omp-conductor 0.19.5 → 0.19.7

package/src/verbs/server.ts

@@ -42,7 +42,7 @@ import { randomUUID } from "node:crypto";
 import { createServer, type Server, type Socket } from "node:net";
 import { join } from "node:path";
 
-import { resolvePolicy, resolveReleaseGrants, resolveReview } from "../config.ts";
+import { resolvePolicy, resolveReleaseGrants, resolveReview, resolveSharedInstallAuthority } from "../config.ts";
 import { wakeDispatch } from "../wake.ts";
 // The mediated release is the drain's closing gesture (#791): a successful
 // release ends this project's bounded release window, so the privileged half
@@ -60,6 +60,8 @@ import {
 import { releaseRefusal } from "../release-policy.ts";
 import { PR_LOOKUP_WINDOW_MS, REVISABLE_RUN_STATES, prReviewReadiness } from "../decisions.ts";
 import { LIVE_STATES } from "../store.ts";
+import { parseToSpecEvidence } from "../to-spec.ts";
+import { DENIED_RELEASE_GRANTS } from "../types.ts";
 import type {
   FileLane,
   IssueComment,
@@ -71,6 +73,7 @@ import type {
   ReleaseRequirement,
   ReleaseShape,
   RepoTarget,
+  ResolvedGrants,
   ReviewReason,
   RunRecord,
   RunState,
@@ -172,6 +175,9 @@ export interface ReleaseExecution {
 export interface InstallExecution {
   /** The published semver to pin all three surfaces to, exactly as npm has it. */
   version: string;
+  /** Shared host authority and scope, carried into the detached report. */
+  holder: ResolvedGrants["install"];
+  projects: readonly string[];
 }
 
