@ccoalm/ccl-skills 0.14.0 → 0.15.1

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/impact-chain-gate.rb

@@ -5,7 +5,7 @@
 # upstream-owner skill must declare a behavioral-evidence status and an
 # observed-failure state, and (for non-wording changes) name an owner-scoped
 # FIRING PATH that resolves to this diff — an anchor on a changed normative
-# rule line, or a changed owner executable. The statuses are required author
+# rule or table data line, or a changed owner executable. The statuses are required author
 # declarations; the firing path and the wording-only classification are the
 # machine-verified core. Extracted from the former inline `ruby -e` block in
 # check-ccl-skills.sh so the program gets normal Ruby tooling and no
@@ -52,19 +52,123 @@ LEDGER_PATH = "skills/skill-extraction-workflow/references/source-register.md"
 # the routing-surface class below was one such patch) only re-instantiates it on
 # the next input. The predicate now reads the round.
 #
-# Rounds are cut at the commits that touch the ledger itself, walked first-parent
-# so one merged worktree round collapses to one boundary. The partition comes from
-# git alone: an author cannot widen, move, or nominate their own scope.
-round_heads = git_read.call("rev-list", "--first-parent", "--reverse", "#{base_ref}..HEAD", "--", LEDGER_PATH)
-                      .split("\n").map(&:strip).reject(&:empty?)
-# Each round spans (previous ledger boundary, this one] so the work commits that
+# Rounds are cut at the commits that touch the ledger itself, walked along a
+# first-parent line. The partition comes from git alone: an author cannot widen,
+# move, or nominate their own scope.
+#
+# THE SAME PARTITION BEFORE AND AFTER THE MERGE. A branch is judged on its own
+# first-parent line while it is a pull request (CI checks out the branch head),
+# and once merged that whole line sits behind ONE first-parent step of the
+# integration branch. Reading that step as one boundary gave the same history a
+# different partition after it landed — every round on the branch collapsed into
+# one, and a row whose validity depends on its round being narrow (a routing-
+# surface `#description` anchor in a commit that changed nothing else) turned red
+# without a byte of it changing. That is the "verdict moved after it landed"
+# defect in a new coat, and it surfaced on every post-merge evaluation: the push
+# build of the integration branch and the promotion pull request. So a merge that
+# git itself reproduces from its two parents is EXPANDED in place: its second
+# parent's line, from the fork point to the merged head, is walked with the same
+# rule, recursively, and contributes exactly the rounds it had as a branch.
+#
+# A merge is expanded only when git can rebuild it — two parents, a tree equal to
+# `git merge-tree --write-tree` of those parents, and a second parent that is
+# neither already on the base nor already on the line being walked (a sync merge
+# brings nothing that needs a round). Anything else — a hand-resolved merge, a
+# conflicted one, an octopus — keeps today's single boundary at the merge, so
+# content git did not derive from the parents is never left in no round.
+ROUND_WALK_MAX_DEPTH = 8
+ancestor_of = lambda do |commit, tip|
+  IO.popen(["git", "-C", root, "merge-base", "--is-ancestor", commit, tip], err: File::NULL, &:read)
+  status = $?.exitstatus
+  next true if status == 0
+  next false if status == 1
+  warn "impact_chain_git_failed: git merge-base --is-ancestor #{commit} #{tip} exited #{status}"
+  exit 1
+end
+# The tree git produces merging `second` into `first`; nil when that merge
+# conflicts (whoever resolved it was not git). Needs git 2.38+, the same floor
+# the review-ledger binder already requires for the identical invariant.
