audit-tools 0.50.21 → 0.51.1

package/dist/remediate/steps/dispatch/hostHandoff.js

@@ -1,6 +1,6 @@
 import { mkdir } from "node:fs/promises";
 import { isAbsolute } from "node:path";
-import { AUDIT_TOOLS_DIRNAME, headCommit, commandLeavesDeclaredShape, FindingSchema, SUBMISSION_ISSUE_CODES, SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION, appendSubmissionEvent, compareCodeUnits, contentSha256, hasExactKeys, hostHandoffResultPath, idsAreStrictlyAscending, isCommit, isGitRepo, isRecord, isSha256, normalizeRepoPath, parseAllWorkloadItems, parseCommandString, parseWorkloadEnvelope, promptSha256, readSubmissionDocument, readSubmissionLedger, repoRelativePath, resolveContainedPath, resolveHostHandoffPaths, resultIdentityIsBound, runTrackedAsync, sameStrings, scanBoundSubmission, stringArray, stableStringify, TRACKED_CHILD_DEADLINE_MS, writeJsonFile, } from "audit-tools/shared";
+import { AUDIT_TOOLS_DIRNAME, headCommit, commandLeavesDeclaredShape, FindingSchema, SUBMISSION_ISSUE_CODES, SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION, appendSubmissionEvent, enrichMissingSubmissionIssues, compareCodeUnits, contentSha256, hasExactKeys, hostHandoffResultPath, idsAreStrictlyAscending, isCommit, isGitRepo, isRecord, isSha256, normalizeRepoPath, parseAllWorkloadItems, parseCommandString, parseWorkloadEnvelope, promptSha256, readSubmissionDocument, readSubmissionLedger, readTrailingSubmissionRefusals, recordHostResultOutcomes, repoRelativePath, resolveContainedPath, resolveHostHandoffPaths, resultIdentityIsBound, runTrackedAsync, sameStrings, scanBoundSubmission, stringArray, stableStringify, TRACKED_CHILD_DEADLINE_MS, writeJsonFile, } from "audit-tools/shared";
 import { StateStore } from "../../state/store.js";
 import { REMEDIATION_HOST_HANDOFF_RECORD_V1ALPHA1, REMEDIATION_HOST_HANDOFF_RECORD_V1ALPHA2, REMEDIATION_HOST_SCOPE_SEMANTICS, RemediationHostHandoffRecordSchema, RemediationPlanSchema, isClarificationCategory, } from "../../state/types.js";
 import { ITEM_STATUSES, isTerminalStatus, isVerifiedCompleteStatus, } from "../../state/itemStatus.js";
@@ -481,7 +481,7 @@ export async function remediationSubmissionBinding(params) {
             const parsed = parseResult(value, params.runId, validationWorkItem, paths.root);
             return parsed.ok
                 ? null
-                : { code: "submission_contract_invalid", message: parsed.reason };
+                : { code: "submission_contract_invalid", check: parsed.check, message: parsed.reason };
         },
     };
 }
@@ -799,8 +799,9 @@ function parseWorkload(value, paths, runId, state) {
     }
     return value;
 }
-function invalidResult(reason) {
-    return { ok: false, reason };
+/** `check` names the registered ingestion check that failed; `reason` is its prose. */
+function invalidResult(check, reason) {
+    return { ok: false, check, reason };
 }
 /**
  * This draw's refusal vocabulary for {@link scanBoundSubmission}. The scan owns
@@ -817,6 +818,8 @@ const remediationScanMessages = {
 };
 function parseResult(value, runId, workItem, root) {
     if (isRecord(value) && value.contract_version === DECISION_CONTRACT_VERSION) {
+        // Envelope first, identity second: one message (the host repairs the same
+        // file either way), two registered checks, so the issue names which failed.
