@cleocode/core 2026.10.27 → 2026.11.1-canary.10

package/dist/tasks/evidence.js

@@ -37,11 +37,12 @@ import { HEAVY_HEAP_ENV, HEAVY_WORKERS_ENV, isHeavyTool } from './heavy-tool-env
 import { DISABLE_ENV, describeMemoryLimit } from './heavy-tool-limit.js';
 import { qaRunUnionGapReason, typecheckCoverageGap } from './qa-run-binding.js';
 import { computeCommitRevalidationKey, readCommitRevalidationEntry, writeCommitRevalidationEntry, } from './revalidation-cache.js';
-import { bindTestRunReport, configSchemaCompositionGap, coveredTestFiles, playwrightTestRun, TEST_RUN_MAX_RECORDED_FILES, } from './test-run-binding.js';
+import { present, readTestReport, TEST_RUN_SHAPE_HINT, } from './test-report-counts.js';
+import { bindTestRunReport, configSchemaCompositionGap, coveredTestFiles, TEST_RUN_MAX_RECORDED_FILES, } from './test-run-binding.js';
 import { captureHead, captureTree, resolveSpawnTimeoutMs, runToolCached, } from './tool-cache.js';
 import { CANONICAL_TOOLS, canonicalToolName, listValidToolNames, resolveToolCommand, } from './tool-resolver.js';
 import { detectStaticVacuity, probeTscFileCount, VACUOUS_TOOL_FIX } from './tool-vacuity.js';
-import { classifyEvidenceTask, declaredEvidenceKind, gateProfileOf, implementedCodeEvidence, isDocumentArtifact, isDocumentEvidencePath, } from './verification-policy.js';
+import { classifyEvidenceTask, declaredEvidenceKind, evidenceProfileOf, gateProfileOf, ignoredProfileReason, implementedCodeEvidence, isDocumentArtifact, isDocumentEvidencePath, } from './verification-policy.js';
 /**
  * Valid tool names recognised by the `tool:<name>` evidence atom.
  *
@@ -142,6 +143,47 @@ export function parseEvidence(raw) {
         throw err;
     }
 }
+/**
+ * The two roots an evidence atom may be about, named so an arm cannot inherit
+ * the wrong one.
+ *
+ * gh#1365 was fixed once by threading a single `executionRoot` parameter, and
+ * the fix reached two of the switch's arms. The reason a single parameter could
+ * not close it is that **"root" is one word for two things**: the tree the
+ * evidence is ABOUT, and the store CLEO keeps its own records in. A parameter
+ * called `root` relocates that ambiguity into a signature rather than removing
+ * it, so the next arm silently picks whichever the author had in mind.
+ *
+ * With both fields named, every arm DECLARES what it is about by which field it
+ * reads. `decision:` reading {@link storeRoot} is self-documenting rather than
+ * an exception needing a comment; `pr:` reading both is obviously correct
+ * rather than obviously odd; and a new arm cannot inherit a default, because
+ * there is no default.
+ *
+ * The rule, stated once: **use the root that matches what the atom is about.**
+ * Evidence about the repository under test → {@link executionRoot}. Evidence
+ * about CLEO's own records → {@link storeRoot}.
+ *
+ * @task T12238 (gh#1365)
+ */
+/**
+ * Repo paths a task's change touches, for judging a `ci-run:` test file's
+ * relevance (T14149): its declared files and the files its recorded
+ * `implemented` evidence names (`files:` paths and `pr:` changed paths).
+ */
+function taskChangePaths(context) {
+    const implemented = context.task.verification?.evidence?.implemented?.atoms ?? [];
+    return [
+        ...new Set([
+            ...(context.task.files ?? []),
+            ...implemented.flatMap((atom) => atom.kind === 'files'
+                ? atom.files.map((file) => file.path)
+                : atom.kind === 'pr'
+                    ? (atom.changedPaths ?? [])
+                    : []),
+        ]),
+    ].map(normalizeEvidencePath);
+}
 /**
  * Validate a single parsed atom against the filesystem / git / tools.
  *
@@ -280,6 +322,41 @@ siblingCommitSha, context) {
                 ? { ok: true, atom: result.atom }
                 : { ok: false, reason: result.reason, codeName: result.codeName };
         }
+        case 'ci-run': {
+            // T14149: a repeat-run.yml run, read from GitHub in the repository. Its
+            // test file must be one the task changed or one a linked criterion names.
+            const owner = taskId ?? context?.task.id;
+            if (owner === undefined || context === undefined)
+                return {
+                    ok: false,
+                    reason: 'ci-run evidence needs the task context to judge which test file is relevant',
+                    codeName: 'E_EVIDENCE_INVALID',
+                };
+            const { resolveCiRunEvidenceAtom } = await import('../release/ci-run-evidence.js');
+            const result = await resolveCiRunEvidenceAtom(parsed.runId, roots, {
+                taskId: owner,
+                changedPaths: taskChangePaths(context),
+                criteriaTexts: (context.creditedCriteria ?? []).map((criterion) => criterion.text),
+            });
+            return result.ok
+                ? { ok: true, atom: result.atom }
+                : { ok: false, reason: result.reason, codeName: result.codeName };
+        }
+        case 'deploy': {
+            // T14083: the project context is CLEO's own record (storeRoot); the
+            // deployed commit is resolved in the repository (executionRoot).
+            const { resolveDeployEvidenceAtom } = await import('../release/deploy-evidence.js');
+            const { loadProjectContext } = await import('../agents/variable-substitution.js');
+            const ctx = loadProjectContext(roots.storeRoot);
+            const owner = taskId ?? context?.task.id;
+            const result = await resolveDeployEvidenceAtom(parsed, roots, {
+                projectContext: ctx.loaded ? ctx.context : null,
+                ...(owner !== undefined ? { taskId: owner } : {}),
+            });
+            return result.ok
+                ? { ok: true, atom: result.atom }
+                : { ok: false, reason: result.reason, codeName: result.codeName };
+        }
         case 'satisfies': {
             // ADR-079-r2: 5-check validator pipeline shipped by T10507.
             // Delegates to the dedicated validator module to keep the dispatch
@@ -811,8 +888,10 @@ export function extractTaskAcFilesWithProvenance(task) {
 /**
  * Return the list of file paths a commit touched (added, modified, or deleted).
  *
- * Uses `git diff-tree --no-commit-id -r --name-only -m --first-parent` which
- * correctly handles **merge commits** by diffing against the first parent only.
+ * Uses `git diff-tree --no-commit-id -r --name-only --diff-merges=first-parent`
+ * (git 2.31+), which diffs a **merge commit** against its first parent only.
