@telora/daemon 0.22.239 → 0.22.289

package/dist/verify/run-selection/default-on-guards.d.ts

@@ -0,0 +1,123 @@
+import { type ReselectionPath } from './reselection-log-line.js';
+/** Test-only: reset the default-on re-run guards (status- and HEAD-keyed). */
+export declare function __resetDefaultOnGuardForTests(): void;
+/** Test-only: snapshot of the default-on re-run guard (delivery id -> the commit its dispatch judged). */
+export declare function __getDefaultOnGuardForTests(): ReadonlyMap<string, string | null>;
+/** Mark a delivery as already run this verify-entry (dispatch-time bookkeeping; the judged commit is noted after). */
+export declare function markDefaultOnRan(deliveryId: string): void;
+/**
+ * The commit the delivery's run mark says its dispatch judged; null when there is
+ * no mark, the dispatch is in flight, or it named no commit -- all "unknown".
+ */
+export declare function judgedShaOfRunMark(deliveryId: string): string | null;
+/**
+ * Whether the delivery carries a run mark at all -- a dispatch was attempted
+ * since the mark was last dropped -- whatever commit (if any) it names.
+ */
+export declare function hasDefaultOnRunMark(deliveryId: string): boolean;
+/** Test-only alias for markDefaultOnRan. */
+export declare function __markDefaultOnRanForTests(deliveryId: string): void;
+/**
+ * Drop a delivery's run mark so the next tick selects it again (its dispatch
+ * rendered nothing it may keep).
+ *
+ * `releasedBy` names the re-selection path for the log. A caller that passes one
+ * logs its OWN line at its own call site (where the reason is known), so this
+ * stays silent for it; a caller that names none gets the fallback
+ * 'run-mark-release' line. Either way nothing is logged when there was no mark to
+ * drop: a release that suppressed nothing re-selected nothing.
+ */
+export declare function releaseDefaultOnMark(deliveryId: string, releasedBy?: ReselectionPath): void;
+/**
+ * Drop a delivery's recorded pass, so the pass guard no longer suppresses it.
+ * The demand pull (verify/run-selection/commit-verdict-pull.ts) calls this for a delivery whose
+ * route is held for a verdict on the current HEAD: the recorded pass is about an
+ * earlier commit, and the held route needs THIS one judged.
+ */
+export declare function forgetRecordedPass(deliveryId: string): void;
+/** The slice of a verification result {@link noteDefaultOnResult} reads. */
+export interface DefaultOnResultFacts {
+    outcome: string;
+    exitCode?: number | null;
+    timedOut?: boolean;
+    verifiedSha?: string;
+    checkoutUnavailable?: boolean;
+    /** The reconciliation could not run (model unavailable): no verdict exists to guard. */
+    modelUnavailable?: boolean;
+    /**
+     * A shortfall park stands on this delivery and EVERY fact behind it is
+     * unchanged (verify/shortfalls/parked-shortfall-reuse.ts parkHoldsOnUnchangedFacts).
+     * Absent/false means no park, moved facts, or an unknown -- all of which
+     * re-select. Read only on the two un-marks (checkout- and model-unavailable).
+     */
+    parkHolds?: boolean;
+}
+/**
+ * Dispatch-result bookkeeping for a default-on run:
+ *  - no checkout could be made, or the verdict was discarded because dependencies
+ *    moved mid-run, or the reconciliation's model could not be reached -> un-mark,
+ *    so the next tick retries (no verdict exists to guard); any recorded pass or
+ *    failure stands;
+ *  - the run judged a known commit -> keep it on the run mark, so a later focus
+ *    HEAD that differs re-arms the delivery;
+ *  - the gate command FAILED at a known sha (non-zero exit, not a timeout, final
+ *    outcome failed) -> record the sha so that commit is not re-verified, and
+ *    forget any recorded pass;
+ *  - a pass -> forget any recorded failure and, at a known judged sha, remember
+ *    the pass so that commit is not re-verified either.
+ *
+ * A PASS DEMOTED TO 'failed' BY THE RECONCILIATION records neither: judgedFailedSha
+ * requires a non-zero gate exit and the gate exited 0, and the outcome is no longer
+ * 'passed'. That is deliberate and it is NOT a hole -- the run mark still carries
+ * the commit the run judged (the line above keeps it), so the delivery is not
+ * re-selected while a readable focus HEAD equals it, and a new commit re-arms it
+ * exactly once. Recording it as a failed sha instead would be wrong twice over: the
+ * gate did not fail, and failedAtSha is DURABLE (gate_state), so it would suppress
+ * the commit across a restart while the shortfall park -- which owns this state and
+ * is released by an operator ruling -- would have nothing to release. Pinned by
+ * verification-default-on.test.ts ("a pass demoted by a shortfall ...").
+ */
+export declare function noteDefaultOnResult(deliveryId: string, result: DefaultOnResultFacts): void;
+/**
+ * True when the delivery's last default-on verify PASSED (skip it). The focus
+ * HEAD is NOT read: a delivery earns its verdict once and keeps it until it
+ * genuinely re-enters verify (see passedAtSha for the rule and what it replaced).
