diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..f39d00c
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,64 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  workflow_dispatch: # Allow manual trigger
+
+# Least privilege: this workflow only ever reads the tree. Declared
+# explicitly rather than inherited, so a change to the repository's default
+# token permissions cannot silently widen what a PR-triggered run can do.
+permissions:
+  contents: read
+
+# A newer push to the same branch supersedes an in-flight run.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: node ${{ matrix.node }}${{ matrix.bun && ' + bun' || '' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # Floor of the supported range (package.json engines) and current.
+        node: ['20', '24']
+        # Buddy's rescue path reproduces Claude Code's Bun.hash() by shelling
+        # out to `bun`, and falls back to FNV-1a when Bun is absent. A bare
+        # runner only ever exercises the fallback, so the Bun branch shipped
+        # untested — and shipped broken: `bun -e <script> <arg>` drops the
+        # trailing argument, so every rescued companion rolled identical
+        # bones. One leg with Bun installed executes that branch for real.
+        bun: [false, true]
+        exclude:
+          # The Bun branch does not vary with the Node version; one leg is
+          # enough to cover it.
+          - node: '20'
+            bun: true
+    # The suite runs file-serially (vitest.config.ts sets fileParallelism:
+    # false, because several files share one BUDDY_DB_PATH) and takes well
+    # under a minute. The ceiling is a hang guard, not a budget: a test that
+    # reads unbounded local state can stall indefinitely, and that should
+    # fail the job rather than occupy a runner.
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+
+      - if: matrix.bun
+        uses: oven-sh/setup-bun@v2
+
+      # `npm ci` builds better-sqlite3 from source when no prebuild matches
+      # the runner's Node ABI — that is the install path users hit too.
+      - run: npm ci
+
+      - run: npm run build
+
+      - run: npm test
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 626edd4..ca2fa76 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,13 @@ All notable changes to this project will follow [Semantic Versioning](https://se
 - **Guard-mode graph stays alive in long sessions (Claude Code + Codex)** — the extraction instruction normally rides home only in the `buddy_observe` response, so when the host stops calling `buddy_observe` past ~100k tokens of context it also stops receiving the reminder, and the reasoning graph goes silent mid-session. Buddy's `UserPromptSubmit` hook (now registered **synchronously** so the host folds its stdout into context — the installer upgrades older async registrations) re-injects the extraction instruction after `REASONING_CONFIG.REINJECT_AFTER_SILENT_TURNS` consecutive turns with no new claims, pulling the host back. Turn-driven and scoped to the current project session (not observe-seq, which freezes when the host goes silent); resets the moment a claim lands; gated behind a cheap status-file check so guard-mode-off users pay no DB cost. **No second LLM call, no API key, no outbound dependency.** A re-injection→recovery metric is recorded and surfaced in `buddy_doctor`. The same compiled hook is wired into both Claude Code (`~/.claude/settings.json`) and Codex (`~/.codex/hooks.json`), which route hook stdout to model context identically. Cursor/Copilot don't yet expose that contract, so on those hosts long-session silence is surfaced via the doctor's inert-guard warning rather than auto-recovered (the same handler drops in when they add the hook). Validated on real transcripts (3 projects × 2 Anthropic models, N=15, claims graded for substantiveness, controls valid incl. at 150k): with the instruction only in the distant system block, substantive extraction falls to ~0% at 150k (opus emits nothing at any length); re-injection in the shipped placement recovers it to 60–100%. Directional, not universal — see `src/lib/reasoning/DESIGN.md`. Note: an existing guard-mode-on companion's re-injection activates on the next `buddy_observe`/status write (when `guard_mode` is first mirrored into the status file) — a one-cycle self-heal, not a regression. The shared `buddy.db` now uses **WAL journaling** so the hook and MCP-server processes don't block each other; this adds `buddy.db-wal`/`buddy.db-shm` sidecar files — if you sync `~/.buddy` across machines, they must travel with the main DB.
 - **`convention` basis** (ported from slimemold) — for stipulated practice/policy by a named actor ("this project uses X", "agents must Y"), correct-by-fiat for its scope; distinct from `definition` (what a term *means*) and `vibes`/`research` (factual claims about a named thing). The observer instruction now carries slimemold's ordered basis decision tree and the v8 precision distinctions, so the host classifies claims more reliably.
 
+### Fixed
+- **`resolveSessionTrace` read every transcript whole, hanging `npm test` and `buddy graph`** — resolving a session id walks `~/.claude/projects`, `~/.claude/sessions` and `~/.codex/sessions` and needs only the first JSONL record (Claude) or first dozen (Codex), but it `readFileSync`'d each file entirely. Cost scaled with total transcript volume rather than with the header being parsed: on a machine with real history — 646 files, 8.5 GB — `reasoning/session-trace.test.ts` never finished, taking the whole suite with it. Fresh clones and CI runners were unaffected because they have no transcript history, which is why this survived. Reads are now bounded to a 32 KiB head per file (whole-file `.json` parsing keeps a separate 256 KiB ceiling), and truncated trailing lines are discarded rather than half-parsed. Same resolution result; the test goes from a >90s hang to 2s.
+- **Every rescued companion rolled identical bones when Bun was installed** — the CC-compat rescue path shells out to `bun -e` to reproduce Claude Code's `Bun.hash()`, passing the userId as a trailing argument. `bun -e '<script>' <arg>` does **not** forward trailing arguments: inside the eval, `process.argv` is `['bun', '<cwd>/[eval]']` and nothing else, so `process.argv[1]` was a constant and the hash input never varied. Measured on a 300-userId sample: one distinct stat vector. Rarity, species, eye and stats were the same for everyone whose machine had Bun (the FNV-1a fallback path was unaffected). The input now travels through the environment, keeping the no-string-interpolation property that made argv attractive. Already-rescued companions keep their stored bones — no migration — but existing rescues were all clones of one roll. The regression test now samples 40 userIds rather than comparing two, since a two-sample assertion reads as an unlucky fixture in exactly the case where the bug is total.
+- **`echo_chamber` could never surface; `grounded_premise_adopted` was shadowed** (#150, reported by @InfinitePortaldev) — some detectors are specializations of others: every `echo_chamber` case is also a `load_bearing_vibes` case (same anchor, plus a user speaker, assistant-only supports, and no pushback). Selection takes the first candidate in detector order, so the general finding always won; and because the per-anchor cooldown is type-agnostic, emitting it also blocked the specific finding on that anchor. `echo_chamber` was therefore unreachable in practice, not merely rare. `runAllDetectors` now drops a general finding when a more specific one fired on the same anchor (`SUBSUMES` in `types.ts`). Exposed by #129 lowering `LOAD_BEARING_MIN_DOWNSTREAM` 3→2 to match `ECHO_CHAMBER_MIN_SUPPORTS`; the thresholds are unchanged here, since they were tuned against real session density.
+- **`unchallenged_chain` fired on the unchallenged *suffix* of a challenged chain** — the detector walked from every node, so a chain whose premise had been questioned still produced a finding anchored mid-chain, where no challenge sits between the remaining endpoints. It now starts only from maximal chains (nodes nothing else depends on), matching its documented "anchors on the head" intent. Also surfaced by #129's minimum-length 4→3.
+- **Detector threshold tests no longer go green by accident** — the "does not fire below threshold" / "below minimum length" fixtures hardcoded edge counts that #129's retuning quietly turned into *at*-threshold cases, so they stopped testing anything. They now derive their fixtures from `REASONING_CONFIG`.
+
 ### Changed
 - **Cross-host graph workflow is CLI-backed, not MCP-backed** — graph visualization ships as a Buddy CLI + host wrappers (Codex skill and Claude commands), avoiding any new MCP tool/schema overhead.
 