+ * `-m --first-parent` listed the diff against EVERY parent, since
+ * `--first-parent` limits a revision walk, not diff-tree (T14166).
  * The legacy `git show --name-only` approach returned an empty list for merge
  * commits because show without `--first-parent` produces a combined diff that
  * `--name-only` cannot meaningfully summarise, causing the content-intersect
@@ -825,6 +904,7 @@ export function extractTaskAcFilesWithProvenance(task) {
  * @internal
  * @task T9245
  * @task T11959 (DHQ-083 companion b — merge-commit first-parent diff)
+ * @task T14166
  */
 async function gitShowFiles(sha, projectRoot) {
     return (await commitFilesOrNull(sha, projectRoot)) ?? [];
@@ -839,9 +919,9 @@ async function gitShowFiles(sha, projectRoot) {
  * @task T14001
  */
 async function commitFilesOrNull(sha, projectRoot) {
-    // diff-tree with --first-parent gives a clean single-parent diff for both
+    // --diff-merges=first-parent gives a clean single-parent diff for both
     // regular commits and merge commits (compares merge result to first parent,
-    // i.e. the branch tip before the PR was merged).
+    // i.e. the branch tip before the PR was merged; T14166).
     //
     // --root: Without this flag, git diff-tree returns EMPTY output for the
     // repository's initial (root) commit because there is no parent to diff
@@ -849,7 +929,15 @@ async function commitFilesOrNull(sha, projectRoot) {
     // against the empty tree, correctly listing all files it introduced.
     // This fixes the gate-verify-hint tests (and any real workflow) where the
     // evidence commit happens to be the very first commit in the repo (T11959).
-    const r = await runCommand('git', ['diff-tree', '--root', '--no-commit-id', '-r', '--name-only', '-m', '--first-parent', sha], projectRoot);
+    const r = await runCommand('git', [
+        'diff-tree',
+        '--root',
+        '--no-commit-id',
+        '-r',
+        '--name-only',
+        '--diff-merges=first-parent',
+        sha,
+    ], projectRoot);
     if (r.exitCode !== 0)
         return null;
     return r.stdout
@@ -1267,121 +1355,6 @@ async function validateFiles(paths, roots, taskId, commitShaFor, requireCommitAr
     }
     return { ok: true, atom: { kind: 'files', files } };
 }
-/**
- * The counter sets a `test-run:` report may carry (gh#1804), tried in order;
- * the first whose total key is present is read. `failed` and `notRun` sum
- * their keys, and an absent count is 0.
- *
- * | Shape | Total | Passed | Failed | Skipped / todo |
- * |---|---|---|---|---|
- * | vitest `--reporter=json`, jest `--json` | `numTotalTests` | `numPassedTests` | `numFailedTests` | `numPendingTests`, `numTodoTests` |
- * | a runner's summary output (bun test, tsx --test) | `total` | `passed` | `failed` | `skipped`, `todo` |
- * | node --test summary (`# tests`, `# pass`, ...) | `tests` | `pass` | `fail`, `cancelled` | `skipped`, `todo` |
- *
- * Integrity (T13136 review): every count is a non-negative integer;
- * passed + failed + skipped/todo equals the total; a failure under ANY key
- * ({@link TEST_RUN_FAILURE_KEYS}) refuses, whichever set supplied the total;
- * a report's `exit` / `exitCode` must be a number, and a non-zero one is
- * refused. A `test-run:` atom proves only what its file says; `tool:test` and
- * `ci:<pr>` are what prove the run. `cleo verify --help` documents the same
- * sets.
- *
- * @task T13136
- */
-const TEST_RUN_COUNTER_SHAPES = [
-    {
-        name: 'vitest/jest',
-        total: 'numTotalTests',
-        passed: 'numPassedTests',
-        failed: ['numFailedTests'],
-        notRun: ['numPendingTests', 'numTodoTests'],
-    },
-    {
-        name: 'summary',
-        total: 'total',
-        passed: 'passed',
-        failed: ['failed'],
-        notRun: ['skipped', 'todo'],
-    },
-    {
-        name: 'node --test',
-        total: 'tests',
-        passed: 'pass',
-        failed: ['fail', 'cancelled'],
-        notRun: ['skipped', 'todo'],
-    },
-];
-/** The keys of each counter set, as the refusals name them. */
-const TEST_RUN_SHAPE_HINT = TEST_RUN_COUNTER_SHAPES.map((s) => `${[s.total, s.passed, ...s.failed, ...s.notRun].join('/')} (${s.name})`).join(', ');
-/**
- * Keys that name failures in any counter set, plus jest/vitest suite failures
- * and the mocha / JUnit spellings: a positive value under any of them refuses
- * the report, whichever set supplied the total.
- */
-const TEST_RUN_FAILURE_KEYS = [
-    'numFailedTests',
-    'numFailedTestSuites',
-    'numRuntimeErrorTestSuites',
-    'failed',
-    'fail',
-    'cancelled',
-    'failures',
-    'errors',
-];
-/** A present, non-null JSON value. */
-const present = (value) => value !== undefined && value !== null;
-/** A non-negative integer, or `undefined` when the value is anything else. */
-const countOf = (value) => typeof value === 'number' && Number.isInteger(value) && value >= 0 ? value : undefined;
-/**
- * Read a report's counts from the first counter set it carries, enforcing
- * their integrity; `null` when it carries none.