+ */
+export declare function alreadyPassed(deliveryId: string): boolean;
+/**
+ * True when the delivery's last default-on verify failed on the focus's CURRENT
+ * HEAD (skip it). The failed sha is the in-memory copy, else the durable
+ * gate_state record. Only a readable HEAD that DIFFERS re-arms the delivery; an
+ * unreadable HEAD keeps it suppressed.
+ */
+export declare function failedOnCurrentHead(delivery: {
+    id: string;
+    gateState?: unknown;
+}, readHead: () => string | null): boolean;
+/**
+ * True when the delivery's default-on dispatch already stands for the focus's
+ * current HEAD (skip it): it is in flight, judged no known commit, or judged the
+ * commit HEAD still names -- or HEAD is unreadable. Only a readable HEAD that
+ * DIFFERS from the judged commit re-arms it (the mark is dropped).
+ */
+export declare function ranOnCurrentHead(deliveryId: string, readHead: () => string | null): boolean;
+/**
+ * Prune the guards of every delivery THIS PRODUCT'S scan no longer observed in
+ * verify. The run mark and the recorded PASS both go: a genuine verify_failed ->
+ * coding -> verify re-entry is the ONLY thing that re-arms a passed delivery, so
+ * this sweep IS that rule -- without it a delivery would keep a pass earned on the
+ * code before its fix commits, which is the one way the narrowed rule could lower
+ * the bar.
+ *
+ * `productId` is the product the observation was taken over (config.productId of
+ * the scan's product-scoped config), and it BOUNDS the conclusion: an entry
+ * claimed by another product is left alone, because this scan never looked for it
+ * (module header, incident 2026-09-24). Pass `undefined` only from a caller whose
+ * single observation IS the whole view. Every observed id is claimed for
+ * `productId` here, so the claim and the prune come from one read.
+ *
+ * failedAtSha is deliberately NOT pruned: a recorded failure is durable in
+ * gate_state and survives the round trip on purpose, unchanged.
+ */
+export declare function pruneGuardsOutsideVerify(observedInVerify: ReadonlySet<string>, productId?: string): void;
+//# sourceMappingURL=default-on-guards.d.ts.map

package/dist/verify/run-selection/default-on-guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-on-guards.d.ts","sourceRoot":"","sources":["../../../src/verify/run-selection/default-on-guards.ts"],"names":[],"mappings":"AA6DA,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAsJjF,8EAA8E;AAC9E,wBAAgB,6BAA6B,IAAI,IAAI,CAMpD;AAED,0GAA0G;AAC1G,wBAAgB,2BAA2B,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAEhF;AAED,sHAAsH;AACtH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,4CAA4C;AAC5C,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAEnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,eAAe,GAAG,IAAI,CAS3F;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAE3D;AAED,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wFAAwF;IACxF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,IAAI,CA0C1F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAYzD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,OAAO,CAqBzH;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,OAAO,CAc3F;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAuBxG"}

package/dist/verify/run-selection/default-on-guards.js

@@ -0,0 +1,432 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/integration/explicit-verdict-departure-during-removal.test.ts,
+//   packages/daemon/src/integration/explicit-verdict-invalidation-restart.test.ts,
+//   packages/daemon/src/integration/explicit-verdict-reuse.test.ts,
+//   packages/daemon/src/integration/focus-commit-verdict-scenario.test.ts,
+//   packages/daemon/src/integration/held-route-pull-dispatch.test.ts,
+//   packages/daemon/src/integration/review-verdict-ruling-release.test.ts,
+//   packages/daemon/src/integration/shortfall-ruling-disposes-proposals-regression.test.ts,
+//   packages/daemon/src/integration/shortfall-ruling-release.test.ts,
+//   packages/daemon/src/verify/deterministic-gate/verify-unprovisioned-worktree.test.ts,
+//   packages/daemon/src/verify/engine/verification-commit-sharing.test.ts,
+//   packages/daemon/src/verify/gate-config/verification-run-config-source.test.ts,
+//   packages/daemon/src/verify/outcome-routing/verification-model-unavailable-hold.test.ts,
+//   packages/daemon/src/verify/run-selection/commit-verdict-pull.test.ts,
+//   packages/daemon/src/verify/run-selection/credit-rearm.test.ts,
+//   packages/daemon/src/verify/run-selection/reselection-log-line.test.ts,
+//   packages/daemon/src/verify/run-selection/verification-default-on.test.ts,
+//   packages/daemon/src/verify/run-selection/verification-tick-product-scoping.test.ts,
+//   packages/daemon/src/verify/shortfalls/shortfall-rulings.test.ts,
+//   packages/daemon/src/worktree/worktree-package-provisioning.test.ts
+// PINNED-BY-END
+/**
+ * The default-on scan's steady-state re-run guards: what a delivery sitting in
+ * verify has ALREADY been judged on, and what re-arms it.
+ *
+ * Three questions, asked in this order by collectDefaultOnVerifications
+ * (verify/run-selection/verification-default-on.ts), each with its own memory:
+ *
+ *   1. alreadyPassed -- has this DELIVERY's verify passed? A pass is earned once
+ *      and kept until the delivery genuinely re-enters verify. No commit is read.
