@cleocode/core 2026.10.27 → 2026.11.1-canary.10

package/dist/tasks/gate-runner.js

@@ -30,7 +30,7 @@ import { constants, mkdirSync, readFileSync, realpathSync, renameSync, writeFile
 import { lstat, open, readFile, realpath, stat } from 'node:fs/promises';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
-import { acceptanceGateResultSchema, acceptanceGateSchema, testCountReportSchema, testCountSummarySchema, } from '@cleocode/contracts/acceptance-gate-schema.js';
+import { acceptanceGateResultSchema, acceptanceGateSchema, testCountSummarySchema, } from '@cleocode/contracts/acceptance-gate-schema.js';
 import { findOnPath } from '@cleocode/paths';
 import { resolveOriginDefault } from '../git/base-ref.js';
 import { discoveryEnv } from '../git/work-tree.js';
@@ -42,11 +42,13 @@ import { captureWrapped } from '../resources/spawn-wrapper.js';
 import { createAttachmentStore } from '../store/attachment-store.js';
 import { registerTeardownAbort } from '../teardown-signal.js';
 import { acItemToText, acTextHash } from './ac-table.js';
+import { commandGateCmdProblem } from './command-gate-cmd.js';
 import { splitCommandLine } from './command-line.js';
 import { resolveCanonicalProjectRoot } from './evidence.js';
-import { resolveEvidenceTree } from './evidence-tree.js';
-import { buildGateCacheEntryBody, captureGateCacheState, describeGateCacheMiss, evidenceCacheKeyPath, gateCacheEntryPath, readGateCacheEntry, sealGateCacheEntry, } from './gate-result-cache.js';
+import { resolveEvidenceRepository, resolveEvidenceTree } from './evidence-tree.js';
+import { buildGateCacheEntryBody, captureGateCacheState, describeGateCacheMiss, evidenceCacheKeyPath, gateCacheEntryPath, isCacheableGate, readGateCacheEntry, sealGateCacheEntry, } from './gate-result-cache.js';
 import { planHeavyToolEnv, vitestWorkerCeiling } from './heavy-tool-env.js';
+import { readParsedTestReport, readTestReport, TEST_REPORT_FORMATS, } from './test-report-counts.js';
 import { resolveSpawnTimeoutMs } from './tool-cache.js';
 import { acquireGlobalSlot } from './tool-semaphore.js';
 // ─── Constants ────────────────────────────────────────────────────────────────
@@ -183,6 +185,85 @@ function loadEvidenceCacheKey() {
         return null;
     }
 }
+/**
+ * Read (never create) the per-machine evidence cache key, for a read-only
+ * probe (T14138). `null` when it does not exist yet or cannot be read.
+ */
+function readEvidenceCacheKey() {
+    try {
+        const hex = readFileSync(evidenceCacheKeyPath(), 'utf-8').trim();
+        return /^[0-9a-f]{64}$/.test(hex) ? Buffer.from(hex, 'hex') : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether the evidence cache holds a sealed pass for one typed gate in the
+ * tree and environment the next evidence write would use (T14138), so
+ * `cleo done --plan` can report a pass `cleo verify --run` cached instead of
+ * calling it not-run. Read-only: it runs no gate, writes no entry and never
+ * creates the machine key. The inputs digest is computed as
+ * {@link runTaskGates} computes it, so a hit here is a hit for the write.
+ *
+ * @param task - Task that owns the gate.
+ * @param gate - The typed gate.
+ * @param execution - Admitted lifetime whose project root scopes the probe.
+ * @param env - Environment the gate would launch with.
+ * @returns A hit with its time, a miss naming the key part that moved (when a
+ *   recent entry explains it), or why the cache cannot be consulted.
