@planu/cli 5.2.0 → 5.3.1

package/dist/engine/planu-core.linux-x64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.2.0",
+      "bom-ref": "pkg:cargo/planu-core@5.3.1",
       "type": "library",
       "name": "planu-core",
-      "version": "5.2.0",
+      "version": "5.3.1",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "828e4ca1e0aac93c5a3ae1c4f8a306cc7eb306e765ea459cb323359075fe19ec"
+          "content": "121e0cde6094d4812a1003f5e8d271c73180f87253d242c0ef2a3ce020114fb2"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.2.0",
+      "ref": "pkg:cargo/planu-core@5.3.1",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-x64-musl.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.2.0",
-  "engineVersion": "5.2.0",
-  "buildId": "1-5.2.0-x86_64-unknown-linux-musl",
+  "cliVersion": "5.3.1",
+  "engineVersion": "5.3.1",
+  "buildId": "1-5.3.1-x86_64-unknown-linux-musl",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "x64",
   "libc": "musl",
-  "artifactSha256": "ecca8121c6a5d0163641a2f612736adb2dfa19d2d576f189b827c802426d1c6d",
+  "artifactSha256": "8bca20fd7b4458f07f9993babe7ae9417bbce0f8dadac3cd6e723bfe5162e405",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-x64-musl.node.sbom.json",
-    "sha256": "fafb2001aba46875a02bf13be9ed6931dc79d2a3f47659914c4a8c8637f6cf49"
+    "sha256": "d6638d7152102d2ba32851fd2df269e4e2a2a2ddc5fc788f4602c0dd22c0ae42"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "121065e63e9fd2c067367e286ecba619ecc3f18a",
+    "sourceCommit": "cff22e20c8f95a4081485b852254fa5fbe1532ef",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "yy7pcnf8jJzWrYp8gYHwG+Gbncuzx8PKYDAmsqdeXPSFCDuwDlkK8os3Arr0fJZp+uVWH4oFbYY4xuhf4/VsAw=="
+    "value": "vZ9UA5RzHSuz+/P18RorLLyH92erubxrJwq4nW766XwepyzlM0m8ol3QYfyrvYvHy4oP9ptee40YvsmexCQcBg=="
   }
 }

package/dist/engine/planu-core.linux-x64-musl.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.2.0",
+      "bom-ref": "pkg:cargo/planu-core@5.3.1",
       "type": "library",
       "name": "planu-core",
-      "version": "5.2.0",
+      "version": "5.3.1",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ecca8121c6a5d0163641a2f612736adb2dfa19d2d576f189b827c802426d1c6d"
+          "content": "8bca20fd7b4458f07f9993babe7ae9417bbce0f8dadac3cd6e723bfe5162e405"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.2.0",
+      "ref": "pkg:cargo/planu-core@5.3.1",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.win32-arm64-msvc.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.2.0",
-  "engineVersion": "5.2.0",
-  "buildId": "1-5.2.0-aarch64-pc-windows-msvc",
+  "cliVersion": "5.3.1",
+  "engineVersion": "5.3.1",
+  "buildId": "1-5.3.1-aarch64-pc-windows-msvc",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "win32",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "1e69721c524c6f6a970d4644c5483529bc6ec17f8174f4f418a5b9191a3a99ef",
+  "artifactSha256": "dbc7bc2092e9280e9cbd9c18d472acc57b171fb51b34ac403d36858e460a5558",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.win32-arm64-msvc.node.sbom.json",
-    "sha256": "bb526f914a2f60f431c01c953fe8cd0f02068f7faa5feb7d53289b4beb76e311"
+    "sha256": "ac0dfa26e7466da91c35ffff0b44eddfe0e871fb4ba4e2527d74b7e6e4ad2166"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "121065e63e9fd2c067367e286ecba619ecc3f18a",
+    "sourceCommit": "cff22e20c8f95a4081485b852254fa5fbe1532ef",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "C/mDKI2Cq6Z/aMPgGQx5kESd4Ow363fsf/qzdtv/rLuAGMKeMy8ukvLyV7yYMB7BGrlNaGU4o1l5pD349v0UDw=="
+    "value": "dXDAyNUV0maapcjOspyRQByaq39viQeMYq7iypA8UC9cUqcvOa33hojUp056RIkG+9dtu4wTFGO1GzF2oPDNCQ=="
   }
 }

