audit-tools 0.42.1 → 0.44.0

package/dist/remediate/intent/intentOrdering.js.map

@@ -1 +1 @@
-{"version":3,"file":"intentOrdering.js","sourceRoot":"","sources":["../../../src/remediate/intent/intentOrdering.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,iFAAiF;AACjF,MAAM,eAAe,GAA2B;IAC9C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,gFAAgF;AAChF,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,6EAA6E;AAC7E,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC,gFAAgF;AAChF,kFAAkF;AAClF,sEAAsE;AACtE,MAAM,eAAe,GACnB,0PAA0P,CAAC;AAE7P;;;;;GAKG;AACH,SAAS,YAAY,CAAC,MAAyB;IAC7C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACjD,kEAAkE;YAClE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,OAAgB,EAAE,OAAiB;IACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACjE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAgB,EAChB,MAAyB,EACzB,UAAoB,YAAY,CAAC,MAAM,CAAC;IAExC,IAAI,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,IAAuC,CAAC,KAAK,SAAS,EAAE,CAAC;QACjG,MAAM,IAAI,mBAAmB,CAAC;IAChC,CAAC;IACD,IAAI,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,oBAAoB,CAAC;IACjC,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,qBAAqB,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0EAA0E;AAC1E,SAAS,aAAa,CAAC,MAAyB;IAC9C,OAAO,CACL,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;QAC5C,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QACnC,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAClC,CAAC;AACJ,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAmB,EACnB,MAA0B,EAC1B,MAAyB;IAEzB,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,kFAAkF;IAClF,MAAM,eAAe,GAAG,QAAQ;SAC7B,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;SAC7C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACtC,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEjC,MAAM,WAAW,GAAG,CAAC,KAAuB,EAAU,EAAE;QACtD,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,GAAG,GAAG;gBAAE,GAAG,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrC,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,MAAM;SACzB,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;SACzC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SAChF,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAE/B,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"intentOrdering.js","sourceRoot":"","sources":["../../../src/remediate/intent/intentOrdering.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,gFAAgF;AAChF,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,6EAA6E;AAC7E,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC,gFAAgF;AAChF,kFAAkF;AAClF,sEAAsE;AACtE,MAAM,eAAe,GACnB,0PAA0P,CAAC;AAE7P;;;;;;;;;;;GAWG;AACH,SAAS,mBAAmB,CAAC,OAAiB;IAC5C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACjD,kEAAkE;YAClE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;sCACsC;AACtC,SAAS,mBAAmB,CAAC,MAAyB;IACpD,OAAO,mBAAmB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AACnD,CAAC;AAED;;;;;0EAK0E;AAC1E,SAAS,mBAAmB,CAAC,MAAyB;IACpD,OAAO,mBAAmB,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,OAAgB,EAAE,OAAiB;IACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACjE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAgB,EAChB,MAAyB,EACzB,iBAA2B,mBAAmB,CAAC,MAAM,CAAC,EACtD,iBAA2B,mBAAmB,CAAC,MAAM,CAAC;IAEtD,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,IAAI,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,IAAuC,CAAC,KAAK,SAAS,EAAE,CAAC;QACjG,MAAM,IAAI,mBAAmB,CAAC;IAChC,CAAC;IACD,IAAI,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,oBAAoB,CAAC;IACjC,CAAC;SAAM,IAAI,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,oBAAoB,CAAC;IACjC,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,qBAAqB,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;8EAC8E;AAC9E,SAAS,aAAa,CAAC,MAAyB;IAC9C,OAAO,CACL,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;QAC5C,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QACnC,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QACjC,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAC5C,CAAC;AACJ,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAmB,EACnB,MAA0B,EAC1B,MAAyB;IAEzB,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,eAAe,CAAC,GAAG,CACjB,OAAO,CAAC,EAAE,EACV,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,CAAC,CACrE,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,MAAM,eAAe,GAAG,QAAQ;SAC7B,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;SAC7C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACtC,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEjC,MAAM,WAAW,GAAG,CAAC,KAAuB,EAAU,EAAE;QACtD,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,GAAG,GAAG;gBAAE,GAAG,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrC,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,MAAM;SACzB,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;SACzC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SAChF,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAE/B,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AAC9D,CAAC"}

package/dist/remediate/phases/close.d.ts

@@ -3,7 +3,19 @@ import { OrchestratorOptions } from "../types/options.js";
 import type { RemediationOutcomesReport, RunLogger, VerificationReport } from "audit-tools/shared";
 import type { ClosingAction } from "../state/closingActions.js";
 import type { OutcomeCoverageLedger } from "../state/types.js";
-export declare function buildRemediationOutcomesReport(state: RemediationState, closingResult: ClosingResult): RemediationOutcomesReport;
+import { type FinalGateReport } from "../../shared/types/remediationOutcome.js";
+/**
+ * Read the run's tool-owned gate outcome for the report.
