load for 12 hours).
+      - name: JSON files parse
+        timeout-minutes: 1
+        run: bun scripts/ci/check-json.ts
+
       # Every command a hint names through toolCommand()/suggestCommand() must still exist, so a
       # renamed command fails here instead of in front of a user.
       # --strict: every `tools …` command in src/** goes through toolCommand() or suggestCommand().
diff --git a/.gitignore b/.gitignore
index 5d9277bbeb..2689acae0e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -261,3 +261,6 @@ src/utils/agent-harness/oracle/bridge/bin/
 
 # Opt-in test-worker log (GENESIS_TOOLS_TEST_WORKER_LOG=1, read by scripts/test-worker-log.ts)
 test-worker-log.jsonl
+
+# The pre-commit hook's sibling copy of a staged file; a killed hook can leave one behind
+.biome-staged.*
diff --git a/scripts/ci/check-json.ts b/scripts/ci/check-json.ts
new file mode 100644
index 0000000000..f8916b7591
--- /dev/null
+++ b/scripts/ci/check-json.ts
@@ -0,0 +1,82 @@
+#!/usr/bin/env bun
+/**
+ * Every committed JSON file parses. Biome reads only the root's JSON files (`files.includes` lists `*.{json,mjs,cjs}`,
+ * which matches no nested folder), so a broken nested file passed every gate: on 2026-10-14 a conflict resolution wrote the word `ours`
+ * into both plugin manifests (d9687720a), the pre-commit hook printed "Checked 0 files", and the genesis-tools plugin
+ * failed to load in every new session for 12 hours. tsconfig files, `.jsonc` files and `.vscode/` settings are JSON
+ * with comments by convention and are read that way; every other file must be strict JSON.
+ *
+ *   bun scripts/ci/check-json.ts            # every tracked .json and .jsonc file (CI)
+ *   bun scripts/ci/check-json.ts --staged   # the staged copies (the pre-commit hook)
+ *
+ * Exit 0 when all parse, 1 naming each file that does not, 2 when git cannot list or read the files.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { basename } from "node:path";
+import { SafeJSON } from "@genesiscz/utils/json";
+
+const PATHSPEC = ["--", "*.json", "*.jsonc"];
+
+export function allowsComments(path: string): boolean {
+    return /^tsconfig.*\.json$/.test(basename(path)) || path.endsWith(".jsonc") || /(^|\/)\.vscode\//.test(path);
+}
+
+/** Why a JSON file does not parse, or null when it does. */
+export function jsonProblem(path: string, text: string): string | null {
+    try {
+        SafeJSON.parse(text, allowsComments(path) ? null : { strict: true });
+        return null;
+    } catch (error) {
+        return error instanceof Error ? error.message : String(error);
+    }
+}
+
+function git(args: string[]): string {
+    const result = Bun.spawnSync(["git", ...args], { stdout: "pipe", stderr: "pipe" });
+
+    if (result.exitCode !== 0) {
+        console.error(`✖ git ${args.join(" ")} failed (exit ${result.exitCode}): ${result.stderr.toString().trim()}`);
+        process.exit(2);
+    }
+
+    return result.stdout.toString();
+}
+
+function main(): void {
+    const staged = process.argv.includes("--staged");
+    const paths = git(
+        staged
+            ? ["diff", "--cached", "--name-only", "-z", "--diff-filter=ACMR", ...PATHSPEC]
+            : ["ls-files", "-z", ...PATHSPEC]
+    )
+        .split("\0")
+        .filter(Boolean);
+    let checked = 0;
+    let broken = 0;
+
+    for (const path of paths) {
+        // A tracked file deleted in the working tree but not yet staged is not this check's business.
+        if (!staged && !existsSync(path)) {
+            continue;
+        }
+
+        const problem = jsonProblem(path, staged ? git(["show", `:${path}`]) : readFileSync(path, "utf8"));
+        checked++;
+
+        if (problem) {
+            broken++;
+            console.error(`✖ ${path}: ${problem}`);
+        }
+    }
+
+    if (broken > 0) {
+        console.error(`✖ ${broken} of ${checked} JSON file(s) do not parse`);
+        process.exit(1);
+    }
+
+    console.log(`✔ ${checked} JSON file(s) parse`);
+}
+
+if (import.meta.main) {
+    main();
+}
diff --git a/scripts/ci/check-lost-comments.ts b/scripts/ci/check-lost-comments.ts
new file mode 100644
index 0000000000..a134095cc7
--- /dev/null
+++ b/scripts/ci/check-lost-comments.ts
@@ -0,0 +1,355 @@
+#!/usr/bin/env bun
+/**
+ * A comment block deleted together with the import below it, whose text appears nowhere in the new file. That is
+ * the shape Biome's unsafe `noUnusedImports` fix leaves: it removes the import with its leading comment, which is
+ * often the file header, and reports only "Fixed N files". On 2026-10-14 a sweep lost a 27-line header in
+ * scripts/benchmarks/ai-usage/poll-duty.ts and a 12-line one in perf-report.ts that way; a diff review caught it, no
+ * gate did. The shell guard now blocks `biome --unsafe` (rule biome-unsafe-deletes-comments); this check catches
+ * the same loss from any other tool: a codemod, an editor's organize-imports, another agent.
+ *
+ * Reported: a block of three or more comment lines, or any file header (the comment at the top of the file), that
+ * ends directly above a removed import (blank lines between are allowed), when at least half of its text lines are
+ * missing from the new file and, for a header, the new file starts without a header of its own (a rewritten header
+ * is a deliberate change). Two short lines about one import are removed with it all the time and are not reported.
+ *
+ *   bun scripts/ci/check-lost-comments.ts --staged           # the staged diff (the pre-commit hook)
+ *   bun scripts/ci/check-lost-comments.ts --range A..B       # every commit in a range (an audit)
+ *
+ * A deliberate removal passes with GT_ALLOW_LOST_COMMENTS=1 in the commit's environment.
+ * Exit 0 when nothing is lost, 1 naming each loss, 2 when git fails.
+ */
+
+const SOURCE_PATHSPEC = ["--", "*.ts", "*.tsx", "*.js", "*.jsx", "*.mjs", "*.cjs"];
+const MIN_BLOCK_LINES = 3;
+
+export interface LostComment {
+    file: string;
+    /** Line of the block's first line in the old file. */
+    oldLine: number;
+    header: boolean;
+    /** The comment text lines that are missing from the new file. */
+    missing: string[];
+    importLine: string;
+}
+
+interface Hunk {
+    oldStart: number;
+    removed: string[];
+}
+
+export interface FileDiff {
+    file: string;
+    /** Null only for additions; omitted by older in-memory callers that use the same path on both sides. */
+    oldFile?: string | null;
+    hunks: Hunk[];
+}
+
+const isComment = (line: string) => /^\s*(\/\/|\/\*|\*|\*\/)/.test(line);
+const isImport = (line: string) => /^\s*import\b/.test(line);
+const textOf = (line: string) =>
+    line
+        .replace(/^\s*(\/\/+|\/\*+|\*\/|\*)\s?/, "")
+        .replace(/\*\/\s*$/, "")
+        .trim();
+
+function diffPath(header: string): string | null {
+    const value = header.slice(4).split("\t")[0];
+    let path = value;
+    if (value.startsWith('"')) {
+        if (!value.endsWith('"')) {
+            throw new Error("unterminated Git path: " + value);
+        }
+
+        const escapes: Record<string, string> = {
+            a: "\x07",
+            b: "\b",
+            t: "\t",
+            n: "\n",
+            v: "\v",
+            f: "\f",
+            r: "\r",
+            '"': '"',
+            "\\": "\\",
+        };
+        const chunks = value
+            .slice(1, -1)
+            .split(/(\\(?:[0-7]{1,3}|.))/s)
+            .map((chunk) => {
+                if (!chunk.startsWith("\\")) {
+                    return Buffer.from(chunk);
+                }
+
+                const octal = /^\\([0-7]{1,3})$/.exec(chunk);
+                if (octal) {
+                    return Buffer.from([Number.parseInt(octal[1], 8)]);
+                }
+
+                const decoded = escapes[chunk.slice(1)];
+                if (decoded === undefined) {
+                    throw new Error("invalid Git path escape: " + chunk);
+                }
+                return Buffer.from(decoded);
+            });
+        // Octal escapes encode UTF-8 bytes, not separate Unicode code points.
+        path = Buffer.concat(chunks).toString("utf8");
+    }
+    return path === "/dev/null" ? null : path.slice(2);
+}
+
+/** Per-file hunks of a `git diff -U0` output. Deleted files are left out: nothing of theirs survives anyway. */
+export function parseZeroContextDiff(diff: string): FileDiff[] {
+    const files: FileDiff[] = [];
+    let current: FileDiff | null = null;
+    let hunk: Hunk | null = null;
+    let deleted = false;
+
+    const close = () => {
+        if (current && !deleted) {
+            files.push(current);
+        }
+
+        current = null;
+        hunk = null;
+        deleted = false;
+    };
+
+    for (const line of diff.split("\n")) {
+        if (line.startsWith("diff --git ")) {
+            close();
+            const split = line.lastIndexOf(" b/");
+            current = { file: line.slice(split + 3), oldFile: line.slice("diff --git a/".length, split), hunks: [] };
+            continue;
+        }
+
+        if (!current) {
+            continue;
+        }
+
+        if (line.startsWith("new file mode")) {
+            current.oldFile = null;
+            continue;
+        }
+
+        if (line.startsWith("--- ")) {
+            current.oldFile = diffPath(line);
+            continue;
+        }
+
+        if (line.startsWith("+++ ")) {
+            current.file = diffPath(line) ?? current.file;
+            continue;
+        }
+
+        if (line.startsWith("deleted file mode")) {
+            deleted = true;
+            continue;
+        }
+
+        const header = /^@@ -(\d+)(?:,\d+)? \+\d+(?:,\d+)? @@/.exec(line);
+
+        if (header) {
+            hunk = { oldStart: Number(header[1]), removed: [] };
+            current.hunks.push(hunk);
+            continue;
+        }
+
+        if (hunk && line.startsWith("-") && !line.startsWith("--- ")) {
+            hunk.removed.push(line.slice(1));
+        }
+    }
+
+    close();
+    return files;
+}
+
+/** True when everything above `line` (1-based) in the old file is blank, a shebang or a directive. */
+function startsTheFile(oldContent: string, line: number): boolean {
+    return oldContent
+        .split("\n")
+        .slice(0, line - 1)
+        .every((text) => text.trim() === "" || text.startsWith("#!") || /^\s*["']use \w+["'];?\s*$/.test(text));
+}
+
+/** The new file opens with a comment (after a shebang and blank lines). */
+function hasHeader(newContent: string): boolean {
+    const first = newContent.split("\n").find((text) => text.trim() !== "" && !text.startsWith("#!"));
+    return first !== undefined && isComment(first);
+}
+
+export function findLostComments(input: { diff: FileDiff; oldContent: string; newContent: string }): LostComment[] {
+    const oldLines = input.oldContent.split("\n");
+    const at = (line: number) => oldLines[line - 1] ?? "";
+    // Old-file line numbers (1-based) the diff removes. A -U0 hunk removes consecutive lines from its start.
+    const removed = new Set(
+        input.diff.hunks.flatMap((hunk) => hunk.removed.map((_, offset) => hunk.oldStart + offset))
+    );
+    const found: LostComment[] = [];
+
+    for (const line of [...removed].sort((a, b) => a - b)) {
+        if (!isImport(at(line))) {
+            continue;
+        }
+
+        // Up over blank lines, removed or kept: the blank line between a header and the import can stay behind.
+        let end = line - 1;
+
+        while (end >= 1 && at(end).trim() === "") {
+            end--;
+        }
+
+        let top = end;
+
+        while (top >= 1 && removed.has(top) && isComment(at(top))) {
+            top--;
+        }
+
+        const block = oldLines.slice(top, end);
+
+        if (block.length === 0) {
+            continue;
+        }
+
+        const oldLine = top + 1;
+        const atTop = startsTheFile(input.oldContent, oldLine);
+
+        // A new header in its place is a rewrite, which is deliberate.
+        if (atTop && hasHeader(input.newContent)) {
+            continue;
+        }
+
+        const header = atTop;
+
+        if (!header && block.length < MIN_BLOCK_LINES) {
+            continue;
+        }
+
+        const texts = block.map(textOf).filter((text) => text.length > 8);
+        const missing = texts.filter((text) => !input.newContent.includes(text));
+
+        if (missing.length === 0 || missing.length * 2 < texts.length) {
+            continue;
+        }
+
+        found.push({ file: input.diff.file, oldLine, header, missing, importLine: at(line).trim() });
+    }
+
+    return found;
+}
+
+function git(args: string[]): string {
+    const result = Bun.spawnSync(["git", ...args], { stdout: "pipe", stderr: "pipe" });
+    if (result.exitCode !== 0) {
+        console.error(
+            "\u2716 git " +
+                args.join(" ") +
+                " failed (exit " +
+                result.exitCode +
+                "): " +
+                result.stderr.toString().trim()
+        );
+        process.exit(2);
+    }
+    return result.stdout.toString();
+}
+
+/** Each side uses its own path; only a diff-declared addition has no old blob. */
+function scan(diff: string, before: (file: string) => string, after: (file: string) => string): LostComment[] {
+    return (
+        parseZeroContextDiff(diff)
+            // Without removed lines there cannot be a deleted comment/import; pure renames need no blob reads.
+            .filter((fileDiff) => fileDiff.hunks.some((hunk) => hunk.removed.length > 0))
+            .flatMap((fileDiff) =>
+                findLostComments({
+                    diff: fileDiff,
+                    oldContent: fileDiff.oldFile === null ? "" : before(fileDiff.oldFile ?? fileDiff.file),
+                    newContent: after(fileDiff.file),
+                })
+            )
+    );
+}
+
+function report(losses: Array<LostComment & { commit?: string }>): void {
+    for (const loss of losses) {
+        const where = `${loss.commit ? `${loss.commit.slice(0, 10)} ` : ""}${loss.file}:${loss.oldLine}`;
+        console.error(
+            `✖ ${where}: ${loss.header ? "the file header" : "a comment block"} was deleted with \`${loss.importLine}\``
+        );
+
+        for (const text of loss.missing.slice(0, 3)) {
+            console.error(`    lost: ${text}`);
+        }
+    }
+}
+
+function main(): void {
+    const rangeAt = process.argv.indexOf("--range");
+    const losses: Array<LostComment & { commit?: string }> = [];
+
+    if (rangeAt > 0) {
+        const range = process.argv[rangeAt + 1];
+        const commits = git(["rev-list", "--no-merges", range]).split("\n").filter(Boolean);
+
+        for (const commit of commits) {
+            const diff = git([
+                "show",
+                "--format=",
+                "-U0",
+                "-M",
+                "--no-color",
+                "--no-textconv",
+                "--no-ext-diff",
+                commit,
+                ...SOURCE_PATHSPEC,
+            ]);
+            const found = scan(
+                diff,
+                (file) => git(["show", `${commit}^:${file}`]),
+                (file) => git(["show", `${commit}:${file}`])
+            );
+            losses.push(...found.map((loss) => ({ ...loss, commit })));
+        }
+    } else if (process.argv.includes("--staged")) {
+        const diff = git([
+            "diff",
+            "--cached",
+            "-U0",
+            "-M",
+            "--no-color",
+            "--no-textconv",
+            "--no-ext-diff",
+            ...SOURCE_PATHSPEC,
+        ]);
+        losses.push(
+            ...scan(
+                diff,
+                (file) => git(["show", `HEAD:${file}`]),
+                (file) => git(["show", `:${file}`])
+            )
+        );
+    } else {
+        console.error("usage: check-lost-comments.ts --staged | --range A..B");
+        process.exit(2);
+    }
+
+    if (losses.length === 0) {
+        console.log("✔ no comment was deleted with an import");
+        return;
+    }
+
+    report(losses);
+
+    if (Bun.env.GT_ALLOW_LOST_COMMENTS === "1") {
+        console.error(`⚠ ${losses.length} loss(es) allowed by GT_ALLOW_LOST_COMMENTS=1`);
+        return;
+    }
+
+    console.error(
+        `✖ ${losses.length} comment block(s) deleted with an import (Biome's unsafe noUnusedImports fix does this). ` +
+            "Put the comment back above the next line, or rerun with GT_ALLOW_LOST_COMMENTS=1 if it is meant to go."
+    );
+    process.exit(1);
+}
+
+if (import.meta.main) {
+    main();
+}
diff --git a/scripts/ci/pre-commit-hook.test.ts b/scripts/ci/pre-commit-hook.test.ts
index 5ecb73ee2e..4944f4a531 100644
--- a/scripts/ci/pre-commit-hook.test.ts
+++ b/scripts/ci/pre-commit-hook.test.ts
@@ -6,24 +6,36 @@ import {
     mkdirSync,
     mkdtempSync,
     readFileSync,
+    realpathSync,
     renameSync,
     rmSync,
     symlinkSync,
     writeFileSync,
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
+import { dirname, join, relative, resolve, sep } from "node:path";
+import { env as testEnvironment } from "@genesiscz/utils/env.client";
+import { persistentFixture } from "@genesiscz/utils/test/persistent-fixture";
+import { jsonProblem } from "./check-json";
+import { findLostComments, parseZeroContextDiff } from "./check-lost-comments";
 
