@telora/daemon 0.20.21 → 0.20.28

package/dist/resolvers/shared/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/resolvers/shared/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUrF"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/resolvers/shared/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOrF"}

package/dist/resolvers/shared/audit.js

@@ -8,18 +8,23 @@
  * If no prior audit exists or the lookup fails, the resolvers fall back
  * to "all since focus start" (no lower bound).
  */
-import { callApi } from '../../queries/shared.js';
+import { getRecentAuditRun } from '../../queries/audit-runs.js';
 /**
  * Best-effort cycle window. Returns the previous cycle's completed_at as
  * the lower bound for "things that happened in the current cycle". Null
  * means "no prior cycle, include everything since focus start". Failures
  * fall back to null so a missing audit_runs table or transient API error
  * does not blank out the resolver output.
+ *
+ * The snake_case -> camelCase transform lives in getRecentAuditRun (the API
+ * returns the Supabase row verbatim -- neither successResponse nor callApi
+ * maps keys). Reading `completedAt` off the raw response here always yielded
+ * undefined, so this window silently never narrowed.
  */
 export async function getAuditCycleLowerBound(focusId) {
     try {
-        const result = await callApi('daemon_get_recent_audit_run_for_focus', { focusId });
-        return result.auditRun?.completedAt ?? null;
+        const run = await getRecentAuditRun(focusId);
+        return run?.completedAt ?? null;
     }
     catch {
         return null;

package/dist/resolvers/shared/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/resolvers/shared/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AASlD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAe;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,uCAAuC,EACvC,EAAE,OAAO,EAAE,CACZ,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,EAAE,WAAW,IAAI,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/resolvers/shared/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAe;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,GAAG,EAAE,WAAW,IAAI,IAAI,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/resolvers/shared/git-diff.d.ts

@@ -11,4 +11,17 @@ export declare function getGitDiff(worktreePath: string, baseBranch: string): st
  * Get a summary of files changed in a diff (for truncation header).
  */
 export declare function getDiffStatSummary(worktreePath: string, baseBranch: string): string;
+/**
+ * List the files changed between the base branch and HEAD (name-only).
+ * Returns an empty array on failure (missing worktree / bad range).
+ */
+export declare function getChangedFiles(worktreePath: string, baseBranch: string): string[];
+/**
+ * Count commits on HEAD that are not reachable from the base branch
+ * (`git rev-list --count base..HEAD`). This is the delivery's own commit
+ * count relative to the integration base -- distinct from the diff, which
+ * can be empty even when commits exist if it is resolved in the wrong
+ * worktree. Returns 0 on failure so callers treat "unknown" as "no commits".
+ */
+export declare function getCommitsAhead(worktreePath: string, baseBranch: string): number;
 //# sourceMappingURL=git-diff.d.ts.map

package/dist/resolvers/shared/git-diff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-diff.d.ts","sourceRoot":"","sources":["../../../src/resolvers/shared/git-diff.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,eAAO,MAAM,cAAc,QAAY,CAAC;AAExC;;;GAGG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAU3E;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CASnF"}
+{"version":3,"file":"git-diff.d.ts","sourceRoot":"","sources":["../../../src/resolvers/shared/git-diff.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,eAAO,MAAM,cAAc,QAAY,CAAC;AAExC;;;GAGG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAU3E;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CASnF;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAUlF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAWhF"}

package/dist/resolvers/shared/git-diff.js

@@ -27,4 +27,34 @@ export function getDiffStatSummary(worktreePath, baseBranch) {
         return '';
     }
 }
+/**
+ * List the files changed between the base branch and HEAD (name-only).
+ * Returns an empty array on failure (missing worktree / bad range).
+ */
+export function getChangedFiles(worktreePath, baseBranch) {
+    try {
+        const out = execSync(`git diff --name-only ${baseBranch}...HEAD`, { cwd: worktreePath, maxBuffer: 1024 * 1024, encoding: 'utf-8' });
+        return out.split('\n').map((l) => l.trim()).filter((l) => l !== '');
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Count commits on HEAD that are not reachable from the base branch
+ * (`git rev-list --count base..HEAD`). This is the delivery's own commit
+ * count relative to the integration base -- distinct from the diff, which
+ * can be empty even when commits exist if it is resolved in the wrong
+ * worktree. Returns 0 on failure so callers treat "unknown" as "no commits".
+ */
+export function getCommitsAhead(worktreePath, baseBranch) {
+    try {
+        const out = execSync(`git rev-list --count ${baseBranch}..HEAD`, { cwd: worktreePath, maxBuffer: 1024 * 1024, encoding: 'utf-8' });
+        const n = Number.parseInt(out.trim(), 10);
+        return Number.isFinite(n) && n > 0 ? n : 0;
+    }
+    catch {
+        return 0;
+    }
+}
 //# sourceMappingURL=git-diff.js.map

