balladeer 1.0.18 → 1.0.20

package/dist/commands/judge.js

@@ -1,13 +1,21 @@
-import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { createHash } from "node:crypto";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { BEHAVIOR_MAP_DIRECTORY, CASE_ID, PROMISE_ID, parseBehaviorMap, } from "../behavior-map-schema.js";
 import { runCommand } from "../gh.js";
 import { repositoryRoot } from "../git.js";
 import { agentEnvironment, resolveClient, runHeadlessAgent, JUDGE_ACTIVE_VARIABLE, } from "../headless-agent.js";
 import { JUDGE_BRIEF_REVISION, judgePrompt } from "../judge-brief.js";
-import { baseBeforePush, checkoutRoot, commitBeforePush, effectiveBudgetSeconds, hasJudgeEntry, hasProjectJudgeHook, hookResponse, installJudgeHook, isPushCommand, mergeTargets, parseHookInput, parsePrePushInput, pushCheckOff, pushLanded, pushPlace, remoteRepositoryNames, repositoryName, sendsCommits, setPushCheck, } from "../judge-hook.js";
+import { codeReviewLines, readCodeReview } from "../judge-review.js";
+import { executeFreshReproduction, executeKeptEvidence, freezeEvidenceFiles, reviewExecutedEvidence, } from "../judge-evidence.js";
+import { catalogReaders, connectionReviewsClient, } from "../promise-review-client.js";
+import { reviewBackstop } from "../review-backstop.js";
+import { targetedRiskCandidates } from "../review-selection.js";
+import { capturePushOperation, consumePushOperation, } from "../push-operation.js";
+import { checkoutRoot, commitBeforePush, effectiveBudgetSeconds, hasJudgeEntry, hasProjectJudgeHook, hookResponse, installJudgeHook, isPushCommand, mergeTargets, parseHookInput, parsePrePushInput, pushCheckOff, pushPlace, remoteRepositoryNames, repositoryName, sendsCommits, setPushCheck, } from "../judge-hook.js";
 import { noteHookFired } from "../hook-trust.js";
 import { sessionMemory } from "../judge-said.js";
+import { deliverReviews, reviewPayload } from "../review-reporting.js";
 import { runOwnedProcess, tail } from "../owned-process.js";
 import { caseIds, connectionReader, meaningExcerpt, promiseFromExcerpt, readPromiseFile, sha256Digest, } from "../promise-meaning.js";
 import { addScratchWorktree, carryFiles, newFiles, removeLiveWorktreesNow, resolveCommit, shareDependencies, } from "../scratch-worktree.js";
@@ -15,7 +23,7 @@ import { normalizeControlPlane, StoreError } from "../store.js";
 import { directness, riskOrder } from "../risk/score.js";
 import { CLI_INVOCATION, DEFAULT_CONTROL_PLANE } from "../wire.js";
 import { AGENT_TOOLS, REFUSED_TOOL_RULES, agentFailure, readBehaviorMap, readBehaviorMaps, } from "./map.js";
-import { offersForPush } from "./offers.js";
+import { isRepairChange, offersForPush } from "./offers.js";
 /**
  * `balladeer judge`: for a change about to leave this machine, ask the person's
  * own coding agent, one promise at a time, whether the change keeps it.
@@ -275,7 +283,20 @@ export function keepReproduction(input) {
         judgeLogDirectory(input.root);
         rmSync(staging, { recursive: true, force: true });
         mkdirSync(staging, { recursive: true });
-        const kept = carryFiles(input.headTree, join(staging, "files"), input.files);
+        const kept = input.frozenFiles === undefined
+            ? carryFiles(input.headTree, join(staging, "files"), input.files)
+            : input.frozenFiles.map((file) => {
+                const destination = insideDirectory(join(staging, "files"), file.path);
+                if (destination === undefined ||
+                    createHash("sha256").update(file.bytes).digest("hex") !== file.sha256)
+                    throw new Error("Frozen evidence validation failed");
+                mkdirSync(dirname(destination), { recursive: true });
+                writeFileSync(destination, file.bytes, { flag: "wx" });
+                return { path: file.path, sha256: file.sha256 };
+            });
+        if (input.frozenFiles !== undefined &&
+            sha256Digest({ command: input.command, cwd: input.cwd, files: kept }) !== input.digest)
+            throw new Error("Stored evidence does not match executed evidence");
         const manifest = {
             schemaVersion: KEPT_REPRODUCTION_SCHEMA_VERSION,
             promiseId: input.promiseId,
@@ -336,6 +357,11 @@ export function readJudgeAnswer(json) {
     const verdict = json.verdict;
     if (verdict !== "kept" && verdict !== "broken" && verdict !== "could_not_tell")
         return undefined;
+    if (verdict !== "could_not_tell" &&
+        (!Array.isArray(json.evidenceFiles) ||
+            json.evidenceFiles.length > 200 ||
+            !json.evidenceFiles.every((file) => typeof file === "string")))
+        return undefined;
     const raw = json.reproduction;
     const reproduction = raw !== null &&
         typeof raw === "object" &&
@@ -357,7 +383,27 @@ export function readJudgeAnswer(json) {
         ...(reproduction === undefined ? {} : { reproduction }),
         exercisedCases,
         notes: typeof json.notes === "string" ? json.notes.slice(0, 2000) : "",
+        ...(readCodeReview(json.review) === undefined ? {} : { review: readCodeReview(json.review) }),
         ...(nextStep === "" ? {} : { nextStep }),
+        evidenceFiles: Array.isArray(json.evidenceFiles) &&
+            json.evidenceFiles.every((file) => typeof file === "string")
+            ? json.evidenceFiles
+            : [],
+        caseEvidence: Array.isArray(json.caseEvidence)
+            ? json.caseEvidence.flatMap((row) => {
+                if (row === null || typeof row !== "object")
+                    return [];
+                const item = row;
+                return typeof item.command === "string" &&
+                    item.command.trim() !== "" &&
+                    item.command.length <= 2000 &&
+                    typeof item.cwd === "string" &&
+                    Array.isArray(item.caseIds) &&
+                    item.caseIds.every((id) => typeof id === "string" && CASE_ID.test(id))
+                    ? [{ command: item.command, cwd: item.cwd, caseIds: item.caseIds }]
+                    : [];
+            })
+            : [],
     };
 }
 /**
@@ -369,40 +415,56 @@ export function readJudgeAnswer(json) {
  */
 export async function judgePromise(input) {
     const timeoutMs = input.timeoutMs ?? JUDGE_CAP_MS;
+    const deadline = Date.now() + timeoutMs;
+    const ownBudget = new AbortController();
+    const signal = input.signal === undefined
+        ? ownBudget.signal
+        : AbortSignal.any([input.signal, ownBudget.signal]);
+    const timer = setTimeout(() => ownBudget.abort(), timeoutMs);
+    const remaining = () => Math.max(1, deadline - Date.now());
     const tree = await addScratchWorktree(input.root, input.head, `judge-${input.promise.promiseId}`, input.scratch);
-    if (!tree.ok)
+    if (!tree.ok) {
+        clearTimeout(timer);
         return { status: "not_judged", reason: tree.reason };
+    }
     const headTree = tree.worktree;
     try {
         await shareDependencies(input.root, headTree.path);
         let linkedTestRun = { file: "", outcome: "none" };
         const linkedTestRuns = [];
-        const firstTest = input.map !== undefined ? input.map.linkedTests[0] : input.anchors?.linkedTests[0];
-        if (firstTest !== undefined) {
-            const command = linkedTestCommand(headTree.path, firstTest.file);
-            if (command === undefined)
-                linkedTestRun = { file: firstTest.file, outcome: "none" };
-            else {
+        const linkedTests = input.map?.linkedTests ?? input.anchors?.linkedTests ?? [];
+        // Linked checks provide a baseline, but must leave time for the model's
+        // actual review. The agent can run additional checks when they resolve a question.
