@rightkit/release 0.6.8 → 0.6.10

package/deterministic-scans.mjs

@@ -23,11 +23,14 @@ import os from "node:os";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn as spawnChild, spawnSync } from "./background-process.mjs";
+import { spawnUnderOwnership } from "./build-ownership.mjs";
 import { checkAdvisoryExceptions } from "./advisory-exceptions.mjs";
 import { canonicalJson, digestScanSet, requiredScanIds, rustCratePlan, rustScanId } from "./scan-digest.mjs";
 import { reach } from "./lock-graph.mjs";
 import { cargoManifestState } from "./cargo-manifest-text.mjs";
+import { LAUNCH_GUARD_IMPORT } from "./class-a-launch-guard.mjs";
 import { advisoryCacheRoot, ensureAdvisoryDb, prepareDenyOverlay, readAdvisoryPin } from "./advisory-db.mjs";
+import { observedEnvOf, readRequestRef, verifySnapshotReceipt, writeSnapshotRequest } from "./snapshot-request.mjs";
 
 export const SCAN_RESULT_SCHEMA = "rightkit.deterministic-scans/1";
 /**
@@ -51,10 +54,15 @@ export const CLASS_A_SCAN_PREFIXES = Object.freeze([
   "rustfmt", "node-check", "json-parse", "toml-parse", "yaml-parse", "ownership-catalog",
   "actionlint", "shellcheck", "pnpm-lockfile", "pnpm-audit", "cargo-metadata", "cargo-deny", "cargo-audit", "cargo-package-list",
   "changelog-version", "license", "secret-scan", "path-policy", "advisory-exceptions", "suite-api",
+  // Everything mechanical and deterministic that does not compile is class A (Adrian, 2026-10-27): typecheck, lint, generated docs.
+  "tsc", "eslint", "biome", "generated-docs",
 ]);
+// Class B includes compiles and tests that execute project code.
 export const CLASS_B_SCAN_PREFIXES = Object.freeze([
-  "clippy", "check", "check-all-features", "check-features", "check-dependent", "doc", "tsc", "eslint", "biome", "swift-build", "test", "generated-docs",
+  "clippy", "check", "check-all-features", "check-features", "check-dependent", "doc", "swift-build",
 ]);
+// Test scripts can invoke a compiler indirectly, so all tests run after Class A.
+export const TEST_SCAN_CLASS = Object.freeze({ "test:rust": "B", "test:rust-serial": "B", "test:npm": "B", "test:scripts-ci": "B" });
 
 /**
  * Rollout switch for the CI integration (ci/gate.config.json: { "deterministicScans": { "enabled": true } }).
@@ -92,8 +100,14 @@ export function stripJsonComments(text) {
 }
 
 /** "A", "B" or null for an id such as "clippy:rightkit-fs". */
-export function scanClassOf(id) {
-  const prefix = String(id).split(":")[0];
+export function scanClassOf(id, scan = null) {
+  const parts = String(id).split(":");
+  const prefix = parts[0];
+  if (prefix === "test") {
+    const kind = TEST_SCAN_CLASS[`test:${parts[1]}`] ?? null;
+    if (kind === "A" && scan?.brokerCall) return SCAN_CLASS.B;
+    return kind === null ? null : SCAN_CLASS[kind];
+  }
   if (CLASS_A_SCAN_PREFIXES.includes(prefix)) return SCAN_CLASS.A;
   if (CLASS_B_SCAN_PREFIXES.includes(prefix)) return SCAN_CLASS.B;
   return null;
@@ -224,6 +238,49 @@ const PNPM_NO_HOOKS_ENV = Object.freeze({ npm_config_ignore_pnpmfile: "true", np
 // fails in the tool or the test with its own error. The `pnpm_config_` spelling is the one pnpm 11.25 honours for this setting
 // (`npm_config_verify_deps_before_run=false` still aborted, checked on a stale tree), the lowercase spelling PNPM_NO_HOOKS_ENV uses for its settings.
 const PNPM_RUN_ENV = Object.freeze({ pnpm_config_verify_deps_before_run: "false" });
+
+// The placeholder a tsc row passes as its project when its package depends on a workspace sibling (planScans; runScans replaces it).
+export const TSC_PROJECT = "{tscProject}";
+const DIST_TYPES = /^\.\/dist\/(.+)\.d\.ts$/;
+/**
+ * Writes the project a tsc row checks through: it extends the package's own tsconfig (its include, exclude and options, resolved from
+ * there), emits nothing, widens rootDir to the checked tree, keeps the package's own @types lookup chain (typeRoots), and maps every
+ * exported entry point of each workspace sibling whose types
+ * are built output (`types: ./dist/<x>.d.ts`) to that sibling's committed source (`src/<x>.ts`, `.tsx`, `/index.ts`, `/index.tsx`).
+ * `workspace` is the siblings' tree-relative directories. Returns { dir, file }; the caller removes `dir`. Throws when a sibling's
+ * manifest cannot be read or an exported entry point has no committed source: such a sibling could only be checked against a build.
+ */
+export function writeTscProject({ contentRoot, packageDir, workspace, tmpdir = os.tmpdir() }) {
+  const paths = {};
+  for (const rel of workspace) {
+    const dir = path.join(contentRoot, rel);
+    let manifest;
+    try { manifest = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8").replace(/^/, "")); }
+    catch (e) { throw new Error(`${rel}/package.json: ${e.message}`); }
+    if (typeof manifest.name !== "string" || path.resolve(dir) === path.resolve(packageDir)) continue;
+    const exported = manifest.exports && typeof manifest.exports === "object" ? Object.entries(manifest.exports) : [];
+    for (const [sub, target] of exported) {
+      const types = target && typeof target === "object" ? target.types : null;
+      const m = typeof types === "string" ? DIST_TYPES.exec(types) : null;
+      if (!m) continue;
+      const source = [`src/${m[1]}.ts`, `src/${m[1]}.tsx`, `src/${m[1]}/index.ts`, `src/${m[1]}/index.tsx`].map((f) => path.join(dir, f)).find((f) => fs.existsSync(f));
+      if (!source) throw new Error(`${manifest.name} exports ${sub} with types ${types}, and ${rel}/src has no committed source for it`);
+      paths[sub === "." ? manifest.name : `${manifest.name}${sub.slice(1)}`] = [source];
+    }
+  }
+  // TypeScript looks type libraries up (`types`, and every @types package by default) in node_modules/@types of the CONFIG's directory
+  // and its ancestors. The project lives outside the tree, so it names the chain the package's own tsconfig would have used.
+  const typeRoots = [];
+  for (let d = path.resolve(packageDir); ; d = path.dirname(d)) {
+    const at = path.join(d, "node_modules", "@types");
+    if (fs.existsSync(at)) typeRoots.push(at);
+    if (path.dirname(d) === d) break;
+  }
+  const out = fs.mkdtempSync(path.join(tmpdir, "rk-tsc-"));
+  const file = path.join(out, "tsconfig.json");
+  fs.writeFileSync(file, `${JSON.stringify({ extends: path.join(packageDir, "tsconfig.json"), compilerOptions: { noEmit: true, rootDir: path.resolve(contentRoot), typeRoots, paths } }, null, 2)}\n`);
+  return { dir: out, file };
+}
 const CONFIG_CRATE_FILE = /(^|\/)Cargo\.(toml|lock)$/;
 const JS_TOOLING_FILE = /(^|\/)(package\.json|pnpm-lock\.yaml|pnpm-workspace\.yaml)$/;
 // Root files that change how EVERY crate (or package) builds: a change to one puts every unit in scope,
@@ -278,6 +335,26 @@ const PROBES = Object.freeze({
  * provision exactly this version; scripts/ci/scan-receipt.test.mjs holds them to it.
  */
 export const PINNED_SCAN_TOOLS = Object.freeze({ shellcheck: "0.11.0" });
+/** Scans whose answer depends on a remote service at run time, not only on their inputs: `pnpm-audit` asks the registry's advisory
+ * service. A verdict that includes them is reusable only after they are re-run (`rightkit-gate live-scans`; GATE-CONTRACT §1, E18),
+ * and a red caused by one is never deterministic. Ids are `<prefix>` or `<prefix>:<root>`; rustright's REMOTE_SCANS mirrors this list. */
+export const LIVE_SCAN_IDS = Object.freeze(["pnpm-audit"]);
+export const isLiveScan = (id) => LIVE_SCAN_IDS.some((p) => id === p || String(id).startsWith(`${p}:`));
+/** Scans whose FAILURE may come from the registry rather than their inputs: `pnpm-lockfile` (`install --frozen-lockfile --lockfile-only`)
+ * re-verifies lockfile entries against the registry when pnpm's cache is cold, so an outage fails it. Their pass is deterministic, but a
+ * red they cause is never a reusable deterministic verdict (rightkit#1257; Oracle review of 79c4427b). */
+export const REGISTRY_SCAN_IDS = Object.freeze(["pnpm-lockfile"]);
+export const isRegistryScan = (id) => REGISTRY_SCAN_IDS.some((p) => id === p || String(id).startsWith(`${p}:`));
+/** Files per rustfmt scan: 120 paths of ~100 bytes stay under Windows' 32 KB command line with the tool and flags. */
+export const RUSTFMT_BATCH = 120;
+
+/** True when this module is the checked repository's own in-tree copy (packages/release of `contentRoot`), where its scripts/ live. */
+export function inTreeGate(contentRoot, exists = fs.existsSync) {
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  const real = (p) => { try { return fs.realpathSync(p); } catch { return path.resolve(p); } };
+  const own = real(path.resolve(here, "..", ".."));
+  return own === real(contentRoot) && exists(path.join(own, "scripts", "gen-suite-api.mjs"));
+}
 // The version a probe's output names, for a tool whose first line is not its version (`shellcheck --version` opens with a banner).
 const PROBE_VERSION = Object.freeze({
   shellcheck: (text) => { const m = /^version:\s*(\S+)\s*$/m.exec(text); return m ? `shellcheck ${m[1]}` : null; },
@@ -410,6 +487,195 @@ export function scriptBrokerCall(scripts, entry = "test", { maxDepth = 8 } = {})
   return visit(String(entry), []);
 }
 
+/**
+ * Whether the package script `entry` builds (emits) code before or while it tests: `tsc` without --noEmit, or a package-manager
+ * run of a `build` / `build:*` script in this package or another (`pnpm run build`, `pnpm --filter <pkg> build`), followed through
+ * the scripts it starts in the same package.json like scriptBrokerCall. Such a test is not a pre-compile check: it runs after
+ * class A, with the compile scans (Codex reviewer 2026-10-28). Returns `{ via, command }` or null.
+ */
+export function scriptBuildCall(scripts, entry = "test", { maxDepth = 8 } = {}) {
+  if (scripts === null || typeof scripts !== "object" || Array.isArray(scripts)) return null;
+  const textOf = (name) => (Object.hasOwn(scripts, name) && typeof scripts[name] === "string" ? scripts[name].slice(0, SCRIPT_TEXT_LIMIT) : null);
+  const builds = (words) => {
+    let i = 0;
+    while (i < words.length && (ENV_ASSIGNMENT.test(words[i]) || COMMAND_WRAPPERS.has(path.posix.basename(words[i])) || PACKAGE_RUNNERS.has(path.posix.basename(words[i])))) i += 1;
+    const word = path.posix.basename(String(words[i] ?? "").replaceAll("\\", "/")).replace(/\.(exe|cmd|bat)$/i, "");
+    if (word === "tsc") return !words.slice(i + 1).some((w) => /^--?noEmit(=true)?$/i.test(w));
+    if (!PACKAGE_MANAGERS.has(word)) return false;
+    // pnpm's `-w` is `--workspace-root` (a flag); npm's `-w` is `--workspace <name>` (takes a value).
+    const rest = words.slice(i + 1); const values = new Set(word === "pnpm" ? ["--filter", "-F", "--dir", "-C"] : word === "npm" ? ["--workspace", "-w", "--prefix"] : ["--cwd", "--filter"]);
+    for (let j = 0; j < rest.length; j += 1) {
+      if (values.has(rest[j])) { j += 1; continue; }
+      if (rest[j].startsWith("-") || rest[j] === "run" || rest[j] === "run-script") continue;
+      return /^build(:|$)/.test(rest[j]);
+    }
+    return false;
+  };
+  const seen = new Set();
+  const visit = (name, via) => {
+    if (via.length >= maxDepth || seen.has(name)) return null;
+    seen.add(name);
+    for (const part of [`pre${name}`, name, `post${name}`]) {
+      const text = textOf(part);
+      if (text === null) continue;
+      for (const words of shellCommands(text)) {
+        if (builds(words)) return { via: [...via, part], command: words.join(" ").slice(0, 200) };
+        const found = inspectCommand(words, scripts);
+        if (found.run !== undefined) { const deeper = visit(found.run, [...via, part]); if (deeper) return deeper; }
+      }
+    }
+    return null;
+  };
+  return visit(String(entry), []);
+}
+
+// Cargo redirections on a reachable command line or script: an explicit manifest or output directory, or a working-directory change.
+const CARGO_REDIRECT = /--manifest-path|--target-dir|(^|[\s;&|(])(CARGO_TARGET_DIR|CARGO_BUILD_TARGET_DIR)=|(^|[\s;&|(])(cd|pushd)\s/;
+
+// The forms a test's path to cargo may take for its target directory to be bound (cargoReachOf). Everything else is unprovable.
+// Tools that run no repository code and start no cargo: any arguments.
