harness-everything 0.40.0 → 0.41.0

package/ci/archive/325-prep/README.md

@@ -0,0 +1,71 @@
+# Archived #325 prep gates (F4-T2)
+
+Historical evidence only. Nothing here is a GREEN gate.
+
+- **Not discovered:** `ci/mechanism-test.js` runs only top-level `ci/mechanism-*.test.js`, so nothing in this directory runs in `npm run test:mechanism`.
+- **Owner clause (T2, 2026-10-22):** "only archive the prep fingerprint and the RED-plan gates as historical evidence, and tag tests with `locks: <anchor clause>`. List the unmapped tests, but don't delete them."
+- **Revision of the historical results:** `0308386058ad942e2764475d48fd65a013910e1e`. The registry was captured at `c271249a8a99d7e0320288af8cb086bb03f8fa1a`.
+
+## Manifest
+
+| # | Archived entry | Original path (sha256 at 0308386) | Removed live gate | Old result at 0308386 | Replacement behaviour command | Residual failure |
+|---|---|---|---|---|---|---|
+| 1 | Prep runner `doc-reconciliation-red.js` | `ci/prep/doc-reconciliation-red.js` (`5e85af19…7849c`) | Runtime-fingerprint check that forces every replay to FAIL on drift; `--expect-red` qualification | `--expect-red`: exit 1, "runtime fingerprint changed" | `node ci/mechanism-325-3b-preparation.test.js` (live infrastructure bounds only) | Fingerprint mismatch: registry `a7679becc1cb…8153b`, current `17a4821a21e1…2394` |
+| 2 | Frozen registry `pending-red.json` | `ci/fixtures/doc-obligations/reconciliation-prep/pending-red.json` (`08ad9eef…7ff0`), kept at its fixture path (outside the T2 write-set) | Registry used as the qualified-gap gate | Validates; fingerprint field stale (see #1) | none (historical data) | Same fingerprint mismatch |
+| 3 | Historical checks from the 3b suite (10 checks) | `ci/mechanism-325-3b-preparation.test.js` (pre-split) | Expected-RED mode, expected-RED report, gap registry, strict-mode gap log, registry validator, omitted-gap and unexpected-PASS checks, fingerprint invalidation, recapture | 4 FAIL, 6 PASS (see `historical-qualification.test.js`) | `node ci/archive/325-prep/historical-qualification.test.js` reproduces the old result | 4 FAIL: expected-RED mode, expected-RED report, gap registry, recapture (all fingerprint-bound) |
+| 4 | T12 `EXPECTED_RED` list and `--expect-red` mode | `ci/mechanism-325-f4-invariants.test.js` (`bd61e6e7…bfcca19`), list in `f4-expected-red.json` | Frozen 20-entry RED plan; `STATUS: RED-PLAN-MATCHED` | `--expect-red`: `RED-PLAN-MISMATCH (expected 20, observed 14, infra 0)`, exit 1. S2-I4, S5-I4 and S6-I4 are CONTROL on both legs | `node ci/mechanism-325-f4-invariants.test.js` (plain mode reports the actual failures) | 14 RED cells, unchanged by T2 (see the live report) |
+| 5 | Probe `P-ignore-missing-expected-must` | `ci/mechanism-325-f4-invariants.test.js` `MUTANTS` (pre-archive line 408, owner S6-I1) | "must become APPLIED" pending handoff in `--mutants` | `NOT APPLIED`. Never detected | Actual missing-MUST refusal tests stay live in the core suite (`ci/mechanism-325-3b-s2a-core.test.js`) | Open gap: no mutant witnesses the missing-MUST refusal. Record it, do not add a resolver redesign to manufacture one |
+
+## Relocation edits (entry 1)
+
+Code changes against the original runner (sha256 `5e85af19…7849c`) are limited to:
+
+- `ROOT` resolves three levels up (`path.resolve(__dirname, '..', '..', '..')`).
+- The fixtures `require` path is `../../lib/doc-reconciliation-prep-fixtures`.
+- The printed re-capture command names `ci/archive/325-prep/doc-reconciliation-red.js`.
+
+The header comment also gained an archive note. Logic, the registry path and the fingerprint files are unchanged.
