@brainervirus/workit-core 8.23.0 → 8.25.0

package/src/hooks/shell-words.ts

@@ -18,6 +18,12 @@ export type Segment = {
   pipe?: true;
   /** Text it reads on standard input: heredoc bodies and here-strings. */
   stdin?: string[];
+  /**
+   * Indexes into `words` of the words the shell expands before the command
+   * runs: an unquoted `$`, `*`, `?`, `[` or backtick, or a `$(…)`, `<(…)` or
+   * double-quoted `$`/backtick. The text of such a word is not what runs.
+   */
+  expands?: number[];
   /** Command substitutions in its words (`$(…)`, `` `…` ``, `<(…)`), run with it. */
   subs?: string[];
   /** The command could not be analyzed (too deeply nested): why. The only segment then. */
@@ -291,6 +297,20 @@ const substitutions = (body: string): string[] => {
 const PLAIN_POSIX = /[^\s'"\\`$(){},<>|;&#]+/uy;
 const PLAIN_POWERSHELL = /[^\s'"`(){}<>|;&#]+/uy;
 
+/** Does a double-quoted body hold an expansion (`$x`, `$(…)`, a backtick)? */
+const expandsInQuotes = (body: string, dialect: ShellDialect): boolean => {
+  const escape = dialect === "posix" ? "\\" : "`";
+  for (let index = 0; index < body.length; index++) {
+    const char = body[index];
+    if (char === escape) index++;
+    else if (char === "$" || (dialect === "posix" && char === "`")) return true;
+  }
+  return false;
+};
+
+/** An unquoted glob or variable character in a plain run. */
+const EXPANDING_RUN = /[*?[]/u;
+
 /** The `)` of a `(( … ))` arithmetic command starting at `start`, or 0 for a subshell (`((a) )`). */
 const arithmeticEnd = (command: string, start: number): number => {
   const end = substitutionEnd(command, start);
@@ -316,6 +336,7 @@ const tokenize = (command: string, dialect: ShellDialect): Segment[] => {
   let current: Segment = { words: [], redirects: [] };
   let word = "";
   let inWord = false;
+  let expanding = false;
   let pending: "redirect" | "input" | "heredoc" | "herestring" | null = null;
   const heredocs: Array<{ delimiter: string; owner: Segment }> = [];
   const escape = posix ? "\\" : "`";
@@ -327,11 +348,16 @@ const tokenize = (command: string, dialect: ShellDialect): Segment[] => {
     } else if (pending === "heredoc")
       heredocs.push({ delimiter: text.replace(/^-/, ""), owner: current });
     else if (pending === "herestring") (current.stdin ??= []).push(text);
-    else if (pending !== "input")
+    else if (pending !== "input") {
+      const at = current.words.length;
       current.words.push(...(MARKERS.test(word) ? expandBraces(word) : [word]));
+      if (expanding || (!posix && word.startsWith("@")))
+        (current.expands ??= []).push(...current.words.slice(at).map((_, i) => at + i));
+    }
     pending = null;
     word = "";
     inWord = false;
+    expanding = false;
   };
   const flushSegment = () => {
     flushWord();
@@ -347,6 +373,7 @@ const tokenize = (command: string, dialect: ShellDialect): Segment[] => {
   /** A substitution read apart: its command runs, its text stays in the word. */
   const substitution = (inner: string, text: string) => {
     (current.subs ??= []).push(inner);
+    expanding = true;
     word += text;
     inWord = true;
   };
@@ -358,6 +385,7 @@ const tokenize = (command: string, dialect: ShellDialect): Segment[] => {
     if (run) {
       word += run[0];
       inWord = true;
+      if (EXPANDING_RUN.test(run[0])) expanding = true;
       index += run[0].length - 1;
       continue;
     }
@@ -383,6 +411,7 @@ const tokenize = (command: string, dialect: ShellDialect): Segment[] => {
       const body = command.slice(index + 1, end < 0 ? undefined : end);
       if (posix && char === '"' && /\$\(|`/.test(body))
         (current.subs ??= []).push(...substitutions(body));
+      if (char === '"' && expandsInQuotes(body, dialect)) expanding = true;
       word += unquote(body, char, dialect);
       inWord = true;
       index = end < 0 ? command.length : end;
@@ -428,6 +457,7 @@ const tokenize = (command: string, dialect: ShellDialect): Segment[] => {
       if (char === "(" && inWord && word.endsWith("$")) {
         word = word.slice(0, -1);
         inWord = word !== "";
+        if (!inWord) expanding = false;
       }
       group(char === "(" ? "open" : "close");
     } else if (!posix && (char === "{" || char === "}")) {
@@ -474,6 +504,7 @@ const tokenize = (command: string, dialect: ShellDialect): Segment[] => {
     } else if (posix && char === "," && word.includes(OPEN)) word += COMMA;
     else if (posix && char === "}" && word.includes(OPEN)) word += CLOSE;
     else {
+      if (char === "$") expanding = true;
       word += char;
       inWord = true;
     }