package/dist/resolvers/shared/git-diff.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-diff.js","sourceRoot":"","sources":["../../../src/resolvers/shared/git-diff.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,uCAAuC;AAEhF;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,YAAoB,EAAE,UAAkB;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CACnB,YAAY,UAAU,SAAS,EAC/B,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,YAAoB,EAAE,UAAkB;IACzE,IAAI,CAAC;QACH,OAAO,QAAQ,CACb,mBAAmB,UAAU,SAAS,EACtC,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CACjE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"git-diff.js","sourceRoot":"","sources":["../../../src/resolvers/shared/git-diff.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,uCAAuC;AAEhF;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,YAAoB,EAAE,UAAkB;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CACnB,YAAY,UAAU,SAAS,EAC/B,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,YAAoB,EAAE,UAAkB;IACzE,IAAI,CAAC;QACH,OAAO,QAAQ,CACb,mBAAmB,UAAU,SAAS,EACtC,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CACjE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,YAAoB,EAAE,UAAkB;IACtE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAClB,wBAAwB,UAAU,SAAS,EAC3C,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CACjE,CAAC;QACF,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,YAAoB,EAAE,UAAkB;IACtE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAClB,wBAAwB,UAAU,QAAQ,EAC1C,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CACjE,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/spawn/review-role-fallback.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Review-spawn reviewer-role fallback.
+ *
+ * When a coding team completes, the auto_terminate_focus_team() Postgres trigger
+ * nulls product_focuses.assigned_agent_role_id -- correct team-lifecycle
+ * shutdown (the Play/queue toggle cleared). But a review is a SECOND team that
+ * must spawn AFTER that completion, and the pending review directive it left
+ * behind still needs a role to spawn under. With assigned_agent_role_id null,
+ * the listener's pending-spawn path used to skip the queued review directive
+ * every poll, and the directive-executor suppressed re-firing (an equivalent
+ * directive is "already queued") -- a review that can never spawn, spin-logging
+ * until review_window_stalled escalates to a human at ~6h.
+ *
+ * This module holds the prevent-at-source decision: for a REVIEW directive with
+ * a null role, resolve a layered reviewer-role fallback (the org's seeded
+ * Developer role) and spawn. It mirrors nexus intake's resolveIntakeRoleLayered
+ * (the org's seeded 'Developer' role is the zero-config fallback). The fallback
+ * is scoped STRICTLY to review spawns: a null role on a CODING spawn is the
+ * intended off-state and must NOT auto-spawn. Defense-in-depth: if even the
+ * fallback resolves nothing, the caller clears the pending directive so it stops
+ * spin-logging and lets the stall detector escalate promptly.
+ */
+import type { AgentRole } from '../types/session.js';
+/**
+ * Name of the org's auto-seeded, full-codebase agent role used as the reviewer
+ * fallback. Every organization gets one on creation (migration
+ * seed_default_agent_roles: 'Developer'). Mirrors nexus intake's
+ * DEFAULT_INTAKE_ROLE_NAME so review-spawn and intake-spawn share the same
+ * zero-config fallback identity.
+ */
+export declare const DEFAULT_REVIEWER_ROLE_NAME = "Developer";
+/**
+ * What to do with a pending spawn directive whose focus has a null
+ * assigned_agent_role_id.
+ *
+ *   - skip:  a CODING directive (or no directive) -- the intended off-state
+ *            (Play/queue toggle cleared). Never auto-spawn.
+ *   - spawn: a REVIEW directive with a resolved fallback role -- spawn the
+ *            review team under it.
+ *   - clear: a REVIEW directive with NO resolvable fallback role -- drop the
+ *            directive so the stranded-review re-fire suppression cannot spin
+ *            forever; review_window_stalled remains the escalation path.
+ */
+export type NullRoleSpawnDecision = {
+    action: 'skip';
+} | {
+    action: 'spawn';
+    role: AgentRole;
+} | {
+    action: 'clear';
+};
+/**
+ * Resolve the org's seeded Developer role from an already-loaded roles
+ * collection (the listener keeps every org agent role in memory). Returns the
+ * first role named DEFAULT_REVIEWER_ROLE_NAME, or undefined when the org has no
+ * seeded Developer role (the degenerate case the 'clear' decision handles).
+ *
+ * Pure and exported for unit testing.
+ */
+export declare function resolveReviewerFallbackRole(roles: Iterable<AgentRole>): AgentRole | undefined;
+/**
+ * Decide what to do with a null-role pending spawn directive.
+ *
+ * The layered fallback applies ONLY to review directives; a coding directive
+ * with a null role is the intended off-state and is always skipped. A review
+ * directive spawns under the fallback role when one resolves, else clears.
+ *
+ * Pure and exported for unit testing (peer of resolveReviewerFallbackRole).
+ */
+export declare function decideNullRoleSpawn(input: {
+    sessionType: 'coding' | 'review' | undefined;
+    fallbackRole: AgentRole | undefined;
+}): NullRoleSpawnDecision;
+//# sourceMappingURL=review-role-fallback.d.ts.map