package/dist/engine/planu-core.win32-arm64-msvc.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.2.0",
+      "bom-ref": "pkg:cargo/planu-core@5.3.1",
       "type": "library",
       "name": "planu-core",
-      "version": "5.2.0",
+      "version": "5.3.1",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1e69721c524c6f6a970d4644c5483529bc6ec17f8174f4f418a5b9191a3a99ef"
+          "content": "dbc7bc2092e9280e9cbd9c18d472acc57b171fb51b34ac403d36858e460a5558"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.2.0",
+      "ref": "pkg:cargo/planu-core@5.3.1",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.win32-x64-msvc.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.2.0",
-  "engineVersion": "5.2.0",
-  "buildId": "1-5.2.0-x86_64-pc-windows-msvc",
+  "cliVersion": "5.3.1",
+  "engineVersion": "5.3.1",
+  "buildId": "1-5.3.1-x86_64-pc-windows-msvc",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "win32",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "bb7d31e5232b18f0ec9e03196cffdc57e48ac6993b6df064ff85b60c37804b93",
+  "artifactSha256": "5d65e9be51ed1f1a391064fbf8892d3ac570c774854b36487d430ee7e7b0b5c8",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.win32-x64-msvc.node.sbom.json",
-    "sha256": "5c12145fab572d9432e20fda2e9d16ef0615db05c7c1b8c75448791f5442172b"
+    "sha256": "6563cbe0310464b49325b14f1e7e17a94e476496dd9bd1f522dafabac5da5d18"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "121065e63e9fd2c067367e286ecba619ecc3f18a",
+    "sourceCommit": "cff22e20c8f95a4081485b852254fa5fbe1532ef",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "M7Szjm7IuOAy5X01ppGd4i2s7JZ3elesGf0vQcdpvAzIohLkXn5htr3w4F8kmAKy4GhB5YK/P7sjwXpc8SSTAg=="
+    "value": "z2Hd9RD31bHF9HmmWsymR4XVqxLPiNSrdCvtWBUXEEBlKdk8rEde8ZPd3BEJCeEsdX0akECDyN7LenOYuFirAQ=="
   }
 }

package/dist/engine/planu-core.win32-x64-msvc.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.2.0",
+      "bom-ref": "pkg:cargo/planu-core@5.3.1",
       "type": "library",
       "name": "planu-core",
-      "version": "5.2.0",
+      "version": "5.3.1",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "bb7d31e5232b18f0ec9e03196cffdc57e48ac6993b6df064ff85b60c37804b93"
+          "content": "5d65e9be51ed1f1a391064fbf8892d3ac570c774854b36487d430ee7e7b0b5c8"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.2.0",
+      "ref": "pkg:cargo/planu-core@5.3.1",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/session-safeguard/autopush.js

@@ -2,7 +2,9 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 const execFileAsync = promisify(execFile);
-const PROTECTED_BRANCHES = new Set(['main', 'master', 'develop']);
+// SPEC-1379: unified with DEFAULT_PROTECTED_BRANCHES (git-helpers.ts) plus the
+// `release` mirror branch; the shell hook template mirrors this same set.
+const PROTECTED_BRANCHES = new Set(['main', 'master', 'develop', 'release', 'production']);
 /** Resolve the current branch name for the given projectPath. */
 async function getCurrentBranch(projectPath) {
     try {
@@ -88,7 +90,11 @@ export async function safeAutopush(projectPath, allowedPatterns = ['feat/*', 'fi
         };
     }
     try {
-        await execFileAsync('git', ['push', '--ff-only', 'origin', branch], { cwd: projectPath });
+        // No --force (git push has no --ff-only flag): the receiving remote
+        // rejects any non-fast-forward push, which is the ff-only guarantee.
+        await execFileAsync('git', ['push', '--end-of-options', 'origin', branch], {
+            cwd: projectPath,
+        });
         return { pushed: true, commitsPushed: commitCount, ref: `origin/${branch}` };
     }
     catch (err) {