package/src/hooks/stop.ts

@@ -11,11 +11,15 @@
 //       or merged;
 //   (c) verdict: the session opened the PR (or verified delivery) but the
 //       head lacks the verdict the policy asks for, while the endpoint is
-//       green or merged (a PR opens without one): the author's own `--self`
-//       verdict at normal risk under `verification: self`, an accepted
-//       non-author verdict at high risk or under `verification: independent`.
-//       Not raised when the task's latest judgment records no behavior
-//       change at normal risk (policy/derive.ts asks for none either), nor while a verifier or reviewer this lead started still runs.
+//       green or merged (a PR opens without one). Under `verification:
+//       proportional` (the default) the review lane of the head decides
+//       (core/policy/lane.ts): none owes nothing, self the author's own
+//       `--self` verdict, focused and full an accepted non-author verdict.
+//       Under `self`: the author's own at normal risk; at high risk or under
+//       `independent`: a non-author one, and not raised when the task's
+//       latest judgment records no behavior change at normal risk
+//       (policy/derive.ts asks for none either). Never raised while a
+//       verifier or reviewer this lead started still runs.
 // Each obligation blocks once per head and session (a marker keyed by kind
 // and head), not once per turn.
 // A branch that landed owes nothing: a recorded merge (`workit pr merge`, or
@@ -29,10 +33,9 @@
 // the ledger and local git only (no forge call), and every failure allows
 // the stop.
 import { spawnSync } from "node:child_process";
-import { resolveAutonomy } from "../autonomy";
-import { latestJudgment } from "../core/policy/derive";
-import type { Judgment } from "../core/task-contract";
-import { TaskStore } from "../core/task-store";
+import { resolveAutonomy, type VerificationMode } from "../autonomy";
+import { currentJudgment } from "../core/policy/current-judgment";
+import { branchLane, laneNeed } from "../core/policy/lane";
 import { currentBranch, pushRemoteName } from "../git/rev";
 import { checkVerdicts, readLedger, type ReadRow } from "../ledger";
 import type { HostDescriptor } from "./descriptor";
@@ -237,43 +240,57 @@ const redChecks = (
   };
 };
 
-/** The open task's latest judgment (the one policy/derive.ts reads), or null when none is recorded. */
-const taskJudgment = (cwd: string): Judgment | null => {
-  try {
-    const store = new TaskStore(cwd);
-    const listed = store.listTaskIndex();
-    const key = store.currentKey();
-    if (!listed.ok || !key.ok) return null;
-    const entry = listed.data
-      .filter((item) => item.key === key.data.key && item.status !== "closed")
-      .toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt))[0];
-    const task = entry ? store.readTask(entry.id) : null;
-    return task?.ok === true ? latestJudgment(task.data) : null;
-  } catch {
-    return null;
-  }
+/**
+ * The base the branch's PR targets: the newest the forge reported (a
+ * `pr.status` row, so a PR retargeted on the forge is read against its
+ * current base), else the one it was opened with (`pr.created`), else null
+ * (the default base). Read from the ledger: the hook never calls the forge.
+ */
+const prBase = (rows: readonly ReadRow[]): string | null => {
+  const seen = rows.findLast(
+    (row) =>
+      (row.type === "pr.status" || row.type === "pr.created") &&
+      row.observer === "workit_cli" &&
+      typeof row.base === "string",
+  );
+  return typeof seen?.base === "string" ? seen.base : null;
 };
 