+        const linkedDeadline = Date.now() + Math.min(30_000, remaining() * 0.1);
+        const seenTests = new Set();
+        for (const test of linkedTests) {
+            if (Date.now() >= linkedDeadline)
+                break;
+            if (seenTests.has(test.file))
+                continue;
+            seenTests.add(test.file);
+            const command = linkedTestCommand(headTree.path, test.file);
+            let outcome = "none";
+            let output = "";
+            if (command !== undefined) {
                 const run = await runShell(command, headTree.path, {
                     env: input.env,
-                    timeoutMs: Math.min(LINKED_TEST_TIMEOUT_MS, timeoutMs),
-                    ...(input.signal === undefined ? {} : { signal: input.signal }),
+                    timeoutMs: Math.max(1, Math.min(LINKED_TEST_TIMEOUT_MS, linkedDeadline - Date.now())),
+                    signal,
                 });
                 if (run.aborted)
                     return { status: "stopped" };
-                const outcome = run.timedOut || run.exitCode === null || run.exitCode === 127
-                    ? "error"
-                    : run.exitCode === 0
-                        ? "pass"
-                        : "fail";
-                linkedTestRun = { file: firstTest.file, outcome };
-                linkedTestRuns.push({
-                    file: firstTest.file,
-                    command,
-                    outcome,
-                    output: tail(run.output, 800),
-                });
+                outcome =
+                    run.timedOut || run.exitCode === null || run.exitCode === 127
+                        ? "error"
+                        : run.exitCode === 0
+                            ? "pass"
+                            : "fail";
+                output = tail(run.output, 800);
             }
+            if (seenTests.size === 1)
+                linkedTestRun = { file: test.file, outcome };
+            linkedTestRuns.push({ file: test.file, command: command ?? "", outcome, output });
         }
         const agent = await (input.runAgent ?? runHeadlessAgent)({
             client: input.login.client,
@@ -418,15 +480,15 @@ export async function judgePromise(input) {
                 base: input.base,
                 head: input.head,
                 linkedTestRuns,
-                minutes: Math.max(1, Math.floor(timeoutMs / 60_000)),
+                minutes: Math.max(0.01, Math.round((remaining() / 60_000) * 100) / 100),
             }),
             allowedTools: AGENT_TOOLS,
             disallowedTools: REFUSED_TOOL_RULES,
             sandbox: "workspace-write",
-            timeoutMs,
+            timeoutMs: remaining(),
             env: input.env,
             jsonOutput: true,
-            ...(input.signal === undefined ? {} : { signal: input.signal }),
+            signal,
             ...(input.scratch === undefined ? {} : { scratch: input.scratch }),
         });
         if (agent.aborted)
@@ -440,6 +502,7 @@ export async function judgePromise(input) {
             inputTokens: agent.inputTokens ?? 0,
             outputTokens: agent.outputTokens ?? 0,
         };
+        const answer = agent.ok ? readJudgeAnswer(agent.json) : undefined;
         const verdict = (fields) => ({
             schemaVersion: JUDGE_VERDICT_SCHEMA_VERSION,
             promiseId: input.promise.promiseId,
@@ -451,14 +514,15 @@ export async function judgePromise(input) {
             reproductionRejected: null,
             exercisedCases: [],
             notes: "",
+            ...(answer?.review === undefined ? {} : { review: answer.review }),
             judge,
             briefRevision: JUDGE_BRIEF_REVISION,
             mapUsed: input.map !== undefined,
             anchorsUsed: input.map === undefined && input.anchors !== undefined,
             linkedTestRun,
+            ...(input.promise.standing === undefined ? {} : { standing: input.promise.standing }),
             ...fields,
         });
-        const answer = agent.ok ? readJudgeAnswer(agent.json) : undefined;
         if (answer === undefined)
             return {
                 status: "judged",
@@ -466,22 +530,82 @@ export async function judgePromise(input) {
                     notes: agent.ok ? "the judge's answer was not a verdict" : agentFailure(agent),
                 }),
             };
+        if (answer.verdict !== "could_not_tell" && answer.review === undefined)
+            return {
+                status: "judged",
+                verdict: verdict({
+                    notes: `The judge did not provide a code review grounded in inspected files. ${answer.notes}`.trim(),
+                }),
+            };
+        const frozen = await freezeEvidenceFiles(headTree.path, answer.evidenceFiles);
+        if (!frozen.ok)
+            return {
+                status: "judged",
+                verdict: verdict({ notes: `Evidence was refused: ${frozen.reason}.` }),
+            };
+        const evidenceInput = {
+            root: input.root,
+            sourceTree: headTree.path,
+            head: input.head,
+            manifest: frozen.manifest,
+            env: input.env,
+            timeoutMs: Math.min(REPRODUCTION_TIMEOUT_MS, remaining()),
+            signal,
+            ...(input.scratch === undefined ? {} : { scratch: input.scratch }),
+        };
+        const boundedReceipts = (receipts) => receipts.map(({ output: _output, ...receipt }) => receipt);
+        const review = async (claim, receipts) => reviewExecutedEvidence({
+            ...evidenceInput,
+            timeoutMs: Math.min(120_000, remaining()),
+            promise: input.promise,
+            base: input.base,
+            claim,
+            ...(answer.review === undefined ? {} : { review: answer.review }),
+            receipts,
+            login: input.login,
+            ...(input.runAgent === undefined ? {} : { runAgent: input.runAgent }),
+        });
         if (answer.verdict === "kept") {
-            const missing = caseIds(input.promise).passing.filter((id) => !answer.exercisedCases.includes(id));
-            if (missing.length > 0)
+            const executed = await executeKeptEvidence({
+                ...evidenceInput,
+                caseEvidence: answer.caseEvidence,
+                passingCaseIds: caseIds(input.promise).passing,
+            });
+            if (executed.stopped)
+                return { status: "stopped" };
+            if (executed.rejected !== null)
                 return {
                     status: "judged",
                     verdict: verdict({
-                        exercisedCases: answer.exercisedCases,
-                        notes: `The judge answered kept without exercising ${missing.join(", ")}. ${answer.notes}`.trim(),
+                        notes: `The judge's kept evidence was not established: ${executed.rejected}. ${answer.notes}`.trim(),
+                        evidenceReceipts: boundedReceipts(executed.receipts),
                     }),
                 };
+            const assessed = await review("kept", executed.receipts);
+            if (assessed.stopped)
+                return { status: "stopped" };
             return {
                 status: "judged",
                 verdict: verdict({
-                    verdict: "kept",
-                    exercisedCases: answer.exercisedCases,
-                    notes: answer.notes,
+                    verdict: assessed.accepted ? "kept" : "could_not_tell",
+                    exercisedCases: assessed.accepted
+                        ? [...new Set(executed.receipts.flatMap((receipt) => receipt.caseIds))]
+                        : [],
+                    evidenceReceipts: boundedReceipts(executed.receipts),
+                    independentReview: {
+                        accepted: assessed.accepted,
+                        reason: assessed.reason,
+                        ...(assessed.agent === undefined
+                            ? {}
+                            : {
+                                durationMs: assessed.agent.durationMs,
+                                inputTokens: assessed.agent.inputTokens ?? 0,
+                                outputTokens: assessed.agent.outputTokens ?? 0,
+                            }),
+                    },
+                    notes: assessed.accepted
+                        ? answer.notes
+                        : `The independent evidence review could not establish kept: ${assessed.reason}.`,
                 }),
             };
         }
@@ -499,19 +623,24 @@ export async function judgePromise(input) {
                         : {}),
                 }),
             };
-        const check = await verifyReproduction({
-            root: input.root,
-            headTree: headTree.path,
-            head: input.head,
+        const executed = await executeFreshReproduction({
+            ...evidenceInput,
             base: input.base,
             command: answer.reproduction.command,
             cwd: answer.reproduction.cwd,
-            env: input.env,
-            ...(input.signal === undefined ? {} : { signal: input.signal }),
-            ...(input.scratch === undefined ? {} : { scratch: input.scratch }),
         });
-        if (check.stopped)
+        if (executed.stopped)
+            return { status: "stopped" };
+        const assessed = executed.rejected === null ? await review("broken", executed.receipts) : undefined;
+        if (assessed?.stopped)
             return { status: "stopped" };
+        const check = {
+            ...executed,
+            rejected: executed.rejected ??