+const REACH_SAFE_TOOLS = new Set(["tsc", "eslint", "prettier", "biome", "oxlint", "echo", "true"]);
+// cargo options that move its manifest, workspace or output, or change its configuration (a short-option cluster holding C or Z too).
+const CARGO_REDIRECT_ARG = /^(--manifest-path|--target-dir|--config)(=|$)|^-[A-Za-z]*[CZ]/;
+// The cargo subcommands a bound test may run; anything else (an alias, cargo make, xtask, install, a plugin) is unprovable.
+const CARGO_REACH_SUBCOMMANDS = new Set(["test", "build", "check", "clippy"]);
+// Package-manager built-ins: never one of the package's scripts, whatever its package.json names (npm pack runs pack, not a script).
+const PM_BUILTINS = new Set(["install", "i", "add", "ci", "pack", "publish", "version", "link", "unlink", "rebuild", "prune", "update", "up", "upgrade", "uninstall", "remove", "rm", "init", "create", "exec", "dlx", "x", "workspace", "workspaces", "config", "set", "import", "patch", "deploy", "audit", "outdated", "why", "store", "cache", "env", "setup", "self-update", "fetch"]);
+// Characters a shell gives meaning outside quotes beyond the separators shellCommands splits on: an escape, a glob, a home or
+// redirection, a brace or history expansion, a comment, and cmd.exe's ^ and %VAR%. A script holding one unquoted is unprovable.
+const UNQUOTED_SHELL_META = new Set(["\\", "*", "?", "[", "]", "~", "<", ">", "{", "}", "!", "#", "^", "%"]);
+/** The first character a shell would read specially outside quotes in `text`, or null. */
+function unquotedShellMeta(text) {
+  let quote = null;
+  for (const c of String(text)) {
+    if (quote) { if (c === quote) quote = null; continue; }
+    if (c === '"' || c === "'") { quote = c; continue; }
+    if (UNQUOTED_SHELL_META.has(c)) return c;
+  }
+  return null;
+}
+// Package-manager options the walk resolves; any other option is unprovable.
+const PM_DIR_OPTIONS = new Set(["--dir", "-C", "--prefix", "--cwd"]);
+const PM_PACKAGE_OPTIONS = new Set(["--filter", "-F", "--filter-prod", "--workspace"]);
+const PM_PLAIN_FLAGS = new Set(["-s", "--silent", "--if-present", "--color", "--no-color", "--stream"]);
+const PM_VALUE_FLAGS = new Set(["--reporter", "--loglevel"]);
+
+/**
+ * Where a package's `test` script makes cargo run, for a commit-snapshot compile (joint plan step 4c): `{ none: true }` when it reaches
+ * no cargo, `{ dir }` (repository-relative) when every cargo it reaches runs from that one directory, `{ dirs }` when from several (the
+ * caller requires them to be one workspace), or `{ unprovable }` with the reason. One CARGO_TARGET_DIR binds the whole test.
+ *
+ * Fail-closed allowlist (root reviews of 431fbeae, f883d5ca, 15300d82): a test is bound only when every command on every path it
+ * reaches (each script with its pre/post hooks) parses completely into one of these forms:
+ *   - `cargo <args>` or `rustright cargo <args>` with no option that moves the manifest, workspace or output (--manifest-path,
+ *     --target-dir, --config, -C, -Z): cargo runs from the script's package directory;
+ *   - `pnpm|npm|yarn` with only resolvable options in any position before the script (--dir/-C/--prefix/--cwd, --filter/-F/
+ *     --filter-prod/--workspace naming one package of this repository, pnpm -w, npm -w <workspace>, and output flags) running
+ *     `run <script>`, `test`, `<script>` with no further arguments, or `exec <command>` (walked the same way in that package);
+ *   - a tool that runs no repository code (tsc, eslint, prettier, biome, oxlint, echo, true).
+ * Anything else is unprovable: `cd`, an environment assignment, a shell expansion, node or any test runner, an unknown command or
+ * option, a recursive run, an unresolvable package, arguments passed on to a script, a script past the size limit, the depth limit,
+ * and a requiresBroker declaration (the declared path is not in the scripts). Over-refusal is the accepted cost.
+ */
+export function cargoReachOf({ unitDir, scripts, declared = null, readScripts = () => null, packageDirOf = () => null, maxDepth = 8 }) {
+  const dirs = new Set();
+  // Keyed on package and script alone: the walk refuses everything that could change how a script runs (cd, environment), so a
+  // script reached twice from one package runs the same way both times.
+  const seen = new Set();
+  const unprovable = (why) => { throw Object.assign(new Error(why), { reach: true }); };
+  const walkScript = (dirScripts, name, dir, via) => {
+    const key = `${dir}\0${name}`;
+    if (seen.has(key)) return;
+    if (via.length >= maxDepth) unprovable(`the path to ${dir}'s ${name} (${via.join(" -> ")}) is deeper than ${maxDepth} scripts`);
+    seen.add(key);
+    for (const part of [`pre${name}`, name, `post${name}`]) {
+      if (!Object.hasOwn(dirScripts, part)) continue;
+      const text = dirScripts[part];
+      if (typeof text !== "string") unprovable(`${dir}'s ${part} script is not text`);
+      if (text.length > SCRIPT_TEXT_LIMIT) unprovable(`${dir}'s ${part} script is longer than ${SCRIPT_TEXT_LIMIT} characters`);
+      const meta = unquotedShellMeta(text);
+      if (meta !== null) unprovable(`${dir}'s ${part} script has an unquoted ${JSON.stringify(meta)}, which a shell would expand or redirect`);
+      const step = [...via, dir === unitDir ? part : `${dir}:${part}`];
+      for (const words of shellCommands(text)) walkCommand(words, dirScripts, dir, step);
+    }
+  };
+  const walkCommand = (words, dirScripts, dir, via) => {
+    const where = `${via.join(" -> ")}`;
+    const shown = words.join(" ").slice(0, 120);
+    if (words.some((w) => /[`$]/.test(w))) unprovable(`${where} runs \`${shown}\`, whose shell expansion this check cannot follow`);
+    if (ENV_ASSIGNMENT.test(words[0])) unprovable(`${where} runs \`${shown}\` with its own environment`);
+    const tool = path.posix.basename(words[0].replaceAll("\\", "/")).replace(/\.(exe|cmd|bat)$/i, "");
+    if (tool === "cargo" || tool === "rustright") {
+      const args = tool === "rustright" ? (words[1] === "cargo" ? words.slice(2) : unprovable(`${where} runs \`${shown}\`, a rustright command other than cargo`)) : words.slice(1);
+      const end = args.indexOf("--");
+      const own = end === -1 ? args : args.slice(0, end);
+      if (own.some((w) => CARGO_REDIRECT_ARG.test(w))) unprovable(`the path to cargo (${where}) redirects it`);
+      const sub = own.find((w) => !w.startsWith("-") && !w.startsWith("+"));
+      if (!CARGO_REACH_SUBCOMMANDS.has(sub)) unprovable(`${where} runs \`${shown}\`, a cargo command (${sub ?? "none"}) other than ${[...CARGO_REACH_SUBCOMMANDS].join(", ")}`);
+      dirs.add(dir);
+      return;
+    }
+    if (PACKAGE_MANAGERS.has(tool)) return walkPackageManager(tool, words.slice(1), dirScripts, dir, via, shown);
+    if (REACH_SAFE_TOOLS.has(tool)) return;
+    unprovable(`${where} runs \`${shown}\` (${tool}), which this check cannot follow to cargo`);
+  };
+  const walkPackageManager = (tool, args, dirScripts, dir, via, shown) => {
+    const where = `${via.join(" -> ")}`;
+    let target = dir;
+    let i = 0;
+    let retargets = 0;
+    // Options, in any position before the script or command: each one resolved, or the command is unprovable. At most one of them
+    // may name the package or directory (two would leave which one wins to the package manager).
+    const options = () => {
+      while (i < args.length && args[i].startsWith("-")) {
+        const [name, ...inline] = args[i].split("=");
+        const value = inline.length ? inline.join("=") : args[i + 1];
+        const width = inline.length ? 1 : 2;
+        if (PM_DIR_OPTIONS.has(name) || PM_PACKAGE_OPTIONS.has(name) || ((name === "-w" || name === "--workspace-root") && (tool === "pnpm" || tool === "npm"))) {
+          retargets += 1;
+          if (retargets > 1) unprovable(`${where}: \`${shown}\` names its package or directory more than once`);
+        }
+        if (PM_DIR_OPTIONS.has(name)) { if (value === undefined) unprovable(`${where}: \`${shown}\` names no directory`); target = path.posix.normalize(path.posix.join(dir, String(value))); i += width; }
+        else if (PM_PACKAGE_OPTIONS.has(name)) { const d = packageDirOf(String(value)); if (d === null || d === undefined) unprovable(`${where}: \`${shown}\` runs a package (${value}) this repository cannot resolve`); target = d; i += width; }
+        else if ((name === "-w" || name === "--workspace-root") && tool === "pnpm") { target = "."; i += 1; }
+        else if ((name === "-w") && tool === "npm") { const d = packageDirOf(String(value)); if (d === null || d === undefined) unprovable(`${where}: \`${shown}\` runs a workspace (${value}) this repository cannot resolve`); target = d; i += width; }
+        else if (PM_PLAIN_FLAGS.has(name) && !inline.length) i += 1;
+        else if (PM_VALUE_FLAGS.has(name)) i += width;
+        else unprovable(`${where}: \`${shown}\` has an option (${name}) this check does not resolve`);
+      }
+    };
+    options();
+    const sub = args[i++];
+    if (sub === undefined) unprovable(`${where}: \`${shown}\` runs no script`);
+    // Options after `run`/`exec` count as well: the target is known only once every option before the script has been read.
+    if (sub === "run" || sub === "run-script" || (sub === "exec" && tool === "pnpm")) options();
+    if (target.startsWith("..")) unprovable(`${where}: \`${shown}\` runs outside this repository (${target})`);
+    const targetScripts = target === dir ? dirScripts : readScripts(target);
+    if (targetScripts === null || targetScripts === undefined) unprovable(`${where}: \`${shown}\` runs scripts of ${target}, which has no readable package.json`);
+    const hop = target === dir ? via : [...via, `${tool} ${args.join(" ")}`.slice(0, 120)];
+    if (sub === "exec" && tool === "pnpm") {
+      if (i >= args.length) unprovable(`${where}: \`${shown}\` executes nothing`);
+      return walkCommand(args.slice(i), targetScripts, target, hop);
+    }
+    let script;
+    if (sub === "run" || sub === "run-script") { script = args[i++]; if (script === undefined) unprovable(`${where}: \`${shown}\` names no script`); }
+    else if (sub === "test" || sub === "t" || sub === "tst") script = "test";
+    else if (!PM_BUILTINS.has(sub) && Object.hasOwn(targetScripts, sub)) script = sub;
+    else unprovable(`${where}: \`${shown}\` is a ${tool} command (${sub}) this check cannot follow`);
+    if (i < args.length) unprovable(`${where}: \`${shown}\` passes arguments to ${target}'s ${script}`);
+    walkScript(targetScripts, script, target, hop);
+  };
+  if (declared?.call) return { unprovable: "it is declared to reach the broker in ways its scripts do not show (requiresBroker)" };
+  try {
+    walkScript(scripts ?? {}, "test", unitDir, []);
+  } catch (e) {
+    if (e.reach) return { unprovable: e.message };
+    throw e;
+  }
+  const list = [...dirs];
+  return list.length === 0 ? { none: true } : list.length === 1 ? { dir: list[0] } : { dirs: list };
+}
+
 // A test script can reach the broker in ways scriptBrokerCall cannot read from package.json alone: `node -e "...spawnSync('pnpm', ['run', n])..."`,
 // `node ./scripts/verify-local.mjs` (a script that spawns `rustright cargo test`), `sh -c`, `pnpm --dir <elsewhere> run verify`, `pnpm --filter`. HeardRight's
 // root `test` is a `node -e` over `verify`, which is `pnpm --dir tauri-app-next run verify`, which is `node ./scripts/verify-local.mjs`, which runs
@@ -434,12 +700,25 @@ export function declaredBrokerCall(unit, value) {
  * managed `rustright cargo` and `pnpm` run in. A scan whose files did not change is not planned.
  */
 export function planScans({
-  changed = [], contentRoot, liveRoot = contentRoot, exists = fs.existsSync, readFile = (f) => fs.readFileSync(f, "utf8"),
+  changed = [], contentRoot, liveRoot = contentRoot, trustedRoot = null, exists = fs.existsSync, readFile = (f) => fs.readFileSync(f, "utf8"),
   platform = process.platform, includeTests = true, localCompile = true,
   // Where the quiet test scans (ci/gate.config.json `quietTests`) run: "local" plans them for the quiet lane; "ci" leaves them to the
   // CI shards (one crate per runner, where the port, pipe, desktop and wall-clock conflicts that force the serial lane do not exist)
   // and records a note naming them (Adrian 2026-10-22: compile locally on the warm cache, qualify the conflicting tests on VMs).
   quietTests = "local",
+  // Which scans this plan owes (Adrian, 2026-10-26; app-check.mjs TIERS): "compile" leaves out the scans added after @rightkit/release
+  // 0.6.6 (shellcheck, and actionlint's shellcheck requirement) until every app builds through the door again; "release" plans everything.
+  tier = "compile",
+  // A broker host (rustright): cargo scans run in this primary checkout instead of the content root, because the RustRight client refuses
+  // every cargo command but a locked metadata outside the app's primary checkout (RK_NOT_PRIMARY_CHECKOUT). The gate sets it only after
+  // proving the checkout's Cargo inputs are blob-identical to the snapshot's (cargoInputsDiffer); null keeps the content/live roots.
