audit-tools 0.45.0 → 0.46.0

package/dist/remediate/steps/dispatch/hostHandoff.js

@@ -1,7 +1,6 @@
-import { spawnSync } from "node:child_process";
 import { mkdir } from "node:fs/promises";
-import { isAbsolute, join, resolve } from "node:path";
-import { headCommit, commandLeavesDeclaredShape, FindingSchema, SUBMISSION_ISSUE_CODES, SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION, appendSubmissionEvent, assertSubmissionRunId, hashContent, isGitRepo, normalizeRepoPath, readSubmissionDocument, readSubmissionLedger, repoRelativePath, resolveContainedPath, spawnSyncHidden, stableStringify, submissionPathFor, writeJsonFile, } from "audit-tools/shared";
+import { isAbsolute } from "node:path";
+import { AUDIT_TOOLS_DIRNAME, headCommit, commandLeavesDeclaredShape, FindingSchema, SUBMISSION_ISSUE_CODES, SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION, appendSubmissionEvent, compareCodeUnits, contentSha256, hasExactKeys, hostHandoffResultPath, idsAreStrictlyAscending, isCommit, isGitRepo, isRecord, isSha256, normalizeRepoPath, parseAllWorkloadItems, parseCommandString, parseWorkloadEnvelope, promptSha256, readSubmissionDocument, readSubmissionLedger, repoRelativePath, resolveContainedPath, resolveHostHandoffPaths, resultIdentityIsBound, runTrackedAsync, sameStrings, stringArray, spawnSyncHidden, stableStringify, writeJsonFile, } from "audit-tools/shared";
 import { RemediationHostHandoffRecordSchema, RemediationPlanSchema, isClarificationCategory, } from "../../state/types.js";
 import { ITEM_STATUSES, isTerminalStatus, isVerifiedCompleteStatus, } from "../../state/itemStatus.js";
 import { REMEDIATION_HOST_DECISION_CONTRACT_VERSION as DECISION_CONTRACT_VERSION, REMEDIATION_HOST_RESULT_CONTRACT_VERSION as RESULT_CONTRACT_VERSION, REMEDIATION_HOST_WORKLOAD_CONTRACT_VERSION as WORKLOAD_CONTRACT_VERSION, } from "../types.js";
@@ -102,24 +101,6 @@ const CURRENT_ITEM_KEYS = new Set([
     "started_at",
     "status",
 ]);
-function compareCodeUnits(left, right) {
-    return left < right ? -1 : left > right ? 1 : 0;
-}
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function hasExactKeys(value, expected) {
-    const actual = Object.keys(value).sort(compareCodeUnits);
-    const canonicalExpected = [...expected].sort(compareCodeUnits);
-    return (actual.length === canonicalExpected.length &&
-        actual.every((key, index) => key === canonicalExpected[index]));
-}
-function isCommit(value) {
-    return typeof value === "string" && /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u.test(value);
-}
-function isSha256(value) {
-    return typeof value === "string" && /^[0-9a-f]{64}$/u.test(value);
-}
 function hasOnlyKnownKeys(value, known) {
     return Object.keys(value).every((key) => known.has(key));
 }
@@ -325,15 +306,19 @@ function cannotPrepareMessage(root, state, raised) {
     return `Cannot prepare a remediation host workload: ${messages.join("; ")}`;
 }
 function resolveBoundaryPaths(params) {
-    assertSubmissionRunId(params.runId, "remediation host run id");
-    const root = resolve(params.root);
-    const artifactsDir = resolveContainedPath(root, params.artifactsDir, "artifactsDir");
-    const runDir = resolveContainedPath(artifactsDir, join("runs", params.runId, "implement"), "remediation host run directory");
+    // The remediate draw's run dir carries the `implement` lane segment — its
+    // runs directory also holds triage/closing lanes — which the core takes as a
+    // parameter rather than a fork.
+    const core = resolveHostHandoffPaths({
+        ...params,
+        runDirSegments: ["implement"],
+        runIdLabel: "remediation host run id",
+    });
     return {
-        root,
-        artifactsDir,
-        workloadPath: join(runDir, "host-workload.json"),
-        resultDir: join(runDir, "host-results"),
+        root: core.root,
+        artifactsDir: core.artifactsDir,
+        workloadPath: core.workloadPath,
+        resultDir: core.resultDir,
     };
 }
 /**
@@ -342,7 +327,13 @@ function resolveBoundaryPaths(params) {
  * divergence between them would have been silent on both sides.