diff --git a/src/__tests__/oldBuddy.test.ts b/src/__tests__/oldBuddy.test.ts
index 0828ded..27f0d05 100644
--- a/src/__tests__/oldBuddy.test.ts
+++ b/src/__tests__/oldBuddy.test.ts
@@ -419,6 +419,22 @@ describe('rollWithCCCompat', () => {
     expect(a.bones.stats).not.toEqual(b.bones.stats);
   }, 15000);
 
+  // A two-userId comparison reads as "unlucky fixture" when it fails. It
+  // wasn't: `bun -e <script> <arg>` silently drops trailing arguments, so the
+  // hash input was a constant and EVERY rescued companion rolled identical
+  // bones. Sampling many ids makes that failure mode unmistakable.
+  // Sample size is a deliberate tradeoff. Each roll spawns a `bun`
+  // subprocess whose cost is ~9ms warm but seconds under load, and these
+  // tests are already timing-fragile for that reason. A dozen ids is far more
+  // than enough discrimination: the bug collapsed EVERY id to one vector, so
+  // it fails at 1-of-12 with enormous margin, while adding a third of the
+  // subprocess churn a larger sample would.
+  it('spreads across many userIds rather than collapsing to one roll', () => {
+    const ids = Array.from({ length: 12 }, (_, i) => `spread-user-${i}`);
+    const vectors = new Set(ids.map(id => JSON.stringify(rollWithCCCompat(id).bones.stats)));
+    expect(vectors.size).toBeGreaterThan(ids.length / 2);
+  }, 30000);
+
   it('species is from CC list (18 species, short names)', () => {
     const CC_SPECIES = [
       'duck', 'goose', 'blob', 'cat', 'dragon', 'octopus', 'owl', 'penguin',
diff --git a/src/__tests__/reasoning/detectors.test.ts b/src/__tests__/reasoning/detectors.test.ts
index 3a84f3f..ee7c8d4 100644
--- a/src/__tests__/reasoning/detectors.test.ts
+++ b/src/__tests__/reasoning/detectors.test.ts
@@ -58,7 +58,7 @@ function withFiller(claims: FixtureClaim[], edges: FixtureEdge[], padTo: number
 // ── Load-bearing vibes ──────────────────────────────────────────────────────
 
 describe('detectLoadBearingVibes', () => {
-  it('fires when vibes claim has ≥3 downstream', () => {
+  it('fires when vibes claim has ≥2 downstream (threshold tuned in #129)', () => {
     const g = withFiller([
       { id: 'v1', basis: 'vibes', text: 'we need auth' },
       { id: 'd1', basis: 'deduction' },
@@ -76,15 +76,16 @@ describe('detectLoadBearingVibes', () => {
     expect(findings[0].claim_text).toBe('we need auth');
   });
 
+  // Derived from config rather than hardcoded: a literal edge count silently
+  // stops testing "below threshold" the moment the threshold is retuned, which
+  // is how #129 left this green-by-accident.
   it('does not fire below threshold', () => {
-    const g = withFiller([
-      { id: 'v1', basis: 'vibes' },
-      { id: 'd1', basis: 'deduction' },
-      { id: 'd2', basis: 'deduction' },
-    ], [
-      { from: 'd1', to: 'v1', type: 'depends_on' },
-      { from: 'd2', to: 'v1', type: 'supports' },
-    ]);
+    const below = REASONING_CONFIG.LOAD_BEARING_MIN_DOWNSTREAM - 1;
+    const supporters = Array.from({ length: below }, (_, i) => ({ id: `d${i}`, basis: 'deduction' as const }));
+    const g = withFiller(
+      [{ id: 'v1', basis: 'vibes' }, ...supporters],
+      supporters.map(s => ({ from: s.id, to: 'v1', type: 'depends_on' as const })),
+    );
     expect(detectLoadBearingVibes(g)).toHaveLength(0);
   });
 
@@ -147,12 +148,18 @@ describe('detectUnchallengedChain', () => {
       { from: 'c3', to: 'c4', type: 'depends_on' },
       { from: 'q1', to: 'c2', type: 'questions' },
     ]);
-    // The chain-detection only flags chains where NO node in the chain has a
-    // challenge edge. But q1 is not in the chain — the challenge is FROM q1 TO c2.
-    // chainHasChallenge inspects edges where both endpoints are in the chain,
-    // so a challenge from outside doesn't count. To properly challenge, the
-    // question edge needs both endpoints in the chain.
-    // Reconfigure: have c2 questions c1 within the chain.
+    // chainHasChallenge only counts challenges with BOTH endpoints in the
+    // chain, so q1 (outside the chain) does not suppress `g`. That is the
+    // documented behaviour, not the case under test — keep `g` as the
+    // contrast and assert on `g2`, where the challenge is internal.
+    expect(detectUnchallengedChain(g).length).toBeGreaterThan(0);
+
+    // g2 challenges every link. #151 needed that because the detector walked
+    // from every node, so the sub-chain below the challenged pair (c2→c3→c4)
+    // qualified on its own; the detector now only starts from maximal chains,
+    // so the c1→c2 challenge alone would suffice. Kept as belt-and-braces —
+    // it pins the invariant regardless of which end the walk starts from.
+
     const g2 = withFiller([
       { id: 'c1', basis: 'assumption' },
       { id: 'c2', basis: 'deduction' },
@@ -163,19 +170,21 @@ describe('detectUnchallengedChain', () => {
       { from: 'c2', to: 'c3', type: 'depends_on' },
       { from: 'c3', to: 'c4', type: 'depends_on' },
       { from: 'c2', to: 'c1', type: 'questions' },
+      { from: 'c3', to: 'c2', type: 'questions' },
     ]);
     expect(detectUnchallengedChain(g2)).toHaveLength(0);
   });
 