+                (assessed?.accepted === true
+                    ? null
+                    : `independent evidence review rejected the claim: ${assessed?.reason ?? "no assessment"}`),
+        };
         // Only a break that held up both ways is worth keeping: it is the start
         // of a lasting test, and a rejected one would be the start of a wrong one.
         const kept = check.rejected === null && check.failsOnHead && check.passesOnBase
@@ -526,6 +655,7 @@ export async function judgePromise(input) {
                 cwd: answer.reproduction.cwd,
                 digest: check.digest,
                 files: check.files,
+                frozenFiles: frozen.manifest.files,
             })
             : undefined;
         const reproduction = {
@@ -542,36 +672,60 @@ export async function judgePromise(input) {
                 verdict: check.rejected === null ? "broken" : "could_not_tell",
                 reproduction,
                 reproductionRejected: check.rejected,
+                evidenceReceipts: boundedReceipts(check.receipts),
+                ...(assessed === undefined
+                    ? {}
+                    : {
+                        independentReview: {
+                            accepted: assessed.accepted,
+                            reason: assessed.reason,
+                            ...(assessed.agent === undefined
+                                ? {}
+                                : {
+                                    durationMs: assessed.agent.durationMs,
+                                    inputTokens: assessed.agent.inputTokens ?? 0,
+                                    outputTokens: assessed.agent.outputTokens ?? 0,
+                                }),
+                        },
+                    }),
                 exercisedCases: answer.exercisedCases,
                 notes: answer.notes,
             }),
         };
     }
     finally {
+        clearTimeout(timer);
         await headTree.remove();
     }
 }
 export const JUDGE_USAGE = `  ${CLI_INVOCATION} judge [--promises <id,id>] [--top <k>] [--base <ref>] [--head <ref>]
-                  [--report-only | --block] [--wait] [--json] [--client auto|claude|codex]
+                  [--report-only | --block] [--wait] [--retry] [--json] [--client auto|claude|codex]
                   [--from-file <promise.json> [--map <map.json>]]
                   [--hook claude|codex|git] [--install-hook [claude|codex|git]]
                   [--push-check on|off]
       Judge whether this change keeps the promises it could break, one promise
-      at a time, on your own Claude Code or Codex login. A break counts only
+      at a time, on your own Claude Code or Codex login. Recorded meaning is
+      advisory and never blocks. Kept requires executable passing-case evidence
+      and a fresh agent assessment. A break counts only
       with a command that fails with the change and passes without it, and
-      this command runs it both ways itself; anything unproven is "could not
+      this command runs it in fresh checkouts and a second local agent checks
+      that its assertion actually expresses the promise; anything unproven is "could not
       tell". Report mode prints one line per promise and never stops anything;
       --block exits 2 on a reproduced break, and when judges are still running
       at the time limit it holds the push rather than letting it through.
       --wait runs without the time limit. Promises come from --promises, else
-      every agreed promise whose anchored code the change edits, and every
+      every visible recorded or agreed promise whose anchored code the change edits, and every
       promise with a behavior map whose own code or tests it edits (with
       "select": "ranked" in .continuity/judge.json, the top of the maps'
       ranking and a small random sample); plus that file's alwaysJudge. A
+      remaining current promise receives a bounded local relevance reading; strong
+      resource, sink and intent signals can add a promise beyond direct files. A
       promise with no anchors yet is anchored first, by one small call on
       your own login (see \`balladeer anchor\`), at most 20 a day on this
       laptop, and a line says what that cost. Verdicts are kept in
-      .continuity/judge-log/, which git ignores. --install-hook adds the push
+      .continuity/judge-log/, which git ignores. Coverage and pending work are
+      logged separately; --retry retries an inconclusive result. A known pushed
+      branch also sends a bounded receipt to Balladeer, with no source or logs. --install-hook adds the push
       hook to .claude/settings.json and .codex/hooks.json, before and after
       each shell command: report mode judges after a push has landed, so the
       push never waits, and block mode judges before it. With git it writes
@@ -581,7 +735,7 @@ export const JUDGE_USAGE = `  ${CLI_INVOCATION} judge [--promises <id,id>] [--to
       whoever is pushing; it records nothing and never holds a push (see
       \`balladeer offers\`). Setup also writes the same pair of entries at
       each host's user scope, running \`judge --hook <host> --user-scope\`,
-      so the check runs in every connected repository with agreed promises
+      so the check runs in every connected repository with visible promises
       and says nothing anywhere else; a checkout with its own entry keeps
       the check to that entry. --push-check off turns the user-scope check
       off on this laptop, and --push-check on turns it back on.
@@ -595,6 +749,7 @@ export function parseJudgeArguments(argv) {
     let json = false;
     let mode;
     let wait = false;
+    let retry = false;
     let hook;
     let userScope = false;
     let pushCheck;
@@ -649,6 +804,8 @@ export function parseJudgeArguments(argv) {
             mode = "block";
         else if (name === "--wait")
             wait = true;
+        else if (name === "--retry")
+            retry = true;
         else if (name === "--hook")
             hook = host(name, value(name, inline));
         else if (name === "--user-scope")
@@ -697,6 +854,7 @@ export function parseJudgeArguments(argv) {
         json,
         ...(mode === undefined ? {} : { mode }),
         wait,
+        ...(retry ? { retry: true } : {}),
         ...(hook === undefined ? {} : { hook }),
         ...(userScope ? { userScope: true } : {}),
         ...(pushCheck === undefined ? {} : { pushCheck }),
@@ -1004,7 +1162,10 @@ export function findLoggedVerdict(root, key, now) {
                     verdict.semanticDigest === key.semanticDigest &&
                     verdict.base === key.base &&
                     verdict.head === key.head &&
-                    verdict.briefRevision === JUDGE_BRIEF_REVISION)
+                    verdict.briefRevision === JUDGE_BRIEF_REVISION &&
+                    (key.environmentDigest === undefined ||
+                        verdict.environmentDigest === key.environmentDigest) &&
+                    (!key.retry || verdict.verdict !== "could_not_tell"))
                     return verdict;
             }
             catch {
@@ -1014,9 +1175,22 @@ export function findLoggedVerdict(root, key, now) {
     }
     return undefined;
 }
-function sentence(text, limit = 240) {
+/**
+ * A judge's words, shortened to fit one line an agent relays. A cut ends on a
+ * whole sentence, or failing that a whole word, and says where the rest is:
+ * the agent repeats the line as it reads it, so a reason cut mid-word reached
+ * the person mid-word (found 1 October 2026).
+ */
+export function sentence(text, limit = 240) {
     const flat = text.replace(/\s+/g, " ").trim();
-    return flat.length <= limit ? flat : `${flat.slice(0, limit - 3)}...`;
+    if (flat.length <= limit)
+        return flat;
+    const head = flat.slice(0, limit);
+    const end = Math.max(head.lastIndexOf(". "), head.lastIndexOf("? "), head.lastIndexOf("! "));
+    const kept = end >= limit / 3
+        ? head.slice(0, end + 1)
+        : `${head.slice(0, Math.max(head.lastIndexOf(" "), 1)).replace(/[,;:]$/, "")}...`;
+    return `${kept} (The rest is in ${JUDGE_LOG_DIRECTORY}.)`;
 }
 /** Said after "fix the behavior": a deliberate change is the person's, and the promise its owner's. */
 export const DELIBERATE_CHANGE = "If the person changed this behavior on purpose, do not undo their change: tell them it breaks this promise, whose meaning only its owner can change.";
@@ -1084,16 +1258,18 @@ export function stillKept(root, verdict) {
  * carries a second, indented line saying what to do next.