  */
 function resultPathFor(paths, workItemId) {
-    return submissionPathFor({ root: paths.root, submissionDir: paths.resultDir }, workItemId);
+    return hostHandoffResultPath({
+        root: paths.root,
+        artifactsDir: paths.artifactsDir,
+        runDir: paths.workloadPath.slice(0, paths.workloadPath.length - "host-workload.json".length - 1),
+        resultDir: paths.resultDir,
+        workloadPath: paths.workloadPath,
+    }, workItemId);
 }
 /**
  * Resolve the submission validator the INGEST applies to one work item, plus
@@ -511,15 +502,12 @@ function buildWorkItem(paths, block, baselineCommit, state) {
         finding_ids: [...block.items],
         allowed_files: allowedFiles,
         baseline_commit: baselineCommit,
-        prompt: { text: promptText, sha256: hashContent(promptText) },
+        prompt: { text: promptText, sha256: promptSha256(promptText) },
         required_tests: requiredTests,
         result_path: resultPath,
         token_estimate: block.token_estimate ?? 0,
     };
 }
-function hostWorkloadSha256(workload) {
-    return hashContent(stableStringify(workload));
-}
 function buildCanonicalWorkload(params) {
     const requestedIds = params.workItemIds
         ? new Set(params.workItemIds)
@@ -566,7 +554,7 @@ function parseWorkItem(value, paths, state, expectedBaselineCommit) {
         !hasExactKeys(value.prompt, ["sha256", "text"]) ||
         typeof value.prompt.text !== "string" ||
         !isSha256(value.prompt.sha256) ||
-        hashContent(value.prompt.text) !== value.prompt.sha256) {
+        promptSha256(value.prompt.text) !== value.prompt.sha256) {
         return null;
     }
     const block = state.plan.blocks.find((candidate) => candidate.block_id === value.id);
@@ -584,40 +572,32 @@ function parseWorkItem(value, paths, state, expectedBaselineCommit) {
         : null;
 }
 function parseWorkload(value, paths, runId, state) {
-    if (!isRecord(value) ||
-        !hasExactKeys(value, ["contract_version", "run_id", "work_items"]) ||
-        value.contract_version !== WORKLOAD_CONTRACT_VERSION ||
-        value.run_id !== runId ||
-        !Array.isArray(value.work_items)) {
+    // Envelope (keys, contract version, run id, items array) is the CORE's check.
+    const envelope = parseWorkloadEnvelope(value, {
+        contractVersion: WORKLOAD_CONTRACT_VERSION,
+        runId,
+    });
+    if (!envelope.ok)
         return null;
-    }
     const binding = state.host_handoff;
     if (binding &&
         (binding.run_id !== runId ||
-            hostWorkloadSha256(value) !==
+            contentSha256(value) !==
                 binding.workload_sha256)) {
         return null;
     }
-    const workItems = value.work_items.map((item) => parseWorkItem(item, paths, state, binding?.baseline_commit));
-    if (workItems.some((item) => item === null))
+    const workItems = parseAllWorkloadItems(envelope.rawItems, (item) => parseWorkItem(item, paths, state, binding?.baseline_commit));
+    if (workItems === null)
         return null;
     const ids = workItems.map((item) => item.id);
-    if (new Set(ids).size !== ids.length ||
-        ids.some((id, index) => index > 0 && compareCodeUnits(ids[index - 1], id) >= 0) ||
+    // Strictly ascending covers BOTH "sorted" and "duplicate-free" — the two
+    // properties the byte-for-byte re-derivation comparison needs.
