@telora/daemon 0.22.160 → 0.22.181

package/dist/verify/judged-ancestor.js

@@ -0,0 +1,101 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/verify/judged-ancestor.test.ts
+// PINNED-BY-END
+/**
+ * The newest ancestor of a commit that a gate run already judged -- and, for the
+ * verify boundary, the newest one it judged GREEN.
+ *
+ * Two callers ask almost the same question of git and the per-commit verdict
+ * record (verify/commit-verdict-record.ts), so the walk lives here once:
+ *
+ *   - verify/no-own-delta-verdict.ts asks for the newest JUDGED ancestor, to
+ *     carry its verdict to a tip that adds nothing of the focus's own;
+ *   - verify/verification-boundary-env.ts asks for the newest ancestor judged
+ *     PASSING under the gate this run applies, to bound what the gate's own
+ *     stages diff against.
+ *
+ * WHY A GREEN ANCESTOR IS THE RIGHT BOUNDARY. The gate's two expensive stages --
+ * the conditional types-drift check and the targeted-test selection -- scope
+ * themselves from a diff base. Taking that base from merge-base(HEAD,
+ * integration) makes it the focus branch's CUMULATIVE delta, which only grows:
+ * every area eventually crosses the "no precise pin map" line and widens to its
+ * whole suite, so a per-delivery run ends up executing the daemon suite, the root
+ * vitest suite, the mcp suite, the scripts self-tests and the deno functions
+ * suite -- the last for a second time, having already run as the gate's first
+ * stage. Measured on mars 2026-09-20: 76 files/22 min, 102/42, 101/28, 115/30 for
+ * one delivery, against 5 min for a run with an empty delta.
+ *
+ * A green ancestor bounds it correctly rather than merely cheaply: everything up
+ * to that commit was covered by a gate run that PASSED on a tree containing it,
+ * so the delta from there is exactly what no green gate has covered. That is the
+ * same rigor the selector already operates at (its pin map plus its widen rules),
+ * applied to a smaller and more accurate input -- not a new approximation.
+ *
+ * Every failure is answered with null, and every caller reads null as "use the
+ * base you would have used anyway". A base that is too OLD costs time; one that
+ * is too NEW launders a pass. So the walk fails toward the older base, always:
+ * an unreadable worktree, an unreadable rev-list, a verdict recorded under
+ * another gate, and a FAILED verdict all decline to anchor.
+ *
+ * A leaf: git and the verdict reader, nothing else.
+ *
+ * @module verify/judged-ancestor
+ */
+import { runGitSync } from '../git/types.js';
+/** How many ancestors of the tip are searched for the newest judged one. */
+export const ANCESTOR_SEARCH_DEPTH = 200;
+export const defaultListAncestors = (worktreePath, tip, depth) => {
+    const r = runGitSync(['rev-list', '--topo-order', `--max-count=${depth}`, '--skip=1', tip], worktreePath);
+    if (!r.success)
+        return null;
+    return r.output.split('\n').map((l) => l.trim()).filter((l) => l !== '');
+};
+/**
+ * The newest ancestor of `tip` whose recorded verdict satisfies `accept`, with
+ * that verdict; null when none does, or when the ancestors are unreadable.
+ */
+export function findJudgedAncestor(productId, focusId, tip, gate, deps, accept = () => true) {
+    const ancestors = (deps.listAncestors ?? defaultListAncestors)(deps.worktreePath, tip, ANCESTOR_SEARCH_DEPTH);
+    if (!ancestors)
+        return null;
+    for (const sha of ancestors) {
+        const verdict = deps.readCommitVerdict(productId, focusId, sha, gate);
+        // A verdict under another gate reads as null here (the record is gate-keyed),
+        // so an unjudged ancestor and a differently-gated one are both simply walked
+        // past -- never taken as a boundary the gate did not actually establish.
+        if (verdict && accept(verdict))
+            return { sha, verdict };
+    }
+    return null;
+}
+/**
+ * The newest ancestor of `tip` this gate judged PASSING: the commit up to which
+ * the gate's stages need not look. Null when none is found, which every caller
+ * reads as "keep the base you already had".
+ *
+ * A FAILED verdict never anchors -- the walk continues past it to an older green
+ * one. A failure says the tree was bad there, not that anything was covered.
+ */
+export function findGreenAncestor(productId, focusId, tip, gate, deps) {
+    return findJudgedAncestor(productId, focusId, tip, gate, deps, (v) => v.outcome === 'passed')?.sha ?? null;
+}
+/**
+ * True when `maybeAncestor` is an ancestor of `descendant` (or the same commit).
+ * Undetermined (`null`) when git cannot answer.
+ *
+ * Ancestry, never commit dates: every coding spawn rebases the focus worktree
+ * (spawn/worktree-session.ts), so author and commit dates are shuffled relative
+ * to branch order and would rank the two bases wrongly.
+ */
+export function isAncestorOf(worktreePath, maybeAncestor, descendant) {
+    if (maybeAncestor === descendant)
+        return true;
+    const r = runGitSync(['merge-base', '--is-ancestor', maybeAncestor, descendant], worktreePath);
+    if (r.success)
+        return true;
+    // git exits 1 for "not an ancestor" and >1 for a real error; the runner
+    // collapses both to !success, so confirm the refs are readable before saying no.
+    const readable = [maybeAncestor, descendant].every((rev) => runGitSync(['rev-parse', '--verify', '--quiet', `${rev}^{commit}`], worktreePath).success);
+    return readable ? false : null;
+}
+//# sourceMappingURL=judged-ancestor.js.map

