tamperward 2.15.1 → 2.16.0

package/README.md

@@ -167,6 +167,19 @@ observer down deterministically. Observer health remains advisory; transient fin
 remain warnings by default and affect the envelope only when the operator explicitly
 sets `TAMPERWARD_TRANSIENT=block`.
 
+Since **2.15.2**, Stop-sweep event consumption uses the saved cursor as a real byte
+offset: it performs positioned reads of only new JSONL bytes instead of decoding the
+whole historical log on every turn. Each physical read is capped at **4 MiB**, and one
+authority decision drains at most **16 MiB** in bounded chunks. Only complete
+newline-terminated records advance the cursor, so a torn final watcher write is replayed
+after completion instead of being lost. Stop commits the cursor only after the entire
+bounded telemetry tail has been parsed and classified; malformed records, an oversized
+single record, a torn tail, or telemetry beyond the 16 MiB aggregate ceiling blocks Stop
+and retains the previous cursor rather than certifying unjudged bytes. Supervised
+`run --observe-transients` keeps observer evidence advisory by default, but when
+`TAMPERWARD_TRANSIENT=block` is explicitly enabled, any unclassified observer tail
+also fails the envelope closed.
+
 After the runtime exits its exit code is treated as untrusted, and the envelope
 checks that post-agent `HEAD` still descends from the entry commit; the committed
 changes over `entry...HEAD`; staged, unstaged and untracked non-ignored worktree
@@ -356,6 +369,18 @@ restored `"test": "sh scripts/test.sh"` will happily call a script nothing
 restored. It bounds the class rather than closing it — see
 [the threat model](./docs/THREAT-MODEL-pristine-run.md).
 
+From **2.16.0**, verifier suite output is diagnostic evidence instead of discarded
+noise. Both visible and pristine stages continuously drain stdout/stderr through a
+trusted supervisor, retain only the final **16 KiB per stream**, and count the total
+bytes observed. Structured output exposes this under
+`visible.diagnostics` / `pristine.diagnostics` with
+`captured_bytes`, `retained_bytes`, `truncated`, and a bounded `tail` on a
+failed stage. Default human output remains quiet on success. On failure, retained
+diagnostics are rendered with every line prefixed and terminal/control characters
+escaped, so candidate output cannot become ANSI control traffic or a GitHub
+`::command::`. These bytes are evidence produced by candidate code; they never own
+the verifier verdict.
+
 The four primitives:
 
 ```bash

package/dist/cli/index.js

@@ -6829,7 +6829,7 @@ function runCheck(opts) {
 }
 
 // src/cli/hook.ts
-import { readFileSync as readFileSync11, appendFileSync as appendFileSync4, writeFileSync as writeFileSync5, existsSync as existsSync8 } from "node:fs";
+import { readFileSync as readFileSync10, appendFileSync as appendFileSync4, writeFileSync as writeFileSync5, existsSync as existsSync8 } from "node:fs";
 import { createHash as createHash5 } from "node:crypto";
 
 // src/adapters/claude/deny.ts
@@ -7085,13 +7085,14 @@ function watchTree(dir, cb, onState, onError) {
     }
   }
   const watchers = /* @__PURE__ */ new Map();
+  let closed = false;
   onState("fallback", 0);
   const addDir = (rel) => {
-    if (watchers.has(rel) || SKIP2.test(rel + "/")) return;
+    if (closed || watchers.has(rel) || SKIP2.test(rel + "/")) return;
     let w;
     try {
       w = watch(rel ? join11(dir, rel) : dir, (kind, fname) => {
-        if (!fname) return;
+        if (closed || !fname) return;
         const child = rel ? `${rel}/${String(fname)}` : String(fname);
         cb(kind, child);
         try {
@@ -7129,9 +7130,14 @@ function watchTree(dir, cb, onState, onError) {
     }
   };
   walk2("");
-  return { close: () => {
-    for (const w of watchers.values()) w.close();
-  } };
+  return {
+    close: () => {
+      if (closed) return;
+      closed = true;
+      for (const w of watchers.values()) w.close();
+      watchers.clear();
+    }
+  };
 }
 function startWatcher(dir, log, policy) {
   try {
@@ -7215,8 +7221,11 @@ function startWatcher(dir, log, policy) {
     },
     (detail) => degrade(detail)
   );
+  let closed = false;
   return {
     close: () => {
+      if (closed) return;
+      closed = true;
       tree.close();
       health.state = "stopped";
       health.stopped_at = (/* @__PURE__ */ new Date()).toISOString();
@@ -7253,26 +7262,200 @@ function runWatch(args) {
 }
 
 // src/detectors/fs-events.ts
-import { readFileSync as readFileSync10, statSync } from "node:fs";
+import { closeSync as closeSync2, openSync as openSync2, readSync as readSync2, statSync } from "node:fs";
 var RULE11 = "transient-protected-mutation";
-function readEvents(log, offset) {
+var MAX_EVENT_READ_BYTES = 4 * 1024 * 1024;
+var MAX_EVENT_SWEEP_BYTES = 16 * 1024 * 1024;
+var DEFAULT_EVENT_READ_IO = {
+  read: (fd, buffer, bufferOffset, length, position) => readSync2(fd, buffer, bufferOffset, length, position)
+};
+function readEvents(log, offset, maxBytes = MAX_EVENT_READ_BYTES, io = DEFAULT_EVENT_READ_IO) {
   let size = 0;
   try {
     size = statSync(log).size;
   } catch {
-    return { events: [], newOffset: offset };
+    return {
+      events: [],
+      newOffset: Math.max(0, Number.isFinite(offset) ? Math.floor(offset) : 0),
+      bytesRead: 0,
+      limitReached: false,
+      malformedLines: 0,
+      incompleteTail: false
+    };
+  }
+  let start = Number.isFinite(offset) ? Math.max(0, Math.floor(offset)) : 0;
+  if (start > size) start = 0;
+  if (size <= start) {
+    return {
+      events: [],
+      newOffset: start,
+      bytesRead: 0,
+      limitReached: false,
+      malformedLines: 0,
