@telora/daemon 0.22.208 → 0.22.226

package/dist/verify/commit-verdict-pull.js

@@ -1,6 +1,8 @@
 // PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
 // Pinned by: packages/daemon/src/integration/held-route-pull-dispatch.test.ts,
-//   packages/daemon/src/verify/commit-verdict-pull.test.ts
+//   packages/daemon/src/verify/commit-verdict-pull.test.ts,
+//   packages/daemon/src/verify/reselection-log.test.ts,
+//   packages/daemon/src/verify/verification-default-on.test.ts
 // PINNED-BY-END
 /**
  * A held route PULLS the gate run for the commit it awaits.
@@ -39,22 +41,72 @@
  *     asks again next poll. Pulling a run for an unknown commit would judge
  *     whatever HEAD happens to be.
  *   - **No second run.** Not while a run that may judge the commit is selected or
- *     in flight (verify/gate-run-registry.ts), and at most once per (delivery,
- *     sha) in this process. A dispatch that renders nothing releases its own run
- *     mark and records no pass, so the scan selects the delivery again on its own
- *     -- the pull mark suppresses nothing that would otherwise run.
+ *     in flight (verify/gate-run-registry.ts), and once per (delivery, sha) in
+ *     this process until the verdict reads back (next rule). A dispatch that
+ *     renders nothing records no pass, and ordinarily releases its own run mark,
+ *     so the scan selects the delivery again on its own -- the pull mark
+ *     suppresses nothing that would otherwise run. The exception is a
+ *     checkout- or model-unavailable attempt on a STANDING park: it keeps a run
+ *     mark naming no commit (verify/default-on-guards.ts noteDefaultOnResult
+ *     declines that un-mark), so nothing else re-selects it -- and the next rule
+ *     is what recognises that settled attempt and pulls again.
+ *   - **A pull is not spent until its verdict reads back.** The per-commit record
+ *     write is BEST-EFFORT (verify/commit-verdict-record.ts writeCommitVerdict
+ *     returns false and the recorder discards it), so the run a pull caused can
+ *     render on the held sha and still leave the release reading 'pending'. A
+ *     commit already pulled for is pulled AGAIN once the attempt it caused has
+ *     SETTLED -- a run mark exists again (a dispatch was attempted) and the
+ *     gate-run registry holds no run selected or in flight -- and the release
+ *     pass's own read (below) still returns a readable 'pending'. Two settled
+ *     outcomes qualify, and the re-pull's log line names which one it saw: a
+ *     run that JUDGED the held sha (its mark names it) whose write did not land,
+ *     and an attempt that RENDERED NOTHING (its mark names no commit) -- a
+ *     checkout-less retry on a standing park, whose preserved mark is the only
+ *     trace it ran; requiring the mark to name the sha would strand the route
+ *     there. 'passed' is answered;
+ *     'failed' is the gate's answer; an unreadable read waits for the next scan
+ *     rather than paying a run on an unknown. Each re-pull costs one run and
+ *     only after the previous one ended, so a store that stays down costs one
+ *     run per scan, and a store that recovers is written by the next one.
  *   - **The failure guard stays authoritative.** Only the run mark and the
  *     recorded PASS are dropped. A recorded failure at the held commit means the
  *     gate already answered; verification feedback routes the delivery to
  *     verify_failed, and re-running the same commit would answer the same way.
  *
- * What it deliberately does NOT do: ask whether a verdict for the sha already
- * exists. That question needs the delivery's CommitVerdictGate resolved
- * (verify/commit-gate-configured.ts, async and config-reading) inside an
- * otherwise cheap scan seam, and it would duplicate a rule that already has one
- * home -- verify/verification-commit-sharing.ts reuses a recorded verdict instead
- * of running the gate, so a pull whose commit is already judged costs one
- * dispatch that reuses and routes, not a suite. Same shape as credit-rearm.ts.
+ *   - **A parked delivery at the held commit is not pulled -- when the verdict
+ *     is READABLE.** The pull DECLINES, and says so, only when all three hold:
+ *     this process already judged the delivery ON the held sha (its run mark
+ *     names it); the shortfall park that judgement left stands on an unchanged
+ *     commit set and unchanged rulings (verify/parked-shortfall-reuse.ts
+ *     parkHoldsOnUnchangedFacts); and the release pass's OWN verdict read
+ *     (readHeldCommitVerdictState -- completion/review-exit-verdict-gate.ts
+ *     readGateVerdictState, the read completion/commit-verdict-release.ts
+ *     releases on) returns 'passed' for that sha. Then a re-selection is neither
+ *     a new ruling nor a new commit and is not needed: the release replays from
+ *     the record with no run.
+ *
+ *     The third condition is not implied by the first two. The per-commit
+ *     record write is BEST-EFFORT (verify/commit-verdict-record.ts
+ *     writeCommitVerdict returns false and the recorder discards it), so a
+ *     passing run can park a delivery while leaving no verdict behind. Declining
+ *     there would leave the release reading 'pending' forever -- a wedge. So the
+ *     pull asks the reader the release asks, and anything but 'passed' pulls:
+ *     the run it causes writes the record again. A mark on another commit, no
+ *     mark (a restart), no product id, no reader, or any unknown fact pulls as
+ *     before -- this may only remove a pull it can prove is pointless.