+ * @task T14138
+ */
+export async function probeTypedGateCache(task, gate, execution, env = process.env) {
+    if (!TOOL_GATE_KINDS.has(gate.kind) || !isCacheableGate(gate))
+        return { status: 'unavailable', reason: `a ${gate.kind} gate is never cached` };
+    const root = resolve(execution.identity.projectRoot);
+    let gateRoot;
+    try {
+        gateRoot = gateTreeFor(gate, resolveTypedGateRoot(root, undefined, undefined, task.id), root);
+    }
+    catch (error) {
+        return {
+            status: 'unavailable',
+            reason: error instanceof Error ? error.message : String(error),
+        };
+    }
+    const state = await captureGateCacheState(gateRoot);
+    if (state === null)
+        return { status: 'unavailable', reason: 'the gate tree is not a git checkout' };
+    const key = readEvidenceCacheKey();
+    if (key === null)
+        return {
+            status: 'unavailable',
+            reason: `no readable machine key at ${evidenceCacheKeyPath()}`,
+        };
+    const { invocation, refusal } = resolveInvocation(gate, gateRoot, { ...env });
+    if (refusal !== undefined)
+        return { status: 'unavailable', reason: refusal };
+    let artifacts;
+    try {
+        artifacts = await snapshotGateInputs(task, gate, invocation, execution, gateRoot);
+    }
+    catch (error) {
+        return {
+            status: 'unavailable',
+            reason: `its inputs could not be captured: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    const inputsHash = gateInputsHash(invocation, artifacts);
+    const lookup = readGateCacheEntry(root, gate, state, inputsHash, key);
+    if (lookup.status === 'hit')
+        return { status: 'hit', cachedAt: lookup.createdAt };
+    if (lookup.status === 'invalid')
+        return { status: 'unavailable', reason: lookup.reason };
+    return {
+        status: 'miss',
+        why: describeGateCacheMiss(root, gate, state, inputsHash, {
+            environmentHash: invocation?.environmentHash ?? null,
+            artifacts,
+        }),
+    };
+}
 /**
  * Seal and store a pass this runner EXECUTED itself. Module-private for the same
  * reason as {@link loadEvidenceCacheKey}: only an observed execution is cached.
@@ -240,7 +321,8 @@ export async function captureGateInputsHash(task, gate, execution, env = process
  * @task T13693
  */
 export async function captureGateInputs(task, gate, execution, env = process.env) {
-    const tree = resolveTypedGateRoot(resolve(execution.identity.projectRoot), undefined, undefined, task.id);
+    const storeRoot = resolve(execution.identity.projectRoot);
+    const tree = gateTreeFor(gate, resolveTypedGateRoot(storeRoot, undefined, undefined, task.id), storeRoot);
     const invocation = executableInvocation(gate, tree, { ...env });
     const artifacts = await snapshotGateInputs(task, gate, invocation, execution, tree);
     return {
@@ -305,6 +387,28 @@ env = process.env, taskId = null) {
     const tree = real(resolveEvidenceTree(projectRoot, taskId, cwd, env, ofThisProject).root);
     return tree === root ? projectRoot : tree;
 }
+/**
+ * The tree ONE typed gate runs in, captures its inputs in and is revalidated
+ * in: the declared evidence repository its `repo` names (T14078), else
+ * `tree` ({@link resolveTypedGateRoot}).
+ *
+ * @param gate - The typed gate.
+ * @param tree - The task's typed-gate tree.
+ * @param storeRoot - CLEO store root, whose project context declares repositories.
+ * @returns The checkout root the gate uses.
+ * @throws When `repo` names a repository the project does not declare, or
+ *   one whose path is not a checkout's root.
+ * @task T14078
+ */
+export function gateTreeFor(gate, tree, storeRoot) {
+    if (gate.repo === undefined)
+        return tree;
+    const repo = resolveEvidenceRepository(storeRoot, gate.repo);
+    // @sync-invariant none:input-shape a typed gate naming an undeclared repository is refused before it runs; nothing is written
+    if (!repo.ok)
+        throw new Error(`Typed gate ${gate.req ?? gate.description}: ${repo.reason}`);
+    return repo.root;
+}
 /**
  * Admission for a batch run without a caller-owned lifetime.
