@codyswann/lisa 4.54.13 → 4.55.0

package/scripts/two-channel-couplings.json

@@ -5,103 +5,103 @@
   },
   "staleness": {
     "create-github-issue-on-failure.yml::scripts/nightly-e2e-provider-action.mjs": {
-      "detects": "existence-only",
-      "reason": "The read files a tracker issue after a nightly failure; it posts no required check and gates no merge. A stale copy files a slightly wrong issue body, which a human reads and corrects, rather than turning a merge green or red from superseded logic. The harm this classification exists to catch is a verdict nobody can see is old, and this coupling produces no verdict."
+      "decision": "not-needed",
+      "reason": "Advisory transport, not a verdict. The script files and reconciles a tracker issue about a nightly run that has ALREADY failed; it posts no check context and no job depends on its answer. A superseded copy files a differently-shaped issue, which lands in front of a human who can see it — the visible failure, not the believed-red one this dimension exists to catch. A handshake here would gate issue filing on a version comparison and buy no cover."
     },
     "create-jira-issue-on-failure.yml::scripts/nightly-e2e-provider-action.mjs": {
-      "detects": "existence-only",
-      "reason": "Same provider action as the GitHub arm, same reasoning: it files a tracker issue after a nightly failure, posts no required check, and gates no merge. A stale copy misformats a report a human reads; it cannot produce a merge verdict derived from superseded logic."
+      "decision": "not-needed",
+      "reason": "Advisory transport, not a verdict. The script files and reconciles a tracker issue about a nightly run that has ALREADY failed; it posts no check context and no job depends on its answer. A superseded copy files a differently-shaped issue, which lands in front of a human who can see it — the visible failure, not the believed-red one this dimension exists to catch. A handshake here would gate issue filing on a version comparison and buy no cover."
     },
     "create-linear-issue-on-failure.yml::scripts/nightly-e2e-provider-action.mjs": {
-      "detects": "existence-only",
-      "reason": "Same provider action as the GitHub and Jira arms, same reasoning: it files a tracker issue after a nightly failure, posts no required check, and gates no merge. A stale copy degrades a report rather than a verdict."
+      "decision": "not-needed",
+      "reason": "Advisory transport, not a verdict. The script files and reconciles a tracker issue about a nightly run that has ALREADY failed; it posts no check context and no job depends on its answer. A superseded copy files a differently-shaped issue, which lands in front of a human who can see it — the visible failure, not the believed-red one this dimension exists to catch. A handshake here would gate issue filing on a version comparison and buy no cover."
     },
     "create-sentry-issue-on-failure.yml::scripts/nightly-e2e-provider-action.mjs": {
-      "detects": "existence-only",
-      "reason": "Same provider action as the other three failure arms, same reasoning: it files an issue after a nightly failure, posts no required check, and gates no merge. A stale copy degrades a report rather than a verdict."
+      "decision": "not-needed",
+      "reason": "Advisory transport, not a verdict. The script files and reconciles a tracker issue about a nightly run that has ALREADY failed; it posts no check context and no job depends on its answer. A superseded copy files a differently-shaped issue, which lands in front of a human who can see it — the visible failure, not the believed-red one this dimension exists to catch. A handshake here would gate issue filing on a version comparison and buy no cover."
     },
     "maestro-native-e2e.yml::scripts/classify-maestro-failures.mjs": {
-      "detects": "existence-only",
-      "reason": "Classifies native E2E failures for the run summary so an operator can tell an infrastructure flake from a product regression. It labels a failure that has already been decided elsewhere; it does not decide one. A stale classifier mislabels a red the operator is already looking at, which is visible in the same output."
+      "decision": "not-needed",
+      "reason": "Advisory classifier over a failure that has already happened. The step carries `exit-zero` and `failure-suppression`, and the job's verdict comes from the suite it annotates rather than from this script — a superseded copy mislabels a failure, it cannot invent or suppress one. Not verdict-bearing, so a handshake is cost without cover."
     },
     "nightly-e2e-health.yml::scripts/check-nightly-e2e-health.mjs": {
-      "detects": "version-handshake"
+      "decision": "handshake"
     },
     "nightly-e2e-health.yml::scripts/nightly-e2e-suites.schema.json": {
-      "detects": "existence-only",
-      "reason": "A JSON schema has no executable surface, so it cannot answer a contract-version call at all — no handshake is constructible here. It is covered transitively rather than left unguarded: the schema and check-nightly-e2e-health.mjs ship on the same typescript/copy-overwrite lane and are read by the same workflow, and that checker DOES handshake, so a tree old enough to carry a stale schema carries a stale checker and the existing handshake fails first."
+      "decision": "not-needed",
+      "reason": "Data, not logic: a JSON schema has no branch that can reach a wrong verdict, only a shape that does or does not validate. Its one reader is `scripts/check-nightly-e2e-health.mjs`, which DOES carry a version handshake, so the vintage of the pair is already named in the run output — a second handshake on the schema would restate an answer that is already given."
     },
     "nightly-e2e-report.yml::scripts/check-nightly-e2e-health.mjs": {
-      "detects": "version-handshake"
+      "decision": "handshake"
     },
     "nightly-e2e-tracking.yml::scripts/reconcile-nightly-e2e-tracking.mjs": {
-      "detects": "existence-only",
-      "reason": "Reconciles the nightly tracking issue — opens, refreshes or closes it to match the latest health verdict. It consumes a verdict rather than producing one, so a stale copy mismanages a tracking issue a human reads and cannot make a merge gate green."
+      "decision": "not-needed",
+      "reason": "Advisory transport, not a verdict. The script files and reconciles a tracker issue about a nightly run that has ALREADY failed; it posts no check context and no job depends on its answer. A superseded copy files a differently-shaped issue, which lands in front of a human who can see it — the visible failure, not the believed-red one this dimension exists to catch. A handshake here would gate issue filing on a version comparison and buy no cover."
