@hunter-harness/workflow-harness 0.2.44 → 0.2.45

package/harness/bundles/general/claude-code/.harness-build.json

@@ -2,5 +2,5 @@
   "schemaVersion": 1,
   "overlay": "none",
   "agent": "claude-code",
-  "coreHash": "367eb27020f2b966"
+  "coreHash": "519b79b5e5c36857"
 }

package/harness/bundles/general/claude-code/harness-archive/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=claude-code; do not edit -->
 # harness-archive — 变更归档
 
 ## Purpose

package/harness/bundles/general/claude-code/harness-codebase-map/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=claude-code; do not edit -->
 # harness-codebase-map — 代码库地图
 
 ## Purpose

package/harness/bundles/general/claude-code/harness-knowledge-ingest/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=claude-code; do not edit -->
 # harness-knowledge-ingest
 
 从 `.harness/archive/**/reports/final/summary-data.json` 抽取项目知识，生成并维护本地 `.harness/knowledge/` 索引。

package/harness/bundles/general/claude-code/harness-knowledge-query/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=claude-code; do not edit -->
 # harness-knowledge-query
 
 并行 change 中查询必须传 `--change <change-id>`；成功后以该 change 的 `meta/knowledge-context.json` 为稳定指针。全局 `context-packs/latest.json` 仅向后兼容，不得用于判断多个 active change 的上下文归属。

package/harness/bundles/general/claude-code/harness-plan/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=claude-code; do not edit -->
 # harness-plan — 需求规划
 
 ## Purpose

package/harness/bundles/general/claude-code/harness-review/SKILL.md

@@ -21,7 +21,7 @@ disallowed-tools:
   - Bash(curl *)
   - Bash(codegraph *)
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=claude-code; do not edit -->
 # harness-review — 代码审查
 
 ## Purpose

package/harness/bundles/general/claude-code/harness-run/SKILL.md

@@ -21,7 +21,7 @@ disallowed-tools:
   - Bash(curl *)
   - Bash(codegraph *)
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=claude-code; do not edit -->
 # harness-run — 需求编码
 
 ## Purpose

package/harness/bundles/general/claude-code/harness-submit/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=claude-code; do not edit -->
 # harness-submit — 最终提交（含 worktree 合并）
 
 ## Purpose

package/harness/bundles/general/claude-code/harness-sync/SKILL.md

@@ -19,7 +19,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=claude-code; do not edit -->
 # harness-sync
 
 ## Purpose

package/harness/bundles/general/claude-code/harness-test/SKILL.md

@@ -22,7 +22,7 @@ disallowed-tools:
   - Bash(node *)
   - Bash(codegraph *)
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=claude-code; do not edit -->
 # harness-test — 测试执行
 
 ## Purpose

package/harness/bundles/general/claude-code/scripts/harness_archive.py

@@ -1963,6 +1963,7 @@ def validate_sensitive_evidence_publication_gate(
     *,
     copy_root: Path | None = None,
     require_receipt: bool = False,
+    receipt_override: dict[str, Any] | None = None,
 ) -> dict[str, Any]:
     """Fail closed before freeze/copy when plaintext evidence is unresolved.
 
@@ -1983,7 +1984,7 @@ def validate_sensitive_evidence_publication_gate(
             "unresolvedFailures": candidates,
             "nextAction": "Quarantine the original bytes before archive publication.",
         }
-    if not receipt_path.is_file():
+    if receipt_override is None and not receipt_path.is_file():
         if require_receipt:
             return {
                 "ok": False,
@@ -1998,15 +1999,18 @@ def validate_sensitive_evidence_publication_gate(
             "receiptRequired": False,
             "unresolvedFailures": [],
         }
-    try:
-        receipt = read_json(receipt_path)
-    except (OSError, json.JSONDecodeError, TypeError) as exc:
-        return {
-            "ok": False,
-            "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
-            "receiptPath": str(receipt_path),
-            "error": str(exc),
-        }
+    if receipt_override is None:
+        try:
+            receipt = read_json(receipt_path)
+        except (OSError, json.JSONDecodeError, TypeError) as exc:
+            return {
+                "ok": False,
+                "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
+                "receiptPath": str(receipt_path),
+                "error": str(exc),
+            }
+    else:
+        receipt = receipt_override
     if not isinstance(receipt, dict):
         return {
             "ok": False,
@@ -7463,10 +7467,35 @@ def cmd_finalize(
         payload["error"] = f"archive target already exists: {archive_dir}"
         return 1, payload
 