   it('does not fire below minimum length', () => {
-    const g = withFiller([
-      { id: 'c1', basis: 'assumption' },
-      { id: 'c2', basis: 'deduction' },
-      { id: 'c3', basis: 'deduction' },
-    ], [
-      { from: 'c1', to: 'c2', type: 'depends_on' },
-      { from: 'c2', to: 'c3', type: 'depends_on' },
-    ]);
+    // Config-derived for the same reason as the load-bearing threshold test.
+    const nodes = REASONING_CONFIG.UNCHALLENGED_CHAIN_MIN_LENGTH - 1;
+    const chain = Array.from({ length: nodes }, (_, i) => ({
+      id: `c${i}`, basis: (i === 0 ? 'assumption' : 'deduction') as Basis,
+    }));
+    const edges = chain.slice(0, -1).map((c, i) => ({
+      from: c.id, to: chain[i + 1].id, type: 'depends_on' as const,
+    }));
+    const g = withFiller(chain, edges);
     expect(detectUnchallengedChain(g)).toHaveLength(0);
   });
 
@@ -238,7 +247,7 @@ describe('detectEchoChamber', () => {
 // ── Bright: well-sourced load-bearer ────────────────────────────────────────
 
 describe('detectWellSourcedLoadBearer', () => {
-  it('fires on research/empirical/deduction basis with ≥3 downstream', () => {
+  it('fires on research/empirical/deduction basis with ≥2 downstream (threshold tuned in #129)', () => {
     const g = withFiller([
       { id: 'r1', basis: 'research', text: 'OWASP ranks XSS #3' },
       { id: 'd1', basis: 'deduction' }, { id: 'd2', basis: 'deduction' }, { id: 'd3', basis: 'deduction' },
diff --git a/src/__tests__/reasoning/observer-integration.test.ts b/src/__tests__/reasoning/observer-integration.test.ts
index 9577204..ab76c00 100644
--- a/src/__tests__/reasoning/observer-integration.test.ts
+++ b/src/__tests__/reasoning/observer-integration.test.ts
@@ -46,10 +46,13 @@ const SID = 'ws-20260422';
 
 function primeClaims(db: Database.Database) {
   // Build a graph that triggers load-bearing vibes:
-  //   v1 (vibes, user)  ← supports by d1, d2, d3
+  //   v1 (vibes, assistant)  ← supports by d1, d2, d3
   // Plus filler to pass cold-start.
+  // v1 is assistant-authored deliberately: a *user* vibes claim backed by
+  // assistants with no pushback is an echo_chamber case, which subsumes
+  // load-bearing (SUBSUMES in types.ts). #150.
   const claims: any[] = [
-    { text: 'we need auth', basis: 'vibes', speaker: 'user', confidence: 'medium', external_id: 'v1' },
+    { text: 'we need auth', basis: 'vibes', speaker: 'assistant', confidence: 'medium', external_id: 'v1' },
     { text: 'so we need sessions', basis: 'deduction', speaker: 'assistant', confidence: 'medium', external_id: 'd1' },
     { text: 'so we need token rotation', basis: 'deduction', speaker: 'assistant', confidence: 'medium', external_id: 'd2' },
     { text: 'so we need a rate limiter', basis: 'deduction', speaker: 'assistant', confidence: 'medium', external_id: 'd3' },
diff --git a/src/__tests__/reasoning/pipeline-per-detector.test.ts b/src/__tests__/reasoning/pipeline-per-detector.test.ts
index 4bcb0f9..184f516 100644
--- a/src/__tests__/reasoning/pipeline-per-detector.test.ts
+++ b/src/__tests__/reasoning/pipeline-per-detector.test.ts
@@ -39,10 +39,15 @@ function seedAndRun(fixture: { claims: any[]; edges: any[] }): FindingType | nul
 describe('pipeline integration — all 6 detectors end-to-end', () => {
   beforeEach(() => { telemetry.reset(); resetGraphCache(); });
 
+  // The anchor is an ASSISTANT vibes claim on purpose. A *user* vibes claim
+  // with assistant supports and no pushback is an echo_chamber case, which
+  // subsumes load-bearing (see SUBSUMES in types.ts) — this fixture used to
+  // be exactly that, and only read as load_bearing_vibes because selection
+  // happened to evaluate that detector first. #150.
   it('fires load_bearing_vibes', () => {
     const t = seedAndRun({
       claims: [
-        { text: 'we need auth', basis: 'vibes', speaker: 'user', confidence: 'medium', external_id: 'v' },
+        { text: 'we need auth', basis: 'vibes', speaker: 'assistant', confidence: 'medium', external_id: 'v' },
         { text: 'a', basis: 'deduction', speaker: 'assistant', confidence: 'medium', external_id: 'a' },
         { text: 'b', basis: 'deduction', speaker: 'assistant', confidence: 'medium', external_id: 'b' },
         { text: 'c', basis: 'deduction', speaker: 'assistant', confidence: 'medium', external_id: 'c' },
@@ -81,6 +86,11 @@ describe('pipeline integration — all 6 detectors end-to-end', () => {
     expect(t).toBe('unchallenged_chain');
   });
 
+  // #151 pinned this as load_bearing_vibes and flagged the open question. The
+  // answer: echo_chamber is a strict specialization of load_bearing_vibes, so
+  // the two are one situation at two resolutions rather than rivals, and the
+  // specific reading is the one worth surfacing. runAllDetectors now drops the
+  // subsumed general finding, so this asserts echo_chamber again. #150.
   it('fires echo_chamber', () => {
     const t = seedAndRun({
       claims: [
@@ -139,6 +149,9 @@ describe('pipeline integration — all 6 detectors end-to-end', () => {
   });
 
   it('fires grounded_premise_adopted', () => {
+    // Exactly one assistant support: enough for grounded_premise_adopted
+    // (min 1 since #129) while staying below well_sourced_load_bearer's
+    // downstream minimum, so the grounded finding is the one that surfaces.
     const t = seedAndRun({
       claims: [
         { text: 'OWASP XSS #3', basis: 'research', speaker: 'user', confidence: 'high', external_id: 'u' },
@@ -150,7 +163,6 @@ describe('pipeline integration — all 6 detectors end-to-end', () => {
       ],
       edges: [
         { from: 'a', to: 'u', type: 'supports' },
-        { from: 'b', to: 'u', type: 'depends_on' },
       ],
     });
     expect(t).toBe('grounded_premise_adopted');
diff --git a/src/__tests__/reasoning/pipeline.test.ts b/src/__tests__/reasoning/pipeline.test.ts
index 5de7e3b..e820a59 100644
--- a/src/__tests__/reasoning/pipeline.test.ts
+++ b/src/__tests__/reasoning/pipeline.test.ts
@@ -16,9 +16,13 @@ function memDb(companionIds: string[] = ['c1']): Database.Database {
 }
 