     },
     "publish-to-npm.yml::scripts/check-npm-publish-landed.mjs": {
-      "detects": "existence-only",
-      "reason": "A GENUINE GAP, recorded rather than waved through. It verifies a publish actually landed, so a stale copy can attest to a release that did not happen. It runs post-merge in the release workflow and posts no merge-blocking required context, which is why it is not the first handshake to build — but it is verdict-bearing and belongs at the front of the queue when this classification is next acted on."
+      "decision": "warranted",
+      "reason": "Verdict-bearing on the release path: this prover decides whether a publish actually landed, and a superseded copy can report a landed publish that did not, or redden one that did. The evidence it produces is exactly the kind read once and believed. Not closed here because a handshake on the release path needs its own red-before-green control against a real registry response, which is more than the classification this entry exists to record; the obligation is recorded rather than defaulted so it is counted on every run."
     },
     "publish-to-npm.yml::scripts/check-release-package-identity.mjs": {
-      "detects": "existence-only",
-      "reason": "A GENUINE GAP, recorded rather than waved through, and the sibling of the publish-landed read: it attests that the published package is the one intended, so a stale copy can attest to an identity it no longer checks the same way. Post-merge and not merge-blocking, so it queues behind the merge gates rather than ahead of them."
+      "decision": "warranted",
+      "reason": "Verdict-bearing on the release path, same shape as `check-npm-publish-landed.mjs`: it decides whether the artifact about to be published is the one this repository built. A copy behind a major can compare a field that has since changed meaning and pass. Not closed here for the same reason, and counted every run rather than exempted."
     },
     "quality-rails.yml::scripts/check-threshold-ratchet.mjs": {
-      "detects": "existence-only",
-      "reason": "Same prover as the quality.yml read and the same GENUINE GAP, reached from the Rails caller tree. Recorded separately because the two callers can drift apart: a handshake added to one workflow does not reach the other, which is how a fleet ends up half-covered."
+      "decision": "warranted",
+      "reason": "Verdict-bearing required gate: it compares committed thresholds against measured coverage and posts a red check. A copy predating a threshold-semantics change enforces the old comparison and its red is believed — the precise harm CodySwannGT/lisa#3477 measured on the work-item gate. The artifact exports no contract version yet, so closing this needs the artifact half authored first; recorded as an open obligation rather than exempted."
     },
     "quality-rails.yml::scripts/lisa-mutation.sh": {
-      "detects": "existence-only",
-      "reason": "A shell wrapper that shapes a mutation-testing invocation; the verdict comes from Stryker and its configured thresholds, not from this file. A stale wrapper passes older flags, which fails loudly as a runner usage error rather than producing a wrong mutation score."
+      "decision": "not-needed",
+      "reason": "A runner, not a judge. The gate's verdict is mutant's exit code, and what it runs is read from the project's own `mutation.gate.yml` and `.mutant.yml`; this script's own logic decides whether the gate is enabled and what ref to diff against, both of which come from configuration it does not own. A superseded copy runs the wrong subjects loudly rather than returning a wrong verdict quietly."
     },
     "quality-rails.yml::scripts/lisa-scratch-run.sh": {
-      "detects": "existence-only",
-      "reason": "A shell wrapper that isolates a run's scratch namespace. It carries no verdict-bearing logic at all — it prepares a directory and execs the real command — so there is no superseded judgement for a stale copy to apply."
+      "decision": "not-needed",
+      "reason": "A supervisor that hosts a verdict rather than computing one: it owns run-scoped scratch and cleanup around whatever it wraps. Nothing it does can turn a passing suite red or a failing one green — a superseded copy misplaces or fails to reap a scratch directory, which surfaces as its own visible failure rather than as a believed verdict."
     },
     "quality-rails.yml::scripts/lisa-work-item.mjs": {
-      "detects": "version-handshake"
+      "decision": "handshake"
     },
     "quality.yml::scripts/check-e2e-coverage.mjs": {
-      "detects": "existence-only",
-      "reason": "Guarded by an existence test and scoped to Expo consumers. It reports route coverage against a declared threshold; a stale copy computes coverage by an older rule and says which rule it used in its own output, so the number it prints is interpretable rather than silently wrong."
+      "decision": "warranted",
+      "reason": "Verdict-bearing required gate: it computes route coverage against a configured floor and posts a red check every reader believes. A copy predating a change to how routes are enumerated reports a coverage number derived from superseded logic, with nothing in the output naming its vintage. The artifact exports no contract version yet, so closing this needs the artifact half authored first; recorded as an open obligation rather than exempted."
     },
     "quality.yml::scripts/check-learnings-budget.ts": {
-      "detects": "existence-only",
-      "reason": "Already ratified as a Lisa-source-only branch: every consumer takes the else arm and runs the prover from the PACKAGE channel at their own declared version, which is a version pin rather than an unversioned copy. The two-channel skew this field is about does not arise on the path consumers actually take."
+      "decision": "not-needed",
+      "reason": "Unreachable outside this repository, and ratified above on that ground: the step tests for two paths that co-exist only here, and every consumer takes the else arm and runs the prover from the PACKAGE channel, whose vintage is their declared dependency version. There is no delivered artifact at this path for a consumer to hold a stale copy of — which is why the detection is `unchecked` rather than a measured negative."
     },
     "quality.yml::scripts/check-skipped-required-checks.mjs": {
-      "detects": "existence-only",
-      "reason": "A GENUINE GAP and the sharpest one in this registry: it is the vacuity and review-evidence prover, so a stale copy posts a review verdict from superseded logic on a merge gate. Its own workflow resolves a second in-repo address when scripts/ has no copy, which bounds the absent case but says nothing about age. Highest-value handshake candidate here."
+      "decision": "warranted",
+      "reason": "Verdict-bearing required gate: it compares skip tokens against the ruleset's required contexts, and the step states that its absence is a failure precisely because a skipped required check reads as satisfied. A superseded copy comparing against a stale notion of the required set is the same false green arriving by the other door. The artifact exports no contract version yet; recorded as an open obligation rather than exempted."
