You are a constitutional council ranking individual git commits for ownership allocation.

Compare these two commits. Decide which contributed more lasting value to the project.

Judge substance, not spectacle:
- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.
- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.
- Do not favor a side merely because its patch is longer or noisier.
- Weight what the change does for the project, not the contributor's name.

Return ONLY a JSON object: {"winner": "A" or "B", "ratio": "N:M", "explanation": "..."}
The explanation must cite concrete differences in the patches (1-3 sentences).

Side A — contributor: tommy-mor
Side A — commit message:
[1efb7222] multi-repository git discovery

Make contribution discovery deterministic across repository and branch DAGs, with replayable attribution and adversarial coverage.

Co-authored-by: Cursor <cursoragent@cursor.com>

Side A — unified diff (full patch):
diff --git a/constitution.py b/constitution.py
index b535faad658c553b3b9046e2401333618e212150..4bee9f83663ab7fb36db95129b92b64b4ef57258 100644
--- a/constitution.py
+++ b/constitution.py
@@ -6,7 +6,7 @@
 #   "uvicorn",
 #   "httpx",
 #   "tenacity",
-#   "evaleval>=0.2.6",
+#   "evaleval==0.2.7",
 #   "authlib",
 #   "itsdangerous",
 #   "starlette",
@@ -29,7 +29,7 @@ from datetime import datetime, timezone
 from fastapi import FastAPI, Request, Response
 from fastapi.responses import PlainTextResponse, HTMLResponse
 from starlette.middleware.sessions import SessionMiddleware
-import json, time, os, asyncio, httpx, pathlib
+import json, time, os, asyncio, httpx, pathlib, subprocess, hashlib, re, fcntl
 import sympy as sp  # type: ignore[reportMissingImports]
 from tenacity import retry, retry_if_exception, stop_after_attempt, wait_exponential
 from evaleval import (
@@ -118,11 +118,35 @@ JSONL_PATH = pathlib.Path(os.environ.get("JSONL_PATH", "/data/ledger.jsonl"))
 
 GITHUB_CLIENT_ID = os.environ.get("GITHUB_CLIENT_ID", "")
 GITHUB_CLIENT_SECRET = os.environ.get("GITHUB_CLIENT_SECRET", "")
-REPO = os.environ.get("REPO", "tommy-mor/slug")
 
 OPENROUTER_API_KEY = os.environ.get("OPENROUTER_API_KEY", "")
 OPENROUTER_BASE_URL = os.environ.get("OPENROUTER_BASE_URL", "https://openrouter.ai").rstrip("/")
-GITHUB_API_BASE_URL = os.environ.get("GITHUB_API_BASE_URL", "https://api.github.com").rstrip("/")
+
+# Repositories, branches, and contributor identities are constitutional inputs.
+# A ref pattern matches a complete Git ref: * stays within one path component,
+# while ** crosses slashes, so refs/heads/** includes branches on branches.
+# Environment overrides exist for deterministic integration tests and deployments
+# using the exact same source; their normalized values are committed to every
+# discovery event.
+DEFAULT_REPOSITORIES = [
+    {
+        "id": "slug",
+        "url": "https://github.com/tommy-mor/slug.git",
+        "refs": ["refs/heads/**"],
+    },
+]
+DEFAULT_CONTRIBUTORS = {
+    "tommy-mor": ["thmorriss@gmail.com"],
+}
+
+REPOSITORIES = json.loads(
+    os.environ.get("REPOSITORIES_JSON", json.dumps(DEFAULT_REPOSITORIES))
+)
+CONTRIBUTORS = json.loads(
+    os.environ.get("CONTRIBUTORS_JSON", json.dumps(DEFAULT_CONTRIBUTORS))
+)
+GIT_MIRROR_DIR = pathlib.Path(os.environ.get("GIT_MIRROR_DIR", "/data/git"))
+GIT_TIMEOUT_SECONDS = int(os.environ.get("GIT_TIMEOUT_SECONDS", "120"))
 
 # Council model IDs: slug.social garden rank under this parent (bodies = OpenRouter URLs), then top-up from OpenRouter list.
 SLUG_SOCIAL_BASE_URL = os.environ.get("SLUG_SOCIAL_BASE_URL", "https://slug.social").rstrip("/")
@@ -146,6 +170,7 @@ class Emission:
     distributions: dict   # author -> amount str
     ranking: dict         # author -> score str
     models_used: list
+    discovery_snapshot_id: str = ""  # empty only for pre-discovery ledger history
 
 
 @event
@@ -163,6 +188,20 @@ class Redemption:
     amount: str
 
 
+@event
+class GitDiscovery:
+    schema_version: int
+    epoch: int
+    snapshot_id: str
+    timestamp_ms: int
+    config_digest: str
+    initial_snapshot: bool
+    configuration: dict
+    repositories: list
+    observations: list
+    commits: list
+
+
 store = JsonlStore(JSONL_PATH)
 
 
@@ -532,44 +571,426 @@ Side B — unified diffs (full patches):
         return json.loads(content)
 
 
-def _github_headers():
-    h = {"Accept": "application/vnd.github+json"}
-    tok = os.environ.get("GITHUB_TOKEN", "")
-    if tok:
-        h["Authorization"] = f"Bearer {tok}"
-    return h
+# ===========================================================================
+# §4b. GIT DISCOVERY — immutable reachability snapshots across repositories
+# ===========================================================================
+#
+# Git timestamps cannot prove when a branch first reached a commit. The first
+# snapshot therefore bootstraps history by committer time at GENESIS_MS. Every
+# later snapshot uses the stronger rule: a commit enters exactly once, when it
+# first becomes reachable from the union of configured refs.
+#
+# OIDs are deduplicated globally, then equivalent cherry-picks are deduplicated
+# by Git's stable patch identity. Merges and empty commits are graph structure,
+# not separately priced contributions. Discovery is all-or-nothing: if any
+# repository cannot be mirrored and verified, no snapshot is appended.
+
+GIT_DISCOVERY_SCHEMA_VERSION = 1
+PATCH_IDENTITY_VERSION = "git-patch-id-stable-v1"
+_DISCOVERY_LOCK = asyncio.Lock()
+
+
+def _normalized_discovery_config() -> dict:
+    repositories = []
+    seen_ids = set()
+    for raw in REPOSITORIES:
+        repo_id = str(raw.get("id", ""))
+        url = str(raw.get("url", ""))
+        refs = sorted(set(str(x) for x in raw.get("refs", [])))
+        if not re.fullmatch(r"[A-Za-z0-9._-]+", repo_id):
+            raise ValueError(f"invalid repository id: {repo_id!r}")
+        if repo_id in seen_ids:
+            raise ValueError(f"duplicate repository id: {repo_id}")
+        if not url or not refs or any(not r.startswith("refs/") for r in refs):
+            raise ValueError(f"repository {repo_id} requires a URL and full ref patterns")
+        seen_ids.add(repo_id)
+        repositories.append({"id": repo_id, "url": url, "refs": refs})
+
+    email_to_contributor = {}
+    contributors = {}
+    for contributor, emails in sorted(CONTRIBUTORS.items()):
+        contributor = str(contributor)
+        normalized = sorted(set(str(e).strip().lower() for e in emails))
+        if not contributor or not normalized:
+            raise ValueError("contributors require an id and at least one email")
+        for email in normalized:
+            if email in email_to_contributor:
+                raise ValueError(f"email belongs to multiple contributors: {email}")
+            email_to_contributor[email] = contributor
+        contributors[contributor] = normalized
+
+    repositories.sort(key=lambda r: r["id"])
+    return {"repositories": repositories, "contributors": contributors}
+
+
+def _config_digest(config: dict) -> str:
+    encoded = json.dumps(config, sort_keys=True, separators=(",", ":")).encode()
+    return hashlib.sha256(encoded).hexdigest()
+
+
+def _ref_pattern_regex(pattern: str) -> re.Pattern:
+    out = ""
+    i = 0
+    while i < len(pattern):
+        if pattern[i:i + 2] == "**":
+            out += ".*"
+            i += 2
+        elif pattern[i] == "*":
+            out += "[^/]*"
+            i += 1
+        elif pattern[i] == "?":
+            out += "[^/]"
+            i += 1
+        else:
+            out += re.escape(pattern[i])
+            i += 1
+    return re.compile(f"^{out}$")
+
+
+def _git(repo: pathlib.Path | None, *args: str, input_bytes: bytes | None = None) -> bytes:
+    command = [
+        "git",
+        "--no-replace-objects",
+        "-c", "core.quotepath=true",
+        "-c", "core.attributesFile=/dev/null",
+        "-c", "diff.external=",
+        "-c", "diff.renames=false",
+        "-c", "diff.algorithm=myers",
+        "-c", "diff.context=3",
+    ]
+    if repo is not None:
+        command += ["-C", str(repo)]
+    command += list(args)
+    try:
+        result = subprocess.run(
+            command,
+            input=input_bytes,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            env={
+                **os.environ,
+                "GIT_CONFIG_NOSYSTEM": "1",
+                "GIT_CONFIG_GLOBAL": os.devnull,
+                "GIT_NO_REPLACE_OBJECTS": "1",
+                "LC_ALL": "C",
+                "TZ": "UTC",
+            },
+            timeout=GIT_TIMEOUT_SECONDS,
+            check=False,
+        )
+    except subprocess.TimeoutExpired as exc:
+        raise RuntimeError(f"git command timed out: {args[0]}") from exc
+    if result.returncode:
+        error = result.stderr.decode("utf-8", "replace").strip()
+        raise RuntimeError(f"git {args[0]} failed: {error}")
+    return result.stdout
+
+
+def _ensure_mirror(repo: dict) -> pathlib.Path:
+    GIT_MIRROR_DIR.mkdir(parents=True, exist_ok=True)
+    mirror = GIT_MIRROR_DIR / f"{repo['id']}.git"
+    if not mirror.exists():
+        _git(None, "clone", "--mirror", "--", repo["url"], str(mirror))
+    else:
+        actual_url = _git(mirror, "remote", "get-url", "origin").decode().strip()
+        if actual_url != repo["url"]:
+            raise RuntimeError(
+                f"mirror URL mismatch for {repo['id']}: {actual_url!r}"
+            )
+    _git(mirror, "fetch", "--prune", "origin", "+refs/*:refs/*")
+    _git(mirror, "fsck", "--connectivity-only", "--no-dangling")
+    return mirror
+
+
+def _matching_refs(mirror: pathlib.Path, patterns: list[str]) -> list[dict]:
+    regexes = [_ref_pattern_regex(p) for p in patterns]
+    lines = _git(
+        mirror, "for-each-ref", "--format=%(refname)%00%(objectname)"
+    ).decode("utf-8", "replace").splitlines()
+    selected = []
+    for line in lines:
+        if not line:
+            continue
+        ref_name, direct_oid = line.split("\x00", 1)
+        if not any(r.fullmatch(ref_name) for r in regexes):
+            continue
+        commit_oid = _git(
+            mirror, "rev-parse", "--verify", f"{ref_name}^{{commit}}"
+        ).decode().strip()
+        selected.append({
+            "name": ref_name,
+            "direct_oid": direct_oid,
+            "commit_oid": commit_oid,
+        })
+    if not selected:
+        raise RuntimeError(f"no refs matched patterns {patterns!r}")
+    return sorted(selected, key=lambda r: r["name"])
+
+
+def _commit_metadata(mirror: pathlib.Path, oid: str) -> dict:
+    raw = _git(
+        mirror,
+        "show",
+        "-s",
+        "--format=%H%x00%T%x00%P%x00%an%x00%ae%x00%at%x00%cn%x00%ce%x00%ct%x00%B",
+        oid,
+    ).decode("utf-8", "replace")
+    fields = raw.split("\x00", 9)
+    if len(fields) != 10:
+        raise RuntimeError(f"could not parse commit metadata for {oid}")
+    return {
+        "oid": fields[0],
+        "tree_oid": fields[1],
+        "parent_oids": fields[2].split() if fields[2] else [],
+        "author_name": fields[3],
+        "author_email": fields[4].strip().lower(),
+        "author_timestamp_ms": int(fields[5]) * 1000,
+        "committer_name": fields[6],
+        "committer_email": fields[7].strip().lower(),
+        "committer_timestamp_ms": int(fields[8]) * 1000,
+        "message": fields[9].rstrip("\n"),
+    }
 
 
-def unified_diff_from_commit_payload(payload: dict) -> str:
-    parts = []
-    for f in payload.get("files") or []:
-        name = f.get("filename", "?")
-        patch = f.get("patch")
-        if patch:
-            parts.append(f"--- {name}\n{patch}")
-        else:
-            parts.append(f"--- {name}\n[no textual patch: binary, submodule, or too large]\n")
-    return "\n\n".join(parts) if parts else "[no files in API response]"
+def _commit_patch(mirror: pathlib.Path, metadata: dict) -> tuple[str, str | None]:
+    parents = metadata["parent_oids"]
+    if len(parents) > 1:
+        return "", None
+    if parents:
+        args = ("diff", "--patch", "--binary", "--full-index", "--no-renames",
+                "--no-ext-diff", "--no-textconv", "--src-prefix=a/",
+                "--dst-prefix=b/", parents[0], metadata["oid"], "--")
+    else:
+        args = ("diff-tree", "--root", "--patch", "--binary", "--full-index",
+                "--no-renames", "--no-ext-diff", "--no-textconv",
+                "--src-prefix=a/", "--dst-prefix=b/", "--no-commit-id",
+                metadata["oid"], "--")
+    patch_bytes = _git(mirror, *args)
+    if not patch_bytes.strip():
+        return "", None
+    # Run patch-id outside the repository so SHA-1 and SHA-256 repositories use
+    # the same canonical patch hash algorithm.
+    patch_id_out = _git(
+        None, "patch-id", "--stable", input_bytes=patch_bytes
+    ).decode().strip()
+    if patch_id_out:
+        stable_id = patch_id_out.split()[0]
+    else:
+        stable_id = hashlib.sha256(patch_bytes).hexdigest()
+    return patch_bytes.decode("utf-8", "replace"), f"{PATCH_IDENTITY_VERSION}:{stable_id}"
+
+
+def _replayed_discovery_state(events: list) -> tuple[set[str], dict[str, str]]:
+    seen_oids = set()
+    seen_patches = {}
+    for event_ in events:
+        if not isinstance(event_, GitDiscovery):
+            continue
+        for observation in event_.observations:
+            seen_oids.add(observation["oid"])
+            patch_identity = observation.get("patch_identity")
+            canonical_oid = observation.get("canonical_patch_oid")
+            if patch_identity and canonical_oid:
+                seen_patches.setdefault(patch_identity, canonical_oid)
+    return seen_oids, seen_patches
+
+
+def _build_discovery(epoch_n: int, boundary_ms: int, events: list) -> GitDiscovery:
+    config = _normalized_discovery_config()
+    digest = _config_digest(config)
+    prior_discoveries = [e for e in events if isinstance(e, GitDiscovery)]
+    initial = not prior_discoveries
+    seen_oids, seen_patches = _replayed_discovery_state(events)
+    email_to_contributor = {
+        email: contributor
+        for contributor, emails in config["contributors"].items()
+        for email in emails
+    }
 
+    repository_rows = []
+    locations: dict[str, list[tuple[str, str, pathlib.Path, str]]] = {}
+    for repo in config["repositories"]:
+        mirror = _ensure_mirror(repo)
+        object_format = _git(
+            mirror, "rev-parse", "--show-object-format"
+        ).decode().strip()
+        refs = _matching_refs(mirror, repo["refs"])
+        repo_reachable = set()
+        for ref in refs:
+            oids = _git(mirror, "rev-list", ref["commit_oid"]).decode().splitlines()
+            for oid in oids:
+                qualified = f"{object_format}:{oid}"
+                repo_reachable.add(qualified)
+                locations.setdefault(qualified, []).append(
+                    (repo["id"], ref["name"], mirror, oid)
+                )
+        repository_rows.append({
+            "id": repo["id"],
+            "url": repo["url"],
+            "object_format": object_format,
+            "refs": refs,
+            "reachable_commit_count": len(repo_reachable),
+            "reachable_set_sha256": hashlib.sha256(
+                "\n".join(sorted(repo_reachable)).encode()
+            ).hexdigest(),
+        })
 
-async def fetch_commits_since(since_ms):
-    since_iso = datetime.fromtimestamp(since_ms / 1000, tz=timezone.utc).isoformat()
-    async with httpx.AsyncClient() as client:
-        resp = await client.get(
-            f"{GITHUB_API_BASE_URL}/repos/{REPO}/commits",
-            params={"since": since_iso, "per_page": 100},
-            headers=_github_headers(),
+    new_oids = sorted(set(locations) - seen_oids)
+    pending = []
+    for qualified_oid in new_oids:
+        source_rows = sorted({
+            (repo_id, ref_name) for repo_id, ref_name, _, _ in locations[qualified_oid]
+        })
+        canonical_location = min(
+            locations[qualified_oid], key=lambda x: (x[0], x[1])
         )
-        return resp.json()
-
+        object_hashes = {
+            hashlib.sha256(_git(m, "cat-file", "commit", raw_oid)).hexdigest()
+            for _, _, m, raw_oid in locations[qualified_oid]
+        }
+        if len(object_hashes) != 1:
+            raise RuntimeError(f"conflicting Git objects share OID {qualified_oid}")
+        _, _, mirror, oid = canonical_location
+        metadata = _commit_metadata(mirror, oid)
+        patch, patch_identity = _commit_patch(mirror, metadata)
+        pending.append({
+            **metadata,
+            "oid": qualified_oid,
+            "commit_object_sha256": next(iter(object_hashes)),
+            "tree_oid": f"{qualified_oid.split(':', 1)[0]}:{metadata['tree_oid']}",
+            "parent_oids": [
+                f"{qualified_oid.split(':', 1)[0]}:{p}"
+                for p in metadata["parent_oids"]
+            ],
+            "patch": patch,
+            "patch_sha256": hashlib.sha256(patch.encode()).hexdigest() if patch else None,
+            "patch_identity_version": PATCH_IDENTITY_VERSION,
+            "patch_identity": patch_identity,
+            "first_sources": [
+                {"repository_id": repo_id, "ref_name": ref_name}
+                for repo_id, ref_name in source_rows
+            ],
+            "contributor": email_to_contributor.get(metadata["author_email"]),
+        })
 
-async def fetch_commit_unified_diff(client: httpx.AsyncClient, sha: str) -> str:
-    resp = await client.get(
-        f"{GITHUB_API_BASE_URL}/repos/{REPO}/commits/{sha}",
-        headers=_github_headers(),
+    # Select patch representatives independently of repository/ref iteration order.
+    # Every observed patch consumes its identity, even when it predates genesis or
+    # has no registered contributor: copying already-observed work later must not
+    # turn it into a newly payable contribution.
+    pending.sort(key=lambda c: (c["committer_timestamp_ms"], c["oid"]))
+    observations = []
+    commits = []
+    for commit in pending:
+        reason = None
+        canonical_patch_oid = None
+        patch_identity = commit["patch_identity"]
+        duplicate_patch = False
+        if patch_identity:
+            if patch_identity in seen_patches:
+                canonical_patch_oid = seen_patches[patch_identity]
+                duplicate_patch = True
+            else:
+                canonical_patch_oid = commit["oid"]
+                seen_patches[patch_identity] = canonical_patch_oid
+
+        if initial and commit["committer_timestamp_ms"] < GENESIS_MS:
+            reason = "before_genesis"
+        elif len(commit["parent_oids"]) > 1:
+            reason = "merge_commit"
+        elif not patch_identity:
+            reason = "empty_commit"
+        elif duplicate_patch:
+            reason = "duplicate_patch"
+        else:
+            if commit["contributor"] is None:
+                reason = "unknown_contributor"
+
+        eligible = reason is None
+        observation = {
+            "oid": commit["oid"],
+            "first_sources": commit["first_sources"],
+            "committer_timestamp_ms": commit["committer_timestamp_ms"],
+            "patch_identity": patch_identity,
+            "canonical_patch_oid": canonical_patch_oid,
+            "eligible": eligible,
+            "exclusion_reason": reason,
+        }
+        observations.append(observation)
+        if eligible:
+            commits.append(commit)
+
+    snapshot_material = {
+        "schema_version": GIT_DISCOVERY_SCHEMA_VERSION,
+        "epoch": epoch_n,
+        "timestamp_ms": boundary_ms,
+        "config_digest": digest,
+        "repositories": repository_rows,
+        "observations": observations,
+    }
+    snapshot_id = hashlib.sha256(
+        json.dumps(snapshot_material, sort_keys=True, separators=(",", ":")).encode()
+    ).hexdigest()
+    return GitDiscovery(
+        schema_version=GIT_DISCOVERY_SCHEMA_VERSION,
+        epoch=epoch_n,
+        snapshot_id=snapshot_id,
+        timestamp_ms=boundary_ms,
+        config_digest=digest,
+        initial_snapshot=initial,
+        configuration=config,
+        repositories=repository_rows,
+        observations=observations,
+        commits=commits,
     )
-    resp.raise_for_status()
-    return unified_diff_from_commit_payload(resp.json())
+
+
+def _acquire_discovery_file_lock():
+    GIT_MIRROR_DIR.mkdir(parents=True, exist_ok=True)
+    lock_file = (GIT_MIRROR_DIR / ".discovery.lock").open("a+b")
+    fcntl.flock(lock_file.fileno(), fcntl.LOCK_EX)
+    return lock_file
+
+
+def _release_discovery_file_lock(lock_file) -> None:
+    fcntl.flock(lock_file.fileno(), fcntl.LOCK_UN)
+    lock_file.close()
+
+
+async def discover_repositories(epoch_n: int, boundary_ms: int) -> GitDiscovery:
+    async with _DISCOVERY_LOCK:
+        lock_file = await asyncio.to_thread(_acquire_discovery_file_lock)
+        try:
+            events = store.read()
+            existing = next(
+                (
+                    e for e in events
+                    if isinstance(e, GitDiscovery) and e.epoch == epoch_n
+                ),
+                None,
+            )
+            if existing:
+                return existing
+            candidate = await asyncio.to_thread(
+                _build_discovery, epoch_n, boundary_ms, events
+            )
+
+            def append_if_new(current_events):
+                if any(
+                    isinstance(e, GitDiscovery) and e.epoch == epoch_n
+                    for e in current_events
+                ):
+                    return None
+                return candidate
+
+            appended = await store.atomic(append_if_new)
+            if appended:
+                return appended
+            return next(
+                e for e in store.read()
+                if isinstance(e, GitDiscovery) and e.epoch == epoch_n
+            )
+        finally:
+            await asyncio.to_thread(_release_discovery_file_lock, lock_file)
 
 
 SSE_CLIENTS = []
@@ -581,28 +1002,27 @@ async def broadcast_js(js: str):
         await queue.put(js)
 
 
-async def rank_commits(since_ms):
-    commits = await fetch_commits_since(since_ms)
+async def rank_commits(commits: list[dict]):
     if not commits:
-        return {}
-
-    async with httpx.AsyncClient() as gh:
-        commit_diffs = await asyncio.gather(*[fetch_commit_unified_diff(gh, c["sha"]) for c in commits])
+        return {}, []
 
     models = await fetch_top_models(n=3)
+    contributors = sorted(set(c["contributor"] for c in commits))
+    if len(contributors) > 1 and not models:
+        raise RuntimeError("no council models available for contributor ranking")
     await broadcast_js(exec_event(Three[Selector("#emission-log")][PREPEND][
         ["div.log-council", f"Council: {', '.join(models)} — {len(commits)} commits"]
     ]))
 