 // Build a payload that pre-primes the graph with load-bearing vibes.
+// The anchor is assistant-authored: a *user* vibes claim with assistant
+// supports and no pushback is an echo_chamber case, which subsumes
+// load-bearing (SUBSUMES in types.ts) and would change this fixture's
+// meaning. #150.
 function primingPayload() {
   const claims = [
-    { text: 'we need auth', basis: 'vibes' as const, speaker: 'user' as const, confidence: 'medium' as const, external_id: 'v1' },
+    { text: 'we need auth', basis: 'vibes' as const, speaker: 'assistant' as const, confidence: 'medium' as const, external_id: 'v1' },
     { text: 'so we need sessions', basis: 'deduction' as const, speaker: 'assistant' as const, confidence: 'medium' as const, external_id: 'd1' },
     { text: 'so we need tokens', basis: 'deduction' as const, speaker: 'assistant' as const, confidence: 'medium' as const, external_id: 'd2' },
     { text: 'so we need rate limits', basis: 'deduction' as const, speaker: 'assistant' as const, confidence: 'medium' as const, external_id: 'd3' },
diff --git a/src/__tests__/reasoning/session-trace.test.ts b/src/__tests__/reasoning/session-trace.test.ts
index 1afe681..7b7e8a2 100644
--- a/src/__tests__/reasoning/session-trace.test.ts
+++ b/src/__tests__/reasoning/session-trace.test.ts
@@ -1,22 +1,130 @@
-import { describe, it, expect } from 'vitest';
+// These tests build a fixture home and point resolveSessionTrace at it.
+//
+// They used to run against the developer's real ~/.claude. That made the
+// result a function of whose machine ran the suite: on a runner with no
+// transcript history it passed in milliseconds, and on a working machine it
+// read every transcript in full — 8.5 GB across 646 files here — blocking the
+// vitest worker synchronously so the timeout could not even fire. The suite
+// looked like it hung with no failing test to point at. A test that reads
+// ambient state outside the repo can only ever be as trustworthy as the
+// machine it ran on.
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { createHash } from 'crypto';
 import { deriveSessionId } from '../../lib/reasoning/session.js';
 import { resolveSessionTrace } from '../../lib/reasoning/session-trace.js';
 
+const CLAUDE_CWD = '/fixture/workspace/claude-project';
+const CODEX_CWD = '/fixture/workspace/codex-project';
+
+// Mirrors hashCwd in session-trace.ts. Duplicated on purpose: if the id
+// derivation ever changes, this fixture should stop matching and fail loudly
+// rather than silently follow the implementation.
+const hashCwd = (cwd: string) => createHash('sha256').update(cwd).digest('hex').slice(0, 16);
+
+let home: string;
+
+beforeAll(() => {
+  home = mkdtempSync(join(tmpdir(), 'buddy-trace-fixture-'));
+
+  const projects = join(home, '.claude', 'projects', 'fixture-project');
+  mkdirSync(projects, { recursive: true });
+  writeFileSync(
+    join(projects, 'session.jsonl'),
+    [
+      JSON.stringify({ cwd: CLAUDE_CWD, type: 'summary' }),
+      JSON.stringify({ type: 'user', message: 'ignored — only the first record is read' }),
+    ].join('\n') + '\n',
+  );
+
+  // Decoy: a transcript for a different cwd must not match.
+  writeFileSync(
+    join(projects, 'other.jsonl'),
+    JSON.stringify({ cwd: '/fixture/workspace/somewhere-else' }) + '\n',
+  );
+
+  const codex = join(home, '.codex', 'sessions', '2026', '07', '20');
+  mkdirSync(codex, { recursive: true });
+  writeFileSync(
+    join(codex, 'rollout.jsonl'),
+    [
+      JSON.stringify({ type: 'other', payload: { note: 'no cwd here' } }),
+      JSON.stringify({ type: 'session_meta', payload: { id: 'codex-abc123', cwd: CODEX_CWD } }),
+    ].join('\n') + '\n',
+  );
+});
+
+afterAll(() => {
+  rmSync(home, { recursive: true, force: true });
+});
+
 describe('resolveSessionTrace', () => {
   it('parses session id shape even when no metadata file is found', () => {
-    const trace = resolveSessionTrace('0123456789abcdef-20260512');
+    const trace = resolveSessionTrace('0123456789abcdef-20260512', { home });
     expect(trace.sessionId).toBe('0123456789abcdef-20260512');
     expect(trace.cwdHash).toBe('0123456789abcdef');
     expect(trace.dateBucket).toBe('20260512');
+    expect(trace.source).toBeUndefined();
+    expect(trace.cwd).toBeUndefined();
   });
 