+    if (!idsAreStrictlyAscending(ids) ||
         (binding !== undefined && !sameStrings(ids, binding.work_item_ids))) {
         return null;
     }
     return value;
 }
-function stringArray(value) {
-    return Array.isArray(value) && value.every((entry) => typeof entry === "string")
-        ? value
-        : null;
-}
-function sameStrings(left, right) {
-    return (left.length === right.length &&
-        left.every((entry, index) => entry === right[index]));
-}
 function invalidResult(reason) {
     return { ok: false, reason };
 }
@@ -631,11 +611,11 @@ function parseResult(value, runId, workItem) {
             "prompt_sha256",
             "outcome",
         ]) ||
-            typeof value.result_id !== "string" ||
-            value.result_id.length === 0 ||
-            value.run_id !== runId ||
-            value.work_item_id !== workItem.id ||
-            value.prompt_sha256 !== workItem.prompt.sha256 ||
+            !resultIdentityIsBound(value, {
+                runId,
+                workItemId: workItem.id,
+                promptSha256: workItem.prompt.sha256,
+            }) ||
             !isRecord(value.outcome) ||
             typeof value.outcome.status !== "string") {
             return invalidResult("decision must match the exact current run, work-item, and prompt binding");
@@ -690,11 +670,11 @@ function parseResult(value, runId, workItem) {
             "worktree_evidence",
         ]) ||
         value.contract_version !== RESULT_CONTRACT_VERSION ||
-        typeof value.result_id !== "string" ||
-        value.result_id.length === 0 ||
-        value.run_id !== runId ||
-        value.work_item_id !== workItem.id ||
-        value.prompt_sha256 !== workItem.prompt.sha256) {
+        !resultIdentityIsBound(value, {
+            runId,
+            workItemId: workItem.id,
+            promptSha256: workItem.prompt.sha256,
+        })) {
         return invalidResult("result must match the exact current contract, run, work-item, and prompt binding");
     }
     const changedFiles = stringArray(value.changed_files);
@@ -797,6 +777,134 @@ function gitChangedFilesOfCommit(root, commit) {
         return null;
     return [...new Set((result.stdout ?? "").split("\0").filter(Boolean))].sort(compareCodeUnits);
 }
+/**
+ * Every repo-relative path the tree shows as touched since `baseline` — the
+ * commits baseline→HEAD, the working tree's own deviation from HEAD (staged and
+ * unstaged alike), and the untracked files git considers repository content.
+ *
+ * All three legs are needed to falsify a no-change claim, and they enumerate the
+ * three ways a host can have edited: committed (leg 1), edited a TRACKED file
+ * and left it uncommitted (leg 2), and CREATED a file (leg 3). A new `src/*.ts`
+ * is a real edit and the most natural shape a remediation takes; without leg 3
+ * the cheapest way to smuggle one past a no-change claim was simply never to
+ * `git add` it. `null` means git could not answer, which callers must treat as
+ * "cannot corroborate" rather than as "nothing changed".
+ *
+ * The untracked leg honours `--exclude-standard`, so it enumerates only what git
+ * itself treats as content — a repo's `.gitignore`d build and coverage output is
+ * already invisible to it. Two exemptions cover the remainder, both ground
+ * truth rather than the host's word:
+ *
+ *  - THIS TOOL'S OWN ARTIFACT TREE ({@link AUDIT_TOOLS_DIRNAME}) is subtracted
+ *    here, explicitly. In a real repository the tool writes a managed
+ *    `.gitignore` block covering it, so it never reaches this probe at all; the
+ *    explicit subtraction is what makes that independent of whether the block
+ *    has been written yet, so a bare root (a fixture, a first run) cannot
+ *    manufacture a false refusal out of the tool's own workload, prompt and
+ *    result documents.
+ *  - PRE-EXISTING untracked strays are excused by the caller's `excusedPaths`,
+ *    for free: `run_start_dirty` is captured from `stagedAndUntracked` before
+ *    any remediation edit exists, so it already enumerates untracked files.
+ *    What survives both is an untracked file that appeared DURING the run — the
+ *    only untracked class that can be this host's edit.
+ */
+function gitChangedFilesSince(root, baseline) {
+    const files = new Set();
+    for (const args of [
+        // baseline → HEAD: what the host committed.
+        ["diff", "--name-only", "-z", baseline, "HEAD"],
+        // HEAD → working tree: what the host edited and did not commit.
+        ["diff", "--name-only", "-z", "HEAD"],
+        // Never added: what the host CREATED. `--exclude-standard` keeps git's own
+        // ignore rules authoritative.