+automatic_merge_tree = lambda do |first, second|
+  out = IO.popen(["git", "-C", root, "merge-tree", "--write-tree", first, second], err: File::NULL, &:read)
+  status = $?.exitstatus
+  next out.to_s.lines.first.to_s.strip if status == 0
+  next nil if status == 1
+  warn "impact_chain_git_failed: git merge-tree --write-tree #{first} #{second} exited #{status} (git 2.38 or newer is required)"
+  exit 1
+end
+# [first parent, second parent, fork point] when `commit` is a merge git can
+# rebuild from its parents and whose second parent carries a line of its own;
+# nil when the merge keeps today's single-boundary treatment. `line_base` is the
+# base of the line being walked: a merge whose second parent is already below
+# that base is a sync of what the line was cut from (the target advancing under
+# a branch), and is a sync on the branch's own line exactly as it is on the
+# integration line — judging it against the outer base alone would expand it
+# during promotion and strand the branch's earlier work in a rowless span.
+expandable_merge = lambda do |commit, line_base|
+  parents = git_read.call("rev-list", "--parents", "-n", "1", commit).split[1..] || []
+  next nil unless parents.length == 2
+  first, second = parents
+  next nil if ancestor_of.call(second, base_ref) || ancestor_of.call(second, line_base) || ancestor_of.call(second, first)
+  own_tree = git_read.call("rev-parse", "#{commit}^{tree}").strip
+  next nil unless automatic_merge_tree.call(first, second) == own_tree
+  # The fork point read FAILS CLOSED like every other git read here: a lookup
+  # that errored would otherwise read as "no fork point", skip the expansion,
+  # and hand the merge the collapsed span — the lenient verdict — on a git
+  # failure nobody sees. Exit 1 is git's own "no common ancestor" and means
+  # there is genuinely no line to expand from.
+  fork_out = IO.popen(["git", "-C", root, "merge-base", first, second], err: File::NULL, &:read)
+  fork_status = $?.exitstatus
+  next nil if fork_status == 1
+  unless fork_status == 0
+    warn "impact_chain_git_failed: git merge-base #{first} #{second} exited #{fork_status}"
+    exit 1
+  end
+  fork = fork_out.to_s.split("\n").first.to_s.strip
+  next nil if fork.empty?
+  [first, second, fork]
+end
+# Each round spans (previous boundary, this one] so the work commits that
 # precede a ledger append are inside the round they belong to — landing the change
 # and appending the row in separate commits is the normal shape, not an evasion.
-round_bounds = ([base_ref] + round_heads).each_cons(2).to_a
-# The trailing span — owner changes committed after the last ledger append — is a
+# The trailing span — owner changes committed after the last boundary — is a
 # round too. It holds no rows, so its owners fall through to the presence check
-# and the gate still fails closed on undeclared work.
-round_bounds << [round_heads.last || base_ref, "HEAD"]
+# and the gate still fails closed on undeclared work. Both hold on every line the
+# walk visits, the integration branch and each expanded merge alike.
+round_bounds_for = lambda do |from, to, depth|
+  if depth > ROUND_WALK_MAX_DEPTH
+    warn "impact_chain_round_walk_too_deep: merges nested more than #{ROUND_WALK_MAX_DEPTH} levels between #{from} and #{to}"
+    exit 1
+  end
+  list = lambda do |*options, pathspec|
+    git_read.call("rev-list", "--first-parent", "--reverse", *options, "#{from}..#{to}", *pathspec)
+            .split("\n").map(&:strip).reject(&:empty?)
+  end
+  line = list.call([])
+  ledger_heads = list.call(["--", LEDGER_PATH])
+  merges = list.call("--merges", [])
+  spans = []
+  prev = from
+  line.each do |commit|
+    expansion = merges.include?(commit) ? expandable_merge.call(commit, from) : nil
+    if expansion
+      first, second, fork = expansion
+      spans << [prev, first] unless prev == first
+      spans.concat(round_bounds_for.call(fork, second, depth + 1))
+      prev = commit
+    elsif ledger_heads.include?(commit)
+      spans << [prev, commit]
+      prev = commit
+    end
+  end
+  spans << [prev, to]
+  spans
+end
+round_bounds = round_bounds_for.call(base_ref, "HEAD", 0)
+# Diagnostic only: print the partition so a verdict can be read against the
+# rounds it was judged in. Off by default so no suite's output assertions move.
