swarm-orchestrator 14.0.2 → 14.2.0

package/CHANGELOG.md

@@ -1,6 +1,395 @@
 # Changelog
 
-## Unreleased
+## 14.2.0 - 2026-09-27
+
+### Fixed
+
+- Rejected acceptance authority for candidate-controlled Playwright JSON. Sealed browser
+  instruments use harness configuration, immutable image dependencies and exact test identities.
+- Retained unavailable package checks through sealing, final assessment and reviewer reports,
+  separating absent optional tools from unavailable required checks.
+- Provisioned Chromium and the isolated browser runtime in clean Linux gate workflows;
+  nightly failure notifications no longer require an optional repository label.
+- Reopened the prior completion claim after the independent audit. Corrective delivery and
+  release status are tracked in [audit corrections](docs/upgrade-audit-corrections.md).
+
+### Added
+
+- Shared model-free branch/PR snapshot verification, reviewer Markdown and versioned JSON source
+  identities alongside patch mode. Standalone source tarballs build and install without providers.
+- Declared npm/pnpm and uv/existing-venv initialization, explicit package scopes, structured
+  Vitest/pytest outcomes, and sealed CLI, local HTTP and optional Playwright behavior checks.
+- Bugfix, refactor and dependency-upgrade presets on the existing engine, with base controls,
+  narrow manifest authorization, locked preparation and recorded installed versions.
+- One explicitly authorized capability escalation with deterministic failure classification,
+  original budget limits and recovery reconciliation. A configured cloud key grants no consent.
+- Trusted-source Action infrastructure and separate good/bad behavioral workflow controls.
+  Source delivery and package publication remain separate; exact validation is tracked in
+  [the upgrade ledger](docs/upgrade-completion.md).
+
+- **An approval mode, asked once per workspace.** The first terminal run asks whether commands
+  off the shell allowlist may be approved automatically and writes the answer to `swarm.toml`
+  as `[tools] approval`; `--approve ask|auto` and `SWARM_APPROVAL` override it. Under `auto` the
+  run answers an allowlist prompt itself and records it as pre-approved; a derivation-heuristic
+  prompt, the injection defence, asks under either mode. Every prompt gains `a`, always: the
+  call runs and its off-list programs are allowed for the rest of that run, recorded as a
+  `run-allowance` ledger record. The screen's header shows the mode.
+- **The default model is the best served local model for this hardware.** With nothing pinned
+  and no calibration, a run discovers the local backends, ranks what they serve by the
+  shortlist's tier for the probed hardware, prints the choice and its reason before the session
+  opens, and records it as a `model-default` ledger record. A frontier key is used only where
+  nothing local is served; with neither, the run stops and names the remedies instead of
+  defaulting to a provider it has no key for.
+- **A preflight card, and a screen that says what became of each step.** Before the screen goes
+  up, `swarm run` and `swarm session` print four lines to stderr naming the repository and base
+  commit, the manifest, the model with the reason it was chosen, and the approval mode. On the
+  screen, the header's second line reads elapsed, step, tokens, attempt, ratchet, model,
+  approval and workspace, and stays at every width; each timeline row starts with a status
+  mark and the clock time it landed; the gate strip counts passed, failed and not-applicable.
+  A finished run ends on a finish card: the verdict, duration, steps, tokens and cost, then the
+  review page and the bundle as rows a terminal that understands OSC 8 shows as clickable
+  links. Marks fall back to ASCII where the locale is not UTF-8. The plain-line stream that CI
+  and pipes read is byte-identical to before.
+- **`swarm-verify`, the verification path as its own package.** `packages/swarm-verify` builds a
+  binary carrying `verify`, `ci` and `gates` from the same modules `swarm` runs under those names,
+  parsed by the same parser, so an invocation reads the same through either. It carries no
+  provider, worker or screen module and none of the agent's run assembly: a test walks its import
+  closure and the build refuses to emit a crossing. A test verifies a committed bundle through
+  both binaries and compares the bytes. Version 0.2.0 has a separate release workflow; the packaged check
+  packs it, installs it beside the full CLI, and runs the tamper demo through it.