+        ["ls-files", "--others", "--exclude-standard", "-z"],
+    ]) {
+        const probe = spawnSyncHidden("git", args, {
+            cwd: root,
+            encoding: "utf8",
+            shell: false,
+        });
+        if (probe.error || probe.status !== 0)
+            return null;
+        for (const file of (probe.stdout ?? "").split("\0").filter(Boolean)) {
+            if (isAuditToolsArtifactPath(file))
+                continue;
+            files.add(file);
+        }
+    }
+    return [...files].sort(compareCodeUnits);
+}
+/** Whether a repo-relative path lives inside this tool's own artifact tree. */
+function isAuditToolsArtifactPath(path) {
+    const normalized = normalizeRepoPath(path);
+    return (normalized === AUDIT_TOOLS_DIRNAME ||
+        normalized.startsWith(`${AUDIT_TOOLS_DIRNAME}/`));
+}
+/**
+ * Corroborate an explicit `resolved_no_change` decision against the repository.
+ *
+ * A no-change decision used to be accepted on its evidence STRINGS alone, with
+ * only the required tests re-run — so a host that had in fact edited and then
+ * declared "nothing to do" was recorded as verified-no-change, and the edit
+ * rode into the run unattributed. The claim is mechanically falsifiable, so it
+ * is FALSIFIED.
+ *
+ * The scope of the falsification is the FULL write-scope corroboration every
+ * other acceptance path gets, NOT a narrowing to this item's `allowed_files`.
+ * `corroborateHostResult` refuses a landed commit that touched anything outside
+ * `allowed_files`; a no-change decision that narrowed the check to files INSIDE
+ * `allowed_files` would be the inverse rule — the out-of-scope edit, the more
+ * serious of the two, would be the one silently admitted. So EVERY path the
+ * tree shows as moved since the workload baseline refuses the claim.
+ *
+ * `excusedPaths` is the only exemption, and it is ground truth rather than the
+ * host's word: `run_start_dirty` (already dirty before the run began, so not
+ * evidence that this host edited anything — and because it is captured from
+ * `stagedAndUntracked`, it excuses pre-existing UNTRACKED strays too) unioned
+ * with the accepted edit surface — `applied_edit_surface` plus whatever this
+ * same ingest has already corroborated and accepted, so a sibling work item's
+ * legitimately landed files do not falsify this item's claim.
+ *
+ * Fails CLOSED, like every other corroboration here: a git that cannot answer
+ * refuses the claim rather than admitting it.
+ */
+function corroborateNoChangeClaim(params) {
+    const { root, workItem, excusedPaths } = params;
+    if (!isGitRepo(root))
+        return { ok: true };
+    const baseline = workItem.baseline_commit;
+    if (!gitCommitExists(root, baseline)) {
+        return {
+            ok: false,
+            code: "commit_missing",
+            message: "resolved_no_change cannot be corroborated: baseline_commit does not resolve to a real commit",
+        };
+    }
+    const changed = gitChangedFilesSince(root, baseline);
+    if (changed === null) {
+        return {
+            ok: false,
+            code: "commit_missing",
+            message: "resolved_no_change cannot be corroborated: git could not enumerate the changes since the workload baseline",
+        };
+    }
+    const violating = changed.filter((path) => !excusedPaths.has(normalizeRepoPath(path)));
+    if (violating.length > 0) {
+        const inScope = violating.filter((path) => workItem.allowed_files.includes(path));
+        const outOfScope = violating.filter((path) => !workItem.allowed_files.includes(path));
+        return {
+            ok: false,
+            code: "changed_files_mismatch",
+            message: "resolved_no_change is contradicted by the tree — these files changed since the " +
+                `workload baseline: ${violating.join(", ")}` +
+                (outOfScope.length > 0
+                    ? ` (outside the prompt-bound allowed_files: ${outOfScope.join(", ")}` +
+                        (inScope.length > 0 ? `; inside: ${inScope.join(", ")})` : ")")
+                    : ""),
+        };
+    }
+    return { ok: true };
+}
 /**
  * Per-command deadline. A required test is host-authored and may legitimately be
  * a full suite, so the bound is generous; what changed is that hitting it is now
@@ -865,10 +973,19 @@ function requiredTestVerdictKey(root, command) {
  * first-class outcome of this function, and an outcome that can only be reached
  * by waiting ten real minutes is an outcome nothing ever tests.