 /**
- * Runs the real `.githooks/pre-commit` in a scratch repository. The hook formats each staged blob by piping it
- * through `biome check --write --stdin-file-path`. For a path biome has no handler for (Swift, Markdown) and that is
- * not on disk, biome prints NOTHING and exits 0, and the hook used to write that empty output back as the staged
- * blob: a file staged and then moved or deleted in the working tree was committed empty (2026-10-13, found when a
- * GenesisKit agent's Swift commits came out with empty test and store files).
+ * Runs the real `.githooks/pre-commit` in a scratch repository. Staged blobs are formatted in a temporary tree at
+ * their original paths. The old stdin formatter printed nothing for unhandled Swift/Markdown paths missing from
+ * disk, and the hook committed that empty output (2026-10-13). These tests preserve staged bytes, unstaged hunks,
+ * exact-path rules and Unicode without using console output as file content.
  */
 
 const ROOT = resolve(import.meta.dir, "../..");
 
+/** Executed files stay outside the wrapper's cleanup root and are immutable once published. */
+function executableFixture(name: string, body: string): string {
+    return persistentFixture(name, body, (path) => {
+        writeFileSync(path, body);
+        chmodSync(path, 0o755);
+    });
+}
+
 // A test run inside another git process (a hook, a rebase --exec) inherits GIT_DIR / GIT_INDEX_FILE, which would
 // point every git call below at the outer repository.
 const env: Record<string, string | undefined> = { ...process.env };
@@ -49,25 +61,25 @@ describe("config hook installer", () => {
         mkdirSync(join(directory, "scripts/git"), { recursive: true });
         copyFileSync(join(ROOT, "scripts/git/install-hooks.ts"), join(directory, "scripts/git/install-hooks.ts"));
         mkdirSync(join(directory, ".githooks"));
-        writeFileSync(
-            join(directory, ".githooks/pre-commit"),
-            '#!/bin/sh\nprintf "pre-commit\\n" >> hook-runs\ntest ! -f fail-hook\n'
+        symlinkSync(
+            executableFixture("pre-commit", '#!/bin/sh\nprintf "pre-commit\\n" >> hook-runs\ntest ! -f fail-hook\n'),
+            join(directory, ".githooks/pre-commit")
+        );
+        symlinkSync(
+            executableFixture("commit-msg", '#!/bin/sh\nprintf "%s\\n" "$@" > hook-args\n'),
+            join(directory, ".githooks/commit-msg")
         );
-        writeFileSync(join(directory, ".githooks/commit-msg"), '#!/bin/sh\nprintf "%s\\n" "$@" > hook-args\n');
         if (unsupported) {
-            const bin = join(directory, "bin");
-            mkdirSync(bin);
             const realGit = Bun.which("git");
             if (!realGit) {
                 throw new Error("git is required");
             }
 
-            writeFileSync(
-                join(bin, "git"),
+            const wrapper = executableFixture(
+                "git",
                 `#!/bin/sh\nif [ "$1" = hook ] && [ "$2" = list ]; then exit 1; fi\nexec '${realGit}' "$@"\n`
             );
-            chmodSync(join(bin, "git"), 0o755);
-            testEnv.PATH = `${bin}:${testEnv.PATH}`;
+            testEnv.PATH = `${dirname(wrapper)}:${testEnv.PATH}`;
         }
 
         const install = () => {
@@ -97,40 +109,39 @@ describe("config hook installer", () => {
         }
     });
 