 /**
@@ -222,6 +228,11 @@ export interface VerbDeps {
    * unreadable, and cannot pick up an operator's edit either.
    */
   project: () => ProjectConfig;
+  /**
+   * Every project served by the shared daemon, re-read from the same config.
+   * Host-global mutations use this set rather than the calling socket's project.
+   */
+  projects: () => readonly ProjectConfig[];
   store: Store;
   tracker: Tracker;
   actions: VerbActions;
@@ -632,7 +643,7 @@ async function decide(deps: VerbDeps, channel: VerbChannel, raw: unknown): Promi
     case "conductor_release":
       return releaseVerb(deps, project, channel, args, refuse, allow);
     case "conductor_install":
-      return installVerb(deps, project, channel, args, refuse, allow);
+      return installVerb(deps, channel, args, refuse, allow);
     case "conductor_pr_review":
       return prReviewVerb(deps, project, channel, args, refuse, allow);
     case "conductor_pr_review_clear":
@@ -1288,10 +1299,23 @@ async function labelVerb(
   let malformed: string | undefined;
   if (action === "add" && label === project.queueLabel) {
     const lane = await laneForEcho(deps, ref.issue);
-    if (lane !== undefined) {
+    if (lane.readable) {
       malformed = lane.malformed;
       echo = laneEcho(lane.lane);
     }
+    // The durable grooming verdict is an admission contract only while the
+    // dispatch brief still matches it (#1036): a stale issue body once
+    // promoted beside a PROMOTABLE verdict whose fileLane had moved on, and
+    // the run dispatched on the stale lane. So before any tracker mutation or
+    // daemon wake, a promotable row must verify against the same parse the
+    // echo reports — exact in both directions, order-insensitive. The syntax
+    // refusal below keeps precedence: fix the section first, then the contract.
+    if (malformed === undefined) {
+      const mismatch = promotionBriefRefusal(deps, project, ref.issue, lane);
+      if (mismatch !== undefined) {
+        return refuse("promotion-brief-mismatch", mismatch, ref.issue);
+      }
+    }
   }
   if (malformed !== undefined) {
     return refuse(
@@ -1344,32 +1368,99 @@ async function labelVerb(
  * The effective file lane admission will enforce for one issue, as the
  * one-line echo (#724), plus the malformed write-lane section marker (#825):
  * the body plus the whole comment thread, the same inputs `effectiveLane`
- * reads at admission. `undefined` when either read fails or the tracker cannot
- * produce the issue — the promotion is never blocked by its own feedback.
+ * reads at admission. `readable` says whether the issue and thread were read
+ * at all — the echo stays best-effort (an unreadable issue never blocks its
+ * own promotion, #724), but the promotion-brief gate (#1036) must be able to
+ * tell "no lane declared" from "could not look", because behind a durable
+ * `promotable` verdict the second is a fail-closed refusal rather than
+ * feedback.
  */
-async function laneForEcho(deps: VerbDeps, issue: number): Promise<
-  | { lane: FileLane | undefined; malformed: string | undefined }
-  | undefined
-> {
+async function laneForEcho(deps: VerbDeps, issue: number): Promise<{
+  readable: boolean;
+  lane: FileLane | undefined;
+  malformed: string | undefined;
+}> {
   let body: string;
   let comments: IssueComment[];
   try {
     const row = await deps.tracker.getIssue(issue);
-    if (row === undefined) return undefined;
+    if (row === undefined) return { readable: false, lane: undefined, malformed: undefined };
     body = row.body;
     comments = await deps.tracker.listComments(issue);
   } catch {
-    return undefined;
+    return { readable: false, lane: undefined, malformed: undefined };
   }
   const lane = effectiveLane(body, comments);
-  if (lane !== undefined) return { lane, malformed: undefined };
+  if (lane !== undefined) return { readable: true, lane, malformed: undefined };
   // No declaration parsed anywhere. If a clearly delimited write-lane section
   // exists anyway, the section tried to declare and failed — the echo must
   // refuse, never claim fail-open.
   const heading =
     writeLaneSectionHeading(body) ??
     comments.map((c) => writeLaneSectionHeading(c.body)).find((h) => h !== undefined);
-  return { lane: undefined, malformed: heading };
+  return { readable: true, lane: undefined, malformed: heading };
+}
+
+/**
+ * The promotion-brief gate (#1036): a durable `promotable` grooming verdict is
+ * an admission contract only while the dispatch brief still matches it, so a
+ * queue-label add must prove the match before any tracker mutation or daemon
+ * wake. Compares the lane admission would enforce (the same parse the echo
+ * reports) against the verdict's `fileLane` as deduplicated,
+ * order-independent path sets, exact in both directions — missing and extra
+ * paths refuse alike. Returns the refusal detail, or `undefined` when
+ * promotion may proceed: no grooming row, a non-`promotable` row, or a
+ * verified match.
+ *
+ * Fail-closed by design: evidence behind a `promotable` row that does not
+ * recover as a strict PROMOTABLE result (`parseToSpecEvidence`, the same
+ * restart round-trip the selection side trusts), or an issue that cannot be
+ * read to compare at all, refuses the promotion rather than dispatching on an
+ * unverifiable brief. The gate never edits the issue — it names both path
+ * sets and points at the verdict's `proposedBrief`; correcting the dispatch
+ * brief is an explicit orchestrator act.
+ */
+function promotionBriefRefusal(
+  deps: VerbDeps,
+  project: ProjectConfig,
+  issue: number,
+  read: { readable: boolean; lane: FileLane | undefined },
+): string | undefined {
+  const row = deps.store.grooming(project.name, issue);
+  if (row?.verdict !== "promotable") return undefined;
+  const result = parseToSpecEvidence(row.evidence);
+  if (result === undefined || result.verdict !== "PROMOTABLE") {
+    return (
+      `refused: ${project.queueLabel} was not added — #${issue}'s durable grooming row reads promotable, but its ` +
+      "evidence does not recover as a strict PROMOTABLE to-spec result, so promotion cannot prove the dispatch " +
+      "brief still matches what was groomed. Re-groom the issue so a fresh verdict replaces the row, then add the label again."
+    );
+  }
+  if (!read.readable) {
+    return (
+      `refused: ${project.queueLabel} was not added — #${issue} carries a durable PROMOTABLE grooming verdict, but ` +
+      "the issue could not be read, so the current brief cannot be compared with the verdict's file lane. " +
+      "Retry when the tracker responds."
+    );
+  }
+  // One closure so both sides of the comparison normalize in lockstep: a set
+  // comparison whose halves dedupe differently lies silently (#1036).
+  const normalizedPaths = (paths: readonly string[]): string[] =>
+    [...new Set(paths.map((path) => path.trim()).filter((path) => path.length > 0))].sort();
+  const brief = normalizedPaths(read.lane?.files ?? []);
+  const verdict = normalizedPaths(result.fileLane);
+  if (
+    brief.length === verdict.length &&
+    brief.every((path, index) => path === verdict[index])
+  ) {
+    return undefined;
+  }
+  return (
+    `refused: ${project.queueLabel} was not added — #${issue}'s current write lane [${brief.join(", ")}] disagrees ` +
+    `with its durable PROMOTABLE verdict's file lane [${verdict.join(", ")}]. The durable verdict is the admission ` +
+    "contract: apply the verdict's proposedBrief to the issue (its ## Exact write lane included), then add the " +
+    "label again. The gate never rewrites the issue itself."
+  );
 }
 