-    authors = list(set(c["commit"]["author"]["name"] for c in commits))
+    authors = contributors
     author_idx = {a: i for i, a in enumerate(authors)}
 
     author_commits = {a: [] for a in authors}
-    for c, diff_text in zip(commits, commit_diffs, strict=True):
-        author_commits[c["commit"]["author"]["name"]].append({
-            "message": c["commit"]["message"],
-            "sha": c["sha"][:8],
-            "diff": diff_text,
+    for c in sorted(commits, key=lambda row: row["oid"]):
+        author_commits[c["contributor"]].append({
+            "message": c["message"],
+            "sha": c["oid"].split(":", 1)[1][:8],
+            "diff": c["patch"],
         })
 
     # TODO do we want ot coagulate the commits into a single block? or rank the many commits
@@ -622,9 +1042,14 @@ async def rank_commits(since_ms):
         for model in models:
             try:
                 result = await llm_pairwise_compare(model, author_side_for_llm(a1), author_side_for_llm(a2))
+                if result["winner"] not in {"A", "B"}:
+                    raise ValueError("winner must be A or B")
                 w, l = (i, j) if result["winner"] == "A" else (j, i)
                 ratio = result["ratio"].split(":")
-                results.append((w, l, float(ratio[0]), float(ratio[1])))
+                winner_weight, loser_weight = float(ratio[0]), float(ratio[1])
+                if winner_weight <= 0 or loser_weight <= 0:
+                    raise ValueError("ratio weights must be positive")
+                results.append((w, l, winner_weight, loser_weight))
                 await broadcast_js(exec_event(Three[Selector("#emission-log")][PREPEND][
                     ["div.log-vote",
                         ["span.model", model], " — ",
@@ -637,6 +1062,7 @@ async def rank_commits(since_ms):
                 await broadcast_js(exec_event(Three[Selector("#emission-log")][PREPEND][
                     ["div.log-error", f"⚠ {model}: {e}"]
                 ]))
+                raise RuntimeError(f"council model failed: {model}") from e
         return results
 
     async def progress_fn(ev):
@@ -651,7 +1077,8 @@ async def rank_commits(since_ms):
     pairs = await pairwise_rank(len(authors), compare_fn, progress_fn)
 
     if not pairs:
-        return {authors[0]: Decimal("1")} if authors else {}
+        ranking = {authors[0]: Decimal("1")} if authors else {}
+        return ranking, models
 
     scores = rank_centrality(pairs)
     ranking = {authors[i]: Decimal(str(scores[i])) for i in range(len(authors))}
@@ -662,7 +1089,7 @@ async def rank_commits(since_ms):
             *[["span.rank-entry", f"{a} {float(s):.3f}  "] for a, s in ranking_rows],
         ]
     ]))
-    return ranking
+    return ranking, models
 
 
 # ===========================================================================
@@ -681,35 +1108,48 @@ async def run_emission(epoch_n, boundary_ms):
         ["div.log-start", f"⚡ Epoch {epoch_n} emission started"]
     ]))
 
-    pool = pool_remaining(store.read())
-    emission = pool * DECAY_RATE
-    await broadcast_js(exec_event(Three[Selector("#emission-log")][PREPEND][
-        ["div.log-amount",
-            f"Pool {pool:.4f} → emit {emission:.4f} → {pool - emission:.4f}"]
-    ]))
-
-    prev_boundary_ms = epoch_boundary(epoch_n - 1) if epoch_n > 0 else GENESIS_MS
-    ranking = await rank_commits(prev_boundary_ms)
+    discovery = await discover_repositories(epoch_n, boundary_ms)
+    ranking, models = await rank_commits(discovery.commits)
 
     def make_emission(events):
         if epoch_n in {e.epoch for e in events if isinstance(e, Emission)}:
             return None
         pool_now = pool_remaining(events)
-        emission_now = pool_now * DECAY_RATE
+        emission_now = pool_now * DECAY_RATE if ranking else Decimal("0")
+        normalized_ranking = {}
+        distributions = {}
+        if ranking:
+            score_total = sum(ranking.values())
+            normalized_ranking = {
+                contributor: score / score_total
+                for contributor, score in sorted(ranking.items())
+            }
+            contributors = list(normalized_ranking)
+            allocated = Decimal("0")
+            for contributor in contributors[:-1]:
+                amount = emission_now * normalized_ranking[contributor]
+                distributions[contributor] = amount
+                allocated += amount
+            distributions[contributors[-1]] = emission_now - allocated
         return Emission(
             epoch=epoch_n,
             timestamp_ms=boundary_ms,
+            discovery_snapshot_id=discovery.snapshot_id,
             pool_before=str(pool_now),
             total_emitted=str(emission_now),
             pool_after=str(pool_now - emission_now),
             decay_rate=str(DECAY_RATE),
-            distributions={a: str(emission_now * s) for a, s in ranking.items()},
-            ranking={a: str(s) for a, s in ranking.items()},
-            models_used=[],
+            distributions={a: str(amount) for a, amount in distributions.items()},
+            ranking={a: str(s) for a, s in normalized_ranking.items()},
+            models_used=models,
         )
 
     entry = await store.atomic(make_emission)
     if entry:
+        await broadcast_js(exec_event(Three[Selector("#emission-log")][PREPEND][
+            ["div.log-amount",
+                f"Pool {entry.pool_before} → emit {entry.total_emitted} → {entry.pool_after}"]
+        ]))
         await broadcast_js(exec_event(Three[Selector("#emission-log")][PREPEND][
             ["div.log-complete",
                 ["b", f"✓ Epoch {entry.epoch} complete — emitted {entry.total_emitted} SLUG"]]
@@ -815,20 +1255,40 @@ async def get_contributor(github_username: str):
 
 @app.get("/api/halvening")
 async def get_halvening():
-    half_life = sp.Rational(str(HALF_LIFE_YEARS))
-    boundary = genesis_ms
-    elapsed = sp.Integer(0)
-    epoch_years = sp.Rational(1, 12)
-    for e in range(300):
-        epoch_dur = tropical_epoch_ms(boundary)
-        if elapsed + epoch_years >= half_life:
-            fraction = (half_life - elapsed) / epoch_years
-            jubilee_ms = round_sympy_ms(boundary + fraction * epoch_dur)
-            dt = datetime.fromtimestamp(jubilee_ms / 1000, tz=timezone.utc)
-            return {"jubilee_ms": jubilee_ms, "jubilee_utc": dt.isoformat(),
-                    "epoch": e + float(fraction), "half_life_years": str(HALF_LIFE_YEARS)}
-        elapsed += epoch_years
-        boundary += epoch_dur
+    # Iterating symbolic rationals recursively causes expression-size explosion
+    # after hundreds of epochs. Fifty-digit Decimal arithmetic is far beyond the
+    # millisecond precision exposed by this endpoint and remains deterministic.
+    boundary = Decimal(GENESIS_MS)
+    j2000 = Decimal(946728000000)
+    century = Decimal(36525 * 86400 * 1000)
+    day = Decimal(86400000)
+
+    def decimal_epoch_ms(at_ms: Decimal) -> Decimal:
+        T = (at_ms - j2000) / century
+        days = (
+            Decimal("365.2421896698")
+            + Decimal("-6.15359e-6") * T
+            + Decimal("-7.29e-10") * T**2
+            + Decimal("2.64e-10") * T**3
+        )
+        return days * day / Decimal(12)
+
+    total_epochs = HALF_LIFE_YEARS * Decimal(12)
+    whole_epochs = int(total_epochs)
+    fraction = total_epochs - whole_epochs
+    for _ in range(whole_epochs):
+        boundary += decimal_epoch_ms(boundary)
+    jubilee_ms = int(
+        (boundary + fraction * decimal_epoch_ms(boundary))
+        .to_integral_value(rounding="ROUND_HALF_UP")
+    )
+    dt = datetime.fromtimestamp(jubilee_ms / 1000, tz=timezone.utc)
+    return {
+        "jubilee_ms": jubilee_ms,
+        "jubilee_utc": dt.isoformat(),
+        "epoch": float(total_epochs),
+        "half_life_years": str(HALF_LIFE_YEARS),
+    }
 
 
 @app.post("/test/emit")
diff --git a/pyproject.toml b/pyproject.toml
index 46f0b6fd922995045008a5e935c5178e9519ac7c..65092f570614a9a5473fea04150a9871d5e0490c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -3,7 +3,7 @@ name = "slug-constitution"
 version = "0.1.0"
 requires-python = ">=3.11"
 dependencies = [
-    "evaleval>=0.2.6",
+    "evaleval==0.2.7",
     "numpy",
     "httpx",
     "fastapi",
@@ -12,6 +12,10 @@ dependencies = [
     "starlette",
     "itsdangerous",
     "pytest",
+    "hypothesis",
+    "sympy",
+    "authlib",
+    "python-multipart",
 ]
 
 [tool.pytest.ini_options]
diff --git a/tests/integration.clj b/tests/integration.clj
index fdc0931e937bcf5f0e1bea8c5b8c632ec99eab17..0d34e3b237b4037a28f5e99350e8d447455665de 100644
--- a/tests/integration.clj
+++ b/tests/integration.clj
@@ -1,7 +1,7 @@
 #!/usr/bin/env bb
 (ns test.integration
   "Integration tests for constitution.py.
-   Starts the server, mocks OpenRouter + GitHub APIs, seeds a JSONL,
+   Starts the server, mocks OpenRouter, creates local Git remotes, seeds a JSONL,
    verifies API endpoints, SSE stream, and replay determinism."
   (:require [babashka.process :as p]
             [clojure.string :as str]
@@ -96,6 +96,47 @@
         (throw (ex-info "bad HTTP status" {:code code :body body})))
       (json/parse-string body true))))
 
+(defn- command!
+  [argv opts]
+  (let [r @(p/process argv (merge {:out :string :err :string} opts))]
+    (when-not (zero? (:exit r))
+      (throw (ex-info (str "command failed: " (pr-str argv) "\n" (:err r))
+                      {:argv argv :result r})))
+    (str/trim (:out r))))
+
+(defn- git!
+  [dir & args]
+  (let [base-env (into {} (System/getenv))
+        env      (merge base-env
+                        {"GIT_CONFIG_NOSYSTEM" "1"
+                         "GIT_AUTHOR_NAME" "Integration"
+                         "GIT_AUTHOR_EMAIL" "integration@example.test"
+                         "GIT_COMMITTER_NAME" "Integration"
+                         "GIT_COMMITTER_EMAIL" "integration@example.test"})]
+    (command! (into ["git" "-C" dir] args) {:env env})))
+
+(defn- make-git-repository!
+  [tmp-dir id contributor email filename]
+  (let [remote (str tmp-dir "/" id ".git")
+        work   (str tmp-dir "/" id "-work")]
+    (command! ["git" "init" "--bare" remote] {})
+    (command! ["git" "init" "-b" "main" work] {})
+    (git! work "config" "user.name" contributor)
+    (git! work "config" "user.email" email)
+    (spit (str work "/" filename) (str contributor " contribution\n"))
+    (git! work "add" "--" filename)
+    (let [env (merge (into {} (System/getenv))
+                     {"GIT_CONFIG_NOSYSTEM" "1"
+                      "GIT_AUTHOR_NAME" contributor
+                      "GIT_AUTHOR_EMAIL" email
+                      "GIT_COMMITTER_NAME" contributor
+                      "GIT_COMMITTER_EMAIL" email})]
+      (command! ["git" "-C" work "commit" "-m" (str "contribution by " contributor)]
+                {:env env}))
+    (git! work "remote" "add" "origin" remote)
+    (git! work "push" "origin" "main")
+    {:id id :url remote :refs ["refs/heads/**"]}))
+
 ;; ---------------------------------------------------------------------------
 ;; mock OpenRouter server
 ;; ---------------------------------------------------------------------------
@@ -199,6 +240,7 @@
   (let [entry {:type         "emission"
                :epoch        0
                :timestamp_ms 1700000000000
+               :discovery_snapshot_id "seeded-discovery"
                :pool_before  "175824"
                :total_emitted "572.1423838308"
                :pool_after   "175251.857616169"
@@ -239,8 +281,8 @@
       (str/trim (second m)))))
 
 (defn- test-live-slug-model-council! [root]
-  (if (= "1" (System/getenv "SKIP_LIVE_SLUG_SOCIAL"))
-    (println "\n━━━ live slug.social checks skipped (SKIP_LIVE_SLUG_SOCIAL=1) ━━━\n")
+  (if-not (= "1" (System/getenv "RUN_LIVE_SLUG_SOCIAL"))
+    (println "\n━━━ live slug.social checks skipped (set RUN_LIVE_SLUG_SOCIAL=1) ━━━\n")
     (letlocals
       (println "\n━━━ live slug.social: /api/v0 + fetch_top_models ━━━\n")
       (bind rank-url (str slug-live-base "/api/v0/rank?parent="
@@ -307,7 +349,7 @@
               (when (str/starts-with? line "data:")
                 (let [raw (str/trim (subs line 5))]
                   (when-not (str/blank? raw)
-                    (swap! events conj (json/parse-string raw true)))))
+                    (swap! events conj raw))))
               (recur))
             nil)))
       (finally
@@ -329,7 +371,6 @@
     (bind jsonl-path   (str tmp-dir "/ledger.jsonl"))
     (bind server-port  (pick-port))
     (bind or-port      (pick-port))  ; openrouter mock
-    (bind gh-port      (pick-port))  ; github mock
     (bind base-url     (str "http://127.0.0.1:" server-port))
 
     ;; genesis ~1 month ago so we're at epoch 1+
@@ -337,38 +378,47 @@
 
     (bind root          (project-root))
     (test-live-slug-model-council! root)
+    (bind repo-a (make-git-repository! tmp-dir "repo-a" "alice"
+                                       "alice@example.test" "alice.txt"))
+    (bind repo-b (make-git-repository! tmp-dir "repo-b" "bob"
+                                       "bob@example.test" "bob.txt"))
+    (bind repositories-json
+      (json/generate-string
+        [(update repo-a :refs vec) (update repo-b :refs vec)]))
+    (bind contributors-json
+      (json/generate-string
+        {"alice" ["alice@example.test"]
+         "bob"   ["bob@example.test"]}))
     (bind server-env
       {"SESSION_SECRET"       "test-secret"
        "GENESIS_MS"           genesis-ms
        "JSONL_PATH"           jsonl-path
+       "GIT_MIRROR_DIR"       (str tmp-dir "/mirrors")
+       "REPOSITORIES_JSON"    repositories-json
+       "CONTRIBUTORS_JSON"    contributors-json
        "OPENROUTER_API_KEY"   "mock-key"
        "GITHUB_CLIENT_ID"     "mock-gh-id"
        "GITHUB_CLIENT_SECRET" "mock-gh-secret"
-       "GITHUB_TOKEN"         "mock-gh-token"
-       "REPO"                 "tommy-mor/slug"
        "PORT"                 (str server-port)
        "DISABLE_EPOCH_LOOP"   "1"
        "ALLOW_TEST_TRIGGERS"  "1"
        "OPENROUTER_BASE_URL"  (str "http://127.0.0.1:" or-port)
-       "GITHUB_API_BASE_URL"  (str "http://127.0.0.1:" gh-port)
        "SLUG_MODEL_RANK_PARENT" ""
        "PATH"                 (get (into {} (System/getenv)) "PATH" "")})
 
     (bind !server  (atom nil))
     (bind !server2 (atom nil))
     (bind !or-mock (atom nil))
-    (bind !gh-mock (atom nil))
 
     (try
       (letlocals
-        ;; 1. start mock servers
-        (println "starting mock OpenRouter and GitHub API servers…")
+        ;; 1. start mock model server; Git discovery uses local bare remotes
+        (println "starting mock OpenRouter server and local Git remotes…")
         (bind or-mock (start-mock-openrouter or-port))
         (reset! !or-mock or-mock)
-        (bind gh-mock (start-mock-github gh-port))
-        (reset! !gh-mock gh-mock)
         (assert! (some? (:stop-fn or-mock)) "mock OpenRouter started")
-        (assert! (some? (:stop-fn gh-mock)) "mock GitHub started")
+        (assert! (fs/exists? (:url repo-a)) "first bare Git remote exists")
+        (assert! (fs/exists? (:url repo-b)) "second bare Git remote exists")
 
         ;; 2. seed ledger so pool_remaining has history to read
         (seed-ledger jsonl-path)
@@ -422,7 +472,8 @@
         (println "\nchecking /sse initial event…")
         (bind sse-events (read-sse-events (str base-url "/sse") 1 5000))
         (assert! (= 1 (count sse-events))             "received 1 SSE event")
-        (assert! (int? (:epoch (first sse-events)))   "initial SSE event has epoch")
+        (assert! (not (str/blank? (first sse-events)))
+                 "initial SSE event contains executable audit data")
 
         ;; 10. POST /test/emit — full ranking pipeline hits mocks
         (println "\ntriggering /test/emit (epoch 1)…")
@@ -430,16 +481,25 @@
         (assert! (= "emission" (:type emit-resp))     "emit response type is emission")
         (assert! (= 1 (:epoch emit-resp))             "emit is epoch 1 after seeded epoch 0")
         (assert! (pos? (count (:distributions emit-resp))) "emit has distributions")
+        (assert! (string? (:discovery_snapshot_id emit-resp))
+                 "emission records discovery snapshot")
+        (assert! (= 3 (count (:models_used emit-resp)))
+                 "emission records all council models")
 
         (bind or-state @(:state or-mock))
-        (bind gh-state @(:state gh-mock))
         (assert! (pos? (:model-requests or-state))    "OpenRouter /models was called")
         (assert! (>= (:compare-requests or-state) 3) "at least 3 pairwise LLM calls (2 authors × 3 models)")
-        (assert! (pos? (:commit-list-requests gh-state)) "GitHub commits list was called")
-        (assert! (>= (:commit-detail-requests gh-state) 2) "GitHub per-SHA fetches for each commit")
 
         (bind ledger2 (get-json base-url "/api/ledger"))
-        (assert! (= 2 (count ledger2))              "ledger has 2 entries after emit")
+        (assert! (= 3 (count ledger2))
+                 "ledger has seed, discovery, and emission entries")
+        (bind discovery-entry (second ledger2))
+        (assert! (= "gitdiscovery" (:type discovery-entry))
+                 "discovery is persisted before emission")
+        (assert! (= 2 (count (:repositories discovery-entry)))
+                 "discovery records both repositories")
+        (assert! (= 2 (count (:commits discovery-entry)))
+                 "discovery admits one contribution from each repository")
         (bind rank-after (get-json base-url "/api/ranking"))
         (assert! (= 1 (:epoch rank-after))           "latest ranking is epoch 1")
 
@@ -458,7 +518,8 @@
                  "restarted server responds to /api/epoch")
 
         (bind replayed-ledger (get-json base-url "/api/ledger"))
-        (assert! (= 2 (count replayed-ledger))        "ledger still has 2 entries after replay")
+        (assert! (= 3 (count replayed-ledger))
+                 "ledger still has 3 entries after replay")
         (bind replayed-rank   (get-json base-url "/api/ranking"))
         (assert! (= (get-in rank-after [:ranking :alice])
                     (get-in replayed-rank [:ranking :alice]))
@@ -473,7 +534,6 @@
           (.destroyForcibly (:proc s))
           (deref s))
         (when-some [m @!or-mock] ((:stop-fn m)))
-        (when-some [m @!gh-mock] ((:stop-fn m)))
         (fs/delete-tree tmp-dir)))
 