+ *
+ * The gate WRITES `final-gate-outcome.json` on every evaluation; until this
+ * reader existed, nothing consumed it — so a scoped-out or suppressed run
+ * produced a completion report byte-identical to one written after a green
+ * floor, which is the whole defect the record was added to close. A record that
+ * is missing, unreadable, or fails its schema degrades to
+ * {@link ABSENT_FINAL_GATE_REPORT}: stated as absent, never as green.
+ */
+export declare function readFinalGateReport(artifactsDir: string): Promise<FinalGateReport>;
+export declare function buildRemediationOutcomesReport(state: RemediationState, closingResult: ClosingResult, finalGate?: FinalGateReport): RemediationOutcomesReport;
 /**
  * Build the outcomes file's coverage-ledger section: the plan's coverage ledger
  * with every never-planned entry (cross-lens-deduped, checkpoint-dropped,
@@ -97,17 +109,60 @@ export interface StagingSelection {
 export declare function collectStagingFiles(root: string, manifest: string[], deliverables?: string[]): StagingSelection;
 export declare function executeClosingAction(state: RemediationState, options: OrchestratorOptions): ClosingResult;
 export interface CombinedTestResult {
+    /**
+     * Whether a suite actually ran. `false` means `plan.test_command` was never
+     * configured — a NEVER-RAN outcome, structurally distinct from `passed`, so
+     * a caller can no longer mistake "nothing ran" for "a real pass" (the
+     * vacuous-pass defect: previously `passed:true` alone claimed a real result
+     * even for an unrun, unconfigured suite).
+     */
+    ran: boolean;
     passed: boolean;
     duration_ms: number;
     suite_name?: string;
     /** Tail of combined stdout/stderr captured on failure (empty on pass). */
     output: string;
 }
+/**
+ * Run the plan's combined test suite over the fully merged post-remediation
+ * state. Returns pass/fail plus the failure-output tail. No test_command =>
+ * `ran:false` (never-ran, distinct from a real pass) — `passed` still reports
+ * `true` so existing gates that fold `combinedTest.passed` into `fullyGreen`
+ * keep their vacuously-green behavior for a run with no configured suite;
+ * `ran` is what lets a caller (buildVerificationReport's trace) tell the two
+ * apart rather than rendering "combined test suite passed" for a suite that
+ * never executed.
+ */
+export declare function runCombinedTestSuite(state: RemediationState, options: OrchestratorOptions): CombinedTestResult;
+/**
+ * On a combined-test failure, selectively re-block items whose touched_files
+ * overlap with the failing tests' implicated paths. When attribution is
+ * ambiguous (no overlap found), falls back to re-blocking all resolved items.
+ * Returns whether any item was blocked — the caller transitions back to triage.
+ */
+export declare function blockResolvedItemsOnCombinedFailure(state: RemediationState, testOutput: string): boolean;
 export interface E2eTestResult {
     ran: boolean;
     passed: boolean;
     output: string;
 }
+/**
+ * {@link cleanupTempBranchesAndArtifacts}'s result — lets a caller observe a
+ * cleanup residue programmatically rather than only through console/log
+ * output. Absent (`{}`) on a clean removal, a not-fully-green close (nothing
+ * was attempted), or a final-state-persist failure alone.
+ */
+export interface CleanupResult {
+    /**
+     * Set to the artifacts directory path when its recursive removal failed
+     * after an otherwise fully-green close — the caller must remove it
+     * manually. The same fact is also written to the durable structured run log
+     * (`runLogger`) and to the console; this field is what surfaces it in the
+     * function's OWN returned result too, so a caller does not have to parse
+     * log/console output to detect the residue.
+     */
+    artifacts_residue?: string;
+}
 /**
  * Persist the completed state and clean up the artifact directory.
  *
@@ -118,7 +173,7 @@ export interface E2eTestResult {
  * closing action failed OR was skipped without completing — the artifacts
  * directory is preserved for diagnosis.
