@christang/keel 5.20.0 → 5.44.0

package/src/core/gates.js

@@ -13,8 +13,9 @@ const {
   isConcrete,
   isPassingReviewStatus,
   parseTasks,
+  unfilledToken,
 } = require("./task-contract");
-const { gitPaths, readManifest, startGuard } = require("./guard");
+const { contentSignature, gitPaths, readManifest, startGuard } = require("./guard");
 
 const GATE_STAGES = new Set(["task-start", "task-complete", "change-close"]);
 
@@ -243,7 +244,7 @@ function taskStart(repo, options) {
   const compiled = compileTaskContract(repo, selection.change, task);
   const problems = [
     ...compiled.diagnostics,
-    ...invalidationProblems(repo, selection.content, selection.tasks),
+    ...invalidationProblems(repo, selection.content, selection.tasks, selection.change),
   ];
   // Recording the current fingerprint is idempotent: --record replaces the
   // selected task's Contract anchor whatever it holds, so reauthorizing a task
@@ -349,11 +350,38 @@ function evidenceValue(task, label) {
   return match ? match[1] : "";
 }
 
+// A Review entry is the text the author wrote under its label, not its first
+// line. `parseTasks()` already gathers the whole Evidence body, so the
+// continuation lines arrive here; a line-anchored `(.*)` used to drop them
+// before any check saw them. That failed in both directions: a `Findings` whose
+// `Durable owner:` sat on the fourth line was refused with the owner present
+// and the path existing, and a `Findings` reading `none` above three lines of
+// real findings passed, because the check tested the word and never saw them
+// (issue #49).
+//
+// The entry ends at the next entry at the same or shallower indentation.
+// Without that bound `Findings` — always the last of the four — would run to
+// the end of Evidence and read `- Blocker:` as its own text, trading a
+// fail-closed defect for a fail-open one. A deeper-indented `- ` line is a
+// continuation, which is what makes a Findings written as a sub-list one entry.
+const REVIEW_SIBLING = /^(\s*)-\s*[^\s:][^:\n]*:/;
+
 function reviewValue(task, label) {
-  const match = field(task, "Evidence").match(
-    new RegExp(`^\\s*-\\s*${label}:\\s*(.*)$`, "im")
-  );
-  return match ? match[1].trim() : "";
+  const lines = field(task, "Evidence").split(/\r?\n/);
+  const opener = new RegExp(`^(\\s*)-\\s*${label}:\\s*(.*)$`, "i");
+  for (let index = 0; index < lines.length; index += 1) {
+    const match = lines[index].match(opener);
+    if (!match) continue;
+    const indent = match[1].length;
+    const value = [match[2]];
+    for (let cursor = index + 1; cursor < lines.length; cursor += 1) {
+      const sibling = lines[cursor].match(REVIEW_SIBLING);
+      if (sibling && sibling[1].length <= indent) break;
+      value.push(lines[cursor]);
+    }
+    return value.join("\n").trim();
+  }
+  return "";
 }
 
 // The durable-owner forms that are pure shape checks, shared by the Review
@@ -366,11 +394,21 @@ const TRACKER_REFERENCE = /\bhttps?:\/\/\S/i;
 
 // The owner forms, stated once so every refusal that lists them agrees with
 // every other and with what the checks below actually accept.
+//
+// What each form is worth is part of the sentence, because a list of accepted
+// spellings reads as a list of verified guarantees. A path is checked for
+// existence at the moment it is cited and never again; a tracker reference is
+// accepted on its shape, because a gate that fetched one would stop being
+// local and offline, which is the property its verdict rests on. Leaving that
+// unsaid is how an author comes to believe a check ran that did not (#100).
 const DURABLE_OWNER_FORMS =
   "an absolute `https://…` tracker reference, or any repo-relative path that "
-  + "exists — `keel/archive/…`, an `openspec/changes/…` artifact, or the "
-  + "repository's own ledger; `keel/HANDOFF.md` is a pointer override rather "
-  + "than an owner";
+  + "exists and outlives this change — an archived `openspec/changes/archive/…` "
+  + "artifact, `keel/archive/…`, or the repository's own ledger; "
+  + "`keel/HANDOFF.md` is a pointer override rather than an owner. A path is "
+  + "checked for existence when it is cited and is not re-checked afterwards, "
+  + "and a tracker reference is accepted on its shape because a gate runs "
+  + "offline and never fetches one";
 