package/dist/verify/judged-ancestor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"judged-ancestor.js","sourceRoot":"","sources":["../../src/verify/judged-ancestor.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,gEAAgE;AAChE,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAKzC,MAAM,CAAC,MAAM,oBAAoB,GAAmB,CAAC,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;IAC/E,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,eAAe,KAAK,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;IAC1G,IAAI,CAAC,CAAC,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC3E,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAiB,EACjB,OAAe,EACf,GAAW,EACX,IAAuB,EACvB,IAAsG,EACtG,SAA8C,GAAG,EAAE,CAAC,IAAI;IAExD,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAC9G,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACtE,8EAA8E;QAC9E,6EAA6E;QAC7E,yEAAyE;QACzE,IAAI,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,OAAe,EACf,GAAW,EACX,IAAuB,EACvB,IAAsG;IAEtG,OAAO,kBAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC;AAC7G,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,YAAoB,EAAE,aAAqB,EAAE,UAAkB;IAC1F,IAAI,aAAa,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;IAC/F,IAAI,CAAC,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC3B,wEAAwE;IACxE,iFAAiF;IACjF,MAAM,QAAQ,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,KAAK,CAChD,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,GAAG,WAAW,CAAC,EAAE,YAAY,CAAC,CAAC,OAAO,CACnG,CAAC;IACF,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/verify/no-own-delta-verdict.d.ts

@@ -19,8 +19,13 @@
  * @module verify/no-own-delta-verdict
  */
 import { isForeignOnlyExtension } from '../git/focus-own-delta.js';
+import { type AncestorLister } from './judged-ancestor.js';
 import type { CommitVerdict, CommitVerdictGate, CommitVerdictReader } from './commit-verdict-record.js';
-/** How many ancestors of the tip are searched for the newest judged one. */
+/**
+ * How many ancestors of the tip are searched for the newest judged one. Kept as
+ * this module's name for the walk's depth, which now lives in
+ * verify/judged-ancestor.ts beside the walk itself.
+ */
 export declare const CARRIED_VERDICT_SEARCH_DEPTH = 200;
 /** The reads a carried verdict is resolved from. */
 export interface CarriedVerdictDeps {
@@ -31,7 +36,7 @@ export interface CarriedVerdictDeps {
     listFocusDeliveryIds: (focusId: string) => Promise<readonly string[]>;
     readCommitVerdict: CommitVerdictReader;
     /** Ancestors of `tip`, newest first, excluding `tip`; null when unreadable. */
-    listAncestors?: (worktreePath: string, tip: string, depth: number) => string[] | null;
+    listAncestors?: AncestorLister;
     isForeignOnlyExtension?: typeof isForeignOnlyExtension;
 }
 /** A verdict carried to `head`, and the judged commit it came from. */

package/dist/verify/no-own-delta-verdict.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"no-own-delta-verdict.d.ts","sourceRoot":"","sources":["../../src/verify/no-own-delta-verdict.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAExG,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAEhD,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,mBAAmB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACxD,qEAAqE;IACrE,oBAAoB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IACtE,iBAAiB,EAAE,mBAAmB,CAAC;IACvC,+EAA+E;IAC/E,aAAa,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,EAAE,GAAG,IAAI,CAAC;IACtF,sBAAsB,CAAC,EAAE,OAAO,sBAAsB,CAAC;CACxD;AAQD,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,aAAa,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,iBAAiB,EACvB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA8BhC"}
+{"version":3,"file":"no-own-delta-verdict.d.ts","sourceRoot":"","sources":["../../src/verify/no-own-delta-verdict.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAA6C,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtG,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAExG;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,MAAwB,CAAC;AAElE,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,mBAAmB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACxD,qEAAqE;IACrE,oBAAoB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IACtE,iBAAiB,EAAE,mBAAmB,CAAC;IACvC,+EAA+E;IAC/E,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B,sBAAsB,CAAC,EAAE,OAAO,sBAAsB,CAAC;CACxD;AAED,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,aAAa,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,iBAAiB,EACvB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA+BhC"}