  */
-export declare function cleanupTempBranchesAndArtifacts(options: OrchestratorOptions, completeState: RemediationState, combinedTest: CombinedTestResult, e2eResult: E2eTestResult, closingResult: ClosingResult, runLogger?: RunLogger): Promise<void>;
+export declare function cleanupTempBranchesAndArtifacts(options: OrchestratorOptions, completeState: RemediationState, combinedTest: CombinedTestResult, e2eResult: E2eTestResult, closingResult: ClosingResult, runLogger?: RunLogger): Promise<CleanupResult>;
 /**
  * Build a VerificationReport from the post-remediation state. One
  * FindingVerificationTrace per terminal finding, with trace entries for:

package/dist/remediate/phases/close.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"close.d.ts","sourceRoot":"","sources":["../../../src/remediate/phases/close.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAiB1D,OAAO,KAAK,EAIV,yBAAyB,EACzB,SAAS,EACT,kBAAkB,EAGnB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAOV,qBAAqB,EAItB,MAAM,mBAAmB,CAAC;AAkF3B,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,gBAAgB,EACvB,aAAa,EAAE,aAAa,GAC3B,yBAAyB,CA8J3B;AAsDD;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CA6B5C;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,gBAAgB,EAAE,wCAAwC,CAAC;IAC3D,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,kGAAkG;IAClG,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,aAAa,GAAG,OAAO,CAK5E;AAwHD,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAAE,EAClB,YAAY,GAAE,MAAM,EAAO,GAC1B,gBAAgB,CAyClB;AAmED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,mBAAmB,GAC3B,aAAa,CAwEf;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AA8GD,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAyRD;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,mBAAmB,EAC5B,aAAa,EAAE,gBAAgB,EAC/B,YAAY,EAAE,kBAAkB,EAChC,SAAS,EAAE,aAAa,EACxB,aAAa,EAAE,aAAa,EAC5B,SAAS,CAAC,EAAE,SAAS,GACpB,OAAO,CAAC,IAAI,CAAC,CAwFf;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,mBAAmB,EAC5B,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,kBAAkB,GAC/B,kBAAkB,CA8JpB;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,mBAAmB,EAC5B,SAAS,CAAC,EAAE,SAAS,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAgN3B"}
+{"version":3,"file":"close.d.ts","sourceRoot":"","sources":["../../../src/remediate/phases/close.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAiB1D,OAAO,KAAK,EAIV,yBAAyB,EACzB,SAAS,EACT,kBAAkB,EAGnB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAOV,qBAAqB,EAItB,MAAM,mBAAmB,CAAC;AAgB3B,OAAO,EAOL,KAAK,eAAe,EACrB,MAAM,0CAA0C,CAAC;AAwFlD;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,eAAe,CAAC,CA2B1B;AAED,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,gBAAgB,EACvB,aAAa,EAAE,aAAa,EAI5B,SAAS,GAAE,eAA0C,GACpD,yBAAyB,CAiN3B;AAsDD;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CA6B5C;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,gBAAgB,EAAE,wCAAwC,CAAC;IAC3D,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,kGAAkG;IAClG,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,aAAa,GAAG,OAAO,CAK5E;AAwHD,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAAE,EAClB,YAAY,GAAE,MAAM,EAAO,GAC1B,gBAAgB,CAyClB;AAmED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,mBAAmB,GAC3B,aAAa,CAwEf;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,mBAAmB,GAC3B,kBAAkB,CA2BpB;AA0CD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,gBAAgB,EACvB,UAAU,EAAE,MAAM,GACjB,OAAO,CAkCT;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAySD;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,mBAAmB,EAC5B,aAAa,EAAE,gBAAgB,EAC/B,YAAY,EAAE,kBAAkB,EAChC,SAAS,EAAE,aAAa,EACxB,aAAa,EAAE,aAAa,EAC5B,SAAS,CAAC,EAAE,SAAS,GACpB,OAAO,CAAC,aAAa,CAAC,CA8FxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,mBAAmB,EAC5B,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,kBAAkB,GAC/B,kBAAkB,CAuKpB;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,mBAAmB,EAC5B,SAAS,CAAC,EAAE,SAAS,GACpB,OAAO,CAAC,gBAAgB,CAAC,CA6Q3B"}

package/dist/remediate/phases/close.js

@@ -8,19 +8,40 @@ import { FAILURE_OUTPUT_TAIL_CHARS } from "./constants.js";
 import { verifyAnalyzerLeads } from "./closeVerifyAnalyzerLeads.js";
 import { intakePaths } from "../intake.js";
 import { isAuditFindingsReport } from "./plan.js";
-import { dispositionToOutcomeStatus, isInProgressStatus, isSkipStatus, isUnsuccessfulEndStatus, isVerifiedCompleteStatus, statusToDisposition, } from "../state/itemStatus.js";
+import { dispositionToOutcomeStatus, isSkipStatus, isTerminalStatus, isUnsuccessfulEndStatus, isVerifiedCompleteStatus, requiresVerificationEvidence, resolveDisposition, } from "../state/itemStatus.js";
+// Brand-new exports of `src/shared/types/remediationOutcome.ts` (CDC-25/
+// CDC-28), not yet re-exported through the `audit-tools/shared` barrel
+// (outside this module's file_scope and this work item's allowed_files) — see
+// the identical note in `src/remediate/state/types.ts`.
+import { ABSENT_FINAL_GATE_REPORT, FinalGateReportSchema, isCompleteEvidence, mechanismContradictsOutcome, missingEvidenceParts, } from "../../shared/types/remediationOutcome.js";
+// The gate record's PATH is single-sourced by the module that writes it. Leaf
+// import (finalGate.ts imports only gateCommands.ts + shared), so this adds no
+// cycle — and the alternative, a second `"final-gate-outcome.json"` literal
+// here, is exactly the drift the layout registry exists to prevent.