+
+## Commands
+
+```
+node ci/archive/325-prep/doc-reconciliation-red.js --expect-red   # exit 1, runtime fingerprint changed
+node ci/archive/325-prep/doc-reconciliation-red.js --strict --case P03   # exit 1, recorded gaps
+node ci/archive/325-prep/historical-qualification.test.js          # 4 FAIL, 6 PASS
+```
+
+## Live suite after T2
+
+- `ci/mechanism-325-3b-preparation.test.js` still runs the archived runner, but only for its infrastructure path (exit 2, child deadline, output bound). Those checks are live.
+- The live suite no longer reads the registry for qualification.
+
+## Coordinator disposition (pending)
+
+The WA pending-probe gate (`P-ignore-missing-expected-must`, WA report 28–30) is superseded for WB by the coordinator's disposition. The coordinator records that disposition. It is not recorded here.
+
+## Retired 2026-10-23 (owner decision 5)
+
+Owner decision 5 (2026-10-23) retired the schema and preload-only predicates below. Each entry keeps its old predicate and its last result at `0c53a57` (source and packaged legs gave the same result unless noted). Each retired cell left a `// locks: historical — retired 2026-10-23 (owner decision 5)` comment where it was.
+
+**Retired from the active pass/fail set**
+
+| Cell | Old predicate | Last result at `0c53a57` | Where |
+|---|---|---|---|
+| S6-I3 | `pilot.acceptedEvents` is an array with one `provenance` per accepted ref (`on-valid-direct-quoted-review` / `review`) | RED: `{"acceptedRefs":2,"acceptedEvents":null}` | `ci/mechanism-325-f4-invariants.test.js` |
+| S7-I3 | `Boolean(pilot.identity)` (`on-valid-direct-quoted-review` / `review`) | RED: `null` | `ci/mechanism-325-f4-invariants.test.js` |
+| S8-I3 | some key of the withheld `obligations` matches `/origin\|withheld\|source/i` (`on-malformed` / `base`) | RED: keys are `schemaVersion, workflowId, sessionId, …` with no origin key | `ci/mechanism-325-f4-invariants.test.js` |
+| F8 preload spy | the internal modules `./lib/harness-state`, `./lib/workflow-isolation`, `./lib/telemetry` are not eagerly loaded in any OFF route/switch case | FAIL: internal-module-load 24/24 OFF cases | `ci/mechanism-325-3b-s2b-capture.test.js` (`R2C1-OFF-CAPTURE-ONLY-FAST-PATH`) |
+
+F8's OFF side-effect assertions (state, capture, output, exit = 0) and the legacy OFF controls stay in the active set. At `0c53a57` they observed 0 / 0 / 0 / 0.
+
+**Replaced oracles (cell kept, key predicate swapped for a behaviour oracle)**
+
+| Cell | Old predicate | Last result at `0c53a57` | Behaviour oracle now |
+|---|---|---|---|
+| S1-I2 | no `session-workspaces/` file exists after the OFF capture-only route (state created by route/plan/start included) | RED: `session-workspaces/346be55a….json` present | file-set delta across the hook (OFF adds none; ON control adds some) |
+| S2-I3 | a `handoff` key matches `/lastVerify/` and `/(source\|kind\|origin)/` | RED: no such key | after drift, `lastDocVerifyAt` is withdrawn, the generic record survives, the workflow Stop names `req-verify` |
+| S10-I3 | the same key predicate on the OFF legacy run | RED: no such key | after drift, `lastGenericVerifyAt` equals the aggregate, and the generic Stop stays silent |
+
+Limits: the S1-I2 delta compares file sets, so an in-place rewrite of a binding that route/plan/start already created is not seen. Pre-existing OFF handoff writes are legacy behaviour and are not part of this cell.
+
+Sources: `F4-T3-before-invariants.log` and `F4-T3-before-capture.log` (`0c53a57`), `F4-T3-after-invariants.log` and `F4-T3-after-capture.log` (this change).

