@yagni-app/code-staging 1.2.10-staging.2105.1 → 1.2.10-staging.2111.1

package/dist/extension/pipeline/verify.js

@@ -36,8 +36,9 @@
  * failures (connection refused, missing env, DB/auth, command not found) and
  * anything UNCERTAIN fail OPEN with an honest note, never a never-clearable
  * critical. A cloud session's gate (`unreadTestFailureIsFinding`) makes an
- * UNCERTAIN failure a finding carrying the output tail, unless the clean tree
- * failed the same command. On a build that named the repository's toolchain
+ * UNCERTAIN failure a finding carrying the output tail: it names nothing the
+ * unchanged code could already have, so it is never excused. On a build that
+ * named the repository's toolchain
  * (`YAGNI_TOOLCHAIN_FILE`, a sandbox) both halves run on it, as the model's
  * shell and the approved checks do ({@link buildGateVerifyEnv},
  * {@link buildGateTestEnv}).
@@ -60,6 +61,7 @@ import { readFileSync } from "node:fs";
 // and would break the walk-up termination check.
 import { basename, dirname, join, relative } from "node:path/posix";
 import { readToolchainFile } from "../toolchain/spawnHook.js";
+import { attributeFailure, canonicalCheckCommand, checkId, diagKey, testKey, } from "./checkAttribution.js";
 import { killTreeSync, trackChild } from "./childRegistry.js";
 import { claimCovers } from "./fanout.js";
 import { ciJobInScope } from "./missionChecks.js";
@@ -115,43 +117,13 @@ export function checkLabel(command) {
     return command.length > 80 ? `${command.slice(0, 77)}...` : command;
 }
 /**
- * Package-manager words that are the manager's own command, never a script:
- * `yarn add`, `pnpm install`. Any other word after `yarn` or `pnpm` runs the
- * script of that name, as `run` does.
+ * A command as the gate compares two (staging bench 2026-10-25: the gate's
+ * own `test` script and two approved twins ran one suite three times):
+ * `checkAttribution.ts`, the one rule the host's attempts/inputs.ts keeps
+ * too; both test files read one corpus,
+ * test/fixtures/equivalentCheckCommands.json.
  */
-const YARN_COMMANDS = new Set("add audit autoclean bin cache check config constraints create dedupe dlx exec explain generate-lock-entry global help import info init install licenses link list login logout node npm outdated owner pack patch patch-commit plugin policies publish rebuild remove run set stage tag team unlink unplug up upgrade upgrade-interactive version versions why workspace workspaces".split(" "));
-const PNPM_COMMANDS = new Set("add audit bin cache cat-file cat-index config create dedupe deploy dlx doctor env exec fetch find-hash i import init install install-test it licenses link list ln ls outdated pack patch patch-commit patch-remove prune publish rb rebuild recursive remove rm root run self-update server setup store un uninstall unlink up update why".split(" "));
-/** The scripts npm runs without `run`: its lifecycle shorthands. */
-const NPM_SCRIPT_SHORTHANDS = new Set(["test", "start", "stop", "restart"]);
-/**
- * A command as the gate compares two: the same words, whatever spaces sit
- * between them, and a package manager's script named the one way it runs,
- * so `yarn test` and `yarn run test`, `npm test` and `npm run test`, `pnpm
- * lint` and `pnpm run lint` are one check, run once (staging bench
- * 2026-10-25: the gate's own `test` script and two approved twins ran one
- * suite three times). Only the leading form: a manager's flags before the
- * script leave the command as it is. The same rule as
- * `canonicalCheckCommand` in the backend's attempts/inputs.ts; both test
- * files read one corpus, test/fixtures/equivalentCheckCommands.json. Pure.
- */
-export function canonicalCheckCommand(command) {
-    const words = command.trim().split(/\s+/).filter(Boolean);
-    const [manager, next, ...rest] = words;
-    const script = /^[A-Za-z0-9][\w:.@/-]*$/;
-    if (manager === "npm" || manager === "yarn" || manager === "pnpm") {
-        const runs = next === "run" || (manager === "npm" && next === "run-script");
-        if (runs && rest[0] && script.test(rest[0]))
-            return [manager, "run", ...rest].join(" ");
-        const shorthand = next !== undefined &&
-            script.test(next) &&
-            (manager === "npm"
-                ? NPM_SCRIPT_SHORTHANDS.has(next)
-                : !(manager === "yarn" ? YARN_COMMANDS : PNPM_COMMANDS).has(next));
-        if (shorthand)
-            return [manager, "run", next, ...rest].join(" ");
-    }
-    return words.join(" ");
-}
+export { canonicalCheckCommand };
 /** Git subcommands that only read: a check may run them as often as it likes. */
 const READ_ONLY_GIT = new Set("status diff log show ls-files ls-tree rev-parse rev-list check-ignore grep blame describe cat-file shortlog diff-tree merge-base for-each-ref show-ref name-rev count-objects var version help".split(" "));
 /**
@@ -781,12 +753,28 @@ function stripDuration(name) {
 }
 /** A failing-test bullet: jest `✕ name`, vitest `×/✗ name`, node spec `✖ name`. */
 const FAIL_BULLET = /^[✕✖✗×]\s+(.+)$/;
+/**
+ * A bullet that names no test: node:test's footer header, and ESLint's
+ * `✖ 3 problems (3 errors, 0 warnings)`, whose rows are diagnostics.
+ */
+const NOT_A_TEST = /^(?:failing tests:?|\d+ problems? \(.*\))$/i;
 /** node:test spec-reporter location line printed right above the footer's ✖ line. */
 const NODE_TEST_AT = /^test at (\S+?):(\d+)(?::\d+)?$/;
 /** TAP failing line (node:test tap reporter): `not ok 1 - name`. */
 const TAP_NOT_OK = /^not ok\s+\d+\s+-\s+(.+)$/;
 /** vitest per-test failure header: ` FAIL  file > suite > name` (jest's has no `>`). */
 const RUNNER_FAIL = /^FAIL\s+(\S+)(?:\s+>\s+(.+))?/;
+/**
+ * Other runners' failing-test lines, each naming its test: pytest's
+ * `FAILED file::name` and Pest's `FAILED Class > name` (without pytest's
+ * ` - reason`; a bare `FAILED to start` is no test), PHPUnit's
+ * `1) Class::method`, go's `--- FAIL: TestName`.