+import { finalGateOutcomePath } from "../steps/finalGate.js";
 // Derived from the single source so the key list can never drift from the
 // RemediationOutcomeStatus contract (A6).
 const OUTCOME_KEYS = [
     ...RemediationOutcomeStatusSchema.options,
 ];
-/** Retry-oriented final status per outcome (see RemediationOutcomeFinalStatus). */
+/**
+ * Retry-oriented final status per outcome (see RemediationOutcomeFinalStatus).
+ * `verified_already_fixed` (CDC-25) joins `resolved`/`verified_no_change`
+ * under `fixed` — the code was already correct at HEAD, requiring no diff, the
+ * same shape as a no-change fix. `refuted` joins `inappropriate` under
+ * `skipped` — investigation determined the finding is not a real problem, so
+ * like a deemed-inappropriate finding it needs no retry; the substantive "why"
+ * for both new members lives in the outcome's `evidence` triple, not in this
+ * coarse four-value retry bucket.
+ */
 const FINAL_STATUS_BY_OUTCOME = {
     resolved: "fixed",
     verified_no_change: "fixed",
     inappropriate: "skipped",
     ignored: "ignored",
     blocked: "failed",
+    verified_already_fixed: "fixed",
+    refuted: "skipped",
 };
 // Skipped and ignored outcomes must always carry a non-empty reason in the
 // outcomes contract; these defaults cover items whose state lost the rationale.
@@ -65,24 +86,106 @@ function durationBetweenMs(startedAt, completedAt) {
     }
     return completed - started;
 }
-export function buildRemediationOutcomesReport(state, closingResult) {
+/**
+ * Read the run's tool-owned gate outcome for the report.
+ *
+ * The gate WRITES `final-gate-outcome.json` on every evaluation; until this
+ * reader existed, nothing consumed it — so a scoped-out or suppressed run
+ * produced a completion report byte-identical to one written after a green
+ * floor, which is the whole defect the record was added to close. A record that
+ * is missing, unreadable, or fails its schema degrades to
+ * {@link ABSENT_FINAL_GATE_REPORT}: stated as absent, never as green.
+ */
+export async function readFinalGateReport(artifactsDir) {
+    const raw = await readOptionalJsonFile(finalGateOutcomePath(artifactsDir)).catch(() => undefined);
+    if (raw === undefined || raw === null || typeof raw !== "object") {
+        return ABSENT_FINAL_GATE_REPORT;
+    }
+    // The on-disk record carries its own `schema_version`; the REPORT field does
+    // not (the outcomes contract has one of its own). Drop that key and keep the
+    // schema `.strict()` for everything else, so an unknown field is still a
+    // refusal rather than something that rides silently into the contract.
+    const { schema_version: _recordVersion, ...body } = raw;
+    const parsed = FinalGateReportSchema.safeParse(body);
+    if (!parsed.success) {
+        return {
+            ...ABSENT_FINAL_GATE_REPORT,
+            reason: "a gate outcome record exists but does not match the outcome contract; " +
+                "treated as no verdict",
+        };
+    }
+    // Defense in depth against a hand-edited or older record: only an EXECUTED
+    // gate may carry a verdict. A not-run kind asserting `passed: true` is
+    // normalized away here rather than reprinted into the report.
+    return parsed.data.outcome === "executed"
+        ? parsed.data
+        : { ...parsed.data, passed: null, commands_run: 0 };
+}
+export function buildRemediationOutcomesReport(state, closingResult, 
+// Defaults to ABSENT so every existing caller keeps compiling AND keeps
+// telling the truth: a caller that supplies no gate outcome is a run with no
+// gate outcome, which the contract now states outright.
+finalGate = ABSENT_FINAL_GATE_REPORT) {
     const findingsById = new Map((state.plan?.findings ?? []).map((finding) => [finding.id, finding]));
     const blocksById = new Map((state.plan?.blocks ?? []).map((block) => [block.block_id, block]));
     const outcomes = [];
     const closeReason = closingStatusReason(closingResult);
     for (const item of Object.values(state.items ?? {})) {
-        // Derive the outcome from the single status→disposition→outcome authority.
-        // An in-progress status means the run was force-closed while the item was
-        // still mid-flight: record it as a failed (`blocked`) outcome — never drop
-        // it — and preserve the original state so a retry sees where it stood.
+        // Derive the outcome from the single status→disposition→outcome
+        // authority. A non-terminal status — in-progress, `blocked`, or an
+        // unanswered `needs_clarification` — means the run was force-closed while
+        // the item was still non-terminal: record it as a failed (`blocked`)
+        // outcome — never drop it — and preserve the original state so a retry
+        // sees where it stood (every non-terminal status, not only the five
+        // in-progress ones — needs_clarification included).
         let outcome;
         let originalState;
-        if (isInProgressStatus(item.status)) {
+        let evidence;
+        let recordedByModule;
+        let evidenceRefusalReason;
+        if (!isTerminalStatus(item.status)) {
             outcome = "blocked";
             originalState = item.status;
         }
         else {
-            outcome = dispositionToOutcomeStatus(statusToDisposition(item.status));
+            const disposition = resolveDisposition(item.status, item.disposition_override);
+            if (requiresVerificationEvidence(disposition)) {
+                // INV-ISC-EVIDENCE-EMITTED — the writer-side backstop. REFUSE a
+                // `verified_already_fixed`/`refuted` terminal disposition whose
+                // evidence triple is incomplete, or whose complete triple's mechanism
+                // CONTRADICTS the disposition it is meant to establish (RED
+                // condition (4)'s mechanism-contradiction leg, the W4 witness) —
+                // record a non-terminal `blocked` outcome naming the missing or
+                // contradicting part instead of a green close on the audit's
+                // assertion alone.