package/dist/verify/no-own-delta-verdict.js

@@ -23,15 +23,13 @@
  * @module verify/no-own-delta-verdict
  */
 import { isForeignOnlyExtension } from '../git/focus-own-delta.js';
-import { runGitSync } from '../git/types.js';
-/** How many ancestors of the tip are searched for the newest judged one. */
-export const CARRIED_VERDICT_SEARCH_DEPTH = 200;
-function defaultListAncestors(worktreePath, tip, depth) {
-    const r = runGitSync(['rev-list', '--topo-order', `--max-count=${depth}`, '--skip=1', tip], worktreePath);
-    if (!r.success)
-        return null;
-    return r.output.split('\n').map((l) => l.trim()).filter((l) => l !== '');
-}
+import { ANCESTOR_SEARCH_DEPTH, findJudgedAncestor } from './judged-ancestor.js';
+/**
+ * How many ancestors of the tip are searched for the newest judged one. Kept as
+ * this module's name for the walk's depth, which now lives in
+ * verify/judged-ancestor.ts beside the walk itself.
+ */
+export const CARRIED_VERDICT_SEARCH_DEPTH = ANCESTOR_SEARCH_DEPTH;
 /**
  * The verdict `head` carries from its newest judged ancestor when it adds nothing
  * of the focus's own (module doc), or null.
@@ -40,15 +38,14 @@ export async function resolveCarriedVerdict(productId, focusId, head, gate, deps
     const worktreePath = deps.resolveWorktreePath(focusId);
     if (!worktreePath)
         return null;
-    const ancestors = (deps.listAncestors ?? defaultListAncestors)(worktreePath, head, CARRIED_VERDICT_SEARCH_DEPTH);
-    if (!ancestors)
-        return null;
-    const judged = ancestors.find((sha) => deps.readCommitVerdict(productId, focusId, sha, gate) !== null);
-    if (!judged)
-        return null;
-    const recorded = deps.readCommitVerdict(productId, focusId, judged, gate);
-    if (!recorded)
+    const found = findJudgedAncestor(productId, focusId, head, gate, {
+        worktreePath,
+        readCommitVerdict: deps.readCommitVerdict,
+        ...(deps.listAncestors ? { listAncestors: deps.listAncestors } : {}),
+    });
+    if (!found)
         return null;
+    const { sha: judged, verdict: recorded } = found;
     let ids;
     try {
         ids = await deps.listFocusDeliveryIds(focusId);

package/dist/verify/no-own-delta-verdict.js.map

@@ -1 +1 @@
-{"version":3,"file":"no-own-delta-verdict.js","sourceRoot":"","sources":["../../src/verify/no-own-delta-verdict.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,8FAA8F;AAC9F,mEAAmE;AACnE,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAehD,SAAS,oBAAoB,CAAC,YAAoB,EAAE,GAAW,EAAE,KAAa;IAC5E,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,eAAe,KAAK,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;IAC1G,IAAI,CAAC,CAAC,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC3E,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,OAAe,EACf,IAAY,EACZ,IAAuB,EACvB,IAAwB;IAExB,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,4BAA4B,CAAC,CAAC;IACjH,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IACvG,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC1E,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,GAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,sBAAsB,IAAI,sBAAsB,CAAC,CACzE,YAAY,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CACjE,CAAC;IACF,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,UAAU,GAAG,gBAAgB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,iEAAiE;UAClH,kDAAkD,CAAC;IACvD,OAAO;QACL,WAAW,EAAE,MAAM;QACnB,OAAO,EAAE;YACP,GAAG,QAAQ;YACX,GAAG,EAAE,IAAI;YACT,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,UAAU,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,UAAU;SACpF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"no-own-delta-verdict.js","sourceRoot":"","sources":["../../src/verify/no-own-delta-verdict.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,8FAA8F;AAC9F,mEAAmE;AACnE,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAuB,MAAM,sBAAsB,CAAC;AAGtG;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,qBAAqB,CAAC;AAqBlE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,OAAe,EACf,IAAY,EACZ,IAAuB,EACvB,IAAwB;IAExB,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE;QAC/D,YAAY;QACZ,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC,CAAC;IACH,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACjD,IAAI,GAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,sBAAsB,IAAI,sBAAsB,CAAC,CACzE,YAAY,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CACjE,CAAC;IACF,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,UAAU,GAAG,gBAAgB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,iEAAiE;UAClH,kDAAkD,CAAC;IACvD,OAAO;QACL,WAAW,EAAE,MAAM;QACnB,OAAO,EAAE;YACP,GAAG,QAAQ;YACX,GAAG,EAAE,IAAI;YACT,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,UAAU,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,UAAU;SACpF;KACF,CAAC;AACJ,CAAC"}