 /**
  * (c) Delivered by this session, yet the head lacks the verdict the policy
- * asks for: the author's own at normal risk when the workspace's
- * verification is `self`, else an accepted non-author one.
+ * asks for. Under `verification: proportional` the review lane of the head
+ * decides (core/policy/lane.ts): none owes nothing, self the author's own,
+ * focused and full a non-author one. Under `self`, the author's own at
+ * normal risk; under `independent` or at high risk, a non-author one.
  */
 const unverified = (
   cwd: string,
   branch: string,
   all: readonly ReadRow[],
   descriptor: HostDescriptor,
-  verification: "self" | "independent",
+  verification: VerificationMode,
+  head: string | null,
 ): StopObligation | null => {
   const check = checkVerdicts(cwd, branch, all);
   if (check.accepted.accepted || check.accepted.reasons.includes("failing_verdict")) return null;
-  const judgment = taskJudgment(cwd);
+  const judgment = currentJudgment(cwd);
   const high = judgment?.riskTier === "high";
-  // Like policy/derive.ts: a verdict is asked for a behavior change or high
-  // risk. A recorded judgment with neither (docs only) owes none.
-  if (judgment && !judgment.behaviorChange && !high) return null;
-  const independent = verification === "independent" || high;
+  let independent: boolean;
+  if (verification === "proportional") {
+    const lane = branchLane(cwd, {
+      base: prBase(all.filter((row) => row.branch === branch)),
+      head,
+      judgment,
+    });
+    const need = laneNeed(lane.lane);
+    if (need === "none") return null;
+    independent = need === "non-author";
+  } else {
+    // Like policy/derive.ts: a verdict is asked for a behavior change or high
+    // risk. A recorded judgment with neither (docs only) owes none.
+    if (judgment && !judgment.behaviorChange && !high) return null;
+    independent = verification === "independent" || high;
+  }
   if (!independent && check.review === "self-reviewed") return null;
   const has = check.review === "self-reviewed" ? "only a self verdict" : "no current verdict";
   const verifier = `${descriptor.subagents.agentPrefix}verifier`;
@@ -332,7 +349,7 @@ export function stopObligation(
     }
     // A PR opens without a verdict: only green and merged need one.
     if (!delivered || (endpoint !== "green" && endpoint !== "merged")) return null;
-    const left = unverified(input.cwd, branch, all, descriptor, autonomy.verification);
+    const left = unverified(input.cwd, branch, all, descriptor, autonomy.verification, head);
     return left ? { ...left, head } : null;
   } catch {
     return null;

package/src/hooks/worktree-confine.ts

@@ -182,7 +182,7 @@ const shown = (target: string): string =>
 
 const unboundDeny = (input: HookInput, target: string): HookDecision => {
   const unblock =
-    "Work only in the worktree your brief names, which the lead made with `workit fanout worktree create <slice>`: edit files under it and run one verb per call against it (`workit --cwd <worktree> git commit -m … -- <paths>`, `workit --cwd <worktree> check <name>`). If your brief names no worktree, stop and report that to the lead.";
+    "Work only in the worktree your brief names, which the lead made with `workit fanout worktree create <slice>`: edit files under it and run one verb per call against it (`workit git --cwd <worktree> commit -m … -- <paths>`, `workit check --cwd <worktree> <name>`). If your brief names no worktree, stop and report that to the lead.";
   return {
     kind: "deny",
     reason: `workit worktree confinement: implementer ${input.session.agentId} is not working in a Workit worktree yet, and ${shown(target)} is outside every worktree \`workit fanout worktree create\` made, so it would change the lead's checkout. ${unblock}`,
@@ -191,7 +191,7 @@ const unboundDeny = (input: HookInput, target: string): HookDecision => {
 };
 
 const outsideDeny = (input: HookInput, worktree: string, target: string): HookDecision => {
-  const unblock = `Edit only under ${worktree} and run git there, one verb per call: \`workit --cwd ${worktree} git commit -m … -- <paths>\`, \`workit --cwd ${worktree} check <name>\` (or \`git -C ${worktree} …\`); a command whose writes Workit cannot see is judged by the directory it runs in. Anything outside it is a follow-up for your report.`;
+  const unblock = `Edit only under ${worktree} and run git there, one verb per call: \`workit git --cwd ${worktree} commit -m … -- <paths>\`, \`workit check --cwd ${worktree} <name>\` (or \`git -C ${worktree} …\`); a command whose writes Workit cannot see is judged by the directory it runs in. Anything outside it is a follow-up for your report.`;
   return {
     kind: "deny",
     reason: `workit worktree confinement: implementer ${input.session.agentId} is bound to the worktree ${worktree}, and ${shown(target)} is outside it. ${unblock}`,
@@ -201,7 +201,7 @@ const outsideDeny = (input: HookInput, worktree: string, target: string): HookDe
 