     },
     "quality.yml::scripts/check-state-classification.mjs": {
-      "detects": "existence-only",
-      "reason": "Guarded by an existence test and advisory in effect: it classifies demo/fixture state against a declared contract and reports what it found. A stale copy reports against an older contract version, which surfaces as a classification mismatch in its own output rather than as a green merge gate, so the failure is self-announcing."
+      "decision": "warranted",
+      "reason": "Verdict-bearing required gate whose subject is classification itself — it decides which states a change is allowed to leave behind. A copy behind a classification change enforces the superseded taxonomy and names states that no longer mean what it thinks. The artifact exports no contract version yet; recorded as an open obligation rather than exempted."
     },
     "quality.yml::scripts/check-threshold-ratchet.mjs": {
-      "detects": "existence-only",
-      "reason": "A GENUINE GAP. The ratchet decides whether a threshold moved the wrong way, so a stale copy can pass a loosened threshold it does not yet know how to refuse. It is declared optional at push in this repository's own gate set, which lowers the blast radius but does not remove it."
+      "decision": "warranted",
+      "reason": "Verdict-bearing required gate, the same artifact and the same exposure as the `quality-rails.yml` entry: a copy predating a threshold-semantics change enforces the old comparison and its red is believed. Closing it once closes both couplings, since they read the same script down two stack lanes. The artifact exports no contract version yet; recorded as an open obligation rather than exempted."
     },
     "quality.yml::scripts/check-verification-coverage.mjs": {
-      "detects": "existence-only",
-      "reason": "Bespoke and conditional — it requires a verification-spec delta on feat/fix changes. A stale copy applies an older definition of what counts as a spec delta, which produces a visible disagreement with the spec in the pull request rather than a silent pass."
+      "decision": "warranted",
+      "reason": "Verdict-bearing gate over whether shipped work carries its verification evidence. A superseded copy looks for evidence in a shape the repository has moved off and reports a gap that is not there, or misses one that is. The artifact exports no contract version yet; recorded as an open obligation rather than exempted."
     },
     "quality.yml::scripts/generate-nightly-e2e-guard-certificate.mjs": {
-      "detects": "existence-only",
-      "reason": "Already ratified as undelivered: no lane ships this path, so no consumer tree carries a copy that could be stale. The staleness question is vacuous here for the same reason the delivery question was, and it is recorded rather than left blank so the entry is not mistaken for one nobody examined."
+      "decision": "not-needed",
+      "reason": "Unreachable outside this repository, and ratified above on that ground: both reusable jobs require this repository before the step can start, and the run body repeats the guard. No consumer ever reads this path from their own tree, so there is no copy of it anywhere to go stale — which is why the detection is `unchecked` rather than a measured negative."
     },
     "quality.yml::scripts/lisa-floor-collisions.mjs": {
-      "detects": "existence-only",
-      "reason": "Reports collisions between declared security floors. A stale copy knows a smaller set of floors, so it under-reports rather than mis-decides, and the floors it does know it still checks correctly. Under-reporting is the benign direction for a collision detector."
+      "decision": "warranted",
+      "reason": "Verdict-bearing gate: it decides whether two declared floors collide and fails the job when they do. A copy predating a change to how a floor is spelled can miss a live collision, and a missed collision is silent by construction. The artifact exports no contract version yet; recorded as an open obligation rather than exempted."
     },
     "quality.yml::scripts/lisa-work-item.mjs": {
-      "detects": "version-handshake"
+      "decision": "handshake"
     }
   },
   "inspected": {
     "workflows": 23,
-    "steps": 719,
+    "steps": 747,
     "couplings": 34,
-    "inventory": 77
+    "inventory": 78
   },
   "counts": {
     "package-backed": 10,
@@ -109,6 +109,18 @@
     "never-delivered": 0,
     "undelivered": 2
   },
+  "detectionCounts": {
+    "version-handshake": 4,
+    "capability-probe": 0,
+    "existence-only": 4,
+    "no-probe": 14,
+    "unchecked": 2
+  },
+  "decisionCounts": {
+    "handshake": 4,
+    "not-needed": 11,
+    "warranted": 9
+  },
   "couplings": [
     {
       "key": "create-github-issue-on-failure.yml::scripts/nightly-e2e-provider-action.mjs",
@@ -118,10 +130,15 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": false,
+      "handling": [],
+      "detection": "no-probe",
+      "stalenessSignals": [],
+      "decision": "not-needed",
+      "reason": "Advisory transport, not a verdict. The script files and reconciles a tracker issue about a nightly run that has ALREADY failed; it posts no check context and no job depends on its answer. A superseded copy files a differently-shaped issue, which lands in front of a human who can see it — the visible failure, not the believed-red one this dimension exists to catch. A handshake here would gate issue filing on a version comparison and buy no cover.",
       "lanes": [
         "typescript/copy-overwrite"
       ],
-      "detail": "`create-github-issue-on-failure.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/nightly-e2e-provider-action.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is unguarded, so an absent path fails the job loudly. Visible, which makes it the better of the two failures."
+      "detail": "`create-github-issue-on-failure.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/nightly-e2e-provider-action.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text carries none of the tokens this scan can see (`else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation`, `notice-annotation`, `failure-suppression`), which is a statement about those names and not about the step's behaviour. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. None of the staleness tokens this scan can see (`artifact-declares-version`, `artifact-answers-version`, `step-requests-version`, `workflow-requests-version`) were found."
     },
     {
       "key": "create-jira-issue-on-failure.yml::scripts/nightly-e2e-provider-action.mjs",
@@ -131,10 +148,15 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": false,
+      "handling": [],
+      "detection": "no-probe",
+      "stalenessSignals": [],
+      "decision": "not-needed",
+      "reason": "Advisory transport, not a verdict. The script files and reconciles a tracker issue about a nightly run that has ALREADY failed; it posts no check context and no job depends on its answer. A superseded copy files a differently-shaped issue, which lands in front of a human who can see it — the visible failure, not the believed-red one this dimension exists to catch. A handshake here would gate issue filing on a version comparison and buy no cover.",
       "lanes": [
         "typescript/copy-overwrite"
       ],
-      "detail": "`create-jira-issue-on-failure.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/nightly-e2e-provider-action.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is unguarded, so an absent path fails the job loudly. Visible, which makes it the better of the two failures."