+- **An agent can record a file as temporary, and is held to removing it.** `declare_file_set`
+  and `amend_file_set` take `temporary`: paths created only to investigate, such as a probe
+  script. The blocking `file-set` gate fails while one is still in the change and names it. An
+  amendment can keep one on purpose with `retain`, and its reason then shows on the ledger, in the
+  reviewer's claim and in the gate's output on every pass. Nothing is deleted behind the model's
+  back and nothing reads a filename. Two repairs in the reach-pressure run left a scratch script
+  in their final patch, and membership alone had passed both.
+- **Derived evidence packs losslessly inside the tree.** `scripts/evidence-pack.mjs` packs tracked
+  review pages and run transcripts under a root into one `utf8-file-map-brotli` archive with a
+  digest for every original, removes originals only after the written archive has been unpacked
+  and compared, and `npm run checks` verifies every committed pack. Ledgers, DAGs, manifests and
+  verifiers can never be packed. The tracked tree went from 99.8 MB to about 90.5 MB with every
+  cited bundle still verifying, and the weight check now also requires 6 MB of headroom so the next
+  experiment's evidence has somewhere to go.
+- **A repair is read as what it did to the verifier's findings.** Experiment rows record, per
+  invocation, one of `patch-unchanged`, `findings-identical`, `findings-moved`, `findings-shrank`,
+  `findings-grew` or `satisfied`, with both finding sets, both patch digests and the files that
+  entered or left the patch, plus the same from the fork to the final patch. No score is computed.
+  Generation 3's nine "repairs exhausted" split into six unchanged patches, two that grew the
+  findings by leaving a scratch file, and one that changed bytes and no finding.
+
+### Fixed
+
+- **Reach reports `unmeasured`, not `reached`, for a change it could not measure at all.** A
+  change made only of documentation, types and its own tests skipped every file, left nothing
+  unreached and read as a measurement. Certification treats the two alike; a reader does not.
+  The verdict now carries every file reach set aside with its reason (`setAsideByReach`) and
+  `swarm ci` prints them. One path rule serves reach, the mutant planner, the patch metrics and
+  the PR miner, which had each spelled it separately: the miner still read a tsd type test as
+  source. tsd's `test-d/` directory and the `_test` suffix are recognized, and scratch scripts and
+  JavaScript tool configuration stay judged.
+- **Three campaign runners asked whether the model lists, not whether it generates.** A wedged
+  local server answers `/models` and completes nothing. `pr-task-pass` probed `/models`, and only
+  when a patch was empty, so a partial patch left by a server that died was judged as the model's;
+  the pilot campaign's health effect returned the literal `healthy: true`; `run-campaign` had no
+  probe. All three ask the configured model for a bounded completion after every invocation. The
+  probes are `endpointListsModels` and `endpointGenerates` in a module of their own, the second
+  names why it failed, and `pr-task-pass` keeps an infrastructure attempt apart from `runs`, where
+  it used to mark its task done and get re-judged.
+- **A failed model call records whether the harness cancelled it.** A call cut off at the wall
+  budget and a provider that raised were both `call-failed`. Every unknown-usage invocation of the
+  reach-pressure run was the first kind, and nothing on the ledger said so.
+- **Unknown usage is no longer added in as zero.** The experiment analysis summed a null model-call
+  count as 0; arm scoring priced a crashed run at $0 and printed dollars per accepted patch off the
+  sum; calibration divided all tokens by all time, so a model with one call cut off measured
+  slower than it is. A total is a number only where every part was measured, and the known part
+  is kept under its own name. The core loop's token total is unchanged and now travels with
+  `callsWithUnknownUsage`.
+- **The experiment analyzer cannot overwrite what a run published.** `analyze` wrote its summary
+  and page in place. It now refuses where the bytes differ and writes to `--out` with a
+  `derivation.json` naming the acquisition identity, the identities it was derived with, and every
+  value changed, added or removed. `run` and `score` refuse to write beside rows of another
+  protocol identity, which only `analyze` had checked, and identity is read before a row is
+  parsed. Generation 3's published summary re-derives with no value changed.
