@zq-silk/yui 0.15.11 → 0.16.0

package/dist/telemetry/sqliteTelemetryStore.js

@@ -1,15 +1,17 @@
+import Database from "better-sqlite3";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import Database from "better-sqlite3";
-import { DEFAULT_RUN_CAP, DEFAULT_TERMINAL_KEEP } from "./telemetryConfig.js";
-import { migrateSqliteSchema } from "../storage/sqliteSchema.js";
 import { CURRENT_DATABASE_FILENAME as COMMITTED_DATABASE_FILENAME } from "../storage/currentTaskStore.js";
+import { migrateSqliteSchema } from "../storage/sqliteSchema.js";
+import { AsyncTaskStoreClient } from "../storage/storeRpc.js";
+import { DEFAULT_RUN_CAP, DEFAULT_TERMINAL_KEEP } from "./telemetryConfig.js";
 /**
  * Default sidecar implementation: the telemetry tables live inside the Home's
  * authoritative `yui.db`, so a Home has one durable database
  * has one file to manage, back up, and migrate. The store opens its own
- * connection to that file: the write path is a single serialized writer (the
- * "WAL worker") and stays isolated from the business store's connection.
+ * connection for cold synchronous reads/explicit retention. Ingestion writes
+ * use the existing persistence-worker RPC, shared with the Controller when
+ * available; standalone consumers lazily own and close their own client.
  *
  * Writes are best-effort and never block the Controller event loop: `observe`
  * only merges into a bounded in-memory queue; a background flush drains it in
@@ -28,6 +30,10 @@ export class SqliteTelemetryStore {
     #terminalKeep;
     #turnCap;
     #maxPending;
+    #home;
+    #writer;
+    #ownedWriter;
+    #flushing;
     #db = null;
     #failed = false;
     #lastError = null;
@@ -39,6 +45,8 @@ export class SqliteTelemetryStore {
     #closed = false;
     constructor(home, options = {}) {
         this.mode = options.mode ?? "on";
+        this.#home = home;
+        this.#writer = options.writer;
         this.#path = join(home, COMMITTED_DATABASE_FILENAME);
         this.#terminalKeep = options.terminalKeep ?? DEFAULT_TERMINAL_KEEP;
         this.#turnCap = options.runCap ?? DEFAULT_RUN_CAP;
@@ -48,8 +56,7 @@ export class SqliteTelemetryStore {
     observe(entry) {
         if (this.#closed)
             return;
-        const db = this.#ensureDb();
-        if (db === null) {
+        if (this.#failed) {
             this.#dropped++;
             return;
         }
@@ -84,9 +91,14 @@ export class SqliteTelemetryStore {
         if (this.#closed)
             return;
         this.#closed = true;
-        await this.#flushPending();
-        this.#db?.close();
-        this.#db = null;
+        try {
+            await this.#flushPending();
+        }
+        finally {
+            await this.#ownedWriter?.close();
+            this.#db?.close();
+            this.#db = null;
+        }
     }
     // -- TelemetryReader -----------------------------------------------------------
     count(taskId, runId) {
@@ -230,6 +242,7 @@ export class SqliteTelemetryStore {
             return this.#db;
         if (this.#failed || this.#closed)
             return null;
+        let opening;
         try {
             // The telemetry tables live in the Home's authoritative database; the
             // store never creates `yui.db` itself. Wiring fails closed on Homes
@@ -237,17 +250,19 @@ export class SqliteTelemetryStore {
             if (!existsSync(this.#path)) {
                 throw new Error(`Telemetry database not found: ${this.#path}`);
             }
-            const db = new Database(this.#path);
+            const db = opening = new Database(this.#path);
             db.pragma("journal_mode = WAL");
             db.pragma("synchronous = FULL");
             db.pragma("foreign_keys = ON");
-            db.pragma("busy_timeout = 5000");
+            // Cold diagnostic reads/retention must not wait behind a semantic writer.