-    test.each([false, true])("preserves inherited global and system hook paths, unsupported=%s", (unsupported) => {
-        for (const scope of ["--global", "--system"]) {
-            for (const local of [false, true]) {
-                const s = scratch(unsupported);
-                expect(s.runGit("config", scope, "core.hooksPath", "inherited-hooks").code).toBe(0);
-                if (local) {
-                    expect(s.runGit("config", "--local", "core.hooksPath", ".githooks").code).toBe(0);
-                }
-
-                s.install();
-                if (local && !unsupported) {
-                    chmodSync(join(s.directory, ".githooks/pre-commit"), 0o755);
-                    chmodSync(join(s.directory, ".githooks/commit-msg"), 0o755);
-                    expect(s.runGit("commit", "--allow-empty", "-qm", "inherited path fixture").code).toBe(0);
-                    expect(readFileSync(join(s.directory, "hook-runs"), "utf8")).toBe("pre-commit\n");
-                }
-
-                expect(s.runGit("config", scope, "--get", "core.hooksPath").out).toBe("inherited-hooks");
-                expect(s.runGit("config", "--local", "--get", "core.hooksPath").out).toBe(local ? ".githooks" : "");
-                expect(s.runGit("config", "--get", "core.hooksPath").out).toBe(local ? ".githooks" : "inherited-hooks");
-            }
-        }
-    });
-
-    test("older Git keeps the repository hook folder when unset or repository-owned", () => {
-        for (const local of [false, true]) {
-            const s = scratch(true);
+    test.each(
+        [false, true].flatMap((unsupported) =>
+            ["--global", "--system"].flatMap((scope) => [false, true].map((local) => ({ unsupported, scope, local })))
+        )
+    )(
+        "preserves inherited hook paths, unsupported=$unsupported scope=$scope local=$local",
+        ({ unsupported, scope, local }) => {
+            const s = scratch(unsupported);
+            expect(s.runGit("config", scope, "core.hooksPath", "inherited-hooks").code).toBe(0);
             if (local) {
                 expect(s.runGit("config", "--local", "core.hooksPath", ".githooks").code).toBe(0);
             }
 
             s.install();
-            expect(s.runGit("config", "--local", "--get", "core.hooksPath").out).toBe(".githooks");
+            if (local && !unsupported) {
+                expect(s.runGit("commit", "--allow-empty", "-qm", "inherited path fixture").code).toBe(0);
+                expect(readFileSync(join(s.directory, "hook-runs"), "utf8")).toBe("pre-commit\n");
+            }
+
+            expect(s.runGit("config", scope, "--get", "core.hooksPath").out).toBe("inherited-hooks");
+            expect(s.runGit("config", "--local", "--get", "core.hooksPath").out).toBe(local ? ".githooks" : "");
+            expect(s.runGit("config", "--get", "core.hooksPath").out).toBe(local ? ".githooks" : "inherited-hooks");
+        }
+    );
+
+    test.each([false, true])("older Git keeps the repository hook folder, local .githooks=%s", (local) => {
+        const s = scratch(true);
+        if (local) {
+            expect(s.runGit("config", "--local", "core.hooksPath", ".githooks").code).toBe(0);
         }
+
+        s.install();
+        expect(s.runGit("config", "--local", "--get", "core.hooksPath").out).toBe(".githooks");
     });
 
     test.skipIf(!supportsConfigHooks).each([false, true])(
@@ -161,15 +172,35 @@ describe("config hook installer", () => {
         }
     );
 
+    test("executable fixtures survive scratch cleanup outside the test temp root", () => {
+        // Construction only: the old scratch executables are never launched by this regression.
+        const s = scratch(true);
+        const wrapper = Bun.which("git", { PATH: s.testEnv.PATH });
+        expect(wrapper).not.toBeNull();
+        const programs = [
+            join(s.directory, ".githooks/pre-commit"),
+            join(s.directory, ".githooks/commit-msg"),
+            wrapper ?? "",
+        ].map((path) => realpathSync(path));
+        const sandbox = testEnvironment.test.getTmpRoot();
+        expect(sandbox).toBeTruthy();
+        for (const program of programs) {
+            const local = relative(realpathSync(sandbox ?? s.directory), program);
+            expect(local === ".." || local.startsWith(".." + sep)).toBe(true);
+        }
+        rmSync(s.directory, { recursive: true, force: true });
+        for (const program of programs) {
+            expect(existsSync(program)).toBe(true);
+            expect(readFileSync(program, "utf8")).toStartWith("#!/bin/sh");
+        }
+    });
+
     test("checkout and rebase early exits never start git or tools", () => {
         const s = scratch();
-        const bin = join(s.directory, "blocked-bin");
-        mkdirSync(bin);
-        for (const command of ["git", "bun", "tools"]) {
-            const file = join(bin, command);
-            writeFileSync(file, '#!/bin/sh\nprintf "unexpected process\\n" >> unexpected-process\nexit 99\n');
-            chmodSync(file, 0o755);
-        }
+        const programs = ["git", "bun", "tools"].map((command) =>
+            executableFixture(command, '#!/bin/sh\nprintf "unexpected process\\n" >> unexpected-process\nexit 99\n')
+        );
+        const bin = dirname(programs[0]);
 