  * An invalid deadline override is not swallowed: {@link runOneGate} resolves it
@@ -381,9 +485,19 @@ export async function runGates(gates, options = {}) {
     if (cacheMode !== 'off' && (snapshot.length !== 1 || !cacheInputsHash))
         throw new Error('Typed gate caching requires one gate per batch and its inputs digest');
     // T12621: the repo state is captured only when the policy reads or writes.
-    const cacheState = cacheMode !== 'off' && TOOL_GATE_KINDS.has(snapshot[0].kind)
-        ? await captureGateCacheState(treeRoot)
-        : null;
+    let cacheState = null;
+    if (cacheMode !== 'off' && TOOL_GATE_KINDS.has(snapshot[0].kind)) {
+        // T14078: keyed to the HEAD of the tree the gate runs in; a refused
+        // repository leaves the state unset and the loop reports the refusal.
+        let cacheTree = null;
+        try {
+            cacheTree = gateTreeFor(snapshot[0], treeRoot, projectRoot);
+        }
+        catch {
+            cacheTree = null;
+        }
+        cacheState = cacheTree === null ? null : await captureGateCacheState(cacheTree);
+    }
     const cacheKey = cacheState ? loadEvidenceCacheKey() : null;
     const results = [];
     try {
@@ -401,6 +515,7 @@ export async function runGates(gates, options = {}) {
                     const parsed = acceptanceGateSchema.parse(gate);
                     if (!isDeepStrictEqual(parsed, gate))
                         throw new Error('Gate includes unsupported or noncanonical fields');
+                    const gateRoot = gateTreeFor(parsed, treeRoot, projectRoot);
                     if (cacheState && cacheKey && (cacheMode === 'use' || cacheMode === 'only')) {
                         const lookup = readGateCacheEntry(projectRoot, parsed, cacheState, cacheInputsHash, cacheKey);
                         if (lookup.status === 'hit') {
@@ -428,7 +543,7 @@ export async function runGates(gates, options = {}) {
                         throw new Error(`${gateNotCachedMessage(parsed, cacheState !== null, cacheKey !== null)}${why ? ` ${why}` : ''}`);
                     }
                     const observed = {
-                        ...(await runOneGate(parsed, i, treeRoot, options.skipManual ?? true, batch, projectRoot)),
+                        ...(await runOneGate(parsed, i, gateRoot, options.skipManual ?? true, { ...batch, cwd: gateRoot }, projectRoot)),
                         source: 'executed',
                     };
                     if (cacheState && cacheKey && cacheMode !== 'only')
@@ -634,20 +749,30 @@ export async function runTaskGates(task, criteria, options) {
             // quote) becomes ITS OWN `error` result. Throwing here rejected the whole
             // batch, and the verify engine turned that into E_GENERAL, discarding
             // every other gate's verdict.
-            const { invocation, refusal: invocationRefusal } = resolveInvocation(gate, tree, env);
+            // T14078: a gate naming a declared evidence repository runs there; an
+            // undeclared one is this gate's error, never a run in another tree.
+            let gateRoot = tree;
+            let repoRefusal;
+            try {
+                gateRoot = gateTreeFor(gate, tree, root);
+            }
+            catch (error) {
+                repoRefusal = error instanceof Error ? error.message : String(error);
+            }
+            const { invocation, refusal: invocationRefusal } = resolveInvocation(gate, gateRoot, env);
             // T13527: an input that cannot be captured (an ambiguous symlink, an
             // escape) is THIS gate's error, not a rejection of every gate in the
             // batch. A cancellation still propagates.
             let artifacts = [];
             let snapshotRefusal;
             try {
-                artifacts = await snapshotGateInputs(snapshot, gate, invocation, execution, tree);
+                artifacts = await snapshotGateInputs(snapshot, gate, invocation, execution, gateRoot);
             }
             catch (error) {
                 execution.assertActive();
                 snapshotRefusal = `Typed gate inputs could not be captured: ${error instanceof Error ? error.message : String(error)}`;
             }
-            const refusal = invocationRefusal ?? snapshotRefusal;
+            const refusal = repoRefusal ?? invocationRefusal ?? snapshotRefusal;
             const binding = {
                 version: 1,
                 verificationId,
@@ -661,7 +786,7 @@ export async function runTaskGates(task, criteria, options) {
                 ...(invocation ? { invocation } : {}),
                 artifacts,
             };
-            const treeBinding = captureTreeBinding(tree, invocation, artifacts);
+            const treeBinding = captureTreeBinding(gateRoot, invocation, artifacts);
             if (treeBinding)
                 binding.tree = treeBinding;
             const observed = refusal
@@ -698,7 +823,7 @@ export async function runTaskGates(task, criteria, options) {
                 // A gate whose inputs were never captured has nothing to compare.