- */
-function testRunCounts(report) {
-    const shape = TEST_RUN_COUNTER_SHAPES.find((s) => present(report[s.total]));
-    if (shape === undefined)
-        return null;
-    const invalid = (key) => ({
-        reason: `test-run report's "${key}" is ${JSON.stringify(report[key])}; every count must be a non-negative integer`,
-        codeName: 'E_EVIDENCE_INVALID',
-    });
-    const read = (key) => {
-        if (!present(report[key]))
-            return 0;
-        return countOf(report[key]) ?? invalid(key);
-    };
-    const total = read(shape.total);
-    if (typeof total !== 'number')
-        return total;
-    const keys = [shape.passed, ...shape.failed, ...shape.notRun];
-    const values = [];
-    for (const key of keys) {
-        const v = read(key);
-        if (typeof v !== 'number')
-            return v;
-        values.push(v);
-    }
-    for (const key of TEST_RUN_FAILURE_KEYS) {
-        if (!present(report[key]))
-            continue;
-        const v = countOf(report[key]);
-        if (v === undefined)
-            return invalid(key);
-        if (v > 0) {
-            return { reason: `test-run reports ${key} = ${v}`, codeName: 'E_EVIDENCE_TESTS_FAILED' };
-        }
-    }
-    const [passed = 0, ...rest] = values;
-    const failed = rest.slice(0, shape.failed.length).reduce((a, b) => a + b, 0);
-    const notRun = rest.slice(shape.failed.length).reduce((a, b) => a + b, 0);
-    if (passed + failed + notRun !== total) {
-        return {
-            reason: `test-run report's counts do not add up: ${shape.total} is ${total}, but ` +
-                `${shape.passed} + ${[...shape.failed, ...shape.notRun].join(' + ')} = ${passed + failed + notRun}`,
-            codeName: 'E_EVIDENCE_INVALID',
-        };
-    }
-    return { shape, total, passed, failed, notRun };
-}
 /**
  * `tool:test-affected` (D11150, T12635): run `testing.affectedCommand` over the
  * packages the branch diff touches plus their dependents, through the same
@@ -1403,6 +1376,9 @@ async function validateAffectedTests(roots, taskId) {
  */
 async function runAffectedTests(tool, run, roots, taskId) {
     const { storeRoot, executionRoot } = roots;
+    const foreign = await workspaceResolutionRefusal(executionRoot);
+    if (foreign !== null)
+        return foreign;
     // T13132: status shows what holds the budget — the scope and the task.
     const result = await runToolCached(run.command, storeRoot, {
         executionRoot,
@@ -1428,15 +1404,17 @@ async function runAffectedTests(tool, run, roots, taskId) {
             exitCode: 0,
             stdoutTail: result.stdoutTail,
             scope: 'affected',
-            scopeReason: run.template.source === 'derived'
-                ? `${AFFECTED_SCOPE_BASIS}; the affected command was derived from the workspace test ` +
-                    `command "${run.template.basis}" (declare testing.affectedCommand to pin it, T13125)`
-                : AFFECTED_SCOPE_BASIS,
+            scopeReason: (run.fileLevel ? FILE_LEVEL_SCOPE_BASIS : AFFECTED_SCOPE_BASIS) +
+                (run.template.source === 'derived'
+                    ? `; the affected command was derived from the workspace test ` +
+                        `command "${run.template.basis}" (declare testing.affectedCommand to pin it, T13125)`
+                    : ''),
             affectedPackages: run.packages,
             affectedProjects: run.projects,
             ...(run.testFiles ? { affectedTestFiles: run.testFiles } : {}),
             ...(run.configPaths ? { configPaths: run.configPaths } : {}),
             ...(run.untested.length > 0 ? { untestedPackages: run.untested } : {}),
+            ...(run.untrackedSetAside ? { untrackedSetAside: run.untrackedSetAside } : {}),
             ...(await toolRunAtomFields(result)),
         },
     };
@@ -1447,6 +1425,9 @@ async function runAffectedTests(tool, run, roots, taskId) {
  * is not in the set.
  */
 const AFFECTED_SCOPE_BASIS = 'changed packages plus their dependents from declared workspace package dependencies only';
+/** What a file-level affected scope rests on (T14366): static imports, read from the checkout. */
+const FILE_LEVEL_SCOPE_BASIS = 'the test files whose static import graph reaches a changed module, plus tests that read ' +
+    'source trees or spawn processes in an affected package';
 /**
  * Resolve the tree that evidence tools should RUN in, given the CLEO store
  * root.
@@ -1600,16 +1581,74 @@ async function readTestRunReport(path, roots) {
             codeName: 'E_EVIDENCE_INVALID',
         };
     }
-    try {
-        return { ok: true, abs, content, parsed: JSON.parse(content.toString('utf-8')) };
-    }
-    catch (err) {
+    // T14124: one reader for every format, shared with typed gates' minCount.
+    // T14161: a TAP report's file names resolve in the caller's tree.
+    const text = content.toString('utf-8');
+    const read = readTestReport(text, { cwd: executionRoot });
+    if (read === null) {
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch (err) {
+            return {
+                ok: false,
+                reason: 'test-run file is not valid JSON, JUnit XML or libtest JSON lines (or node:test TAP): ' +
+                    `${err instanceof Error ? err.message : String(err)}`,
+                codeName: 'E_EVIDENCE_INVALID',
+            };
+        }
         return {
             ok: false,
-            reason: `test-run file is not valid JSON: ${err instanceof Error ? err.message : String(err)}`,
+            reason: parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)
+                ? `test-run file is not a JSON object. Expected test counts: ${TEST_RUN_SHAPE_HINT}`
+                : `test-run report has no test counts. Expected one of: ${TEST_RUN_SHAPE_HINT}; ` +
+                    "e.g. vitest's --reporter=json --outputFile, Playwright's --reporter=json, or " +
+                    '{"total":43,"passed":42,"failed":0,"skipped":1}',
             codeName: 'E_EVIDENCE_INVALID',
         };
     }
+    if (!read.ok)
+        return { ok: false, reason: read.reason, codeName: read.codeName };
+    return { ok: true, abs, content, parsed: read.report, counts: read.counts };
+}
+/**
+ * T14097: refuse a test run in a checkout whose workspace packages resolve
+ * into another checkout (its tests would run that checkout's build) or whose
+ * dist was built from other source (T14123), and warn when a dependency's
+ * build is borrowed from a checkout with identical source. Null when the run
+ * may proceed.
+ *
+ * @param root - The tree the run is about (any directory inside the checkout).
+ * @param testFiles - Test files the run names, to scope the check; all packages when empty.
+ */
+async function workspaceResolutionRefusal(root, testFiles = []) {
+    const { borrowedBuildWarning, checkoutRootOf, checkWorkspaceResolution, packagesNamedByTestArgs, UNSTAMPED_DIST_FIX, unstampedDistWarning, workspaceResolutionError, } = await import('./workspace-resolution.js');
+    const checkout = checkoutRootOf(root) ?? root;
+    const report = checkWorkspaceResolution(checkout, packagesNamedByTestArgs(checkout, checkout, testFiles));
+    const refused = workspaceResolutionError(report);
+    // @sync-invariant none:input-shape a test run against another checkout's build, or a dist built from other source, is refused before anything is written
+    if (refused !== null)
+        return { ok: false, reason: refused.message, codeName: refused.codeName };
+    const borrowed = borrowedBuildWarning(report);
+    if (borrowed !== null)
+        pushWarning({
+            // @sync-invariant none:input-shape a warning only; nothing is refused or written
+            code: 'W_WORKSPACE_BORROWED_BUILD',
+            severity: 'warn',
+            message: borrowed,
+            context: { root: checkout },
+        });
+    const unstamped = unstampedDistWarning(report);
+    if (unstamped !== null)
+        pushWarning({
+            // @sync-invariant none:input-shape a warning only; nothing is refused or written
+            code: 'W_WORKSPACE_UNSTAMPED_DIST',
+            severity: 'warn',
+            message: unstamped,
+            context: { root: checkout, fix: UNSTAMPED_DIST_FIX },
+        });
+    return null;
 }
 /**
  * Validate a `test-run:` report: its counts, then bound to the change.