         const linked = join(s.directory, "linked");
         mkdirSync(linked);
@@ -231,14 +262,31 @@ beforeAll(() => {
     symlinkSync(join(ROOT, "node_modules"), join(repo, "node_modules"));
     copyFileSync(join(ROOT, "biome.json"), join(repo, "biome.json"));
     mkdirSync(join(repo, ".githooks"));
-    copyFileSync(join(ROOT, ".githooks", "pre-commit"), join(repo, ".githooks", "pre-commit"));
-    chmodSync(join(repo, ".githooks", "pre-commit"), 0o755);
+    symlinkSync(
+        executableFixture("pre-commit", readFileSync(join(ROOT, ".githooks/pre-commit"), "utf8")),
+        join(repo, ".githooks/pre-commit")
+    );
+    mkdirSync(join(repo, "scripts", "ci"), { recursive: true });
+    copyFileSync(join(ROOT, "scripts", "ci", "check-json.ts"), join(repo, "scripts", "ci", "check-json.ts"));
+    copyFileSync(
+        join(ROOT, "scripts", "ci", "check-lost-comments.ts"),
+        join(repo, "scripts", "ci", "check-lost-comments.ts")
+    );
     git("config", "core.hooksPath", ".githooks");
     write("tsconfig.json", '{"compilerOptions":{"strict":true,"noEmit":true,"skipLibCheck":true},"files":["ok.ts"]}\n');
     write("ok.ts", "export const ok = 1;\n");
     write(".gitignore", "node_modules\naside\n");
     mkdirSync(join(repo, "aside"));
-    git("add", ".gitignore", "biome.json", "tsconfig.json", "ok.ts", ".githooks/pre-commit");
+    git(
+        "add",
+        ".gitignore",
+        "biome.json",
+        "tsconfig.json",
+        "ok.ts",
+        ".githooks/pre-commit",
+        "scripts/ci/check-json.ts",
+        "scripts/ci/check-lost-comments.ts"
+    );
     const init = git("commit", "-qm", "init");
     expect(init.code, init.out).toBe(0);
 });
@@ -294,3 +342,314 @@ describe("pre-commit hook: staged content survives the biome pass", () => {
         );
     }, 60_000);
 });
+
+// d9687720a (2026-10-14): a conflict resolver wrote the word `ours` into both plugin manifests. Biome reads only the
+// root's JSON files, so the hook passed it with "Checked 0 files", and the plugin did not load for 12 hours.
+describe("round 16 exact Biome overrides", () => {
+    test("a partly staged exact-path restriction blocks the index and preserves Unicode on a valid retry", () => {
+        const file = "src/utils/logger/client.ts";
+        const bad = 'import color from "picocolors";\nexport const mark = color.green("fixture");\n';
+        const good = 'export const mark = "✔ ✖ ⚠ ℹ";\n';
+        write(file, bad);
+        git("add", "--", file);
+        write(file, good);
+        const before = git("rev-parse", "HEAD").out;
+        const blocked = git("commit", "-qm", "exact override fixture");
+        expect(blocked.code, blocked.out).not.toBe(0);
+        expect(blocked.out).toContain("noRestrictedImports");
+        expect(git("rev-parse", "HEAD").out).toBe(before);
+        expect(readFileSync(join(repo, file), "utf8")).toBe(good);
+        git("add", "--", file);
+        const committed = git("commit", "-qm", "valid exact override fixture");
+        expect(committed.code, committed.out).toBe(0);
+        expect(headBlob(file)).toBe(good);
+    });
+});
+
+describe("pre-commit hook: staged JSON must parse", () => {
+    const stray = '{\n    "name": "genesis-tools",\nours    "description": "Skills"\n}\n';
+
+    test("tsconfig, .jsonc and .vscode files may carry comments; every other JSON file is strict", () => {
+        expect(jsonProblem("src/app/tsconfig.json", '{ // paths\n    "compilerOptions": {},\n}\n')).toBeNull();
+        expect(jsonProblem(".vscode/settings.json", '{ /* editor */ "a": 1 }')).toBeNull();
+        expect(jsonProblem("plugins/p/.claude-plugin/plugin.json", '{ // version\n    "a": 1\n}\n')).not.toBeNull();
+    });
+
+    test("the stray word fails with comments allowed and without", () => {
+        expect(jsonProblem(".claude-plugin/marketplace.json", stray)).not.toBeNull();
+        expect(jsonProblem("src/app/tsconfig.json", stray)).not.toBeNull();
+    });
+
+    test("a nested manifest that does not parse blocks the commit and is named", () => {
+        write(".claude-plugin/plugin.json", stray);
+        git("add", ".claude-plugin/plugin.json");
+        const commit = git("commit", "-qm", "broken manifest");
+        git("rm", "-q", "--cached", "--", ".claude-plugin/plugin.json");
+        expect(commit.code, commit.out).not.toBe(0);
+        expect(commit.out).toContain("✖ .claude-plugin/plugin.json:");
+        expect(git("log", "-1", "--format=%s").out.trim()).not.toBe("broken manifest");
+    }, 60_000);
+});
+
+// Biome's unsafe noUnusedImports fix deleted a 27-line header with the import under it (2026-10-14).
+describe("pre-commit hook: no comment deleted with an import", () => {
+    const HEADER = [
+        "#!/usr/bin/env bun",
+        "/**",
+        " * What the poll daemon costs, read back out of the day logs.",
+        " *",
+        " * Every tick is its own short-lived process, so there is nothing resident to sample.",
+        " */",
+        "",
+    ];
+    // Sorted as Biome sorts them, so the removed import is the one under the header.
+    const IMPORTS = ['import { readFileSync } from "node:fs";', 'import { join } from "node:path";', ""];
+    const BODY = ['export const text = readFileSync(join("a", "b"), "utf8");', ""];
+    // What a removed `readFileSync` import leaves: the body no longer calls it.
+    const AFTER_BODY = ['export const text = join("a", "b");', ""];
+    const before = [...HEADER, ...IMPORTS, ...BODY].join("\n");
+
+    function lost(after: string): string[] {
+        // The -U0 diff the hook reads, from two scratch files.
+        write("lost/before.ts", before);
+        write("lost/after.ts", after);
+        const diff = Bun.spawnSync(["git", "diff", "--no-index", "-U0", "lost/before.ts", "lost/after.ts"], {
+            cwd: repo,
+            env,
+        }).stdout.toString();
+        const [fileDiff] = parseZeroContextDiff(diff);
+
+        return fileDiff
+            ? findLostComments({ diff: fileDiff, oldContent: before, newContent: after }).flatMap(
+                  (loss) => loss.missing
+              )
+            : [];
+    }
+
+    test("a header deleted with the import below it is reported, with or without the blank line between", () => {
+        const withoutBlank = ["#!/usr/bin/env bun", ...IMPORTS.slice(1), ...AFTER_BODY].join("\n");
+        const blankKept = ["#!/usr/bin/env bun", "", ...IMPORTS.slice(1), ...AFTER_BODY].join("\n");
+
+        expect(lost(withoutBlank)).toContain("What the poll daemon costs, read back out of the day logs.");
+        expect(lost(blankKept)).toContain("What the poll daemon costs, read back out of the day logs.");
+    });
+
+    test("a rewritten header, a moved comment and a short comment that goes with its import pass", () => {
+        const rewritten = ["#!/usr/bin/env bun", "/** The poll daemon's cost. */", ...IMPORTS.slice(1), ...AFTER_BODY];
+        const moved = ["#!/usr/bin/env bun", ...IMPORTS.slice(1), ...HEADER.slice(1), ...AFTER_BODY];
+        const short = ["// fs for the reader", 'import { readFileSync } from "node:fs";', ...BODY].join("\n");
+        const shortBefore = [
+            "// fs for the reader",
+            'import { readFileSync } from "node:fs";',
+            "// one",
+            'import "a";',
+            ...BODY,
+        ];
+
+        expect(lost(rewritten.join("\n"))).toEqual([]);
+        expect(lost(moved.join("\n"))).toEqual([]);
+        expect(
+            findLostComments({
+                diff: { file: "x.ts", hunks: [{ oldStart: 3, removed: ["// one", 'import "a";'] }] },
+                oldContent: shortBefore.join("\n"),
+                newContent: short,
+            })
+        ).toEqual([]);
+    });
+
+    test("the hook blocks the commit and names the file; GT_ALLOW_LOST_COMMENTS=1 lets it through", () => {
+        write("src/poll.ts", before);
+        git("add", "src/poll.ts");
+        expect(git("commit", "-qm", "poll").code).toBe(0);
+
+        write("src/poll.ts", ["#!/usr/bin/env bun", ...IMPORTS.slice(1), ...AFTER_BODY].join("\n"));
+        git("add", "src/poll.ts");
+        const blocked = git("commit", "-qm", "lost header");
+        expect(blocked.code, blocked.out).not.toBe(0);
+        expect(blocked.out).toContain("✖ src/poll.ts:2: the file header was deleted with");
+
+        const allowed = Bun.spawnSync(["git", "commit", "-qm", "header goes on purpose"], {
+            cwd: repo,
+            env: { ...env, GT_ALLOW_LOST_COMMENTS: "1" },
+            stdout: "pipe",
+            stderr: "pipe",
+        });
+        expect(allowed.exitCode, allowed.stderr.toString()).toBe(0);
+    }, 60_000);
+});
+
+describe("round 7 lost-comment rename regressions", () => {
+    function renamedFixture() {
+        const directory = mkdtempSync(join(tmpdir(), "gt-lost-rename-"));
+        const runGit = (...args: string[]) =>
+            Bun.spawnSync(["git", "-c", "core.hooksPath=/dev/null", ...args], {
+                cwd: directory,
+                env,
+                stdout: "pipe",
+                stderr: "pipe",
+            });
+        expect(runGit("init", "-q").exitCode).toBe(0);
+        runGit("config", "user.name", "Fixture");
+        runGit("config", "user.email", "fixture@example.com");
+        const header = "/** Important fixture header explaining retained behavior. */\nimport 'unused-fixture';\n";
+        const body = Array.from({ length: 30 }, (_, i) => "export const fixture" + i + " = " + i + ";\n").join("");
+        writeFileSync(join(directory, "old name.ts"), header + body);
+        runGit("add", "--", "old name.ts");
+        expect(runGit("commit", "-qm", "fixture baseline").exitCode).toBe(0);
+        const baseline = runGit("rev-parse", "HEAD").stdout.toString().trim();
+        renameSync(join(directory, "old name.ts"), join(directory, "new name.ts"));
+        writeFileSync(join(directory, "new name.ts"), body);
+        runGit("add", "--", "old name.ts", "new name.ts");
+        const check = (args: string[], preload?: string) =>
+            Bun.spawnSync(
+                [
+                    process.execPath,
+                    ...(preload ? ["--preload", preload] : []),
+                    join(ROOT, "scripts/ci/check-lost-comments.ts"),
+                    ...args,
+                ],
+                { cwd: directory, env, stdout: "pipe", stderr: "pipe", timeout: 5000 }
+            );
+        return { directory, runGit, baseline, check };
+    }
+
+    test("staged and range audits read a rename's old path and still allow additions", () => {
+        const s = renamedFixture();
+        const staged = s.check(["--staged"]);
+        expect(staged.exitCode, staged.stderr.toString()).toBe(1);
+        expect(staged.stderr.toString()).toContain("new name.ts:1: the file header");
+        expect(s.runGit("commit", "-qm", "fixture renamed").exitCode).toBe(0);
+        const ranged = s.check(["--range", s.baseline + "..HEAD"]);
+        expect(ranged.exitCode, ranged.stderr.toString()).toBe(1);
+        expect(ranged.stderr.toString()).toContain("new name.ts:1: the file header");
+        writeFileSync(join(s.directory, "added.ts"), "export const added = 1;\n");
+        writeFileSync(join(s.directory, "empty.ts"), "");
+        s.runGit("add", "--", "added.ts", "empty.ts");
+        expect(s.check(["--staged"]).exitCode).toBe(0);
+    });
+
+    test("unexpected blob read errors fail the audit instead of standing in for empty content", () => {
+        const s = renamedFixture();
+        const preload = join(s.directory, "read-error.ts");
+        writeFileSync(
+            preload,
+            "const spawn = Bun.spawnSync; Bun.spawnSync = (args,opts) => args[0] === 'git' && args[1] === 'show' ? {...spawn([process.execPath,'-e','void 0'],opts),exitCode:128,stdout:Buffer.from(''),stderr:Buffer.from('fixture blob read failed')} : spawn(args,opts);\n"
+        );
+        const result = s.check(["--staged"], preload);
+        expect(result.exitCode).toBe(2);
+        expect(result.stderr.toString()).toContain("fixture blob read failed");
+    });
+});
+
+describe("round 8 quoted pure rename regression", () => {
+    test("staged and range audits skip blob reads for a content-identical rename with Git-quoted names", () => {
+        const directory = mkdtempSync(join(tmpdir(), "gt-pure-rename-"));
+        const runGit = (...args: string[]) =>
+            Bun.spawnSync(["git", "-c", "core.hooksPath=/dev/null", ...args], {
+                cwd: directory,
+                env,
+                stdout: "pipe",
+                stderr: "pipe",
+            });
+        expect(runGit("init", "-q").exitCode).toBe(0);
+        runGit("config", "user.name", "Fixture");
+        runGit("config", "user.email", "fixture@example.com");
+        runGit("config", "core.quotePath", "true");
+        const before = "café.ts";
+        const after = "žluťoučký.ts";
+        writeFileSync(
+            join(directory, before),
+            "/** A fixture header that remains unchanged. */\nimport 'fixture';\nexport const fixture = 1;\n"
+        );
+        runGit("add", "--", before);
+        expect(runGit("commit", "-qm", "fixture baseline").exitCode).toBe(0);
+        const baseline = runGit("rev-parse", "HEAD").stdout.toString().trim();
+        renameSync(join(directory, before), join(directory, after));
+        runGit("add", "--", before, after);
+        const diff = runGit("diff", "--cached", "-U0", "-M").stdout.toString();
+        expect(diff).toContain('diff --git "a/');
+        expect(diff).not.toContain("@@");
+        const check = (args: string[]) =>
+            Bun.spawnSync([process.execPath, join(ROOT, "scripts/ci/check-lost-comments.ts"), ...args], {
+                cwd: directory,
+                env,
+                stdout: "pipe",
+                stderr: "pipe",
+                timeout: 5000,
+            });
+        const staged = check(["--staged"]);
+        expect(staged.exitCode, staged.stderr.toString()).toBe(0);
+        expect(staged.stdout.toString()).toContain("no comment was deleted");
+        expect(runGit("commit", "-qm", "fixture pure rename").exitCode).toBe(0);
+        const range = check(["--range", baseline + "..HEAD"]);
+        expect(range.exitCode, range.stderr.toString()).toBe(0);
+        expect(range.stdout.toString()).toContain("no comment was deleted");
+    });
+});
+
+describe("round 20 modified quoted paths", () => {
+    test.each(["café.ts", "with\ttab.ts", 'with"quote.ts', "with\\slash.ts", "with\nnewline.ts", "plain.ts"])(
+        "staged and range comment audits read the real filename %j",
+        (file) => {
+            const directory = mkdtempSync(join(tmpdir(), "gt-modified-quoted-"));
+            const runGit = (...args: string[]) =>
+                Bun.spawnSync(["git", "-c", "core.hooksPath=/dev/null", ...args], {
+                    cwd: directory,
+                    env,
+                    stdout: "pipe",
+                    stderr: "pipe",
+                });
+            expect(runGit("init", "-q").exitCode).toBe(0);
+            runGit("config", "user.name", "Fixture");
+            runGit("config", "user.email", "fixture@example.com");
+            runGit("config", "core.quotePath", "true");
+            const header = "/** Important fixture header explaining retained behavior. */\nimport 'unused-fixture';\n";
+            const body = "export const kept = 1;\n";
+            writeFileSync(join(directory, file), header + body + "export const removed = 2;\n");
+            expect(runGit("add", "--", file).exitCode).toBe(0);
+            expect(runGit("commit", "-qm", "fixture baseline").exitCode).toBe(0);
+            const baseline = runGit("rev-parse", "HEAD").stdout.toString().trim();
+            const check = (args: string[]) =>
+                Bun.spawnSync([process.execPath, join(ROOT, "scripts/ci/check-lost-comments.ts"), ...args], {
+                    cwd: directory,
+                    env,
+                    stdout: "pipe",
+                    stderr: "pipe",
+                    timeout: 5000,
+                });
+            writeFileSync(join(directory, file), header + body);
+            runGit("add", "--", file);
+            const safe = check(["--staged"]);
+            expect(safe.exitCode, safe.stderr.toString()).toBe(0);
+            expect(safe.stdout.toString()).toContain("no comment was deleted");
+            writeFileSync(join(directory, file), body);
+            runGit("add", "--", file);
+            const staged = check(["--staged"]);
+            expect(staged.exitCode, staged.stderr.toString()).toBe(1);
+            expect(staged.stderr.toString()).toContain(file + ":1: the file header");
+            expect(runGit("commit", "-qm", "fixture comment removed").exitCode).toBe(0);
+            const range = check(["--range", baseline + "..HEAD"]);
+            expect(range.exitCode, range.stderr.toString()).toBe(1);
+            expect(range.stderr.toString()).toContain(file + ":1: the file header");
+        }
+    );
+});
+
+describe("round 33 nested mirror configuration", () => {
+    test("a partly staged dashboard file uses its standalone nested Biome config", () => {
+        const config = "src/claude-history-dashboard/biome.json";
+        const file = "src/claude-history-dashboard/src/staged.ts";
+        write(
+            config,
+            '{"formatter":{"indentStyle":"tab"},"javascript":{"formatter":{"quoteStyle":"single"}},"linter":{"enabled":false},"assist":{"enabled":false}}\n'
+        );
+        const staged = 'export function staged() {\n return "✔";\n}\n';
+        write(file, staged);
+        expect(git("add", "--", config, file).code).toBe(0);
+        write(file, staged + 'export const unstaged = "kept";\n');
+        const result = git("commit", "-qm", "nested config mirror");
+        expect(result.code, result.out).toBe(0);
+        expect(headBlob(file)).toBe("export function staged() {\n\treturn '✔';\n}\n");
+        expect(readFileSync(join(repo, file), "utf8")).toContain("export const unstaged = 'kept';");
+    });
+});
diff --git a/src/ai/commands/agent/wait.test.ts b/src/ai/commands/agent/wait.test.ts
index e29a98a56f..7e958561a6 100644
--- a/src/ai/commands/agent/wait.test.ts
+++ b/src/ai/commands/agent/wait.test.ts
@@ -43,6 +43,7 @@ import {
     WAIT_EXIT_DONE,
     WAIT_EXIT_STALLED,
     WAIT_EXIT_TIMEOUT,
+    WAIT_EXIT_TURN_FAILED,
     waitCommand,
 } from "./wait";
 