 // Trailing punctuation a declared path can abut in prose. ASCII sentence marks
 // and their CJK counterparts both belong here: once the extractor stops
@@ -401,20 +439,55 @@ function declaredPath(value) {
   return bare[0].replace(DECLARED_PATH_TRAILING, "") || null;
 }
 
+// A path inside the selected change's own directory exists now and cannot
+// exist later: archiving moves `openspec/changes/<name>/` under
+// `openspec/changes/archive/`, so the one guarantee the gate offers expires in
+// the next step of the workflow that accepted it. Measured in this repository,
+// 10 declarations name such a path and all 10 are dead; the field report
+// measured 35 of 36 (issue #100). Existence is necessary and not sufficient —
+// the same line `keel/HANDOFF.md` already sits on.
+//
+// The rule is the directory, not the file: every file under it moves together,
+// and naming `design.md` would refuse one spelling of one instance. And it is
+// *this* change's directory, not change directories in general — the protocol
+// names a new OpenSpec change as a legitimate owner of deferred work, and no
+// measured pointer has that shape.
+function insideOwnChangeDirectory(candidate, change) {
+  if (!change || !candidate) return false;
+  const prefix = `openspec/changes/${change}/`;
+  return String(candidate).replace(/^\.\//, "").startsWith(prefix);
+}
+
 // Classify a declared `Durable owner:` value. A gate runs without network, so a
 // URL is accepted on shape alone; a path is the one form it can actually check,
-// and checking it is stricter than the prefix whitelist this replaced.
-function durableOwnerVerdict(repo, value) {
+// and checking it is stricter than the prefix whitelist this replaced — for as
+// long as the path outlives the change, which `insideOwnChangeDirectory` is
+// there to decide.
+function durableOwnerVerdict(repo, value, change) {
   const owner = String(value || "").trim();
   if (!owner) return { ok: false, reason: "unrecognized" };
   if (/keel\/HANDOFF\.md/i.test(owner)) return { ok: false, reason: "handoff" };
   if (TRACKER_REFERENCE.test(owner)) return { ok: true };
   const candidate = declaredPath(owner);
   if (!candidate) return { ok: false, reason: "unrecognized" };
+  if (insideOwnChangeDirectory(candidate, change)) {
+    return { ok: false, reason: "transient", path: candidate };
+  }
   if (fs.existsSync(path.join(repo, candidate))) return { ok: true };
   return { ok: false, reason: "missing", path: candidate };
 }
 