                 const after = snapshotRefusal
                     ? artifacts
-                    : await snapshotGateInputs(snapshot, gate, invocation, execution, tree);
+                    : await snapshotGateInputs(snapshot, gate, invocation, execution, gateRoot);
                 if (!isDeepStrictEqual(after, artifacts))
                     throw new Error('Verification inputs changed during execution');
             }
@@ -924,7 +1049,7 @@ function rebindCommand(task, tree) {
 }
 /** Revalidate the stored result of the typed gate at `index`; throws when it does not stand. */
 async function revalidateTypedResult(scope, index, gate) {
-    const { task, rows, results, execution, root, tree, env, requirePassing } = scope;
+    const { task, rows, results, execution, root, env, requirePassing } = scope;
     execution.assertActive();
     const matches = results.filter((result) => result.index === index);
     if (matches.length !== 1)
@@ -934,6 +1059,8 @@ async function revalidateTypedResult(scope, index, gate) {
     if (stale)
         throw new Error(`Typed requirement ${gate.req ?? index} ${stale}`);
     const binding = result.binding;
+    // T14078: revalidated in the tree it runs in, its declared repository when it names one.
+    const tree = gateTreeFor(gate, scope.tree, root);
     // A refused command is bound without an invocation (T12718 review), so it
     // revalidates as the unmet `error` it was recorded as.
     const { invocation: resolved } = resolveInvocation(gate, tree, env);
@@ -1246,6 +1373,13 @@ export function executableInvocation(gate, root, env) {
     const [testCommand, ...testArgs] = gate.kind === 'test' ? splitCommandLine(gate.command) : [];
     if (gate.kind === 'test' && testCommand === undefined)
         throw new Error('Test gate command is empty');
+    // T14155: a stored command gate whose cmd carries its arguments would spawn
+    // a program named the whole line and fail with a bare ENOENT. Every run path
+    // (preview, verify --run, done) resolves its invocation here first.
+    const cmdProblem = commandGateCmdProblem(gate, root);
+    // @sync-invariant none:input-shape a stored gate's cmd shape is refused before it spawns; nothing is written
+    if (cmdProblem !== null)
+        throw new Error(cmdProblem);
     const command = gate.kind === 'test'
         ? testCommand
         : gate.kind === 'command'
@@ -1674,6 +1808,37 @@ function matchingBrace(text, start) {
     }
     return -1;
 }
+/**
+ * A report the shared reader (T14124) read, as gate counts; a refusal is
+ * recorded in `refusals` (prefixed with where it was found) and yields null.
+ */
+function gateCounts(read, where, refusals) {
+    if (read === null)
+        return null;
+    if (!read.ok) {
+        refusals.push(`${where} is a ${read.format} report that was refused: ${read.reason}`);
+        return null;
+    }
+    const { passed, failed, total, failure } = read.counts;
+    return {
+        numPassedTests: passed,
+        numFailedTests: failed,
+        numTotalTests: total,
+        success: failed === 0 && failure === undefined,
+    };
+}
+/**
+ * Whether a read report is a bare counter summary (runner summary or
+ * node --test counters with no per-test results), which a gate accepts only as
+ * its whole stdout or its report file (T14132).