+ *
+ * THE VERDICT READ, and what it is not. Two rules above -- the park decline and
+ * the re-pull -- ask the release pass's OWN verdict reader
+ * (readHeldCommitVerdictState: completion/review-exit-verdict-gate.ts
+ * readGateVerdictState over the delivery's resolved CommitVerdictGate,
+ * verify/commit-gate-configured.ts), and they ask it only for a delivery this
+ * process already dispatched for the held sha. They ask whether the route's wait is
+ * OVER, never whether a run may be skipped: a first pull on a commit is not
+ * declined because a verdict exists -- only where the park ALSO stands on
+ * unchanged facts, so a re-selection could change nothing. Reusing a recorded verdict instead
+ * of running the gate has one home -- verify/verification-commit-sharing.ts --
+ * so a pull whose commit is already judged costs one dispatch that reuses and
+ * routes, not a suite. Same shape as credit-rearm.ts.
  *
  * Wrapper shape follows the two existing re-arm seams (verify/credit-rearm.ts
  * withCreditRearm, verify/shortfall-rulings.ts withShortfallRulingRearm): wrap the
@@ -67,16 +119,80 @@ import { DELIVERY_STATUS } from '@telora/daemon-core';
 import { readCommitVerdictHold } from '../delivery/commit-verdict-hold.js';
 import { hasPendingGateRun, isGateRunSelected } from './gate-run-registry.js';
 import { defaultResolveFocusHeadSha } from './verification-default-on.js';
-import { forgetRecordedPass, releaseDefaultOnMark } from './default-on-guards.js';
+import { forgetRecordedPass, hasDefaultOnRunMark, judgedShaOfRunMark, releaseDefaultOnMark } from './default-on-guards.js';
+import { parkHoldsOnUnchangedFacts } from './parked-shortfall-reuse.js';
+import { logReselection } from './reselection-log.js';
 import { createLogger } from '../shell/log.js';
 const log = createLogger({ module: 'verification' });
 const defaultPullDeps = {
     resolveFocusHeadSha: defaultResolveFocusHeadSha,
     hasPendingGateRun,
     isGateRunSelected,
-    releaseRunMark: releaseDefaultOnMark,
+    // Names itself, so the guard's fallback line does not also speak: the pull's own
+    // line below is the one that says why (verify/reselection-log.ts).
+    releaseRunMark: (deliveryId) => releaseDefaultOnMark(deliveryId, 'commit-verdict-pull'),
     forgetRecordedPass,
 };
+/**
+ * The two answers that read the held verdict through the release pass's own
+ * reader, when the caller can supply it and the product to key it by.
+ *
+ * parkAnswersHeldCommit is TRUE only where this process already judged the
+ * delivery ON the held commit (its run mark names it), the park the judgement
+ * left stands on unchanged facts, and the held verdict reads 'passed'. Every
+ * other case -- no mark (a restart), a mark on another commit, no injection, a
+ * verdict that did not persist, any unknown -- answers false, and the pull fires.
+ *
+ * heldVerdictStillAwaited is TRUE only where the attempt the pull caused has
+ * SETTLED (a run mark exists again, and no run is selected or in flight -- the
+ * caller asks the gate-run registry first) and the held verdict reads a
+ * readable 'pending': the write that run owed did not land, or the attempt
+ * rendered nothing (no checkout). 'passed' is
+ * answered, 'failed' is the gate's answer (re-running would repeat it), and an
+ * unreadable read waits for the next scan rather than paying a run on an unknown.
+ */
+function heldAnswersFrom(deps, productId) {
+    const readHeld = deps.readHeldCommitVerdictState;
+    if (!readHeld || !productId)
+        return {};
+    const heldState = async (focusId, d, sha) => {
+        try {
+            return await readHeld({
+                productId, focusId, focusReadOnly: false, deliveryId: d.id, injectionId: d.injectionId ?? null, gateState: d.gateState,
+            }, sha);
+        }
+        catch {
+            return null; // unreadable: an unknown, never a decline and never a paid run
+        }
+    };
+    return {
+        // A mark means a dispatch was attempted since the pull dropped it; the caller
+        // has already refused a run that is selected or in flight (the gate-run
+        // registry), so the attempt SETTLED -- whether it judged the sha, or named no
+        // commit at all (a checkout-less retry the park declined to un-mark).