     (let [{:keys [pass fail]} @counts]
diff --git a/tests/test_git_discovery.py b/tests/test_git_discovery.py
new file mode 100644
index 0000000000000000000000000000000000000000..0dd31bc42a19bc8c59842dc61f193c595c474659
--- /dev/null
+++ b/tests/test_git_discovery.py
@@ -0,0 +1,467 @@
+"""Real-Git tests for the constitutional multi-repository discovery rules."""
+
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import os
+import subprocess
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+import constitution as c
+
+
+def git(repo: Path | None, *args: str, env: dict | None = None) -> str:
+    command = ["git"]
+    if repo is not None:
+        command += ["-C", str(repo)]
+    command += list(args)
+    merged_env = os.environ.copy()
+    merged_env.update({
+        "GIT_CONFIG_NOSYSTEM": "1",
+        "GIT_AUTHOR_NAME": "Test Author",
+        "GIT_AUTHOR_EMAIL": "author@example.test",
+        "GIT_COMMITTER_NAME": "Test Committer",
+        "GIT_COMMITTER_EMAIL": "author@example.test",
+    })
+    if env:
+        merged_env.update(env)
+    result = subprocess.run(
+        command,
+        env=merged_env,
+        text=True,
+        input="",
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        check=False,
+    )
+    assert result.returncode == 0, result.stderr
+    return result.stdout.strip()
+
+
+def make_remote(tmp_path: Path, name: str) -> tuple[Path, Path]:
+    remote = tmp_path / f"{name}.git"
+    work = tmp_path / f"{name}-work"
+    git(None, "init", "--bare", str(remote))
+    git(None, "init", "-b", "main", str(work))
+    git(work, "config", "user.name", "Test Author")
+    git(work, "config", "user.email", "author@example.test")
+    git(work, "remote", "add", "origin", str(remote))
+    return remote, work
+
+
+def commit_file(
+    work: Path,
+    name: str,
+    content: str | bytes,
+    message: str,
+    timestamp: int,
+    *,
+    email: str = "author@example.test",
+) -> str:
+    path = work / name
+    path.parent.mkdir(parents=True, exist_ok=True)
+    if isinstance(content, bytes):
+        path.write_bytes(content)
+    else:
+        path.write_text(content)
+    git(work, "add", "--", name)
+    date = f"@{timestamp} +0000"
+    return git(
+        work,
+        "commit",
+        "-m",
+        message,
+        env={
+            "GIT_AUTHOR_EMAIL": email,
+            "GIT_COMMITTER_EMAIL": email,
+            "GIT_AUTHOR_DATE": date,
+            "GIT_COMMITTER_DATE": date,
+        },
+    ) and git(work, "rev-parse", "HEAD")
+
+
+def push(work: Path, *refs: str) -> None:
+    git(work, "push", "--force", "origin", *refs)
+
+
+@pytest.fixture
+def discovery_config(tmp_path, monkeypatch):
+    monkeypatch.setattr(c, "GIT_MIRROR_DIR", tmp_path / "mirrors")
+    monkeypatch.setattr(c, "GENESIS_MS", 1_000_000)
+    monkeypatch.setattr(c, "CONTRIBUTORS", {
+        "alice": ["author@example.test"],
+        "bob": ["bob@example.test"],
+    })
+    return tmp_path
+
+
+def configure(monkeypatch, repositories):
+    monkeypatch.setattr(c, "REPOSITORIES", repositories)
+
+
+def test_ref_patterns_distinguish_nested_branches():
+    shallow = c._ref_pattern_regex("refs/heads/*")
+    recursive = c._ref_pattern_regex("refs/heads/**")
+    assert shallow.fullmatch("refs/heads/main")
+    assert not shallow.fullmatch("refs/heads/team/topic")
+    assert recursive.fullmatch("refs/heads/team/topic")
+
+
+def test_manifest_order_does_not_change_digest(monkeypatch):
+    repos = [
+        {"id": "b", "url": "/b", "refs": ["refs/heads/z", "refs/heads/a"]},
+        {"id": "a", "url": "/a", "refs": ["refs/heads/**"]},
+    ]
+    configure(monkeypatch, repos)
+    monkeypatch.setattr(c, "CONTRIBUTORS", {"alice": ["A@EXAMPLE.TEST"]})
+    first = c._config_digest(c._normalized_discovery_config())
+    configure(monkeypatch, list(reversed(repos)))
+    second = c._config_digest(c._normalized_discovery_config())
+    assert first == second
+
+
+@pytest.mark.parametrize(
+    "repositories",
+    [
+        [{"id": "../escape", "url": "/x", "refs": ["refs/heads/main"]}],
+        [{"id": "x", "url": "", "refs": ["refs/heads/main"]}],
+        [{"id": "x", "url": "/x", "refs": []}],
+        [
+            {"id": "x", "url": "/x", "refs": ["refs/heads/main"]},
+            {"id": "x", "url": "/y", "refs": ["refs/heads/main"]},
+        ],
+    ],
+)
+def test_invalid_manifests_fail(repositories, monkeypatch):
+    configure(monkeypatch, repositories)
+    monkeypatch.setattr(c, "CONTRIBUTORS", {"alice": ["a@example.test"]})
+    with pytest.raises(ValueError):
+        c._normalized_discovery_config()
+
+
+def test_bootstrap_genesis_nested_refs_and_exclusions(discovery_config, monkeypatch):
+    remote, work = make_remote(discovery_config, "one")
+    old_oid = commit_file(work, "old.txt", "old", "before genesis", 999)
+    new_oid = commit_file(work, "new.txt", "new", "after genesis", 1001)
+    git(work, "branch", "team/topic")
+    push(work, "main", "team/topic")
+    configure(monkeypatch, [{
+        "id": "one", "url": str(remote), "refs": ["refs/heads/**"],
+    }])
+
+    event = c._build_discovery(0, c.GENESIS_MS, [])
+    observations = {row["oid"].split(":", 1)[1]: row for row in event.observations}
+    assert observations[old_oid]["exclusion_reason"] == "before_genesis"
+    assert observations[new_oid]["eligible"]
+    assert {source["ref_name"] for source in observations[new_oid]["first_sources"]} == {
+        "refs/heads/main", "refs/heads/team/topic",
+    }
+    assert event.commits[0]["contributor"] == "alice"
+
+
+def test_first_reachable_ignores_old_timestamp_after_bootstrap(
+    discovery_config, monkeypatch
+):
+    remote, work = make_remote(discovery_config, "one")
+    commit_file(work, "base.txt", "base", "base", 1001)
+    push(work, "main")
+    configure(monkeypatch, [{
+        "id": "one", "url": str(remote), "refs": ["refs/heads/main"],
+    }])
+    first = c._build_discovery(0, c.GENESIS_MS, [])
+
+    git(work, "checkout", "-b", "hidden")
+    old_dated_oid = commit_file(work, "late.txt", "late", "old dated", 500)
+    git(work, "checkout", "main")
+    git(work, "merge", "--ff-only", "hidden")
+    push(work, "main")
+
+    second = c._build_discovery(1, c.GENESIS_MS + 1, [first])
+    row = next(
+        row for row in second.observations
+        if row["oid"].endswith(old_dated_oid)
+    )
+    assert row["eligible"]
+
+
+def test_force_push_removal_and_reintroduction_never_reattributes(
+    discovery_config, monkeypatch
+):
+    remote, work = make_remote(discovery_config, "one")
+    base = commit_file(work, "base.txt", "base", "base", 1001)
+    extra = commit_file(work, "extra.txt", "extra", "extra", 1002)
+    push(work, "main")
+    configure(monkeypatch, [{
+        "id": "one", "url": str(remote), "refs": ["refs/heads/main"],
+    }])
+    first = c._build_discovery(0, c.GENESIS_MS, [])
+
+    git(work, "reset", "--hard", base)
+    push(work, "main")
+    second = c._build_discovery(1, c.GENESIS_MS + 1, [first])
+    assert second.observations == []
+
+    git(work, "reset", "--hard", extra)
+    push(work, "main")
+    third = c._build_discovery(2, c.GENESIS_MS + 2, [first, second])
+    assert third.observations == []
+
+
+def test_global_oid_and_cherry_pick_patch_dedup(discovery_config, monkeypatch):
+    remote_a, work_a = make_remote(discovery_config, "a")
+    commit_file(work_a, "base.txt", "base", "base", 1001)
+    shared = commit_file(work_a, "feature.txt", "feature\n", "feature", 1002)
+    push(work_a, "main")
+
+    remote_b = discovery_config / "b.git"
+    git(None, "clone", "--bare", str(remote_a), str(remote_b))
+    work_b = discovery_config / "b-work"
+    git(None, "clone", str(remote_b), str(work_b))
+    git(work_b, "config", "user.name", "Bob")
+    git(work_b, "config", "user.email", "bob@example.test")
+
+    configure(monkeypatch, [
+        {"id": "a", "url": str(remote_a), "refs": ["refs/heads/main"]},
+        {"id": "b", "url": str(remote_b), "refs": ["refs/heads/main"]},
+    ])
+    first = c._build_discovery(0, c.GENESIS_MS, [])
+    shared_rows = [r for r in first.observations if r["oid"].endswith(shared)]
+    assert len(shared_rows) == 1
+    assert len(shared_rows[0]["first_sources"]) == 2
+
+    git(work_b, "checkout", "-b", "copy", f"{shared}^")
+    git(
+        work_b,
+        "cherry-pick",
+        shared,
+        env={
+            "GIT_COMMITTER_NAME": "Bob",
+            "GIT_COMMITTER_EMAIL": "bob@example.test",
+            "GIT_COMMITTER_DATE": "@1003 +0000",
+        },
+    )
+    copied = git(work_b, "rev-parse", "HEAD")
+    git(work_b, "branch", "-f", "main", copied)
+    push(work_b, "main")
+
+    second = c._build_discovery(1, c.GENESIS_MS + 1, [first])
+    copied_row = next(r for r in second.observations if r["oid"].endswith(copied))
+    assert copied_row["exclusion_reason"] == "duplicate_patch"
+    assert copied_row["canonical_patch_oid"].endswith(shared)
+    assert second.commits == []
+
+
+def test_merge_empty_unknown_and_binary_are_explicit(discovery_config, monkeypatch):
+    remote, work = make_remote(discovery_config, "one")
+    commit_file(work, "base.txt", "base", "base", 1001)
+    git(work, "checkout", "-b", "feature")
+    commit_file(work, "binary.bin", b"\x00\x01\xff", "binary", 1002)
+    git(work, "checkout", "main")
+    commit_file(work, "main.txt", "main", "main", 1003)
+    git(
+        work,
+        "merge",
+        "--no-ff",
+        "feature",
+        "-m",
+        "merge",
+        env={"GIT_AUTHOR_DATE": "@1004 +0000", "GIT_COMMITTER_DATE": "@1004 +0000"},
+    )
+    git(
+        work,
+        "commit",
+        "--allow-empty",
+        "-m",
+        "empty",
+        env={"GIT_AUTHOR_DATE": "@1005 +0000", "GIT_COMMITTER_DATE": "@1005 +0000"},
+    )
+    commit_file(
+        work, "unknown.txt", "unknown", "unknown", 1006,
+        email="unknown@example.test",
+    )
+    push(work, "main")
+    configure(monkeypatch, [{
+        "id": "one", "url": str(remote), "refs": ["refs/heads/main"],
+    }])
+
+    event = c._build_discovery(0, c.GENESIS_MS, [])
+    reasons = {row["exclusion_reason"] for row in event.observations}
+    assert {"merge_commit", "empty_commit", "unknown_contributor"} <= reasons
+    binary = next(row for row in event.commits if row["message"] == "binary")
+    assert binary["patch_identity"]
+    assert binary["patch_sha256"] == hashlib.sha256(
+        binary["patch"].encode()
+    ).hexdigest()
+
+
+def test_repository_failure_does_not_return_partial_snapshot(
+    discovery_config, monkeypatch
+):
+    remote, work = make_remote(discovery_config, "good")
+    commit_file(work, "file.txt", "ok", "ok", 1001)
+    push(work, "main")
+    configure(monkeypatch, [
+        {"id": "good", "url": str(remote), "refs": ["refs/heads/main"]},
+        {
+            "id": "missing",
+            "url": str(discovery_config / "missing.git"),
+            "refs": ["refs/heads/main"],
+        },
+    ])
+    with pytest.raises(RuntimeError):
+        c._build_discovery(0, c.GENESIS_MS, [])
+
+
+def test_git_replace_refs_cannot_falsify_discovered_commit(
+    discovery_config, monkeypatch
+):
+    remote, work = make_remote(discovery_config, "one")
+    original = commit_file(work, "file.txt", "original", "original", 1001)
+    replacement = commit_file(work, "file.txt", "replacement", "replacement", 1002)
+    git(work, "replace", original, replacement)
+    git(work, "reset", "--hard", original)
+    push(work, "main", f"refs/replace/{original}")
+    configure(monkeypatch, [{
+        "id": "one", "url": str(remote), "refs": ["refs/heads/main"],
+    }])
+
+    event = c._build_discovery(0, c.GENESIS_MS, [])
+    discovered = next(row for row in event.commits if row["oid"].endswith(original))
+    assert discovered["message"] == "original"
+    assert "original" in discovered["patch"]
+    assert "replacement" not in discovered["patch"]
+
+
+def test_replay_is_idempotent_and_path_independent(discovery_config, monkeypatch):
+    remote, work = make_remote(discovery_config, "one")
+    commit_file(work, "file.txt", "ok", "ok", 1001)
+    push(work, "main")
+    configure(monkeypatch, [{
+        "id": "one", "url": str(remote), "refs": ["refs/heads/main"],
+    }])
+    first = c._build_discovery(0, c.GENESIS_MS, [])
+    second = c._build_discovery(1, c.GENESIS_MS + 1, [first])
+    assert second.observations == []
+    assert second.commits == []
+    assert first.repositories[0]["reachable_set_sha256"] == (
+        second.repositories[0]["reachable_set_sha256"]
+    )
+
+
+def test_git_timeout_is_reported_without_partial_result(monkeypatch, tmp_path):
+    def timeout(*_args, **_kwargs):
+        raise subprocess.TimeoutExpired(["git", "fetch"], 1)
+
+    monkeypatch.setattr(c.subprocess, "run", timeout)
+    with pytest.raises(RuntimeError, match="timed out"):
+        c._git(tmp_path, "fetch")
+
+
+def test_concurrent_same_epoch_discovery_appends_once(
+    discovery_config, monkeypatch
+):
+    remote, work = make_remote(discovery_config, "one")
+    commit_file(work, "file.txt", "ok", "ok", 1001)
+    push(work, "main")
+    configure(monkeypatch, [{
+        "id": "one", "url": str(remote), "refs": ["refs/heads/main"],
+    }])
+    ledger_path = discovery_config / "ledger.jsonl"
+    monkeypatch.setattr(c, "store", c.JsonlStore(ledger_path))
+
+    async def run_both():
+        return await asyncio.gather(
+            c.discover_repositories(0, c.GENESIS_MS),
+            c.discover_repositories(0, c.GENESIS_MS),
+        )
+
+    left, right = asyncio.run(run_both())
+    assert left.snapshot_id == right.snapshot_id
+    discoveries = [
+        event for event in c.store.read() if isinstance(event, c.GitDiscovery)
+    ]
+    assert len(discoveries) == 1
+
+
+def test_empty_epoch_records_zero_emission_without_burning_pool(
+    discovery_config, monkeypatch
+):
+    monkeypatch.setattr(c, "store", c.JsonlStore(discovery_config / "ledger.jsonl"))
+
+    async def discover(_epoch, _boundary):
+        return SimpleNamespace(commits=[], snapshot_id="empty-snapshot")
+
+    async def rank(_commits):
+        return {}, []
+
+    monkeypatch.setattr(c, "discover_repositories", discover)
+    monkeypatch.setattr(c, "rank_commits", rank)
+    entry = asyncio.run(c.run_emission(0, c.GENESIS_MS))
+    assert c.Decimal(entry.total_emitted) == 0
+    assert entry.pool_before == entry.pool_after
+    assert entry.distributions == {}
+
+
+def test_emission_distribution_sums_exactly_to_total(
+    discovery_config, monkeypatch
+):
+    monkeypatch.setattr(c, "store", c.JsonlStore(discovery_config / "ledger.jsonl"))
+
+    async def discover(_epoch, _boundary):
+        return SimpleNamespace(commits=[{"x": 1}], snapshot_id="ranked-snapshot")
+
+    async def rank(_commits):
+        return {
+            "alice": c.Decimal("0.33333333333333333333333333333333333333333333333333"),
+            "bob": c.Decimal("0.66666666666666666666666666666666666666666666666667"),
+        }, ["model"]
+
+    monkeypatch.setattr(c, "discover_repositories", discover)
+    monkeypatch.setattr(c, "rank_commits", rank)
+    entry = asyncio.run(c.run_emission(0, c.GENESIS_MS))
+    distributed = sum(c.Decimal(x) for x in entry.distributions.values())
+    assert distributed == c.Decimal(entry.total_emitted)
+    assert entry.discovery_snapshot_id == "ranked-snapshot"
+
+
+def test_single_contributor_ranking_is_total_and_uses_no_pairwise_votes(
+    monkeypatch,
+):
+    async def models(n=3):
+        return []
+
+    monkeypatch.setattr(c, "fetch_top_models", models)
+    ranking, used = asyncio.run(c.rank_commits([{
+        "contributor": "alice",
+        "oid": "sha1:" + "a" * 40,
+        "message": "one contribution",
+        "patch": "patch",
+    }]))
+    assert ranking == {"alice": c.Decimal("1")}
+    assert used == []
+
+
+def test_any_council_failure_aborts_ranking(monkeypatch):
+    async def models(n=3):
+        return ["broken"]
+
+    async def compare(*_args):
+        raise RuntimeError("model unavailable")
+
+    monkeypatch.setattr(c, "fetch_top_models", models)
+    monkeypatch.setattr(c, "llm_pairwise_compare", compare)
+    commits = [
+        {
+            "contributor": contributor,
+            "oid": "sha1:" + char * 40,
+            "message": contributor,
+            "patch": "patch",
+        }
+        for contributor, char in [("alice", "a"), ("bob", "b")]
+    ]
+    with pytest.raises(RuntimeError, match="council model failed"):
+        asyncio.run(c.rank_commits(commits))
diff --git a/tests/test_git_discovery_stateful.py b/tests/test_git_discovery_stateful.py
new file mode 100644
index 0000000000000000000000000000000000000000..e41041fdbc84fff441c85422c23eaa3df53b094b
--- /dev/null
+++ b/tests/test_git_discovery_stateful.py
@@ -0,0 +1,161 @@
+"""State-machine checks for discovery under changing real Git refs."""
+
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+import tempfile
+from pathlib import Path
+
+from hypothesis import settings
+from hypothesis.stateful import (
+    RuleBasedStateMachine,
+    invariant,
+    precondition,
+    rule,
+)
+
+import constitution as c
+
+
+def git(repo: Path | None, *args: str, timestamp: int | None = None) -> str:
+    command = ["git"]
+    if repo is not None:
+        command += ["-C", str(repo)]
+    command += list(args)
+    env = os.environ.copy()
+    env.update({
+        "GIT_CONFIG_NOSYSTEM": "1",
+        "GIT_AUTHOR_NAME": "State Machine",
+        "GIT_AUTHOR_EMAIL": "state@example.test",
+        "GIT_COMMITTER_NAME": "State Machine",
+        "GIT_COMMITTER_EMAIL": "state@example.test",
+    })
+    if timestamp is not None:
+        env["GIT_AUTHOR_DATE"] = f"@{timestamp} +0000"
+        env["GIT_COMMITTER_DATE"] = f"@{timestamp} +0000"
+    result = subprocess.run(
+        command,
+        text=True,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        env=env,
+        check=False,
+    )
+    if result.returncode:
+        raise AssertionError(result.stderr)
+    return result.stdout.strip()
+
+
+class GitDiscoveryMachine(RuleBasedStateMachine):
+    def __init__(self):
+        super().__init__()
+        self.root = Path(tempfile.mkdtemp(prefix="constitution-stateful-"))
+        self.remote = self.root / "remote.git"
+        self.work = self.root / "work"
+        git(None, "init", "--bare", str(self.remote))
+        git(None, "init", "-b", "main", str(self.work))
+        git(self.work, "config", "user.name", "State Machine")
+        git(self.work, "config", "user.email", "state@example.test")
+        git(self.work, "remote", "add", "origin", str(self.remote))
+
+        self.original = (
+            c.REPOSITORIES, c.CONTRIBUTORS, c.GIT_MIRROR_DIR, c.GENESIS_MS,
+        )
+        c.REPOSITORIES = [{
+            "id": "state",
+            "url": str(self.remote),
+            "refs": ["refs/heads/main"],
+        }]
+        c.CONTRIBUTORS = {"state": ["state@example.test"]}
+        c.GIT_MIRROR_DIR = self.root / "mirrors"
+        c.GENESIS_MS = 1_000_000
+
+        self.counter = 0
+        self.events = []
+        self.removed_tip: str | None = None
+        self._commit_and_push()
+
+    def teardown(self):
+        (
+            c.REPOSITORIES, c.CONTRIBUTORS, c.GIT_MIRROR_DIR, c.GENESIS_MS,
+        ) = self.original
+        shutil.rmtree(self.root, ignore_errors=True)
+
+    def _commit_and_push(self):
+        self.counter += 1
+        path = self.work / f"file-{self.counter}.txt"
+        path.write_text(f"value {self.counter}\n")
+        git(self.work, "add", "--", path.name)
+        git(
+            self.work,
+            "commit",
+            "-m",
+            f"commit {self.counter}",
+            timestamp=1000 + self.counter,
+        )
+        git(self.work, "push", "--force", "origin", "main")
+
+    @rule()
+    def advance_branch(self):
+        if self.removed_tip is None:
+            self._commit_and_push()
+
+    @rule()
+    def scan(self):
+        event = c._build_discovery(
+            len(self.events), c.GENESIS_MS + len(self.events), self.events
+        )
+        self.events.append(event)
+
+    @precondition(lambda self: self.removed_tip is None)
+    @rule()
+    def force_push_back(self):
+        if self.counter < 2:
+            return
+        self.removed_tip = git(self.work, "rev-parse", "HEAD")
+        git(self.work, "reset", "--hard", "HEAD^")
+        git(self.work, "push", "--force", "origin", "main")
+
+    @precondition(lambda self: self.removed_tip is not None)
+    @rule()
+    def restore_force_pushed_tip(self):
+        git(self.work, "reset", "--hard", self.removed_tip)
+        git(self.work, "push", "--force", "origin", "main")
+        self.removed_tip = None
+
+    @invariant()
+    def observations_are_monotonic_and_unique(self):
+        observed = [
+            row["oid"]
+            for event in self.events
+            for row in event.observations
+        ]
+        assert len(observed) == len(set(observed))
+
+    @invariant()
+    def patch_classes_are_ranked_at_most_once(self):
+        patch_ids = [
+            commit["patch_identity"]
+            for event in self.events
+            for commit in event.commits
+        ]
+        assert len(patch_ids) == len(set(patch_ids))
+
+    @invariant()
+    def replay_matches_accumulated_state(self):
+        seen_oids, seen_patches = c._replayed_discovery_state(self.events)
+        expected_oids = {
+            row["oid"] for event in self.events for row in event.observations
+        }
+        assert seen_oids == expected_oids
+        assert all(oid in seen_oids for oid in seen_patches.values())
+
+
+TestGitDiscoveryStateMachine = GitDiscoveryMachine.TestCase
+TestGitDiscoveryStateMachine.settings = settings(
+    max_examples=8,
+    stateful_step_count=12,
+    deadline=None,
+)
diff --git a/uv.lock b/uv.lock
index 9cf3e067adf2f39d9eb160631c3a4b3c237ec26a..bab8e115a73870fd236bd46a1bf773b44fb5d3ee 100644
--- a/uv.lock
+++ b/uv.lock
@@ -33,6 +33,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/da/42/e921fccf5015463e32a3cf6ee7f980a6ed0f395ceeaa45060b61d86486c2/anyio-4.13.0-py3-none-any.whl", hash = "sha256:08b310f9e24a9594186fd75b4f73f4a4152069e3853f1ed8bfbf58369f4ad708", size = 114353, upload-time = "2026-03-24T12:59:08.246Z" },
 ]
 
+[[package]]
+name = "authlib"
+version = "1.7.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cryptography" },
+    { name = "joserfc" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/36/98/7d93f30d029643c0275dbc0bd6d5a6f670661ee6c9a94d93af7ab4887600/authlib-1.7.2.tar.gz", hash = "sha256:2cea25fefcd4e7173bdf1372c0afc265c8034b23a8cd5dcb6a9164b826c64231", size = 176511, upload-time = "2026-05-06T08:10:23.116Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/fb/95/adcb68e20c34162e9135f370d6e31737719c2b6f94bc953fe7ed1f10fe21/authlib-1.7.2-py2.py3-none-any.whl", hash = "sha256:3e1faedc9d87e7d56a164eca3ccb6ace0d61b94abe83e92242f8dc8bba9b4a9f", size = 259548, upload-time = "2026-05-06T08:10:21.436Z" },
+]
+
 [[package]]
 name = "certifi"
 version = "2026.2.25"
@@ -42,6 +55,104 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/9a/3c/c17fb3ca2d9c3acff52e30b309f538586f9f5b9c9cf454f3845fc9af4881/certifi-2026.2.25-py3-none-any.whl", hash = "sha256:027692e4402ad994f1c42e52a4997a9763c646b73e4096e4d5d6db8af1d6f0fa", size = 153684, upload-time = "2026-02-25T02:54:15.766Z" },
 ]
 