package/dist/verify/recorded-targets.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Report the targets a verify run did NOT hold its delivery to: named in the
+ * daemon log, and RECORDED on the delivery's gate_state, where an operator and a
+ * later pass can read them.
+ *
+ * An arm covers the effects the focus held when the human said go, and the verify
+ * reconciliation narrows what it judges to those (verify/verify-restatement.ts
+ * narrowToArmCoverage, over queries/arm-covered-targets.ts). A target added after
+ * the arm produces no shortfall, no hold and no re-work issue -- it waits for the
+ * next arm. That is the intended behaviour, but an intended silence and an
+ * accidental one read identically: a gate that sets work aside without recording
+ * it is indistinguishable from a gate that never saw the work. So the set is
+ * stated at the same altitude as the verdict (the log) AND kept where the verdict
+ * is kept (the delivery row), because a log line does not survive the run and
+ * cannot be read by the next pass.
+ *
+ * WHEN THE WRITE HAPPENS. Last, after the run's own gate_state writers have
+ * settled (the shortfall hold, the evidence-unavailable re-work, the
+ * deterministic failure feedback, and the pass's history reset all rewrite the
+ * gate). Writing earlier would hand those writers a gate_state they did not read
+ * this record from, and the record would be dropped by the very run that made it.
+ * Written last, it stamps ONLY its own key over the FRESH row in the delivery's
+ * serialized write turn (queries/deliveries.ts
+ * rewriteDeliveryGateStateAtOwnStatus), at the row's own status, so it never
+ * moves a delivery and never erases what those writers left.
+ *
+ * WHAT CHANGES IT. Only a reconciliation's own result: a run that reconciled
+ * records what it set aside, or removes a record it no longer sets aside (the
+ * next arm covered those targets, so a standing record would lie). A run that
+ * never reconciled -- a deterministic failure, a security-gate demotion, a
+ * delivery that left verify -- leaves the record exactly as it stands: it learned
+ * nothing about coverage, and silence is not an answer.
+ *
+ * Its lifetime is the gate's. It is a record of THIS gate, so it clears with the
+ * rest of gate_state when the delivery finally routes -- the same lifetime as the
+ * verdict it qualifies.
+ *
+ * @module verify/recorded-targets
+ */
+import { type DeliveryGateRowIo, type DeliveryGateState } from '../queries/deliveries.js';
+import { type RecordedTargetsRecord } from '../queries/recorded-targets-record.js';
+/** The delivery a verify run is reporting about, and the injection it verified. */
+export interface RecordedTargetsSubject {
+    deliveryId: string;
+    injectionNodeId: string | null;
+}
+/** Injected row IO for the durable write (the real row read and physical write by default). */
+export interface RecordedTargetsWriteDeps extends DeliveryGateRowIo {
+    now: () => string;
+}
+/**
+ * Persist a verify run's set-aside targets on its delivery's gate_state
+ * (verify/recorded-targets.ts). Bound in defaultDeps; a test may bind its own.
+ */
+export type RecordedTargetsPersist = (deliveryId: string, injectionNodeId: string | null, nodeIds: string[]) => Promise<unknown>;
+/** The recorded-targets record `gateState` carries; null when absent or malformed. Pure. */
+export declare function readRecordedTargets(gateState: unknown): RecordedTargetsRecord | null;
+/**
+ * `gateState` with its recorded targets REPLACED: set to `recorded` when the run
+ * set targets aside, removed when it set none aside, so a stale set never stands
+ * for a newer run. Every other key is untouched, and a gate left holding nothing
+ * is null. A record stamped on a null gate_state rides beside an EMPTY `blocking`
+ * array, like carried history, so it is never read as a live block. Pure.
+ */
+export declare function stampRecordedTargets(gateState: unknown, recorded: RecordedTargetsRecord | null): DeliveryGateState | null;
+/**
+ * Record on the delivery's gate_state the targets its verify run set aside --
+ * `nodeIds`, of the injection `injectionNodeId` -- or REMOVE the standing record
+ * when the run set none aside.
+ *
+ * Reads the row FRESH and writes it at the row's OWN status inside one serialized
+ * write turn (see the module header), so the gate-only write never moves the
+ * delivery and never carries a stale copy of what another writer left. Nothing is
+ * written when the record would not change, when there is no record to remove, or
+ * for a delivery that is not found, done or cancelled. Best-effort: never throws
+ * -- a record that failed to land holds nothing and is written by the next run.
+ * Returns whether a write landed.
+ */
+export declare function persistRecordedTargets(deliveryId: string, injectionNodeId: string | null, nodeIds: readonly string[], deps?: Partial<RecordedTargetsWriteDeps>): Promise<boolean>;
+/**
+ * Name the targets the arm did NOT cover, so narrowing what verify judges never
+ * looks like losing track of it.
+ *
+ * Targets recorded after the arm produce no shortfall, no hold and no re-work
+ * issue -- they wait for the next arm. That is the intended behaviour, but an
+ * intended silence and an accidental one read identically in a log, so the
+ * reconciliation reports the set and this states it at the same altitude as the
+ * verdict.
+ */
+export declare function logRecordedTargets(v: RecordedTargetsSubject, recordedTargetNodeIds: readonly string[]): void;
+/**
+ * Report a verify run's set-aside targets: state them in the log, then record
+ * them on the delivery (see the module header).
+ *
+ * `recordedTargetNodeIds` is null when NO reconciliation ran, and the record is
+ * then left exactly as it stands -- this run learned nothing about coverage. An
+ * empty array is an answer: the run reconciled and set nothing aside, so a
+ * standing record is removed. `persist` is the durable writer; absent, the set is
+ * logged only (defaultDeps binds persistRecordedTargets). Best-effort: never
+ * throws, so reporting never demotes a rendered verdict.
+ */
+export declare function reportRecordedTargets(v: RecordedTargetsSubject, recordedTargetNodeIds: string[] | null, persist?: RecordedTargetsPersist): Promise<void>;
+//# sourceMappingURL=recorded-targets.d.ts.map

