@warpgogol/forge 5.3.4 → 6.2.0

package/os/rfc/types.ts

@@ -12,7 +12,6 @@
  * </non-goals>
  * </MODULE_CONTRACT>
  *  * <CHANGE_SUMMARY>
-  <item>RFC-0795: added dependsOn, batch fields to RfcFrontmatter and RFC_KNOWN_KEYS; added RFC-IMP-07 to RfcImplementStampRule; added batch/dependsOn to RfcListEntry.</item>
   <item>RFC-0998: added TestProbe and JsonSchemaProbe to AcceptanceProbe union for test and json-schema acceptance probe kinds.</item>
   <item>RFC-0999: added lastRefreshedAt to VerificationEvidence; added RfcVerificationRefreshResult interface.</item>
   <item>RFC-1097: step 6 — compass.migrate codemod run
@@ -21,7 +20,8 @@ Mechanical v1 to v2 header migration across the workspace: 942 files rewritten
   <item>RFC-1097: sweep — packages/forge + services clean
 
 Sweep batch 2: real KEY_DECISIONS on 10 files, expanded purposes (CONTRACT-02/PURPOSE-02), headers on mission/index + gen-upstreams, sanitizeItemText in summary.record (literal Compass tags corrupted history), excludedPaths for wrangler types, test-fixtures testPattern. forge+services now 0 diagnostics under --mode error.</item>
-  <history>RFC-0465, RFC-0478, RFC-0480</history>
+  <item>RFC-1249: wire werkstatt.commands.validate into packages.check + retire CMD-OUTPUT debt</item>
+  <history>RFC-0465, RFC-0478, RFC-0480, RFC-0795</history>
 </CHANGE_SUMMARY>
  ***************************************************************/
 
@@ -338,12 +338,25 @@ export interface VerificationEvidence {
   filesModified?: string[];
 }
 
+export interface VerificationDelta {
+  /** Envelopes that flipped fail → pass since the committed version. */
+  recovered: string[];
+  /** Envelopes that flipped pass → fail since the committed version. */
+  regressed: string[];
+}
+
 export interface RfcVerificationEmitResult {
   command: "rfc.verification.emit";
   status: "pass" | "fail";
-  emitted: Array<{ rfcId: string; file: string; overall: "pass" | "fail" }>;
+  emitted: Array<{
+    rfcId: string;
+    file: string;
+    overall: "pass" | "fail";
+    previousOverall?: "pass" | "fail";
+  }>;
   skipped: Array<{ rfcId: string; reason: "no-probes" }>;
   diagnostics: Diagnostic[];
+  delta?: VerificationDelta;
 }
 
 export interface RfcVerificationRefreshResult {
@@ -353,11 +366,13 @@ export interface RfcVerificationRefreshResult {
     rfcId: string;
     file: string;
     overall: "pass" | "fail";
+    previousOverall?: "pass" | "fail";
     probesTotal: number;
     probesFailed: number;
   }>;
   skipped: Array<{ rfcId: string; reason: "no evidence envelope" | "not implemented" }>;
   diagnostics: Diagnostic[];
+  delta?: VerificationDelta;
   summary: { total: number; passed: number; failed: number; skipped: number };
 } // ─── Validation ──────────────────────────────────────────────────────────────
 export interface RfcValidationViolation {