+[[package]]
+name = "cffi"
+version = "2.1.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pycparser", marker = "implementation_name != 'PyPy'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/57/5f/ff100cae70ebe9d8df1c01a00e510e45d9adb5c1fdda84791b199141de97/cffi-2.1.0.tar.gz", hash = "sha256:efc1cdd798b1aaf39b4610bba7aad28c9bea9b910f25c784ccf9ec1fa719d1f9", size = 531036, upload-time = "2026-07-06T21:34:30.382Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d3/67/85c89a59ba36a671e79638f44d466749f08179266a57e4f2ffdf92174072/cffi-2.1.0-cp311-cp311-macosx_10_15_x86_64.whl", hash = "sha256:02cb7ff33ded4f1532476731f89ede53e2e488a8e6205515a82144246ffa7dcc", size = 183845, upload-time = "2026-07-06T21:32:26.32Z" },
+    { url = "https://files.pythonhosted.org/packages/ea/dd/e3b0baa2d3d6a857ac72b7efbf18e32e487c9cdafcc13049ad765495b15e/cffi-2.1.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:f5bce581e6b8c235e566a14768a943b172ada3ed73537bb0c0be1edee312d4e7", size = 184186, upload-time = "2026-07-06T21:32:28.025Z" },
+    { url = "https://files.pythonhosted.org/packages/65/68/9f3ef890cf3c6ab97bd531c5677f67613d302165d16f8142b2811782a614/cffi-2.1.0-cp311-cp311-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:30b65779d598c370374fefabf138d456fd6f3216bfa7bedfab1ba82025b0cd93", size = 211892, upload-time = "2026-07-06T21:32:29.565Z" },
+    { url = "https://files.pythonhosted.org/packages/22/d7/1a74539db16d8bfd839ff1515948948efbb162e574650fd3d846896eea95/cffi-2.1.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:88023dfe18799507b73f1dbb0d14326a17465de1bc9c9c7655c22845e9ddc3a2", size = 218793, upload-time = "2026-07-06T21:32:30.951Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/d1/9a5b7169499e8e8d8e636de70b97ac7c9447104d2ff1a2cd94790cea5162/cffi-2.1.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:0a96b74cda968eebbad56d973efe5098974f0a9fb323865bf99ea1fd24e3e64c", size = 205737, upload-time = "2026-07-06T21:32:32.216Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/b0/e131a9c41f10607926278453d9596163594fe1c4ebc46efe3b5e5b34eb84/cffi-2.1.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:a5781494d4d400a3f47f8f1da94b324f6e6b440a53387774002890a2a2f4b50f", size = 204909, upload-time = "2026-07-06T21:32:33.655Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/d2/4398416cd699b35167947c6e22aca52c47e69ad5695073c9f1f2c52e04aa/cffi-2.1.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:aa7a1b53a2a4452ada2d1b5dade9960b2522f1e61293a811a077439e39029565", size = 217883, upload-time = "2026-07-06T21:32:35.173Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/a5/d4fe77b589e5e82d43ebc809bf2e6474afe8e48e32ea050b9357645b6471/cffi-2.1.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:9d8272c0e483b024e1b9ad029821470ed8ec65631dbd90217469da0e7cd89f1c", size = 221251, upload-time = "2026-07-06T21:32:36.527Z" },
+    { url = "https://files.pythonhosted.org/packages/22/f0/a2fc43084c0433caf7f461bccc013e28f848d04ee1c5ed7fce71423cf4d9/cffi-2.1.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:7762faa47e8ff7eb80bd261d9a7d8eea2d8baa69de5e95b70c1f338bbe712f02", size = 214250, upload-time = "2026-07-06T21:32:37.852Z" },
+    { url = "https://files.pythonhosted.org/packages/04/8c/b925975448cf20634a9fbd5efceb807219db452653648d2897c0989cab2d/cffi-2.1.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:89095c1968b4ba8285840e131bf2891b09ae137fe2146905acae0354fbce1b5e", size = 219441, upload-time = "2026-07-06T21:32:39.146Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/da/5c4918a2d61d86fa927d716cb3d8e4626ef8dc8f605a599d32f33897f59a/cffi-2.1.0-cp311-cp311-win32.whl", hash = "sha256:64c753a0f87a256020004f37a1c8c02c480e725f910f0b2a0f3f07debd1b2479", size = 174496, upload-time = "2026-07-06T21:32:40.467Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/c8/6c2de1d55cf35ef8b92885d5ef280790f0fb9634d87ea1cc315176aecd61/cffi-2.1.0-cp311-cp311-win_amd64.whl", hash = "sha256:4f26194e3d95e06501b942642855aed4f953d55e95d7d01b7c4483db3ecff458", size = 185113, upload-time = "2026-07-06T21:32:41.761Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/4e/e8d7cb5783f1841a3c8fb3a7735838d7484d08ec08c9f984b14cac1ac0e9/cffi-2.1.0-cp311-cp311-win_arm64.whl", hash = "sha256:35aaea0c7ee0e58a5cd8c2fd1a48fdf7ece0d2699b7ecdda08194e9ce5dd9b3d", size = 179927, upload-time = "2026-07-06T21:32:42.961Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/85/990925db5df586ec90beb97529c853497e7f85ba0234830447faf41c3057/cffi-2.1.0-cp312-cp312-macosx_10_15_x86_64.whl", hash = "sha256:df2b82571a1b30f58a87bf4e5a9e78d2b1eff6c6ce8fd3aa3757221f93f0863f", size = 184829, upload-time = "2026-07-06T21:32:44.324Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/92/e7bb136ad6b5352603732cf907ef862ca103f20f2031c1735a46300c20c9/cffi-2.1.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:78474632761faa0fb96f30b1c928c84ebcf68713cbb80d15bab09dfe61640fde", size = 184728, upload-time = "2026-07-06T21:32:45.683Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/c0/d1ec30ffb370f748f2fb54425972bfef9871e0132e82fb589c46b6676049/cffi-2.1.0-cp312-cp312-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:5972433ad71a9e46516584ef60a0fda12d9dc459938d1539c3ddecf9bdc1368d", size = 214815, upload-time = "2026-07-06T21:32:48.557Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/dc/5620cf930688be01f2d673804291de757a934c90b946dbdc3d84130c2ea4/cffi-2.1.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:b6422532152adf4e59b110cb2808cee7a033800952f5c036b4af047ee43199e7", size = 222429, upload-time = "2026-07-06T21:32:49.848Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/a4/77b53abbf7a1e0beb9637edbef2a94d15f9c822f591e85d439ffd91519a6/cffi-2.1.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:46b1c8db8f6122420f32d02fffb924c2fe9bc772d228c7c711748fff56aabb2b", size = 210315, upload-time = "2026-07-06T21:32:51.221Z" },
+    { url = "https://files.pythonhosted.org/packages/58/0c/f528df19cc94b675087324d4760d9e6d5bfae97d6217aa4fac43de4f5fcc/cffi-2.1.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:d9fafc5aa2e2a39aaf7f8cc0c1f044a9b07fca12e558dca53a3cc5c654ad67a7", size = 208859, upload-time = "2026-07-06T21:32:52.512Z" },
+    { url = "https://files.pythonhosted.org/packages/62/f2/c9522a81c32132799a1972c39f5c5f8b4c8b9f00488a23feaa6c06f07741/cffi-2.1.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:1e9f50d192a3e525b15a75ab5114e442d83d657b7ec29182a991bc9a88fd3a66", size = 221844, upload-time = "2026-07-06T21:32:53.704Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/28/bd53988b9833e8f8ad539d26f4c07a6b3f6bcb1e9e02e7ca038250b3428d/cffi-2.1.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:98fff996e983a36d3aa2eca83af40c5821202e7e6f32d13ae94e3d2286f10cfe", size = 225287, upload-time = "2026-07-06T21:32:54.907Z" },
+    { url = "https://files.pythonhosted.org/packages/79/99/0d0fd37f055224085f42bbb2c022d002e17dde4a97972822327b07d84101/cffi-2.1.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:379de10ce1ba048b1448599d1b37b24caee16309d1ac98d3982fc997f768700b", size = 223681, upload-time = "2026-07-06T21:32:56.329Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/80/c138990aa2a70b1a269f6e06348729836d733d6f970867943f61d367f8cc/cffi-2.1.0-cp312-cp312-win32.whl", hash = "sha256:9b8f0f26ca4e7513c534d351eca551947d053fac438f2a04ac96d882909b0d3a", size = 175269, upload-time = "2026-07-06T21:32:57.777Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/eb/f636456ff21a83fc13c032b58cc5dde061691546ac79efa284b2989b7982/cffi-2.1.0-cp312-cp312-win_amd64.whl", hash = "sha256:c97f080ea627e2863524c5af3836e2270b5f5dfff1f104392b959f8df0c5d384", size = 185881, upload-time = "2026-07-06T21:32:59.253Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/2c/400ea43e721727dca8a65c4521390e9196757caba4a45643acb2b63271b8/cffi-2.1.0-cp312-cp312-win_arm64.whl", hash = "sha256:6d194185eabd279f1c05ebe3504265ddfc5ad2b58d0714f7db9f01da592e9eb6", size = 180088, upload-time = "2026-07-06T21:33:02.278Z" },
+    { url = "https://files.pythonhosted.org/packages/96/88/a996879e2eeccb815f6e3a5967b12a308257412acec882039d386bd2aa7b/cffi-2.1.0-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:10537b1df4967ca26d21e5072d7d54188354483b91dc75058968d3f0cf13fbda", size = 194331, upload-time = "2026-07-06T21:33:03.697Z" },
+    { url = "https://files.pythonhosted.org/packages/58/85/7ae00d5c8dd6266f4e944c3db630f3c5c9a98b61d469c714d848b1d8138a/cffi-2.1.0-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:a95b05f9baf29b91171b3a8bd2020b028835243e7b0ff6bb23e2a3c228518b1b", size = 196966, upload-time = "2026-07-06T21:33:05.353Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/e9/45c3a76ad8d43ad9261f4c95436da61128d3ca545d72b9612c0ab5be0b1c/cffi-2.1.0-cp313-cp313-macosx_10_15_x86_64.whl", hash = "sha256:15faec4adfff450819f3aee0e2e02c812de6edb88203aa58807955db2003472a", size = 184795, upload-time = "2026-07-06T21:33:06.699Z" },
+    { url = "https://files.pythonhosted.org/packages/84/4c/82f132cb4418ee6d953d982b19191e87e2a6372c8a4ce36e50b69d6ade4a/cffi-2.1.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:716ff8ec22f20b4d988b12884086bcef0fc99737043e503f7a3935a6be99b1ea", size = 184746, upload-time = "2026-07-06T21:33:08.071Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/1c/4ed5a0e5bdca6cbc275556de3328dd1b76fd0c11cc13c88fe66d1d8715f2/cffi-2.1.0-cp313-cp313-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:63960549e4f8dc41e31accb97b975abaecfc44c03e396c093a6436763c2ea7db", size = 214747, upload-time = "2026-07-06T21:33:09.671Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/a6/e879bb68cc23a2bc9ba8f4b7d8019f0c2694bad2ab6c4a3701d429439f58/cffi-2.1.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:ff067a8d8d880e7809e4ac88eb009bb848870115317b306666502ccad30b147f", size = 222392, upload-time = "2026-07-06T21:33:10.896Z" },
+    { url = "https://files.pythonhosted.org/packages/88/f6/01890cfd63c08f8eb96a8319b0443690197d240a8bd6346048cf7bde9190/cffi-2.1.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:3b926723c13eba9f81d2ef3820d63aeceec3b2d4639906047bf675cb8a7a500d", size = 210285, upload-time = "2026-07-06T21:33:12.251Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/cf/2b684132056f438567b61e19d690dd31cd0921ace051e0a458be6074369e/cffi-2.1.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:47ff3a8bfd8cb9da1af7524b965127095055654c177fcfc7578debcb015eecd0", size = 208801, upload-time = "2026-07-06T21:33:13.617Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/08/f2e7d62c460faae0926f2d6e423694aa409ced3bc1fe2927a0a6e5f05416/cffi-2.1.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:799416bae98336e400981ff6e532d67d5c709cfb30afb79865a1315f94b0e224", size = 221808, upload-time = "2026-07-06T21:33:15.466Z" },
+    { url = "https://files.pythonhosted.org/packages/38/37/04f54b8e63a02f3d908332c9effbf8c366167c6f733ed8a3d4f79b7e2a1e/cffi-2.1.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:961be50688f7fba2fa65f63712d3b9b341a22311f5253460ce933f52f0de1c8c", size = 225241, upload-time = "2026-07-06T21:33:16.869Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/d6/c72eecca433cd3e681c65ed313ab4835d9d4a379704d0f628a6a05f51c2e/cffi-2.1.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:bf5c6cf48238b0eb4c086978c492ad1cbc22373fc5b2d7353b3a598ce6db887a", size = 223588, upload-time = "2026-07-06T21:33:18.239Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/4b/e706f67279140f92939da3475ad610df18bfd52d50f14953a8e5fede71d5/cffi-2.1.0-cp313-cp313-win32.whl", hash = "sha256:db3eb7d46527159a878ec3460e9d40615bc25ba337d477db681aea6e4f05c5d2", size = 175248, upload-time = "2026-07-06T21:33:19.799Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/47/59eb7975cb0e4ef0afa764ea945b29a5bb4537a9f771cb7d6c8a5dd74c95/cffi-2.1.0-cp313-cp313-win_amd64.whl", hash = "sha256:8e74a6135550c4748af665b1b1118b6aab33b1fc6a16f9aff630af107c3b4512", size = 185717, upload-time = "2026-07-06T21:33:21.47Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/af/34fee85c48f8d94efc8597bc09470c9dd274c145f1c12e0fbc6ab6d38d74/cffi-2.1.0-cp313-cp313-win_arm64.whl", hash = "sha256:2282cd5e38aa8accd03e99d1256af8411c84cdbee6a89d841b563fdbd1f3e50f", size = 180114, upload-time = "2026-07-06T21:33:22.515Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/f0/81478e482afa03f6d18dc8f2afb5edc45b3080853b634b5ed91961be0998/cffi-2.1.0-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:d2117334c3af3bdcb9a88522b844a2bdb5efdc4f71c6c822df55486ae1c3347a", size = 194142, upload-time = "2026-07-06T21:33:23.657Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/95/8de304305cd9204974b0ca051b86d307cafca13aa575a0ef1b44d92c0d8c/cffi-2.1.0-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:702c436735fbe99d59ada02a1f65cfc0d31c0ee8b7290912f8fbc5cd1e4b16c3", size = 196819, upload-time = "2026-07-06T21:33:25.007Z" },
+    { url = "https://files.pythonhosted.org/packages/20/71/7c8372d30e42415602ed9f268f7cfd66f1b855fed881ecd168bcb45dbc0b/cffi-2.1.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:1ff3456eab0d889592d1936d6125bbfbc7ae4d3354a700f8bd80450a66445d4d", size = 184965, upload-time = "2026-07-06T21:33:26.605Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/5c/584e626835f0375c928176c04137c96927165cb8733cdb3150ec04e5ee5e/cffi-2.1.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c4165821e131d6d4ca444347c2b694e2311bcfa3fe5a861cc72968f28867beac", size = 184952, upload-time = "2026-07-06T21:33:27.823Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/d2/065fcae1c73979fac8e054462478d0ff8a29c40cdc2ed7ea5676a061df53/cffi-2.1.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:276f20fffd7b396e12516ba8edf9509210ac248cbbc5acbc39cd512f9f59ebe6", size = 222353, upload-time = "2026-07-06T21:33:29.178Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/a5/e8bbb1ce5b3ac2f53ad6a10bde44318a5a8d99d4f4a000d44a6e39aeb3e4/cffi-2.1.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:7d5980a3433d4b71a5e120f9dd551403d7824e31e2e67124fe2769c404c06913", size = 210051, upload-time = "2026-07-06T21:33:30.534Z" },
+    { url = "https://files.pythonhosted.org/packages/28/ed/c127d3ac36e899c965e3361357c3befacd6578c03f40125183e41c3b219e/cffi-2.1.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:6ca4919c6e4f89aa99c42510b42cf54596892c00b3f9077f6bdd1505e24b9c8d", size = 208630, upload-time = "2026-07-06T21:33:31.753Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/d7/97d3136f81db489ec8d1d67748c110d6c994268fd7528014aa9f2b085e4e/cffi-2.1.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:d53d10f7da99ae46f7373b9150393e9c5eab9b224909982b43832668de4779f5", size = 221593, upload-time = "2026-07-06T21:33:33.044Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/27/93195977168ee63aed233a1a0993a2178798654d1f4bddcdd321d6fd3b21/cffi-2.1.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:c351efb95e832a853a29361675f33a7ce53de1a109cd73fd47af0712213aa4ce", size = 225146, upload-time = "2026-07-06T21:33:34.224Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/c1/6dbd291ee2ae5a50a034aa057207081f545923bbf15dad4511e985aafff5/cffi-2.1.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:dbf7c7a88e2bac086f06d14577332760bdeecc42bdec8ac4077f6260557d9326", size = 223240, upload-time = "2026-07-06T21:33:35.57Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/6f/ade5ce9863a57992a6ea3d0d10d7e29b8749fc127204b3d493d667b2815f/cffi-2.1.0-cp314-cp314-win32.whl", hash = "sha256:1854b724d00f6654c742097d5387569021be12d3a0f770eae1df8f8acfcc6acd", size = 177723, upload-time = "2026-07-06T21:33:51.626Z" },
+    { url = "https://files.pythonhosted.org/packages/41/de/92b9eeed4ae4a21d6fd9b2a2c8505cbed573299902ea73981cc13f7ff62c/cffi-2.1.0-cp314-cp314-win_amd64.whl", hash = "sha256:1b96bfe2c4bd825681b7d311ad6d9b7280a091f43e8f63da5729638083cd3bfb", size = 187937, upload-time = "2026-07-06T21:33:53.403Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/1a/cc6ae6c2913a03aab8898eee57963cf1035b8df5872ed8b9115fcc7e2be8/cffi-2.1.0-cp314-cp314-win_arm64.whl", hash = "sha256:7d28dff1db6764108bc30788d85d61c876beff416d9a49cb9dd7c5a9f34f5804", size = 183001, upload-time = "2026-07-06T21:33:54.74Z" },
+    { url = "https://files.pythonhosted.org/packages/14/f0/134c00ce0779ec86dea2aa1aac69339c2741a8045072676763512363a2ea/cffi-2.1.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:7ea6b3e2c4250ff1de21c630fe72d0f63eb95c2c32ffbf64a358cf4a8836d714", size = 188538, upload-time = "2026-07-06T21:33:36.792Z" },
+    { url = "https://files.pythonhosted.org/packages/50/d8/3b86aba791cb610d24e8a3e1b2cd529e71fa15096b04e4d4e360049d4a4c/cffi-2.1.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:6af371f3767faeffc6ac1ef57cdfd25844403e9d3f476c5537caee499de96376", size = 188230, upload-time = "2026-07-06T21:33:38.011Z" },
+    { url = "https://files.pythonhosted.org/packages/14/d0/117dcd9209255ad8571fbc8c92ef32593a1d294dcec91ddc4e4db50606f2/cffi-2.1.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:eb4e8997a49aa2c08a3e43c9045d224448b8941d88e7ac163c7d383e560cbf98", size = 223899, upload-time = "2026-07-06T21:33:39.514Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/3d/f20f8b886b254e3ad10e15cd4186d3aed49f3e6a35ab37aab9f8f25f7c03/cffi-2.1.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:bf01d8c84cbea96b944c73b22182e6c7c432b3475632b8111dbfdc95ddad6e13", size = 211652, upload-time = "2026-07-06T21:33:40.851Z" },
+    { url = "https://files.pythonhosted.org/packages/28/3b/fad54de07260b93ddeef4b96d0131d57ea900675df1d410ae1deee52d7a6/cffi-2.1.0-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:33eb1ad83ebe8f313e0df035c406227d55a79456704a863fad9842136af5ad7d", size = 210755, upload-time = "2026-07-06T21:33:42.183Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/82/3d5c705acb7abbba9bbd7d79b8e62e0f25b6120eb7ae6ac49f1b721722fe/cffi-2.1.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:ac0f1a2d0cfa7eea3f2aaf006ab6e70e8feeb16b75d65b7e5939982ca2f11056", size = 223933, upload-time = "2026-07-06T21:33:43.603Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/d0/47e338384ab6b1004241002fa616301020cea4fc95f283506565d252f276/cffi-2.1.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:c16914df9fb7f500e440e6875fa23ff5e0b31db01fa9c06af98d59a91f0dc2e4", size = 226749, upload-time = "2026-07-06T21:33:45.046Z" },
+    { url = "https://files.pythonhosted.org/packages/70/25/65bd5b58ea4bfdfc15cde02cb5365f89ef8ab8b2adfb8fe5c4bd4233382f/cffi-2.1.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:5ecbd0499275d57506d397eebe1981cee87b47fcd9ef5c22cab7ed7644a39a94", size = 225703, upload-time = "2026-07-06T21:33:46.374Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/78/aa01ac599a8a4322533d45a1f9bc93b338276d2d59dabbe7c6d92a775c81/cffi-2.1.0-cp314-cp314t-win32.whl", hash = "sha256:7d034dcffa09e9a46c93fa3a3be402096cb5354ac6e41ab8e5cc9cd8b642ad76", size = 182857, upload-time = "2026-07-06T21:33:47.696Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/26/d00496b22de4d4228f32dde94ad996f350c8aad676d63bcca0743c8dea4d/cffi-2.1.0-cp314-cp314t-win_amd64.whl", hash = "sha256:0582a58f3051372229ca8e7f5f589f9e5632678208d8636fea3676711fdf7fe5", size = 194065, upload-time = "2026-07-06T21:33:48.953Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/dd/0c7dbf815a579ff005008a2d815a55d6bb047c349eef536d9dc53d3f0a8d/cffi-2.1.0-cp314-cp314t-win_arm64.whl", hash = "sha256:510aeeeac94811b138077451da1fb18b308a5feab47dd2b603af55804155e1c8", size = 186404, upload-time = "2026-07-06T21:33:50.309Z" },
+    { url = "https://files.pythonhosted.org/packages/55/c7/8c8c50cb11c6750051daf12164098a9a6f027ac4356967fd4d800a07f242/cffi-2.1.0-cp315-cp315-ios_13_0_arm64_iphoneos.whl", hash = "sha256:2e9dabb9abcb7ad15938c7196ad5c1718a4e6d33cc79b4c0209bdb64c4a54a5c", size = 194121, upload-time = "2026-07-06T21:33:56.109Z" },
+    { url = "https://files.pythonhosted.org/packages/99/e2/67680bf19a6b60d2bb7ff83baefa2a4c3d2d7dc0f3277034b802e1fc504c/cffi-2.1.0-cp315-cp315-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:37f525a7e7e50c017fdebe58b787be310ad59357ae43a053943a6e1a6c526001", size = 196820, upload-time = "2026-07-06T21:33:57.288Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/da/4bbe583a3b3a5c8c60892124fe17f3fa3656523faf0d3484eae90f091853/cffi-2.1.0-cp315-cp315-macosx_10_15_x86_64.whl", hash = "sha256:95f2954c2c9473d892eca6e0409f3568b37ab62a8eedb122461f73cc273476e3", size = 184936, upload-time = "2026-07-06T21:33:58.765Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/4b/1f4c36ab273980d7aa75bb126ea4f8971f24a96108acad3a0a084028c57b/cffi-2.1.0-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:cdf2448aab5f661c9315308ec8b93f4e8a1a67a3c733f8631067a2b67d5913dc", size = 185045, upload-time = "2026-07-06T21:34:00.085Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/c3/ad299dc38f3583f8d916b299f028af418a9ec98bc695fcbebeae7420691c/cffi-2.1.0-cp315-cp315-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:90bec57cf82089383bd06a605b3eb8daebf7e5a668520beaf6e327a83a947699", size = 222342, upload-time = "2026-07-06T21:34:01.814Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/d8/df4543cc087245044ed02ef3ad8e0a26619d0075ac7a77a12dc81177851b/cffi-2.1.0-cp315-cp315-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:6274dcb2d15cef48daa73ed1be5a40d501d74dccd0cd6db364776d12cb6ba022", size = 210073, upload-time = "2026-07-06T21:34:03.255Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/0e/fac738d73728c6cea2a88a2883dca54892496cbba88a1dc1f2909cb8a6f5/cffi-2.1.0-cp315-cp315-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:2b71d409cccee78310ab5dec549aed052aaea483346e282c7b02362596e01bb0", size = 208551, upload-time = "2026-07-06T21:34:04.433Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/3f/0b04a700dd64f465c93020253a793a82c9b4dff9961f48facd0df945d9b8/cffi-2.1.0-cp315-cp315-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7d3538f9c0e50670f4deb93dbb696576e60590369cae2faf7de681e597a8a1f1", size = 221649, upload-time = "2026-07-06T21:34:06.157Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/7c/b7379a5704c79eda57ce075869ba70a0368d1c850f803b3c0d078d39dcaf/cffi-2.1.0-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:8f9ec95b8a043d3dfbc74d9abc6f7baf524dd27a8dc160b0a32ff9cdab650c28", size = 225203, upload-time = "2026-07-06T21:34:07.489Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/02/d5e6c43ea85c41bda2a184a3418f195fe7cf602967a8d2b94e085b83deef/cffi-2.1.0-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:af5e2915d41fe6c961694d7bfdc8562942638200f3ce2765dfb8b745cf997629", size = 223263, upload-time = "2026-07-06T21:34:08.712Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/d8/772b8259bf75749adffb1c546828978381fb516f60cf701f6c83daf60c85/cffi-2.1.0-cp315-cp315-win32.whl", hash = "sha256:0a42c688d19fca6e095a53c6a6e2295a5b050a8b289f109adab02a9e61a25de6", size = 177696, upload-time = "2026-07-06T21:34:26.355Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/dd/afa2191fc6d57fedd26e5844a2fe2fcc0bbfa00961bbaa5a41e4921e7cca/cffi-2.1.0-cp315-cp315-win_amd64.whl", hash = "sha256:bccbbb5ee76a61f9d99b5bf3846a51d7fca4b6a732fe46f89295610edaf41853", size = 187914, upload-time = "2026-07-06T21:34:27.58Z" },
+    { url = "https://files.pythonhosted.org/packages/05/ef/6cd4f8c671517162379dc79cfae5aea9106bc38abb89628d5c16adf6a838/cffi-2.1.0-cp315-cp315-win_arm64.whl", hash = "sha256:8d35c139744adb3e727cd51b1a18324bbe44b8bd41bf8322bca4d41289f48eda", size = 183004, upload-time = "2026-07-06T21:34:28.905Z" },
+    { url = "https://files.pythonhosted.org/packages/11/b6/12fc55092817a5faa26fb8c40c7f9d662e11a46ee248c137aafc42517d92/cffi-2.1.0-cp315-cp315t-macosx_10_15_x86_64.whl", hash = "sha256:f9912624a0c0b834b7520d7769b3644453aabc0a7e1c839da7359f050750e9bc", size = 188378, upload-time = "2026-07-06T21:34:09.926Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/2e/cdac88979f295fde5daa69622c7d2111e56e7ceb94f211357fbe452339e4/cffi-2.1.0-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:df92f2aba50eb4d96718b68ef76f2e57a57b54f2fa62333496d16c6d585a85ca", size = 188319, upload-time = "2026-07-06T21:34:11.101Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/27/1d0b408497e41a74795af122d7b603c418c5fed0171450f899afd04e594f/cffi-2.1.0-cp315-cp315t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:0520e1f4c35f44e209cbbb421b67eec42e6a157f59444dfb6058874ff3610e5d", size = 223904, upload-time = "2026-07-06T21:34:12.606Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/31/e115c985105dd7ffb32444505f18ceb874bb42d992af05d5dced7ecf1980/cffi-2.1.0-cp315-cp315t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:3681e031db29958a7502f5c0c9d6bbc4c36cb20f7b104086fa642d1799631ff8", size = 211554, upload-time = "2026-07-06T21:34:13.987Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/67/9e6e09409336d9e515c58367e7cfcf4f89df06ad25252675595a58eb59d5/cffi-2.1.0-cp315-cp315t-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:762f99479dcb369f60ab9017ad4ab97a36a1dd7c1ee5a3b15db0f4b8659120cd", size = 210795, upload-time = "2026-07-06T21:34:15.972Z" },
+    { url = "https://files.pythonhosted.org/packages/19/e5/d3cc82a4a0be7902af279c04181ad038449c096734464a5ae1de3e1401bd/cffi-2.1.0-cp315-cp315t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:0611e7ebf90573a535ebdc33ae9da222d037853983e13359f580fab781ca017f", size = 223843, upload-time = "2026-07-06T21:34:17.509Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/65/b434abc97ce7cecc2c640fde160507c0ecc7e21544b483ba3325d2e2ea17/cffi-2.1.0-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:86cf8755a791f72c85dc287128cc62d4f24d392e3f1e15837245623f4a33cccc", size = 226773, upload-time = "2026-07-06T21:34:19.05Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/9f/d4dc66ca651eb1145a133314cda721abf13cfac3d28c4a0402263ae6ad75/cffi-2.1.0-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:ba00f661f8ba35d075c937174e27c2c421cec3942fd2e0ea3e66996757c0fdd9", size = 225719, upload-time = "2026-07-06T21:34:20.576Z" },
+    { url = "https://files.pythonhosted.org/packages/68/5a/e536c528bc8057496c360c0978559a2dc45653f89dd6151078aa7d8fca1a/cffi-2.1.0-cp315-cp315t-win32.whl", hash = "sha256:cb96698e3c7413d906ce83f8ffd245ec1bd94707541f299d0ce4d6b0193e982b", size = 182760, upload-time = "2026-07-06T21:34:22.059Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/0b/0ffe8b82d3875bced5fa1e7986a7a46b748262a40ab7f60b475eb9fb1bb3/cffi-2.1.0-cp315-cp315t-win_amd64.whl", hash = "sha256:f146d154428a2523f9cc7936c02353c2459b8f6cf07d3cd1ee1c0a611109c5d5", size = 193769, upload-time = "2026-07-06T21:34:23.589Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/17/1073b53b68c9b5ca6914adf5f8bf55aacc2d3be102418c90700160ea8605/cffi-2.1.0-cp315-cp315t-win_arm64.whl", hash = "sha256:cbb7640ce37159548d2147b5b8c241f962143d4c71231431820783f4dc78f210", size = 186405, upload-time = "2026-07-06T21:34:24.857Z" },
+]
+
 [[package]]
 name = "click"
 version = "8.3.1"
@@ -63,6 +174,62 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
 ]
 