+ */
+function isBareSummary(read) {
+    if (read.format !== 'runner summary JSON' && read.format !== 'node --test summary JSON')
+        return false;
+    const files = read.report.testResults;
+    return !(Array.isArray(files) &&
+        files.some((f) => Array.isArray(f.assertionResults) && f.assertionResults.length > 0));
+}
 /** Top-level keys that mark a JSON object as an attempted test-count report. */
 const COUNT_REPORT_KEYS = ['numTotalTests', 'numPassedTests', 'numFailedTests', 'testResults'];
 /**
@@ -1695,57 +1860,12 @@ function looksLikeCountReport(value) {
         value !== null &&
         COUNT_REPORT_KEYS.some((key) => Object.hasOwn(value, key)));
 }
-/**
- * Counts from node:test TAP output (`node --test --test-reporter=tap`, also
- * via `tsx --test`), which ships no JSON reporter (T14051). The run's LAST
- * top-level plan (`1..N` at column 0) must be followed by its `# tests N`,
- * `# pass N` and `# fail N` summary; `# cancelled N` counts as failed. Test
- * console output is re-emitted as indented or `# ` comment lines before that
- * plan, so it cannot forge the summary.
- *
- * @param stdout - The run's captured stdout.
- * @returns Counts, a refusal reason, or null when the output is not TAP.
- * @task T14051
- */
-function tapTestCounts(stdout) {
-    const lines = stdout.split(/\r?\n/);
-    if (!lines.some((line) => /^TAP version \d+$/.test(line.trim())))
-        return null;
-    if (lines.some((line) => /^\s*Bail out!/.test(line)))
-        return { refusal: 'its TAP output contains "Bail out!"' };
-    const plan = lines.findLastIndex((line) => /^1\.\.\d+(?:\s|$)/.test(line));
-    if (plan === -1)
-        return { refusal: 'its TAP output has no top-level 1..N plan' };
-    const summary = new Map();
-    for (const line of lines.slice(plan + 1)) {
-        const match = line.match(/^# (tests|pass|fail|cancelled) (\d+)$/);
-        if (match)
-            summary.set(match[1], Number(match[2]));
-    }
-    const tests = summary.get('tests');
-    const pass = summary.get('pass');
-    const fail = summary.get('fail');
-    if (tests === undefined || pass === undefined || fail === undefined)
-        return {
-            refusal: 'its TAP output has no "# tests", "# pass" and "# fail" summary after the plan',
-        };
-    if (tests === 0 || /^1\.\.0(?:\s|$)/.test(lines[plan]))
-        return { refusal: 'its TAP output reports zero tests' };
-    const failed = fail + (summary.get('cancelled') ?? 0);
-    return {
-        numPassedTests: pass,
-        numFailedTests: failed,
-        numTotalTests: tests,
-        success: failed === 0,
-    };
-}
 /**
  * Structured test counts emitted by THIS gate's own process, or `null`.
  *
- * Validated with {@link testCountReportSchema} — the contract written for
- * exactly this purpose, which cross-checks every summary counter against the
- * individual assertion results, so a report cannot claim a total its own
- * details contradict.
+ * Read by the shared count reader ({@link readParsedTestReport}, T14124),
+ * which cross-checks the counters against the individual test results, so a
+ * report cannot claim a total its own details contradict.
  *
  * The whole captured stream is searched rather than requiring `stdout` to BE
  * the document, because a runner that writes a JSON report to stdout routinely
@@ -1758,7 +1878,8 @@ function tapTestCounts(stdout) {
  *
  * A non-runner command (a wrapper script) may instead print a bare count
  * summary ({@link testCountSummarySchema}) as its last stdout line (T13753),
- * and node:test may print TAP ({@link tapTestCounts}, T14051).
+ * and node:test may print TAP (T14051). TAP and every JSON candidate are read
+ * by the reader `test-run:` uses ({@link readTestReport}, T14124).
  *
  * A candidate that parses as a count report but fails its schema is recorded
  * in `refusals` with its first issue (T14060), so the error can say which
@@ -1768,13 +1889,15 @@ function tapTestCounts(stdout) {
  * @param refusals - Receives why each report-like candidate was refused, in the order the
  *   candidates are tried (last stdout line, TAP, then the output newest-first); the
  *   first is the one reported.
