@seanyao/roll 4.706.1 → 4.707.1

package/docs/architecture.md

@@ -131,6 +131,11 @@ no-TCR/gave-up、成功交付、成本档位和角色能力标签排序。运行
 [--json]` 暴露 route trace：候选池、ranked score/reasons、warnings、skipped 候选及原因、策略、
 近期使用输入、最终 agent 和 source 配置路径。
 
+**Rig lifecycle**：quota、auth、network 和 agent stall 是运行级状态，不回写
+`agents.yaml`。loop 把不可用 rig 写入 runtime lifecycle 文件并发出 `rig:suspended` /
+`rig:recovered` 事件；挂起 rig 按恢复窗口轻量探活，恢复后自动回到候选池。若当前池全挂起，
+cycle 写 `loop:pending`，只做恢复探测，不启动 Builder、不把卡记失败、不触发全局熔断。
+
 **反规则**：不因历史表现自动改写角色绑定。不做失败后的静默跨 agent 重试。指标可以*建议*
 策略变更，但绝不绕过 human-on-the-loop。
 

package/guide/en/acceptance-evidence.md

@@ -40,8 +40,8 @@ the archive rebuild; they are a convenience/archive view, not the delivery-truth
    into `ROLL_EVIDENCE_DIR`; visual lanes write screenshots into
    `ROLL_SCREENSHOTS_DIR` when the surface requires inspection. The agent keeps
    `ac-map.json` in the story card root, mapping each AC to the evidence files
-   that support it, with a status per AC: `pass` · `readonly` · `partial` ·
-   `claimed` · `missing`.
+   that support it, with a status per AC: `pass` · `pass-with-evidence` ·
+   `readonly` · `partial` · `claimed` · `missing`.
 3. Close with the hard attest gate. The runner calls
    `roll attest <story-id> --run-dir "$ROLL_RUN_DIR"` at the end of delivery.
    `roll attest` sweeps the hard facts (TCR commits, latest CI run, optional
@@ -75,7 +75,10 @@ when any of these facts are true:
   card archive, except allowed GitHub PR/commit/check URLs for this repository;
 - an AC remains `claimed`, which means the Builder asserted completion without
   pass/fail evidence;
-- a positive AC has no real evidence reference;
+- an AC remains `needs-confirmation`, which means the harness draft still needs
+  Builder review;
+- a positive AC (`pass`, `pass-with-evidence`, `readonly`, or `partial`) has no
+  real evidence reference;
 - a non-exempt visual card has no captured screenshot or recorded machine
   capture skip;
 - a declared `deliverable_url`, `deliverable_cmd`, or `physical_terminal`
@@ -99,9 +102,11 @@ any issue exits 1 and lists the story IDs and missing references.
 
 ## The red line
 
-An AC with **zero evidence** can never claim `pass`: the renderer forces it
-down to 🟧 Claimed and lists it under **Discrepancies**. Verbal completion
-("I confirmed it works") is exactly what this rules out.
+An AC with **zero evidence** can never claim `pass` or `pass-with-evidence`: the
+renderer forces it down to 🟧 Claimed and lists it under **Discrepancies**.
+`pass-with-evidence` is a harness-confirmed status backed by strong on-disk
+evidence; it is explicitly not the same as an agent-confirmed `pass`. Verbal
+completion ("I confirmed it works") is exactly what this rules out.
 
 ## Declaring visual evidence at design time
 

package/guide/en/loop.md

@@ -390,10 +390,13 @@ defaults:
 candidate pool, runtime health notes, and any legacy compatibility inputs. Use
 `roll agent migrate --dry-run` to preview conversion from old agent files.
 
-Runtime health is not static policy. Auth, network, VPN, account, or missing
-binary failures skip a candidate for the current resolution and are recorded as
-runtime facts. If no candidate remains, loop pauses and writes an ALERT instead
-of silently rewriting the pool.
+Runtime health is not static policy. Quota, auth, network, VPN, account, stall,
+or missing binary failures suspend only the runtime rig and are recorded as
+runtime facts; Roll does not rewrite `agents.yaml`. Suspended rigs are probed on
+the recovery interval and return to the pool automatically when reachable. If no
+candidate remains, the cycle records `loop:pending` and only runs recovery probes
+instead of starting a Builder, charging the card's failure budget, or silently
+rewriting the pool.
 