  */
 export function verdictLine(verdict, title, context = {}) {
-    const name = `${title} (${verdict.promiseId})`;
+    const name = `${title} (${verdict.promiseId})${verdict.standing === "recorded" ? " [recorded intent; advisory]" : ""}`;
     const earlier = context.reused ? " [judged earlier for this commit]" : "";
+    const review = codeReviewLines(verdict.review);
+    const reviewSuffix = review ? `\n${review}` : "";
     if (verdict.verdict === "kept")
-        return `kept: ${name}${earlier}`;
+        return `kept: ${name}${earlier}${reviewSuffix}`;
     if (verdict.verdict === "broken") {
         const where = verdict.reproduction && verdict.reproduction.cwd !== "."
             ? ` (in ${verdict.reproduction.cwd})`
             : "";
-        return (`broken: ${name}${earlier}. Reproduce with: ${verdict.reproduction?.command ?? ""}${where}\n` +
-            `    ${afterBreakLine(verdict, context.checkBound)}`);
+        return (`${verdict.standing === "recorded" ? "conflicts with recorded intent" : "broken"}: ${name}${earlier}. Reproduce with: ${verdict.reproduction?.command ?? ""}${where}\n` +
+            `    ${verdict.standing === "recorded" ? "Ask the recorder whether this is still intended, or correct the behavior. Meaning awaits named-human agreement." : afterBreakLine(verdict, context.checkBound)}${reviewSuffix}`);
     }
     const rejected = verdict.reproductionRejected
         ? ` A reported break did not hold up when run both ways: ${verdict.reproductionRejected}.`
@@ -1102,7 +1278,7 @@ export function verdictLine(verdict, title, context = {}) {
     const nextStep = verdict.nextStep?.trim()
         ? ` To let it run: ${sentence(verdict.nextStep, NEXT_STEP_LIMIT)}`
         : "";
-    return `could not tell: ${name}${earlier}.${notes}${rejected}${nextStep}`;
+    return `could not tell: ${name}${earlier}.${notes}${rejected}${nextStep}${reviewSuffix}`;
 }
 /** The head commit of a named pull request, through the person's own `gh`. */
 async function pullRequestHead(root, target) {
@@ -1213,7 +1389,7 @@ export function nothingSelected(input) {
     if (stage?.available && stage.promises.length === 0 && input.maps === 0)
         return {
             reason: "no_promises",
-            message: "This repository has no agreed promise yet, so nothing was judged.",
+            message: "This repository has no visible recorded or agreed promise yet, so nothing was judged.",
         };
     if (input.maps === 0 && input.anchors === 0) {
         if (stage?.available)
@@ -1248,11 +1424,80 @@ export function commitFirstLine(made) {
 }
 export async function runJudge(options) {
     const { args } = options;
+    const manualArgs = { ...args };
+    delete manualArgs.hook;
+    delete manualArgs.userScope;
     const deps = options.deps ?? {};
+    // The catalog path owns versioned receipt delivery, including failures to
+    // read the catalog. Never downgrade it to a second, legacy reporting lane.
+    const usesReviewCatalog = args.fromFile === undefined &&
+        deps.reviews !== null &&
+        (deps.reviews !== undefined || (deps.anchors === undefined && deps.reader === undefined));
     const now = deps.now ?? (() => new Date());
     const hook = args.hook;
     const json = args.json && hook === undefined;
     const lines = [];
+    const deferredOffers = [];
+    const offersForRef = async (root, base, head, config, deadline) => {
+        if (!config.offers || Date.now() >= deadline)
+            return false;
+        const timeoutMs = Math.max(1, Math.min(1000, deadline - Date.now()));
+        const changed = await runCommand("git", ["-C", root, "diff", "--name-only", base, head], {
+            timeoutMs,
+        });
+        if (!changed.ok || changed.stdout.trim() === "")
+            return false;
+        if (config.offersOn === "all")
+            return true;
+        const messages = await runCommand("git", ["-C", root, "log", "--format=%s%x00", `${base}..${head}`], { timeoutMs: Math.max(1, Math.min(1000, deadline - Date.now())) });
+        return messages.ok && isRepairChange(messages.stdout.split("\0").join("\n---\n"));
+    };
+    const childOutputLines = (chunks) => {
+        const output = chunks.join("").trimEnd();
+        return output.length === 0 ? [] : output.split("\n");
+    };
+    const settingsFallback = () => {
+        const message = "Balladeer: app push-review settings are unavailable; using .continuity/judge.json or the defaults (3 concurrent, 240 seconds).";
+        lines.push(message);
+        emit({
+            step: "judge",
+            status: "review_settings_unavailable",
+            reason: "app_settings_unavailable",
+            message,
+            exitCode: 0,
+        });
+    };
+    const operationReviews = async (root) => {
+        let client = deps.reviews ?? undefined;
+        if (deps.reviews === undefined && deps.anchors === undefined && deps.reader === undefined) {
+            const found = connectionReviewsClient({
+                cwd: root,
+                environment: options.environment,
+                controlPlane: args.controlPlane,
+                ...(args.repository === undefined ? {} : { repository: args.repository }),
+            });
+            if (found.ok)
+                client = found.client;
+        }
+        if (client === undefined)
+            return { deps, settings: deps.reviewSettings };
+        const source = client;
+        let catalog;
+        const memo = { ...source, list: () => (catalog ??= source.list()) };
+        const result = await memo.list();
+        const settings = deps.reviewSettings ?? result.reviewSettings;
+        if (settings === undefined && deps.reviewSettingsResolved !== true)
+            settingsFallback();
+        return {
+            settings,
+            deps: {
+                ...deps,
+                reviews: memo,
+                reviewSettingsResolved: true,
+                ...(settings === undefined ? {} : { reviewSettings: settings }),
+            },
+        };
+    };
     const emit = (step) => {
         if (json)
             options.write(`${JSON.stringify(step)}\n`);
@@ -1290,6 +1535,7 @@ export async function runJudge(options) {
     let command;
     // Said after everything else the run has to say, before any offers.
     const trailing = [];
+    let reportingWarning;
     // Set only when the check runs before a line that makes a commit before it
     // pushes (a checkout whose hook predates judging after the push): whatever
     // it says is about the code before that commit, and the answer says so
@@ -1299,11 +1545,19 @@ export async function runJudge(options) {
         if (commitFirst !== undefined)
             lines.unshift(commitFirstLine(commitFirst));
         commitFirst = undefined;
-        const offered = await settleOffers();
+        if (options.deferOffers !== undefined && offerReading !== undefined)
+            options.deferOffers(settleOffers());
+        const offered = [
+            ...(options.deferOffers === undefined ? await settleOffers() : []),
+            ...(await Promise.all(deferredOffers)).flat(),
+        ];
         lines.push(...trailing);
+        if (reportingWarning)
+            lines.push(reportingWarning);
         // Apart from the verdicts, after them, with a line between.
-        if (offered.length > 0)
+        if (offered.length > 0) {
             lines.push(...(lines.length > 0 ? [""] : []), ...offered);
+        }
         const response = hookResponse(hook ?? "git", { block, lines, event });
         if (!json) {
             if (response.stdout)
@@ -1332,14 +1586,68 @@ export async function runJudge(options) {
     // cannot be told for certain, nothing is judged and the answer says so.
     let place;
     // The host's session, so a could-not-tell it already heard comes back quietly.
-    let sessionId;
+    let sessionId = args.pushSessionId;
+    let hookResult;
+    let toolUseId;
+    let shellCwd = cwd;
     if (hook !== undefined) {
         const input = await (deps.stdin ?? (() => readStdin()))();
         if (hook === "git") {
             const refs = parsePrePushInput(input);
             if (refs.length === 0)
                 return 0;
-            pushedHead = refs[0].localSha;
+            const gitRoot = args.repo !== undefined ? resolve(options.cwd, args.repo) : await repositoryRoot(cwd);
+            if (gitRoot === undefined)
+                return 0;
+            const changes = refs.filter((ref) => !/^0+$/.test(ref.localSha));
+            const operationStarted = Date.now();
+            const prepared = changes.length === 0
+                ? { deps, settings: deps.reviewSettings }
+                : await operationReviews(gitRoot);
+            const gitConfig = { ...readJudgeConfig(gitRoot).config, ...prepared.settings };
+            const operationDeadline = args.operationDeadline ??