 const unknownDirDeny = (input: HookInput, worktree: string | null): HookDecision => {
   const wt = worktree ?? "<worktree>";
-  const unblock = `Workit cannot resolve \`cd -\`, \`cd "$X"\` or \`popd\`: write by absolute path, \`git -C ${wt}\` or \`workit --cwd ${wt}\`.`;
+  const unblock = `Workit cannot resolve \`cd -\`, \`cd "$X"\` or \`popd\`: write by absolute path, \`git -C ${wt}\` or \`workit <verb> --cwd ${wt}\`.`;
   return {
     kind: "deny",
     reason: `workit worktree confinement: implementer ${input.session.agentId} writes after an unknown directory change. ${unblock}`,

package/src/hooks/write-gate.ts

@@ -509,7 +509,7 @@ const segmentTargets = (
     }
     const inner = depth < 4 ? (wrappedScript(words) ?? (strict ? shellScript(words) : null)) : null;
     if (inner !== null && dir !== undefined)
-      targets.push(...segmentTargets(dir, inner, "posix", depth + 1, strict));
+      targets.push(...segmentTargets(workitRunDir(dir, words), inner, "posix", depth + 1, strict));
     if (strict && dir !== undefined) {
       const runIn = dir;
       for (const sub of depth < 4 ? (segment.subs ?? []) : [])
@@ -550,6 +550,15 @@ const segmentTargets = (
   return targets;
 };
 
+/** Where `workit check|lock run [--cwd <dir>] -- <cmd>` runs its command: `--cwd` resolved against `dir`. */
+const workitRunDir = (dir: string, words: string[]): string => {
+  for (const invocation of workitInvocations(words.map(quoteWord).join(" "), "posix")) {
+    const { at, args } = workitCwd(dir, invocation);
+    if (args[0] === "check" || (args[0] === "lock" && args[1] === "run")) return at;
+  }
+  return dir;
+};
+
 /** A workit invocation's global `--cwd <dir>` (or `--cwd=<dir>`), resolved against `dir`. */
 const workitCwd = (dir: string, args: string[]): { at: string; args: string[] } => {
   const { rest, cwd } = skipWorkitGlobals(args);

package/src/ledger.ts

@@ -33,7 +33,10 @@
 //   `base`, the stable patch-id of `base...head` and an exact diff hash. It is
 //   `fresh` (same head; verdicts on a dirty worktree are refused, so the head
 //   is the judged tree), `carried` (new head, same patch-id AND same exact
-//   diff: a rebase that only moved the base) or `stale`.
+//   diff AND, for a pass, byte-identical own files the base left alone: a
+//   rebase that only moved the base; or a trusted verdict whose
+//   follow-up change is lane none, or test-only for a unit verdict, see
+//   core/policy/carry.ts) or `stale`.
 // - Integrity (D18): every row the CLI appends carries `prevHash` (sha256 of
 //   the previous line) and `rowHash` (sha256 over `prevHash` and the row), a
 //   running chain. A row without it after the chain began, or whose hashes do
@@ -54,8 +57,16 @@ import { createHash, randomBytes } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { hostAwareLockTimeout } from "./core/store-lock";
-import { vcsConfig } from "./core/vcs-config";
-import { GIT_TIMEOUTS, currentBranch, headSha, patchId, worktreeTree } from "./git/rev";
+import { verdictDrift, type CarryRule, type Drift } from "./core/policy/carry";
+import { defaultBase } from "./git/default-base";
+import {
+  GIT_TIMEOUTS,
+  currentBranch,
+  headSha,
+  patchId,
+  sameOwnChange,
+  worktreeTree,
+} from "./git/rev";
 import { hostSessionFromEnv, issuedBinding } from "./host-session";
 import { bumpStandingRev } from "./hooks/standing-signal";
 import { resolveStore } from "./store/paths";
@@ -281,47 +292,8 @@ export function branchHead(cwd: string, branch: string): string | null {
   );
 }
 