+                const missing = missingEvidenceParts(item.evidence);
+                if (missing.length > 0 || !isCompleteEvidence(item.evidence)) {
+                    outcome = "blocked";
+                    evidenceRefusalReason = `incomplete verification evidence for disposition '${disposition}' (missing: ${missing.join(", ")})`;
+                }
+                else {
+                    const candidateOutcome = dispositionToOutcomeStatus(disposition);
+                    if (mechanismContradictsOutcome(candidateOutcome, item.evidence.mechanism)) {
+                        outcome = "blocked";
+                        evidenceRefusalReason = `evidence mechanism '${item.evidence.mechanism}' contradicts disposition '${disposition}'`;
+                    }
+                    else {
+                        outcome = candidateOutcome;
+                        evidence = item.evidence;
+                        recordedByModule = item.recorded_by_module;
+                    }
+                }
+            }
+            else {
+                outcome = dispositionToOutcomeStatus(disposition);
+                // Evidence is optional decoration for the original five dispositions,
+                // but when a module DID record it, round-trip it byte-exact (the
+                // ATTRIBUTION ROUND-TRIP) rather than silently dropping it.
+                if (isCompleteEvidence(item.evidence)) {
+                    evidence = item.evidence;
+                    recordedByModule = item.recorded_by_module;
+                }
+            }
         }
         const finding = findingsById.get(item.finding_id);
         const fileExts = [
@@ -91,12 +194,18 @@ export function buildRemediationOutcomesReport(state, closingResult) {
                 .filter((ext) => ext.length > 0)),
         ].sort();
         const durationMs = durationBetweenMs(item.started_at, item.completed_at);
-        const isNonResolved = outcome !== "resolved" && outcome !== "verified_no_change";
-        let reason = isNonResolved ? item.failure_reason : undefined;
-        if (originalState) {
+        const isSuccessfulOutcome = outcome === "resolved" ||
+            outcome === "verified_no_change" ||
+            outcome === "verified_already_fixed" ||
+            outcome === "refuted";
+        let reason = !isSuccessfulOutcome ? item.failure_reason : undefined;
+        if (evidenceRefusalReason) {
+            reason = `INV-ISC-EVIDENCE-EMITTED refusal: ${evidenceRefusalReason}.${item.failure_reason ? ` ${item.failure_reason}` : ""}`;
+        }
+        else if (originalState) {
             reason = `Force-closed while non-terminal (original state '${originalState}').${item.failure_reason ? ` ${item.failure_reason}` : ""}`;
         }
-        else if (isNonResolved && !reason) {
+        else if (!isSuccessfulOutcome && !reason) {
             reason = DEFAULT_REASON_BY_OUTCOME[outcome];
         }
         const base = {
@@ -114,6 +223,8 @@ export function buildRemediationOutcomesReport(state, closingResult) {
             ...(item.mechanical_verification
                 ? { mechanical_verification: item.mechanical_verification }
                 : {}),
+            ...(evidence ? { evidence } : {}),
+            ...(recordedByModule ? { recorded_by_module: recordedByModule } : {}),
         };
         if (!finding) {
             // Degenerate (corrupt state): without the plan finding there is no payload
@@ -185,6 +296,7 @@ export function buildRemediationOutcomesReport(state, closingResult) {
         ...(aggregateStarted ? { started_at: aggregateStarted.value } : {}),
         ...(aggregateCompleted ? { completed_at: aggregateCompleted.value } : {}),
         ...(aggregateDuration !== undefined ? { duration_ms: aggregateDuration } : {}),
+        final_gate: finalGate,
         outcomes,
     };
 }
@@ -598,12 +710,17 @@ export function executeClosingAction(state, options) {
 /**
  * Run the plan's combined test suite over the fully merged post-remediation
  * state. Returns pass/fail plus the failure-output tail. No test_command =>
- * vacuously passing.
+ * `ran:false` (never-ran, distinct from a real pass) — `passed` still reports
+ * `true` so existing gates that fold `combinedTest.passed` into `fullyGreen`
+ * keep their vacuously-green behavior for a run with no configured suite;
+ * `ran` is what lets a caller (buildVerificationReport's trace) tell the two
+ * apart rather than rendering "combined test suite passed" for a suite that
+ * never executed.