+ *   2. ranOnCurrentHead -- does this delivery's dispatch already stand for the
+ *      focus's current HEAD (in flight, or judged the commit HEAD still names)?
+ *   3. failedOnCurrentHead -- did its last verify FAIL on the commit HEAD names?
+ *
+ * The order is load-bearing: (1) answers a question about the DELIVERY, (2) and
+ * (3) about the COMMIT. Asked after (2), a sibling's commit would drop the run
+ * mark and log a re-arm that (1) then silently suppressed.
+ *
+ * The guards are the rule; the scan is the loop that asks them. A leaf: it reads
+ * gate_state and logs, and imports nothing from the scan.
+ *
+ * THE GUARDS ARE PRODUCT-SCOPED AT THE PRUNE. The maps below are module-level and
+ * keyed by delivery id alone, but the scan that prunes them runs once PER PRODUCT
+ * (verification-engine.ts runVerificationTick), and a scan of product B observes
+ * only B's deliveries. An unscoped prune would let B's scan conclude "no longer in
+ * verify" about A's deliveries -- which it cannot see -- and wipe A's run marks and
+ * recorded passes on every tick. The prune is scoped rather than accumulating one
+ * tick-wide observation, because scoping keeps the prune's MEANING true: each scan
+ * may only conclude something about the product it actually looked at. Each
+ * delivery's guards are therefore CLAIMED by the product whose scan observed it in
+ * verify, and only that product's scan may prune them; a scan naming no product
+ * claims the whole view, as a single-scope caller does. Every drop names its path
+ * in the log (verify/run-selection/reselection-log-line.ts), so a re-selection is one grep away.
+ *
+ * History: docs/daemon/history-verify.md (verify/run-selection/default-on-guards.ts).
+ *
+ * @module verify/run-selection/default-on-guards
+ */
+import { judgedFailedSha, readVerificationHistory } from '../../queries/delivery-gate-state/delivery-gate-state.js';
+import { logReselection } from './reselection-log-line.js';
+import { createLogger } from '../../log/daemon-log.js';
+import { evaluateStop } from '../../supervision/stop-registry.js';
+const log = createLogger({ module: 'verification' });
+/**
+ * A delivery synthesized by the default-on scan is NOT filtered server-side
+ * (the edge `daemon_get_pending_verifications` only returns explicit-method
+ * rows), so without a guard a delivery sitting in verify -- e.g. awaiting a
+ * review window -- would re-run the whole-repo suite on every verification
+ * tick. This map records deliveries whose default-on run has already been
+ * dispatched during THIS daemon run, with the commit that dispatch judged (null
+ * while in flight or when the run named no commit). A delivery is pruned the
+ * moment it is no longer observed in verify (so a genuine re-entry is selected
+ * again, unless one of the HEAD-keyed guards below already holds its verdict for
+ * the unchanged commit), and re-armed when a readable focus HEAD differs from the
+ * commit it was judged on: every delivery is judged on the focus HEAD, so a new
+ * commit on the focus branch is a new question for every delivery sitting in
+ * verify. Neither re-selection runs the gate twice for one commit -- the dispatch
+ * takes a verdict already recorded for that commit
+ * (verify/engine/verification-commit-sharing.ts), which is also what makes a restart
+ * (this map empty) cost no run.
+ */
+const defaultOnRan = new Map();
+/**
+ * HEAD-keyed re-verify guard: delivery id -> the commit its last default-on
+ * verify FAILED on (the gate command exited non-zero at that sha).
+ *
+ * The steady-state guard above is keyed on STATUS re-entry, and a failed verify
+ * with every issue Done steps verify -> verify_failed -> coding -> verify within
+ * ~60s -- so the same unchanged commit re-ran the whole gate (one delivery
+ * re-verified 5x on one sha, f1 2026-09-13), and each run re-took the verify hold.
+ * A gate on an unchanged tree renders the same verdict; only a NEW commit on the
+ * focus branch can change it. So an entry here suppresses selection while the
+ * focus HEAD still equals the failed sha, survives the status round trip, and is
+ * dropped (re-armed) the first time a readable HEAD differs; an unreadable HEAD
+ * keeps it (fail closed). A pass clears it. A timed-out run records nothing (a
+ * kill is not a verdict about the tree; judgedFailedSha).
+ * A BLIND run (blind_zero_parse) IS held here, in-process only: its re-work stamps
+ * no durable record and no iteration_count, so this bounds a blind re-run loop at
+ * one sha. The restart shipping a parser fix clears it: the held delivery is
+ * re-judged at the same commit, with no new commit or status edit.
+ *
+ * This map is only the hot copy. The DURABLE record is gate_state
+ * `verificationHistory.failedAtSha`: the failure feedback stamps it on the
+ * rejection, every clearing writer carries it (carryVerificationHistory), and a
+ * pass resets it -- so a daemon restart does not re-arm the unchanged commit.
+ * Selection reads the map first, then that record; the map covers a rejection
+ * write that did not land.