+        heldVerdictStillAwaited: async (focusId, d, sha) => hasDefaultOnRunMark(d.id) && await heldState(focusId, d, sha) === 'pending',
+        ...(deps.readDeliveryGateRecord ? {
+            parkAnswersHeldCommit: async (focusId, d, sha) => {
+                if (judgedShaOfRunMark(d.id) !== sha || !d.injectionId)
+                    return false;
+                const parked = await parkHoldsOnUnchangedFacts({
+                    deliveryId: d.id,
+                    deliveryName: d.name ?? d.id,
+                    productId: null,
+                    focusId,
+                    injectionNodeId: d.injectionId,
+                    verificationMethod: 'deterministic',
+                    verificationConfig: null,
+                    verificationOutcome: null,
+                    verificationLastRunAt: null,
+                    gitState: d.gitState ?? null,
+                    mergeCommitSha: d.mergeCommitSha ?? null,
+                }, sha, deps);
+                return parked && await heldState(focusId, d, sha) === 'passed';
+            },
+        } : {}),
+    };
+}
 /** The commit each delivery was last pulled for in this process. */
 const pulledAt = new Map();
 /** Test-only: forget every pull this process made. */
@@ -90,7 +206,7 @@ export function __resetCommitVerdictPullForTests() {
  * selects the delivery, and the ordinary dispatch runs the gate under the same
  * semaphore and cap and records the verdict under the same per-commit record.
  */
-export function pullHeldCommitVerdicts(focusId, deliveries, deps = defaultPullDeps) {
+export async function pullHeldCommitVerdicts(focusId, deliveries, deps = defaultPullDeps) {
     const pulled = [];
     let head;
     const readHead = () => (head ??= { sha: deps.resolveFocusHeadSha(focusId) }).sha;
@@ -101,20 +217,34 @@ export function pullHeldCommitVerdicts(focusId, deliveries, deps = defaultPullDe
         // No hold, or a hold whose judged commit was unreadable: nothing to aim a run at.
         if (hold === null || hold.sha === null)
             continue;
-        if (pulledAt.get(d.id) === hold.sha)
-            continue;
         // A run that may judge the commit is already coming; a second would answer the same question.
         if (deps.isGateRunSelected(d.id) || deps.hasPendingGateRun(focusId, hold.sha))
             continue;
         // A run judges the worktree HEAD, so a hold naming another commit cannot be served by one.
         if (readHead() !== hold.sha)
             continue;
+        const again = pulledAt.get(d.id) === hold.sha;
+        // Asked for this sha already: spent only once the verdict reads back, never before.
+        if (again && !(deps.heldVerdictStillAwaited && await deps.heldVerdictStillAwaited(focusId, d, hold.sha)))
+            continue;
+        if (!again && deps.parkAnswersHeldCommit && await deps.parkAnswersHeldCommit(focusId, d, hold.sha)) {
+            pulledAt.set(d.id, hold.sha); // answered for this sha; asked once, like a pull
+            logReselection('commit-verdict-pull', d.id, `DECLINED for ${hold.sha.slice(0, 8)}: its dispatch already judged that commit, its shortfall park stands on ` +
+                'an unchanged commit set and unchanged rulings, and the passing verdict the held route awaits reads back; ' +
+                'only a new ruling or a new commit re-selects it', `park-declined@${hold.sha}`);
+            continue;
+        }
+        // Read before the release below drops it: which settled outcome this re-pull answers.
+        const priorJudged = again ? judgedShaOfRunMark(d.id) : null;
         pulledAt.set(d.id, hold.sha);
         deps.releaseRunMark(d.id);
         deps.forgetRecordedPass(d.id);
         pulled.push(d.id);
-        log.info(`[verification] commit-verdict pull: re-arming delivery "${d.name ?? d.id}" (${d.id}) for ${hold.sha.slice(0, 8)} -- ` +
-            `its ${hold.route ?? 'done'} route has been held since ${hold.heldAt} for a verdict on that commit`);
+        logReselection('commit-verdict-pull', d.id, `re-armed for ${hold.sha.slice(0, 8)} -- delivery "${d.name ?? d.id}"'s ${hold.route ?? 'done'} route has been ` +
+            `held since ${hold.heldAt} for a verdict on that commit` +
+            (!again ? '' : priorJudged === hold.sha
+                ? '; the run that answered the last pull judged it, but its verdict does not read back'
+                : '; the attempt the last pull caused rendered nothing (no checkout or no verdict), and no verdict reads back'));
     }
     return pulled;
 }
@@ -130,13 +260,20 @@ export function pullHeldCommitVerdicts(focusId, deliveries, deps = defaultPullDe
  * only when the hold names HEAD -- is only as sound as its agreeing with the
  * selection that follows it.
  */
-export function withCommitVerdictPull(deps, pullDeps = deps.resolveFocusHeadSha
-    ? { ...defaultPullDeps, resolveFocusHeadSha: deps.resolveFocusHeadSha }
-    : defaultPullDeps) {
+export function withCommitVerdictPull(deps, explicitPullDeps, 
+/** The product the scan runs over; the held verdict is keyed by it. Absent: the pull never declines. */
+productId) {
+    const pullDeps = explicitPullDeps ?? {
+        ...defaultPullDeps,
+        ...(deps.resolveFocusHeadSha ? { resolveFocusHeadSha: deps.resolveFocusHeadSha } : {}),
+        // The park is asked through the SAME deps the dispatch reads it with, so the
+        // pull and the dispatch cannot answer differently about one park.