+      "detail": "`create-jira-issue-on-failure.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/nightly-e2e-provider-action.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text carries none of the tokens this scan can see (`else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation`, `notice-annotation`, `failure-suppression`), which is a statement about those names and not about the step's behaviour. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. None of the staleness tokens this scan can see (`artifact-declares-version`, `artifact-answers-version`, `step-requests-version`, `workflow-requests-version`) were found."
     },
     {
       "key": "create-linear-issue-on-failure.yml::scripts/nightly-e2e-provider-action.mjs",
@@ -144,10 +166,15 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": false,
+      "handling": [],
+      "detection": "no-probe",
+      "stalenessSignals": [],
+      "decision": "not-needed",
+      "reason": "Advisory transport, not a verdict. The script files and reconciles a tracker issue about a nightly run that has ALREADY failed; it posts no check context and no job depends on its answer. A superseded copy files a differently-shaped issue, which lands in front of a human who can see it — the visible failure, not the believed-red one this dimension exists to catch. A handshake here would gate issue filing on a version comparison and buy no cover.",
       "lanes": [
         "typescript/copy-overwrite"
       ],
-      "detail": "`create-linear-issue-on-failure.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/nightly-e2e-provider-action.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is unguarded, so an absent path fails the job loudly. Visible, which makes it the better of the two failures."
+      "detail": "`create-linear-issue-on-failure.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/nightly-e2e-provider-action.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text carries none of the tokens this scan can see (`else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation`, `notice-annotation`, `failure-suppression`), which is a statement about those names and not about the step's behaviour. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. None of the staleness tokens this scan can see (`artifact-declares-version`, `artifact-answers-version`, `step-requests-version`, `workflow-requests-version`) were found."
     },
     {
       "key": "create-sentry-issue-on-failure.yml::scripts/nightly-e2e-provider-action.mjs",
@@ -157,10 +184,15 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": false,
+      "handling": [],
+      "detection": "no-probe",
+      "stalenessSignals": [],
+      "decision": "not-needed",
+      "reason": "Advisory transport, not a verdict. The script files and reconciles a tracker issue about a nightly run that has ALREADY failed; it posts no check context and no job depends on its answer. A superseded copy files a differently-shaped issue, which lands in front of a human who can see it — the visible failure, not the believed-red one this dimension exists to catch. A handshake here would gate issue filing on a version comparison and buy no cover.",
       "lanes": [
         "typescript/copy-overwrite"
       ],
-      "detail": "`create-sentry-issue-on-failure.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/nightly-e2e-provider-action.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is unguarded, so an absent path fails the job loudly. Visible, which makes it the better of the two failures."
+      "detail": "`create-sentry-issue-on-failure.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/nightly-e2e-provider-action.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text carries none of the tokens this scan can see (`else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation`, `notice-annotation`, `failure-suppression`), which is a statement about those names and not about the step's behaviour. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. None of the staleness tokens this scan can see (`artifact-declares-version`, `artifact-answers-version`, `step-requests-version`, `workflow-requests-version`) were found."
     },
     {
       "key": "maestro-native-e2e.yml::scripts/classify-maestro-failures.mjs",
@@ -170,10 +202,18 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": false,
+      "handling": [
+        "exit-zero",
+        "failure-suppression"
+      ],
+      "detection": "no-probe",
+      "stalenessSignals": [],
+      "decision": "not-needed",
+      "reason": "Advisory classifier over a failure that has already happened. The step carries `exit-zero` and `failure-suppression`, and the job's verdict comes from the suite it annotates rather than from this script — a superseded copy mislabels a failure, it cannot invent or suppress one. Not verdict-bearing, so a handshake is cost without cover.",
       "lanes": [
         "expo/copy-overwrite"
       ],
-      "detail": "`maestro-native-e2e.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/classify-maestro-failures.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (expo/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is unguarded, so an absent path fails the job loudly. Visible, which makes it the better of the two failures."
+      "detail": "`maestro-native-e2e.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/classify-maestro-failures.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (expo/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text does carry `exit-zero`, `failure-suppression` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. None of the staleness tokens this scan can see (`artifact-declares-version`, `artifact-answers-version`, `step-requests-version`, `workflow-requests-version`) were found."
     },
     {
       "key": "nightly-e2e-health.yml::scripts/check-nightly-e2e-health.mjs",
@@ -183,10 +223,19 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": false,
+      "handling": [],
+      "detection": "version-handshake",
+      "stalenessSignals": [
+        "artifact-declares-version",
+        "artifact-answers-version",
+        "workflow-requests-version"
+      ],
+      "decision": "handshake",
+      "reason": null,
       "lanes": [
         "typescript/copy-overwrite"
       ],
-      "detail": "`nightly-e2e-health.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-nightly-e2e-health.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is unguarded, so an absent path fails the job loudly. Visible, which makes it the better of the two failures."
+      "detail": "`nightly-e2e-health.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-nightly-e2e-health.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text carries none of the tokens this scan can see (`else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation`, `notice-annotation`, `failure-suppression`), which is a statement about those names and not about the step's behaviour. STALENESS (a separate dimension from the delivery verdict above): `version-handshake`. The delivered artifact answers a contract version and the workflow asks for one, so a copy too old to speak the same contract is NAMED rather than silently run. Tokens found: `artifact-declares-version`, `artifact-answers-version`, `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "nightly-e2e-health.yml::scripts/nightly-e2e-suites.schema.json",
@@ -196,10 +245,17 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": false,
+      "handling": [],
+      "detection": "no-probe",
+      "stalenessSignals": [
+        "workflow-requests-version"
+      ],
+      "decision": "not-needed",
+      "reason": "Data, not logic: a JSON schema has no branch that can reach a wrong verdict, only a shape that does or does not validate. Its one reader is `scripts/check-nightly-e2e-health.mjs`, which DOES carry a version handshake, so the vintage of the pair is already named in the run output — a second handshake on the schema would restate an answer that is already given.",
       "lanes": [
         "typescript/copy-overwrite"
       ],
-      "detail": "`nightly-e2e-health.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/nightly-e2e-suites.schema.json` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is unguarded, so an absent path fails the job loudly. Visible, which makes it the better of the two failures."