+      incompleteTail: false
+    };
+  }
+  const cap = Number.isFinite(maxBytes) && maxBytes > 0 ? Math.max(1, Math.floor(maxBytes)) : MAX_EVENT_READ_BYTES;
+  const available = size - start;
+  const requested = Math.min(available, cap);
+  const buffer = Buffer.allocUnsafe(requested);
+  const fd = openSync2(log, "r");
+  let bytesRead = 0;
+  try {
+    bytesRead = io.read(fd, buffer, 0, requested, start);
+  } finally {
+    closeSync2(fd);
+  }
+  if (bytesRead <= 0) {
+    return {
+      events: [],
+      newOffset: start,
+      bytesRead: 0,
+      limitReached: available > 0,
+      malformedLines: 0,
+      incompleteTail: available > 0
+    };
+  }
+  const chunk = buffer.subarray(0, bytesRead);
+  const lastNewline = chunk.lastIndexOf(10);
+  const limitReached = start + bytesRead < size;
+  if (lastNewline < 0) {
+    return {
+      events: [],
+      newOffset: start,
+      bytesRead,
+      limitReached,
+      malformedLines: 0,
+      incompleteTail: true
+    };
   }
-  if (size <= offset) return { events: [], newOffset: offset >= 0 ? Math.min(offset, size) : 0 };
-  const raw = readFileSync10(log, "utf8").slice(offset);
   const events = [];
-  for (const line of raw.split("\n")) {
+  let malformedLines = 0;
+  const complete = chunk.subarray(0, lastNewline + 1).toString("utf8");
+  for (const line of complete.split("\n")) {
     if (!line.trim()) continue;
     try {
       events.push(JSON.parse(line));
     } catch {
+      malformedLines++;
+    }
+  }
+  const newOffset = start + lastNewline + 1;
+  return {
+    events,
+    newOffset,
+    bytesRead,
+    limitReached,
+    malformedLines,
+    incompleteTail: newOffset < start + bytesRead
+  };
+}
+function drainEvents(log, offset, maxTotalBytes = MAX_EVENT_SWEEP_BYTES, io = DEFAULT_EVENT_READ_IO) {
+  const start = Number.isFinite(offset) ? Math.max(0, Math.floor(offset)) : 0;
+  const aggregateCap = Number.isFinite(maxTotalBytes) && maxTotalBytes > 0 ? Math.max(1, Math.floor(maxTotalBytes)) : MAX_EVENT_SWEEP_BYTES;
+  const events = [];
+  let cursor = start;
+  let bytesRead = 0;
+  let batches = 0;
+  let malformedLines = 0;
+  while (bytesRead < aggregateCap) {
+    const remainingBudget = aggregateCap - bytesRead;
+    const batch = readEvents(
+      log,
+      cursor,
+      Math.min(MAX_EVENT_READ_BYTES, remainingBudget),
+      io
+    );
+    batches++;
+    bytesRead += batch.bytesRead;
+    malformedLines += batch.malformedLines;
+    events.push(...batch.events);
+    if (batch.malformedLines > 0) {
+      return {
+        events,
+        newOffset: cursor,
+        bytesRead,
+        batches,
+        malformedLines,
+        complete: false,
+        issue: "malformed-record"
+      };
+    }
+    if (batch.bytesRead === 0) {
+      if (batch.limitReached || batch.incompleteTail) {
+        return {
+          events,
+          newOffset: cursor,
+          bytesRead,
+          batches,
+          malformedLines,
+          complete: false,
+          issue: "read-stalled"
+        };
+      }
+      return {
+        events,
+        newOffset: cursor,
+        bytesRead,
+        batches,
+        malformedLines,
+        complete: true
+      };
+    }
+    if (batch.limitReached && batch.newOffset === cursor) {
+      return {
+        events,
+        newOffset: cursor,
+        bytesRead,
+        batches,
+        malformedLines,
+        complete: false,
+        issue: "oversized-record"
+      };
+    }
+    if (!batch.limitReached && batch.incompleteTail) {
+      return {
+        events,
+        newOffset: cursor,
+        bytesRead,
+        batches,
+        malformedLines,
+        complete: false,
+        issue: "incomplete-record"
+      };
+    }
+    cursor = batch.newOffset;
+    if (!batch.limitReached) {
+      return {
+        events,
+        newOffset: cursor,
+        bytesRead,
+        batches,
+        malformedLines,
+        complete: true
+      };
+    }
+    if (bytesRead >= aggregateCap) {
+      return {
+        events,
+        newOffset: cursor,
+        bytesRead,
+        batches,
+        malformedLines,
+        complete: false,
+        issue: "aggregate-limit"
+      };
     }
   }
-  return { events, newOffset: size };
+  return {
+    events,
+    newOffset: cursor,
+    bytesRead,
+    batches,
+    malformedLines,
+    complete: false,
+    issue: "aggregate-limit"
+  };
 }
 function transientFindings(events, persistentPaths, policy, finalHash) {
   if (!isEnabled(RULE11, policy)) return [];
@@ -7316,7 +7499,7 @@ var HookInputError = class extends Error {
 };
 function readStdin() {
   try {
-    return readFileSync11(0, "utf8");
+    return readFileSync10(0, "utf8");
   } catch (e) {
     throw new HookInputError(`cannot read the hook payload on stdin: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -7564,6 +7747,17 @@ function cursorPath(cwd, sessionId) {
   const p = ptreePath(cwd, sessionId);
   return p ? p.replace(/ptree-/, "fscursor-") : null;
 }
+function observerIntegrityBlock(issue, bytesRead, malformedLines) {
+  const detail = issue === "malformed-record" ? `${malformedLines} malformed complete JSONL record(s)` : issue === "oversized-record" ? `one event record exceeded the ${MAX_EVENT_READ_BYTES}-byte per-record/read ceiling` : issue === "incomplete-record" ? "the event log ended with an incomplete JSONL record" : issue === "aggregate-limit" ? `more than ${MAX_EVENT_SWEEP_BYTES} observer bytes required classification in one Stop sweep` : "the positioned event-log read made no safe progress";
+  return {
+    rule: "tamperward-unavailable",
+    severity: "block",