 async function releaseVerb(
@@ -1660,31 +1751,50 @@ async function releaseVerb(
 
 
 /**
- * The fleet-installs-itself request (#486).
- *
- * Gated like a release act: the caller must be an orchestrator (spec), and the
- * `install` shape must be granted to the orchestrator (release policy) — the
- * package floor's "nobody patches the running conductor" is the deny default
- * an operator deliberately moves, never something this verb works around.
- *
- * Everything past the gate is the privileged half's job: `actions.install`
- * refussses a version npm does not expose and starts the detached transient
- * unit. This verb records the request durably (the journal the post-restart
- * tick verifies against) and tells the caller where the evidence will land.
+ * The install is host-global: one package tree and daemon serve every project.
+ * Authority is therefore the consensus holder across the configured project
+ * set, never whichever project happened to invoke the verb (#1018). Mixed
+ * holders refuse before version lookup or transient-unit creation.
  */
 async function installVerb(
   deps: VerbDeps,
-  project: ProjectConfig,
   channel: VerbChannel,
   args: Record<string, unknown>,
   refuse: Refuse,
   allow: Allow,
 ): Promise<Verdict> {
-  const grants = resolveReleaseGrants(project);
-  const granted = releaseRefusal(grants, channel.role, "install");
+  let projects: readonly ProjectConfig[];
+  try {
+    projects = deps.projects();
+  } catch (err) {
+    const why = err instanceof Error ? err.message : String(err);
+    return refuse("config-unreadable", `refused: shared install authority could not be read (${why}).`);
+  }
+  if (projects.length === 0) {
+    return refuse("config-unreadable", "refused: shared install authority has no configured projects.");
+  }
+  const authority = resolveSharedInstallAuthority(projects);
+  const holderDetail = authority.entries.map((entry) => `${entry.project}=${entry.holder}`).join(", ");
+  if (authority.holder === undefined) {
+    return refuse(
+      "release-not-granted",
+      `refused: conductor_install is host-global, but configured install holders conflict (${holderDetail}). ` +
+        "No dispatch pause or transient install unit was created.",
+    );
+  }
+  const globalHolder = authority.holder;
+  const granted = releaseRefusal(
+    { ...DENIED_RELEASE_GRANTS, install: globalHolder },
+    channel.role,
+    "install",
+  );
   if (granted !== undefined) {
-    return refuse("release-not-granted", `refused: ${granted.reason}`);
+    return refuse(
+      "release-not-granted",
+      `refused: ${granted.reason} Shared-host holders: ${holderDetail}.`,
+    );
   }
+  const affectedProjects = authority.entries.map((entry) => entry.project);
 
   const version = args["version"];
   if (typeof version !== "string" || version.trim().length === 0) {
@@ -1695,16 +1805,21 @@ async function installVerb(
     );
   }
 
-  const outcome = await deps.actions.install({ version: version.trim() });
+  const outcome = await deps.actions.install({
+    version: version.trim(),
+    holder: globalHolder,
+    projects: affectedProjects,
+  });
   if (!outcome.ok) {
     return refuse("action-failed", `refused: the install request failed:\n${outcome.stderr}`);
   }
   const unit = outcome.detail;
   return allow(
-    `install requested: omp-conductor@${version} will be installed by a detached unit` +
+    `install requested by host-global holder ${globalHolder}: omp-conductor@${version} will be installed ` +
+      `for projects ${affectedProjects.join(", ")} by a detached unit` +
       `${unit === undefined ? "" : ` (${unit})`} that survives the restart. ` +
       "The first tick after the fleet restarts verifies version, /healthz, ticks, pane and doctor, " +
-"and the outcome is reported through the durable outbox.",
+      "and the outcome is reported through the durable outbox.",
   );
 }
 

package/systemd/omp-conductor-recover.sh

@@ -61,6 +61,7 @@ PROG=omp-conductor-recover
 SYSTEMCTL=${SYSTEMCTL_BIN:-systemctl}
 JOURNALCTL=${JOURNALCTL_BIN:-journalctl}
 CONDUCTOR=${OMP_CONDUCTOR_BIN:-omp-conductor}
+BUN=${BUN_BIN:-bun}
 