@@ -78,6 +79,13 @@ describe("wait exit codes", () => {
         expect(new Set([exitCodeOf("done"), exitCodeOf("stalled"), exitCodeOf("timeout")]).size).toBe(3);
         expect(WAIT_EXIT_TIMEOUT).toBe(124);
     });
+
+    it("a turn that ended on an error exits with its own status, and only a done turn can", () => {
+        expect(exitCodeOf("done", "Selected model is at capacity")).toBe(WAIT_EXIT_TURN_FAILED);
+        expect(exitCodeOf("done", null)).toBe(WAIT_EXIT_DONE);
+        expect(exitCodeOf("stalled", "ignored")).toBe(WAIT_EXIT_STALLED);
+        expect(new Set([WAIT_EXIT_DONE, WAIT_EXIT_STALLED, WAIT_EXIT_TIMEOUT, WAIT_EXIT_TURN_FAILED]).size).toBe(4);
+    });
 });
 
 describe("answeredBeforeWatch", () => {
@@ -88,6 +96,7 @@ describe("answeredBeforeWatch", () => {
             asksQuestion: false,
             question: null,
             interrupted: false,
+            turnError: null,
             lastEventAt: turnStartedAt,
             turnStartedAt,
             lastActivityAt: 0,
@@ -252,6 +261,9 @@ describe("registerAgentWaitCommand", () => {
             "--last",
             "--tools",
             "--quiet",
+            "--sent-at",
+            "--baseline-turn-started-at",
+            "--baseline-transcript-bytes",
         ]);
         expect(command.description()).toContain("grok");
         expect(DEFAULT_WAIT_STALL_SECONDS).toBeGreaterThan(120);
@@ -810,3 +822,55 @@ describe("cmuxNamedSessionId", () => {
         expect(cmuxNamedSessionId({ alias: "grok", query: "other", records, refs })).toBeNull();
     });
 });
+
+describe("persisted answering-turn CLI fences", () => {
+    it("parses the saved pre-delivery baseline as numbers without losing a fast finished reply", async () => {
+        const program = new Command();
+        const command = registerAgentWaitCommand(program, "codex");
+        let received: Record<string, unknown> = {};
+        command.action((_session, options) => {
+            received = options;
+        });
+        await program.parseAsync(
+            [
+                "wait",
+                "fixture-thread",
+                "--next",
+                "--sent-at",
+                "1000",
+                "--baseline-turn-started-at",
+                "10",
+                "--baseline-transcript-bytes",
+                "100",
+            ],
+            { from: "user" }
+        );
+        expect(received).toMatchObject({
+            next: true,
+            sentAt: 1000,
+            baselineTurnStartedAt: 10,
+            baselineTranscriptBytes: 100,
+        });
+        const window = {
+            turnStartedAfter: received.sentAt as number,
+            turnNewerThan: received.baselineTurnStartedAt as number,
+            openedFromByte: received.baselineTranscriptBytes as number,
+        };
+        expect(turnWait.turnAnswers(10, window, 0)).toBe(false);
+        expect(turnWait.turnAnswers(2000, window, 200)).toBe(true);
+    });
+
+    it("rejects invalid saved fence arguments", async () => {
+        for (const option of ["--sent-at", "--baseline-turn-started-at", "--baseline-transcript-bytes"]) {
+            for (const value of ["NaN", "Infinity", "-1", "1.5"]) {
+                const program = new Command().exitOverride().configureOutput({ writeErr: () => {} });
+                registerAgentWaitCommand(program, "codex").action(() => {
+                    throw new Error("must not wait");
+                });
+                await expect(
+                    program.parseAsync(["wait", "fixture-thread", option, value], { from: "user" })
+                ).rejects.toThrow("nonnegative finite integer");
+            }
+        }
+    });
+});
diff --git a/src/ai/commands/agent/wait.ts b/src/ai/commands/agent/wait.ts
index 6d491dc997..03e69ba5d4 100644
--- a/src/ai/commands/agent/wait.ts
+++ b/src/ai/commands/agent/wait.ts
@@ -12,7 +12,7 @@ import {
 } from "@genesiscz/utils/ai/transcripts/types";
 import { formatDuration } from "@genesiscz/utils/format";
 import { logger, out } from "@genesiscz/utils/logger";
-import type { Command } from "commander";
+import { type Command, InvalidArgumentError, Option } from "commander";
 import pc from "picocolors";
 
 const { log } = logger.scoped("agent-wait");
@@ -25,6 +25,8 @@ export const WAIT_EXIT_USAGE = 2;
 export const WAIT_EXIT_STALLED = 3;
 /** `--timeout` passed first. 124 is what coreutils `timeout` exits with, so a script can treat both alike. */
 export const WAIT_EXIT_TIMEOUT = 124;
+/** The turn ended on an error (Codex: an API outage, a failed compaction, a model at capacity): no work was done. */
+export const WAIT_EXIT_TURN_FAILED = 4;
 
 /** Default silence that counts as a stall. A long tool call (a test run) is silent too, so this is generous. */
 export const DEFAULT_WAIT_STALL_SECONDS = 900;
@@ -184,10 +186,10 @@ export function answerAlreadyRunning(
     );
 }
 
-/** The exit status for an outcome. */
-export function exitCodeOf(outcome: TurnWaitOutcome): number {
+/** The exit status for an outcome. A turn that ended on an error is not done: it did no work. */
+export function exitCodeOf(outcome: TurnWaitOutcome, turnError: string | null = null): number {
     if (outcome === "done") {
-        return WAIT_EXIT_DONE;
+        return turnError ? WAIT_EXIT_TURN_FAILED : WAIT_EXIT_DONE;
     }
 
     return outcome === "stalled" ? WAIT_EXIT_STALLED : WAIT_EXIT_TIMEOUT;
@@ -447,6 +449,8 @@ interface WaitReport {
     lastText: string;
     asksQuestion: boolean;
     interrupted: boolean;
+    /** The error the turn ended with, else null (see `TurnSnapshot.turnError`). */
+    error: string | null;
     /** Questions the agent asked while it kept working (it did not stop for an answer). */
     questions: string[];
     durationMs: number;
@@ -473,6 +477,7 @@ function reportOf(args: {
         lastText: snapshot?.lastText ?? "",
         asksQuestion: snapshot?.asksQuestion ?? false,
         interrupted: snapshot?.interrupted ?? false,
+        error: snapshot?.turnError ?? null,
         questions: args.questions,
         durationMs: args.waitedMs,
         silenceMs: snapshot?.silenceMs ?? null,
@@ -484,6 +489,10 @@ function statusLine(report: WaitReport): string {
     const id = report.sessionId.slice(0, 8);
     const waited = formatDuration(report.durationMs, "ms");
 
+    if (report.outcome === "done" && report.error) {
+        return `${report.provider} ${id}: the turn FAILED after ${waited}: ${report.error}`;
+    }
+
     if (report.outcome === "done") {
         const question = report.asksQuestion
             ? " (ended on a question for the user)"
@@ -594,7 +603,7 @@ export async function waitCommand(alias: TurnProvider, query: string, options: W
                 ? await readTurnExtras(await transcriptPager(resolved), { last, tools: options.tools })
                 : {};
 
-        process.exitCode = exitCodeOf(result.outcome);
+        process.exitCode = exitCodeOf(result.outcome, report.error);
 
         if (options.json) {
             out.result({ ...options.embed, ...report, ...extras });
@@ -631,6 +640,14 @@ export async function waitCommand(alias: TurnProvider, query: string, options: W
     }
 }
 
+function parseFenceNumber(value: string): number {
+    const number = Number(value);
+    if (!value.trim() || !Number.isSafeInteger(number) || number < 0) {
+        throw new InvalidArgumentError("expected a nonnegative finite integer");
+    }
+    return number;
+}
+
 /** Register transcript waiting, output controls and distinct timeout or stall exit statuses for one provider. */
 export function registerAgentWaitCommand(program: Command, alias: TurnProvider): Command {
     return program
@@ -655,6 +672,9 @@ export function registerAgentWaitCommand(program: Command, alias: TurnProvider):
         .option("--last <n>", "Print the last N assistant messages of the session, not only the final one")
         .option("--tools", "Also list the tool calls of the turn that ended (name ×count)")
         .option("--quiet", "Suppress live progress, retaining requested messages, tools and the final status")
+        .addOption(new Option("--sent-at <epoch-ms>").hideHelp().argParser(parseFenceNumber))
+        .addOption(new Option("--baseline-turn-started-at <epoch-ms>").hideHelp().argParser(parseFenceNumber))
+        .addOption(new Option("--baseline-transcript-bytes <bytes>").hideHelp().argParser(parseFenceNumber))
         .addHelpText(
             "after",
             `
@@ -663,7 +683,9 @@ Without --json the final assistant message goes to stdout and one status line to
 An idle session returns at once. A turn that ended on a question for the user exits 0 too:
 read "asksQuestion" in --json and never answer a design question for the human.
 A question the agent asks while it keeps working (Codex and Grok do this) does not end the wait;
-it is listed in "questions" (and on stderr) when the turn ends.`
+it is listed in "questions" (and on stderr) when the turn ends.
+A turn that ended on an error (Codex: an API outage, a failed compaction, a model at capacity) exits 4
+and carries the message in "error"; it did no work. Exit codes: 0 done, 3 stalled, 4 turn failed, 124 timeout.`
         )
         .action(async (session: string, options: WaitOptions) => {
             await waitCommand(alias, session, options);
diff --git a/src/claude/commands/cmux/send.ts b/src/claude/commands/cmux/send.ts
index 4e778e54f6..2ad8ec7057 100644
--- a/src/claude/commands/cmux/send.ts
+++ b/src/claude/commands/cmux/send.ts
@@ -362,7 +362,7 @@ function report({ opts, query, target, surfaceId, enter, source }: SendReport):
     }
 
     out.printlnErr(
-        `${pc.green("√")} sent to ${pc.bold(target.workspaceName)} ${pc.dim(target.paneId)} ` +
+        `${pc.green("✔")} sent to ${pc.bold(target.workspaceName)} ${pc.dim(target.paneId)} ` +
             pc.dim(`${surfaceId} (matched on ${describeMatch(target)})`)
     );
 }
diff --git a/src/utils/ai/transcripts/turn-state.test.ts b/src/utils/ai/transcripts/turn-state.test.ts
index fca492ab70..a220dcc344 100644
--- a/src/utils/ai/transcripts/turn-state.test.ts
+++ b/src/utils/ai/transcripts/turn-state.test.ts
@@ -225,6 +225,33 @@ describe("codexTurnState", () => {
         expect(finished.lastEventAt).toBe(T0 + 4000);
     });
 