-/**
- * The PR target of the release track the checkout is on, when the workspace
- * configures tracks (as `fanout plan` and `stack plan` pick their trunk); a
- * plain workspace default does not override origin's default branch.
- */
-const trackTrunk = (cwd: string): string | null => {
-  try {
-    const resolved = vcsConfig("resolve", cwd);
-    if (resolved.ok === false || !resolved.releaseTrack || resolved.releaseTrack.blocking)
-      return null;
-    const target = String(resolved.defaultTargetBranch ?? "").trim();
-    return target && safeRef(target) ? target : null;
-  } catch {
-    return null;
-  }
-};
-
-/**
- * The default base for patch-ids and author trailers: the release track's PR
- * target (origin's copy, else the local one) when tracks are configured, else
- * origin's HEAD branch, else the first of origin/main, origin/master, main,
- * master, origin/develop, develop that exists.
- */
-export function defaultBase(cwd: string): string | null {
-  const trunk = trackTrunk(cwd);
-  if (trunk)
-    for (const candidate of [`origin/${trunk}`, trunk])
-      if (resolveCommit(cwd, candidate)) return candidate;
-  const originHead = git(cwd, ["symbolic-ref", "-q", "--short", "refs/remotes/origin/HEAD"]);
-  if (originHead && resolveCommit(cwd, originHead)) return originHead;
-  for (const candidate of [
-    "origin/main",
-    "origin/master",
-    "main",
-    "master",
-    "origin/develop",
-    "develop",
-  ])
-    if (resolveCommit(cwd, candidate)) return candidate;
-  return null;
-}
+// The default base lives in git/default-base.ts (shared with the review lane).
+export { defaultBase };
 
 /**
  * sha256 of the exact `base...head` diff with the pinned options rev.ts uses
@@ -1136,9 +1108,21 @@ export type VerdictEntry = {
   /** current AND passing AND independent. */
   accepted: boolean;
   reasons: RejectReason[];
+  /** Why a verdict on an older head still applies after a follow-up change (core/policy/carry.ts). */
+  carry: CarryNote | null;
   verdict: ReadRow;
 };
 