+// The one sentence every transient refusal makes, so the three consumers say
+// it the same way. It names the cause (the directory moves) rather than the
+// symptom, because the author cannot repair a spelling problem they do not
+// have.
+function transientOwnerMessage(candidate) {
+  return `\`${candidate}\` is inside this change's own directory, which moves `
+    + "to `openspec/changes/archive/` when the change is archived — the file "
+    + "exists now and the pointer is guaranteed to break. Name something that "
+    + `outlives the change: ${DURABLE_OWNER_FORMS}.`;
+}
+
 // A finding has three dispositions and the gate recognized two. One found and
 // fixed inside the task recording it has no owner to name and nothing to
 // discard, so the only text that passed was `Discard reason:` — filing a repair
@@ -424,13 +497,15 @@ function durableOwnerVerdict(repo, value) {
 // same third slot since it shipped, where `Updated by:` names tasks of this
 // change.
 // The capture is the single token after the marker, not the rest of the line.
-// Findings is one line of free prose that normally holds several findings with
-// different dispositions, so a capture reaching to the newline swallows every
-// marker after it — a block recording one fix and one tracker-owned follow-up
-// was refused because the *follow-up's* URL was read as the *fix's* evidence.
-// Measured on this change's own task 1.3. The match is global because each
-// resolved claim owes its own evidence; checking only the first would let a
-// second one assert itself for free.
+// Findings is free prose that normally holds several findings with different
+// dispositions, so a capture reaching to the newline swallows every marker
+// after it — a block recording one fix and one tracker-owned follow-up was
+// refused because the *follow-up's* URL was read as the *fix's* evidence.
+// Measured on this change's own task 1.3. That block used to be one line and
+// may now wrap across several, which widens what a greedy capture would
+// swallow and changes nothing about why this one is narrow. The match is
+// global because each resolved claim owes its own evidence; checking only the
+// first would let a second one assert itself for free.
 const RESOLVED_HERE = /\bresolved here\s*:[ \t]*(\S*)/gi;
 
 // Resolution evidence is deliberately narrower than a durable owner. An
@@ -439,7 +514,7 @@ const RESOLVED_HERE = /\bresolved here\s*:[ \t]*(\S*)/gi;
 // it or the artifact that shows it. A bare marker is refused because a
 // disposition that asserts its own conclusion would be a way out of the other
 // two, and the third state would decay into the easiest exit.
-function resolutionEvidenceVerdict(repo, value, commands) {
+function resolutionEvidenceVerdict(repo, value, commands, change) {
   const evidence = String(value || "").trim();
   if (!evidence) return { ok: false, reason: "empty" };
   // The tracker form is tested before the path form: a URL contains something
@@ -454,6 +529,12 @@ function resolutionEvidenceVerdict(repo, value, commands) {
   }
   const candidate = declaredPath(evidence);
   if (!candidate) return { ok: false, reason: "unrecognized" };
+  // Resolution evidence is a file like any other and moves with the directory
+  // holding it, so it earns the same verdict rather than a second answer to
+  // the same question.
+  if (insideOwnChangeDirectory(candidate, change)) {
+    return { ok: false, reason: "transient", path: candidate };
+  }
   if (fs.existsSync(path.join(repo, candidate))) return { ok: true };
   return { ok: false, reason: "missing", path: candidate };
 }
@@ -474,13 +555,16 @@ function resolutionEvidenceMessage(verdict) {
   if (verdict.reason === "unknown-check") {
     return `${lead}${verdict.label} is not a check this task declares.${tail}`;
   }
+  if (verdict.reason === "transient") {
+    return `${lead}${transientOwnerMessage(verdict.path)}${tail}`;
+  }
   if (verdict.reason === "missing") {
     return `${lead}\`${verdict.path}\` does not exist.${tail}`;
   }
   return `${lead}it names neither a check nor a path.${tail}`;
 }
 