+    source_sensitive_refresh = hruntime.refresh_sensitive_evidence_scan_receipt(
+        original_change_dir,
+        persist=False,
+    )
+    payload["steps"]["sensitive_evidence_source_refresh"] = source_sensitive_refresh
+    if not source_sensitive_refresh.get("ok"):
+        payload["error"] = str(
+            source_sensitive_refresh.get("error")
+            or "sensitive evidence source receipt refresh failed"
+        )
+        payload["issues"] = [
+            {
+                "code": str(
+                    source_sensitive_refresh.get("reasonCode")
+                    or "SECRET_SCAN_RECEIPT_REFRESH_FAILED"
+                ),
+                "severity": "error",
+                "message": payload["error"],
+            }
+        ]
+        payload["original_preserved"] = original_change_dir.is_dir()
+        payload["finalStatus"] = "FAIL"
+        return 1, payload
+
     source_sensitive_gate = validate_sensitive_evidence_publication_gate(
         original_change_dir,
         copy_root=original_change_dir,
-        require_receipt=False,
+        require_receipt=True,
+        receipt_override=source_sensitive_refresh.get("receipt"),
     )
     payload["steps"]["sensitive_evidence_source_gate"] = source_sensitive_gate
     if not source_sensitive_gate.get("ok"):
@@ -7580,9 +7609,38 @@ def cmd_finalize(
     # receipt in the isolated staging tree.  This keeps legacy archives
     # compatible while making every published archive auditable.
     try:
-        staged_receipt = hruntime.sensitive_evidence_receipt_path(work_dir)
-        if not staged_receipt.is_file():
-            hruntime.ensure_sensitive_evidence_scan_receipt(work_dir)
+        # Split-v1 runtime state becomes part of the publishable archive.  Merge
+        # it before the final scan so no late runtime byte can bypass the
+        # sensitive-evidence gate or invalidate the receipt digest.
+        if split_state_dir is not None and split_state_dir.is_dir():
+            _merge_runtime_state(split_state_dir, work_dir)
+            payload["steps"]["split_state_merge"] = {
+                "ok": True,
+                "stateDir": str(split_state_dir),
+            }
+        staged_sensitive_refresh = hruntime.refresh_sensitive_evidence_scan_receipt(
+            work_dir
+        )
+        payload["steps"][
+            "sensitive_evidence_staging_refresh"
+        ] = staged_sensitive_refresh
+        if not staged_sensitive_refresh.get("ok"):
+            payload["error"] = str(
+                staged_sensitive_refresh.get("error")
+                or "sensitive evidence staging receipt refresh failed"
+            )
+            payload["issues"] = [
+                {
+                    "code": str(
+                        staged_sensitive_refresh.get("reasonCode")
+                        or "SECRET_SCAN_RECEIPT_REFRESH_FAILED"
+                    ),
+                    "severity": "error",
+                    "message": payload["error"],
+                }
+            ]
+            _restore_finalize_failure()
+            return 1, payload
         staged_sensitive_gate = validate_sensitive_evidence_publication_gate(
             work_dir,
             copy_root=work_dir,
@@ -7608,13 +7666,6 @@ def cmd_finalize(
         _restore_finalize_failure()
         return 1, payload
 
-    if split_state_dir is not None and split_state_dir.is_dir():
-        _merge_runtime_state(split_state_dir, work_dir)
-        payload["steps"]["split_state_merge"] = {
-            "ok": True,
-            "stateDir": str(split_state_dir),
-        }
-
     def _safe_append(**kwargs: Any) -> None:
         nonlocal work_dir
         try:

package/harness/bundles/general/claude-code/scripts/harness_runtime.py

@@ -217,7 +217,7 @@ def sensitive_evidence_candidates(root: Path) -> list[dict[str, Any]]:
     return _sensitive_candidates(root)
 
 
-def _write_sensitive_scan_receipt(
+def _build_sensitive_scan_receipt(
     change_root: Path,
     *,
     entries: list[dict[str, Any]],
@@ -225,7 +225,7 @@ def _write_sensitive_scan_receipt(
     status: str,
 ) -> dict[str, Any]:
     change_root = change_root.expanduser().resolve()
-    receipt = {
+    return {
         "schemaVersion": 1,
         "rulesVersion": SECRET_SCAN_RULES_VERSION,
         "changeId": change_root.name,
@@ -236,6 +236,22 @@ def _write_sensitive_scan_receipt(
         "publicationExcluded": True,
         "recordedAt": now_iso(),
     }
+
+
+def _write_sensitive_scan_receipt(
+    change_root: Path,
+    *,
+    entries: list[dict[str, Any]],
+    unresolved: list[dict[str, Any]],
+    status: str,
+) -> dict[str, Any]:
+    change_root = change_root.expanduser().resolve()
+    receipt = _build_sensitive_scan_receipt(
+        change_root,
+        entries=entries,
+        unresolved=unresolved,
+        status=status,
+    )
     atomic_write_json(_sensitive_evidence_receipt_path(change_root), receipt)
     return receipt
 