+            db.pragma("busy_timeout = 0");
             db.pragma("wal_autocheckpoint = 1000");
             migrateSqliteSchema(db, { mode: "validate" });
             this.#db = db;
             return db;
         }
         catch (error) {
+            opening?.close();
             this.#failed = true;
             this.#lastError = error instanceof Error ? error.message : String(error);
             return null;
@@ -263,43 +278,28 @@ export class SqliteTelemetryStore {
         });
         handle.unref?.();
     }
-    async #flushPending() {
-        if (this.#pending.size === 0)
-            return;
-        const db = this.#ensureDb();
-        if (db === null) {
-            this.#dropped += this.#pending.size;
-            this.#pending.clear();
-            return;
-        }
-        const batch = new Map(this.#pending);
-        this.#pending.clear();
-        const upsert = db.prepare(`INSERT INTO telemetry (task_id, role_name, turn_id, progress_id, sequence, payload, received_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?)
-       ON CONFLICT(task_id, role_name, turn_id, progress_id) DO UPDATE SET
-         sequence = excluded.sequence,
-         payload = excluded.payload,
-         received_at = excluded.received_at
-       WHERE excluded.received_at >= telemetry.received_at`);
-        try {
-            const touchedRuns = new Map();
-            db.transaction(() => {
-                for (const entry of batch.values()) {
-                    upsert.run(entry.taskId, entry.roleName, entry.runId, entry.progressId, entry.sequence ?? null, JSON.stringify(entry.payload), entry.receivedAt);
-                    touchedRuns.set(`${entry.taskId}\0${entry.runId}`, {
-                        taskId: entry.taskId,
-                        runId: entry.runId
-                    });
-                }
-                for (const { taskId, runId } of touchedRuns.values()) {
-                    this.capRun(taskId, runId);
-                }
-            })();
-            this.#applied += batch.size;
-        }
-        catch (error) {
-            this.#lastError = error instanceof Error ? error.message : String(error);
-            this.#dropped += batch.size;
+    #flushPending() {
+        this.#flushing ??= this.#drain().finally(() => { this.#flushing = undefined; });
+        return this.#flushing;
+    }
+    async #drain() {
+        while (this.#pending.size > 0) {
+            const batch = [];
+            for (const [key, entry] of this.#pending) {
+                this.#pending.delete(key);
+                batch.push(entry);
+                if (batch.length === 256)
+                    break;
+            }
+            try {
+                const writer = this.#writer ?? (this.#ownedWriter ??= new AsyncTaskStoreClient(this.#home, { readPoolSize: 1 }));
+                await writer.flushTelemetry(batch, this.#turnCap);
+                this.#applied += batch.length;
+            }
+            catch (error) {
+                this.#lastError = error instanceof Error ? error.message : String(error);
+                this.#dropped += batch.length;
+            }
         }
     }
 }

package/dist/telemetry/telemetryWiring.js

@@ -1,16 +1,16 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { resolveRunCap, resolveTerminalKeep } from "./telemetryConfig.js";
 import { resolveTelemetryEnabled } from "../config/yuiConfig.js";
-import { SqliteTelemetryStore } from "./sqliteTelemetryStore.js";
 import { CURRENT_DATABASE_FILENAME as COMMITTED_DATABASE_FILENAME } from "../storage/currentTaskStore.js";
+import { SqliteTelemetryStore } from "./sqliteTelemetryStore.js";
+import { resolveRunCap, resolveTerminalKeep } from "./telemetryConfig.js";
 /**
  * Open optional telemetry from the current Home's authoritative `yui.db`.
  * Disabled telemetry performs no database work. Once opened, telemetry fails
  * isolated: a broken sink increments its dropped counter without blocking the
  * semantic lane.