+ */
+const NAMED_TEST_FAILURE = [
+    /^FAILED\s+(\S+(?:::|\s+>\s+)\S.*?)(?:\s+-\s.*)?$/,
+    /^\d+\)\s+(\S+::\S+)(?:\s+with data set .*)?$/,
+    /^--- FAIL:\s+(\S+)/,
+];
 /** Evidence that a test RUN happened and failed, even when no per-test line parsed. */
 const FAILURE_SUMMARY = [
     /(?:^|\n)\s*# fail\s+[1-9]\d*\b/, // node:test TAP footer
@@ -810,7 +798,8 @@ const FAILURE_SUMMARY = [
  *    prerequisite ({@link classifyMissingPrerequisite}, given the `env` the
  *    command ran under) is `infra` with `needs` and the cause "needs <it>".
  *  - recognisable failing-test lines (pnpm-wrapped vitest / jest / node:test
- *    TAP + spec reporters) → `failures` with located `critical` findings
+ *    TAP + spec reporters, pytest, Pest, PHPUnit, go test) → `failures` with
+ *    located `critical` findings
  *    (capped at 25, deduped, locations attached when the runner printed them).
  *  - a failure summary with no parseable per-test lines → one capped tail
  *    finding (still real evidence tests ran and failed).
@@ -854,7 +843,7 @@ export function classifyTestFailure(output, exitCode, limit = MAX_LOCATED_FINDIN
         const bullet = line.match(FAIL_BULLET) ?? line.match(TAP_NOT_OK);
         if (bullet) {
             const name = stripDuration(bullet[1]);
-            if (name && name.length <= 200 && !/^failing tests:?$/i.test(name)) {
+            if (name && name.length <= 200 && !NOT_A_TEST.test(name)) {
                 parsed = { message: name };
                 if (pendingLocation) {
                     parsed.file = pendingLocation.file;
@@ -876,6 +865,12 @@ export function classifyTestFailure(output, exitCode, limit = MAX_LOCATED_FINDIN
                 else
                     currentFile = fail[1];
             }
+            else {
+                const named = NAMED_TEST_FAILURE.map((re) => line.match(re)).find(Boolean);
+                const name = named ? stripDuration(named[1]) : "";
+                if (name && name.length <= 200)
+                    parsed = { message: name };
+            }
         }
         if (!parsed)
             continue;
@@ -1024,62 +1019,39 @@ function liftFinding(finding, repoRoot, commandCwd) {
     const file = toRepoRelativePath(finding.file, repoRoot, commandCwd);
     return file === finding.file ? finding : { ...finding, file };
 }
-/**
- * A test command's baseline entry when the clean tree failed it with output
- * no parser reads: it already failed there. It matches no failure's key, so
- * it never excuses a finding.
- */
-const UNREAD_FAILURE_KEY = "\u0000unread failure";
-/** One command's identity across the baseline run and the build's runs: where it runs and what it runs. */
-export function verifyCommandKey(command) {
-    return `${command.cwd}\u0000${command.argv.join(" ")}`;
+/** A detected command's id, as the base measurement and the gate both key it. */
+export function commandCheckId(repoRoot, command) {
+    return checkId(command.argv.join(" "), relative(repoRoot, command.cwd) || ".");
 }
 /**
- * One failure's key, the shape #2601's `failureKeyOf` gives a CI failure: the
- * repo-relative file and the message, never the line, since a change above a
- * failure moves it. A failure that is only the output's tail names nothing
- * stable, so it has no key and is never excused. Pure.
+ * One finding's failure key, in `checkAttribution.ts`'s shapes: a failing
+ * test's name, or a located diagnostic's repo-relative file and message,
+ * never its line, since a change above a failure moves it. A finding that is
+ * only the output's tail names nothing stable: null, and never excused. Read
+ * before the finding is prefixed with what ran. Pure.
  */
-export function verifyFailureKey(finding) {
+export function findingKey(finding) {
     if (finding.message.includes("Output tail:"))
         return null;
-    return `${finding.file ?? ""}\u0000${finding.message}`;
-}
-/** How many times each failure key occurs. Pure. */
-export function failureKeyCounts(findings) {
-    const counts = new Map();
-    for (const finding of findings) {
-        const key = verifyFailureKey(finding);
-        if (key !== null)
-            counts.set(key, (counts.get(key) ?? 0) + 1);
-    }
-    return counts;
+    const test = /^verify: test failed: ([\s\S]+)$/.exec(finding.message);
+    if (test)
+        return testKey(test[1]);
+    return finding.file ? diagKey(finding.file, finding.message.replace(/^verify: /, "")) : null;
 }
 /**
- * The failures this change caused: each failure key is excused at most as many
- * times as the clean tree had it, so a second copy of an old error is new. A
- * failure in a file the build did not touch still counts when the baseline did
- * not have it, since a change can break another file's types. No baseline for
- * the command leaves every failure in place. Pure.
+ * The failures this change caused, by `attributeFailure`: each failure the
+ * unchanged code already had is excused once, so a second copy of an old
+ * error is new, and a failure that names nothing never is. No measurement on
+ * the base leaves every failure in place. `keys` is index for index with
+ * `findings`. Pure.