+        ...heldAnswersFrom(deps, productId),
+    };
     const getFocusDeliveriesPulling = async (focusId) => {
         const deliveries = await deps.getFocusDeliveries(focusId);
         try {
-            pullHeldCommitVerdicts(focusId, deliveries, pullDeps);
+            await pullHeldCommitVerdicts(focusId, deliveries, pullDeps);
         }
         catch (err) {
             log.debug(`[verification] commit-verdict pull check failed for focus ${focusId.slice(0, 8)}:`, err.message);

package/dist/verify/commit-verdict-pull.js.map

@@ -1 +1 @@
-{"version":3,"file":"commit-verdict-pull.js","sourceRoot":"","sources":["../../src/verify/commit-verdict-pull.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,+EAA+E;AAC/E,2DAA2D;AAC3D,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAgBrD,MAAM,eAAe,GAA0B;IAC7C,mBAAmB,EAAE,0BAA0B;IAC/C,iBAAiB;IACjB,iBAAiB;IACjB,cAAc,EAAE,oBAAoB;IACpC,kBAAkB;CACnB,CAAC;AAEF,oEAAoE;AACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE3C,sDAAsD;AACtD,MAAM,UAAU,gCAAgC;IAC9C,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,UAA4C,EAC5C,OAA8B,eAAe;IAE7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAwC,CAAC;IAC7C,MAAM,QAAQ,GAAG,GAAkB,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;IAEhG,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,eAAe,KAAK,eAAe,CAAC,MAAM;YAAE,SAAS;QAC3D,MAAM,IAAI,GAAG,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChD,kFAAkF;QAClF,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI;YAAE,SAAS;QACjD,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,GAAG;YAAE,SAAS;QAC9C,8FAA8F;QAC9F,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACxF,2FAA2F;QAC3F,IAAI,QAAQ,EAAE,KAAK,IAAI,CAAC,GAAG;YAAE,SAAS;QAEtC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClB,GAAG,CAAC,IAAI,CACN,2DAA2D,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,SAAS,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM;YACtH,OAAO,IAAI,CAAC,KAAK,IAAI,MAAM,8BAA8B,IAAI,CAAC,MAAM,+BAA+B,CACpG,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAInC,IAAO,EACP,WAAkC,IAAI,CAAC,mBAAmB;IACxD,CAAC,CAAC,EAAE,GAAG,eAAe,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE;IACvE,CAAC,CAAC,eAAe;IAEnB,MAAM,yBAAyB,GAA8B,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,6DAA6D,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QACzH,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;IACF,OAAO,EAAE,GAAG,IAAI,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,CAAC;AACpE,CAAC"}
+{"version":3,"file":"commit-verdict-pull.js","sourceRoot":"","sources":["../../src/verify/commit-verdict-pull.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,+EAA+E;AAC/E,4DAA4D;AAC5D,wDAAwD;AACxD,+DAA+D;AAC/D,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8GG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC3H,OAAO,EAAE,yBAAyB,EAAiC,MAAM,6BAA6B,CAAC;AAEvG,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAkCrD,MAAM,eAAe,GAA0B;IAC7C,mBAAmB,EAAE,0BAA0B;IAC/C,iBAAiB;IACjB,iBAAiB;IACjB,iFAAiF;IACjF,mEAAmE;IACnE,cAAc,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,oBAAoB,CAAC,UAAU,EAAE,qBAAqB,CAAC;IACvF,kBAAkB;CACnB,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,eAAe,CACtB,IAAoB,EACpB,SAA6B;IAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC;IACjD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,KAAK,EAAE,OAAe,EAAE,CAAwB,EAAE,GAAW,EAA0B,EAAE;QACzG,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC;gBACpB,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;aACvH,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,+DAA+D;QAC9E,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,8EAA8E;QAC9E,wEAAwE;QACxE,8EAA8E;QAC9E,sEAAsE;QACtE,uBAAuB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CACjD,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,SAAS;QAC7E,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;YAChC,qBAAqB,EAAE,KAAK,EAAE,OAAe,EAAE,CAAwB,EAAE,GAAW,EAAE,EAAE;gBACtF,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW;oBAAE,OAAO,KAAK,CAAC;gBACrE,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;oBAC7C,UAAU,EAAE,CAAC,CAAC,EAAE;oBAChB,YAAY,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE;oBAC5B,SAAS,EAAE,IAAI;oBACf,OAAO;oBACP,eAAe,EAAE,CAAC,CAAC,WAAW;oBAC9B,kBAAkB,EAAE,eAAe;oBACnC,kBAAkB,EAAE,IAAI;oBACxB,mBAAmB,EAAE,IAAI;oBACzB,qBAAqB,EAAE,IAAI;oBAC3B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;oBAC5B,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;iBACzC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBACd,OAAO,MAAM,IAAI,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,QAAQ,CAAC;YACjE,CAAC;SACF,CAAC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE3C,sDAAsD;AACtD,MAAM,UAAU,gCAAgC;IAC9C,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,UAA4C,EAC5C,OAA8B,eAAe;IAE7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAwC,CAAC;IAC7C,MAAM,QAAQ,GAAG,GAAkB,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;IAEhG,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,eAAe,KAAK,eAAe,CAAC,MAAM;YAAE,SAAS;QAC3D,MAAM,IAAI,GAAG,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChD,kFAAkF;QAClF,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI;YAAE,SAAS;QACjD,8FAA8F;QAC9F,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACxF,2FAA2F;QAC3F,IAAI,QAAQ,EAAE,KAAK,IAAI,CAAC,GAAG;YAAE,SAAS;QACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC;QAC9C,oFAAoF;QACpF,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,uBAAuB,IAAI,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,SAAS;QACnH,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,qBAAqB,IAAI,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,iDAAiD;YAC/E,cAAc,CACZ,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAC3B,gBAAgB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,0EAA0E;gBAC9G,2GAA2G;gBAC3G,iDAAiD,EACjD,iBAAiB,IAAI,CAAC,GAAG,EAAE,CAC5B,CAAC;YACF,SAAS;QACX,CAAC;QAED,sFAAsF;QACtF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClB,cAAc,CACZ,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAC3B,gBAAgB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,KAAK,IAAI,MAAM,kBAAkB;YAChH,cAAc,IAAI,CAAC,MAAM,+BAA+B;YACxD,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,GAAG;gBACrC,CAAC,CAAC,qFAAqF;gBACvF,CAAC,CAAC,4GAA4G,CAAC,CAClH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAInC,IAAO,EACP,gBAAwC;AACxC,wGAAwG;AACxG,SAAkB;IAElB,MAAM,QAAQ,GAA0B,gBAAgB,IAAI;QAC1D,GAAG,eAAe;QAClB,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,6EAA6E;QAC7E,kEAAkE;QAClE,GAAG,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC;KACpC,CAAC;IACF,MAAM,yBAAyB,GAA8B,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,6DAA6D,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QACzH,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;IACF,OAAO,EAAE,GAAG,IAAI,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,CAAC;AACpE,CAAC"}

package/dist/verify/credit-rearm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credit-rearm.d.ts","sourceRoot":"","sources":["../../src/verify/credit-rearm.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAU/D,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACvF,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAOD,4DAA4D;AAC5D,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED,6FAA6F;AAC7F,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAAE,EACrE,IAAI,GAAE,eAAkC,GACvC,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,6GAA6G;AAC7G,wBAAgB,eAAe,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACtF,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,EAAE,CAAC,EACvC,IAAI,GAAE,eAAkC,GACvC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,EAAE,CAAC,CAUnC"}
+{"version":3,"file":"credit-rearm.d.ts","sourceRoot":"","sources":["../../src/verify/credit-rearm.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AA+B/D,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACvF,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AASD,4DAA4D;AAC5D,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED,6FAA6F;AAC7F,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAAE,EACrE,IAAI,GAAE,eAAkC,GACvC,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED,6GAA6G;AAC7G,wBAAgB,eAAe,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACtF,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,EAAE,CAAC,EACvC,IAAI,GAAE,eAAkC,GACvC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,EAAE,CAAC,CAUnC"}

package/dist/verify/credit-rearm.js

@@ -1,5 +1,7 @@
 // PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
-// Pinned by: packages/daemon/src/verify/credit-rearm.test.ts
+// Pinned by: packages/daemon/src/verify/credit-rearm.test.ts,
+//   packages/daemon/src/verify/reselection-log.test.ts,
+//   packages/daemon/src/verify/verification-default-on.test.ts
 // PINNED-BY-END
 /**
  * A new commit credit re-arms the focus's deliveries sitting in verify.
@@ -11,23 +13,62 @@
  * diagnosis, which stops re-queuing -- would never be re-judged with the credit.
  *
  * This watches each focus's credit set as the verification scan reads the
- * focus's deliveries. When the set differs from the one last seen, every
- * delivery of the focus in verify has its run mark released, so the next scan
- * judges it again at the same commit (the per-commit gate verdict is reused, so
- * no suite re-runs; only the evidence and reconciliation are re-read). The first
- * sighting of a focus only records the set: after a restart nothing is marked.
- * An unreadable credit read changes nothing.
+ * focus's deliveries. The run mark is released for a delivery whose OWN credited
+ * commits changed, so the next scan judges it again at the same commit (the
+ * per-commit gate verdict is reused, so no suite re-runs; only the evidence and
+ * reconciliation are re-read). The first sighting of a focus only records the
+ * set: after a restart nothing is marked. An unreadable credit read changes
+ * nothing.
+ *
+ * PER DELIVERY, NOT PER FOCUS -- and that distinction is the whole correctness
+ * of this module. It used to compare one fingerprint of the focus's WHOLE credit
+ * set and then release EVERY in-verify delivery when it moved, so attributing a
+ * commit to delivery A re-armed parked sibling B, whose own evidence had not
+ * changed at all. On 2026-09-24 that was one of the paths re-selecting a parked
+ * delivery at an unchanged HEAD: the declared rule is that only a new ruling or
+ * a new commit re-selects it, and a SIBLING's new commit is neither. A credit
+ * set is per-delivery data; reading it as a focus-wide scalar threw away exactly
+ * the attribution that makes it answerable.