+    it("carries the error a turn ended with, and the next turn clears it", () => {
+        const failed = [
+            codexLine(0, "event_msg", { type: "task_started" }),
+            codexLine(1, "event_msg", {
+                type: "task_complete",
+                last_agent_message: null,
+                error: { message: "Error running remote compaction" },
+            }),
+        ];
+        const ended = codexTurnState(input(failed, 60));
+        const next = codexTurnState(
+            input(
+                [
+                    ...failed,
+                    codexLine(2, "event_msg", { type: "task_started" }),
+                    codexLine(3, "event_msg", { type: "task_complete", last_agent_message: "Shipped." }),
+                ],
+                60
+            )
+        );
+
+        expect(ended.state).toBe("AWAITING-INPUT");
+        expect(ended.turnError).toBe("Error running remote compaction");
+        expect(next.turnError).toBeNull();
+        expect(next.lastText).toBe("Shipped.");
+    });
+
     it("stays finished through settings bookkeeping, and only a record of a new turn reopens it", () => {
         const done = [
             codexLine(0, "event_msg", { type: "task_started" }),
@@ -308,6 +335,8 @@ describe("readTurnState", () => {
 
         expect(snap?.state).toBe("AWAITING-INPUT");
         expect(snap?.lastText).toBe("hi");
+        expect(snap?.tailStartOffset).toBe(0);
+        expect(snap?.earliestTailEventAt).toBe(T0);
         expect(readTurnState("claude", empty, { stallTimeoutMs: 900_000 })).toBeNull();
         expect(readTurnState("claude", join(dir, "missing.jsonl"), { stallTimeoutMs: 900_000 })).toBeNull();
     });
diff --git a/src/utils/ai/transcripts/turn-state.ts b/src/utils/ai/transcripts/turn-state.ts
index 32c03a3bf2..c3de888897 100644
--- a/src/utils/ai/transcripts/turn-state.ts
+++ b/src/utils/ai/transcripts/turn-state.ts
@@ -54,6 +54,11 @@ export interface TurnSnapshot {
     question: string | null;
     /** True when the user stopped the turn (Esc in Claude, `turn_aborted` in Codex). The turn has ended. */
     interrupted: boolean;
+    /**
+     * The error the turn ended with, else null: Codex writes it on `task_complete` (an API outage, a failed remote
+     * compaction, a model at capacity). The turn ended without doing its work, so callers must not read it as done.
+     */
+    turnError: string | null;
     /** Epoch ms of the newest turn-level record. Null when the tail holds none. Grows when a turn ends. */
     lastEventAt: number | null;
     /**
@@ -68,6 +73,10 @@ export interface TurnSnapshot {
      * that opened after a send starts at or past the size the file had before it.
      */
     turnStartOffset?: number;
+    /** Byte offset of the first whole line in the disk tail. Absent for readers without a byte window. */
+    tailStartOffset?: number;
+    /** Earliest retained activity event, used to fence a turn whose opening record left the tail. */
+    earliestTailEventAt?: number;
     /** The newer of `lastEventAt` and the file's modification time. */
     lastActivityAt: number;
     /** `now` minus `lastActivityAt`. */
@@ -264,6 +273,7 @@ function snapshotOf({
     question = null,
     endedTurn,
     interrupted = false,
+    turnError = null,
     turnStartedAt,
     turnStartOffset,
     calls,
@@ -275,6 +285,7 @@ function snapshotOf({
     question?: string | null;
     endedTurn: boolean;
     interrupted?: boolean;
+    turnError?: string | null;
     turnStartedAt: number | null;
     turnStartOffset?: number;
     calls: TurnCalls;
@@ -295,7 +306,9 @@ function snapshotOf({
         asksQuestion,
         question,
         interrupted,
+        turnError,
         lastEventAt,
+        ...(events.length > 0 ? { earliestTailEventAt: Math.min(...events.map((event) => event.ts)) } : {}),
         turnStartedAt,
         ...(turnStartOffset !== undefined ? { turnStartOffset } : {}),
         lastActivityAt,
@@ -702,6 +715,7 @@ export function codexTurnState(input: TurnStateInput): TurnSnapshot {
     let message = "";
     let ended = false;
     let aborted = false;
+    let turnError: string | null = null;
     let question: string | null = null;
     // call_id → question text of a `request_user_input` with no `function_call_output` yet.
     const open = new Map<string, string>();
@@ -722,6 +736,10 @@ export function codexTurnState(input: TurnStateInput): TurnSnapshot {
         if (record.type === "event_msg" && (parsed.type === "task_complete" || parsed.type === "turn_aborted")) {
             ended = true;
             aborted = parsed.type === "turn_aborted";
+            // 2026-10-14: a worker whose remote compaction failed ended every turn at once with this error, and
+            // `tools codex wait` reported each one as done.
+            const failure = parsed.payload.error;
+            turnError = isRecord(failure) && typeof failure.message === "string" ? failure.message : null;
             calls.end();
             events.push({ ts, kind: "question" });
 
@@ -788,6 +806,7 @@ export function codexTurnState(input: TurnStateInput): TurnSnapshot {
 
         ended = false;
         aborted = false;
+        turnError = null;
         events.push({ ts, kind: "output" });
     }
 
@@ -801,6 +820,7 @@ export function codexTurnState(input: TurnStateInput): TurnSnapshot {
         question: question || null,
         endedTurn: ended || waiting,
         interrupted: aborted,
+        turnError: ended ? turnError : null,
         turnStartedAt,
         calls,
     });
@@ -948,13 +968,16 @@ export function readTurnState(
             from = end + 1;
         }
 
-        return turnStateOf(provider, {
-            records,
-            offsets,
-            lastModified: stat.mtimeMs,
-            now,
-            stallTimeoutMs: options.stallTimeoutMs,
-        });
+        return {
+            ...turnStateOf(provider, {
+                records,
+                offsets,
+                lastModified: stat.mtimeMs,
+                now,
+                stallTimeoutMs: options.stallTimeoutMs,
+            }),
+            tailStartOffset: tail.start,
+        };
     } catch (err) {
         logger.debug({ err, filePath, provider }, "[transcripts] could not read the turn state of a transcript");
         return null;
diff --git a/src/utils/ai/transcripts/turn-wait.test.ts b/src/utils/ai/transcripts/turn-wait.test.ts
index 7a2224e72f..81c959f7ce 100644
--- a/src/utils/ai/transcripts/turn-wait.test.ts
+++ b/src/utils/ai/transcripts/turn-wait.test.ts
@@ -1,11 +1,11 @@
-import { describe, expect, it } from "bun:test";
+import { describe, expect, it, spyOn } from "bun:test";
 import { appendFileSync, mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { SafeJSON } from "@genesiscz/utils/json";
 import type { ActivityState } from "./activity";
 import type { TurnSnapshot } from "./turn-state";
-import { codexTurnState, grokTurnState, readTurnState } from "./turn-state";
+import { codexTurnState, grokTurnState, readTurnState, TURN_TAIL_BYTES } from "./turn-state";
 import { looksLikeQuestion, questionOf, TRANSCRIPT_GONE_MS, turnAnswers, waitForTurn, watchTurn } from "./turn-wait";
 
 function snap(state: ActivityState, lastEventAt: number | null, turnStartedAt: number | null = null): TurnSnapshot {
@@ -15,6 +15,7 @@ function snap(state: ActivityState, lastEventAt: number | null, turnStartedAt: n
         asksQuestion: false,
         question: null,
         interrupted: false,
+        turnError: null,
         lastEventAt,
         turnStartedAt,
         lastActivityAt: 0,
@@ -45,6 +46,60 @@ function clock(): { now: () => number; sleep: (ms: number) => Promise<void> } {
     };
 }
 
+describe("round 33 tail-only answering turns", () => {
+    const sentAt = Date.parse("2026-10-17T12:00:00Z");
+    const line = (at: number, payload: Record<string, unknown>): string =>
+        `${SafeJSON.stringify({ timestamp: new Date(at).toISOString(), type: "event_msg", payload })}\n`;
+
+    it.each(["bytes", "newer", "after"] as const)("accepts a long answer under a %s fence", async (fence) => {
+        const file = join(mkdtempSync(join(tmpdir(), "answer-tail-")), "rollout.jsonl");
+        const baseline = line(sentAt - 1000, { type: "task_complete", last_agent_message: "previous" });
+        const middle = line(sentAt + 2000, { type: "agent_message", message: "x".repeat(1024) });
+        writeFileSync(
+            file,
+            baseline +
+                line(sentAt + 1000, { type: "task_started" }) +
+                middle.repeat(Math.ceil(TURN_TAIL_BYTES / middle.length) + 5) +
+                line(sentAt + 3000, { type: "task_complete", last_agent_message: "long answer" })
+        );
+        const read = () => readTurnState("codex", file, { now: sentAt + 4000, stallTimeoutMs: 60_000 });
+        expect(read()?.turnStartedAt).toBeNull();
+        const options =
+            fence === "bytes"
+                ? { openedFromByte: Buffer.byteLength(baseline), turnNewerThan: sentAt }
+                : fence === "newer"
+                  ? { turnNewerThan: sentAt }
+                  : { turnStartedAfter: sentAt };
+        const result = await waitForTurn({ read, ...options, ...clock(), pollMs: 100, timeoutMs: 200 });
+        expect(result.outcome).toBe("done");
+        expect(result.snapshot?.lastText).toBe("long answer");
+    });
+
+    it.each(["bytes", "newer", "after"] as const)(
+        "rejects a tail overlapping the send under a %s fence",
+        async (fence) => {
+            const file = join(mkdtempSync(join(tmpdir(), "predecessor-tail-")), "rollout.jsonl");
+            const old = line(sentAt - 1000, { type: "agent_message", message: "x".repeat(1024) });
+            const beforeSend =
+                line(sentAt - 2000, { type: "task_started" }) + old.repeat(Math.ceil(TURN_TAIL_BYTES / old.length) + 5);
+            writeFileSync(
+                file,
+                beforeSend + line(sentAt + 1000, { type: "task_complete", last_agent_message: "previous" })
+            );
+            const read = () => readTurnState("codex", file, { now: sentAt + 2000, stallTimeoutMs: 60_000 });
+            expect(read()?.turnStartedAt).toBeNull();
+            const options =
+                fence === "bytes"
+                    ? { openedFromByte: Buffer.byteLength(beforeSend), turnNewerThan: sentAt }
+                    : fence === "newer"
+                      ? { turnNewerThan: sentAt }
+                      : { turnStartedAfter: sentAt };
+            const result = await waitForTurn({ read, ...options, ...clock(), pollMs: 100, timeoutMs: 200 });
+            expect(result.outcome).toBe("timeout");
+        }
+    );
+});
+
 describe("waitForTurn", () => {
     it("returns at once when the turn is already idle", async () => {
         const reader = script(snap("AWAITING-INPUT", 100));
@@ -146,6 +201,27 @@ describe("waitForTurn", () => {
         expect(result.snapshot?.lastEventAt).toBe(180);
     });
 