package/dist/verify/recorded-targets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recorded-targets.d.ts","sourceRoot":"","sources":["../../src/verify/recorded-targets.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAwB,KAAK,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAKzG,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,+FAA+F;AAC/F,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,GAAG,EAAE,MAAM,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACnC,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,GAAG,IAAI,EAC9B,OAAO,EAAE,MAAM,EAAE,KACd,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,4FAA4F;AAC5F,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,OAAO,GAAG,qBAAqB,GAAG,IAAI,CAKpF;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,OAAO,EAClB,QAAQ,EAAE,qBAAqB,GAAG,IAAI,GACrC,iBAAiB,GAAG,IAAI,CAW1B;AAcD;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,GAAG,IAAI,EAC9B,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,IAAI,GAAE,OAAO,CAAC,wBAAwB,CAAM,GAC3C,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,CAAC,EAAE,sBAAsB,EACzB,qBAAqB,EAAE,SAAS,MAAM,EAAE,GACvC,IAAI,CAON;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,CAAC,EAAE,sBAAsB,EACzB,qBAAqB,EAAE,MAAM,EAAE,GAAG,IAAI,EACtC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAYf"}

package/dist/verify/recorded-targets.js

@@ -0,0 +1,159 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/queries/delivery-gate-record-wire-parity.test.ts,
+//   packages/daemon/src/verify/recorded-targets.test.ts,
+//   packages/daemon/src/verify/verification-deps-default.test.ts
+// PINNED-BY-END
+/**
+ * Report the targets a verify run did NOT hold its delivery to: named in the
+ * daemon log, and RECORDED on the delivery's gate_state, where an operator and a
+ * later pass can read them.
+ *
+ * An arm covers the effects the focus held when the human said go, and the verify
+ * reconciliation narrows what it judges to those (verify/verify-restatement.ts
+ * narrowToArmCoverage, over queries/arm-covered-targets.ts). A target added after
+ * the arm produces no shortfall, no hold and no re-work issue -- it waits for the
+ * next arm. That is the intended behaviour, but an intended silence and an
+ * accidental one read identically: a gate that sets work aside without recording
+ * it is indistinguishable from a gate that never saw the work. So the set is
+ * stated at the same altitude as the verdict (the log) AND kept where the verdict
+ * is kept (the delivery row), because a log line does not survive the run and
+ * cannot be read by the next pass.
+ *
+ * WHEN THE WRITE HAPPENS. Last, after the run's own gate_state writers have
+ * settled (the shortfall hold, the evidence-unavailable re-work, the
+ * deterministic failure feedback, and the pass's history reset all rewrite the
+ * gate). Writing earlier would hand those writers a gate_state they did not read
+ * this record from, and the record would be dropped by the very run that made it.
+ * Written last, it stamps ONLY its own key over the FRESH row in the delivery's
+ * serialized write turn (queries/deliveries.ts
+ * rewriteDeliveryGateStateAtOwnStatus), at the row's own status, so it never
+ * moves a delivery and never erases what those writers left.
+ *
+ * WHAT CHANGES IT. Only a reconciliation's own result: a run that reconciled
+ * records what it set aside, or removes a record it no longer sets aside (the
+ * next arm covered those targets, so a standing record would lie). A run that
+ * never reconciled -- a deterministic failure, a security-gate demotion, a
+ * delivery that left verify -- leaves the record exactly as it stands: it learned
+ * nothing about coverage, and silence is not an answer.
+ *
+ * Its lifetime is the gate's. It is a record of THIS gate, so it clears with the
+ * rest of gate_state when the delivery finally routes -- the same lifetime as the
+ * verdict it qualifies.
+ *
+ * @module verify/recorded-targets
+ */
+import { rewriteDeliveryGateStateAtOwnStatus, } from '../queries/deliveries.js';
+import { isEmptyClear } from '../queries/delivery-gate-state.js';
+import { parseRecordedTargets } from '../queries/recorded-targets-record.js';
+import { createLogger } from '../shell/log.js';
+const log = createLogger({ module: 'verification' });
+/** The recorded-targets record `gateState` carries; null when absent or malformed. Pure. */
+export function readRecordedTargets(gateState) {
+    const gate = gateState != null && typeof gateState === 'object' && !Array.isArray(gateState)
+        ? gateState
+        : null;
+    return parseRecordedTargets(gate?.recordedTargets);
+}
+/**
+ * `gateState` with its recorded targets REPLACED: set to `recorded` when the run
+ * set targets aside, removed when it set none aside, so a stale set never stands