+ */
+const failedAtSha = new Map();
+/** `${deliveryId}@${sha}` pairs whose suppression was already logged. */
+const loggedShaSkips = new Set();
+function forgetFailedSha(deliveryId, durableSha) {
+    for (const sha of [failedAtSha.get(deliveryId), durableSha]) {
+        if (sha !== undefined)
+            loggedShaSkips.delete(`${deliveryId}@${sha}`);
+    }
+    failedAtSha.delete(deliveryId);
+}
+/**
+ * Pass memory: delivery id -> the commit its last default-on verify PASSED on
+ * (an actual 'passed' outcome at a known judged sha).
+ *
+ * A DELIVERY EARNS ITS VERDICT ONCE. An entry here suppresses selection until the
+ * delivery genuinely re-enters verify -- NOT until the focus HEAD moves.
+ *
+ * It used to be HEAD-keyed, dropped the first time a readable HEAD differed, and
+ * its log line said so ("a new commit on the focus branch re-arms it"). But every
+ * delivery of a focus is judged on ONE branch, so a commit made for a SIBLING
+ * delivery moved the HEAD of a delivery whose own work had not changed, and
+ * re-armed it. Measured on focus 09fc9cc6, delivery 5d02a2d2 (2026-09-19/20): 8
+ * gate runs over 8 shas, ALL PASSED, ~3h of wall time, while its code stood still;
+ * 2026-09-20 across all foci, 20 runs and ~5.7h of gate wall time in one day.
+ *
+ * WHAT COUNTS AS "ITS OWN WORK" -- the rule is a genuine verify_failed -> coding
+ * -> verify re-entry, and nothing else. The alternative considered was a commit
+ * carrying this delivery's own Telora-Delivery trailer (verify/shortfalls/delivery-commit-set.ts
+ * already reads that set as stable patch ids, and verify/shortfalls/shortfall-park.ts already
+ * fingerprints it, so cost was not why it lost). It lost on SOUNDNESS: a trailer is
+ * an attribution claim about who a commit is FOR, not a statement about the code
+ * the gate judges. The gate runs a whole-repo command over the worktree, so a
+ * sibling's commit can break a passed delivery's verdict carrying no trailer of its
+ * own, and a commit trailered to a delivery can touch none of the code its verdict
+ * depended on. Trailer-keyed re-arm therefore buys imprecise EARLY feedback, not
+ * correctness -- and correctness is owned by the done route, which judges the exact
+ * tip it is waiting on whatever this rule says (see below). Adding it later is
+ * purely additive on top of this rule; nothing here forecloses it.
+ *
+ * THE BAR IS NOT LOWERED. completion/review-exit-holds/review-exit-verdict-gate.ts still refuses to
+ * converge a delivery with no PASSING verdict for the commit it is judged on, and
+ * verify/run-selection/commit-verdict-pull.ts makes the held route cause the run that judges that
+ * commit. So this removes SPECULATIVE runs only: the commit a route actually needs
+ * answered is still answered, on demand, at the tip that turns out to matter.
+ *
+ * Dropped by a genuine re-entry (the prune sweep in collectDefaultOnVerifications,
+ * which sees the delivery leave verify), or when a later run FAILS at a judged sha.
+ * It survives a discarded (checkoutUnavailable) run -- not a verdict -- and a
+ * 'pending' is never a pass: a pass demoted because injection retirement threw
+ * records nothing.
+ *
+ * The HEAD is no longer read here at all, so the old unreadable-HEAD carve-out is
+ * gone with it: the question this guard answers is about the delivery, not about a
+ * commit.
+ *
+ * IN-MEMORY ONLY, deliberately, and re-examined under the narrowed rule. The
+ * durable counterpart would be a passed sha in gate_state's verificationHistory,
+ * beside failedAtSha. It was rejected: that field is written and cleared by every
+ * gate_state writer under the per-row write discipline, and the pass is exactly the
+ * moment the history is RESET (verify/outcome-routing/verification-history-reset.ts), so the new
+ * key would have to be carved out of its own reset -- real perturbation of a
+ * load-bearing invariant. What it would buy is bounded and mostly not waste: after
+ * a restart this map is empty, so an in-verify delivery is selected once at the
+ * current HEAD, and the dispatch takes the recorded per-commit verdict where that
+ * commit was judged (verify/gate-verdicts/commit-verdict-record.ts, no run). Where it was NOT
+ * judged, the run that follows is the one the done route will ask for anyway as
+ * soon as review exits -- early, not wasted. So: at most one gate run per in-verify
+ * delivery per restart, usually needed. Making it durable is additive if that ever
+ * proves wrong.
+ */
+const passedAtSha = new Map();
+/**
+ * delivery id -> the product whose scan owns its guards (the module header's
+ * scoping rule). Claimed by the scan that OBSERVES the delivery in verify, not by
+ * the dispatch that marks it: the claim and the prune are then two halves of the
+ * same read, so a prune can never be a conclusion about a delivery its own scan
+ * never looked for. An unclaimed entry is prunable by any scan -- it was recorded
+ * with no product claim (a direct caller, or a test), which is the single-view
+ * semantics this replaced.
