audit-tools 0.51.7 → 0.51.9

package/dist/remediate/steps/dispatch/hostHandoff.js

@@ -1,11 +1,18 @@
+// sites-pinned: tests/remediate/host-handoff-corroboration.test.ts
+// (the bounded
+// required-test failure message)
 import { mkdir } from "node:fs/promises";
 import { isAbsolute } from "node:path";
-import { AUDIT_TOOLS_DIRNAME, headCommit, commandLeavesDeclaredShape, FindingSchema, SUBMISSION_ISSUE_CODES, SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION, appendSubmissionEvent, enrichMissingSubmissionIssues, compareCodeUnits, contentSha256, hasExactKeys, hostHandoffResultPath, idsAreStrictlyAscending, isCommit, isGitRepo, isRecord, isSha256, normalizeRepoPath, parseAllWorkloadItems, parseCommandString, parseWorkloadEnvelope, promptSha256, readSubmissionDocument, readSubmissionLedger, readTrailingSubmissionRefusals, recordHostResultOutcomes, repoRelativePath, resolveContainedPath, resolveHostHandoffPaths, resultIdentityIsBound, runTrackedAsync, sameStrings, scanBoundSubmission, stringArray, stableStringify, TRACKED_CHILD_DEADLINE_MS, writeJsonFile, } from "audit-tools/shared";
-import { StateStore } from "../../state/store.js";
+import { AUDIT_TOOLS_DIRNAME, headCommit, commandLeavesDeclaredShape, FindingSchema, SUBMISSION_ISSUE_CODES, SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION, appendSubmissionEvent, enrichMissingSubmissionIssues, isMissingObservation, compareCodeUnits, contentSha256, deriveLaneDemand, hasExactKeys, identityFailureDiagnostic, hostHandoffResultPath, idsAreStrictlyAscending, isCommit, isGitRepo, isRecord, isSha256, LaneDemandSchema, normalizeRepoPath, parseAllWorkloadItems, parseCommandString, parseWorkloadEnvelope, promptSha256, readSubmissionDocument, readSubmissionLedger, readTrailingSubmissionRefusals, recoveryMarkMatches, recordHostResultOutcomes, repoRelativePath, resolveContainedPath, resolveHostHandoffPaths, runTrackedAsync, sameStrings, scanBoundSubmission, SEVERITIES, severityRank, stringArray, stableStringify, TRACKED_CHILD_DEADLINE_MS, writeJsonFile, } from "audit-tools/shared";
+import { REMEDIATION_STATE_CONTRACT_VERSION, StateStore, } from "../../state/store.js";
 import { REMEDIATION_HOST_HANDOFF_RECORD_V1ALPHA1, REMEDIATION_HOST_HANDOFF_RECORD_V1ALPHA2, REMEDIATION_HOST_SCOPE_SEMANTICS, RemediationHostHandoffRecordSchema, RemediationPlanSchema, isClarificationCategory, } from "../../state/types.js";
 import { ITEM_STATUSES, isTerminalStatus, isVerifiedCompleteStatus, } from "../../state/itemStatus.js";
 import { REMEDIATION_HOST_DECISION_CONTRACT_VERSION as DECISION_CONTRACT_VERSION, REMEDIATION_HOST_RESULT_CONTRACT_VERSION as RESULT_CONTRACT_VERSION, REMEDIATION_HOST_WORKLOAD_CONTRACT_VERSION as WORKLOAD_CONTRACT_VERSION, } from "../types.js";
-const STATE_CONTRACT_VERSION = "remediate-code-state/v1alpha1";
+// The state contract version is the STORE's declaration, not a second literal
+// here. It used to be private to this module — and the module then supplied it
+// to its own parser at the call site below, so the check it performed was
+// "does the constant equal itself".
+const STATE_CONTRACT_VERSION = REMEDIATION_STATE_CONTRACT_VERSION;
 /**
  * Remediation's issue vocabulary: the SHARED submission codes plus this draw's
  * own domain corroboration codes.
@@ -69,6 +76,14 @@ export const REMEDIATION_ISSUE_CODES = [
      * tree that is no longer current. The whole recovery aborts.
      */
     "tree_moved_between_phases",
+    /**
+     * The run's own WORKLOAD BINDING changed between the recovery verb's unlocked
+     * test phase and its locked write phase — the sibling of
+     * `tree_moved_between_phases` for a concurrent state writer that settles items
+     * and re-mints the binding without moving a commit. The pre-computed verdicts
+     * describe work that is no longer pending, so the whole recovery aborts.