package/dist/spawn/review-role-fallback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-role-fallback.d.ts","sourceRoot":"","sources":["../../src/spawn/review-role-fallback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,cAAc,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GACpC;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC;AAExB;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,GACzB,SAAS,GAAG,SAAS,CAKvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,WAAW,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC7C,YAAY,EAAE,SAAS,GAAG,SAAS,CAAC;CACrC,GAAG,qBAAqB,CAIxB"}

package/dist/spawn/review-role-fallback.js

@@ -0,0 +1,62 @@
+/**
+ * Review-spawn reviewer-role fallback.
+ *
+ * When a coding team completes, the auto_terminate_focus_team() Postgres trigger
+ * nulls product_focuses.assigned_agent_role_id -- correct team-lifecycle
+ * shutdown (the Play/queue toggle cleared). But a review is a SECOND team that
+ * must spawn AFTER that completion, and the pending review directive it left
+ * behind still needs a role to spawn under. With assigned_agent_role_id null,
+ * the listener's pending-spawn path used to skip the queued review directive
+ * every poll, and the directive-executor suppressed re-firing (an equivalent
+ * directive is "already queued") -- a review that can never spawn, spin-logging
+ * until review_window_stalled escalates to a human at ~6h.
+ *
+ * This module holds the prevent-at-source decision: for a REVIEW directive with
+ * a null role, resolve a layered reviewer-role fallback (the org's seeded
+ * Developer role) and spawn. It mirrors nexus intake's resolveIntakeRoleLayered
+ * (the org's seeded 'Developer' role is the zero-config fallback). The fallback
+ * is scoped STRICTLY to review spawns: a null role on a CODING spawn is the
+ * intended off-state and must NOT auto-spawn. Defense-in-depth: if even the
+ * fallback resolves nothing, the caller clears the pending directive so it stops
+ * spin-logging and lets the stall detector escalate promptly.
+ */
+/**
+ * Name of the org's auto-seeded, full-codebase agent role used as the reviewer
+ * fallback. Every organization gets one on creation (migration
+ * seed_default_agent_roles: 'Developer'). Mirrors nexus intake's
+ * DEFAULT_INTAKE_ROLE_NAME so review-spawn and intake-spawn share the same
+ * zero-config fallback identity.
+ */
+export const DEFAULT_REVIEWER_ROLE_NAME = 'Developer';
+/**
+ * Resolve the org's seeded Developer role from an already-loaded roles
+ * collection (the listener keeps every org agent role in memory). Returns the
+ * first role named DEFAULT_REVIEWER_ROLE_NAME, or undefined when the org has no
+ * seeded Developer role (the degenerate case the 'clear' decision handles).
+ *
+ * Pure and exported for unit testing.
+ */
+export function resolveReviewerFallbackRole(roles) {
+    for (const role of roles) {
+        if (role.name === DEFAULT_REVIEWER_ROLE_NAME)
+            return role;
+    }
+    return undefined;
+}
+/**
+ * Decide what to do with a null-role pending spawn directive.
+ *
+ * The layered fallback applies ONLY to review directives; a coding directive
+ * with a null role is the intended off-state and is always skipped. A review
+ * directive spawns under the fallback role when one resolves, else clears.
+ *
+ * Pure and exported for unit testing (peer of resolveReviewerFallbackRole).
+ */
+export function decideNullRoleSpawn(input) {
+    if (input.sessionType !== 'review')
+        return { action: 'skip' };
+    if (input.fallbackRole)
+        return { action: 'spawn', role: input.fallbackRole };
+    return { action: 'clear' };
+}
+//# sourceMappingURL=review-role-fallback.js.map

package/dist/spawn/review-role-fallback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-role-fallback.js","sourceRoot":"","sources":["../../src/spawn/review-role-fallback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CAAC;AAmBtD;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAA0B;IAE1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,0BAA0B;YAAE,OAAO,IAAI,CAAC;IAC5D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAGnC;IACC,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9D,IAAI,KAAK,CAAC,YAAY;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;IAC7E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}