package/os/rfc/verification-emit.test.ts

@@ -0,0 +1,305 @@
+// @vitest-environment node
+import { test, expect, describe, vi, beforeEach, afterEach } from "vitest";
+import fs from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+import { stringify as yamlStringify } from "yaml";
+
+import {
+  runRfcVerificationEmit,
+  mapWithConcurrency,
+  resolveConcurrency,
+} from "./verification-evidence.ts";
+import type { ForgeCommandInput, ForgeRuntimeContext } from "../../src/types.ts";
+
+const { mockRunProbe } = vi.hoisted(() => ({
+  mockRunProbe: vi.fn(),
+}));
+
+vi.mock("./acceptance.ts", () => ({
+  runProbe: mockRunProbe,
+}));
+
+const RFC_FRONTMATTER = (id: string, status: string, probes: Record<string, unknown>[] = []) => {
+  const probeYaml = probes
+    .map(
+      (p) =>
+        `  - probe: ${p.probe}\n    path: ${p.path ?? ""}\n    criterion: ${p.criterion ?? ""}`,
+    )
+    .join("\n");
+  return `---\nid: ${id}\ntitle: "Test ${id}"\nstatus: ${status}\nkind: command\nscope: workspace\nowners:\n  - architecture\ncreatedAt: 2026-01-01\nupdatedAt: 2026-01-01\nacceptance:\n${probeYaml}\n---\n\n# ${id}\n## Context\nTest.\n`;
+};
+
+const PROBE = { probe: "file-exists", path: "src/index.ts", criterion: "AC-1" };
+
+function makeEnvelope(rfcId: string, overall: "pass" | "fail"): Record<string, unknown> {
+  return {
+    rfcId,
+    title: `Test ${rfcId}`,
+    rfcStatus: "implemented",
+    emittedAt: "2026-01-01T00:00:00.000Z",
+    commit: "abc123",
+    workingTreeDirty: false,
+    kernelVersion: "1.0.0",
+    rfcFileHash: "hash123",
+    acceptanceHash: "accHash123",
+    probes: [{ probe: PROBE, ok: overall === "pass", detail: "", durationMs: 5 }],
+    overall,
+  };
+}
+
+async function setupWorkspace(opts: {
+  rfcs: Array<{ id: string; status: string; probes?: unknown[] }>;
+  envelopes?: Array<{ id: string; overall: "pass" | "fail" }>;
+}): Promise<{ workspaceRoot: string; cleanup: () => Promise<void> }> {
+  const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "rfc-emit-test-"));
+  const rfcDir = path.join(tmpDir, "docs", "rfcs");
+  const verificationDir = path.join(rfcDir, "verification");
+  await fs.mkdir(rfcDir, { recursive: true });
+
+  for (const rfc of opts.rfcs) {
+    const slug = rfc.id.toLowerCase();
+    const probes = rfc.probes ?? [PROBE];
+    await fs.writeFile(
+      path.join(rfcDir, `${slug}-test.md`),
+      RFC_FRONTMATTER(rfc.id, rfc.status, probes),
+    );
+  }
+
+  for (const env of opts.envelopes ?? []) {
+    await fs.mkdir(verificationDir, { recursive: true });
+    await fs.writeFile(
+      path.join(verificationDir, `${env.id.toLowerCase()}.generated.yaml`),
+      yamlStringify(makeEnvelope(env.id, env.overall)) + "\n",
+    );
+  }
+
+  return {
+    workspaceRoot: tmpDir,
+    cleanup: async () => {
+      await fs.rm(tmpDir, { recursive: true, force: true });
+    },
+  };
+}
+
+function makeContext(workspaceRoot: string, overrides: Record<string, unknown> = {}) {
+  return {
+    workspaceRoot,
+    logger: { info: () => {} },
+    outputFormat: "json" as const,
+    commandRegistry: undefined,
+    dryRun: false,
+    ...overrides,
+  };
+}
+
+const envelopePath = (root: string, rfcId: string) =>
+  path.join(root, "docs", "rfcs", "verification", `${rfcId.toLowerCase()}.generated.yaml`);
+
+beforeEach(() => {
+  mockRunProbe.mockReset();
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("rfc.verification.emit — baseline emission", () => {
+  test("writes the emit-canonical structured marker header + envelope", async () => {
+    const { workspaceRoot, cleanup } = await setupWorkspace({
+      rfcs: [{ id: "RFC-0100", status: "implemented" }],
+    });
+
+    try {
+      mockRunProbe.mockResolvedValue({ probe: PROBE, ok: true, detail: "exists" });
+
+      const result = await runRfcVerificationEmit(
