@ngockhoale/ukit 3.3.3 → 3.4.0

package/template_project/.claude/ukit/runtime/execution-ledger.mjs

@@ -17,6 +17,10 @@ const LEDGER_VERSION = 1;
 const RESUME_INTENT_VERSION = 1;
 const RESUME_INTENT_TTL_MS = 30 * 60 * 1000;
 const MAX_RECEIPTS = 24;
+// TASK-005 (FR-005): bounded OutcomeRecord dedupe slot — a resumable-run
+// pointer (interrupted run) emits `outcome.observed` once per task; replays
+// and resume folds are seen via this list, never re-emitted.
+const MAX_LEDGER_OUTCOMES = 16;
 const MAX_SOURCE_FILES = 16;
 const MAX_CONTINUATIONS = 6;
 // A malformed stdin payload crashes `--evaluate-stop` before a route/session can be read, so
@@ -91,6 +95,16 @@ function sessionIdentity(payload = {}) {
   return 'default';
 }
 
+// TASK-C85-016 (BL-016): bounded identity string for the per-pair receipt
+// fields (implementer/reviewer/reviewVerdict). Model/role ids are short
+// strings; anything else collapses to null so OutcomeRecord fields stay
+// nullable-clean.
+function pairIdentity(value) {
+  return typeof value === 'string' && value.trim()
+    ? value.trim().slice(0, 96)
+    : null;
+}
+
 function ledgerPath(projectRoot, payload = {}) {
   return path.join(
     projectRoot,
@@ -312,7 +326,14 @@ function hasUnfinishedCompletion(state = {}, ledger = {}) {
   if (!IMPLEMENT_MODES.has(mode)) return false;
   const required = requiredEvidence(state);
   if (required.length === 0) return false;
-  return required.some((item) => !evidenceSatisfied(item, ledger, state));
+  const unfinished = required.some((item) => !evidenceSatisfied(item, ledger, state));
+  if (unfinished) return true;
+  // TASK-009 (BL-011): a bug-fix route is also unfinished while its floor is
+  // missing — the generic evidence alone never releases a bug fix.
+  if (state?.routeSummary?.playbookId === BUGFIX_PLAYBOOK_ID) {
+    return bugFixFloorMissing(bugFixFloorStatus(ledger, BUGFIX_PLAYBOOK_ID)).length > 0;
+  }
+  return false;
 }
 
 function resumeSessionHash(sessionId) {
@@ -480,7 +501,7 @@ function compactReceipt(receipt) {
     kind: receipt.kind,
     success: receipt.success,
   };
-  for (const key of ['toolName', 'toolUseId', 'file', 'command', 'exitCode', 'scope', 'error', 'verdict']) {
+  for (const key of ['toolName', 'toolUseId', 'file', 'command', 'exitCode', 'scope', 'error', 'verdict', 'evidence', 'evidenceSurface', 'class', 'status', 'detail']) {
     if (receipt[key] !== undefined && receipt[key] !== null && receipt[key] !== '') {
       compact[key] = receipt[key];
     }
@@ -894,10 +915,20 @@ function carriedEvidenceLedger(fresh, current) {
     // Verification-loop tracking and any minted blocker belong to the same logical request
     // too — dropping a blocker on re-key would resume the exact loop it recorded.
     failedVerificationStreak: current.failedVerificationStreak || null,
+    playbookId: fresh.playbookId || current.playbookId || null,
+    // The bug-fix floor bank is monotone request-scoped evidence — a same-prompt
+    // re-key must keep it or the gate would re-demand repro receipts mid-request.
+    bugFixFloor: current.bugFixFloor || fresh.bugFixFloor || null,
+    // TASK-008: the playbook-finding bank is request-scoped like the floor —
+    // a same-prompt re-key must keep the latest per-class statuses.
+    playbookFindings: current.playbookFindings || fresh.playbookFindings || null,
     verificationFailureCounts: current.verificationFailureCounts || {},
     blocker: current.blocker || null,
     // Journal bookkeeping belongs to the file, not the request: the dedupe memory must
     // survive a re-key or replayed journal events would be applied twice (TASK-027).
+    // Outcome-emit dedupe rides the same request carry — a same-prompt re-key
+    // must not re-emit an INTERRUPTED record it already wrote.
+    outcomes: [...(current.outcomes || []), ...(fresh.outcomes || [])].slice(-MAX_LEDGER_OUTCOMES),
     journalSeen: current.journalSeen || [],
     journalQuarantined: current.journalQuarantined || 0,
     lastJournalQuarantineAt: current.lastJournalQuarantineAt || null,
@@ -927,6 +958,16 @@ function freshLedger(payload, routeState, harness) {
     requestKey: routeState?.requestKey || null,
     promptKey: evidencePromptKey(routeState),
     routeFingerprint: routeState?.fingerprint || null,
+    // TASK-009 (BL-011): the routed playbook rides the ledger so the bug-fix
+    // completion floor can classify repro receipts at apply time — including
+    // journaled replays, where no route state is passed.
+    playbookId: routeState?.routeSummary?.playbookId || null,
+    // Bug-fix completion floor bank: monotone, request-scoped, never evicted by
+    // the receipt window. null until the first floor receipt lands.
+    bugFixFloor: null,
+    // TASK-008 (BL-010): latest-per-class playbook-finding statuses, banked
+    // outside the evictable receipt window.
+    playbookFindings: null,
     sourceSucceeded: false,
     sourceFiles: [],
     writeAttempted: false,
@@ -946,6 +987,9 @@ function freshLedger(payload, routeState, harness) {
     bankedWrites: {},
     bankedVerifications: {},
     notified: false,
+    // TASK-005 (FR-005): OutcomeRecord dedupe ledger ({verdict, runKey, at}).
+    // Emitted-once for INTERRUPTED survives re-keys via carriedEvidenceLedger.
+    outcomes: [],
     updatedAt: Date.now(),
   };
 }
@@ -971,7 +1015,7 @@ const MAX_JOURNAL_SEEN = 64;
 const MAX_JOURNAL_RECORDS = 128;
 const MAX_JOURNAL_QUARANTINE_LINES = 32;
 const LEDGER_EVENT_TYPES = new Set(['receipt', 'continuation', 'notified', 'stop-progress', 'resumable-run']);
-const RECEIPT_KINDS = new Set(['source', 'write', 'verification']);
+const RECEIPT_KINDS = new Set(['source', 'write', 'verification', 'playbook-finding']);
 
 function journalPathFor(target) {
   return `${target}.journal`;
@@ -1077,6 +1121,24 @@ function newEventId() {
 
 const JOURNAL_RECEIPT_FIELDS = ['ts', 'kind', 'toolName', 'toolUseId', 'success', 'exitCode', 'file', 'command', 'scope'];
 