@@ -1623,44 +1662,14 @@ async function validateTestRun(path, roots, taskId, siblings = []) {
     const read = await readTestRunReport(path, roots);
     if (!read.ok)
         return read;
-    const { abs, content } = read;
-    let parsed = read.parsed;
+    const { abs, content, parsed, counts } = read;
     const sha256 = createHash('sha256').update(content).digest('hex');
-    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    if (counts.failure !== undefined)
         return {
             ok: false,
-            reason: `test-run file is not a JSON object. Expected test counts: ${TEST_RUN_SHAPE_HINT}`,
-            codeName: 'E_EVIDENCE_INVALID',
-        };
-    }
-    // T14031: a Playwright JSON report is read in the vitest shape.
-    const playwright = playwrightTestRun(parsed);
-    if (playwright !== null && 'refusal' in playwright)
-        return { ok: false, reason: playwright.refusal, codeName: playwright.codeName };
-    if (playwright !== null)
-        parsed = playwright;
-    if (present(parsed.testResults) &&
-        (!Array.isArray(parsed.testResults) ||
-            parsed.testResults.some((tr) => tr === null || typeof tr !== 'object' || Array.isArray(tr)))) {
-        return {
-            ok: false,
-            reason: 'test-run report\'s "testResults" must be an array of objects',
-            codeName: 'E_EVIDENCE_INVALID',
-        };
-    }
-    const counts = testRunCounts(parsed);
-    if (counts !== null && !('shape' in counts)) {
-        return { ok: false, reason: counts.reason, codeName: counts.codeName };
-    }
-    if (counts === null) {
-        return {
-            ok: false,
-            reason: `test-run report has no test counts. Expected one of: ${TEST_RUN_SHAPE_HINT}; ` +
-                "e.g. vitest's --reporter=json --outputFile, Playwright's --reporter=json, or " +
-                '{"total":43,"passed":42,"failed":0,"skipped":1}',
-            codeName: 'E_EVIDENCE_INVALID',
+            reason: `test-run reports ${counts.failure}`,
+            codeName: 'E_EVIDENCE_TESTS_FAILED',
         };
-    }
     const { total, failed, passed, notRun: pending } = counts;
     // Both spellings are checked: a report carrying exit 0 and exitCode 1 failed
     // (T13136 review).
@@ -1736,18 +1745,19 @@ async function validateTestRun(path, roots, taskId, siblings = []) {
     if (broken)
         return { ok: false, reason: broken, codeName: E_EVIDENCE_GIT_ROOT };
     const testFiles = coveredTestFiles(parsed, bindRoot);
+    // T14097: never record a receipt from a checkout testing another one's build.
+    const foreign = await workspaceResolutionRefusal(bindRoot, testFiles);
+    if (foreign !== null)
+        return foreign;
     // T14031: the other reports of this write cover the change with this one.
     const siblingFiles = [];
     for (const sibling of siblings) {
         if (sibling === path)
             continue;
         const other = await readTestRunReport(sibling, roots);
-        if (!other.ok || other.parsed === null || typeof other.parsed !== 'object')
-            continue;
-        const adapted = playwrightTestRun(other.parsed);
-        if (adapted !== null && 'refusal' in adapted)
+        if (!other.ok)
             continue;
-        siblingFiles.push(...coveredTestFiles(adapted ?? other.parsed, bindRoot));
+        siblingFiles.push(...coveredTestFiles(other.parsed, bindRoot));
     }
     // The tree hash is the tool cache's (T12958), so a bound test-run and a
     // cached tool run of the same content agree.
@@ -1892,6 +1902,7 @@ async function validateQaRun(path, roots, taskId) {
             ...(gaps?.nonCodeChange ? { nonCodeChange: true } : {}),
             ...(gaps?.configPaths ? { configPaths: gaps.configPaths } : {}),
             ...(gaps?.untrackedSetAside ? { untrackedSetAside: gaps.untrackedSetAside } : {}),
+            ...(gaps?.owedChecks ? { owedChecks: gaps.owedChecks } : {}),
         },
     };
 }
@@ -2109,7 +2120,8 @@ async function validateTool(tool, roots, context, siblingCommitSha) {
             ? (await import('./change-set.js')).resolveChangeSetRoot(roots.storeRoot, context.task.id)
                 .root
             : roots.executionRoot;
-        const changed = scopedChangedPaths(root)?.paths ?? [];
+        const scoped = scopedChangedPaths(root);
+        const changed = scoped?.paths ?? [];
         const treeHash = isNonCodeOnlyChange(changed) ? (await captureTree(root)).tree : null;
         if (treeHash) {
             return {
@@ -2121,6 +2133,11 @@ async function validateTool(tool, roots, context, siblingCommitSha) {
                     notApplicable: true,
                     nonCodeChange: true,
                     treeHash,
+                    // T14125: a stray untracked code file is not this change; once one
+                    // is committed, `cleo complete` refuses this result.
+                    ...(scoped && scoped.untrackedSetAside.length > 0
+                        ? { untrackedSetAside: scoped.untrackedSetAside }
+                        : {}),
                     reason: `no test reads this change: it touches only non-code files (${changed.join(', ')})`,
                 },
             };
@@ -2214,6 +2231,11 @@ async function validateTool(tool, roots, context, siblingCommitSha) {
     // T13132: a heavy tool here runs the whole project (the affected scope
     // returned above); status marks it scope=full with its task.
     const taskId = context?.task.id;
+    if (resolution.command.canonical === 'test') {
+        const foreign = await workspaceResolutionRefusal(executionRoot);
+        if (foreign !== null)
+            return foreign;
+    }
     const result = await runToolCached(resolution.command, projectRoot, {
         executionRoot,
         semaphoreOptions: {
@@ -2714,13 +2736,23 @@ async function validateDecision(decisionId, roots) {
  * task in its title, body or head branch, or its diff intersects the task's
  * declared files — and when files are declared, the diff MUST intersect them.
  *
+ * T14094: a task with no declared files may also credit a PR merged under
+ * another task, through the criteria the same write names with
+ * `satisfies:<task>#AC…` ({@link creditRefusal}).