+        { flags: { id: "RFC-0100" } } as unknown as ForgeCommandInput,
+        makeContext(workspaceRoot) as unknown as ForgeRuntimeContext,
+      );
+
+      expect(result.data!.emitted).toHaveLength(1);
+      expect(result.exitCode).toBe(0);
+
+      const raw = await fs.readFile(envelopePath(workspaceRoot, "RFC-0100"), "utf-8");
+      // RFC-1237 canonical format: structured marker keys, not '#' comments.
+      expect(raw).toMatch(/^generatedMarker: GENERATED\./);
+      expect(raw).toContain("doNotEdit: DO NOT EDIT THIS FILE.");
+      expect(raw).toContain("ownerCommand: rfc.verification.emit");
+      expect(raw).toContain("regenerateCommand: pnpm exec werkstatt run rfc.verification.emit");
+      expect(raw).toContain("rfcId: RFC-0100");
+      expect(raw).toContain("overall: pass");
+      expect(raw.split("\n").every((line) => !line.startsWith("#"))).toBe(true);
+    } finally {
+      await cleanup();
+    }
+  });
+});
+
+describe("rfc.verification.emit — sweep delta report", () => {
+  test("reports recovered (fail→pass) and regressed (pass→fail) transitions", async () => {
+    const { workspaceRoot, cleanup } = await setupWorkspace({
+      rfcs: [
+        { id: "RFC-0100", status: "implemented" },
+        { id: "RFC-0101", status: "implemented" },
+        { id: "RFC-0102", status: "implemented" },
+      ],
+      envelopes: [
+        { id: "RFC-0100", overall: "fail" },
+        { id: "RFC-0101", overall: "pass" },
+        { id: "RFC-0102", overall: "fail" },
+      ],
+    });
+
+    try {
+      mockRunProbe
+        .mockResolvedValueOnce({ probe: PROBE, ok: true, detail: "exists" })
+        .mockResolvedValueOnce({ probe: PROBE, ok: false, detail: "missing" })
+        .mockResolvedValueOnce({ probe: PROBE, ok: false, detail: "missing" });
+
+      const result = await runRfcVerificationEmit(
+        { flags: { status: "implemented" } } as unknown as ForgeCommandInput,
+        makeContext(workspaceRoot) as unknown as ForgeRuntimeContext,
+      );
+
+      expect(result.data!.delta).toEqual({
+        recovered: ["RFC-0100"],
+        regressed: ["RFC-0101"],
+      });
+      const entries = Object.fromEntries(result.data!.emitted.map((e) => [e.rfcId, e]));
+      expect(entries["RFC-0100"]?.previousOverall).toBe("fail");
+      expect(entries["RFC-0101"]?.previousOverall).toBe("pass");
+      expect(entries["RFC-0102"]?.previousOverall).toBe("fail");
+      const r101Diag = result.data!.diagnostics.find((d) => d.file?.includes("rfc-0101"));
+      expect(r101Diag?.message).toContain("regressed: was pass");
+      expect(result.summary).toContain("1 regressed, 1 recovered");
+    } finally {
+      await cleanup();
+    }
+  });
+});
+
+describe("rfc.verification.emit — RFC-1237 AC-6: dry-run", () => {
+  test("context.dryRun (the real werkstatt run --dry-run path) writes zero envelopes", async () => {
+    const { workspaceRoot, cleanup } = await setupWorkspace({
+      rfcs: [{ id: "RFC-0100", status: "implemented" }],
+    });
+
+    try {
+      mockRunProbe.mockResolvedValue({ probe: PROBE, ok: true, detail: "exists" });
+
+      // The real CLI path: consumeCommonFlags strips --dry-run from argv into
+      // context.dryRun — input.flags carries no "dry-run" key at all.
+      const result = await runRfcVerificationEmit(
+        { flags: { id: "RFC-0100" } } as unknown as ForgeCommandInput,
+        makeContext(workspaceRoot, { dryRun: true }) as unknown as ForgeRuntimeContext,
+      );
+
+      expect(result.data!.emitted).toHaveLength(1);
+      expect(result.summary).toContain("dry-run");
+      await expect(fs.stat(envelopePath(workspaceRoot, "RFC-0100"))).rejects.toThrow();
+      // The verification dir itself is also not created under dry-run.
+      await expect(
+        fs.stat(path.join(workspaceRoot, "docs", "rfcs", "verification")),