+if ENV["CCL_IMPACT_CHAIN_TRACE_ROUNDS"] == "1"
+  round_bounds.each { |span_base, span_head| warn "impact_chain_round: #{span_base[0, 12]}..#{span_head[0, 12]}" }
+end
 # Everything a predicate needs to judge one span. Built lazily per span and
 # memoized: a round whose rows are all RED-baseline never pays for the rename
 # derivation.
@@ -1037,9 +1141,80 @@ if upstream.any? || routing_entrypoint_changed || changed_paths.include?(LEDGER_
         blob[:content].scan(Regexp.new(Regexp.escape(anchor))).length == 1
     end
   end
+  # Definition/decision tables are firing surfaces too. Recognize explicit
+  # Markdown tables with a header and delimiter; comments and code examples do
+  # not count. This proves location/shape, not the truth of the definition.
+  table_data_anchor_valid = lambda do |scope, parts|
+    prior = blob_at.call(scope.base, parts[:path])
+    next false if prior && prior[:content].include?(parts[:anchor])
+    previous_cells = nil
+    columns = nil
+    fence = nil
+    comment = false
+    raw_html = nil
+    html_block = false
+    head_blob.call(scope, parts[:path])[:content].each_line do |raw_line|
+      line = raw_line.chomp
+      if fence
+        fence = nil if line.match?(/\A {0,3}#{Regexp.escape(fence[0])}{#{fence.length},}\s*\z/)
+        next
+      end
+      if raw_html
+        raw_html = nil if line.match?(raw_html)
+        next
+      end
+      if html_block
+        html_block = false if line.strip.empty?
+        next
+      end
+      hidden = comment || line.include?("<!--") || line.include?("-->")
+      line.scan(/<!--|-->/).each { |marker| comment = marker == "<!--" }
+      if hidden
+        previous_cells = columns = nil
+        next
+      end
+      if (opening = line.match(/\A {0,3}(`{3,}|~{3,})/))
+        fence = opening[1]
+        previous_cells = columns = nil
+        next
+      end
+      terminator = case line
+                   when /\A {0,3}<\?/ then /\?>/
+                   when /\A {0,3}<!\[CDATA\[/ then /\]\]>/
+                   when /\A {0,3}<![A-Z]/ then />/
+                   end
+      if terminator
+        raw_html = terminator unless line.match?(terminator)
+        previous_cells = columns = nil
+        next
+      end
+      if line.match?(%r{\A {0,3}</?[A-Za-z][\w-]*(?:\s|>|/|\z)})
+        tag = line[/\A {0,3}<(script|pre|style|textarea)(?:\s|>|\z)/i, 1]
+        raw_html = %r{</#{tag}\s*>}i if tag && !line.match?(%r{</#{tag}\s*>}i)
+        html_block = !tag
+        previous_cells = columns = nil
+        next
+      end
+      unless line.match?(/\A {0,3}\|.*\|\s*\z/)
+        previous_cells = columns = nil
+        next
+      end
+      cells = line.strip[1...-1].split(/(?<!\\)\|/, -1).map(&:strip)
+      delimiter = cells.length >= 2 && cells.all? { |cell| cell.match?(/\A:?-{3,}:?\z/) }
+      if delimiter
+        columns = previous_cells && previous_cells.length == cells.length ? cells.length : nil
+      elsif columns && columns == cells.length
+        break true if cells.any? { |cell| cell.include?(parts[:anchor]) }
+      else
+        columns = nil
+      end
+      previous_cells = cells
+    end == true
+  end
   enforcing_file_locator_valid = lambda do |scope, parts|
     next false unless parts && parts[:kind] == "file"
     next false unless parts[:path].end_with?(".md")
+    next false if parts[:path] == LEDGER_PATH # Evidence cannot certify itself.