package/dist/engine/validation/validation-freshness.d.ts

@@ -1,4 +1,4 @@
-import type { ValidationFreshnessLease, ValidationReceiptBindings } from '../../types/validation-receipt.js';
+import type { ValidationFreshnessLease, ValidationReceiptBindings, ValidationWatchEventClassification } from '../../types/validation-receipt.js';
 export type { ValidationFreshnessLease } from '../../types/validation-receipt.js';
 /**
  * Invalidate the active validation lease for a spec.
@@ -10,6 +10,25 @@ export declare function invalidateValidationFreshness(input: {
     projectId: string;
     specId: string;
 }): boolean;
+/**
+ * Classify one raw watcher event as a direct relevant/ignored child path, a
+ * synthetic root event (macOS emits these for the watched directory itself),
+ * or an ambiguous filename-less event that needs authoritative verification
+ * before it can be trusted to mean real byte drift.
+ */
+export declare function classifyValidationWatchEventForTests(input: {
+    filename: string | null;
+    watchedRoot: string;
+    relevant: (filename: string) => boolean;
+}): ValidationWatchEventClassification;
+/** Inject one classified watcher event without relying on host-specific fs.watch timing. */
+export declare function injectValidationWatchEventForTests(input: {
+    lease: Pick<ValidationFreshnessLease, 'projectId' | 'specId' | 'epoch'>;
+    scope: 'project' | 'handoff';
+    filename: string | null;
+}): ValidationWatchEventClassification | undefined;
+/** Pause or observe authoritative verification turns without changing watcher topology. */
+export declare function setValidationFreshnessVerificationHookForTests(hook: (() => Promise<void>) | undefined): void;
 /** Start both watchers before snapshotting and invalidate any older receipt immediately. */
 export declare function beginValidationFreshnessBarrier(input: {
     projectId: string;