+      ).rejects.toThrow();
+    } finally {
+      await cleanup();
+    }
+  });
+
+  test('input.flags["dry-run"] (direct/programmatic callers) writes zero envelopes', async () => {
+    const { workspaceRoot, cleanup } = await setupWorkspace({
+      rfcs: [{ id: "RFC-0100", status: "implemented" }],
+    });
+
+    try {
+      mockRunProbe.mockResolvedValue({ probe: PROBE, ok: true, detail: "exists" });
+
+      const result = await runRfcVerificationEmit(
+        { flags: { id: "RFC-0100", "dry-run": true } } as unknown as ForgeCommandInput,
+        makeContext(workspaceRoot) as unknown as ForgeRuntimeContext,
+      );
+
+      expect(result.summary).toContain("dry-run");
+      await expect(fs.stat(envelopePath(workspaceRoot, "RFC-0100"))).rejects.toThrow();
+    } finally {
+      await cleanup();
+    }
+  });
+
+  test("dry-run still runs probes and reports overall: fail", async () => {
+    const { workspaceRoot, cleanup } = await setupWorkspace({
+      rfcs: [{ id: "RFC-0100", status: "implemented" }],
+    });
+
+    try {
+      mockRunProbe.mockResolvedValue({ probe: PROBE, ok: false, detail: "does not exist" });
+
+      const result = await runRfcVerificationEmit(
+        { flags: { id: "RFC-0100" } } as unknown as ForgeCommandInput,
+        makeContext(workspaceRoot, { dryRun: true }) as unknown as ForgeRuntimeContext,
+      );
+
+      expect(mockRunProbe).toHaveBeenCalledOnce();
+      expect(result.data!.emitted[0]?.overall).toBe("fail");
+      expect(result.exitCode).toBe(1);
+      await expect(fs.stat(envelopePath(workspaceRoot, "RFC-0100"))).rejects.toThrow();
+    } finally {
+      await cleanup();
+    }
+  });
+});
+
+describe("verification sweep — --concurrency", () => {
+  test("mapWithConcurrency preserves input order and bounds parallelism", async () => {
+    let inFlight = 0;
+    let maxInFlight = 0;
+    const items = Array.from({ length: 10 }, (_, i) => i);
+    const results = await mapWithConcurrency(items, 3, async (n) => {
+      inFlight += 1;
+      maxInFlight = Math.max(maxInFlight, inFlight);
+      await new Promise((r) => setTimeout(r, Math.random() * 5));
+      inFlight -= 1;
+      return n * 2;
+    });
+    expect(results).toEqual(items.map((n) => n * 2));
+    expect(maxInFlight).toBeLessThanOrEqual(3);
+    expect(maxInFlight).toBeGreaterThan(1);
+  });
+
+  test("resolveConcurrency: absent→1, garbage→1+warn, >16→clamped", () => {
+    const warnings: string[] = [];
+    const warn = (m: string) => warnings.push(m);
+    expect(resolveConcurrency(undefined)).toBe(1);
+    expect(resolveConcurrency("abc", warn)).toBe(1);
+    expect(resolveConcurrency("0", warn)).toBe(1);
+    expect(resolveConcurrency("4", warn)).toBe(4);
+    expect(resolveConcurrency("99", warn)).toBe(16);
+    expect(warnings).toHaveLength(3);
+  });
+
+  test("--concurrency 3 emits identical results to sequential", async () => {
+    const ids = ["RFC-0201", "RFC-0202", "RFC-0203", "RFC-0204"];
+    const { workspaceRoot, cleanup } = await setupWorkspace({
+      rfcs: ids.map((id) => ({ id, status: "implemented" })),
+    });
+
+    try {
+      mockRunProbe.mockResolvedValue({ probe: PROBE, ok: true, detail: "exists" });
+
+      const result = await runRfcVerificationEmit(
+        { flags: { status: "implemented", concurrency: "3" } } as unknown as ForgeCommandInput,
+        makeContext(workspaceRoot) as unknown as ForgeRuntimeContext,
+      );
+
+      expect(result.data!.emitted.map((e) => e.rfcId)).toEqual(ids);
+      expect(result.data!.emitted.every((e) => e.overall === "pass")).toBe(true);
+      expect(result.exitCode).toBe(0);
+      for (const id of ids) {
+        await expect(fs.stat(envelopePath(workspaceRoot, id))).resolves.toBeDefined();
+      }
+    } finally {
+      await cleanup();
+    }
+  });
+});