+[[package]]
+name = "cryptography"
+version = "49.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/1f/99/d1c90d6041656cc6ee229dc99cd67fd0cd5aec3c5f7d72fffc27cc750054/cryptography-49.0.0.tar.gz", hash = "sha256:f89660a348f4f78a92366240a61404e337586ef7f5909a2fef59ca88ef505493", size = 854345, upload-time = "2026-06-12T20:02:30.512Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/9b/22/adf66990e63584a68dfb50c24f48a125c07b1699899381c8151e63ed458c/cryptography-49.0.0-cp311-abi3-macosx_11_0_arm64.whl", hash = "sha256:966fe0e9c67490071f14c0d2b1cb2dfb3023c5ce39457343931415f08382f2db", size = 4032100, upload-time = "2026-06-12T20:02:32.143Z" },
+    { url = "https://files.pythonhosted.org/packages/09/41/3797cfaf69cae04a13ee78ebd83f0678d9c02b4779d21ce24445326f1a69/cryptography-49.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:36d1709f992593689b45bda411498d62c6e365f2ca00b84657d4dadd24de16db", size = 4692978, upload-time = "2026-06-12T20:01:21.305Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/8b/43011f7ebe515a8aa20d61f290a326cd890c2e738e16e59eaff8d9c3a412/cryptography-49.0.0-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:0e959b578856a3924bc0cbb710fc12c387b9412a951389f3ca61704a9e25f325", size = 4716422, upload-time = "2026-06-12T20:01:48.566Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/91/01ce7303a4579e6d3a6abef01bd322848e9ea7a219adcabc5048b9033571/cryptography-49.0.0-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:53ecee2e23f7169b6117e99fc8a944e5e50f79e69758a83b52a00cb98ab2b2d2", size = 4700503, upload-time = "2026-06-12T20:02:47.091Z" },
+    { url = "https://files.pythonhosted.org/packages/62/99/a2c95cf8293f07491e9e27c20cc4dcd18176d944e674679adeb1d0173fd6/cryptography-49.0.0-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:2eda353d8a27bcbcaa4cbed18994a74ab4d19a2ca897db188ea269ab9b71419b", size = 5309779, upload-time = "2026-06-12T20:02:08.987Z" },
+    { url = "https://files.pythonhosted.org/packages/20/2c/0622f20ff02b2ef32558733443805dc82fd4c275be01b2d19d14676f3a1b/cryptography-49.0.0-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:2afe9051da7ae7bd5905da5a949280c7d2bb75682e188f650a9d0f2756b834c6", size = 4749683, upload-time = "2026-06-12T20:02:03.335Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/5b/c5246635d5fd3b64e0d45ae10e99fd32fe9676a79915ccfe5a61ba9af1a5/cryptography-49.0.0-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:0b82e28ee398a386f0807bba7884d30f25218855690f45115831bcce5d90822c", size = 4337874, upload-time = "2026-06-12T20:02:54.323Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/88/05563c7fe2e914e87d1a536d06fe83e66b4e1d95cb593e05aea375531da8/cryptography-49.0.0-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:ccac2bfebc306b862133e3bb71f3f6ee8bb525240089b2d952e4144b3a6d5da7", size = 4700283, upload-time = "2026-06-12T20:01:34.822Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/b6/d7696e4e890d6ae1469935164c9e5215c557671cb78d6e3f458ccceaa632/cryptography-49.0.0-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:d0527ce944105f257f605a827d6ebead966c752038b6e8656abb9c5edee6fc68", size = 5265844, upload-time = "2026-06-12T20:01:24.09Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/3c/f3ad17eecc1a57b0ba236dc01f90e783c51f4a2f35f64777cc4f47a184b2/cryptography-49.0.0-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:cbc77da8c523d5abd028635ba850a6966fcee2c82e2bf65a41d1d8afe0f98be9", size = 4749290, upload-time = "2026-06-12T20:01:30.848Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/01/339573cf1023163a400b0b5d16f6d507de413b9f60be6fd1b77feeaf6737/cryptography-49.0.0-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:b87e65d263b3e5d3bb92a57e2a6638e2f31110fa7aa890c7b2dbba42248d0a3f", size = 4834612, upload-time = "2026-06-12T20:01:29.246Z" },
+    { url = "https://files.pythonhosted.org/packages/71/fd/577302e213a1be9468f92d1afef66fcf1ef83d516819d9992ca547f592bd/cryptography-49.0.0-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:66ec79c3904820572d7e987abdf304281f141d37ad9a489b8e97066e7b9b6459", size = 4980804, upload-time = "2026-06-12T20:01:42.853Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/09/f42b1d190c5ba75f72062a387f8030d1d75f6ab035788f1d9c4b01de6525/cryptography-49.0.0-cp311-abi3-win_amd64.whl", hash = "sha256:e5dfc1e64de5677cec922ffa8da89c546d0415bf6efdf081842e5d44c84e1f0e", size = 3810026, upload-time = "2026-06-12T20:02:39.262Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/9e/db72b3ae7fc9cfad53e630e56c6ae83b9b6ff0bf3718ffb8012d20b3aabf/cryptography-49.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:73a205dce83953d131a4aa1e0fd917a2fd1c5b1eef251e9d7152efefcbf5caf7", size = 4013892, upload-time = "2026-06-12T20:02:10.735Z" },
+    { url = "https://files.pythonhosted.org/packages/86/12/c48a424f38db03027be9f7ed5c7dc5de9933dbee992865f98b13727a009d/cryptography-49.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:196ecd6a36e4e9aa10270393bb98d8df88fccee0bf1e5128b91ae4eb4375896d", size = 4678835, upload-time = "2026-06-12T20:02:48.743Z" },
+    { url = "https://files.pythonhosted.org/packages/68/28/8a3ad4653662c93fc44dc4e5d8fd374c25c42e07b34bbfbadf49cf57a5a8/cryptography-49.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7abcee80084cda3f7691f3eb1ce480d8df49cec637b429aa35986c1de71738aa", size = 4697239, upload-time = "2026-06-12T20:02:56.03Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/b2/2193fc74f81aee4f9b62733133b73b5176718932ed8f2e4b03fa040480a6/cryptography-49.0.0-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:4ae387c9cb68ea569ca17e490d66d8142b81c3cc814bf179974b7d146e490bbb", size = 4685593, upload-time = "2026-06-12T20:02:50.666Z" },
+    { url = "https://files.pythonhosted.org/packages/47/f1/1d3eaa243bfc5de4a187b22aa8c048b3e4980bfbe830ac46e6bac2e66947/cryptography-49.0.0-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:f37d847238971164fdbc68ade6f6574aecc9c0af714190e2083429ff68f4ce9d", size = 5289961, upload-time = "2026-06-12T20:01:46.468Z" },
+    { url = "https://files.pythonhosted.org/packages/58/39/2d51306721330c486495853eda1c567880ff036de15a14c4b74f399934af/cryptography-49.0.0-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:c2bc30226390d60ea19d9f82b19db005fe0452154a23c1c410c12ea801e43561", size = 4731145, upload-time = "2026-06-12T20:02:16.832Z" },
+    { url = "https://files.pythonhosted.org/packages/17/50/983e838c7fd0d87fd8c969bcdd328edaf5f756e38df5281637424c155873/cryptography-49.0.0-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:07cab27cc7b7e0fd28e5e26bb9eeedde5c135c868b46de4a27845abe94af6122", size = 4321719, upload-time = "2026-06-12T20:02:52.611Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/f5/8f571d7e27c55bce9f76f026143bcb1e040a4233149ecca0bea5fa5dd5f7/cryptography-49.0.0-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:b20133d204d2bb56ba047642199603876c872026ca53e79c35b83772ab2cc505", size = 4685209, upload-time = "2026-06-12T20:02:07.282Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/84/0e27016a6fc5a0886f797018b26aa42f40c09a82332bff77822a451deaaa/cryptography-49.0.0-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:b970c6da94d5bb18629db453d14f2a1300f6bf59b61e9b82377931ef95504866", size = 5246285, upload-time = "2026-06-12T20:01:32.439Z" },
+    { url = "https://files.pythonhosted.org/packages/11/2d/5e1fb307cb5931881516b464c98774b3f2c36b5d4bb9a2830253cf553cad/cryptography-49.0.0-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:d8ecde755e2e91bf773fc94e8c9d730cd7f2007004cb492263a794ec3899a1c8", size = 4730441, upload-time = "2026-06-12T20:02:01.469Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/c0/bff5a02ee731d207d6a1ed51732549d8c53d2bc8da1d10ec6f2844201d68/cryptography-49.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e3fb64c420688e5319ae25113a354015abbd8dffbfbc41781a1ea66fc7622ac3", size = 4815869, upload-time = "2026-06-12T20:01:36.574Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/26/814681d14248d95d73d5c3eea0c39a94eb8302df966f670a2c60de90974b/cryptography-49.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:32703d93296f5c1f4b53349ad3a250c2cae0fdecd3a3dd5d47e616d8d616af27", size = 4960948, upload-time = "2026-06-12T20:02:18.688Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/fe/93ecac273d3738939d023612ad12cca9a3740a5345d69fda04134c43fd96/cryptography-49.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:33cd0565932807baddb67b96dbee92f2c374b5c89dee09fd74079aeb8c8dba61", size = 3799153, upload-time = "2026-06-12T20:01:39.059Z" },
+    { url = "https://files.pythonhosted.org/packages/19/2a/5bb823f5bedcf80718cea7fbc95ec5515cca3769633c4b01a32be7f30e7c/cryptography-49.0.0-cp39-abi3-macosx_11_0_arm64.whl", hash = "sha256:ec5e529fb80935c94fe7b729f9972b50e351a0e6b50aa294fd5cabb109fcc29a", size = 4025947, upload-time = "2026-06-12T20:01:25.745Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/df/40577043ca124e17012f408ddddaeb213b856336ac82ddb3bc915f39e29f/cryptography-49.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f78ff2c9ed8dc2d036b0f4d640e22522213d047c1b14e61205a7e55c80a494d4", size = 4692429, upload-time = "2026-06-12T20:01:53.628Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/99/2d13299eb3dd27b02dcfaafcc91d6b5cb3329f7cbd6d8f51921acd566c1a/cryptography-49.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:35b151772baff2c74cba7fa290ceaff4c3b11c0c881eb93eb5dbc05a7cfbba18", size = 4700968, upload-time = "2026-06-12T20:02:45.383Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/4d/9c0cd02f95e2602dd5e563da149ee0830abef3537be8b34dc56281ebe27a/cryptography-49.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:0f21641cf4b30fca7aee061ced0ec7ad7b073518088b7c9969a297c0ae796c69", size = 4697758, upload-time = "2026-06-12T20:01:41.13Z" },
+    { url = "https://files.pythonhosted.org/packages/24/01/186c825898477d77e2324d5360fefe622ff1d8d1963ec0554e2cada8ec77/cryptography-49.0.0-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:9e82dcc8e56052715fb18b2429e3bca4823b1629136a2084fc45a9a5cecb9b64", size = 5298863, upload-time = "2026-06-12T20:02:24.579Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/7b/62cbbab75d0659865bf0273790031544a0b16c8072d258f9428dcd8190dc/cryptography-49.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:6f2debedf9ca60cf1d5bd466475638af5130f89965605cd818484d19987d3a21", size = 4735983, upload-time = "2026-06-12T20:01:50.14Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/72/3e798c064bc39e471008075d0f9bc9daf77a80879c092e4a8e170c585ed4/cryptography-49.0.0-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:8c25ceb16df5b9435f3f6a9829204985b0e0cbee3b48aacd432c7d2c850b44d9", size = 4334173, upload-time = "2026-06-12T20:01:44.743Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/ee/6fca21d1ac73e06f8bef71940abfd4d2f6472b4bca284d770f32bd4086f6/cryptography-49.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:28d8b15e6275f12c8a207dc309dfa957903c927d08d0cc937ee3f63f200693cc", size = 4697298, upload-time = "2026-06-12T20:02:20.918Z" },
+    { url = "https://files.pythonhosted.org/packages/67/d0/a5fcd3515f0bae49a7b6d0413cc1bdccdcc1fc0047037a0d480642cdc5d6/cryptography-49.0.0-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:6fc361c34fb6aac015ce19435876635e5c6d21db31998b0920f675f131e043b8", size = 5254338, upload-time = "2026-06-12T20:02:22.737Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/84/84fe36f19caf857d61cb7fc9c63035a47ffabd84ea12d1d393148efa3615/cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:2400ef9c9e2299a25614eb1dea3db54a69b1349efd043bfac9c67630d136df36", size = 4735650, upload-time = "2026-06-12T20:02:41.389Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/a0/db537264e234f7273a73ec020873d6d6b39dfd8a53db78b550ca8320440e/cryptography-49.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:67e1d20ad9ef3a563c59ef22e7a8a0b8210bd26604369ea4a30a7c66aefe504e", size = 4834820, upload-time = "2026-06-12T20:01:51.847Z" },
+    { url = "https://files.pythonhosted.org/packages/93/77/8df9eb486495979bccecd1062e2eaf435250e84437040295b57d09048b0b/cryptography-49.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:42b0684e0e40cf26122427802486f6d93aea593612603a94fbf260c7eb1e9c1b", size = 4967968, upload-time = "2026-06-12T20:02:12.524Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/e6/f60198ea8d9dfa15fff9ed4ca02ce362f6eadd9ba757dcc50634c4257b63/cryptography-49.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:026ac7423e6fa66872d3bf889be5974507da3944f866f704fa200eadacd00001", size = 3785547, upload-time = "2026-06-12T20:02:26.847Z" },
+    { url = "https://files.pythonhosted.org/packages/63/d3/4a83af35d65e3fad632c926fad684c193ea4398569ccb0bbbc7fe8f5dc9a/cryptography-49.0.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:fc1e275c2f1d97b1a6450b8b0ea3ebfa6e087a611c2b26cb2404d48588abab7b", size = 3993685, upload-time = "2026-06-12T20:02:14.883Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/a7/f9dac0ab7f80368c56993a7bf638ef9935f825c91902798481fac0898138/cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:c83782480a4a9da4d0feb51950131ba32e12e70813848b3343f6e18c28a66838", size = 4676239, upload-time = "2026-06-12T20:02:28.793Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/70/2ba3769dd0ae167e2f33dfa9592d45db6ff9a61d62ca1a5b3d1bdd09068f/cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:b39efa323140595abd3ecca8529d321ae50f55f3aa3ba9cc81ea56a6011953d5", size = 4715584, upload-time = "2026-06-12T20:01:27.495Z" },
+    { url = "https://files.pythonhosted.org/packages/94/64/2923570ac1c0bd3a737aa366ac3abbbbde273042308b8cde95e2364a6e6a/cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:b47db11c2c3525083296069b98ac5221907455e989ae0c2e3008bde851921615", size = 4675885, upload-time = "2026-06-12T20:01:55.49Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/f8/614dc7e051418cfe53d55173c1e24c6b0085e89996fe90508c2fdf769aef/cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:084ef1af862eb07ec46d25f68689f2102a9fc0e05ce7b80f14f5fe51e4eef0f6", size = 4715449, upload-time = "2026-06-12T20:02:05.469Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/50/a9caea39ad19c431c1a3f8a31114df65b260cdfe67786b6c7e7c040c4c44/cryptography-49.0.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:be9fcb48a55f023493482827d4f459bd263cc20efde64f204b97c123201850c6", size = 3783731, upload-time = "2026-06-12T20:02:43.319Z" },
+]
+
 [[package]]
 name = "evaleval"
 version = "0.2.7"
@@ -125,6 +292,67 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/2a/39/e50c7c3a983047577ee07d2a9e53faf5a69493943ec3f6a384bdc792deb2/httpx-0.28.1-py3-none-any.whl", hash = "sha256:d909fcccc110f8c7faf814ca82a9a4d816bc5a6dbfea25d6591d6985b8ba59ad", size = 73517, upload-time = "2024-12-06T15:37:21.509Z" },
 ]
 