+ *
  * @param prNumber - The PR being linked.
  * @param pr - The verified PR (title, body, head branch, changed files).
  * @param context - The task the evidence is being recorded for.
+ * @param mergedAt - When the PR merged, for the credited-criteria edit check.
+ * @param reviewed - The merge sweep proved the linkage from the PR's
+ *   `Closes:`/`Refs:` line and non-author verdicts (T14259,
+ *   {@link reviewedDirectiveLinkage}); only the file-inventory check remains.
  * @returns The refusal, or null when the PR is linked to the task.
  * @task T12634
+ * @task T14094
+ * @task T14259
  */
-export function checkPrTaskLinkage(prNumber, pr, context) {
+export function checkPrTaskLinkage(prNumber, pr, context, mergedAt, reviewed = false) {
     if (pr.changedFileCount !== pr.changedPaths.length || pr.changedPaths.length === 0) {
         return {
             ok: false,
@@ -2728,17 +2760,101 @@ export function checkPrTaskLinkage(prNumber, pr, context) {
             reason: `PR #${prNumber} changed-file coverage is incomplete or empty (${pr.changedPaths.length}/${pr.changedFileCount})${pr.changedFilesError ? ` — ${pr.changedFilesError}` : ''}; inspect the full diff before recording evidence.`,
         };
     }
+    if (reviewed)
+        return null;
     const declaredFiles = context.task.files ?? [];
     const taskMention = new RegExp(`(^|[^A-Za-z0-9])${context.task.id}([^A-Za-z0-9]|$)`);
     const explicitlyLinked = taskMention.test(`${pr.title}\n${pr.body}\n${pr.headRefName}`);
     const scopeIntersects = declaredFiles.length > 0 && diffIntersectsAc(pr.changedPaths, declaredFiles);
-    if ((!explicitlyLinked && !scopeIntersects) || (declaredFiles.length > 0 && !scopeIntersects)) {
+    if (declaredFiles.length > 0 && !scopeIntersects) {
         return {
             ok: false,
             codeName: 'E_EVIDENCE_CONTENT_MISMATCH',
-            reason: `PR #${prNumber} does not establish a relationship to task ${context.task.id}. Changed artifacts: ${pr.changedPaths.join(', ')}. Declare task files or cite the exact task in the PR; declared scope must intersect the diff.`,
+            reason: `PR #${prNumber} changes none of task ${context.task.id}'s declared files (${declaredFiles.join(', ')}). Changed artifacts: ${pr.changedPaths.join(', ')}.`,
         };
     }
+    if (explicitlyLinked || scopeIntersects)
+        return null;
+    const refusal = creditRefusal(prNumber, pr.changedPaths, context, mergedAt);
+    return refusal === null
+        ? null
+        : { ok: false, codeName: 'E_EVIDENCE_CONTENT_MISMATCH', reason: refusal };
+}
+/**
+ * Whether the merge sweep's linkage holds for a PR and a task (T14259): the
+ * PR's body names the task on a `Closes:`/`Refs:` line, and a non-author
+ * `met` verdict covers every criterion that line names on the PR head, each
+ * bound to the criterion's current text. A child task named on its parent's
+ * PR links this way whatever its declared files or its criteria's paths.
+ *
+ * @param prNumber - The PR.
+ * @param body - Its body.
+ * @param headSha - Its head (`headRefOid`), or undefined when unknown.
+ * @param storeRoot - The CLEO store (verdicts and criteria).
+ * @param taskId - The task.
+ * @returns True when the line and the verdicts link the PR to the task.
+ * @task T14259
+ */
+export async function reviewedDirectiveLinkage(prNumber, body, headSha, storeRoot, taskId) {
+    if (!headSha)
+        return false;
+    const { parseMergeDirectives } = await import('./merge-close.js');
+    const line = parseMergeDirectives(body).directives.find((d) => d.taskId === taskId);
+    if (line === undefined)
+        return false;
+    const { currentAcTexts, judgeReviewVerdicts, reviewVerdictsFor } = await import('./review-verdict.js');
+    const judged = judgeReviewVerdicts(await reviewVerdictsFor(storeRoot, taskId, prNumber), line.acs, headSha, await currentAcTexts(storeRoot, taskId));
+    return judged.gaps.length === 0 && judged.met.length === line.acs.length;
+}
+/**
+ * Why a PR that neither cites a task nor declares its files cannot be credited
+ * to it, or null when it can (T14094: work shipped under another task). The
+ * write must name criteria with `satisfies:<task>#AC…`; each must name at
+ * least one repo path, the PR must have changed every one of them, and none
+ * may have been edited after the PR merged, so a criterion cannot be made to
+ * match after the fact. The refusal names that one route, and for a task the
+ * other task fully covers, the duplicate close.
+ *
+ * @param prNumber - The PR being credited.
+ * @param changedPaths - Its complete changed-file list.
+ * @param context - The task, with the criteria the write credits.
+ * @param mergedAt - When the PR merged; unknown refuses any credit.
+ * @returns The refusal, or null.
+ * @task T14094
+ */
+function creditRefusal(prNumber, changedPaths, context, mergedAt) {
+    const id = context.task.id;
+    const credited = context.creditedCriteria ?? [];
+    if (credited.length === 0)
+        return (`PR #${prNumber} does not cite task ${id} and ${id} declares no files, so it is not ${id}'s work. ` +
+            `To credit a PR merged under another task, name the criteria it delivers in the same write ` +
+            `(satisfies:${id}#AC<n>); each must name the files the PR changed. If another task fully covers ${id}, ` +
+            `close it with cleo cancel ${id} --reason "covered by T<n>" and cleo relates add ${id} T<n> duplicates "<reason>". ` +
+            `Changed artifacts: ${changedPaths.join(', ')}.`);
+    // Credit is for merged PRs only; without the merge time the edit check below cannot run.
+    // Times here are zoned ISO-8601 (GitHub's mergedAt; criteria normalised to
+    // UTC by the writer), so Date.parse reads them exactly.
+    const mergedMs = mergedAt ? Date.parse(mergedAt) : Number.NaN;
+    if (Number.isNaN(mergedMs))
+        return `PR #${prNumber}'s merge time is unknown, so its credited criteria cannot be checked for later edits.`;
+    const changed = new Set(changedPaths.map(normalizeEvidencePath));
+    for (const criterion of credited) {
+        // An edit gives a criterion a new row, so its creation time counts too.