package/os/rfc/verification-evidence.ts

@@ -14,6 +14,12 @@ a JSON evidence envelope to docs/rfcs/verification/<slug>.generated.yaml.
 <CHANGE_SUMMARY>
   <item>RFC-0330: initial implementation.</item>
   <item>RFC-0999: exported captureGitContext, getKernelVersion, byteHashHex, VERIFICATION_DIR for reuse by verification-refresh.ts.</item>
+  <item>RFC-1237: dual-read dry-run (context.dryRun || flags["dry-run"]),
+io.writeFile port routing, dry-run summary marker; serializeEvidenceEnvelope —
+shared emit-canonical serializer restoring the structured YAML marker-key
+header (generatedMarker/doNotEdit/ownerCommand/editInstead/regenerateCommand
+with "pnpm exec werkstatt run" prefix), also consumed by refresh.</item>
+  <item>RFC-1249: wire werkstatt.commands.validate into packages.check + retire CMD-OUTPUT debt</item>
 </CHANGE_SUMMARY>
 */
 
@@ -26,9 +32,8 @@ import { byteHash } from "../../src/utils/hash.ts";
 
 import { runProbe } from "./acceptance.ts";
 import { listRfcFiles, readAndParseRfc } from "./frontmatter-io.ts";
-import { writeFileAtomic } from "../../src/utils/fs-atomic.ts";
-import { buildGeneratedHeader } from "../../src/utils/generated-marker.ts";
-import { stringify as yamlStringify } from "yaml";
+import { generatedHeaderFields } from "../../src/utils/generated-marker.ts";
+import { parse as yamlParse, stringify as yamlStringify } from "yaml";
 import { RFC_DIR } from "./types.ts";
 
 // Ambient default for helper fns without a context param — handlers override
@@ -90,6 +95,71 @@ export function byteHashHex(content: string): string {
   return byteHash(content).slice(HASH_PREFIX.length);
 }
 