+    message: `TamperWard could not fully classify transient observer telemetry (${detail}), so Stop is blocked rather than certifying an unjudged tail.`,
+    evidence: `observer_issue=${issue}; bytes_read=${bytesRead}; malformed_lines=${malformedLines}`,
+    remediation: "Let the watcher finish its current record or repair/rotate the malformed observer log, then retry Stop. Do not delete the cursor/log to bypass unjudged telemetry.",
+    signoff: { required: true, command: 'tamperward allow --reason "..."' }
+  };
+}
 function turnTransientBlocks(cwd, sessionId, policy, changes) {
   const none = { blocks: [], commit: () => {
   } };
@@ -7576,16 +7770,34 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
   if (!existsSync8(log)) return none;
   let offset = 0;
   if (cp && existsSync8(cp)) {
-    const n = Number(readFileSync11(cp, "utf8"));
+    const n = Number(readFileSync10(cp, "utf8"));
     offset = Number.isFinite(n) ? n : 0;
   }
-  const { events, newOffset } = readEvents(log, offset);
-  if (events.length === 0) return { ...none, commit: () => {
-    if (cp) try {
-      writeFileSync5(cp, String(newOffset));
-    } catch {
-    }
-  } };
+  const drained = drainEvents(log, offset);
+  if (!drained.complete) {
+    const issue = drained.issue ?? "read-stalled";
+    recordObserverHealth(
+      "degraded",
+      `event telemetry was not fully classified (${issue}); Stop retained the prior cursor`
+    );
+    return {
+      blocks: [observerIntegrityBlock(issue, drained.bytesRead, drained.malformedLines)],
+      commit: () => {
+      }
+    };
+  }
+  const { events, newOffset } = drained;
+  if (events.length === 0) {
+    return {
+      ...none,
+      commit: () => {
+        if (cp) try {
+          writeFileSync5(cp, String(newOffset));
+        } catch {
+        }
+      }
+    };
+  }
   const persistent = new Set(changes.filter((c) => c.kind === "file").map((c) => c.path));
   const finalHash = (path) => {
     const e = inspectRel(cwd, path);
@@ -7742,7 +7954,7 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 // src/cli/init.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync6, chmodSync, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync6, chmodSync, statSync as statSync2 } from "node:fs";
 import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute8, join as join12, relative as relative3, resolve as resolve3 } from "node:path";
 
 // src/verifier-limits.ts
@@ -7986,7 +8198,7 @@ function planClaudeHooks(cwd) {
   if (existsSync9(path)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync12(path, "utf8"));
+      parsed = JSON.parse(readFileSync11(path, "utf8"));
     } catch {
       return {
         item: "agent",
@@ -8132,7 +8344,7 @@ function planPreCommit(cwd) {
   if (existsSync9(path) && !statSync2(path).isFile()) {
     return { item: "pre-commit", path: rel, status: "error", detail: "exists but is not a regular file \u2014 refusing to write" };
   }
-  const existing = existsSync9(path) ? readFileSync12(path, "utf8") : null;
+  const existing = existsSync9(path) ? readFileSync11(path, "utf8") : null;
   if (existing === null) {
     return {
       item: "pre-commit",
@@ -8224,7 +8436,7 @@ function planCodeowners(cwd) {
     (r) => existsSync9(join12(cwd, r))
   );
   const path = join12(cwd, existingRel ?? rel);
-  const existing = existingRel ? readFileSync12(path, "utf8") : null;
+  const existing = existingRel ? readFileSync11(path, "utf8") : null;
   const missing = CODEOWNERS_PATHS.filter((p) => existing === null || !coveredBy(existing, p));
   if (missing.length === 0) {
     return { item: "codeowners", path: existingRel, status: "ok", detail: "gate paths already have code owners" };
@@ -8273,7 +8485,7 @@ function planWorkflow(cwd, force) {
   }
   let src;
   try {
-    src = readFileSync12(path, "utf8");
+    src = readFileSync11(path, "utf8");
   } catch {
     return { item: "ci", path: rel, status: "error", detail: "exists but cannot be read \u2014 refusing to overwrite" };
   }
@@ -8372,7 +8584,7 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 
 // src/cli/doctor.ts
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync13, readdirSync as readdirSync3 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync12, readdirSync as readdirSync3 } from "node:fs";
 import { join as join13, resolve as resolve4 } from "node:path";
 import { parse as parse3 } from "yaml";
 var VERIFY_COMMAND = /\btamperward(?:@\S+)?\s+verify\b/;
@@ -8410,7 +8622,7 @@ function pinsInFile(path) {
   if (!existsSync10(path)) return [];
   let src = "";
   try {
-    src = readFileSync13(path, "utf8");
+    src = readFileSync12(path, "utf8");
   } catch {
     return [];
   }
@@ -8437,7 +8649,7 @@ function workflowPermissionCheck(cwd, workflowRels = [".github/workflows/tamperw
     }
     let doc;
     try {
-      doc = parse3(readFileSync13(path, "utf8"));
+      doc = parse3(readFileSync12(path, "utf8"));
     } catch (e) {
       broken.push(`${rel} is not valid YAML (${e instanceof Error ? e.message : String(e)})`);
       continue;
@@ -8843,7 +9055,7 @@ function runDoctor(opts = {}) {
     }
     let doc;
     try {
-      doc = parse3(readFileSync13(workflowPath, "utf8"));
+      doc = parse3(readFileSync12(workflowPath, "utf8"));
     } catch (e) {
       return fail(
         "ci-verifier",
@@ -8949,11 +9161,11 @@ function runDoctor(opts = {}) {
 }
 
 // src/cli/verify.ts
-import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
+import { execFileSync as execFileSync9, spawnSync as spawnSync3 } from "node:child_process";