+      "detail": "`nightly-e2e-health.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/nightly-e2e-suites.schema.json` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text carries none of the tokens this scan can see (`else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation`, `notice-annotation`, `failure-suppression`), which is a statement about those names and not about the step's behaviour. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "nightly-e2e-report.yml::scripts/check-nightly-e2e-health.mjs",
@@ -209,10 +265,19 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": false,
+      "handling": [],
+      "detection": "version-handshake",
+      "stalenessSignals": [
+        "artifact-declares-version",
+        "artifact-answers-version",
+        "workflow-requests-version"
+      ],
+      "decision": "handshake",
+      "reason": null,
       "lanes": [
         "typescript/copy-overwrite"
       ],
-      "detail": "`nightly-e2e-report.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-nightly-e2e-health.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is unguarded, so an absent path fails the job loudly. Visible, which makes it the better of the two failures."
+      "detail": "`nightly-e2e-report.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-nightly-e2e-health.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text carries none of the tokens this scan can see (`else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation`, `notice-annotation`, `failure-suppression`), which is a statement about those names and not about the step's behaviour. STALENESS (a separate dimension from the delivery verdict above): `version-handshake`. The delivered artifact answers a contract version and the workflow asks for one, so a copy too old to speak the same contract is NAMED rather than silently run. Tokens found: `artifact-declares-version`, `artifact-answers-version`, `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "nightly-e2e-tracking.yml::scripts/reconcile-nightly-e2e-tracking.mjs",
@@ -222,10 +287,15 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": false,
+      "handling": [],
+      "detection": "no-probe",
+      "stalenessSignals": [],
+      "decision": "not-needed",
+      "reason": "Advisory transport, not a verdict. The script files and reconciles a tracker issue about a nightly run that has ALREADY failed; it posts no check context and no job depends on its answer. A superseded copy files a differently-shaped issue, which lands in front of a human who can see it — the visible failure, not the believed-red one this dimension exists to catch. A handshake here would gate issue filing on a version comparison and buy no cover.",
       "lanes": [
         "typescript/copy-overwrite"
       ],
-      "detail": "`nightly-e2e-tracking.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/reconcile-nightly-e2e-tracking.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is unguarded, so an absent path fails the job loudly. Visible, which makes it the better of the two failures."
+      "detail": "`nightly-e2e-tracking.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/reconcile-nightly-e2e-tracking.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text carries none of the tokens this scan can see (`else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation`, `notice-annotation`, `failure-suppression`), which is a statement about those names and not about the step's behaviour. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. None of the staleness tokens this scan can see (`artifact-declares-version`, `artifact-answers-version`, `step-requests-version`, `workflow-requests-version`) were found."
     },
     {
       "key": "publish-to-npm.yml::scripts/check-npm-publish-landed.mjs",
@@ -235,10 +305,15 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": false,
+      "handling": [],
+      "detection": "no-probe",
+      "stalenessSignals": [],
+      "decision": "warranted",
+      "reason": "Verdict-bearing on the release path: this prover decides whether a publish actually landed, and a superseded copy can report a landed publish that did not, or redden one that did. The evidence it produces is exactly the kind read once and believed. Not closed here because a handshake on the release path needs its own red-before-green control against a real registry response, which is more than the classification this entry exists to record; the obligation is recorded rather than defaulted so it is counted on every run.",
       "lanes": [
         "all/copy-overwrite"
       ],
-      "detail": "`publish-to-npm.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-npm-publish-landed.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is unguarded, so an absent path fails the job loudly. Visible, which makes it the better of the two failures."
+      "detail": "`publish-to-npm.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-npm-publish-landed.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text carries none of the tokens this scan can see (`else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation`, `notice-annotation`, `failure-suppression`), which is a statement about those names and not about the step's behaviour. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. None of the staleness tokens this scan can see (`artifact-declares-version`, `artifact-answers-version`, `step-requests-version`, `workflow-requests-version`) were found."
     },
     {
       "key": "publish-to-npm.yml::scripts/check-release-package-identity.mjs",
@@ -248,10 +323,15 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": false,
+      "handling": [],
+      "detection": "no-probe",
+      "stalenessSignals": [],
+      "decision": "warranted",
+      "reason": "Verdict-bearing on the release path, same shape as `check-npm-publish-landed.mjs`: it decides whether the artifact about to be published is the one this repository built. A copy behind a major can compare a field that has since changed meaning and pass. Not closed here for the same reason, and counted every run rather than exempted.",
       "lanes": [
         "all/copy-overwrite"
       ],
-      "detail": "`publish-to-npm.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-release-package-identity.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is unguarded, so an absent path fails the job loudly. Visible, which makes it the better of the two failures."
+      "detail": "`publish-to-npm.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-release-package-identity.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text carries none of the tokens this scan can see (`else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation`, `notice-annotation`, `failure-suppression`), which is a statement about those names and not about the step's behaviour. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. None of the staleness tokens this scan can see (`artifact-declares-version`, `artifact-answers-version`, `step-requests-version`, `workflow-requests-version`) were found."
     },
     {
       "key": "quality-rails.yml::scripts/check-threshold-ratchet.mjs",
@@ -261,11 +341,23 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": false,
+      "handling": [
+        "else-branch",
+        "exit-zero",
+        "exit-nonzero",
+        "error-annotation"
+      ],
+      "detection": "no-probe",
+      "stalenessSignals": [
+        "workflow-requests-version"
+      ],
+      "decision": "warranted",
+      "reason": "Verdict-bearing required gate: it compares committed thresholds against measured coverage and posts a red check. A copy predating a threshold-semantics change enforces the old comparison and its red is believed — the precise harm CodySwannGT/lisa#3477 measured on the work-item gate. The artifact exports no contract version yet, so closing this needs the artifact half authored first; recorded as an open obligation rather than exempted.",
       "lanes": [
         "rails/copy-overwrite",
         "typescript/copy-overwrite"
       ],
-      "detail": "`quality-rails.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-threshold-ratchet.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (rails/copy-overwrite, typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is unguarded, so an absent path fails the job loudly. Visible, which makes it the better of the two failures."