package/dist/verification-engine.d.ts

@@ -26,7 +26,7 @@ import { runDeterministicStrategy, type StrategyResult } from './verification-de
 export { runDeterministicStrategy, type DeterministicLogContext } from './verification-deterministic.js';
 import { getPendingVerifications, type PendingVerification, type VerificationOutcome } from './queries/verification.js';
 import type { NodeWriteback } from './reality-writeback.js';
-import { type ReconcileTargetsResult, type TargetRestatement, type VerifyEvidence } from './verify-restatement.js';
+import { type ReconcileTargetsResult, type TargetRestatement, type TargetShortfall, type VerifyEvidence } from './verify-restatement.js';
 import { type FileEscalationInput } from './escalations.js';
 import type { DaemonConfig } from './types.js';
 import { type ResolvedDefaultVerification } from './verification-config.js';
@@ -125,8 +125,22 @@ export interface VerificationDeps {
     getFocusDeliveries: typeof getFocusDeliveries;
     /** Failed-run feedback (gate_state + live inject). Optional; defaultDeps provides it. */
     deliverFailureFeedback?: (v: PendingVerification, result: StrategyResult) => Promise<void>;
+    /**
+     * Shortfall-origin gate-hold feedback (gate_state under the shortfall guard +
+     * live inject describing the declared-vs-achieved gap). Distinct from
+     * deliverFailureFeedback so a shortfall hold never reports under the
+     * deterministic guard. Optional; defaultDeps provides it.
+     */
+    deliverShortfallFeedback?: (v: PendingVerification, shortfalls: readonly TargetShortfall[]) => Promise<void>;
     /** cwd for the HEAD run -- the focus worktree. Optional; dispatch falls back to resolveCwd. */
     resolveVerificationCwd?: (v: PendingVerification) => string;
+    /**
+     * Count of commits the delivery branch is ahead of the integration base.
+     * Used by the evidence-integrity guard to tell a broken diff MEASUREMENT
+     * (commits present but diff empty -> hold) from genuine inaction (no commits
+     * -> a real shortfall). Optional; defaultDeps resolves it in the focus worktree.
+     */
+    resolveCommitsAhead?: (v: PendingVerification) => number;
     /** Baseline-diff attribution; null => no baseline resolvable (gate all). Optional. */
     attributeFailures?: (v: PendingVerification, result: StrategyResult) => Promise<FailureClassification | null>;
 }

package/dist/verification-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verification-engine.d.ts","sourceRoot":"","sources":["../src/verification-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,wBAAwB,EAAE,KAAK,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,KAAK,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AACzG,OAAO,EACL,uBAAuB,EAIvB,KAAK,mBAAmB,EAExB,KAAK,mBAAmB,EACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE5D,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAEtB,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAA2C,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGrG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AASrE,OAAO,EAAgF,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAItJ,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,gCAAgC,EAChC,qBAAqB,EACrB,qBAAqB,EACrB,kCAAkC,EAClC,6BAA6B,EAC7B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,eAAe,IAAI,sBAAsB,EACzC,KAAK,gBAAgB,EACtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,4BAA4B,CAAC;AAYpC,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,cAAc,CAAC,CAKrE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,gBAAgB,EACtB,CAAC,EAAE,mBAAmB,GACrB,OAAO,CAAC,cAAc,GAAG;IAAE,UAAU,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAmB7D;AAMD,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE;QACX,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,IAAI,EAAE,kBAAkB,GAAG,UAAU,GAAG,aAAa,GAAG,kBAAkB,GAAG,gBAAgB,CAAC;QAC9F,QAAQ,EAAE,MAAM,CAAC;QACjB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,uBAAuB,EAAE,OAAO,uBAAuB,CAAC;IACxD,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF,eAAe,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,iBAAiB,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChG;;;;;;;;OAQG;IACH,wBAAwB,CAAC,EAAE,CACzB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,QAAQ,EAAE,cAAc,KACrB,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrC;;;;;OAKG;IACH,cAAc,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,uCAAuC;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,iBAAiB,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,eAAe,EAAE,CACf,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,