package/ci/{prep → archive/325-prep}/doc-reconciliation-red.js

@@ -2,17 +2,19 @@
 'use strict';
 
 // #325 Phase 3b preparation: strict and expected-RED replay over the real CLI, hook and Stop entry points.
+// ARCHIVED by F4-T2 (historical evidence, revision 0308386); see ci/archive/325-prep/README.md. Relocation edits only:
+// ROOT, the fixtures require path and the printed re-capture command point at this directory.
 //
-//   node ci/prep/doc-reconciliation-red.js --strict      exits 1 on any desired-contract gap or control failure
-//   node ci/prep/doc-reconciliation-red.js --expect-red  exits 0 only when every gap is qualified by the registry
-//   node ci/prep/doc-reconciliation-red.js --recapture-candidate <file> --baseline-sha <40-hex>
+//   node ci/archive/325-prep/doc-reconciliation-red.js --strict      exits 1 on any desired-contract gap or control failure
+//   node ci/archive/325-prep/doc-reconciliation-red.js --expect-red  exits 0 only when every gap is qualified by the registry
+//   node ci/archive/325-prep/doc-reconciliation-red.js --recapture-candidate <file> --baseline-sha <40-hex>
 //                                                        writes a candidate registry for review; never the registry
 //
 // Optional: --case <id> (repeatable), --cases <file>, --registry <file>, --json (print the report), --log <file>.
 // Exit 2 means infrastructure or registry error (replay crash, malformed registry, unreadable file, a spawn error,
 // a signal, an exit outside the action's expectExit policy, or missing required output).
 //
-// This file is not discovered by filename. The preparation suite invokes --expect-red and parses the report.
+// This file is not discovered by filename. The live preparation suite runs it only for infrastructure checks (exit 2).
 // A qualified gap is an ON assertion that fails today and matches a registry entry exactly (case, assertion,
 // distribution, actual and desired). Infrastructure faults are decided first and never qualify as gaps.
 // Qualification is bound to the runtime fingerprint of the shared runtime files, not to the commit: a registry
@@ -22,9 +24,9 @@ const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
-const fx = require('../lib/doc-reconciliation-prep-fixtures');
+const fx = require('../../lib/doc-reconciliation-prep-fixtures');
 
-const ROOT = path.resolve(__dirname, '..', '..');
+const ROOT = path.resolve(__dirname, '..', '..', '..');
 const PREP_DIR = path.join(ROOT, 'ci', 'fixtures', 'doc-obligations', 'reconciliation-prep');
 const DEFAULT_CASES = path.join(PREP_DIR, 'cases.json');
 const DEFAULT_REGISTRY = path.join(PREP_DIR, 'pending-red.json');
@@ -63,7 +65,7 @@ function currentCommit() {
 }
 
 function recaptureCommand(commit) {
-  return `node ci/prep/doc-reconciliation-red.js --recapture-candidate ${CANDIDATE_FILE} --baseline-sha ${commit}`;
+  return `node ci/archive/325-prep/doc-reconciliation-red.js --recapture-candidate ${CANDIDATE_FILE} --baseline-sha ${commit}`;
 }
 
 function parseArgs(argv) {

package/ci/archive/325-prep/f4-expected-red.json

@@ -0,0 +1,34 @@
+{
+  "schemaVersion": 1,
+  "archivedBy": "F4-T2 r1 (owner clause T2, 2026-10-22)",
+  "revision": "0308386058ad942e2764475d48fd65a013910e1e",
+  "removedFrom": "ci/mechanism-325-f4-invariants.test.js",
+  "removedGate": "EXPECTED_RED constant and the --expect-red mode (STATUS: RED-PLAN-MATCHED / RED-PLAN-MISMATCH)",
+  "frozenFiles": {
+    "ci/mechanism-325-f4-invariants.test.js": "bd61e6e79f48b108b45cab04f1ee7df0a1d13594878ce3dbfe531337bbfcca19",
+    "ci/lib/doc-reconciliation-prep-fixtures.js": "d5ad9b9a66e63ac7c157deb157843c99463b95ce68c84ecff8f2b8ffcacf70db",
+    "ci/fixtures/doc-obligations/reconciliation-prep/pending-red.json": "08ad9eef0475b0121c13a38f5e61f5bd1cd4ad76aa4140c7ff662112c95c7ff0"
+  },
+  "frozenAt": "F4-T12 report, 20 frozen entries, RED-PLAN-MATCHED",
+  "resultAtRevision": {
+    "command": "node ci/mechanism-325-f4-invariants.test.js --expect-red",
+    "status": "RED-PLAN-MISMATCH",
+    "expected": 20,
+    "observed": 14,
+    "infra": 0,
+    "notObservedRed": [
+      "S2-I4@source", "S2-I4@packaged",
+      "S5-I4@source", "S5-I4@packaged",
+      "S6-I4@source", "S6-I4@packaged"
+    ],
+    "unexpectedRed": [],
+    "note": "S2-I4, S5-I4 and S6-I4 are CONTROL at 0308386 on both legs; the 0308386 resolver commit closed them. Plain mode reports the 14 RED cells as actual failures."
+  },
+  "frozenList": [
+    "S1-I2@packaged", "S1-I2@source", "S10-I3@packaged", "S10-I3@source",
+    "S2-I3@packaged", "S2-I3@source", "S2-I4@packaged", "S2-I4@source",
+    "S5-I4@packaged", "S5-I4@source", "S6-I3@packaged", "S6-I3@source",
+    "S6-I4@packaged", "S6-I4@source", "S7-I1@packaged", "S7-I1@source",
+    "S7-I3@packaged", "S7-I3@source", "S8-I3@packaged", "S8-I3@source"
+  ]
+}