  */
-export function openSchedulerTelemetry(home, config) {
+export function openSchedulerTelemetry(home, config, writer) {
     if (!resolveTelemetryEnabled(config.telemetryEnabled))
         return null;
     const mode = "on";
@@ -21,6 +21,7 @@ export function openSchedulerTelemetry(home, config) {
     }
     const store = new SqliteTelemetryStore(home, {
         mode,
+        writer,
         terminalKeep: resolveTerminalKeep(config.telemetryTerminalKeep),
         runCap: resolveRunCap(config.telemetryRunCap)
     });

package/dist/tmux/tmuxManager.js

@@ -509,7 +509,9 @@ export class TmuxManager {
         let output;
         try {
             output = this.run([
-                "list-panes", "-s", "-t", this.sessionName(taskId), "-F",
+                // list-panes takes a pane target: the colon keeps this an exact
+                // session lookup instead of falling back to a similarly named one.
+                "list-panes", "-s", "-t", `=${this.sessionName(taskId)}:`, "-F",
                 `#{window_name}${formatSeparator}#{pane_dead}${formatSeparator}#{pane_dead_status}${formatSeparator}#{pane_pid}${formatSeparator}#{pane_current_command}`
             ]);
         }
@@ -865,7 +867,7 @@ export class TmuxManager {
         this.recordTaskTargets(taskId);
         for (const session of [...sessions.filter((name) => name !== taskSession), taskSession]) {
             try {
-                this.run(["kill-session", "-t", session]);
+                this.run(["kill-session", "-t", `=${session}`]);
             }
             catch (error) {
                 if (!isExplicitlyAbsentTmuxSession(error))
@@ -882,7 +884,7 @@ export class TmuxManager {
         await this.recordTaskTargetsAsync(taskId);
         for (const session of [...sessions.filter((name) => name !== taskSession), taskSession]) {
             try {
-                await this.runAsync(["kill-session", "-t", session]);
+                await this.runAsync(["kill-session", "-t", `=${session}`]);
             }
             catch (error) {
                 if (!isExplicitlyAbsentTmuxSession(error))
@@ -897,11 +899,23 @@ export class TmuxManager {
     }
     killRole(taskId, roleName) {
         this.recordRoleTarget(taskId, roleName);
-        this.run(["kill-window", "-t", this.target(taskId, roleName)]);
+        try {
+            this.run(["kill-window", "-t", this.exactTarget(taskId, roleName)]);
+        }
+        catch (error) {
+            if (!isExplicitlyAbsentTmuxSession(error))
+                throw error;
+        }
     }
     async killRoleAsync(taskId, roleName) {
         this.recordRoleTarget(taskId, roleName);
-        await this.runAsync(["kill-window", "-t", this.target(taskId, roleName)]);
+        try {
+            await this.runAsync(["kill-window", "-t", this.exactTarget(taskId, roleName)]);
+        }
+        catch (error) {
+            if (!isExplicitlyAbsentTmuxSession(error))
+                throw error;
+        }
     }
     renameRole(taskId, oldRoleName, newRoleName) {
         const target = this.target(taskId, oldRoleName);
@@ -916,7 +930,7 @@ export class TmuxManager {
     }
     hasSession(taskId) {
         try {
-            this.run(["has-session", "-t", this.sessionName(taskId)]);
+            this.run(["has-session", "-t", `=${this.sessionName(taskId)}`]);
             return true;
         }
         catch (error) {
@@ -927,7 +941,7 @@ export class TmuxManager {
     }
     async hasSessionAsync(taskId) {
         try {
-            await this.runAsync(["has-session", "-t", this.sessionName(taskId)]);
+            await this.runAsync(["has-session", "-t", `=${this.sessionName(taskId)}`]);
             return true;
         }