+  cargoLiveRoot = null,
+  // { [cargoDir]: absolute directory }: the checkout's resolved target directory per Cargo workspace, set as CARGO_TARGET_DIR on
+  // that workspace's cargo scans when the scans read a snapshot (the door's commit compile, joint plan step 4c).
+  targetDirs = null,
+  // True when the gate's runtime cargo wrapper (cargo-target-shim.mjs) is first on PATH for every scan: each cargo invocation binds its
+  // own workspace's checkout target directory or is refused at run time, so the static walk (cargoReachOf) is advisory, never a refusal.
+  cargoShim = false,
   // The command prefix every cargo scan runs through: `rustright cargo` on a managed host, plain `cargo` in CI.
   cargoCommand = ["rustright", "cargo"],
   // Physical containment: a changed path whose real path leaves the real content root (a symlink) is refused.
@@ -452,6 +731,8 @@ export function planScans({
   crateFeatures = {},
   // ci/gate.config.json `npm`: per-package gate settings (`quietTests`), read by the package's unit name (packages/<dir> → rightkit-<dir>).
   packageFeatures = {},
+  // True for full class A on the live checkout, which runs the repository's own code anyway (tests, typecheck, lint).
+  liveExecution = false,
   // Crates a workspace-wide Rust change (Cargo.lock, vendor/) actually reaches, computed by the caller from
   // the lock graph (scripts/ci/select.mjs). null keeps every crate in scope.
   rustScope = null,
@@ -503,9 +784,14 @@ export function planScans({
   const bytesDigest = (f) => { try { return sha256(readBytes(path.join(contentRoot, f))); } catch { return "unreadable"; } };
   const inputDigest = sha256(canonicalJson({ files: [...files].sort().map((f) => [f, bytesDigest(f)]), refused: refusals.map((r) => r.raw).sort() }));
   const under = (prefix) => files.filter((f) => f.startsWith(prefix));
+  if (!["compile", "release"].includes(tier)) throw new Error(`planScans: tier must be compile or release, not ${JSON.stringify(tier)}`);
   let scans = []; const notes = [];
+  if (cargoLiveRoot) notes.push(`broker host: cargo scans run in the primary checkout ${cargoLiveRoot}, whose Cargo inputs match the checked snapshot (rustright refuses cargo outside the primary checkout)`);
+  // A snapshot compile's scans carry its target map (item 7): the map is part of every scan's cache key, so no result cached by a
+  // live-checkout run (or a compile with another map) is taken for one that writes to these directories.
+  const snapshotTargets = targetDirs ? { RK_SNAPSHOT_TARGETS: canonicalJson(targetDirs) } : {};
   const add = (d) => {
-    const entry = { root: "live", env: {}, args: [], ...d };
+    const entry = { root: "live", args: [], ...d, env: { ...snapshotTargets, ...(d.env ?? {}) } };
     entry.command = commandText(entry);
     scans.push(entry);
   };
@@ -524,7 +810,7 @@ export function planScans({
   const plainDir = (d) => !ABSOLUTE_PATH.test(d) && !d.split("/").includes("..") && SAFE_UNIT_DIR.test(d);
   const cargoWs = cleanDir(cargoDir);
   if (!plainDir(cargoWs)) throw new TypeError("planScans: cargoDir must be a plain repository-relative directory");
-  const cargoIn = (ws, ...args) => ({ tool: cargoCommand[0], args: [...cargoCommand.slice(1), ...args], ...(ws !== "." ? { cwd: ws } : {}) });
+  const cargoIn = (ws, ...args) => ({ tool: cargoCommand[0], args: [...cargoCommand.slice(1), ...args], ...(ws !== "." ? { cwd: ws } : {}), ...(cargoLiveRoot ? { root: "cargoLive" } : {}), ...(targetDirs?.[ws] ? { env: { CARGO_TARGET_DIR: targetDirs[ws] } } : {}) });
   const unitMap = (units, kind) => {
     if (units === null) return null;
     if (!Array.isArray(units)) throw new TypeError(`planScans: ${kind}Units must be an array of { name, dir }`);
@@ -632,8 +918,14 @@ export function planScans({
     }
     byEdition.set(found.edition, [...(byEdition.get(found.edition) ?? []), f]);
   }
+  // One rustfmt scan per edition, batched: Windows refuses a command line past ~32 KB (spawn ENAMETOOLONG on a large repository,
+  // HeardRight on the Dell, 2026-10-27), so a batch holds at most RUSTFMT_BATCH files and the first batch keeps the plain id.
   for (const [edition, group] of [...byEdition].sort((a, b) => (a[0] < b[0] ? -1 : 1))) {
-    add({ id: `rustfmt:${edition}`, class: A, tool: "rustfmt", args: ["--check", "--edition", edition, ...group.sort()], root: "content" });
+    const sorted = group.sort();
+    for (let i = 0; i < sorted.length; i += RUSTFMT_BATCH) {
+      const batch = sorted.slice(i, i + RUSTFMT_BATCH);
+      add({ id: `rustfmt:${edition}${i ? `:${i / RUSTFMT_BATCH + 1}` : ""}`, class: A, tool: "rustfmt", args: ["--check", "--edition", edition, ...batch], root: "content" });
+    }
   }
   for (const f of files.filter((f) => /\.(mjs|cjs|js)$/.test(f) && !f.includes("node_modules")).sort()) {
     add({ id: `node-check:${f}`, class: A, tool: "node", args: ["--check", f], root: "content" });
@@ -687,13 +979,14 @@ export function planScans({
   const actionlintConfig = exists(path.join(contentRoot, ".github/actionlint.yaml")) ? ["-config-file", ".github/actionlint.yaml"] : [];
   // actionlint lints every run: script with shellcheck only when shellcheck is found, and otherwise passes silently; class A
   // requires it (`requires`), so a host without it fails the scan instead of skipping the shell checks.
-  if (workflowFiles.length) add({ id: "actionlint", class: A, tool: "actionlint", requires: ["shellcheck"], args: [...actionlintConfig, ...workflowFiles], root: "content" });
+  if (workflowFiles.length) add({ id: "actionlint", class: A, tool: "actionlint", requires: tier === "release" ? ["shellcheck"] : [], args: [...actionlintConfig, ...workflowFiles], root: "content", runScriptLimit: { files: workflowFiles, bytes: RUN_SCRIPT_LIMIT_BYTES } });
   // Standalone shell scripts (SellRight's deploy scripts failed SC2154, SC2030/2031 and SC2016 in CI): every tracked .sh/.bash file,
   // with ShellCheck's own defaults and the repository's .shellcheckrc (data, not code). actionlint covers only workflow run: blocks.
   // A script whose shebang names another shell (zsh, fish) is not ShellCheck's to judge, so it is left out, never failed.
   const otherShell = (f) => { try { return /^#!.*\b(zsh|fish|pwsh|powershell)\b/.test(String(readFile(path.join(contentRoot, f))).split("\n", 1)[0]); } catch { return false; } };
   const shellFiles = files.filter((f) => /\.(sh|bash)$/.test(f) && !/(^|\/)node_modules\//.test(f) && !otherShell(f)).sort();
-  if (shellFiles.length) add({ id: "shellcheck", class: A, tool: "shellcheck", args: ["--format=gcc", "--external-sources", ...shellFiles], root: "content" });
+  if (shellFiles.length && tier !== "release") notes.push("compile tier: shellcheck (added after 0.6.6) is not planned; it runs in the release tier (--to qualify|release)");
+  if (shellFiles.length && tier === "release") add({ id: "shellcheck", class: A, tool: "shellcheck", tier: "release", args: ["--format=gcc", "--external-sources", ...shellFiles], root: "content" });
   // No right-git drift scan: the one workflow right-git renders here, ci.yml, is hand-owned (its header;
   // docs/CI.md) and held by scripts/ci/ci-scans-contract.mjs instead, so drift is always reported by design.
 
@@ -706,22 +999,36 @@ export function planScans({
   for (const ws of workspaces) {
     if (typeof ws !== "string") continue;
     const dir = ws === "." ? "" : ws;
-    const ignores = ["deny.toml", ".cargo/audit.toml"].some((f) => { try { return /\bignore\s*=\s*\[[^\]]*\S[^\]]*\]/s.test(readFile(path.join(contentRoot, dir, f))); } catch { return false; } });
+    // A non-empty list only: `[^\]\s]` is one character that is neither whitespace nor the closing bracket, so `ignore = []` followed by
+    // a later `]` (the next table header) is not an ignore (Pulse, 2026-10-27: `\S` matched the `]` itself).
+    const ignores = ["deny.toml", ".cargo/audit.toml"].some((f) => { try { return /\bignore\s*=\s*\[[^\]]*[^\]\s][^\]]*\]/s.test(readFile(path.join(contentRoot, dir, f))); } catch { return false; } });
     if (ignores && !(dir === "" && exists(path.join(contentRoot, "ci/advisory-exceptions.json")))) add({ id: `advisory-exceptions${dir ? `:${dir}` : ""}`, class: A, internal: "advisory-exceptions", dir, exceptionsFile: ".rightkit/advisory-exceptions.json" });
   }
   // Like generated-docs, planned only when a changed file is one of the contract's inputs or projections. The generator runs from
   // the trusted scanner checkout (the import below); the exported contract and projections are data it checks.
-  if (files.some((f) => SUITE_API_INPUT.test(f)) && exists(path.join(contentRoot, "contracts/right-suite-api.v1.json"))) add({ id: "suite-api", class: A, internal: "suite-api" });
+  if (files.some((f) => SUITE_API_INPUT.test(f)) && exists(path.join(contentRoot, "contracts/right-suite-api.v1.json"))) {
+    // RightKit's own generator contract (scripts/gen-suite-api.mjs) is the checked repository's code: like scripts/preflight.mjs it
+    // runs only when this gate is that repository's in-tree copy (and in CI), never from a pinned or installed copy checking the
+    // repository (the broker's trusted gate refused RightKit's own compile on a module it could not find, 2026-10-27).
+    // The trusted home is the gate's own repository (`trustedRoot`, the checkout rightkit-gate runs for: a commit check exports the
+    // commit to a snapshot and hands that as contentRoot and liveRoot); the generator is code and runs only from that checkout's
+    // in-tree gate, reading the snapshot as data. Without a trusted root (library callers), the live checkout or content root decides.
+    const home = trustedRoot ?? (path.resolve(liveRoot) !== path.resolve(contentRoot) ? liveRoot : contentRoot);
+    if (inTreeGate(home, exists)) add({ id: "suite-api", class: A, internal: "suite-api" });
+    else notes.push("suite-api: RightKit's own generator contract runs from the in-tree gate and CI, not from this installed copy");
+  }
   if (rustTouched) {
     for (const ws of touchedWs) add({ id: `cargo-metadata${wsIdSuffix(ws)}`, class: A, ...cargoIn(ws, ...metadataArgs()) });
-    for (const name of crateNames.filter((n) => rustMap?.get(n).publish !== false)) add({ id: rustScanId.packageList(name), class: A, ...cargoIn(wsOf(name), "package", "-p", crateOf(name), "--list", "--allow-dirty", "--locked") });
+    // Locked package listings are observations in RustRight (#1216). They run through the selected executor
+    // from the checked Cargo inputs, just like metadata; an executor refusal remains a failed scan.
+    if (tier === "release") for (const name of crateNames.filter((n) => rustMap?.get(n).publish !== false)) add({ id: rustScanId.packageList(name), class: A, tier: "release", ...cargoIn(wsOf(name), "package", "-p", crateOf(name), "--list", "--allow-dirty", "--locked") });
   }
   for (const ws of [...configWs].sort()) {
     // Offline against the pinned database. The pin commit is part of the command (env), so a pin change is a different scan, and the
     // placeholders are filled at run time from the materialised checkout (runScans).
     const pin = advisoryPin ?? (advisoryPin = readAdvisoryPin());
     const pinEnv = { RK_ADVISORY_DB_COMMIT: pin.commit };
-    add({ id: `cargo-deny${wsIdSuffix(ws)}`, class: A, ...cargoIn(ws, "deny", "--offline", "--metadata-path", "{advisoryMetadata}", "--config", "{advisoryDenyConfig}", "check"), env: pinEnv, advisoryDb: "deny", advisoryPin: pin });
+    add({ id: `cargo-deny${wsIdSuffix(ws)}`, class: A, ...cargoIn(ws, "deny", "--frozen", "--metadata-path", "{advisoryMetadata}", "--config", "{advisoryDenyConfig}", "check"), env: pinEnv, advisoryDb: "deny", advisoryPin: pin });
     add({ id: `cargo-audit${wsIdSuffix(ws)}`, class: A, ...cargoIn(ws, "audit", "--db", "{advisoryDb}", "--no-fetch"), env: pinEnv, advisoryDb: "audit", advisoryPin: pin });
   }
   // The audit policy is the consumer's own: every package.json script that is exactly `pnpm audit <flags>` (only --prod, --dev,
@@ -770,9 +1077,11 @@ export function planScans({
   // requiring a trusted-root run: deferred (never a pass), not run from submitted code.
   // Planned only when a changed file is one of the generator's inputs (GENERATOR_INPUT).
   if (exists(path.join(contentRoot, "scripts/generate-index.mjs")) && files.some((f) => GENERATOR_INPUT.test(f))) {
-    const trusted = path.resolve(liveRoot) !== path.resolve(contentRoot) && exists(path.join(liveRoot, "scripts/generate-index.mjs"));
+    // Full class A on the live checkout (`liveExecution`) already executes the repository's own code (its tests): there the
+    // generator runs from that same checkout. Everywhere else the separation above holds.