package/ci/archive/325-prep/historical-qualification.test.js

@@ -0,0 +1,143 @@
+#!/usr/bin/env node
+'use strict';
+
+// #325 Phase 3b historical qualification, archived by F4-T2 (owner clause T2, 2026-10-22) from
+// ci/mechanism-325-3b-preparation.test.js at revision 0308386. Not discovered by ci/mechanism-test.js and not part of
+// `npm run test:mechanism`. Run explicitly: node ci/archive/325-prep/historical-qualification.test.js
+// These checks gate the frozen registry and the runtime fingerprint. They record the prep qualification; they are not a
+// live behaviour gate. See README.md in this directory for the manifest and the residual failures.
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..', '..', '..');
+const PREP_DIR = path.join(ROOT, 'ci', 'fixtures', 'doc-obligations', 'reconciliation-prep');
+const RUNNER = path.join(__dirname, 'doc-reconciliation-red.js');
+const registry = JSON.parse(fs.readFileSync(path.join(PREP_DIR, 'pending-red.json'), 'utf8'));
+const workDir = fs.mkdtempSync(path.join(os.tmpdir(), 'doc-recon-prep-historical-'));
+
+let failed = 0;
+function check(condition, message) {
+  if (condition) console.log('  PASS ' + message);
+  else { console.error('  FAIL ' + message); failed++; }
+}
+function checkCase(name, runCase) {
+  try { runCase(); check(true, name); } catch (error) { check(false, `${name}: ${error.message.split('\n')[0]}`); }
+}
+function runRunner(args) {
+  return spawnSync(process.execPath, [RUNNER, ...args], { cwd: ROOT, encoding: 'utf8' });
+}
+function writeRegistry(name, mutate) {
+  const copy = JSON.parse(JSON.stringify(registry));
+  mutate(copy);
+  const file = path.join(workDir, name);
+  fs.writeFileSync(file, `${JSON.stringify(copy, null, 2)}\n`, 'utf8');
+  return file;
+}
+
+console.log('=== #325 3b historical qualification (archived by F4-T2) ===');
+
+// The full replay runs once, through the runner's JSON report. Every case must be a control or a qualified gap,
+// with matching parity between the two legs and no pilot credit.
+let report = null;
+// locks: historical — T2
+checkCase('expected-RED mode: every case is CONTROL_PASS or EXPECTED_RED and exits 0', () => {
+  const run = runRunner(['--expect-red', '--json']);
+  assert.strictEqual(run.status, 0, `exit ${run.status}: ${(run.stderr || run.stdout).slice(0, 400)}`);
+  report = JSON.parse(run.stdout);
+});
+
+// locks: historical — T2
+checkCase('expected-RED report: legs agree, controls are green, no pilot credit, runtime fingerprint matches', () => {
+  assert.ok(report, 'the report was produced');
+  assert.strictEqual(report.pilotCredit, false, 'preparation reports never grant pilot credit');
+  assert.strictEqual(report.runtimeFingerprintMatches, true, 'registry describes the current shared runtime bytes');
+  for (const item of report.cases) {
+    assert.ok(['CONTROL_PASS', 'EXPECTED_RED'].includes(item.status), `${item.caseId} is ${item.status}`);
+    assert.strictEqual(item.parity, 'match', `${item.caseId} source and packaged legs agree`);
+  }
+  const controls = report.cases.filter(item => item.status === 'CONTROL_PASS').map(item => item.caseId).sort();
+  // P02e is a control since F4-T3: its review gap closed (the ON self-authored review PASS is refused) and its registry entries were retired.
+  assert.deepStrictEqual(controls, ['P01', 'P02a', 'P02b', 'P02c', 'P02d', 'P02e', 'P02f', 'P02g', 'P04', 'P06', 'P07-fable-multi-agent-workspace', 'P07-fable-parallel', 'P07-fable-staged', 'P07u']);
+});
+
+// locks: historical — T2
+checkCase('gap registry: every entry is qualified and the expected-RED mode accounts for all of them', () => {
+  assert.ok(report, 'the report was produced');
+  const qualified = report.cases.flatMap(item => item.assertions.filter(entry => entry.status === 'gap-qualified'));
+  assert.strictEqual(qualified.length, registry.entries.length, 'each registry entry is observed exactly once');
+  assert.ok(!report.cases.some(item => item.assertions.some(entry => entry.status === 'gap-unqualified' || entry.status === 'unexpected-pass')));
+});
+
+// locks: historical — T2
+checkCase('strict mode fails on the recorded gaps and preserves the RED log', () => {
+  // Retargeted to P03 in F4-T3: P02e's gaps are closed, and P03 still has open verify-retry gaps on both legs.