SAAS,aAAa,EAAE,EACpC,aAAa,CAAC,EAAE,MAAM,KACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,gBAAgB,EAAE,OAAO,wBAAwB,CAAC;IAClD,eAAe,EAAE,OAAO,sBAAsB,CAAC;IAC/C,yBAAyB,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC1F,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,MAAM,CAAC;IACjD,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,mBAAmB,EAAE,uBAAuB,CAAC;IAE7C;;;;OAIG;IACH,0BAA0B,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,2BAA2B,CAAC;IAClF,+EAA+E;IAC/E,gBAAgB,EAAE,OAAO,gBAAgB,CAAC;IAC1C,mEAAmE;IACnE,kBAAkB,EAAE,OAAO,kBAAkB,CAAC;IAC9C,yFAAyF;IACzF,sBAAsB,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3F,+FAA+F;IAC/F,sBAAsB,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,MAAM,CAAC;IAC5D,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;CAC/G;AAyID;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,0BAA0B,CAC9C,CAAC,EAAE,mBAAmB,EACtB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,cAAc,CAAC,CA2LzB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,YAAY,EACpB,IAAI,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAC/B,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAwFlG"}
+{"version":3,"file":"verification-engine.d.ts","sourceRoot":"","sources":["../src/verification-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,wBAAwB,EAAE,KAAK,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,KAAK,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AACzG,OAAO,EACL,uBAAuB,EAIvB,KAAK,mBAAmB,EAExB,KAAK,mBAAmB,EACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE5D,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAA2C,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGrG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AASrE,OAAO,EAAgF,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAItJ,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,gCAAgC,EAChC,qBAAqB,EACrB,qBAAqB,EACrB,kCAAkC,EAClC,6BAA6B,EAC7B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,eAAe,IAAI,sBAAsB,EACzC,KAAK,gBAAgB,EACtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,4BAA4B,CAAC;AAYpC,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,cAAc,CAAC,CAKrE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,gBAAgB,EACtB,CAAC,EAAE,mBAAmB,GACrB,OAAO,CAAC,cAAc,GAAG;IAAE,UAAU,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAmB7D;AAMD,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE;QACX,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,IAAI,EAAE,kBAAkB,GAAG,UAAU,GAAG,aAAa,GAAG,kBAAkB,GAAG,gBAAgB,CAAC;QAC9F,QAAQ,EAAE,MAAM,CAAC;QACjB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,uBAAuB,EAAE,OAAO,uBAAuB,CAAC;IACxD,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF,eAAe,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,iBAAiB,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChG;;;;;;;;OAQG;IACH,wBAAwB,CAAC,EAAE,CACzB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,QAAQ,EAAE,cAAc,KACrB,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrC;;;;;OAKG;IACH,cAAc,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,uCAAuC;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,iBAAiB,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,eAAe,EAAE,CACf,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,SAAS,aAAa,EAAE,EACpC,aAAa,CAAC,EAAE,MAAM,KACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,gBAAgB,EAAE,OAAO,wBAAwB,CAAC;IAClD,eAAe,EAAE,OAAO,sBAAsB,CAAC;IAC/C,yBAAyB,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC1F,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,MAAM,CAAC;IACjD,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,mBAAmB,EAAE,uBAAuB,CAAC;IAE7C;;;;OAIG;IACH,0BAA0B,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,2BAA2B,CAAC;IAClF,+EAA+E;IAC/E,gBAAgB,EAAE,OAAO,gBAAgB,CAAC;IAC1C,mEAAmE;IACnE,kBAAkB,EAAE,OAAO,kBAAkB,CAAC;IAC9C,yFAAyF;IACzF,sBAAsB,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3F;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,EAAE,UAAU,EAAE,SAAS,eAAe,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7G,+FAA+F;IAC/F,sBAAsB,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,MAAM,CAAC;IAC5D;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,MAAM,CAAC;IACzD,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;CAC/G;AA0KD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,0BAA0B,CAC9C,CAAC,EAAE,mBAAmB,EACtB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,cAAc,CAAC,CAsOzB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,YAAY,EACpB,IAAI,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAC/B,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAwFlG"}