 import { createHash as createHash10 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync5, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync7 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname7, isAbsolute as isAbsolute10, join as join16, relative as relative5, resolve as resolve7, sep as sep2 } from "node:path";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync5, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync4, symlinkSync, writeFileSync as writeFileSync8 } from "node:fs";
+import { tmpdir as tmpdir3 } from "node:os";
+import { dirname as dirname7, isAbsolute as isAbsolute10, join as join17, relative as relative5, resolve as resolve7, sep as sep2 } from "node:path";
 
 // src/fingerprint.ts
 import { execFileSync as execFileSync8 } from "node:child_process";
@@ -8987,7 +9199,7 @@ import {
   existsSync as existsSync11,
   lstatSync as lstatSync4,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync14,
+  readFileSync as readFileSync13,
   readlinkSync as readlinkSync2,
   realpathSync as realpathSync3,
   statSync as statSync3
@@ -9044,7 +9256,7 @@ function fingerprintRoot(root, cwd, h) {
       st = statSync3(path);
       if (!st.isFile()) throw new Error("not a regular file");
       h.update(label + "\0external-file\0" + path + "\0" + String(st.mode) + "\0");
-      h.update(readFileSync14(path));
+      h.update(readFileSync13(path));
       h.update("\0");
     } catch (e) {
       throw new Unattestable(
@@ -9078,7 +9290,7 @@ function fingerprintRoot(root, cwd, h) {
       h.update(rel + "\0" + ident.kind + "\0" + String(ident.mode) + "\0");
       if (ident.kind === "file") {
         try {
-          h.update(readFileSync14(path));
+          h.update(readFileSync13(path));
           h.update("\0");
         } catch (e) {
           throw new Unattestable(
@@ -9239,7 +9451,7 @@ function venvProblem(root) {
   const cfg = join14(root, "pyvenv.cfg");
   if (!existsSync11(cfg)) return "VIRTUAL_ENV " + JSON.stringify(root) + " has no pyvenv.cfg";
   try {
-    const body = readFileSync14(cfg, "utf8");
+    const body = readFileSync13(cfg, "utf8");
     if (/^\s*include-system-site-packages\s*=\s*true\s*$/im.test(body)) {
       return "Python environment " + JSON.stringify(root) + " enables system site-packages; those external package roots are not bounded";
     }
@@ -9336,9 +9548,321 @@ function dependencyEnvironmentSummary(descriptor) {
 
 // src/verifier-backend.ts
 import { createHash as createHash9, randomUUID } from "node:crypto";
-import { spawnSync } from "node:child_process";
+import { spawnSync as spawnSync2 } from "node:child_process";
 import { accessSync, constants as constants2, readFileSync as readFileSync15, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
-import { delimiter as delimiter2, dirname as dirname6, join as join15, resolve as resolve6 } from "node:path";
+import { delimiter as delimiter2, dirname as dirname6, join as join16, resolve as resolve6 } from "node:path";
+
+// src/suite-diagnostics.ts
+import { spawnSync } from "node:child_process";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join15 } from "node:path";
+var DIAGNOSTIC_TAIL_BYTES = 16 * 1024;
+var EMPTY_STREAM = {
+  captured_bytes: 0,
+  retained_bytes: 0,
+  truncated: false,
+  tail: ""
+};
+function emptySuiteDiagnostics() {
+  return {
+    stdout: { ...EMPTY_STREAM },
+    stderr: { ...EMPTY_STREAM }
+  };
+}
+function decodeUtf8Tail(tail) {
+  let start = 0;
+  while (start < tail.length && (tail[start] & 192) === 128) start++;
+  return tail.subarray(start).toString("utf8");
+}
+function streamFromRaw(raw) {
+  let tail = Buffer.alloc(0);
+  try {
+    tail = Buffer.from(raw?.tail_b64 ?? "", "base64");
+  } catch {
+    tail = Buffer.alloc(0);
+  }
+  const captured = Number.isFinite(raw?.captured_bytes) ? Math.max(0, Number(raw?.captured_bytes)) : tail.length;
+  return {
+    captured_bytes: captured,
+    retained_bytes: tail.length,
+    truncated: captured > tail.length,
+    tail: decodeUtf8Tail(tail)
+  };
+}
+function scrubDiagnosticText(input) {
+  let out2 = "";
+  for (const ch of input) {
+    const cp = ch.codePointAt(0);
+    if (ch === "\n" || ch === "	") {
+      out2 += ch;
+    } else if (cp === 13) {
+      out2 += "\\r";
+    } else if (cp < 32 || cp >= 127 && cp <= 159) {
+      out2 += cp <= 255 ? `\\x${cp.toString(16).padStart(2, "0")}` : `\\u{${cp.toString(16)}}`;
+    } else {
+      out2 += ch;
+    }
+  }
+  return out2;
+}
+function diagnosticLines(stage, diagnostics) {
+  const lines = [];
+  for (const streamName of ["stdout", "stderr"]) {
+    const stream = diagnostics[streamName];
+    if (stream.captured_bytes === 0) continue;
+    const suffix = stream.truncated ? ` \u2014 tail ${stream.retained_bytes}/${stream.captured_bytes} bytes retained` : ` \u2014 ${stream.captured_bytes} bytes`;
+    lines.push(`${stage} suite ${streamName}${suffix}:`);
+    const scrubbed = scrubDiagnosticText(stream.tail);
+    const body = scrubbed.split("\n");
+    if (body.at(-1) === "") body.pop();
+    for (const line of body) lines.push(`  | ${line}`);
+  }
+  return lines;
+}
+var CAPTURE_SUPERVISOR = String.raw`
+const cp = require('node:child_process');
+const fs = require('node:fs');
+
+const [configFile] = process.argv.slice(1);
+const cfg = JSON.parse(fs.readFileSync(configFile, 'utf8'));
+const CAP = Number(cfg.captureBytes);
+
+const fresh = () => ({ total: 0, tail: Buffer.alloc(0) });
+const stdout = fresh();
+const stderr = fresh();
+
+// Linux ordinary-exit hardening (#371): process-group ownership alone misses a
+// descendant that calls setsid(). Track the real descendant tree while the
+// suite is alive so a reparented session escape is still known when the main
+// child exits. This supplements, rather than replaces, group termination.
