@sun-asterisk/sungen 3.3.0-alpha.1 → 3.3.0-alpha.10

package/src/graph/test-case-results.ts

@@ -7,15 +7,21 @@
  *   stale    the run manifest (`sungen changed`) selects the scenario: its steps/tags, a selector or a
  *            test-data key it uses, or a project input changed since the recorded run
  *   triage   the rows of `.sungen/triage/<unit>.json` for the case, only when that triage is not
- *            older than the case's result files (a re-run voids it)
+ *            older than the case's result files (a re-run voids it) — unless a manual classification
+ *            in force judged this very red (manual-triage-decisions.ts, #928): that one wins
+ *   evidence a red case's hash of its red final attempts (file, title, status, start, duration,
+ *            messages): what a manual classification is bound to
  */
+import { createHash } from 'crypto';
 import * as fs from 'fs';
 import * as path from 'path';
+import { canonicalJson } from '../decisions/decision-identity';
 import { loadPlaywrightReport } from '../exporters/playwright-report-parser';
 import type { PlaywrightResult } from '../exporters/types';
 import { buildRunManifest, readRunManifest, selectChanged } from '../harness/run-manifest';
 import { readTriageReport } from '../harness/triage-unit';
 import type { TriageClass } from '../harness/triage';
+import { manualClassificationFor, manualClassifications } from './manual-triage-decisions';
 import type { FeatureCase } from './test-case-identity';
 import type { TestCaseResult, TestCaseState } from './test-case-state-shape';
 import { generatedDirs, RESULT_FILE } from './unit-artifact-probes';
@@ -24,7 +30,7 @@ const RED = new Set<PlaywrightResult['status']>(['failed', 'timedOut', 'interrup
 /** The class a case shows when its rows disagree: what needs a human first. */
 const TRIAGE_PRECEDENCE: TriageClass[] = ['product-candidate', 'unclassified', 'test-defect', 'environment', 'known-defect', 'blocked-capability', 'flaky'];
 
-export interface CaseOutcome { result: TestCaseResult; failedResults: number; resultFiles: string[]; stale?: string; triage?: TestCaseState['triage'] }
+export interface CaseOutcome { result: TestCaseResult; failedResults: number; resultFiles: string[]; stale?: string; triage?: TestCaseState['triage']; evidence?: string }
 
 const ownsTitle = (key: string, title: string): boolean => key === title || key.endsWith(` > ${title}`)
   || key.startsWith(`${title} — `) || key.includes(` > ${title} — `);
@@ -63,16 +69,28 @@ function triageRows(projectRoot: string, unitId: string): { at: number; rows: Ar
   return { at: report && typeof report.generatedAt === 'string' ? Date.parse(report.generatedAt) : NaN, rows };
 }
 
+/** The red final attempts of one case, hashed: the same red reads the same; a re-run (new start, duration) does not. */
+function redEvidence(projectRoot: string, reds: Array<{ file: string; key: string; r: PlaywrightResult }>): string {
+  const rows = reds.map(({ file, key, r }) => ({
+    file: path.relative(projectRoot, file).split(path.sep).join('/'), key, status: r.status,
+    startTime: r.startTime ?? null, duration: r.duration ?? null, messages: r.errorMessages ?? (r.error ? [r.error] : []),
+  })).sort((a, b) => (`${a.file}\n${a.key}` < `${b.file}\n${b.key}` ? -1 : 1));
+  return createHash('sha256').update(canonicalJson(rows)).digest('hex');
+}
+
 export function caseOutcomes(projectRoot: string, unitDir: string, unit: string, unitId: string, cases: FeatureCase[]): CaseOutcome[] {
   const byFeature = resultsByFeature(projectRoot, unit, unitId);
   const stale = staleReasons(projectRoot, unitDir, unit);
   const triage = triageRows(projectRoot, unitId);
+  const manual = manualClassifications(projectRoot, unitDir);
   return cases.map((c) => {
     const statuses: PlaywrightResult['status'][] = [];
     const files: string[] = [];
+    const reds: Array<{ file: string; key: string; r: PlaywrightResult }> = [];
     for (const { file, report } of byFeature.get(c.featureBase) ?? []) {
-      const mine = [...report.entries()].filter(([key]) => ownsTitle(key, c.title)).map(([, r]) => r.status);
-      if (mine.length) { statuses.push(...mine); files.push(file); }
+      const mine = [...report.entries()].filter(([key]) => ownsTitle(key, c.title));
+      if (mine.length) { statuses.push(...mine.map(([, r]) => r.status)); files.push(file); }
+      for (const [key, r] of mine) if (RED.has(r.status)) reds.push({ file, key, r });
     }
     const result: TestCaseResult = statuses.some((s) => RED.has(s)) ? 'failed'
       : statuses.includes('passed') ? 'passed' : statuses.includes('skipped') ? 'skipped' : 'never-run';
@@ -81,10 +99,13 @@ export function caseOutcomes(projectRoot: string, unitDir: string, unit: string,
       resultFiles: files.map((f) => path.relative(projectRoot, f).split(path.sep).join('/')),
     };
     if (result !== 'never-run' && stale[c.title]) out.stale = stale[c.title];
+    if (result === 'failed') out.evidence = redEvidence(projectRoot, reds);
     const current = !Number.isNaN(triage.at) && files.every((f) => mtime(f) <= triage.at);
     const rows = current ? triage.rows.filter((r) => rowOwns(r.scenario, c.title)) : [];
     const worst = TRIAGE_PRECEDENCE.find((cls) => rows.some((r) => r.class === cls));
     if (worst) out.triage = { class: worst, ruleId: rows.find((r) => r.class === worst)!.ruleId };
+    const byHand = manualClassificationFor(manual, c.id, out.evidence);
+    if (byHand) out.triage = { class: byHand.class, ruleId: 'manual', decision: byHand.decision };
     return out;
   });
 }