         catch (error) {
@@ -941,7 +955,7 @@ export class TmuxManager {
             return [];
         try {
             return this.run([
-                "list-windows", "-t", this.sessionName(taskId), "-F", "#{window_name}"
+                "list-windows", "-t", `=${this.sessionName(taskId)}`, "-F", "#{window_name}"
             ]).split("\n").map((name) => name.trim()).filter(Boolean);
         }
         catch (error) {
@@ -953,7 +967,7 @@ export class TmuxManager {
     async sessionWindowNamesAsync(taskId) {
         try {
             const names = (await this.runAsync([
-                "list-windows", "-t", this.sessionName(taskId), "-F", "#{window_name}"
+                "list-windows", "-t", `=${this.sessionName(taskId)}`, "-F", "#{window_name}"
             ])).split("\n").map((name) => name.trim()).filter(Boolean);
             return { exists: true, names };
         }
@@ -1141,16 +1155,12 @@ function writableClientSessionPrefix(roleName) {
 function writableLeaseMatchesRole(sessionName, roleName) {
     if (!sessionName.startsWith(WRITABLE_CLIENT_SESSION_PREFIX))
         return false;
-    if (roleName === undefined)
-        return true;
-    if (sessionName.startsWith(HOST_WRITABLE_CLIENT_SESSION_PREFIX))
+    if (/^yui-writer-host-[a-f0-9]{24}$/u.test(sessionName))
         return true;
-    if (sessionName.startsWith(ROLE_WRITABLE_CLIENT_SESSION_PREFIX)) {
-        return sessionName.startsWith(writableClientSessionPrefix(roleName));
+    if (/^yui-writer-role-[a-f0-9]{24}-[a-f0-9]{24}$/u.test(sessionName)) {
+        return roleName === undefined || sessionName.startsWith(writableClientSessionPrefix(roleName));
     }
-    // Conservative compatibility for writer leases created before Role-scoped
-    // lease names existed.
-    return true;
+    throw runtimeError(`Unverified tmux writer lease: ${sessionName}. Preserve it and inspect its owner before retrying.`);
 }
 function writableClientRowsContainMatch(clients, taskSession, roleName, excludedLease, formatSeparator, encodedSeparator) {
     return clients.split("\n").some((line) => {
@@ -1169,9 +1179,8 @@ function writableClientRowsContainMatch(clients, taskSession, roleName, excluded
             || readOnly !== "0") {
             return false;
         }
-        // Current Yui clients publish a lease before attach. A direct or legacy
-        // writable tmux client has no Role identity, so conservatively fence every
-        // Role in that host.
+        // A direct writable tmux client has no Role identity and fences the host.
+        // A Yui lease must instead prove its exact current scope.
         return !sessionName.startsWith(WRITABLE_CLIENT_SESSION_PREFIX)
             || writableLeaseMatchesRole(sessionName, roleName);
     });

package/dist/verification/gateArtifact.js

@@ -4,10 +4,11 @@ import { requireIdentity, requirePositiveInteger, requireText, requireTimestamp
 /**
  * Issue 08: the reusable exact-SHA gate evidence record.
  *
- * A GateArtifact binds one gate run to its full identity tuple: Project,
+ * A GateArtifact is the latest cached proof for its full identity tuple: Project,
  * candidate commit, VerificationPlan digest, toolchain digest, and (for L2)
- * the source/base/target boundary. The same tuple reuses the same successful
- * artifact; any tuple change invalidates it. Artifacts are stored in the
+ * the source/base/target boundary. Fresh execution withdraws the previous
+ * success; a failed or incomplete latest result is not reusable. Job and
+ * Integration records own execution history. Artifacts are stored in the
  * SQLite `gate_artifacts` / `gate_artifact_logs` tables, backend-neutral
  * through the GateArtifactStorePort.