+[[package]]
+name = "hypothesis"
+version = "6.156.7"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "sortedcontainers" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/39/a8/654d7533861cfdc291e55d5c335fdff2958dfd4833f7ff17c17de063b036/hypothesis-6.156.7.tar.gz", hash = "sha256:a646061075d13ebeb763eeafe3a68604483678b2c0eed90dde2ab8ff21abb62a", size = 476259, upload-time = "2026-07-18T12:16:31.862Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e6/d5/d52b00c6b7a059695beb1a68cfb76f9e9b50cbc3655278a671243d447961/hypothesis-6.156.7-cp310-abi3-macosx_10_12_x86_64.whl", hash = "sha256:cb227db6ab96667b44ace873cb5d6e9b1819c362d5ad30267ec3f279be6059dd", size = 748085, upload-time = "2026-07-18T12:15:39.252Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/0e/7d9408e51862774b8ea09da12d3159efd0d4e33d27416e3139de40f26383/hypothesis-6.156.7-cp310-abi3-macosx_11_0_arm64.whl", hash = "sha256:8706f34f3c6d84db5d5a857920da27412e598a134a935070f2466f1cd32cf598", size = 742726, upload-time = "2026-07-18T12:15:28.506Z" },
+    { url = "https://files.pythonhosted.org/packages/72/9f/12584e813b8e1d807344b02976a98808cc9a41fe2c64aedf1d86b0ed8dd2/hypothesis-6.156.7-cp310-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ac49a158abcad440513b463b7a1e8471a0ff2c3c31f8f01a61aae1e9dac19756", size = 1070224, upload-time = "2026-07-18T12:16:04.786Z" },
+    { url = "https://files.pythonhosted.org/packages/74/7d/036e0ba919c592d375ca82fc452c9f1a7bd0a32092fabf4e0849c18fc206/hypothesis-6.156.7-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:aec915de6c6ee5adaa05a22602d1ed521e1b187e6b23d416741a0aa9dea75923", size = 1121701, upload-time = "2026-07-18T12:15:24.003Z" },
+    { url = "https://files.pythonhosted.org/packages/de/5c/bec7b48fc78c3683ee01e9111262a6871a9a8c571d9a2698d5646cba63a4/hypothesis-6.156.7-cp310-abi3-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:317b828b52fb42184541c56c501b14f19cdf478e5cc27f0ff327b08ceb8048bc", size = 1111143, upload-time = "2026-07-18T12:15:15.496Z" },
+    { url = "https://files.pythonhosted.org/packages/76/b1/23803fd70851bf10eeb1b1ad747b813a94ff1ff479721870658a2fef366d/hypothesis-6.156.7-cp310-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:8f1d9b2b80a961745e8603983e43c79721bd1e08c7b11e59782fbe5d999f2e9e", size = 1244920, upload-time = "2026-07-18T12:16:12.689Z" },
+    { url = "https://files.pythonhosted.org/packages/09/01/6c2826eb077cb2815e4b6b53261650af959f94a0fd7019ea5681bcf0bc07/hypothesis-6.156.7-cp310-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:90709a411250637a4a3e7e025f5c5934ce26000566b0a9c257311972185f1574", size = 1288673, upload-time = "2026-07-18T12:15:14.093Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/e2/1acf3718536ed6ed96bdb8d034dcb28c8370be2382c954e7dd143cf2b298/hypothesis-6.156.7-cp310-abi3-win32.whl", hash = "sha256:6a5ddbb137b56829b743420865788947a333289b2809cbb5cc3396f22f497ae0", size = 635183, upload-time = "2026-07-18T12:15:41.851Z" },
+    { url = "https://files.pythonhosted.org/packages/13/dc/8fb902c649444357b5732a316dbb7f7b6cee65440e469db45578d60d7ae7/hypothesis-6.156.7-cp310-abi3-win_amd64.whl", hash = "sha256:84d876ca599d8b5131b218050708750c848e5c0513210423e49f3518035eda3f", size = 640977, upload-time = "2026-07-18T12:15:25.168Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/6b/b97e666503ff04af8d8a4bebac26c685f05b70394f0466d71a648ab3719b/hypothesis-6.156.7-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:b486272b3fbef0adea2f2b9f929642f7aaa454447a39bb988bb404372537cbff", size = 748550, upload-time = "2026-07-18T12:15:57.109Z" },
+    { url = "https://files.pythonhosted.org/packages/db/3a/574b8476607e6dbdbde56e1732c3b73fa63486babbd9676f677d6d2e7fea/hypothesis-6.156.7-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:cf115f228cfefe7651a66fd25d601783b11366aaa336d826a6820f5d4a111967", size = 743341, upload-time = "2026-07-18T12:16:09.45Z" },
+    { url = "https://files.pythonhosted.org/packages/21/c2/55d18d5fd99254307b776f340390930ba5548c9e41999aa6c5a4f7a76a28/hypothesis-6.156.7-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e373bfbeccd0b4ea181e1076ca31b6252f70d95fd735e867959074d5d9638eaa", size = 1070864, upload-time = "2026-07-18T12:15:33.683Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/07/4170c3000ba06b6d3fd0e4434d49ce69044dcc161038ee36010018fb9d9e/hypothesis-6.156.7-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f5efbc419e7b2774a5c66e7349851a58a69bc56138ee70d543ec1d4833aa8883", size = 1122080, upload-time = "2026-07-18T12:16:25.889Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/d5/fff0db43896163f9a8a115e942c60f2d07fe75fb8d339ed42aec83dfcffb/hypothesis-6.156.7-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:080439d4930600742e4f7878929e71a3c4f0e31f4ac99812d675ed95086a221b", size = 1245772, upload-time = "2026-07-18T12:16:07.801Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/96/d449714acd4a4cad5590d74f4644f2a1c163b8055eebbe6a6278400fdaab/hypothesis-6.156.7-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:43e2aef269045af0531f4facd0b93f1c7c6d50147ce69a9b0a8b0285b0f13638", size = 1289045, upload-time = "2026-07-18T12:16:30.36Z" },
+    { url = "https://files.pythonhosted.org/packages/69/80/3872f8fbe9b2035b7a44c0911cc52b40bed75388e99b5c298077b75c00b1/hypothesis-6.156.7-cp311-cp311-win_amd64.whl", hash = "sha256:f9b1679aa75ab8452767cd8af1a91de0b8615b2057134079f78628faf9f49bfb", size = 640786, upload-time = "2026-07-18T12:15:17.963Z" },
+    { url = "https://files.pythonhosted.org/packages/10/46/65e5ec7694b88af0e4b79cd0972ef4bc9b6b1ef4e5a7de98c45cc63a19f0/hypothesis-6.156.7-cp312-cp312-macosx_10_12_x86_64.whl", hash = "sha256:a8ec2634571c1048d6c69a620aacae0a43533ea2fe36aff52a0d27720f2f8017", size = 748950, upload-time = "2026-07-18T12:15:44.372Z" },
+    { url = "https://files.pythonhosted.org/packages/21/59/f00a5e5a7504d6c999042d0ea98b4fb4c7fa45523379b5c1233f667b1425/hypothesis-6.156.7-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:3f122fc5db966d4f66b61c37c8e69ed38290891dc11aee4ca0ac1ac07d31cc6b", size = 741468, upload-time = "2026-07-18T12:15:08.797Z" },
+    { url = "https://files.pythonhosted.org/packages/42/d7/649c22c1ac2d273293b91977a10adb40ad59663bf23496a4c224eb5d150b/hypothesis-6.156.7-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:aa2e4958fd25622303824b023721f4199110473cf34e29d331db255568ee9931", size = 1069808, upload-time = "2026-07-18T12:15:40.644Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/bf/d8053ff8f0d9506098ba5373543be4f84eba14543f506281bbc2d5da481f/hypothesis-6.156.7-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9841c485148830f2f4755923b4ef3648c42792bf9d8896b3a530d6d7b7999eef", size = 1121058, upload-time = "2026-07-18T12:16:28.879Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/62/fa89af5dd25a181cdc9bf5c6dd706ced8b2bf886f6537151c06a25b65a0e/hypothesis-6.156.7-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:b3fdcba3697df6981c4d9916b1cb03229cb92235db27e410447db5fe564b9598", size = 1244097, upload-time = "2026-07-18T12:15:30.95Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/63/c95a954fbd6c2059141be356afbefda6a7a7955f104d0d3cdc6a2b5415ac/hypothesis-6.156.7-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:7fd38f6879808194d1e196b26d0f335fb9fd717ce3fe3ab2ab79562d7d22cd17", size = 1287646, upload-time = "2026-07-18T12:16:15.853Z" },
+    { url = "https://files.pythonhosted.org/packages/39/ff/db93ab090e7a05fda97900f4290a3cab67e777bce47ca5d3cf59a68f02bc/hypothesis-6.156.7-cp312-cp312-win_amd64.whl", hash = "sha256:6bd58e06628863212ecb46c80546ba6bb6ab8d018b6d3f5cf3ad0ed639c5a3cd", size = 638291, upload-time = "2026-07-18T12:15:58.44Z" },
+    { url = "https://files.pythonhosted.org/packages/57/c7/80313bf239c6431f05b5e98cf6d4241cd6d1f570e4f0953a09ba0e034a5c/hypothesis-6.156.7-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:bc0688c17802bad5dc77c5d56f2d2f57bdcde52350f1858bd44f156608d29311", size = 749321, upload-time = "2026-07-18T12:15:46.929Z" },
+    { url = "https://files.pythonhosted.org/packages/97/60/54693423e0b0df8005532fa0f70daa31ef023e2d974acb465e87e520cf0e/hypothesis-6.156.7-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:dd3aa1bc6994ffd9b7c484dc6ecdd07455dabaa171cc1665b3541309c2203721", size = 741778, upload-time = "2026-07-18T12:15:48.359Z" },
+    { url = "https://files.pythonhosted.org/packages/10/5b/6090f8f47d2a5d95ee7863bccc71f448a58001ad4b556fa47f8ec588018f/hypothesis-6.156.7-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:160c74f54576e566922055730c578c61b421069f5aeec21fbe3759284071aed6", size = 1070014, upload-time = "2026-07-18T12:15:53.958Z" },
+    { url = "https://files.pythonhosted.org/packages/78/0f/7d46320495f9ddb42ea0e99652a49c118a4c289a46ce2e72ea729e056a8c/hypothesis-6.156.7-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e8b52ac55d0a8e09254840f81787a3a727f771cb7af46dd854139b438ab4d7e1", size = 1121225, upload-time = "2026-07-18T12:16:20.907Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/99/7dfbed6ee39b8899197c8dd68adbc364a0d6594d07a3bf14880cbf25ba31/hypothesis-6.156.7-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:ad5f3250ed768b2b98088d3fd3c902fadb4edf2282ed1751e18e712b55fbd060", size = 1244459, upload-time = "2026-07-18T12:16:22.613Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/63/3d2ce8803616bc4528e253a744477ca8ba61e6c5ae9ce0bfb751a16d3892/hypothesis-6.156.7-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:79c90a535ca3910af614b568a487545b4ce20ee3ddcdd3c25a27628e355e9470", size = 1287988, upload-time = "2026-07-18T12:16:14.248Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/92/d8454244f55ad18b0392cc44e982111b8595348ff7c704db07f65a8df28e/hypothesis-6.156.7-cp313-cp313-win_amd64.whl", hash = "sha256:5f7b92b8aa2803881e9aed3511cb2fb88e1aa9dc615dd1e4ce68d51a5035e86b", size = 638511, upload-time = "2026-07-18T12:15:45.728Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/09/cf6e1eef6d56abd2b87551bcbe926e1ddf2f099b98bd8f0aa31e4cecd8a3/hypothesis-6.156.7-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:9c3ef9b0370e393617266d645a574fbebcbd25ead0c9058a17e2278790f7bdf7", size = 749397, upload-time = "2026-07-18T12:15:51.213Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/f4/a451d9220635f4f6c9de7d28247ec2ca8cc8162abf4cbcc8785831e0b058/hypothesis-6.156.7-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:ecec3ab386f1f4f4d8607dcecc9e3ff6924a9c8cf2d8f5f5dcde37d99fae08d2", size = 741909, upload-time = "2026-07-18T12:16:27.361Z" },
+    { url = "https://files.pythonhosted.org/packages/87/cd/40e3c78289619fc65412b2fb2bb43efd61c87cd97d29b4b397f365b20fbb/hypothesis-6.156.7-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:24e09a82fb80166a9e92a8579537fae2858946dcf364de21bbb6fa529d5b4848", size = 1070292, upload-time = "2026-07-18T12:16:01.482Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/1b/ad83da2595b71d078f252d034aa49c396fcdd94a15a4535407fe106f0629/hypothesis-6.156.7-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c9e3d6120bb4069e63b555b1b3e6eac6ef662acfb3146cd2579bc226c9c92aee", size = 1121520, upload-time = "2026-07-18T12:15:16.638Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/d6/318524efa95ac9868a7589dce676c5241b56d2c6ad39b0b6e2a6d0669eff/hypothesis-6.156.7-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:992b3c8424e9d8daf27107bbb14fb194f9155edcea28f0c6efd66b007fe7cfa3", size = 1244807, upload-time = "2026-07-18T12:15:35.541Z" },
+    { url = "https://files.pythonhosted.org/packages/10/da/8225a4e51c2ba06152cf5e89566cb5d1eef7c16132cfe134774355677d22/hypothesis-6.156.7-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:783033b5d398272b332705306612fd6280b23ba7fa818221cf68c08604a3a532", size = 1288261, upload-time = "2026-07-18T12:15:49.82Z" },
+    { url = "https://files.pythonhosted.org/packages/51/6d/1722c49b2eaf728c08591e3b1a7c77a06664e8227acda5a23e323fa47969/hypothesis-6.156.7-cp314-cp314-pyemscripten_2026_0_wasm32.whl", hash = "sha256:d780b494c9caa06cb17b69fa87af688fc9944203d7fa050d41fba2db370bf03a", size = 586675, upload-time = "2026-07-18T12:16:24.252Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/d5/ec1da06da07ee1fe7fc2ca31fdc9f94653f02b684485fb0972e330e80a5f/hypothesis-6.156.7-cp314-cp314-win_amd64.whl", hash = "sha256:a612ed61dc2341d42f282caca98787e85534613381ba0d9cc2829858d293985d", size = 638331, upload-time = "2026-07-18T12:16:19.062Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/f7/d0c4fdc42d1c70c76ebeaf51295fedb1401457bd4bfef033d76a22594c8d/hypothesis-6.156.7-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:847a07059a1029ae64c5fd1480737d3615326424cfe91c89e47e4ea3a0b543e7", size = 747280, upload-time = "2026-07-18T12:16:03.41Z" },
+    { url = "https://files.pythonhosted.org/packages/61/c1/15fd29960f31ec95cc7300f21e74f0a54a68e0c118ca5822e817929ef70b/hypothesis-6.156.7-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:b933f54a8176d5f0e7fdf73ff933154ec5551ec0996081ae01bec75ecea1ef26", size = 740552, upload-time = "2026-07-18T12:15:43.098Z" },
+    { url = "https://files.pythonhosted.org/packages/14/0e/22564a3e479850c86fcf835eaea8551da1f79e5f687fe1f84b7c24c40bfa/hypothesis-6.156.7-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:540933cdb53d0d08ee3fd47af3d78ed6b785db434afe12f08dc9f4b56400c5c9", size = 1069465, upload-time = "2026-07-18T12:15:32.314Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/e0/add146dfd54d4b8616053823da30385f4c959a80903f9b6825fc39a8a687/hypothesis-6.156.7-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:53f53c665a82e75da49a78e33a353dd654afa96176d7c396ea59c3574c0ed3f6", size = 1120529, upload-time = "2026-07-18T12:15:22.766Z" },
+    { url = "https://files.pythonhosted.org/packages/12/33/4d9d4c57933b98df397a6a0d5f3700c2389358580d780661cfccbd43c836/hypothesis-6.156.7-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:a33a1e82149916c4662811e48870aa0dab45ecca0dd5a76e6bae39067e6f4cff", size = 1243233, upload-time = "2026-07-18T12:15:29.65Z" },
+    { url = "https://files.pythonhosted.org/packages/47/b6/c476ba0ba65e8640e38ce3971d0a63d492d612ab3fcc724a5662395f89b6/hypothesis-6.156.7-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:96553167deab92c5d02d3854d865ae8e66850491eedda45f8306e88fe906e03f", size = 1287045, upload-time = "2026-07-18T12:16:11.136Z" },
+    { url = "https://files.pythonhosted.org/packages/de/75/43e4dec9ccd56ed665f9dd3e78398453e16b41dac33ed56ea2efa92e3024/hypothesis-6.156.7-cp314-cp314t-win_amd64.whl", hash = "sha256:7884cea7ebe616690f976eae26cd7562dbda6030602ba32e0666681f3134d37a", size = 638419, upload-time = "2026-07-18T12:15:36.804Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/91/8932195b775d9c558dc0841b6ee25f774484ffed8f61bdb0552187cd1e81/hypothesis-6.156.7-pp311-pypy311_pp73-macosx_10_12_x86_64.whl", hash = "sha256:bfd514af542ca7b7a6c6f1ecaf825f074996a712e14a29382b83b9233981ba34", size = 749266, upload-time = "2026-07-18T12:15:52.523Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/d5/a69882dc126c01f04c68bb1d2b7c24e972959f2b363de4c4db32d6b1bc7b/hypothesis-6.156.7-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:f8542dccbad2592c7e6eabfa8957987bc65b6b51862df63bbc6ef75e36734287", size = 743982, upload-time = "2026-07-18T12:15:38.052Z" },
+    { url = "https://files.pythonhosted.org/packages/00/5d/2937c75a015564e75ca2ea8ab287f82bdf5f954ff523cd1c35c27315d0e9/hypothesis-6.156.7-pp311-pypy311_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:72e964b04ec22b2273e0646b47686682f0df5a81c122c48da8acac2e0d17b8da", size = 1071135, upload-time = "2026-07-18T12:15:11.819Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/a9/f49de6cd6d154683c3d5e5daf89eae8a1ebee394021fe7a20515bc1293bf/hypothesis-6.156.7-pp311-pypy311_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4d97075ab6d97dd62e940cb75f26bc6a23a3e3376324dd754df506bcfbafcab6", size = 1122685, upload-time = "2026-07-18T12:16:17.345Z" },
+    { url = "https://files.pythonhosted.org/packages/21/6f/cfc4a6ca25c086f3622d21ef5d334de3633d5b8692a3165e16b12686ebb3/hypothesis-6.156.7-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:cfd381e3d32a5e85fda2038a06fcfafea953e53217ca2d4b090ca576eab70c38", size = 641377, upload-time = "2026-07-18T12:15:19.719Z" },
+]
+
 [[package]]
 name = "idna"
 version = "3.11"
@@ -152,6 +380,27 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/04/96/92447566d16df59b2a776c0fb82dbc4d9e07cd95062562af01e408583fc4/itsdangerous-2.2.0-py3-none-any.whl", hash = "sha256:c6242fc49e35958c8b15141343aa660db5fc54d4f13a1db01a3f5891b98700ef", size = 16234, upload-time = "2024-04-16T21:28:14.499Z" },
 ]
 
+[[package]]
+name = "joserfc"
+version = "1.7.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cryptography" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/d4/c6/b1cac0280f8efc57626ea8804866b37099f23cae11b1485a42b213245e31/joserfc-1.7.3.tar.gz", hash = "sha256:116955c2587139dba20621fd0bd7fc9255fa960c9fe7f43c43ebef2e801dcfcf", size = 233821, upload-time = "2026-07-08T12:41:42.66Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7d/f5/650b59d1b74f5befb7a7a7e7d7c92a26b94256df3541e2b4914152cd177a/joserfc-1.7.3-py3-none-any.whl", hash = "sha256:7c39f3f2c943dbc03122747fa8ebbd8e156e54904cf25651b452f4d2634a6075", size = 70982, upload-time = "2026-07-08T12:41:41.521Z" },
+]
+
+[[package]]
+name = "mpmath"
+version = "1.3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e0/47/dd32fa426cc72114383ac549964eecb20ecfd886d1e5ccf5340b55b02f57/mpmath-1.3.0.tar.gz", hash = "sha256:7a28eb2a9774d00c7bc92411c19a89209d5da7c4c9a9e227be8330a23a25b91f", size = 508106, upload-time = "2023-03-07T16:47:11.061Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/43/e3/7d92a15f894aa0c9c4b49b8ee9ac9850d6e63b03c9c32c0367a13ae62209/mpmath-1.3.0-py3-none-any.whl", hash = "sha256:a0b2b9fe80bbcd81a6647ff13108738cfb482d481d826cc0e02f5b35e5c88d2c", size = 536198, upload-time = "2023-03-07T16:47:09.197Z" },
+]
+
 [[package]]
 name = "numpy"
 version = "2.4.3"
@@ -249,6 +498,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/54/20/4d324d65cc6d9205fabedc306948156824eb9f0ee1633355a8f7ec5c66bf/pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746", size = 20538, upload-time = "2025-05-15T12:30:06.134Z" },
 ]
 
+[[package]]
+name = "pycparser"
+version = "3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/1b/7d/92392ff7815c21062bea51aa7b87d45576f649f16458d78b7cf94b9ab2e6/pycparser-3.0.tar.gz", hash = "sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29", size = 103492, upload-time = "2026-01-21T14:26:51.89Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/0c/c3/44f3fbbfa403ea2a7c779186dc20772604442dde72947e7d01069cbe98e3/pycparser-3.0-py3-none-any.whl", hash = "sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992", size = 48172, upload-time = "2026-01-21T14:26:50.693Z" },
+]
+
 [[package]]
 name = "pydantic"
 version = "2.12.5"
@@ -386,35 +644,61 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/3b/ab/b3226f0bd7cdcf710fbede2b3548584366da3b19b5021e74f5bde2a8fa3f/pytest-9.0.2-py3-none-any.whl", hash = "sha256:711ffd45bf766d5264d487b917733b453d917afd2b0ad65223959f59089f875b", size = 374801, upload-time = "2025-12-06T21:30:49.154Z" },
 ]
 
+[[package]]
+name = "python-multipart"
+version = "0.0.32"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/5b/42/55c32bb9b12693c092ad250a0e82edb5b31ddeda6eb772de5f308b3804ad/python_multipart-0.0.32.tar.gz", hash = "sha256:be54b7f3fa167bb83e4fcd936b887b708f4e57fe75911c02aebf53efaf8d938e", size = 46881, upload-time = "2026-06-04T16:18:58.647Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e1/04/e8135ebd1ad02c56ec633277529b2602ff99ff634be76cdba5744cf554fd/python_multipart-0.0.32-py3-none-any.whl", hash = "sha256:ff6d3f776f16878c894e52e107296ffc890e913c611b1a4ec6c44e2821fe2e23", size = 30042, upload-time = "2026-06-04T16:18:57.319Z" },
+]
+
 [[package]]
 name = "slug-constitution"
 version = "0.1.0"
 source = { virtual = "." }
 dependencies = [
+    { name = "authlib" },
     { name = "evaleval" },
     { name = "fastapi" },
     { name = "httpx" },
+    { name = "hypothesis" },
     { name = "itsdangerous" },
     { name = "numpy" },
     { name = "pytest" },
+    { name = "python-multipart" },
     { name = "starlette" },
+    { name = "sympy" },
     { name = "tenacity" },
     { name = "uvicorn" },
 ]
 
 [package.metadata]
 requires-dist = [
-    { name = "evaleval", specifier = ">=0.2.6" },
+    { name = "authlib" },
+    { name = "evaleval", specifier = "==0.2.7" },
     { name = "fastapi" },
     { name = "httpx" },
+    { name = "hypothesis" },
     { name = "itsdangerous" },
     { name = "numpy" },
     { name = "pytest" },
+    { name = "python-multipart" },
     { name = "starlette" },
+    { name = "sympy" },
     { name = "tenacity" },
     { name = "uvicorn" },
 ]
 
+[[package]]
+name = "sortedcontainers"
+version = "2.4.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e8/c4/ba2f8066cceb6f23394729afe52f3bf7adec04bf9ed2c820b39e19299111/sortedcontainers-2.4.0.tar.gz", hash = "sha256:25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88", size = 30594, upload-time = "2021-05-16T22:03:42.897Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/32/46/9cb0e58b2deb7f82b84065f37f3bffeb12413f947f9388e4cac22c4621ce/sortedcontainers-2.4.0-py2.py3-none-any.whl", hash = "sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0", size = 29575, upload-time = "2021-05-16T22:03:41.177Z" },
+]
+
 [[package]]
 name = "starlette"
 version = "1.0.0"
@@ -428,6 +712,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/0b/c9/584bc9651441b4ba60cc4d557d8a547b5aff901af35bda3a4ee30c819b82/starlette-1.0.0-py3-none-any.whl", hash = "sha256:d3ec55e0bb321692d275455ddfd3df75fff145d009685eb40dc91fc66b03d38b", size = 72651, upload-time = "2026-03-22T18:29:45.111Z" },
 ]
 