         if (!hasExactKeys(value, [
             "contract_version",
             "result_id",
@@ -825,14 +828,16 @@ function parseResult(value, runId, workItem, root) {
             "prompt_sha256",
             "outcome",
         ]) ||
-            !resultIdentityIsBound(value, {
-                runId,
-                workItemId: workItem.id,
-                promptSha256: workItem.prompt.sha256,
-            }) ||
             !isRecord(value.outcome) ||
             typeof value.outcome.status !== "string") {
-            return invalidResult("decision must match the exact current run, work-item, and prompt binding");
+            return invalidResult("result_envelope", "decision must match the exact current run, work-item, and prompt binding");
+        }
+        if (!resultIdentityIsBound(value, {
+            runId,
+            workItemId: workItem.id,
+            promptSha256: workItem.prompt.sha256,
+        })) {
+            return invalidResult("identity_binding", "decision must match the exact current run, work-item, and prompt binding");
         }
         const outcome = value.outcome;
         if (outcome.status === "resolved_no_change") {
@@ -841,14 +846,14 @@ function parseResult(value, runId, workItem, root) {
                 !evidence ||
                 evidence.length === 0 ||
                 evidence.some((entry) => entry.trim().length === 0)) {
-                return invalidResult("resolved_no_change requires a non-empty evidence string array");
+                return invalidResult("outcome_shape", "resolved_no_change requires a non-empty evidence string array");
             }
         }
         else if (outcome.status === "blocked") {
             if (!hasExactKeys(outcome, ["status", "failure_reason"]) ||
                 typeof outcome.failure_reason !== "string" ||
                 outcome.failure_reason.trim().length === 0) {
-                return invalidResult("blocked requires a non-empty failure_reason");
+                return invalidResult("outcome_shape", "blocked requires a non-empty failure_reason");
             }
         }
         else if (outcome.status === "needs_clarification") {
@@ -857,11 +862,11 @@ function parseResult(value, runId, workItem, root) {
                 outcome.question.trim().length === 0 ||
                 (outcome.category !== undefined &&
                     !isClarificationCategory(outcome.category))) {
-                return invalidResult("needs_clarification requires a non-empty question and optional canonical category");
+                return invalidResult("outcome_shape", "needs_clarification requires a non-empty question and optional canonical category");
             }
         }
         else {
-            return invalidResult("decision outcome.status must be resolved_no_change, blocked, or needs_clarification");
+            return invalidResult("outcome_shape", "decision outcome.status must be resolved_no_change, blocked, or needs_clarification");
         }
         return {
             ok: true,
@@ -884,13 +889,15 @@ function parseResult(value, runId, workItem, root) {
             "work_item_id",
             "worktree_evidence",
         ]) ||
-        value.contract_version !== RESULT_CONTRACT_VERSION ||
-        !resultIdentityIsBound(value, {
-            runId,
-            workItemId: workItem.id,
-            promptSha256: workItem.prompt.sha256,
-        })) {
-        return invalidResult("result must match the exact current contract, run, work-item, and prompt binding");
+        value.contract_version !== RESULT_CONTRACT_VERSION) {
+        return invalidResult("result_envelope", "result must match the exact current contract, run, work-item, and prompt binding");
+    }
+    if (!resultIdentityIsBound(value, {
+        runId,
+        workItemId: workItem.id,
+        promptSha256: workItem.prompt.sha256,
+    })) {
+        return invalidResult("identity_binding", "result must match the exact current contract, run, work-item, and prompt binding");
     }
     const changedFiles = stringArray(value.changed_files);
     if (!changedFiles ||
@@ -898,25 +905,25 @@ function parseResult(value, runId, workItem, root) {
         new Set(changedFiles).size !== changedFiles.length ||
         !sameStrings([...changedFiles].sort(compareCodeUnits), changedFiles) ||
         changedFiles.some((path) => !pathIsAllowedByWriteScope(root, path, workItem.allowed_files))) {
-        return invalidResult("changed_files must be non-empty, sorted, unique, normalized paths within allowed_files");
+        return invalidResult("write_scope", "changed_files must be non-empty, sorted, unique, normalized paths within allowed_files");
     }
     if (!isRecord(value.commit_evidence) ||
         !hasExactKeys(value.commit_evidence, ["after", "before"]) ||
         value.commit_evidence.before !== workItem.baseline_commit ||
         !isCommit(value.commit_evidence.after) ||
         value.commit_evidence.after === value.commit_evidence.before) {
-        return invalidResult("commit_evidence must bind the workload baseline to a distinct full commit id");
+        return invalidResult("commit_evidence", "commit_evidence must bind the workload baseline to a distinct full commit id");
     }
     if (!Array.isArray(value.test_evidence) ||
         value.test_evidence.length !== workItem.required_tests.length) {
-        return invalidResult("test_evidence must contain exactly one entry for every required test");
+        return invalidResult("test_evidence", "test_evidence must contain exactly one entry for every required test");
     }
     for (const [index, evidence] of value.test_evidence.entries()) {
         if (!isRecord(evidence) ||
             !hasExactKeys(evidence, ["command", "status"]) ||
             evidence.command !== workItem.required_tests[index] ||
             evidence.status !== "passed") {
-            return invalidResult(`test_evidence[${index}] must echo the bound command with status passed`);
+            return invalidResult("test_evidence", `test_evidence[${index}] must echo the bound command with status passed`);
         }
     }
     // The evidence-coverage floor: the cited obligation set must equal the
@@ -924,7 +931,7 @@ function parseResult(value, runId, workItem, root) {
     // whether a citation SUFFICES is the per-run conformance review's job.
