@telora/daemon 0.22.97 → 0.22.131

package/dist/verify/verification-diagnostics.d.ts

@@ -0,0 +1,16 @@
+/** The roots a verify log names for itself: every `(cwd: <path>)` preamble line. */
+export declare function logCwdRoots(logText: string): string[];
+/**
+ * The diagnostic signatures of one red stage's log segment (module doc), sorted.
+ * `roots` are checkout paths to strip in addition to those the text names.
+ */
+export declare function diagnosticSignatures(stageLines: readonly string[], roots?: readonly string[]): string[];
+/**
+ * The head signatures the base does not cover, as a multiset difference (a
+ * signature the head reports N times and the base M < N times contributes N - M
+ * copies). Empty means covered. Sorted.
+ */
+export declare function uncoveredDiagnostics(head: readonly string[], base: readonly string[]): string[];
+/** A short, bounded rendering of diagnostics for a rationale. */
+export declare function describeDiagnostics(signatures: readonly string[], limit?: number): string;
+//# sourceMappingURL=verification-diagnostics.d.ts.map

package/dist/verify/verification-diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-diagnostics.d.ts","sourceRoot":"","sources":["../../src/verify/verification-diagnostics.ts"],"names":[],"mappings":"AAgFA,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAOrD;AAqGD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,EAAE,CAU3G;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAU/F;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,SAAI,GAAG,MAAM,CAGpF"}

package/dist/verify/verification-diagnostics.js

@@ -0,0 +1,219 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/verify/verification-diagnostics.test.ts
+// PINNED-BY-END
+/**
+ * Diagnostic signatures of one red gate stage, comparable across two checkouts.
+ *
+ * Stage attribution (verify/verification-attribution.ts) used to call a non-test
+ * red pre-existing when only the stage NAMES matched and neither side parsed a
+ * failing-test id -- so a base lint error in file A and a new lint or type error
+ * in file B laundered together. A stage red is the base's only when the base
+ * reports every diagnostic this run reports. This module reduces a stage's log
+ * segment to a MULTISET of stable, effect-bearing signatures:
+ *
+ *   - eslint (stylish): `eslint <file> <rule> <message>`, errors only (a warning
+ *     never fails the stage); the file comes from the path line above the problem
+ *     lines;
+ *   - tsc: `tsc <file> <TSxxxx> <message>` from `file(l,c): error TSxxxx: msg`
+ *     and the pretty `file:l:c - error TSxxxx: msg`;
+ *   - every OTHER line that bears an error word (error, fail, violated, drift,
+ *     exceeds, ...) or names a file path -- which keeps ratchet counts
+ *     (`name: 130 > baseline 120`) and drift file lines, and drops progress prose
+ *     such as an IMPROVED count;
+ *   - and when none of that yields anything, every remaining output line.
+ *
+ * The tiers compose; a structured tier never replaces the rest. A stage whose
+ * output mixes a structured tool with anything else (an eslint error beside a
+ * ratchet count) keeps every effect-bearing line the structured parsers did not
+ * account for. What they account for is left out, because their signatures
+ * already count it: the lines they consumed (an eslint file header and its
+ * problem lines, warnings included; a tsc diagnostic, its indented message chain
+ * and its code frame) and the tallies they print about them (eslint's `N
+ * problems` and `--fix` lines, tsc's `Found N errors` and its per-file table).
+ * (Structured signatures used to win outright, so a head reporting the base's
+ * eslint error PLUS a new ratchet violation compared identical to the base and
+ * the new red was laundered as pre-existing -- TEL-6.)
+ *
+ * Normalised away, because they differ between two runs of the same defect:
+ * ANSI codes, npm's own script headers and lifecycle trailer (their package
+ * VERSION and paths move between base and head), timestamps and durations, the
+ * checkout's absolute path prefix (base and head run in DIFFERENT checkout
+ * directories: the `(cwd: ...)` preamble a verify log opens with, any explicitly
+ * known root, and the daemon's checkout-root layout), and line/column numbers
+ * (an unrelated edit above a base error moves it). Counts are kept: a count is
+ * the effect.
+ *
+ * Comparison ({@link uncoveredDiagnostics}): the head red is covered only if every
+ * head signature occurs at least as many times in the base. A head red with no
+ * extractable signature is NOT covered by anything -- attribution charges it
+ * rather than launder an unreadable red (decided: a charge names the stage, which
+ * the team can act on; the base red it might match cannot be shown). Pure.