  */
-function runCombinedTestSuite(state, options) {
+export function runCombinedTestSuite(state, options) {
     console.log("Running full test suite on combined post-remediation state...");
     if (!state.plan?.test_command) {
-        return { passed: true, duration_ms: 0, output: "" };
+        return { ran: false, passed: true, duration_ms: 0, output: "" };
     }
     const suiteName = Array.isArray(state.plan.test_command)
         ? state.plan.test_command.join(" ")
@@ -619,12 +736,12 @@ function runCombinedTestSuite(state, options) {
     });
     const durationMs = Date.now() - startedAt;
     if (result.status === 0) {
-        return { passed: true, suite_name: suiteName, duration_ms: durationMs, output: "" };
+        return { ran: true, passed: true, suite_name: suiteName, duration_ms: durationMs, output: "" };
     }
     const output = ((result.stdout?.toString() ?? "") + (result.stderr?.toString() ?? ""))
         .trim()
         .slice(-FAILURE_OUTPUT_TAIL_CHARS);
-    return { passed: false, suite_name: suiteName, duration_ms: durationMs, output };
+    return { ran: true, passed: false, suite_name: suiteName, duration_ms: durationMs, output };
 }
 /**
  * Parse test output to extract implicated file paths. Looks for common test
@@ -649,13 +766,29 @@ function extractImplicatedPaths(testOutput) {
     }
     return [...paths];
 }
+/**
+ * Whether a touched file `tf` and an implicated path `ip` (extracted from test
+ * output, which may be a bare/partial path) refer to the same file: exact
+ * match after normalization, or one is a path-SEPARATOR-anchored suffix of the
+ * other. Never a bare string-suffix test — `"src/myfoo.ts".endsWith("foo.ts")`
+ * is true but the two are unrelated files; anchoring the match to a `/`
+ * boundary (via `normalizeRepoPath`, which also folds case/slash direction) is
+ * what a real path-key join requires and a substring test does not give.
+ */
+function touchedPathMatchesImplicated(tf, ip) {
+    const a = normalizeRepoPath(tf);
+    const b = normalizeRepoPath(ip);
+    if (a === b)
+        return true;
+    return a.endsWith(`/${b}`) || b.endsWith(`/${a}`);
+}
 /**
  * On a combined-test failure, selectively re-block items whose touched_files
  * overlap with the failing tests' implicated paths. When attribution is
  * ambiguous (no overlap found), falls back to re-blocking all resolved items.
  * Returns whether any item was blocked — the caller transitions back to triage.
  */
-function blockResolvedItemsOnCombinedFailure(state, testOutput) {
+export function blockResolvedItemsOnCombinedFailure(state, testOutput) {
     const resolvedItems = Object.values(state.items ?? {}).filter((i) => isVerifiedCompleteStatus(i.status));
     if (resolvedItems.length === 0)
         return false;
@@ -666,7 +799,7 @@ function blockResolvedItemsOnCombinedFailure(state, testOutput) {
     if (implicatedPaths.length > 0) {
         for (const item of resolvedItems) {
             const touchedFiles = item.item_spec?.touched_files ?? [];
-            const overlaps = touchedFiles.some((tf) => implicatedPaths.some((ip) => tf === ip || tf.endsWith(`/${ip}`) || ip.endsWith(`/${tf}`) || tf.endsWith(ip) || ip.endsWith(tf)));
+            const overlaps = touchedFiles.some((tf) => implicatedPaths.some((ip) => touchedPathMatchesImplicated(tf, ip)));
             if (overlaps)
                 attributed.push(item);
         }
@@ -864,6 +997,25 @@ function buildRemediationReportMarkdown(state, entries, closingResult, e2ePassed
             reportContent += `- \`${f}\`\n`;
         }
     }
+    // The tool-owned repository gate, ALWAYS rendered. A run whose gate was
+    // scoped out, suppressed, or never reached used to produce a report identical
+    // to one written after a green floor — "the suite passed" and "no suite ran"
+    // were the same document. Every branch below names which happened.
+    const gate = outcomesReport.final_gate;
+    reportContent += `\n## Repository Gate\n\n`;
+    if (gate.outcome === "executed") {
+        reportContent += `Outcome: executed — the repository build/typecheck/test floor RAN (${gate.commands_run} command(s)) and ${gate.passed ? "PASSED" : "FAILED"}.\n`;
+    }
+    else if (gate.outcome === "absent") {
+        reportContent += `Outcome: absent — NO gate outcome was recorded for this run, so nothing here corroborates it. This is not a pass.\n`;
+    }
+    else {
+        reportContent += `Outcome: ${gate.outcome} — the repository floor did NOT run (0 commands), so nothing here corroborates this run. This is not a pass.\n`;
+    }
+    if (gate.reason)
+        reportContent += `Reason: ${gate.reason}\n`;
+    if (gate.scope)
+        reportContent += `Scope: ${gate.scope}\n`;
     if (e2ePassed !== undefined) {
         reportContent += `\n## End-to-End Tests\n\nResult: ${e2ePassed ? "passed" : "failed"}\n`;
     }
@@ -938,11 +1090,15 @@ export async function cleanupTempBranchesAndArtifacts(options, completeState, co
     // Only delete artifacts on a fully-green close. When any test or closing
     // action failed, preserve the directory for diagnosis.
