@yagni-app/code-staging 1.2.7-staging.2035.1 → 1.2.7-staging.2059.1

package/dist/extension/pipeline/changeScan.d.ts

@@ -52,11 +52,18 @@ export interface ChangeScanOpts {
     /** This session's own credentials, matched by value. */
     sessionSecrets?: readonly string[];
     readFile?: (path: string) => Buffer;
+    /**
+     * The commit the run started from: what it committed past it is scanned
+     * too, since a model that commits leaves nothing on top of HEAD (YAG-1039).
+     * Absent: HEAD.
+     */
+    base?: string;
 }
 /**
- * Scan what this run added on top of HEAD: tracked files' added lines, new
- * files whole, minus `skip` (the tree's pre-run dirt). Null when git could
- * not say what changed: the gate then notes the scan did not run.
+ * Scan what this run added on top of its base (HEAD, unless `opts.base`):
+ * tracked files' added lines, new files whole, minus `skip` (the tree's
+ * pre-run dirt). Null when git could not say what changed: the gate then
+ * notes the scan did not run.
  */
 export declare function scanChange(cwd: string, opts: ChangeScanOpts, skip?: readonly string[], signal?: AbortSignal): Promise<Finding[] | null>;
 //# sourceMappingURL=changeScan.d.ts.map

package/dist/extension/pipeline/changeScan.js

@@ -253,9 +253,10 @@ function bytesAreBinary(bytes) {
 /** How much of one new file is scanned: a credential sits in source, not past the first megabyte. */
 const MAX_SCANNED_FILE_BYTES = 1024 * 1024;
 /**
- * Scan what this run added on top of HEAD: tracked files' added lines, new
- * files whole, minus `skip` (the tree's pre-run dirt). Null when git could
- * not say what changed: the gate then notes the scan did not run.
+ * Scan what this run added on top of its base (HEAD, unless `opts.base`):
+ * tracked files' added lines, new files whole, minus `skip` (the tree's
+ * pre-run dirt). Null when git could not say what changed: the gate then
+ * notes the scan did not run.
  */
 export async function scanChange(cwd, opts, skip = [], signal) {
     // `git status --porcelain` lists an untracked folder as `dir/`, so a skip
@@ -267,10 +268,11 @@ export async function scanChange(cwd, opts, skip = [], signal) {
         has: (path) => skipFiles.has(path) || skipDirs.some((dir) => path.startsWith(dir)),
     };
     const git = (args) => opts.exec(["git", "-c", "core.quotepath=off", ...args], cwd, signal);
+    const base = opts.base ?? "HEAD";
     // A deleted binary is no binary in the change: the host lets it through.
     const [numstat, diff, others] = await Promise.all([
-        git(["diff", "HEAD", "--numstat", "--no-renames", "--no-ext-diff", "--diff-filter=d"]),
-        git(["diff", "HEAD", "-U0", "--no-color", "--no-renames", "--no-ext-diff"]),
+        git(["diff", base, "--numstat", "--no-renames", "--no-ext-diff", "--diff-filter=d"]),
+        git(["diff", base, "-U0", "--no-color", "--no-renames", "--no-ext-diff"]),
         git(["ls-files", "--others", "--exclude-standard"]),
     ]);
     if (numstat.code !== 0 || diff.code !== 0 || others.code !== 0)

package/dist/extension/pipeline/cloud.d.ts

@@ -190,8 +190,10 @@ export interface CloudCompletion {
  * commits its work locally on the branch the host checked out, so nothing is
  * lost when the sandbox goes. `result.json` is written last; the caller mirrors
  * it on the stream. `ok` is a written plan, or a clean candidate whose branch
- * carries this attempt's committed work, from this execution or an earlier
- * one: a clean stop with nothing committed at all delivered nothing.
+ * carries this attempt's committed work: a commit past the execution's base,
+ * whoever wrote it (a model that ran `git commit` too, YAG-1039), or an
+ * earlier execution's. A clean stop with nothing committed at all delivered
+ * nothing.
  */
 export declare function completeCloudSession(c: CloudCompletion, ran: {
     result: PipelineResult;

package/dist/extension/pipeline/cloud.js

@@ -247,8 +247,10 @@ function findingKey(finding) {
  * commits its work locally on the branch the host checked out, so nothing is
  * lost when the sandbox goes. `result.json` is written last; the caller mirrors
  * it on the stream. `ok` is a written plan, or a clean candidate whose branch
- * carries this attempt's committed work, from this execution or an earlier
- * one: a clean stop with nothing committed at all delivered nothing.
+ * carries this attempt's committed work: a commit past the execution's base,
+ * whoever wrote it (a model that ran `git commit` too, YAG-1039), or an
+ * earlier execution's. A clean stop with nothing committed at all delivered
+ * nothing.
  */
 export async function completeCloudSession(c, ran) {
     const notes = "error" in ran ? [ran.error] : [];
@@ -334,21 +336,25 @@ export async function completeCloudSession(c, ran) {
             rounds: result?.rounds.length ?? 0,
             openPr: false,
             ...(c.preRunDirt.length > 0 ? { baselinePaths: c.preRunDirt } : {}),
+            ...(c.baseSha ? { baseSha: c.baseSha } : {}),
             exec: c.exec,
         });
         committed = finish.committed;
         notes.push(...finish.notes);
     }
+    const facts = await gitFacts(c.cwd, c.exec, c.baseSha);
+    notes.push(...facts.notes);
     let delivered = outputsWritten;
     if (c.stage !== "plan") {
-        const onBranch = committed || (await attemptCommitted(c.cwd, c.exec, c.identity.attemptId));
+        // A commit past the base is this execution's work, whoever wrote it.
+        const onBranch = committed ||
+            facts.commits.length > 0 ||
+            (await attemptCommitted(c.cwd, c.exec, c.identity.attemptId));
         if (onBranch === null) {
             notes.push("git log failed, so the result cannot say whether the branch carries this attempt's work.");
         }
         delivered = onBranch === true;
     }
-    const facts = await gitFacts(c.cwd, c.exec, c.baseSha);
-    notes.push(...facts.notes);
     // What the final scan and checks found beside the last round's findings; a
     // finding both report is listed once.
     const seen = new Set((result?.findings ?? []).map(findingKey));

package/dist/extension/pipeline/finish.d.ts

@@ -7,7 +7,8 @@
  *    branch (the tree started clean, so everything is the run's own). In --here
  *    mode it commits ONLY when the pre-run baseline was verifiably clean;
  *    otherwise it skips with an honest note (never mixing user dirt into an
- *    agent commit).
+ *    agent commit). A run given its base commit (the cloud session) whose work
+ *    is already committed past it gets the trailer on an empty commit instead.
  *  - Commit message: `<type>(<scope>): <title>` + a 2-3 sentence plan summary +
  *    the exact provenance trailer (YAGNI-Run / YAGNI-Ticket / YAGNI-Verify /
  *    YAGNI-Decisions / YAGNI-Rounds / Co-Authored-By: YAGNI Code).
@@ -72,6 +73,13 @@ export interface RunFinishOpts extends TrailerInputs {
      * lands in the run's provenance commit. Absent ⇒ the whole diff is the run's.
      */
     baselinePaths?: string[];
+    /**
+     * The commit the run started from (a cloud session's). When the tree holds
+     * nothing of the run's own because the run already committed its work past
+     * it (the model ran `git commit`), FINISH puts the trailer on an empty
+     * commit on top, so the branch still carries the run's `YAGNI-Run` line.
+     */
+    baseSha?: string;
     signal?: AbortSignal;
     exec?: WorktreeExec;
 }

package/dist/extension/pipeline/finish.js

@@ -7,7 +7,8 @@
  *    branch (the tree started clean, so everything is the run's own). In --here
  *    mode it commits ONLY when the pre-run baseline was verifiably clean;
  *    otherwise it skips with an honest note (never mixing user dirt into an
- *    agent commit).
+ *    agent commit). A run given its base commit (the cloud session) whose work
+ *    is already committed past it gets the trailer on an empty commit instead.
  *  - Commit message: `<type>(<scope>): <title>` + a 2-3 sentence plan summary +
  *    the exact provenance trailer (YAGNI-Run / YAGNI-Ticket / YAGNI-Verify /
  *    YAGNI-Decisions / YAGNI-Rounds / Co-Authored-By: YAGNI Code).
@@ -238,6 +239,27 @@ function tail(output) {
         .trim();
     return t;
 }
+/**
+ * The paths the run's commits past `baseSha` changed: empty with no base, no
+ * commit past it, or a change that nets to nothing; `failed` when git could
+ * not say, so a note never reads that as nothing committed.
+ */
+async function committedSince(run, baseSha) {
+    if (!baseSha)
+        return [];
+    const commits = await run(["git", "rev-list", `${baseSha}..HEAD`]);
+    if (commits.code !== 0)
+        return { failed: tail(commits.output) || "git rev-list failed" };
+    if (!commits.output.trim())
+        return [];
+    const diff = await run(["git", "diff", "--name-only", baseSha, "HEAD"]);
+    if (diff.code !== 0)
+        return { failed: tail(diff.output) || "git diff failed" };
+    return diff.output
+        .split("\n")
+        .map((line) => line.trim())
+        .filter(Boolean);
+}
 /**
  * Run the FINISH stage. NEVER throws; every failure path returns an honest
  * {@link FinishResult} with notes. See the module docblock for the contract.
@@ -273,33 +295,42 @@ export async function runFinish(opts) {
         if (status.code !== 0) {
             return skipped(`FINISH could not read the git status (${tail(status.output) || "git failed"}); nothing was committed.`);
         }
-        if (!status.output.trim()) {
-            return skipped("FINISH found nothing to commit (the tree is already clean).");
-        }
         // The run's OWN paths = everything changed now, minus what was already dirty
         // at pipeline start (bootstrap lockfile churn, or a pre-existing edit). We
         // commit only these, so the provenance commit never folds in non-run work.
         const changed = parseChangedPaths(status.output);
         const baseline = new Set(opts.baselinePaths ?? []);
         const runOwned = baseline.size === 0 ? changed : changed.filter((p) => !baseline.has(p));
-        if (runOwned.length === 0) {
-            return skipped("FINISH found nothing of the run's own to commit (the only changes were already present before the run).");
+        // Nothing of the run's own left in the tree, but its work may already be
+        // committed past its base: the trailer then goes on an empty commit.
+        const committed = runOwned.length === 0 ? await committedSince(run, opts.baseSha) : [];
+        if (!Array.isArray(committed)) {
+            return skipped(`FINISH could not read what the run committed past its base (${committed.failed}); nothing was committed.`);
+        }
+        if (runOwned.length === 0 && committed.length === 0) {
+            return skipped(status.output.trim()
+                ? "FINISH found nothing of the run's own to commit (the only changes were already present before the run)."
+                : "FINISH found nothing to commit (the tree is already clean).");
         }
+        const trailerOnly = runOwned.length === 0;
         // Message derivation off the run's real diff.
-        const subject = commitSubject(commitType(opts.ticket, opts.ticketBrief), deriveCommitScope(runOwned), commitTitle(opts.ticket, opts.ticketBrief));
+        const subject = commitSubject(commitType(opts.ticket, opts.ticketBrief), deriveCommitScope(trailerOnly ? committed : runOwned), commitTitle(opts.ticket, opts.ticketBrief));
         const summary = summarizePlan(opts.planText, opts.ticket);
         const trailer = provenanceTrailer(opts);
         const message = buildCommitMessage(subject, summary, trailer);
         // No baseline dirt ⇒ everything is the run's own: `git add -A` (preserves
         // rename detection). With a baseline, stage only the run-owned paths so
         // bootstrap/pre-existing dirt never lands (`--` guards flag-like paths).
-        const add = baseline.size === 0
-            ? await run(["git", "add", "-A"])
-            : await run(["git", "add", "--", ...runOwned]);
-        if (add.code !== 0) {
-            return skipped(`FINISH could not stage the changes (git add failed: ${tail(add.output)}); nothing was committed.`);
+        if (!trailerOnly) {
+            const add = baseline.size === 0
+                ? await run(["git", "add", "-A"])
+                : await run(["git", "add", "--", ...runOwned]);
+            if (add.code !== 0) {
+                return skipped(`FINISH could not stage the changes (git add failed: ${tail(add.output)}); nothing was committed.`);
+            }
         }
-        let commit = await run(["git", "commit", "-m", message]);
+        const commitArgs = [...(trailerOnly ? ["--allow-empty"] : []), "-m", message];
+        let commit = await run(["git", "commit", ...commitArgs]);
         if (commit.code !== 0) {
             // Most likely a missing git identity in a fresh environment (mirrors
             // commitWip): retry once with an explicit YAGNI Code identity.
@@ -310,8 +341,7 @@ export async function runFinish(opts) {
                 "-c",
                 "user.email=code@yagni.app",
                 "commit",
-                "-m",
-                message,
+                ...commitArgs,
             ]);
         }
         if (commit.code !== 0) {

package/dist/extension/pipeline/headlessGo.js

@@ -456,6 +456,13 @@ export async function runHeadlessGo(argv, deps = {}) {
         if (stream)
             emit({ type: "pipeline_log", event, data });
     };
+    // Each command the gate runs, as it starts and ends: a check runs for
+    // minutes with no turn of the model's, and the host's ticket went quiet
+    // through it (YAG-1031). The host shows the command and its verdict.
+    const onCheck = stream
+        ? (event) => logPipeline("verify_check", event)
+        : undefined;
+    const heard = onCheck ? { onCheck } : {};
     // A measurement before the build (the baseline, the plan's checks on the
     // base) gets at most a sixth of the run's time left when it starts, and
     // none below a minute: the build itself must still fit. No deadline, no cap.
@@ -480,7 +487,7 @@ export async function runHeadlessGo(argv, deps = {}) {
         }
         else if (dirs.length > 0) {
             try {
-                const taken = await (deps.takeVerifyBaseline ?? makeTakeVerifyBaseline())(cwd, dirs, deps.signal, share.shareMs);
+                const taken = await (deps.takeVerifyBaseline ?? makeTakeVerifyBaseline(heard))(cwd, dirs, deps.signal, share.shareMs);
                 logPipeline("verify_baseline", {
                     ran: taken.ran,
                     failures: taken.failures,
@@ -518,7 +525,7 @@ export async function runHeadlessGo(argv, deps = {}) {
         }
         else {
             try {
-                const measured = await (deps.measureChecksOnBase ?? makeMeasureChecksOnBase())(cwd, measureFile, deps.signal, share.shareMs);
+                const measured = await (deps.measureChecksOnBase ?? makeMeasureChecksOnBase(heard))(cwd, measureFile, deps.signal, share.shareMs);
                 logPipeline("verify_checks_on_base", {
                     ran: measured.ran,
                     passed: [...measured.passed],
@@ -542,6 +549,14 @@ export async function runHeadlessGo(argv, deps = {}) {
     // A cloud session reports the checks of the tree it commits: the gate's last
     // verdict, with the tree it judged.
     const snapshot = deps.snapshotWorkspace ?? snapshotWorkspace;
+    // A cloud session's start: the commit it builds on (its result's `baseSha`,
+    // which its gate and scan read its change against, since a model may commit
+    // its own work) and the tree's pre-run dirt (an install's lockfile churn),
+    // which never lands in its commit.
+    const startTree = cloud ? await snapshot(cwd, deps.signal) : undefined;
+    const baseSha = startTree?.head ?? "";
+    const preRunDirt = startTree ? parseChangedPaths(startTree.status) : [];
+    const onBase = baseSha ? { base: baseSha } : {};
     let gate;
     let lastVerify;
     // A cloud session's gate also runs the host's secret and binary scans on
@@ -549,7 +564,7 @@ export async function runHeadlessGo(argv, deps = {}) {
     const exec = deps.exec ?? finishExec;
     const sessionSecrets = [env.YAGNI_TOKEN, env.GH_ENTERPRISE_TOKEN].filter((value) => Boolean(value));
     const scan = cloud
-        ? (scanCwd, signal, skip) => scanChange(scanCwd, { exec, sessionSecrets }, skip, signal)
+        ? (scanCwd, signal, skip) => scanChange(scanCwd, { exec, sessionSecrets, ...onBase }, skip, signal)
         : undefined;
     if (gateOpts || baseline || cloud) {
         const made = (deps.makeRunVerify ?? makeRunVerify)({
@@ -557,7 +572,11 @@ export async function runHeadlessGo(argv, deps = {}) {
             ...(baseline ? { baseline } : {}),
             ...(checksOnBase ? { checksOnBase } : {}),
             ...(scan ? { scanChange: scan } : {}),
-            ...(cloud ? { unreadTestFailureIsFinding: true } : {}),
+            // The one-attempt lane's host runs no checks after the build.
+            ...(cloud
+                ? { unreadTestFailureIsFinding: true, hostRechecks: false, ...(baseSha ? { baseSha } : {}) }
+                : {}),
+            ...heard,
         });
         gate = made;
         runVerify = async (verifyCwd, signal, baselinePaths) => {
@@ -626,12 +645,6 @@ export async function runHeadlessGo(argv, deps = {}) {
                 emit({ type: "pipeline_log", event, ...(data === undefined ? {} : { data }) });
         },
     };
-    // A cloud session's start: the commit it builds on (its result's `baseSha`)
-    // and the tree's pre-run dirt (an install's lockfile churn), which never
-    // lands in its commit.
-    const startTree = cloud ? await snapshot(cwd, deps.signal) : undefined;
-    const baseSha = startTree?.head ?? "";
-    const preRunDirt = startTree ? parseChangedPaths(startTree.status) : [];
     /** The cloud session's last act (cloud.ts `completeCloudSession`), mirrored on the stream. */
     const completeCloud = async (session, ran) => {
         const verifyGate = gate;
@@ -660,7 +673,7 @@ export async function runHeadlessGo(argv, deps = {}) {
                     },
                 }
                 : {}),
-            scan: () => scanChange(cwd, { exec, sessionSecrets }, preRunDirt),
+            scan: () => scanChange(cwd, { exec, sessionSecrets, ...onBase }, preRunDirt),
             planPaths: (planText) => baselineDirs(cwd, planPaths(planText), readFile).map((dir) => relative(cwd, dir) || "."),
             exec,
             writeFile: deps.writeFile ?? writeFileSync,

package/dist/extension/pipeline/verify.d.ts

@@ -158,6 +158,38 @@ export interface VerifyCheckRun {
      */
     note?: string;
 }
+/**
+ * How the note of an approved check this gate run did not run starts (its
+ * budget was spent, it was not reached, the build stopped first, the
+ * typecheck half failed first). The host's pull request body reads these
+ * words (`CHECK_NOT_RUN_NOTE` in @yagni/shared's attempts.ts); a change here
+ * is a change there.
+ */
+export declare const CHECK_NOT_RUN_NOTE = "not run on this tree";
+/**
+ * One command the gate starts or ends, for the session's stream (headlessGo's
+ * `verify_check` line), so the ticket says what runs instead of going quiet
+ * for minutes (YAG-1031). `base` is a run on the unchanged code before the
+ * build. An end that did not pass carries the last few hundred characters
+ * of its output, scrubbed: the host logs them and never shows them.
+ */
+export type VerifyCheckEvent = {
+    phase: "start";
+    name: string;
+    command: string;
+    cwd: string;
+    base?: true;
+} | {
+    phase: "end";
+    name: string;
+    command: string;
+    cwd: string;
+    exitCode: number | null;
+    durationMs: number;
+    baseline?: VerifyCheckRun["baseline"];
+    base?: true;
+    tail?: string;
+};
 /**
  * Why a command threw instead of exiting, as its check record says it. `run`
  * is the run's own signal (a /stop or the run's end); `capped` is the one
@@ -212,13 +244,19 @@ export declare function parseChangedPaths(status: string): string[];
  */
 export declare function resolvePackageDirs(repoRoot: string, relPaths: string[], readFile: (path: string) => string): string[];
 /**
- * This run's OWN changed package dirs: the porcelain `status`'s packages MINUS the
- * packages touched only by `baselinePaths` (the tree's pre-run dirt). A package with
- * a NEW change stays in scope even if it also had pre-run dirt; a package whose every
- * changed path predates the run drops out. Pure (the `readFile` seam keeps it so), so
- * an unrelated dirty package can never retarget the gate off this run's real diff.
+ * This run's OWN changed paths: the porcelain `status`'s, plus `committed` (what
+ * the run already committed past its base, YAG-1039), MINUS `baselinePaths` (the
+ * tree's pre-run dirt). Pure, deduped.
+ */
+export declare function ownChangedPaths(status: string, baselinePaths: string[], committed?: string[]): string[];
+/**
+ * This run's OWN changed package dirs: the packages of {@link ownChangedPaths}, so a
+ * package touched only by `baselinePaths` (the tree's pre-run dirt) drops out. A
+ * package with a NEW change stays in scope even if it also had pre-run dirt. Pure
+ * (the `readFile` seam keeps it so), so an unrelated dirty package can never
+ * retarget the gate off this run's real diff.
  */
-export declare function ownChangedDirs(repoRoot: string, status: string, baselinePaths: string[], readFile: (path: string) => string): string[];
+export declare function ownChangedDirs(repoRoot: string, status: string, baselinePaths: string[], readFile: (path: string) => string, committed?: string[]): string[];
 /**
  * Resolve the verify command(s) for a repo. An explicitly allowed `.yagni-code/verify`
  * override wins (first non-comment, non-empty line, whitespace-split into argv; run
@@ -463,6 +501,19 @@ export interface MakeRunVerifyOpts {
      * Recomputed each round so the scope follows the growing diff.
      */
     changedDirs?: (cwd: string, signal?: AbortSignal, baselinePaths?: string[]) => Promise<string[]>;
+    /**
+     * The commit the run started from (the cloud session's): what the run
+     * committed past it counts as changed beside the uncommitted tree, in the
+     * default `changedDirs` and `changedPaths`, so a model that commits its own
+     * work keeps the gate's scope (YAG-1039). Absent: the tree alone.
+     */
+    baseSha?: string;
+    /**
+     * Whether the host runs the approved checks again after the build, which the
+     * gate's note of checks it left unrun says. Absent: it does (the mission
+     * lane). The one-attempt lane's host does not, so its session passes false.
+     */
+    hostRechecks?: boolean;
     exec?: VerifyExec;
     timeoutMs?: number;
     /**
@@ -488,8 +539,8 @@ export interface MakeRunVerifyOpts {
     onFailedChecks?: (results: FailedCheckResult[]) => void;
     /**
      * This run's own changed paths (repo-relative), which scope the CI jobs by
-     * their `paths` filters. Default: the same `git status` the scope reads,
-     * minus the pre-run dirt.
+     * their `paths` filters. Default: the same `git status` (and commits past
+     * `baseSha`) the scope reads, minus the pre-run dirt.
      */
     changedPaths?: (cwd: string, signal?: AbortSignal, baselinePaths?: string[]) => Promise<string[]>;
     /** Repository-checks env override for determinism in tests (default: buildRepoCheckEnv() per run). */
@@ -535,6 +586,8 @@ export interface MakeRunVerifyOpts {
      * removes. Absent: no scan half, as before (the cloud session sets it).
      */
     scanChange?: (cwd: string, signal?: AbortSignal, baselinePaths?: string[]) => Promise<Finding[] | null>;
+    /** Told as each command starts and ends (the session's stream). Absent: nobody hears it. */
+    onCheck?: (event: VerifyCheckEvent) => void;
 }
 /**
  * One workstream as the scoped checker sees it: the name its findings are
@@ -636,6 +689,8 @@ export interface MakeTakeVerifyBaselineOpts {
     now?: () => number;
     treeStatus?: (cwd: string, signal?: AbortSignal) => Promise<string>;
     undoTreeWrites?: (cwd: string, entries: TreeEntry[]) => Promise<void>;
+    /** Told as each command starts and ends on the clean tree (the session's stream). */
+    onCheck?: (event: VerifyCheckEvent) => void;
 }
 /** What the baseline run found, for the gate and for the run's log. */
 export interface VerifyBaselineResult {
@@ -698,6 +753,8 @@ export interface MakeMeasureChecksOnBaseOpts {
     now?: () => number;
     treeStatus?: (cwd: string, signal?: AbortSignal) => Promise<string>;
     undoTreeWrites?: (cwd: string, entries: TreeEntry[]) => Promise<void>;
+    /** Told as each check starts and ends on the unchanged code (the session's stream). */
+    onCheck?: (event: VerifyCheckEvent) => void;
 }
 /**
  * Run each approved check `checks.json` marks `measureOnBase` once on the

package/dist/extension/pipeline/verify.js

@@ -65,7 +65,7 @@ import { claimCovers } from "./fanout.js";
 import { ciJobInScope } from "./missionChecks.js";
 import { composeAbortSignal } from "./resilience.js";
 import { scrubSecrets } from "./scrubSecrets.js";
-import { snapshotWorkspace } from "./workspace.js";
+import { committedPaths, snapshotWorkspace } from "./workspace.js";
 /**
  * Total wall-clock budget for a single verify run before it is abandoned
  * (fail-open). Ten minutes until 2026-10-09; twenty now, matching the run
@@ -195,6 +195,44 @@ export function changesGitState(command) {
     }
     return false;
 }
+/**
+ * How the note of an approved check this gate run did not run starts (its
+ * budget was spent, it was not reached, the build stopped first, the
+ * typecheck half failed first). The host's pull request body reads these
+ * words (`CHECK_NOT_RUN_NOTE` in @yagni/shared's attempts.ts); a change here
+ * is a change there.
+ */
+export const CHECK_NOT_RUN_NOTE = "not run on this tree";
+/** How much of a failed command's output its end carries, for the host's own log. */
+const CHECK_TAIL_CHARS = 400;
+/** How a check went the last time it ran, after its not-run note; nothing when it never ran. */
+function earlierRunWords(last) {
+    if (last === undefined)
+        return "";
+    if (last.exitCode === null)
+        return "; it gave no verdict on an earlier tree";
+    if (last.exitCode === 0)
+        return "; it passed on an earlier tree";
+    return `; it failed on an earlier tree (exit ${last.exitCode})`;
+}
+/** The end of a command's output, scrubbed, as a check's end carries it. */
+function checkTail(output) {
+    return scrubSecrets(output).trimEnd().slice(-CHECK_TAIL_CHARS);
+}
+/** A recorded run's end, as the stream hears it: the output's tail only when it did not pass. */
+function checkEnded(record, output) {
+    const tail = output && record.exitCode !== 0 ? checkTail(output) : "";
+    return {
+        phase: "end",
+        name: record.name,
+        command: record.command,
+        cwd: record.cwd,
+        exitCode: record.exitCode,
+        durationMs: record.durationMs,
+        baseline: record.baseline,
+        ...(tail ? { tail } : {}),
+    };
+}
 /**
  * Why a command threw instead of exiting, as its check record says it. `run`
  * is the run's own signal (a /stop or the run's end); `capped` is the one
@@ -317,16 +355,23 @@ export function resolvePackageDirs(repoRoot, relPaths, readFile) {
     return [...dirs].sort();
 }
 /**
- * This run's OWN changed package dirs: the porcelain `status`'s packages MINUS the
- * packages touched only by `baselinePaths` (the tree's pre-run dirt). A package with
- * a NEW change stays in scope even if it also had pre-run dirt; a package whose every
- * changed path predates the run drops out. Pure (the `readFile` seam keeps it so), so
- * an unrelated dirty package can never retarget the gate off this run's real diff.
+ * This run's OWN changed paths: the porcelain `status`'s, plus `committed` (what
+ * the run already committed past its base, YAG-1039), MINUS `baselinePaths` (the
+ * tree's pre-run dirt). Pure, deduped.
  */
-export function ownChangedDirs(repoRoot, status, baselinePaths, readFile) {
+export function ownChangedPaths(status, baselinePaths, committed = []) {
     const baseline = new Set(baselinePaths);
-    const own = parseChangedPaths(status).filter((p) => !baseline.has(p));
-    return resolvePackageDirs(repoRoot, own, readFile);
+    return [...new Set([...parseChangedPaths(status), ...committed])].filter((p) => !baseline.has(p));
+}
+/**
+ * This run's OWN changed package dirs: the packages of {@link ownChangedPaths}, so a
+ * package touched only by `baselinePaths` (the tree's pre-run dirt) drops out. A
+ * package with a NEW change stays in scope even if it also had pre-run dirt. Pure
+ * (the `readFile` seam keeps it so), so an unrelated dirty package can never
+ * retarget the gate off this run's real diff.
+ */
+export function ownChangedDirs(repoRoot, status, baselinePaths, readFile, committed = []) {
+    return resolvePackageDirs(repoRoot, ownChangedPaths(status, baselinePaths, committed), readFile);
 }
 /**
  * The highest-priority package.json script at `pkgDir` that is a string AND not a
@@ -1371,6 +1416,10 @@ function measuredBaseline(onBase, check) {
 export function makeRunVerify(opts = {}) {
     const detect = opts.detect ?? defaultDetect;
     const detectTests = opts.detectTests ?? defaultDetectTests;
+    // What the run committed past its base: a model that commits leaves the tree clean.
+    const committedOf = (cwd, head, signal) => opts.baseSha && head !== opts.baseSha
+        ? committedPaths(cwd, opts.baseSha, signal)
+        : Promise.resolve([]);
     const changedDirs = opts.changedDirs ??
         (async (cwd, signal, baselinePaths) => {
             const snapshot = await snapshotWorkspace(cwd, signal);
@@ -1379,7 +1428,7 @@ export function makeRunVerify(opts = {}) {
             // This run's OWN changed packages = the current diff minus the pre-run dirt, so
             // a stray pre-existing file (or an unrelated dirty package) never pulls its dir
             // into scope and the gate verifies what THIS run actually touched.
-            return ownChangedDirs(cwd, snapshot.status, baselinePaths ?? [], (p) => readFileSync(p, "utf8"));
+            return ownChangedDirs(cwd, snapshot.status, baselinePaths ?? [], (p) => readFileSync(p, "utf8"), await committedOf(cwd, snapshot.head, signal));
         });
     const exec = opts.exec ?? defaultExec;
     const timeoutMs = opts.timeoutMs ?? VERIFY_TIMEOUT_MS;
@@ -1390,8 +1439,7 @@ export function makeRunVerify(opts = {}) {
             const snapshot = await snapshotWorkspace(cwd, signal);
             if (!snapshot.tracked)
                 return [];
-            const baseline = new Set(baselinePaths ?? []);
-            return parseChangedPaths(snapshot.status).filter((p) => !baseline.has(p));
+            return ownChangedPaths(snapshot.status, baselinePaths ?? [], await committedOf(cwd, snapshot.head, signal));
         });
     const toolchain = opts.toolchain ?? sessionToolchain;
     const treeStatus = opts.treeStatus ??
@@ -1401,6 +1449,55 @@ export function makeRunVerify(opts = {}) {
     // keys from the last call it failed in.
     let repoChecksSpentMs = 0;
     const lastCiFailure = new Map();
+    const hostRechecks = opts.hostRechecks === false ? "" : "; the host still runs the approved checks after the build";
+    // Each approved check's last run in this build, by command (trimmed).
+    const lastApproved = new Map();
+    /**
+     * The approved checks as one call reports them, in `checks.json`'s order:
+     * one the sandbox cannot run with no verdict (#2694), one this call ran
+     * with its record, and any other with no verdict on this tree, why, and how
+     * it went the last time it ran. The cloud session's report is the last
+     * call's: one that ran none of them (the build's check budget spent, the
+     * typecheck half failing first) used to drop every one, and a pull request
+     * whose plan named six checks said the session reported none (YAG-1031,
+     * production 2026-10-25). A check that changes the checkout's git state is
+     * never run and never listed.
+     */
+    function approvedRecords(file, ran, why) {
+        return file.checks.flatMap((check) => {
+            if (check.status === "cannot_run") {
+                return [
+                    {
+                        name: checkLabel(check.command),
+                        command: check.command,
+                        cwd: ".",
+                        exitCode: null,
+                        durationMs: 0,
+                        baseline: "cannot_run",
+                        note: `could not run in the sandbox${check.cause ? `: ${check.cause}` : ""}`,
+                    },
+                ];
+            }
+            if (changesGitState(check.command))
+                return [];
+            const key = check.command.trim();
+            const record = ran.get(key);
+            if (record)
+                return [record];
+            const last = lastApproved.get(key);
+            return [
+                {
+                    name: checkLabel(check.command),
+                    command: check.command,
+                    cwd: ".",
+                    exitCode: null,
+                    durationMs: 0,
+                    baseline: last?.baseline ?? measuredBaseline(opts.checksOnBase, check),
+                    note: `${CHECK_NOT_RUN_NOTE}: ${why}${earlierRunWords(last)}`,
+                },
+            ];
+        });
+    }
     /**
      * The repository-checks half: the plan's approved checks, then the pull
      * request's CI steps its changed paths trigger. A failure becomes `critical`
@@ -1417,22 +1514,12 @@ export function makeRunVerify(opts = {}) {
         const labels = [];
         const cannotRun = [];
         // An approved check the sandbox cannot run is on the report as one with no
-        // verdict, so a session that never ran it is never read as all green
-        // (#2694): the host leaves its pull request a draft.
-        const unrunnable = [];
+        // verdict (`approvedRecords`), so a session that never ran it is never
+        // read as all green (#2694): the host leaves its pull request a draft.
         for (const check of file.checks) {
             if (check.status !== "cannot_run")
                 continue;
             cannotRun.push(`\`${check.command}\`${check.cause ? ` (${check.cause})` : ""}`);
-            unrunnable.push({
-                name: checkLabel(check.command),
-                command: check.command,
-                cwd: ".",
-                exitCode: null,
-                durationMs: 0,
-                baseline: "cannot_run",
-                note: `could not run in the sandbox${check.cause ? `: ${check.cause}` : ""}`,
-            });
         }
         const paths = await changedPaths(cwd, signal, input.baselinePaths);
         // A job the pull request's CI reported failed runs whatever its paths say.
@@ -1479,12 +1566,23 @@ export function makeRunVerify(opts = {}) {
         const steps = jobs.flatMap((job) => job.steps.map((step) => ({ job, step })));
         if (approved.length === 0 && steps.length === 0) {
             report();
-            return { findings, reasons, labels, checks: unrunnable };
+            // Every approved check here is one the sandbox cannot run: none is "not run".
+            return {
+                findings,
+                reasons,
+                labels,
+                checks: approvedRecords(file, new Map(), "the sandbox cannot run it"),
+            };
         }
         const buildLeft = (opts.repoChecksBuildBudgetMs ?? REPO_CHECKS_BUILD_BUDGET_MS) - repoChecksSpentMs;
         if (buildLeft < REPO_CHECK_MIN_START_MS) {
-            reasons.push("approved checks and CI steps not run again: the build's check budget is spent; the host still runs the approved checks after the build");
-            return { findings, reasons, labels, checks: unrunnable };
+            reasons.push(`approved checks and CI steps not run again: the build's check budget is spent${hostRechecks}`);
+            return {
+                findings,
+                reasons,
+                labels,
+                checks: approvedRecords(file, new Map(), "the build's check budget is spent"),
+            };
         }
         const callBudget = Math.min(opts.repoChecksCallBudgetMs ?? REPO_CHECKS_CALL_BUDGET_MS, timeoutMs - (now() - input.callStartedAt), buildLeft);
         const halfStartedAt = now();
@@ -1500,6 +1598,7 @@ export function makeRunVerify(opts = {}) {
             failedJobs,
             approvedFailed: new Set(),
             checks: [],
+            approvedRuns: new Map(),
         };
         const before = await treeStatus(cwd, signal).catch((err) => {
             const msg = err instanceof Error ? err.message : String(err);
@@ -1531,9 +1630,21 @@ export function makeRunVerify(opts = {}) {
             }
         }
         if (run.notReached > 0) {
-            reasons.push(`${run.notReached} approved check(s) or CI step(s) not reached in the gate's time budget; the host still runs the approved checks after the build`);
+            reasons.push(`${run.notReached} approved check(s) or CI step(s) not reached in the gate's time budget${hostRechecks}`);
         }
-        return { findings, reasons, labels, checks: [...unrunnable, ...run.checks] };
+        const approvedRan = new Set(run.approvedRuns.values());
+        const whyNotRun = signal?.aborted
+            ? "the build stopped first"
+            : "not reached in the gate's time budget";
+        return {
+            findings,
+            reasons,
+            labels,
+            checks: [
+                ...approvedRecords(file, run.approvedRuns, whyNotRun),
+                ...run.checks.filter((record) => !approvedRan.has(record)),
+            ],
+        };
     }
     /**
      * One repository command's verdict: passed, a note (it could not run), or a
@@ -1543,6 +1654,8 @@ export function makeRunVerify(opts = {}) {
      * (`needs` says what). Only the session that measured knows it passed: a
      * resumed session's host carries forward what failed on the base, never
      * what passed, so there the same check is could not run, failing open.
+     * The stream hears the command start, and its end here unless it failed:
+     * a failure's caller tells its end once it decided whose the failure is.
      */
     async function runRepoCommand(run, command, dir, stepEnv, check) {
         const capMs = Math.min(opts.repoCheckTimeoutMs ?? REPO_CHECK_TIMEOUT_MS, run.left());
@@ -1550,6 +1663,8 @@ export function makeRunVerify(opts = {}) {
         const env = opts.repoChecksEnv
             ? { ...opts.repoChecksEnv, ...(stepEnv ?? {}) }
             : buildRepoCheckEnv(process.env, run.toolchainFile, stepEnv);
+        const cwd = relative(run.cwd, dir) || ".";
+        opts.onCheck?.({ phase: "start", name: check.name, command, cwd });
         const startedAt = now();
         try {
             const { code, output: rawOutput } = await exec(repoCheckArgv(command), dir, composed, env);
@@ -1557,7 +1672,7 @@ export function makeRunVerify(opts = {}) {
                 const entry = {
                     name: check.name,
                     command,
-                    cwd: relative(run.cwd, dir) || ".",
+                    cwd,
                     exitCode: note ? null : code,
                     durationMs: now() - startedAt,
                     baseline,
@@ -1567,14 +1682,16 @@ export function makeRunVerify(opts = {}) {
                 return entry;
             };
             if (code === 0) {
-                record(check.baseline);
+                const entry = record(check.baseline);
+                opts.onCheck?.(checkEnded(entry));
                 return { kind: "passed" };
             }
             const output = scrubSecrets(rawOutput);
             const cls = classifyTestFailure(output, code, MAX_LOCATED_FINDINGS, env);
             if (cls.kind === "infra" && !(cls.needs && check.passedOnBase)) {
                 const reason = `could not run: ${cls.reason}`;
-                record("cannot_run", `${reason}; ${exitSummary(check.name, code, output)}`);
+                const entry = record("cannot_run", `${reason}; ${exitSummary(check.name, code, output)}`);
+                opts.onCheck?.(checkEnded(entry, output));
                 return { kind: "note", reason };
             }
             return {
@@ -1587,15 +1704,17 @@ export function makeRunVerify(opts = {}) {
             };
         }
         catch (err) {
-            run.checks.push({
+            const entry = {
                 name: check.name,
                 command,
-                cwd: relative(run.cwd, dir) || ".",
+                cwd,
                 exitCode: null,
                 durationMs: now() - startedAt,
                 baseline: check.baseline,
                 note: unexitedNote(err, run.signal, composed),
-            });
+            };
+            run.checks.push(entry);
+            opts.onCheck?.(checkEnded(entry));
             const msg = err instanceof Error ? err.message : String(err);
             return { kind: "note", reason: `could not run: ${scrubSecrets(msg)}` };
         }
@@ -1628,11 +1747,18 @@ export function makeRunVerify(opts = {}) {
             // The failures it had there, when the session measured it failing.
             const failedOnBase = opts.checksOnBase?.failed.get(check.command.trim());
             const status = measuredBaseline(opts.checksOnBase, check);
+            const recorded = run.checks.length;
             const verdict = await runRepoCommand(run, check.command, run.cwd, undefined, {
                 name: label,
                 baseline: status,
                 passedOnBase: opts.checksOnBase?.passed.has(check.command.trim()) ?? false,
             });
+            // `runRepoCommand` records every run once, whatever its verdict.
+            const ran = run.checks[recorded];
+            if (ran) {
+                run.approvedRuns.set(check.command.trim(), ran);
+                lastApproved.set(check.command.trim(), ran);
+            }
             if (verdict.kind === "failed")
                 run.approvedFailed.add(canonicalCheckCommand(check.command));
             if (verdict.kind === "failed" && verdict.needs) {
@@ -1668,6 +1794,8 @@ export function makeRunVerify(opts = {}) {
                     run.findings.push(...found.slice(0, findingRoom(run)));
                 }
             }
+            if (verdict.kind === "failed")
+                opts.onCheck?.(checkEnded(verdict.record, verdict.output));
         }
     }
     /**
@@ -1742,6 +1870,7 @@ export function makeRunVerify(opts = {}) {
                 continue;
             }
             settle(job, "failed");
+            opts.onCheck?.(checkEnded(verdict.record, verdict.output));
             const stepFindings = repoFailureFindings(run, verdict, step.name, where, dir);
             const keys = new Set(stepFindings.map((f) => f.message));
             const previous = lastCiFailure.get(key);
@@ -1791,15 +1920,27 @@ export function makeRunVerify(opts = {}) {
             const counts = opts.baseline?.get(verifyCommandKey(command));
             return counts && [...counts.values()].some((n) => n > 0) ? "fails_on_base" : "runnable";
         };
-        const recordCommand = (command, code, startedAt, baseline, note) => checks.push({
+        /** A detected command starting, as the stream hears it. */
+        const commandStarted = (command) => opts.onCheck?.({
+            phase: "start",
             name: command.label,
             command: command.argv.join(" "),
             cwd: relative(cwd, command.cwd) || ".",
-            exitCode: code,
-            durationMs: now() - startedAt,
-            baseline,
-            ...(note ? { note } : {}),
         });
+        /** A detected command's record, its end told to the stream with its output's tail. */
+        const recordCommand = (command, code, startedAt, baseline, more = {}) => {
+            const entry = {
+                name: command.label,
+                command: command.argv.join(" "),
+                cwd: relative(cwd, command.cwd) || ".",
+                exitCode: code,
+                durationMs: now() - startedAt,
+                baseline,
+                ...(more.note ? { note: more.note } : {}),
+            };
+            checks.push(entry);
+            opts.onCheck?.(checkEnded(entry, more.output));
+        };
         // TYPECHECK HALF (frozen behavior, §0.2): run every changed package's build
         // check; union the findings. One package that cannot spawn fails OPEN (a
         // recorded reason, no finding) without sinking the verdict for the packages
@@ -1808,6 +1949,7 @@ export function makeRunVerify(opts = {}) {
         const typecheckEnv = buildGateVerifyEnv(process.env, toolchainFile);
         for (const command of commands) {
             const composed = composeAbortSignal(signal, AbortSignal.timeout(timeoutMs));
+            commandStarted(command);
             const startedAt = now();
             try {
                 const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed, typecheckEnv);
@@ -1820,11 +1962,14 @@ export function makeRunVerify(opts = {}) {
                     const infra = classifyVerifyInfraFailure(output, code);
                     if (infra) {
                         reasons.push(`verify (${command.label}) could not run: ${infra}`);
-                        recordCommand(command, null, startedAt, "cannot_run", `could not run: ${infra}; ${exitSummary(command.label, code, output)}`);
+                        recordCommand(command, null, startedAt, "cannot_run", {
+                            note: `could not run: ${infra}; ${exitSummary(command.label, code, output)}`,
+                            output,
+                        });
                         continue;
                     }
                 }
-                recordCommand(command, code, startedAt, standing(command));
+                recordCommand(command, code, startedAt, standing(command), { output });
                 anyRan = true;
                 typecheckLabels.push(command.label);
                 if (code !== 0) {
@@ -1835,7 +1980,9 @@ export function makeRunVerify(opts = {}) {
                 }
             }
             catch (err) {
-                recordCommand(command, null, startedAt, standing(command), unexitedNote(err, signal, composed));
+                recordCommand(command, null, startedAt, standing(command), {
+                    note: unexitedNote(err, signal, composed),
+                });
                 const msg = err instanceof Error ? err.message : String(err);
                 reasons.push(`verify (${command.label}) could not run: ${scrubSecrets(msg)}`);
             }
@@ -1871,13 +2018,17 @@ export function makeRunVerify(opts = {}) {
                         continue;
                     }
                     const composed = composeAbortSignal(signal, AbortSignal.timeout(testTimeoutMs));
+                    commandStarted(command);
                     const startedAt = now();
                     try {
                         const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed, testEnv);
                         const output = scrubSecrets(rawOutput);
                         const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY, testEnv);
                         if (cls.kind === "infra") {
-                            recordCommand(command, null, startedAt, "cannot_run", `could not run: ${cls.reason}; ${exitSummary(command.label, code, output)}`);
+                            recordCommand(command, null, startedAt, "cannot_run", {
+                                note: `could not run: ${cls.reason}; ${exitSummary(command.label, code, output)}`,
+                                output,
+                            });
                             reasons.push(`tests (${where}) could not run: ${cls.reason}; 'clean' reflects typecheck + review only`);
                             continue;
                         }
@@ -1887,19 +2038,22 @@ export function makeRunVerify(opts = {}) {
                             testLabels.push(command.label);
                             if (base === "fails_on_base") {
                                 const summary = exitSummary(command.label, code, output);
-                                recordCommand(command, code, startedAt, base, `failed on the unchanged code too: ${summary}`);
+                                recordCommand(command, code, startedAt, base, {
+                                    note: `failed on the unchanged code too: ${summary}`,
+                                    output,
+                                });
                                 reasons.push(`tests (${where}) failed on the unchanged code too, so not a finding: ${summary}`);
                             }
                             else {
                                 // One finding per command, past the cap too: it is the only
                                 // word of this command's failure.
-                                recordCommand(command, code, startedAt, base);
+                                recordCommand(command, code, startedAt, base, { output });
                                 testFindingCount += 1;
                                 findings.push(tailFinding(command.label, code, output));
                             }
                             continue;
                         }
-                        recordCommand(command, code, startedAt, base);
+                        recordCommand(command, code, startedAt, base, { output });
                         if (cls.kind === "uncertain") {
                             // Failing OPEN on an uninterpretable failure (§3d): an honest note,
                             // never a guessed finding the fix stage cannot clear.
@@ -1918,7 +2072,9 @@ export function makeRunVerify(opts = {}) {
                         }
                     }
                     catch (err) {
-                        recordCommand(command, null, startedAt, standing(command), unexitedNote(err, signal, composed));
+                        recordCommand(command, null, startedAt, standing(command), {
+                            note: unexitedNote(err, signal, composed),
+                        });
                         const msg = err instanceof Error ? err.message : String(err);
                         reasons.push(`tests (${where}) could not run: ${scrubSecrets(msg)}`);
                     }
@@ -1932,6 +2088,7 @@ export function makeRunVerify(opts = {}) {
         if (repoFile) {
             if (typecheckFailed) {
                 reasons.push("approved checks and CI steps skipped: the typecheck half failed; a later round runs them");
+                checks.push(...approvedRecords(repoFile, new Map(), "the typecheck half failed first"));
             }
             else {
                 const repo = await runRepoChecks({
@@ -2056,7 +2213,8 @@ export function makeTakeVerifyBaseline(opts = {}) {
             for (const { command, test } of runs) {
                 if (signal?.aborted)
                     break;
-                const left = budgetMs - (now() - startedAt);
+                const commandStartedAt = now();
+                const left = budgetMs - (commandStartedAt - startedAt);
                 if (left < REPO_CHECK_MIN_START_MS) {
                     result.notes.push(`${command.label} (${command.cwd}): not reached in the baseline budget`);
                     continue;
@@ -2065,8 +2223,23 @@ export function makeTakeVerifyBaseline(opts = {}) {
                     ? (opts.testTimeoutMs ?? VERIFY_TEST_TIMEOUT_MS)
                     : (opts.timeoutMs ?? VERIFY_TIMEOUT_MS), left);
                 const composed = composeAbortSignal(signal, AbortSignal.timeout(cap));
+                const heard = {
+                    name: command.label,
+                    command: command.argv.join(" "),
+                    cwd: relative(cwd, command.cwd) || ".",
+                    base: true,
+                };
+                opts.onCheck?.({ phase: "start", ...heard });
+                const ended = (exitCode, output) => opts.onCheck?.({
+                    phase: "end",
+                    ...heard,
+                    exitCode,
+                    durationMs: now() - commandStartedAt,
+                    ...(output && exitCode !== 0 ? { tail: checkTail(output) } : {}),
+                });
                 try {
                     const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed, test ? testEnv : verifyEnv);
+                    ended(code, rawOutput);
                     const output = scrubSecrets(rawOutput);
                     let failed;
                     if (test) {
@@ -2095,6 +2268,7 @@ export function makeTakeVerifyBaseline(opts = {}) {
                         result.failures += n;
                 }
                 catch (err) {
+                    ended(null);
                     const msg = err instanceof Error ? err.message : String(err);
                     result.notes.push(`${command.label} (${command.cwd}): could not run: ${scrubSecrets(msg)}`);
                 }
@@ -2170,14 +2344,25 @@ export function makeMeasureChecksOnBase(opts = {}) {
                     break;
                 const command = check.command.trim();
                 const label = checkLabel(check.command);
-                const left = budgetMs - (now() - startedAt);
+                const checkStartedAt = now();
+                const left = budgetMs - (checkStartedAt - startedAt);
                 if (left < REPO_CHECK_MIN_START_MS) {
                     result.notes.push(`\`${label}\`: not reached in the budget`);
                     continue;
                 }
                 const composed = composeAbortSignal(signal, AbortSignal.timeout(Math.min(opts.timeoutMs ?? REPO_CHECK_TIMEOUT_MS, left)));
+                const heard = { name: label, command: check.command, cwd: ".", base: true };
+                opts.onCheck?.({ phase: "start", ...heard });
+                const ended = (exitCode, output) => opts.onCheck?.({
+                    phase: "end",
+                    ...heard,
+                    exitCode,
+                    durationMs: now() - checkStartedAt,
+                    ...(output && exitCode !== 0 ? { tail: checkTail(output) } : {}),
+                });
                 try {
                     const { code, output: rawOutput } = await exec(repoCheckArgv(check.command), cwd, composed, env);
+                    ended(code, rawOutput);
                     if (code === 0) {
                         passed.add(command);
                         result.ran.push(label);
@@ -2206,6 +2391,7 @@ export function makeMeasureChecksOnBase(opts = {}) {
                     result.ran.push(label);
                 }
                 catch (err) {
+                    ended(null);
                     result.notes.push(`\`${label}\`: ${unexitedNote(err, signal, composed)}`);
                 }
             }

package/dist/extension/pipeline/workspace.d.ts

@@ -29,4 +29,10 @@ export declare function workspaceChanged(before: WorkspaceSnapshot, after: Works
  * report `tracked: false` and skip the second call.
  */
 export declare function snapshotWorkspace(cwd: string, signal?: AbortSignal): Promise<WorkspaceSnapshot>;
+/**
+ * The repo-relative paths committed between `baseSha` and HEAD: what a run
+ * committed past its base. Empty on any git error, so a caller reads the
+ * uncommitted tree alone, as it did before.
+ */
+export declare function committedPaths(cwd: string, baseSha: string, signal?: AbortSignal): Promise<string[]>;
 //# sourceMappingURL=workspace.d.ts.map

package/dist/extension/pipeline/workspace.js

@@ -70,4 +70,16 @@ export async function snapshotWorkspace(cwd, signal) {
     const status = await runGit(["status", "--porcelain"], cwd, signal);
     return { tracked: true, head, status };
 }
+/**
+ * The repo-relative paths committed between `baseSha` and HEAD: what a run
+ * committed past its base. Empty on any git error, so a caller reads the
+ * uncommitted tree alone, as it did before.
+ */
+export async function committedPaths(cwd, baseSha, signal) {
+    const names = await runGit(["diff", "--name-only", baseSha, "HEAD"], cwd, signal);
+    return names
+        .split("\n")
+        .map((line) => line.trim())
+        .filter(Boolean);
+}
 //# sourceMappingURL=workspace.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.7-staging.2035.1",
+  "version": "1.2.7-staging.2059.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "83d927d6ece210d0734c46e6654c34bf89ecb565"
+  "yagniSourceSha": "6e9cbb06e7ae4d5b15b14fecc749fb5fbab2e93b"
 }