  */
@@ -40,12 +41,11 @@ export function createGateArtifact(identity, metadata, now) {
         planVersion: requireText(metadata.planVersion, "GateArtifact planVersion"),
         planDigest: identity.planDigest,
         toolchainDigest: identity.toolchainDigest,
-        ...(identity.boundary === undefined ? {} : { boundary: identity.boundary }),
+        boundary: identity.boundary,
         steps: Object.freeze([]),
         generator: requireText(metadata.generator, "GateArtifact generator"),
         status: "incomplete",
         outcome: "unknown",
-        potentialReuseCount: 0,
         reuseCount: 0,
         createdAt: timestamp,
         lastUsedAt: timestamp
@@ -67,16 +67,7 @@ export function completeGateArtifact(artifact, steps, outcome, now) {
         lastUsedAt: timestamp
     });
 }
-/** Record a shadow potential-reuse observation (record mode). */
-export function recordGateArtifactPotentialReuse(artifact, now) {
-    validateGateArtifact(artifact);
-    return validateGateArtifact({
-        ...artifact,
-        potentialReuseCount: artifact.potentialReuseCount + 1,
-        lastUsedAt: now.toISOString()
-    });
-}
-/** Record an actual reuse (reuse/enforce mode). */
+/** Record an actual reuse of complete successful evidence. */
 export function recordGateArtifactReuse(artifact, now) {
     validateGateArtifact(artifact);
     if (artifact.status !== "complete" || artifact.outcome !== "succeeded") {
@@ -93,7 +84,7 @@ export function validateGateArtifact(artifact) {
         throw new Error(`GateArtifact must use schemaVersion ${GATE_ARTIFACT_SCHEMA_VERSION}.`);
     }
     requireIdentity(artifact.projectId, "GateArtifact projectId");
-    if (artifact.level !== "L1" && artifact.level !== "L2") {
+    if (artifact.level !== "L2") {
         throw new Error(`GateArtifact level is invalid: ${String(artifact.level)}.`);
     }
     requireCommit(artifact.commit, "GateArtifact commit");
@@ -106,17 +97,15 @@ export function validateGateArtifact(artifact) {
         commit: artifact.commit,
         planDigest: artifact.planDigest,
         toolchainDigest: artifact.toolchainDigest,
-        ...(artifact.boundary === undefined ? {} : { boundary: artifact.boundary })
+        boundary: artifact.boundary
     })) {
         throw new Error("GateArtifact key does not match its identity tuple.");
     }
-    if (artifact.level === "L2" && artifact.boundary === undefined) {
+    if (artifact.boundary === undefined) {
         throw new Error("An L2 GateArtifact requires a target boundary.");
     }
-    if (artifact.boundary !== undefined) {
-        requireText(artifact.boundary.targetRef, "GateArtifact boundary targetRef");
-        requireCommit(artifact.boundary.baseHead, "GateArtifact boundary baseHead");
-    }
+    requireText(artifact.boundary.targetRef, "GateArtifact boundary targetRef");
+    requireCommit(artifact.boundary.baseHead, "GateArtifact boundary baseHead");
     if (!["incomplete", "complete"].includes(artifact.status)) {
         throw new Error(`GateArtifact status is invalid: ${String(artifact.status)}.`);
     }
@@ -150,7 +139,8 @@ export function validateGateArtifact(artifact) {
             throw new Error(`GateArtifact step ${step.name} logBytes is invalid.`);
         }
     }
-    requirePositiveInteger(artifact.potentialReuseCount + 1, "GateArtifact potentialReuseCount");
+    if (Object.hasOwn(artifact, "potentialReuseCount"))
+        throw new Error("GateArtifact contains retired shadow metrics.");
     requirePositiveInteger(artifact.reuseCount + 1, "GateArtifact reuseCount");
     requireTimestamp(artifact.createdAt, "GateArtifact createdAt");
     requireTimestamp(artifact.lastUsedAt, "GateArtifact lastUsedAt");
@@ -185,7 +175,8 @@ export function verifyGateArtifactLogs(artifact, logs) {
     });
 }
 export function isReusableGateArtifact(artifact) {
-    return artifact.status === "complete" && artifact.outcome === "succeeded";
+    return artifact.status === "complete" && artifact.outcome === "succeeded"
+        && artifact.steps.length > 0 && artifact.steps.every(step => step.outcome === "passed" && step.exitCode === 0 && step.signal === null && !step.timedOut);
 }
 function requireCommit(value, label) {
     const normalized = requireText(value, label).toLowerCase();

package/dist/verification/gateArtifactStore.js

@@ -30,19 +30,26 @@ export function findGateArtifact(store, identity) {
  * commit, plan digest, toolchain digest, and target ref.  Unlike
  * {@link findGateArtifact} the base head is not part of the match: a release
  * consumes the gate that proved the exact frozen tree, regardless of which
- * base it integrated onto.  Logs are verified before returning.