+    const trusted = (liveExecution || path.resolve(liveRoot) !== path.resolve(contentRoot)) && exists(path.join(liveRoot, "scripts/generate-index.mjs"));
     add({
-      id: "generated-docs", class: B, tool: "node", args: ["scripts/generate-index.mjs", "--check", "--root", "{contentRoot}"],
+      id: "generated-docs", class: A, executes: true, tool: "node", args: ["scripts/generate-index.mjs", "--check", "--root", "{contentRoot}"],
       ...(trusted ? {} : { deferred: "requires a trusted-root run: the generator is repository code and no separate trusted checkout provides it; the content root's copy is never executed" }),
     });
   }
@@ -809,15 +1118,43 @@ export function planScans({
   }
   // A linter config in the unit's directory or any ancestor of it (a repository-level config covers every unit, as the tools look it up).
   const hasConfig = (dir, names) => ancestorDirsOf(dir).some((d) => names.some((f) => exists(path.join(liveRoot, inDir(d, f)))));
+  // tsc reads a workspace sibling's types where its package.json exports point: built output (dist/*.d.ts) that no commit holds, so a
+  // check of the committed tree (CI, a commit snapshot) cannot find them, and a checkout with an old build checks against stale types.
+  // A package that depends on another workspace package is therefore checked through a generated project that maps each sibling's
+  // exported entry points to its committed sources (TSC_PROJECT, built by the runner); every other package keeps its own tsconfig.
+  // `--noEmit` stays on the command line as well as in the project: the class A launch guard judges a tsc launch by its argv alone.
+  const workspaceDirs = (npmMap ? [...npmMap.values()].map((u) => u.dir) : listDir(path.join(liveRoot, "packages")).map((n) => `packages/${n}`)).sort();
+  const manifestOf = (dir) => { try { return JSON.parse(readFile(path.join(liveRoot, dir, "package.json")).replace(/^/, "")); } catch { return null; } };
+  const workspaceNames = new Map(workspaceDirs.map((d) => [manifestOf(d)?.name, d]).filter(([n]) => typeof n === "string"));
+  const usesWorkspaceSibling = (dir) => {
+    const m = manifestOf(dir);
+    return ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"].some((k) => Object.keys(m?.[k] ?? {}).some((n) => n !== m.name && workspaceNames.has(n)));
+  };
   for (const name of pkgNames) {
     const dir = npmDir(name);
-    if (exists(path.join(liveRoot, dir, "tsconfig.json"))) add({ id: `tsc:${name}`, class: B, tool: "pnpm", args: ["exec", "tsc", "--noEmit", "-p", "tsconfig.json"], env: PNPM_RUN_ENV, cwd: dir });
-    if (hasConfig(dir, ESLINT_CONFIG_FILES)) add({ id: `eslint:${name}`, class: B, tool: "pnpm", args: ["exec", "eslint", "."], env: PNPM_RUN_ENV, cwd: dir });
-    if (hasConfig(dir, BIOME_CONFIG_FILES)) add({ id: `biome:${name}`, class: B, tool: "pnpm", args: ["exec", "biome", "lint", "."], env: PNPM_RUN_ENV, cwd: dir });
+    if (exists(path.join(liveRoot, dir, "tsconfig.json"))) {
+      add(usesWorkspaceSibling(dir)
+        ? { id: `tsc:${name}`, class: A, executes: true, tool: "pnpm", args: ["exec", "tsc", "--noEmit", "-p", TSC_PROJECT], tscWorkspace: [...workspaceNames.values()].sort(), env: PNPM_RUN_ENV, cwd: dir }
+        : { id: `tsc:${name}`, class: A, executes: true, tool: "pnpm", args: ["exec", "tsc", "--noEmit", "-p", "tsconfig.json"], env: PNPM_RUN_ENV, cwd: dir });
+    }
+    if (hasConfig(dir, ESLINT_CONFIG_FILES)) add({ id: `eslint:${name}`, class: A, executes: true, tool: "pnpm", args: ["exec", "eslint", "."], env: PNPM_RUN_ENV, cwd: dir });
+    if (hasConfig(dir, BIOME_CONFIG_FILES)) add({ id: `biome:${name}`, class: A, executes: true, tool: "pnpm", args: ["exec", "biome", "lint", "."], env: PNPM_RUN_ENV, cwd: dir });
   }
-  if (files.some((f) => f.startsWith("swift/") || f === "Package.swift")) {
-    if (platform === "darwin") add({ id: "swift-build", class: B, tool: "swift", args: ["build"] });
-    else notes.push("swift files changed; `swift build` is required on the Mac host before its push");
+  // One `swift build` per Swift package a changed file belongs to: the nearest Package.swift at or above the file, built in its own
+  // directory (rightkit#1229: Pulse's package is swift/RightKitHub, and a root `swift build` found no package and blocked every push).
+  const swiftFiles = files.filter((f) => f.startsWith("swift/") || f === "Package.swift" || f.endsWith("/Package.swift"));
+  if (swiftFiles.length) {
+    const packages = new Set();
+    for (const f of swiftFiles) {
+      const owner = ancestorDirsOf(path.posix.dirname(f)).reverse().find((d) => exists(path.join(contentRoot, inDir(d, "Package.swift"))));
+      if (owner !== undefined) packages.add(owner);
+      else notes.push(`${f}: no Package.swift at or above it, so no Swift package builds it`);
+    }
+    for (const dir of [...packages].sort()) {
+      const id = dir === "" || dir === "." ? "swift-build" : `swift-build:${dir}`;
+      if (platform === "darwin") add({ id, class: B, tool: "swift", args: ["build"], ...(dir === "" || dir === "." ? {} : { cwd: dir }) });
+      else notes.push(`swift files changed in ${dir === "" || dir === "." ? "the root package" : dir}; \`swift build\` is required on the Mac host before its push`);
+    }
   }
   if (includeTests) {
     const deferredToCi = [];
@@ -851,8 +1188,64 @@ export function planScans({
       // A declaration (`npm.<unit>.requiresBroker`, declaredBrokerCall) covers what the script text does not show; a call the scripts do show wins.
       const declared = declaredBrokerCall(name, own.requiresBroker);
       if (declared.problem) notes.push(declared.problem);
+      // `npm.<unit>.afterClassA.reason` (ci/gate.config.json): the unit's tests launch stand-ins named like compilers (stub scripts,
+      // which can run anything), so they cannot run under the class A launch guard; they run after class A, with the compile scans.
+      // A reason is required.
+      const afterClassA = typeof own.afterClassA?.reason === "string" && own.afterClassA.reason.trim() !== "" ? own.afterClassA.reason.trim() : null;
       const brokerCall = scriptBrokerCall(manifest.scripts, "test") ?? declared.call ?? null;
-      add({ id: `test:npm:${name}`, class: B, ...(own.quietTests === true ? { quiet: true } : {}), ...(brokerCall ? { brokerCall } : {}), tool: "pnpm", args: ["--dir", npmDir(name), "run", "test"], env: { ...PNPM_RUN_ENV, RIGHTKIT_ISOLATED_CHECKOUT: "1" } });
+      const buildCall = brokerCall ? null : scriptBuildCall(manifest.scripts, "test");
+      const laterReason = brokerCall ? null : buildCall ? `its test script builds before testing (${buildCall.command}); it runs after class A, with the compile scans` : afterClassA ? `declared to run after class A (ci/gate.config.json npm.${name}.afterClassA): ${afterClassA}` : null;
+      // Isolated only where the tests run on an export (contentRoot is not the live checkout): there sibling repositories are
+      // absent by construction. On the live checkout (full class A, broker admission) the cross-app contract tests run for real.
+      const isolatedCheckout = path.resolve(contentRoot) !== path.resolve(liveRoot);
+      // `npm.<unit>.classATests.evidence` (ci/gate.config.json): the unit's tests were shown, by import inspection and launch observation
+      // under the class A launch guard, to compile and build nothing (docs/GATE-CLASS-A-INVENTORY.md "Test units"); they run in class A,
+      // still under the guard, which refuses any compile at run time. Never when the script reaches the broker, builds, or is declared after class A.
+      const classAEvidence = typeof own.classATests?.evidence === "string" && own.classATests.evidence.trim() !== "" ? own.classATests.evidence.trim() : null;
+      const inClassA = classAEvidence && !brokerCall && !buildCall && !afterClassA;
+      if (classAEvidence && !inClassA) notes.push(`npm.${name}.classATests is ignored: ${brokerCall ? "its test script reaches the broker" : buildCall ? `its test script builds (${buildCall.command})` : "it is declared afterClassA"}; it runs after class A`);
+      // A commit snapshot's compile (targetDirs): a test that reaches cargo writes where cargo puts the outputs of the workspace it
+      // finds from the directory it runs in, which would be inside the snapshot. Bound to that workspace's checkout target directory
+      // when the reachable path proves the directory (cargoReachOf); refused before launch only when it reaches Rust unprovably.
+      let cargoTarget = null;
+      if (targetDirs && cargoShim) {
+        // Advisory only: the wrapper binds or refuses each cargo the test starts, whatever path reaches it.
+        const reach = cargoReachOf({ unitDir: npmDir(name), scripts: manifest.scripts, declared });
+        if (reach.unprovable && Object.keys(targetDirs).length) notes.push(`npm unit ${name}: the static walk cannot prove where its cargo writes (${reach.unprovable}); the runtime cargo wrapper binds each invocation to its workspace's checkout target directory or refuses it`);
+      } else if (targetDirs) {
+        const unitDir = npmDir(name);
+        const scriptsOf = (dir) => { try { const m = JSON.parse(readFile(path.join(contentRoot, ...(dir === "." ? [] : dir.split("/")), "package.json"))); return m?.scripts && typeof m.scripts === "object" ? m.scripts : {}; } catch { return null; } };
+        const packageDirOf = (pkg) => {
+          for (const [unit, entry] of npmMap ?? []) {
+            if (unit === pkg) return entry.dir;
+            try { if (JSON.parse(readFile(path.join(contentRoot, ...(entry.dir === "." ? [] : entry.dir.split("/")), "package.json"))).name === pkg) return entry.dir; } catch { /* unreadable: not this one */ }
+          }
+          return null;
+        };
+        // Every call the test reaches, not the first: one CARGO_TARGET_DIR binds the whole test, so all of them must be one workspace.
+        const reach = cargoReachOf({ unitDir, scripts: manifest.scripts, declared, readScripts: scriptsOf, packageDirOf });
+        const hasRust = Object.keys(targetDirs).length > 0;
+        if (reach.unprovable) {
+          if (hasRust) { refuse(`npm unit ${name}`, `its test reaches cargo while the compile reads a commit snapshot, and which workspace's outputs it writes cannot be proven (${reach.unprovable}); outputs must be the checkout's`); continue; }
+        } else if (reach.dir !== undefined || reach.dirs) {
+          const workspaceOf = (from) => {
+            let manifestDir = null;
+            for (let d = from; ; d = path.posix.dirname(d) === "." || d === "." ? "." : path.posix.dirname(d)) {
+              if (exists(path.join(contentRoot, ...(d === "." ? [] : d.split("/")), "Cargo.toml"))) { manifestDir = d; break; }
+              if (d === ".") break;
+            }
+            const ws = manifestDir === null ? null : Object.hasOwn(targetDirs, manifestDir) ? manifestDir : ([...(rustMap?.values() ?? [])].find((u) => u.dir === manifestDir)?.cargoDir ?? null);
+            return ws && targetDirs[ws] ? { ws } : { why: `its test reaches cargo from ${from}, ${manifestDir === null ? `which no Cargo.toml encloses` : `whose ${manifestDir}/Cargo.toml is not a known workspace or member`}; outputs must be the checkout's` };
+          };
+          const found = (reach.dirs ?? [reach.dir]).map(workspaceOf);
+          const unknown = found.find((f) => f.why);
+          if (unknown) { refuse(`npm unit ${name}`, unknown.why); continue; }
+          const workspaces = [...new Set(found.map((f) => f.ws))];
+          if (workspaces.length > 1) { refuse(`npm unit ${name}`, `its test reaches cargo in more than one workspace (${workspaces.join(", ")} from ${reach.dirs.join(", ")}); one CARGO_TARGET_DIR binds the whole test, so one of them would write into another's outputs`); continue; }
+          cargoTarget = targetDirs[workspaces[0]];
+        }
+      }
+      add({ id: `test:npm:${name}`, class: inClassA ? A : B, kind: "test", executes: true, classReason: inClassA ? `class A on recorded evidence (${classAEvidence}); run under the launch guard` : brokerCall ? "its test script reaches the broker (compiles); it runs with the compile scans" : laterReason ?? "test scripts execute project code and run after class A", ...(own.quietTests === true ? { quiet: true } : {}), ...(brokerCall ? { brokerCall } : {}), tool: "pnpm", args: ["--dir", npmDir(name), "run", "test"], env: { ...PNPM_RUN_ENV, ...(isolatedCheckout ? { RIGHTKIT_ISOLATED_CHECKOUT: "1" } : {}), ...(cargoTarget ? { CARGO_TARGET_DIR: cargoTarget } : {}) } });
     }
     if (deferredToCi.length) notes.push(`${deferredToCi.length} quiet test scan(s) left to the CI shards (one crate per runner), not run here: ${deferredToCi.join(", ")}`);
     // scripts/ci tests run when scripts/, ci/ or .github/ changed, or a file the scripts/ci sources reference (imports and
@@ -883,7 +1276,7 @@ export function planScans({
       // The suite is the exported commit's test files, named explicitly: an untracked WIP test in the live
       // checkout is never run and can neither block nor pass a push.
       const suite = listDir(path.join(contentRoot, "scripts", "ci")).filter((n) => n.endsWith(".test.mjs")).sort().map((n) => `scripts/ci/${n}`);
-      add({ id: "test:scripts-ci", class: B, tool: "node", args: ["--test", ...(suite.length ? suite : ["scripts/ci/*.test.mjs"])] });
+      add({ id: "test:scripts-ci", class: B, kind: "test", executes: true, classReason: "tests execute project code and run after class A", tool: "node", args: ["--test", ...(suite.length ? suite : ["scripts/ci/*.test.mjs"])] });
     }
   }
 
@@ -904,7 +1297,7 @@ export function planScans({
   if (dup) throw new Error(`planScans: duplicate scan id ${dup}`);
   const classDigest = (cls) => digestScanSet(scans.filter((s) => s.class === cls));
   return {
-    schema: SCAN_RESULT_SCHEMA, roots: { contentRoot, liveRoot }, changed: files, inputDigest, scans, notes, deferred,
+    schema: SCAN_RESULT_SCHEMA, roots: { contentRoot, liveRoot, ...(cargoLiveRoot ? { cargoLiveRoot } : {}) }, changed: files, inputDigest, scans, notes, deferred,
     scanSetDigest: digestScanSet(scans), classDigests: { A: classDigest(A), B: classDigest(B) },
   };
 }
@@ -921,7 +1314,7 @@ const SAFE_SHIM_PATH = /^[A-Za-z0-9_.,:=@+ \/\\()-]+$/;
  * run any other .cmd/.bat shim only when its path and every argument pass a strict allowlist.