+/**
+ * Bounded-parallel map preserving input order — one in-flight worker per slot,
+ * results land in the same positions as their inputs. Used by the emit/refresh
+ * sweeps so `--concurrency N` overlaps probe subprocesses across RFCs.
+ */
+export async function mapWithConcurrency<T, R>(
+  items: readonly T[],
+  concurrency: number,
+  worker: (item: T, index: number) => Promise<R>,
+): Promise<R[]> {
+  const results = new Array<R>(items.length);
+  let cursor = 0;
+  const lanes = Array.from({ length: Math.min(Math.max(concurrency, 1), items.length) }, () =>
+    (async () => {
+      while (cursor < items.length) {
+        const index = cursor;
+        cursor += 1;
+        results[index] = await worker(items[index]!, index);
+      }
+    })(),
+  );
+  await Promise.all(lanes);
+  return results;
+}
+
+/**
+ * Resolve the `--concurrency` flag (string flag; the kernel schema has no
+ * number kind). Garbage/NaN/non-positive degrades to 1 with a warning;
+ * clamped to 16 — probe workers spawn vitest/site-kernel children and wider
+ * fan-out starves CPU rather than speeding the sweep.
+ */
+export function resolveConcurrency(flag: unknown, warn?: (message: string) => void): number {
+  if (flag === undefined) return 1;
+  const raw = Array.isArray(flag) ? flag[0] : flag;
+  const parsed = Number.parseInt(String(raw), 10);
+  if (!Number.isFinite(parsed) || parsed < 1) {
+    warn?.(`--concurrency "${String(raw)}" is not a positive integer — falling back to 1.`);
+    return 1;
+  }
+  if (parsed > 16) {
+    warn?.(
+      `--concurrency ${parsed} exceeds the 16 cap — clamped (probe workers spawn subprocesses).`,
+    );
+    return 16;
+  }
+  return parsed;
+}
+
+/**
+ * RFC-1237: the emit-canonical envelope serialization — structured marker keys
+ * (generatedMarker/doNotEdit/ownerCommand/editInstead/regenerateCommand) as
+ * leading YAML fields, then the envelope body. emit and refresh MUST share
+ * this serializer: refresh owns content freshness, never envelope identity
+ * (OWN-DUP-01), so refresh output is identical-by-construction.
+ */
+export function serializeEvidenceEnvelope(envelope: VerificationEvidence): string {
+  return `${yamlStringify({
+    ...generatedHeaderFields({
+      ownerCommand: "rfc.verification.emit",
+      commandPrefix: "pnpm exec werkstatt run",
+    }),
+    ...envelope,
+  })}\n`;
+}
+
 function normalizeProbes(probes: AcceptanceProbe[]): string {
   return JSON.stringify(probes, Object.keys(probes[0] ?? {}).sort());
 }
@@ -130,6 +200,10 @@ export async function runRfcVerificationEmit(
   const rfcDirPath = join(workspaceRoot, RFC_DIR);
   const targetId = input.flags["id"] as string | undefined;
   const targetStatus = input.flags["status"] as string | undefined;
+  // RFC-1237: consumeCommonFlags strips --dry-run into context.dryRun before
+  // dispatch — the input.flags read stays for direct/programmatic callers.
+  const dryRun = context.dryRun === true || input.flags["dry-run"] === true;
+  const concurrency = resolveConcurrency(input.flags["concurrency"], (m) => logger.warn(m));
 
   if (!targetId && !targetStatus) {
     return {
@@ -161,22 +235,27 @@ export async function runRfcVerificationEmit(
   }
   const kernelVersion = await getKernelVersion(workspaceRoot);
   const verificationDirAbs = join(workspaceRoot, VERIFICATION_DIR);
-  await io.mkdir(verificationDirAbs);
+  if (!dryRun) await io.mkdir(verificationDirAbs);
 
-  for (const fileName of allFiles) {
+  const processFile = async (
+    fileName: string,
+  ): Promise<{
+    emittedEntry?: NonNullable<RfcVerificationEmitResult["emitted"]>[number];
+    skippedEntry?: NonNullable<RfcVerificationEmitResult["skipped"]>[number];
+    diagnostic?: Diagnostic;
+  }> => {
     const parsedFile = await readAndParseRfc(rfcDirPath, fileName);
-    if (!parsedFile) continue;
-    if ("error" in parsedFile) continue;
+    if (!parsedFile) return {};
+    if ("error" in parsedFile) return {};
     const fm = parsedFile.parsed.frontmatter;
     const rfcId = String(fm["id"] ?? "");
 
-    if (targetId && rfcId.toLowerCase() !== targetId.toLowerCase()) continue;
-    if (targetStatus && String(fm["status"] ?? "") !== targetStatus) continue;
+    if (targetId && rfcId.toLowerCase() !== targetId.toLowerCase()) return {};
+    if (targetStatus && String(fm["status"] ?? "") !== targetStatus) return {};
 
     const acceptance = fm["acceptance"];
     if (!Array.isArray(acceptance) || acceptance.length === 0) {
-      skipped.push({ rfcId, reason: "no-probes" });
-      continue;
+      return { skippedEntry: { rfcId, reason: "no-probes" } };
     }
 
     const probes = acceptance as AcceptanceProbe[];
@@ -213,29 +292,74 @@ export async function runRfcVerificationEmit(
     const evidenceFileName = `${slug}.generated.yaml`;
     const evidenceRelPath = join(VERIFICATION_DIR, evidenceFileName);
     const evidenceAbsPath = join(workspaceRoot, evidenceRelPath);
-    const jsonContent = `${buildGeneratedHeader({ filePath: evidenceRelPath, ownerCommand: "rfc.verification.emit" })}${yamlStringify(envelope)}\n`;
-    await writeFileAtomic(evidenceAbsPath, jsonContent);
-
-    emitted.push({ rfcId, file: evidenceRelPath, overall: envelope.overall });
 