+ *
+ * @module verify/verification-diagnostics
+ */
+const ESC = String.fromCharCode(27);
+const ANSI_RE = new RegExp(`${ESC}\\[[0-9;?]*[A-Za-z]`, 'g');
+const NPM_HEADER_RE = /^> (?:@[^\s@/]+\/)?[^\s@]+@\S+ \S+$/;
+/** npm's own lines about the script it ran (not the script's diagnostics); a missing script is kept. */
+const NPM_NOISE_RE = /^npm (?:error|ERR!|warn|WARN|notice|verb)\b(?!.*Missing script)/;
+const LOG_CWD_RE = /^\(cwd: (.+)\)$/;
+/** The daemon's checkout layouts under its state dir: `<...>/verification-checkout/<key>/`. */
+const CHECKOUT_ROOT_RE = /(?:\/[^\s/:'"()]+)*\/verification-(?:checkout|baseline-wt)\/[^\s/:'"()]+\/?/g;
+const SOURCE_PATH = String.raw `[^\s:()'"]+\.(?:[cm]?[jt]sx?|json|mjs|cjs|sql|md|ya?ml|css|html|sh|py|toml)`;
+const ESLINT_FILE_RE = new RegExp(`^(${SOURCE_PATH})$`);
+const ESLINT_PROBLEM_RE = /^\s+\d+:\d+\s+(error|warning)\s+(.+?)(?:\s{2,}(\S+))?$/;
+const TSC_RE = new RegExp(`^(${SOURCE_PATH})(?:\\(\\d+,\\d+\\):|:\\d+:\\d+ -) error (TS\\d+): (.*)$`);
+const ERROR_WORD_RE = /\b(?:errors?|fail(?:s|ed|ure|ures|ing)?|violat(?:ed|ion|ions)|drift|exceed(?:s|ed)?|grew|stale|mismatch(?:es)?|missing|not found|forbidden|invalid|cannot|unable|not ok)\b|[✖✗×]/i;
+const PATH_TOKEN_RE = new RegExp(`(?:^|\\s)(?:\\./)?[\\w@.-]+/${SOURCE_PATH}`);
+/** The tallies eslint and tsc print about their own diagnostics (trimmed line). */
+const STRUCTURED_TALLY_RE = /^(?:[✖✗×]\s*)?\d+ problems?\b|^\d+ errors? and \d+ warnings? potentially fixable\b|^Found \d+ errors?\b/;
+/** tsc's per-file error table: its `Errors  Files` head, then `<count>  <file>` rows. */
+const TSC_TABLE_HEAD_RE = /^Errors\s+Files$/;
+const TSC_TABLE_ROW_RE = /^\d+\s+\S/;
+/** A code frame: a numbered source line directly above its squiggle underline. */
+const FRAME_SOURCE_RE = /^\d+ /;
+const FRAME_UNDERLINE_RE = /^~+$/;
+/** The roots a verify log names for itself: every `(cwd: <path>)` preamble line. */
+export function logCwdRoots(logText) {
+    const roots = [];
+    for (const line of (typeof logText === 'string' ? logText : '').split(/\r?\n/)) {
+        const match = LOG_CWD_RE.exec(line.trim());
+        if (match)
+            roots.push(match[1].trim());
+    }
+    return roots;
+}
+function stripRoots(line, roots) {
+    let out = line;
+    for (const root of roots) {
+        const trimmed = root.replace(/\/+$/, '');
+        if (trimmed.length > 1)
+            out = out.split(`${trimmed}/`).join('').split(trimmed).join('.');
+    }
+    return out.replace(CHECKOUT_ROOT_RE, '');
+}
+/** One line reduced to what is stable across two runs of the same defect. */
+function normaliseLine(line, roots) {
+    return stripRoots(line.replace(ANSI_RE, ''), roots)
+        .replace(/\b\d{4}-\d{2}-\d{2}[T ]\d{2}[:_]\d{2}[:_]\d{2}(?:[._]\d+)?Z?/g, '<time>')
+        .replace(/\b\d{1,2}:\d{2}:\d{2}(?:\.\d+)?\b/g, '<time>')
+        .replace(/\b(duration(?:_ms)?:?\s*)\d+(?:\.\d+)?/gi, '$1<dur>')
+        .replace(/\b\d+(?:\.\d+)?\s?(?:ms|s|sec|secs|seconds|m|min|mins|minutes|h)\b/g, '<dur>')
+        .replace(/\(\d+,\d+\)/g, '')
+        .replace(/:\d+(?::\d+)?\b/g, '')
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+/**
+ * The stage's own output lines: npm's script headers (and their command lines)
+ * and lifecycle trailer removed. A blank line, and each removed line, stays as ''
+ * -- a boundary the structured reading needs (a tsc message chain ends at one).