  * Returns { file, args, verbatim } or { error }.
  */
-export function resolveInvocation(command, args, { platform = process.platform, env = process.env, exists = fs.existsSync, execPath = process.execPath } = {}) {
+export function resolveInvocation(command, args, { platform = process.platform, env = process.env, exists = fs.existsSync, execPath = process.execPath, readFile = (f) => fs.readFileSync(f, "utf8") } = {}) {
   if (platform !== "win32") return { file: command, args, verbatim: false };
   const hasExt = /\.[A-Za-z0-9]{1,4}$/.test(command);
   const pathKey = Object.keys(env).find((k) => k.toLowerCase() === "path");
@@ -936,6 +1329,10 @@ export function resolveInvocation(command, args, { platform = process.platform,
   if (!/\.(cmd|bat)$/i.test(found)) return { file: found, args, verbatim: false };
   const cjs = path.win32.join(path.win32.dirname(found), "node_modules", "pnpm", "bin", "pnpm.cjs");
   if (/^pnpm\.cmd$/i.test(path.win32.basename(found)) && exists(cjs)) return { file: execPath, args: [cjs, ...args], verbatim: false };
+  // A Node cmd-shim (what npm, pnpm and nvm install: `"%~dp0\...\entry.js" %*`, npm's `SET "NPM_CLI_JS=%~dp0\...npm-cli.js"`) runs
+  // its JS entry with node: started here as node + that entry, no shell, so any argument passes unchanged (rightkit#1261).
+  const entry = cmdShimEntry(found, { readFile, exists });
+  if (entry) return { file: execPath, args: [entry, ...args], verbatim: false };
   const bad = args.find((a) => !SAFE_SHIM_ARG.test(a));
   if (bad !== undefined) return { error: new Error(`refusing to pass ${JSON.stringify(bad)} to the shell shim ${found}`) };
   if (!SAFE_SHIM_PATH.test(found)) return { error: new Error(`refusing to run shell shim ${found}: unsafe path`) };
@@ -943,14 +1340,83 @@ export function resolveInvocation(command, args, { platform = process.platform,
   return { file: env.ComSpec || "cmd.exe", args: ["/d", "/s", "/c", `""${found}"${args.map((a) => ` ${a}`).join("")}"`], verbatim: true };
 }
 
+/**
+ * The JS entry a Node cmd-shim at `shim` runs, or null: the line that passes the caller's arguments (`%*`) names it, either as a
+ * `%~dp0`-relative path (`"%~dp0\\..\\pnpm.mjs" %*`) or through a variable set to one (npm's `"%NODE_EXE%" "%NPM_CLI_JS%" %*` with
+ * `SET "NPM_CLI_JS=%~dp0\\node_modules\\npm\\bin\\npm-cli.js"`). Helpers the shim runs on other lines (npm's npm-prefix.js) are not it.
+ */
+export function cmdShimEntry(shim, { readFile = (f) => fs.readFileSync(f, "utf8"), exists = fs.existsSync } = {}) {
+  let text;
+  try { text = String(readFile(shim)); } catch { return null; }
+  const vars = new Map();
+  // Every value a variable is set to (npm's NPM_CLI_JS is reassigned to a global-prefix copy when one exists): the %~dp0 one is used.
+  for (const m of text.matchAll(/^\s*@?SET\s+"?([A-Za-z_][A-Za-z0-9_]*)=([^"\r\n]*)"?\s*$/gim)) vars.set(m[1].toUpperCase(), [...(vars.get(m[1].toUpperCase()) ?? []), m[2]]);
+  const fromDp0 = (value) => {
+    const m = /^%~dp0\\?(.+\.(?:mjs|cjs|js))$/i.exec(String(value ?? "").trim());
+    if (!m) return null;
+    const entry = path.win32.resolve(path.win32.dirname(shim), m[1]);
+    return exists(entry) ? entry : null;
+  };
+  for (const line of text.split(/\r?\n/)) {
+    if (!line.includes("%*")) continue;
+    for (const q of line.matchAll(/"([^"]+)"/g)) {
+      const token = q[1];
+      const direct = fromDp0(token);
+      if (direct) return direct;
+      const v = /^%([A-Za-z_][A-Za-z0-9_]*)%$/.exec(token);
+      if (v) for (const value of vars.get(v[1].toUpperCase()) ?? []) { const viaVar = fromDp0(value); if (viaVar) return viaVar; }
+    }
+  }
+  return null;
+}
+
 /** Default spawn: synchronous, no console window, never `shell: true`. */
 export function defaultSpawn(command, args, options = {}) {
+  if (options.boundedMs) return boundedSpawn(command, args, options);
   const inv = resolveInvocation(command, args, { env: options.env ?? process.env });
   if (inv.error) return { status: null, stdout: "", stderr: "", error: inv.error };
   return spawnSync(inv.file, inv.args, { encoding: "utf8", windowsHide: true, maxBuffer: 64 * 1024 * 1024, windowsVerbatimArguments: inv.verbatim, ...options, shell: false });
 }
 
 const OUTPUT_KEEP = 4 * 1024 * 1024;
+/**
+ * defaultSpawn with a deadline (`options.boundedMs`), for short identity probes that must never hang the caller: the command runs
+ * in a helper node process through defaultSpawnAsync, which on the deadline kills the command's whole process tree
+ * (killProcessTree) and reports `timedOut: true`. The helper records the command's pid first; if the helper itself overruns its
+ * backstop (`backstopMs`, default deadline + 15 s), it is killed and the command's tree is killed from here by that pid, so no
+ * probe outlives the call. A launch failure keeps its `error` (e.g. ENOENT); a command that ran keeps its `status`.
+ */
+export function boundedSpawn(command, args, { boundedMs, backstopMs = boundedMs + 15000, cwd, env, pidFile = null } = {}) {
+  const dir = pidFile ? null : fs.mkdtempSync(path.join(os.tmpdir(), "rk-probe-"));
+  const pids = pidFile ?? path.join(dir, "pid");
+  const script = `import(${JSON.stringify(new URL(import.meta.url).href)}).then(async (m) => {
+    const [command, args, ms, pidFile] = JSON.parse(process.argv[1]); const fs = await import("node:fs");
+    const ac = new AbortController(); const timer = setTimeout(() => ac.abort(), ms);
+    const r = await m.defaultSpawnAsync(command, args, { signal: ac.signal, onSpawn: (pid) => fs.writeFileSync(pidFile, String(pid)) }); clearTimeout(timer);
+    process.stdout.write(JSON.stringify({ status: r.status, stdout: r.stdout, stderr: r.stderr, timedOut: r.cancelled === true, error: r.cancelled ? null : (r.error ? { code: r.error.code ?? null, message: r.error.message } : null) }));
+  });`;
+  try {
+    const r = spawnSync(process.execPath, ["--input-type=module", "-e", script, JSON.stringify([command, args, boundedMs, pids])], { cwd, env: env ?? process.env, encoding: "utf8", windowsHide: true, stdio: ["ignore", "pipe", "pipe"], timeout: backstopMs, killSignal: "SIGKILL", maxBuffer: 16 * 1024 * 1024 });
+    const timeout = (why) => ({ status: null, stdout: "", stderr: "", timedOut: true, error: Object.assign(new Error(`timed out after ${boundedMs} ms${why}`), { code: "ETIMEDOUT" }) });
+    if (r.error?.code === "ETIMEDOUT") {
+      let pid = null; try { pid = Number(fs.readFileSync(pids, "utf8")) || null; } catch { /* never started */ }
+      if (pid) killProcessTree({ pid });
+      return timeout(" (backstop)");
+    }
+    try {
+      const o = JSON.parse(r.stdout);
+      if (o.timedOut) return timeout("");
+      return { status: o.status, stdout: o.stdout ?? "", stderr: o.stderr ?? "", ...(o.error ? { error: Object.assign(new Error(o.error.message), { code: o.error.code }) } : {}) };
+    } catch { return { status: null, stdout: "", stderr: r.stderr ?? "", error: new Error(`the bounded probe gave no result (${r.error?.message ?? `exit ${r.status}`})`) }; }
+  } finally { if (dir) fs.rmSync(dir, { recursive: true, force: true }); }
+}
+
+/** The environment additions that load the class A launch guard into a test row's Node processes (NODE_OPTIONS appended, not replaced). */
+export function launchGuardEnv(env = process.env) {
+  const current = String(env.NODE_OPTIONS ?? "");
+  return { RIGHTKIT_CLASS_A_LAUNCH_GUARD: "1", NODE_OPTIONS: current.includes(LAUNCH_GUARD_IMPORT) ? current : `${current} ${LAUNCH_GUARD_IMPORT}`.trim() };
+}
+
 /** Kill `child` and everything it started: taskkill /T /F on Windows, the whole process group elsewhere (the child leads one when spawned with a signal). */
 export function killProcessTree(child, { platform = process.platform, run = spawnSync, kill = (pid, sig) => process.kill(pid, sig) } = {}) {
   if (!child?.pid) return;
@@ -967,17 +1433,21 @@ export function killProcessTree(child, { platform = process.platform, run = spaw
  * With `options.stdoutFile`, stdout is written to that file whole instead of kept in memory.
  */
 export function defaultSpawnAsync(command, args, options = {}) {
-  const { signal, stdoutFile, ...rest } = options;
+  const { signal, stdoutFile, onSpawn, ...rest } = options;
   const inv = resolveInvocation(command, args, { env: rest.env ?? process.env });
   if (inv.error) return Promise.resolve({ status: null, stdout: "", stderr: "", error: inv.error });
   if (signal?.aborted) return Promise.resolve({ status: null, stdout: "", stderr: "", error: new Error("cancelled"), cancelled: true });
   return new Promise((resolve) => {
     let stdout = ""; let stderr = ""; let error = null;
-    const keep = (buf, chunk) => { const next = buf + chunk; return next.length > OUTPUT_KEEP ? next.slice(-OUTPUT_KEEP) : next; };
+    let truncated = false;
+    const keep = (buf, chunk) => { const next = buf + chunk; if (next.length > OUTPUT_KEEP) { truncated = true; return next.slice(-OUTPUT_KEEP); } return next; };
     let child;
     try {
-      child = spawnChild(inv.file, inv.args, { windowsHide: true, windowsVerbatimArguments: inv.verbatim, ...(signal && process.platform !== "win32" ? { detached: true } : {}), ...rest, shell: false, stdio: ["ignore", "pipe", "pipe"] });
+      // stdin is closed: no scan reads it, and an open pipe nobody writes can block a tool that probes it (Windows).
+      // A detached child (POSIX, its own group for the abort kill) is recorded under the held build ownership (build-ownership.mjs).
+      child = spawnUnderOwnership(spawnChild, inv.file, inv.args, { windowsHide: true, windowsVerbatimArguments: inv.verbatim, stdio: ["ignore", "pipe", "pipe"], ...(signal && process.platform !== "win32" ? { detached: true } : {}), ...rest, shell: false, stdio: ["ignore", "pipe", "pipe"] });
     } catch (e) { resolve({ status: null, stdout: "", stderr: "", error: e }); return; }
+    if (onSpawn && child.pid) onSpawn(child.pid);
     const onAbort = () => killProcessTree(child);
     signal?.addEventListener("abort", onAbort, { once: true });
     child.stdout.setEncoding("utf8"); child.stderr.setEncoding("utf8");
@@ -989,7 +1459,7 @@ export function defaultSpawnAsync(command, args, options = {}) {
       if (sink) await new Promise((done) => (sink.writableFinished ? done() : sink.on("finish", done).on("error", done)));
       signal?.removeEventListener("abort", onAbort);
       const cancelled = signal?.aborted === true;
-      resolve({ status, stdout, stderr, ...(error ? { error } : cancelled ? { error: new Error("cancelled") } : {}), ...(cancelled ? { cancelled: true } : {}) });
+      resolve({ status, stdout, stderr, ...(truncated ? { truncated: true } : {}), ...(error ? { error } : cancelled ? { error: new Error("cancelled") } : {}), ...(cancelled ? { cancelled: true } : {}) });
     });
     if (signal?.aborted) onAbort();
   });
@@ -1000,6 +1470,80 @@ export function defaultSpawnAsync(command, args, options = {}) {
 // time; a test scan marked `quiet` (ci/gate.config.json `rust.<crate>.quietTests`: the crate's tests share ports, devices,
 // wall-clock budgets or the broker's own queue, so they fail under load) runs last, one at a time, under the broker's quiet
 // lease when the gate can take one (runScans `quietLane`).