     const obligationEvidence = value.obligation_evidence;
     if (!Array.isArray(obligationEvidence)) {
-        return invalidResult("obligation_evidence must be an array with one entry per bound obligation");
+        return invalidResult("obligation_evidence", "obligation_evidence must be an array with one entry per bound obligation");
     }
     const citedIds = [];
     for (const [index, entry] of obligationEvidence.entries()) {
@@ -939,7 +946,7 @@ function parseResult(value, runId, workItem, root) {
             const named = isRecord(entry) && typeof entry.obligation_id === "string"
                 ? ` (obligation_id: ${entry.obligation_id})`
                 : "";
-            return invalidResult(`obligation_evidence[${index}] must cite at least one non-empty evidence string for a named obligation${named}`);
+            return invalidResult("obligation_evidence", `obligation_evidence[${index}] must cite at least one non-empty evidence string for a named obligation${named}`);
         }
         citedIds.push(entry.obligation_id);
     }
@@ -948,24 +955,24 @@ function parseResult(value, runId, workItem, root) {
         const duplicates = [
             ...new Set(citedIds.filter((id, i) => citedIds.indexOf(id) !== i)),
         ];
-        return invalidResult(`obligation_evidence cites an obligation more than once: ${duplicates.join(", ")}`);
+        return invalidResult("obligation_evidence", `obligation_evidence cites an obligation more than once: ${duplicates.join(", ")}`);
     }
     const uncovered = workItem.obligation_ids.filter((id) => !cited.has(id));
     if (uncovered.length > 0) {
-        return invalidResult(`obligation_evidence must cover every prompt-bound obligation; uncovered: ${uncovered.join(", ")}`);
+        return invalidResult("obligation_evidence", `obligation_evidence must cover every prompt-bound obligation; uncovered: ${uncovered.join(", ")}`);
     }
     const unknown = citedIds.filter((id) => !workItem.obligation_ids.includes(id));
     if (unknown.length > 0) {
-        return invalidResult(`obligation_evidence cites obligations the work item does not bind: ${unknown.join(", ")}`);
+        return invalidResult("obligation_evidence", `obligation_evidence cites obligations the work item does not bind: ${unknown.join(", ")}`);
     }
     if (!isRecord(value.worktree_evidence) ||
         !hasExactKeys(value.worktree_evidence, ["baseline_commit", "changed_files"]) ||
         value.worktree_evidence.baseline_commit !== workItem.baseline_commit) {
-        return invalidResult("worktree_evidence must bind the workload baseline and changed-file list");
+        return invalidResult("worktree_evidence", "worktree_evidence must bind the workload baseline and changed-file list");
     }
     const worktreeFiles = stringArray(value.worktree_evidence.changed_files);
     if (!worktreeFiles || !sameStrings(worktreeFiles, changedFiles)) {
-        return invalidResult("worktree_evidence.changed_files must exactly equal changed_files");
+        return invalidResult("worktree_evidence", "worktree_evidence.changed_files must exactly equal changed_files");
     }
     if (!isRecord(value.acceptance) ||
         !hasExactKeys(value.acceptance, ["status"]) ||
@@ -973,7 +980,7 @@ function parseResult(value, runId, workItem, root) {
         !isRecord(value.merge) ||
         !hasExactKeys(value.merge, ["status"]) ||
         value.merge.status !== "merged") {
-        return invalidResult("acceptance and merge must both attest a completed landing");
+        return invalidResult("landing_attestation", "acceptance and merge must both attest a completed landing");
     }
     return {
         ok: true,
@@ -1136,6 +1143,7 @@ async function corroborateNoChangeClaim(params) {
         return {
             ok: false,
             code: "commit_missing",
+            check: "no_change_corroboration",
             message: "resolved_no_change cannot be corroborated: baseline_commit does not resolve to a real commit",
         };
     }
@@ -1144,6 +1152,7 @@ async function corroborateNoChangeClaim(params) {
         return {
             ok: false,
             code: "commit_missing",
+            check: "no_change_corroboration",
             message: "resolved_no_change cannot be corroborated: git could not enumerate the changes since the workload baseline",
         };
     }
@@ -1154,6 +1163,7 @@ async function corroborateNoChangeClaim(params) {
         return {
             ok: false,
             code: "changed_files_mismatch",
+            check: "no_change_corroboration",
             message: "resolved_no_change is contradicted by the tree — these files changed since the " +
                 `workload baseline: ${violating.join(", ")}` +
                 (outOfScope.length > 0
@@ -1359,6 +1369,7 @@ function requiredTestIssue(workItem, failures) {
             : failures.some((failure) => failure.outcome === "output_overflow")
                 ? "required_test_output_overflow"
                 : "required_test_failed",
+        check: "test_evidence",
         work_item_id: workItem.id,