+ */
+function ownOutput(lines) {
+    const out = [];
+    for (let index = 0; index < lines.length; index++) {
+        const line = lines[index].replace(ANSI_RE, '').trimEnd();
+        if (NPM_HEADER_RE.test(line)) {
+            if (lines[index + 1]?.startsWith('> '))
+                index += 1;
+            out.push('');
+            continue;
+        }
+        out.push(line.trim().length === 0 || NPM_NOISE_RE.test(line.trim()) ? '' : line);
+    }
+    return out;
+}
+/** eslint stylish + tsc signatures (the structured tiers), with the lines each consumed. */
+function structuredSignatures(lines, roots) {
+    const signatures = [];
+    const consumed = new Set(structuredTallies(lines));
+    let eslintFile = null;
+    let tscChain = false;
+    for (let index = 0; index < lines.length; index++) {
+        const line = lines[index];
+        const indented = /^\s/.test(line);
+        if (tscChain && indented) {
+            consumed.add(index); // the diagnostic's indented message chain
+            continue;
+        }
+        const tsc = TSC_RE.exec(line.trim());
+        tscChain = tsc !== null;
+        if (tsc) {
+            signatures.push(`tsc ${normaliseLine(tsc[1], roots)} ${tsc[2]} ${normaliseLine(tsc[3], roots)}`);
+            consumed.add(index);
+            continue;
+        }
+        const file = ESLINT_FILE_RE.exec(line.trim());
+        if (file && !indented) {
+            eslintFile = { name: normaliseLine(file[1], roots), index };
+            continue;
+        }
+        const problem = eslintFile === null ? null : ESLINT_PROBLEM_RE.exec(line);
+        if (problem && eslintFile) {
+            consumed.add(eslintFile.index).add(index);
+            if (problem[1] === 'error')
+                signatures.push(`eslint ${eslintFile.name} ${problem[3] ?? '-'} ${normaliseLine(problem[2], roots)}`);
+            continue;
+        }
+        if (!indented)
+            eslintFile = null;
+    }
+    return { signatures, consumed };
+}
+/** Indexes of the tallies, per-file tables and code frames eslint and tsc print about their diagnostics. */
+function structuredTallies(lines) {
+    const tallies = [];
+    let inTable = false;
+    lines.forEach((line, index) => {
+        const text = line.replace(ANSI_RE, '').trim();
+        inTable = TSC_TABLE_HEAD_RE.test(text) || (inTable && TSC_TABLE_ROW_RE.test(text));
+        if (inTable || STRUCTURED_TALLY_RE.test(text))
+            tallies.push(index);
+        if (FRAME_UNDERLINE_RE.test(text)) {
+            tallies.push(index);
+            if (FRAME_SOURCE_RE.test(lines[index - 1]?.trim() ?? ''))
+                tallies.push(index - 1);
+        }
+    });
+    return tallies;
+}
+/**
+ * The diagnostic signatures of one red stage's log segment (module doc), sorted.
+ * `roots` are checkout paths to strip in addition to those the text names.
+ */
+export function diagnosticSignatures(stageLines, roots = []) {
+    const allRoots = [...roots, ...stageLines.flatMap((line) => logCwdRoots(line))];
+    const lines = ownOutput(stageLines);
+    const { signatures, consumed } = structuredSignatures(lines, allRoots);
+    // What the structured tiers consumed is left out only when they read a signature from it.
+    const rest = lines.filter((line, index) => line.length > 0 && !(signatures.length > 0 && consumed.has(index)));
+    const bearing = rest.filter((line) => ERROR_WORD_RE.test(line) || PATH_TOKEN_RE.test(line));
+    const chosen = bearing.length > 0 || signatures.length > 0 ? bearing : rest;
+    const unstructured = chosen.map((line) => normaliseLine(line, allRoots)).filter((line) => line.length > 0);
+    return [...signatures, ...unstructured].sort();
+}
+/**
+ * The head signatures the base does not cover, as a multiset difference (a
+ * signature the head reports N times and the base M < N times contributes N - M
+ * copies). Empty means covered. Sorted.
+ */
+export function uncoveredDiagnostics(head, base) {
+    const available = new Map();
+    for (const signature of base)
+        available.set(signature, (available.get(signature) ?? 0) + 1);
+    const uncovered = [];
+    for (const signature of head) {
+        const left = available.get(signature) ?? 0;
+        if (left > 0)
+            available.set(signature, left - 1);
+        else
+            uncovered.push(signature);
+    }
+    return uncovered.sort();
+}
+/** A short, bounded rendering of diagnostics for a rationale. */
+export function describeDiagnostics(signatures, limit = 3) {
+    const shown = signatures.slice(0, limit).map((signature) => `"${signature}"`).join(', ');
+    return signatures.length > limit ? `${shown} (+${signatures.length - limit} more)` : shown;
+}
+//# sourceMappingURL=verification-diagnostics.js.map