+- **The router considers every model the table has measured, not only the last sweep's pair.**
+  The calibration pick's candidates were the models the last sweep ran together, so a model with
+  the best evidence of all on a class was never in the running when a later sweep happened not
+  to include it: on one machine qwen3.6 held the best edit share across two sweeps and the router
+  chose between gemma4 and mistral. The candidates are now the pick's own plus every model the
+  competency table has measured on the task's class, on the same golden set, at or above the
+  floor, restricted as before to what the backend serves.
+- **A turn cut off at the output cap is not a completion.** A live run's only turn was the
+  marker `<channel|>` repeated to the 8192-token cap around a fragment of a plan, with no tool
+  called; the loop read the cut-off text as the model's account of finishing, the gates ran
+  green over an unchanged workspace, and the run ended "work accepted" with nothing written.
+  Two of five samples of the same request against gemma4:31b behind Ollama spiral the same way.
+  A turn cut off at the cap before it called a tool is now sampled again, its text never becomes
+  the plan or the claim, and a run whose every sample is cut off stops as `output-cap`. A stream
+  that repeats one short unit 96 times in a row is cut off there and sampled again, rather than
+  running minutes to the cap. The finish card over an unchanged workspace says nothing was done
+  instead of repeating the assessment, and the header's elapsed counter stops when the card
+  goes up.
+- **A run stops before the session where it could never go green.** A directory that is not a
+  repository, a `--base` that does not resolve, and a repository with no manifest each used to be
+  found out after the model had worked: eight steps in one case, three attempts and 112,000
+  tokens in another, then a first gate saying "add the manifest". `run` and `session` now check
+  the base commit and the manifest first. With no manifest, `swarm` on a terminal offers to add
+  a Node harness (`package.json` running `node --test`, and `.gitignore`) and commit it; off a
+  terminal, or declined, it stops with the remedy named.
+- **An interpreter cache is not a change.** Running a Python test writes `__pycache__`, and the
+  file-set gate charged that as an edit outside the declared set, after which the ratchet
+  rejected the attempt for a gate that had passed before and discarded the work. `__pycache__`,
+  `.pytest_cache`, `.mypy_cache` and `.ruff_cache` are excluded from the change set by name.
+- **A stopped run says what stopped it.** A cancellation during a model call reported "model
+  error: This operation was aborted", the transport's words. The signal now carries the reason
+  (cancelled from the keyboard, or the run's wall budget spent) and the loop reports it.
+- **A refused assessment names only what refused.** The status line read "work refused: work
+  refused: required checks passed, lifecycle interrupted, ..." beside four failed gates. It now
+  reads, for example, "work refused: the gates settled escalated; the run was cancelled".
+- **The macOS keychain is asked whether a default keychain exists before a signing key is
+  added.** `security add-generic-password` with no default keychain raises a dialog and blocks
+  until the store kills it; the probe fails cleanly instead and the run signs with a per-run key.
+
+### Measured
+
+- **Enforcing changed-line reach after visible acceptance changed no held-back verdict in 79
+  mined tasks.** A pre-registered shared-prefix experiment ran each task until the visible half of
+  its oracle first accepted, took that patch as the control, and forked a reach condition from the
+  same workspace that was told which added lines the oracle never executed. Thirteen tasks reached
+  visible acceptance, reach triggered on nine, no repair satisfied it, and the held-back half
+  agreed on every pair: 12 pass both, 67 fail both, zero discordant, exact McNemar p = 1, paired
+  difference 0.0 points, 95% CI [-4.0, +4.0]. Three repairs changed bytes, none narrowed the
+  implementation, two left scratch files behind. Six of the nine refusals named a tsd type-test
+  file no runner executes. The protocol, rows, patches and a report that re-derives from the rows
+  are in [`docs/evidence/2026-09-17/reach-pressure-experiment/`](docs/evidence/2026-09-17/reach-pressure-experiment/report.md).
+  Two earlier generations were stopped on instrument defects and are kept beside it. The instrument
+  defects it exposed, and what closed each without touching a row, are in
+  [`docs/evidence/2026-09-18/reach-pressure-hardening/`](docs/evidence/2026-09-18/reach-pressure-hardening/README.md).