+     */
+    "state_moved_between_phases",
 ];
 const CURRENT_STATE_KEYS = new Set([
     "applied_edit_surface",
@@ -91,6 +106,12 @@ const CURRENT_ITEM_KEYS = new Set([
     "completed_at",
     "failure_context",
     "failure_reason",
+    // The corroborated landing this ingest itself writes on an accepted item (see
+    // RemediationItemState.host_landed_commit). Listed because this gate is an
+    // ALLOWLIST: without them the first ingest persists them and the very next
+    // one refuses the whole state as a retired shape it cannot parse.
+    "host_landed_commit",
+    "host_landed_files",
     "host_result_evidence",
     "finding_id",
     "incomplete_coverage_attempts",
@@ -395,18 +416,13 @@ function cannotPrepareMessage(root, state, raised) {
 function resolveBoundaryPaths(params) {
     // The remediate draw's run dir carries the `implement` lane segment — its
     // runs directory also holds triage/closing lanes — which the core takes as a
-    // parameter rather than a fork.
-    const core = resolveHostHandoffPaths({
+    // parameter rather than a fork. The core's whole result is returned: the draw
+    // adds no fields and re-derives none of the core's.
+    return resolveHostHandoffPaths({
         ...params,
         runDirSegments: ["implement"],
         runIdLabel: "remediation host run id",
     });
-    return {
-        root: core.root,
-        artifactsDir: core.artifactsDir,
-        workloadPath: core.workloadPath,
-        resultDir: core.resultDir,
-    };
 }
 /**
  * The bound path for one work item's submission — the SHARED rule, not a local
@@ -414,13 +430,7 @@ function resolveBoundaryPaths(params) {
  * divergence between them would have been silent on both sides.
  */
 function resultPathFor(paths, workItemId) {
-    return hostHandoffResultPath({
-        root: paths.root,
-        artifactsDir: paths.artifactsDir,
-        runDir: paths.workloadPath.slice(0, paths.workloadPath.length - "host-workload.json".length - 1),
-        resultDir: paths.resultDir,
-        workloadPath: paths.workloadPath,
-    }, workItemId);
+    return hostHandoffResultPath(paths, workItemId);
 }
 /**
  * Resolve the submission validator the INGEST applies to one work item, plus
@@ -457,12 +467,13 @@ export async function remediationSubmissionBinding(params) {
     let validationWorkItem = workItem;
     try {
         const storedState = await new StateStore(paths.artifactsDir).loadState();
-        const state = storedState
-            ? parseCurrentState({
-                ...storedState,
-                contract_version: STATE_CONTRACT_VERSION,
-            })
-            : null;
+        // No version is supplied here. The store reads the state from disk and
+        // stamps the contract version it just VALIDATED, so `parseCurrentState`
+        // tests the value that was in the file. It used to be handed
+        // `STATE_CONTRACT_VERSION` from this line, which made the parser's version
+        // check compare a constant to itself and accept any state the store was
+        // willing to return.
+        const state = storedState ? parseCurrentState(storedState) : null;
         const canonicalWorkload = state
             ? parseWorkload(read.value, paths, params.runId, state)
             : null;
@@ -648,6 +659,63 @@ function buildPrompt(item) {
         `If no edit should land, write ${DECISION_CONTRACT_VERSION} instead with exactly contract_version, result_id, run_id, work_item_id, prompt_sha256, outcome. outcome must be one of: {status: resolved_no_change, evidence: [non-empty strings]}, {status: blocked, failure_reason: non-empty string}, or {status: needs_clarification, question: non-empty string, optional category}.`,
     ].join("\n");
 }
+/**
+ * The remediate draw's risk score for one block, in `[0, 1]`.
+ *
+ * The per-mode INPUT to the shared ranking is what this draw's artifacts
+ * already carry: the severities of the findings the block addresses. A block
+ * fixing three `critical` findings is not the same dispatch as one fixing a
+ * single `info`, and before this it looked identical to the host.
+ *
+ * The score is the WORST severity in the block, with the count of same-or-worse
+ * findings nudging it up — a block of many high-severity findings is above a
+ * block with one. Deterministic (no clock, no sampling) and bounded by
+ * construction. A block whose findings are all absent from the plan contributes
+ * nothing, so an unresolvable block honestly ranks `low` rather than being
+ * guessed at.