-  it('can resolve the current buddy workspace via Codex metadata when present', () => {
-    const sessionId = deriveSessionId('/Users/steven.wu/Documents/buddy', Date.UTC(2026, 4, 12, 12, 0, 0));
-    const trace = resolveSessionTrace(sessionId);
-    expect(trace.cwdHash).toHaveLength(16);
-    if (trace.source === 'codex') {
-      expect(trace.cwd).toBe('/Users/steven.wu/Documents/buddy');
-      expect(trace.codexSessionFile).toContain('.codex/sessions');
-    }
+  it('returns empty hash and bucket for a malformed session id', () => {
+    const trace = resolveSessionTrace('not-a-session-id', { home });
+    expect(trace.cwdHash).toBe('');
+    expect(trace.dateBucket).toBe('');
+  });
+
+  it('resolves a workspace from a Claude transcript', () => {
+    const sessionId = deriveSessionId(CLAUDE_CWD, Date.UTC(2026, 4, 12, 12, 0, 0));
+    const trace = resolveSessionTrace(sessionId, { home });
+
+    expect(trace.cwdHash).toBe(hashCwd(CLAUDE_CWD));
+    expect(trace.source).toBe('claude');
+    expect(trace.cwd).toBe(CLAUDE_CWD);
+    expect(trace.projectLabel).toBe('workspace/claude-project');
+    expect(trace.claudeSessionFile).toContain('session.jsonl');
+  });
+
+  it('falls through to Codex metadata when no Claude transcript matches', () => {
+    const sessionId = deriveSessionId(CODEX_CWD, Date.UTC(2026, 4, 12, 12, 0, 0));
+    const trace = resolveSessionTrace(sessionId, { home });
+
+    expect(trace.source).toBe('codex');
+    expect(trace.cwd).toBe(CODEX_CWD);
+    expect(trace.codexSessionId).toBe('codex-abc123');
+    expect(trace.codexSessionFile).toContain('.codex/sessions');
+  });
+
+  it('does not match a transcript belonging to a different cwd', () => {
+    const sessionId = deriveSessionId('/fixture/workspace/never-recorded', Date.UTC(2026, 4, 12));
+    const trace = resolveSessionTrace(sessionId, { home });
+    expect(trace.source).toBeUndefined();
+    expect(trace.cwd).toBeUndefined();
+  });
+
+  it('matches on the first record without depending on the rest of the file', () => {
+    // The tail is deliberately larger than the read bound and deliberately
+    // unparseable. Resolution must still succeed from the first record, and
+    // must not choke on content it never needed to look at.
+    //
+    // Note this asserts correctness under truncation, NOT that reads are
+    // bounded — a few megabytes is cheap to read whole, so no timing
+    // assertion here could tell the two implementations apart. The bound is
+    // a performance property, and it is not honestly testable at a file size
+    // that belongs in a unit test.
+    const big = join(home, '.claude', 'projects', 'fixture-project', 'huge.jsonl');
+    const bigCwd = '/fixture/workspace/big-transcript';
+    writeFileSync(
+      big,
+      JSON.stringify({ cwd: bigCwd }) + '\n' + 'not json at all '.repeat(8 * 1024) + '\n',
+    );
+
+    const trace = resolveSessionTrace(deriveSessionId(bigCwd, Date.UTC(2026, 4, 12)), { home });
+    expect(trace.cwd).toBe(bigCwd);
+    expect(trace.source).toBe('claude');
+    rmSync(big, { force: true });
   });
 });
diff --git a/src/__tests__/reasoning/subsumption.test.ts b/src/__tests__/reasoning/subsumption.test.ts
new file mode 100644
index 0000000..9dd8162
--- /dev/null
+++ b/src/__tests__/reasoning/subsumption.test.ts
@@ -0,0 +1,157 @@
+// Regression coverage for #150.
+//
+// Some detectors are specializations of others — their predicate is another
+// detector's plus extra conjuncts — so both fire on the same anchor and
+// describe one situation at two resolutions. Selection takes candidates[0],
+// so before `dropSubsumed` the general finding always won on array order and
+// the specific one could never surface. `echo_chamber` was fully unreachable:
+// every echo case is also a load-bearing case, and the per-anchor cooldown
+// meant load-bearing's emission blocked echo on that anchor too.
+
+import { describe, it, expect } from 'vitest';
+import type { SessionGraph, Node, Edge } from '../../lib/reasoning/graph.js';
+import type { Basis, EdgeType, Speaker, Finding } from '../../lib/reasoning/types.js';
+import { SUBSUMES, CAUTION_FINDINGS } from '../../lib/reasoning/types.js';
+import {
+  dropSubsumed,
+  runAllDetectors,
+  detectEchoChamber,
+  detectLoadBearingVibes,
+  detectGroundedPremiseAdopted,
+  detectWellSourcedLoadBearer,
+} from '../../lib/reasoning/detectors.js';
+import { REASONING_CONFIG } from '../../lib/reasoning/config.js';
+
+type FixtureClaim = { id: string; speaker?: Speaker; text?: string; basis: Basis };
+type FixtureEdge = { from: string; to: string; type: EdgeType };
+
+function buildGraph(claims: FixtureClaim[], edges: FixtureEdge[]): SessionGraph {
+  const nodes = new Map<string, Node>();
+  for (const c of claims) {
+    nodes.set(c.id, {
+      id: c.id, session_id: 'fixture', speaker: c.speaker ?? 'assistant',
+      text: c.text ?? c.id, basis: c.basis, confidence: 'medium', created_at: 0,
+    });
+  }
+  const edgesById = new Map<string, Edge>();
+  const outgoing = new Map<string, Edge[]>();
+  const incoming = new Map<string, Edge[]>();
+  let i = 0;
+  for (const e of edges) {
+    const edge: Edge = {
+      id: `e${i++}`, session_id: 'fixture',
+      from_claim: e.from, to_claim: e.to, type: e.type, created_at: 0,
+    };
+    edgesById.set(edge.id, edge);
+    const o = outgoing.get(edge.from_claim) ?? []; o.push(edge); outgoing.set(edge.from_claim, o);
+    const n = incoming.get(edge.to_claim) ?? []; n.push(edge); incoming.set(edge.to_claim, n);
+  }
+  return { sessionId: 'fixture', nodes, edgesById, outgoing, incoming };
+}
+
+function withFiller(claims: FixtureClaim[], edges: FixtureEdge[]): SessionGraph {
+  const pad: FixtureClaim[] = [];
+  for (let i = claims.length; i < REASONING_CONFIG.COLD_START_MIN_CLAIMS; i++) {
+    pad.push({ id: `filler${i}`, basis: 'definition', text: `filler claim ${i}` });
+  }
+  return buildGraph([...claims, ...pad], edges);
+}
+
+// A user vibes claim with N assistant supports and no pushback: the canonical
+// echo chamber, and simultaneously a load-bearing vibes claim.
+function echoGraph(supports = REASONING_CONFIG.ECHO_CHAMBER_MIN_SUPPORTS): SessionGraph {
+  const backers = Array.from({ length: supports }, (_, i) => ({
+    id: `a${i}`, basis: 'deduction' as const, speaker: 'assistant' as const,
+  }));
+  return withFiller(
+    [{ id: 'u1', basis: 'vibes', speaker: 'user', text: 'this is the right approach' }, ...backers],
+    backers.map(b => ({ from: b.id, to: 'u1', type: 'supports' as const })),
+  );
+}
+
+const typesOf = (fs: Finding[]) => fs.map(f => f.type);
+
+describe('detector subsumption (#150)', () => {
+  it('the overlap is real: both detectors independently fire on the same anchor', () => {
+    const g = echoGraph();
+    const echo = detectEchoChamber(g);
+    const general = detectLoadBearingVibes(g);
+    expect(typesOf(echo)).toEqual(['echo_chamber']);
+    expect(typesOf(general)).toEqual(['load_bearing_vibes']);
+    expect(echo[0].anchor_claim_id).toBe(general[0].anchor_claim_id);
+  });
+
+  it('runAllDetectors surfaces echo_chamber, not the general finding it subsumes', () => {
+    const types = typesOf(runAllDetectors(echoGraph()));
+    expect(types).toContain('echo_chamber');
+    expect(types).not.toContain('load_bearing_vibes');
+  });
+
+  it('echo_chamber is reachable as the FIRST candidate, so selection can pick it', () => {
+    // findings.ts takes candidates[0] within a category. Before the fix this
+    // was always load_bearing_vibes and echo could never be selected.
+    const caution = runAllDetectors(echoGraph()).filter(f => f.type !== 'unverified_hedge');
+    expect(caution[0].type).toBe('echo_chamber');
+  });
+
+  it('grounded_premise_adopted wins over well_sourced_load_bearer on a shared anchor', () => {
+    const g = withFiller([
+      { id: 'u1', basis: 'research', speaker: 'user', text: 'OWASP lists XSS third' },
+      { id: 'a1', basis: 'deduction', speaker: 'assistant' },
+      { id: 'a2', basis: 'deduction', speaker: 'assistant' },
+    ], [
+      { from: 'a1', to: 'u1', type: 'supports' },
+      { from: 'a2', to: 'u1', type: 'depends_on' },
+    ]);
+    expect(typesOf(detectWellSourcedLoadBearer(g))).toEqual(['well_sourced_load_bearer']);
+    expect(typesOf(detectGroundedPremiseAdopted(g))).toEqual(['grounded_premise_adopted']);
+
+    const types = typesOf(runAllDetectors(g));
+    expect(types).toContain('grounded_premise_adopted');
+    expect(types).not.toContain('well_sourced_load_bearer');
+  });
+
+  it('leaves the general finding alone when the specific one did not fire', () => {
+    // Same shape, but assistant-authored — echo_chamber requires a user
+    // speaker, so there is nothing to subsume and load-bearing stands.
+    const backers = Array.from({ length: REASONING_CONFIG.LOAD_BEARING_MIN_DOWNSTREAM }, (_, i) => ({
+      id: `a${i}`, basis: 'deduction' as const, speaker: 'assistant' as const,
+    }));
+    const g = withFiller(
+      [{ id: 'x1', basis: 'vibes', speaker: 'assistant' }, ...backers],
+      backers.map(b => ({ from: b.id, to: 'x1', type: 'supports' as const })),
+    );
+    const types = typesOf(runAllDetectors(g));
+    expect(types).toContain('load_bearing_vibes');
+    expect(types).not.toContain('echo_chamber');
+  });
+
+  it('only subsumes on a SHARED anchor, never across different anchors', () => {
+    const specific: Finding = { type: 'echo_chamber', anchor_claim_id: 'A', claim_text: 'a' };
+    const general: Finding = { type: 'load_bearing_vibes', anchor_claim_id: 'B', claim_text: 'b' };
+    expect(dropSubsumed([general, specific])).toHaveLength(2);
+    expect(dropSubsumed([
+      general,
+      { ...specific, anchor_claim_id: 'B' },
+    ])).toEqual([{ ...specific, anchor_claim_id: 'B' }]);
+  });
+
+  it('is a no-op on findings with no subsumption relationship', () => {
+    const fs: Finding[] = [
+      { type: 'unchallenged_chain', anchor_claim_id: 'A', claim_text: 'a' },
+      { type: 'unverified_hedge', anchor_claim_id: 'A', claim_text: 'a' },
+    ];
+    expect(dropSubsumed(fs)).toEqual(fs);
+  });
+
+  it('every SUBSUMES pair stays within one category, so the kudos/caution mix is unchanged', () => {
+    // findings.ts balances caution against kudos. If a specific caution
+    // finding displaced a general kudos one (or vice versa) the bias logic
+    // would silently skew.
+    for (const [specific, general] of Object.entries(SUBSUMES)) {
+      const sameCategory =
+        CAUTION_FINDINGS.includes(specific as never) === CAUTION_FINDINGS.includes(general as never);
+      expect(sameCategory, `${specific} → ${general} crosses categories`).toBe(true);
+    }
+  });
+});
diff --git a/src/lib/oldBuddy.ts b/src/lib/oldBuddy.ts
index 6c99aca..a09e881 100644
--- a/src/lib/oldBuddy.ts
+++ b/src/lib/oldBuddy.ts
@@ -262,12 +262,22 @@ function ccHashString(s: string): { hash: number; engine: 'bun' | 'fnv1a' } {
 