     //
-    // CE-003 force-close guard: a `blocked` or `abandoned` item means the run did
-    // NOT fully succeed — the tool-owned final gate (INV-RS-10) coarse-re-blocked
-    // or the bounded backstop abandoned the remaining items. Such a run must never
-    // be "landed green" (artifacts deleted as if complete); a vacuous/unset
-    // plan.test_command (combinedTest vacuously passing) cannot mask it. Preserve
+    // Force-close guard: a `blocked` or `abandoned` item means the run did NOT
+    // fully succeed. It reaches close that way through triage exhausting an item's
+    // retries, an operator halt, or the force-close backstop converting a
+    // still-non-terminal item — NOT through the tool-owned gate, which no longer
+    // mutates item statuses at all (a red pauses the run instead of re-blocking or
+    // abandoning). The guard is unchanged and still needed; only its causes are.
+    // Such a run must never be "landed green" (artifacts deleted as if complete); a
+    // vacuous/unset plan.test_command (combinedTest vacuously passing) cannot mask
+    // it. Preserve
     // the artifacts so the partial outcome is diagnosable. The predicate is
     // single-sourced in itemStatus so this guard cannot drift from the seam that
     // produces the statuses it defends against.
@@ -963,7 +1119,7 @@ export async function cleanupTempBranchesAndArtifacts(options, completeState, co
             artifact: options.artifactsDir,
             note: `Artifacts directory preserved for diagnosis (combinedTest.passed=${combinedTest.passed}, e2e.passed=${e2eResult.passed}, closing=${closingResult.status}, closingAction=${closingResult.action}, anyBlocked=${anyBlocked})`,
         });
-        return;
+        return {};
     }
     // Archive the friction close-out record with the promoted deliverables BEFORE
     // deleting the artifacts dir — same property as the audit side's
@@ -988,7 +1144,9 @@ export async function cleanupTempBranchesAndArtifacts(options, completeState, co
             artifact: options.artifactsDir,
             note: `Failed to clean up artifacts directory (manual removal may be needed): ${reason}`,
         });
+        return { artifacts_residue: options.artifactsDir };
     }
+    return {};
 }
 /**
  * Build a VerificationReport from the post-remediation state. One
@@ -1031,16 +1189,25 @@ export function buildVerificationReport(state, options, closingResult, combinedT
             });
             continue;
         }
-        // Combined test suite trace.
+        // Combined test suite trace. A never-configured suite (`ran:false`) is
+        // NEVER labelled "passed" here — `combinedTest.passed` stays `true` for
+        // that case only so the pre-existing fullyGreen/itemPassed formulas below
+        // keep their vacuously-green behavior; this trace's own evidence/status is
+        // what tells a reader "nothing ran" apart from "it ran and passed"
+        // (`status` stays the file's established "failed" for any non-affirmative
+        // case — see the identical choice on the skipped-item trace above — the
+        // finding-level verdict is driven by `itemPassed`, not by this one trace).
         const suiteLabel = combinedTest.suite_name ?? "combined test suite";
         traces.push({
             trace_id: `${item.finding_id}:combined-tests`,
             kind: "task",
             label: suiteLabel,
-            evidence: combinedTest.passed
-                ? [`${suiteLabel} passed`]
-                : [`${suiteLabel} failed`, ...(combinedTest.output ? [combinedTest.output.slice(-500)] : [])],
-            status: combinedTest.passed ? "passed" : "failed",
+            evidence: !combinedTest.ran
+                ? ["no combined test suite configured for this run"]
+                : combinedTest.passed
+                    ? [`${suiteLabel} passed`]
+                    : [`${suiteLabel} failed`, ...(combinedTest.output ? [combinedTest.output.slice(-500)] : [])],
+            status: combinedTest.ran && combinedTest.passed ? "passed" : "failed",
         });
         const contractGoalId = finding?.contract_goal_id ?? state.plan?.goal_id;
         if (contractGoalId) {
@@ -1144,6 +1311,25 @@ export async function runClosePhase(state, options, runLogger) {
     if (!state.plan || !state.items || !state.closing_plan) {
         throw new Error("Cannot run close phase: missing plan, items, or closing_plan from state.");
     }
+    // CDC-19 (advisory): a planned finding with no corresponding item in
+    // state.items would be left uncounted by every module's INV-COVERAGE join
+    // — a module that was blocked or never dispatched must not silently vanish
+    // from the coverage set. Diagnostic-only: never throws, and a no-op unless a
+    // runLogger is actually wired, so it changes nothing for a caller that
+    // doesn't ask for it.