+// TASK-009 (BL-011): evidence attestations are whitelisted verbatim — class /
+// surface / result / claim, the ARCH §Evidence Schema fields a receipt may
+// carry — because a journaled bug-fix receipt must replay with its floor
+// evidence intact. The nested whitelist bounds the journal record the same way
+// the flat one bounds the receipt.
+const JOURNAL_EVIDENCE_FIELDS = ['class', 'surface', 'result', 'claim'];
+
+function sanitizeEvidenceForJournal(evidence) {
+  if (!evidence || typeof evidence !== 'object' || Array.isArray(evidence)) return null;
+  const clean = {};
+  for (const key of JOURNAL_EVIDENCE_FIELDS) {
+    const value = evidence[key];
+    if (value === undefined || value === null || value === '') continue;
+    clean[key] = String(value).slice(0, 400);
+  }
+  return Object.keys(clean).length > 0 ? clean : null;
+}
+
 function sanitizeReceiptForJournal(receipt) {
   const clean = {};
   for (const key of JOURNAL_RECEIPT_FIELDS) {
@@ -1084,6 +1146,8 @@ function sanitizeReceiptForJournal(receipt) {
       clean[key] = receipt[key];
     }
   }
+  const evidence = sanitizeEvidenceForJournal(receipt && receipt.evidence);
+  if (evidence) clean.evidence = evidence;
   return clean;
 }
 
@@ -1312,6 +1376,203 @@ async function drainJournal(target, { ledger, payload, signal, deadlineMs }) {
   return { ledger: next, applied, quarantined: malformed.length, commit };
 }
 