package/dist/engine/validation/validation-freshness.js

@@ -67,6 +67,7 @@ const FINGERPRINT_CHUNK_BYTES = 64 * 1024;
 const EVIDENCE_FILE = /^(?:discovery|task-plan|traceability-matrix|contract-validation-(?:api|graphql|event|ui|mcp))\.json$/u;
 const active = new Map();
 const beginQueues = new Map();
+let verificationHookForTests;
 function key(projectId, specId) {
     return `${projectId}:${specId}`;
 }
@@ -149,18 +150,57 @@ export function invalidateValidationFreshness(input) {
     runInvalidationTurn(input.projectId, input.specId, state);
     return true;
 }
-function startWatch(path, relevant, onRelevantChange, onError) {
+/**
+ * Invalidate only if `expected` is still the exact live state for this
+ * identity. `invalidateValidationFreshness` mutates whatever is currently
+ * active for a projectId/specId regardless of epoch — callers holding a
+ * lease captured before an `await` must use this guard so a stale lease can
+ * never invalidate the epoch that replaced it.
+ */
+function invalidateExactEpoch(lease, expected) {
+    if (active.get(key(lease.projectId, lease.specId)) !== expected) {
+        return false;
+    }
+    return invalidateValidationFreshness(lease);
+}
+/**
+ * Classify one raw watcher event as a direct relevant/ignored child path, a
+ * synthetic root event (macOS emits these for the watched directory itself),
+ * or an ambiguous filename-less event that needs authoritative verification
+ * before it can be trusted to mean real byte drift.
+ */
+export function classifyValidationWatchEventForTests(input) {
+    if (!input.filename) {
+        return 'ambiguous';
+    }
+    const normalized = input.filename.replaceAll('\\', '/');
+    if (normalized === input.watchedRoot ||
+        normalized === `${input.watchedRoot}/` ||
+        normalized === '.' ||
+        normalized === './') {
+        return 'synthetic';
+    }
+    const rootPrefix = `${input.watchedRoot}/`;
+    const relative = normalized.startsWith(rootPrefix)
+        ? normalized.slice(rootPrefix.length)
+        : normalized;
+    return input.relevant(relative) ? 'direct-relevant' : 'ignored';
+}
+function startWatch(path, relevant, onRelevantChange, onAmbiguousChange, onError) {
     try {
         const watchedRoot = basename(path);
-        const watcher = watch(path, { recursive: true }, (event, filename) => {
-            // macOS emits a synthetic `change` for the watched directory itself in
-            // addition to the actionable relative child event.
-            if (event === 'change' && filename === watchedRoot) {
-                return;
-            }
-            if (!filename || relevant(filename.replaceAll('\\', '/'))) {
+        const watcher = watch(path, { recursive: true }, (_event, filename) => {
+            const classification = classifyValidationWatchEventForTests({
+                filename,
+                watchedRoot,
+                relevant,
+            });
+            if (classification === 'direct-relevant') {
                 onRelevantChange();
             }
+            else if (classification === 'synthetic' || classification === 'ambiguous') {
+                onAmbiguousChange();
+            }
         });
         watcher.on('error', onError);
         watcher.unref();
@@ -172,6 +212,111 @@ function startWatch(path, relevant, onRelevantChange, onError) {
         return undefined;
     }
 }
+/** Inject one classified watcher event without relying on host-specific fs.watch timing. */
+export function injectValidationWatchEventForTests(input) {
+    const state = active.get(key(input.lease.projectId, input.lease.specId));
+    if (state?.epoch !== input.lease.epoch || !state.accepting) {
+        return undefined;
+    }
+    const projectScope = input.scope === 'project';
+    const classification = classifyValidationWatchEventForTests({
+        filename: input.filename,
+        watchedRoot: basename(projectScope ? state.projectPath : state.handoffPath),
+        relevant: projectScope ? isValidationSourcePath : (filename) => EVIDENCE_FILE.test(filename),
+    });
+    if (classification === 'direct-relevant') {
+        invalidateValidationFreshness(input.lease);
+    }
+    else if (classification === 'synthetic' || classification === 'ambiguous') {
+        noteAmbiguousEvent(state);
+    }
+    return classification;
+}
+/** Pause or observe authoritative verification turns without changing watcher topology. */
+export function setValidationFreshnessVerificationHookForTests(hook) {
+    verificationHookForTests = hook;
+}
+function noteAmbiguousEvent(state) {
+    // Every synthetic or filename-less event counts, even while a cycle is
+    // already in flight: the in-flight cycle's target snapshot was captured
+    // before this event arrived, so skipping it here would let a mutation
+    // signaled only by this event slip past with no follow-up verification
+    // turn. The drain loop still bounds the total work to one leading and one
+    // trailing turn regardless of how many events land during a cycle.
+    state.ambiguousEvents += 1;
+}
+/**
+ * Run one authoritative verification turn confirming the exact epoch, source
+ * digest, and evidence fingerprint are unchanged as of `targetEvent`.
+ */
+async function runAmbiguousVerificationTurn(lease, state, bindings, targetEvent) {
+    const generationBefore = state.generation;
+    try {
+        await verificationHookForTests?.();
+        const fingerprintBefore = await evidenceFingerprint(state.handoffPath);
+        const sourceDigest = await gitSourceTreeDigest(state.projectPath);
+        const fingerprintAfter = await evidenceFingerprint(state.handoffPath);
+        const confirmed = active.get(key(lease.projectId, lease.specId));
+        if (confirmed !== state ||
+            confirmed.epoch !== lease.epoch ||
+            !confirmed.healthy ||
+            confirmed.generation !== generationBefore ||
+            sourceDigest !== bindings.sourceDigest ||
+            fingerprintBefore !== state.evidenceFingerprint ||
+            fingerprintAfter !== fingerprintBefore) {
+            invalidateExactEpoch(lease, state);
+            return false;
+        }
+        state.verifiedAmbiguousEvents = Math.max(state.verifiedAmbiguousEvents, targetEvent);
+        return true;
+    }
+    catch (error) {
+        reportClassifiedDegradation('VALIDATION_FRESHNESS_CHECK_FAILED', error);
+        invalidateExactEpoch(lease, state);
+        return false;
+    }
+}
+/**
+ * Run the bounded leading-plus-trailing verification cycle for every
+ * ambiguous event noted so far. Every concurrent caller shares the SAME
+ * cycle promise for its full duration — joining mid-cycle can never start an
+ * independent third turn, which keeps AC4's "at most one leading and one
+ * trailing turn" bound even when callers interleave with new events.
+ */
+function runAmbiguousDrainCycle(lease, state, bindings) {
+    const cycle = (async () => {
+        for (let turnIndex = 0; turnIndex < 2; turnIndex += 1) {
+            if (state.ambiguousEvents === state.verifiedAmbiguousEvents) {
+                return true;
+            }