+ *
+ * So the question asked here is "did THIS delivery's evidence change", which
+ * needs no park read and no extra IO: the credit map already carries the
+ * attribution, and a delivery whose own credits are unchanged is left alone.
  */
 import { DELIVERY_STATUS } from '@telora/daemon-core';
 import { getCommitAttributionsForFocus } from '../queries/commit-attributions.js';
 import { releaseDefaultOnMark } from './default-on-guards.js';
+import { logReselection } from './reselection-log.js';
 import { createLogger } from '../shell/log.js';
 const log = createLogger({ module: 'verification' });
-/** Focus id -> fingerprint of the credit set last seen. */
+/** Focus id -> each of its deliveries' own credit fingerprint, as last seen. */
 const seenCredits = new Map();
+/**
+ * Each delivery's OWN credited commits, fingerprinted. The credit map is keyed by
+ * sha and VALUED by delivery, so the attribution is already there to be read --
+ * this only groups it the way the question is asked. Pure.
+ *
+ * A delivery credited nothing has no entry, which compares equal to '' below, so
+ * "no credits" and "no entry" are one state rather than a spurious change.
+ */
+function creditsByDelivery(credits) {
+    const shas = new Map();
+    for (const [sha, deliveryId] of credits) {
+        const list = shas.get(deliveryId);
+        if (list)
+            list.push(sha);
+        else
+            shas.set(deliveryId, [sha]);
+    }
+    const out = new Map();
+    for (const [deliveryId, list] of shas)
+        out.set(deliveryId, list.sort().join(','));
+    return out;
+}
 const defaultRearmDeps = {
     readCredits: getCommitAttributionsForFocus,
-    release: releaseDefaultOnMark,
+    // Names itself, so the guard's own fallback line does not also speak: the
+    // per-delivery line below is the one that says why (verify/reselection-log.ts).
+    release: (deliveryId) => releaseDefaultOnMark(deliveryId, 'credit-rearm'),
 };
 /** Test-only: forget every focus's last-seen credit set. */
 export function __resetCreditRearmForTests() {
@@ -41,17 +82,31 @@ export async function rearmOnCreditChange(focusId, deliveries, deps = defaultRea
     const lookup = await deps.readCredits(focusId);
     if (lookup.state === 'undetermined')
         return;
-    const fingerprint = lookup.state === 'found'
-        ? [...lookup.value].map(([sha, deliveryId]) => `${sha}:${deliveryId}`).sort().join(',')
-        : '';
+    const current = creditsByDelivery(lookup.state === 'found' ? lookup.value : new Map());
     const previous = seenCredits.get(focusId);
-    seenCredits.set(focusId, fingerprint);
-    if (previous === undefined || previous === fingerprint)
-        return;
-    for (const d of inVerify)
+    seenCredits.set(focusId, current);
+    if (previous === undefined)
+        return; // first sighting records only
+    const rearmed = [];
+    for (const d of inVerify) {
+        const before = previous.get(d.id) ?? '';
+        const now = current.get(d.id) ?? '';
+        // A SIBLING's credit is not this delivery's evidence, so it does not re-arm it.
+        if (before === now)
+            continue;
         deps.release(d.id);
+        rearmed.push(d.id);
+        // PER DELIVERY, not only per focus: the focus line below cannot be matched to
+        // the delivery a later dispatch names, which is exactly what the 2026-09-24
+        // re-dispatch investigation needed (verify/reselection-log.ts).