+    it("with turnStartedAfter, a silent turn that began before the send is not a stall of the answer", async () => {
+        // An idle session whose last turn never wrote its end reads STALLED; the message starts a new turn seconds later.
+        const reader = script(
+            snap("STALLED", 40, 30),
+            snap("STALLED", 40, 30),
+            snap("RUNNING", 130, 120),
+            snap("AWAITING-INPUT", 180, 120)
+        );
+        const result = await waitForTurn({ read: reader.read, turnStartedAfter: 110, pollMs: 1000, ...clock() });
+
+        expect(result.outcome).toBe("done");
+        expect(result.snapshot?.lastEventAt).toBe(180);
+    });
+
+    it("with turnStartedAfter, the answering turn that goes silent is still a stall", async () => {
+        const reader = script(snap("RUNNING", 130, 120), snap("STALLED", 130, 120));
+        const result = await waitForTurn({ read: reader.read, turnStartedAfter: 110, pollMs: 1000, ...clock() });
+
+        expect(result.outcome).toBe("stalled");
+    });
+
     it("with turnNewerThan, the turn that was current before the send is not the answer even inside the tolerance", async () => {
         // The send was at 110 with 20 ms of tolerance; the previous turn began at 100 and was still running.
         const reader = script(
@@ -203,8 +279,13 @@ describe("waitForTurn", () => {
         expect(turnAnswers(second, window, undefined)).toBe(false);
     });
 
-    it("with turnStartedAfter, a turn whose start is outside the tail still counts", async () => {
-        const reader = script(snap("RUNNING", 90, null), snap("AWAITING-INPUT", 100, null));
+    it("with turnStartedAfter, an unknown predecessor never counts before an identifiable answer", async () => {
+        const reader = script(
+            snap("RUNNING", 90, null),
+            snap("AWAITING-INPUT", 100, null),
+            snap("RUNNING", 130, 120),
+            snap("AWAITING-INPUT", 180, 120)
+        );
         const result = await waitForTurn({
             read: reader.read,
             next: true,
@@ -214,6 +295,8 @@ describe("waitForTurn", () => {
         });
 
         expect(result.outcome).toBe("done");
+        expect(result.snapshot?.turnStartedAt).toBe(120);
+        expect(result.waitedMs).toBe(2000);
     });
 
     it("with next, a turn that ends in the baseline's second still counts once it was seen running", async () => {
@@ -454,3 +537,59 @@ describe("watchTurn deadline", () => {
         expect(Date.now() - started).toBeLessThan(2_000);
     });
 });
+
+describe("round 33 fenced wait bounds", () => {
+    it.each([30, null])("bounds a permanently stalled predecessor with turn start %s", async (turnStart) => {
+        let time = 0;
+        const result = await waitForTurn({
+            read: () => snap("STALLED", 40, turnStart),
+            turnStartedAfter: 110,
+            pollMs: 31 * 60_000,
+            now: () => time,
+            sleep: async (ms) => {
+                time += ms;
+                if (time > 2 * 60 * 60_000) {
+                    throw new Error("the fenced wait has no finite default deadline");
+                }
+            },
+        });
+        expect(result.outcome).toBe("timeout");
+        expect(result.waitedMs).toBe(30 * 60_000);
+    });
+
+    it("an explicit shorter deadline also bounds an unknown finished predecessor", async () => {
+        const result = await waitForTurn({
+            read: () => snap("FINISHED", 100, null),
+            turnNewerThan: 100,
+            timeoutMs: 2500,
+            pollMs: 1000,
+            ...clock(),
+        });
+        expect(result.outcome).toBe("timeout");
+        expect(result.waitedMs).toBe(2500);
+    });
+
+    it.each([30, null])("arms the same finite default deadline for the watcher, turn start %s", async (turnStart) => {
+        const file = join(mkdtempSync(join(tmpdir(), "fenced-watch-")), "stalled.jsonl");
+        writeFileSync(file, "{}\n");
+        const delays: Array<number | undefined> = [];
+        const original = globalThis.setTimeout;
+        const timers = spyOn(globalThis, "setTimeout").mockImplementation(((callback: () => void, ms?: number) => {
+            delays.push(ms);
+            return original(callback, ms === 30 * 60_000 ? 10 : ms);
+        }) as typeof setTimeout);
+        try {
+            const result = await watchTurn({
+                path: file,
+                read: () => snap("STALLED", 40, turnStart),
+                turnStartedAfter: 110,
+                pollMs: 20_000,
+                signal: AbortSignal.timeout(1000),
+            });
+            expect(result.outcome).toBe("timeout");
+            expect(delays).toContain(30 * 60_000);
+        } finally {
+            timers.mockRestore();
+        }
+    });
+});
diff --git a/src/utils/ai/transcripts/turn-wait.ts b/src/utils/ai/transcripts/turn-wait.ts
index ec2008bc7d..de9261310a 100644
--- a/src/utils/ai/transcripts/turn-wait.ts
+++ b/src/utils/ai/transcripts/turn-wait.ts
@@ -71,6 +71,45 @@ function endedTurn(snapshot: TurnSnapshot): boolean {
  *  the file was deleted) ends the wait as `stalled`: no write can ever wake it again. */
 export const TRANSCRIPT_GONE_MS = 30_000;
 
+/** A queued answering turn must become identifiable within 30 minutes unless the caller supplies a deadline. */
+export const DEFAULT_FENCED_TIMEOUT_MS = 30 * 60_000;
+
+interface AnswerFence {
+    turnStartedAfter?: number;
+    turnNewerThan?: number;
+    openedFromByte?: number;
+}
+
+function hasAnswerFence(options: AnswerFence): boolean {
+    return (
+        options.turnStartedAfter !== undefined ||
+        options.turnNewerThan !== undefined ||
+        options.openedFromByte !== undefined
+    );
+}
+
+/** When the opening record left the tail, the whole retained window must be after the send. */
+function tailAnswers(snapshot: TurnSnapshot, fence: AnswerFence): boolean {
+    if (!hasAnswerFence(fence)) {
+        return true;
+    }
+
+    if (fence.openedFromByte !== undefined) {
+        return snapshot.tailStartOffset !== undefined && snapshot.tailStartOffset >= fence.openedFromByte;
+    }
+
+    const earliest = snapshot.earliestTailEventAt;
+    return (
+        earliest !== undefined &&
+        (fence.turnNewerThan === undefined || earliest > fence.turnNewerThan) &&
+        (fence.turnStartedAfter === undefined || earliest > fence.turnStartedAfter)
+    );
+}
+
+function waitTimeout(options: AnswerFence & { timeoutMs?: number }): number | undefined {
+    return options.timeoutMs ?? (hasAnswerFence(options) ? DEFAULT_FENCED_TIMEOUT_MS : undefined);
+}
+
 export class TurnJudge {
     readonly questions: string[] = [];
     private snapshot: TurnSnapshot | null = null;
@@ -118,12 +157,12 @@ export class TurnJudge {
 
         const isNew =
             !this.options.next || this.sawRunning || (snapshot.lastEventAt ?? 0) > (this.options.baselineEnd ?? 0);
-        // A turn whose start is outside the tail (null) cannot be told apart, so it counts, as it did before.
-        // This also keeps the running-turn rule above honest for `message --wait`: seeing the turn that was
-        // already running when the message was sent makes its end "new", but it did not begin after the send.
+        // A missing opening record needs proof that the whole tail follows the send; an overlapping
+        // predecessor remains unconfirmed, while an answer longer than the tail can still finish.
         const answering =
-            snapshot.turnStartedAt === null ||
-            turnAnswers(snapshot.turnStartedAt, this.options, snapshot.turnStartOffset);
+            snapshot.turnStartedAt === null
+                ? tailAnswers(snapshot, this.options)
+                : turnAnswers(snapshot.turnStartedAt, this.options, snapshot.turnStartOffset);
 
         if (ended && isNew && answering) {
             return this.result("done");
@@ -135,7 +174,9 @@ export class TurnJudge {
             this.questions.push(question);
         }
 
-        return snapshot.state === "STALLED" ? this.result("stalled") : null;
+        // Only the answering turn can stall: the silence of a turn from before the send (an idle session whose
+        // last turn never wrote its end) said STALLED at once on 2026-10-15, seconds before the reply began.
+        return snapshot.state === "STALLED" && answering ? this.result("stalled") : null;
     }
 
     result(outcome: TurnWaitOutcome): TurnWaitResult {
@@ -191,7 +232,7 @@ export interface WaitForTurnOptions {
     /** The transcript's byte size before the send: a turn that began in the same instant as `turnNewerThan` counts
      *  when it opened at or past it (see `turnAnswers`). */
     openedFromByte?: number;
-    /** Give up after this long. Undefined waits for ever. */
+    /** Give up after this long. Fenced waits default to 30 minutes; unfenced waits may wait indefinitely. */
     timeoutMs?: number;
     /** Time between two reads. */
     pollMs: number;
@@ -251,7 +292,8 @@ export async function waitForTurn(options: WaitForTurnOptions): Promise<TurnWait
         openedFromByte: options.openedFromByte,
         now,
     });
-    const deadline = options.timeoutMs === undefined ? Number.POSITIVE_INFINITY : now() + options.timeoutMs;
+    const timeoutMs = waitTimeout(options);
+    const deadline = timeoutMs === undefined ? Number.POSITIVE_INFINITY : now() + timeoutMs;
 
     while (true) {
         const snapshot = options.read();
@@ -305,7 +347,8 @@ export async function watchTurn(options: WatchTurnOptions): Promise<TurnWaitResu
     // The watcher checks its deadline only on a write or a poll, so a quiet transcript would overrun
     // `--timeout` by up to one poll. A timer aborts it on time instead.
     const deadline = new AbortController();
-    const timer = options.timeoutMs === undefined ? null : setTimeout(() => deadline.abort(), options.timeoutMs);
+    const timeoutMs = waitTimeout(options);
+    const timer = timeoutMs === undefined ? null : setTimeout(() => deadline.abort(), timeoutMs);
     const signals = options.signal ? [deadline.signal, options.signal] : [deadline.signal];
 