+// --- TASK-009 (BL-011): bug-fix completion floor --------------------------------
+// A green verdict on a `playbookId: bug-fix` route requires verbatim
+// `repro-before` (failing) + `repro-after` (passing) evidence receipts on the
+// SAME surface plus a named root cause in the exec-ledger — a symptom patch
+// without receipts cannot pass the gate. A defect that honest attempts cannot
+// reproduce ends INCONCLUSIVE with the attempt count and the runtime-forensics
+// follow-on named; the floor never fabricates a pass.
+//
+// Receipts may carry an explicit ARCH §Evidence Schema attestation
+// (`receipt.evidence = {class, surface, result, claim}`) — minted from
+// `payload.evidence`, `payload.tool_input.evidence`, or a leading
+// `UKIT_EVIDENCE=class=…;surface=…` env assignment on a Bash command. On a
+// bug-fix ledger the apply step additionally classifies every un-attested
+// verification receipt itself: a failed verification is a `repro-before`
+// (the old failure reproduced verbatim), and a success on a surface with a
+// recorded failure is the `repro-after` — so the live hook path produces the
+// floor without any attestation at all. Derived classes are stamped back onto
+// the receipt, which keeps them verbatim inside the receipt window.
+//
+// The bank lives in `ledger.bugFixFloor` and is monotone per request: receipts
+// evicted by the MAX_RECEIPTS window can never un-bank evidence. `seen` dedupes
+// per surface+class so replayed journal records and eval-time receipt folds
+// are idempotent.
+const BUGFIX_PLAYBOOK_ID = 'bug-fix';
+const BUGFIX_REPRO_BEFORE = 'repro-before';
+const BUGFIX_REPRO_AFTER = 'repro-after';
+const BUGFIX_FLOOR_SEEN_CAP = 32;
+// Root-cause classes: the mechanism attestation carries the named cause in
+// `claim` (ARCH §Done Criteria: instrumentation/behavioral-check for the named
+// mechanism; `root-cause` attested directly is accepted too).
+const BUGFIX_ROOT_CAUSE_CLASSES = new Set(['root-cause', 'instrumentation', 'behavioral-check']);
+const BUGFIX_FLOOR_CLASSES = new Set([
+  BUGFIX_REPRO_BEFORE,
+  BUGFIX_REPRO_AFTER,
+  ...BUGFIX_ROOT_CAUSE_CLASSES,
+]);
+const EVIDENCE_RESULTS = new Set(['pass', 'fail', 'inconclusive']);
+const EVIDENCE_FIELD_MAX = 400;
+
+function emptyBugFixFloor() {
+  return {
+    seen: [],
+    reproAttempts: 0,
+    // surface -> true: the original failure reproduced verbatim on it.
+    reproBefore: {},
+    // surface -> true: the same surface went green after the fix.
+    reproAfter: {},
+    rootCause: null,
+  };
+}
+
+// A receipt's floor surface is its attested surface verbatim, else the
+// terminal-shell identity of its command — env-var prefixes (the
+// UKIT_EVIDENCE attestation channel) never change the surface of a command.
+function bugFixReceiptSurface(receipt) {
+  const attested = receipt?.evidence?.surface;
+  if (typeof attested === 'string' && attested) return attested;
+  const command = String(receipt?.command || '').trim();
+  if (!command) return null;
+  const stripped = command.replace(/^(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)+/, '');
+  return terminalShellCommandUnit(stripped) || stripped;
+}
+
+// The class a receipt carries for the floor: an attested floor class wins;
+// otherwise, on a bug-fix ledger only, the verification outcome itself is the
+// evidence — a failed run is repro-before, a pass over a failed surface is
+// repro-after. `failureCounts` must be the per-surface failure map observed
+// BEFORE this receipt applies (the live path passes
+// `ledger.verificationFailureCounts`; the eval fold passes a counter it builds
+// while walking the receipt window in order).
+function bugFixReceiptClass(receipt, floor, failureCounts = {}, playbookId = null) {
+  const attested = receipt?.evidence?.class;
+  if (typeof attested === 'string' && BUGFIX_FLOOR_CLASSES.has(attested)) return attested;
+  if (playbookId !== BUGFIX_PLAYBOOK_ID || receipt?.kind !== 'verification' || receipt?.evidence) {
+    return null;
+  }
+  if (receipt.success === true) {
+    const surface = bugFixReceiptSurface(receipt);
+    if (
+      surface
+      && (floor.reproBefore[surface] === true || Number(failureCounts[surface]) > 0)
+    ) {
+      return BUGFIX_REPRO_AFTER;
+    }
+    return null;
+  }
+  // A failed verification on a bug-fix ledger IS the reproduced old failure —
+  // verbatim, no attestation needed.
+  return BUGFIX_REPRO_BEFORE;
+}
+
+// Fold one receipt into the floor bank. Idempotent per surface+class: replayed
+// journal records and the eval-time window fold can run over the same receipt
+// without double counting. A `repro-after` only banks on a surface with a
+// confirmed `repro-before` — a passing run on an unrelated surface is not the
+// fix-proof the playbook demands (same-surface rule, verbatim).
+function foldBugFixReceipt(floor, receipt, playbookId = null, failureCounts = {}) {
+  const cls = bugFixReceiptClass(receipt, floor, failureCounts, playbookId);
+  if (!cls) return floor;
+  const surface = bugFixReceiptSurface(receipt);
+  // The dedupe stamp identifies one receipt, not one surface: every recorded
+  // repro attempt counts toward the INCONCLUSIVE report, while a replayed
+  // journal record (same receipt) folds idempotently.
+  const stamp = `${cls}:${surface || '-'}:${receipt?.toolUseId ?? receipt?.ts ?? ''}`;
+  if (floor.seen.includes(stamp)) return floor;
+  const next = { ...floor, seen: [...floor.seen, stamp].slice(-BUGFIX_FLOOR_SEEN_CAP) };
+  if (cls === BUGFIX_REPRO_BEFORE) {
+    // Every recorded attempt counts toward the INCONCLUSIVE report; only a
+    // verbatim FAIL confirms the defect reproduced.
+    next.reproAttempts += 1;
+    const result = receipt?.evidence?.result;
+    if (result === 'fail' || (receipt?.success !== true && result !== 'pass' && result !== 'inconclusive')) {
+      next.reproBefore = { ...next.reproBefore, ...(surface ? { [surface]: true } : {}) };
+    }
+    return next;
+  }
+  if (cls === BUGFIX_REPRO_AFTER) {
+    const result = receipt?.evidence?.result;
+    const reproduced = surface !== null && next.reproBefore[surface] === true;
+    if (
+      surface !== null
+      && reproduced
+      && (result === 'pass' || (receipt?.success === true && result !== 'fail' && result !== 'inconclusive'))
+    ) {
+      next.reproAfter = { ...next.reproAfter, [surface]: true };
+    }
+    return next;
+  }
+  // Root-cause classes: the claim names the mechanism; an unattributed
+  // attestation does not satisfy the floor.
+  const claim = receipt?.evidence?.claim;
+  if (typeof claim === 'string' && claim.trim()) {
+    next.rootCause = String(claim).slice(0, EVIDENCE_FIELD_MAX);
+  }
+  return next;
+}
+
+// The eval-side view: the bank is authoritative, and receipts still inside the
+// window are folded through the same rules so a fixture ledger that never ran
+// recordExecutionReceipt (no bank) is judged identically. Per-surface failure
+// counts are rebuilt by walking the window in order.
+function bugFixFloorStatus(ledger = {}, playbookId = null) {
+  const floor = ledger.bugFixFloor || emptyBugFixFloor();
+  const counts = {};
+  let merged = {
+    ...floor,
+    seen: [...floor.seen],
+    reproBefore: { ...floor.reproBefore },
+    reproAfter: { ...floor.reproAfter },
+  };
+  for (const receipt of Array.isArray(ledger.receipts) ? ledger.receipts : []) {
+    merged = foldBugFixReceipt(merged, receipt, playbookId, counts);
+    if (receipt?.kind === 'verification') {
+      const surface = bugFixReceiptSurface(receipt);
+      if (surface) {
+        if (receipt.success === true) delete counts[surface];
+        else counts[surface] = Number(counts[surface] || 0) + 1;
+      }
+    }
+  }
+  return merged;
+}
+
+function bugFixFloorMissing(floor) {
+  const missing = [];
+  if (Object.values(floor.reproBefore).every((value) => value !== true)) {
+    missing.push('repro-before');
+  }
+  if (Object.values(floor.reproAfter).every((value) => value !== true)) {
+    missing.push('repro-after');
+  }
+  if (!floor.rootCause) missing.push('root-cause');
+  return missing;
+}
+
+// Mint the class onto the receipt (verbatim evidence) and fold it. Runs before
+// appendReceipt so the derived class is kept inside the receipt window too.
+function applyBugFixFloorReceipt(ledger, receipt) {
+  if (ledger?.playbookId !== BUGFIX_PLAYBOOK_ID) return receipt;
+  const cls = bugFixReceiptClass(
+    receipt,
+    ledger.bugFixFloor || emptyBugFixFloor(),
+    ledger.verificationFailureCounts || {},
+    ledger.playbookId,
+  );
+  if (cls && !receipt.evidence?.class) {
+    receipt = {
+      ...receipt,
+      evidence: {
+        ...(receipt.evidence && typeof receipt.evidence === 'object' ? receipt.evidence : {}),
+        class: cls,
+      },
+    };
+  }
+  return receipt;
+}
+
 function applyReceiptToLedger(ledger, receipt, { vibecode = false } = {}) {
   if (!receipt || typeof receipt !== 'object' || !RECEIPT_KINDS.has(receipt.kind)) return null;
   const next = { ...ledger };
@@ -1406,6 +1667,51 @@ function applyReceiptToLedger(ledger, receipt, { vibecode = false } = {}) {
       }
     }
   }
+  // TASK-008 (BL-010): advisory playbook-finding receipts — the latest status
+  // per receipt class is banked on `playbookFindings` so consumers never have
+  // to re-fold an evictable receipt window. An identical-status repeat is a
+  // no-op (the window is not flooded); a status change replaces the entry.
+  if (receipt.kind === 'playbook-finding') {
+    const cls = typeof receipt.class === 'string' ? receipt.class : null;
+    if (!cls) {
+      next.receipts = appendReceipt(next.receipts, receipt);
+      next.updatedAt = Date.now();
+      return { ledger: next, value: null };
+    }
+    const prior = ledger?.playbookFindings?.[cls];
+    if (prior && prior.status === receipt.status) {
+      return { ledger: next, value: null };
+    }
+    next.playbookFindings = {
+      ...(ledger?.playbookFindings && typeof ledger.playbookFindings === 'object'
+        ? ledger.playbookFindings
+        : {}),
+      [cls]: {
+        status: receipt.status ?? null,
+        detail: receipt.detail ?? null,
+        file: receipt.file ?? null,
+        ts: receipt.ts ?? Date.now(),
+      },
+    };
+    next.receipts = appendReceipt(next.receipts, receipt);
+    next.updatedAt = Date.now();
+    return { ledger: next, value: null };
+  }
+  // TASK-009 (BL-011): fold the receipt into the bug-fix floor bank before it
+  // enters the (evictable) receipt window. The fold runs on the pre-update
+  // verificationFailureCounts: a pass over a surface whose failure is still
+  // recorded is the repro-after the floor demands. Bug-fix ledgers only —
+  // non-bug-fix ledgers never grow the field.
+  if (ledger?.playbookId === BUGFIX_PLAYBOOK_ID) {
+    receipt = applyBugFixFloorReceipt(ledger, receipt);
+    next.bugFixFloor = foldBugFixReceipt(
+      ledger.bugFixFloor || emptyBugFixFloor(),
+      receipt,
+      ledger.playbookId,
+      ledger.verificationFailureCounts || {},
+    );
+  }
+
   next.receipts = appendReceipt(next.receipts, receipt);
   next.updatedAt = Date.now();
   return { ledger: next, value: null };
@@ -1490,6 +1796,68 @@ function liveBaseLedger(event, current, payload, routeState, harness, fallbackLe
   return current || fallbackLedger || freshLedger(payload, null, 'unknown');
 }
 