 For open casting, `health-aware` ranks the same visible pool across Builder,
 Designer, Evaluator, and Peer Reviewer roles. `roll supervisor route --role

package/guide/zh/acceptance-evidence.md

@@ -35,7 +35,7 @@ HTML。那些归档页想看时用 归档重建 按需渲染，它们是便捷/
 2. 过程采集。`roll test` 把命令输出和摘要写入 `ROLL_EVIDENCE_DIR`；需要视觉
    验收的端面把截图写入 `ROLL_SCREENSHOTS_DIR`。agent 在故事卡根目录维护
    `ac-map.json`，把每条 AC 映射到支撑证据，并标注状态：`pass` ·
-   `readonly` · `partial` · `claimed` · `missing`。
+   `pass-with-evidence` · `readonly` · `partial` · `claimed` · `missing`。
 3. 收尾硬闸。交付结束时 runner 调用
    `roll attest <story-id> --run-dir "$ROLL_RUN_DIR"`。`roll attest` 清扫硬事实
    （TCR commits、最新 CI、可选部署探针、test-pass 凭证），渲染验收 Review Page，把
@@ -65,7 +65,8 @@ soft 模式会记录缺口并发出同一类审计信号，但不阻塞本轮交
 - `ac-map.json` 引用的路径无法在本次 story run 或卡片归档下解析，除非是本仓允许的
   GitHub PR/commit/check URL；
 - AC 仍是 `claimed`，表示 Builder 只有完成声明，没有 pass/fail 证据；
-- positive AC 没有真实证据引用；
+- AC 仍是 `needs-confirmation`，表示 harness 草稿还没被 Builder 处理；
+- positive AC（`pass`、`pass-with-evidence`、`readonly` 或 `partial`）没有真实证据引用；
 - 无豁免的可视卡没有截图，也没有记录化的机器采集 skip；
 - 声明了 `deliverable_url`、`deliverable_cmd` 或 `physical_terminal`，但对应
   surface 没有真实采集；
@@ -86,9 +87,10 @@ roll attest audit --json
 
 ## 红线
 
-**零证据**的 AC 永远不能是 `pass`：渲染层强制降级为 🟧 仅声明，并列入
-**Discrepancies（证据缺口）**附录。"我确认它能跑"这类口头完成，正是被这条
-红线挡住的东西。
+**零证据**的 AC 永远不能是 `pass` 或 `pass-with-evidence`：渲染层强制降级为
+🟧 仅声明，并列入 **Discrepancies（证据缺口）**附录。`pass-with-evidence`
+表示 harness 基于硬盘上强证据做出的确认，明确不同于 agent 亲自确认的 `pass`。
+"我确认它能跑"这类口头完成，正是被这条红线挡住的东西。
 
 ## 设计期声明可视证据
 

package/guide/zh/loop.md

@@ -343,9 +343,10 @@ defaults:
 以及 legacy compatibility 输入。用 `roll agent migrate --dry-run` 预览旧 agent
 文件迁移。
 
-运行时健康不是静态策略。auth、网络、VPN、账号或 binary 缺失只会让候选在本次
-resolution 中被跳过，并记录为运行时事实。若没有候选可用，loop 会 PAUSE + ALERT，
-而不是悄悄改写静态 pool。
+运行时健康不是静态策略。quota、auth、网络、VPN、账号、stall 或 binary 缺失只会
+挂起运行态 rig，并记录为运行时事实；Roll 不回写 `agents.yaml`。挂起 rig 按恢复窗口
+轻量探活，恢复后自动回到候选池。若没有候选可用，cycle 记录 `loop:pending`，只做
+恢复探测，不启动 Builder、不记入卡的失败账，也不悄悄改写静态 pool。
 
 ### Agent 工具链健康检查（US-V4-022）
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seanyao/roll",
-  "version": "4.706.1",
+  "version": "4.707.1",
   "description": "Roll — Roll out features with AI agents",
   "packageManager": "pnpm@11.1.3",
   "scripts": {