@@ -364,6 +380,93 @@ def ensure_sensitive_evidence_scan_receipt(change_root: Path) -> dict[str, Any]:
     )
 
 
+def refresh_sensitive_evidence_scan_receipt(
+    change_root: Path,
+    *,
+    persist: bool = True,
+) -> dict[str, Any]:
+    """Rescan current bytes while preserving valid quarantine audit entries."""
+    change_root = change_root.expanduser().resolve()
+    receipt_path = _sensitive_evidence_receipt_path(change_root)
+    entries: list[dict[str, Any]] = []
+    if receipt_path.is_file():
+        try:
+            prior = json.loads(receipt_path.read_text(encoding="utf-8-sig"))
+        except (OSError, json.JSONDecodeError) as exc:
+            return {
+                "ok": False,
+                "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
+                "receiptPath": str(receipt_path),
+                "error": str(exc),
+            }
+        if not isinstance(prior, dict):
+            return {
+                "ok": False,
+                "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
+                "receiptPath": str(receipt_path),
+                "error": "receipt must be an object",
+            }
+        prior_entries = prior.get("entries")
+        prior_unresolved = prior.get("unresolvedFailures")
+        valid_identity = (
+            prior.get("schemaVersion") == 1
+            and prior.get("rulesVersion") == SECRET_SCAN_RULES_VERSION
+            and prior.get("changeId") == change_root.name
+            and prior.get("publicationExcluded") is True
+            and str(prior.get("status") or "").upper()
+            in {"OK", "QUARANTINED", "FAIL"}
+        )
+        if (
+            not valid_identity
+            or not isinstance(prior_entries, list)
+            or not isinstance(prior_unresolved, list)
+        ):
+            return {
+                "ok": False,
+                "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
+                "receiptPath": str(receipt_path),
+                "error": "receipt identity or collection fields are invalid",
+            }
+        entries = list(prior_entries)
+
+    unresolved = _sensitive_candidates(change_root)
+    status = "FAIL" if unresolved else "QUARANTINED" if entries else "OK"
+    if persist:
+        try:
+            receipt = _write_sensitive_scan_receipt(
+                change_root,
+                entries=entries,
+                unresolved=unresolved,
+                status=status,
+            )
+        except OSError as exc:
+            return {
+                "ok": False,
+                "reasonCode": "SECRET_SCAN_RECEIPT_REFRESH_FAILED",
+                "receiptPath": str(receipt_path),
+                "error": str(exc),
+            }
+    else:
+        receipt = _build_sensitive_scan_receipt(
+            change_root,
+            entries=entries,
+            unresolved=unresolved,
+            status=status,
+        )
+    return {
+        "ok": not unresolved,
+        "reasonCode": (
+            "SENSITIVE_EVIDENCE_UNQUARANTINED"
+            if unresolved
+            else "SECRET_SCAN_RECEIPT_REFRESHED"
+        ),
+        "receiptPath": str(receipt_path),
+        "receipt": receipt,
+        "persisted": persist,
+        "unresolvedFailures": unresolved,
+    }
+
+
 def _run_sessions_root(state_root: Path) -> Path:
     return state_root.expanduser().resolve() / "runtime" / "run-sessions"
 

package/harness/bundles/general/codebuddy/.harness-build.json

@@ -2,5 +2,5 @@
   "schemaVersion": 1,
   "overlay": "none",
   "agent": "codebuddy",
-  "coreHash": "367eb27020f2b966"
+  "coreHash": "519b79b5e5c36857"
 }

package/harness/bundles/general/codebuddy/harness-archive/SKILL.md

@@ -3,7 +3,7 @@ name: harness-archive
 description: 归档所有变更产出（计划/测试报告/审查/SQL/API文档）到
   .harness/archive/，含归档元数据和可视化最终总结。使用场景：归档、完成归档、收尾、打包产出物
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=codebuddy; do not edit -->
 # harness-archive — 变更归档
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-codebase-map/SKILL.md