package/src/graph/test-case-satisfied.ts

@@ -8,14 +8,15 @@
  *   trigger — what the case needs otherwise, first match wins:
  *            never run → run · result older than the scenario (run manifest) → rerun-stale ·
  *            red with no current triage, or left `unclassified` by it → triage (a classification
- *            is still owed) · triaged product-candidate → a QA decision
- * A pass — Pass (Mocked) included — needs nothing. A red triaged test-defect / environment has been
- * judged; the triage report and the deliverable carry it (no P0 node — a P1 follow-up).
+ *            is still owed) · triaged product-candidate → a QA decision · triaged environment →
+ *            rerun-environment (once it is up) · triaged test-defect → fix-test (#928)
+ * A pass — Pass (Mocked) included — needs nothing. The class may be `sungen triage`'s or a manual
+ * classification in force (manual-triage-decisions.ts); test-case-results.ts decides which.
  */
 import type { TestCaseState } from './test-case-state-shape';
 
 export type TestCaseExemption = 'manual' | 'requires' | 'known-defect' | 'deferred' | 'blocked-capability';
-export type TestCaseNeed = 'run' | 'rerun-stale' | 'triage' | 'product-candidate';
+export type TestCaseNeed = 'run' | 'rerun-stale' | 'triage' | 'product-candidate' | 'rerun-environment' | 'fix-test';
 
 const tagged = (tc: TestCaseState, tag: string): boolean => tc.tags.some((t) => t === tag || t.startsWith(`${tag}:`));
 
@@ -36,6 +37,8 @@ export function triggerOf(tc: TestCaseState): TestCaseNeed | null {
   if (tc.result === 'failed') {
     if (!tc.triage || tc.triage.class === 'unclassified') return 'triage';
     if (tc.triage.class === 'product-candidate') return 'product-candidate';
+    if (tc.triage.class === 'environment') return 'rerun-environment';
+    if (tc.triage.class === 'test-defect') return 'fix-test';
   }
   return null;
 }

package/src/graph/test-case-state-shape.ts

@@ -52,8 +52,13 @@ export interface TestCaseState {
   resultFiles: string[];
   /** Set when the scenario changed after the run that produced its result (run manifest). */
   stale?: string;
-  /** The current `sungen triage` row for a red case — absent when triage has not judged this result. */
-  triage?: { class: TriageClass; ruleId: string };
+  /**
+   * The class of a red case: a manual classification in force (`ruleId: 'manual'` and its decision id,
+   * #928), else the current `sungen triage` row — absent when neither has judged this result.
+   */
+  triage?: { class: TriageClass; ruleId: string; decision?: string };
+  /** Hash of the red final attempts the case accounts for (failed only) — a manual classification is bound to it; a re-run changes it. */
+  evidence?: string;
   /** Spec anchors the case was generated from (manifest), and whether they moved since. */
   anchors: Array<{ anchor: string; change: 'keep' | 'regenerate' | 'retire' | 'unknown' }>;
   findings: LocatedFinding[];

package/src/graph/unit-artifact-probes.ts

@@ -9,6 +9,7 @@ import { parse as parseYaml } from 'yaml';
 import { featureFilesFor } from '../harness/unit-paths';
 import { readTextFile } from '../harness/read-text';
 import { loadPlaywrightReport } from '../exporters/playwright-report-parser';
+import { isDraftDeliverable } from '../exporters/csv-exporter';
 