  */
-export function runRequiredTest(root, command, timeoutMs = REQUIRED_TEST_TIMEOUT_MS) {
-    const result = spawnSync(command, {
+export async function runRequiredTest(root, command, timeoutMs = REQUIRED_TEST_TIMEOUT_MS) {
+    // AWAITED, never `spawnSync`: ingestion runs with the remediation state lock
+    // held, and a synchronous child blocks the event loop for the whole suite —
+    // starving the lock's mtime heartbeat until a LIVE lock is classified stale
+    // and stolen mid-ingest.
+    //
+    // argv + `shell: false`, never a shell string. A required test is a workload
+    // command that already cleared the declared-shape gate at the producer, so
+    // splitting it is unambiguous, and dropping the shell removes the last place
+    // an ingest hands a declared string to `sh`/`cmd.exe`. `resolveExecArgv`
+    // inside the runner is what keeps the npm/npx shims resolvable on win32.
+    const result = await runTrackedAsync(parseCommandString(command), {
         cwd: root,
-        shell: true,
         // Captured, not discarded: without it a red ingest reports that something
         // failed and nothing about why.
         encoding: "utf8",
@@ -920,7 +1037,7 @@ export function runRequiredTest(root, command, timeoutMs = REQUIRED_TEST_TIMEOUT
     // `status` with `signal` null — so this branch is unreachable on the platform
     // this repo runs its suites on, and no test exercises it. It is kept because
     // the runner is OS-agnostic by contract, not because it has been observed.
-    if (result.signal !== null) {
+    if (result.signal !== null && result.signal !== undefined) {
         return {
             command,
             outcome: "failed",
@@ -941,7 +1058,7 @@ export function runRequiredTest(root, command, timeoutMs = REQUIRED_TEST_TIMEOUT
     }
     return null;
 }
-function rerunRequiredTests(root, commands, 
+async function rerunRequiredTests(root, commands, 
 /** `null` on the normal lane — see {@link RemediationRequiredTestVerdicts}. */
 verdicts) {
     const failures = [];
@@ -962,7 +1079,7 @@ verdicts) {
             }
             continue;
         }
-        const failure = runRequiredTest(root, command);
+        const failure = await runRequiredTest(root, command);
         if (failure !== null)
             failures.push(failure);
     }
@@ -1028,11 +1145,11 @@ export async function precomputeRecoveryTestVerdicts(params) {
         }
     }
     for (const command of commands) {
-        verdicts.set(requiredTestVerdictKey(paths.root, command), runRequiredTest(paths.root, command));
+        verdicts.set(requiredTestVerdictKey(paths.root, command), await runRequiredTest(paths.root, command));
     }
     return verdicts;
 }
-function corroborateHostResult(params) {
+async function corroborateHostResult(params) {
     const { root, state, workItem, result, verdicts } = params;
     const baseline = workItem.baseline_commit;
     const landed = result.commit_evidence.after;
@@ -1103,7 +1220,7 @@ function corroborateHostResult(params) {
             message: `landed files overlap pre-existing run-start dirt: ${dirtyOverlap.join(", ")}`,
         };
     }
-    const failedTests = rerunRequiredTests(root, workItem.required_tests, verdicts);
+    const failedTests = await rerunRequiredTests(root, workItem.required_tests, verdicts);
     if (failedTests.length > 0) {
         const issue = requiredTestIssue(workItem, failedTests);
         return { ok: false, code: issue.code, message: issue.message };
@@ -1163,7 +1280,7 @@ export async function prepareRemediationHostHandoff(params) {
                 .map((issue) => issue.message)
                 .join("; ")}`);
     }
-    const workloadDigest = hostWorkloadSha256(workload);
+    const workloadDigest = contentSha256(workload);
     if (existingRecord &&
         existingRecord.workload_sha256 !== workloadDigest) {
         throw new Error("Trusted remediation host workload no longer matches the persisted state binding");
@@ -1312,7 +1429,13 @@ export async function ingestRemediationHostResults(params) {
     // the same acceptance.
     let recordedRecoveryMarks = null;
     const landedFiles = new Set(nextState.applied_edit_surface ?? []);
-    const requireRepositoryCorroboration = state.host_handoff !== undefined || isGitRepo(paths.root);
+    // Can this ingest be corroborated against ground truth AT ALL? A git root
+    // supplies the tree; a persisted `host_handoff` supplies the trusted binding.