+[[package]]
+name = "sympy"
+version = "1.14.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "mpmath" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/83/d3/803453b36afefb7c2bb238361cd4ae6125a569b4db67cd9e79846ba2d68c/sympy-1.14.0.tar.gz", hash = "sha256:d3d3fe8df1e5a0b42f0e7bdf50541697dbe7d23746e894990c030e2b05e72517", size = 7793921, upload-time = "2025-04-27T18:05:01.611Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a2/09/77d55d46fd61b4a135c444fc97158ef34a095e5681d0a6c10b75bf356191/sympy-1.14.0-py3-none-any.whl", hash = "sha256:e091cc3e99d2141a0ba2847328f5479b05d94a6635cb96148ccb3f34671bd8f5", size = 6299353, upload-time = "2025-04-27T18:04:59.103Z" },
+]
+
 [[package]]
 name = "tenacity"
 version = "9.1.4"


Side B — contributor: tommy-mor
Side B — commit message:
[15e1037a] url stuff

Side B — unified diff (full patch):
diff --git a/server/src/url_rules/graph.rs b/server/src/url_rules/graph.rs
new file mode 100644
index 0000000000000000000000000000000000000000..f7ac0f9a551a1727cb2f9294778c283b9885b147
--- /dev/null
+++ b/server/src/url_rules/graph.rs
@@ -0,0 +1,831 @@
+//! Semantic URL graph: DFA traversal on host + path, query in context, generic fallback.
+
+use std::collections::HashMap;
+use std::sync::OnceLock;
+
+use url::Url;
+
+use super::graph_builder::GraphBuilder;
+use super::parse::{normalize_match_host, strip_tracking_query, UrlParts};
+
+#[derive(Debug, Clone, Default)]
+pub struct Context {
+    pub vars: HashMap<String, String>,
+    pub query: HashMap<String, String>,
+}
+
+pub type CanonicalFn = fn(&Context) -> Option<String>;
+
+#[derive(Clone, Copy)]
+pub enum EdgePattern {
+    Literal(&'static str),
+    Variable(&'static str),
+    /// Absorb any trailing segment without leaving this node (e.g. post title slug).
+    AbsorbAny,
+    /// Absorb segment when `cond(seg)` (e.g. subreddit listing suffix).
+    AbsorbIf(fn(&str) -> bool),
+}
+
+pub struct Edge {
+    pub pattern: EdgePattern,
+    pub target: &'static str,
+}
+
+pub struct Node {
+    pub edges: Vec<Edge>,
+    pub canonical: CanonicalFn,
+    pub parent: Option<&'static str>,
+}
+
+impl Node {
+    pub(crate) fn empty() -> Self {
+        Self {
+            edges: Vec::new(),
+            canonical: |_| None,
+            parent: None,
+        }
+    }
+}
+
+pub struct Graph {
+    pub nodes: HashMap<&'static str, Node>,
+}
+
+static GRAPH: OnceLock<Graph> = OnceLock::new();
+
+pub fn graph() -> &'static Graph {
+    GRAPH.get_or_init(build_graph)
+}
+
+impl Graph {
+    pub fn resolve_canonical(&self, parts: &UrlParts) -> Option<String> {
+        let mut query = parts.query.clone();
+        strip_tracking_query(&mut query);
+        let mut ctx = Context {
+            vars: HashMap::new(),
+            query,
+        };
+
+        if let Some(node_id) = self.traverse(parts, &mut ctx) {
+            if let Some(canon) = (self.nodes.get(node_id)?.canonical)(&ctx) {
+                return Some(canon);
+            }
+        }
+        Some(generic_canonical(parts))
+    }
+
+    pub fn breadcrumbs(&self, parts: &UrlParts) -> Vec<String> {
+        let mut query = parts.query.clone();
+        strip_tracking_query(&mut query);
+        let mut ctx = Context {
+            vars: HashMap::new(),
+            query,
+        };
+
+        if let Some(mut node_id) = self.traverse(parts, &mut ctx) {
+            let mut paths = Vec::new();
+            loop {
+                let node = match self.nodes.get(node_id) {
+                    Some(n) => n,
+                    None => break,
+                };
+                if let Some(url) = (node.canonical)(&ctx) {
+                    if paths.last() != Some(&url) {
+                        paths.push(url);
+                    }
+                }
+                match node.parent {
+                    Some(p) => node_id = p,
+                    None => break,
+                }
+            }
+            paths.reverse();
+            if !paths.is_empty() {
+                return paths;
+            }
+        }
+        generic_breadcrumbs(parts)
+    }
+
+    fn traverse(&self, parts: &UrlParts, ctx: &mut Context) -> Option<&'static str> {
+        let host = parts.match_host();
+        let mut node_id = match host.as_str() {
+            "reddit.com" => "reddit_root",
+            "youtube.com" => "youtube_root",
+            "youtu.be" => "youtu_be_entry",
+            _ => return None,
+        };
+
+        let segs: Vec<&str> = parts.path_segments.iter().map(String::as_str).collect();
+        let mut i = 0;
+        while i < segs.len() {
+            let seg = segs[i];
+            match self.follow_edge(node_id, seg, ctx) {
+                Ok(next) => {
+                    node_id = next;
+                    i += 1;
+                }
+                Err(()) => {
+                    if self.try_absorb(node_id, seg) {
+                        i += 1;
+                        continue;
+                    }
+                    return None;
+                }
+            }
+        }
+        Some(node_id)
+    }
+
+    fn follow_edge(
+        &self,
+        node_id: &'static str,
+        seg: &str,
+        ctx: &mut Context,
+    ) -> Result<&'static str, ()> {
+        let node = self.nodes.get(node_id).ok_or(())?;
+        for edge in &node.edges {
+            match edge.pattern {
+                EdgePattern::Literal(lit) if lit == seg => return Ok(edge.target),
+                EdgePattern::Variable(name) => {
+                    ctx.vars.insert(name.to_string(), seg.to_string());
+                    return Ok(edge.target);
+                }
+                EdgePattern::AbsorbAny
+                | EdgePattern::AbsorbIf(_)
+                | EdgePattern::Literal(_)
+                | EdgePattern::Variable(_) => {}
+            }
+        }
+        Err(())
+    }
+
+    fn try_absorb(&self, node_id: &'static str, seg: &str) -> bool {
+        let node = match self.nodes.get(node_id) {
+            Some(n) => n,
+            None => return false,
+        };
+        for edge in &node.edges {
+            match edge.pattern {
+                EdgePattern::AbsorbAny => return true,
+                EdgePattern::AbsorbIf(cond) if cond(seg) => return true,
+                EdgePattern::AbsorbIf(_) | EdgePattern::Literal(_) | EdgePattern::Variable(_) => {}
+            }
+        }
+        false
+    }
+
+    /// Test hook: terminal graph node and captured context after traversal.
+    #[cfg(test)]
+    pub fn traverse_terminal(&self, parts: &UrlParts) -> Option<(&'static str, Context)> {
+        let mut query = parts.query.clone();
+        strip_tracking_query(&mut query);
+        let mut ctx = Context {
+            vars: HashMap::new(),
+            query,
+        };
+        let node = self.traverse(parts, &mut ctx)?;
+        Some((node, ctx))
+    }
+}
+
+fn is_reddit_listing_suffix(seg: &str) -> bool {
+    matches!(seg, "hot" | "top" | "new" | "rising" | "controversial")
+}
+
+/// Percent-encode a path or query fragment so `&`, `?`, etc. cannot break URL structure.
+fn enc(s: &str) -> String {
+    urlencoding::encode(s).into_owned()
+}
+
+// --- Canonical formatters ---
+
+fn canon_reddit_root(_: &Context) -> Option<String> {
+    Some("https://reddit.com".to_string())
+}
+
+fn canon_reddit_r_hub(_: &Context) -> Option<String> {
+    Some("https://reddit.com/r".to_string())
+}
+
+fn canon_reddit_subreddit(ctx: &Context) -> Option<String> {
+    let sub = ctx.vars.get("subreddit")?;
+    Some(format!(
+        "https://reddit.com/r/{}",
+        enc(&sub.to_ascii_lowercase())
+    ))
+}
+
+fn canon_reddit_post(ctx: &Context) -> Option<String> {
+    let sub = ctx.vars.get("subreddit")?.to_ascii_lowercase();
+    let id = ctx.vars.get("post_id")?;
+    Some(format!(
+        "https://reddit.com/r/{}/comments/{}",
+        enc(&sub),
+        enc(id)
+    ))
+}
+
+fn canon_youtube_root(_: &Context) -> Option<String> {
+    Some("https://youtube.com".to_string())
+}
+
+fn canon_youtube_watch(ctx: &Context) -> Option<String> {
+    let v = ctx
+        .query
+        .get("v")
+        .or_else(|| ctx.vars.get("video_id"))?;
+    Some(format!("https://youtube.com/watch?v={}", enc(v)))
+}
+
+fn canon_youtu_be(ctx: &Context) -> Option<String> {
+    let v = ctx.vars.get("vid_id")?;
+    Some(format!("https://youtube.com/watch?v={}", enc(v)))
+}
+
+pub fn build_graph() -> Graph {
+    GraphBuilder::new()
+        .node("reddit_root")
+        .canonical(canon_reddit_root)
+        .edge(EdgePattern::Literal("r"), "reddit_r_hub")
+        .node("reddit_r_hub")
+        .parent("reddit_root")
+        .canonical(canon_reddit_r_hub)
+        .edge(EdgePattern::Variable("subreddit"), "reddit_subreddit")
+        .node("reddit_subreddit")
+        .parent("reddit_r_hub")
+        .canonical(canon_reddit_subreddit)
+        .edge(
+            EdgePattern::AbsorbIf(is_reddit_listing_suffix),
+            "reddit_subreddit",
+        )
+        .edge(EdgePattern::Literal("comments"), "reddit_comments_gate")
+        .node("reddit_comments_gate")
+        .parent("reddit_subreddit")
+        .canonical(canon_reddit_subreddit)
+        .edge(EdgePattern::Variable("post_id"), "reddit_post")
+        .node("reddit_post")
+        .parent("reddit_subreddit")
+        .canonical(canon_reddit_post)
+        .edge(EdgePattern::AbsorbAny, "reddit_post")
+        .node("youtube_root")
+        .canonical(canon_youtube_root)
+        .edge(EdgePattern::Literal("watch"), "youtube_watch")
+        .edge(EdgePattern::Literal("shorts"), "youtube_shorts_gate")
+        .node("youtube_watch")
+        .parent("youtube_root")
+        .canonical(canon_youtube_watch)
+        .node("youtube_shorts_gate")
+        .parent("youtube_root")
+        .canonical(canon_youtube_root)
+        .edge(EdgePattern::Variable("video_id"), "youtube_watch")
+        .node("youtu_be_entry")
+        .canonical(canon_youtube_root)
+        .edge(EdgePattern::Variable("vid_id"), "youtu_be_video")
+        .node("youtu_be_video")
+        .parent("youtube_root")
+        .canonical(canon_youtu_be)
+        .build()
+}
+
+// --- Generic internet fallback ---
+
+pub fn generic_canonical(parts: &UrlParts) -> String {
+    let host = normalize_match_host(&parts.host);
+    let path_segments: Vec<String> = parts.path_segments.clone();
+    let mut query = parts.query.clone();
+    strip_tracking_query(&mut query);
+
+    let mut url = if path_segments.is_empty() {
+        Url::parse(&format!("https://{host}"))
+            .unwrap_or_else(|_| Url::parse("https://invalid").unwrap())
+    } else {
+        let path = format!("/{}", path_segments.join("/"));
+        Url::parse(&format!("https://{host}{path}"))
+            .unwrap_or_else(|_| Url::parse("https://invalid").unwrap())
+    };
+
+    if !query.is_empty() {
+        let mut pairs: Vec<_> = query.iter().collect();
+        pairs.sort_by(|a, b| a.0.cmp(b.0));
+        url.query_pairs_mut().clear();
+        for (k, v) in pairs {
+            url.query_pairs_mut().append_pair(k, v);
+        }
+    }
+
+    let mut s = url.to_string();
+    if path_segments.is_empty() {
+        s = s.trim_end_matches('/').to_string();
+    }
+    s
+}
+
+pub fn generic_breadcrumbs(parts: &UrlParts) -> Vec<String> {
+    let host = normalize_match_host(&parts.host);
+    let n = parts.path_segments.len();
+    let mut out = Vec::new();
+
+    let base = generic_canonical(&UrlParts {
+        scheme: "https".to_string(),
+        host: host.clone(),
+        path_segments: vec![],
+        query: HashMap::new(),
+    });
+    out.push(base);
+
+    for i in 0..n {
+        let segs: Vec<String> = parts.path_segments[..=i].to_vec();
+        let url = generic_canonical(&UrlParts {
+            scheme: "https".to_string(),
+            host: host.clone(),
+            path_segments: segs,
+            query: HashMap::new(),
+        });
+        if out.last() != Some(&url) {
+            out.push(url);
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::url_rules::parse::test_parts;
+
+    fn g() -> &'static Graph {
+        graph()
+    }
+
+    fn canon(parts: &UrlParts) -> String {
+        g().resolve_canonical(parts).unwrap()
+    }
+
+    fn crumbs(parts: &UrlParts) -> Vec<String> {
+        g().breadcrumbs(parts)
+    }
+
+    fn terminal(parts: &UrlParts) -> Option<&'static str> {
+        g().traverse_terminal(parts).map(|(n, _)| n)
+    }
+
+    fn vars(parts: &UrlParts) -> HashMap<String, String> {
+        g().traverse_terminal(parts)
+            .map(|(_, c)| c.vars)
+            .unwrap_or_default()
+    }
+
+    #[test]
+    fn youtu_be_malicious_segment_encoded_not_injected() {
+        let p = test_parts("youtu.be", &["abc&t=1"], &[]);
+        assert_eq!(canon(&p), "https://youtube.com/watch?v=abc%26t%3D1");
+        assert!(!canon(&p).contains("abc&t=1"));
+    }
+
+    #[test]
+    fn youtube_query_v_encoded() {
+        let p = test_parts("youtube.com", &["watch"], &[("v", "a&b=c")]);
+        assert_eq!(canon(&p), "https://youtube.com/watch?v=a%26b%3Dc");
+    }
+
+    #[test]
+    fn absorb_patterns_live_on_edges_not_in_engine() {
+        let g = build_graph();
+        let sub = g.nodes.get("reddit_subreddit").unwrap();
+        assert!(sub
+            .edges
+            .iter()
+            .any(|e| matches!(e.pattern, EdgePattern::AbsorbIf(_))));
+        let post = g.nodes.get("reddit_post").unwrap();
+        assert!(post
+            .edges
+            .iter()
+            .any(|e| matches!(e.pattern, EdgePattern::AbsorbAny)));
+    }
+
+    #[test]
+    fn builder_rejects_missing_parent() {
+        let result = std::panic::catch_unwind(|| {
+            GraphBuilder::new()
+                .node("orphan")
+                .parent("nonexistent_parent")
+                .build();
+        });
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn generic_canonical_forces_https_and_strips_www() {
+        let p = test_parts("www.example.com", &["blog", "post"], &[]);
+        assert_eq!(canon(&p), "https://example.com/blog/post");
+    }
+
+    #[test]
+    fn generic_canonical_sorts_query_keys() {
+        let p = test_parts("example.com", &["search"], &[("q", "rust"), ("page", "2")]);
+        assert_eq!(canon(&p), "https://example.com/search?page=2&q=rust");
+    }
+
+    #[test]
+    fn generic_canonical_strips_tracking_from_query() {
+        let p = test_parts(
+            "news.ycombinator.com",
+            &["item"],
+            &[("id", "1"), ("utm_medium", "social")],
+        );
+        assert_eq!(canon(&p), "https://news.ycombinator.com/item?id=1");
+    }
+
+    #[test]
+    fn generic_breadcrumbs_cumulative_path() {
+        let p = test_parts("paulgraham.com", &["articles", "lisp.html"], &[]);
+        assert_eq!(
+            crumbs(&p),
+            vec![
+                "https://paulgraham.com",
+                "https://paulgraham.com/articles",
+                "https://paulgraham.com/articles/lisp.html"
+            ]
+        );
+    }
+
+    #[test]
+    fn generic_breadcrumbs_domain_only() {
+        let p = test_parts("example.com", &[], &[]);
+        assert_eq!(crumbs(&p), vec!["https://example.com"]);
+    }
+
+    #[test]
+    fn unknown_host_uses_generic_not_graph() {
+        let p = test_parts("hackernews.com", &["item", "123"], &[]);
+        assert_eq!(terminal(&p), None);
+        assert_eq!(canon(&p), "https://hackernews.com/item/123");
+    }
+
+    #[test]
+    fn traverse_captures_subreddit_variable() {
+        let p = test_parts("reddit.com", &["r", "Rust"], &[]);
+        assert_eq!(terminal(&p), Some("reddit_subreddit"));
+        assert_eq!(vars(&p).get("subreddit").map(String::as_str), Some("Rust"));
+    }
+
+    #[test]
+    fn traverse_captures_post_id() {
+        let p = test_parts("reddit.com", &["r", "aww", "comments", "abc123"], &[]);
+        assert_eq!(terminal(&p), Some("reddit_post"));
+        assert_eq!(vars(&p).get("post_id").map(String::as_str), Some("abc123"));
+    }
+
+    #[test]
+    fn traverse_absorbs_listing_suffix_stays_on_subreddit() {
+        let p = test_parts("reddit.com", &["r", "rust", "hot"], &[]);
+        assert_eq!(terminal(&p), Some("reddit_subreddit"));
+        assert_eq!(canon(&p), "https://reddit.com/r/rust");
+    }
+
+    #[test]
+    fn traverse_absorbs_all_listing_suffixes() {
+        for suffix in ["hot", "top", "new", "rising", "controversial"] {
+            let p = test_parts("reddit.com", &["r", "test", suffix], &[]);
+            assert_eq!(terminal(&p), Some("reddit_subreddit"), "suffix {suffix}");
+            assert_eq!(canon(&p), "https://reddit.com/r/test", "suffix {suffix}");
+        }
+    }
+
+    #[test]
+    fn traverse_absorbs_post_title_slug() {
+        let p = test_parts(
+            "reddit.com",
+            &["r", "rust", "comments", "aaa", "my_great_post_title"],
+            &[],
+        );
+        assert_eq!(terminal(&p), Some("reddit_post"));
+        assert_eq!(canon(&p), "https://reddit.com/r/rust/comments/aaa");
+    }
+
+    #[test]
+    fn traverse_unknown_segment_falls_back_to_generic() {
+        let p = test_parts("reddit.com", &["r", "rust", "wiki", "faq"], &[]);
+        assert_eq!(terminal(&p), None);
+        assert_eq!(canon(&p), "https://reddit.com/r/rust/wiki/faq");
+    }
+
+    #[test]
+    fn traverse_youtube_watch_requires_v_in_query() {
+        let p = test_parts("youtube.com", &["watch"], &[("v", "xyz")]);
+        assert_eq!(terminal(&p), Some("youtube_watch"));
+    }
+
+    #[test]
+    fn traverse_youtu_be_captures_vid_id() {
+        let p = test_parts("youtu.be", &["dQw4w9WgXcQ"], &[]);
+        assert_eq!(terminal(&p), Some("youtu_be_video"));
+        assert_eq!(vars(&p).get("vid_id").map(String::as_str), Some("dQw4w9WgXcQ"));
+    }
+
+    #[test]
+    fn traverse_shorts_sets_video_id_var() {
+        let p = test_parts("youtube.com", &["shorts", "abc99"], &[]);
+        assert_eq!(terminal(&p), Some("youtube_watch"));
+        assert_eq!(vars(&p).get("video_id").map(String::as_str), Some("abc99"));
+    }
+
+    #[test]
+    fn reddit_domain_canonical() {
+        let p = test_parts("reddit.com", &[], &[]);
+        assert_eq!(canon(&p), "https://reddit.com");
+    }
+
+    #[test]
+    fn reddit_r_hub_canonical() {
+        let p = test_parts("reddit.com", &["r"], &[]);
+        assert_eq!(terminal(&p), Some("reddit_r_hub"));
+        assert_eq!(canon(&p), "https://reddit.com/r");
+    }
+
+    #[test]
+    fn reddit_subreddit_lowercases_name() {
+        let p = test_parts("reddit.com", &["r", "AmITheAsshole"], &[]);
+        assert_eq!(canon(&p), "https://reddit.com/r/amitheasshole");
+    }
+
+    #[test]
+    fn reddit_host_aliases_old_new_www() {
+        for host in ["old.reddit.com", "new.reddit.com", "www.reddit.com"] {
+            let p = test_parts(host, &["r", "rust"], &[]);
+            assert_eq!(canon(&p), "https://reddit.com/r/rust", "host {host}");
+        }
+    }
+
+    #[test]
+    fn reddit_post_strips_slug_and_query() {
+        let p = test_parts(
+            "old.reddit.com",
+            &["r", "Rust", "comments", "1abc", "title_slug_here"],
+            &[("sort", "new")],
+        );
+        assert_eq!(canon(&p), "https://reddit.com/r/rust/comments/1abc");
+    }
+
+    #[test]
+    fn reddit_post_multiple_slugs_absorbed() {
+        let p = test_parts(
+            "reddit.com",
+            &["r", "x", "comments", "id1", "slug1", "extra"],
+            &[],
+        );
+        assert_eq!(canon(&p), "https://reddit.com/r/x/comments/id1");
+    }
+
+    #[test]
+    fn reddit_listing_with_query_only() {
+        let p = test_parts("www.reddit.com", &["r", "programming"], &[("sort", "top")]);
+        assert_eq!(canon(&p), "https://reddit.com/r/programming");
+    }
+
+    #[test]
+    fn reddit_subreddit_breadcrumbs_include_r_hub() {
+        let p = test_parts("reddit.com", &["r", "movies"], &[]);
+        assert_eq!(
+            crumbs(&p),
+            vec![
+                "https://reddit.com",
+                "https://reddit.com/r",
+                "https://reddit.com/r/movies"
+            ]
+        );
+    }
+
+    #[test]
+    fn reddit_post_breadcrumbs_skip_comments_node() {
+        let p = test_parts("reddit.com", &["r", "aww", "comments", "1trnvdl"], &[]);
+        let c = crumbs(&p);
+        assert!(!c.iter().any(|u| u.ends_with("/comments")));
+        assert_eq!(
+            c.last().map(String::as_str),
+            Some("https://reddit.com/r/aww/comments/1trnvdl")
+        );
+        assert!(c.contains(&"https://reddit.com/r/aww".to_string()));
+    }
+
+    #[test]
+    fn reddit_post_parent_is_subreddit_not_comments() {
+        let p = test_parts("reddit.com", &["r", "aww", "comments", "1trnvdl"], &[]);
+        let c = crumbs(&p);
+        let parent = c.get(c.len() - 2).unwrap();
+        assert_eq!(parent, "https://reddit.com/r/aww");
+    }
+
+    #[test]
+    fn reddit_domain_parent_is_none_in_breadcrumb_chain() {
+        let p = test_parts("reddit.com", &[], &[]);
+        assert_eq!(crumbs(&p), vec!["https://reddit.com"]);
+    }
+
+    #[test]
+    fn youtube_watch_canonical_uses_v_only() {
+        let p = test_parts("youtube.com", &["watch"], &[("v", "abc"), ("t", "99")]);
+        assert_eq!(canon(&p), "https://youtube.com/watch?v=abc");
+    }
+
+    #[test]
+    fn youtube_query_order_independent() {
+        let a = test_parts("youtube.com", &["watch"], &[("v", "abc"), ("t", "4")]);
+        let b = test_parts("youtube.com", &["watch"], &[("t", "4"), ("v", "abc")]);
+        assert_eq!(canon(&a), canon(&b));
+    }
+
+    #[test]
+    fn youtube_host_aliases() {
+        for host in ["www.youtube.com", "m.youtube.com"] {
+            let p = test_parts(host, &["watch"], &[("v", "x")]);
+            assert_eq!(canon(&p), "https://youtube.com/watch?v=x", "host {host}");
+        }
+    }
+
+    #[test]
+    fn youtube_shorts_canonical_matches_watch() {
+        let shorts = test_parts("youtube.com", &["shorts", "vid123"], &[]);
+        let watch = test_parts("youtube.com", &["watch"], &[("v", "vid123")]);
+        assert_eq!(canon(&shorts), canon(&watch));
+        assert_eq!(canon(&shorts), "https://youtube.com/watch?v=vid123");
+    }
+
+    #[test]
+    fn youtu_be_matches_youtube_watch() {
+        let be = test_parts("youtu.be", &["dQw4w9WgXcQ"], &[]);
+        let watch = test_parts("youtube.com", &["watch"], &[("v", "dQw4w9WgXcQ")]);
+        assert_eq!(canon(&be), canon(&watch));
+    }
+
+    #[test]
+    fn youtube_breadcrumbs_domain_then_watch() {
+        let p = test_parts("youtube.com", &["watch"], &[("v", "abc")]);
+        assert_eq!(
+            crumbs(&p),
+            vec!["https://youtube.com", "https://youtube.com/watch?v=abc"]
+        );
+    }
+
+    #[test]
+    fn youtu_be_breadcrumbs_include_youtube_domain() {
+        let p = test_parts("youtu.be", &["abc"], &[]);
+        let c = crumbs(&p);
+        assert_eq!(c.first().map(String::as_str), Some("https://youtube.com"));
+        assert_eq!(
+            c.last().map(String::as_str),
+            Some("https://youtube.com/watch?v=abc")
+        );
+    }
+
+    #[test]
+    fn parsed_urls_match_hand_built_parts() {
+        let raw = "https://www.reddit.com/r/rust/comments/aaa/title/?utm=x";
+        let parsed = UrlParts::parse(raw).unwrap();
+        let hand = test_parts(
+            "www.reddit.com",
+            &["r", "rust", "comments", "aaa", "title"],
+            &[("utm", "x")],
+        );
+        assert_eq!(canon(&parsed), canon(&hand));
+    }
+
+    #[test]
+    fn equivalence_cluster_youtube_formats() {
+        let urls = [
+            "https://youtu.be/abc123",
+            "https://www.youtube.com/watch?v=abc123",
+            "https://youtube.com/watch?v=abc123&t=1",
+            "https://m.youtube.com/watch?t=1&v=abc123",
+        ];
+        let canonical: Vec<_> = urls
+            .iter()
+            .map(|u| canon(&UrlParts::parse(u).unwrap()))
+            .collect();
+        assert!(canonical.iter().all(|c| *c == "https://youtube.com/watch?v=abc123"));
+    }
+
+    #[test]
+    fn equivalence_cluster_reddit_post_formats() {
+        let urls = [
+            "https://old.reddit.com/r/Rust/comments/aaa/slug/",
+            "reddit.com/r/rust/comments/aaa/other_slug",
+            "https://reddit.com/r/RUST/comments/aaa",
+        ];
+        let canonical: Vec<_> = urls
+            .iter()
+            .map(|u| canon(&UrlParts::parse(u).unwrap()))
+            .collect();
+        assert!(
+            canonical
+                .iter()
+                .all(|c| *c == "https://reddit.com/r/rust/comments/aaa")
+        );
+    }
+
+    #[test]
+    fn graph_nodes_all_have_valid_parent_links() {
+        let g = build_graph();
+        for (id, node) in &g.nodes {
+            if let Some(parent) = node.parent {
+                assert!(g.nodes.contains_key(parent), "node {id} parent {parent}");
+            }
+        }
+    }
+
+    #[test]
+    fn graph_terminal_canonical_always_succeeds_for_reddit_paths() {
+        let cases: &[(&[&str], &str)] = &[
+            (&["r", "rust"], "https://reddit.com/r/rust"),
+            (
+                &["r", "rust", "comments", "x"],
+                "https://reddit.com/r/rust/comments/x",
+            ),
+        ];
+        for (segs, want) in cases {
+            let p = test_parts("reddit.com", segs, &[]);
+            assert_eq!(canon(&p), *want);
+        }
+    }
+
+    #[test]
+    fn breadcrumb_parent_walk_matches_parent_url_semantics() {
+        let p = test_parts("reddit.com", &["r", "aww", "comments", "id1"], &[]);
+        let c = crumbs(&p);
+        assert_eq!(c.len(), 4);
+        assert_eq!(
+            c.get(c.len() - 2).map(String::as_str),
+            Some("https://reddit.com/r/aww")
+        );
+    }
+
+    #[test]
+    fn youtube_watch_without_v_falls_back_to_generic() {
+        let p = test_parts("youtube.com", &["watch"], &[]);
+        assert_eq!(terminal(&p), Some("youtube_watch"));
+        assert_eq!(canon(&p), "https://youtube.com/watch");
+    }
+
+    #[test]
+    fn reddit_only_comments_path_stops_at_gate() {
+        let p = test_parts("reddit.com", &["r", "rust", "comments"], &[]);
+        assert_eq!(terminal(&p), Some("reddit_comments_gate"));
+        assert_eq!(canon(&p), "https://reddit.com/r/rust");
+    }
+
+    #[test]
+    fn generic_deep_path_many_segments() {
+        let segs: Vec<&str> = (0..10)
+            .map(|i| match i {
+                0 => "a",
+                1 => "b",
+                2 => "c",
+                3 => "d",
+                4 => "e",
+                5 => "f",
+                6 => "g",
+                7 => "h",
+                8 => "i",
+                _ => "j",
+            })
+            .collect();
+        let p = test_parts("site.com", &segs, &[]);
+        assert_eq!(crumbs(&p).len(), 11);
+    }
+
+    #[test]
+    fn traverse_literal_r_required_for_subreddit() {
+        let p = test_parts("reddit.com", &["rust"], &[]);
+        assert_eq!(terminal(&p), None);
+    }
+
+    #[test]
+    fn http_scheme_upgraded_via_generic_fallback_host() {
+        let parsed = UrlParts::parse("http://example.com/page").unwrap();
+        assert_eq!(canon(&parsed), "https://example.com/page");
+    }
+
+    #[test]
+    fn each_graph_node_canonical_is_invokable() {
+        let g = build_graph();
+        let empty = Context::default();
+        for (id, node) in &g.nodes {
+            let _ = (node.canonical)(&empty);
+            let _ = id;
+        }
+    }
+
+    #[test]
+    fn reddit_double_listing_suffix_both_absorbed() {
+        let p = test_parts("reddit.com", &["r", "rust", "hot", "new"], &[]);
+        assert_eq!(terminal(&p), Some("reddit_subreddit"));
+        assert_eq!(canon(&p), "https://reddit.com/r/rust");
+    }
+
+    #[test]
+    fn youtu_be_empty_path_stays_at_entry() {
+        let p = test_parts("youtu.be", &[], &[]);
+        assert_eq!(terminal(&p), Some("youtu_be_entry"));
+    }
+}
diff --git a/server/src/url_rules/graph_builder.rs b/server/src/url_rules/graph_builder.rs
new file mode 100644
index 0000000000000000000000000000000000000000..243204ad5ca514fff459057956080cacb5bf38e2
--- /dev/null
+++ b/server/src/url_rules/graph_builder.rs
@@ -0,0 +1,73 @@
+//! Declarative construction of the URL graph with build-time link validation.
+
+use std::collections::HashMap;
+
+use super::graph::{CanonicalFn, Edge, EdgePattern, Graph, Node};
+
+pub struct GraphBuilder {
+    nodes: HashMap<&'static str, Node>,
+    current: Option<&'static str>,
+}
+
+impl GraphBuilder {
+    pub fn new() -> Self {
+        Self {
+            nodes: HashMap::new(),
+            current: None,
+        }
+    }
+
+    pub fn node(mut self, id: &'static str) -> Self {
+        self.nodes.entry(id).or_insert_with(Node::empty);
+        self.current = Some(id);
+        self
+    }
+
+    pub fn canonical(mut self, f: CanonicalFn) -> Self {
+        let id = self.current.expect("canonical() without node()");
+        self.nodes.get_mut(id).expect("node missing").canonical = f;
+        self
+    }
+
+    pub fn parent(mut self, parent_id: &'static str) -> Self {
+        let id = self.current.expect("parent() without node()");
+        self.nodes.get_mut(id).expect("node missing").parent = Some(parent_id);
+        self
+    }
+
+    pub fn edge(mut self, pattern: EdgePattern, target: &'static str) -> Self {
+        let id = self.current.expect("edge() without node()");
+        self.nodes
+            .get_mut(id)
+            .expect("node missing")
+            .edges
+            .push(Edge { pattern, target });
+        self
+    }
+
+    pub fn build(self) -> Graph {
+        for (id, node) in &self.nodes {
+            if let Some(parent) = node.parent {
+                assert!(
+                    self.nodes.contains_key(parent),
+                    "node {id}: parent {parent} does not exist"
+                );
+            }
+            for edge in &node.edges {
+                if !matches!(
+                    edge.pattern,
+                    EdgePattern::AbsorbAny | EdgePattern::AbsorbIf(_)
+                ) {
+                    assert!(
+                        self.nodes.contains_key(edge.target),
+                        "node {id}: edge target {} does not exist",
+                        edge.target
+                    );
+                }
+            }
+        }
+        Graph {
+            nodes: self.nodes,
+        }
+    }
+}
diff --git a/server/src/url_rules/mod.rs b/server/src/url_rules/mod.rs
index 9e1445346ce77a49dd6a7e7713bf9c57aef353cc..ba4ac662acc7bd4d50ee34613eb7eb6fccbfb17b 100644
--- a/server/src/url_rules/mod.rs
+++ b/server/src/url_rules/mod.rs
@@ -1,6 +1,7 @@
 //! URL canonicalization and hierarchy via a semantic graph (DFA + generic fallback).
 