+
+### Changed
+
+- **The verify-only commands are command definition data.** `verify`, `ci` and `gates` are marked
+  as needing no model, and a test runs each through the real CLI with no provider key and the
+  local endpoint pinned to a closed port. `docs/verify-only.md` walks all three through on
+  committed artifacts, with every transcript captured from the command it sits under.
+
+- **Node 22 runs the tool; Node 24 is needed only for the coverage measurement.** The whole CLI
+  refused to start below Node 24 because the changed-line coverage arm spawns node's test runner
+  with `--test-isolation=process`, which Node 22 rejects. Now `engines.node` is `>=22`, every
+  command runs there, and on a Node below 24 the tests gate runs the project's own test command
+  while the coverage arm reports `unmeasured` with the reason named in the gate-run record and in
+  the ratchet's abstention. Unmeasured never renders as a pass, so a change touching covered
+  lines fails the ratchet on that runtime rather than passing quietly. `swarm doctor` reports
+  which Node it found and what that disables.
+
+## 14.1.0 - 2026-09-14
+
+### Added
+
+- **Goal runs now complete through adaptive integration.** `swarm parallel --goal` creates one
+  shared run context before planning, resolves each task contract into enforced paths, tools,
+  checks, runtime policy and budget, and schedules ready work without whole-layer barriers. Merge
+  conflicts, behavioral failures and ratchet rejections retain their candidate commits and create
+  bounded repair attempts against the current integration tree. Missing prerequisites, coupled
+  tasks and repair routes use append-only graph revisions that preserve requirement identities.
+  Final status comes from independent checks of the exact integrated tree. `resume` rebuilds the
+  durable controller state and will not duplicate an accepted landing. The pilot driver and its
+  paired evaluation remain descriptive evidence, not a claim of universal correctness or swarm
+  superiority.
+
+- **The oracle bond asks something of ordinary code.** Its five operators each needed a particular
+  token on the line, and a guard clause, an assignment, a `require` and a callback carry none of
+  them, so `not-bonded` was what a bond said when it had nothing to ask rather than when it had
+  found a strong oracle. Both adversarial false greens are that shape and produced zero mutants
+  between them across every line they add. Three more operators cover the statement shapes that
+  went uncovered: an `if` or `while` condition negated whole, the value a plain assignment or
+  declaration writes replaced by a sentinel, and the statement removed. They are read off the
+  language's own `Statement` productions rather than off the patches that exposed the gap, because
+  operators fitted to the cases that motivated them measure the fitting, and the derivation, the
+  ordering and which tasks were in sample were committed before any of it was implemented:
+  [`docs/oracle-bond-operators.md`](docs/oracle-bond-operators.md). All eight fire on the mined
+  corpus and the three new ones account for 25 of the 34 mutants built. `koa#1999`, the patch a
+  rejected stricter option would have cost because nothing here could change any of its added
+  lines, certifies on `held`.
+- **A deleted statement is confirmed to parse before it is read as evidence.** Statement deletion
+  is the one operator that can leave a file which does not compile, and every oracle refuses one of
+  those, so a bond counting that refusal would credit the oracle with a rejection it never made. It
+  runs `node --check` over the file the patch left and over the file with the line blanked. Where
+  the original does not parse, node cannot read the dialect and so cannot tell a syntax error from
+  a mutant: the operator proposes nothing for that file and the other seven still apply, which is
+  what TypeScript and JSX get.
+- **A vacuous bond names what showed the mutant changed anything.** An oracle accepting a mutant
+  means nothing unless the mutant was a change, and what established that was a person reading each
+  mutated line: an audit that found two equivalent mutants, does not scale, and is not evidence
+  anybody else can re-derive. Every mutant the oracle accepted on a line it ran is now adjudicated
+  by a second detector, cheapest first. The oracle runs again under the same instrumentation reach
+  uses, and a line other than the mutated one that ran in one reading and not the other is a
+  demonstrated difference in what the program did; failing that, the repository's own gates that
+  passed with the patch are run again. Neither seeing anything is recorded as such, and a suite run
+  that was never spent says so rather than answering. What the pair cannot see is named: a mutant
+  that changes only a value on a path that runs either way, in code the project did not have
+  before.