+ */
+const guardProduct = new Map();
+/** Drop the product claim once neither guard holds the delivery. */
+function forgetGuardProduct(deliveryId) {
+    if (!defaultOnRan.has(deliveryId) && !passedAtSha.has(deliveryId))
+        guardProduct.delete(deliveryId);
+}
+const passSkipKey = (deliveryId, sha) => `${deliveryId}@${sha}#passed`;
+function forgetPassedSha(deliveryId) {
+    const sha = passedAtSha.get(deliveryId);
+    if (sha !== undefined)
+        loggedShaSkips.delete(passSkipKey(deliveryId, sha));
+    passedAtSha.delete(deliveryId);
+}
+/** Test-only: reset the default-on re-run guards (status- and HEAD-keyed). */
+export function __resetDefaultOnGuardForTests() {
+    defaultOnRan.clear();
+    failedAtSha.clear();
+    passedAtSha.clear();
+    loggedShaSkips.clear();
+    guardProduct.clear();
+}
+/** Test-only: snapshot of the default-on re-run guard (delivery id -> the commit its dispatch judged). */
+export function __getDefaultOnGuardForTests() {
+    return defaultOnRan;
+}
+/** Mark a delivery as already run this verify-entry (dispatch-time bookkeeping; the judged commit is noted after). */
+export function markDefaultOnRan(deliveryId) {
+    defaultOnRan.set(deliveryId, null);
+}
+/**
+ * The commit the delivery's run mark says its dispatch judged; null when there is
+ * no mark, the dispatch is in flight, or it named no commit -- all "unknown".
+ */
+export function judgedShaOfRunMark(deliveryId) {
+    return defaultOnRan.get(deliveryId) ?? null;
+}
+/**
+ * Whether the delivery carries a run mark at all -- a dispatch was attempted
+ * since the mark was last dropped -- whatever commit (if any) it names.
+ */
+export function hasDefaultOnRunMark(deliveryId) {
+    return defaultOnRan.has(deliveryId);
+}
+/** Test-only alias for markDefaultOnRan. */
+export function __markDefaultOnRanForTests(deliveryId) {
+    markDefaultOnRan(deliveryId);
+}
+/**
+ * Drop a delivery's run mark so the next tick selects it again (its dispatch
+ * rendered nothing it may keep).
+ *
+ * `releasedBy` names the re-selection path for the log. A caller that passes one
+ * logs its OWN line at its own call site (where the reason is known), so this
+ * stays silent for it; a caller that names none gets the fallback
+ * 'run-mark-release' line. Either way nothing is logged when there was no mark to
+ * drop: a release that suppressed nothing re-selected nothing.
+ */
+export function releaseDefaultOnMark(deliveryId, releasedBy) {
+    if (!defaultOnRan.delete(deliveryId))
+        return;
+    forgetGuardProduct(deliveryId);
+    if (releasedBy === undefined) {
+        logReselection('run-mark-release', deliveryId, 'its run mark was dropped, so the next default-on scan selects it again');
+    }
+}
+/**
+ * Drop a delivery's recorded pass, so the pass guard no longer suppresses it.
+ * The demand pull (verify/run-selection/commit-verdict-pull.ts) calls this for a delivery whose
+ * route is held for a verdict on the current HEAD: the recorded pass is about an
+ * earlier commit, and the held route needs THIS one judged.
+ */
+export function forgetRecordedPass(deliveryId) {
+    forgetPassedSha(deliveryId);
+}
+/**
+ * Dispatch-result bookkeeping for a default-on run:
+ *  - no checkout could be made, or the verdict was discarded because dependencies
+ *    moved mid-run, or the reconciliation's model could not be reached -> un-mark,
+ *    so the next tick retries (no verdict exists to guard); any recorded pass or
+ *    failure stands;
+ *  - the run judged a known commit -> keep it on the run mark, so a later focus
+ *    HEAD that differs re-arms the delivery;
+ *  - the gate command FAILED at a known sha (non-zero exit, not a timeout, final
+ *    outcome failed) -> record the sha so that commit is not re-verified, and
+ *    forget any recorded pass;
+ *  - a pass -> forget any recorded failure and, at a known judged sha, remember
+ *    the pass so that commit is not re-verified either.
+ *
+ * A PASS DEMOTED TO 'failed' BY THE RECONCILIATION records neither: judgedFailedSha
+ * requires a non-zero gate exit and the gate exited 0, and the outcome is no longer
+ * 'passed'. That is deliberate and it is NOT a hole -- the run mark still carries
+ * the commit the run judged (the line above keeps it), so the delivery is not
+ * re-selected while a readable focus HEAD equals it, and a new commit re-arms it
+ * exactly once. Recording it as a failed sha instead would be wrong twice over: the
+ * gate did not fail, and failedAtSha is DURABLE (gate_state), so it would suppress
+ * the commit across a restart while the shortfall park -- which owns this state and
+ * is released by an operator ruling -- would have nothing to release. Pinned by
+ * verification-default-on.test.ts ("a pass demoted by a shortfall ...").