+ */
+export function severityRiskWeight(severity) {
+    // DERIVED from the shared tuple, never a second copy of it. This used to be a
+    // hand-written `Record<string, number>` — a second severity vocabulary beside
+    // the one `FindingSeveritySchema`/`SEVERITIES`/`severityRank` single-source in
+    // `src/shared/types/lens.ts` — read through `?? 0`. A severity added to the
+    // shared union fell through that fallback and weighted as ZERO, i.e. the
+    // safest possible rank, so a block of brand-new-critical findings dispatched
+    // as if it fixed nothing. The return type is the shared union, and `SEVERITIES`
+    // is the tuple it is DERIVED from, so that class of miss is now a type error
+    // rather than a silent downgrade.
+    //
+    // The scale is "how far up the severity ladder", 1 at the top and 0 at the
+    // bottom: ORDER is the shared fact, and this is only the scale applied to it.
+    // The values reproduce the hand-written table this replaced EXACTLY
+    // (1 / 0.75 / 0.5 / 0.25 / 0.1 for five tiers), so no emitted ranking moves.
+    //
+    // The bottom tier's floor is deliberate. Unguarded it would be 0 — the same
+    // weight as "this block's findings could not be resolved at all" — and those
+    // are different facts: a block that fixes `info` findings is a real, if
+    // smallest, dispatch, while an unresolvable block is a hole in the plan.
+    // Keeping the bottom off zero is what lets `blockRiskScore`'s corroboration
+    // bump distinguish them.
+    const ladder = SEVERITIES.length - 1;
+    return severity === "info"
+        ? 0.1
+        : ladder === 0
+            ? 1
+            : (severityRank(severity) - 1) / ladder;
+}
+function blockRiskScore(state, block) {
+    const scores = block.items
+        .map((findingId) => state.plan.findings.find((entry) => entry.id === findingId)?.severity)
+        .flatMap((severity) => severity === undefined ? [] : [severityRiskWeight(severity)]);
+    if (scores.length === 0)
+        return 0;
+    const worst = Math.max(...scores);
+    // Each additional finding at or above half the worst severity adds a tenth,
+    // capped: breadth within a severity band is real but must not outrank a
+    // genuinely worse finding.
+    const corroborating = scores.filter((score) => score >= worst / 2).length - 1;
+    return Math.min(1, worst + Math.max(0, corroborating) * 0.1);
+}
 function buildFindingAssignments(state, block) {
     return block.items.map((findingId) => {
         const finding = state.plan.findings.find((entry) => entry.id === findingId);
@@ -703,6 +771,11 @@ function buildWorkItem(paths, block, baselineCommit, state) {
         prompt: { text: promptText, sha256: promptSha256(promptText) },
         required_tests: requiredTests,
         result_path: resultPath,
+        demand: deriveLaneDemand({
+            tokenEstimate: block.token_estimate ?? 0,
+            fileCount: allowedFiles.length,
+            riskScore: blockRiskScore(state, block),
+        }),
         token_estimate: block.token_estimate ?? 0,
     };
 }
@@ -730,6 +803,7 @@ function parseWorkItem(value, paths, state, expectedBaselineCommit) {
         !hasExactKeys(value, [
             "allowed_files",
             "baseline_commit",
+            "demand",
             "finding_ids",
             "id",
             "obligation_ids",
@@ -739,6 +813,7 @@ function parseWorkItem(value, paths, state, expectedBaselineCommit) {
             "token_estimate",
         ]) ||
         typeof value.id !== "string" ||
+        !LaneDemandSchema.safeParse(value.demand).success ||
         !isCommit(value.baseline_commit) ||
         !Array.isArray(value.finding_ids) ||
         !value.finding_ids.every((entry) => typeof entry === "string") ||
@@ -832,12 +907,17 @@ function parseResult(value, runId, workItem, root) {
             typeof value.outcome.status !== "string") {
             return invalidResult("result_envelope", "decision must match the exact current run, work-item, and prompt binding");
         }
-        if (!resultIdentityIsBound(value, {
+        // The identity walk AND its vocabulary are the CORE's, so this refusal
+        // names the same broken component the audit draw names for the same
+        // submission — the shared sentence is appended to this draw's framing,
+        // which addresses a host repairing a remediation decision.