   if (bunAvailable) {
     try {
-      // Pass input as process.argv to avoid shell injection — no string interpolation
+      // Input goes through the environment, not argv and not string
+      // interpolation: `bun -e <script> <arg>` does NOT forward trailing
+      // arguments — process.argv is ['bun', '<cwd>/[eval]'] and nothing else,
+      // so process.argv[1] was a constant. Every userId hashed to the same
+      // value, and every rescued companion came out with identical rarity,
+      // species, eye and stats. Env keeps the no-interpolation property that
+      // made argv attractive in the first place.
       const result = spawnSync('bun', [
         '-e',
-        'console.log(Number(BigInt(Bun.hash(process.argv[1])) & 0xffffffffn))',
-        s,
-      ], { timeout: 5000, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+        'console.log(Number(BigInt(Bun.hash(process.env.BUDDY_CC_HASH_INPUT ?? "")) & 0xffffffffn))',
+      ], {
+        timeout: 5000,
+        encoding: 'utf-8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+        env: { ...process.env, BUDDY_CC_HASH_INPUT: s },
+      });
       const hash = parseInt((result.stdout || '').trim(), 10);
       if (!isNaN(hash)) return { hash, engine: 'bun' };
     } catch { /* fall through */ }
diff --git a/src/lib/reasoning/DESIGN.md b/src/lib/reasoning/DESIGN.md
index d680a57..4d93242 100644
--- a/src/lib/reasoning/DESIGN.md
+++ b/src/lib/reasoning/DESIGN.md
@@ -234,6 +234,52 @@ only (confirmed by its README) and buddy's edge over slimemold is
 *symmetric* noticing — celebrating rigor is the other half of the
 sycophancy-as-tool inversion.
 