-function findingOwnerIsDurable(repo, findings) {
+function findingOwnerIsDurable(repo, findings, change) {
   if (/keel\/HANDOFF\.md/i.test(findings)) return false;
   if (/\b(?:explicit\s+)?discard (?:reason|rationale)\s*:/i.test(findings)) {
     return true;
@@ -490,11 +574,17 @@ function findingOwnerIsDurable(repo, findings) {
   // prose, and a finding that merely mentions the source file it concerns has
   // not thereby given that finding an owner.
   const declared = findings.match(/Durable owner:\s*(\S[^\n]*)/i);
-  if (declared) return durableOwnerVerdict(repo, declared[1]).ok;
+  if (declared) return durableOwnerVerdict(repo, declared[1], change).ok;
   const artifact = findings.match(
     /\b(openspec\/changes\/[A-Za-z0-9][A-Za-z0-9._-]*\/(?:proposal|design|tasks)\.md)(?:#\d+(?:\.\d+)*)?/i
   );
-  if (artifact && fs.existsSync(path.join(repo, artifact[1]))) return true;
+  if (
+    artifact
+    && !insideOwnChangeDirectory(artifact[1], change)
+    && fs.existsSync(path.join(repo, artifact[1]))
+  ) {
+    return true;
+  }
   // Same extractor, scoped to the archive prefix: the segment after
   // `keel/archive/` is a path like any other and was equally ASCII-bound.
   const archive = findings.match(/keel\/archive\/[^\s`]*/i);
@@ -520,6 +610,9 @@ function findingOwnerIsDurable(repo, findings) {
 // what a manifest written before this field, a cleared guard, or a
 // `--no-guard` start all produce. Reading null as empty would attribute the
 // whole worktree to the task and fail every completion in a dirty repository.
+// Each entry is `{ path, sha256 }`, the content signature `contentSignature`
+// read at that same moment — the record of *what* was dirty, not only that a
+// path was.
 function recordedBaseline(repo, change, task) {
   const loaded = readManifest(repo);
   if (loaded.state !== "ok") return null;
@@ -608,20 +701,27 @@ function scopeEvidence(
   }
 
   if (!base) {
-    // Dirty now and not dirty when the task started. This answers "did this
-    // task write it", which is the question the boundary actually asks; it
-    // does not answer "which task wrote it", which is why the completed-
-    // sibling exclusion below still applies and still reports itself.
+    // Dirty now and not dirty when the task started, or dirty now with
+    // content that no longer matches what was there at task start. Either
+    // answers "did this task write it", which is the question the boundary
+    // actually asks; it does not answer "which task wrote it", which is why
+    // the completed-sibling exclusion below still applies and still reports
+    // itself.
     //
-    // A path already dirty at task start is subtracted even if the task also
-    // modified it. That is the price of a baseline that is not a commit, and
-    // it buys the far larger class this exists to avoid: failing every
-    // completion in a worktree that was dirty before the task began.
-    const startedDirty = new Set(baseline);
+    // A path already dirty at task start is exempt only while its content
+    // stays the one recorded then — recording a hash instead of only a name
+    // is what lets that hold without falling back to subtracting the whole
+    // path, which exempted every later write to it, not just the one that
+    // predated the task (#72).
+    const unchangedSinceStart = new Set(
+      baseline
+        .filter((entry) => contentSignature(repo, entry.path) === entry.sha256)
+        .map((entry) => entry.path)
+    );
     return attributeChanged(
       repo,
       task,
-      dirtyPaths.filter((item) => !startedDirty.has(item)),
+      dirtyPaths.filter((item) => !unchangedSinceStart.has(item)),
       contract,
       change,
       tasks
@@ -701,7 +801,7 @@ function attributeChanged(repo, task, changedList, contract, change, tasks) {
   };
 }
 
-function completionChecks(repo, task, contract = null) {
+function completionChecks(repo, task, contract = null, changeVerify = null, change = null) {
   const problems = [];
   const commands = contract
     ? contract.capsule.verification.commands.map((item) => item.label)
@@ -750,11 +850,65 @@ function completionChecks(repo, task, contract = null) {
       }
     }
   }
+  // A `(regression)` check's bare Evidence may defer to a change-level `C<n>`
+  // check instead of recording its own result (issue #95). The regression
+  // flag comes from the compiled contract, the same source the exemption
+  // above already trusts, so this cannot disagree with what `(regression)`
+  // itself decided. Resolution only — whether the reference is declared, not
+  // whether it has run yet — because at task-complete time it legitimately
+  // may not have; `changeVerifyProblems` requires it answered by close.
+  if (contract) {
+    const declaredLabels = new Set(
+      (changeVerify ? changeVerify.checks : []).map((entry) => entry.label)
+    );
+    for (const entry of contract.capsule.verification.commands) {
+      const deferred = deferredChangeCheck(evidenceValue(task, entry.label));
+      if (!deferred) continue;
+      if (!entry.regression) {
+        problems.push(
+          problem(
+            "deferred-evidence-not-regression",
+            `${entry.label} Evidence defers to ${deferred}, but ${entry.label} `
+              + "is not tagged `(regression)`; only a `(regression)`-tagged "
+              + "check may defer to a change-level check."
+          )
+        );
+        continue;
+      }
+      if (!declaredLabels.has(deferred)) {
+        problems.push(
+          problem(
+            "deferred-check-unresolved",
+            `${entry.label} defers to ${deferred}, but tasks.md's \`## `
+              + `Change Verify\` does not declare it. Declare it there, or `
+              + `record concrete Evidence for ${entry.label} directly.`
+          )
+        );
+      }
+    }
+  }
   const blocker = evidenceValue(task, "Blocker");
   if (isConcrete(blocker)) {
     problems.push(problem("blocker", `Task records a blocker: ${blocker}`));
   }
 