+        const decisionIdentityFailure = identityFailureDiagnostic(value, {
             runId,
             workItemId: workItem.id,
             promptSha256: workItem.prompt.sha256,
-        })) {
-            return invalidResult("identity_binding", "decision must match the exact current run, work-item, and prompt binding");
+        });
+        if (decisionIdentityFailure !== null) {
+            return invalidResult("identity_binding", `decision must match the exact current run, work-item, and prompt binding: ${decisionIdentityFailure}`);
         }
         const outcome = value.outcome;
         if (outcome.status === "resolved_no_change") {
@@ -892,12 +972,18 @@ function parseResult(value, runId, workItem, root) {
         value.contract_version !== RESULT_CONTRACT_VERSION) {
         return invalidResult("result_envelope", "result must match the exact current contract, run, work-item, and prompt binding");
     }
-    if (!resultIdentityIsBound(value, {
+    // The identity walk AND its vocabulary are the CORE's, so the same broken
+    // submission is reported with the same named component whichever half of the
+    // pipeline reads it. Only the framing is this draw's — and the framing is the
+    // part that used to differ, producing two undifferentiated sentences that
+    // named no component at all.
+    const resultIdentityFailure = identityFailureDiagnostic(value, {
         runId,
         workItemId: workItem.id,
         promptSha256: workItem.prompt.sha256,
-    })) {
-        return invalidResult("identity_binding", "result must match the exact current contract, run, work-item, and prompt binding");
+    });
+    if (resultIdentityFailure !== null) {
+        return invalidResult("identity_binding", `result must match the exact current contract, run, work-item, and prompt binding: ${resultIdentityFailure}`);
     }
     const changedFiles = stringArray(value.changed_files);
     if (!changedFiles ||
@@ -1016,9 +1102,29 @@ async function gitCommitIsAncestor(root, ancestor, descendant) {
  * So orphanhood is the CONJUNCTION of two probes: `git for-each-ref --contains`
  * lists every branch/tag/remote ref whose history contains the commit (empty
  * output = no live ref keeps it), and the HEAD ancestry check rides alongside
- * it because a detached HEAD is not a ref `for-each-ref` enumerates and would
- * otherwise scan clean. A failed scan is not evidence of orphanhood — it fails
- * closed, so a git that cannot answer never unlocks the relaxation.
+ * it.
+ *
+ * A THIRD source of reachability sits outside `for-each-ref` entirely: the
+ * HEADs of this repository's OTHER worktrees, checked into no ref at all. In a
+ * linked worktree git DETACHES HEAD (or parks a per-worktree branch), so a
+ * baseline that is the live HEAD of a sibling worktree — exactly the state a
+ * parallel remediation lane is in — would be reported as contained by nothing,
+ * i.e. orphaned, and the relaxation would be handed out for a commit the
+ * repository is actively keeping. `git worktree list --porcelain` enumerates
+ * every worktree with its current HEAD, so it is read and compared. The linked
+ * worktree's own HEAD is included by this probe, which is why the ordinary
+ * detached-HEAD case needs no separate arm.
+ *
+ * RESIDUAL, deliberately not closed: that probe compares HEAD for EQUALITY, so
+ * it covers a worktree detached at the baseline ONLY when its HEAD *is* the
+ * baseline. A sibling worktree detached at a DESCENDANT of the baseline — a
+ * lane that landed further commits on top — keeps the baseline reachable while
+ * matching no ref and no worktree HEAD, and is still reported orphaned. Closing
+ * it means an ancestry probe per enumerated worktree HEAD; the residual is
+ * stated here rather than left as an implied full cover.
+ *
+ * A failed scan is not evidence of orphanhood — any probe that cannot answer
+ * fails closed, so a git that cannot answer never unlocks the relaxation.
  */
 async function gitCommitIsOrphaned(root, commit) {
     if (await gitCommitIsAncestor(root, commit, "HEAD"))
@@ -1026,7 +1132,18 @@ async function gitCommitIsOrphaned(root, commit) {
     const result = await runTrackedAsync(["git", "for-each-ref", "--contains", commit, "--format=%(refname)"], { cwd: root, encoding: "utf8", timeout: TRACKED_CHILD_DEADLINE_MS });
     if (result.error || result.status !== 0)
         return false;
-    return result.stdout.trim().length === 0;
+    if (result.stdout.trim().length > 0)
+        return false;
+    // Reached only when no REF keeps the commit. Every worktree HEAD is then
+    // checked, so the detached (and per-worktree-branch) HEADs git does not
+    // enumerate as refs are still seen.