     next false unless locator_valid.call(scope, "file:#{parts[:path]}##{parts[:anchor]}")
     line = added_lines_for.call(scope, parts[:path]).find { |added| added.include?(parts[:anchor]) }
     next false unless line
@@ -1057,7 +1232,7 @@ if upstream.any? || routing_entrypoint_changed || changed_paths.include?(LEDGER_
     # "the adapter does not support"), and single characters with broad
     # compounds (应/只/别 — 应用/只是/区别).
     normative = line.match?(/(?:\b(?:must|shall|never|do\s+not|don'?t|required?|requires?|block(?:s|ed)?|reject(?:s|ed)?|deny|denied|invalidates?|forbid(?:s|den)?|cannot|enforcement)\b|必须|不得|禁止|拒绝|作废|仅限|只能|应当|应该|务必|不能|不允许|不可)/i)
-    list_rule && normative
+    (list_rule && normative) || table_data_anchor_valid.call(scope, parts)
   end
   # A routing-surface-only owner has no changed rule line to anchor on: its whole
   # change is one YAML scalar. The answer is NOT to exempt it — a description edit
@@ -1256,7 +1431,7 @@ if upstream.any? || routing_entrypoint_changed || changed_paths.include?(LEDGER_
       firing_parts = locator_parts.call(firing_path)
       firing_path_valid = firing_locator_valid.call(row_scope, firing_parts, owner)
       # The machine-checked core is the FIRING PATH (an owner-scoped anchor on a
-      # changed normative rule, or a changed owner executable) plus the
+      # changed normative rule/table data, or a changed owner executable) plus the
       # deterministic wording-only classification. The behavioral-evidence
       # status and observed-failure fields are required author declarations —
       # honest labels, not digest-verified artifacts: a digest-bound evidence

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/review_ledger_binding.py

@@ -89,8 +89,13 @@ its own branch and a later round could restore the real one, so judging history
 with history's tools would let that round's forged ledger stand forever. Using
 the landing tree's tools means a controller or validator change between a round
 and the promotion can stop an old round reproducing, and that reads as a refusal
-rather than a pass. A round is never itself a chain, so the walk is one level
-deep by construction. The detached checkout is released with `git worktree
+rather than a pass. A round's evidence is likewise read from the landing tree,
+not from the round's own checkout: a ledger is evidence because the validator
+accepts it and its candidate hash equals the round's packet, not because of
+where it was committed, so a round that merged without its ledger is bound by a
+later review of the same bytes committed on the integration branch -- and by
+nothing less, since a ledger for any other bytes does not match. A round is
+never itself a chain, so the walk is one level deep by construction. The detached checkout is released with `git worktree
 remove` and its removal verified against the worktree list; a checkout that
 cannot be released is an error, never a pass, and nothing prunes registrations
 this run did not create. The chain is
@@ -581,7 +586,7 @@ def render_manifest(
 
 def accepted_ledger_for(
     evidence: list[tuple[Path, dict]],
-    repo_root: Path,
+    evidence_home: Path,
     validator: Path,
     digest: str,
     rejected: list[str],
@@ -590,14 +595,15 @@ def accepted_ledger_for(
 
     The same criterion the single-candidate path uses: a receipt-shaped file is
     not evidence, only a ledger the validator accepts, because this gate cannot
-    authenticate that a controller minted what it reads.
+    authenticate that a controller minted what it reads. `evidence_home` is the
+    tree the evidence was enumerated from, used only to name the ledger.