package/dist/verification-engine.js

@@ -28,12 +28,12 @@ import { getPendingVerifications, recordDeliveryVerificationOutcome, verifyInjec
 import { configForProduct } from './config.js';
 import { authorTargetRestatements as defaultAuthorTargetRestatements, } from './verify-restatement.js';
 import { fileEscalation as defaultFileEscalation } from './escalations.js';
-import { getGitDiff } from './assembly-resolvers.js';
+import { getGitDiff, getDiffStatSummary, getChangedFiles, getCommitsAhead } from './assembly-resolvers.js';
 import { ESCALATION_REASONS, ESCALATION_DISPOSITIONS } from '@telora/daemon-core';
 import { resolveDefaultVerification as defaultResolveDefaultVerification, } from './verification-config.js';
 import { getActiveFocuses, getFocusDeliveries } from './supabase.js';
 import { collectDefaultOnVerifications, markDefaultOnRan, resolveDaemonWideVerifyCap, resolveProductVerificationScopes, verificationSemaphore, } from './verification-default-on.js';
-import { deliverVerificationFailureFeedback } from './verification-feedback.js';
+import { deliverVerificationFailureFeedback, deliverShortfallFailureFeedback } from './verification-feedback.js';
 import { buildDefaultAttributeFailures, buildResolveVerificationCwd, applyAttribution } from './verification-baseline.js';
 // Re-export the default-on selection + concurrency surface so existing
 // importers (and tests) can reach it through verification-engine.
@@ -107,6 +107,7 @@ const defaultDeps = (config) => {
             return config.repoPath;
         return configForProduct(config, product).repoPath;
     };
+    const resolveVerificationCwd = buildResolveVerificationCwd(resolveCwd);
     return {
         getPendingVerifications,
         recordOutcome: recordDeliveryVerificationOutcome,
@@ -130,7 +131,9 @@ const defaultDeps = (config) => {
         getActiveFocuses,
         getFocusDeliveries,
         deliverFailureFeedback: (v, result) => deliverVerificationFailureFeedback(v, result, config.organizationId).then(() => undefined),
-        resolveVerificationCwd: buildResolveVerificationCwd(resolveCwd),
+        deliverShortfallFeedback: (v, shortfalls) => deliverShortfallFailureFeedback(v, shortfalls, config.organizationId).then(() => undefined),
+        resolveVerificationCwd,
+        resolveCommitsAhead: (v) => getCommitsAhead(resolveVerificationCwd(v), config.integrationBranch),
         attributeFailures: buildDefaultAttributeFailures(config),
     };
 };
@@ -139,6 +142,17 @@ const STRATEGIES = {
     behavioral: () => runBehavioralStrategy(),
     ai_inspection: (deps, v) => runAiInspectionStrategy(deps, v),
 };
+/**
+ * Resolve the cwd the delivery's diff must be read in: the FOCUS WORKTREE
+ * (HEAD of the focus branch), the SAME cwd the deterministic strategy runs in.
+ * NOT the product repo path -- the product repo's HEAD is the integration
+ * branch, so `git diff base...HEAD` there is empty even when the focus branch
+ * has real commits. Reading the diff in the wrong cwd is the resolution bug
+ * that manufactures a false-negative shortfall (2026-07-23 incident).
+ */
+function resolveDiffCwd(v, deps) {
+    return (deps.resolveVerificationCwd ?? ((pv) => deps.resolveCwd(pv.productId)))(v);
+}
 /**
  * Build the cited-evidence bundle the achieved-DE authoring consumes. Sourced
  * from the verification verdict (NOT the UDE problem text):
@@ -146,20 +160,36 @@ const STRATEGIES = {
  *   - deterministic: the check exit code + stdout/stderr tails, plus the diff
  *     against integration (fetched best-effort; an empty diff just yields less
  *     evidence, it never blocks).
+ *
+ * The raw diff is accompanied by STRUCTURED signals (changed-files list + diff
+ * stat) resolved in the same focus-worktree cwd, so delivered behavior is
+ * legible to the judge without parsing the full diff.
  */
 function buildVerifyEvidence(result, v, deps) {
+    const cwd = resolveDiffCwd(v, deps);
     let diff = result.deliveryDiff ?? '';
     if (diff === '') {
         try {
-            diff = getGitDiff(deps.resolveCwd(v.productId), deps.integrationBranch);
+            diff = getGitDiff(cwd, deps.integrationBranch);
         }
         catch (err) {
             // best-effort: no diff is fine, the other evidence slots still carry signal
             log.debug('best-effort: no diff is fine, the other evidence slots still carry signal', { error: String(err?.message ?? err) });
         }
     }
+    let changedFiles = [];
+    let diffStat = '';
+    try {
+        changedFiles = getChangedFiles(cwd, deps.integrationBranch);
+        diffStat = getDiffStatSummary(cwd, deps.integrationBranch);
+    }
+    catch (err) {
+        log.debug('best-effort: structured diff signals unavailable', { error: String(err?.message ?? err) });
+    }
     return {
         diff: diff || undefined,
+        changedFiles: changedFiles.length > 0 ? changedFiles : undefined,
+        diffStat: diffStat.trim() !== '' ? diffStat : undefined,
         testStdout: result.stdoutTail,
         testStderr: result.stderrTail,
         exitCode: result.exitCode,
@@ -173,7 +203,8 @@ function buildVerifyEvidence(result, v, deps) {
  * crash the tick (the gate is already held by the demoted 'failed' outcome).
  */
 async function escalateShortfalls(v, shortfalls, deps) {
-    const lines = shortfalls.map((s) => `- node ${s.nodeId}\n  declared: ${s.declaredStatement}\n  achieved: ${s.achievedStatement}\n  shortfall: ${s.reason}`);
+    const lines = shortfalls.map((s) => `- node ${s.nodeId}\n  declared: ${s.declaredStatement}\n  achieved: ${s.achievedStatement}\n  shortfall: ${s.reason}` +
+        (s.diffCitation ? `\n  diff citation: ${s.diffCitation}` : ''));
     try {
         await deps.fileEscalation({
             organizationId: deps.organizationId,
@@ -194,6 +225,7 @@ async function escalateShortfalls(v, shortfalls, deps) {
                     declared: s.declaredStatement,
                     achieved: s.achievedStatement,
                     reason: s.reason,