+const trackedDescendants = new Set();
+
+function linuxDescendants(rootPid) {
+  if (process.platform !== 'linux' || !rootPid) return [];
+  const byParent = new Map();
+  let names = [];
+  try { names = fs.readdirSync('/proc').filter((x) => /^\d+$/.test(x)); } catch { return []; }
+  for (const name of names) {
+    const pid = Number(name);
+    try {
+      const stat = fs.readFileSync('/proc/' + name + '/stat', 'utf8');
+      const fields = stat.slice(stat.lastIndexOf(')') + 2).split(' ');
+      const ppid = Number(fields[1]);
+      if (!Number.isFinite(ppid)) continue;
+      const kids = byParent.get(ppid) || [];
+      kids.push(pid);
+      byParent.set(ppid, kids);
+    } catch {}
+  }
+  const out = [];
+  const seen = new Set([rootPid]);
+  const stack = [rootPid];
+  while (stack.length) {
+    const parent = stack.pop();
+    for (const pid of (byParent.get(parent) || [])) {
+      if (seen.has(pid)) continue;
+      seen.add(pid);
+      out.push(pid);
+      stack.push(pid);
+    }
+  }
+  return out;
+}
+
+function trackDescendants() {
+  if (!child || !child.pid || process.platform !== 'linux') return;
+  for (const pid of linuxDescendants(child.pid)) trackedDescendants.add(pid);
+}
+
+function append(state, chunk) {
+  const b = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+  state.total += b.length;
+  if (b.length >= CAP) {
+    state.tail = Buffer.from(b.subarray(b.length - CAP));
+    return;
+  }
+  if (state.tail.length + b.length <= CAP) {
+    state.tail = Buffer.concat([state.tail, b]);
+    return;
+  }
+  const keep = CAP - b.length;
+  state.tail = Buffer.concat([state.tail.subarray(state.tail.length - keep), b]);
+}
+
+function diag(state) {
+  return {
+    captured_bytes: state.total,
+    tail_b64: state.tail.toString('base64'),
+  };
+}
+
+let child;
+let done = false;
+let timedOut = false;
+let exitInfo = { exit: null, signal: null };
+let descendantTracker = null;
+
+function killOwned() {
+  if (!child || !child.pid) return;
+  trackDescendants();
+  if (cfg.detached && process.platform !== 'win32') {
+    try { process.kill(-child.pid, 'SIGKILL'); } catch {}
+  }
+  try { child.kill('SIGKILL'); } catch {}
+  if (process.platform === 'linux') {
+    // Deepest-first is friendlier to short-lived process trees. PIDs are still
+    // rechecked by kill(2); races with natural exit are harmless.
+    for (const pid of Array.from(trackedDescendants).reverse()) {
+      try { process.kill(pid, 'SIGKILL'); } catch {}
+    }
+  }
+}
+
+function finish(extra) {
+  if (done) return;
+  done = true;
+  if (descendantTracker) clearInterval(descendantTracker);
+  try {
+    // stdout is reserved for the trusted supervisor result. Candidate suite
+    // stdout/stderr are separate pipes and are never inherited here.
+    process.stdout.write(JSON.stringify({
+      ...exitInfo,
+      timedOut,
+      ...extra,
+      stdout: diag(stdout),
+      stderr: diag(stderr),
+    }));
+  } catch {}
+  process.exit(0);
+}
+
+try {
+  child = cp.spawn(cfg.executable, cfg.args, {
+    cwd: cfg.cwd,
+    env: process.env,
+    detached: Boolean(cfg.detached) && process.platform !== 'win32',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+} catch (e) {
+  finish({ error: String(e) });
+}
+
+if (child) {
+  if (process.platform === 'linux') {
+    trackDescendants();
+    descendantTracker = setInterval(trackDescendants, 5);
+    descendantTracker.unref();
+  }
+  child.stdout.on('data', (b) => append(stdout, b));
+  child.stderr.on('data', (b) => append(stderr, b));
+
+  const timer = setTimeout(() => {
+    timedOut = true;
+    killOwned();
+    // Backstop if a platform fails to emit close after the forced kill.
+    setTimeout(() => finish({}), 1000).unref();
+  }, Number(cfg.timeoutMs));
+  timer.unref();
+
+  child.on('error', (e) => {
+    clearTimeout(timer);
+    killOwned();
+    finish({ error: String(e) });
+  });
+
+  child.on('exit', (code, signal) => {
+    exitInfo = {
+      exit: code == null ? null : Number(code),
+      signal: signal == null ? null : String(signal),
+    };
+    if (cfg.killGroupOnFinish) killOwned();
+  });
+
+  // close fires after the stdio pipes close, so the retained tails include all
+  // output that was drained before owned descendants were terminated.
+  child.on('close', (code, signal) => {
+    clearTimeout(timer);
+    if (exitInfo.exit === null && code != null) exitInfo.exit = Number(code);
+    if (exitInfo.signal === null && signal != null) exitInfo.signal = String(signal);
+    finish({});
+  });
+}
+`;
+function parseCapturedSupervisorResult(stdoutText) {
+  let raw;
+  try {
+    raw = JSON.parse(stdoutText);
+  } catch {
+    return null;
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const diagnostics = {
+    stdout: streamFromRaw(raw.stdout),
+    stderr: streamFromRaw(raw.stderr)
+  };
+  return {
+    exit: typeof raw.exit === "number" ? raw.exit : null,
+    signal: typeof raw.signal === "string" ? raw.signal : null,
+    timedOut: Boolean(raw.timedOut),
+    ...typeof raw.error === "string" && raw.error ? { error: raw.error } : {},
+    diagnostics
+  };
+}
+function runCapturedProcessSync(executable, args, opts) {
+  const stateDir = mkdtempSync2(join15(tmpdir2(), "tw-suite-capture-"));
+  const configFile = join15(stateDir, "config.json");
+  const backstop = opts.backstopMs ?? 3e4;
+  try {
+    writeFileSync7(
+      configFile,
+      JSON.stringify({
+        executable,
+        args,
+        cwd: opts.cwd,
+        timeoutMs: opts.timeoutMs,
+        detached: Boolean(opts.detached),
+        killGroupOnFinish: Boolean(opts.killGroupOnFinish),
+        captureBytes: DIAGNOSTIC_TAIL_BYTES
+      }),
+      { mode: 384 }
+    );
+    const supervisor = spawnSync(
+      process.execPath,
+      ["-e", CAPTURE_SUPERVISOR, configFile],
+      {
+        cwd: opts.cwd,
+        env: opts.env,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        // The trusted result is at most two 16 KiB tails plus small metadata.
+        // A candidate that somehow writes into the supervisor's stdout through
+        // same-UID /proc can only overflow/corrupt this bounded channel and make
+        // parsing fail closed; its suite streams are never inherited here.