+/** The counts a test runner printed last: node:test's `ℹ tests N` / `ℹ pass` / `ℹ fail` / `ℹ skipped` / `ℹ todo` lines, or vitest's
+ * `Tests  N passed | M skipped | K failed (T)` line. Null when neither is present. Several node:test summaries (a script that runs
+ * the runner more than once) are summed. */
+/** null when a test summary is evidence of a pass; otherwise { code, detail }. Used for fresh and cached test rows alike. */
+export function testResultsProblem(results) {
+  if (!results) return { code: "NO_TEST_SUMMARY", detail: "no test counts recorded" };
+  if (!(results.tests > 0)) return { code: "NO_TESTS", detail: "the test scan executed no test" };
+  if (results.fail > 0) return { code: "SUMMARY_FAILED", detail: `the test runner exited 0 but its summary reports ${results.fail} failed test(s)` };
+  // A suite that ran tests but passed none of them (every test skipped or todo) proves nothing (D17, rightkit#1236).
+  if (!(results.pass > 0)) return { code: "ALL_SKIPPED", detail: `the test scan passed no test: ${results.skipped ?? 0} skipped, ${results.todo ?? 0} todo of ${results.tests}` };
+  return null;
+}
+
+export function parseTestSummary(text) {
+  const lines = String(text ?? "").split(/\r?\n/);
+  const node = { tests: 0, pass: 0, fail: 0, skipped: 0, todo: 0 }; let sawNode = false;
+  for (const line of lines) {
+    const m = /^[ℹ#]\s+(tests|pass|fail|skipped|todo)\s+(\d+)\s*$/.exec(line.trim());
+    if (m) { node[m[1]] += Number(m[2]); sawNode = true; }
+  }
+  if (sawNode) return { runner: "node:test", ...node };
+  const vt = lines.map((l) => l.replace(/\x1b\[[0-9;]*m/g, "")).reverse().find((l) => /^\s*Tests\s+.*\(\d+\)\s*$/.test(l));
+  if (vt) {
+    const n = (re) => Number((re.exec(vt) ?? [0, 0])[1]);
+    const tests = Number(/\((\d+)\)\s*$/.exec(vt)[1]);
+    return { runner: "vitest", tests, pass: n(/(\d+) passed/), fail: n(/(\d+) failed/), skipped: n(/(\d+) skipped/), todo: n(/(\d+) todo/) };
+  }
+  return null;
+}
+
+/** The largest inline `run:` script a workflow may carry while the pinned actionlint is 1.7.12 (rhysd/actionlint#702). */
+export const RUN_SCRIPT_LIMIT_BYTES = 3800;
+/** Every block `run:` script (`run: |` or `run: >`) of a workflow text larger than `limit` bytes, as "<file>:<line> <bytes> bytes".
+ * Line-based and conservative: the block is every following line indented deeper than the `run:` key (blank lines included),
+ * with that common indentation removed, as YAML reads a literal block. */
+export function oversizedRunScripts(text, file, limit = RUN_SCRIPT_LIMIT_BYTES) {
+  const lines = String(text).split(/\r?\n/);
+  const out = [];
+  for (let i = 0; i < lines.length; i += 1) {
+    const m = /^(\s*)(?:-\s+)?run:\s*[|>][-+0-9]*\s*$/.exec(lines[i]);
+    if (!m) continue;
+    const keyIndent = lines[i].indexOf("run:");
+    const body = [];
+    let j = i + 1;
+    for (; j < lines.length; j += 1) {
+      const line = lines[j];
+      if (line.trim() === "") { body.push(""); continue; }
+      if (line.length - line.trimStart().length <= keyIndent) break;
+      body.push(line);
+    }
+    while (body.length && body[body.length - 1] === "") body.pop();
+    const indent = Math.min(...body.filter(Boolean).map((l) => l.length - l.trimStart().length));
+    const script = body.map((l) => l.slice(Number.isFinite(indent) ? indent : 0)).join("\n") + "\n";
+    const bytes = Buffer.byteLength(script);
+    if (bytes > limit) out.push(`${file}:${i + 1} ${bytes} bytes`);
+    i = j - 1;
+  }
+  return out;
+}
+
+/** The time limit of one scan: its own `timeoutMs`, then the run's `scanTimeoutMs`, else 5 min for actionlint, 30 min for class A and
+ * 60 min for class B (a cold compile of the largest crate). */
+/** The broker's quiet lease ceiling (rustright-state quiet.rs QUIET_LEASE_MAX_TTL_MS) and the quiet suite timeout under it. */
+export const QUIET_LEASE_MAX_MS = 30 * 60_000;
+export const QUIET_SCAN_MAX_MS = 26 * 60_000;
+/** A tool version probe's bound; with QUIET_SCAN_MAX_MS it keeps a whole leased quiet suite (probes + run) under the 30 min lease. */
+export const PROBE_TIMEOUT_MS = 60_000;
+export function scanTimeoutMs(scan, options = {}) {
+  if (Number.isFinite(scan?.timeoutMs) && scan.timeoutMs > 0) return scan.timeoutMs;
+  if (Number.isFinite(options.scanTimeoutMs) && options.scanTimeoutMs > 0) return options.scanTimeoutMs;
+  if (scan?.tool === "actionlint") return 5 * 60_000;
+  return scan?.class === SCAN_CLASS.B ? 60 * 60_000 : 30 * 60_000;
+}
+
 export function laneOf(scan) {
   if (/^(clippy|check|check-features|check-dependent):/.test(scan.id)) return "compile";
   if (/^doc:/.test(scan.id)) return "doc";
@@ -1052,6 +1596,30 @@ async function defaultScanSecrets() {
   return (await import("./publish-cargo.mjs")).scanCrateForSecrets;
 }
 
+/**
+ * For a content root that is a git worktree's toplevel: a predicate over absolute paths that is true for every git-ignored file or
+ * directory there (`git ls-files --others --ignored --exclude-standard --directory`, which lists an ignored directory once, with a
+ * trailing slash). Null when the root is not a git toplevel (a committed export) or git cannot answer: then nothing is skipped.
+ */
+export async function ignoredPathSkip(ctx) {
+  const git = async (args) => { try { return await ctx.deps.spawn("git", args, { cwd: ctx.contentRoot, encoding: "utf8", env: ctx.deps.env }); } catch { return null; } };
+  const top = await git(["rev-parse", "--show-toplevel"]);
+  if (!top || top.status !== 0) return null;
+  const same = (a, b) => { try { return fs.realpathSync(a) === fs.realpathSync(b); } catch { return path.resolve(a) === path.resolve(b); } };
+  if (!same(String(top.stdout ?? "").trim(), ctx.contentRoot)) return null;
+  const listed = await git(["ls-files", "-z", "--others", "--ignored", "--exclude-standard", "--directory"]);
+  if (!listed || listed.status !== 0) return null;
+  const entries = String(listed.stdout ?? "").split("\0").filter(Boolean);
+  const dirs = entries.filter((e) => e.endsWith("/"));
+  const files = new Set(entries.filter((e) => !e.endsWith("/")));
+  const root = ctx.contentRoot;
+  return (absolute) => {
+    const rel = path.relative(root, absolute).replaceAll("\\", "/");
+    if (!rel || rel.startsWith("..")) return false;
+    return files.has(rel) || dirs.some((d) => rel === d.slice(0, -1) || rel.startsWith(d));
+  };
+}
+
 // What rustfmt needs from a Cargo.toml, read by table so an `edition` under [package.metadata.x] or [dependencies.x] is not the
 // package's: `pkg` is the [package] edition (a literal year, or "workspace" for `edition.workspace = true` / `edition = { workspace = true }`),
 // `ws` the [workspace.package] edition literal, `isWorkspace` whether the manifest declares a [workspace]. An `edition` entry in one of
@@ -1196,11 +1764,15 @@ const INTERNAL = {
   // Each violation names its repository-relative path, so a unit that is both a crate and a package reports a file once.
   "secret-scan": async (s, ctx) => {
     const scan = await ctx.deps.scanSecrets();
+    // A committed export holds only tracked files. A live tree (--to dev|test: the content root is the checkout itself) also holds
+    // git-ignored build output (.right-release/, DerivedData, a vendored checkout under it), which the gate never judges: the scanner
+    // skips what `git ls-files --ignored` names there. Outside a git toplevel nothing is skipped (Pulse, 2026-10-27).
+    const skip = await ignoredPathSkip(ctx);
     const bad = new Set();
     for (const dir of s.dirs) {
       const abs = path.join(ctx.contentRoot, dir);
       if (!ctx.deps.exists(abs)) { bad.add(`${dir}: directory not found`); continue; }
-      for (const v of scan(abs, { envTemplates: true, repoRoot: ctx.contentRoot })) bad.add(v);
+      for (const v of scan(abs, { envTemplates: true, repoRoot: ctx.contentRoot, skip })) bad.add(v);
     }
     return [...bad];
   },
@@ -1225,8 +1797,8 @@ export async function runScans(plan, options = {}) {
   const exclude = options.exclude ?? (() => false);
   // An AbortSignal: once aborted, no further scan starts, running children are killed (process tree) and every unfinished scan is "not-run" with code CANCELLED.
   const signal = options.signal; const sig = signal ? { signal } : {};
-  const { contentRoot, liveRoot } = plan.roots;
-  const rootDir = (r) => (r === "content" ? contentRoot : r === "parent" ? path.dirname(contentRoot) : liveRoot);
+  const { contentRoot, liveRoot, cargoLiveRoot = null } = plan.roots;
+  const rootDir = (r) => (r === "content" ? contentRoot : r === "parent" ? path.dirname(contentRoot) : r === "cargoLive" ? (cargoLiveRoot ?? liveRoot) : liveRoot);
   const selected = plan.scans.filter((s) => classes.includes(s.class) && !exclude(s));
   const ordered = [...selected.filter((s) => s.class === SCAN_CLASS.A), ...selected.filter((s) => s.class === SCAN_CLASS.B)];
   const ctx = { deps, contentRoot, read: (f) => deps.readFile(path.join(contentRoot, f)) };
@@ -1256,7 +1828,7 @@ export async function runScans(plan, options = {}) {
   const classBBlocked = !inCallA && !priorClassAValid;
 
   const toolCommand = (tool) => (tool === "node" ? deps.execPath : tool === "rustfmt" ? deps.findRustfmt({ env: deps.env, exists: deps.exists, readdir: deps.readdir, platform: deps.platform, spawn: deps.lookupSpawn }) : tool);
-  async function probe(tool) {
+  async function probe(tool, scanDir = null) {
     if (probed.has(tool)) return probed.get(tool);
     let outcome;
     const command = toolCommand(tool);
@@ -1264,7 +1836,15 @@ export async function runScans(plan, options = {}) {
     else {
       // A version probe never runs inside the repository: a tool started there reads the repository's own configuration first
       // (pnpm's .npmrc and pnpmfile, corepack's packageManager pin, cargo's .cargo/config), before any scan's protections apply.
-      const r = await deps.spawn(command, PROBES[tool] ?? ["--version"], { cwd: deps.probeDir ?? probeDir(), env: { ...deps.env, ...PNPM_NO_HOOKS_ENV, COREPACK_ENABLE_AUTO_PIN: "0" }, ...sig });
+      // rustright is the one exception: the RustRight client refuses to run anywhere that is not a Cargo workspace inside a repository
+      // (RK_NOT_PRIMARY_CHECKOUT, "workspace discovery failed"), so from a neutral directory every cargo scan read as TOOL_MISSING on
+      // every broker host (rightkit#1215). Its probe runs where the scan itself will run; `cargo --version` reads no repository config.
+      const cwd = (tool === "rustright" || (tool === "cargo" && cargoLiveRoot)) && scanDir ? scanDir : (deps.probeDir ?? probeDir());
+      // A version probe is bounded (PROBE_TIMEOUT_MS): a hung tool reads as unavailable instead of holding a lane, or a quiet
+      // lease, open.