+- **`scripts/deadline-overshoot.mjs`, and gate 9 has a number.** Twenty samples with a real child
+  that outlives its deadline and the whole cancellation tree between them. Worst overshoot 3ms,
+  1.20% of a 250ms budget against the 2% the gate asks, and the budget floor is printed beside the
+  percentage because the percentage depends on both. The wall clock rather than an injected one: a
+  driven clock reports zero by construction, which is the one answer this cannot be allowed to
+  give.
+- **`scripts/task-difficulty.mjs`, and gate 7's blocker was misdiagnosed.** That row said the
+  discriminating corpus has three tasks and more would have to be authored by hand. They are
+  already mined: over the pull-request corpus this model solves 11 of 79, 13.9% [8.0, 23.2], spread
+  across fourteen repositories. A set where the model both succeeds and fails is what a paired test
+  needs and what the golden set does not give. What is left is arm selection in the mined pass and
+  a second run of every task, neither of which is authoring.
+- **The adversarial arm's numbers come out of the same script as the rest.** They were in prose and
+  nothing re-derived them. `separateAdversarialRows` also keeps them out of every other rate by a
+  check rather than by which file a row sits in, since a model shown its acceptance test is a
+  different sampling process rather than a harder subset of one.
+
+- **`swarm ci` refuses to certify on an oracle that never ran the change.** An oracle is evidence
+  only about the code it executed, so the run reports `oracleReach`, and a change the oracle
+  demonstrably skipped is not verified. The unreached lines are named, because "extend the oracle
+  to cover the lines the patch added" is not actionable without them. Reach is measured only where
+  the harness can rebuild the oracle's invocation as an argument vector it controls, per invariant
+  7; anywhere else it reads `unmeasured`, which blocks nothing. koa#1946, the first false green
+  this project found, is refused by it: its oracle never executed lines 270-273 of the file it
+  certified. Across both corpora the check produced no false reds.
+
+### Fixed
+
+- Run the deadline measurement tests after competing test processes finish, retaining the
+  existing timing bounds. A hosted macOS run exposed a 255 ms overshoot under concurrent suite
+  load; that failed observation remains recorded in the implementation evidence.
+
+- **A regular expression is masked like the literal it is.** The claim beside the deletion parse
+  check was that no other operator can leave a file which does not parse, and that claim is why
+  only one operator is checked at runtime. Measured across every operator over 186 real files, it
+  was false: `swap-call-arguments` broke 1 of its 105 on a line splitting on a pattern whose own
+  comma is part of it. `withoutLiterals` masked strings and comments and had never masked a
+  pattern, so the argument scan read that comma as an argument separator and swapped halves of a
+  regex; the same blindness reached every operator that looks for a token, since a comparison
+  inside a pattern is not a comparison. Which of two things a slash is gets settled by what
+  precedes it, wrong only in the direction that masks too much and costs a mutant. Re-measured over
+  the same files: 2,702 mutants and every operator but the deletion at zero.
+- **An empty patch is not charged to the model unless the endpoint answered.** An MLX server ran
+  out of GPU memory mid-batch, inside `mx.eval` over its own prompt cache, and every task after it
+  came back with a zero-byte patch recorded as the model writing nothing. That is the
+  misattribution this corpus was already bitten by in the other direction, when twelve rows the
+  agent had failed on were reported as an oracle nobody could run. `scripts/pr-task-pass.mjs` now
+  probes the endpoint before the pass and again after any empty patch, records nothing where it
+  does not answer, and stops, because every task after an endpoint failure records the same wrong
+  thing. Not under `--rejudge`, which re-derives verdicts from recorded patches and asks no model
+  anything.
+- **`swarm ci` stops printing one sentence for two different absences.** `unshown` said "the oracle
+  accepted, and nothing shows it ran the mutated lines" even where it had run them and no detector
+  could show the mutant changed anything, which sends a reader to inspect coverage that is fine. The
+  line names which absence it is, and a gap names what witnessed it, because a refusal resting on an
+  instrument and one resting on the operator alone are different amounts of evidence.