  */
-export function subtractBaseline(findings, baseline) {
-    if (!baseline)
-        return { findings: [...findings], excused: 0 };
-    const left = new Map(baseline);
-    const fresh = [];
-    let excused = 0;
-    for (const finding of findings) {
-        const key = verifyFailureKey(finding);
-        const count = key === null ? 0 : (left.get(key) ?? 0);
-        if (key !== null && count > 0) {
-            left.set(key, count - 1);
-            excused += 1;
-        }
-        else {
-            fresh.push(finding);
-        }
-    }
-    return { findings: fresh, excused };
+export function attributeFindings(findings, keys, base) {
+    const { verdict, excused } = attributeFailure({ keys }, base);
+    return {
+        findings: findings.filter((_, index) => !excused[index]),
+        excused: excused.filter(Boolean).length,
+        verdict,
+    };
 }
 /** The note for failures the clean tree already had, by command label. Pure. */
 export function preexistingNote(byLabel) {
@@ -1432,7 +1404,8 @@ export function makeWorkstreamCheck(opts = {}) {
                 anyRan = true;
                 labels.push(command.label);
                 if (run.code !== 0) {
-                    const parsed = subtractBaseline(parseVerifyFailures(run.output, run.code, command.label, Number.POSITIVE_INFINITY).map((f) => liftFinding(f, cwd, command.cwd)), opts.baseline?.get(verifyCommandKey(command))).findings.slice(0, MAX_LOCATED_FINDINGS);
+                    const lifted = parseVerifyFailures(run.output, run.code, command.label, Number.POSITIVE_INFINITY).map((f) => liftFinding(f, cwd, command.cwd));
+                    const parsed = attributeFindings(lifted, lifted.map(findingKey), opts.onBase?.get(commandCheckId(cwd, command))).findings.slice(0, MAX_LOCATED_FINDINGS);
                     const covered = parsed.filter((f) => f.file != null && target.files.some((claim) => claimCovers(claim, f.file)));
                     findings.push(...covered.map((f) => tagFinding(f, target.name)));
                     if (!uncoveredEmitted.has(memoKey)) {
@@ -1455,34 +1428,36 @@ export function makeWorkstreamCheck(opts = {}) {
 }
 /**
  * A failing repository command's findings, located from the folder it ran in
- * and prefixed with what ran: the gate's on the build's tree, and the
- * unchanged code's measurement ({@link makeMeasureChecksOnBase}), so a failure
- * keys the same on both. Pure.
+ * and prefixed with what ran, each with its failure key ({@link findingKey},
+ * index for index): the gate's on the build's tree, and the unchanged code's
+ * measurement ({@link makeMeasureOnBase}), so a failure keys the same on
+ * both. Pure.
  */
-function repoCommandFindings(failure, at) {
+export function repoCommandFindings(failure, at) {
     const limit = at.limit ?? MAX_LOCATED_FINDINGS;
     const cls = classifyTestFailure(failure.output, failure.code, limit, failure.env);
-    const parsed = cls.kind === "failures"
+    const parsed = (cls.kind === "failures"
         ? cls.findings
-        : parseVerifyFailures(failure.output, failure.code, at.label, limit);
-    return parsed.map((f) => ({
-        ...liftFinding(f, at.repoRoot, at.dir),
-        message: `${at.prefix}: ${f.message}`,
-    }));
+        : parseVerifyFailures(failure.output, failure.code, at.label, limit)).map((f) => liftFinding(f, at.repoRoot, at.dir));
+    return {
+        findings: parsed.map((f) => ({ ...f, message: `${at.prefix}: ${f.message}` })),
+        keys: parsed.map(findingKey),
+    };
 }
 /** What an approved check's failure is prefixed with, on the build's tree and on the unchanged code. */
 const approvedPrefix = (label) => `approved check \`${label}\``;
+/** An approved check's id: the command, run from the repository root. */
+const approvedId = (check) => checkId(check.command, ".");
 /**
- * An approved check's standing on the unchanged code. What the session
- * measured there stands over what the host handed it: a red the record kept
- * may be stale.
+ * An approved check's standing on the unchanged code, for its record before
+ * it runs. What the session measured there stands over what the host handed
+ * it: a red the record kept may be stale. A label only: whether a failure is
+ * the change's is `attributeFindings`'s, never this.
  */
 function measuredBaseline(onBase, check) {
-    const command = check.command.trim();
-    if (onBase?.failed.has(command))
-        return "fails_on_base";
-    if (onBase?.passed.has(command))
-        return "runnable";
+    const measured = onBase?.get(approvedId(check));
+    if (measured)
+        return measured.outcome === "failed" ? "fails_on_base" : "runnable";
     return check.status;
 }
 /**
@@ -1573,7 +1548,7 @@ export function makeRunVerify(opts = {}) {
                     cwd: ".",
                     exitCode: null,
                     durationMs: 0,
-                    baseline: last?.baseline ?? measuredBaseline(opts.checksOnBase, check),
+                    baseline: last?.baseline ?? measuredBaseline(opts.onBase, check),
                     note: `${CHECK_NOT_RUN_NOTE}: ${why}${earlierRunWords(last)}`,
                 },
             ];
@@ -1584,10 +1559,10 @@ export function makeRunVerify(opts = {}) {
      * request's CI steps its changed paths trigger. A failure becomes `critical`
      * findings the fix turn works on, except where it can never clear: a check
      * the sandbox cannot start, an infra failure, a path the check reads that is
-     * not there ({@link classifyMissingInput}), an approved check that already
-     * failed on the unchanged code (the host compares it after the build), and a
-     * CI step that fails exactly as it did before a fix turn (it may fail on the
-     * base too, and the pull request's CI shows it). Those are notes.
+     * not there ({@link classifyMissingInput}), the failures of an approved
+     * check the unchanged code already had (`attributeFindings`), and a CI step
+     * that fails exactly as it did before a fix turn (it may fail on the base
+     * too, and the pull request's CI shows it). Those are notes.
      */
     async function runRepoChecks(input) {
         const { file, cwd, signal } = input;
@@ -1732,12 +1707,10 @@ export function makeRunVerify(opts = {}) {
     /**
      * One repository command's verdict: passed, a note (it could not run), or a
      * failure with its output. A check that passed on the unchanged code
-     * (`passedOnBase`, measured in this environment) and now says it lacks a
-     * credential failed: the change made it need one, and that is the change's
-     * (`needs` says what). Only a session that measured knows it passed: a
-     * resumed session that could not measure on the attempt's base gets what
-     * failed there from its host, never what passed, so there the same check
-     * is could not run, failing open.
+     * (`passedOnBase`, measured in this environment, by this session or an
+     * earlier one of the attempt) and now says it lacks a credential failed:
+     * the change made it need one, and that is the change's (`needs` says
+     * what). With no measurement the same check is could not run, failing open.