+      const probeMs = Number.isFinite(options.probeTimeoutMs) && options.probeTimeoutMs > 0 ? options.probeTimeoutMs : PROBE_TIMEOUT_MS;
+      const probeSignal = signal ? AbortSignal.any([signal, AbortSignal.timeout(probeMs)]) : AbortSignal.timeout(probeMs);
+      const r = await deps.spawn(command, PROBES[tool] ?? ["--version"], { cwd, env: { ...deps.env, ...PNPM_NO_HOOKS_ENV, COREPACK_ENABLE_AUTO_PIN: "0" }, signal: probeSignal });
       if (!r || r.error || r.status !== 0) outcome = { ok: false, why: r?.error?.message ?? `exit ${r?.status}` };
       else {
         const text = String(r.stdout || r.stderr || "");
@@ -1284,7 +1864,14 @@ export async function runScans(plan, options = {}) {
   const quietLane = options.quietLane && typeof options.quietLane.acquire === "function" ? options.quietLane : null;
   const onResult = typeof options.onResult === "function" ? options.onResult : () => {};
   const total = ordered.length; let done = 0;
+  // Every class A failure latches, whichever branch produced it (Astra, 2026-10-26: two early returns bypassed the latch below, so a
+  // missing advisory database or a failed deny metadata could be followed by a class B compile). Class B reads the latch before it starts.
   async function runOne(s, extraEnv = null) {
+    const row = await runOneBody(s, extraEnv);
+    if (row.status === "fail" && s.class === SCAN_CLASS.A) classAFailed = true;
+    return row;
+  }
+  async function runOneBody(s, extraEnv = null) {
     if (signal?.aborted) return { id: s.id, class: s.class, command: s.command, tool: s.tool ?? null, toolVersion: null, status: "not-run", code: "CANCELLED", detail: "cancelled before it started" };
     const started = Date.now();
     const row = await scanRow(s, extraEnv);
@@ -1292,18 +1879,49 @@ export async function runScans(plan, options = {}) {
     try { onResult(row, { done, total, seconds: Math.round((Date.now() - started) / 1000) }); } catch { /* reporting never fails a scan */ }
     return row;
   }
-  // Class A in order (a failure stops class B); then class B by lane: compile lanes (`jobs`) beside the doc lane, then the test
-  // lane (`testJobs`), then the quiet lane one at a time under the broker's quiet lease, so the tests that fail under load run on
-  // an otherwise quiet machine, as CI's shards run tests after their build. With jobs = 1 and testJobs = 1 the order is the same.
+  // Class A may run concurrently. Every class B lane runs serially: tests and docs can compile too, and one checkout gets one build.
   const aScans = ordered.filter((s) => s.class === SCAN_CLASS.A);
   const bScans = ordered.filter((s) => s.class === SCAN_CLASS.B);
   // Class A scans are independent content checks (and short broker calls: metadata, package list, deny, audit): they run
   // `classAJobs` at a time (default: `jobs`); the rows keep plan order. Class B starts only once every class A row is in.
   const aJobs = Math.max(1, Number(options.classAJobs ?? jobs) || jobs);
   {
-    const slots = new Array(aScans.length); const queue = aScans.map((_, i) => i);
-    const drain = async () => { while (queue.length) { const i = queue.shift(); slots[i] = await runOne(aScans[i]); } };
-    await Promise.all(Array.from({ length: aJobs }, drain));
+    // Class A is everything mechanical and deterministic that does not compile (Adrian, 2026-10-27): the content checks first,
+    // `classAJobs` at a time, then the class A tests (kind "test"), `testJobs` at a time, then the quiet ones alone under the
+    // broker's quiet lease. A failed content check stops the tests: they run on content class A already judged.
+    const slots = new Array(aScans.length);
+    const content = []; const tests = []; const quietTests = [];
+    aScans.forEach((s, i) => (s.kind === "test" ? (s.quiet === true ? quietTests : tests) : content).push(i));
+    const drain = (queue, extraEnv = null) => async () => {
+      while (queue.length) {
+        const i = queue.shift();
+        slots[i] = aScans[i].kind === "test" && classAFailed
+          ? { id: aScans[i].id, class: aScans[i].class, command: aScans[i].command, tool: aScans[i].tool ?? null, toolVersion: null, status: "not-run", detail: "a class A content check failed; the class A tests start only after it passes" }
+          : await runOne(aScans[i], extraEnv);
+      }
+    };
+    await Promise.all(Array.from({ length: aJobs }, drain(content)));
+    await Promise.all(Array.from({ length: testJobs }, drain(tests)));
+    if (quietTests.length) {
+      // One broker quiet lease per quiet suite (the broker caps a lease at 30 min and has no renewal): each suite runs alone,
+      // under its own lease, with a timeout shorter than the lease, so a lease never expires while its suite still runs.
+      for (const i of quietTests) {
+        if (classAFailed || signal?.aborted) {
+          slots[i] = { id: aScans[i].id, class: aScans[i].class, command: aScans[i].command, tool: aScans[i].tool ?? null, toolVersion: null, status: "not-run", detail: signal?.aborted ? "cancelled" : "a class A check failed; the quiet suites start only on a green class A" };
+          continue;
+        }
+        let lease = null;
+        if (quietLane) { try { lease = (await quietLane.acquire({ ttlMs: QUIET_LEASE_MAX_MS })) ?? null; } catch { lease = null; } }
+        if (!lease && options.requireQuietLease) {
+          slots[i] = { id: aScans[i].id, class: aScans[i].class, command: aScans[i].command, tool: aScans[i].tool ?? null, toolVersion: null, status: "fail", code: "QUIET_LEASE_UNAVAILABLE", detail: "the broker's quiet lease could not be held; this conflict-prone suite does not run alongside other jobs on a managed host. Run again when the broker can grant the lease." };
+          classAFailed = true; // a refused class A suite is a red class A: no class B scan starts after it
+          continue;
+        }
+        try { slots[i] = await runOne({ ...aScans[i], timeoutMs: Math.min(scanTimeoutMs(aScans[i], options), QUIET_SCAN_MAX_MS) }, lease?.env ?? null); } finally {
+          if (lease && typeof quietLane.release === "function") { try { await quietLane.release(lease.id); } catch { /* the lease expires on its own */ } }
+        }
+      }
+    }
     results.push(...slots);
   }
   {
@@ -1311,14 +1929,25 @@ export async function runScans(plan, options = {}) {
     const lanes = { compile: [], doc: [], tests: [], quiet: [] };
     bScans.forEach((s, i) => lanes[laneOf(s)].push(i));
     const drain = async (queue, extraEnv = null) => { while (queue.length) { const i = queue.shift(); slots[i] = await runOne(bScans[i], extraEnv); } };
-    await Promise.all([...Array.from({ length: jobs }, () => drain(lanes.compile)), drain(lanes.doc)]);
-    await Promise.all(Array.from({ length: testJobs }, () => drain(lanes.tests)));
+    await drain(lanes.compile);
+    await drain(lanes.doc);
+    await drain(lanes.tests);
     if (lanes.quiet.length) {
-      let lease = null;
-      // No lease when the lane cannot run anyway (class A failed or was not supplied): its rows are not-run without one.
-      if (quietLane && !signal?.aborted && !classAFailed && !classBBlocked) { try { lease = (await quietLane.acquire()) ?? null; } catch { lease = null; } }
-      try { await drain(lanes.quiet, lease?.env ?? null); } finally {
-        if (lease && typeof quietLane.release === "function") { try { await quietLane.release(lease.id); } catch { /* the lease expires on its own */ } }
+      // One lease per quiet suite, as in class A above.
+      for (const i of lanes.quiet) {
+        if (classAFailed || classBBlocked || signal?.aborted) {
+          slots[i] = { id: bScans[i].id, class: bScans[i].class, command: bScans[i].command, tool: bScans[i].tool ?? null, toolVersion: null, status: "not-run", detail: signal?.aborted ? "cancelled" : classAFailed ? "class A is red; nothing in class B starts" : "class B is blocked" };
+          continue;
+        }
+        let lease = null;
+        if (quietLane) { try { lease = (await quietLane.acquire({ ttlMs: QUIET_LEASE_MAX_MS })) ?? null; } catch { lease = null; } }
+        if (!lease && options.requireQuietLease) {
+          slots[i] = { id: bScans[i].id, class: bScans[i].class, command: bScans[i].command, tool: bScans[i].tool ?? null, toolVersion: null, status: "fail", code: "QUIET_LEASE_UNAVAILABLE", detail: "the broker's quiet lease could not be held; this conflict-prone suite does not run alongside other jobs on a managed host. Run again when the broker can grant the lease." };
+          continue;
+        }
+        try { slots[i] = await runOne({ ...bScans[i], timeoutMs: Math.min(scanTimeoutMs(bScans[i], options), QUIET_SCAN_MAX_MS) }, lease?.env ?? null); } finally {
+          if (lease && typeof quietLane.release === "function") { try { await quietLane.release(lease.id); } catch { /* the lease expires on its own */ } }
+        }
       }
     }
     results.push(...slots);
@@ -1368,11 +1997,12 @@ export async function runScans(plan, options = {}) {
         if (out && out.missing) { status = "fail"; code = "TOOL_MISSING"; detail = out.missing; }
         else if (out.length) { status = "fail"; detail = out.join("; "); }
       } else {
-        const p = await probe(s.tool);
+        const scanDir = path.join(rootDir(s.root), s.cwd ?? "");
+        const p = await probe(s.tool, scanDir);
         row.toolVersion = p.ok ? p.version : null;
         let missingDep = null; let depVersionProblem = null; const depVersions = [];
         for (const dep of s.requires ?? []) {
-          const d = await probe(dep);
+          const d = await probe(dep, scanDir);
           if (!d.ok) { missingDep = `${dep} (${d.why})`; break; }
           if (d.pinProblem) { depVersionProblem = d.pinProblem; break; }
           depVersions.push(d.version);
@@ -1383,7 +2013,10 @@ export async function runScans(plan, options = {}) {
         else if (depVersionProblem) { status = "fail"; code = "TOOL_VERSION"; detail = `TOOL_VERSION: ${s.tool} runs ${depVersionProblem}`; }
         else {
           let cacheKey = null;
-          if (cache) {
+          // A cargo request that builds the commit snapshot through the broker (options.snapshotBroker) is never served from or written
+          // to the scan cache: each run must carry its own request and verify the broker's own signed evidence.
+          const viaSnapshotBroker = Boolean(deps.snapshotBroker) && s.root === "cargoLive" && (s.tool === "rustright" || s.tool === "cargo");
+          if (cache && !viaSnapshotBroker) {
             try {
               const digest = cache.digest(s);
               // The analyzers a scan runs through (actionlint's shellcheck) judge it too, so their versions key it as well.
@@ -1391,25 +2024,44 @@ export async function runScans(plan, options = {}) {
               if (digest) cacheKey = scanCacheKey({ id: s.id, command: s.command, toolVersion, env: s.env ?? {}, inheritedEnv: inheritedEnvDigest({ ...deps.env, ...s.env }), digest });
             } catch { cacheKey = null; }
             const hit = cacheKey ? cache.read(cacheKey) : null;
-            if (hit && hit.key === cacheKey && hit.row?.status === "pass" && hit.row.id === s.id && hit.row.command === s.command) {
+            // A cached test pass counts only with the counts it recorded: without them its coverage is unknown, so it runs again.
+            // ...and only if it passed at least one test: a cached all-skipped "pass" (written before D17) runs again (rightkit#1236).
+            const testEvidence = s.kind !== "test" || testResultsProblem(hit?.row?.results) === null;
+            if (hit && hit.key === cacheKey && hit.row?.status === "pass" && hit.row.id === s.id && hit.row.command === s.command && testEvidence) {
               cacheHits.push(s.id);
-              return { ...row, status: "pass", cached: true, detail: `cached ${String(hit.at ?? "").slice(0, 10) || "earlier"}` };
+              return { ...row, status: "pass", cached: true, detail: `cached ${String(hit.at ?? "").slice(0, 10) || "earlier"}`, ...(s.kind === "test" ? { results: hit.row.results } : {}) };
             }
           }
           let advisory = null; let args = s.args;
           if (s.advisoryDb) {
             try { advisory = prepareAdvisory(s); } catch (e) { return { ...row, status: "fail", code: "ADVISORY_DB", detail: e.message }; }
-            // cargo-deny --offline must not fetch the advisory database, but its own `cargo metadata` would then be offline too and
+            // cargo-deny --frozen (--offline + --locked: the nested `cargo fetch` it runs may not rewrite Cargo.lock, so the broker admits it as analysis) must not fetch the advisory database, but its own `cargo metadata` would then be offline too and
             // fail on a runner whose cargo cache is cold. The workspace's metadata is resolved first, online and --locked (the
             // lockfile decides every version), and handed to cargo-deny as a file.
             if (s.advisoryDb === "deny") {
               const at = args.indexOf("deny");
               // The whole document is needed (the concurrent spawn keeps only the tail of stdout), so it streams to the file; a
               // spawn that does not know `stdoutFile` returns stdout, which is written below.
+              // cargo-deny --frozen reads crate sources only from the local cargo cache, and `cargo metadata` does not download them
+              // (fullA-19: rightkit-qa 0.9.1 was missing). They are fetched first, online and --locked (bound to the lockfile, so the
+              // broker admits it as analysis). A fetch that fails, is refused or times out fails the row before metadata or deny run:
+              // an offline or unreachable registry is red, never green.
+              const fetchLimit = scanTimeoutMs(s, options);
+              const fetchTimer = new AbortController();
+              const fetchClock = setTimeout(() => fetchTimer.abort(), fetchLimit);
+              let fetched;
+              try { fetched = await deps.spawn(p.command, [...args.slice(0, at), "fetch", "--locked"], { cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...s.env }, signal: signal ? AbortSignal.any([signal, fetchTimer.signal]) : fetchTimer.signal, timeout: fetchLimit }); } finally { clearTimeout(fetchClock); }
+              if (!fetched || fetched.error || fetched.status !== 0) {
+                advisory.cleanup?.();
+                if (signal?.aborted) return { ...row, status: "not-run", code: "CANCELLED", detail: "cancelled while running" };
+                if (fetchTimer.signal.aborted || fetched?.error?.code === "ETIMEDOUT") return { ...row, status: "fail", code: "TIMEOUT", detail: `cargo fetch --locked for cargo-deny ran longer than ${Math.round(fetchLimit / 60000)} min and was killed with its process tree` };
+                return { ...row, status: "fail", code: "FETCH", detail: `cargo fetch --locked for cargo-deny failed (crate sources must be local before deny): ${fetched?.error?.message ?? (tail(fetched) || `exit ${fetched?.status}`)}` };
+              }
               const metadataDir = fs.mkdtempSync(path.join(os.tmpdir(), "rk-deny-metadata-"));
               const metadataFile = path.join(metadataDir, "metadata.json");
               const metadata = await deps.spawn(p.command, [...args.slice(0, at), ...metadataArgs({ noDeps: false })], { cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...s.env }, stdoutFile: metadataFile, ...sig });
-              if (!metadata || metadata.error || metadata.status !== 0) { fs.rmSync(metadataDir, { recursive: true, force: true }); advisory.cleanup?.(); return { ...row, status: "fail", code: "EXIT", detail: `cargo metadata for cargo-deny failed: ${metadata?.error?.message ?? (tail(metadata) || `exit ${metadata?.status}`)}` }; }
+              // AUX_METADATA: the auxiliary metadata that feeds deny could not be produced; not a deny finding, so never a deterministic red (rightkit#1257).