+ * for a newer run. Every other key is untouched, and a gate left holding nothing
+ * is null. A record stamped on a null gate_state rides beside an EMPTY `blocking`
+ * array, like carried history, so it is never read as a live block. Pure.
+ */
+export function stampRecordedTargets(gateState, recorded) {
+    const gate = gateState != null && typeof gateState === 'object' && !Array.isArray(gateState)
+        ? gateState
+        : null;
+    let next;
+    if (gate)
+        next = { ...gate };
+    else if (recorded)
+        next = { blocking: [], warnings: [], evaluatedAt: recorded.recordedAt };
+    else
+        return null;
+    delete next.recordedTargets;
+    if (recorded)
+        next.recordedTargets = recorded;
+    return isEmptyClear(next) ? null : next;
+}
+/** Whether a standing record already states exactly this run's set-aside targets. Pure. */
+function alreadyRecorded(standing, injectionNodeId, nodeIds) {
+    return standing !== null
+        && standing.injectionNodeId === injectionNodeId
+        && standing.nodeIds.length === nodeIds.length
+        && standing.nodeIds.every((id, i) => id === nodeIds[i]);
+}
+/**
+ * Record on the delivery's gate_state the targets its verify run set aside --
+ * `nodeIds`, of the injection `injectionNodeId` -- or REMOVE the standing record
+ * when the run set none aside.
+ *
+ * Reads the row FRESH and writes it at the row's OWN status inside one serialized
+ * write turn (see the module header), so the gate-only write never moves the
+ * delivery and never carries a stale copy of what another writer left. Nothing is
+ * written when the record would not change, when there is no record to remove, or
+ * for a delivery that is not found, done or cancelled. Best-effort: never throws
+ * -- a record that failed to land holds nothing and is written by the next run.
+ * Returns whether a write landed.
+ */
+export async function persistRecordedTargets(deliveryId, injectionNodeId, nodeIds, deps = {}) {
+    const now = deps.now ?? (() => new Date().toISOString());
+    try {
+        const written = await rewriteDeliveryGateStateAtOwnStatus(deliveryId, (row) => {
+            const standing = readRecordedTargets(row.gateState);
+            if (nodeIds.length === 0)
+                return standing ? stampRecordedTargets(row.gateState, null) : undefined;
+            if (alreadyRecorded(standing, injectionNodeId, nodeIds))
+                return undefined;
+            return stampRecordedTargets(row.gateState, { injectionNodeId, nodeIds: [...nodeIds], recordedAt: now() });
+        }, { io: deps });
+        return written === 'written';
+    }
+    catch (err) {
+        log.warn(`[verification] failed to record the targets the arm did not cover for delivery ${deliveryId}:`, err.message);
+        return false;
+    }
+}
+/**
+ * Name the targets the arm did NOT cover, so narrowing what verify judges never
+ * looks like losing track of it.
+ *
+ * Targets recorded after the arm produce no shortfall, no hold and no re-work
+ * issue -- they wait for the next arm. That is the intended behaviour, but an
+ * intended silence and an accidental one read identically in a log, so the
+ * reconciliation reports the set and this states it at the same altitude as the
+ * verdict.
+ */
+export function logRecordedTargets(v, recordedTargetNodeIds) {
+    if (recordedTargetNodeIds.length === 0)
+        return;
+    log.info(`[verification] injection ${v.injectionNodeId} carries ${recordedTargetNodeIds.length} ` +
+        `target(s) the focus's arm did not cover -- recorded, not judged, and not held against ` +
+        `delivery ${v.deliveryId}; they run on the next arm: ${recordedTargetNodeIds.join(', ')}`);
+}
+/**
+ * Report a verify run's set-aside targets: state them in the log, then record
+ * them on the delivery (see the module header).
+ *
+ * `recordedTargetNodeIds` is null when NO reconciliation ran, and the record is
+ * then left exactly as it stands -- this run learned nothing about coverage. An
+ * empty array is an answer: the run reconciled and set nothing aside, so a
+ * standing record is removed. `persist` is the durable writer; absent, the set is
+ * logged only (defaultDeps binds persistRecordedTargets). Best-effort: never
+ * throws, so reporting never demotes a rendered verdict.
+ */
+export async function reportRecordedTargets(v, recordedTargetNodeIds, persist) {
+    if (recordedTargetNodeIds === null)
+        return;
+    logRecordedTargets(v, recordedTargetNodeIds);
+    if (!persist)
+        return;
+    try {
+        await persist(v.deliveryId, v.injectionNodeId, recordedTargetNodeIds);
+    }
+    catch (err) {
+        log.warn(`[verification] failed to report the targets the arm did not cover for delivery ${v.deliveryId}:`, err.message);
+    }
+}
+//# sourceMappingURL=recorded-targets.js.map