+ * @param cwd - The run's cwd, where TAP test file names resolve (T14161).
  * @returns Validated counts, or `null` when the run emitted no usable report.
  * @task T12308
  * @task T13753
  * @task T14051
  * @task T14060
+ * @task T14161
  */
-function structuredTestCounts(captured, refusals) {
+function structuredTestCounts(captured, refusals, cwd) {
     const lastLine = captured.stdout.trimEnd().split('\n').at(-1)?.trim() ?? '';
     if (lastLine.startsWith('{')) {
         try {
@@ -1790,26 +1913,36 @@ function structuredTestCounts(captured, refusals) {
             // Not JSON: fall through to the full-report search.
         }
     }
-    const tap = tapTestCounts(captured.stdout);
-    if (tap !== null) {
-        if ('refusal' in tap) {
-            refusals.push(tap.refusal);
-            return null;
-        }
-        return tap;
-    }
+    // T14124: TAP through the reader `test-run:` uses.
+    if (/^TAP version \d+$/m.test(captured.stdout))
+        return gateCounts(readTestReport(captured.stdout, { cwd }), 'its TAP output', refusals);
+    // T14124: a report that IS the whole stdout, in any format `test-run:` reads
+    // (JUnit XML and libtest JSON lines included).
+    const whole = readTestReport(captured.stdout.trim());
+    if (whole !== null)
+        return gateCounts(whole, 'its output', refusals);
     const text = `${captured.stdout}\n${captured.stderr}`.trim();
     if (text.length === 0)
         return null;
+    let embeddedSummary = false;
     const tryParse = (candidate) => {
         try {
             const raw = JSON.parse(candidate);
-            const report = testCountReportSchema.safeParse(raw);
-            if (report.success)
-                return report.data;
-            if (looksLikeCountReport(raw))
-                refusals.push(`a JSON report in its output fails the full report shape (${firstSchemaIssue(report.error)})`);
-            return null;
+            // T14124: the reader `test-run:` uses, so every shape it reads counts here.
+            const read = readParsedTestReport(raw);
+            // T14132: a bare counter summary found INSIDE the output (any test can
+            // print `{"total":5,"passed":5}`) proves nothing; only the whole stdout or
+            // the gate's report file may be one. Full reports embedded in noise count.
+            if (read?.ok && isBareSummary(read)) {
+                if (!embeddedSummary)
+                    refusals.push(`a ${read.format} object inside its output is not counted; only the whole stdout ` +
+                        "or the gate's report file may be a summary-shaped report. Make the summary the " +
+                        "command's entire stdout (nothing else printed), or write it to a file the gate " +
+                        'names (--outputFile) or announces ("JSON report written to <path>")');
+                embeddedSummary = true;
+                return null;
+            }
+            return gateCounts(read, 'a JSON report in its output', refusals);
         }
         catch {
             return null;
@@ -1919,23 +2052,26 @@ async function fileStamp(path) {
  * @param before - Each candidate's stamp just before the spawn.
  * @param startedAt - Epoch ms just before the spawn.
  * @param refusals - Receives why a fresh report that failed its schema was refused (T14060).
+ * @param cwd - The run's cwd, where TAP test file names resolve (T14161).
  * @returns Validated counts, or null.
  * @task T13782
  * @task T14060
  */
-async function freshReportCounts(before, startedAt, refusals) {
+async function freshReportCounts(before, startedAt, refusals, cwd) {
     for (const [path, was] of before) {
         const now = await fileStamp(path);
         if (now === null || now.mtimeMs < startedAt || (was !== null && was.sha256 === now.sha256))
             continue;
         try {
-            const raw = JSON.parse(await readFile(path, 'utf-8'));
-            if (typeof raw.startTime === 'number' && raw.startTime < startedAt)
+            // T14124: any format `test-run:` reads (JUnit XML, libtest, JSON, TAP).