+  const log = path.join(workDir, 'p03-red.json');
+  const run = runRunner(['--strict', '--case', 'P03', '--log', log]);
+  assert.strictEqual(run.status, 1, `strict mode exits 1 on gaps: ${run.stdout}`);
+  const saved = JSON.parse(fs.readFileSync(log, 'utf8'));
+  assert.ok(saved.cases[0].assertions.some(entry => entry.status === 'gap-qualified'), 'the log keeps the qualified gaps');
+});
+
+// locks: historical — T2
+checkCase('malformed registry is an infrastructure error, not a RED pass', () => {
+  const file = writeRegistry('missing-reason.json', copy => { delete copy.entries[0].reasonCode; });
+  const run = runRunner(['--expect-red', '--case', 'P01', '--registry', file]);
+  assert.strictEqual(run.status, 2, `registry errors exit 2: ${run.stdout} ${run.stderr}`);
+});
+
+// locks: historical — T2
+checkCase('a registry that omits a gap fails expected-RED mode', () => {
+  const file = writeRegistry('omit-gap.json', copy => { copy.entries = copy.entries.filter(entry => entry.assertionId !== 'P03.on.verify-retry-exit' || entry.distribution !== 'source'); });
+  const run = runRunner(['--expect-red', '--case', 'P03', '--registry', file]);
+  assert.strictEqual(run.status, 1, `an unqualified gap fails: ${run.stdout}`);
+});
+
+// locks: historical — T2
+checkCase('an unexpected PASS on a control fails expected-RED mode', () => {
+  const file = writeRegistry('unexpected-pass.json', copy => {
+    copy.entries.push({
+      caseId: 'P06', assertionId: 'P06.on.stop-satisfied', distribution: 'source', baselineSha: copy.baselineSha,
+      actual: 'satisfied', desired: 'running', blocker: '#341 E0', reasonCode: 'pretend-gap'
+    });
+  });
+  const run = runRunner(['--expect-red', '--case', 'P06', '--registry', file]);
+  assert.strictEqual(run.status, 1, `a passing assertion with a registry entry fails: ${run.stdout}`);
+});
+
+// locks: historical — T2
+checkCase('a runtime fingerprint change invalidates qualification and prints the exact deliberate re-capture command', () => {
+  const file = writeRegistry('stale-fingerprint.json', copy => { copy.runtimeFingerprint = '0'.repeat(64); });
+  const run = runRunner(['--expect-red', '--case', 'P01', '--registry', file]);
+  assert.strictEqual(run.status, 1, `a fingerprint mismatch fails: ${run.stdout}`);
+  const output = run.stdout + run.stderr;
+  assert.ok(output.includes('--recapture-candidate ci/fixtures/doc-obligations/reconciliation-prep/pending-red.candidate.json'), 'the re-capture command names the candidate');
+  assert.ok(/--baseline-sha [0-9a-f]{40}/.test(output), 'the re-capture command names the commit');
+  assert.ok(output.includes('nothing is auto-accepted'), 'the message says nothing is auto-accepted');
+});
+
+// locks: historical — T2
+checkCase('recapture writes a reviewable candidate and never the committed registry', () => {
+  const candidate = path.join(workDir, 'candidate.json');
+  const before = fs.readFileSync(path.join(PREP_DIR, 'pending-red.json'), 'utf8');
+  const run = spawnSync(process.execPath, [RUNNER, '--recapture-candidate', candidate, '--baseline-sha', registry.baselineSha, '--case', 'P06'], { cwd: ROOT, encoding: 'utf8' });
+  assert.strictEqual(run.status, 0, run.stderr);
+  assert.strictEqual(fs.readFileSync(path.join(PREP_DIR, 'pending-red.json'), 'utf8'), before, 'the committed registry is untouched');
+  const saved = JSON.parse(fs.readFileSync(candidate, 'utf8'));
+  assert.strictEqual(saved.entries.length, 0, 'a control case has no gaps to record');
+  assert.strictEqual(saved.runtimeFingerprint, registry.runtimeFingerprint, 'the candidate describes the current runtime');
+});
+
+// locks: historical — T2
+checkCase('a candidate with unreviewed reasons is rejected by the registry validator', () => {
+  const file = writeRegistry('unreviewed.json', copy => { copy.entries[0].reasonCode = 'needs-reason'; });
+  const run = runRunner(['--expect-red', '--case', 'P01', '--registry', file]);
+  assert.strictEqual(run.status, 2, 'an unreviewed reason is a registry error');
+});
+
+fs.rmSync(workDir, { recursive: true, force: true });
+console.log(failed ? `\n${failed} historical check(s) failed` : '\nAll historical checks passed');
+process.exitCode = failed ? 1 : 0;