+      "detail": "`quality-rails.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-threshold-ratchet.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (rails/copy-overwrite, typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text does carry `else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "quality-rails.yml::scripts/lisa-mutation.sh",
@@ -275,10 +367,21 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": true,
+      "handling": [
+        "exit-zero",
+        "exit-nonzero",
+        "error-annotation"
+      ],
+      "detection": "existence-only",
+      "stalenessSignals": [
+        "workflow-requests-version"
+      ],
+      "decision": "not-needed",
+      "reason": "A runner, not a judge. The gate's verdict is mutant's exit code, and what it runs is read from the project's own `mutation.gate.yml` and `.mutant.yml`; this script's own logic decides whether the gate is enabled and what ref to diff against, both of which come from configuration it does not own. A superseded copy runs the wrong subjects loudly rather than returning a wrong verdict quietly.",
       "lanes": [
         "rails/copy-contents"
       ],
-      "detail": "`quality-rails.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/lisa-mutation.sh` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (rails/copy-contents). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is guarded by an existence test, so an absent path SKIPS rather than fails — the step posts no context, and an absent required context is not a red one. Nothing reads as broken."
+      "detail": "`quality-rails.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/lisa-mutation.sh` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (rails/copy-contents). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read sits behind an existence test, which is ALL this scan examined of the step's control flow: it did not read the test's other branch, any fallback, any explicit `exit`, or any verification of the step's output. Whether an absent path skips quietly, falls back, or fails loudly is therefore NOT MEASURED — read the step before concluding it proves nothing. The shape worth ruling out is the silent one, where a skip posts no context and an absent required context is not a red one. The step's text does carry `exit-zero`, `exit-nonzero`, `error-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `existence-only`. An existence test and no version probe: this coupling can see that the artifact is MISSING and cannot see that it is OLD. A present copy of any vintage runs, and its verdict is believed. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "quality-rails.yml::scripts/lisa-scratch-run.sh",
@@ -288,10 +391,21 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": true,
+      "handling": [
+        "exit-zero",
+        "exit-nonzero",
+        "error-annotation"
+      ],
+      "detection": "existence-only",
+      "stalenessSignals": [
+        "workflow-requests-version"
+      ],
+      "decision": "not-needed",
+      "reason": "A supervisor that hosts a verdict rather than computing one: it owns run-scoped scratch and cleanup around whatever it wraps. Nothing it does can turn a passing suite red or a failing one green — a superseded copy misplaces or fails to reap a scratch directory, which surfaces as its own visible failure rather than as a believed verdict.",
       "lanes": [
         "rails/copy-overwrite"
       ],
-      "detail": "`quality-rails.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/lisa-scratch-run.sh` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (rails/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is guarded by an existence test, so an absent path SKIPS rather than fails — the step posts no context, and an absent required context is not a red one. Nothing reads as broken."
+      "detail": "`quality-rails.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/lisa-scratch-run.sh` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (rails/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read sits behind an existence test, which is ALL this scan examined of the step's control flow: it did not read the test's other branch, any fallback, any explicit `exit`, or any verification of the step's output. Whether an absent path skips quietly, falls back, or fails loudly is therefore NOT MEASURED — read the step before concluding it proves nothing. The shape worth ruling out is the silent one, where a skip posts no context and an absent required context is not a red one. The step's text does carry `exit-zero`, `exit-nonzero`, `error-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `existence-only`. An existence test and no version probe: this coupling can see that the artifact is MISSING and cannot see that it is OLD. A present copy of any vintage runs, and its verdict is believed. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "quality-rails.yml::scripts/lisa-work-item.mjs",
@@ -301,10 +415,26 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": true,
+      "handling": [
+        "else-branch",
+        "exit-zero",
+        "exit-nonzero",
+        "error-annotation",
+        "notice-annotation"
+      ],
+      "detection": "version-handshake",
+      "stalenessSignals": [
+        "artifact-declares-version",
+        "artifact-answers-version",
+        "step-requests-version",
+        "workflow-requests-version"
+      ],
+      "decision": "handshake",
+      "reason": null,
       "lanes": [
         "all/copy-overwrite"
       ],
-      "detail": "`quality-rails.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/lisa-work-item.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is guarded by an existence test, so an absent path SKIPS rather than fails — the step posts no context, and an absent required context is not a red one. Nothing reads as broken."
+      "detail": "`quality-rails.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/lisa-work-item.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read sits behind an existence test, which is ALL this scan examined of the step's control flow: it did not read the test's other branch, any fallback, any explicit `exit`, or any verification of the step's output. Whether an absent path skips quietly, falls back, or fails loudly is therefore NOT MEASURED — read the step before concluding it proves nothing. The shape worth ruling out is the silent one, where a skip posts no context and an absent required context is not a red one. The step's text does carry `else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation`, `notice-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `version-handshake`. The delivered artifact answers a contract version and the workflow asks for one, so a copy too old to speak the same contract is NAMED rather than silently run. Tokens found: `artifact-declares-version`, `artifact-answers-version`, `step-requests-version`, `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "quality.yml::scripts/check-e2e-coverage.mjs",
@@ -314,10 +444,22 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": true,
+      "handling": [
+        "else-branch",
+        "exit-nonzero",
+        "error-annotation",
+        "notice-annotation"
+      ],
+      "detection": "existence-only",
+      "stalenessSignals": [
+        "workflow-requests-version"
+      ],
+      "decision": "warranted",
+      "reason": "Verdict-bearing required gate: it computes route coverage against a configured floor and posts a red check every reader believes. A copy predating a change to how routes are enumerated reports a coverage number derived from superseded logic, with nothing in the output naming its vintage. The artifact exports no contract version yet, so closing this needs the artifact half authored first; recorded as an open obligation rather than exempted.",
       "lanes": [
         "expo/copy-overwrite"
       ],
-      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-e2e-coverage.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (expo/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is guarded by an existence test, so an absent path SKIPS rather than fails — the step posts no context, and an absent required context is not a red one. Nothing reads as broken."