+    // With NEITHER there is nothing to check a host's claim against, and the
+    // remaining evidence is the host's own attestation — which is exactly the
+    // claim under test. That branch is REFUSED for both result and decision
+    // documents rather than admitted on the attestation alone.
+    const canCorroborate = state.host_handoff !== undefined || isGitRepo(paths.root);
     for (const workItem of workload.work_items) {
         const pendingItems = workItem.finding_ids.filter((findingId) => nextState.items[findingId]?.status === "pending");
         if (pendingItems.length === 0)
@@ -1372,7 +1495,36 @@ export async function ingestRemediationHostResults(params) {
             const result = parsed.result;
             const outcome = result.outcome;
             if (outcome.status === "resolved_no_change") {
-                const failedTests = rerunRequiredTests(paths.root, workItem.required_tests, requiredTestVerdicts);
+                if (!canCorroborate) {
+                    issues.push({
+                        code: "trusted_binding_missing",
+                        work_item_id: workItem.id,
+                        result_path: workItem.result_path,
+                        message: "resolved_no_change needs a git root or a persisted host_handoff binding to corroborate the write scope against; attestation-only acceptance is refused",
+                    });
+                    continue;
+                }
+                const noChange = corroborateNoChangeClaim({
+                    root: paths.root,
+                    workItem,
+                    // Ground truth only: pre-existing dirt plus the edit surface this run
+                    // has already corroborated and accepted (`landedFiles` starts from
+                    // `applied_edit_surface` and grows as this same ingest accepts).
+                    excusedPaths: new Set([
+                        ...(state.run_start_dirty ?? []).map(normalizeRepoPath),
+                        ...[...landedFiles].map(normalizeRepoPath),
+                    ]),
+                });
+                if (!noChange.ok) {
+                    issues.push({
+                        code: noChange.code,
+                        work_item_id: workItem.id,
+                        result_path: workItem.result_path,
+                        message: noChange.message,
+                    });
+                    continue;
+                }
+                const failedTests = await rerunRequiredTests(paths.root, workItem.required_tests, requiredTestVerdicts);
                 if (failedTests.length > 0) {
                     issues.push(requiredTestIssue(workItem, failedTests));
                     continue;
@@ -1414,76 +1566,82 @@ export async function ingestRemediationHostResults(params) {
             continue;
         }
         const result = parsed.result;
-        let acceptedFiles = result.changed_files;
-        if (requireRepositoryCorroboration) {
-            const corroborated = corroborateHostResult({
-                root: paths.root,
-                state,
-                workItem,
-                result,
-                verdicts: requiredTestVerdicts,
-                recovery: params.recovery !== undefined,
+        if (!canCorroborate) {
+            issues.push({
+                code: "trusted_binding_missing",
+                work_item_id: workItem.id,
+                result_path: workItem.result_path,
+                message: "a landed result needs a git root or a persisted host_handoff binding to corroborate the write scope against; attestation-only acceptance is refused",
             });
-            if (!corroborated.ok) {
+            continue;
+        }
+        const corroborated = await corroborateHostResult({
+            root: paths.root,
+            state,
+            workItem,
+            result,
+            verdicts: requiredTestVerdicts,
+            recovery: params.recovery !== undefined,
+        });
+        if (!corroborated.ok) {
+            issues.push({
+                code: corroborated.code,
+                work_item_id: workItem.id,
+                result_path: workItem.result_path,
+                message: corroborated.message,
+            });
+            continue;
+        }
+        if (corroborated.usedRecovery) {
+            // No acceptance without a record. The mark goes down BEFORE the item is
+            // marked resolved, and an append that throws refuses this item rather
+            // than landing an acceptance the ledger cannot account for — the run
+            // must never read as one that never drifted. The refusal is per item:
+            // an unwritable ledger is not a reason to discard the whole ingest.
+            try {
+                recordedRecoveryMarks ??= (await readSubmissionLedger(paths.artifactsDir)).filter((event) => event.kind === "accepted_via_recovery");
+                // The mark's identity is (run, item, LANDED COMMIT), not just
+                // (run, item): an item re-opened and later re-accepted from a
+                // DIFFERENT landing is a different relaxed acceptance and earns its
+                // own record. Only a retry of the SAME landing is a duplicate. The
+                // landed sha is matched inside the message because the shared event
+                // contract carries no commit field, and a 40-hex sha this writer
+                // itself emitted is an unambiguous token to match on.