-    if (envelope.overall === "fail") {
-      diagnostics.push({
-        ruleId: "RFC-EVID-02",
-        severity: "error",
-        file: evidenceRelPath,
-        message: `${rfcId}: evidence overall is "fail" — ${probeRecords.filter((r) => !r.ok).length} probe(s) failed.`,
-      });
+    // Committed-envelope baseline for the sweep delta — lets a fail-heavy run
+    // separate still-failing drift from fresh regressions without git diff.
+    let previousOverall: "pass" | "fail" | undefined;
+    try {
+      const existing = yamlParse(await io.readFile(evidenceAbsPath)) as VerificationEvidence | null;
+      if (existing && (existing.overall === "pass" || existing.overall === "fail")) {
+        previousOverall = existing.overall;
+      }
+    } catch {
+      // No committed envelope — first emission for this RFC.
     }
 
+    // RFC-1237: port write — the recording IO adapter intercepts under kernel
+    // --dry-run even if the explicit guard regresses.
+    if (!dryRun) await io.writeFile(evidenceAbsPath, serializeEvidenceEnvelope(envelope));
+
     if (outputFormat === "pretty") {
+      const drift =
+        previousOverall !== undefined && previousOverall !== envelope.overall
+          ? `, was ${previousOverall}`
+          : "";
       logger.info(
-        `[evidence] ${rfcId} → ${evidenceRelPath} (${envelope.overall}, ${probeRecords.length} probes)`,
+        `[evidence] ${rfcId} → ${evidenceRelPath} (${envelope.overall}, ${probeRecords.length} probes${drift}${dryRun ? ", dry-run" : ""})`,
       );
     }
+
+    return {
+      emittedEntry: {
+        rfcId,
+        file: evidenceRelPath,
+        overall: envelope.overall,
+        ...(previousOverall !== undefined ? { previousOverall } : {}),
+      },
+      ...(envelope.overall === "fail"
+        ? {
+            diagnostic: {
+              ruleId: "RFC-EVID-02",
+              severity: "error",
+              file: evidenceRelPath,
+              message: `${rfcId}: evidence overall is "fail" — ${probeRecords.filter((r) => !r.ok).length} probe(s) failed${previousOverall === "pass" ? " (regressed: was pass)" : ""}.`,
+            } satisfies Diagnostic,
+          }
+        : {}),
+    };
+  };
+
+  const results = await mapWithConcurrency(allFiles, concurrency, processFile);
+  for (const r of results) {
+    if (r.emittedEntry) emitted.push(r.emittedEntry);
+    if (r.skippedEntry) skipped.push(r.skippedEntry);
+    if (r.diagnostic) diagnostics.push(r.diagnostic);
   }
 
   const hasFailures = emitted.some((e) => e.overall === "fail");
   const status: RfcVerificationEmitResult["status"] = hasFailures ? "fail" : "pass";
+  const delta = {
+    recovered: emitted
+      .filter((e) => e.previousOverall === "fail" && e.overall === "pass")
+      .map((e) => e.rfcId),
+    regressed: emitted
+      .filter((e) => e.previousOverall === "pass" && e.overall === "fail")
+      .map((e) => e.rfcId),
+  };
+  const deltaSummary =
+    delta.recovered.length + delta.regressed.length > 0
+      ? `, ${delta.regressed.length} regressed, ${delta.recovered.length} recovered`
+      : "";
 
   return {
     data: {
@@ -244,8 +368,9 @@ export async function runRfcVerificationEmit(
       emitted,
       skipped,
       diagnostics,
+      delta,
     },
     exitCode: hasFailures ? 1 : 0,
-    summary: `rfc.verification.emit: ${emitted.length} emitted, ${skipped.length} skipped`,
+    summary: `rfc.verification.emit: ${emitted.length} emitted, ${skipped.length} skipped${deltaSummary}${dryRun ? ", dry-run" : ""}`,
   };
 }