package/dist/verify/verification-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-diagnostics.js","sourceRoot":"","sources":["../../src/verify/verification-diagnostics.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,yEAAyE;AACzE,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AACpC,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,qBAAqB,EAAE,GAAG,CAAC,CAAC;AAC7D,MAAM,aAAa,GAAG,qCAAqC,CAAC;AAC5D,wGAAwG;AACxG,MAAM,YAAY,GAAG,iEAAiE,CAAC;AACvF,MAAM,UAAU,GAAG,iBAAiB,CAAC;AACrC,+FAA+F;AAC/F,MAAM,gBAAgB,GAAG,8EAA8E,CAAC;AAExG,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAA,6EAA6E,CAAC;AAC5G,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC;AACxD,MAAM,iBAAiB,GAAG,wDAAwD,CAAC;AACnF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,WAAW,0DAA0D,CAAC,CAAC;AACtG,MAAM,aAAa,GAAG,mLAAmL,CAAC;AAC1M,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,+BAA+B,WAAW,EAAE,CAAC,CAAC;AAE/E,mFAAmF;AACnF,MAAM,mBAAmB,GAAG,yGAAyG,CAAC;AACtI,yFAAyF;AACzF,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAC7C,MAAM,gBAAgB,GAAG,WAAW,CAAC;AACrC,kFAAkF;AAClF,MAAM,eAAe,GAAG,OAAO,CAAC;AAChC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,oFAAoF;AACpF,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/E,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,KAAwB;IACxD,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,6EAA6E;AAC7E,SAAS,aAAa,CAAC,IAAY,EAAE,KAAwB;IAC3D,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC;SAChD,OAAO,CAAC,+DAA+D,EAAE,QAAQ,CAAC;SAClF,OAAO,CAAC,oCAAoC,EAAE,QAAQ,CAAC;SACvD,OAAO,CAAC,0CAA0C,EAAE,SAAS,CAAC;SAC9D,OAAO,CAAC,qEAAqE,EAAE,OAAO,CAAC;SACvF,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;SAC/B,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAwB;IACzC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACzD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;YACnD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACb,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAQD,4FAA4F;AAC5F,SAAS,oBAAoB,CAAC,KAAwB,EAAE,KAAwB;IAC9E,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,IAAI,UAAU,GAA2C,IAAI,CAAC;IAC9D,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;YACzB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,0CAA0C;YAC/D,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACrC,QAAQ,GAAG,GAAG,KAAK,IAAI,CAAC;QACxB,IAAI,GAAG,EAAE,CAAC;YACR,UAAU,CAAC,IAAI,CAAC,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACjG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,UAAU,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1E,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;YAC1B,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO;gBAAE,UAAU,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YAClI,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,UAAU,GAAG,IAAI,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED,4GAA4G;AAC5G,SAAS,iBAAiB,CAAC,KAAwB;IACjD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACnF,IAAI,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAA6B,EAAE,QAA2B,EAAE;IAC/F,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACvE,0FAA0F;IAC1F,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3G,OAAO,CAAC,GAAG,UAAU,EAAE,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAuB,EAAE,IAAuB;IACnF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,SAAS,IAAI,IAAI;QAAE,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,IAAI,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;;YAC5C,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,mBAAmB,CAAC,UAA6B,EAAE,KAAK,GAAG,CAAC;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzF,OAAO,UAAU,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,UAAU,CAAC,MAAM,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7F,CAAC"}

package/dist/verify/verification-engine.d.ts

@@ -26,6 +26,7 @@ import { type StrategyResult } from './verification-deterministic.js';
 export { runDeterministicStrategy, type DeterministicLogContext } from './verification-deterministic.js';
 import { type PendingVerification } from '../queries/verification.js';
 import type { DaemonConfig } from '../types/index.js';
+import { type JudgeOptions } from './verification-commit-sharing.js';
 export { collectDefaultOnVerifications, resolveDaemonWideVerifyCap, resolveProductVerificationScopes, verificationSemaphore, VerificationSemaphore, __getVerificationSemaphoreForTests, __resetDefaultOnGuardForTests, __getDefaultOnGuardForTests, __markDefaultOnRanForTests, } from './verification-default-on.js';
 import { type InspectionResult } from './ai-inspection-runner.js';
 export declare function runBehavioralStrategy(): Promise<StrategyResult>;
@@ -67,7 +68,8 @@ export { MERGED_BACK_GIT_STATES, recordedMergeShaForVerify, type VerifyEvidenceD
  * Run verification for a single delivery.
  *
  * Ordering invariants:
- *   1. Run the strategy.
+ *   1. Judge: run the strategy -- or, given `opts.reused`, take the verdict
+ *      already recorded for the commit the delivery is judged on.
  *   2. On verdict 'passed' with an injection node: retire injection FIRST
  *      (verifyInjection runs the reality_tree_verify_injection compound op).
  *      If retirement fails, the outcome demotes to 'pending' so the loop
@@ -80,16 +82,18 @@ export { MERGED_BACK_GIT_STATES, recordedMergeShaForVerify, type VerifyEvidenceD
  * Drift emission is best-effort: a single failure logs and continues so
  * one bad observation does not prevent the rest from being persisted.
  */
-export declare function runVerificationForDelivery(v: PendingVerification, deps: VerificationDeps): Promise<StrategyResult>;
-/**
- * One tick: fetch pending verifications across products, dispatch each.
- * Returns counts for telemetry.
- */
-export declare function runVerificationTick(config: DaemonConfig, deps?: Partial<VerificationDeps>): Promise<{
+export declare function runVerificationForDelivery(v: PendingVerification, deps: VerificationDeps, opts?: JudgeOptions): Promise<StrategyResult>;
+/** A tick's telemetry counts. */
+type TickCounts = {
     checked: number;
     passed: number;
     failed: number;
     pending: number;
     escalated: number;
-}>;
+};
+/**
+ * One tick: fetch pending verifications across products, dispatch each.
+ * Returns counts for telemetry.