     """
     for path, payload in evidence:
         if payload.get("candidate_sha256") != digest:
             continue
         if "closeout_state" not in payload or "controller_receipts" not in payload:
             continue
-        relative = str(path.relative_to(repo_root))
+        relative = str(path.relative_to(evidence_home))
         accepted, output = validator_accepts(validator, path)
         if accepted:
             return f"{relative} -- {output}"
@@ -613,6 +619,7 @@ def bind_manifest(
     excludes: tuple[str, ...],
     changed_all: list[str],
     evidence: list[tuple[Path, dict]],
+    evidence_home: Path,
     validator: Path,
     rejected_ledgers: list[str],
 ) -> list[str]:
@@ -630,7 +637,7 @@ def bind_manifest(
             raise ManifestError(
                 f"{label} recorded {recorded[:12]}... but does not reproduce: the candidate now hashes to {actual[:12]}..."
             )
-        proof = accepted_ledger_for(evidence, repo_root, validator, actual, rejected_ledgers)
+        proof = accepted_ledger_for(evidence, evidence_home, validator, actual, rejected_ledgers)
         if proof is None:
             raise ManifestError(f"no accepted ledger binds {label} {actual}")
         proofs.append(f"  {label} {actual[:12]}... <- {proof}")
@@ -889,8 +896,9 @@ def bind_chain(
     Returns (round count, proof lines) or raises ChainError naming the first
     step that does not add up. Each round is rebound by this same gate in a
     detached checkout of its head against its first parent, with THIS tree's
-    controller and validator (never the round's own), and never as a chain of
-    its own.
+    controller, validator and committed evidence (never the round's own tools;
+    the round's own evidence is part of this tree's history and is found there),
+    and never as a chain of its own.
     """
     steps = walk_first_parent_chain(repo_root, base_tip)
     proofs: list[str] = []
@@ -902,7 +910,13 @@ def bind_chain(
             continue
         with detached_checkout(repo_root, second) as round_root:
             binding = bind_candidate(
-                round_root, first, DEFAULT_PATHS, evidence_root, allow_chain=False, tools_root=repo_root
+                round_root,
+                first,
+                DEFAULT_PATHS,
+                evidence_root,
+                allow_chain=False,
+                tools_root=repo_root,
+                evidence_tree=repo_root,
             )
         subject = git_read(repo_root, ["log", "-1", "--format=%s", merge], f"cannot read {merge[:12]}")
         if not binding.ok:
@@ -955,15 +969,24 @@ def bind_candidate(
     evidence_root: str,
     allow_chain: bool,
     tools_root: Path | None = None,
+    evidence_tree: Path | None = None,
 ) -> Binding:
     """Evaluate one checkout against one base: single ledger, then manifest, then chain.
 
     `tools_root` names the tree whose controller and validator judge the
     candidate; it defaults to the checkout itself and is the landing tree when a
     historical round is rebound, so a round never judges itself with its own tools.
+    `evidence_tree` names the tree whose committed evidence is consulted; it too
+    defaults to the checkout and is the landing tree when a historical round is
+    rebound. Evidence is a validator-accepted closeout bound to the round's own
+    candidate hash wherever it was committed: a round that merged without its
+    ledger is bound by a later review of the same bytes, committed on the
+    integration branch, and by nothing less -- the candidate hash and the
+    validator, not the file's location, are what make a ledger evidence.
     """
     binding = Binding()
     tools = tools_root if tools_root is not None else repo_root
+    evidence_home = evidence_tree if evidence_tree is not None else repo_root
     fork, excludes, paths, changed = candidate_scope(repo_root, base_tip, user_paths)
     binding.fork = fork
     binding.changed = changed
@@ -987,14 +1010,14 @@ def bind_candidate(
         whole_error = str(exc)
 
     validator = tools / "skills" / "skill-extraction-workflow" / "scripts" / VALIDATOR
-    evidence = scan(repo_root, evidence_root)
+    evidence = scan(evidence_home, evidence_root)
     ledgers: list[str] = []
     if expected is not None:
         # Only a validator-accepted ledger counts. A receipt-shaped file proves
         # nothing on its own: this gate cannot authenticate that a controller
         # minted it, so any branch keyed on a self-declared field is a bypass a
         # contributor can hand-write.
-        proof = accepted_ledger_for(evidence, repo_root, validator, expected, ledgers)
+        proof = accepted_ledger_for(evidence, evidence_home, validator, expected, ledgers)
         if proof is not None:
             binding.ok = True
             binding.summary = (
@@ -1007,10 +1030,10 @@ def bind_candidate(
     for path, payload in evidence:
         if payload.get("kind") != MANIFEST_KIND:
             continue
-        relative = str(path.relative_to(repo_root))
+        relative = str(path.relative_to(evidence_home))
         try:
             proofs = bind_manifest(
-                module, repo_root, fork, payload, excludes, changed, evidence, validator, ledgers
+                module, repo_root, fork, payload, excludes, changed, evidence, evidence_home, validator, ledgers
             )
         except ManifestError as exc:
             manifests.append(f"{relative}: {exc}")

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/skill-behavior-eval.py

@@ -52,7 +52,7 @@ Usage:
 Run in a SCRATCH checkout: the current arm executes the installed hooks/plugins (not just the
 read-only model tools), so treat it as potentially side-effecting, not inert.
 """
-import argparse, hashlib, json, os, re, subprocess, sys, threading, time
+import argparse, hashlib, json, os, re, signal, subprocess, sys, time
 
 HERE = os.path.dirname(os.path.abspath(__file__))
 DEFAULT_FIXTURES = os.path.normpath(os.path.join(HERE, "..", "..", "..", "eval", "behavior-fixtures.jsonl"))
@@ -100,23 +100,62 @@ def _headless_claude(cmd, prompt, timeout_s):
         # stderr → DEVNULL: we never read it, and a full stderr pipe would deadlock the child
         # on a verbose run and time out an otherwise-valid answer.
         p = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
-                             stderr=subprocess.DEVNULL, text=True)
+                             stderr=subprocess.DEVNULL, text=True,
+                             start_new_session=(os.name == "posix"))
     except FileNotFoundError:
         return None, "claude_not_found", None, []
-    out = {"s": ""}
-    t = threading.Thread(target=lambda: out.__setitem__("s", p.stdout.read()))
-    t.start()
     try:
-        p.stdin.write(prompt); p.stdin.close()
-    except (BrokenPipeError, OSError):
-        pass
-    t.join(timeout_s)
-    if t.is_alive():
-        p.kill(); t.join(2)
-        return None, f"timeout_{timeout_s}s", None, []
-    rc = p.wait()
+        # One deadline covers stdin backpressure, stdout collection and process
+        # completion. A reader-only timer leaves writes and p.wait() unbounded.
+        out, _ = p.communicate(input=prompt, timeout=timeout_s)
+    except BaseException as stopped:
+        # The group can outlive its leader while a descendant holds stdout open.
+        # Kill the recorded group even when the direct child has already exited.
+        cleanup_errors = []
+        try:
+            if os.name == "posix":
+                os.killpg(p.pid, signal.SIGKILL)
+            else:
+                cleanup_errors.append("descendant_cleanup_unsupported")
+                p.kill()
+        except ProcessLookupError:
+            pass
+        except PermissionError:
+            target = "group" if os.name == "posix" else "process"
+            cleanup_errors.append(f"{target}_kill_permission_denied")
+        try:
+            p.communicate(timeout=1)
+        except (subprocess.TimeoutExpired, OSError) as cleanup_error:
+            # An escaped descendant may still own a pipe; do not wait for EOF.
+            cleanup_errors.append("stdio_timeout" if isinstance(cleanup_error, subprocess.TimeoutExpired) else "stdio_error")
+            try:
+                p.kill()
+            except ProcessLookupError:
+                pass
+            except PermissionError:
+                cleanup_errors.append("process_kill_permission_denied")
+            try:
+                p.wait(timeout=1)
+            except (subprocess.TimeoutExpired, OSError) as cleanup_error:
+                cleanup_errors.append("wait_timeout" if isinstance(cleanup_error, subprocess.TimeoutExpired) else "wait_error")
+        # A denied kill or incomplete drain/reap is not evidence of cleanup.