+## Overlapping detectors: subsumption, not competition
+
+Two detectors can fire on the same anchor while describing one situation at
+two resolutions. `echo_chamber`'s predicate is `load_bearing_vibes`' predicate
+plus three conjuncts — the claim is the user's, its supports are all
+assistant-authored, and the assistant never pushed back — so **every echo case
+is also a load-bearing case**. That isn't a tie to break; it's containment.
+
+Selection (`findings.ts`) picks `candidates[0]` within a category, so before
+this was modelled, the general finding won purely on the order detectors run
+in, and the specific one was unreachable. The per-anchor cooldown made it
+worse rather than self-correcting: it keys on `anchor_claim_id` without
+regard to type, so emitting the general finding also blocked the specific one
+on that same anchor for the next N observes. `echo_chamber` therefore could
+not surface at all — not rarely, *never* (#150).
+
+`SUBSUMES` in `types.ts` names the containment explicitly, and
+`runAllDetectors` drops a general finding when a more specific one fired on
+the same anchor. Two consequences worth knowing:
+
+- `load_bearing_vibes` no longer fires on *user* vibes claims that the
+  assistant backed without pushback — those now read as `echo_chamber`, which
+  is the better message for that shape. It still fires on assistant-authored
+  vibes, on user claims that did get challenged, and on user-supported claims.
+- The relationship must stay within one category. Caution/kudos balance
+  (`KUDOS_BIAS_*`, `KUDOS_TIE_BREAK_WEIGHT`) assumes the two pools are
+  independent; a subsumption that crossed them would skew the bias silently.
+  A test asserts every `SUBSUMES` pair is same-category.
+- **Telemetry shifts at the version boundary.** `pipeline.ts` feeds
+  `recordDetectedFindings` from `runAllDetectors`' output, which is now
+  post-drop, so `findings_detected_by_type` counts candidates *offered to
+  selection* rather than candidates raised. Expect `load_bearing_vibes` to
+  fall and `echo_chamber` to rise in `buddy_doctor` after this lands. That is
+  the change working, not a regression — but a metric comparison across the
+  boundary is not like-for-like.
+
+`SUBSUMES` is deliberately single-level: `dropSubsumed` resolves one hop, not
+a transitive closure. Nothing chains today. If a future detector ever makes it
+chain (A ⊂ B and B ⊂ C), the resolution becomes order-dependent and the table
+needs to grow a real closure rather than another row.
+
+Adding a detector that specializes an existing one means adding it to
+`SUBSUMES`. Adding one that merely *overlaps* — neither predicate contains
+the other — is a different problem this doesn't solve, and needs a real
+priority policy rather than a containment table.
+
 ## Schema and storage
 
 Three tables, all additive (see `schema.ts`):
diff --git a/src/lib/reasoning/detectors.ts b/src/lib/reasoning/detectors.ts
index a19e985..92e896d 100644
--- a/src/lib/reasoning/detectors.ts
+++ b/src/lib/reasoning/detectors.ts
@@ -11,7 +11,7 @@
 // Chain-walking detectors share a single `ChainScratch` across their
 // per-node iteration so overlapping subtrees aren't re-walked.
 
-import type { Finding } from './types.js';
+import { type Finding, SUBSUMES } from './types.js';
 import { REASONING_CONFIG } from './config.js';
 import {
   type SessionGraph,
@@ -50,6 +50,13 @@ export function detectUnchallengedChain(graph: SessionGraph, scratch: ChainScrat
   const out: Finding[] = [];
   const minLen = REASONING_CONFIG.UNCHALLENGED_CHAIN_MIN_LENGTH;
   for (const node of graph.nodes.values()) {
+    // Only start from a maximal chain — a node nothing else depends on.
+    // Otherwise a challenged chain still fires via its own unchallenged
+    // suffix: challenge c1→c2, and the walk starting at c2 sees no challenge
+    // between its own endpoints. That suffix isn't a separate chain, it's the
+    // tail of one we already considered. Was masked until #129 lowered the
+    // minimum length to 3 and made short suffixes long enough to qualify.
+    if (downstreamCount(graph, node.id) > 0) continue;
     const chain = longestChainNodesFrom(graph, node.id, ['supports', 'depends_on'], scratch);
     if (chain.length < minLen) continue;
     if (chainHasChallenge(graph, chain)) continue;
@@ -198,10 +205,24 @@ export function detectGroundedPremiseAdopted(graph: SessionGraph): Finding[] {
   return out;
 }
 
+// Drop a general finding when a more specific one fired on the same anchor.
+// Both describe one situation; surfacing the general one loses information,
+// and the per-anchor cooldown in findings.ts means whichever is emitted
+// blocks the other for the next N observes anyway. Exported for testing.
+export function dropSubsumed(findings: Finding[]): Finding[] {
+  const specificByAnchor = new Set<string>();
+  for (const f of findings) {
+    const general = SUBSUMES[f.type];
+    if (general) specificByAnchor.add(`${f.anchor_claim_id}:${general}`);
+  }
+  if (specificByAnchor.size === 0) return findings;
+  return findings.filter(f => !specificByAnchor.has(`${f.anchor_claim_id}:${f.type}`));
+}
+
 export function runAllDetectors(graph: SessionGraph): Finding[] {
   if (graph.nodes.size < REASONING_CONFIG.COLD_START_MIN_CLAIMS) return [];
   const scratch = makeChainScratch();
-  return [
+  return dropSubsumed([
     ...detectLoadBearingVibes(graph),
     ...detectUnchallengedChain(graph, scratch),
     ...detectEchoChamber(graph),
@@ -209,5 +230,5 @@ export function runAllDetectors(graph: SessionGraph): Finding[] {
     ...detectWellSourcedLoadBearer(graph),
     ...detectProductiveStressTest(graph, scratch),
     ...detectGroundedPremiseAdopted(graph),
-  ];
+  ]);
 }
diff --git a/src/lib/reasoning/session-trace.ts b/src/lib/reasoning/session-trace.ts
index 7c04e27..1ebea1e 100644
--- a/src/lib/reasoning/session-trace.ts
+++ b/src/lib/reasoning/session-trace.ts
@@ -1,5 +1,5 @@
 import { createHash } from 'crypto';
-import { existsSync, readdirSync, readFileSync, statSync } from 'fs';
+import { closeSync, existsSync, openSync, readdirSync, readFileSync, readSync, statSync } from 'fs';
 import { basename, dirname, join } from 'path';
 import { homedir } from 'os';
 
@@ -50,6 +50,45 @@ function walkFiles(root: string, exts: string[], depth: number = 4): string[] {
   return out;
 }
 