+// --- TASK-005 (FR-005, BL-007): outcome.observed terminal emissions ---------
+// OutcomeRecord = ARCH §Data Contracts: outcomeId, runId, routeId,
+// routeFingerprint, ledgerKey, verdict ∈ OUTCOME_VERDICTS, evidenceIds[],
+// cost{latencyMs,rounds}, reviewActions[], enforcement: enforced|advisory,
+// ts — plus the TASK-003 session-boot `request_key` join id. The emit module
+// (observability-emit.mjs, TASK-003) owns record construction; the ledger
+// owns WHEN a terminal event fires.
+let observabilityEmitModule = null;
+
+async function loadObservabilityEmit() {
+  if (observabilityEmitModule === null) {
+    try {
+      observabilityEmitModule = await import(
+        new URL('./observability-emit.mjs', import.meta.url).href
+      );
+    } catch {
+      observabilityEmitModule = false;
+    }
+  }
+  return observabilityEmitModule === false ? null : observabilityEmitModule;
+}
+
+/**
+ * Fire-and-forget `outcome.observed` emission (FR-005). `outcome` is the
+ * emitter's terminal descriptor ({verdict, source, routeId?, routeFingerprint?,
+ * ledgerKey?, runId?, evidenceIds?, cost?, reviewActions?}); the builder stamps
+ * outcomeId/ts/enforcement/request_key. NEVER throws and returns null on any
+ * failure — a dropped telemetry write must never block a receipt, the Stop
+ * gate, or session end (acceptance: emission is fire-and-forget).
+ */
+export async function emitTerminalOutcome({
+  projectRoot,
+  outcome,
+  payload = {},
+  harness = null,
+  engine = null,
+  env = null,
+  deadlineMs,
+} = {}) {
+  try {
+    const emit = await loadObservabilityEmit();
+    if (!emit || typeof emit.emitOutcomeObserved !== 'function'
+      || typeof emit.buildOutcomeObservedRecord !== 'function') {
+      return null;
+    }
+    const descriptor = outcome && typeof outcome === 'object' ? outcome : {};
+    const record = emit.buildOutcomeObservedRecord({
+      outcome: { ...descriptor, engine: engine ?? harness ?? descriptor.engine ?? null },
+      projectRoot,
+      payload: payload && typeof payload === 'object' ? payload : {},
+      env: env === null ? process.env : env,
+    });
+    return await emit.emitOutcomeObserved({
+      projectRoot,
+      record,
+      deadlineMs,
+    });
+  } catch {
+    return null;
+  }
+}
+
 /**
  * The one locked mutation protocol for the execution ledger (TASK-027). Never mutates
  * the ledger without lock ownership; journals the event when the lock cannot be taken.
@@ -1513,8 +1881,15 @@ export async function recordLedgerEvent(event, {
   }
   const eventId = newEventId();
   const target = ledgerPath(projectRoot, payload);
+  // Hoisted so the post-commit outcome emitter sees the same state snapshot
+  // the lock callback evaluated (a fresh read could observe a re-route).
+  let lockedRouteState = routeState || null;
+  // The descriptor the post-commit emitter must fire (lock-local `value` is
+  // nested two levels deep in the lock result — a hoisted ref is clearer).
+  let emittedOutcome = null;
   const outcome = await withLedgerLock(target, { signal, deadlineMs }, async () => {
     const state = routeState || await readRouteState(projectRoot, payload);
+    lockedRouteState = state || null;
     const current = await readExecutionLedger(projectRoot, payload);
     let ledger = liveBaseLedger(event, current, payload, state, harness, fallbackLedger);
     // Reconcile pending journaled events first — inside this caller's acquired lock and
@@ -1523,15 +1898,91 @@ export async function recordLedgerEvent(event, {
     ledger = drained.ledger;
     let value;
     if (event.type === 'receipt') {
+      // TASK-009 (BL-011): stamp the routed playbook on the ledger so the floor
+      // fold can classify repro receipts at apply time — including journaled
+      // replays, where the ledger's own stamp is the only playbook carrier.
+      // A lost route state (state null) keeps the stamp the request already had.
+      const playbookId = state?.routeSummary?.playbookId || null;
+      if (state && ledger.playbookId !== playbookId) {
+        ledger = { ...ledger, playbookId };
+      }
       const applied = applyReceiptToLedger(ledger, event.receipt, { vibecode: event.vibecode === true });
       if (!applied) return { committed: false, eventId, reason: 'invalid-receipt' };
       ledger = applied.ledger;
+      // TASK-005 (FR-005): completion receipts (write/verification terminal
+      // fields — source receipts carry no outcome signal) mint a descriptor
+      // the CALLER emits: record-execution.mjs for the hook path, the
+      // `--record` CLI for direct invocation. Emitted via the shared seam,
+      // never inside the lock.
+      if (event.receipt?.kind === 'write' || event.receipt?.kind === 'verification') {
+        value = {
+          outcome: {
+            verdict: event.receipt.success === true ? 'VERIFIED' : 'FAILED',
+            source: `receipt-${event.receipt.kind}`,
+            routeId: state?.requestKey ?? ledger?.requestKey ?? null,
+            routeFingerprint: ledger?.routeFingerprint ?? state?.fingerprint ?? null,
+            ledgerKey: `sess-${sessionIdentity(payload)}`,
+            evidenceIds: event.receipt.toolUseId ? [String(event.receipt.toolUseId).slice(0, 160)] : [],
+            cost: { latencyMs: null, rounds: Number.isFinite(ledger?.continuationCount) ? ledger.continuationCount : null },
+            reviewActions: [],
+            // TASK-C85-016 (BL-016): per-pair tracking — nullable, additive.
+            implementer: pairIdentity(event.receipt?.implementer ?? payload.implementer),
+            reviewer: pairIdentity(event.receipt?.reviewer ?? payload.reviewer),
+            reviewVerdict: pairIdentity(event.receipt?.reviewVerdict ?? payload.reviewVerdict),
+          },
+        };
+      }
     } else if (event.type === 'continuation') {
       ledger = applyContinuationToLedger(ledger, event);
     } else if (event.type === 'notified') {
       ledger = { ...ledger, notified: true, updatedAt: Date.now() };
     } else if (event.type === 'resumable-run') {
+      // TASK-005 (FR-005): a resumable-run pointer is the interrupted-run
+      // terminal event — emit `outcome.observed` verdict INTERRUPTED exactly
+      // ONCE per task. The ledger's `outcomes` dedupe slot (carried across
+      // re-keys by carriedEvidenceLedger) suppresses journal replays and
+      // resume-fold re-emissions; `run` pointers that fail to apply never
+      // mint an outcome.
+      const resumableBefore = ledger?.resumableRun || null;
       ledger = applyResumableRunToLedger(ledger, event.run);
+      const resumableApplied = ledger.resumableRun !== resumableBefore;
+      const runKey = typeof event.run?.taskId === 'string' && event.run.taskId
+        ? String(event.run.taskId).slice(0, 160)
+        : null;
+      if (resumableApplied && runKey) {
+        const prior = Array.isArray(ledger.outcomes) ? ledger.outcomes : [];
+        if (!prior.some((entry) => entry?.verdict === 'INTERRUPTED' && entry?.runKey === runKey)) {
+          ledger = {
+            ...ledger,
+            outcomes: [...prior, { verdict: 'INTERRUPTED', runKey, at: Date.now() }]
+              .slice(-MAX_LEDGER_OUTCOMES),
+          };
+          emittedOutcome = {
+            verdict: 'INTERRUPTED',
+            source: 'resumable-run',
+            runId: `run-${runKey.replace(/[^a-zA-Z0-9._-]/g, '_')}`,
+            routeId: state?.requestKey ?? ledger?.requestKey ?? null,
+            routeFingerprint: ledger?.routeFingerprint ?? state?.fingerprint ?? null,
+            ledgerKey: `sess-${sessionIdentity(payload)}`,
+            evidenceIds: [],
+            cost: { latencyMs: null, rounds: null },
+            reviewActions: [],
+          };
+          value = {
+            outcome: {
+              verdict: 'INTERRUPTED',
+              source: 'resumable-run',
+              runId: `run-${runKey.replace(/[^a-zA-Z0-9._-]/g, '_')}`,
+              routeId: state?.requestKey ?? ledger?.requestKey ?? null,
+              routeFingerprint: ledger?.routeFingerprint ?? state?.fingerprint ?? null,
+              ledgerKey: `sess-${sessionIdentity(payload)}`,
+              evidenceIds: [],
+              cost: { latencyMs: null, rounds: null },
+              reviewActions: [],
+            },
+          };
+        }
+      }
     } else if (event.type === 'stop-progress') {
       if (!current && drained.applied === 0) {
         // A stop with no ledger at all creates nothing (historic noteStopProgress shape).
@@ -1553,6 +2004,20 @@ export async function recordLedgerEvent(event, {
     return { committed: true, eventId, value, drained: drained.applied, quarantined: drained.quarantined };
   });
   if (outcome.ok) {
+    // TASK-005 (FR-005): ledger-owned terminal events emit their outcome
+    // descriptor after the commit — never inside the lock (the emit runs its
+    // own bounded write) and never for the caller-owned receipt path
+    // (record-execution.mjs / --record emit those).
+    if (event.type === 'resumable-run' && emittedOutcome) {
+      try {
+        await emitTerminalOutcome({
+          projectRoot,
+          outcome: emittedOutcome,
+          payload,
+          harness,
+        });
+      } catch { /* telemetry must never block the ledger */ }
+    }
     // Sampled bounded dir sweep (BUG-C21-11): runs outside the ledger lock so a
     // contended acquisition never pays sweep latency. Advisory — never throws.
     // BUG-C23-10: a persistent failure is still surfaced as a bounded degrade.
@@ -1576,6 +2041,63 @@ export async function recordLedgerEvent(event, {
   return { rejected: true, eventId, reason: journalResult.reason };
 }
 