+        maxBuffer: 256 * 1024,
+        timeout: opts.timeoutMs + backstop,
+        killSignal: "SIGKILL"
+      }
+    );
+    const parsed = parseCapturedSupervisorResult(supervisor.stdout ?? "");
+    const diagnostics = parsed?.diagnostics ?? emptySuiteDiagnostics();
+    if (!parsed) {
+      const supervisorTimedOut = Boolean(supervisor.error) && supervisor.error.code === "ETIMEDOUT";
+      return {
+        exit: null,
+        signal: supervisor.signal ? String(supervisor.signal) : null,
+        timedOut: supervisorTimedOut,
+        error: supervisor.error?.message ?? "suite capture supervisor did not produce a result",
+        diagnostics
+      };
+    }
+    return parsed;
+  } finally {
+    rmSync3(stateDir, { recursive: true, force: true });
+  }
+}
+
+// src/verifier-backend.ts
 var DEFAULT_CONTAINER_RESOURCE_LIMITS = Object.freeze({
   memoryBytes: 2 * 1024 * 1024 * 1024,
   // Docker interprets memory-swap == memory as no additional swap allowance.
@@ -9381,7 +9905,7 @@ function replaceableByCaller(path) {
 function findExecutable(name) {
   for (const raw of (process.env.PATH ?? "").split(delimiter2)) {
     if (!raw) continue;
-    const candidate = join15(raw, name);
+    const candidate = join16(raw, name);
     try {
       accessSync(candidate, constants2.X_OK);
       return realpathSync4(candidate);
@@ -9406,7 +9930,7 @@ function dockerArgs(host, args) {
 }
 function dockerAvailable(enginePath, host) {
   try {
-    const r = spawnSync(enginePath, dockerArgs(host, ["version"]), {
+    const r = spawnSync2(enginePath, dockerArgs(host, ["version"]), {
       stdio: "ignore",
       timeout: 5e3,
       killSignal: "SIGKILL",
@@ -9434,7 +9958,7 @@ function declaredImageVolumePaths(metadata) {
 }
 function inspectImageMetadata(enginePath, host, image) {
   try {
-    const r = spawnSync(enginePath, dockerArgs(host, ["image", "inspect", image]), {
+    const r = spawnSync2(enginePath, dockerArgs(host, ["image", "inspect", image]), {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 1e4,
@@ -9609,7 +10133,7 @@ function verifierBackendSummary(backend) {
 function cleanupContainer(backend, name) {
   if (!backend.enginePath || !backend.daemonHost || !engineStable(backend)) return;
   try {
-    spawnSync(backend.enginePath, dockerArgs(backend.daemonHost, ["rm", "-f", "-v", name]), {
+    spawnSync2(backend.enginePath, dockerArgs(backend.daemonHost, ["rm", "-f", "-v", name]), {
       stdio: "ignore",
       timeout: 1e4,
       killSignal: "SIGKILL",
@@ -9720,29 +10244,45 @@ function runContainerStage(backend, dir, command, budgetSecs) {
     resources: backend.resources ?? DEFAULT_CONTAINER_RESOURCE_LIMITS
   });
   try {
-    const r = spawnSync(
+    const r = runCapturedProcessSync(
       backend.enginePath,
       dockerArgs(backend.daemonHost, args),
       {
-        stdio: "ignore",
-        timeout: budgetSecs * 1e3,
-        killSignal: "SIGKILL",
-        env: engineClientEnv()
+        cwd: dirname6(backend.enginePath),
+        env: engineClientEnv(),
+        timeoutMs: budgetSecs * 1e3,
+        backstopMs: 3e4
       }
     );
     const secs = Math.round((Date.now() - t0) / 1e3);
+    if (r.timedOut) {
+      cleanupContainer(backend, name);
+      return {
+        exit: null,
+        secs,
+        failure: "budget",
+        reason: "verifier stage exceeded its budget",
+        diagnostics: r.diagnostics
+      };
+    }
     if (r.error) {
       cleanupContainer(backend, name);
-      const code2 = r.error.code;
-      return code2 === "ETIMEDOUT" ? { exit: null, secs, failure: "budget", reason: "verifier stage exceeded its budget" } : { exit: null, secs, failure: "backend", reason: `Docker client failed: ${r.error.message}` };
+      return {
+        exit: null,
+        secs,
+        failure: "backend",
+        reason: `Docker client failed: ${r.error}`,
+        diagnostics: r.diagnostics
+      };
     }
-    if (r.status === null) {
+    if (r.exit === null) {
       cleanupContainer(backend, name);
       return {
         exit: null,
         secs,
         failure: "backend",
-        reason: `Docker client did not return a status${r.signal ? ` (signal ${r.signal})` : ""}`
+        reason: `Docker client did not return a status${r.signal ? ` (signal ${r.signal})` : ""}`,
+        diagnostics: r.diagnostics
       };
     }
     if (!engineStable(backend)) {
@@ -9750,10 +10290,11 @@ function runContainerStage(backend, dir, command, budgetSecs) {
         exit: null,
         secs,
         failure: "backend",
-        reason: "Docker engine identity changed before verifier result inspection"
+        reason: "Docker engine identity changed before verifier result inspection",
+        diagnostics: r.diagnostics
       };
     }
-    const inspected = spawnSync(
+    const inspected = spawnSync2(
       backend.enginePath,
       dockerArgs(backend.daemonHost, ["inspect", "--format", "{{json .State}}", name]),
       {
@@ -9773,7 +10314,10 @@ function runContainerStage(backend, dir, command, budgetSecs) {
       }
     }
     cleanupContainer(backend, name);
-    return containerStateResult(state, secs);
+    return {
+      ...containerStateResult(state, secs),
+      diagnostics: r.diagnostics
+    };
   } catch (e) {
     cleanupContainer(backend, name);
     return {
@@ -9878,7 +10422,7 @@ function resolveBase(base, cwd) {
   }
 }
 function baseIsAncestorOfHead(base, cwd) {
-  const r = spawnSync2("git", ["merge-base", "--is-ancestor", base, "HEAD"], { cwd, env: trustedGitEnv() });
+  const r = spawnSync3("git", ["merge-base", "--is-ancestor", base, "HEAD"], { cwd, env: trustedGitEnv() });
   return r.status === 0;
 }
 function inside2(root, path) {