+        const written = criterion.updatedAt ?? criterion.createdAt;
+        const writtenMs = written ? Date.parse(written) : Number.NaN;
+        if (Number.isNaN(writtenMs))
+            return `${id}#${criterion.alias} has no readable write time, so it cannot be shown to predate PR #${prNumber}'s merge.`;
+        if (writtenMs > mergedMs)
+            return `${id}#${criterion.alias} was written or edited at ${written}, after PR #${prNumber} merged at ${mergedAt}; a criterion changed after the merge cannot be credited by it.`;
+        const paths = extractTaskAcFilesWithProvenance({ acceptance: [criterion.text] }).files ?? [];
+        if (paths.length === 0)
+            // T14299: name the supported route (T14259): the PR's Closes: line plus a
+            // non-author verdict links a criterion that names no file.
+            return `${id}#${criterion.alias} names no file, so PR #${prNumber} cannot be shown to deliver it. List ${id} ${criterion.alias} on the PR's Closes: line and have another session review it: \`cleo review packet ${prNumber} --task ${id}\`, then the merge sweep closes it.`;
+        const missing = paths.filter((path) => !changed.has(normalizeEvidencePath(path)));
+        if (missing.length > 0)
+            return `PR #${prNumber} did not change ${missing.join(', ')}, which ${id}#${criterion.alias} names, so it cannot be credited with ${criterion.alias}.`;
+    }
     return null;
 }
 /**
@@ -2789,10 +2905,14 @@ async function validatePrAtom(prNumber, roots, context, componentPrNumber) {
     // T12671: `pr:<component>@<integration>` — the integration PR is the
     // provenance (merge commit, required workflows); the component PR is the
     // task's link and its change. Both are verified, both are recorded.
-    const linked = await linkedPrChange(prNumber, result, roots, componentPrNumber);
+    const linked = await linkedPrChange(prNumber, result, roots, componentPrNumber, undefined, context.task.id);
     if (!linked.ok)
         return linked;
-    const unlinked = checkPrTaskLinkage(linked.prNumber, linked.pr, context);
+    // T14259: on the merge sweep's path, the PR's Closes:/Refs: line and the
+    // non-author verdicts are the whole linkage rule.
+    const reviewed = context.reviewedLinkage === true &&
+        (await reviewedDirectiveLinkage(prNumber, result.body, result.headRefOid, roots.storeRoot, context.task.id));
+    const unlinked = checkPrTaskLinkage(linked.prNumber, linked.pr, context, result.mergedAt, reviewed);
     if (unlinked)
         return unlinked;
     const changedPaths = linked.pr.changedPaths;
@@ -2848,14 +2968,40 @@ async function validatePrAtom(prNumber, roots, context, componentPrNumber) {
  * @param prNumber - The (integration) PR the atom names.
  * @param landing - Its verified resolution.
  * @param roots - Evidence roots (git runs in the execution root).
+ * Without a component, a PR that does not name the task itself is linked
+ * through a merge commit on it that names the task (T14164), carrying that
+ * merge's own landed change only, never the whole PR's files.
+ *
  * @param componentPrNumber - Component PR, when the atom names one.
  * @param view - Component PR reader (tests inject; defaults to `gh pr view`).
+ * @param taskId - The task the evidence is for, to find a merge that names it.
  * @returns The linkage subject, or the refusal.
  * @task T12671
+ * @task T14164
  */
-export async function linkedPrChange(prNumber, landing, roots, componentPrNumber, view) {
-    if (componentPrNumber === undefined)
-        return { ok: true, prNumber, pr: landing };
+export async function linkedPrChange(prNumber, landing, roots, componentPrNumber, view, taskId) {
+    if (componentPrNumber === undefined) {
+        if (taskId === undefined ||
+            new RegExp(`(^|[^A-Za-z0-9])${taskId}([^A-Za-z0-9]|$)`).test(`${landing.title}\n${landing.body}\n${landing.headRefName}`))
+            return { ok: true, prNumber, pr: landing };
+        const { taskMergesInLanding } = await import('./component-pr.js');
+        const merged = taskMergesInLanding(roots.executionRoot, taskId, landing);
+        if (merged === null)
+            return { ok: true, prNumber, pr: landing };
+        const changedPaths = [...merged.files, ...merged.deleted];
+        return {
+            ok: true,
+            prNumber,
+            pr: {
+                title: merged.merges.map((m) => m.subject).join('\n'),
+                body: '',
+                headRefName: landing.headRefName,
+                changedPaths,
+                changedFileCount: changedPaths.length,
+                ...(merged.deleted.length > 0 ? { deletedPaths: merged.deleted } : {}),
+            },
+        };
+    }
     const { resolveComponentPr } = await import('./component-pr.js');
     const c = await resolveComponentPr(componentPrNumber, {
         prNumber,
@@ -3034,6 +3180,12 @@ export function checkTaskEvidenceContext(context, gate, atoms) {
     // T12634: a `ci:` result is bound to the task it was validated for, like `pr:`.
     if (atoms.some((atom) => atom.kind === 'ci' && atom.taskId !== context.task.id))
         return 'CI evidence lacks verified task linkage; re-verify with current task context.';
+    // T14083: a probed deployment is bound to the task it was verified for.
+    if (atoms.some((atom) => atom.kind === 'deploy' && atom.taskId !== context.task.id))
+        return 'Deploy evidence lacks verified task linkage; re-verify with current task context.';
+    // T14149: a repeat-run is judged relevant to the task it was verified for.
+    if (atoms.some((atom) => atom.kind === 'ci-run' && atom.taskId !== context.task.id))
+        return 'ci-run evidence lacks verified task linkage; re-verify with current task context.';
     // T12848: several PRs in one write are unambiguous — each `files:` path is
     // pinned to the merge of the PR that changed it (prMergeCommitForPath), and
     // every PR must be proven by an artifact it changed that was READ AT ITS OWN
@@ -3072,6 +3224,7 @@ export function checkTaskEvidenceContext(context, gate, atoms) {
         !atoms.some((atom) => atom.kind === 'test-run' ||
             atom.kind === 'qa-run' ||
             atom.kind === 'ci' ||
+            (atom.kind === 'deploy' && atom.satisfiesGates.includes(gate)) ||
             (atom.kind === 'tool' && (!atom.notApplicable || atom.nonCodeChange === true)))) {
         return `Code task ${context.task.id} requires an actual verification result for ${gate}; absence of a toolchain is not a passing result.`;
     }
@@ -3096,11 +3249,31 @@ export function checkTaskEvidenceContext(context, gate, atoms) {
         !atoms.some((atom) => atom.kind === 'ci')) {
         // T13745: a non-code-only change has no TypeScript to typecheck.
         const nonCode = atoms.some((atom) => atom.kind === 'qa-run' && atom.nonCodeChange === true);
-        const missing = ['typecheck', 'lint'].filter((check) => !(nonCode && check === 'typecheck') &&
-            !atoms.some((atom) => (atom.kind === 'qa-run' && atom.check === check) ||
-                (atom.kind === 'tool' && canonicalToolName(atom.tool) === check)));
-        if (missing.length > 0)
-            return `qaPassed with qa-run receipts needs a typecheck and a lint result; missing ${missing.join(' and ')}: add qa-run:<${missing[0]}-receipt.json> or tool:${missing[0]}.`;
+        // T14089: a check is owed only for the changed paths it reads, as the
+        // receipts judged them at bind time. A receipt bound without that
+        // judgement (older, or nothing judged) owes both, as before.