+// TASK-009 (BL-011): an evidence attestation rides a receipt as the bounded
+// ARCH §Evidence Schema tuple {class, surface, result, claim}. Attestation
+// surfaces, checked in order: `payload.evidence` (the `--record` CLI and
+// in-proc callers), `payload.tool_input.evidence` (tools that pass extra
+// input fields through), and a leading `UKIT_EVIDENCE=class=…;surface=…` env
+// assignment on a Bash command (the one channel a model can mint through an
+// ordinary Bash call). Values are bounded strings only — no tool output.
+function normalizeEvidenceAttestation(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const clean = {};
+  for (const key of JOURNAL_EVIDENCE_FIELDS) {
+    const field = value[key];
+    if (field === undefined || field === null || field === '') continue;
+    const text = String(field).slice(0, EVIDENCE_FIELD_MAX);
+    if (key === 'result' && !EVIDENCE_RESULTS.has(text)) continue;
+    clean[key] = text;
+  }
+  return Object.keys(clean).length > 0 ? clean : null;
+}
+
+function parseCommandEvidence(command) {
+  const text = String(command || '').trim();
+  const match = text.match(/^UKIT_EVIDENCE=((?:"[^"]*")|(?:'[^']*')|(?:\S+))/);
+  if (!match) return null;
+  let token = match[1];
+  if (
+    (token.startsWith('"') && token.endsWith('"'))
+    || (token.startsWith("'") && token.endsWith("'"))
+  ) {
+    token = token.slice(1, -1);
+  }
+  const fields = {};
+  for (const part of token.split(';')) {
+    const trimmed = part.trim();
+    if (!trimmed) continue;
+    const eq = trimmed.indexOf('=');
+    if (eq === -1) {
+      if (!('class' in fields)) fields.class = trimmed;
+      continue;
+    }
+    const key = trimmed.slice(0, eq).trim();
+    const fieldValue = trimmed.slice(eq + 1).trim();
+    if (JOURNAL_EVIDENCE_FIELDS.includes(key) && fieldValue) {
+      fields[key] = fieldValue;
+    }
+  }
+  return normalizeEvidenceAttestation(fields);
+}
+
+function receiptEvidenceAttestation(payload, toolInput) {
+  return (
+    normalizeEvidenceAttestation(payload?.evidence)
+    || normalizeEvidenceAttestation(toolInput?.evidence)
+    || parseCommandEvidence(toolInput?.command)
+  );
+}
+
 // TASK-027: the receipt is classified (kind, file, command, targeted/broad scope) from the
 // advisory route state BEFORE locking — that read is read-only — and then applied through
 // recordLedgerEvent, which owns the fail-closed lock/journal protocol.
@@ -1593,6 +2115,7 @@ export async function recordExecutionReceipt({
   const exitCode = extractExitCode(payload);
   const success = !failed && (exitCode === null || exitCode === 0);
   const toolInput = payload.tool_input || {};
+  const evidence = receiptEvidenceAttestation(payload, toolInput);
   const receipt = {
     ts: Date.now(),
     toolName,
@@ -1607,7 +2130,12 @@ export async function recordExecutionReceipt({
   } else if (toolName === 'Edit' || toolName === 'Write') {
     receipt.kind = 'write';
     receipt.file = toolInput.file_path || toolInput.path || toolInput.paths?.[0] || null;
-  } else if (toolName === 'Bash' && isVerificationCommand(toolInput.command)) {
+  } else if (toolName === 'Bash' && (isVerificationCommand(toolInput.command) || evidence)) {
+    // TASK-009 (BL-011): a Bash command carrying an evidence attestation
+    // records as a verification receipt even when the command is not a known
+    // test runner — a repro command, a trace, a one-off check. The typed
+    // verdict stays restricted to real verification commands: attestation
+    // alone must never mint verification evidence.
     receipt.kind = 'verification';
     receipt.command = String(toolInput.command || '').trim();
     // WS-C routed-verification receipt: a command counts as "targeted" when it matches the
@@ -1622,11 +2150,24 @@ export async function recordExecutionReceipt({
     // SPEC-typed-verdicts §2.1: every verification receipt mints a typed verdict record
     // (kind/evidence/verifier/headSha/baseSha/patchId/ts). Explicit payload.verdict
     // fields win so a hook or subagent verifier can attest its own kind and identity.
-    receipt.verdict = mintVerificationVerdict(receipt, payload, projectRoot);
+    if (isVerificationCommand(toolInput.command)) {
+      receipt.verdict = mintVerificationVerdict(receipt, payload, projectRoot);
+    }
   } else {
     // Untracked tool: no event, no lock, no write — same as the old unlocked early return.
     return { rejected: true, eventId: null };
   }
+  if (evidence) {
+    receipt.evidence = evidence;
+  }
+
+  // TASK-C85-016 (BL-016): additive per-pair tracking fields — the caller
+  // (hook payload or a future review lane) attests who implemented, who
+  // reviewed, and the verdict. Nullable + bounded; absent → null on the
+  // outcome descriptor so old ledgers stay valid.
+  receipt.implementer = pairIdentity(payload.implementer ?? toolInput.implementer);
+  receipt.reviewer = pairIdentity(payload.reviewer ?? toolInput.reviewer);
+  receipt.reviewVerdict = pairIdentity(payload.reviewVerdict ?? toolInput.reviewVerdict);
 