+ */
+export function noteDefaultOnResult(deliveryId, result) {
+    if (result.checkoutUnavailable || result.modelUnavailable) {
+        // A parked delivery whose every fact is unchanged is re-selected by no path
+        // except a new ruling or a new commit, so the retry is DECLINED -- for BOTH
+        // un-marks: the next dispatch would re-derive exactly what the park already
+        // records. No wedge follows, and that is decided by STATE, not by path: a
+        // model-unavailable hold that LANDED on gate_state refuses the park
+        // (parked-shortfall-reuse.ts 'awaiting-model'), so parkHolds is false and the
+        // retry proceeds; parkHolds is true only where a real judgement on these same
+        // facts still stands and answers for the delivery.
+        if (result.parkHolds) {
+            const path = result.modelUnavailable ? 'model-unavailable-unmark' : 'checkout-unavailable-unmark';
+            logReselection(path, deliveryId, `DECLINED: ${result.modelUnavailable ? 'the reconciliation could not reach the model' : 'no checkout could be made'}, `
+                + 'but its shortfall park stands on an unchanged commit set and unchanged rulings, so a retry would re-derive '
+                + 'the same park; only a new ruling or a new commit re-selects it', 'park-declined');
+            return;
+        }
+        if (defaultOnRan.delete(deliveryId)) {
+            forgetGuardProduct(deliveryId);
+            logReselection(result.modelUnavailable ? 'model-unavailable-unmark' : 'checkout-unavailable-unmark', deliveryId, result.modelUnavailable
+                ? 'its reconciliation could not reach the model, so no verdict exists to guard; the next tick re-judges the same commit'
+                : 'no checkout could be made, or the verdict was discarded because dependencies moved mid-run; the next tick retries');
+        }
+        return;
+    }
+    if (result.verifiedSha && defaultOnRan.has(deliveryId))
+        defaultOnRan.set(deliveryId, result.verifiedSha);
+    const failedSha = judgedFailedSha(result);
+    if (result.outcome === 'failed' && failedSha) {
+        failedAtSha.set(deliveryId, failedSha);
+        forgetPassedSha(deliveryId);
+    }
+    else if (result.outcome === 'passed') {
+        forgetFailedSha(deliveryId);
+        if (result.verifiedSha)
+            passedAtSha.set(deliveryId, result.verifiedSha);
+    }
+}
+/**
+ * True when the delivery's last default-on verify PASSED (skip it). The focus
+ * HEAD is NOT read: a delivery earns its verdict once and keeps it until it
+ * genuinely re-enters verify (see passedAtSha for the rule and what it replaced).
+ */
+export function alreadyPassed(deliveryId) {
+    const passedSha = passedAtSha.get(deliveryId);
+    if (!evaluateStop('verify_rerun_already_passed', { passedSha: passedSha ?? null }) || passedSha === undefined)
+        return false;
+    const key = passSkipKey(deliveryId, passedSha);
+    if (!loggedShaSkips.has(key)) {
+        loggedShaSkips.add(key);
+        log.info(`[verification] default-on: not re-verifying delivery ${deliveryId} -- its verify already passed on `
+            + `${passedSha.slice(0, 8)}; a sibling's commit does not re-arm it, only a re-entry into verify does`);
+    }
+    return true;
+}
+/**
+ * True when the delivery's last default-on verify failed on the focus's CURRENT
+ * HEAD (skip it). The failed sha is the in-memory copy, else the durable
+ * gate_state record. Only a readable HEAD that DIFFERS re-arms the delivery; an
+ * unreadable HEAD keeps it suppressed.
+ */
+export function failedOnCurrentHead(delivery, readHead) {
+    const failedSha = failedAtSha.get(delivery.id) ?? readVerificationHistory(delivery.gateState).failedAtSha;
+    if (failedSha === undefined)
+        return false;
+    const head = readHead();
+    // The suppression decision is the registry's verify_rerun_failed_on_head row.
+    if (!evaluateStop('verify_rerun_failed_on_head', { failedSha, head })) {
+        forgetFailedSha(delivery.id, failedSha);
+        return false;
+    }
+    const key = `${delivery.id}@${failedSha}`;
+    if (!loggedShaSkips.has(key)) {
+        loggedShaSkips.add(key);
+        const why = head === null
+            ? `its last verify failed on ${failedSha.slice(0, 8)} and the focus HEAD is unreadable`
+            : `focus HEAD ${failedSha.slice(0, 8)} is the commit its last verify failed on`;
+        log.info(`[verification] default-on: not re-verifying delivery ${delivery.id} -- ${why}; `
+            + `a new commit on the focus branch re-arms it`);
+    }
+    return true;
+}
+/**
+ * True when the delivery's default-on dispatch already stands for the focus's
+ * current HEAD (skip it): it is in flight, judged no known commit, or judged the
+ * commit HEAD still names -- or HEAD is unreadable. Only a readable HEAD that
+ * DIFFERS from the judged commit re-arms it (the mark is dropped).
+ */
+export function ranOnCurrentHead(deliveryId, readHead) {
+    const hasRunMark = defaultOnRan.has(deliveryId);
+    const judgedSha = defaultOnRan.get(deliveryId) ?? null;
+    // HEAD is read only when a known judged commit could be re-armed by it. The
+    // suppression decision is the registry's verify_rerun_ran_on_head row.