+ * base it integrated onto. The newest recorded matching result governs:
+ * failure/incompleteness/corruption must not fall through to an older success.
+ * Logs are verified before returning.
  */
 export async function findL2ArtifactForCommit(store, query) {
-    const artifacts = store.findL2GateArtifactsForCommit(query);
-    for (const artifact of artifacts) {
+    const recordedAt = (artifact) => Date.parse(artifact.completedAt ?? artifact.createdAt);
+    const artifacts = [...store.findL2GateArtifactsForCommit(query)]
+        .sort((left, right) => recordedAt(right) - recordedAt(left));
+    const latest = artifacts[0];
+    if (latest === undefined)
+        return null;
+    for (const artifact of artifacts.filter(value => recordedAt(value) === recordedAt(latest))) {
         if (!isReusableGateArtifact(artifact))
-            continue;
+            return null;
         const logs = store.getGateArtifactLogs(artifact.key);
         const verification = verifyGateArtifactLogs(artifact, logs);
-        if (verification.ok)
-            return artifact;
+        if (!verification.ok)
+            return null;
     }
-    return null;
+    return latest;
 }
 /**
  * Read each step's source log, hash it, and return the completed step

package/dist/verification/verificationGateService.js

@@ -2,9 +2,10 @@ import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { mkdir, open, rm } from "node:fs/promises";
 import { join, resolve } from "node:path";
-import { completeGateArtifact, createGateArtifact, gateArtifactRef, isReusableGateArtifact, parseGateArtifactRef, recordGateArtifactReuse, validateGateArtifact, verifyGateArtifactLogs } from "./gateArtifact.js";
-import { findGateArtifact, importGateArtifactSteps, loadGateArtifact, saveGateArtifact, touchGateArtifact } from "./gateArtifactStore.js";
-import { planL1JobSteps, resolveProjectVerificationPlan, resolveToolchain, selectL1Checks, toolchainDigest, verificationPlanDigest, verificationStepCommand } from "./verificationPlan.js";
+import { jobStepDirectory } from "../job/stepDirectory.js";
+import { completeGateArtifact, createGateArtifact, gateArtifactRef, isReusableGateArtifact, parseGateArtifactRef, verifyGateArtifactLogs } from "./gateArtifact.js";
+import { findGateArtifact, importGateArtifactSteps, loadGateArtifact, saveGateArtifact } from "./gateArtifactStore.js";
+import { resolveProjectVerificationPlan, resolveToolchain, toolchainDigest, verificationPlanDigest } from "./verificationPlan.js";
 /** Resolve a Project's active plan and the runtime toolchain it gates under. */
 export function resolveVerificationGate(project, _environment = process.env) {
     const plan = resolveProjectVerificationPlan(project);
@@ -13,26 +14,22 @@ export function resolveVerificationGate(project, _environment = process.env) {
     const toolchain = resolveToolchain();
     return Object.freeze({
         plan,
-        mode: plan.mode,
         toolchain,
         planDigest: verificationPlanDigest(plan),
         toolchainDigest: toolchainDigest(plan, toolchain)
     });
 }
 export function gateIdentityForCandidate(input) {
-    const boundary = input.level === "L2"
-        ? {
-            targetRef: input.targetRef ?? "master",
-            baseHead: input.baseHead ?? input.commit
-        }
-        : undefined;
+    if (input.level !== "L2" || input.targetRef === undefined || input.baseHead === undefined) {
+        throw new Error("L2 verification requires its exact target ref and base head.");