+                operationStarted + effectiveBudgetSeconds(gitConfig.budgetSeconds, true) * 1000;
+            let blocked = false;
+            let offersStarted = false;
+            for (const ref of changes) {
+                if (Date.now() >= operationDeadline) {
+                    lines.push(`Balladeer: ${ref.remoteRef}: review budget exhausted; this ref remains pending. Run \`balladeer judge --base ${ref.remoteSha} --head ${ref.localSha} --wait\`.`);
+                    judgeLogDirectory(gitRoot);
+                    appendFileSync(join(gitRoot, JUDGE_LOG_DIRECTORY, "coverage.jsonl"), `${JSON.stringify({ schemaVersion: "balladeer-review-coverage/v1", at: now().toISOString(), base: ref.remoteSha, head: ref.localSha, destinationRef: ref.remoteRef, catalogComplete: false, relevanceComplete: false, pendingRef: true, reason: "operation_budget_exhausted" })}\n`, "utf8");
+                    continue;
+                }
+                const text = [];
+                const errors = [];
+                const offerBase = /^0+$/.test(ref.remoteSha)
+                    ? await defaultBase(gitRoot, ref.localSha)
+                    : ref.remoteSha;
+                const offerThisRef = !offersStarted &&
+                    offerBase !== undefined &&
+                    (await offersForRef(gitRoot, offerBase, ref.localSha, gitConfig, operationDeadline));
+                const code = await runJudge({
+                    ...options,
+                    deps: prepared.deps,
+                    cwd: gitRoot,
+                    deferOffers: (reading) => deferredOffers.push(reading),
+                    args: {
+                        ...manualArgs,
+                        head: ref.localSha,
+                        operationDeadline,
+                        ...(offerThisRef ? { pushHost: hook } : {}),
+                        ...(/^0+$/.test(ref.remoteSha) ? {} : { base: ref.remoteSha }),
+                        destinationRef: ref.remoteRef,
+                        json: false,
+                    },
+                    write: (line) => text.push(line),
+                    error: (line) => errors.push(line),
+                });
+                offersStarted ||= offerThisRef;
+                lines.push(...childOutputLines(text), ...childOutputLines(errors));
+                blocked ||= code === 2;
+            }
+            if (changes.length === 0)
+                lines.push("Balladeer: this push only deletes refs; no source change was reviewed.");
+            return respond(blocked);
         }
         else {
             // Codex runs a user hook only once the person trusted it, so this one
@@ -1352,12 +1660,15 @@ export async function runJudge(options) {
             // The installer adds this command to both events; on any other event,
             // wired by hand, there is nothing for it to do.
             const called = parsed.eventName ?? "PreToolUse";
-            if (called !== "PreToolUse" && called !== "PostToolUse")
+            if (called !== "PreToolUse" && called !== "PostToolUse" && called !== "PostToolUseFailure")
                 return 0;
             event = called;
             command = parsed.command;
             if (parsed.cwd !== undefined && existsSync(parsed.cwd))
                 cwd = parsed.cwd;
+            shellCwd = cwd;
+            toolUseId = parsed.toolUseId;
+            hookResult = parsed.result;
             // Where the push leaves from first: the user-scope entry decides on
             // that repository, or on the session's own when the line does not say.
             place = pushPlace(parsed.command, cwd);
@@ -1450,14 +1761,125 @@ export async function runJudge(options) {
         }
         return refused ? 4 : 0;
     }
-    const { config, problems } = readJudgeConfig(root);
+    const localConfig = readJudgeConfig(root);
+    let config = { ...localConfig.config, ...deps.reviewSettings };
+    const problems = localConfig.problems;
     const mode = args.mode ?? config.mode;
     for (const problem of problems)
         lines.push(`Balladeer judge: ${problem}.`);
+    if ((hook === "claude" || hook === "codex") &&
+        event === "PreToolUse" &&
+        mode === "block" &&
+        command !== undefined &&
+        commitBeforePush(command) !== undefined) {
+        lines.push(COMMIT_THEN_PUSH);
+        return respond(true);
+    }
+    if ((hook === "claude" || hook === "codex") &&
+        event === "PreToolUse" &&
+        mode === "report" &&
+        !args.userScope &&
+        !hasJudgeEntry(root, hook, "PostToolUse")) {
+        trailing.push(`Balladeer judge: this push waited for the check because this checkout's hook was installed by an earlier release. Run \`balladeer judge --install-hook ${hook}\` again so the check runs after the push instead.`);
+    }
+    if ((hook === "claude" || hook === "codex") &&
+        command !== undefined &&
+        sendsCommits(command) &&
+        args.head === undefined &&
+        place?.known !== false) {
+        const operationOptions = {
+            root,
+            cwd: shellCwd,
+            command,
+            environment: options.environment,
+            now: now(),
+            ...(sessionId === undefined ? {} : { sessionId }),
+            ...(toolUseId === undefined ? {} : { toolUseId }),
+        };
+        const operation = event === "PreToolUse"
+            ? capturePushOperation(operationOptions)
+            : consumePushOperation({
+                ...operationOptions,
+                ...(hookResult === undefined ? {} : { result: hookResult }),
+            });
+        if (event === "PreToolUse" &&
+            mode === "report" &&
+            (args.userScope || hasJudgeEntry(root, hook, "PostToolUse")))
+            return 0;
+        if (event !== "PreToolUse" && mode === "block")
+            return 0;
+        if (operation.status === "unknown") {
+            lines.push(`Balladeer: push coverage is Unknown: ${operation.reason}. Run \`balladeer judge --base <before> --head <pushed>\` for each pushed branch.`);
+            return respond(false);
+        }
+        const targets = operation.status === "reconciled" ? operation.targets : operation.operation.targets;
+        const operationStarted = Date.now();
+        const hasSourceChange = targets.some((target) => target.head !== null && (!("status" in target) || target.status === "pushed"));
+        const prepared = hasSourceChange
+            ? await operationReviews(root)
+            : { deps, settings: deps.reviewSettings };
+        config = { ...config, ...prepared.settings };
+        const operationDeadline = args.operationDeadline ??
+            operationStarted + effectiveBudgetSeconds(config.budgetSeconds, true) * 1000;
+        const fanoutDeps = prepared.deps;
+        let blocked = false;
+        let offersStarted = false;
+        for (const target of targets) {
+            const status = "status" in target ? target.status : target.head === null ? "deleted" : "pushed";
+            if (status !== "pushed" || target.head === null) {
+                lines.push(`Balladeer: ${target.destination}: ${status}; no source change was reviewed.`);
+                if (status === "unknown")
+                    blocked ||= mode === "block";
+                continue;
+            }
+            // A new branch uses the bounded repository comparison base; the captured
+            // destination tip is preferred whenever it is locally available.
+            const base = target.base ?? (await defaultBase(root, target.head));
+            if (base === undefined) {
+                lines.push(`Balladeer: ${target.destination}: comparison base unavailable; coverage Unknown.`);
+                blocked ||= mode === "block";
+                continue;
+            }
+            if (Date.now() >= operationDeadline) {
+                lines.push(`Balladeer: ${target.destination}: review budget exhausted; this ref remains pending. Run \`balladeer judge --base ${base} --head ${target.head} --wait\`.`);
+                judgeLogDirectory(root);
+                appendFileSync(join(root, JUDGE_LOG_DIRECTORY, "coverage.jsonl"), `${JSON.stringify({ schemaVersion: "balladeer-review-coverage/v1", at: now().toISOString(), base, head: target.head, destinationRef: target.destination, catalogComplete: false, relevanceComplete: false, pendingRef: true, reason: "operation_budget_exhausted" })}\n`, "utf8");
+                continue;
+            }
+            const text = [];
+            const errors = [];
+            const offerThisRef = !offersStarted && (await offersForRef(root, base, target.head, config, operationDeadline));
+            const code = await runJudge({
+                ...options,
+                deps: fanoutDeps,
+                cwd: root,
+                deferOffers: (reading) => deferredOffers.push(reading),
+                args: {
+                    ...manualArgs,
+                    head: target.head,
+                    base,
+                    destinationRef: target.destination,
+                    destinationDigest: `sha256:${operation.operation.remoteDigest}`,
+                    operationDeadline,
+                    ...(offerThisRef ? { pushHost: hook } : {}),
+                    ...(sessionId === undefined ? {} : { pushSessionId: sessionId }),
+                    client: args.client ?? hook,
+                    json: false,
+                    mode,
+                },
+                write: (line) => text.push(line),
+                error: (line) => errors.push(line),
+            });
+            offersStarted ||= offerThisRef;
+            lines.push(`Pushed ref: ${target.destination} (${target.head.slice(0, 12)}).`, ...childOutputLines(text), ...childOutputLines(errors));
+            blocked ||= code === 2;
+        }
+        return respond(blocked);
+    }
     // Report mode judges after the command and block mode before it, so each
     // mode acts on one of the two events and lets the other go at once.