   return recordLedgerEvent(
     {
@@ -1691,6 +2232,17 @@ function requiredEvidence(state = {}) {
   if (routeSummary.riskEscalation?.level === 'high' && routeSummary.riskEscalation?.stage !== 'shadow') {
     required.push('verification-evidence');
   }
+  // TASK-C85-014 (BL-014): a resolved verification-map recipe rides the route
+  // summary (stamped by stop-coordinator's recipe consult). Its
+  // evidenceRequired[] classes join the required set verbatim — a `|` token
+  // is an anyOf list satisfied by ANY alternative receipt class. Absent or
+  // malformed recipe data adds nothing: the gate stays exactly as before.
+  const recipeRequired = routeSummary.verificationRecipe?.evidenceRequired;
+  if (Array.isArray(recipeRequired)) {
+    for (const item of recipeRequired) {
+      if (typeof item === 'string' && item.trim()) required.push(item.trim());
+    }
+  }
   return [...new Set(required)];
 }
 
@@ -1733,12 +2285,83 @@ function evidenceSatisfied(evidence, ledger = {}, state = {}, { cwd } = {}) {
     }
     return ledger.sourceSucceeded === true;
   }
-  return false;
+  // TASK-C85-014 (BL-014): recipe evidence classes (verification-map.json
+  // artifactClasses.<cls>.evidenceRequired) satisfy by receipt attestation /
+  // playbook-finding bank — see receiptEvidenceSatisfied below.
+  return receiptEvidenceSatisfied(evidence, ledger);
+}
+
+// ─── Receipt-class satisfaction (TASK-C85-014 fix round) ────────────────────
+// Semantics identical to receiptEvidenceSatisfied in
+// ukit/index/verification-map.mjs (canonical: src/index/verificationMap.js).
+// A shared leaf is impossible — runtime/ must not static-import index/
+// (partial installs break: the ledger runs with the reader absent) — so parity
+// is enforced by tests/consistency/receiptSatisfactionParity.test.js instead.
+// Any `|` alternative satisfies; the playbook-finding bank is latest-wins (a
+// later 'missing' finding revokes an earlier 'satisfied' one, and a satisfied
+// class survives receipt eviction via the bank). A failed attestation is not
+// proof of the class.
+export function receiptEvidenceSatisfied(requiredClass, ledger = {}) {
+  const token = String(requiredClass || '').trim();
+  const alternatives = token
+    .split('|')
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+  if (alternatives.length === 0) return false;
+  const matchesClass = (value) => {
+    const cls = typeof value === 'string' ? value.trim() : '';
+    return cls === token || alternatives.includes(cls);
+  };
+  // The banked latest-per-class status governs the receipt window; several
+  // banked keys can match one anyOf token, so the newest entry wins. A
+  // playbook-finding receipt folds into the bank regardless of its success
+  // flag — the receipt scan below mirrors that.
+  let bankedTs = -1;
+  let bankedStatus = null;
+  const bank = ledger?.playbookFindings;
+  if (bank && typeof bank === 'object') {
+    for (const [key, entry] of Object.entries(bank)) {
+      if (!matchesClass(key)) continue;
+      const ts = typeof entry?.ts === 'number' ? entry.ts : 0;
+      if (ts >= bankedTs) {
+        bankedTs = ts;
+        bankedStatus = typeof entry?.status === 'string' ? entry.status : null;
+      }
+    }
+  }
+  const receipts = Array.isArray(ledger?.receipts) ? ledger.receipts : [];
+  let attested = false;
+  let scannedStatus = null;
+  for (const receipt of receipts) {
+    if (!receipt || typeof receipt !== 'object') continue;
+    if (receipt.kind === 'playbook-finding') {
+      if (matchesClass(receipt.class) && typeof receipt.status === 'string') {
+        scannedStatus = receipt.status; // chronological — last write wins
+      }
+      continue;
+    }
+    if (receipt.success === false) continue;
+    const cls = receipt?.evidence?.class;
+    if (typeof cls === 'string' && alternatives.includes(cls.trim())) attested = true;
+  }
+  if (attested) return true;
+  const findingStatus = bankedTs >= 0 ? bankedStatus : scannedStatus;
+  return findingStatus === 'satisfied';
 }
 