+/** A verdict carried over a follow-up change: by which rule, from which judged head, over which files. */
+export type CarryNote = { rule: CarryRule; since: string; files: string[] };
+
+/** A stale verdict whose follow-up change is small and off risk paths: re-verify only these files. */
+export type Reverify = { scope: "focused"; since: string; files: string[] };
+
+/** `carried (lane none since <head>)`: how a carried verdict reads in `ledger check` and `pr status`. */
+export const carryLabel = (carry: CarryNote): string =>
+  `carried (${carry.rule === "lane-none" ? "lane none" : "tests only"} since ${carry.since.slice(0, 12)})`;
+
 export type VerdictCheck = {
   branch: string;
   head: string | null;
@@ -1146,6 +1130,10 @@ export type VerdictCheck = {
   patchId: string | null;
   /** Newest current verdict (else newest verdict): does it still apply? */
   current: { basis: VerdictBasis; verdict: ReadRow | null };
+  /** The carry of the accepted verdict (else of the newest current one), when a follow-up change carried it. */
+  carry: CarryNote | null;
+  /** No verdict applies, but the newest passing one is stale only by a small change: re-verify that. */
+  reverify: Reverify | null;
   /**
    * What merge gates read: an accepted strong (`verified`/`tests-verified`)
    * verdict and no current independent failure. `type-check-only` never counts.
@@ -1276,7 +1264,7 @@ const derivesFrom = (derived: string, bare: string): boolean =>
  * child that committed as `<lead>:<child>` and judges as `<child>` is still
  * the author). Two derived ids never match on a shared last segment.
  */
-const authoredBy = (authors: Set<string>, session: string): boolean => {
+export const authoredBy = (authors: Set<string>, session: string): boolean => {
   if (authors.has(session)) return true;
   for (const author of authors)
     if (derivesFrom(author, session) || derivesFrom(session, author)) return true;
@@ -1414,15 +1402,39 @@ function effectiveOf(
  * each restack itself and records `stack.restacked` with `patchEqual` when
  * the change relative to the parent is identical (same patch-id AND same
  * exact diff hash, D18). A verdict carries when such observed rows link its
- * head to the current head.
+ * head to the current head. With `exactIn` (the checkout), each link is
+ * re-read with exact blobs (sameOwnChange, #334), so a row recorded before
+ * that check carries a pass only when the branch's own files are identical
+ * across the restack. Null keeps every observed link: a failure keeps
+ * applying through them (failing closed the other way).
  */
+const restackExact = new WeakMap<ReadRow, boolean>();
 function restackCarries(
+  exactIn: string | null,
   rows: readonly ReadRow[],
   branch: string,
   from: string | null,
   to: string | null,
 ): boolean {
   if (!from || !to) return false;
+  const exact = (row: ReadRow, fromHead: string, head: string): boolean => {
+    if (exactIn === null) return true;
+    const cwd = exactIn;
+    let known = restackExact.get(row);
+    if (known === undefined) {
+      known =
+        typeof row.fromBase === "string" &&
+        typeof row.toBase === "string" &&
+        sameOwnChange(cwd, {
+          from: fromHead,
+          to: head,
+          fromBase: row.fromBase,
+          toBase: row.toBase,
+        });
+      restackExact.set(row, known);
+    }
+    return known;
+  };
   const edges = new Map<string, string[]>();
   for (const row of rows)
     if (
@@ -1432,7 +1444,8 @@ function restackCarries(
       row.branch === branch &&
       row.patchEqual === true &&
       typeof row.fromHead === "string" &&
-      row.head
+      row.head &&
+      exact(row, row.fromHead, row.head)
     )
       edges.set(row.fromHead, [...(edges.get(row.fromHead) ?? []), row.head]);
   const seen = new Set<string>([from]);
@@ -1471,9 +1484,73 @@ export function checkVerdicts(
     return key;
   };
   const keyFor = (base: string | null) => keysAt(base, head);
-  const basisOf = (row: ReadRow): Exclude<VerdictBasis, "none"> => {
+  // The branch's own change since a trusted verdict's head, read once per
+  // row (#334). A row the gates cannot trust never carries.
+  const driftCache = new Map<ReadRow, Drift | null>();
+  const driftOf = (row: ReadRow): Drift | null => {
+    if (driftCache.has(row)) return driftCache.get(row) ?? null;
+    let drift: Drift | null = null;
+    const toBase = row.base ?? fallbackBase;
+    const toBaseSha = toBase ? resolveCommit(cwd, toBase) : null;
+    const fromBase = row.baseSha ?? toBaseSha;
+    if (
+      row.head &&
+      head &&
+      row.head !== head &&
+      toBaseSha &&
+      fromBase &&
+      !untrusted(reasonsOf(row))
+    )
+      drift = verdictDrift(cwd, {
+        from: row.head,
+        to: head,
+        fromBase,
+        toBase: toBaseSha,
+        kind: typeof row.kind === "string" ? row.kind : "review",
+      });
+    driftCache.set(row, drift);
+    return drift;
+  };
+  // The same patch-id and diff hash are not enough to carry a pass (#334):