@@ -3,7 +3,7 @@ name: harness-codebase-map
 description: 分析现有代码库并生成 .harness/codebase/map/
   下的结构化代码库地图。用于陌生项目理解、重大改造前梳理、harness-sync 提示 map 过期后的人工刷新。
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=codebuddy; do not edit -->
 # harness-codebase-map — 代码库地图
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-knowledge-ingest/SKILL.md

@@ -3,7 +3,7 @@ name: harness-knowledge-ingest
 description: 从 .harness/archive 归档整理、同步和维护项目知识索引。适用场景：ingest knowledge、sync
   knowledge、rebuild knowledge index、promote knowledge、确认知识条目、检查知识库是否过期。
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=codebuddy; do not edit -->
 # harness-knowledge-ingest
 
 从 `.harness/archive/**/reports/final/summary-data.json` 抽取项目知识，生成并维护本地 `.harness/knowledge/` 索引。

package/harness/bundles/general/codebuddy/harness-knowledge-query/SKILL.md

@@ -3,7 +3,7 @@ name: harness-knowledge-query
 description: 根据新需求、设计任务、代码修改请求或问题排查，在规划和编码前查询 .harness/knowledge
   历史上下文。适用场景：query knowledge、查找历史需求、根据归档理解需求、继续之前类似开发、生成需求上下文包。
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=codebuddy; do not edit -->
 # harness-knowledge-query
 
 并行 change 中查询必须传 `--change <change-id>`；成功后以该 change 的 `meta/knowledge-context.json` 为稳定指针。全局 `context-packs/latest.json` 仅向后兼容，不得用于判断多个 active change 的上下文归属。

package/harness/bundles/general/codebuddy/harness-plan/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-plan
 description: 将需求转化为设计文档+实施计划+完整测试场景表，必须在编码前完成。使用场景：需求分析、feature plan、技术方案设计、实现方案规划
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=codebuddy; do not edit -->
 # harness-plan — 需求规划
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-review/SKILL.md

@@ -3,7 +3,7 @@ name: harness-review
 description: 6维度代码审查（架构/安全/规范/兼容/测试/性能），对照项目规则（见
   .harness/context-index.json）和测试场景表，在隔离上下文运行。使用场景：代码审查、提交前检查、合并评审
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=codebuddy; do not edit -->
 # harness-review — 代码审查
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-run/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-run
 description: 按变更簇执行 TDD 编码循环（RED→GREEN→REFACTOR→编译验证），逐变更簇实现计划中的任务。使用场景：开始编码、实现功能、写代码、TDD 编码
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=codebuddy; do not edit -->
 # harness-run — 需求编码
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-submit/SKILL.md

@@ -3,7 +3,7 @@ name: harness-submit
 description: 最终提交封装：验证→中文 commit→提交/推送；worktree 模式含 --no-ff
   合并回主分支。使用场景：提交代码、commit、push、合并分支、merge to main、完成开发
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=codebuddy; do not edit -->
 # harness-submit — 最终提交（含 worktree 合并）
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-sync/SKILL.md

@@ -4,7 +4,7 @@ description: Use when the user asks to synchronize, refresh, or validate Harness
   metadata, adapters, knowledge, rules, instruction entrypoints, config origins,
   or CodeGraph status.
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=codebuddy; do not edit -->
 # harness-sync
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-test/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-test
 description: 测试执行：读取场景表，执行单元测试+API接口测试+数据兼容验证，输出测试报告。当用户说'跑测试/验证/跑用例/接口测试/单元测试'时使用
 ---
-<!-- generated by harness_deploy.py; core=367eb27020f2b966; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=codebuddy; do not edit -->
 # harness-test — 测试执行
 
 ## Purpose

package/harness/bundles/general/codebuddy/scripts/harness_archive.py

@@ -1963,6 +1963,7 @@ def validate_sensitive_evidence_publication_gate(
     *,
     copy_root: Path | None = None,
     require_receipt: bool = False,
+    receipt_override: dict[str, Any] | None = None,
 ) -> dict[str, Any]:
     """Fail closed before freeze/copy when plaintext evidence is unresolved.
 