package/ci/fixtures/doc-obligations/reconciliation-prep/cases.json

@@ -1497,7 +1497,11 @@
             "stepId": "req-review",
             "disposition": "pass",
             "evidence": "self-review by the author of the change"
-          }
+          },
+          "expectExit": {
+            "on": 2
+          },
+          "note": "F4-T3 decision 1 (#325 S2 slice plan, 2026-10-21): the ON self-authored review PASS is refused with exit 2 by the F4 I2a review-mode refusal; the step stays pending. OFF is unchanged."
         },
         {
           "id": "stop",
@@ -1787,7 +1791,11 @@
             "stepId": "req-review",
             "disposition": "pass",
             "evidence": "review scope recorded"
-          }
+          },
+          "expectExit": {
+            "on": 2
+          },
+          "note": "F4-T3 decision 1 (#325 S2 slice plan, 2026-10-21): the ON self-authored review PASS is refused with exit 2 by the F4 I2a review-mode refusal; the step stays pending. OFF is unchanged."
         },
         {
           "id": "verify-bind",
@@ -1797,7 +1805,11 @@
             "bindingId": "verification-loop",
             "disposition": "loaded",
             "evidence": "verification loop skill located"
-          }
+          },
+          "expectExit": {
+            "on": 2
+          },
+          "note": "F4-T3: refused with exit 2 on ON because the review step stays active after the refused review PASS (bindings may only be resolved for the active step). OFF unchanged."
         },
         {
           "id": "verify-pass",
@@ -1896,7 +1908,8 @@
               "exitCode"
             ],
             "operator": "equals",
-            "expected": 0
+            "expected": 2,
+            "note": "F4-T3 decision 1 (#325 S2 slice plan, 2026-10-21): the ON self-authored review PASS is refused with exit 2 by the F4 I2a review-mode refusal; the step stays pending. OFF is unchanged."
           },
           {
             "id": "verify-pass-exit",