+    const worktrees = await runTrackedAsync(["git", "worktree", "list", "--porcelain"], { cwd: root, encoding: "utf8", timeout: TRACKED_CHILD_DEADLINE_MS });
+    if (worktrees.error || worktrees.status !== 0)
+        return false;
+    return !worktrees.stdout
+        .split("\n")
+        .filter((line) => line.startsWith("HEAD "))
+        .some((line) => line.slice("HEAD ".length).trim() === commit);
 }
 async function gitChangedFilesOfCommit(root, commit) {
     const result = await runTrackedAsync([
@@ -1174,6 +1291,84 @@ async function corroborateNoChangeClaim(params) {
     }
     return { ok: true };
 }
+/**
+ * The MINTED verdict table: a Map subclass that exists only inside this module.
+ *
+ * The type above says "a table of verdicts"; it cannot say "a table produced by
+ * actually running the tests". A plain-JS caller at the package boundary — or a
+ * `as unknown as` cast — can hand the ingest a hand-built map in which every
+ * command reads `null`, i.e. green, without spawning anything. So the trust the
+ * ingest needs is a RUNTIME property, and a module-private subclass is exactly
+ * that: {@link precomputeRecoveryTestVerdicts} is the only code that can produce
+ * one, and because the class is never exported, no other module can construct or
+ * subclass it. A caller that wants a trusted table can still get one — by
+ * calling the minter, which runs the tests, which is the whole point.
+ */
+class MintedRequiredTestVerdicts extends Map {
+}
+/** Whether a caller-supplied verdict table came from {@link precomputeRecoveryTestVerdicts}. */
+function isMintedVerdictTable(value) {
+    return value instanceof MintedRequiredTestVerdicts;
+}
+/**
+ * The FRONTIER a recovery verdict table describes, as a comparable identity.
+ *
+ * The recovery verb splits into an unlocked phase that runs the required tests
+ * and a locked phase that ingests their verdicts, and it used to bind the two
+ * by HEAD alone. HEAD says the TREE has not moved; it says nothing about whether
+ * the RUN's own state changed underneath those unlocked spawns — and a
+ * concurrent state writer can settle items without touching a single commit.
+ * The verdict table phase 1 computed is keyed on which findings were PENDING
+ * (`precomputeRecoveryTestVerdicts` filters on exactly that), so once the
+ * frontier moves, a command the table no longer covers reads as
+ * `required_test_failed` — a bookkeeping race reported as the host's work being
+ * wrong. Both halves of the comparison degrade safely: a mismatch refuses.
+ *
+ * So the identity carries three things, and each catches a writer the others
+ * cannot:
+ *
+ *  - the binding record's own parts (run, baseline, workload digest, item ids),
+ *    which the ordinary workload-integrity check would also catch — kept here so
+ *    this guard is the one place that says "the frontier moved";
+ *  - the sorted set of work items with at least one still-PENDING finding, which
+ *    is what the verdict table is actually keyed on. This is the residual's real
+ *    shape, and no digest in the state tracks it.
+ *
+ * `null` means "no binding", which is itself a distinct identity: a phase-1
+ * snapshot with no handoff and a phase-2 read that grew one describe different
+ * runs.
+ */
+export function workloadBindingIdentity(state) {
+    const record = state.host_handoff;
+    if (!record)
+        return null;
+    const pendingWorkItemIds = unresolvedFrontierWorkItemIds(state, record);
+    return JSON.stringify([
+        record.run_id,
+        record.baseline_commit,
+        record.workload_sha256,
+        [...record.work_item_ids].sort(compareCodeUnits),
+        pendingWorkItemIds,
+    ]);
+}
+/**
+ * The bound work item ids with at least one finding still `pending`, sorted.
+ *
+ * Derived from the STATE alone — the workload document is not read, because the
+ * caller may be comparing a snapshot whose workload file is no longer on disk
+ * (which is one of the situations this guard exists to refuse). A finding with
+ * no item record is NOT counted: the state is corrupt in that case, and the
+ * ingest's own parse refuses it with a better message than this guard could.