         result_path: workItem.result_path,
         message: `mechanical required-test rerun failed: ${failures
@@ -1418,6 +1429,7 @@ async function corroborateHostResult(params) {
         return {
             ok: false,
             code: "commit_missing",
+            check: "commit_evidence",
             message: "baseline_commit and commit_evidence.after must both resolve to real commits",
         };
     }
@@ -1426,6 +1438,7 @@ async function corroborateHostResult(params) {
             return {
                 ok: false,
                 code: "baseline_not_ancestor",
+                check: "commit_evidence",
                 message: "the trusted workload baseline is not an ancestor of the claimed landed commit",
             };
         }
@@ -1442,6 +1455,7 @@ async function corroborateHostResult(params) {
             return {
                 ok: false,
                 code: "baseline_not_ancestor",
+                check: "commit_evidence",
                 message: "the trusted workload baseline is not an ancestor of the claimed landed commit, " +
                     "and the baseline is NOT orphaned (a ref still contains it, or it is reachable " +
                     "from HEAD), so the stale-worker protection stands and recovery cannot waive it",
@@ -1453,6 +1467,7 @@ async function corroborateHostResult(params) {
         return {
             ok: false,
             code: "commit_not_landed",
+            check: "commit_evidence",
             message: "commit_evidence.after is not reachable from the repository HEAD",
         };
     }
@@ -1461,6 +1476,7 @@ async function corroborateHostResult(params) {
         return {
             ok: false,
             code: "changed_files_mismatch",
+            check: "write_scope",
             message: "the landed commit's mechanically derived changed files do not exactly match changed_files",
         };
     }
@@ -1468,6 +1484,7 @@ async function corroborateHostResult(params) {
         return {
             ok: false,
             code: "changed_files_mismatch",
+            check: "write_scope",
             message: "the landed commit changed a file outside the prompt-bound allowed_files",
         };
     }
@@ -1477,13 +1494,14 @@ async function corroborateHostResult(params) {
         return {
             ok: false,
             code: "run_start_dirty_overlap",
+            check: "worktree_evidence",
             message: `landed files overlap pre-existing run-start dirt: ${dirtyOverlap.join(", ")}`,
         };
     }
     const failedTests = await rerunRequiredTests(root, workItem.required_tests, verdicts);
     if (failedTests.length > 0) {
         const issue = requiredTestIssue(workItem, failedTests);
-        return { ok: false, code: issue.code, message: issue.message };
+        return { ok: false, code: issue.code, check: "test_evidence", message: issue.message };
     }
     return { ok: true, changedFiles: actualFiles, usedRecovery };
 }
@@ -1609,6 +1627,55 @@ export async function ingestRemediationHostResults(params) {
         return "unsupported_retired_state";
     const paths = resolveBoundaryPaths(params);
     const nextState = structuredClone(state);
+    const validated = await validateHostResultBundle({
+        state,
+        nextState,
+        paths,
+        runId: params.runId,
+        recovery: params.recovery,
+    });
+    if (validated.kind === "summary") {
+        const issues = await recordAndEnrichHostIssues(params.artifactsDir, params.runId, validated.summary.issues, validated.summary.completed_work_item_ids);
+        return { ...validated.summary, issues };
+    }
+    const acc = {
+        issues: validated.issues,
+        completed: [],
+        resultIds: new Set(),
+        landedFiles: new Set(nextState.applied_edit_surface ?? []),
+        settledFindingIds: new Set(),
+        recordedRecoveryMarks: null,
+    };
+    const verdicts = await executeHostVerificationReruns(validated.ctx, acc);
+    const issues = await recordAndEnrichHostIssues(params.artifactsDir, params.runId, acc.issues, acc.completed);
+    return commitRemediationStateUpdates(validated.ctx, acc, verdicts, issues);
+}
+/** Record raw observations first, then decorate only the returned diagnostics. */
+async function recordAndEnrichHostIssues(artifactsDir, runId, issues, acceptedIds) {
+    const refusals = await readTrailingSubmissionRefusals(artifactsDir, issues
+        .map((issue) => issue.work_item_id ?? issue.submission_id)
+        .filter((id) => id !== undefined), { runId });
+    await recordHostResultOutcomes(artifactsDir, runId, {
+        // This refusal already reports that the ledger write failed. Retrying
+        // that same item would replace its diagnostic with an ingest exception;
+        // other items retain normal recording and error propagation.
+        issues: issues.filter((issue) => issue.code !== "recovery_unrecorded"),
+        acceptedIds,
+    }, { scopeToRunId: runId });
+    return enrichMissingSubmissionIssues(issues, refusals, "submission_rejected");
+}
+/**
+ * Phase 1 — the whole-bundle gates, up to the schedulable frontier.