+        # Return it so callers can save partial results and stop new processes.
+        interrupted = not isinstance(stopped, subprocess.TimeoutExpired)
+        error = "interrupted" if interrupted else f"timeout_{timeout_s}s"
+        if cleanup_errors:
+            error += ";cleanup_unconfirmed:" + ",".join(cleanup_errors)
+        if interrupted:
+            if cleanup_errors:
+                print(f"{error}; confirm process termination before resuming", file=sys.stderr)
+            raise
+        return None, error, None, []
+    finally:
+        p.stdin.close()
+        p.stdout.close()
+    rc = p.returncode
     parts, result_text, result_subtype, util, invoked = [], None, None, None, []
-    for ln in out["s"].splitlines():
+    terminal_results = []
+    for ln in out.splitlines():
         # The stream is external/untrusted: a line may be invalid JSON, deeply nested (RecursionError),
         # or a shape-drifted value. Wrap the WHOLE per-line parse+extract so any bad line skips itself
         # and never crashes the eval run (fail-closed-skip). We read only known fields of known event
@@ -127,6 +166,7 @@ def _headless_claude(cmd, prompt, timeout_s):
             if not isinstance(ev, dict):
                 continue
             if ev.get("type") == "result":
+                terminal_results.append(ev)
                 result_subtype = ev.get("subtype")
                 if result_subtype == "success":
                     result_text = ev.get("result")
@@ -159,8 +199,19 @@ def _headless_claude(cmd, prompt, timeout_s):
     # teardown failure — the answer is complete, accept. Without that event we do NOT bank the
     # text, even if some assistant chunks streamed and rc==0: a truncation or format drift before
     # the terminal event would otherwise be recorded as a valid sample.
-    if result_subtype == "success":
-        return ("\n\n".join(parts) if parts else result_text), None, util, invoked
+    if len(terminal_results) > 1:
+        return None, "invalid_terminal_result", util, invoked
+    if result_subtype == "success" and terminal_results:
+        terminal = terminal_results[0]
+        if (terminal.get("is_error") not in (None, False)
+                or terminal.get("permission_denials")
+                or terminal.get("api_error_status") not in (None, 0, "0")
+                or terminal.get("terminal_reason") not in (None, "completed")):
+            return None, "invalid_terminal_result", util, invoked
+        text = "\n\n".join(parts) if parts else result_text
+        if not isinstance(text, str) or not text.strip():
+            return None, "invalid_terminal_result", util, invoked
+        return text, None, util, invoked
     if rc != 0:
         return None, f"claude_exit_{rc}", util, invoked
     if result_subtype:
@@ -312,8 +363,12 @@ def build_report(rows, out_dir, do_judge, timeout_s, last_util, stop_util,
     in the summary (never silently dropped, or the report reads clean when it isn't). Raw responses
     stay on disk for audit; judgment-ASSIST, never a score. do_judge=False → fill-in scaffold."""
     verdicts = []
+    cleanup_error = None
     for fx in rows:
         base = {"id": fx["id"], "axis": fx.get("axis", "")}
+        if cleanup_error:
+            verdicts.append({**base, "status": "judge-skipped", "note": cleanup_error})
+            continue
         cur = read_saved_response(os.path.join(out_dir, f"{fx['id']}.current.s1.txt"))
         cand = read_saved_response(os.path.join(out_dir, f"{fx['id']}.candidate.s1.txt"))
         if not cur or not cand:
@@ -342,6 +397,8 @@ def build_report(rows, out_dir, do_judge, timeout_s, last_util, stop_util,
             last_util = util
         if err:
             verdicts.append({**base, "status": f"judge-error:{err}"})
+            if ";cleanup_unconfirmed:" in err:
+                cleanup_error = err
             continue
         v.update(base); v["status"] = "judged"
         if fixture_needs_human(fx):
@@ -467,8 +524,10 @@ def main():
         if not a.no_judge:
             print(f"--report-only will make up to {len(rows)} LLM-judge claude call(s) "
                   f"(one per fixture with both arms saved). Use --no-judge for a fill-in scaffold.")