+                    ...(s.diffCitation ? { citation: s.diffCitation } : {}),
                 })),
             },
         });
@@ -245,6 +277,11 @@ export async function runVerificationForDelivery(v, deps) {
             log.warn(`[verification] baseline attribution failed for delivery ${v.deliveryId}:`, err.message);
         }
     }
+    // Shortfall-origin tracking: set when the reconciliation demotes a PASSED
+    // outcome to 'failed'. Feedback for a shortfall hold routes under its own
+    // guard (not deterministic_verification), so the origin must survive to the
+    // feedback dispatch below.
+    let shortfallHold = [];
     // Pass path FIRST so a verifyInjection failure short-circuits before we
     // record an outcome that does not match graph state.
     if (result.outcome === 'passed' && v.injectionNodeId) {
@@ -280,81 +317,117 @@ export async function runVerificationForDelivery(v, deps) {
             // declared DE. If ANY target falls short, we hold the gate (demote to
             // 'failed'), skip the flip, and escalate the gap to a human. Reality is
             // moved toward intent, never the reverse.
-            let restatements = [];
-            let shortfalls = [];
-            let realityTreeId;
-            if (deps.authorTargetRestatements) {
-                const evidence = buildVerifyEvidence(result, v, deps);
-                try {
-                    const reconciled = await deps.authorTargetRestatements(v.injectionNodeId, v.focusId, evidence);
-                    restatements = reconciled.restatements;
-                    shortfalls = reconciled.shortfalls;
-                    realityTreeId = reconciled.realityTreeId;
-                }
-                catch (err) {
-                    // A reconciliation we could not run at all is asymmetric-unsafe: do not
-                    // flip an injection whose achievement we could not verify. Treat the
-                    // whole injection as a shortfall and hold the gate.
-                    log.warn(`[verification] verify-time reconciliation failed for ${v.injectionNodeId}:`, err.message);
-                    shortfalls = [{
-                            nodeId: v.injectionNodeId,
-                            declaredStatement: '(unknown -- reconciliation failed)',
-                            achievedStatement: '(reconciliation failed)',
-                            reason: `Reconciliation failed: ${err.message}`,
-                        }];
-                }
-            }
-            if (shortfalls.length > 0) {
-                // Hold the gate, do NOT flip, escalate the declared-vs-achieved gap.
-                result.outcome = 'failed';
+            const evidence = buildVerifyEvidence(result, v, deps);
+            // Evidence-INTEGRITY guard (fail closed on a broken measurement): a
+            // delivery branch with commits ahead of the integration base MUST resolve
+            // to a non-empty diff. If it does not, the diff was resolved in the wrong
+            // range/worktree -- a broken MEASUREMENT, not a genuine shortfall. Hold the
+            // gate for retry ('pending') and NEVER author a shortfall or escalate from
+            // the remaining (non-diff) evidence. A genuine no-work delivery (no commits
+            // AND empty diff) is NOT held here -- it flows into reconciliation below and
+            // can still be classified a real shortfall.
+            const commitsAhead = deps.resolveCommitsAhead ? deps.resolveCommitsAhead(v) : 0;
+            const diffEmpty = !evidence.diff || evidence.diff.trim() === '';
+            if (commitsAhead > 0 && diffEmpty) {
+                result.outcome = 'pending';
                 result.rationale =
-                    `verify reconciliation found ${shortfalls.length} shortfall(s) vs declared intent; ` +
-                        `injection ${v.injectionNodeId} not flipped (escalated to human)`;
-                await escalateShortfalls(v, shortfalls, deps);
+                    `verify held: delivery branch is ${commitsAhead} commit(s) ahead of ` +
+                        `${deps.integrationBranch} but the resolved diff is empty -- broken diff ` +
+                        `measurement, not a shortfall; retrying (injection ${v.injectionNodeId} not flipped)`;
+                log.warn(`[verification] ${result.rationale} (delivery ${v.deliveryId})`);
             }
             else {
-                let flipped = false;
-                try {
-                    await deps.verifyInjection(v.injectionNodeId, restatements);
-                    flipped = true;
+                let restatements = [];
+                let shortfalls = [];
+                let realityTreeId;
+                if (deps.authorTargetRestatements) {
+                    try {
+                        const reconciled = await deps.authorTargetRestatements(v.injectionNodeId, v.focusId, evidence);
+                        restatements = reconciled.restatements;
+                        shortfalls = reconciled.shortfalls;
+                        realityTreeId = reconciled.realityTreeId;
+                    }
+                    catch (err) {
+                        // A reconciliation we could not run at all is asymmetric-unsafe: do not
+                        // flip an injection whose achievement we could not verify. Treat the
+                        // whole injection as a shortfall and hold the gate.
+                        log.warn(`[verification] verify-time reconciliation failed for ${v.injectionNodeId}:`, err.message);
+                        shortfalls = [{
+                                nodeId: v.injectionNodeId,
+                                declaredStatement: '(unknown -- reconciliation failed)',
+                                achievedStatement: '(reconciliation failed)',
+                                reason: `Reconciliation failed: ${err.message}`,
+                            }];
+                    }
                 }
-                catch (err) {
-                    result.outcome = 'pending';