+ *
+ * Returns either a populated context or ONE OF THREE finished summaries. The
+ * three do not agree on `pending_work_item_ids` — the read failure and the
+ * canonical parse failure return the binding's own item ids, the trusted-binding
+ * refusal returns the empty list — so folding any two together is a silent
+ * behavior change. Each is pinned by a test that asserts the pending list, not
+ * just the code.
+ */
+async function validateHostResultBundle(input) {
+    const { state, nextState, paths } = input;
     const issues = [];
     const workloadRead = await readSubmissionDocument(paths.workloadPath);
     if (workloadRead.kind !== "value") {
@@ -1617,18 +1684,22 @@ export async function ingestRemediationHostResults(params) {
                 code: workloadRead.kind === "missing"
                     ? "workload_missing"
                     : "workload_invalid",
+                check: "workload_binding",
                 message: workloadRead.kind === "missing"
                     ? "the persisted trusted handoff has no workload file"
                     : `the workload file is not valid JSON: ${workloadRead.detail}`,
             });
         }
         return {
-            accepted_count: 0,
-            completed_work_item_ids: [],
-            pending_work_item_ids: state.host_handoff?.work_item_ids ?? [],
-            issues,
-            state_changed: false,
-            state: nextState,
+            kind: "summary",
+            summary: {
+                accepted_count: 0,
+                completed_work_item_ids: [],
+                pending_work_item_ids: state.host_handoff?.work_item_ids ?? [],
+                issues,
+                state_changed: false,
+                state: nextState,
+            },
         };
     }
     // Producer-side plan defects are reported BEFORE the workload is parsed: a
@@ -1648,62 +1719,85 @@ export async function ingestRemediationHostResults(params) {
     if ((await isGitRepo(paths.root)) && !state.host_handoff) {
         issues.push({
             code: "trusted_binding_missing",
+            check: "workload_binding",
             message: "a git-backed remediation workload requires the tool-owned host_handoff state binding",
         });
         return {
-            accepted_count: 0,
-            completed_work_item_ids: [],
-            pending_work_item_ids: [],
-            issues,
-            state_changed: false,
-            state: nextState,
+            kind: "summary",
+            summary: {
+                accepted_count: 0,
+                completed_work_item_ids: [],
+                pending_work_item_ids: [],
+                issues,
+                state_changed: false,
+                state: nextState,
+            },
         };
     }
-    const workload = parseWorkload(workloadRead.value, paths, params.runId, state);
+    const workload = parseWorkload(workloadRead.value, paths, input.runId, state);
     if (!workload) {
         // Accumulated, not replaced: when a block-contract defect is WHY the
         // canonical re-derivation failed, the block-attributed issue is the only
         // thing that names the cause.
         issues.push({
             code: "workload_invalid",
+            check: "workload_binding",
             message: "the workload does not match its canonical state shape and persisted digest binding",
         });
         return {
-            accepted_count: 0,
-            completed_work_item_ids: [],
-            pending_work_item_ids: state.host_handoff?.work_item_ids ?? [],
-            issues,
-            state_changed: false,
-            state: nextState,
+            kind: "summary",
+            summary: {
+                accepted_count: 0,
+                completed_work_item_ids: [],
+                pending_work_item_ids: state.host_handoff?.work_item_ids ?? [],
+                issues,
+                state_changed: false,
+                state: nextState,
+            },
         };
     }
-    const effectiveWorkload = effectiveBoundWorkload(state, workload);
-    const eligibleIds = new Set((hostDependencyLevels(state)[0] ?? []).map((block) => block.block_id));
-    const resultIds = new Set();
-    const completed = [];
-    // Recovery-only answer table; the normal lane gets null and spawns exactly as
-    // it always has. See RemediationRequiredTestVerdicts.
-    const requiredTestVerdicts = params.recovery?.requiredTestVerdicts ?? null;
-    // Lazily loaded on the first recovery-marked acceptance: the recovery marks
-    // the ledger ALREADY carries. A crash between the append and the state write
-    // leaves a mark whose item is still pending, and the natural response is to
-    // re-run the verb — which must converge, not accumulate a second record of
-    // the same acceptance.
-    let recordedRecoveryMarks = null;
-    const landedFiles = new Set(nextState.applied_edit_surface ?? []);
-    // Can this ingest be corroborated against ground truth AT ALL? A git root
-    // supplies the tree; a persisted `host_handoff` supplies the trusted binding.
-    // With NEITHER there is nothing to check a host's claim against, and the
-    // remaining evidence is the host's own attestation — which is exactly the
-    // claim under test. That branch is REFUSED for both result and decision
-    // documents rather than admitted on the attestation alone.