package/dist/verify/recorded-targets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recorded-targets.js","sourceRoot":"","sources":["../../src/verify/recorded-targets.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,mFAAmF;AACnF,yDAAyD;AACzD,iEAAiE;AACjE,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EACL,mCAAmC,GAGpC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAA8B,MAAM,uCAAuC,CAAC;AACzG,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAuBrD,4FAA4F;AAC5F,MAAM,UAAU,mBAAmB,CAAC,SAAkB;IACpD,MAAM,IAAI,GAAG,SAAS,IAAI,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1F,CAAC,CAAE,SAA2C;QAC9C,CAAC,CAAC,IAAI,CAAC;IACT,OAAO,oBAAoB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAkB,EAClB,QAAsC;IAEtC,MAAM,IAAI,GAAG,SAAS,IAAI,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1F,CAAC,CAAE,SAA+B;QAClC,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,IAAuB,CAAC;IAC5B,IAAI,IAAI;QAAE,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;SACxB,IAAI,QAAQ;QAAE,IAAI,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;;QACtF,OAAO,IAAI,CAAC;IACjB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC5B,IAAI,QAAQ;QAAE,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC;IAC9C,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,2FAA2F;AAC3F,SAAS,eAAe,CACtB,QAAsC,EACtC,eAA8B,EAC9B,OAA0B;IAE1B,OAAO,QAAQ,KAAK,IAAI;WACnB,QAAQ,CAAC,eAAe,KAAK,eAAe;WAC5C,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;WAC1C,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB,EAClB,eAA8B,EAC9B,OAA0B,EAC1B,OAA0C,EAAE;IAE5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YAC5E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,IAAI,eAAe,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC1E,OAAO,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5G,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACjB,OAAO,OAAO,KAAK,SAAS,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,kFAAkF,UAAU,GAAG,EAC9F,GAAa,CAAC,OAAO,CACvB,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,CAAyB,EACzB,qBAAwC;IAExC,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/C,GAAG,CAAC,IAAI,CACN,4BAA4B,CAAC,CAAC,eAAe,YAAY,qBAAqB,CAAC,MAAM,GAAG;QACxF,wFAAwF;QACxF,YAAY,CAAC,CAAC,UAAU,+BAA+B,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,CAAyB,EACzB,qBAAsC,EACtC,OAAgC;IAEhC,IAAI,qBAAqB,KAAK,IAAI;QAAE,OAAO;IAC3C,kBAAkB,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,kFAAkF,CAAC,CAAC,UAAU,GAAG,EAChG,GAAa,CAAC,OAAO,CACvB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/verify/rework-attribution.d.ts