+ */
+function unresolvedFrontierWorkItemIds(state, record) {
+    const items = state.items;
+    const pendingBlockIds = new Set(Object.values(items)
+        .filter((item) => item?.status === "pending")
+        .map((item) => item.block_id));
+    return [...record.work_item_ids]
+        .filter((id) => pendingBlockIds.has(id))
+        .sort(compareCodeUnits);
+}
 /**
  * Per-command deadline. A required test is host-authored and may legitimately be
  * a full suite, so the bound is generous; what changed is that hitting it is now
@@ -1186,6 +1381,24 @@ const REQUIRED_TEST_TIMEOUT_MS = 10 * 60 * 1_000;
  * into every rendered issue.
  */
 const CAPTURED_OUTPUT_LIMIT = 4_000;
+/**
+ * The bound on the MESSAGE a required-test failure produces.
+ *
+ * `CAPTURED_OUTPUT_LIMIT` bounds one STREAM; the message is a different thing —
+ * `requiredTestIssue` joins every failing command, and a work item may bind any
+ * number of them, so the rendered message grew with the number of failures. A
+ * message is a HOST-FACING delivery (it is rendered into the step prompt an
+ * operator reads), so its size cannot be a function of how many commands
+ * happened to fail.
+ *
+ * The bound TRUNCATES the excerpt and says so; it never drops the verdict. What
+ * survives at the front is the part that identifies the failure — the command
+ * and its outcome — and the marker tells the operator the rest was elided and
+ * where to look instead.
+ */
+export const REQUIRED_TEST_MESSAGE_LIMIT = 8_000;
+/** The marker that names an elided excerpt, so truncation is never silent. */
+const REQUIRED_TEST_TRUNCATION_MARKER = "… [excerpt truncated — re-run the command to see the full output]";
 /**
  * The spawn's raw capture buffer. Exceeding it does not truncate — node KILLS
  * the child — so the cap is a named constant the `output_overflow` message can
@@ -1363,6 +1576,13 @@ verdicts) {
  * `required_test_failed`.
  */
 function requiredTestIssue(workItem, failures) {
+    // Bounded at the point the message is BUILT, not left to the caller: the
+    // failure count is a property of the work item's bound commands, so bounding
+    // anywhere downstream would still have carried an unbounded string through
+    // state and into the ledger. See REQUIRED_TEST_MESSAGE_LIMIT.
+    const body = `mechanical required-test rerun failed: ${failures
+        .map(describeRequiredTestFailure)
+        .join("; ")}`;
     return {
         code: failures.some((failure) => failure.outcome === "timed_out")
             ? "required_test_timed_out"
@@ -1372,11 +1592,22 @@ function requiredTestIssue(workItem, failures) {
         check: "test_evidence",
         work_item_id: workItem.id,
         result_path: workItem.result_path,
-        message: `mechanical required-test rerun failed: ${failures
-            .map(describeRequiredTestFailure)
-            .join("; ")}`,
+        message: boundRequiredTestMessage(body),
     };
 }
+/**
+ * Truncate a required-test failure message to {@link REQUIRED_TEST_MESSAGE_LIMIT},
+ * marking the elision. The head is kept because it is what identifies the
+ * failure — the command and its classified outcome — and the marker replaces
+ * the tail rather than being appended past the cap, so the result is bounded by
+ * construction.
+ */
+function boundRequiredTestMessage(message) {
+    if (message.length <= REQUIRED_TEST_MESSAGE_LIMIT)
+        return message;
+    const room = REQUIRED_TEST_MESSAGE_LIMIT - REQUIRED_TEST_TRUNCATION_MARKER.length;
+    return `${message.slice(0, room)}${REQUIRED_TEST_TRUNCATION_MARKER}`;
+}
 /**
  * Run every required-test command a recovery ingest could need, ONCE each, and
  * return the finished verdict table. Call this OUTSIDE the state lock — that is
@@ -1393,7 +1624,7 @@ export async function precomputeRecoveryTestVerdicts(params) {
     if (!state)
         return "unsupported_retired_state";
     const paths = resolveBoundaryPaths(params);
-    const verdicts = new Map();
+    const verdicts = new MintedRequiredTestVerdicts();
     const workloadRead = await readSubmissionDocument(paths.workloadPath);
     if (workloadRead.kind !== "value")
         return verdicts;
@@ -1415,7 +1646,7 @@ export async function precomputeRecoveryTestVerdicts(params) {
         }
     }
     for (const command of commands) {
-        verdicts.set(requiredTestVerdictKey(paths.root, command), await runRequiredTest(paths.root, command));
+        verdicts.set(requiredTestVerdictKey(paths.root, command), await runRequiredTest(paths.root, command, params.requiredTestTimeoutMs));
     }
     return verdicts;
 }
@@ -1625,6 +1856,16 @@ export async function ingestRemediationHostResults(params) {
     const state = parseCurrentState(params.state);
     if (!state)
         return "unsupported_retired_state";
+    // The verdict table is the ONE input whose validity the type system cannot
+    // check: a hand-built map of all-green verdicts asserts tests ran that never
+    // did. Refuse it up front — before any ledger append, any git probe, and any
+    // acceptance — rather than letting the per-item loop read a fabricated table
+    // as evidence. See MintedRequiredTestVerdicts.