-    const canCorroborate = state.host_handoff !== undefined || (await isGitRepo(paths.root));
-    for (const workItem of effectiveWorkload.work_items) {
-        const pendingItems = workItem.finding_ids.filter((findingId) => nextState.items[findingId]?.status === "pending");
+    return {
+        kind: "context",
+        issues,
+        ctx: {
+            paths,
+            runId: input.runId,
+            recovery: input.recovery !== undefined,
+            state,
+            nextState,
+            effectiveWorkload: effectiveBoundWorkload(state, workload),
+            eligibleIds: new Set((hostDependencyLevels(state)[0] ?? []).map((block) => block.block_id)),
+            // Can this ingest be corroborated against ground truth AT ALL? A git root
+            // supplies the tree; a persisted `host_handoff` supplies the trusted
+            // binding. With NEITHER there is nothing to check a host's claim against,
+            // and the remaining evidence is the host's own attestation — which is
+            // exactly the claim under test. That branch is REFUSED for both result
+            // and decision documents rather than admitted on the attestation alone.
+            canCorroborate: state.host_handoff !== undefined || (await isGitRepo(paths.root)),
+            // Recovery-only answer table; the normal lane gets null and spawns
+            // exactly as it always has. See RemediationRequiredTestVerdicts.
+            requiredTestVerdicts: input.recovery?.requiredTestVerdicts ?? null,
+        },
+    };
+}
+/**
+ * Phase 2 — per-item verification. Writes NOTHING to `ctx.nextState`.
+ *
+ * Iterates the effective workload in order and emits one verdict per ACCEPTED
+ * item; a refusal pushes its classified issue and continues. The ledger mark
+ * for a recovery acceptance still goes down before that item's verdict is
+ * emitted, so no acceptance can outrun its record.
+ */
+async function executeHostVerificationReruns(ctx, acc) {
+    const { paths, nextState, state } = ctx;
+    const verdicts = [];
+    for (const workItem of ctx.effectiveWorkload.work_items) {
+        const pendingItems = workItem.finding_ids.filter((findingId) => nextState.items[findingId]?.status === "pending" &&
+            !acc.settledFindingIds.has(findingId));
         if (pendingItems.length === 0)
             continue;
-        if (!eligibleIds.has(workItem.id)) {
-            issues.push({
+        if (!ctx.eligibleIds.has(workItem.id)) {
+            acc.issues.push({
                 code: "submission_contract_invalid",
                 work_item_id: workItem.id,
                 result_path: workItem.result_path,
@@ -1717,29 +1811,30 @@ export async function ingestRemediationHostResults(params) {
             workItemId: workItem.id,
             resultPath: workItem.result_path,
             parse: (value) => {
-                const result = parseResult(value, params.runId, workItem, paths.root);
+                const result = parseResult(value, ctx.runId, workItem, paths.root);
                 return result.ok
                     ? { ok: true, parsed: result }
-                    : { ok: false, detail: result.reason };
+                    : { ok: false, check: result.check, detail: result.reason };
             },
             resultId: (result) => result.result.result_id,
-            seen: (resultId) => resultIds.has(resultId),
+            seen: (resultId) => acc.resultIds.has(resultId),
             messages: remediationScanMessages,
         });
         if (!scan.ok) {
-            issues.push(scan.issue);
+            acc.issues.push(scan.issue);
             continue;
         }
         const parsed = scan.parsed;
         const resultId = parsed.result.result_id;
-        resultIds.add(resultId);
+        acc.resultIds.add(resultId);
         if (parsed.kind === "decision") {
             const result = parsed.result;
             const outcome = result.outcome;
             if (outcome.status === "resolved_no_change") {
-                if (!canCorroborate) {
-                    issues.push({
+                if (!ctx.canCorroborate) {
+                    acc.issues.push({
                         code: "trusted_binding_missing",
+                        check: "no_change_corroboration",
                         work_item_id: workItem.id,
                         result_path: workItem.result_path,
                         message: "resolved_no_change needs a git root or a persisted host_handoff binding to corroborate the write scope against; attestation-only acceptance is refused",
@@ -1754,63 +1849,42 @@ export async function ingestRemediationHostResults(params) {
                     // `applied_edit_surface` and grows as this same ingest accepts).