+ */
+export declare function runVerificationTick(config: DaemonConfig, deps?: Partial<VerificationDeps>): Promise<TickCounts>;
 //# sourceMappingURL=verification-engine.d.ts.map

package/dist/verify/verification-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verification-engine.d.ts","sourceRoot":"","sources":["../../src/verify/verification-engine.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,KAAK,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AACzG,OAAO,EAEL,KAAK,mBAAmB,EAGzB,MAAM,4BAA4B,CAAC;AAQpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAYtD,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,gCAAgC,EAChC,qBAAqB,EACrB,qBAAqB,EACrB,kCAAkC,EAClC,6BAA6B,EAC7B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,gBAAgB,EACtB,MAAM,2BAA2B,CAAC;AAenC,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,cAAc,CAAC,CAKrE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,gBAAgB,EACtB,CAAC,EAAE,mBAAmB,GACrB,OAAO,CAAC,cAAc,GAAG;IAAE,UAAU,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAmB7D;AAMD;;;;GAIG;AACH,YAAY,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC3F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAO/D,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AAYxC;;;;;;GAMG;AACH,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,kBAAkB,GACxB,MAAM,4BAA4B,CAAC;AA+BpC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,0BAA0B,CAC9C,CAAC,EAAE,mBAAmB,EACtB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,cAAc,CAAC,CAiczB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,YAAY,EACpB,IAAI,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAC/B,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA2FlG"}
+{"version":3,"file":"verification-engine.d.ts","sourceRoot":"","sources":["../../src/verify/verification-engine.ts"],"names":[],"mappings":"AAmBA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,KAAK,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AACzG,OAAO,EAEL,KAAK,mBAAmB,EAGzB,MAAM,4BAA4B,CAAC;AAQpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAQtD,OAAO,EAA8G,KAAK,YAAY,EAAE,MAAM,kCAAkC,CAAC;AASjL,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,gCAAgC,EAChC,qBAAqB,EACrB,qBAAqB,EACrB,kCAAkC,EAClC,6BAA6B,EAC7B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,gBAAgB,EACtB,MAAM,2BAA2B,CAAC;AAenC,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,cAAc,CAAC,CAKrE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,gBAAgB,EACtB,CAAC,EAAE,mBAAmB,GACrB,OAAO,CAAC,cAAc,GAAG;IAAE,UAAU,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAmB7D;AAMD;;;;GAIG;AACH,YAAY,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC3F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAO/D,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AAWxC;;;;;;GAMG;AACH,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,kBAAkB,GACxB,MAAM,4BAA4B,CAAC;AAoDpC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,0BAA0B,CAC9C,CAAC,EAAE,mBAAmB,EACtB,IAAI,EAAE,gBAAgB,EACtB,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,cAAc,CAAC,CA6YzB;AAED,iCAAiC;AACjC,KAAK,UAAU,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAoD1G;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,YAAY,EACpB,IAAI,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAC/B,OAAO,CAAC,UAAU,CAAC,CAuErB"}

package/dist/verify/verification-engine.js

@@ -1,17 +1,31 @@
 // PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
-// Pinned by: packages/daemon/src/resolvers/verify-evidence-merged-back.test.ts,
+// Pinned by: packages/daemon/src/integration/explicit-gate-outcome-restart.test.ts,
+//   packages/daemon/src/integration/explicit-verdict-departure-during-removal.test.ts,
+//   packages/daemon/src/integration/explicit-verdict-invalidation-restart.test.ts,
+//   packages/daemon/src/integration/explicit-verdict-reuse.test.ts,
+//   packages/daemon/src/integration/focus-commit-verdict-scenario.test.ts,
+//   packages/daemon/src/resolvers/verify-evidence-merged-back.test.ts,
 //   packages/daemon/src/verify/shortfall-inward-proposal.test.ts,
+//   packages/daemon/src/verify/verification-attribution.test.ts,
+//   packages/daemon/src/verify/verification-commit-sharing.test.ts,
 //   packages/daemon/src/verify/verification-default-on.test.ts,
 //   packages/daemon/src/verify/verification-engine-real-paths.test.ts,
 //   packages/daemon/src/verify/verification-engine.test.ts,
+//   packages/daemon/src/verify/verification-run-config-source.test.ts,
 //   packages/daemon/src/verify/verification-tick-product-scoping.test.ts,
-//   packages/daemon/src/verify/verify-injection-evidence.test.ts
+//   packages/daemon/src/verify/verify-injection-evidence.test.ts,
+//   packages/daemon/src/verify/verify-unprovisioned-worktree.test.ts
 // PINNED-BY-END
 export { runDeterministicStrategy } from './verification-deterministic.js';
 import { emitObservedShortfallDrift, } from '../queries/verification.js';
 import { diagnoseEmptyDiffSource } from '../resolvers/index.js';
 import { collectDefaultOnVerifications, markDefaultOnRan, resolveDaemonWideVerifyCap, resolveProductVerificationScopes, verificationSemaphore, } from './verification-default-on.js';
-import { applyAttribution } from './verification-baseline.js';
+import { dispatchDefaultOnCandidate, dispatchExplicitCandidate, invalidateSupersededExplicitVerdicts, judgeDelivery } from './verification-commit-sharing.js';
+import { collectRearmedExplicitVerifications } from './explicit-rearm.js';
+import { explicitRunIdOf, recordExplicitGateOutcome, registerGateRun } from './gate-run-registry.js';
+import { explicitGateKeyOf } from './commit-verdict-record.js';
+import { judgedShaOfRun } from './gate-verdict-source.js';
+import { runVerdictOf } from './rework-judgment.js';
 // Re-export the default-on selection + concurrency surface so existing
 // importers (and tests) can reach it through verification-engine.
 export { collectDefaultOnVerifications, resolveDaemonWideVerifyCap, resolveProductVerificationScopes, verificationSemaphore, VerificationSemaphore, __getVerificationSemaphoreForTests, __resetDefaultOnGuardForTests, __getDefaultOnGuardForTests, __markDefaultOnRanForTests, } from './verification-default-on.js';
@@ -68,7 +82,6 @@ import { defaultDeps } from './verification-deps-default.js';
 // daemon 800-line limit. Re-exported so existing importers/tests reach it here.
 export { VERIFY_BASE_REF_ENV, VERIFY_RECORDED_COMMIT_COUNT_ENV, resolveVerifyBoundaryEnv, } from './verification-boundary-env.js';
 import { runDeterministicAtFixedCommit } from './verification-checkout.js';
-import { noteDefaultOnResult } from './verification-default-on.js';
 const STRATEGIES = {
     // Judges a detached checkout of the focus HEAD, never the live worktree a team
     // may be moving (verify/verification-checkout.ts).