 /** `<f>-test-result[.<os>][.<env>].json` — a mobile run writes the OS into the name, an env run the env (#868). */
 export const RESULT_FILE = /-test-result(?:\.[^.]+)*\.json$/;
@@ -72,6 +73,7 @@ export function countFailedResults(resultFiles: string[]): number {
 
 export function hasDeliverableFor(projectRoot: string, slug: string): boolean {
   try {
-    return fs.readdirSync(path.join(projectRoot, 'qa', 'deliverables')).some((f) => f.startsWith(`${slug}-`));
+    // A `--preview` DRAFT is not a deliverable (#965).
+    return fs.readdirSync(path.join(projectRoot, 'qa', 'deliverables')).some((f) => f.startsWith(`${slug}-`) && !isDraftDeliverable(f));
   } catch { return false; }                                    // nothing exported yet
 }

package/src/graph/unit-results-freshness.ts

@@ -0,0 +1,165 @@
+/**
+ * Which run a unit's results come from, and whether they still describe the suite (#942) — so `next`
+ * and the delivery checklist never read a months-old results JSON in silence. Read-only, like the rest
+ * of the graph's facts.
+ *
+ *   run       each result file's run start, as Playwright records it (`stats.startTime`); a file
+ *             without one is dated by its own change time, and says so
+ *   older     an input changed after the results it feeds were recorded:
+ *               per feature   its `.feature` and compiled `<base>.spec.ts` ↔ its `<base>-test-result*.json`
+ *               unit-wide     requirements/spec.md ↔ the oldest result file
+ *             Not contracts.lock.yaml: approving the contract after a run is the normal order, and it
+ *             changes no test — the contract check judges the lock, not the results.
+ *             A file's "change time" is its last commit when git tracks it unchanged, else its file
+ *             time. Results are "recorded" at the later of their run start and their own change time.
+ *             So a fresh checkout (every file the checkout's time) and results committed in the same
+ *             commit as the edit they ran against read fresh; an edit, or a commit, after them does not.
+ *   env       SUNGEN_ENV names an env no result file is for: readers fall back to another env's results
+ * Advisory: it states what it sees and warns; it decides no step and changes no exit code.
+ */
+import { execFileSync } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+import { catalogIdFromScreenDir, featureFilesFor } from '../harness/unit-paths';
+import { generatedDirs, RESULT_FILE } from './unit-artifact-probes';
+
+export interface ResultsFreshness {
+  files: Array<{ file: string; runAt: string; source: 'run' | 'file' }>;
+  /** The oldest result file's run — what the counts are at least as old as. */
+  oldestRunAt: string;
+  newestRunAt: string;
+  /** How the oldest run is dated: Playwright's run start, or (none recorded) the file's change time. */
+  runAtSource: 'run' | 'file';
+  /** Inputs changed after the results they feed were recorded. */
+  newerInputs: Array<{ file: string; changedAt: string; source: 'commit' | 'file' }>;
+  /** SUNGEN_ENV, when no result file is for it. */
+  missingEnv?: string;
+  /** One line: what makes these results untrustworthy — absent when nothing does. */
+  warning?: string;
+}
+
+type Change = { ms: number; source: 'commit' | 'file' };
+/** `next` also runs inside the Claude Code hooks (10 s budget, the contract's git calls included): a slow git dates by file time instead. */
+const GIT_TIMEOUT_MS = 2_000;
+/** Commit times have one-second resolution: an edit and its results in one commit tie. */
+const TIE_MS = 1_000;
+const posix = (p: string): string => p.split(path.sep).join('/');