+    const head = hasRunMark && judgedSha !== null ? readHead() : null;
+    if (evaluateStop('verify_rerun_ran_on_head', { hasRunMark, judgedSha, head }))
+        return true;
+    if (!hasRunMark || judgedSha === null || head === null)
+        return false;
+    defaultOnRan.delete(deliveryId);
+    log.info(`[verification] default-on: re-arming delivery ${deliveryId} -- focus HEAD ${head.slice(0, 8)} is a new commit `
+        + `(its last verify judged ${judgedSha.slice(0, 8)})`);
+    return false;
+}
+/**
+ * Prune the guards of every delivery THIS PRODUCT'S scan no longer observed in
+ * verify. The run mark and the recorded PASS both go: a genuine verify_failed ->
+ * coding -> verify re-entry is the ONLY thing that re-arms a passed delivery, so
+ * this sweep IS that rule -- without it a delivery would keep a pass earned on the
+ * code before its fix commits, which is the one way the narrowed rule could lower
+ * the bar.
+ *
+ * `productId` is the product the observation was taken over (config.productId of
+ * the scan's product-scoped config), and it BOUNDS the conclusion: an entry
+ * claimed by another product is left alone, because this scan never looked for it
+ * (module header, incident 2026-09-24). Pass `undefined` only from a caller whose
+ * single observation IS the whole view. Every observed id is claimed for
+ * `productId` here, so the claim and the prune come from one read.
+ *
+ * failedAtSha is deliberately NOT pruned: a recorded failure is durable in
+ * gate_state and survives the round trip on purpose, unchanged.
+ */
+export function pruneGuardsOutsideVerify(observedInVerify, productId) {
+    if (productId !== undefined) {
+        for (const id of observedInVerify)
+            guardProduct.set(id, productId);
+    }
+    // An entry another product's scan claimed is none of this scan's business.
+    const outOfScope = (id) => productId !== undefined && (guardProduct.get(id) ?? productId) !== productId;
+    for (const id of new Set([...defaultOnRan.keys(), ...passedAtSha.keys(), ...guardProduct.keys()])) {
+        if (observedInVerify.has(id) || outOfScope(id))
+            continue;
+        const dropped = [
+            ...(defaultOnRan.delete(id) ? ['its run mark'] : []),
+            ...(passedAtSha.has(id) ? ['its recorded pass'] : []),
+        ];
+        forgetPassedSha(id);
+        guardProduct.delete(id);
+        // A claim with no guard behind it suppressed nothing: forgetting it is bookkeeping, not a re-selection.
+        if (dropped.length === 0)
+            continue;
+        logReselection('run-mark-prune', id, `${dropped.join(' and ')} dropped -- the default-on scan of product `
+            + `${productId ?? 'the whole view'} no longer observed it in verify`);
+    }
+}
+//# sourceMappingURL=default-on-guards.js.map

package/dist/verify/run-selection/default-on-guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-on-guards.js","sourceRoot":"","sources":["../../../src/verify/run-selection/default-on-guards.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,gGAAgG;AAChG,mFAAmF;AACnF,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,2EAA2E;AAC3E,4FAA4F;AAC5F,sEAAsE;AACtE,yFAAyF;AACzF,2EAA2E;AAC3E,mFAAmF;AACnF,4FAA4F;AAC5F,0EAA0E;AAC1E,mEAAmE;AACnE,2EAA2E;AAC3E,8EAA8E;AAC9E,wFAAwF;AACxF,qEAAqE;AACrE,uEAAuE;AACvE,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACpH,OAAO,EAAE,cAAc,EAAwB,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAElE,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAGrD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAyB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC9C,yEAAyE;AACzE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;AAEzC,SAAS,eAAe,CAAC,UAAkB,EAAE,UAAmB;IAC9D,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;QAC5D,IAAI,GAAG,KAAK,SAAS;YAAE,cAAc,CAAC,MAAM,CAAC,GAAG,UAAU,IAAI,GAAG,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE/C,oEAAoE;AACpE,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,UAAkB,EAAE,GAAW,EAAU,EAAE,CAAC,GAAG,UAAU,IAAI,GAAG,SAAS,CAAC;AAE/F,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,SAAS;QAAE,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3E,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,6BAA6B;IAC3C,YAAY,CAAC,KAAK,EAAE,CAAC;IACrB,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,cAAc,CAAC,KAAK,EAAE,CAAC;IACvB,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,2BAA2B;IACzC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,OAAO,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACtC,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,gBAAgB,CAAC,UAAU,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,UAA4B;IACnF,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO;IAC7C,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/B,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,cAAc,CACZ,kBAAkB,EAAE,UAAU,EAC9B,wEAAwE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,eAAe,CAAC,UAAU,CAAC,CAAC;AAC9B,CAAC;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB,EAAE,MAA4B;IAClF,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC1D,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,oEAAoE;QACpE,8EAA8E;QAC9E,8EAA8E;QAC9E,mDAAmD;QACnD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,GAAoB,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,6BAA6B,CAAC;YACnH,cAAc,CACZ,IAAI,EAAE,UAAU,EAChB,aAAa,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,2BAA2B,IAAI;kBACrH,6GAA6G;kBAC7G,gEAAgE,EAClE,eAAe,CAChB,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAC/B,cAAc,CACZ,