 function recoveryInstruction(missingEvidence, ledger = {}, routeSummary = {}, { cwd } = {}) {
   let instruction = null;
-  if (missingEvidence.includes('write-evidence')) {
+  // TASK-009 (BL-011): bug-fix floor instructions take precedence — the fix
+  // loop needs the verbatim repro pair and the named mechanism, not more
+  // generic write/verify pushes.
+  if (missingEvidence.includes('repro-before')) {
+    instruction = 'Reproduce the original failure verbatim on the defect surface and record it as the repro-before receipt (failing run). No fix evidence counts before the failure is proven.';
+  } else if (missingEvidence.includes('repro-after')) {
+    instruction = 'Re-run the original repro on the same surface after the fix and record the passing repro-after receipt — a different surface or unrelated green check is not the fix-proof.';
+  } else if (missingEvidence.includes('root-cause')) {
+    instruction = 'Record the root cause: attest the named mechanism (UKIT_EVIDENCE root-cause/instrumentation/behavioral-check with claim) — the rejected hypotheses and the surviving mechanism, one line each.';
+  }
+  if (!instruction && missingEvidence.includes('write-evidence')) {
     if (!ledger.sourceSucceeded) {
       instruction = 'Pull one bounded indexed source slice, then make the requested Edit/Write in this continuation.';
     } else if (ledger.writeAttempted && !ledger.writeSucceeded) {
@@ -1772,6 +2395,21 @@ function recoveryInstruction(missingEvidence, ledger = {}, routeSummary = {}, {
       }
     }
   }
+  // TASK-C85-014 (BL-014): a missing recipe receipt names the recipe's own
+  // check and its capability-negotiated fallback receipt spec — never a
+  // fabricated command.
+  if (!instruction) {
+    const recipe = routeSummary?.verificationRecipe;
+    const recipeMissing = missingEvidence.filter((item) =>
+      Array.isArray(recipe?.evidenceRequired) && recipe.evidenceRequired.includes(item));
+    if (recipeMissing.length > 0) {
+      instruction = [
+        `The verification-map recipe for artifact class '${recipe.artifactClass || 'unknown'}' requires receipt class ${recipeMissing.join(', ')}.`,
+        recipe.check ? `Check: ${recipe.check}` : null,
+        recipe.fallback ? `Fallback receipt: ${recipe.fallback}` : null,
+      ].filter(Boolean).join(' ');
+    }
+  }
   // WS-C: the target hint travels with the reason whenever impact evidence is missing and
   // the route names expected files — it must survive branch precedence above.
   if (missingEvidence.includes('impact-evidence')) {
@@ -1858,6 +2496,44 @@ export function evaluateCompletion({ state = {}, ledger = {}, cwd } = {}) {
     || (ledger.promptKey && evidencePromptKey(state) === ledger.promptKey);
   const effectiveLedger = sameRequest ? ledger : {};
   const missingEvidence = evidence.filter((item) => !evidenceSatisfied(item, effectiveLedger, state, { cwd }));
+  // TASK-009 (BL-011): the bug-fix floor. On a `playbookId: bug-fix` route a
+  // green verdict requires verbatim repro-before (fail) + repro-after (pass)
+  // receipts on the same surface plus a named root cause in the exec-ledger —
+  // symptom-patching without receipts can never release green. Scoped to
+  // bug-fix only: every other playbook and plain-mode route keeps the generic
+  // completion behavior (false-block = 0 on the P2 gate).
+  const playbookId = routeSummary.playbookId || null;
+  if (playbookId === BUGFIX_PLAYBOOK_ID) {
+    const floor = bugFixFloorStatus(effectiveLedger, playbookId);
+    missingEvidence.push(...bugFixFloorMissing(floor));
+    // An unreproducible defect ends INCONCLUSIVE, never a fabricated pass and
+    // never an unbounded recovery loop: the defect could not be reproduced in
+    // the recorded attempts, so the fix floor is unreachable. The reason names
+    // the attempt count and the runtime-forensics follow-on (playbook step 5).
+    if (
+      floor.reproAttempts > 0
+      && Object.values(floor.reproBefore).every((value) => value !== true)
+      && Object.values(floor.reproAfter).every((value) => value !== true)
+    ) {
+      return {
+        continue: false,
+        notify: true,
+        inconclusive: true,
+        outcome: 'inconclusive',
+        missingEvidence,
+        reason: `UKit completion gate: bug-fix INCONCLUSIVE — the defect did not reproduce in ${floor.reproAttempts} recorded repro attempt(s), so the fix floor (verbatim repro-before fail + repro-after pass on the same surface) is unreachable. Report verified-vs-not verbatim, the attempts made, and the runtime-forensics follow-on lane (live symptom). Never claim a fix without the repro pair.`,
+      };
+    }
+    if (missingEvidence.length === 0) {
+      return {
+        continue: false,
+        notify: false,
+        complete: true,
+        outcome: 'verified',
+        missingEvidence: [],
+      };
+    }
+  }
   if (missingEvidence.length === 0) {
     // Silent success: the route is present and every required evidence is satisfied. Marked
     // `complete` so the CLI dispatch recognizes it BEFORE the loud final else — otherwise a
@@ -1873,15 +2549,26 @@ export function evaluateCompletion({ state = {}, ledger = {}, cwd } = {}) {
   // recovery gate — only a no-mutation, recommend-only investigation that has not already
   // observed a failed verification gets this release valve. A route that named an actionable
   // command, or a failing check, has concrete unfinished work and must keep recovering.
+  // TASK-C85-019 fix B: the release criterion is the find-cause contract's
+  // completionRule ('never-claim-fixed-without-write-and-verification' — a FIX
+  // claim needs evidence, a mutation is never mandatory), NOT the verification
+  // policyMode. policyMode derives from the verification recommendation, so any
+  // route that resolved targeted commands lands on auto-run-* and the old
+  // recommend-only check never fired in a real project. An absent rule keeps
+  // the pre-C85-019 states and the canonical find-cause contract on the valve.
+  const findCauseNoMutationContract = mode === 'find-cause'
+    && (routeSummary?.executionContract?.completionRule == null
+      || routeSummary.executionContract.completionRule === 'never-claim-fixed-without-write-and-verification');
   if (
-    mode === 'find-cause'
-    && routeSummary.policyMode === 'recommend-only'
+    findCauseNoMutationContract
+    && playbookId !== BUGFIX_PLAYBOOK_ID
     && !effectiveLedger.writeAttempted
     && !effectiveLedger.verificationFailed
   ) {
     return {
       continue: false,
       notify: true,
+      gateRelease: 'find-cause-no-mutation',
       missingEvidence,
       reason: 'UKit investigation ended without a mutation. A clean audit is valid; report whether no actionable defect was found or a concrete blocker remains. Do not claim a bug was fixed without write and verification evidence.',
     };
@@ -1904,6 +2591,7 @@ export function evaluateCompletion({ state = {}, ledger = {}, cwd } = {}) {
     return {
       continue: false,
       notify: true,
+      gateRelease: 'map-impact-no-mutation',
       missingEvidence,
       reason: 'UKit impact analysis ended without a mutation. A completed impact map with no warranted change is valid; report the findings and whether a follow-up edit is needed. Do not claim any fix without write and verification evidence.',
     };
@@ -1915,6 +2603,7 @@ export function evaluateCompletion({ state = {}, ledger = {}, cwd } = {}) {
       continue: false,
       notify: true,
       missingEvidence,
+      ...(playbookId === BUGFIX_PLAYBOOK_ID ? { outcome: 'inconclusive' } : {}),
       reason: `UKit completion gate: missing ${missingEvidence.join(', ')}. This mode does not auto-continue; tell the user what is unfinished.`,
     };
   }
@@ -1937,6 +2626,7 @@ export function evaluateCompletion({ state = {}, ledger = {}, cwd } = {}) {
         capped: true,
         notify: true,
         missingEvidence,
+        ...(playbookId === BUGFIX_PLAYBOOK_ID ? { outcome: 'inconclusive' } : {}),
         reason: `UKit continuation cap reached with missing evidence: ${missingEvidence.join(', ')}.`,
       };
     }
@@ -1946,6 +2636,7 @@ export function evaluateCompletion({ state = {}, ledger = {}, cwd } = {}) {
       notify: true,
       capped: true,
       missingEvidence,
+      ...(playbookId === BUGFIX_PLAYBOOK_ID ? { outcome: 'blocked' } : {}),
       reason: `UKit stopping with unfinished work: ${missingEvidence.join(', ')}. Tell the user what is unfinished and stop; do not continue further.`,
     };
   }
@@ -1964,6 +2655,7 @@ export function evaluateCompletion({ state = {}, ledger = {}, cwd } = {}) {
         notify: true,
         noProgressCount,
         missingEvidence,
+        ...(playbookId === BUGFIX_PLAYBOOK_ID ? { outcome: 'inconclusive' } : {}),
         reason: `UKit vibecode liveness breaker: ${noProgressCount} continuations produced no new verifiable progress (missing evidence: ${missingEvidence.join(', ')}). Stop and tell the user what is unfinished; do not keep continuing without new evidence.`,
       };
     }
@@ -1974,6 +2666,7 @@ export function evaluateCompletion({ state = {}, ledger = {}, cwd } = {}) {
       capped: true,
       noProgressCount,
       missingEvidence,
+      ...(playbookId === BUGFIX_PLAYBOOK_ID ? { outcome: 'blocked' } : {}),
       reason: `UKit stopping with unfinished work: ${noProgressCount} continuations produced no new verifiable progress (${missingEvidence.join(', ')}). Tell the user what is unfinished and stop; do not continue further.`,
     };
   }
@@ -1984,6 +2677,7 @@ export function evaluateCompletion({ state = {}, ledger = {}, cwd } = {}) {
     continue: true,
     missingEvidence,
     noProgressCount,
+    ...(playbookId === BUGFIX_PLAYBOOK_ID ? { outcome: 'blocked' } : {}),
     reason: [
       `UKit completion gate: missing ${missingEvidence.join(', ')}.`,
       instruction,
@@ -2125,6 +2819,71 @@ async function runEvaluateStop() {
 