+const real = (p: string): string => { try { return fs.realpathSync(p); } catch { return path.resolve(p); } };
+const iso = (ms: number): string => new Date(ms).toISOString();
+
+/** project root → its git work tree (null outside one), asked once per process: `next` reads every unit. */
+const workTrees = new Map<string, string | null>();
+
+function git(cwd: string, args: string[]): string | null {
+  try { return execFileSync('git', args, { cwd, stdio: ['ignore', 'pipe', 'ignore'], timeout: GIT_TIMEOUT_MS, maxBuffer: 16 * 1024 * 1024 }).toString('utf8'); } catch { return null; }
+}
+
+/**
+ * When each file last changed: its last commit when git tracks it and it is unchanged, else its file
+ * time (no git, uncommitted, untracked, ignored, or git failed). Two git calls for the whole set.
+ */
+function changeTimes(projectRoot: string, files: string[]): (abs: string) => Change | null {
+  const mtime = (abs: string): Change | null => { try { return { ms: fs.statSync(abs).mtimeMs, source: 'file' }; } catch { return null; } };
+  if (!workTrees.has(projectRoot)) workTrees.set(projectRoot, git(projectRoot, ['rev-parse', '--show-toplevel'])?.trim() || null);
+  const top = workTrees.get(projectRoot);
+  if (!top) return mtime;
+  const topReal = real(top);
+  const rels = files.map((f) => posix(path.relative(topReal, real(f)))).filter((r) => r && !r.startsWith('..'));
+  if (!rels.length) return mtime;
+  const status = git(topReal, ['status', '--porcelain=v1', '-z', '--untracked-files=all', '--', ...rels]);
+  const log = git(topReal, ['log', '-n', '500', '--format=%x01%ct', '--name-only', '--', ...rels]);
+  if (status === null || log === null) return mtime;
+  const dirty = new Set<string>();
+  const entries = status.split('\0');
+  for (let i = 0; i < entries.length; i++) {
+    const e = entries[i];
+    if (e.length < 4) continue;
+    dirty.add(e.slice(3));
+    if (e[0] === 'R' || e[0] === 'C') i++;   // a rename/copy carries its source path next
+  }
+  const committed = new Map<string, number>();
+  let at = 0;
+  for (const line of log.split('\n')) {
+    if (line.startsWith('\x01')) at = Number(line.slice(1)) * 1000;
+    else if (line.trim() && at && !committed.has(line.trim())) committed.set(line.trim(), at);
+  }
+  return (abs) => {
+    const rel = posix(path.relative(topReal, real(abs)));
+    const t = committed.get(rel);
+    return t !== undefined && !dirty.has(rel) && fs.existsSync(abs) ? { ms: t, source: 'commit' } : mtime(abs);
+  };
+}
+
+function runStartOf(file: string): number | null {
+  try {
+    const t = (JSON.parse(fs.readFileSync(file, 'utf8')) as { stats?: { startTime?: unknown } })?.stats?.startTime;
+    const ms = typeof t === 'string' ? Date.parse(t) : NaN;
+    return Number.isNaN(ms) ? null : ms;
+  } catch { return null; }
+}
+
+/** Every result file of the unit, in the directories its readers look in. */
+function resultFilesOf(projectRoot: string, unitDir: string, unit: string): string[] {
+  const dirs = [...new Set([...generatedDirs(projectRoot, unit), path.join(projectRoot, 'specs', 'generated', catalogIdFromScreenDir(unitDir))])];
+  return dirs.flatMap((d) => { try { return fs.readdirSync(d).filter((f) => RESULT_FILE.test(f)).sort().map((f) => path.join(d, f)); } catch { return []; } });
+}
+
+/** The unit's results, dated, and what they are older than — undefined when the unit has none. */
+export function resultsFreshness(projectRoot: string, unitDir: string, unit: string, env: string | undefined = process.env.SUNGEN_ENV): ResultsFreshness | undefined {
+  const results = resultFilesOf(projectRoot, unitDir, unit);
+  if (!results.length) return undefined;