+  // both drop hunk line numbers, so an edit moved within a file keeps them.
+  // The branch's own files must be identical blobs too (sameOwnChange). A
+  // failure keeps the looser carry: it fails closed by applying more.
+  const exactCache = new Map<ReadRow, boolean>();
+  const exactCarry = (row: ReadRow): boolean => {
+    if (FAILING.has(String(row.result))) return true;
+    let exact = exactCache.get(row);
+    if (exact === undefined) {
+      const toBase = row.base ?? fallbackBase;
+      const toBaseSha = toBase ? resolveCommit(cwd, toBase) : null;
+      const fromBase = row.baseSha ?? toBaseSha;
+      exact = Boolean(
+        row.head &&
+        head &&
+        toBaseSha &&
+        fromBase &&
+        sameOwnChange(cwd, { from: row.head, to: head, fromBase, toBase: toBaseSha }),
+      );
+      exactCache.set(row, exact);
+    }
+    return exact;
+  };
+  const keyBasis = (row: ReadRow): Exclude<VerdictBasis, "none"> => {
     const basis = verdictBasis(row, { head, ...keyFor(row.base ?? fallbackBase) });
-    return basis === "stale" && restackCarries(rows, branch, row.head, head) ? "carried" : basis;
+    return basis === "carried" && !exactCarry(row) ? "stale" : basis;
+  };
+  const restacked = (row: ReadRow): boolean =>
+    restackCarries(FAILING.has(String(row.result)) ? null : cwd, rows, branch, row.head, head);
+  /** The follow-up carry of a verdict the exact keys and restacks do not carry. */
+  const carryOf = (row: ReadRow): CarryNote | null => {
+    if (keyBasis(row) !== "stale") return null;
+    if (restacked(row)) return null;
+    const drift = driftOf(row);
+    return drift?.carries ? { rule: drift.rule, since: drift.since, files: drift.files } : null;
+  };
+  const basisOf = (row: ReadRow): Exclude<VerdictBasis, "none"> => {
+    const basis = keyBasis(row);
+    if (basis !== "stale") return basis;
+    return restacked(row) || carryOf(row) ? "carried" : basis;
   };
   // A newer row is judged under the failure's own base, so a row recorded
   // with a different --base cannot make unchanged code look changed. When
@@ -1487,7 +1564,7 @@ export function checkVerdicts(
     const keys = stored ? { patchId: row.patchId, diffHash: row.diffHash } : keysAt(base, row.head);
     return (
       verdictBasis(failed, { head: row.head, ...keys }) !== "stale" ||
-      restackCarries(rows, branch, failed.head, row.head)
+      restackCarries(null, rows, branch, failed.head, row.head)
     );
   };
   const authors = authorSessions(cwd, rows, branch, { base: fallbackBase, head }, scope);
@@ -1566,6 +1643,7 @@ export function checkVerdicts(
       independent: independence.length === 0,
       accepted: reasons.length === 0,
       reasons,
+      carry: basis === "carried" ? carryOf(row) : null,
       verdict: row,
     });
     // The author's own failure never displaces an independent pass, but it
@@ -1622,15 +1700,38 @@ export function checkVerdicts(
                 ? newestCurrent.reasons
                 : (["type_check_only"] as RejectReason[]),
         };
-  const selfEntry = failing
+  // The author's latest pass or failure on the current code wins, across
+  // kinds: a newer failure cancels an older pass (review finding mvkcoxgb).
+  const latestSelf = failing
     ? undefined
     : verdicts.findLast(
         (entry) =>
           entry.current &&
           !entry.independent &&
           !untrusted(entry.reasons) &&
-          STRONG_RESULTS.has(String(entry.verdict.result)),
+          (STRONG_RESULTS.has(String(entry.verdict.result)) ||
+            FAILING.has(String(entry.verdict.result))),
       );
+  const selfEntry =
+    latestSelf && STRONG_RESULTS.has(String(latestSelf.verdict.result)) ? latestSelf : undefined;
+  const carryEntry =
+    verdicts.find((entry) => entry.verdict === accepted.verdict && entry.accepted) ?? newestCurrent;
+  // A focused re-verify: nothing applies now, and the newest trusted pass is
+  // stale only by a small change off risk paths (the drift's lane is self).
+  const lastPass =
+    accepted.accepted || failing || tampered.length
+      ? undefined
+      : verdicts.findLast(
+          (entry) =>
+            !entry.current &&
+            !untrusted(entry.reasons) &&
+            STRONG_RESULTS.has(String(entry.verdict.result)),
+        );
+  const drift = lastPass ? driftOf(lastPass.verdict) : null;
+  const reverify: Reverify | null =
+    drift && !drift.carries && drift.focused && drift.files
+      ? { scope: "focused", since: drift.since, files: drift.files }
+      : null;
   return {
     branch,
     head,
@@ -1639,6 +1740,8 @@ export function checkVerdicts(
     base: newestCurrent?.verdict.base ?? fallbackBase,
     patchId: keyFor(newestCurrent?.verdict.base ?? fallbackBase).patchId,
     current: { basis: newestCurrent?.basis ?? "none", verdict: newestCurrent?.verdict ?? null },
+    carry: carryEntry?.carry ?? null,
+    reverify,
     accepted,
     verdicts,
     authors: [...authors].toSorted(),