+        const receipts = atoms.flatMap((atom) => (atom.kind === 'qa-run' ? [atom] : []));
+        const owedPaths = (check) => receipts.some((r) => r.owedChecks === undefined)
+            ? null
+            : [...new Set(receipts.flatMap((r) => r.owedChecks?.[check] ?? []))];
+        const missing = ['typecheck', 'lint'].filter((check) => {
+            if (nonCode && check === 'typecheck')
+                return false;
+            const paths = owedPaths(check);
+            if (paths !== null && paths.length === 0)
+                return false;
+            return !atoms.some((atom) => (atom.kind === 'qa-run' && atom.check === check) ||
+                (atom.kind === 'tool' && canonicalToolName(atom.tool) === check));
+        });
+        if (missing.length > 0) {
+            const named = missing.map((check) => {
+                const paths = owedPaths(check);
+                return paths === null
+                    ? check
+                    : `${check} (it reads ${paths.slice(0, 5).join(', ')}${paths.length > 5 ? `, … (${paths.length})` : ''})`;
+            });
+            return `qaPassed with qa-run receipts needs a result for each check that reads the changed paths; missing ${named.join(' and ')}: add qa-run:<${missing[0]}-receipt.json> or tool:${missing[0]}.`;
+        }
         // T13580: receipts of one kind cover the change together; a check also
         // recorded as a whole-project tool: run needs no receipt coverage.
         const gap = qaRunUnionGapReason(atoms.filter((atom) => atom.kind === 'qa-run' &&
@@ -3128,8 +3301,13 @@ export function checkTaskEvidenceContext(context, gate, atoms) {
     if (classifyEvidenceTask(context) === 'code' &&
         gate === 'implemented' &&
         atoms.some((atom) => atom.kind === 'decision') &&
-        !atoms.some((atom) => atom.kind === 'commit' || atom.kind === 'pr'))
-        return 'A research decision alone cannot implement a code-fix task.';
+        !atoms.some((atom) => atom.kind === 'commit' || atom.kind === 'pr')) {
+        // T14193: when a gate profile was overridden, say which rule decided code.
+        const ignored = ignoredProfileReason(context.task);
+        return ignored === null
+            ? 'A research decision alone cannot implement a code-fix task.'
+            : `A research decision alone cannot implement a code-fix task: ${ignored}`;
+    }
     return null;
 }
 /**
@@ -3240,18 +3418,43 @@ export function decisionOnlyRouteNote(gate, implemented) {
 // ---------------------------------------------------------------------------
 // Gate minimum evaluation
 // ---------------------------------------------------------------------------
+/**
+ * Whether a probed `deploy:` atom stands for `gate` (T14083): only for the
+ * gates the project listed in `evidence.deploySatisfies` when it was verified.
+ * Static gate requirements never name `deploy`, so no gate takes one by default.
+ */
+function deploySatisfiesGate(gate, atoms) {
+    return atoms.some((atom) => atom.kind === 'deploy' && atom.satisfiesGates.includes(gate));
+}
+/**
+ * The profile whose extra combinations apply to these atoms (T14187): the
+ * task's, while every `files:` path is a document. A code path keeps the base
+ * requirements, so a profiled change that touched code still owes a commit
+ * or PR.
+ */
+function profileForAtoms(profile, atoms) {
+    if (!profile)
+        return null;
+    const paths = atoms.flatMap((atom) => atom.kind === 'files' ? atom.files.map((f) => f.path) : []);
+    return paths.every(isDocumentEvidencePath) ? profile : null;
+}
 /**
  * Check whether a set of validated atoms satisfies the minimum evidence
  * required for a given gate.
  *
  * @param gate - The gate being verified
  * @param atoms - Validated atoms
+ * @param profile - The task's gate profile ({@link evidenceProfileOf}); its
+ *   extra combinations apply while every `files:` path is a document (T14187).
  * @returns null when satisfied; otherwise the reason message
  *
  * @task T832
+ * @task T14187
  * @adr ADR-051 §2.3
  */
-export function checkGateEvidenceMinimum(gate, atoms) {
+export function checkGateEvidenceMinimum(gate, atoms, profile) {
+    if (deploySatisfiesGate(gate, atoms))
+        return null;
     // Delegate to the SSoT in @cleocode/contracts (T10337). validateEvidenceForGate
     // only inspects `.kind`; the post-validation EvidenceAtom union includes the
     // `override` kind which is never present here (override-evidence flows skip
@@ -3267,7 +3470,7 @@ export function checkGateEvidenceMinimum(gate, atoms) {
         const kind = atom.kind;
         projected.push({ kind });
     }
-    const result = validateEvidenceForGate(gate, projected);
+    const result = validateEvidenceForGate(gate, projected, profileForAtoms(profile, atoms));
     return result.ok ? null : result.message;
 }
 /**
@@ -3281,12 +3484,16 @@ export function checkGateEvidenceMinimum(gate, atoms) {
  *
  * @param gate - The gate being verified
  * @param atoms - Validated atoms
+ * @param profile - The task's gate profile, as for {@link checkGateEvidenceMinimum} (T14187).