+  const features = featureFilesFor(unitDir, unit).filter((f) => fs.existsSync(f));
+  const specsOf = (base: string): string[] => [...new Set(results.map((r) => path.join(path.dirname(r), `${base}.spec.ts`)))].filter((f) => fs.existsSync(f));
+  const unitWide = [path.join(unitDir, 'requirements', 'spec.md')].filter((f) => fs.existsSync(f));
+  const baseOf = (f: string): string => path.basename(f).replace(RESULT_FILE, '');
+  const bases = [...new Set(results.map(baseOf))];
+  const changed = changeTimes(projectRoot, [...results, ...features, ...bases.flatMap(specsOf), ...unitWide]);
+  const rel = (f: string): string => posix(path.relative(projectRoot, f));
+
+  const dated = results.map((file) => {
+    const start = runStartOf(file);
+    const own = changed(file)?.ms ?? 0;
+    return { file, base: baseOf(file), runAt: start ?? own, source: (start !== null ? 'run' : 'file') as 'run' | 'file', recordedAt: Math.max(start ?? 0, own) };
+  });
+  const oldest = dated.reduce((a, b) => (b.runAt < a.runAt ? b : a));
+  const newest = dated.reduce((a, b) => (b.runAt > a.runAt ? b : a));
+  const recordedFor = (files: typeof dated): number => Math.min(...files.map((d) => d.recordedAt));
+
+  const newerInputs: ResultsFreshness['newerInputs'] = [];
+  const judge = (input: string, recordedAt: number): void => {
+    const c = changed(input);
+    if (c && c.ms > recordedAt + TIE_MS) newerInputs.push({ file: rel(input), changedAt: iso(c.ms), source: c.source });
+  };
+  for (const base of bases) {
+    const feeds = recordedFor(dated.filter((d) => d.base === base));
+    for (const f of [...features.filter((x) => path.basename(x, '.feature') === base), ...specsOf(base)]) judge(f, feeds);
+  }
+  for (const f of unitWide) judge(f, recordedFor(dated));
+
+  const variants = results.map((f) => path.basename(f).replace(/^.*-test-result\.?/, '').replace(/\.?json$/, ''));
+  const missingEnv = env && !variants.some((v) => v === env || v.endsWith(`.${env}`)) ? env : undefined;
+  const problems = [
+    ...(newerInputs.length ? [`results are older than ${newerInputs.slice(0, 3).map((i) => `${i.file} (changed ${shortDate(i.changedAt)})`).join(', ')}${newerInputs.length > 3 ? ', …' : ''} — re-run the tests before trusting the counts`] : []),
+    ...(missingEnv ? [`no results for SUNGEN_ENV=${missingEnv} — readers fall back to ${rel(oldest.file)}`] : []),
+  ];
+  return {
+    files: dated.map((d) => ({ file: rel(d.file), runAt: iso(d.runAt), source: d.source })),
+    oldestRunAt: iso(oldest.runAt), newestRunAt: iso(newest.runAt), runAtSource: oldest.source,
+    newerInputs, ...(missingEnv ? { missingEnv } : {}), ...(problems.length ? { warning: problems.join('; ') } : {}),
+  };
+}
+
+/** `2026-08-21 03:42Z` */
+export const shortDate = (isoTime: string): string => `${isoTime.slice(0, 16).replace('T', ' ')}Z`;
+
+/** `run 2026-08-21 03:42Z (65 days ago)` — the oldest run, and the newest when they are days apart. */
+export function describeResultsRun(f: ResultsFreshness, now = Date.now()): string {
+  // A file neither the JSON nor the file system could date reads as epoch 0 — "20000 days ago" is noise.
+  if (!(Date.parse(f.oldestRunAt) > 0)) return 'run time unknown (no run start in the JSON, no file time)';
+  const days = Math.floor((now - Date.parse(f.oldestRunAt)) / 86_400_000);
+  const age = days <= 0 ? 'today' : days === 1 ? '1 day ago' : `${days} days ago`;
+  const span = Date.parse(f.newestRunAt) - Date.parse(f.oldestRunAt) >= 86_400_000 ? ` to ${shortDate(f.newestRunAt)}` : '';
+  return f.runAtSource === 'run'
+    ? `run ${shortDate(f.oldestRunAt)} (${age})${span}`
+    : `file time ${shortDate(f.oldestRunAt)} (${age}; the JSON records no run start)${span}`;
+}