@@ -89,19 +102,41 @@ import { buildVerifyEvidence, summarizeEvidenceForInjection, describeMissingJudg
  * Record a verification outcome (a VERDICT only -- the reconciler owns the
  * verify -> done edge) and log it by delivery NAME, so a pass is visible in the
  * daemon log directly (not merely as a tick count) and the closing that follows
- * on review evidence reads as a distinct, later event. Extracted to keep
- * runVerificationForDelivery under the daemon per-function line limit.
+ * on review evidence reads as a distinct, later event. A 'pending' is a finished
+ * run that rendered NO verdict (a discarded checkout run, a pass demoted because
+ * injection retirement threw, an inconclusive inspection), so its line names the
+ * rationale recorded for it. Extracted to keep runVerificationForDelivery under
+ * the daemon per-function line limit.
+ *
+ * An EXPLICIT-METHOD row's outcome is also kept as its gate verdict: its run may
+ * write no per-commit record, and the review exit reads the outcome in its place.
+ * It is kept in process (verify/gate-run-registry.ts) AND on the delivery's
+ * gate_state after recordOutcome's pass reset (verify/explicit-gate-outcome.ts),
+ * under the gate the row applied, so a daemon restart still reads the verdict the
+ * run rendered, and a gate the row names later does not.
+ *
+ * The judged commit rides along, so a pass keeps a review route's stamp of that
+ * same commit (verify/verification-history-reset.ts).
  */
-async function recordAndLogOutcome(deps, v, outcome) {
-    await deps.recordOutcome(v.deliveryId, outcome);
+async function recordAndLogOutcome(deps, v, result) {
+    const { outcome, rationale } = result;
+    await deps.recordOutcome(v.deliveryId, outcome, judgedShaOfRun(result));
+    if (!v.defaultOnSource) {
+        const gateKey = explicitGateKeyOf(v.verificationMethod, v.verificationConfig);
+        recordExplicitGateOutcome(v.deliveryId, result, gateKey);
+        await deps.persistExplicitGateOutcome?.(v.deliveryId, result, gateKey, explicitRunIdOf(v));
+    }
+    const recorded = outcome !== 'pending' ? 'verdict only'
+        : `no verdict: ${rationale !== undefined && rationale.trim() !== '' ? rationale : '(no rationale recorded)'}`;
     log.info(`[verification] recorded outcome '${outcome}' for delivery ` +
-        `"${v.deliveryName}" (${v.deliveryId}) -- verdict only; reconciler owns any status edge`);
+        `"${v.deliveryName}" (${v.deliveryId}) -- ${recorded}; reconciler owns any status edge`);
 }
 /**
  * Run verification for a single delivery.
  *
  * Ordering invariants:
- *   1. Run the strategy.
+ *   1. Judge: run the strategy -- or, given `opts.reused`, take the verdict
+ *      already recorded for the commit the delivery is judged on.
  *   2. On verdict 'passed' with an injection node: retire injection FIRST
  *      (verifyInjection runs the reality_tree_verify_injection compound op).
  *      If retirement fails, the outcome demotes to 'pending' so the loop
@@ -114,10 +149,14 @@ async function recordAndLogOutcome(deps, v, outcome) {
  * Drift emission is best-effort: a single failure logs and continues so
  * one bad observation does not prevent the rest from being persisted.
  */
-export async function runVerificationForDelivery(v, deps) {
-    const strategy = STRATEGIES[v.verificationMethod];
-    const strategyResult = await strategy(deps, v);
-    const result = { ...strategyResult };
+export async function runVerificationForDelivery(v, deps, opts = {}) {
+    // Judge (verify/verification-commit-sharing.ts): the strategy's verdict or the
+    // commit's recorded one, baseline-attributed, and recorded against the commit.
+    const judged = await judgeDelivery(v, deps, () => STRATEGIES[v.verificationMethod](deps, v), opts);
+    const result = judged.result;
+    // Left verify while its run was in flight: the verdict is the commit's (recorded above) and routes nothing.
+    if (!judged.routes)
+        return result;
     // Instrument-fault tracking: set when the verify path could render NO verdict
     // about the WORK. Three origins share this hold and the SAME bounded
     // verify_failed re-work (evidence-unavailable guard, files no escalation):
@@ -127,60 +166,9 @@ export async function runVerificationForDelivery(v, deps) {
     //     failing-test ids (a type-check crash / missing deps / a run that died
     //     before any test ran), or was KILLED by its timeout before completing.
     // A blind or timed-out deterministic run must NEVER be laundered into a
-    // differential pass; it routes here instead. Declared before the attribution
-    // block so that block can set it.