  * @returns `null` when satisfied; `{ message, hint }` when not
  *
  * @task T9949
+ * @task T14187
  * @adr ADR-051 §2.3
  */
-export function checkGateEvidenceMinimumDetailed(gate, atoms) {
+export function checkGateEvidenceMinimumDetailed(gate, atoms, profile) {
+    if (deploySatisfiesGate(gate, atoms))
+        return null;
     const projected = [];
     for (const atom of atoms) {
         if (atom.kind === 'override')
@@ -3294,7 +3501,7 @@ export function checkGateEvidenceMinimumDetailed(gate, atoms) {
         const kind = atom.kind;
         projected.push({ kind });
     }
-    const result = validateEvidenceForGate(gate, projected);
+    const result = validateEvidenceForGate(gate, projected, profileForAtoms(profile, atoms));
     return result.ok ? null : { message: result.message, hint: result.hint };
 }
 /**
@@ -3343,7 +3550,8 @@ export function composeGateEvidence(atoms, capturedBy, override, overrideReason,
             return atom.kind === 'tool' ||
                 atom.kind === 'test-run' ||
                 atom.kind === 'qa-run' ||
-                atom.kind === 'ci'
+                atom.kind === 'ci' ||
+                atom.kind === 'ci-run'
                 ? [index]
                 : [];
         });
@@ -3395,7 +3603,13 @@ export function composeGateEvidence(atoms, capturedBy, override, overrideReason,
  * @task T13003
  */
 export async function boundHeadGapReason(task, atoms, projectRoot) {
-    const runs = atoms.filter((a) => (a.kind === 'test-run' || a.kind === 'qa-run' || a.kind === 'tool') &&
+    // T14083: a probed deployment is bound to the commit it serves.
+    // T14149: a repeat-run is bound to the commit it tested.
+    const runs = atoms.filter((a) => (a.kind === 'test-run' ||
+        a.kind === 'qa-run' ||
+        a.kind === 'tool' ||
+        a.kind === 'deploy' ||
+        a.kind === 'ci-run') &&
         typeof a.headSha === 'string');
     if (runs.length === 0)
         return null;
@@ -3468,7 +3682,11 @@ export async function boundHeadGapReason(task, atoms, projectRoot) {
             continue;
         const bound = run.kind === 'tool'
             ? `tool:${run.tool} ran at ${head.slice(0, 12)}`
-            : `${run.kind}:${run.path} was bound at ${head.slice(0, 12)}`;
+            : run.kind === 'deploy'
+                ? `deploy:${run.provider}/${run.deploymentId} serves ${head.slice(0, 12)}`
+                : run.kind === 'ci-run'
+                    ? `ci-run:${run.runId} (${run.test} x${run.runs}) tested ${head.slice(0, 12)}`
+                    : `${run.kind}:${run.path} was bound at ${head.slice(0, 12)}`;
         if (missing !== null) {
             return (`${bound}, and git cannot read the commits that relate it to ${task.id}'s implemented ` +
                 `commit ${shas} (missing object, or a shallow clone: ${missing}). ` +
@@ -3483,6 +3701,15 @@ export async function boundHeadGapReason(task, atoms, projectRoot) {
                 'the branch was rebased, amended or squash-merged after implemented was recorded. ' +
                 `Re-record implemented (cleo verify ${task.id} --gate implemented ...), then the run.`);
         }
+        if (run.kind === 'ci-run') {
+            return (`${bound}, which does not contain ${task.id}'s implemented commit ${shas}: dispatch ` +
+                'repeat-run.yml on the default branch after the change merged, and record that run.');
+        }
+        if (run.kind === 'deploy') {
+            return (`${bound}, which does not contain ${task.id}'s implemented commit ${shas} (neither an ` +
+                'ancestor nor a patch-equivalent copy): that deployment predates or excludes the change. ' +
+                'Deploy a build that contains it and probe that deployment.');
+        }
         return (`${bound}, which never saw ${task.id}'s implemented commit ${shas}: it tested other ` +
             "work (another task's checkout, or a commit before the change). Run the tests on this " +
             "task's checkout and record that report.");
@@ -3514,8 +3741,11 @@ export async function taskEvidenceKindReport(task, projectRoot, extraPaths = [],
     const kind = classifyEvidenceTask({ task });
     // T14048: a task its record leaves undecided is classified by what it changed.
     const undecided = kind === 'code' && declaredEvidenceKind(task) === null;
-    if (kind === 'code' && !undecided)
-        return { kind };
+    if (kind === 'code' && !undecided) {
+        // T14193: a profile the record overrides is named, with the deciding rule.
+        const ignored = ignoredProfileReason(task);
+        return ignored === null ? { kind } : { kind, reason: ignored };
+    }
     // T13474: a gate profile never covers code evidence, wherever it points.
     const profile = gateProfileOf(task);
     const codeAtom = profile === null ? null : implementedCodeEvidence(task);
@@ -3681,7 +3911,9 @@ export async function revalidateEvidence(evidence, projectRoot, gate, taskId, op
         const accessor = await getTaskAccessor(resolveCanonicalProjectRoot(projectRoot));
         const task = await accessor.loadSingleTask(taskId);
         if (!task)
-            throw new CleoError(ExitCode.NOT_FOUND, `Evidence task ${taskId} is missing`);
+            throw new CleoError(ExitCode.NOT_FOUND, `Evidence task ${taskId} is missing`, {
+                fix: `cleo find "${taskId}"`,
+            });
         const context = {
             task,
             gates: [gate],
@@ -3694,7 +3926,7 @@ export async function revalidateEvidence(evidence, projectRoot, gate, taskId, op
             !(classifyEvidenceTask(context) !== 'code' &&
                 isDecisionOnlyImplementation(task.verification?.evidence?.implemented) &&
                 DECISION_ONLY_RELAXED_GATES.includes(gate))) {
-            reason = checkGateEvidenceMinimum(gate, evidence.atoms);
+            reason = checkGateEvidenceMinimum(gate, evidence.atoms, evidenceProfileOf(task));
         }
         if (!reason && evidence.scope) {
             if (evidence.scope.taskId !== taskId || evidence.scope.gate !== gate)
@@ -3913,6 +4145,20 @@ export async function revalidateEvidence(evidence, projectRoot, gate, taskId, op
                     failed.push({ atom, reason: recheck.reason });
                 break;
             }
+            case 'ci-run': {
+                // T14149: a re-run of the repeat-run that went red, or a run that moved
+                // to another commit, no longer stands; containment is re-checked above.
+                const { recheckCiRunAtom } = await import('../release/ci-run-evidence.js');
+                const recheck = recheckCiRunAtom(atom, resolveEvidenceExecutionRoot(projectRoot));
+                if (!recheck.ok)
+                    failed.push({ atom, reason: recheck.reason });
+                break;
+            }
+            case 'deploy':
+                // T14083: the probe is not re-run (the deployment may have moved on
+                // since); the SHA containment it carries is re-checked above, through
+                // boundHeadGapReason.
+                break;
             case 'pr':
                 // PR atoms capture (prNumber, mergedAt, mergeCommitSha) at verify
                 // time. A merged PR's mergedAt is immutable, so the atom is trusted