+      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-e2e-coverage.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (expo/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read sits behind an existence test, which is ALL this scan examined of the step's control flow: it did not read the test's other branch, any fallback, any explicit `exit`, or any verification of the step's output. Whether an absent path skips quietly, falls back, or fails loudly is therefore NOT MEASURED — read the step before concluding it proves nothing. The shape worth ruling out is the silent one, where a skip posts no context and an absent required context is not a red one. The step's text does carry `else-branch`, `exit-nonzero`, `error-annotation`, `notice-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `existence-only`. An existence test and no version probe: this coupling can see that the artifact is MISSING and cannot see that it is OLD. A present copy of any vintage runs, and its verdict is believed. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "quality.yml::scripts/check-learnings-budget.ts",
@@ -327,8 +469,20 @@
       "verdict": "undelivered",
       "remedy": "author-the-artifact",
       "guarded": true,
+      "handling": [
+        "else-branch",
+        "exit-nonzero",
+        "error-annotation",
+        "failure-suppression"
+      ],
+      "detection": "unchecked",
+      "stalenessSignals": [
+        "workflow-requests-version"
+      ],
+      "decision": "not-needed",
+      "reason": "Unreachable outside this repository, and ratified above on that ground: the step tests for two paths that co-exist only here, and every consumer takes the else arm and runs the prover from the PACKAGE channel, whose vintage is their declared dependency version. There is no delivered artifact at this path for a consumer to hold a stale copy of — which is why the detection is `unchecked` rather than a measured negative.",
       "lanes": [],
-      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-learnings-budget.ts` from the CALLER's tree, and Lisa ships no such path in any delivery lane — no apply and no bump ever produces it. Either the consumer authors it or this step proves nothing wherever it is absent. The read is guarded by an existence test, so an absent path SKIPS rather than fails — the step posts no context, and an absent required context is not a red one. Nothing reads as broken."
+      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-learnings-budget.ts` from the CALLER's tree, and Lisa ships no such path in any delivery lane — no apply and no bump ever produces it. Either the consumer authors it, or whatever the step does where the path is missing runs instead — and that branch is the part this scan does not read. The read sits behind an existence test, which is ALL this scan examined of the step's control flow: it did not read the test's other branch, any fallback, any explicit `exit`, or any verification of the step's output. Whether an absent path skips quietly, falls back, or fails loudly is therefore NOT MEASURED — read the step before concluding it proves nothing. The shape worth ruling out is the silent one, where a skip posts no context and an absent required context is not a red one. The step's text does carry `else-branch`, `exit-nonzero`, `error-annotation`, `failure-suppression` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `unchecked`. Lisa delivers nothing at this path, so there is no artifact to ask whether it could answer a version. The staleness half is UNKNOWN here — not current, and not probe-less. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "quality.yml::scripts/check-skipped-required-checks.mjs",
@@ -338,10 +492,21 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": false,
+      "handling": [
+        "exit-zero",
+        "exit-nonzero",
+        "error-annotation"
+      ],
+      "detection": "no-probe",
+      "stalenessSignals": [
+        "workflow-requests-version"
+      ],
+      "decision": "warranted",
+      "reason": "Verdict-bearing required gate: it compares skip tokens against the ruleset's required contexts, and the step states that its absence is a failure precisely because a skipped required check reads as satisfied. A superseded copy comparing against a stale notion of the required set is the same false green arriving by the other door. The artifact exports no contract version yet; recorded as an open obligation rather than exempted.",
       "lanes": [
         "typescript/copy-overwrite"
       ],
-      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-skipped-required-checks.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is unguarded, so an absent path fails the job loudly. Visible, which makes it the better of the two failures."
+      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-skipped-required-checks.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text does carry `exit-zero`, `exit-nonzero`, `error-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "quality.yml::scripts/check-state-classification.mjs",
@@ -351,10 +516,22 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": true,
+      "handling": [
+        "else-branch",
+        "exit-nonzero",
+        "error-annotation",
+        "notice-annotation"
+      ],
+      "detection": "existence-only",
+      "stalenessSignals": [
+        "workflow-requests-version"
+      ],
+      "decision": "warranted",
+      "reason": "Verdict-bearing required gate whose subject is classification itself — it decides which states a change is allowed to leave behind. A copy behind a classification change enforces the superseded taxonomy and names states that no longer mean what it thinks. The artifact exports no contract version yet; recorded as an open obligation rather than exempted.",
       "lanes": [
         "all/copy-overwrite"
       ],
-      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-state-classification.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is guarded by an existence test, so an absent path SKIPS rather than fails — the step posts no context, and an absent required context is not a red one. Nothing reads as broken."
+      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-state-classification.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read sits behind an existence test, which is ALL this scan examined of the step's control flow: it did not read the test's other branch, any fallback, any explicit `exit`, or any verification of the step's output. Whether an absent path skips quietly, falls back, or fails loudly is therefore NOT MEASURED — read the step before concluding it proves nothing. The shape worth ruling out is the silent one, where a skip posts no context and an absent required context is not a red one. The step's text does carry `else-branch`, `exit-nonzero`, `error-annotation`, `notice-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `existence-only`. An existence test and no version probe: this coupling can see that the artifact is MISSING and cannot see that it is OLD. A present copy of any vintage runs, and its verdict is believed. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "quality.yml::scripts/check-threshold-ratchet.mjs",
@@ -364,11 +541,23 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": false,
+      "handling": [
+        "else-branch",
+        "exit-zero",
+        "exit-nonzero",
+        "error-annotation"
+      ],
+      "detection": "no-probe",
+      "stalenessSignals": [
+        "workflow-requests-version"
+      ],
+      "decision": "warranted",
+      "reason": "Verdict-bearing required gate, the same artifact and the same exposure as the `quality-rails.yml` entry: a copy predating a threshold-semantics change enforces the old comparison and its red is believed. Closing it once closes both couplings, since they read the same script down two stack lanes. The artifact exports no contract version yet; recorded as an open obligation rather than exempted.",
       "lanes": [
         "rails/copy-overwrite",
         "typescript/copy-overwrite"
       ],
-      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-threshold-ratchet.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (rails/copy-overwrite, typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is unguarded, so an absent path fails the job loudly. Visible, which makes it the better of the two failures."