+    if (params.recovery !== undefined &&
+        !isMintedVerdictTable(params.recovery.requiredTestVerdicts)) {
+        throw new Error("recovery.requiredTestVerdicts must come from precomputeRecoveryTestVerdicts: " +
+            "a caller-supplied verdict table asserts required tests ran that no runner produced");
+    }
     const paths = resolveBoundaryPaths(params);
     const nextState = structuredClone(state);
     const validated = await validateHostResultBundle({
@@ -1641,6 +1882,7 @@ export async function ingestRemediationHostResults(params) {
     const acc = {
         issues: validated.issues,
         completed: [],
+        workItemOutcomes: new Map(),
         resultIds: new Set(),
         landedFiles: new Set(nextState.applied_edit_surface ?? []),
         settledFindingIds: new Set(),
@@ -1697,6 +1939,7 @@ async function validateHostResultBundle(input) {
                 completed_work_item_ids: [],
                 pending_work_item_ids: state.host_handoff?.work_item_ids ?? [],
                 issues,
+                work_item_outcomes: new Map(),
                 state_changed: false,
                 state: nextState,
             },
@@ -1729,6 +1972,7 @@ async function validateHostResultBundle(input) {
                 completed_work_item_ids: [],
                 pending_work_item_ids: [],
                 issues,
+                work_item_outcomes: new Map(),
                 state_changed: false,
                 state: nextState,
             },
@@ -1751,6 +1995,7 @@ async function validateHostResultBundle(input) {
                 completed_work_item_ids: [],
                 pending_work_item_ids: state.host_handoff?.work_item_ids ?? [],
                 issues,
+                work_item_outcomes: new Map(),
                 state_changed: false,
                 state: nextState,
             },
@@ -1788,6 +2033,23 @@ async function validateHostResultBundle(input) {
  * for a recovery acceptance still goes down before that item's verdict is
  * emitted, so no acceptance can outrun its record.
  */
+/**
+ * Did a corroborated commit already land for this work item, even though no
+ * result file is at its bound path?
+ *
+ * Ground truth, not a claim: `host_landed_commit` is written only after
+ * `corroborateHostResult` verified the commit resolves, is reachable from HEAD,
+ * and that its mechanically derived diff equals the result's `changed_files`
+ * within the item's write scope. Anything less is not a landing.
+ *
+ * ANY finding of the item counts, because the commit is attributed per FINDING
+ * and a work item is a bundle of them: a commit for one of its findings is work
+ * this item did, which is exactly what the host needs to know before rewriting
+ * the result from scratch.
+ */
+function hasLandedCommitFor(state, workItem) {
+    return workItem.finding_ids.some((findingId) => typeof state.items[findingId]?.host_landed_commit === "string");
+}
 async function executeHostVerificationReruns(ctx, acc) {
     const { paths, nextState, state } = ctx;
     const verdicts = [];
@@ -1822,6 +2084,23 @@ async function executeHostVerificationReruns(ctx, acc) {
         });
         if (!scan.ok) {
             acc.issues.push(scan.issue);
+            // A refusal is a REFUSAL — unless the refusal is "nothing is there", in
+            // which case it says nothing about whether the host did the work. The run
+            // holds a CORROBORATED commit for a settled item (see
+            // `RemediationItemState.host_landed_commit`), and an item whose edits
+            // landed but whose result is missing is PARTIAL PROGRESS the host must be
+            // told about; it used to disappear as a bare missing-result line.