@@ -0,0 +1,71 @@
+import { type ReviewWindowCommit } from '../resolvers/shared/review-window-commits.js';
+import { findGreenAncestor } from './judged-ancestor.js';
+import { type CommitVerdict, type CommitVerdictGate } from './commit-verdict-record.js';
+/** Injectable seams; each defaults to the real read. */
+export interface ReworkAttributionDeps {
+    /** The focus worktree the failed commit was judged in; null when the daemon holds none. */
+    resolveWorktreePath: (focusId: string) => string | null;
+    /** The verdict recorded for a commit; without a gate, the newest under any gate (which carries its own). */
+    readCommitVerdict: (productId: string, focusId: string, sha: string, gate?: CommitVerdictGate) => CommitVerdict | null;
+    /** The newest ancestor of `tip` this gate judged PASSING (verify/judged-ancestor.ts). */
+    findGreenAncestor: typeof findGreenAncestor;
+    /** The non-merge commits in base..tip with their trailer attribution; null when git could not answer. */
+    listWindow: (worktreePath: string, base: string, tip: string) => readonly ReviewWindowCommit[] | null;
+    /**
+     * The focus's deliveries sitting in verify -- the candidate set an unattributable
+     * failure is settled over, so a pass that was handed one delivery can still ask the
+     * focus-wide question (module doc).
+     */
+    listVerifyCandidates: (focusId: string) => Promise<readonly string[]>;
+}
+export declare const defaultReworkAttributionDeps: () => ReworkAttributionDeps;
+/** The focus commit whose failure is being attributed. */
+export interface FailedCommit {
+    productId: string;
+    focusId: string;
+    /** The commit the gate failed on. */
+    sha: string;
+}
+/** Who owns a failed verdict, and how that was decided. */
+export interface FailureOwnership {
+    /** The deliveries whose own commits are in the judged range; empty when none is attributable. */
+    causingDeliveryIds: ReadonlySet<string>;
+    /** Those deliveries in range order, NEWEST COMMIT FIRST -- the ranking the owner is taken from. */
+    causingNewestFirst: readonly string[];
+    /** The delivery whose dispatch ran the gate -- the owner when nothing is attributable. */
+    judgedDeliveryId: string;
+    /** The ONE delivery this failure's rework belongs on: the newest causing commit's, else the judged one. */
+    owningDeliveryId: string;
+    /** False when the range could not be read at all (git or the green ancestor); the fallback then decides alone. */
+    rangeRead: boolean;
+}
+/**
+ * Who a failed verdict belongs to (module doc), or null when its verdict cannot be
+ * read -- the one answer that means "cannot tell". Never throws.
+ */
+export declare function resolveFailureOwnership(at: FailedCommit, deps?: ReworkAttributionDeps): FailureOwnership | null;
+/**
+ * The ONE delivery a failed verdict's rework belongs on, chosen from the
+ * `candidates` a filing pass would otherwise fan out over (module doc). Null means
+ * "cannot tell" -- the verdict itself was unreadable or is not a failure -- and the
+ * caller files as it did before. Never throws.
+ */
+export declare function selectReworkOwner(candidates: readonly string[], at: FailedCommit, deps?: ReworkAttributionDeps): string | null;
+/**
+ * Rung 3: the owner of a failure NOTHING attributes, over the candidates that could
+ * carry it. The lowest id -- arbitrary on purpose, and a pure function of the set, so
+ * a sibling, a later poll, a restarted daemon and the per-focus filer all name the
+ * same one delivery. Null only when there is no candidate at all.
+ */
+export declare function unattributableOwner(candidates: readonly string[]): string | null;
+/**
+ * Whether the rework Bug for `failedSha` belongs on `deliveryId` (module doc): it is
+ * the ONE owner the range names -- the delivery of the newest commit in it, or, with
+ * nothing attributable there, the delivery whose dispatch ran the gate. An unreadable
+ * verdict names no owner from the commit, so the question is asked of the FOCUS
+ * instead: the candidate set settles it by rung 3, identically for every asker and
+ * across a restart. A candidate read that fails files nothing this poll (the retry
+ * owns that case). Never throws.
+ */
+export declare function deliveryOwnsFailure(deliveryId: string, at: FailedCommit, deps?: ReworkAttributionDeps): Promise<boolean>;
+//# sourceMappingURL=rework-attribution.d.ts.map

package/dist/verify/rework-attribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rework-attribution.d.ts","sourceRoot":"","sources":["../../src/verify/rework-attribution.ts"],"names":[],"mappings":"AAsGA,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAChH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAqB,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAK3G,wDAAwD;AACxD,MAAM,WAAW,qBAAqB;IACpC,2FAA2F;IAC3F,mBAAmB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACxD,4GAA4G;IAC5G,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,KAAK,aAAa,GAAG,IAAI,CAAC;IACvH,yFAAyF;IACzF,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;IAC5C,yGAAyG;IACzG,UAAU,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,SAAS,kBAAkB,EAAE,GAAG,IAAI,CAAC;IACtG;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CACvE;AAED,eAAO,MAAM,4BAA4B,QAAO,qBAQ9C,CAAC;AAEH,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,iGAAiG;IACjG,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,mGAAmG;IACnG,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,0FAA0F;IAC1F,gBAAgB,EAAE,MAAM,CAAC;IACzB,2GAA2G;IAC3G,gBAAgB,EAAE,MAAM,CAAC;IACzB,kHAAkH;IAClH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,YAAY,EAChB,IAAI,GAAE,qBAAsD,GAC3D,gBAAgB,GAAG,IAAI,CAkBzB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,EAAE,EAAE,YAAY,EAChB,IAAI,GAAE,qBAAsD,GAC3D,MAAM,GAAG,IAAI,CAoBf;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAIhF;AA4BD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,YAAY,EAChB,IAAI,GAAE,qBAAsD,GAC3D,OAAO,CAAC,OAAO,CAAC,CAiBlB"}