     if (hook === "claude" || hook === "codex") {
-        if (event === "PostToolUse" && mode === "block")
+        if (event !== "PreToolUse" && mode === "block")
             return 0;
         if (event === "PreToolUse" && mode === "block" && command !== undefined) {
             if (commitBeforePush(command) !== undefined) {
@@ -1474,7 +1896,6 @@ export async function runJudge(options) {
                 commitFirst = commitBeforePush(command);
             // Installed by an earlier release, with no entry after the push: judge
             // here as that release did, rather than not at all, and say how to move.
-            trailing.push(`Balladeer judge: this push waited for the check because this checkout's hook was installed by an earlier release. Run \`balladeer judge --install-hook ${hook}\` again so the check runs after the push instead.`);
         }
     }
     // Where the push leaves from: judged there, or not at all when that cannot be known,
@@ -1495,6 +1916,21 @@ export async function runJudge(options) {
         lines.push(message);
         return respond(false);
     }
+    if (args.fromFile === undefined && !usesReviewCatalog) {
+        try {
+            const retry = await deliverReviews({
+                root,
+                environment: options.environment,
+                controlPlane: args.controlPlane,
+                payloads: [],
+                ...(deps.reportReviews === undefined ? {} : { send: deps.reportReviews }),
+            });
+            reportingWarning = retry;
+        }
+        catch {
+            /* Original verdict logs remain available; a later run can retry. */
+        }
+    }
     await runCommand("git", ["-C", root, "worktree", "prune"]);
     if (namedMerge !== undefined && args.head === undefined) {
         const named = [namedMerge.repo, namedMerge.selector].filter(Boolean).join(" ");
@@ -1526,30 +1962,7 @@ export async function runJudge(options) {
             options.error(`${message}\n`);
         return 4;
     }
-    // After the command, what was pushed is what is judged, so it has to have
-    // reached the remote: Codex calls this hook after a push that failed, too.
-    // A merge sends no commits of this checkout, so it has nothing to check.
-    if (event === "PostToolUse" &&
-        command !== undefined &&
-        sendsCommits(command) &&
-        namedMerge === undefined &&
-        args.head === undefined &&
-        !(await pushLanded(root, head))) {
-        const message = `Balladeer judge: nothing was judged, because the push did not land: ${head.slice(0, 12)} is on no remote branch.`;
-        emit({
-            step: "judge",
-            status: "nothing_to_judge",
-            reason: "push_not_landed",
-            message,
-            exitCode: 0,
-        });
-        lines.push(message);
-        return respond(false);
-    }
-    const base = args.base !== undefined
-        ? await resolveCommit(root, args.base)
-        : ((event === "PostToolUse" ? await baseBeforePush(root, head) : undefined) ??
-            (await defaultBase(root, head)));
+    const base = args.base !== undefined ? await resolveCommit(root, args.base) : await defaultBase(root, head);
     if (base === undefined || base === head) {
         const message = base === undefined
             ? `${args.base ?? "the base"} is not a commit here, so nothing was judged.`
@@ -1613,6 +2026,39 @@ export async function runJudge(options) {
         if (found.ok)
             reader = found.reader;
     }
+    let reviews = deps.reviews ?? undefined;
+    const reviewStarted = Date.now();
+    let targets;
+    let catalogProblem;
+    if (filePromise === undefined &&
+        deps.reviews !== null &&
+        (deps.reviews !== undefined || (deps.anchors === undefined && deps.reader === undefined))) {
+        if (reviews === undefined) {
+            const found = connectionReviewsClient(connection);
+            if (found.ok)
+                reviews = found.client;
+            else
+                catalogProblem = found.reason;
+        }
+        if (reviews !== undefined) {
+            const catalog = await reviews.list();
+            if (deps.reviewSettingsResolved !== true) {
+                if (catalog.reviewSettings !== undefined)
+                    config = { ...config, ...catalog.reviewSettings };
+                else
+                    settingsFallback();
+            }
+            if (catalog.ok) {
+                targets = catalog.targets;
+                reader = catalogReaders(reviews, targets).reader;
+            }
+            else {
+                catalogProblem = catalog.reason;
+            }
+        }
+        if (catalogProblem !== undefined)
+            trailing.push(`Review coverage is incomplete: recorded promises could not be read (${catalogProblem}).`);
+    }
     // The login is checked once, and only when something needs it: an anchoring call or a judge.
     const prefer = hook === "claude" || hook === "codex" ? hook : undefined;
     const requested = args.client ?? config.client;
@@ -1621,14 +2067,24 @@ export async function runJudge(options) {
         ((client, preferred) => resolveClient(client, {
             env: options.environment,
             cwd: root,
+            ...(args.wait
+                ? {}
+                : {
+                    deadline: args.operationDeadline ??
+                        reviewStarted +
+                            effectiveBudgetSeconds(config.budgetSeconds, args.hook !== undefined) * 1000,
+                }),
             ...(preferred === undefined ? {} : { prefer: preferred }),
         })))(requested, prefer));
     // From a hook, the host's own timeout rules and a timed-out hook lets the
     // push run, so the budget is capped below it; by hand, the person's number.
-    // It starts here, so anchoring and judging share it.
+    // Catalog, anchoring, login and judging share the elapsed budget.
     const budgetMs = args.wait
         ? undefined
-        : effectiveBudgetSeconds(config.budgetSeconds, args.hook !== undefined) * 1000;
+        : Math.max(1, Math.min(effectiveBudgetSeconds(config.budgetSeconds, args.hook !== undefined) * 1000 -
+            (Date.now() - reviewStarted), args.operationDeadline === undefined
+            ? Number.POSITIVE_INFINITY
+            : args.operationDeadline - Date.now()));
     const started = Date.now();
     // Anchors, brought current before anything is selected: read from Balladeer,
     // then cut from a current map or written by a call for each agreed promise
@@ -1642,9 +2098,11 @@ export async function runJudge(options) {
     // exits above pay nothing for the anchoring machinery.
     const kit = filePromise === undefined ? await import("./anchor.js") : undefined;
     if (kit !== undefined) {
-        let client = deps.anchors ?? undefined;
+        let client = targets !== undefined && reviews !== undefined
+            ? catalogReaders(reviews, targets).anchors
+            : (deps.anchors ?? undefined);
         let clientMissing;
-        if (deps.anchors === undefined) {
+        if (client === undefined && deps.anchors === undefined) {
             const found = kit.connectionAnchorsClient(connection);
             if (found.ok)
                 client = found.client;
@@ -1672,9 +2130,10 @@ export async function runJudge(options) {
     }
     const parsedMaps = storedMaps.flatMap((entry) => (entry.map === undefined ? [] : [entry.map]));
     // The user-scope entry still says nothing where there is nothing to check:
-    // the server says this repository has no agreed promise, or the server
+    // the server says this repository has no visible promise, or the server
     // cannot be read and no promise here has a map.
     if (args.userScope &&
+        catalogProblem === undefined &&
         stage !== undefined &&
         (stage.available ? stage.promises.length === 0 : parsedMaps.length === 0))
         return 0;
@@ -1693,16 +2152,17 @@ export async function runJudge(options) {
             if (!stage.currentMaps.has(promiseId))
                 selectBy.set(promiseId, anchorFilesOf);
     }
-    if (config.offers && hook !== undefined) {
+    const offerHost = hook ?? args.pushHost;
+    if (config.offers && offerHost !== undefined) {
         // Even when no promise is at risk and no map exists: a change nobody
         // mapped is exactly where a rule nobody wrote down is likeliest.