package/src/harness/audit.ts

@@ -11,7 +11,7 @@ import * as fs from 'fs';
 import { loadUnitScenarios, readUnitFeatureText, parseViewpointOverview, ScenarioInfo, ViewpointEntry } from './parse';
 import { checkViewpointBaseline, ViewpointBaseline } from './viewpoint-baseline';
 import { flowQuality, statefulDepthFor, continuityGaps, flowInventory, misfiledPhases, FlowQualityResult, InventoryResult } from './flow-contract';
-import { featureFilesFor } from './unit-paths';
+import { catalogIdFromScreenDir, featureFilesFor, isScreenUnitId } from './unit-paths';
 import {
   loadCatalog, viewpointGate, assertionDepth, dataThemesFor, depthThresholdFor, coverageBalance, duplicateClusters, scenarioIdReuse, ReusedScenarioId, traceability, claimProof, taxonomyLint,
   automatableManual, flowCoveredThemes, flowRegressionDepth, oracleStrength, declaredPageType,
@@ -129,17 +129,8 @@ export function projectUnitDirs(projectRoot: string): string[] {
   return out;
 }
 
-/** The catalog-resolution id for a unit dir (relative to qa/): screen · flows/<flow> · api/<area> · api/flows/<flow>. */
-export function catalogIdFromScreenDir(screenDir: string): string {
-  const parts = screenDir.split(path.sep);
-  const qa = parts.lastIndexOf('qa');
-  if (qa >= 0) {
-    if (parts[qa + 1] === 'api' && parts[qa + 2] === 'flows' && parts[qa + 3]) return `api/flows/${parts[qa + 3]}`;
-    if (parts[qa + 1] === 'api' && parts[qa + 2]) return `api/${parts[qa + 2]}`;
-    if (parts[qa + 1] === 'flows' && parts[qa + 2]) return `flows/${parts[qa + 2]}`;
-  }
-  return path.basename(screenDir);
-}
+/** The catalog-resolution id for a unit dir — lives in unit-paths.ts (the inputsHash reads it too); kept exported here. */
+export { catalogIdFromScreenDir };
 
 /**
  * The capability that owns SCORING for a unit (AO-1): the first path segment of the unit id when it
@@ -246,7 +237,7 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
   // gate gap, credit it to the flow instead of double-counting it as a screen gap. Screens only
   // (a flow/api unit is not credited by sibling flows); mutates the gate before coverage is scored.
   const flowCredits: { theme: string; flow: string }[] = [];
-  const isScreenUnit = !/^(flows|api)\//.test(catalogScreenName);
+  const isScreenUnit = isScreenUnitId(catalogScreenName);
   if (isScreenUnit && gate.gaps.length) {
     const flowScenarios = loadFlowScenarios(projectRootFromScreenDir(screenDir));
     if (flowScenarios.length) {

package/src/harness/catalog/gate-rules.yaml

@@ -535,8 +535,8 @@ rules:
     stage: deliver
     severity: error
     kind: soft
-    rationale: "Pre-delivery halt: everything automated plus the single human sign-off must be satisfied or waived with a reason."
-    fix: "Close the open obligations and sign off, or waive with a reason."
+    rationale: "Pre-delivery halt: everything automated must be satisfied or waived with a reason, plus the single human sign-off, which is given (sungen journey --signoff), never waived."
+    fix: "Close or waive the open obligations, then a human signs off: sungen journey --screen <unit> --signoff --by <name>."
     since: "<=3.2.34"
     offAllowed: false
 
@@ -586,7 +586,7 @@ rules:
     severity: review
     kind: hard
     rationale: "A check on a JS value, API or canvas result is not tied to an element and cannot be compared automatically (DOS-14.6); it always goes to review and is locked at review."
-    fix: "QA reviews the verbatim step and its file:line, then approves."
+    fix: "QA reviews the verbatim step and its file:line (`sungen contract check`), then accepts it as it reads now on a terminal: `sungen contract approve --screen <unit> --scenario <id> --accept-opaque`. A plain re-approve never clears it."
     since: "p0"
     offAllowed: false
   - id: contract.nondeterministic

package/src/harness/defect-draft.ts

@@ -20,6 +20,7 @@ import { readCapabilities } from './capability';
 import { defectsDir, nextDefectId, readDefects } from './defects';
 import type { TriageRow } from './triage';
 import { readTriageReport, unitSecrets } from './triage-unit';
+import { testCaseStates } from '../graph/test-case-states';
 
 export interface DraftResult {
   /** `sungen triage` has not run for this unit. */
@@ -89,14 +90,24 @@ function render(cwd: string, unit: ResolvedUnit, id: string, row: TriageRow, sc:
   return redactSecrets(body, sc?.secrets ?? []);
 }
 
+/**
+ * The class a triage row stands for now: a classification by hand in force for its case wins (#928) —
+ * a red classified `product` by hand is drafted, one a human classified test-defect is not.
+ */
+function effectiveClass(cwd: string, unit: ResolvedUnit): (row: TriageRow) => TriageRow['class'] {
+  const byHand = testCaseStates(cwd, unit.unitId, { unitDir: unit.dir, auditFindings: [] }).filter((c) => c.triage?.ruleId === 'manual');
+  return (row) => byHand.find((c) => row.scenario === c.title || row.scenario.startsWith(`${c.title} — `))?.triage?.class ?? row.class;
+}
+
 export function draftDefects(cwd: string, unit: ResolvedUnit, opts: { scenario?: string } = {}): DraftResult {
   const triage = readTriageReport(cwd, unit.unitId);
   if (!triage) return { missingTriage: true, written: [], skipped: [] };
   const recorded = new Map<string, string>();
   for (const r of readDefects(cwd)) if (r.units.includes(unit.unitId)) for (const s of r.scenarios) recorded.set(s, r.id);
 