      * The stream hears the command start, and its end here unless it failed:
      * a failure's caller tells its end once it decided whose the failure is.
      */
@@ -1775,10 +1748,10 @@ export function makeRunVerify(opts = {}) {
             // A path the check reads that is not there (a log an earlier plan step
             // writes, a folder named from the wrong root) gave no verdict either,
             // unless the check passed on the unchanged code: then the change lost it.
-            // One already failing on the base is a note as it is, its record kept.
+            // A red label on the check changes nothing: it excuses no failure.
             const cause = cls.kind === "infra" && !(cls.needs && check.passedOnBase)
                 ? cls.reason
-                : cls.kind === "uncertain" && check.baseline === "runnable" && !check.passedOnBase
+                : cls.kind === "uncertain" && !check.passedOnBase
                     ? classifyMissingInput(command, output, {
                         repoRoot: run.cwd,
                         dir,
@@ -1816,15 +1789,19 @@ export function makeRunVerify(opts = {}) {
             return { kind: "note", reason: `could not run: ${scrubSecrets(msg)}` };
         }
     }
-    /** A failure's findings, located from the folder the command ran in and prefixed with what ran. */
-    function repoFailureFindings(run, failure, label, prefix, dir) {
-        return repoCommandFindings(failure, { label, prefix, repoRoot: run.cwd, dir });
+    /** A failure's findings and their keys, located from the folder the command ran in and prefixed with what ran. */
+    function repoFailureFindings(run, failure, at) {
+        return repoCommandFindings(failure, { ...at, repoRoot: run.cwd });
     }
     const findingRoom = (run) => Math.max(0, MAX_LOCATED_FINDINGS - run.findings.length);
     /**
      * The plan's approved checks, at the repository root as the host runs them.
-     * One that already failed on the unchanged code is a note: the host compares
-     * the two after the build.
+     * Of a failure, only what the unchanged code did not already have is this
+     * change's (`attributeFindings` against the check's measurement there): a
+     * check every failure of which the base had is a note, labelled
+     * `fails_on_base`; any other failure reads as the change's, for the host
+     * too. A check `checks.json` calls red with no measurement here excuses
+     * nothing.
      */
     async function runApprovedChecks(run, approved) {
         for (const check of approved) {
@@ -1841,14 +1818,13 @@ export function makeRunVerify(opts = {}) {
                 run.reasons.push(`approved check \`${label}\` not run: it changes the checkout's git state (a branch, a commit or a reset), which a check must never do`);
                 continue;
             }
-            // The failures it had there, when the session measured it failing.
-            const failedOnBase = opts.checksOnBase?.failed.get(check.command.trim());
-            const status = measuredBaseline(opts.checksOnBase, check);
+            // How it went on the unchanged code, when a session measured it there.
+            const base = opts.onBase?.get(approvedId(check));
             const recorded = run.checks.length;
             const verdict = await runRepoCommand(run, check.command, run.cwd, undefined, {
                 name: label,
-                baseline: status,
-                passedOnBase: opts.checksOnBase?.passed.has(check.command.trim()) ?? false,
+                baseline: measuredBaseline(opts.onBase, check),
+                passedOnBase: base?.outcome === "passed",
             });
             // `runRepoCommand` records every run once, whatever its verdict.
             const ran = run.checks[recorded];
@@ -1864,32 +1840,28 @@ export function makeRunVerify(opts = {}) {
             if (verdict.kind === "note") {
                 run.reasons.push(`approved check \`${label}\` ${verdict.reason}`);
             }
-            else if (verdict.kind === "failed" && failedOnBase) {
-                // Only what the unchanged code did not already fail is this change's.
-                // A failure no parser reads is excused only when the unchanged code's
-                // was unread too (a summary line, as PHPUnit prints); after readable
-                // failures there, it says the change broke the run itself.
-                const found = repoFailureFindings(run, verdict, label, approvedPrefix(label), run.cwd);
-                const fresh = subtractBaseline(found, failedOnBase).findings.filter((finding) => failedOnBase.size > 0 || verifyFailureKey(finding) !== null);
-                if (fresh.length === 0) {
+            else if (verdict.kind === "failed") {
+                // Every failure read, so none past the findings' cap goes unweighed.
+                const found = repoFailureFindings(run, verdict, {
+                    label,
+                    prefix: approvedPrefix(label),
+                    dir: run.cwd,
+                    limit: Number.POSITIVE_INFINITY,
+                });
+                const fresh = attributeFindings(found.findings, found.keys, base);
+                // Its record says how it stands, for the host too: a check with a
+                // failure of its own, or none to compare with, is the change's.
+                verdict.record.baseline = fresh.verdict === "preexisting" ? "fails_on_base" : "runnable";
+                if (fresh.verdict === "preexisting") {
                     run.reasons.push(`approved check \`${label}\` failed as it did on the unchanged code before the build; not this change's`);
                 }
                 else {
-                    // Its record reads as the change's failure, for the host too.
-                    verdict.record.baseline = "runnable";
                     run.labels.push(label);
-                    run.findings.push(...fresh.slice(0, findingRoom(run)));
+                    run.findings.push(...fresh.findings.slice(0, findingRoom(run)));
                 }
             }
-            else if (verdict.kind === "failed" && status === "fails_on_base") {
-                run.reasons.push(`approved check \`${label}\` failed, and it already failed on the unchanged code; the host compares the two after the build`);
-            }
             else {
                 run.labels.push(label);
-                if (verdict.kind === "failed") {
-                    const found = repoFailureFindings(run, verdict, label, approvedPrefix(label), run.cwd);
-                    run.findings.push(...found.slice(0, findingRoom(run)));
-                }
             }
             if (verdict.kind === "failed")
                 opts.onCheck?.(checkEnded(verdict.record, verdict.output));
@@ -1968,7 +1940,11 @@ export function makeRunVerify(opts = {}) {
             }
             settle(job, "failed");
             opts.onCheck?.(checkEnded(verdict.record, verdict.output));
-            const stepFindings = repoFailureFindings(run, verdict, step.name, where, dir);
+            const stepFindings = repoFailureFindings(run, verdict, {
+                label: step.name,
+                prefix: where,
+                dir,
+            }).findings;
             const keys = new Set(stepFindings.map((f) => f.message));
             const previous = lastCiFailure.get(key);
             lastCiFailure.set(key, keys);
@@ -2012,10 +1988,17 @@ export function makeRunVerify(opts = {}) {
                 preexisting.set(label, (preexisting.get(label) ?? 0) + n);
         };
         const checks = [];
-        // A detected command's standing on the clean tree, from the baseline run.
-        const standing = (command) => {
-            const counts = opts.baseline?.get(verifyCommandKey(command));
-            return counts && [...counts.values()].some((n) => n > 0) ? "fails_on_base" : "runnable";
+        /**
+         * A detected command's failures this change caused, against its
+         * measurement on the unchanged code; its record's label is
+         * `fails_on_base` only when the base had every one of them.
+         */
+        const judged = (command, failed) => {
+            const lifted = failed.map((f) => liftFinding(f, cwd, command.cwd));
+            const fresh = attributeFindings(lifted, lifted.map(findingKey), opts.onBase?.get(commandCheckId(cwd, command)));
+            countPreexisting(command.label, fresh.excused);
+            const baseline = fresh.verdict === "preexisting" ? "fails_on_base" : "runnable";
+            return { findings: fresh.findings, baseline };
         };
         /** A detected command starting, as the stream hears it. */
         const commandStarted = (command) => opts.onCheck?.({
@@ -2066,18 +2049,17 @@ export function makeRunVerify(opts = {}) {
                         continue;
                     }
                 }
-                recordCommand(command, code, startedAt, standing(command), { output });
+                const fresh = code === 0
+                    ? null
+                    : judged(command, parseVerifyFailures(output, code, command.label, Number.POSITIVE_INFINITY));
+                recordCommand(command, code, startedAt, fresh?.baseline ?? "runnable", { output });
                 anyRan = true;
                 typecheckLabels.push(command.label);
-                if (code !== 0) {
-                    const parsed = parseVerifyFailures(output, code, command.label, Number.POSITIVE_INFINITY).map((f) => liftFinding(f, cwd, command.cwd));
-                    const fresh = subtractBaseline(parsed, opts.baseline?.get(verifyCommandKey(command)));
-                    countPreexisting(command.label, fresh.excused);
+                if (fresh)
                     findings.push(...fresh.findings.slice(0, MAX_LOCATED_FINDINGS));
-                }
             }
             catch (err) {
-                recordCommand(command, null, startedAt, standing(command), {
+                recordCommand(command, null, startedAt, "runnable", {
                     note: unexitedNote(err, signal, composed),
                 });
                 const msg = err instanceof Error ? err.message : String(err);
@@ -2129,28 +2111,19 @@ export function makeRunVerify(opts = {}) {
                             reasons.push(`tests (${where}) could not run: ${cls.reason}; 'clean' reflects typecheck + review only`);
                             continue;
                         }
-                        const base = standing(command);
                         if (cls.kind === "uncertain" && opts.unreadTestFailureIsFinding) {
                             anyRan = true;
                             testLabels.push(command.label);
-                            if (base === "fails_on_base") {
-                                const summary = exitSummary(command.label, code, output);
-                                recordCommand(command, code, startedAt, base, {
-                                    note: `failed on the unchanged code too: ${summary}`,
-                                    output,
-                                });
-                                reasons.push(`tests (${where}) failed on the unchanged code too, so not a finding: ${summary}`);
-                            }
-                            else {
-                                // One finding per command, past the cap too: it is the only
-                                // word of this command's failure.
-                                recordCommand(command, code, startedAt, base, { output });
-                                testFindingCount += 1;
-                                findings.push(tailFinding(command.label, code, output));
-                            }
+                            // One finding per command, past the cap too: it is the only
+                            // word of this command's failure, and it names nothing the
+                            // unchanged code could already have, so it is never excused.
+                            recordCommand(command, code, startedAt, "runnable", { output });
+                            testFindingCount += 1;
+                            findings.push(tailFinding(command.label, code, output));
                             continue;
                         }
-                        recordCommand(command, code, startedAt, base, { output });
+                        const fresh = cls.kind === "failures" ? judged(command, cls.findings) : null;
+                        recordCommand(command, code, startedAt, fresh?.baseline ?? "runnable", { output });
                         if (cls.kind === "uncertain") {
                             // Failing OPEN on an uninterpretable failure (§3d): an honest note,
                             // never a guessed finding the fix stage cannot clear.
@@ -2159,17 +2132,15 @@ export function makeRunVerify(opts = {}) {
                         }
                         anyRan = true;
                         testLabels.push(command.label);
-                        if (cls.kind === "failures") {
+                        if (fresh) {
                             const room = Math.max(0, MAX_LOCATED_FINDINGS - testFindingCount);
-                            const fresh = subtractBaseline(cls.findings.map((f) => liftFinding(f, cwd, command.cwd)), opts.baseline?.get(verifyCommandKey(command)));
-                            countPreexisting(command.label, fresh.excused);
                             const take = fresh.findings.slice(0, room);
                             testFindingCount += take.length;
                             findings.push(...take);
                         }
                     }
                     catch (err) {
-                        recordCommand(command, null, startedAt, standing(command), {
+                        recordCommand(command, null, startedAt, "runnable", {
                             note: unexitedNote(err, signal, composed),
                         });
                         const msg = err instanceof Error ? err.message : String(err);
@@ -2259,242 +2230,192 @@ export function makeRunVerify(opts = {}) {
         };
     };
 }
-/** The whole baseline run's cap, before the build starts: it costs minutes at most. */
-export const VERIFY_BASELINE_BUDGET_MS = 10 * 60_000;
+/** The whole base measurement's cap, before the build starts: it costs minutes at most. */
+export const BASE_MEASUREMENT_BUDGET_MS = 10 * 60_000;
 /**
- * Run the gate's own typecheck and test commands ONCE on the clean tree,
- * before the build changes anything (YAG-1003), in the package dirs the
- * approved plan names, and keep each command's failure keys. The build's gate
- * then counts only the failures this change added ({@link subtractBaseline}).
- *
- * The same detection, exec seam and environments as {@link makeRunVerify}, so
- * a command's key and its failures' keys match the build's runs. Fail-open per
- * command: one that cannot run, times out, or is not reached in the budget
- * has no baseline, and its failures all count, as before. What the commands
- * write into the tree is undone, so none of it reaches the candidate.
+ * What the gate will judge, in the order it is measured: the approved
+ * checks `checks.json` marks `measureOnBase` (every one it can run with
+ * `allChecks`, a resumed session's rule: the record's green is what went
+ * stale), then the gate's own typecheck and test commands in `dirs`, the
+ * packages the build will change. Each once, by id; a check that changes the
+ * checkout's git state or that the sandbox cannot run is never one. Read on
+ * the tree as it is: the gate detects its commands on the build's tree, so
+ * these are the ids it will look up.
  */
-export function makeTakeVerifyBaseline(opts = {}) {
-    const detect = opts.detect ?? defaultDetect;
-    const detectTests = opts.detectTests ?? defaultDetectTests;
-    const exec = opts.exec ?? defaultExec;
-    const now = opts.now ?? Date.now;
-    const treeStatus = opts.treeStatus ??
-        (async (cwd, signal) => (await snapshotWorkspace(cwd, signal)).status);
-    const undoTreeWrites = opts.undoTreeWrites ?? defaultUndoTreeWrites;
-    return async function takeVerifyBaseline(cwd, dirs, signal, budgetOverrideMs) {
-        const baseline = new Map();
-        const result = { baseline, ran: [], failures: 0, notes: [] };
-        if (dirs.length === 0)
-            return result;
-        const commands = detect(cwd, dirs);
-        const overridden = commands.some((c) => c.source === "override");
-        const tests = overridden ? [] : detectTests(cwd, dirs);
-        if (commands.length === 0 && tests.length === 0)
-            return result;
-        const startedAt = now();
-        const budgetMs = Math.min(opts.budgetMs ?? VERIFY_BASELINE_BUDGET_MS, budgetOverrideMs ?? Number.POSITIVE_INFINITY);
-        const before = await treeStatus(cwd, signal).catch((err) => {
-            const msg = err instanceof Error ? err.message : String(err);
-            result.notes.push(`could not read the tree before the baseline, so what it writes is not undone: ${scrubSecrets(msg)}`);
-            return null;
+export function baseTargets(cwd, input, opts = {}) {
+    const targets = new Map();
+    for (const check of input.checks?.checks ?? []) {
+        if (!input.allChecks && check.measureOnBase !== true)
+            continue;
+        if (check.status === "cannot_run" || changesGitState(check.command))
+            continue;
+        const id = approvedId(check);
+        if (targets.has(id))
+            continue;
+        targets.set(id, {
+            id,
+            label: checkLabel(check.command),
+            kind: "check",
+            command: check.command,
+            argv: repoCheckArgv(check.command),
+            dir: cwd,
         });
-        const runs = [
-            ...commands.map((command) => ({ command, test: false })),
-            ...tests.map((command) => ({ command, test: true })),
-        ];
-        // The gate's environments, so a failure keys the same on the clean tree and the build's.
-        const toolchainFile = (opts.toolchain ?? sessionToolchain)();
-        const verifyEnv = buildGateVerifyEnv(process.env, toolchainFile);
-        const testEnv = opts.testEnv ?? buildGateTestEnv(process.env, toolchainFile);
-        try {
-            for (const { command, test } of runs) {
-                if (signal?.aborted)
-                    break;
-                const commandStartedAt = now();
-                const left = budgetMs - (commandStartedAt - startedAt);
-                if (left < REPO_CHECK_MIN_START_MS) {
-                    result.notes.push(`${command.label} (${command.cwd}): not reached in the baseline budget`);
+    }
+    if (input.dirs.length > 0) {
+        const commands = (opts.detect ?? defaultDetect)(cwd, input.dirs);
+        const overridden = commands.some((c) => c.source === "override");
+        const tests = overridden ? [] : (opts.detectTests ?? defaultDetectTests)(cwd, input.dirs);
+        for (const [kind, list] of [
+            ["typecheck", commands],
+            ["test", tests],
+        ]) {
+            for (const command of list) {
+                const id = commandCheckId(cwd, command);
+                if (targets.has(id))
                     continue;
-                }
-                const cap = Math.min(test
-                    ? (opts.testTimeoutMs ?? VERIFY_TEST_TIMEOUT_MS)
-                    : (opts.timeoutMs ?? VERIFY_TIMEOUT_MS), left);
-                const composed = composeAbortSignal(signal, AbortSignal.timeout(cap));
-                const heard = {
-                    name: command.label,
+                targets.set(id, {
+                    id,
+                    label: command.label,
+                    kind,
                     command: command.argv.join(" "),
-                    cwd: relative(cwd, command.cwd) || ".",
-                    base: true,
-                };
-                opts.onCheck?.({ phase: "start", ...heard });
-                const ended = (exitCode, output) => opts.onCheck?.({
-                    phase: "end",
-                    ...heard,
-                    exitCode,
-                    durationMs: now() - commandStartedAt,
-                    ...(output && exitCode !== 0 ? { tail: checkTail(output) } : {}),
+                    argv: command.argv,
+                    dir: command.cwd,
                 });
-                try {
-                    const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed, test ? testEnv : verifyEnv);
-                    ended(code, rawOutput);
-                    const output = scrubSecrets(rawOutput);
-                    let failed;
-                    if (test) {
-                        const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY, testEnv);
-                        if (cls.kind === "infra" || cls.kind === "uncertain") {
-                            result.notes.push(`${command.label} (${command.cwd}): ${cls.kind === "infra" ? cls.reason : "output not interpretable"}`);
-                            if (cls.kind === "uncertain") {
-                                baseline.set(verifyCommandKey(command), new Map([[UNREAD_FAILURE_KEY, 1]]));
-                            }
-                            continue;
-                        }
-                        failed = cls.kind === "failures" ? cls.findings : [];
-                    }
-                    else {
-                        const infra = code === 0 ? null : classifyVerifyInfraFailure(output, code);
-                        if (infra) {
-                            result.notes.push(`${command.label} (${command.cwd}): ${infra}`);
-                            continue;
-                        }
-                        failed = parseVerifyFailures(output, code, command.label, Number.POSITIVE_INFINITY);
-                    }
-                    const counts = failureKeyCounts(failed.map((f) => liftFinding(f, cwd, command.cwd)));
-                    baseline.set(verifyCommandKey(command), counts);
-                    result.ran.push(command.label);
-                    for (const n of counts.values())
-                        result.failures += n;
-                }
-                catch (err) {
-                    ended(null);
-                    const msg = err instanceof Error ? err.message : String(err);
-                    result.notes.push(`${command.label} (${command.cwd}): could not run: ${scrubSecrets(msg)}`);
-                }
-            }
-        }
-        finally {
-            if (before !== null) {
-                try {
-                    const written = newTreeEntries(before, await treeStatus(cwd));
-                    if (written.length > 0)
-                        await undoTreeWrites(cwd, written);
-                }
-                catch (err) {
-                    const msg = err instanceof Error ? err.message : String(err);
-                    result.notes.push(`could not undo what the baseline wrote into the tree: ${scrubSecrets(msg)}`);
-                }
             }
         }
-        return result;
-    };
+    }
+    return [...targets.values()];
 }
 /**
- * The whole measurement's cap, before the build starts: each check marked to
- * measure, once, the plan's first.
- */
-export const CHECKS_ON_BASE_BUDGET_MS = 10 * 60_000;
-/**
- * Run each approved check `checks.json` marks `measureOnBase` once on the
- * unchanged code, before the build changes anything: a plan's check the
- * host has not seen pass there (none of the record's, or a red one the
- * record may hold from long ago), and a command the repository's CI runs
- * when the record names no check of its own. A check the plan wrote for the
- * change often fails there by design (its test file is not written yet), and a
- * failure that says only that (a file not found, no tests to run, output no
- * parser reads) is no verdict: its failures all count after the build, as
- * before. A failure the gate reads (failing tests, located diagnostics, a
- * test runner's failure summary) is one the unchanged code already has.
+ * Run each target ({@link baseTargets}) once on the unchanged code, before
+ * the build changes anything (YAG-1003), and keep what it did: passed, or
+ * failed with its failure keys ({@link findingKey}). The build's gate then
+ * counts only the failures the change added ({@link attributeFindings}).
  *
- * Run as the gate runs the check ({@link makeRunVerify}): the same command
- * line, environment and toolchain, from the repository root, so a failure
- * keys the same on both trees. Bounded: each check by its cap, the whole by
- * the budget, and one not reached in it has no verdict. What the checks
- * write into the tree is undone.
+ * Each runs as the gate runs it, with the same command line, environment
+ * and toolchain, so a failure keys the same on both trees. A run that says
+ * only that it could not run (an infra failure, a path it reads not there,
+ * a command not found) gives no verdict, and its failures all count after
+ * the build. A test run or check whose output no parser reads failed there
+ * with no keys: nothing after the build is excused by it. Bounded: each by
+ * its cap, the whole by the budget, and a target not reached in it gives no
+ * verdict. What the commands write into the tree is undone.
  */
-export function makeMeasureChecksOnBase(opts = {}) {
+export function makeMeasureOnBase(opts = {}) {
     const exec = opts.exec ?? defaultExec;
     const now = opts.now ?? Date.now;
-    const toolchain = opts.toolchain ?? sessionToolchain;
     const treeStatus = opts.treeStatus ??
         (async (cwd, signal) => (await snapshotWorkspace(cwd, signal)).status);
     const undoTreeWrites = opts.undoTreeWrites ?? defaultUndoTreeWrites;
-    return async function measureChecksOnBase(cwd, file, signal, budgetOverrideMs) {
-        const passed = new Set();
-        const failed = new Map();
-        const result = { passed, failed, ran: [], notes: [], treeUndone: true };
-        const targets = file.checks.filter((check) => check.measureOnBase === true &&
-            check.status !== "cannot_run" &&
-            !changesGitState(check.command));
+    return async function measureOnBase(cwd, targets, signal, budgetOverrideMs) {
+        const measured = new Map();
+        const result = {
+            measured,
+            ran: [],
+            failures: 0,
+            notes: [],
+            treeUndone: true,
+        };
         if (targets.length === 0)
             return result;
         const startedAt = now();
-        const budgetMs = Math.min(opts.budgetMs ?? CHECKS_ON_BASE_BUDGET_MS, budgetOverrideMs ?? Number.POSITIVE_INFINITY);
-        const env = opts.repoChecksEnv ?? buildRepoCheckEnv(process.env, toolchain());
+        const budgetMs = Math.min(opts.budgetMs ?? BASE_MEASUREMENT_BUDGET_MS, budgetOverrideMs ?? Number.POSITIVE_INFINITY);
+        // The gate's environments, so a failure keys the same on both trees.
+        const toolchainFile = (opts.toolchain ?? sessionToolchain)();
+        const envs = {
+            check: opts.repoChecksEnv ?? buildRepoCheckEnv(process.env, toolchainFile),
+            typecheck: buildGateVerifyEnv(process.env, toolchainFile),
+            test: opts.testEnv ?? buildGateTestEnv(process.env, toolchainFile),
+        };
+        const caps = {
+            check: opts.repoCheckTimeoutMs ?? REPO_CHECK_TIMEOUT_MS,
+            typecheck: opts.timeoutMs ?? VERIFY_TIMEOUT_MS,
+            test: opts.testTimeoutMs ?? VERIFY_TEST_TIMEOUT_MS,
+        };
         const before = await treeStatus(cwd, signal).catch((err) => {
             const msg = err instanceof Error ? err.message : String(err);
             result.treeUndone = false;
-            result.notes.push(`could not read the tree before the checks, so what they write is not undone: ${scrubSecrets(msg)}`);
+            result.notes.push(`could not read the tree before the base measurement, so what it writes is not undone: ${scrubSecrets(msg)}`);
             return null;
         });
+        /** The keys of a failure, or why it gave no verdict. */
+        const failureOf = (target, output, code) => {
+            const env = envs[target.kind];
+            if (target.kind === "typecheck") {
+                const infra = classifyVerifyInfraFailure(output, code);
+                if (infra)
+                    return { note: infra };
+                const failed = parseVerifyFailures(output, code, target.label, Number.POSITIVE_INFINITY);
+                return { keys: keysOf(failed.map((f) => liftFinding(f, cwd, target.dir))) };
+            }
+            const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY, env);
+            if (cls.kind === "infra")
+                return { note: cls.reason };
+            if (target.kind === "test") {
+                return {
+                    keys: cls.kind === "failures"
+                        ? keysOf(cls.findings.map((f) => liftFinding(f, cwd, target.dir)))
+                        : [],
+                };
+            }
+            const missing = cls.kind === "uncertain"
+                ? classifyMissingInput(target.command, output, { repoRoot: cwd, dir: cwd })
+                : null;
+            if (missing)
+                return { note: `could not run: ${missing}` };
+            const found = repoCommandFindings({ output, code, env }, {
+                label: target.label,
+                prefix: approvedPrefix(target.label),
+                repoRoot: cwd,
+                dir: cwd,
+                limit: Number.POSITIVE_INFINITY,
+            });
+            return { keys: found.keys.filter((key) => key !== null) };
+        };
         try {
-            for (const check of targets) {
+            for (const target of targets) {
                 if (signal?.aborted)
                     break;
-                const command = check.command.trim();
-                const label = checkLabel(check.command);
-                const checkStartedAt = now();
-                const left = budgetMs - (checkStartedAt - startedAt);
+                const targetStartedAt = now();
+                const left = budgetMs - (targetStartedAt - startedAt);
+                const where = relative(cwd, target.dir) || ".";
                 if (left < REPO_CHECK_MIN_START_MS) {
-                    result.notes.push(`\`${label}\`: not reached in the budget`);
+                    result.notes.push(`\`${target.label}\` (${where}): not reached in the budget`);
                     continue;
                 }
-                const composed = composeAbortSignal(signal, AbortSignal.timeout(Math.min(opts.timeoutMs ?? REPO_CHECK_TIMEOUT_MS, left)));
-                const heard = { name: label, command: check.command, cwd: ".", base: true };
+                const composed = composeAbortSignal(signal, AbortSignal.timeout(Math.min(caps[target.kind], left)));
+                const heard = {
+                    name: target.label,
+                    command: target.command,
+                    cwd: where,
+                    base: true,
+                };
                 opts.onCheck?.({ phase: "start", ...heard });
                 const ended = (exitCode, output) => opts.onCheck?.({
                     phase: "end",
                     ...heard,
                     exitCode,
-                    durationMs: now() - checkStartedAt,
+                    durationMs: now() - targetStartedAt,
                     ...(output && exitCode !== 0 ? { tail: checkTail(output) } : {}),
                 });
                 try {
-                    const { code, output: rawOutput } = await exec(repoCheckArgv(check.command), cwd, composed, env);
+                    const { code, output: rawOutput } = await exec(target.argv, target.dir, composed, envs[target.kind]);
                     ended(code, rawOutput);
-                    if (code === 0) {
-                        passed.add(command);
-                        result.ran.push(label);
-                        continue;
-                    }
-                    const output = scrubSecrets(rawOutput);
-                    const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY, env);
-                    const cause = cls.kind === "infra"
-                        ? cls.reason
-                        : cls.kind === "uncertain"
-                            ? classifyMissingInput(check.command, output, { repoRoot: cwd, dir: cwd })
-                            : null;
-                    if (cause) {
-                        result.notes.push(`\`${label}\`: could not run: ${cause}`);
+                    const failure = code === 0 ? { keys: [] } : failureOf(target, scrubSecrets(rawOutput), code);
+                    if ("note" in failure) {
+                        result.notes.push(`\`${target.label}\` (${where}): ${failure.note}`);
                         continue;
                     }
-                    const found = repoCommandFindings({ output, code, env }, {
-                        label,
-                        prefix: approvedPrefix(label),
-                        repoRoot: cwd,
-                        dir: cwd,
-                        limit: Number.POSITIVE_INFINITY,
+                    measured.set(target.id, {
+                        outcome: code === 0 ? "passed" : "failed",
+                        keys: failure.keys,
                     });
-                    // Output no parser reads says nothing of what failed (a test file
-                    // the change writes, not there yet): no verdict.
-                    if (cls.kind === "uncertain" && found.every((f) => verifyFailureKey(f) === null)) {
-                        result.notes.push(`\`${label}\`: exited ${code} with output no parser reads`);
-                        continue;
-                    }
-                    failed.set(command, failureKeyCounts(found));
-                    result.ran.push(label);
+                    result.ran.push(target.label);
+                    result.failures += failure.keys.length;
                 }
                 catch (err) {
                     ended(null);
-                    result.notes.push(`\`${label}\`: ${unexitedNote(err, signal, composed)}`);
+                    result.notes.push(`\`${target.label}\` (${where}): ${unexitedNote(err, signal, composed)}`);
                 }
             }
         }
@@ -2508,11 +2429,15 @@ export function makeMeasureChecksOnBase(opts = {}) {
                 catch (err) {
                     const msg = err instanceof Error ? err.message : String(err);
                     result.treeUndone = false;
-                    result.notes.push(`could not undo what the checks wrote into the tree: ${scrubSecrets(msg)}`);
+                    result.notes.push(`could not undo what the base measurement wrote into the tree: ${scrubSecrets(msg)}`);
                 }
             }
         }
         return result;
     };
 }
+/** The failure keys of findings that name what failed. */
+function keysOf(findings) {
+    return findings.map(findingKey).filter((key) => key !== null);
+}
 //# sourceMappingURL=verify.js.map