+    {
+        const findingIds = new Set((state.plan.findings ?? []).map((f) => f.id));
+        const itemIds = new Set(Object.keys(state.items));
+        const uncounted = [...findingIds].filter((id) => !itemIds.has(id));
+        if (uncounted.length > 0) {
+            runLogger?.event({
+                phase: "close",
+                kind: "error",
+                obligation: "closing",
+                note: `${uncounted.length} planned finding(s) have no corresponding item in state.items and would be left uncounted by every module's coverage join: ${uncounted.slice(0, 10).join(", ")}`,
+            });
+        }
+    }
     // 1. Check whether closing action requires user confirmation (preview).
     // When not pre-authorized and action is confirmable, generate the file list +
     // commit message, attach them to closing_plan.closing_action_preview, and
@@ -1151,6 +1337,12 @@ export async function runClosePhase(state, options, runLogger) {
     // closing_plan.pre_authorized = true before the next next-step call.
     const preview = checkClosingPreview(state, options);
     if (preview) {
+        runLogger?.event({
+            phase: "close",
+            kind: "state",
+            obligation: "closing",
+            note: `Closing action '${state.closing_plan.action}' requires confirmation before proceeding — preview attached, awaiting pre_authorized.`,
+        });
         const updatedClosingPlan = { ...state.closing_plan, closing_action_preview: preview };
         return { ...state, closing_plan: updatedClosingPlan };
     }
@@ -1159,6 +1351,12 @@ export async function runClosePhase(state, options, runLogger) {
     if (!combinedTest.passed) {
         console.log("Full test suite failed. Transitioning back to triage.");
         if (blockResolvedItemsOnCombinedFailure(state, combinedTest.output)) {
+            runLogger?.event({
+                phase: "close",
+                kind: "state",
+                obligation: "closing",
+                note: "Combined test suite failed — re-blocked resolved item(s), transitioning to triage.",
+            });
             return { ...state, status: "triage" };
         }
         console.warn("Combined test suite failed but no resolved items to re-block — completing with test failure recorded in report.");
@@ -1194,15 +1392,34 @@ export async function runClosePhase(state, options, runLogger) {
         if (analyzerVerify.persisting.length > 0) {
             console.log(`Analyzer lead re-verify: ${analyzerVerify.persisting.length} lead(s) persist ` +
                 `(${analyzerVerify.persisting.join(", ")}). Transitioning back to triage.`);
+            runLogger?.event({
+                phase: "close",
+                kind: "state",
+                obligation: "closing",
+                note: `Mechanical re-verify: ${analyzerVerify.persisting.length} analyzer lead(s) persist (${analyzerVerify.persisting.join(", ")}) — transitioning to triage.`,
+            });
             return { ...state, status: "triage" };
         }
     }
-    // 3. Run end-to-end tests on the fully merged post-remediation state.
+    // 3. Run end-to-end tests on the fully merged post-remediation state. Mirrors
+    // the combined-test-failure branch's own guard above: a failure transitions
+    // to triage ONLY when something was actually re-blocked for triage to act
+    // on, never unconditionally (a failure with zero verified-complete items has
+    // nothing to re-block, so an unconditional triage transition would enter a
+    // state with no newly-blocked item to drive it forward).
     const e2eResult = runE2eTests(state, options);
     if (!e2eResult.passed) {
         console.log("End-to-end tests failed. Transitioning back to triage.");
-        blockResolvedItemsOnCombinedFailure(state, e2eResult.output);
-        return { ...state, status: "triage" };
+        if (blockResolvedItemsOnCombinedFailure(state, e2eResult.output)) {
+            runLogger?.event({
+                phase: "close",
+                kind: "state",
+                obligation: "closing",
+                note: "End-to-end tests failed — re-blocked resolved item(s), transitioning to triage.",
+            });
+            return { ...state, status: "triage" };
+        }
+        console.warn("End-to-end tests failed but no resolved items to re-block — completing with e2e failure recorded in report.");
     }
     // 4. Execute the closing action and record exact command outcomes before
     // reporting success.
@@ -1211,8 +1428,15 @@ export async function runClosePhase(state, options, runLogger) {
     await writeJsonFile(join(options.artifactsDir, "remediation-closing-result.json"), closingResult);
     // 4. Generate remediation-report.md and remediation-report.json
     const entries = collectReportEntries(state, options);
-    // Phase 7B: capture per-finding outcomes (surface only).
-    const outcomesReport = buildRemediationOutcomesReport(state, closingResult);
+    // Phase 7B: capture per-finding outcomes (surface only), carrying the run's
+    // tool-owned gate outcome so the report can say which of executed / scoped-out
+    // / disabled / absent this run actually was.
+    const finalGate = await readFinalGateReport(options.artifactsDir);
+    const outcomesReport = buildRemediationOutcomesReport(state, closingResult, finalGate);
+    // No run-log line for the gate here ON PURPOSE: the gate already records its
+    // own outcome at evaluation time (`recordFinalGateOutcome`), so a second line
+    // at close would be a duplicate — and `kind: "outcome"` at close means "one
+    // per finding", which a run-level line would quietly break.
     // One run-log line per outcome, plus a summary line for the artifact write.
     for (const outcome of outcomesReport.outcomes) {
         runLogger?.event({