+            const read = readTestReport(await readFile(path, 'utf-8'), { cwd });
+            if (read?.ok &&
+                typeof read.report.startTime === 'number' &&
+                read.report.startTime < startedAt)
                 continue;
-            const report = testCountReportSchema.safeParse(raw);
-            if (report.success)
-                return report.data;
-            refusals.push(`${path} fails the full report shape (${firstSchemaIssue(report.error)})`);
+            const counts = gateCounts(read, path, refusals);
+            if (counts !== null)
+                return counts;
         }
         catch {
             // Unreadable or not JSON: not a report of this run.
@@ -1973,13 +2109,13 @@ function describeMissingTestCount(gate, refusal) {
         ? `\`${invoked}\` emitted no machine-readable test report`
         : `\`${invoked}\` emitted a test report that was refused: ${refusal}`;
     return (`minCount ${gate.minCount} cannot be proved: ${found}, and an exit code alone carries no ` +
-        `count. Add a reporter to the gate command itself (e.g. \`${invoked} ${flag}\`) so the run ` +
-        `that is being attested is the run that is counted. Accepted: a full Vitest/Jest JSON report ` +
-        `(numTotalTests, numPassedTests, numFailedTests, numPendingTests, numTodoTests, the four ` +
-        `numTotal/Passed/Failed/PendingTestSuites counters, success, testResults[].assertionResults, ` +
-        `counters equal to the assertions); a bare summary as the LAST stdout line, at minimum ` +
-        `{"numPassedTests":N} (numFailedTests, numTotalTests and success optional, no testResults); ` +
-        `or node:test TAP (--test-reporter=tap) with its 1..N plan and # tests/# pass/# fail summary. ` +
+        `count. Formats tried: ${TEST_REPORT_FORMATS.join(', ')}, and a bare count summary as the ` +
+        `LAST stdout line (at minimum {"numPassedTests":N}). These are the formats \`test-run:\` ` +
+        `reads, among them a full Vitest/Jest JSON report (numTotalTests, numPassedTests, ` +
+        `numFailedTests, numPendingTests, numTodoTests, testResults[].assertionResults); a report's ` +
+        `counters must add up and agree with its own test results. Add a reporter ` +
+        `to the gate command itself (e.g. \`${invoked} ${flag}\`) so the run that is being attested ` +
+        `is the run that is counted. ` +
         `A report file this run writes (its --outputFile, or ${REDIRECTED_JSON_REPORT}) is read too, ` +
         `but one produced by a separate invocation is deliberately not accepted \u2014 it is not bound ` +
         `to this execution; record that as \`test-run:<path>\` evidence instead, or drop minCount if ` +
@@ -2021,6 +2157,10 @@ export function outputReportsFailure(stdout) {
     return /\bFAIL\b|failing|Error:|\b[1-9]\d*\s+fail(?:ed|ures?)\b/i.test(stdout.replace(PASSING_TEST_LINE, '').replace(ZERO_FAILURE_COUNT, ''));
 }
 async function runTestGate(gate, index, projectRoot, timeoutMs, context) {
+    // Keep a direct call's refusal (T14155) an error verdict, not a rejection.
+    const cmdProblem = commandGateCmdProblem(gate, projectRoot);
+    if (cmdProblem !== null)
+        return makeResult(index, gate, 'error', 0, undefined, cmdProblem);
     const invocation = executableInvocation(gate, projectRoot, context.env ?? process.env);
     // T13782: a JSON reporter redirected to a file still yields this run's counts.
     const reportFiles = reportFileCandidates(invocation.args, invocation.cwd);
@@ -2035,8 +2175,8 @@ async function runTestGate(gate, index, projectRoot, timeoutMs, context) {
     if (announced !== null && !before.has(announced))
         before.set(announced, null);
     const refusals = [];
-    const counts = structuredTestCounts(captured, refusals) ??
-        (await freshReportCounts(before, startedAt, refusals));
+    const counts = structuredTestCounts(captured, refusals, invocation.cwd) ??
+        (await freshReportCounts(before, startedAt, refusals, invocation.cwd));
     // T12308: the counts come from this run's own validated report; only their
     // ABSENCE is an error, because inferring a count from exit zero is the thing
     // that must not happen. T13753: the error keeps the run's execution record.