@@ -9902,7 +10446,7 @@ function safeSymlink(target, out2, root, label) {
   if (rootedLinkTarget(target) || !inside2(root, resolve7(dirname7(out2), target))) {
     throw linkEscape(label, target);
   }
-  rmSync3(out2, { force: true });
+  rmSync4(out2, { force: true });
   symlinkSync(target, out2);
 }
 function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
@@ -9925,7 +10469,7 @@ function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
       continue;
     }
     const base = domain === "tree" ? root : dependencyRoot;
-    const current = join16(base, ...stack);
+    const current = join17(base, ...stack);
     let st;
     try {
       st = lstatSync5(current);
@@ -9961,7 +10505,7 @@ function rejectLinkedParent(cwd, rel) {
   const parts = rel.split("/").slice(0, -1);
   let current = cwd;
   for (const part of parts) {
-    current = join16(current, part);
+    current = join17(current, part);
     let st;
     try {
       st = lstatSync5(current);
@@ -9977,7 +10521,7 @@ function materialize(cwd, dest, dependencyRoot) {
   const listed = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   const links = [];
   for (const rel of listed) {
-    const src = join16(cwd, rel);
+    const src = join17(cwd, rel);
     rejectLinkedParent(cwd, rel);
     let st;
     try {
@@ -9985,7 +10529,7 @@ function materialize(cwd, dest, dependencyRoot) {
     } catch {
       continue;
     }
-    const out2 = join16(dest, rel);
+    const out2 = join17(dest, rel);
     mkdirSync6(dirname7(out2), { recursive: true });
     dropSymlink(out2);
     if (st.isSymbolicLink()) {
@@ -10002,11 +10546,11 @@ function materialize(cwd, dest, dependencyRoot) {
   for (const link of links) {
     validateSymlinkGraph(link.target, link.out, dest, dependencyRoot, link.rel);
   }
-  if (dependencyRoot) symlinkSync(dependencyRoot, join16(dest, "node_modules"), "dir");
+  if (dependencyRoot) symlinkSync(dependencyRoot, join17(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
   try {
-    if (lstatSync5(p).isSymbolicLink()) rmSync3(p, { force: true });
+    if (lstatSync5(p).isSymbolicLink()) rmSync4(p, { force: true });
   } catch {
   }
 }
@@ -10035,7 +10579,7 @@ function overlayDigest(dest, paths) {
   for (const rel of [...paths].sort()) {
     h.update(rel);
     h.update("\0");
-    const p = join16(dest, rel);
+    const p = join17(dest, rel);
     try {
       const st = lstatSync5(p);
       h.update(String(st.mode));
@@ -10063,15 +10607,15 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot) {
       throw new Error(`the base's ${e.path} is a submodule; the pristine copy cannot reproduce it`);
     }
     const content = execFileSync9("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
-    const out2 = join16(dest, e.path);
+    const out2 = join17(dest, e.path);
     mkdirSync6(dirname7(out2), { recursive: true });
-    rmSync3(out2, { force: true });
+    rmSync4(out2, { force: true });
     if (e.mode === "120000") {
       const target = content.toString("utf8");
       safeSymlink(target, out2, dest, `the base's ${e.path}`);
       restoredLinks.push({ path: e.path, out: out2, target });
     } else {
-      writeFileSync7(out2, content);
+      writeFileSync8(out2, content);
       chmodSync2(out2, parseInt(e.mode.slice(-4), 8) & 511);
     }
     restored.push(e.path);
@@ -10080,7 +10624,7 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot) {
   const inCopy = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(rel)) continue;
-    rmSync3(join16(dest, rel), { force: true });
+    rmSync4(join17(dest, rel), { force: true });
     removed++;
   }
   for (const link of restoredLinks) {
@@ -10088,27 +10632,6 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot) {
   }
   return { restored, removed };
 }
-var SUPERVISOR = `
-const cp = require('node:child_process');
-const fs = require('node:fs');
-const [cmd, budgetMs, outFile] = process.argv.slice(1);
-const child = cp.spawn('sh', ['-c', cmd], { stdio: 'ignore', detached: process.platform !== 'win32' });
-const killGroup = () => {
-  try { process.kill(-child.pid, 'SIGKILL'); } catch {}
-  try { child.kill('SIGKILL'); } catch {}
-};
-let done = false;
-const finish = (r) => {
-  if (done) return;
-  done = true;
-  killGroup();
-  fs.writeFileSync(outFile, JSON.stringify(r));
-  process.exit(0);
-};
-const timer = setTimeout(() => finish({ timedOut: true }), Number(budgetMs));
-child.on('error', (e) => { clearTimeout(timer); finish({ error: String(e) }); });
-child.on('exit', (code, signal) => { clearTimeout(timer); finish({ exit: code, signal }); });
-`;
 var DROPPED_ENV = /* @__PURE__ */ new Set([
   "NODE_OPTIONS",
   "NODE_PATH",
@@ -10125,9 +10648,9 @@ function suiteEnv(scratch) {
     if (DROPPED_ENV.has(k) || PINNED_NPM.test(k)) continue;
     env[k] = v;
   }
-  const userRc = join16(scratch, "npmrc-user");
-  const globalRc = join16(scratch, "npmrc-global");
-  for (const f of [userRc, globalRc]) writeFileSync7(f, "", { mode: 292 });
+  const userRc = join17(scratch, "npmrc-user");
+  const globalRc = join17(scratch, "npmrc-global");
+  for (const f of [userRc, globalRc]) writeFileSync8(f, "", { mode: 292 });
   env.npm_config_userconfig = userRc;
   env.npm_config_globalconfig = globalRc;
   env.npm_config_node_options = " ";
@@ -10136,31 +10659,75 @@ function suiteEnv(scratch) {
 }
 function runLocalSuite(dir, cmd, budgetSecs) {
   const t0 = Date.now();
-  const outDir = mkdtempSync2(join16(tmpdir2(), "tw-verify-run-"));
-  const outFile = join16(outDir, "result.json");
+  const scratch = mkdtempSync3(join17(tmpdir3(), "tw-verify-run-"));
   try {
-    spawnSync2(process.execPath, ["-e", SUPERVISOR, cmd, String(budgetSecs * 1e3), outFile], {
+    const r = runCapturedProcessSync("sh", ["-c", cmd], {