 # The fleet's conductor home: where config.json, the sqlite store and the
 # upgrade's durable snapshots live. The unit renders OMP_CONDUCTOR_HOME and
@@ -84,6 +85,12 @@ JOURNAL_LINES=${RECOVER_JOURNAL_LINES:-200}
 VERIFY_POLL_S=${RECOVER_VERIFY_POLL_S:-2}
 VERIFY_TRIES=${RECOVER_VERIFY_TRIES:-10}
 PROJECT=${RECOVER_PROJECT:-}
+# Recovery action scope and durable-report ownership are deliberately separate.
+# `RECOVER_PROJECT` is only safe on a single-project host; the report still
+# needs one configured project to own its outbox row on a shared host.
+REPORT_PROJECT=${RECOVER_REPORT_PROJECT:-$PROJECT}
+AFFECTED_PROJECTS=${RECOVER_PROJECTS:-$PROJECT}
+REPORT_ROUTING_NOTE=
 # The bound on the post-restore re-arm. `arm` with a claim-only proof performs
 # no Telegram send or wait, so it completes in milliseconds; the timeout exists
 # so a misbehaving conductor can never hang this bounded playbook (#613).
@@ -190,6 +197,40 @@ append_evidence() { # <evidence path> <text>
   printf '%s\n' "$2" >>"$1" 2>/dev/null || true
 }
 
+
+# Resolve the host-global report owner from the live machine-written config.
+# Bun is not an extra prerequisite: omp-conductor itself runs under Bun, and
+# the recovery unit's canonical PATH already contains that executable. When a
+# manual/degraded invocation cannot read the config, the script still attempts
+# the legacy unscoped report and records that degradation in the evidence.
+resolve_report_scope() {
+  if [[ -n $REPORT_PROJECT && -n $AFFECTED_PROJECTS ]]; then
+    return 0
+  fi
+  local lines first all
+  if lines=$(
+    "$BUN" -e '
+      const path = Bun.argv.at(-1);
+      const config = await Bun.file(path).json();
+      const names = Array.isArray(config.projects)
+        ? config.projects.map((project) => project?.name).filter((name) => typeof name === "string" && name.length > 0)
+        : [];
+      if (names.length === 0) process.exit(2);
+      console.log(names[0]);
+      console.log(names.join(","));
+    ' "$CONFIG_PATH" 2>/dev/null
+  ); then
+    first=${lines%%$'\n'*}
+    all=${lines#*$'\n'}
+    REPORT_PROJECT=${REPORT_PROJECT:-$first}
+    AFFECTED_PROJECTS=${AFFECTED_PROJECTS:-$all}
+  fi
+  if [[ -z $REPORT_PROJECT || -z $AFFECTED_PROJECTS ]]; then
+    AFFECTED_PROJECTS=${AFFECTED_PROJECTS:-unknown}
+    REPORT_ROUTING_NOTE="configured project resolution failed for $CONFIG_PATH; attempting the report without a project selector"
+  fi
+  return 0
+}
 # --------------------------------------------------------------------------
 # escalation — always, through the durable outbox (#123, #288)
 # --------------------------------------------------------------------------
@@ -199,23 +240,27 @@ append_evidence() { # <evidence path> <text>
 # (the durable outbox) before anything is sent, and the daemon owns delivery
 # with bounded retries once it is back. This script only ever enqueues.
 escalation_text() { # <failed-unit or empty> <action> <outcome> <evidence>
+  local projects=${AFFECTED_PROJECTS:-unknown}
   if [[ ${1:-none} == none ]]; then
     printf '%s\n' \
-      "fleet recovery (#485): a recovery trigger fired but no fleet unit was failing when it ran — the fleet got itself up or was started externally; evidence=$4"
+      "fleet recovery (#485): a recovery trigger fired but no fleet unit was failing when it ran — the fleet got itself up or was started externally; affected-projects=$projects; evidence=$4"
     return
   fi
   printf '%s\n' \
-    "fleet recovery (#485): $1 entered failed state; recovery=${2:-none}; outcome=${3}; evidence=${4}; next: read the evidence file (and its doctor output) before touching the fleet"
+    "fleet recovery (#485): $1 entered failed state; affected-projects=$projects; recovery=${2:-none}; outcome=${3}; evidence=${4}; next: read the evidence file (and its doctor output) before touching the fleet"
 }
 