+    }
     return Object.freeze({
         projectId: input.projectId,
         level: input.level,
         commit: input.commit,
         planDigest: input.gate.planDigest,
         toolchainDigest: input.gate.toolchainDigest,
-        ...(boundary === undefined ? {} : { boundary })
+        boundary: { targetRef: input.targetRef, baseHead: input.baseHead }
     });
 }
 /**
@@ -48,6 +45,17 @@ export async function lookupReusableGateArtifact(store, identity) {
     const verification = verifyGateArtifactLogs(artifact, logs);
     return verification.ok ? artifact : null;
 }
+/** Withdraw prior reusable evidence before execution. An interrupted attempt
+ * remains incomplete, never an excuse to return the previous success. */
+export function beginGateVerification(store, identity, plan, now) {
+    const existing = findGateArtifact(store, identity);
+    const artifact = {
+        ...createGateArtifact(identity, { planId: plan.id, planVersion: plan.version, generator: "yui" }, now),
+        reuseCount: existing?.reuseCount ?? 0
+    };
+    saveGateArtifact(store, artifact, new Map());
+    return artifact;
+}
 /**
  * Record a GateArtifact from a terminal check DurableJob. The job's step
  * logs are copied into the artifact store and bound to their digests, so the
@@ -91,38 +99,17 @@ export async function recordGateArtifactFromStepOutcomes(store, identity, plan,
     return recordGateArtifact(store, identity, plan, steps, succeeded, now);
 }
 async function recordGateArtifact(store, identity, plan, steps, succeeded, now) {
-    const created = createGateArtifact(identity, {
-        planId: plan.id,
-        planVersion: plan.version,
-        generator: "yui"
-    }, now);
+    const created = beginGateVerification(store, identity, plan, now);
     const { steps: importedSteps, logs } = await importGateArtifactSteps(steps);
-    let artifact = completeGateArtifact(created, importedSteps, succeeded ? "succeeded" : "failed", now);
-    // Preserve shadow/reuse counters when re-recording the same identity tuple
-    // (e.g. record mode always re-runs the gate but must not lose the potential
-    // reuse observations from earlier runs).
-    const existing = findGateArtifact(store, identity);
-    if (existing !== null) {
-        if (isReusableGateArtifact(existing) && !succeeded) {
-            // A failed re-run must not downgrade a proven successful artifact.
-            touchGateArtifact(store, existing);
-            return existing;
-        }
-        artifact = validateGateArtifact({
-            ...artifact,
-            potentialReuseCount: existing.potentialReuseCount,
-            reuseCount: existing.reuseCount,
-            createdAt: existing.createdAt
-        });
-    }
+    const artifact = completeGateArtifact(created, importedSteps, succeeded && importedSteps.length > 0 && importedSteps.every(step => step.outcome === "passed")
+        ? "succeeded" : "failed", now);
     saveGateArtifact(store, artifact, logs);
     return artifact;
 }
 const GATE_STEP_TIMEOUT_MS = 30 * 60_000;
 const SIGKILL_GRACE_MS = 2_000;
 /**
- * Run structured gate steps in-process (L1 targeted checks and the jobless
- * L2 fallback). Each step gets its own log file; argv steps run without a
+ * Run structured gate steps in-process. Each step gets its own log file; argv steps run without a
  * shell. This is the local form of the gate; the DurableJob form is the
  * Controller-owned one used by production Integration.