                     excusedPaths: new Set([
                         ...(state.run_start_dirty ?? []).map(normalizeRepoPath),
-                        ...[...landedFiles].map(normalizeRepoPath),
+                        ...[...acc.landedFiles].map(normalizeRepoPath),
                     ]),
                 });
                 if (!noChange.ok) {
-                    issues.push({
+                    acc.issues.push({
                         code: noChange.code,
+                        check: noChange.check,
                         work_item_id: workItem.id,
                         result_path: workItem.result_path,
                         message: noChange.message,
                     });
                     continue;
                 }
-                const failedTests = await rerunRequiredTests(paths.root, workItem.required_tests, requiredTestVerdicts);
+                const failedTests = await rerunRequiredTests(paths.root, workItem.required_tests, ctx.requiredTestVerdicts);
                 if (failedTests.length > 0) {
-                    issues.push(requiredTestIssue(workItem, failedTests));
+                    acc.issues.push(requiredTestIssue(workItem, failedTests));
                     continue;
                 }
             }
-            const now = new Date().toISOString();
-            for (const findingId of pendingItems) {
-                const item = nextState.items[findingId];
-                item.started_at ??= now;
-                if (outcome.status === "resolved_no_change") {
-                    item.status = "resolved_no_change";
-                    item.completed_at = now;
-                    item.host_result_evidence = [...outcome.evidence];
-                    delete item.failure_reason;
-                }
-                else if (outcome.status === "blocked") {
-                    item.status = "blocked";
-                    item.completed_at = now;
-                    item.failure_reason = outcome.failure_reason;
-                }
-                else {
-                    item.status = "needs_clarification";
-                    delete item.completed_at;
-                    item.failure_reason = outcome.question;
-                    const clarifications = nextState.clarifications ?? [];
-                    if (!clarifications.some((entry) => entry.finding_id === findingId)) {
-                        clarifications.push({
-                            finding_id: findingId,
-                            category: isClarificationCategory(outcome.category)
-                                ? outcome.category
-                                : "scope_of_fix",
-                            description: outcome.question,
-                        });
-                    }
-                    nextState.clarifications = clarifications;
-                }
-            }
-            completed.push(workItem.id);
+            for (const findingId of pendingItems)
+                acc.settledFindingIds.add(findingId);
+            verdicts.push({
+                kind: "decision",
+                workItem,
+                pendingItems,
+                at: new Date().toISOString(),
+                outcome,
+            });
+            acc.completed.push(workItem.id);
             continue;
         }
         const result = parsed.result;
-        if (!canCorroborate) {
-            issues.push({
+        if (!ctx.canCorroborate) {
+            acc.issues.push({
                 code: "trusted_binding_missing",
+                check: "workload_binding",
                 work_item_id: workItem.id,
                 result_path: workItem.result_path,
                 message: "a landed result needs a git root or a persisted host_handoff binding to corroborate the write scope against; attestation-only acceptance is refused",
@@ -1822,12 +1896,13 @@ export async function ingestRemediationHostResults(params) {
             state,
             workItem,
             result,
-            verdicts: requiredTestVerdicts,
-            recovery: params.recovery !== undefined,
+            verdicts: ctx.requiredTestVerdicts,
+            recovery: ctx.recovery,
         });
         if (!corroborated.ok) {
-            issues.push({
+            acc.issues.push({
                 code: corroborated.code,
+                check: corroborated.check,
                 work_item_id: workItem.id,
                 result_path: workItem.result_path,
                 message: corroborated.message,
@@ -1841,7 +1916,7 @@ export async function ingestRemediationHostResults(params) {
             // must never read as one that never drifted. The refusal is per item:
             // an unwritable ledger is not a reason to discard the whole ingest.
             try {
-                recordedRecoveryMarks ??= (await readSubmissionLedger(paths.artifactsDir)).filter((event) => event.kind === "accepted_via_recovery");
+                acc.recordedRecoveryMarks ??= (await readSubmissionLedger(paths.artifactsDir)).filter((event) => event.kind === "accepted_via_recovery");
                 // The mark's identity is (run, item, LANDED COMMIT), not just
                 // (run, item): an item re-opened and later re-accepted from a
                 // DIFFERENT landing is a different relaxed acceptance and earns its
@@ -1850,13 +1925,13 @@ export async function ingestRemediationHostResults(params) {
                 // contract carries no commit field, and a 40-hex sha this writer
                 // itself emitted is an unambiguous token to match on.