 mod graph;
+mod graph_builder;
 mod parse;
 mod registry;
 
diff --git a/server/src/url_rules/parse.rs b/server/src/url_rules/parse.rs
new file mode 100644
index 0000000000000000000000000000000000000000..19d0c82feb718817168b8b445fcbfa39cf6aa6ba
--- /dev/null
+++ b/server/src/url_rules/parse.rs
@@ -0,0 +1,169 @@
+//! Parse raw strings into host, path segments, and query (order-independent).
+
+use std::collections::HashMap;
+
+use url::Url;
+
+#[derive(Debug, Clone)]
+pub struct UrlParts {
+    pub scheme: String,
+    pub host: String,
+    pub path_segments: Vec<String>,
+    pub query: HashMap<String, String>,
+}
+
+impl UrlParts {
+    pub fn parse(raw: &str) -> Option<Self> {
+        let trimmed = raw.trim();
+        if trimmed.is_empty() {
+            return None;
+        }
+
+        let with_scheme = if trimmed.contains("://") {
+            trimmed.to_string()
+        } else if trimmed.starts_with("r/") || trimmed.starts_with("/r/") {
+            let rest = trimmed.trim_start_matches('/').trim_start_matches("r/");
+            format!("https://reddit.com/r/{rest}")
+        } else if trimmed.contains('.') && !trimmed.starts_with('/') {
+            format!("https://{trimmed}")
+        } else {
+            trimmed.to_string()
+        };
+
+        let url = Url::parse(&with_scheme).ok()?;
+        let host = url.host_str()?.to_string();
+        let path_segments: Vec<String> = url
+            .path_segments()
+            .map(|segs| segs.filter(|s| !s.is_empty()).map(str::to_string).collect())
+            .unwrap_or_default();
+
+        let mut query = HashMap::new();
+        for (k, v) in url.query_pairs() {
+            query.insert(k.into_owned(), v.into_owned());
+        }
+
+        Some(Self {
+            scheme: url.scheme().to_string(),
+            path_segments,
+            query,
+            host,
+        })
+    }
+
+    /// Host normalized for graph entry matching (lowercase, aliases).
+    pub fn match_host(&self) -> String {
+        normalize_match_host(&self.host)
+    }
+}
+
+pub fn normalize_match_host(host: &str) -> String {
+    let h = host
+        .strip_prefix("www.")
+        .unwrap_or(host)
+        .to_ascii_lowercase();
+    match h.as_str() {
+        "old.reddit.com" | "new.reddit.com" => "reddit.com".to_string(),
+        "m.youtube.com" => "youtube.com".to_string(),
+        _ => h,
+    }
+}
+
+pub fn strip_tracking_query(query: &mut HashMap<String, String>) {
+    query.retain(|k, _| {
+        let lower = k.to_ascii_lowercase();
+        !(lower.starts_with("utm_")
+            || matches!(
+                lower.as_str(),
+                "fbclid" | "gclid" | "ref" | "ref_src" | "ref_source" | "mc_cid" | "mc_eid"
+            ))
+    });
+}
+
+#[cfg(test)]
+pub(crate) fn test_parts(host: &str, segs: &[&str], query: &[(&str, &str)]) -> UrlParts {
+    UrlParts {
+        scheme: "https".to_string(),
+        host: host.to_string(),
+        path_segments: segs.iter().map(|s| (*s).to_string()).collect(),
+        query: query
+            .iter()
+            .map(|(k, v)| (k.to_string(), v.to_string()))
+            .collect(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parse_full_url_splits_host_path_query() {
+        let p = UrlParts::parse("https://www.youtube.com/watch?v=abc&t=4").unwrap();
+        assert_eq!(p.host, "www.youtube.com");
+        assert_eq!(p.path_segments, vec!["watch"]);
+        assert_eq!(p.query.get("v").map(String::as_str), Some("abc"));
+        assert_eq!(p.query.get("t").map(String::as_str), Some("4"));
+    }
+
+    #[test]
+    fn parse_r_shortcut_expands_to_reddit() {
+        let p = UrlParts::parse("r/rust").unwrap();
+        assert_eq!(p.match_host(), "reddit.com");
+        assert_eq!(p.path_segments, vec!["r", "rust"]);
+    }
+
+    #[test]
+    fn parse_slash_r_shortcut() {
+        let p = UrlParts::parse("/r/aww").unwrap();
+        assert_eq!(p.path_segments, vec!["r", "aww"]);
+    }
+
+    #[test]
+    fn parse_schemeless_host_path() {
+        let p = UrlParts::parse("reddit.com/r/rust/comments/aaa/slug").unwrap();
+        assert_eq!(p.match_host(), "reddit.com");
+        assert_eq!(
+            p.path_segments,
+            vec!["r", "rust", "comments", "aaa", "slug"]
+        );
+    }
+
+    #[test]
+    fn parse_empty_returns_none() {
+        assert!(UrlParts::parse("").is_none());
+        assert!(UrlParts::parse("   ").is_none());
+    }
+
+    #[test]
+    fn normalize_match_host_reddit_aliases() {
+        assert_eq!(normalize_match_host("old.reddit.com"), "reddit.com");
+        assert_eq!(normalize_match_host("NEW.reddit.com"), "reddit.com");
+        assert_eq!(normalize_match_host("www.reddit.com"), "reddit.com");
+    }
+
+    #[test]
+    fn normalize_match_host_youtube_aliases() {
+        assert_eq!(normalize_match_host("m.youtube.com"), "youtube.com");
+        assert_eq!(normalize_match_host("www.youtube.com"), "youtube.com");
+    }
+
+    #[test]
+    fn strip_tracking_query_removes_known_params() {
+        let mut q = HashMap::from([
+            ("v".into(), "1".into()),
+            ("utm_source".into(), "x".into()),
+            ("fbclid".into(), "y".into()),
+            ("ref".into(), "z".into()),
+        ]);
+        strip_tracking_query(&mut q);
+        assert_eq!(q.len(), 1);
+        assert_eq!(q.get("v").map(String::as_str), Some("1"));
+    }
+
+    #[test]
+    fn strip_tracking_query_utm_prefix() {
+        let mut q = HashMap::from([("utm_campaign".into(), "email".into())]);
+        strip_tracking_query(&mut q);
+        assert!(q.is_empty());
+    }
+}
diff --git a/server/src/url_rules/registry_tests.rs b/server/src/url_rules/registry_tests.rs
new file mode 100644
index 0000000000000000000000000000000000000000..7b76b550f808f590e011469fdae02adf603b43d2
--- /dev/null
+++ b/server/src/url_rules/registry_tests.rs
@@ -0,0 +1,195 @@
+//! End-to-end tests for the public registry API (`canonicalize_raw`, breadcrumbs, parent).
+
+use super::registry::{
+    canonicalize_raw, looks_like_url, navigable_breadcrumbs, parent_url, resolve_id,
+};
+
+fn canon(raw: &str) -> String {
+    canonicalize_raw(raw).unwrap().canonical
+}
+
+#[test]
+fn looks_like_url_positive_cases() {
+    for raw in [
+        "https://reddit.com/r/rust",
+        "r/rust",
+        "/r/aww",
+        "reddit.com/r/x",
+        "www.example.com/path",
+        "youtu.be/abc",
+    ] {
+        assert!(looks_like_url(raw), "{raw}");
+    }
+}
+
+#[test]
+fn looks_like_url_negative_cases() {
+    for raw in ["alpha", "beta", "", "hello world", "no-dots"] {
+        assert!(!looks_like_url(raw), "{raw}");
+    }
+}
+
+#[test]
+fn resolve_id_matches_canonicalize_raw() {
+    let raw = "https://youtu.be/xyz";
+    assert_eq!(
+        resolve_id(raw).as_deref(),
+        Some(canon(raw).as_str())
+    );
+}
+
+#[test]
+fn canonicalize_empty_returns_none() {
+    assert!(canonicalize_raw("").is_none());
+}
+
+#[test]
+fn alias_when_slug_stripped() {
+    let r = canonicalize_raw(
+        "https://reddit.com/r/rust/comments/aaa/very_long_title_slug",
+    )
+    .unwrap();
+    assert_eq!(r.canonical, "https://reddit.com/r/rust/comments/aaa");
+    assert!(r.alias_of.is_some());
+}
+
+#[test]
+fn alias_none_when_already_canonical() {
+    let raw = "https://reddit.com/r/rust";
+    let r = canonicalize_raw(raw).unwrap();
+    assert_eq!(r.canonical, raw);
+    assert!(r.alias_of.is_none());
+}
+
+#[test]
+fn parent_url_subreddit_under_r_hub() {
+    assert_eq!(
+        parent_url("https://reddit.com/r/movies").as_deref(),
+        Some("https://reddit.com/r")
+    );
+}
+
+#[test]
+fn parent_url_domain_has_none() {
+    assert_eq!(parent_url("https://reddit.com").as_deref(), None);
+}
+
+#[test]
+fn parent_url_generic_site() {
+    assert_eq!(
+        parent_url("https://example.com/a/b").as_deref(),
+        Some("https://example.com/a")
+    );
+}
+
+#[test]
+fn breadcrumbs_from_canonical_string_roundtrip() {
+    let id = "https://reddit.com/r/golang/comments/abc123";
+    let crumbs = navigable_breadcrumbs(id);
+    assert_eq!(crumbs.last().map(String::as_str), Some(id));
+}
+
+// --- Table: Reddit raw URLs → canonical ---
+
+#[test]
+fn reddit_canonical_matrix() {
+    let cases: &[(&str, &str)] = &[
+        ("r/rust", "https://reddit.com/r/rust"),
+        ("/r/aww", "https://reddit.com/r/aww"),
+        ("https://reddit.com/r/rust", "https://reddit.com/r/rust"),
+        (
+            "https://www.reddit.com/r/programming/new",
+            "https://reddit.com/r/programming",
+        ),
+        (
+            "https://old.reddit.com/r/test/comments/xyz/slug/",
+            "https://reddit.com/r/test/comments/xyz",
+        ),
+        (
+            "reddit.com/r/Movies/comments/abc/Title_Case_Slug",
+            "https://reddit.com/r/movies/comments/abc",
+        ),
+    ];
+    for (raw, want) in cases {
+        assert_eq!(canon(raw), *want, "raw={raw}");
+    }
+}
+
+// --- Table: YouTube raw URLs → canonical ---
+
+#[test]
+fn youtube_canonical_matrix() {
+    let cases: &[(&str, &str)] = &[
+        (
+            "https://youtube.com/watch?v=abc",
+            "https://youtube.com/watch?v=abc",
+        ),
+        (
+            "https://www.youtube.com/watch?v=abc&t=1&feature=share",
+            "https://youtube.com/watch?v=abc",
+        ),
+        ("https://youtu.be/abc", "https://youtube.com/watch?v=abc"),
+        (
+            "https://youtube.com/shorts/abc",
+            "https://youtube.com/watch?v=abc",
+        ),
+    ];
+    for (raw, want) in cases {
+        assert_eq!(canon(raw), *want, "raw={raw}");
+    }
+}
+
+// --- Table: generic sites ---
+
+#[test]
+fn generic_canonical_matrix() {
+    let cases: &[(&str, &str)] = &[
+        (
+            "https://news.ycombinator.com/item?id=38472",
+            "https://news.ycombinator.com/item?id=38472",
+        ),
+        (
+            "https://www.github.com/rust-lang/rust/issues/1?utm_source=x",
+            "https://github.com/rust-lang/rust/issues/1",
+        ),
+        ("https://example.com", "https://example.com"),
+    ];
+    for (raw, want) in cases {
+        assert_eq!(canon(raw), *want, "raw={raw}");
+    }
+}
+
+// --- Phantom /comments/ regression (sorter2-specific) ---
+
+#[test]
+fn phantom_comments_not_in_breadcrumbs_for_post() {
+    let crumbs = navigable_breadcrumbs("https://reddit.com/r/rust/comments/aaa");
+    assert!(!crumbs.iter().any(|c| c.ends_with("/comments")));
+}
+
+#[test]
+fn phantom_comments_not_sibling_of_subreddit_in_breadcrumb_chain() {
+    let crumbs = navigable_breadcrumbs("https://reddit.com/r/rust/comments/aaa");
+    let subs: Vec<_> = crumbs
+        .iter()
+        .filter(|c| c.contains("/r/rust") && !c.contains("/comments/"))
+        .collect();
+    assert_eq!(subs, vec!["https://reddit.com/r/rust"]);
+}
+
+// --- Distinct items must stay distinct ---
+
+#[test]
+fn different_posts_different_canonical() {
+    let a = canon("https://reddit.com/r/rust/comments/aaa");
+    let b = canon("https://reddit.com/r/rust/comments/bbb");
+    assert_ne!(a, b);
+}
+
+#[test]
+fn different_subreddits_different_canonical() {
+    assert_ne!(
+        canon("https://reddit.com/r/rust"),
+        canon("https://reddit.com/r/golang")
+    );
+}