+// Session transcripts are big and there are a lot of them — a working
+// ~/.claude/projects runs to gigabytes across hundreds of .jsonl files. We
+// only ever need the first line (Claude) or the first handful (Codex), so
+// reading each file whole made this scale with total transcript volume
+// instead of with the header we actually parse. On a machine with real
+// history it never finished.
+// 32 KiB comfortably covers a first JSONL record while keeping a full scan of
+// a few hundred transcripts in the tens of megabytes rather than the tens of
+// gigabytes. A whole .json still gets parsed as one object, so it has its own
+// (larger) ceiling.
+const HEAD_BYTES = 32 * 1024;
+const MAX_WHOLE_JSON_BYTES = 256 * 1024;
+
+// Reads at most `bytes` from the front of a file. `truncated` says whether
+// the file continued past what we read, so callers can discard a trailing
+// partial line rather than trying to parse half a JSON object.
+function readHead(file: string, bytes: number = HEAD_BYTES): { text: string; truncated: boolean } {
+  let fd: number | undefined;
+  try {
+    fd = openSync(file, 'r');
+    const buf = Buffer.allocUnsafe(bytes);
+    const got = readSync(fd, buf, 0, bytes, 0);
+    return { text: buf.toString('utf-8', 0, got), truncated: got === bytes };
+  } catch {
+    return { text: '', truncated: false };
+  } finally {
+    if (fd !== undefined) { try { closeSync(fd); } catch { /* ignore */ } }
+  }
+}
+
+// Complete lines only — a truncated read almost always ends mid-line.
+function headLines(file: string, bytes: number = HEAD_BYTES): string[] {
+  const { text, truncated } = readHead(file, bytes);
+  if (!text) return [];
+  const lines = text.split('\n');
+  if (truncated) lines.pop();
+  return lines.filter(Boolean);
+}
+
 function tryMatchCwd(trace: SessionTrace, cwd: string): boolean {
   if (hashCwd(cwd) !== trace.cwdHash) return false;
   trace.cwd = cwd;
@@ -57,13 +96,23 @@ function tryMatchCwd(trace: SessionTrace, cwd: string): boolean {
   return true;
 }
 
-function resolveClaudeTrace(trace: SessionTrace): boolean {
-  const candidates = [join(homedir(), '.claude', 'sessions'), join(homedir(), '.claude', 'projects')];
+function resolveClaudeTrace(trace: SessionTrace, home: string): boolean {
+  const candidates = [join(home, '.claude', 'sessions'), join(home, '.claude', 'projects')];
   for (const dir of candidates) {
     for (const file of walkFiles(dir, ['.json', '.jsonl'], 3)) {
       try {
-        const raw = readFileSync(file, 'utf-8');
-        const firstLine = file.endsWith('.jsonl') ? raw.split('\n').find(Boolean) ?? '' : raw;
+        // .json is parsed whole, so it is read whole — but only when it is
+        // small enough to plausibly be session metadata. .jsonl needs just
+        // the first record.
+        let firstLine: string;
+        if (file.endsWith('.jsonl')) {
+          firstLine = headLines(file)[0] ?? '';
+        } else {
+          let size = 0;
+          try { size = statSync(file).size; } catch { continue; }
+          if (size > MAX_WHOLE_JSON_BYTES) continue;
+          firstLine = readFileSync(file, 'utf-8');
+        }
         if (!firstLine) continue;
         const data = JSON.parse(firstLine) as { cwd?: string };
         if (!data.cwd || !tryMatchCwd(trace, data.cwd)) continue;
@@ -78,11 +127,11 @@ function resolveClaudeTrace(trace: SessionTrace): boolean {
   return false;
 }
 
-function resolveCodexTrace(trace: SessionTrace): boolean {
-  const root = join(homedir(), '.codex', 'sessions');
+function resolveCodexTrace(trace: SessionTrace, home: string): boolean {
+  const root = join(home, '.codex', 'sessions');
   for (const file of walkFiles(root, ['.jsonl'], 4)) {
     try {
-      const lines = readFileSync(file, 'utf-8').split('\n').filter(Boolean).slice(0, 12);
+      const lines = headLines(file).slice(0, 12);
       for (const line of lines) {
         const row = JSON.parse(line) as any;
         const payload = row?.payload;
@@ -102,12 +151,22 @@ function resolveCodexTrace(trace: SessionTrace): boolean {
   return false;
 }
 
-export function resolveSessionTrace(sessionId: string): SessionTrace {
+export type ResolveOptions = {
+  // Root to search under, defaulting to the real home directory. Tests point
+  // this at a fixture tree: reading the developer's actual ~/.claude made the
+  // result depend on whose machine ran the suite, and made runtime scale with
+  // their transcript history — a test that took >90s here and 0s on a CI
+  // runner with no history, which is how an unbounded read went unnoticed.
+  home?: string;
+};
+
+export function resolveSessionTrace(sessionId: string, opts: ResolveOptions = {}): SessionTrace {
   const parsed = parseSessionId(sessionId);
   if (!parsed) return { sessionId, cwdHash: '', dateBucket: '' };
 
+  const home = opts.home ?? homedir();
   const trace: SessionTrace = { sessionId, cwdHash: parsed.cwdHash, dateBucket: parsed.dateBucket };
-  if (resolveClaudeTrace(trace)) return trace;
-  if (resolveCodexTrace(trace)) return trace;
+  if (resolveClaudeTrace(trace, home)) return trace;
+  if (resolveCodexTrace(trace, home)) return trace;
   return trace;
 }
diff --git a/src/lib/reasoning/types.ts b/src/lib/reasoning/types.ts
index 115b87b..1d86052 100644
--- a/src/lib/reasoning/types.ts
+++ b/src/lib/reasoning/types.ts
@@ -91,6 +91,29 @@ export function isCaution(type: FindingType): boolean {
   return (CAUTION_FINDINGS as readonly FindingType[]).includes(type);
 }
 
+// Some detectors are specializations of others: their predicate is another
+// detector's predicate plus extra conjuncts, so both fire on the same anchor
+// and describe ONE situation at two resolutions. Left key = the specific
+// finding; value = the general finding it subsumes on a shared anchor.
+//
+//   echo_chamber ⊂ load_bearing_vibes
+//     load-bearing = vibes/assumption basis with N+ incoming supports.
+//     echo adds: speaker is the user, the supports are all assistant-authored,
+//     and the assistant never pushed back. Every echo case is therefore also a
+//     load-bearing case, and echo's phrasing (nobody challenged it) carries
+//     strictly more than load-bearing's (this isn't anchored).
+//
+//   grounded_premise_adopted ⊂ well_sourced_load_bearer (on a shared anchor)
+//     Not a strict subset — grounded fires at 1 support where well-sourced
+//     needs 2 — but where both fire, grounded is the more specific reading.
+//
+// Without this, selection picked whichever detector ran first (findings.ts
+// takes candidates[0]), so the specific finding was unreachable. See #150.
+export const SUBSUMES: Readonly<Partial<Record<FindingType, FindingType>>> = {
+  echo_chamber: 'load_bearing_vibes',
+  grounded_premise_adopted: 'well_sourced_load_bearer',
+} as const;
+
 export type Finding = {
   type: FindingType;
   anchor_claim_id: string;  // cooldown key; also used to source `{claim}` in phrasings