+  // Reauthorizations (#70) is a log, not a stop condition: absent, `none`, and
+  // concrete text all pass. Only an abandoned `<slot>` token — real content
+  // the author started and never finished — is refused, the same distinction
+  // `unfilledToken()` already draws for every other field that uses it.
+  const reauthorizationsToken = unfilledToken(reviewValue(task, "Reauthorizations"));
+  if (reauthorizationsToken) {
+    problems.push(
+      problem(
+        "reauthorizations-shape",
+        `Reauthorizations carries the unfilled slot \`${reauthorizationsToken}\`, `
+          + "so it is not concrete. Replace that slot with the value it stands "
+          + "for, or fence it in inline code when it is literal text rather "
+          + "than a slot left to fill."
+      )
+    );
+  }
+
   const reviewFields = {
     Status: reviewValue(task, "Status"),
     "Acceptance check": reviewValue(task, "Acceptance check"),
@@ -806,25 +960,25 @@ function completionChecks(repo, task, contract = null) {
     const resolved = [...reviewFields.Findings.matchAll(RESOLVED_HERE)];
     if (resolved.length > 0) {
       for (const claim of resolved) {
-        const verdict = resolutionEvidenceVerdict(repo, claim[1], commands);
+        const verdict = resolutionEvidenceVerdict(repo, claim[1], commands, change);
         if (verdict.ok) continue;
         problems.push(
           problem("finding-resolution-evidence", resolutionEvidenceMessage(verdict))
         );
         break;
       }
-    } else if (!findingOwnerIsDurable(repo, reviewFields.Findings)) {
+    } else if (!findingOwnerIsDurable(repo, reviewFields.Findings, change)) {
       problems.push(
         problem(
           "finding-owner",
-          "Review Findings must be `none` or carry a disposition. A finding "
-            + "fixed in this task is `Resolved here:` naming an `M<n>` check "
-            + "this task declares or a repo-relative path that exists; one "
-            + "someone must still do is `Durable owner:` naming "
+          "Review Findings must be `none` or carry a disposition — name a "
+            + "path after `Durable owner:` so it reads as the owner rather "
+            + "than a file the finding mentions. A finding fixed in this "
+            + "task is `Resolved here:` naming an `M<n>` check this task "
+            + "declares or a repo-relative path that exists; one someone "
+            + "must still do is `Durable owner:` naming "
             + `${DURABLE_OWNER_FORMS}; one deliberately not being done is a `
-            + "`Discard reason:`/`Discard rationale:` prefix. Name a path after "
-            + "`Durable owner:` so it reads as the owner rather than a file the "
-            + "finding mentions."
+            + "`Discard reason:`/`Discard rationale:` prefix."
         )
       );
     }
@@ -855,7 +1009,14 @@ function taskComplete(repo, options) {
   }
   const contract = compileTaskContract(repo, selection.change, task);
   const usableContract = contract.diagnostics.length === 0 ? contract : null;
-  const checks = completionChecks(repo, task, usableContract);
+  const changeVerify = changeVerifyChecks(selection.content, selection.tasks);
+  const checks = completionChecks(
+    repo,
+    task,
+    usableContract,
+    changeVerify,
+    selection.change
+  );
   checks.problems.push(...contract.diagnostics);
   const missingAnchor = missingAnchorProblem(selection, task);
   if (missingAnchor) {
@@ -895,6 +1056,131 @@ function taskComplete(repo, options) {
   );
 }
 