+            if (!bindings) {
+                invalidateExactEpoch(lease, state);
+                return false;
+            }
+            const targetEvent = state.ambiguousEvents;
+            if (!(await runAmbiguousVerificationTurn(lease, state, bindings, targetEvent))) {
+                return false;
+            }
+        }
+        if (state.ambiguousEvents === state.verifiedAmbiguousEvents) {
+            return true;
+        }
+        invalidateExactEpoch(lease, state);
+        return false;
+    })().finally(() => {
+        if (state.ambiguousDrainCycle === cycle) {
+            state.ambiguousDrainCycle = undefined;
+        }
+    });
+    return cycle;
+}
+async function drainAmbiguousEvents(lease, state, bindings) {
+    if (state.ambiguousEvents === state.verifiedAmbiguousEvents) {
+        return true;
+    }
+    state.ambiguousDrainCycle ??= runAmbiguousDrainCycle(lease, state, bindings);
+    return state.ambiguousDrainCycle;
+}
 async function evidenceFingerprint(path) {
     const names = (await readdir(path, { withFileTypes: true }))
         .filter((entry) => EVIDENCE_FILE.test(entry.name))
@@ -263,6 +408,8 @@ export async function beginValidationFreshnessBarrier(input) {
             epoch: randomUUID(),
             expiresAt: Date.now() + policy.freshnessLeaseTtlMs,
             generation: 0,
+            ambiguousEvents: 0,
+            verifiedAmbiguousEvents: 0,
             healthy: true,
             accepting: true,
             projectPath: input.projectPath,
@@ -279,14 +426,19 @@ export async function beginValidationFreshnessBarrier(input) {
                 invalidateValidationFreshness(input);
             }
         };
+        const ambiguous = () => {
+            if (active.get(identity)?.epoch === watchedEpoch && state.accepting) {
+                noteAmbiguousEvent(state);
+            }
+        };
         const failed = () => {
             if (active.get(identity)?.epoch === watchedEpoch && state.accepting) {
                 state.healthy = false;
                 changed();
             }
         };
-        const projectWatcher = startWatch(input.projectPath, isValidationSourcePath, changed, failed);
-        const handoffWatcher = startWatch(input.handoffPath, (filename) => EVIDENCE_FILE.test(filename), changed, failed);
+        const projectWatcher = startWatch(input.projectPath, isValidationSourcePath, changed, ambiguous, failed);
+        const handoffWatcher = startWatch(input.handoffPath, (filename) => EVIDENCE_FILE.test(filename), changed, ambiguous, failed);
         if (!projectWatcher || !handoffWatcher) {
             projectWatcher?.close();
             handoffWatcher?.close();
@@ -346,10 +498,11 @@ export async function closeValidationFreshnessLease(lease) {
         return;
     }
     state.closing ??= (async () => {
-        state.accepting = false;
         state.watchers.splice(0).forEach((watcher) => {
             watcher.close();
         });
+        await drainAmbiguousEvents(lease, state, state.bindings);
+        state.accepting = false;
         if (state.ttlTimer) {
             clearTimeout(state.ttlTimer);
         }
@@ -386,27 +539,30 @@ export async function bindValidationFreshnessLease(lease, bindings) {
         Date.now() >= state.expiresAt) {
         return false;
     }
+    if (!(await drainAmbiguousEvents(lease, state, bindings))) {
+        return false;
+    }
     let fingerprintBefore;
     try {
         fingerprintBefore = await evidenceFingerprint(state.handoffPath);
         if ((await gitSourceTreeDigest(state.projectPath)) !== bindings.sourceDigest) {
-            invalidateValidationFreshness(lease);
+            invalidateExactEpoch(lease, state);
             return false;
         }
     }
     catch (error) {
         reportClassifiedDegradation('VALIDATION_FRESHNESS_CHECK_FAILED', error);
-        invalidateValidationFreshness(lease);
+        invalidateExactEpoch(lease, state);
         return false;
     }
     if (fingerprintBefore !== state.evidenceFingerprint) {
-        invalidateValidationFreshness(lease);
+        invalidateExactEpoch(lease, state);
         return false;
     }
     const confirmed = active.get(key(lease.projectId, lease.specId));
     if (!confirmed?.healthy ||
         confirmed.epoch !== state.epoch ||
-        confirmed.generation !== state.generation) {
+        confirmed.generation !== lease.generation) {
         return false;
     }
     confirmed.bindings = structuredClone(bindings);
@@ -443,29 +599,32 @@ export async function assertValidationFreshnessBarrier(lease, bindings) {
         candidate.generation !== lease.generation) {
         return false;
     }
+    if (!(await drainAmbiguousEvents(lease, candidate, candidate.bindings))) {
+        return false;
+    }
     let fingerprintBefore;
     try {
         fingerprintBefore = await evidenceFingerprint(candidate.handoffPath);
     }
     catch (error) {
         reportClassifiedDegradation('VALIDATION_FRESHNESS_CHECK_FAILED', error);
-        invalidateValidationFreshness(lease);
+        invalidateExactEpoch(lease, candidate);
         return false;
     }
     if (fingerprintBefore !== candidate.evidenceFingerprint) {
-        invalidateValidationFreshness(lease);
+        invalidateExactEpoch(lease, candidate);
         return false;
     }
     try {
         if (candidate.bindings &&
             (await gitSourceTreeDigest(candidate.projectPath)) !== candidate.bindings.sourceDigest) {
-            invalidateValidationFreshness(lease);
+            invalidateExactEpoch(lease, candidate);
             return false;
         }
     }
     catch (error) {
         reportClassifiedDegradation('VALIDATION_FRESHNESS_CHECK_FAILED', error);
-        invalidateValidationFreshness(lease);
+        invalidateExactEpoch(lease, candidate);
         return false;
     }
     // A generation change invalidates the lease synchronously. Do not wait for
@@ -481,7 +640,7 @@ export async function assertValidationFreshnessBarrier(lease, bindings) {
         fingerprintAfter = undefined;
     }
     if (!state || fingerprintAfter !== fingerprintBefore) {
-        invalidateValidationFreshness(lease);
+        invalidateExactEpoch(lease, candidate);
         return false;
     }
     if (state.generation !== lease.generation) {
@@ -518,7 +677,7 @@ export async function rebaselineValidationFreshnessLeaseAfterRecompute(input) {
         }
         catch (error) {
             reportClassifiedDegradation('VALIDATION_FRESHNESS_CHECK_FAILED', error);
-            invalidateValidationFreshness(input.lease);
+            invalidateExactEpoch(input.lease, before);
             return undefined;
         }
         const after = await readStableState(input.lease);
@@ -549,6 +708,7 @@ export async function resetValidationFreshnessForTests() {
     });
     await Promise.all(leases.map((lease) => closeValidationFreshnessLease(lease)));
     beginQueues.clear();
+    verificationHookForTests = undefined;
 }
 /** Count-only process diagnostic; intentionally absent from the package entrypoint. */
 export function getValidationFreshnessDiagnosticsForTests() {