-    let evidenceUnavailableHold = null;
-    // Baseline-diff attribution (deterministic only): a failed HEAD run whose
-    // failures ALL pre-exist on the focus base introduced no regression -> demote
-    // to 'passed' (the differential gate measures only the focus's delta). Runs
-    // BEFORE the pass path so a demotion feeds injection retirement; a null
-    // classification (no baseline) leaves the outcome unchanged (all failures gate).
-    if (v.verificationMethod === 'deterministic' && result.outcome === 'failed') {
-        if (result.timedOut) {
-            // A killed-mid-run process produces garbage output that parses to zero ids;
-            // do NOT attempt baseline attribution against it. Route straight to bounded
-            // instrument-fault re-work -- a timeout is never a verdict about the work.
-            evidenceUnavailableHold = {
-                missing: ['complete deterministic run output (killed by timeout before completion)'],
-                commitsAhead: 0,
-                deterministicFault: { kind: 'timeout', exitCode: result.exitCode ?? null },
-            };
-            log.warn(`[verification] deterministic run timed out for delivery ${v.deliveryId} -- ` +
-                `routing to bounded instrument-fault re-work (not a pass)`);
-        }
-        else if (deps.attributeFailures) {
-            try {
-                const classification = await deps.attributeFailures(v, result);
-                if (classification) {
-                    const attributed = applyAttribution(v.deliveryId, classification);
-                    result.newFailures = attributed.newFailures;
-                    result.preExisting = attributed.preExisting;
-                    result.rationale = attributed.rationale;
-                    if (attributed.outcome === 'blind') {
-                        // Exited non-zero but zero parseable failing ids: the gate cannot
-                        // attribute the failure. Keep the run FAILED (never a differential
-                        // pass) and route it to the bounded instrument-fault re-work path.
-                        result.outcome = 'failed';
-                        evidenceUnavailableHold = {
-                            missing: ['attributable failing-test ids (deterministic run exited non-zero, parsed zero)'],
-                            commitsAhead: 0,
-                            deterministicFault: { kind: 'blind_zero_parse', exitCode: result.exitCode ?? null },
-                        };
-                        log.warn(`[verification] ${attributed.rationale} (delivery ${v.deliveryId}) -- ` +
-                            `routing to bounded instrument-fault re-work`);
-                    }
-                    else {
-                        result.outcome = attributed.outcome;
-                        if (attributed.log)
-                            log.info(attributed.log);
-                    }
-                }
-            }
-            catch (err) {
-                log.warn(`[verification] baseline attribution failed for delivery ${v.deliveryId}:`, err.message);
-            }
-        }
-    }
+    // differential pass; it routes here instead. The judge step's attribution
+    // seeds it.
+    let evidenceUnavailableHold = judged.evidenceUnavailableHold;
     // Shortfall-origin tracking: set when the reconciliation demotes a PASSED
     // outcome to 'failed'. Feedback for a shortfall hold routes under its own
     // guard (not deterministic_verification), so the origin must survive to the
@@ -456,7 +444,7 @@ export async function runVerificationForDelivery(v, deps) {
             }
         }
     }
-    await recordAndLogOutcome(deps, v, result.outcome);
+    await recordAndLogOutcome(deps, v, result);
     // Feedback dispatch by FAILURE ORIGIN. The three origins are mutually
     // exclusive: a shortfall / instrument-fault hold only demotes a PASSED
     // outcome, so a deterministic-failed run carries neither.
@@ -469,7 +457,7 @@ export async function runVerificationForDelivery(v, deps) {
     // holds; the iteration cap (verify_gate_unclearable) is the sole residue.
     if (evidenceUnavailableHold && deps.requeueEvidenceUnavailableAsRework) {
         try {
-            await deps.requeueEvidenceUnavailableAsRework(v, evidenceUnavailableHold);
+            await deps.requeueEvidenceUnavailableAsRework(v, evidenceUnavailableHold, judgedShaOfRun(result), runVerdictOf(result, judged.evidenceUnavailableHold !== null));
         }
         catch (err) {
             log.warn(`[verification] evidence-unavailable re-work failed for delivery ${v.deliveryId}:`, err.message);
@@ -477,7 +465,7 @@ export async function runVerificationForDelivery(v, deps) {
     }
     else if (shortfallHold.length > 0 && deps.deliverShortfallFeedback) {
         try {
-            await deps.deliverShortfallFeedback(v, shortfallHold);
+            await deps.deliverShortfallFeedback(v, shortfallHold, judgedShaOfRun(result), runVerdictOf(result, judged.evidenceUnavailableHold !== null));
         }
         catch (err) {
             log.warn(`[verification] shortfall feedback failed for delivery ${v.deliveryId}:`, err.message);
@@ -513,6 +501,53 @@ export async function runVerificationForDelivery(v, deps) {
     }
     return result;
 }
+/**
+ * Dispatch one product's selected candidates, one at a time under the shared
+ * semaphore. Every candidate is registered as a selected gate run BEFORE any of
+ * them waits on the semaphore (verify/gate-run-registry.ts) -- a review exit about
+ * to send its delivery's work back waits for that verdict -- and each registration
+ * ends when its own dispatch settles. Before any wait, an explicit candidate's
+ * previous verdict is also removed from gate_state, and one whose removal did not
+ * land is not started. Default-on candidates share one run per
+ * focus commit, and neither kind starts or routes a run for a delivery that left
+ * verify (verify/verification-commit-sharing.ts).