package/ci/fixtures/doc-obligations/reconciliation-prep/pending-red.json

@@ -1,62 +1,14 @@
 {
   "schemaVersion": 1,
   "phase": "325-3b-H2",
-  "baselineSha": "5f9726c7d01364cb75a61eff54c8f5b89027e9d6",
-  "runtimeFingerprint": "50700bc05748ee1901279681c6bfc33f9676cbb3a1151edf775e8aa55fbe911f",
+  "baselineSha": "c271249a8a99d7e0320288af8cb086bb03f8fa1a",
+  "runtimeFingerprint": "a7679becc1cbd190377816c8c6cf14e2a1e94d42dd2a83bbd1ade5bd7b38153b",
   "entries": [
-    {
-      "caseId": "P02e",
-      "assertionId": "P02e.on.review-pass-exit",
-      "distribution": "source",
-      "baselineSha": "5f9726c7d01364cb75a61eff54c8f5b89027e9d6",
-      "actual": 0,
-      "desired": 2,
-      "blocker": "#341 E0",
-      "reasonCode": "self-review-pass-accepted"
-    },
-    {
-      "caseId": "P02e",
-      "assertionId": "P02e.on.stop-reports",
-      "distribution": "source",
-      "baselineSha": "5f9726c7d01364cb75a61eff54c8f5b89027e9d6",
-      "actual": [
-        "step:req-verify:pending",
-        "verify:pending",
-        "binding:req-verify:verification-loop:pending"
-      ],
-      "desired": "step:req-review:pending",
-      "blocker": "#341 E0",
-      "reasonCode": "unsatisfied-review-not-reported"
-    },
-    {
-      "caseId": "P02e",
-      "assertionId": "P02e.on.review-pass-exit",
-      "distribution": "packaged",
-      "baselineSha": "5f9726c7d01364cb75a61eff54c8f5b89027e9d6",
-      "actual": 0,
-      "desired": 2,
-      "blocker": "#341 E0",
-      "reasonCode": "self-review-pass-accepted"
-    },
-    {
-      "caseId": "P02e",
-      "assertionId": "P02e.on.stop-reports",
-      "distribution": "packaged",
-      "baselineSha": "5f9726c7d01364cb75a61eff54c8f5b89027e9d6",
-      "actual": [
-        "step:req-verify:pending",
-        "verify:pending",
-        "binding:req-verify:verification-loop:pending"
-      ],
-      "desired": "step:req-review:pending",
-      "blocker": "#341 E0",
-      "reasonCode": "unsatisfied-review-not-reported"
-    },
     {
       "caseId": "P03",
       "assertionId": "P03.on.verify-retry-exit",
       "distribution": "source",
-      "baselineSha": "5f9726c7d01364cb75a61eff54c8f5b89027e9d6",
+      "baselineSha": "c271249a8a99d7e0320288af8cb086bb03f8fa1a",
       "actual": 2,
       "desired": 0,
       "blocker": "#341 E0",
@@ -66,7 +18,7 @@
       "caseId": "P03",
       "assertionId": "P03.on.verify-retry-exit",
       "distribution": "packaged",
-      "baselineSha": "5f9726c7d01364cb75a61eff54c8f5b89027e9d6",
+      "baselineSha": "c271249a8a99d7e0320288af8cb086bb03f8fa1a",
       "actual": 2,
       "desired": 0,
       "blocker": "#341 E0",
@@ -76,7 +28,7 @@
       "caseId": "P05",
       "assertionId": "P05.on.stop-on-2-withheld",
       "distribution": "source",
-      "baselineSha": "5f9726c7d01364cb75a61eff54c8f5b89027e9d6",
+      "baselineSha": "c271249a8a99d7e0320288af8cb086bb03f8fa1a",
       "actual": 2,
       "desired": 0,
       "blocker": "#341 E0",
@@ -86,7 +38,7 @@
       "caseId": "P05",
       "assertionId": "P05.on.stop-on-3-withheld",
       "distribution": "source",
-      "baselineSha": "5f9726c7d01364cb75a61eff54c8f5b89027e9d6",
+      "baselineSha": "c271249a8a99d7e0320288af8cb086bb03f8fa1a",
       "actual": "running",
       "desired": "satisfied",
       "blocker": "#341 E0",
@@ -96,7 +48,7 @@
       "caseId": "P05",
       "assertionId": "P05.on.stop-on-2-withheld",
       "distribution": "packaged",
-      "baselineSha": "5f9726c7d01364cb75a61eff54c8f5b89027e9d6",
+      "baselineSha": "c271249a8a99d7e0320288af8cb086bb03f8fa1a",
       "actual": 2,
       "desired": 0,
       "blocker": "#341 E0",
@@ -106,7 +58,7 @@
       "caseId": "P05",
       "assertionId": "P05.on.stop-on-3-withheld",
       "distribution": "packaged",
-      "baselineSha": "5f9726c7d01364cb75a61eff54c8f5b89027e9d6",
+      "baselineSha": "c271249a8a99d7e0320288af8cb086bb03f8fa1a",
       "actual": "running",
       "desired": "satisfied",
       "blocker": "#341 E0",