 escalate() { # <failed-unit or empty> <action-name> <outcome> <evidence-path>
   local unit=${1:-none} text args
-  text=$(escalation_text "$unit" "$2" "$3" "$4")
-  if [[ -n $PROJECT ]]; then
-    args=("$CONDUCTOR" report --kind tier2 --project "$PROJECT" --text "$text")
-  else
-    args=("$CONDUCTOR" report --kind tier2 --text "$text")
+  resolve_report_scope
+  if [[ -n $REPORT_ROUTING_NOTE ]]; then
+    log "$REPORT_ROUTING_NOTE"
+    append_evidence "$4" "report routing: $REPORT_ROUTING_NOTE"
   fi
+  text=$(escalation_text "$unit" "$2" "$3" "$4")
+  args=("$CONDUCTOR" report --kind tier2)
+  [[ -n $REPORT_PROJECT ]] && args+=(--project "$REPORT_PROJECT")
+  args+=(--text "$text")
   say "escalation: ${args[*]}"
   if dry_run; then
     return 0
@@ -365,6 +410,9 @@ run_recovery() {
   done
 
   if dry_run; then
+    resolve_report_scope
+    say "plan: report owner — ${REPORT_PROJECT:-unscoped}; affected projects — $AFFECTED_PROJECTS"
+    [[ -n $REPORT_ROUTING_NOTE ]] && say "plan: report routing degraded — $REPORT_ROUTING_NOTE"
     say "dry run: nothing will be written or executed"
     [[ -z $failed ]] && say "plan: no unit failed — escalate only"
     if [[ -n $failed ]]; then

package/systemd/recover-unit-test.sh

@@ -50,6 +50,7 @@ fi
 
 tmp=$(mktemp -d "${TMPDIR:-/tmp}/omp-recover-test.XXXXXX")
 trap 'rm -rf "$tmp"' EXIT
+bun_bin=$(command -v bun)
 mkdir -p "$tmp/bin"
 
 # --------------------------------------------------------------------------
@@ -156,6 +157,18 @@ write_project_config() { # <case-dir> <proof>
   printf '{\n  "version": 2,\n  "projects": [\n    { "name": "demo", "arm": { "proof": "%s" } }\n  ]\n}\n' "$2" >"$1/state/config.json"
 }
 
+write_multi_project_config() { # <case-dir>
+  cat >"$1/state/config.json" <<'JSON'
+{
+  "version": 2,
+  "projects": [
+    { "name": "alpha" },
+    { "name": "beta" }
+  ]
+}
+JSON
+}
+
 run_recover() { # <case-dir> [env assignments…]
   local d="$1"
   shift
@@ -182,7 +195,9 @@ run_recover() { # <case-dir> [env assignments…]
 # marks the named unit active, which is what a real peer restart does to a
 # healthy peer), so tests wanting daemon-side healing pass HEAL_ON_START=<unit>
 # and the stub's `start` flips that unit back to active.
-run_with_heal() { # <case-dir> <heal-on-start>
+run_with_heal() { # <case-dir> <heal-on-start> [env assignments…]
+  local d="$1" heal="$2"
+  shift 2
   (
     cd "$here" || exit 1
     env \
@@ -190,14 +205,15 @@ run_with_heal() { # <case-dir> <heal-on-start>
       SYSTEMCTL_BIN="$tmp/bin/systemctl" \
       JOURNALCTL_BIN="$tmp/bin/journalctl" \
       OMP_CONDUCTOR_BIN="$tmp/bin/omp-conductor" \
-      RECOVER_STATE_DIR="$1/state" \
+      RECOVER_STATE_DIR="$d/state" \
       RECOVER_PROJECT=demo \
       RECOVER_VERIFY_POLL_S=0 \
       RECOVER_VERIFY_TRIES=3 \
-      STUB_CALLS="$1/calls" \
-      STUB_UNITS="$1/units" \
-      STUB_HEAL_ON_START="$2" \
-      bash "$recover" >"$1/out" 2>"$1/stderr"
+      STUB_CALLS="$d/calls" \
+      STUB_UNITS="$d/units" \
+      STUB_HEAL_ON_START="$heal" \
+      "$@" \
+      bash "$recover" >"$d/out" 2>"$d/stderr"
   )
   echo $?
 }
@@ -412,6 +428,83 @@ check 'a trigger with nothing failed escalates (fleet came back)' \
 check 'a trigger with nothing failed exits 0' '0' "$code"
 check 'a trigger with nothing failed clears the old counter' '0' "$(marker "$d")"
 