+              if (!metadata || metadata.error || metadata.status !== 0) { fs.rmSync(metadataDir, { recursive: true, force: true }); advisory.cleanup?.(); return { ...row, status: "fail", code: "AUX_METADATA", detail: `cargo metadata for cargo-deny failed: ${metadata?.error?.message ?? (tail(metadata) || `exit ${metadata?.status}`)}` }; }
               if (!fs.existsSync(metadataFile)) fs.writeFileSync(metadataFile, String(metadata.stdout ?? ""));
               advisory.metadataPath = metadataFile;
               const overlayCleanup = advisory.cleanup;
@@ -1418,11 +2070,110 @@ export async function runScans(plan, options = {}) {
             args = args.map((a) => (a === "{advisoryDb}" ? advisory.dbDir : a === "{advisoryDenyConfig}" ? advisory.configPath : a === "{advisoryMetadata}" ? advisory.metadataPath : a));
           }
           let r;
-          try { r = await deps.spawn(p.command, args.map((a) => (a === "{contentRoot}" ? contentRoot : a)), { cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...s.env, ...(extraEnv ?? {}) }, ...sig }); } finally { advisory?.cleanup?.(); }
+          // actionlint 1.7.12 writes each run: script to shellcheck's stdin before starting it (rhysd/actionlint#702): a script over the
+          // pipe buffer (~4 KB on Windows) deadlocks. Oversized scripts are refused here, before actionlint starts, so it cannot hang.
+          if (s.runScriptLimit) {
+            const over = s.runScriptLimit.files.flatMap((file) => { try { return oversizedRunScripts(ctx.read(file), file, s.runScriptLimit.bytes); } catch { return [`${file}: unreadable`]; } });
+            if (over.length) return { ...row, status: "fail", code: "RUN_SCRIPT_TOO_LARGE", detail: `run: scripts over ${s.runScriptLimit.bytes} bytes (actionlint 1.7.12 deadlocks on them, rhysd/actionlint#702; split the step): ${over.join("; ")}` };
+          }
+          // Every scan has a time limit (fails closed, names the scan, kills the process tree): a hung tool is a check that never
+          // fails, i.e. a run that never ends (actionlint on the Dell, 2026-10-27).
+          // A tsc row that names TSC_PROJECT checks its package against the committed sources of its workspace siblings: the project is
+          // generated outside the checked tree and removed after the run, so the check reads nothing a commit lacks and writes nothing.
+          let tscProject = null;
+          if (args.includes(TSC_PROJECT)) {
+            try { tscProject = writeTscProject({ contentRoot, packageDir: path.join(rootDir(s.root), s.cwd ?? ""), workspace: s.tscWorkspace ?? [] }); }
+            catch (e) { advisory?.cleanup?.(); return { ...row, status: "fail", code: "TSC_PROJECT", detail: `${s.id}: the check project could not be built from the committed workspace: ${e.message}` }; }
+            args = args.map((a) => (a === TSC_PROJECT ? tscProject.file : a));
+          }
+          const limitMs = scanTimeoutMs(s, options);
+          const timer = new AbortController();
+          const clock = setTimeout(() => timer.abort(), limitMs);
+          const scanSignal = signal ? AbortSignal.any([signal, timer.signal]) : timer.signal;
+          // A class A test row runs under the launch guard (class-a-launch-guard.mjs): its Node processes may not launch a compile.
+          // Every class A row that executes repository code (tests, lint/typecheck with repository config, generators) runs under the
+          // launch guard: class A runs before any compile, so none of them may start one (joint plan step 4; inventory gap 3).
+          const guardEnv = s.class === SCAN_CLASS.A && (s.kind === "test" || s.executes === true) ? launchGuardEnv({ ...deps.env, ...s.env, ...(extraEnv ?? {}) }) : {};
+          // The broker snapshot carrier (joint plan step 4d): this one cargo request names the commit, the snapshot, the ownership
+          // handle and its own argv and working directory, under a fresh nonce; the ownership records the submit first.
+          const finalArgs = args.map((a) => (a === "{contentRoot}" ? contentRoot : a));
+          let carrier = null;
+          if (viaSnapshotBroker) {
+            const sb = deps.snapshotBroker;
+            const cwd = path.join(rootDir(s.root), s.cwd ?? "");
+            const refDir = fs.mkdtempSync(path.join(os.tmpdir(), "rk-snapreq-"));
+            try {
+              const cargoArgv = s.tool === "rustright" ? finalArgs.slice(1) : finalArgs;
+              // The ownership must record the submit, under this gate's handle, before anything is launched: a missing hook or a
+              // mark that did not land refuses the request (the reclaim proof reads broker.submitted).
+              if (typeof sb.markBrokerSubmit !== "function") throw new Error("no build-ownership submit hook: the broker submit cannot be recorded");
+              const marked = sb.markBrokerSubmit();
+              if (marked?.broker?.submitted !== true || marked.handle !== sb.handle) throw new Error(`the build ownership did not record the broker submit under ${sb.handle}`);
+              const made = writeSnapshotRequest({ controlRoot: sb.controlRoot, commit: sb.commit, snapshot: sb.snapshot, declaredInputs: sb.declaredInputs ?? [], handle: sb.handle, primaryCwd: fs.realpathSync.native(cwd), argv: cargoArgv, requestIdFile: path.join(refDir, "request.json") });
+              carrier = { made, refDir, cargoArgv };
+            } catch (e) { fs.rmSync(refDir, { recursive: true, force: true }); clearTimeout(clock); advisory?.cleanup?.(); return { ...row, status: "fail", code: "SNAPSHOT_REQUEST", detail: `the snapshot request for ${s.id} could not be written: ${e.message}` }; }
+          }
+          // From here to the end of its verification the carrier and the request reference are this request's: every exit (cancel,
+          // timeout, a thrown spawn, a refused receipt) removes them.
+          // A wrapped snapshot compile with several Cargo workspaces (options.cargoSentinel, item 7): a scan whose own env binds no
+          // CARGO_TARGET_DIR gets an empty directory of its own as one. Every cargo reached through the wrapper is bound elsewhere; only
+          // a cargo that bypassed it (an absolute path, `rustup run`, a reset PATH) can write here, and the scan then fails below.
+          let sentinel = null;
+          if (options.cargoSentinel && !Object.hasOwn(s.env ?? {}, "CARGO_TARGET_DIR")) {
+            sentinel = path.join(options.cargoSentinel, sha256(s.id).slice(0, 16));
+            fs.rmSync(sentinel, { recursive: true, force: true });
+            fs.mkdirSync(sentinel, { recursive: true });
+          }
+          const sentinelEnv = sentinel ? { CARGO_TARGET_DIR: sentinel, CARGO_BUILD_TARGET_DIR: sentinel } : {};
+          try {
+          try { r = await deps.spawn(p.command, finalArgs, { cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...sentinelEnv, ...s.env, ...(extraEnv ?? {}), ...guardEnv, ...(carrier ? carrier.made.env : {}) }, signal: scanSignal, timeout: limitMs }); } finally { clearTimeout(clock); advisory?.cleanup?.(); }
           if (signal?.aborted && (!r || r.error || r.status !== 0)) return { ...row, status: "not-run", code: "CANCELLED", detail: "cancelled while running" };
+          if ((timer.signal.aborted || r?.error?.code === "ETIMEDOUT") && (!r || r.error || r.status !== 0)) return { ...row, status: "fail", code: "TIMEOUT", detail: `${s.id} ran longer than ${Math.round(limitMs / 60000)} min and was killed with its process tree; a scan that does not finish fails` };
           if (!r || r.error) { status = "fail"; code = "SPAWN_ERROR"; detail = r?.error?.message ?? "no result"; }
           else if (r.status !== 0) { status = "fail"; code = "EXIT"; detail = tail(r) || `exit ${r.status}`; }
-          else if (cacheKey && !signal?.aborted) cache.write(cacheKey, { id: s.id, class: s.class, command: s.command, tool: s.tool ?? null, toolVersion: row.toolVersion, status: "pass" });
+          // cargo-deny reports some failures only as an [ERROR] line and still exits 0 (under the broker, its nested offline
+          // `cargo fetch` of crate sources is refused: "failed to fetch crates"). A deny row passes only with no [ERROR] line in
+          // its complete output; output cut to the kept tail cannot prove that, so it fails too (RR, reviewer 2026-10-28).
+          if (sentinel) {
+            let written = [];
+            try { written = fs.readdirSync(sentinel); } catch (e) { written = [`(unreadable: ${e.message})`]; }
+            if (written.length) { status = "fail"; code = "RK_CARGO_UNBOUND"; detail = `${s.id}: a cargo that bypassed the gate's wrapper wrote ${written.slice(0, 5).join(", ")} into the unbound sentinel ${sentinel}; with several Cargo workspaces no output directory can be inferred for it, so the scan proves nothing about where its outputs went`; }
+          }
+          if (s.advisoryDb === "deny" && code !== "RK_CARGO_UNBOUND") {
+            const denyError = `${r.stdout ?? ""}\n${r.stderr ?? ""}`.split(/\r?\n/).find((line) => /\[ERROR\]/.test(line));
+            if (r.truncated) { status = "fail"; code = "DENY_ERROR"; detail = "cargo-deny output exceeded the kept tail, so the absence of an [ERROR] line cannot be shown"; }
+            else if (denyError) { status = "fail"; code = "DENY_ERROR"; detail = `cargo-deny exited 0 but reported an error: ${denyError.trim().slice(0, 300)}`; }
+          }
+          // The broker's signed account of that request: the receipt verifies against this host's pins and its snapshotEvidence names
+          // this commit, this snapshot unchanged from START to exit, this ownership and the output directory. Anything less fails the row.
+          if (carrier) {
+            try {
+              const ref = readRequestRef(path.join(carrier.refDir, "request.json"));
+              const receipt = await deps.snapshotBroker.receiptOf(ref.requestId);
+              const { evidence } = verifySnapshotReceipt(receipt, { pins: deps.snapshotBroker.pins, jobId: ref.requestId, carrier: carrier.made.carrier, argv: carrier.cargoArgv, workspace: ref.workspace, observedEnv: observedEnvOf({ ...deps.env, ...s.env, ...(extraEnv ?? {}) }, deps.platform ?? process.platform) });
+              row.snapshotEvidence = { requestId: ref.requestId, outputDir: evidence.outputDir, treeAtStart: evidence.snapshot.treeAtStart, treeAtExit: evidence.snapshot.treeAtExit };
+            } catch (e) {
+              status = "fail"; code = "SNAPSHOT_EVIDENCE"; detail = `${s.id}: the broker's snapshot evidence did not verify (${e.code ?? "error"}: ${e.message})`;
+            }
+          }
+          } finally {
+            if (carrier) { fs.rmSync(carrier.made.file, { force: true }); fs.rmSync(carrier.refDir, { recursive: true, force: true }); }
+            if (tscProject) fs.rmSync(tscProject.dir, { recursive: true, force: true });
+          }
+          if (status === "fail" && options.scanLogDir && r) {
+            try { fs.mkdirSync(options.scanLogDir, { recursive: true }); const file = path.join(options.scanLogDir, `${s.id.replace(/[^A-Za-z0-9._-]+/g, "_")}.log`); fs.writeFileSync(file, `$ ${s.command ?? s.id}\nexit ${r.status}\n--- stdout\n${r.stdout ?? ""}\n--- stderr\n${r.stderr ?? ""}\n`); row.log = file; detail = `${detail} (full output: ${file})`; } catch { /* the tail in the row remains */ }
+          }
+          if (s.kind === "test" && r && !r.error && r.status === 0) {
+            // What the suite executed and skipped is evidence, not decoration: a later stage reuses this row only with these counts.
+            const counts = parseTestSummary(`${r.stdout ?? ""}\n${r.stderr ?? ""}`);
+            if (counts) row.results = counts;
+            else if (status === "pass") { status = "fail"; code = "NO_TEST_SUMMARY"; detail = "the test scan passed but printed no recognisable summary (node:test or vitest); its coverage cannot be recorded"; }
+            else row.results = null;
+            // One rule for fresh and cached rows (testResultsProblem): tests ran, none failed, at least one passed.
+            const problem = status === "pass" && row.results ? testResultsProblem(row.results) : null;
+            if (problem) { status = "fail"; code = problem.code; detail = problem.detail; }
+          }
+          if (status === "pass" && cacheKey && !signal?.aborted) cache.write(cacheKey, { id: s.id, class: s.class, command: s.command, tool: s.tool ?? null, toolVersion: row.toolVersion, status: "pass", ...(row.results ? { results: row.results } : {}) });
         }
       }
     } catch (e) { status = "fail"; code = "SCAN_ERROR"; detail = e.message; }