+- **The deadline overshoot test measured the machine rather than the tool.** It went red inside its
+  own suite. Overshoot is scheduling and does not shrink with the budget, so 2% of a 500ms budget is
+  10ms of headroom and the whole suite running in parallel ate it: 3ms idle, 5ms with eight
+  processes spinning, more than 10ms under the suite. The 2% claim is now made at a two-second
+  budget where 40ms stands against a measured 2 to 5, the absolute number is asserted separately,
+  and gate 9's row says the published 1.20% is an idle-machine number.
+- **The bond stops spending detectors once the verdict cannot change.** Which fact the verdict rests
+  on also decides when adjudicating can stop, and the loop read only one of the two, so detectors
+  were spent looking for something that could not change the answer. One coverage reading and at
+  most one suite run per patch now. That also removed a state the record could not describe
+  honestly, a mutant past the bound on suite runs recorded as not adjudicated while coverage had
+  been asked and been silent.
+- **Two imports nothing in `src/cli-select.ts` used**, and an empty shell argument read as a path.
+  `sed -i '' 's/a/b/' file` is the in-place form every macOS invocation uses and it was refused with
+  "the path is empty", because the quoted empty argument reached a check whose whole subject is
+  paths.
+- **Three attacks that got past the policy guard.** Every security case in this repository was
+  written by whoever wrote the defence, so `src/tools/guard-attacks.test.ts` was written the other
+  way round. Casing: macOS and Windows are case-insensitive by default, so `.ENV` opens `.env`, and
+  every pattern in the credential denylist was case-sensitive. Measured on APFS before the fix,
+  `readFileSync('.ENV')` returns what `.env` holds, and `realpathSync` hands back the casing it was
+  given rather than the casing on disk, so nothing upstream normalized it; `SWARM.TOML`,
+  `server.PEM`, `.git/CONFIG` and a differently cased denied root were the same hole. The denial
+  comparisons now fold, whatever the host filesystem does, because a denial whose verdict depends
+  on which machine ran it is the defect. The workspace containment check does not fold: that one
+  decides whether anything is allowed at all, and folding it is the fail-open direction. A revision
+  and a path in one word: `git show HEAD:.env` prints a credential file and the word the guard
+  ruled on matched no pattern. A path inside a word the shell passes whole: `sed -n
+  'w /home/dev/.ssh/authorized_keys'` writes outside the workspace and the operand was the whole
+  script. A word now offers every path it could open, its whitespace-separated pieces and what
+  follows a colon, each through the same guard, with a URL scheme left alone. Two attacks still
+  succeed and are asserted as succeeding, because a residual nobody can point at is not named:
+  `git config --list` reads a denied file without naming it, and `node -e "..."` is an allowlisted
+  interpreter handed a program.
+- **vitest and `@vitest/coverage-v8` to 4.1.11, for GHSA-82fw-gwwq-j7x9.** A path traversal in
+  `@vitest/mocker`'s redirect mock, CVSS 5.9, published 2026-09-08 against every version from
+  2.1.0. Dev-only and inside the range `package.json` already declared, so the lockfile was the
+  only thing holding the tree on 4.1.10. The coverage provider is pinned exactly rather than
+  ranged, so it moves in the same change or it drifts away from the runner it instruments. This is
+  the first finding the weekly scan has produced that was the world changing rather than the tree:
+  it landed a day after the last scheduled run, and the scan caught it on the next.
+- **A dynamic gate the harness ran itself now counts as having executed the change.** Reported from
+  outside against e261c859b: a project declaring a linter and no test runner settled green over a
+  changed source file that nothing had executed, because the check for "was this change measured"
+  asked only whether some command gate had passed and a linter is one. That reading was replaced by
+  what a gate is capable of establishing, and half the old predicate was left behind: it still
+  asked for a command as well, which discards the behaviour probe, an inspection that imports the
+  changed module and calls its functions. So the probe's classification was dead, and with it the
+  two abstentions added to keep a probe that measured nothing from reading as a pass, and a project
+  with no declared runner spent every attempt and escalated saying nothing had run over a change
+  its own probe had just run. Capability decides it now, and the gate's shape decides nothing. The
+  reported case is driven whole in `src/gates/static-only-project.test.ts`, with the changed file
+  instrumented so that executing it leaves a trace: it settles green only where the trace exists.