-  const wanted = triage.rows.filter((r) => r.class === 'product-candidate'
-    && (!opts.scenario || r.scenario.includes(opts.scenario) || r.ids.includes(opts.scenario)));
+  const classOf = effectiveClass(cwd, unit);
+  const wanted = triage.rows.map((r): TriageRow => (classOf(r) === r.class ? r : { ...r, class: classOf(r), ruleId: 'manual' }))
+    .filter((r) => r.class === 'product-candidate' && (!opts.scenario || r.scenario.includes(opts.scenario) || r.ids.includes(opts.scenario)));
   const scenarios = unitScenarios(cwd, unit);
   const result: DraftResult = { written: [], skipped: [] };
   const seen = new Set<string>();

package/src/harness/defects.ts

@@ -66,24 +66,37 @@ export function readDefects(cwd: string): DefectRecord[] {
   return out;
 }
 
+/**
+ * Everything the defect-link findings of one unit read off qa/defects/ — and so what the audit's
+ * inputsHash covers there (#927): the unit's `@known-defect:<id>` tags with no record, in tag order,
+ * and the unit's OPEN records with the scenarios they name. Title, severity and prose are not read,
+ * so editing them never asks for a re-audit.
+ */
+export interface DefectLinkInputs { missing: string[]; open: Array<{ id: string; scenarios: string[] }> }
+
+export function defectLinkInputs(cwd: string, unitId: string, featureText: string): DefectLinkInputs {
+  const records = readDefects(cwd);
+  const known = new Set(records.map((r) => r.id));
+  const tagged = [...new Set([...featureText.matchAll(KNOWN_DEFECT_TAG)].map((m) => m[1]))];
+  return {
+    missing: tagged.filter((id) => !known.has(id)),
+    open: records.filter((r) => r.status === 'open' && r.units.includes(unitId)).map((r) => ({ id: r.id, scenarios: r.scenarios })),
+  };
+}
+
 /**
  * Advisory audit findings for one unit (never scored):
  *   DEFECT-REF-MISSING     a `@known-defect:DEF-NNN` tag with no record file.
  *   DEFECT-ORPHAN (info)   an OPEN record of this unit names a scenario the unit no longer has.
  */
 export function defectLinkFindings(cwd: string, unitId: string, featureText: string, scenarioNames: string[]): string[] {
-  const records = readDefects(cwd);
+  const { missing, open } = defectLinkInputs(cwd, unitId, featureText);
   const findings: string[] = [];
-  const known = new Set(records.map((r) => r.id));
-  const tagged = new Set([...featureText.matchAll(KNOWN_DEFECT_TAG)].map((m) => m[1]));
-  for (const id of tagged) {
-    if (!known.has(id)) {
-      findings.push(`DEFECT-REF-MISSING: \`@known-defect:${id}\` has no record in qa/defects/ — draft it with \`sungen defect draft --screen ${unitId}\`, or correct the id.`);
-    }
+  for (const id of missing) {
+    findings.push(`DEFECT-REF-MISSING: \`@known-defect:${id}\` has no record in qa/defects/ — draft it with \`sungen defect draft --screen ${unitId}\`, or correct the id.`);
   }
   const names = new Set(scenarioNames);
-  for (const r of records) {
-    if (r.status !== 'open' || !r.units.includes(unitId)) continue;
+  for (const r of open) {
     for (const s of r.scenarios) {
       if (!names.has(s)) {
         findings.push(`DEFECT-ORPHAN (info): ${r.id} is open and names scenario "${s}", which ${unitId} no longer has — update the record's scenarios, or close it.`);

package/src/harness/flow-check.ts

@@ -70,6 +70,17 @@ export function loadFlowScenarios(cwd: string): FlowScenario[] {
   return out;
 }
 
+/**
+ * What a screen audit reads from its sibling flows (#927): the scenarios that can credit a gate theme
+ * — only deep ones do (flowCoveredThemes) — by flow and haystack. The screen's inputsHash covers them,
+ * sorted so the hash does not depend on directory order; a shallow scenario or prose moves nothing.
+ */
+export function flowCreditInputs(cwd: string): Array<{ flow: string; haystack: string }> {
+  const key = (s: { flow: string; haystack: string }): string => `${s.flow}\n${s.haystack}`;
+  return loadFlowScenarios(cwd).filter((s) => s.deep).map(({ flow, haystack }) => ({ flow, haystack }))
+    .sort((a, b) => (key(a) < key(b) ? -1 : key(a) > key(b) ? 1 : 0));
+}
+
 export function buildFlowCheck(cwd: string, onlyFlow?: string): FlowCheckReport {
   const screens = listDirs(path.join(cwd, 'qa', 'screens'));
   const flows = (onlyFlow ? [onlyFlow] : listDirs(path.join(cwd, 'qa', 'flows')));