   const result = evaluateCompletion({ state, ledger, cwd: projectRoot });
 
+  // TASK-C85-019 fix C: a mutating-mode route released by a no-mutation valve
+  // while evidence is missing is the anomaly signal for misrouted advisory
+  // turns — measure it. One bounded gate-release row lands in decisions.tsv
+  // (mode + missing evidence + prompt hash, never prompt text), and
+  // UKIT_GATE_DEBUG=1 mirrors the same signal on stderr.
+  if (result.gateRelease) {
+    const gateMode = state?.routeSummary?.executionMode
+      || state?.routeSummary?.approachSelector?.executionMode
+      || 'unknown';
+    try {
+      await appendDecisionReceipt(projectRoot, {
+        kind: 'gate-release',
+        boundary: 'completion-gate',
+        stage: 'no-mutation',
+        outcomeClass: gateMode,
+        checkpoint: evidencePromptKey(state) ?? 'no-prompt-hash',
+        decisionKeys: Array.isArray(result.missingEvidence) ? result.missingEvidence : [],
+        agreement: 'released',
+        fallbackCode: result.gateRelease,
+      });
+    } catch { /* advisory */ }
+    if (process.env.UKIT_GATE_DEBUG === '1') {
+      process.stderr.write(
+        `[ukit-completion] gate-release mode=${gateMode} valve=${result.gateRelease} missing=${(result.missingEvidence || []).join(',') || 'none'} prompt=${evidencePromptKey(state) || 'none'}\n`,
+      );
+    }
+  }
+
+  // TASK-005 (FR-005): the completion evaluator's terminal verdict emits one
+  // `outcome.observed` record per evaluated stop. The verdict maps the gate's
+  // own decision shape — a still-blocked stop is BLOCKED, a capped/unfinished
+  // release FAILED, a notice-only or undecidable release INCONCLUSIVE, and a
+  // satisfied route VERIFIED. Fire-and-forget: awaited inside this child's
+  // own deadline so the record is durable before exit, but a failed emit
+  // never changes the decision below.
+  {
+    // continue → still blocked; satisfied → VERIFIED; an explicit inconclusive
+    // release (the bug-fix unreproducible path) → INCONCLUSIVE; a
+    // capped/missing-evidence release → FAILED; every other release is
+    // INCONCLUSIVE (a notice-only or undecidable end is an honest non-verdict).
+    const stopVerdict = result.continue === true ? 'BLOCKED'
+      : result.complete === true ? 'VERIFIED'
+      : result.inconclusive === true ? 'INCONCLUSIVE'
+      : result.capped === true || (Array.isArray(result.missingEvidence) && result.missingEvidence.length > 0) ? 'FAILED'
+      : 'INCONCLUSIVE';
+    try {
+      await emitTerminalOutcome({
+        projectRoot,
+        outcome: {
+          verdict: stopVerdict,
+          source: 'stop-evaluate',
+          routeId: state?.requestKey ?? ledger?.requestKey ?? null,
+          routeFingerprint: ledger?.routeFingerprint ?? state?.fingerprint ?? null,
+          ledgerKey: `sess-${sessionIdentity(payload)}`,
+          evidenceIds: [],
+          cost: { latencyMs: null, rounds: Number.isFinite(ledger?.continuationCount) ? ledger.continuationCount : null },
+          reviewActions: [],
+        },
+        payload,
+        harness: process.env.UKIT_HARNESS || null,
+        deadlineMs: 200,
+      });
+    } catch { /* advisory */ }
+  }
+
   // A reentrant Stop (Claude Code re-fires Stop after this hook already blocked once) is
   // gated exactly like any other Stop: while evidence is still missing it blocks again with
   // the actionable reason instead of silently releasing the recovery turn. Loop termination
@@ -2162,12 +2921,24 @@ async function main() {
   const payload = JSON.parse((await readStdin()) || '{}');
   const projectRoot = process.env.CLAUDE_PROJECT_DIR || payload.cwd || process.cwd();
   if (process.argv.includes('--record')) {
-    await recordExecutionReceipt({
+    const receiptResult = await recordExecutionReceipt({
       projectRoot,
       payload,
       toolName: payload.tool_name,
       harness: process.env.UKIT_HARNESS || 'claude-code',
     });
+    // TASK-005 (FR-005): emit the committed completion receipt's outcome —
+    // same terminal contract record-execution.mjs performs for hook callers.
+    if (receiptResult?.value?.outcome) {
+      try {
+        await emitTerminalOutcome({
+          projectRoot,
+          outcome: receiptResult.value.outcome,
+          payload,
+          harness: process.env.UKIT_HARNESS || 'claude-code',
+        });
+      } catch { /* advisory: never block the receipt path */ }
+    }
   }
 }
 
@@ -2234,7 +3005,14 @@ export async function appendDecision(projectRoot, {
 // 'shadow' (advisory run, deterministic policy stayed authoritative),
 // 'applied' (canary/default accepted answer), 'fallback' (adapter failed and
 // the deterministic baseline stayed in force).
-const DECISION_RECEIPT_KINDS = new Set(['shadow', 'applied', 'fallback']);
+// TASK-C85-015 (BL-015): 'review-policy' receipts carry the review decision
+// evaluator's advisory verdicts (action/namedCheck/signalsHit/round per SPEC §7)
+// — additive kind; the shadow/applied/fallback semantics are unchanged.
+// TASK-C85-019 fix C: 'gate-release' receipts carry the completion gate's
+// no-mutation valve releases — a mutating-mode route let go while evidence is
+// missing is the anomaly signal for misrouted advisory turns, made measurable
+// in decisions.tsv (mode + missingEvidence + prompt hash; never prompt text).
+const DECISION_RECEIPT_KINDS = new Set(['shadow', 'applied', 'fallback', 'review-policy', 'gate-release']);
 const DECISION_RECEIPT_CELL_MAX = 160;
 
 function receiptCell(value) {