+        logReselection('credit-rearm', d.id, `its OWN commit credits on focus ${focusId} changed (${before === '' ? 'none' : before} -> `
+            + `${now === '' ? 'none' : now}), so its evidence is re-read at the same commit`);
+    }
+    if (rearmed.length === 0)
+        return;
     log.info(`[verification] commit credits changed on focus ${focusId.slice(0, 8)}: re-judging ` +
-        `${inVerify.length} delivery(ies) in verify at the current commit`);
+        `${rearmed.length} of ${inVerify.length} delivery(ies) in verify at the current commit ` +
+        '(only those whose own credits moved)');
 }
 /** Wrap a focus-deliveries read so every read also checks the focus's credits. Never throws on the check. */
 export function withCreditRearm(read, deps = defaultRearmDeps) {

package/dist/verify/credit-rearm.js.map

@@ -1 +1 @@
-{"version":3,"file":"credit-rearm.js","sourceRoot":"","sources":["../../src/verify/credit-rearm.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,6DAA6D;AAC7D,gBAAgB;AAEhB;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAErD,2DAA2D;AAC3D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;AAO9C,MAAM,gBAAgB,GAAoB;IACxC,WAAW,EAAE,6BAA6B;IAC1C,OAAO,EAAE,oBAAoB;CAC9B,CAAC;AAEF,4DAA4D;AAC5D,MAAM,UAAU,0BAA0B;IACxC,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,UAAqE,EACrE,OAAwB,gBAAgB;IAExC,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,eAAe,CAAC,MAAM,CAAC,CAAC;IACxF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,KAAK,KAAK,cAAc;QAAE,OAAO;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,KAAK,OAAO;QAC1C,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QACvF,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO;IAC/D,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7C,GAAG,CAAC,IAAI,CACN,kDAAkD,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,eAAe;QACpF,GAAG,QAAQ,CAAC,MAAM,gDAAgD,CACnE,CAAC;AACJ,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,eAAe,CAC7B,IAAuC,EACvC,OAAwB,gBAAgB;IAExC,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,uDAAuD,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QACnH,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"credit-rearm.js","sourceRoot":"","sources":["../../src/verify/credit-rearm.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,8DAA8D;AAC9D,wDAAwD;AACxD,+DAA+D;AAC/D,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAErD,gFAAgF;AAChF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuC,CAAC;AAEnE;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,OAAoC;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,OAAO,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;YACpB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,IAAI;QAAE,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,OAAO,GAAG,CAAC;AACb,CAAC;AAOD,MAAM,gBAAgB,GAAoB;IACxC,WAAW,EAAE,6BAA6B;IAC1C,0EAA0E;IAC1E,gFAAgF;IAChF,OAAO,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,oBAAoB,CAAC,UAAU,EAAE,cAAc,CAAC;CAC1E,CAAC;AAEF,4DAA4D;AAC5D,MAAM,UAAU,0BAA0B;IACxC,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,UAAqE,EACrE,OAAwB,gBAAgB;IAExC,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,eAAe,CAAC,MAAM,CAAC,CAAC;IACxF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,KAAK,KAAK,cAAc;QAAE,OAAO;IAC5C,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,CAAC,8BAA8B;IAClE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACpC,gFAAgF;QAChF,IAAI,MAAM,KAAK,GAAG;YAAE,SAAS;QAC7B,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnB,8EAA8E;QAC9E,4EAA4E;QAC5E,gEAAgE;QAChE,cAAc,CACZ,cAAc,EAAE,CAAC,CAAC,EAAE,EACpB,mCAAmC,OAAO,aAAa,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM;cAC1F,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,kDAAkD,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,GAAG,CAAC,IAAI,CACN,kDAAkD,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,eAAe;QACpF,GAAG,OAAO,CAAC,MAAM,OAAO,QAAQ,CAAC,MAAM,iDAAiD;QACxF,sCAAsC,CACvC,CAAC;AACJ,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,eAAe,CAC7B,IAAuC,EACvC,OAAwB,gBAAgB;IAExC,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,uDAAuD,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QACnH,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;AACJ,CAAC"}

package/dist/verify/default-on-guards.d.ts

@@ -1,13 +1,33 @@
+import { type ReselectionPath } from './reselection-log.js';
 /** Test-only: reset the default-on re-run guards (status- and HEAD-keyed). */
 export declare function __resetDefaultOnGuardForTests(): void;
 /** Test-only: snapshot of the default-on re-run guard (delivery id -> the commit its dispatch judged). */
 export declare function __getDefaultOnGuardForTests(): ReadonlyMap<string, string | null>;
 /** Mark a delivery as already run this verify-entry (dispatch-time bookkeeping; the judged commit is noted after). */
 export declare function markDefaultOnRan(deliveryId: string): void;
+/**
+ * The commit the delivery's run mark says its dispatch judged; null when there is
+ * no mark, the dispatch is in flight, or it named no commit -- all "unknown".
+ */
+export declare function judgedShaOfRunMark(deliveryId: string): string | null;
+/**
+ * Whether the delivery carries a run mark at all -- a dispatch was attempted
+ * since the mark was last dropped -- whatever commit (if any) it names.
+ */
+export declare function hasDefaultOnRunMark(deliveryId: string): boolean;
 /** Test-only alias for markDefaultOnRan. */
 export declare function __markDefaultOnRanForTests(deliveryId: string): void;
-/** Drop a delivery's run mark so the next tick selects it again (its dispatch rendered nothing it may keep). */
-export declare function releaseDefaultOnMark(deliveryId: string): void;
+/**
+ * Drop a delivery's run mark so the next tick selects it again (its dispatch
+ * rendered nothing it may keep).
+ *
+ * `releasedBy` names the re-selection path for the log. A caller that passes one
+ * logs its OWN line at its own call site (where the reason is known), so this
+ * stays silent for it; a caller that names none gets the fallback
+ * 'run-mark-release' line. Either way nothing is logged when there was no mark to
+ * drop: a release that suppressed nothing re-selected nothing.
+ */
+export declare function releaseDefaultOnMark(deliveryId: string, releasedBy?: ReselectionPath): void;
 /**
  * Drop a delivery's recorded pass, so the pass guard no longer suppresses it.