package/ci/fixtures/doc-obligations/reconciliation-prep/trust-contract.json

@@ -121,7 +121,7 @@
     "baselineShaSemantics": "40-hex capture commit copied to every entry for provenance and internal consistency; it is not compared with the current checkout and does not qualify a gap.",
     "runtimeFingerprintContract": {
       "format": "64 lowercase hexadecimal SHA-256",
-      "scope": "Exact bytes of the ordered FINGERPRINT_FILES list in ci/prep/doc-reconciliation-red.js.",
+      "scope": "Exact bytes of the ordered FINGERPRINT_FILES list in ci/archive/325-prep/doc-reconciliation-red.js (historical T2 evidence, not a GREEN gate).",
       "currentFiles": [
         "hooks/scripts/lib/workflow-obligations.js",
         "hooks/scripts/workflow-disposition.js",
@@ -134,7 +134,7 @@
     "entryExactKeys": true,
     "assertionIdFormat": "<caseId>.on.<expectation-id> and must name an ON assertion in the corresponding case",
     "recapture": {
-      "command": "node ci/prep/doc-reconciliation-red.js --recapture-candidate ci/fixtures/doc-obligations/reconciliation-prep/pending-red.candidate.json --baseline-sha <40-hex-commit>",
+      "command": "node ci/archive/325-prep/doc-reconciliation-red.js --recapture-candidate ci/fixtures/doc-obligations/reconciliation-prep/pending-red.candidate.json --baseline-sha <40-hex-commit>",
       "review": "The runner writes a separate candidate. Review entries and reason codes before replacing pending-red.json, then delete the candidate; there is no auto-accept."
     },
     "distributionValues": ["source", "packaged"],

package/ci/fixtures/doc-obligations/reconciliation-s1/cases.json

@@ -2067,6 +2067,9 @@
             "stepId": "req-review",
             "disposition": "pass",
             "evidence": "self-review by the author of the change"
+          },
+          "expectExit": {
+            "on": 2
           }
         },
         {
@@ -2127,8 +2130,9 @@
               "exitCode"
             ],
             "operator": "equals",
-            "expected": 0,
-            "s1Kind": "control"
+            "expected": 2,
+            "s1Kind": "control",
+            "note": "F4-T3 decision 1 (#325 S2 slice plan, comment of 2026-10-21: S2 retires P02e x2, P03 verify-retry-exit, P05 x2). The ON self-authored review PASS is refused with exit 2 by the F4 I2a review-mode refusal; the step stays pending. The OFF expectation is unchanged."
           },
           {
             "id": "stop-exit-0",
@@ -2225,6 +2229,9 @@
             "stepId": "req-review",
             "disposition": "pass",
             "evidence": "review scope recorded"
+          },
+          "expectExit": {
+            "on": 2
           }
         },
         {
@@ -2235,7 +2242,11 @@
             "bindingId": "verification-loop",
             "disposition": "loaded",
             "evidence": "verification loop skill located"
-          }
+          },
+          "expectExit": {
+            "on": 2
+          },
+          "note": "F4-T3: after the ON review PASS is refused (review-pass exit 2) the review step stays active, so the verification binding is refused with exit 2 (bindings may only be resolved for the active step). Declared as an ON refusal; the OFF leg is unchanged."
         },
         {
           "id": "verify-pass",
@@ -2354,8 +2365,9 @@
               "exitCode"
             ],
             "operator": "equals",
-            "expected": 0,
-            "s1Kind": "control"
+            "expected": 2,
+            "s1Kind": "control",
+            "note": "F4-T3 decision 1 (#325 S2 slice plan, comment of 2026-10-21: S2 retires P02e x2, P03 verify-retry-exit, P05 x2). The ON self-authored review PASS is refused with exit 2 by the F4 I2a review-mode refusal; the step stays pending. The OFF expectation is unchanged."
           },
           {
             "id": "verify-pass-exit",