+            // THREE-WAY, not two. "Nothing is at the bound path" is an OBSERVATION,
+            // and it splits again on whether the run holds a corroborated commit for
+            // this item: with one it is partial progress, without one it is simply
+            // unfinished work. Only a REFUSAL of something that WAS written is
+            // `rejected`. Collapsing the missing half into `rejected` would restore
+            // exactly the conflation this split exists to end.
+            acc.workItemOutcomes.set(workItem.id, !isMissingObservation(scan.issue)
+                ? "rejected"
+                : hasLandedCommitFor(nextState, workItem)
+                    ? "missing_result_with_commit"
+                    : "awaiting_result");
             continue;
         }
         const parsed = scan.parsed;
@@ -1921,13 +2200,12 @@ async function executeHostVerificationReruns(ctx, acc) {
                 // (run, item): an item re-opened and later re-accepted from a
                 // DIFFERENT landing is a different relaxed acceptance and earns its
                 // own record. Only a retry of the SAME landing is a duplicate. The
-                // landed sha is matched inside the message because the shared event
-                // contract carries no commit field, and a 40-hex sha this writer
-                // itself emitted is an unambiguous token to match on.
+                // landed commit is carried on the event as `landed_commit` and read
+                // back through `recoveryMarkMatches` — prose is not an identity, and a
+                // message reworded by any later edit silently un-deduped the mark.
                 const landedCommit = result.commit_evidence.after;
                 const alreadyMarked = acc.recordedRecoveryMarks.some((event) => event.run_id === ctx.runId &&
-                    event.submission_id === workItem.id &&
-                    (event.message ?? "").includes(landedCommit));
+                    recoveryMarkMatches(event, workItem.id, landedCommit));
                 if (!alreadyMarked) {
                     const event = {
                         contract_version: SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION,
@@ -1935,6 +2213,10 @@ async function executeHostVerificationReruns(ctx, acc) {
                         submission_id: workItem.id,
                         lane: workItem.id,
                         kind: "accepted_via_recovery",
+                        // The structured half of this event's identity, beside the prose
+                        // that narrates it. `recoveryMarkMatches` reads THIS, never the
+                        // message below.
+                        landed_commit: landedCommit,
                         // Derived from what was actually probed, never asserted: the
                         // baseline was found in no ref and unreachable from HEAD.
                         message: `accepted under recovery: the trusted baseline ${workItem.baseline_commit} is ` +
@@ -1965,6 +2247,8 @@ async function executeHostVerificationReruns(ctx, acc) {
             workItem,
             pendingItems,
             at: new Date().toISOString(),
+            landedCommit: result.commit_evidence.after,
+            changedFiles: corroborated.changedFiles,
         });
         for (const changedFile of corroborated.changedFiles) {
             acc.landedFiles.add(changedFile);
@@ -2024,6 +2308,13 @@ function commitRemediationStateUpdates(ctx, acc, verdicts, issues) {
             item.status = "resolved";
             item.started_at ??= verdict.at;
             item.completed_at = verdict.at;
+            // The corroborated outcome is PERSISTED per item, not just folded into the
+            // run-wide `applied_edit_surface`, so the attribution survives the process
+            // that observed it — and read back by `hasLandedCommitFor` on the next
+            // ingest, which is how an item whose edits landed but whose result file
+            // never arrived is told apart from one that was never attempted.
+            item.host_landed_commit = verdict.landedCommit;
+            item.host_landed_files = [...verdict.changedFiles];
             delete item.failure_reason;
             delete item.host_result_evidence;
         }
@@ -2040,11 +2331,20 @@ function commitRemediationStateUpdates(ctx, acc, verdicts, issues) {
         delete nextState.host_handoff;
         stateChanged = true;
     }
+    // Every remaining work item is `awaiting_result` unless the verify loop
+    // already classified it: an item the loop never reached (a sibling's refusal
+    // ended the pass early) is still genuinely unread, and "not read" is the
+    // honest answer there — never a claim that something was refused.
+    const workItemOutcomes = new Map();
+    for (const workItem of ctx.effectiveWorkload.work_items) {
+        workItemOutcomes.set(workItem.id, acc.workItemOutcomes.get(workItem.id) ?? "awaiting_result");
+    }
     return {
         accepted_count: acc.completed.length,
         completed_work_item_ids: acc.completed,
         pending_work_item_ids: pendingWorkItemIds,
         issues,
+        work_item_outcomes: workItemOutcomes,
         state_changed: stateChanged,
         state: nextState,
     };