  * The demand pull (verify/commit-verdict-pull.ts) calls this for a delivery whose
@@ -24,6 +44,13 @@ export interface DefaultOnResultFacts {
     checkoutUnavailable?: boolean;
     /** The reconciliation could not run (model unavailable): no verdict exists to guard. */
     modelUnavailable?: boolean;
+    /**
+     * A shortfall park stands on this delivery and EVERY fact behind it is
+     * unchanged (verify/parked-shortfall-reuse.ts parkHoldsOnUnchangedFacts).
+     * Absent/false means no park, moved facts, or an unknown -- all of which
+     * re-select. Read only on the two un-marks (checkout- and model-unavailable).
+     */
+    parkHolds?: boolean;
 }
 /**
  * Dispatch-result bookkeeping for a default-on run:
@@ -38,6 +65,17 @@ export interface DefaultOnResultFacts {
  *    forget any recorded pass;
  *  - a pass -> forget any recorded failure and, at a known judged sha, remember
  *    the pass so that commit is not re-verified either.
+ *
+ * A PASS DEMOTED TO 'failed' BY THE RECONCILIATION records neither: judgedFailedSha
+ * requires a non-zero gate exit and the gate exited 0, and the outcome is no longer
+ * 'passed'. That is deliberate and it is NOT a hole -- the run mark still carries
+ * the commit the run judged (the line above keeps it), so the delivery is not
+ * re-selected while a readable focus HEAD equals it, and a new commit re-arms it
+ * exactly once. Recording it as a failed sha instead would be wrong twice over: the
+ * gate did not fail, and failedAtSha is DURABLE (gate_state), so it would suppress
+ * the commit across a restart while the shortfall park -- which owns this state and
+ * is released by an operator ruling -- would have nothing to release. Pinned by
+ * verification-default-on.test.ts ("a pass demoted by a shortfall ...").
  */
 export declare function noteDefaultOnResult(deliveryId: string, result: DefaultOnResultFacts): void;
 /**
@@ -64,14 +102,22 @@ export declare function failedOnCurrentHead(delivery: {
  */
 export declare function ranOnCurrentHead(deliveryId: string, readHead: () => string | null): boolean;
 /**
- * Prune the guards of every delivery no longer observed in verify. The run mark
- * and the recorded PASS both go: a genuine verify_failed -> coding -> verify
- * re-entry is the ONLY thing that re-arms a passed delivery, so this sweep IS
- * that rule -- without it a delivery would keep a pass earned on the code before
- * its fix commits, which is the one way the narrowed rule could lower the bar.
+ * Prune the guards of every delivery THIS PRODUCT'S scan no longer observed in
+ * verify. The run mark and the recorded PASS both go: a genuine verify_failed ->
+ * coding -> verify re-entry is the ONLY thing that re-arms a passed delivery, so
+ * this sweep IS that rule -- without it a delivery would keep a pass earned on the
+ * code before its fix commits, which is the one way the narrowed rule could lower
+ * the bar.
+ *
+ * `productId` is the product the observation was taken over (config.productId of
+ * the scan's product-scoped config), and it BOUNDS the conclusion: an entry
+ * claimed by another product is left alone, because this scan never looked for it
+ * (module header, incident 2026-09-24). Pass `undefined` only from a caller whose
+ * single observation IS the whole view. Every observed id is claimed for
+ * `productId` here, so the claim and the prune come from one read.
  *
  * failedAtSha is deliberately NOT pruned: a recorded failure is durable in
  * gate_state and survives the round trip on purpose, unchanged.
  */
-export declare function pruneGuardsOutsideVerify(observedInVerify: ReadonlySet<string>): void;
+export declare function pruneGuardsOutsideVerify(observedInVerify: ReadonlySet<string>, productId?: string): void;
 //# sourceMappingURL=default-on-guards.d.ts.map

package/dist/verify/default-on-guards.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default-on-guards.d.ts","sourceRoot":"","sources":["../../src/verify/default-on-guards.ts"],"names":[],"mappings":"AAwKA,8EAA8E;AAC9E,wBAAgB,6BAA6B,IAAI,IAAI,CAKpD;AAED,0GAA0G;AAC1G,wBAAgB,2BAA2B,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAEhF;AAED,sHAAsH;AACtH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,4CAA4C;AAC5C,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAEnE;AAED,gHAAgH;AAChH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAE7D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAE3D;AAED,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wFAAwF;IACxF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAc1F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAYzD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,OAAO,CAoBzH;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,OAAO,CAY3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAOpF"}
+{"version":3,"file":"default-on-guards.d.ts","sourceRoot":"","sources":["../../src/verify/default-on-guards.ts"],"names":[],"mappings":"AAsDA,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAqJ5E,8EAA8E;AAC9E,wBAAgB,6BAA6B,IAAI,IAAI,CAMpD;AAED,0GAA0G;AAC1G,wBAAgB,2BAA2B,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAEhF;AAED,sHAAsH;AACtH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,4CAA4C;AAC5C,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAEnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,eAAe,GAAG,IAAI,CAS3F;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAE3D;AAED,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wFAAwF;IACxF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,IAAI,CA0C1F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAYzD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,OAAO,CAoBzH;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,OAAO,CAY3F;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAuBxG"}