-        build_report(rows, a.out, not a.no_judge, a.timeout, None, a.stop_util, ctext, a.current_tag)
+        verdicts = build_report(rows, a.out, not a.no_judge, a.timeout, None, a.stop_util, ctext, a.current_tag)
         print(f"\nReport: {os.path.join(a.out, 'capability-delta-report.md')}")
+        if any(";cleanup_unconfirmed:" in v["status"] for v in verdicts):
+            sys.exit(1)
         return
     # Fail fast: don't burn every current-arm run and only then discover the candidate
     # arm has no contract to inject.
@@ -501,6 +560,12 @@ def main():
                           f"{a.stop_util:.0%} — stopping before [{fx['id']}/{arm}/s{s}]. "
                           f"Partial results in {a.out}; rerun to continue, then --report-only.")
                     logf.close(); return
+                # A failed replacement must not leave its old response usable.
+                # Invalidate only after quota allows this sample to start.
+                try:
+                    os.unlink(rpath)
+                except FileNotFoundError:
+                    pass
                 t0 = time.time()
                 text, err, util, invoked = run_agent(fx["prompt"], a.timeout, arm, a.contract)
                 dt = time.time() - t0
@@ -509,7 +574,13 @@ def main():
                 if err:
                     print(f"[{fx['id']}/{arm}/s{s}] ERROR {err} ({dt:.0f}s)")
                     logf.write(json.dumps({"id": fx["id"], "arm": arm, "sample": s, "error": err}) + "\n")
-                    logf.flush(); continue
+                    logf.flush()
+                    if ";cleanup_unconfirmed:" in err:
+                        print(f"*** ABORT: process cleanup is unconfirmed; no further samples or judges started. "
+                              f"Partial results in {a.out}. Confirm process termination before resuming.")
+                        logf.close()
+                        sys.exit(1)
+                    continue
                 with open(rpath, "w", encoding="utf-8") as rf:
                     rf.write(f"# sig: {sig}\n")
                     rf.write(f"# {fx['id']} / arm={arm} / sample={s} / {dt:.0f}s / util={last_util}\n")
@@ -528,13 +599,24 @@ def main():
     if "current" in arms and "candidate" in arms:
         print("Building capability-delta report (candidate vs current)"
               + ("" if a.no_judge else " via LLM-judge — this makes more claude calls") + " ...")
-        build_report(rows, a.out, not a.no_judge, a.timeout, last_util, a.stop_util,
-                     contract_text, a.current_tag)
+        verdicts = build_report(rows, a.out, not a.no_judge, a.timeout, last_util, a.stop_util,
+                                contract_text, a.current_tag)
         print(f"Report: {os.path.join(a.out, 'capability-delta-report.md')} "
               f"(confirm every 🔴 HUMAN row by eye; it is judgment-assist, not a score).")
+        if any(";cleanup_unconfirmed:" in v["status"] for v in verdicts):
+            sys.exit(1)
     else:
         print("Single arm — no delta to report. Run --both-arms for the capability-delta report.")
 
 
 if __name__ == "__main__":
-    main()
+    previous_sigterm = signal.getsignal(signal.SIGTERM)
+    if previous_sigterm == signal.SIG_DFL:
+        def terminate(signum, _frame):
+            raise SystemExit(128 + signum)
+        signal.signal(signal.SIGTERM, terminate)
+    try:
+        main()
+    finally:
+        if previous_sigterm == signal.SIG_DFL:
+            signal.signal(signal.SIGTERM, previous_sigterm)