package/src/harness/gates/audit-gate-verdict.ts

@@ -5,7 +5,8 @@
  *
  *   gateOverrides[]  every override touching the unit, applied / ineffective / rejected
  *   decisionsHash    the overrides it was judged under       (stale when they change)
- *   inputsHash       .feature + spec + viewpoint + decisionsHash
+ *   inputsHash       .feature + spec + viewpoint + … + decisionsHash, and the defect records and
+ *                    crediting flows it reads (audit-input-hash.ts, #927)
  *   exitCode         0 on PASS, 2 on FAIL — what `sungen audit` exits with
  *
  * The decision layer adds three hard terms: a rejected override (gate.override-rejected) and a

package/src/harness/gates/audit-input-hash.ts

@@ -12,14 +12,23 @@
  *   requirements/flow-contract.yaml · requirements/spec_figma.md · requirements/ui-inventory.md ·
  *   requirements/ui/* · qa/context.md (intent focus → thresholds) · qa/capabilities.yaml (platform,
  *   enabled drivers → gate sensors)
- * Not yet (phase 05 follow-ups): qa/defects/ and the sibling flows credited to a screen.
+ * and what it reads outside the unit (#927), as the audit reads it — not the files whole, so a
+ * re-audit is asked for only when the verdict can move:
+ *   defects     qa/defects/: the unit's `@known-defect:<id>` tags with no record, and its OPEN records
+ *               with their scenarios (defectLinkInputs — DEFECT-REF-MISSING, DEFECT-ORPHAN)
+ *   flowCredit  a SCREEN's sibling flows: the deep scenarios that can credit a gate theme
+ *               (flowCreditInputs — TQ-4, COVERED-VIA-FLOW); a flow or api unit is never credited
+ * Each is part of the hash only when it holds something, so a project with neither keeps the hash it
+ * had; a report written before #927 in a project with either reads stale once.
  */
 import { createHash } from 'crypto';
 import * as fs from 'fs';
 import * as path from 'path';
 import { canonicalJson } from '../../decisions/decision-identity';
+import { defectLinkInputs } from '../defects';
+import { flowCreditInputs } from '../flow-check';
 import { projectRootFromScreenDir } from '../intent';
-import { featureFilesFor } from '../unit-paths';
+import { catalogIdFromScreenDir, featureFilesFor, isScreenUnitId } from '../unit-paths';
 
 const sha256 = (s: string | Buffer): string => createHash('sha256').update(s).digest('hex');
 
@@ -47,9 +56,24 @@ export function auditInputFiles(unitDir: string, unitName: string): string[] {
   return candidates.filter((f) => fs.existsSync(f));
 }
 
+/** What the audit reads outside the unit — each key only when it holds something. */
+function crossUnitInputs(root: string, unitDir: string, unitName: string): Record<string, unknown> {
+  const unitId = catalogIdFromScreenDir(unitDir);
+  const featureText = featureFilesFor(unitDir, unitName).map((f) => { try { return fs.readFileSync(f, 'utf8'); } catch { return ''; } }).join('\n');
+  const defects = defectLinkInputs(root, unitId, featureText);
+  const flowCredit = isScreenUnitId(unitId) ? flowCreditInputs(root) : [];
+  return { ...(defects.missing.length || defects.open.length ? { defects } : {}), ...(flowCredit.length ? { flowCredit } : {}) };
+}
+
 export function auditInputsHash(unitDir: string, unitName: string, decisionsHash: string): string {
   const root = projectRootFromScreenDir(unitDir);
   const inputs = auditInputFiles(unitDir, unitName)
     .map((f) => ({ file: path.relative(root, f).split(path.sep).join('/'), sha: fileSha(f) }));
-  return sha256(canonicalJson({ schema: 2, inputs, decisionsHash }));
+  return sha256(canonicalJson({ schema: 2, inputs, decisionsHash, ...crossUnitInputs(root, unitDir, unitName) }));
+}
+
+/** The stale reason when the inputsHash moved — it names every kind of input, the ones outside the unit too. */
+export function auditInputsChangedReason(unitDir: string): string {
+  const outside = isScreenUnitId(catalogIdFromScreenDir(unitDir)) ? 'the defect records and sibling flows it reads' : 'the defect records it reads';
+  return `an input the audit judged (.feature, spec, viewpoint, context, design, or ${outside}) changed since this audit`;
 }