+# ---------------------------------------------------------------------------
+# case — a host-global recovery on a multi-project config still has one
+# deterministic outbox owner, while its body names every affected project.
+# ---------------------------------------------------------------------------
+
+d=$(newcase multi-project-report)
+write_multi_project_config "$d"
+unit_state "$d" omp-conductor.service active
+unit_state "$d" herdr-fleet.service active
+code=$(run_recover "$d" \
+  RECOVER_PROJECT= \
+  RECOVER_REPORT_PROJECT= \
+  RECOVER_PROJECTS= \
+  BUN_BIN="$bun_bin")
+report_call=$(grep '^omp-conductor report' "$d/calls" | head -n 1)
+check 'multi-project recovery exits after queuing its report' '0' "$code"
+check 'multi-project recovery uses the first configured outbox owner' \
+  '--project alpha' "$report_call"
+check 'multi-project recovery names every affected project' \
+  'affected-projects=alpha,beta' "$report_call"
+check 'multi-project recovery queues exactly one report' \
+  '1' "$(grep -c '^omp-conductor report' "$d/calls")"
+
+d=$(newcase multi-project-recovery-action)
+write_multi_project_config "$d"
+unit_state "$d" omp-conductor.service active
+unit_state "$d" herdr-fleet.service failed
+code=$(run_with_heal "$d" herdr-fleet.service \
+  RECOVER_PROJECT= \
+  RECOVER_REPORT_PROJECT= \
+  RECOVER_PROJECTS= \
+  BUN_BIN="$bun_bin")
+report_call=$(grep '^omp-conductor report' "$d/calls" | head -n 1)
+check 'verified multi-project recovery action exits cleanly' '0' "$code"
+check 'verified multi-project recovery action queues one scoped report' \
+  '1' "$(grep -c '^omp-conductor report' "$d/calls")"
+check 'verified multi-project recovery action uses configured owner' \
+  '--project alpha' "$report_call"
+check 'verified multi-project recovery action names every project' \
+  'affected-projects=alpha,beta' "$report_call"
+
+d=$(newcase multi-project-dry-run)
+write_multi_project_config "$d"
+unit_state "$d" omp-conductor.service active
+unit_state "$d" herdr-fleet.service failed
+code=$(run_recover "$d" \
+  RECOVER_PROJECT= \
+  RECOVER_REPORT_PROJECT= \
+  RECOVER_PROJECTS= \
+  RECOVER_DRY_RUN=1 \
+  BUN_BIN="$bun_bin")
+check 'multi-project dry run exits cleanly' '0' "$code"
+check 'multi-project dry run names its report owner' \
+  'plan: report owner — alpha' "$(cat "$d/out")"
+check 'multi-project dry run names every affected project' \
+  'affected projects — alpha,beta' "$(cat "$d/out")"
+
+d=$(newcase report-routing-fallback)
+unit_state "$d" omp-conductor.service active
+unit_state "$d" herdr-fleet.service active
+code=$(run_recover "$d" \
+  RECOVER_PROJECT= \
+  RECOVER_REPORT_PROJECT= \
+  RECOVER_PROJECTS= \
+  BUN_BIN="$bun_bin")
+report_call=$(grep '^omp-conductor report' "$d/calls" | head -n 1)
+check 'unreadable config routing still attempts a durable report' \
+  'omp-conductor report --kind tier2 --text' "$report_call"
+if [[ $report_call == *"--project "* ]]; then
+  fail "routing fallback does not guess an unconfigured project — $report_call"
+else
+  pass 'routing fallback does not guess an unconfigured project'
+fi
+check 'routing fallback remains a successful recovered run' '0' "$code"
+check 'routing fallback is preserved in durable evidence' \
+  'attempting the report without a project selector' "$(cat "$d/state/recovery"/evidence-*)"
+
 # ---------------------------------------------------------------------------
 # case DRY-RUN — the operator's rehearsal mode prints decisions and mutates
 # nothing, not even the recovery dir or the fixture call log.