                 const landedCommit = result.commit_evidence.after;
-                const alreadyMarked = recordedRecoveryMarks.some((event) => event.run_id === params.runId &&
+                const alreadyMarked = acc.recordedRecoveryMarks.some((event) => event.run_id === ctx.runId &&
                     event.submission_id === workItem.id &&
                     (event.message ?? "").includes(landedCommit));
                 if (!alreadyMarked) {
                     const event = {
                         contract_version: SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION,
-                        run_id: params.runId,
+                        run_id: ctx.runId,
                         submission_id: workItem.id,
                         lane: workItem.id,
                         kind: "accepted_via_recovery",
@@ -1869,11 +1944,11 @@ export async function ingestRemediationHostResults(params) {
                         recorded_at: new Date().toISOString(),
                     };
                     await appendSubmissionEvent(paths.artifactsDir, event);
-                    recordedRecoveryMarks.push(event);
+                    acc.recordedRecoveryMarks.push(event);
                 }
             }
             catch (error) {
-                issues.push({
+                acc.issues.push({
                     code: "recovery_unrecorded",
                     work_item_id: workItem.id,
                     result_path: workItem.result_path,
@@ -1883,35 +1958,91 @@ export async function ingestRemediationHostResults(params) {
                 continue;
             }
         }
-        const acceptedFiles = corroborated.changedFiles;
-        const completedAt = new Date().toISOString();
-        for (const findingId of pendingItems) {
+        for (const findingId of pendingItems)
+            acc.settledFindingIds.add(findingId);
+        verdicts.push({
+            kind: "landed",
+            workItem,
+            pendingItems,
+            at: new Date().toISOString(),
+        });
+        for (const changedFile of corroborated.changedFiles) {
+            acc.landedFiles.add(changedFile);
+        }
+        acc.completed.push(workItem.id);
+    }
+    return verdicts;
+}
+/**
+ * Phase 3 — apply the accepted verdicts to the clone and assemble the summary.
+ *
+ * Infallible given the verdicts: every refusal was already classified in
+ * phase 2, so nothing here can reject. Verdicts apply in workload order, which
+ * is the order they were emitted, so a finding two items share is written the
+ * same way it was before the phases were separated.
+ */
+function commitRemediationStateUpdates(ctx, acc, verdicts, issues) {
+    const { nextState } = ctx;
+    for (const verdict of verdicts) {
+        if (verdict.kind === "decision") {
+            const outcome = verdict.outcome;
+            for (const findingId of verdict.pendingItems) {
+                const item = nextState.items[findingId];
+                item.started_at ??= verdict.at;
+                if (outcome.status === "resolved_no_change") {
+                    item.status = "resolved_no_change";
+                    item.completed_at = verdict.at;
+                    item.host_result_evidence = [...outcome.evidence];
+                    delete item.failure_reason;
+                }
+                else if (outcome.status === "blocked") {
+                    item.status = "blocked";
+                    item.completed_at = verdict.at;
+                    item.failure_reason = outcome.failure_reason;
+                }
+                else {
+                    item.status = "needs_clarification";
+                    delete item.completed_at;
+                    item.failure_reason = outcome.question;
+                    const clarifications = nextState.clarifications ?? [];
+                    if (!clarifications.some((entry) => entry.finding_id === findingId)) {
+                        clarifications.push({
+                            finding_id: findingId,
+                            category: isClarificationCategory(outcome.category)
+                                ? outcome.category
+                                : "scope_of_fix",
+                            description: outcome.question,
+                        });
+                    }
+                    nextState.clarifications = clarifications;
+                }
+            }
+            continue;
+        }
+        for (const findingId of verdict.pendingItems) {
             const item = nextState.items[findingId];
             item.status = "resolved";
-            item.started_at ??= completedAt;
-            item.completed_at = completedAt;
+            item.started_at ??= verdict.at;
+            item.completed_at = verdict.at;
             delete item.failure_reason;
             delete item.host_result_evidence;
         }
-        for (const changedFile of acceptedFiles)
-            landedFiles.add(changedFile);
-        completed.push(workItem.id);
     }
-    if (completed.length > 0) {
-        nextState.applied_edit_surface = [...landedFiles].sort(compareCodeUnits);
+    if (acc.completed.length > 0) {
+        nextState.applied_edit_surface = [...acc.landedFiles].sort(compareCodeUnits);
     }
-    const pendingWorkItemIds = effectiveWorkload.work_items
+    const pendingWorkItemIds = ctx.effectiveWorkload.work_items
         .filter((workItem) => workItem.finding_ids.some((findingId) => nextState.items[findingId]?.status === "pending"))
         .map((workItem) => workItem.id);
-    let stateChanged = completed.length > 0;
+    let stateChanged = acc.completed.length > 0;
     if (nextState.host_handoff && pendingWorkItemIds.length === 0) {
         migrateLegacyDirectoryScopesAfterFinalDrain(nextState);
         delete nextState.host_handoff;
         stateChanged = true;
     }
     return {
-        accepted_count: completed.length,
-        completed_work_item_ids: completed,
+        accepted_count: acc.completed.length,
+        completed_work_item_ids: acc.completed,
         pending_work_item_ids: pendingWorkItemIds,
         issues,
         state_changed: stateChanged,