+- **The weekly scan reports what somebody can act on.** It read 16,731 files, nearly all of them
+  captured evidence, and 171 of its 177 findings were one rule firing once per copy of the
+  re-derivation script that every exported bundle carries. Editing a bundle to quiet a scanner
+  falsifies the record it exists to be, so those paths are data the scan does not read, and the
+  finding was fixed where it lives: the template in `src/evidence/verifier/rederive.mjs` was
+  missing the suppression its mirror in `src/gates/parsers.ts` already carried. The other five in
+  source are dispositioned at the line that carries each, one of them a fix: a `replace` stripping
+  the first `$` of a pattern where every one of them was meant. The scan now reads 1,050 files and
+  reports nothing. It also stops opening a fresh issue every Monday for findings that have not
+  changed: it comments on the open one, since three identical notifications is how a scan teaches
+  people to close it unread.
+- **An invocation the harness could not read, so it could not measure.** The recognizer that
+  decides whether the harness controls a command read quoted text as bare: a title filter's `|`
+  tripped its shell-operator scan and its spaces split one argument into several, so no real
+  oracle could be vouched. Quoting is read now, which is narrower than a shell rather than wider:
+  nothing expands, nothing is escaped, and an operator outside quotes still ends the reading.
+  Vouching those commands then exposed that a flag whose value is the next argument was being
+  separated from it, which asked node to filter titles by a coverage flag and to run a test file
+  named after the titles.
+- **The patch's own tests are not code the oracle skipped.** An acceptance oracle runs its own test
+  file and never the candidate's, so the candidate's tests are absent from every coverage report by
+  construction. Counting them refused patches that both oracles accept, which is nearly every
+  well-behaved change, since a feature is expected to arrive with its tests.
+- **Reach measured the tree the oracle judged.** Two paths reverted the patch and left it reverted:
+  the vacuity check stashed it and popped it back without checking the pop, which fails when the
+  patch adds a file the oracle overwrites, and attribution reverts it to measure the base. Both
+  meant later measurements were taken on the base commit and reported as though they were about the
+  patch. The revert and re-apply are checked now, and a checkout that could not be put back makes
+  reach abstain rather than measure whatever the tree holds.
+- **`swarm ci` stops what it started.** The command installed no signal handler, so a Ctrl-C or a
+  supervisor's SIGTERM ended the CLI and left its test runners reparented and running: two node
+  processes from an oracle were found holding a checkout open five hours after the run that started
+  them had gone. It takes the same cancellation the run commands use, so a stop reaches the process
+  group rather than only the process.
+- **An oracle that cannot judge is not an oracle that refused.** The corner classifier read the
+  held-back verdict as a boolean, folding "accepts the base too" and "could not be run" into a
+  refusal. Both now classify as unjudgeable and leave the denominator, with the count reported
+  beside the rate. This cuts both ways: it stopped charging the tool for certifying work that
+  nothing contradicted, and it removed two tasks that were being counted as opportunities the tool
+  passed.
+- **Re-judging cannot answer worse than scoring did.** `--rejudge` re-derives verdicts from
+  recorded patches after a harness change, and the order-dependence check lived only in the fresh
+  scoring pass, so re-judging winston#2256 turned a task already recorded as order-dependent into a
+  false green. Both passes go through one function, and it calls the rule that was already in src
+  with tests beside it rather than a third hand-rolled copy.
+
+### Measured
+
+- **False-green rate 1 in 19 valid opportunities: 5.3%, 95% CI [0.9, 24.6]**, from 2 in 22. One of
+  the two is now refused by the reach check; the other two changes are corpus defects found while
+  re-judging, where a held-back oracle that accepts the base was counted as an opportunity the tool
+  passed. The bar is zero, so gate 3 still fails, and 19 opportunities is not 400 tasks.
 
 ## 14.0.2 - 2026-09-07