+// The body of a change-level section — `## Invalidates`, `## Expectation
+// Coverage` — ending at the next `##` heading or at the next task, whichever
+// comes first. The heading half alone is the right bound for a document made of
+// headings, and a tasks file is not one: its dominant structure is a list, so a
+// section that is not the file's last one ran over the whole task list and read
+// what the tasks had declared. An `E<n>` line under a task's `Covers` was
+// judged as a coverage entry and reported unclosed; a `repo-action` task's
+// `Touch` of a bare `- none` was read as the section's `- None.` and closed a
+// declaration that closed nothing. The first failed loudly and named an entry
+// that was fine, the second failed silently, and which one an author met
+// depended only on where they had put the section — a position no template,
+// diagnostic, or document has ever stated.
+//
+// The task half is the task list already parsed for this file rather than a
+// second checkbox pattern, so it cannot drift from the boundary `parseTasks()`
+// applies to a task's own body. The heading half stays as it was: the two
+// spellings are not interchangeable, and unifying them truncates a tail-position
+// section at an indented `##` line inside its own body, which is this same
+// defect pointed the other way.
+function sectionBody(content, headingOffset, tasks) {
+  const lines = content.split(/\r?\n/);
+  const headingLine = content.slice(0, headingOffset).split(/\r?\n/).length - 1;
+  let end = lines.length;
+  for (const task of tasks) {
+    if (task.line > headingLine && task.line < end) end = task.line;
+  }
+  for (let cursor = headingLine + 1; cursor < end; cursor += 1) {
+    if (/^##\s+/.test(lines[cursor])) {
+      end = cursor;
+      break;
+    }
+  }
+  return lines.slice(headingLine + 1, end).join("\n");
+}
+
+// A `(regression)` check's bare Evidence may point at a change-level check
+// instead of recording its own result — issue #95. `deferred to C<n>` is
+// matched at the front of the value, the same way `Resolved here:`/`Durable
+// owner:` prefixes are read elsewhere in this file, so a real result that
+// happens to mention "deferred" mid-sentence is not misread as one.
+function deferredChangeCheck(value) {
+  const match = String(value || "").trim().match(/^deferred to (C[1-9]\d*)\b/i);
+  return match ? match[1] : null;
+}
+
+// `## Change Verify` is a change-level section a `(regression)` check's
+// Evidence can defer to — a check that only needs to run once for the whole
+// change instead of once per task. Parsed the same way as `## Invalidates`/
+// `## Expectation Coverage`: located by heading, bounded by `sectionBody()`.
+// Absent by default; a change that no task defers in never needs it.
+function changeVerifyChecks(content, tasks) {
+  const heading = content.search(/^## Change Verify\s*$/m);
+  if (heading < 0) return null;
+  const section = sectionBody(content, heading, tasks);
+  const strategyEntry = section.match(/^\s*-\s*Strategy:\s*(.*)$/im);
+  const checks = [
+    ...section.matchAll(/^\s*-\s*(C[1-9]\d*):\s*(.*)$/gim),
+  ].map((match) => ({ label: match[1], check: match[2].trim() }));
+  return {
+    strategy: strategyEntry ? strategyEntry[1].trim() : "",
+    checks,
+  };
+}
+
+// The `## Change Evidence` counterpart to `changeVerifyChecks` — one `C<n>:`
+// result per declared check, read the same way a task's own `M<n>` Evidence
+// already is.
+function changeEvidenceValue(content, tasks, label) {
+  const heading = content.search(/^## Change Evidence\s*$/m);
+  if (heading < 0) return "";
+  const section = sectionBody(content, heading, tasks);
+  const escaped = label.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const match = section.match(new RegExp(`^\\s*-\\s*${escaped}:\\s*(.*)$`, "im"));
+  return match ? match[1].trim() : "";
+}
+
+// `change-close`-only: `## Change Verify`'s own shape, and completeness of
+// `## Change Evidence` for every check it declares — whether or not any task