-        offerDeadline = Date.now() + effectiveBudgetSeconds(config.budgetSeconds, true) * 1000;
+        offerDeadline = Math.min(args.operationDeadline ?? Number.POSITIVE_INFINITY, Date.now() + effectiveBudgetSeconds(config.budgetSeconds, true) * 1000);
         offerReading = offersForPush({
             root,
             base,
             head,
             files,
-            host: hook,
+            host: offerHost,
             environment: options.environment,
             controlPlane: args.controlPlane,
             client: args.client ?? config.client,
@@ -1721,7 +2181,7 @@ export async function runJudge(options) {
         : [];
     // Their meanings, read once: the scorer orders them by their words, and
     // their judges need them anyway.
-    const meanings = new Map();
+    const meanings = new Map((targets ?? []).map((target) => [target.promiseId, target]));
     if (reader !== undefined)
         for (const promiseId of anchored) {
             const read = await reader.get(promiseId);
@@ -1732,7 +2192,7 @@ export async function runJudge(options) {
     // listed after those the ranking can place.
     const scored = [
         ...mapsInUse,
-        ...anchored.flatMap((promiseId) => {
+        ...[...anchorsInUse.keys()].flatMap((promiseId) => {
             const anchors = anchorsInUse.get(promiseId);
             const meaning = meanings.get(promiseId);
             return anchors === undefined || kit === undefined
@@ -1756,6 +2216,46 @@ export async function runJudge(options) {
         ...(args.topK === undefined ? {} : { topK: args.topK }),
         random: deps.random ?? Math.random,
     });
+    let relevanceComplete = targets === undefined ? filePromise !== undefined : named !== undefined;
+    if (targets !== undefined && named === undefined) {
+        const chosen = new Set(selected.map((entry) => entry.promiseId));
+        for (const entry of targetedRiskCandidates(risk ?? [], chosen)) {
+            selected.push({ promiseId: entry.promiseId, why: "risk" });
+            chosen.add(entry.promiseId);
+        }
+        const remaining = targets.filter((target) => !chosen.has(target.promiseId));
+        const backstopLogin = remaining.length === 0 ? undefined : await resolveLogin();
+        const left = budgetMs === undefined ? 60_000 : Math.max(0, budgetMs - (Date.now() - started));
+        if (remaining.length === 0)
+            relevanceComplete = true;
+        else if (backstopLogin !== undefined && left > 1000) {
+            const result = await (deps.backstop ?? reviewBackstop)({
+                root,
+                base,
+                head,
+                files,
+                targets: remaining,
+                login: backstopLogin,
+                env: options.environment,
+                timeoutMs: Math.min(60_000, Math.max(1000, Math.floor(left / 4))),
+                ...(deps.runAgent === undefined ? {} : { runAgent: deps.runAgent }),
+            });
+            relevanceComplete = result.ok;
+            if (result.ok)
+                for (const id of result.ids) {
+                    selected.push({ promiseId: id, why: "risk" });
+                    chosen.add(id);
+                }
+            else
+                trailing.push(`Review coverage is incomplete: ${result.reason}.`);
+        }
+        else
+            trailing.push("Review coverage is incomplete: the remaining promises could not receive a relevance reading.");
+    }
+    const logCoverage = (completed, pending) => {
+        judgeLogDirectory(root);
+        appendFileSync(join(root, JUDGE_LOG_DIRECTORY, "coverage.jsonl"), `${JSON.stringify({ schemaVersion: "balladeer-review-coverage/v1", at: now().toISOString(), base, head, destinationRef: args.destinationRef, catalogComplete: targets !== undefined || filePromise !== undefined, relevanceComplete, considered: targets?.map((target) => ({ id: target.promiseId, standing: target.standing, semanticDigest: target.semanticDigest, subject: target.subject })) ?? [], selected: selected.map((entry) => entry.promiseId), completed, pending })}\n`, "utf8");
+    };
     // What anchoring did, said after the verdicts whenever it ran or was held back.
     const anchorRun = stage?.available ? stage.run : undefined;
     if (anchorRun !== undefined && kit !== undefined) {
@@ -1783,6 +2283,7 @@ export async function runJudge(options) {
         }
     }
     if (selected.length === 0) {
+        logCoverage([], []);
         // Said in one line either way, so that silence is never read as safe.
         const nothing = nothingSelected({
             stage,
@@ -1802,6 +2303,7 @@ export async function runJudge(options) {
     }
     const login = await resolveLogin();
     if (login === undefined) {
+        logCoverage([], selected.map((entry) => entry.promiseId));
         const message = "not judged: no Claude Code signed in through claude.ai, and no Codex signed in with ChatGPT, is on this machine, so Balladeer did not judge this change.";
         emit({ step: "judge", status: "not_judged", reason: "no_login", message, exitCode: 0 });
         lines.push(message);
@@ -1824,6 +2326,9 @@ export async function runJudge(options) {
         }
         if (promise === undefined && map?.meaning !== undefined)
             promise = promiseFromExcerpt(promiseId, map.semanticDigest, map.meaning);
+        // A local proposal map cannot supply human agreement during a catalog outage.
+        if (promise !== undefined && promiseId.startsWith("cand_") && promise.standing === undefined)
+            promise = { ...promise, standing: "recorded" };
         if (promise === undefined)
             unreadable.push(promiseId);
         else
@@ -1835,6 +2340,37 @@ export async function runJudge(options) {
                     : { anchors: kit.judgeAnchors(anchors, repository) }),
             });
     }
+    const environmentDigest = sha256Digest({
+        runner: JUDGE_BRIEF_REVISION,
+        node: process.version,
+        executable: process.execPath,
+        client: login.client,
+        login: login.method ?? "verified",
+        path: options.environment.PATH ?? "",
+        setup: [
+            "package.json",
+            "pnpm-lock.yaml",
+            "package-lock.json",
+            "requirements.txt",
+            "pyproject.toml",
+            "poetry.lock",
+            "go.mod",
+            "go.sum",
+            "node_modules/.modules.yaml",
+        ].map((path) => {
+            try {
+                const file = join(root, path);
+                return {
+                    path,
+                    bytes: statSync(file).size,
+                    digest: sha256Digest(readFileSync(file, "utf8")),
+                };
+            }
+            catch {
+                return { path, absent: true };
+            }
+        }),
+    });
     const stopHandler = () => {
         removeLiveWorktreesNow();
         process.exit(130);
@@ -1844,7 +2380,7 @@ export async function runJudge(options) {
     const budget = new AbortController();
     const timer = budgetMs === undefined
         ? undefined
-        : setTimeout(() => budget.abort(), Math.max(1000, budgetMs - (Date.now() - started)));
+        : setTimeout(() => budget.abort(), Math.max(1, budgetMs - (Date.now() - started)));
     const verdicts = [];
     const stillJudging = [];
     const notJudged = [];
@@ -1855,11 +2391,18 @@ export async function runJudge(options) {
                 const job = queue.shift();
                 if (job === undefined)
                     return;
+                const cacheDigest = sha256Digest({
+                    environmentDigest,
+                    subject: job.promise.subject ?? null,
+                    standing: job.promise.standing ?? "unknown",
+                });
                 const logged = findLoggedVerdict(root, {
                     promiseId: job.promise.promiseId,
                     semanticDigest: job.promise.semanticDigest,
                     base,
                     head,
+                    environmentDigest: cacheDigest,
+                    ...(args.retry ? { retry: true } : {}),
                 }, now());
                 if (logged !== undefined) {
                     verdicts.push({
@@ -1870,11 +2413,11 @@ export async function runJudge(options) {
                     });
                     continue;
                 }
-                if (budget.signal.aborted) {
+                if (budget.signal.aborted || (budgetMs !== undefined && Date.now() >= started + budgetMs)) {
                     stillJudging.push(job);
                     continue;
                 }
-                const remaining = budgetMs === undefined ? JUDGE_CAP_MS : Math.max(1000, budgetMs - (Date.now() - started));
+                const remaining = budgetMs === undefined ? JUDGE_CAP_MS : Math.max(1, budgetMs - (Date.now() - started));
                 const outcome = await (deps.judge ?? judgePromise)({
                     root,
                     promise: job.promise,
@@ -1896,12 +2439,16 @@ export async function runJudge(options) {
                     notJudged.push({ id: job.promise.promiseId, reason: outcome.reason });
                 else {
                     verdicts.push({
-                        verdict: outcome.verdict,
+                        verdict: {
+                            ...outcome.verdict,
+                            environmentDigest: cacheDigest,
+                            ...(job.promise.standing === undefined ? {} : { standing: job.promise.standing }),
+                        },
                         title: job.promise.title,
                         reused: false,
                         checkBound: job.promise.verifierBound,
                     });
-                    appendVerdicts(root, [outcome.verdict], now());
+                    appendVerdicts(root, [verdicts[verdicts.length - 1].verdict], now());
                 }
             }
         };
@@ -1915,7 +2462,116 @@ export async function runJudge(options) {
     }
     const order = new Map(selected.map((entry, index) => [entry.promiseId, index]));
     verdicts.sort((a, b) => (order.get(a.verdict.promiseId) ?? 0) - (order.get(b.verdict.promiseId) ?? 0));
-    const broken = verdicts.filter((entry) => entry.verdict.verdict === "broken");
+    const broken = verdicts.filter((entry) => entry.verdict.verdict === "broken" && entry.verdict.standing !== "recorded");
+    const pending = [
+        ...stillJudging.map((job) => job.promise.promiseId),
+        ...notJudged.map((job) => job.id),
+        ...unreadable,
+        ...verdicts
+            .filter((entry) => entry.verdict.verdict === "could_not_tell")
+            .map((entry) => entry.verdict.promiseId),
+    ];
+    logCoverage(verdicts.map((entry) => entry.verdict.promiseId), pending);
+    const shareReceipts = async () => {
+        if (reviews === undefined || targets === undefined || args.destinationRef === undefined)
+            return;
+        const deadline = Math.min(args.operationDeadline ??