  */
@@ -144,9 +131,9 @@ export async function runGateStepsInProcess(workspace, steps, environment, logsD
         const output = await open(absoluteLogPath, "w", 0o600);
         let timedOut = false;
         let child;
-        const stepCwd = step.cwd ?? cwd;
         const stepEnv = step.env === undefined ? env : { ...env, ...step.env };
         try {
+            const stepCwd = jobStepDirectory(cwd, step.cwd);
             if (step.argv !== undefined) {
                 const [file, ...args] = step.argv;
                 child = spawn(file, args, {
@@ -228,7 +215,7 @@ function sanitizeLogName(name) {
  * environment/registry failure is never recorded as a Candidate test
  * failure; the Integration gate has not started when bootstrap fails.
  */
-export function checkResultsFromGateJob(job, home) {
+export function checkResultsFromGateJob(job, _home) {
     const results = new Map((job.result?.steps ?? []).map((step) => [step.name, step]));
     const checks = [];
     for (const step of job.steps) {
@@ -285,6 +272,10 @@ export function checkResultsFromGateArtifact(artifact, reused = false) {
         outcome: step.outcome,
         ...(step.logPath === undefined ? {} : { logPath: step.logPath })
     }));
+    if (!isReusableGateArtifact(artifact) && !checks.some(check => check.outcome === "failed")) {
+        checks.push({ name: "verification-result", outcome: "failed",
+            details: `Verification is ${artifact.status}/${artifact.outcome}; successful evidence is not established.` });
+    }
     if (reused) {
         checks.push({
             name: gateArtifactRef(artifact.key),
@@ -331,56 +322,6 @@ export async function verifyGateArtifactForReview(store, projectId, key, expecte
     }
     return { ok: true, artifact };
 }
-/**
- * Enforce mode (rollout step 4): reject ad-hoc full-suite shell checks that
- * duplicate the plan's L2 steps for a configured Project. Explicit targeted
- * diagnostic checks (anything that is not an L2 step command) stay allowed.
- */
-export function assertNoAdHocFullSuiteChecks(plan, checkCommands) {
-    const l2Commands = new Set(plan.l2.steps.map((step) => verificationStepCommand(step)));
-    for (const command of checkCommands) {
-        if (l2Commands.has(command)) {
-            throw new Error(`Ad-hoc full-suite check is rejected for plan-enabled Project `
-                + `${plan.id}: use the VerificationPlan L2 gate (or pass a targeted `
-                + `diagnostic command that is not an L2 step): ${command}`);
-        }
-    }
-}
-/**
- * Run an L1 gate for a change: select the affected categories' checks, run
- * them in-process, and record the L1 artifact. Reuse mode returns an existing
- * successful artifact for the same tuple.
- */
-export async function runL1Gate(input) {
-    const identity = gateIdentityForCandidate({
-        projectId: input.projectId,
-        gate: input.gate,
-        level: "L1",
-        commit: input.commit
-    });
-    if (input.gate.mode !== "record") {
-        const existing = await lookupReusableGateArtifact(input.store, identity);
-        if (existing !== null) {
-            const reused = recordGateArtifactReuse(existing, input.now);
-            touchGateArtifact(input.store, reused);
-            return {
-                artifact: reused,
-                reused: true,
-                checks: checkResultsFromGateArtifact(reused, true)
-            };
-        }
-    }
-    const selected = selectL1Checks(input.gate.plan, input.changedPaths);
-    const outcomes = await runGateStepsInProcess(input.workspace, planL1JobSteps(selected), input.environment, input.logsDirectory, input.commit);
-    const succeeded = outcomes.length > 0
-        && outcomes.every((outcome) => outcome.exitCode === 0 && outcome.signal === null && !outcome.timedOut);
-    const artifact = await recordGateArtifactFromStepOutcomes(input.store, identity, input.gate.plan, outcomes, succeeded, input.now);
-    return {
-        artifact,
-        reused: false,
-        checks: checkResultsFromGateArtifact(artifact, false)
-    };
-}
 /** Stable digest of a log file, for ad-hoc evidence binding. */
 export function digestLogContent(content) {
     return createHash("sha256").update(content).digest("hex");