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,6BAA6B,EACpF,UAAU,EACV,MAAM,CAAC,gBAAgB;gBACrB,CAAC,CAAC,sHAAsH;gBACxH,CAAC,CAAC,mHAAmH,CACxH,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACzG,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC7C,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACvC,eAAe,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;SAAM,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,WAAW;YAAE,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,YAAY,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,SAAS,IAAI,IAAI,EAAE,CAAC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5H,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,GAAG,CAAC,IAAI,CACN,wDAAwD,UAAU,mCAAmC;cACnG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,2EAA2E,CACtG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA6C,EAAE,QAA6B;IAC9G,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,uBAAuB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC;IAC1G,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,8EAA8E;IAC9E,IAAI,CAAC,YAAY,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,EAAE,IAAI,SAAS,EAAE,CAAC;IAC1C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,KAAK,IAAI;YACvB,CAAC,CAAC,6BAA6B,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,mCAAmC;YACvF,CAAC,CAAC,cAAc,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,0CAA0C,CAAC;QAClF,GAAG,CAAC,IAAI,CACN,wDAAwD,QAAQ,CAAC,EAAE,OAAO,GAAG,IAAI;cAC/E,6CAA6C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,QAA6B;IAChF,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;IACvD,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,IAAI,GAAG,UAAU,IAAI,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,YAAY,CAAC,0BAA0B,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,CAAC,UAAU,IAAI,SAAS,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACrE,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAChC,GAAG,CAAC,IAAI,CACN,iDAAiD,UAAU,kBAAkB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,mBAAmB;UAC9G,2BAA2B,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CACtD,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,wBAAwB,CAAC,gBAAqC,EAAE,SAAkB;IAChG,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,KAAK,MAAM,EAAE,IAAI,gBAAgB;YAAE,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACrE,CAAC;IACD,2EAA2E;IAC3E,MAAM,UAAU,GAAG,CAAC,EAAU,EAAW,EAAE,CACzC,SAAS,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,SAAS,CAAC,KAAK,SAAS,CAAC;IAC/E,KAAK,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAClG,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC;YAAE,SAAS;QACzD,MAAM,OAAO,GAAG;YACd,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;QACF,eAAe,CAAC,EAAE,CAAC,CAAC;QACpB,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,wGAAwG;QACxG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,cAAc,CACZ,gBAAgB,EAAE,EAAE,EACpB,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,6CAA6C;cACnE,GAAG,SAAS,IAAI,gBAAgB,kCAAkC,CACrE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/verify/run-selection/explicit-rearm.d.ts

@@ -0,0 +1,27 @@
+import type { DaemonConfig } from '../../types/index.js';
+import type { PendingVerification } from '../../queries/verification/verification.js';
+import type { getActiveFocuses } from '../../queries/focuses/focus-discovery.js';
+import type { getFocusDeliveries } from '../../queries/focuses/focuses.js';
+/** The reads the re-arm scan takes (a structural slice of VerificationDeps). */
+export interface ExplicitRearmDeps {
+    getActiveFocuses: typeof getActiveFocuses;
+    getFocusDeliveries: typeof getFocusDeliveries;
+    resolveFocusHeadSha: (focusId: string) => string | null;
+}
+/**
+ * The explicit-method rows of the product to select again this tick (see the
+ * module header). `pendingIds` are the rows daemon_get_pending_verifications
+ * already listed. Never throws: an unreadable focus list or delivery list re-arms
+ * nothing for it, and the next tick asks again.
+ */
+export declare function collectRearmedExplicitVerifications(config: DaemonConfig, pendingIds: ReadonlySet<string>, deps: ExplicitRearmDeps): Promise<PendingVerification[]>;
+/**
+ * Release the re-arm mark `candidate` set, when its run never judged its commit
+ * (see the module header), so the scan selects the delivery again at the same HEAD
+ * and gate. A no-op for a candidate this scan did not build, or once a later re-arm
+ * replaced its mark.
+ */
+export declare function releaseExplicitRearm(candidate: PendingVerification): void;
+/** Test seam: forget every re-arm this process made. */
+export declare function __resetExplicitRearmForTests(): void;
+//# sourceMappingURL=explicit-rearm.d.ts.map

package/dist/verify/run-selection/explicit-rearm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"explicit-rearm.d.ts","sourceRoot":"","sources":["../../../src/verify/run-selection/explicit-rearm.ts"],"names":[],"mappings":"AA0DA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAsB,MAAM,4CAA4C,CAAC;AAC1G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAQ3E,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,OAAO,gBAAgB,CAAC;IAC1C,kBAAkB,EAAE,OAAO,kBAAkB,CAAC;IAC9C,mBAAmB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACzD;AAwBD;;;;;GAKG;AACH,wBAAsB,mCAAmC,CACvD,MAAM,EAAE,YAAY,EACpB,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,EAC/B,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAoDhC;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,mBAAmB,GAAG,IAAI,CAGzE;AAED,wDAAwD;AACxD,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD"}