+                const landedCommit = result.commit_evidence.after;
+                const alreadyMarked = recordedRecoveryMarks.some((event) => event.run_id === params.runId &&
+                    event.submission_id === workItem.id &&
+                    (event.message ?? "").includes(landedCommit));
+                if (!alreadyMarked) {
+                    const event = {
+                        contract_version: SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION,
+                        run_id: params.runId,
+                        submission_id: workItem.id,
+                        lane: workItem.id,
+                        kind: "accepted_via_recovery",
+                        // Derived from what was actually probed, never asserted: the
+                        // baseline was found in no ref and unreachable from HEAD.
+                        message: `accepted under recovery: the trusted baseline ${workItem.baseline_commit} is ` +
+                            "contained by no ref and unreachable from HEAD, so landed commit " +
+                            `${landedCommit} was corroborated against HEAD and this ` +
+                            "item's bound scope instead of against baseline ancestry",
+                        recorded_at: new Date().toISOString(),
+                    };
+                    await appendSubmissionEvent(paths.artifactsDir, event);
+                    recordedRecoveryMarks.push(event);
+                }
+            }
+            catch (error) {
                 issues.push({
-                    code: corroborated.code,
+                    code: "recovery_unrecorded",
                     work_item_id: workItem.id,
                     result_path: workItem.result_path,
-                    message: corroborated.message,
+                    message: "the recovery acceptance could not be recorded on the submission ledger, so it " +
+                        `was refused: ${error instanceof Error ? error.message : String(error)}`,
                 });
                 continue;
             }
-            if (corroborated.usedRecovery) {
-                // No acceptance without a record. The mark goes down BEFORE the item is
-                // marked resolved, and an append that throws refuses this item rather
-                // than landing an acceptance the ledger cannot account for — the run
-                // must never read as one that never drifted. The refusal is per item:
-                // an unwritable ledger is not a reason to discard the whole ingest.
-                try {
-                    recordedRecoveryMarks ??= (await readSubmissionLedger(paths.artifactsDir)).filter((event) => event.kind === "accepted_via_recovery");
-                    // The mark's identity is (run, item, LANDED COMMIT), not just
-                    // (run, item): an item re-opened and later re-accepted from a
-                    // DIFFERENT landing is a different relaxed acceptance and earns its
-                    // own record. Only a retry of the SAME landing is a duplicate. The
-                    // landed sha is matched inside the message because the shared event
-                    // contract carries no commit field, and a 40-hex sha this writer
-                    // itself emitted is an unambiguous token to match on.
-                    const landedCommit = result.commit_evidence.after;
-                    const alreadyMarked = recordedRecoveryMarks.some((event) => event.run_id === params.runId &&
-                        event.submission_id === workItem.id &&
-                        (event.message ?? "").includes(landedCommit));
-                    if (!alreadyMarked) {
-                        const event = {
-                            contract_version: SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION,
-                            run_id: params.runId,
-                            submission_id: workItem.id,
-                            lane: workItem.id,
-                            kind: "accepted_via_recovery",
-                            // Derived from what was actually probed, never asserted: the
-                            // baseline was found in no ref and unreachable from HEAD.
-                            message: `accepted under recovery: the trusted baseline ${workItem.baseline_commit} is ` +
-                                "contained by no ref and unreachable from HEAD, so landed commit " +
-                                `${landedCommit} was corroborated against HEAD and this ` +
-                                "item's bound scope instead of against baseline ancestry",
-                            recorded_at: new Date().toISOString(),
-                        };
-                        await appendSubmissionEvent(paths.artifactsDir, event);
-                        recordedRecoveryMarks.push(event);
-                    }
-                }
-                catch (error) {
-                    issues.push({
-                        code: "recovery_unrecorded",
-                        work_item_id: workItem.id,
-                        result_path: workItem.result_path,
-                        message: "the recovery acceptance could not be recorded on the submission ledger, so it " +
-                            `was refused: ${error instanceof Error ? error.message : String(error)}`,
-                    });
-                    continue;
-                }
-            }
-            acceptedFiles = corroborated.changedFiles;
         }
+        const acceptedFiles = corroborated.changedFiles;
         const completedAt = new Date().toISOString();
         for (const findingId of pendingItems) {
             const item = nextState.items[findingId];