+// actually defers to it, because a declared check still owes its own result.
+// Per-task resolution (does a deferred reference resolve at all) runs inside
+// `completionChecks`, shared by `task-complete` and this loop's own call to
+// it, so it is not repeated here.
+function changeVerifyProblems(content, tasks) {
+  const changeVerify = changeVerifyChecks(content, tasks);
+  if (!changeVerify) return [];
+  const problems = [];
+  const labels = changeVerify.checks.map((entry) => entry.label);
+  const expected = labels.map((_, index) => `C${index + 1}`);
+  if (labels.length === 0 || !isConcrete(changeVerify.strategy)) {
+    problems.push(
+      problem(
+        "change-verify-shape",
+        "`## Change Verify` requires a concrete `Strategy:` line and at "
+          + "least one `C<n>:` check."
+      )
+    );
+  } else if (labels.some((label, index) => label !== expected[index])) {
+    problems.push(
+      problem(
+        "change-verify-shape",
+        "`## Change Verify` labels must be contiguous and ordered: "
+          + `expected ${expected.join(", ")}; found ${labels.join(", ")}.`
+      )
+    );
+  }
+  for (const entry of changeVerify.checks) {
+    if (!isConcrete(entry.check)) {
+      problems.push(
+        problem("change-verify-shape", `${entry.label} must define a concrete check.`)
+      );
+    }
+  }
+  for (const entry of changeVerify.checks) {
+    if (!isConcrete(changeEvidenceValue(content, tasks, entry.label))) {
+      problems.push(
+        problem(
+          "change-evidence-missing",
+          `Missing concrete \`## Change Evidence\` for ${entry.label}.`
+        )
+      );
+    }
+  }
+  return problems;
+}
+
 // Follow-up Ownership governs work a change left undone. This is the opposite
 // shape: statements left standing by work the change completed. It is asked at
 // task-start rather than change-close because the whole value is that the
@@ -905,7 +1191,7 @@ function taskComplete(repo, options) {
 // the author was not already holding in mind, so a list of remembered files
 // reproduces the failure; a searchable phrase is what turns the declaration
 // into a grep. What the phrase says is the agent's judgment, not the gate's.
-function invalidationProblems(repo, content, tasks) {
+function invalidationProblems(repo, content, tasks, change) {
   const heading = content.search(/^## Invalidates\s*$/m);
   if (heading < 0) {
     return [
@@ -919,10 +1205,7 @@ function invalidationProblems(repo, content, tasks) {
       ),
     ];
   }
-  const bodyStart = content.indexOf("\n", heading);
-  const remainder = bodyStart < 0 ? "" : content.slice(bodyStart + 1);
-  const nextHeading = remainder.search(/^##\s+/m);
-  const section = nextHeading < 0 ? remainder : remainder.slice(0, nextHeading);
+  const section = sectionBody(content, heading, tasks);
   if (/^\s*-\s+None\.?\s*$/im.test(section)) return [];
   const entries = [
     ...section.matchAll(
@@ -956,7 +1239,7 @@ function invalidationProblems(repo, content, tasks) {
     const updated = body.match(/Updated by:\s*([0-9.,\s-]+)/i);
     const declaredOwner = body.match(/Durable owner:\s*(\S[^\n]*)/i);
     const verdict = declaredOwner
-      ? durableOwnerVerdict(repo, declaredOwner[1])
+      ? durableOwnerVerdict(repo, declaredOwner[1], change)
       : { ok: false, reason: "absent" };
     const discarded = /Discard(?:ed)? (?:reason|rationale):\s*\S/i.test(body);
     if (!updated && !verdict.ok && !discarded) {
@@ -968,6 +1251,13 @@ function invalidationProblems(repo, content, tasks) {
               + "file exists in this repository."
           )
         );
+      } else if (verdict.reason === "transient") {
+        problems.push(
+          problem(
+            "invalidation-owner-transient",
+            `${id} names ${transientOwnerMessage(verdict.path)}`
+          )
+        );
       } else if (verdict.reason === "handoff") {
         problems.push(
           problem(
@@ -1010,7 +1300,7 @@ function invalidationProblems(repo, content, tasks) {
   return problems;
 }
 