package/dist/engine/validator/analyzer.d.ts

@@ -12,8 +12,11 @@ export declare function scanCodeForSpec(spec: Spec, projectPath: string): Promis
  * buildFileContentsCache from criterion-matcher) to avoid a redundant
  * glob+readFile pass when checking multiple criteria in the same call.
  */
-export declare function checkCriterionEvidence(criterion: string, projectPath: string, codeState: CodeState, verifyBlock?: VerifyBlock, sharedFileContents?: Map<string, string>): Promise<CriterionEvidenceResult>;
-export declare function checkCriterion(criterion: string, projectPath: string, codeState: CodeState, verifyBlock?: VerifyBlock, sharedFileContents?: Map<string, string>): Promise<boolean>;
+export declare function checkCriterionEvidence(criterion: string, projectPath: string, codeState: CodeState, verifyBlock?: VerifyBlock, sharedFileContents?: Map<string, string>, declaredTestPaths?: string[], probeCache?: Map<string, {
+    passed: boolean;
+    evidence: string;
+}>): Promise<CriterionEvidenceResult>;
+export declare function checkCriterion(criterion: string, projectPath: string, codeState: CodeState, verifyBlock?: VerifyBlock, sharedFileContents?: Map<string, string>, declaredTestPaths?: string[]): Promise<boolean>;
 /**
  * Classify the severity of a missing criterion based on its content.
  * Keywords and severity levels are loaded from src/config/drift-severity.json (SPEC-209).