+            (budgetMs === undefined ? Number.POSITIVE_INFINITY : started + budgetMs), Date.now() + 10_000);
+        const abort = new AbortController();
+        const expired = new Promise((done) => {
+            abort.signal.addEventListener("abort", () => done({ ok: false, reason: "sharing budget exhausted" }), { once: true });
+        });
+        const timer = setTimeout(() => abort.abort(), Math.max(0, deadline - Date.now()));
+        const remainsLocal = (id, reason) => {
+            const message = `Review receipt remains local for ${id}: ${reason}.`;
+            trailing.push(message);
+            emit({
+                step: "judge",
+                status: "review_receipt_remains_local",
+                promiseIds: [id],
+                reason,
+                message,
+                exitCode: 0,
+            });
+        };
+        try {
+            for (const { verdict } of verdicts) {
+                const target = targets.find((item) => item.promiseId === verdict.promiseId);
+                if (target === undefined)
+                    continue;
+                if (Date.now() >= deadline || abort.signal.aborted) {
+                    remainsLocal(target.promiseId, "sharing budget exhausted");
+                    continue;
+                }
+                const resolvesReportIds = [];
+                if (verdict.verdict === "kept" && args.destinationDigest !== undefined) {
+                    for (const finding of target.openFindings ?? []) {
+                        if (Date.now() >= deadline || abort.signal.aborted || resolvesReportIds.length >= 100)
+                            break;
+                        if (finding.sourceSha === head ||
+                            finding.destinationRef !== args.destinationRef ||
+                            finding.destinationDigest !== args.destinationDigest)
+                            continue;
+                        const ancestor = await runCommand("git", ["-C", root, "merge-base", "--is-ancestor", finding.sourceSha, head], { timeoutMs: Math.max(1, Math.min(1000, deadline - Date.now())) });
+                        if (ancestor.ok)
+                            resolvesReportIds.push(finding.reportId);
+                    }
+                }
+                if (Date.now() >= deadline || abort.signal.aborted) {
+                    remainsLocal(target.promiseId, "sharing budget exhausted");
+                    continue;
+                }
+                const result = await Promise.race([
+                    reviews
+                        .record({
+                        schemaVersion: "balladeer-review-receipt/v1",
+                        subject: target.subject,
+                        semanticDigest: target.semanticDigest,
+                        baseSha: base,
+                        sourceSha: head,
+                        destinationRef: args.destinationRef,
+                        ...(args.destinationDigest === undefined
+                            ? {}
+                            : { destinationDigest: args.destinationDigest }),
+                        ...(resolvesReportIds.length === 0
+                            ? {}
+                            : { resolvesReportIds, ancestryVerified: true }),
+                        verdict: verdict.verdict,
+                        briefRevision: verdict.briefRevision,
+                        client: verdict.judge.client,
+                        ...(verdict.verdict === "broken" && verdict.reproduction?.digest !== undefined
+                            ? { reproductionDigest: verdict.reproduction.digest }
+                            : {}),
+                    }, { signal: abort.signal, timeoutMs: Math.max(1, deadline - Date.now()) })
+                        .catch(() => ({ ok: false, reason: "the receipt could not be shared" })),
+                    expired,
+                ]);
+                if (!result.ok)
+                    remainsLocal(target.promiseId, result.reason);
+            }
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    };
+    if (filePromise === undefined && !usesReviewCatalog) {
+        try {
+            const reporting = await deliverReviews({
+                root,
+                environment: options.environment,
+                controlPlane: args.controlPlane,
+                payloads: verdicts.map(({ verdict }) => reviewPayload(verdict, {
+                    ...(sessionId === undefined ? {} : { sessionId }),
+                    ...(args.pushHost === "git" ? { client: "git" } : {}),
+                })),
+                ...(deps.reportReviews === undefined ? {} : { send: deps.reportReviews }),
+            });
+            reportingWarning = reporting;
+        }
+        catch {
+            lines.push("Review reporting could not finish. The original review remains in this machine’s local log.");
+        }
+    }
     if (json)
         for (const { verdict } of verdicts)
             options.write(`${JSON.stringify(verdict)}\n`);
@@ -1933,12 +2589,13 @@ export async function runJudge(options) {
         lines.push(`  not judged: ${id}: ${reason}`);
     for (const id of unreadable)
         lines.push(`  not judged: ${id}: its meaning could not be read here and it has no behavior map.`);
+    const blockingPending = stillJudging.filter((job) => job.promise.standing !== "recorded");
     if (stillJudging.length > 0) {
         const ids = stillJudging.map((job) => job.promise.promiseId);
         const names = stillJudging
             .map((job) => `${job.promise.title} (${job.promise.promiseId})`)
             .join("; ");
-        const message = mode === "block"
+        const message = mode === "block" && blockingPending.length > 0
             ? `Held: ${STILL_JUDGING}, then push again. Still judging when the time ran out: ${names}.`
             : `Still judging when the time ran out, so not judged yet: ${names}. Run \`balladeer judge --wait\` to finish them.`;
         lines.push(message);
@@ -1948,12 +2605,13 @@ export async function runJudge(options) {
             reason: "budget_spent",
             message,
             promiseIds: ids,
-            exitCode: mode === "block" ? 2 : 0,
+            exitCode: mode === "block" && blockingPending.length > 0 ? 2 : 0,
         });
     }
     if (broken.length > 0 && mode === "block")
         lines.push("This push is stopped because a promise's break was reproduced both ways. Fix the behavior, or run the reproduction to see it, then push again.");
-    const block = mode === "block" && (broken.length > 0 || stillJudging.length > 0);
+    const block = mode === "block" && (broken.length > 0 || blockingPending.length > 0);
+    await shareReceipts();
     if (json)
         return block ? 2 : 0;
     return respond(block);