+      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-threshold-ratchet.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (rails/copy-overwrite, typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text does carry `else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "quality.yml::scripts/check-verification-coverage.mjs",
@@ -378,10 +567,17 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": false,
+      "handling": [],
+      "detection": "no-probe",
+      "stalenessSignals": [
+        "workflow-requests-version"
+      ],
+      "decision": "warranted",
+      "reason": "Verdict-bearing gate over whether shipped work carries its verification evidence. A superseded copy looks for evidence in a shape the repository has moved off and reports a gap that is not there, or misses one that is. The artifact exports no contract version yet; recorded as an open obligation rather than exempted.",
       "lanes": [
         "typescript/copy-overwrite"
       ],
-      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-verification-coverage.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is unguarded, so an absent path fails the job loudly. Visible, which makes it the better of the two failures."
+      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-verification-coverage.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text carries none of the tokens this scan can see (`else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation`, `notice-annotation`, `failure-suppression`), which is a statement about those names and not about the step's behaviour. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "quality.yml::scripts/generate-nightly-e2e-guard-certificate.mjs",
@@ -391,8 +587,18 @@
       "verdict": "undelivered",
       "remedy": "author-the-artifact",
       "guarded": true,
+      "handling": [
+        "exit-zero",
+        "notice-annotation"
+      ],
+      "detection": "unchecked",
+      "stalenessSignals": [
+        "workflow-requests-version"
+      ],
+      "decision": "not-needed",
+      "reason": "Unreachable outside this repository, and ratified above on that ground: both reusable jobs require this repository before the step can start, and the run body repeats the guard. No consumer ever reads this path from their own tree, so there is no copy of it anywhere to go stale — which is why the detection is `unchecked` rather than a measured negative.",
       "lanes": [],
-      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/generate-nightly-e2e-guard-certificate.mjs` from the CALLER's tree, and Lisa ships no such path in any delivery lane — no apply and no bump ever produces it. Either the consumer authors it or this step proves nothing wherever it is absent. The read is guarded by an existence test, so an absent path SKIPS rather than fails — the step posts no context, and an absent required context is not a red one. Nothing reads as broken."
+      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/generate-nightly-e2e-guard-certificate.mjs` from the CALLER's tree, and Lisa ships no such path in any delivery lane — no apply and no bump ever produces it. Either the consumer authors it, or whatever the step does where the path is missing runs instead — and that branch is the part this scan does not read. The read sits behind an existence test, which is ALL this scan examined of the step's control flow: it did not read the test's other branch, any fallback, any explicit `exit`, or any verification of the step's output. Whether an absent path skips quietly, falls back, or fails loudly is therefore NOT MEASURED — read the step before concluding it proves nothing. The shape worth ruling out is the silent one, where a skip posts no context and an absent required context is not a red one. The step's text does carry `exit-zero`, `notice-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `unchecked`. Lisa delivers nothing at this path, so there is no artifact to ask whether it could answer a version. The staleness half is UNKNOWN here — not current, and not probe-less. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "quality.yml::scripts/lisa-floor-collisions.mjs",
@@ -402,10 +608,20 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": false,
+      "handling": [
+        "exit-nonzero",
+        "error-annotation"
+      ],
+      "detection": "no-probe",
+      "stalenessSignals": [
+        "workflow-requests-version"
+      ],
+      "decision": "warranted",
+      "reason": "Verdict-bearing gate: it decides whether two declared floors collide and fails the job when they do. A copy predating a change to how a floor is spelled can miss a live collision, and a missed collision is silent by construction. The artifact exports no contract version yet; recorded as an open obligation rather than exempted.",
       "lanes": [
         "all/copy-overwrite"
       ],
-      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/lisa-floor-collisions.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is unguarded, so an absent path fails the job loudly. Visible, which makes it the better of the two failures."
+      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/lisa-floor-collisions.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text does carry `exit-nonzero`, `error-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "quality.yml::scripts/lisa-work-item.mjs",
@@ -415,10 +631,26 @@
       "verdict": "apply-lagged",
       "remedy": "run-lisa-apply",
       "guarded": true,
+      "handling": [
+        "else-branch",
+        "exit-zero",
+        "exit-nonzero",
+        "error-annotation",
+        "notice-annotation"
+      ],
+      "detection": "version-handshake",
+      "stalenessSignals": [
+        "artifact-declares-version",
+        "artifact-answers-version",
+        "step-requests-version",
+        "workflow-requests-version"
+      ],
+      "decision": "handshake",
+      "reason": null,
       "lanes": [
         "all/copy-overwrite"
       ],
-      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/lisa-work-item.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is guarded by an existence test, so an absent path SKIPS rather than fails — the step posts no context, and an absent required context is not a red one. Nothing reads as broken."
+      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/lisa-work-item.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read sits behind an existence test, which is ALL this scan examined of the step's control flow: it did not read the test's other branch, any fallback, any explicit `exit`, or any verification of the step's output. Whether an absent path skips quietly, falls back, or fails loudly is therefore NOT MEASURED — read the step before concluding it proves nothing. The shape worth ruling out is the silent one, where a skip posts no context and an absent required context is not a red one. The step's text does carry `else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation`, `notice-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `version-handshake`. The delivered artifact answers a contract version and the workflow asks for one, so a copy too old to speak the same contract is NAMED rather than silently run. Tokens found: `artifact-declares-version`, `artifact-answers-version`, `step-requests-version`, `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     }
   ]
 }