+ */
+async function dispatchSelected(selected, explicitIds, deps, counts) {
+    const registrations = selected.map((v) => registerGateRun({ deliveryId: v.deliveryId, focusId: v.focusId, explicit: explicitIds.has(v.deliveryId) }));
+    try {
+        const startable = await invalidateSupersededExplicitVerdicts(selected, explicitIds, registrations, deps);
+        for (const [i, v] of selected.entries()) {
+            if (!startable[i])
+                continue;
+            counts.checked += 1;
+            // Mark default-on candidates as run BEFORE dispatch so a mid-run failure
+            // does not re-enqueue the same 30-min suite on the next tick.
+            const defaultOnCandidate = v.verificationOutcome === null && !explicitIds.has(v.deliveryId);
+            if (defaultOnCandidate)
+                markDefaultOnRan(v.deliveryId);
+            // Cap concurrent whole-repo runs across overlapping ticks.
+            await verificationSemaphore.acquire();
+            try {
+                const r = defaultOnCandidate
+                    ? await dispatchDefaultOnCandidate(v, deps, runVerificationForDelivery)
+                    : await dispatchExplicitCandidate(v, deps, runVerificationForDelivery);
+                if (r)
+                    counts[r.outcome] = (counts[r.outcome] ?? 0) + 1;
+            }
+            catch (err) {
+                log.warn(`[verification] tick failed for delivery ${v.deliveryId}:`, err.message);
+            }
+            finally {
+                verificationSemaphore.release();
+                registrations[i]?.end();
+            }
+        }
+    }
+    finally {
+        for (const registration of registrations)
+            registration.end();
+    }
+}
 /**
  * One tick: fetch pending verifications across products, dispatch each.
  * Returns counts for telemetry.
@@ -533,7 +568,7 @@ export async function runVerificationTick(config, deps) {
     // last product iterated would silently win. See resolveDaemonWideVerifyCap for
     // the rule (min across products) and why.
     verificationSemaphore.setLimit(resolveDaemonWideVerifyCap(scopes));
-    for (const { product, productConfig, resolved } of scopes) {
+    for (const { product, productConfig, resolved, judgedCommitOnly } of scopes) {
         let pending;
         try {
             pending = await merged.getPendingVerifications(product.id);
@@ -543,44 +578,25 @@ export async function runVerificationTick(config, deps) {
             continue;
         }
         // Default-on: append deterministic runs for verify deliveries with no
-        // explicit method (the whole-repo suite the daemon now owns). Inert when
-        // no default command is configured for THIS product (resolved.enabled ===
-        // false) or when its config could not be resolved at all (resolved ===
-        // undefined -- malformed manifest, already logged at ERROR above).
+        // explicit method (the whole-repo suite the daemon now owns). A product whose
+        // repoPath manifest is malformed (resolved === undefined, logged at ERROR
+        // above) still scans, arming only from judged commits (judgedCommitOnly).
         const explicitIds = new Set(pending.map((p) => p.deliveryId));
+        // An explicit row whose recorded pass judged an older commit is selected again (verify/explicit-rearm.ts).
+        const rearmed = await collectRearmedExplicitVerifications(productConfig, explicitIds, merged);
+        for (const r of rearmed)
+            explicitIds.add(r.deliveryId);
+        const scanResolved = resolved ?? judgedCommitOnly;
         let defaultOn = [];
-        if (resolved) {
+        if (scanResolved) {
             try {
-                defaultOn = await collectDefaultOnVerifications(productConfig, resolved, explicitIds, merged);
+                defaultOn = await collectDefaultOnVerifications(productConfig, scanResolved, explicitIds, merged);
             }
             catch (err) {
                 log.warn(`[verification] default-on scan failed for product ${product.id}:`, err.message);
             }
         }
-        for (const v of [...pending, ...defaultOn]) {
-            counts.checked += 1;
-            // Mark default-on candidates as run BEFORE dispatch so a mid-run failure
-            // does not re-enqueue the same 30-min suite on the next tick.
-            const defaultOnCandidate = v.verificationOutcome === null && !explicitIds.has(v.deliveryId);
-            if (defaultOnCandidate) {
-                markDefaultOnRan(v.deliveryId);
-            }
-            // Cap concurrent whole-repo runs across overlapping ticks.
-            await verificationSemaphore.acquire();
-            try {
-                const r = await runVerificationForDelivery(v, merged);
-                // HEAD-keyed guard: a failed commit is not re-verified until HEAD moves.
-                if (defaultOnCandidate)
-                    noteDefaultOnResult(v.deliveryId, r);
-                counts[r.outcome] = (counts[r.outcome] ?? 0) + 1;
-            }
-            catch (err) {
-                log.warn(`[verification] tick failed for delivery ${v.deliveryId}:`, err.message);
-            }
-            finally {
-                verificationSemaphore.release();
-            }
-        }
+        await dispatchSelected([...pending, ...rearmed, ...defaultOn], explicitIds, merged, counts);
     }
     // Clean-environment install probe (Review Gate Hardening, deferrable): an
     // ADDITIONAL, out-of-band pass over manifest-touching verify deliveries,