-                    result.rationale = `verifyInjection failed for ${v.injectionNodeId}: ${err.message}`;
+                if (shortfalls.length > 0) {
+                    // Hold the gate, do NOT flip, escalate the declared-vs-achieved gap.
+                    shortfallHold = shortfalls;
+                    result.outcome = 'failed';
+                    result.rationale =
+                        `verify reconciliation found ${shortfalls.length} shortfall(s) vs declared intent; ` +
+                            `injection ${v.injectionNodeId} not flipped (escalated to human)`;
+                    await escalateShortfalls(v, shortfalls, deps);
                 }
-                // INWARD drift (TEL-3/TEL-4): any target the reconciliation stamped
-                // `legitimate_divergence` is a tree CLAIM reality contradicted. Surface
-                // each as an inward drift proposal -- AFTER the flip landed -- so a
-                // confident-but-wrong assertion is corrected by drift rather than
-                // frozen. observedState carries the tree's ORIGINAL claim (not the
-                // achieved reality); proposedCorrection carries what reality showed.
-                // Best-effort + non-fatal: a failure must not undo the verify flip.
-                if (flipped) {
-                    const divergedWritebacks = restatements
-                        .filter((r) => r.classification === 'legitimate_divergence')
-                        .map((r) => ({
-                        nodeId: r.nodeId,
-                        classification: 'legitimate_divergence',
-                        statement: r.statement,
-                        originalClaim: r.originalClaim,
-                        ...(r.divergenceReason ? { verifyDivergenceReason: r.divergenceReason } : {}),
-                    }));
-                    if (divergedWritebacks.length > 0) {
-                        try {
-                            await deps.emitInwardDrift(v.injectionNodeId, divergedWritebacks, realityTreeId);
-                        }
-                        catch (err) {
-                            log.warn(`[verification] inward drift emit failed for ${v.injectionNodeId}:`, err.message);
+                else {
+                    let flipped = false;
+                    try {
+                        await deps.verifyInjection(v.injectionNodeId, restatements);
+                        flipped = true;
+                    }
+                    catch (err) {
+                        result.outcome = 'pending';
+                        result.rationale = `verifyInjection failed for ${v.injectionNodeId}: ${err.message}`;
+                    }
+                    // INWARD drift (TEL-3/TEL-4): any target the reconciliation stamped
+                    // `legitimate_divergence` is a tree CLAIM reality contradicted. Surface
+                    // each as an inward drift proposal -- AFTER the flip landed -- so a
+                    // confident-but-wrong assertion is corrected by drift rather than
+                    // frozen. observedState carries the tree's ORIGINAL claim (not the
+                    // achieved reality); proposedCorrection carries what reality showed.
+                    // Best-effort + non-fatal: a failure must not undo the verify flip.
+                    if (flipped) {
+                        const divergedWritebacks = restatements
+                            .filter((r) => r.classification === 'legitimate_divergence')
+                            .map((r) => ({
+                            nodeId: r.nodeId,
+                            classification: 'legitimate_divergence',
+                            statement: r.statement,
+                            originalClaim: r.originalClaim,
+                            ...(r.divergenceReason ? { verifyDivergenceReason: r.divergenceReason } : {}),
+                        }));
+                        if (divergedWritebacks.length > 0) {
+                            try {
+                                await deps.emitInwardDrift(v.injectionNodeId, divergedWritebacks, realityTreeId);
+                            }
+                            catch (err) {
+                                log.warn(`[verification] inward drift emit failed for ${v.injectionNodeId}:`, err.message);
+                            }
                         }
                     }
                 }
-            }
+            } // end evidence-integrity else (measurement OK -> reconcile)
         }
     }
     await deps.recordOutcome(v.deliveryId, result.outcome);
-    // Failure feedback: on a failed deterministic run, write gate_state + inject
-    // into the live team. Best-effort -- never let feedback failure crash the tick.
-    if (result.outcome === 'failed' && v.verificationMethod === 'deterministic' && deps.deliverFailureFeedback) {
+    // Feedback dispatch by FAILURE ORIGIN (the two are mutually exclusive: a
+    // shortfall hold only demotes a PASSED outcome, so a deterministic-failed run
+    // never carries a shortfallHold).
+    //
+    // Shortfall-origin hold: report under the shortfall guard (never
+    // deterministic_verification) with the declared-vs-achieved detail, and inject
+    // a gap-framed message -- never "fix the failing tests". Independent of method.
+    if (shortfallHold.length > 0 && deps.deliverShortfallFeedback) {
+        try {
+            await deps.deliverShortfallFeedback(v, shortfallHold);
+        }
+        catch (err) {
+            log.warn(`[verification] shortfall feedback failed for delivery ${v.deliveryId}:`, err.message);
+        }
+    }
+    else if (result.outcome === 'failed' && v.verificationMethod === 'deterministic' && deps.deliverFailureFeedback) {
+        // Genuine deterministic failure (the shell command actually failed): write
+        // gate_state under deterministic_verification + inject. Best-effort.
         try {
             await deps.deliverFailureFeedback(v, result);
         }