-function expectationProblems(repo, content, tasks) {
+function expectationProblems(repo, content, tasks, change) {
   const heading = content.search(/^## Expectation Coverage\s*$/m);
   if (heading < 0) {
     return [
@@ -1022,10 +1312,7 @@ function expectationProblems(repo, content, tasks) {
       ),
     ];
   }
-  const bodyStart = content.indexOf("\n", heading);
-  const remainder = bodyStart < 0 ? "" : content.slice(bodyStart + 1);
-  const nextHeading = remainder.search(/^##\s+/m);
-  const section = nextHeading < 0 ? remainder : remainder.slice(0, nextHeading);
+  const section = sectionBody(content, heading, tasks);
   if (/^\s*-\s+None\.?\s*$/im.test(section)) return [];
   const entries = [
     ...section.matchAll(
@@ -1049,7 +1336,7 @@ function expectationProblems(repo, content, tasks) {
     const covered = body.match(/Covered by:\s*([0-9.,\s-]+)/i);
     const declaredOwner = body.match(/Durable owner:\s*(\S[^\n]*)/i);
     const verdict = declaredOwner
-      ? durableOwnerVerdict(repo, declaredOwner[1])
+      ? durableOwnerVerdict(repo, declaredOwner[1], change)
       : { ok: false, reason: "absent" };
     const discarded = /Discard(?:ed)? (?:reason|rationale):\s*\S/i.test(body);
     if (!covered && !verdict.ok && !discarded) {
@@ -1061,6 +1348,13 @@ function expectationProblems(repo, content, tasks) {
               + "file exists in this repository."
           )
         );
+      } else if (verdict.reason === "transient") {
+        problems.push(
+          problem(
+            "expectation-owner-transient",
+            `${id} names ${transientOwnerMessage(verdict.path)}`
+          )
+        );
       } else {
         problems.push(
           problem(
@@ -1117,6 +1411,7 @@ function changeClose(repo, options) {
   const problems = [];
   const reviewProblems = [];
   const contracts = [];
+  const changeVerify = changeVerifyChecks(selection.content, selection.tasks);
   if (selection.tasks.length === 0) {
     problems.push(problem("missing-tasks", "Change has no executable tasks."));
   }
@@ -1162,7 +1457,9 @@ function changeClose(repo, options) {
     const checks = completionChecks(
       repo,
       task,
-      contract.diagnostics.length === 0 ? contract : null
+      contract.diagnostics.length === 0 ? contract : null,
+      changeVerify,
+      selection.change
     );
     problems.push(
       ...checks.problems.map((item) =>
@@ -1175,7 +1472,10 @@ function changeClose(repo, options) {
       )
     );
   }
-  problems.push(...expectationProblems(repo, selection.content, selection.tasks));
+  problems.push(
+    ...expectationProblems(repo, selection.content, selection.tasks, selection.change)
+  );
+  problems.push(...changeVerifyProblems(selection.content, selection.tasks));
 
   const changePath = path.dirname(selection.tasksPath);
   if (!hasDeltaSpec(changePath)) {