@@ -1983,7 +1984,7 @@ def validate_sensitive_evidence_publication_gate(
             "unresolvedFailures": candidates,
             "nextAction": "Quarantine the original bytes before archive publication.",
         }
-    if not receipt_path.is_file():
+    if receipt_override is None and not receipt_path.is_file():
         if require_receipt:
             return {
                 "ok": False,
@@ -1998,15 +1999,18 @@ def validate_sensitive_evidence_publication_gate(
             "receiptRequired": False,
             "unresolvedFailures": [],
         }
-    try:
-        receipt = read_json(receipt_path)
-    except (OSError, json.JSONDecodeError, TypeError) as exc:
-        return {
-            "ok": False,
-            "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
-            "receiptPath": str(receipt_path),
-            "error": str(exc),
-        }
+    if receipt_override is None:
+        try:
+            receipt = read_json(receipt_path)
+        except (OSError, json.JSONDecodeError, TypeError) as exc:
+            return {
+                "ok": False,
+                "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
+                "receiptPath": str(receipt_path),
+                "error": str(exc),
+            }
+    else:
+        receipt = receipt_override
     if not isinstance(receipt, dict):
         return {
             "ok": False,
@@ -7463,10 +7467,35 @@ def cmd_finalize(
         payload["error"] = f"archive target already exists: {archive_dir}"
         return 1, payload
 
+    source_sensitive_refresh = hruntime.refresh_sensitive_evidence_scan_receipt(
+        original_change_dir,
+        persist=False,
+    )
+    payload["steps"]["sensitive_evidence_source_refresh"] = source_sensitive_refresh
+    if not source_sensitive_refresh.get("ok"):
+        payload["error"] = str(
+            source_sensitive_refresh.get("error")
+            or "sensitive evidence source receipt refresh failed"
+        )
+        payload["issues"] = [
+            {
+                "code": str(
+                    source_sensitive_refresh.get("reasonCode")
+                    or "SECRET_SCAN_RECEIPT_REFRESH_FAILED"
+                ),
+                "severity": "error",
+                "message": payload["error"],
+            }
+        ]
+        payload["original_preserved"] = original_change_dir.is_dir()
+        payload["finalStatus"] = "FAIL"
+        return 1, payload
+
     source_sensitive_gate = validate_sensitive_evidence_publication_gate(
         original_change_dir,
         copy_root=original_change_dir,
-        require_receipt=False,
+        require_receipt=True,
+        receipt_override=source_sensitive_refresh.get("receipt"),
     )
     payload["steps"]["sensitive_evidence_source_gate"] = source_sensitive_gate
     if not source_sensitive_gate.get("ok"):
@@ -7580,9 +7609,38 @@ def cmd_finalize(
     # receipt in the isolated staging tree.  This keeps legacy archives
     # compatible while making every published archive auditable.
     try:
-        staged_receipt = hruntime.sensitive_evidence_receipt_path(work_dir)
-        if not staged_receipt.is_file():
-            hruntime.ensure_sensitive_evidence_scan_receipt(work_dir)
+        # Split-v1 runtime state becomes part of the publishable archive.  Merge
+        # it before the final scan so no late runtime byte can bypass the
+        # sensitive-evidence gate or invalidate the receipt digest.
+        if split_state_dir is not None and split_state_dir.is_dir():
+            _merge_runtime_state(split_state_dir, work_dir)
+            payload["steps"]["split_state_merge"] = {
+                "ok": True,
+                "stateDir": str(split_state_dir),
+            }
+        staged_sensitive_refresh = hruntime.refresh_sensitive_evidence_scan_receipt(
+            work_dir
+        )
+        payload["steps"][
+            "sensitive_evidence_staging_refresh"
+        ] = staged_sensitive_refresh
+        if not staged_sensitive_refresh.get("ok"):
+            payload["error"] = str(
+                staged_sensitive_refresh.get("error")
+                or "sensitive evidence staging receipt refresh failed"
+            )
+            payload["issues"] = [
+                {
+                    "code": str(
+                        staged_sensitive_refresh.get("reasonCode")
+                        or "SECRET_SCAN_RECEIPT_REFRESH_FAILED"
+                    ),
+                    "severity": "error",
+                    "message": payload["error"],
+                }
+            ]
+            _restore_finalize_failure()
+            return 1, payload
         staged_sensitive_gate = validate_sensitive_evidence_publication_gate(
             work_dir,
             copy_root=work_dir,
@@ -7608,13 +7666,6 @@ def cmd_finalize(
         _restore_finalize_failure()
         return 1, payload
 
-    if split_state_dir is not None and split_state_dir.is_dir():
-        _merge_runtime_state(split_state_dir, work_dir)
-        payload["steps"]["split_state_merge"] = {
-            "ok": True,
-            "stateDir": str(split_state_dir),
-        }
-
     def _safe_append(**kwargs: Any) -> None:
         nonlocal work_dir
         try: