@zq-silk/yui 0.15.11 → 0.15.12

package/dist/storage/taskCatalog.js

@@ -0,0 +1,123 @@
+/** Current facts, not another persisted projection or execution status. */
+export const CATALOG_ATTENTION = [
+    "openInputs", "pendingOperations", "unknownOperations", "executionSignals"
+];
+/**
+ * All filtering/counting stays in SQLite. Only page-sized rows and fixed
+ * attention samples cross into JS; no Task/Run/Message/Event body is decoded.
+ * The existing catalog and record tables remain the only stored authorities.
+ */
+export function queryTaskCatalog(db, query) {
+    const scope = ["1=1"];
+    const params = { limit: query.limit };
+    if (query.taskId !== undefined) {
+        scope.push("c.task_id = @taskId");
+        params.taskId = query.taskId;
+    }
+    if (!query.all)
+        scope.push("c.status <> 'archived'");
+    const match = ["1=1"];
+    if (query.status !== undefined) {
+        match.push("status = @status");
+        params.status = query.status;
+    }
+    if (query.project !== undefined) {
+        match.push(`EXISTS (SELECT 1 FROM task_records r, json_each(r.payload, '$.projectBindings') p
+      WHERE r.task_id = facts.id AND json_extract(p.value, '$.projectId') = @project)`);
+        params.project = query.project;
+    }
+    if (query.search) {
+        match.push(`EXISTS (SELECT 1 FROM task_records r WHERE r.task_id = facts.id AND
+      (instr(lower(json_extract(r.payload, '$.title')), lower(@search)) > 0
+       OR instr(lower(r.task_id), lower(@search)) > 0
+       OR EXISTS (SELECT 1 FROM json_each(r.payload, '$.tags') tag
+          WHERE instr(lower(tag.value), lower(@search)) > 0)
+       OR EXISTS (SELECT 1 FROM json_each(r.payload, '$.projectBindings') b
+          JOIN projects p ON p.id = json_extract(b.value, '$.projectId')
+          WHERE instr(lower(json_extract(p.payload, '$.name')), lower(@search)) > 0)))`);
+        params.search = query.search;
+    }
+    if (query.attention !== undefined)
+        match.push(`${query.attention} > 0`);
+    const position = (name, op) => {
+        const value = query[name];
+        if (value === undefined)
+            return;
+        params[`${name}Date`] = value.createdAt;
+        params[`${name}Id`] = value.id;
+        match.push(`(createdAt, id) ${op} (@${name}Date, @${name}Id)`);
+    };
+    position("through", "<=");
+    // A fixed upper key excludes newly-created Tasks on later pages. Updates
+    // to mutable filters are current reads, not a snapshot/session protocol.
+    const after = [];
+    if (query.after !== undefined) {
+        params.afterDate = query.after.createdAt;
+        params.afterId = query.after.id;
+        after.push("(createdAt, id) > (@afterDate, @afterId)");
+    }
+    const count = (table, condition) => `(SELECT count(*) FROM ${table} x WHERE x.task_id = c.task_id AND (${condition}))`;
+    // Execution signals deliberately preserve raw inspectable conditions:
+    // live runs (including unknown admission/identity/stall), unresolved work,
+    // integrations, and pending Leader recovery. They are NOT a second
+    // classifier for working/blocked/success; precise execution stays in detail.
+    // Including all live runs is conservative: an off-page runtime attention
+    // cannot disappear just because a lightweight read did not fold its history.
+    const cte = `WITH facts AS MATERIALIZED (
+    SELECT c.task_id AS id, c.created_at AS createdAt, c.updated_at AS updatedAt, c.status,
+      ${count("work_items", "1=1")} AS workItems,
+      ${count("turns", "status = 'active'")} AS activeRuns,
+      ${count("input_requests", "status = 'open'")} AS openInputs,
+      ${count("durable_jobs", "status IN ('queued','running')")} AS pendingOperations,
+      ${count("durable_jobs", "status = 'unknown-needs-attention'")} AS unknownOperations,
+      CASE WHEN c.status IN ('active','draft') THEN
+        ${count("turns", "status = 'active'")} +
+        ${count("work_items", "status = 'open' OR (status = 'accepted' AND json_extract(payload, '$.currentExecutionGroupId') IS NOT NULL)")} +
+        ${count("integration_attempts", "status IN ('running','validating','blocked','conflicted','failed')")} +
+        ${count("review_rounds", "status IN ('pending','running','failed')")} +
+        ${count("task_projections", "kind = 'leader-failure' AND payload IS NOT NULL AND payload <> 'null'")} +
+        ${count("mailboxes", "role_name = 'leader' AND (json_type(pending) = 'object' OR json_type(processing) = 'object')")}
+      ELSE 0 END AS executionSignals
+    FROM tasks_catalog c WHERE ${scope.join(" AND ")}
+  ), matching AS MATERIALIZED (SELECT * FROM facts WHERE ${match.join(" AND ")})
+  SELECT
+    (SELECT json_group_array(json_object('status',status,'count',n))
+      FROM (SELECT status,count(*) n FROM facts GROUP BY status)) AS counts,
+    (SELECT count(*) FROM matching) AS total,
+    (SELECT json_object('id',id,'createdAt',createdAt) FROM matching
+      ORDER BY createdAt DESC,id DESC LIMIT 1) AS upper,
+    ${CATALOG_ATTENTION.map(kind => `
+      (SELECT sum(${kind}) FROM facts) AS ${kind}Count,
+      (SELECT count(*) FROM facts WHERE ${kind} > 0) AS ${kind}Tasks,
+      (SELECT json_group_array(id) FROM (SELECT id FROM facts WHERE ${kind} > 0
+        ORDER BY createdAt,id LIMIT 4)) AS ${kind}Ids`).join(",")},
+    (SELECT json_group_array(json_object(
+      'id',page.id,'createdAt',page.createdAt,'updatedAt',page.updatedAt,'status',page.status,
+      'title',substr(json_extract(r.payload,'$.title'),1,256),
+      'summary',substr(json_extract(r.brief,'$.leaderSummary'),1,512),
+      'summaryPresent',json(CASE WHEN r.brief IS NULL THEN 'false' ELSE 'true' END),
+      'workItems',page.workItems,'activeRuns',page.activeRuns,
+      'openInputs',page.openInputs,'pendingOperations',page.pendingOperations,
+      'unknownOperations',page.unknownOperations,'executionSignals',page.executionSignals)
+      ORDER BY page.createdAt,page.id)
+      FROM (SELECT * FROM matching ${after.length ? `WHERE ${after.join(" AND ")}` : ""}
+        ORDER BY createdAt,id LIMIT @limit) page
+      JOIN task_records r ON r.task_id = page.id) AS rows`;
+    const result = db.prepare(cte).get(params);
+    const counts = { draft: 0, active: 0, completed: 0, cancelled: 0, archived: 0, total: 0 };
+    for (const entry of JSON.parse(result.counts)) {
+        counts[entry.status] = entry.count;
+        counts.total += entry.count;
+    }
+    return {
+        rows: JSON.parse(result.rows),
+        total: result.total,
+        through: result.upper === null ? null : JSON.parse(result.upper),
+        counts,
+        attention: Object.fromEntries(CATALOG_ATTENTION.map(kind => [kind, {
+                count: Number(result[`${kind}Count`] ?? 0),
+                taskCount: Number(result[`${kind}Tasks`] ?? 0),
+                taskIds: JSON.parse(result[`${kind}Ids`])
+            }]))
+    };
+}

package/dist/storage/taskStore.js

@@ -448,6 +448,8 @@ export function storedPublicationReference(value) {
         fields.push("targetBranch");
     if (reference.localCommit !== undefined)
         fields.push("localCommit");
+    if (reference.headCommit !== undefined)
+        fields.push("headCommit");
     if (reference.remoteCommit !== undefined)
         fields.push("remoteCommit");
     if (reference.evidence !== undefined)

package/dist/task/archiveDiagnostics.js

@@ -122,6 +122,7 @@ export function taskArchiveDiagnostics(store, task) {
 export function renderArchiveDiagnostics(data) {
     return [
         `Archived: ${data.archived}; forced: ${data.forced}; cleanup finished: ${data.cleanupFinished}`,
+        `Retained references: ${data.retainedResources.length}; a finished cleanup attempt is not physical resource release evidence.`,
         ...data.warnings.map(w => `Warning [${w.resource}]: ${w.detail}`),
         ...data.retainedResources.map(r => `Retained [${r.resource}]: ${r.detail}${r.paths ? ` (${r.paths.join(", ")})` : ""}`)
     ].join("\n") + "\n";

package/dist/task/archivePreflight.js

@@ -0,0 +1,124 @@
+import { readArchiveDelivery } from "../repository/workspaceCleanupInspection.js";
+import { WorkspaceCleanupBlockedError } from "../repository/taskWorkspacePreparer.js";
+import { managedWorkspaceKey } from "../worktree/managedWorkspace.js";
+import { hasRuntimeLifecycleWork, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
+import { cleanupCheckFromError, renderCleanupCheck } from "../workspace/cleanupInspection.js";
+/** Semantic admission facts. Cleanup still has its own resource boundary. */
+export function archiveSettlementChecks(store, task) {
+    const checks = [];
+    const add = (resource, reason, detail, expected, observed, action) => checks.push({ resource, reason, status: "blocked", detail, expected, observed, sources: [resource], actions: [action] });
+    for (const input of store.listInputRequests(task.id).filter(i => i.status === "open")) {
+        add(`input:${task.id}/${input.id}`, "unresolved-input", "Open user input is not answered by archive.", "resolved input", input.status, `yui task input show ${task.id}/${input.id}`);
+    }
+    for (const item of store.listWorkItems(task.id).filter(i => i.status === "open")) {
+        add(`work-item:${task.id}/${item.id}`, "owner-unsettled", "WorkItem must be accepted or explicitly retired before archive.", ["accepted", "retired"], item.status, `yui task work show ${task.id}/${item.id}`);
+    }
+    for (const attempt of store.listIntegrationAttempts(task.id).filter(a => ["running", "blocked", "conflicted", "validating"].includes(a.status))) {
+        add(`integration-attempt:${task.id}/${attempt.id}`, "unresolved-integration", "Task has an unresolved Integration Attempt.", "terminal attempt", attempt.status, `yui task integration show ${task.id}/${attempt.id}`);
+    }
+    for (const job of store.listDurableJobs(task.id).filter(j => ["queued", "running"].includes(j.status) || (j.status === "unknown-needs-attention" && j.acknowledgedAt === undefined))) {
+        add(`job:${task.id}/${job.id}`, "active-durable-job", "Task has an active or unacknowledged DurableJob.", "settled job", job.status, `yui job get --task ${task.id} --job ${job.id}`);
+    }
+    return checks;
+}
+/** Unknown execution is never permission to remove workspaces, even after
+ * force admission. These facts are reloaded in the actual force cleanup path.
+ */
+export function archiveExecutionChecks(store, taskId) {
+    const checks = [];
+    const add = (resource, reason, detail, observed, action) => checks.push({ resource, reason, status: "unknown", detail, expected: "settled execution",
+        observed, sources: [resource], actions: [action] });
+    for (const run of store.listRuns(taskId).filter(r => r.status === "active")) {
+        add(`run:${taskId}/${run.id}`, "active-turn", "AgentRun remains active; archive is not stop evidence.", run.status, `yui task run show ${taskId}/${run.id}`);
+    }
+    for (const job of store.listDurableJobs(taskId).filter(j => ["queued", "running", "unknown-needs-attention"].includes(j.status))) {
+        add(`job:${taskId}/${job.id}`, "unresolved-execution", "DurableJob may still hold resources; acknowledgement is not physical exit evidence.", job.status, `yui job get --task ${taskId} --job ${job.id}`);
+    }
+    for (const role of store.listRoles(taskId)) {
+        const resource = `role:${taskId}/${role.name}`;
+        const action = `yui task role session inspect ${taskId} ${role.name}`;
+        const provider = store.getTaskRoleSessionSet(taskId, role.name)?.providerBinding;
+        const mailbox = store.getWorkMailbox({ kind: "role", taskId, roleName: role.name });
+        if (provider?.run != null && !["completed", "failed", "cancelled"].includes(provider.run.status)) {
+            add(resource, "unresolved-provider-input", "Original provider input outcome is unresolved; do not replay it.", { attemptId: provider.run.attemptId, status: provider.run.status }, action);
+        }
+        if (mailbox?.processing != null && (provider?.run == null
+            || !["completed", "failed", "cancelled"].includes(provider.run.status))) {
+            add(resource, "unresolved-mailbox", "Original mailbox claim has no proven terminal; archive does not acknowledge it.", { batchId: mailbox.processing.batchId }, action);
+        }
+        if (hasRuntimeLifecycleWork(store.getWorkMailbox(runtimeLifecycleTarget({ scope: "task", taskId, roleName: role.name })))) {
+            add(resource, "unresolved-runtime-lifecycle", "Role has unsettled runtime lifecycle work.", "pending", action);
+        }
+    }
+    return checks;
+}
+export async function inspectTaskArchive(coordinator, request) {
+    const { store, preparer, runtime } = coordinator;
+    const task = store.getTask(request.taskId);
+    if (task === null)
+        throw new Error(`Task not found: ${request.taskId}.`);
+    const settlement = archiveSettlementChecks(store, task);
+    const delivery = await readArchiveDelivery(store, preparer.git, task, request.force);
+    const deliveryChecks = delivery.projects.filter(p => p.codeDelivery !== "none" && (!p.merged || !p.verified))
+        .map(p => ({ resource: `delivery:${task.id}/${p.projectId}`, reason: "delivery-coverage", status: "blocked",
+        detail: p.reason, expected: { merged: true, verified: true, localCommit: p.expectedLocalCommit },
+        observed: { coverage: p.coverage, merged: p.merged, verified: p.verified, localCommit: p.publication?.localCommit ?? null },
+        sources: [`task:${task.id}`, ...(p.publication === null ? [] : [`publication:${task.id}/${p.publication.id}`])],
+        actions: [`yui task remote-delivery ${task.id}`] }));
+    const execution = archiveExecutionChecks(store, task.id);
+    const runtimeResource = `runtime:${task.id}`;
+    if (runtime.assertTaskPhysicalResourcesReleased === undefined) {
+        execution.push(...cleanupCheckFromError(null, runtimeResource, [`task:${task.id}`], [`yui task role status ${task.id}`]));
+    }
+    else {
+        try {
+            await runtime.assertTaskPhysicalResourcesReleased(task.id);
+        }
+        catch (error) {
+            execution.push({ resource: runtimeResource, reason: "physical-resources-unreleased", status: "unknown",
+                detail: error instanceof WorkspaceCleanupBlockedError ? error.message
+                    : "Exact physical resource release is not established by the runtime inspection.",
+                expected: "proven physical absence",
+                observed: error instanceof WorkspaceCleanupBlockedError ? { reason: error.reason, resource: error.resource } : "unavailable",
+                sources: [`task:${task.id}`],
+                actions: [`yui task role status ${task.id}`, `yui session reconcile --report`] });
+        }
+    }
+    const resources = [];
+    for (const workspace of store.listManagedWorkspaces(task.id)) {
+        const disposition = workspace.owner.type === "work-item"
+            && store.getWorkItem(task.id, workspace.owner.workItemId)?.status === "retired" ? "abandoned" : request.disposition;
+        let checks;
+        try {
+            checks = await preparer.inspectWorkspaceCleanup(workspace, disposition, request.force);
+        }
+        catch (error) {
+            checks = cleanupCheckFromError(error, managedWorkspaceKey(workspace.owner), [managedWorkspaceKey(workspace.owner)], [`yui task show ${task.id}`]);
+        }
+        resources.push({ resource: managedWorkspaceKey(workspace.owner), owner: workspace.owner,
+            status: checks.some(c => c.status === "unknown") ? "unknown" : checks.length > 0 ? "blocked" : "checked",
+            checks });
+    }
+    const eligible = ["completed", "cancelled", "archived"].includes(task.status);
+    return { taskId: task.id, observedAt: new Date().toISOString(), disposition: request.disposition, force: request.force,
+        readOnly: true, authorizesCleanup: false,
+        archive: { status: task.status, eligible, alreadyArchived: task.status === "archived",
+            settlement, delivery: deliveryChecks, forceBypassesSettlement: request.force,
+            requiresIndependentAuthorization: true },
+        cleanup: { execution, resources },
+        note: "Current observations only. Execution reloads the checks. Force commits archive first and retains unsafe resources; a finished attempt does not prove resource release." };
+}
+export function renderTaskArchivePreflight(data) {
+    return [
+        `Archive preflight: ${data.taskId} (${data.disposition}${data.force ? ", force" : ""}); read-only, not authorization`,
+        `Task: ${data.archive.status}; terminal eligibility: ${data.archive.eligible}`,
+        ...data.archive.settlement.map(c => `Admission${data.force ? " (force preserves)" : ""}: ${renderCleanupCheck(c)}`),
+        ...data.archive.delivery.map(c => `Delivery${data.force || data.disposition === "abandoned" ? " (advisory for admission)" : ""}: ${renderCleanupCheck(c)}`),
+        ...data.cleanup.execution.map(c => `Cleanup: ${renderCleanupCheck(c)}`),
+        ...data.cleanup.resources.flatMap(r => [
+            `Workspace [${r.resource}]: ${r.status}`,
+            ...r.checks.map(c => `  ${renderCleanupCheck(c)}`)
+        ]),
+        data.note
+    ].join("\n") + "\n";
+}

package/dist/task/publicationAdoption.js

@@ -0,0 +1,56 @@
+import { contextContentDigest } from "../context/contextSnapshot.js";
+import { publicationExternalKey } from "./publicationReference.js";
+export const PUBLICATION_ADOPTED_EVENT = "publication.candidate-adopted";
+/**
+ * An explicit semantic decision over fixed Git endpoints, not an ancestry
+ * heuristic or a replacement completion head. Publication metadata/verification
+ * successors may retain it only while every intervening local candidate agrees.
+ */
+export function publicationAdoption(publication, completion, acceptedCommit, events, publications, integrations) {
+    const unavailable = { event: null, reason: null };
+    if (completion === undefined || acceptedCommit === null)
+        return unavailable;
+    const lineage = new Set();
+    let current = publication;
+    while (current !== undefined && !lineage.has(current.id)
+        && current.taskId === publication.taskId
+        && current.projectId === publication.projectId
+        && current.externalKind === publication.externalKind
+        && publicationExternalKey(current) === publicationExternalKey(publication)
+        && current.localCommit === publication.localCommit) {
+        lineage.add(current.id);
+        current = publications.find(p => p.id === current.supersedes);
+    }
+    const event = events.slice().reverse().find(event => {
+        const p = event.payload;
+        return event.type === PUBLICATION_ADOPTED_EVENT
+            && event.taskId === publication.taskId
+            && p.completionEventId === completion.id
+            && p.acceptedCommit === acceptedCommit
+            && p.projectId === publication.projectId
+            && p.localCommit === publication.localCommit
+            && lineage.has(p.publicationId ?? "");
+    });
+    if (event === undefined)
+        return unavailable;
+    const p = event.payload;
+    if (!p.acceptance?.trim()
+        || !["user", "operator", "leader"].includes(p.by ?? "")
+        || !/^[0-9a-f]{64}$/u.test(p.diffDigest ?? "")
+        || !/^[0-9a-f]{40}$/u.test(p.acceptedTree ?? "")
+        || !/^[0-9a-f]{40}$/u.test(p.candidateTree ?? "")) {
+        return { event: null, reason: `Adoption ${event.id} has incomplete fixed evidence.` };
+    }
+    if (p.integrationId === undefined)
+        return { event, reason: null };
+    const integration = integrations.find(i => i.id === p.integrationId);
+    const valid = integration !== undefined && integration.status === "committed"
+        && integration.taskId === publication.taskId
+        && integration.projectId === publication.projectId
+        && integration.afterCommit === publication.localCommit
+        && contextContentDigest(integration) === p.integrationDigest;
+    return valid ? { event, reason: null } : {
+        event: null,
+        reason: `Adoption ${event.id} references Integration ${p.integrationId}, whose committed candidate evidence is missing or changed (${integration?.status ?? "missing"}).`
+    };
+}

package/dist/task/publicationReference.js

@@ -35,6 +35,9 @@ export function createPublicationReference(id, taskId, input, now) {
         ...(input.localCommit === undefined ? {} : {
             localCommit: requireCommit(input.localCommit, "Publication local commit")
         }),
+        ...(input.headCommit === undefined ? {} : {
+            headCommit: requireCommit(input.headCommit, "Publication remote head")
+        }),
         ...(input.remoteCommit === undefined ? {} : {
             remoteCommit: requireCommit(input.remoteCommit, "Publication remote commit")
         }),
@@ -82,6 +85,13 @@ export function validatePublicationReference(reference) {
     if (reference.localCommit !== undefined) {
         requireCommit(reference.localCommit, "Publication local commit");
     }
+    if (reference.headCommit !== undefined) {
+        requireCommit(reference.headCommit, "Publication remote head");
+        if (reference.verification === "verified"
+            && reference.headCommit !== reference.localCommit) {
+            throw new Error("Verified publication remote head must match its local commit.");
+        }
+    }
     if (reference.remoteCommit !== undefined) {
         requireCommit(reference.remoteCommit, "Publication remote commit");
     }

package/dist/task/remoteDelivery.js

@@ -1,3 +1,4 @@
+import { publicationAdoption } from "./publicationAdoption.js";
 /**
  * One read-only delivery projection over existing Task, workspace, completion,
  * and Publication facts. It never writes a merged flag or queries a provider.
@@ -19,13 +20,19 @@ export function projectTaskRemoteDelivery(facts) {
             .filter((reference) => reference.projectId === binding.projectId);
         const matching = expectedLocalCommit === null
             ? []
-            : projectPublications.filter((reference) => reference.localCommit === expectedLocalCommit);
+            : projectPublications.filter((reference) => reference.localCommit === expectedLocalCommit
+                || publicationAdoption(reference, expected.event, expectedLocalCommit, facts.events, facts.publications, facts.integrations ?? []).event !== null);
         const publication = bestPublication(matching.length > 0 ? matching : projectPublications);
-        const coverage = projectCoverage(codeDelivery, expectedLocalCommit, publication);
+        const adoptionEvidence = publication === null ? null
+            : publicationAdoption(publication, expected.event, expectedLocalCommit, facts.events, facts.publications, facts.integrations ?? []);
+        const adoption = adoptionEvidence?.event ?? null;
+        const covers = expectedLocalCommit !== null && publication !== null
+            && (publication.localCommit === expectedLocalCommit || adoption !== null);
+        const headMatches = publication?.headCommit === undefined
+            || publication.headCommit === publication.localCommit;
+        const coverage = projectCoverage(codeDelivery, expectedLocalCommit, publication, covers, headMatches);
         const merged = codeDelivery === "none"
-            || (publication !== null
-                && expectedLocalCommit !== null
-                && publication.localCommit === expectedLocalCommit
+            || (covers && headMatches
                 && publication.state === "merged");
         const verified = codeDelivery === "none"
             || (merged && publication?.verification === "verified");
@@ -34,6 +41,8 @@ export function projectTaskRemoteDelivery(facts) {
             directory: binding.directory,
             baseCommit,
             expectedLocalCommit,
+            deliveryLocalCommit: covers ? publication.localCommit ?? null : null,
+            adoption,
             codeDelivery,
             publication,
             state: publication?.state ?? null,
@@ -42,7 +51,8 @@ export function projectTaskRemoteDelivery(facts) {
             coverage,
             merged,
             verified,
-            reason: projectCoverageReason(codeDelivery, expectedLocalCommit, publication, coverage)
+            reason: projectCoverageReason(expectedLocalCommit, publication, coverage, adoption) + (coverage === "stale" && adoptionEvidence?.reason
+                ? ` ${adoptionEvidence.reason}` : "")
         };
     });
     const codeProjects = projects.filter((project) => project.codeDelivery !== "none");
@@ -55,8 +65,9 @@ export function projectTaskRemoteDelivery(facts) {
         : codeProjects.some((project) => project.coverage === "head-unavailable")
             ? "unavailable"
             : allMerged
-                ? "merged"
-                : mergedProjectCount > 0 ? "partial" : "pending";
+                ? allVerified ? "merged" : "unverified"
+                : mergedProjectCount > 0 ? "partial"
+                    : codeProjects.some(p => p.state === "merged") ? "uncovered" : "pending";
     return {
         taskId: facts.task.id,
         source: expected.source,
@@ -111,7 +122,7 @@ function expectedDelivery(facts) {
         commits: new Map()
     };
 }
-function completionEvent(events, completedAt) {
+export function completionEvent(events, completedAt) {
     const exact = latestEvent(events, "task.completed", (event) => (event.createdAt === completedAt));
     return exact ?? latestEvent(events, "task.completed", (event) => (event.createdAt <= completedAt));
 }
@@ -154,7 +165,7 @@ function candidateCommits(candidate) {
         commit.toLowerCase()
     ]));
 }
-function commitMap(value) {
+export function commitMap(value) {
     const result = new Map();
     for (const entry of value?.split(",") ?? []) {
         const separator = entry.indexOf("@");
@@ -188,7 +199,7 @@ function publicationRank(reference) {
         return 2;
     return 1;
 }
-function projectCoverage(codeDelivery, expectedLocalCommit, publication) {
+function projectCoverage(codeDelivery, expectedLocalCommit, publication, covers, headMatches) {
     if (codeDelivery === "none")
         return "not-applicable";
     if (expectedLocalCommit === null)
@@ -197,7 +208,9 @@ function projectCoverage(codeDelivery, expectedLocalCommit, publication) {
         return "missing";
     if (publication.localCommit === undefined)
         return "missing-local-commit";
-    if (publication.localCommit !== expectedLocalCommit)
+    if (!headMatches)
+        return "head-mismatch";
+    if (!covers)
         return "stale";
     if (publication.state === "open")
         return "open";
@@ -205,7 +218,7 @@ function projectCoverage(codeDelivery, expectedLocalCommit, publication) {
         return "closed";
     return publication.verification === "verified" ? "verified" : "merged";
 }
-function projectCoverageReason(codeDelivery, expectedLocalCommit, publication, coverage) {
+function projectCoverageReason(expectedLocalCommit, publication, coverage, adoption) {
     switch (coverage) {
         case "not-applicable":
             return "Task head equals the managed workspace base; no code delivery is required.";
@@ -216,15 +229,17 @@ function projectCoverageReason(codeDelivery, expectedLocalCommit, publication, c
         case "missing-local-commit":
             return `Publication ${publication.id} does not record a local commit.`;
         case "stale":
-            return `Publication ${publication.id} covers ${publication.localCommit}, not the expected Task head ${expectedLocalCommit}.`;
+            return `Publication ${publication.id} is ${publication.state}, but its local candidate ${publication.localCommit} has no valid adoption covering accepted Task head ${expectedLocalCommit}.`;
+        case "head-mismatch":
+            return `Publication ${publication.id} is ${publication.state}, but observed remote head ${publication.headCommit} differs from local candidate ${publication.localCommit}; verification is invalid.`;
         case "open":
             return `Publication ${publication.id} covers the Task head but is still open.`;
         case "closed":
             return `Publication ${publication.id} covers the Task head but is closed without merge.`;
         case "merged":
-            return `Publication ${publication.id} reports the exact Task head as merged.`;
+            return `Publication ${publication.id} reports a covering candidate as merged, but remote verification is still required.`;
         case "verified":
-            return `Publication ${publication.id} verifies the exact Task head as merged.`;
+            return `Publication ${publication.id} verifies ${adoption === null ? "the exact Task head" : `candidate ${publication.localCommit} adopted by ${adoption.id}`} as merged.`;
     }
 }
 function compareCreated(left, right) {