     try {
diff --git a/src/utils/shell/rules/biome.ts b/src/utils/shell/rules/biome.ts
new file mode 100644
index 0000000000..80eeecb078
--- /dev/null
+++ b/src/utils/shell/rules/biome.ts
@@ -0,0 +1,111 @@
+// `biome lint|check --write --unsafe` (or `--fix --unsafe`, or 1.x `--apply-unsafe`).
+//
+// The unsafe fix for `noUnusedImports` deletes the import together with the comment
+// attached above it, and that comment is often the file's header. Nothing in the
+// output says a comment went: Biome reports "Fixed N files". On 2026-10-14 a sweep run
+// with `--only=correctness/noUnusedImports --write --unsafe` deleted the 27-line header
+// of a benchmark script and a 12-line header of another; only a review of the diff
+// caught it. The safe fixes never delete comments, so the command without `--unsafe`
+// is the corrected form, and an unused import is removed by hand.
+
+import { commandTokenIndex, commandWord, originalSlice, rawToken, splitPipeline, tokenize } from "../scan";
+import type { ShellMatch, ShellRule } from "./types";
+
+/** Runners that start the next word as the command: `bunx biome`, `npx biome`, `pnpm biome`. */
+const RUNNERS = new Set(["bunx", "npx", "pnpx", "pnpm", "yarn"]);
+const EXEC_RUNNERS = new Set(["yarn", "pnpm", "npm"]);
+const BIOME = new Set(["biome", "@biomejs/biome"]);
+const UNSAFE = new Set(["--unsafe", "--apply-unsafe"]);
+
+/** The index of the `biome` word among the args after the command, or -1. */
+function biomeIndex(word: string, args: string[]): number {
+    if (BIOME.has(word)) {
+        return -1;
+    }
+
+    if (RUNNERS.has(word) && BIOME.has(commandWord(args[0] ?? ""))) {
+        return 0;
+    }
+
+    if (EXEC_RUNNERS.has(word) && args[0] === "exec") {
+        const index = args[1] === "--" ? 2 : 1;
+        if (BIOME.has(commandWord(args[index] ?? ""))) {
+            return index;
+        }
+    }
+
+    // `bun x biome …`
+    if (word === "bun" && args[0] === "x" && BIOME.has(commandWord(args[1] ?? ""))) {
+        return 1;
+    }
+
+    return -2;
+}
+
+export const biomeUnsafeDeletesComments: ShellRule = {
+    id: "biome-unsafe-deletes-comments",
+    kind: "destructive",
+    title: "biome --write --unsafe deletes the comment above every import it removes",
+    severity: "block",
+    why:
+        "Biome's unsafe fix for noUnusedImports removes the import with its leading comment, which is often the " +
+        'file header, and reports only "Fixed N files". The safe fixes never delete comments. Run the command ' +
+        "without --unsafe, then remove each import it lists as unused by hand, keeping the comment above it.",
+    wrong: "bunx biome lint --only=correctness/noUnusedImports --write --unsafe src",
+    right: "bunx biome lint --only=correctness/noUnusedImports src   # then delete the listed imports by hand",
+    evidence:
+        "2026-10-14: a path sweep ran the unsafe fix over 98 files; it deleted a 27-line header in " +
+        "scripts/benchmarks/ai-usage/poll-duty.ts and a 12-line header in perf-report.ts. A history scan found " +
+        "the same loss shape in earlier commits.",
+    detect(scan): ShellMatch | null {
+        for (const statements of scan.units) {
+            for (const statement of statements) {
+                if (!statement.text.includes("biome")) {
+                    continue;
+                }
+
+                for (const element of splitPipeline(statement)) {
+                    const tokens = tokenize(element);
+                    const cmd = commandTokenIndex(tokens);
+
+                    if (cmd === -1) {
+                        continue;
+                    }
+
+                    const word = commandWord(tokens[cmd].text);
+                    const args = tokens.slice(cmd + 1).map((token) => rawToken(scan.command, token));
+
+                    if (biomeIndex(word, args) === -2) {
+                        continue;
+                    }
+
+                    const unsafe = args.flatMap((arg, index) => (UNSAFE.has(arg.split("=")[0]) ? [index] : []));
+
+                    if (unsafe.length === 0) {
+                        continue;
+                    }
+
+                    const matched = originalSlice(scan, tokens[cmd].start, element.start + element.text.length);
+                    let suggestion = scan.command;
+                    // Edit right to left to retain the original offsets and all unrelated shell text.
+                    for (const index of unsafe.toReversed()) {
+                        const flag = tokens[cmd + 1 + index];
+                        // Biome 1.x's legacy option becomes its safe equivalent, retaining any explicit value.
+                        const replacement = args[index].startsWith("--apply-unsafe")
+                            ? args[index].replace("--apply-unsafe", "--apply")
+                            : "";
+                        const before = suggestion.slice(0, flag.start).trimEnd();
+                        const after = suggestion.slice(flag.start + flag.text.length);
+                        suggestion = replacement ? `${before} ${replacement}${after}` : `${before}${after}`;
+                    }
+
+                    return { matched, index: tokens[cmd].start, suggestion };
+                }
+            }
+        }
+
+        return null;
+    },
+};
+
+export const biomeRules: readonly ShellRule[] = [biomeUnsafeDeletesComments];
diff --git a/src/utils/shell/rules/index.ts b/src/utils/shell/rules/index.ts
index ad52d2ef08..58286591f4 100644
--- a/src/utils/shell/rules/index.ts
+++ b/src/utils/shell/rules/index.ts
@@ -13,6 +13,7 @@
 // `suggestion` is the caller's command corrected, offered, never applied.
 
 import { type ShellScan, scanShell } from "../scan";
+import { biomeRules } from "./biome";
 import { destructiveRules } from "./destructive";
 import { devnullRules } from "./devnull";
 import { findRules } from "./find";
@@ -36,6 +37,7 @@ export const SHELL_RULES: readonly ShellRule[] = [
     ...zshRules,
     ...swiftpmRules,
     ...destructiveRules,
+    ...biomeRules,
 ];
 
 export function ruleById(id: string): ShellRule | undefined {
diff --git a/src/utils/shell/rules/rules.test.ts b/src/utils/shell/rules/rules.test.ts
index b5fa729bf2..740fa01a33 100644
--- a/src/utils/shell/rules/rules.test.ts
+++ b/src/utils/shell/rules/rules.test.ts
@@ -3,6 +3,7 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { scanShell } from "../scan";
+import { biomeRules } from "./biome";
 import { detectShellViolations, renderViolation, renderViolations, ruleById, SHELL_RULES } from "./index";
 import { swiftpmRules, swiftpmStalePlan } from "./swiftpm";
 
@@ -53,10 +54,11 @@ describe("the registry", () => {
         }
     });
 
-    it("holds the fourteen general rules; personal ones load from guard.customRules", () => {
+    it("holds the fifteen general rules; personal ones load from guard.customRules", () => {
         expect(SHELL_RULES.map((r) => r.id).sort()).toEqual(
             [
                 "bare-log-command",
+                "biome-unsafe-deletes-comments",
                 "docker-volume-destroy",
                 "exit-code-after-grep",
                 "exit-code-after-pipeline",
@@ -373,3 +375,63 @@ describe("swiftpm-stale-plan", () => {
         expect(fires(`swift test --package-path ${join(root, "missing")}`)).toBe(false);
     });
 });
+
+describe("biome-unsafe-deletes-comments", () => {
+    const fired = (command: string) =>
+        detectShellViolations(command, biomeRules).map((violation) => violation.suggestion ?? violation.ruleId);
+
+    it("blocks the unsafe fix through every runner and drops only the flag", () => {
+        expect(fired("bunx biome lint --only=correctness/noUnusedImports --write --unsafe src")).toEqual([
+            "bunx biome lint --only=correctness/noUnusedImports --write src",
+        ]);
+        expect(fired("cd app && npx @biomejs/biome check --fix --unsafe .")).toEqual([
+            "cd app && npx @biomejs/biome check --fix .",
+        ]);
+        expect(fired("bun x biome check --write --unsafe a.ts | tail -3")).toEqual([
+            "bun x biome check --write a.ts | tail -3",
+        ]);
+        expect(fired("./node_modules/.bin/biome check --apply-unsafe src")).toEqual([
+            "./node_modules/.bin/biome check --apply src",
+        ]);
+    });
+
+    it.each([
+        ["bunx biome check --write --unsafe --unsafe src", "bunx biome check --write src"],
+        ["bunx biome check --apply-unsafe --unsafe src", "bunx biome check --apply src"],
+        ["bunx biome check --write --unsafe src --unsafe", "bunx biome check --write src"],
+        [
+            "bunx biome check src --apply-unsafe --unsafe --apply-unsafe --verbose",
+            "bunx biome check src --apply --apply --verbose",
+        ],
+        ["bunx biome check --write --unsafe=true src --unsafe=false", "bunx biome check --write src"],
+        [
+            "bunx biome check --apply-unsafe=true src --unsafe --apply-unsafe=false",
+            "bunx biome check --apply=true src --apply=false",
+        ],
+        [
+            "cd app && bunx biome check --write --unsafe 'src/with space' --verbose --unsafe 2>&1 | tail -3",
+            "cd app && bunx biome check --write 'src/with space' --verbose 2>&1 | tail -3",
+        ],
+    ])("removes every unsafe option while preserving the other arguments in %s", (command, expected) => {
+        const suggestions = fired(command);
+        expect(suggestions).toEqual([expected]);
+        expect(suggestions[0]).not.toMatch(/--(?:unsafe|apply-unsafe)(?:[=\s]|$)/);
+        expect(fired(expected)).toEqual([]);
+    });
+
+    it.each(["yarn exec", "pnpm exec", "npm exec", "npm exec --"])("blocks unsafe Biome fixes through %s", (runner) => {
+        expect(fired(`${runner} biome lint --write --unsafe src`)).toEqual([`${runner} biome lint --write src`]);
+        expect(fired(`${runner} @biomejs/biome check src --apply-unsafe --unsafe`)).toEqual([
+            `${runner} @biomejs/biome check src --apply`,
+        ]);
+        expect(fired(`${runner} eslint --fix --unsafe src`)).toEqual([]);
+        expect(fired(`${runner} biome check --write src`)).toEqual([]);
+    });
+
+    it("leaves the safe fixes and other tools alone", () => {
+        expect(fired("bunx biome check --write src")).toEqual([]);
+        expect(fired("bunx biome lint --only=correctness/noUnusedImports src")).toEqual([]);
+        expect(fired("bunx eslint --fix --unsafe src")).toEqual([]);
+        expect(fired('rg -n "biome --unsafe" docs')).toEqual([]);
+    });
+});