       cwd: dir,
-      env: suiteEnv(outDir),
-      stdio: "ignore",
-      timeout: budgetSecs * 1e3 + 3e4,
-      // backstop only; the supervisor enforces the budget
-      killSignal: "SIGKILL"
+      env: suiteEnv(scratch),
+      timeoutMs: budgetSecs * 1e3,
+      detached: process.platform !== "win32",
+      killGroupOnFinish: true,
+      backstopMs: 3e4
     });
     const secs = Math.round((Date.now() - t0) / 1e3);
-    let r;
-    try {
-      r = JSON.parse(readFileSync16(outFile, "utf8"));
-    } catch {
-      return { exit: null, secs };
+    if (r.timedOut) {
+      return {
+        exit: null,
+        secs,
+        failure: "budget",
+        reason: "verifier stage exceeded its budget",
+        diagnostics: r.diagnostics
+      };
+    }
+    if (r.error) {
+      return {
+        exit: null,
+        secs,
+        failure: "backend",
+        reason: r.error,
+        diagnostics: r.diagnostics
+      };
+    }
+    if (r.exit === null) {
+      return {
+        exit: null,
+        secs,
+        failure: "backend",
+        reason: `verifier suite did not return an exit code${r.signal ? ` (signal ${r.signal})` : ""}`,
+        diagnostics: r.diagnostics
+      };
     }
-    if (r.timedOut || r.error) return { exit: null, secs };
-    if (r.exit === null || r.exit === void 0) return { exit: null, secs };
-    return { exit: r.exit, secs };
+    return { exit: r.exit, secs, diagnostics: r.diagnostics };
   } finally {
-    rmSync3(outDir, { recursive: true, force: true });
+    rmSync4(scratch, { recursive: true, force: true });
   }
 }
+function diagnosticsJson(diagnostics, includeTail) {
+  if (!diagnostics) return void 0;
+  const stream = (d) => ({
+    captured_bytes: d.captured_bytes,
+    retained_bytes: d.retained_bytes,
+    truncated: d.truncated,
+    ...includeTail && d.captured_bytes > 0 ? { tail: d.tail } : {}
+  });
+  return {
+    stdout: stream(diagnostics.stdout),
+    stderr: stream(diagnostics.stderr)
+  };
+}
+function stageJson(result) {
+  const includeTail = result.exit !== 0 || result.failure !== void 0;
+  return {
+    exit: result.exit,
+    secs: result.secs,
+    ...result.reason ? { reason: result.reason } : {},
+    ...result.diagnostics ? { diagnostics: diagnosticsJson(result.diagnostics, includeTail) } : {}
+  };
+}
+function renderStageDiagnostics(out2, stage, result) {
+  if (!result.diagnostics) return;
+  for (const line of diagnosticLines(stage, result.diagnostics)) out2(line);
+}
 function runVerify(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const out2 = (s) => void process.stdout.write(s + "\n");
@@ -10242,11 +10809,11 @@ function runVerify(opts) {
     out2(`verify: cannot resolve base rev "${opts.base ?? "HEAD"}" \u2014 failing closed`);
     return 2;
   }
-  const visRoot = mkdtempSync2(join16(tmpdir2(), "tw-verify-vis-"));
-  const visDir = join16(visRoot, "t");
+  const visRoot = mkdtempSync3(join17(tmpdir3(), "tw-verify-vis-"));
+  const visDir = join17(visRoot, "t");
   const cleanup = (dirs) => {
     if (opts.keep) return;
-    for (const d of dirs) rmSync3(d, { recursive: true, force: true });
+    for (const d of dirs) rmSync4(d, { recursive: true, force: true });
   };
   const protectedIgnored = (rel) => isProtected(rel, policy);
   const treeBefore = treeFingerprint(cwd, protectedIgnored);
@@ -10276,14 +10843,16 @@ function runVerify(opts) {
         stage: "visible",
         ...visible.resource ? { resource: visible.resource } : {},
         detail: visible.reason,
+        diagnostics: diagnosticsJson(visible.diagnostics, true),
         verifier_backend: backendReport(),
         oracle_assurance: oracleAssuranceReport()
       }));
     } else {
       out2(
-        exhausted ? "verify: isolated verifier resource envelope was exhausted during the visible stage \u2014 failing closed" : "verify: isolated verifier backend failed while running the visible stage \u2014 failing closed"
+        exhausted ? "verify: isolated verifier resource envelope was exhausted during the visible stage \u2014 failing closed" : "verify: verifier execution backend failed while running the visible stage \u2014 failing closed"
       );
       if (visible.reason) out2("verify: " + visible.reason);
+      renderStageDiagnostics(out2, "visible", visible);
     }
     return 2;
   }
@@ -10300,8 +10869,8 @@ function runVerify(opts) {
     out2((dependencyAfterVisible.reason ?? "dependency identity changed") + ". Failing closed, not open.");
     return 2;
   }
-  const priRoot = mkdtempSync2(join16(tmpdir2(), "tw-verify-pri-"));
-  const priDir = join16(priRoot, "t");
+  const priRoot = mkdtempSync3(join17(tmpdir3(), "tw-verify-pri-"));
+  const priDir = join17(priRoot, "t");
   let restored = [];
   let removedAdded = 0;
   try {
@@ -10332,14 +10901,16 @@ function runVerify(opts) {
         stage: "pristine",
         ...pristine.resource ? { resource: pristine.resource } : {},
         detail: pristine.reason,
+        diagnostics: diagnosticsJson(pristine.diagnostics, true),
         verifier_backend: backendReport(),
         oracle_assurance: oracleAssuranceReport()
       }));
     } else {
       out2(
-        exhausted ? "verify: isolated verifier resource envelope was exhausted during the pristine stage \u2014 failing closed" : "verify: isolated verifier backend failed while running the pristine stage \u2014 failing closed"
+        exhausted ? "verify: isolated verifier resource envelope was exhausted during the pristine stage \u2014 failing closed" : "verify: verifier execution backend failed while running the pristine stage \u2014 failing closed"
       );
       if (pristine.reason) out2("verify: " + pristine.reason);
+      renderStageDiagnostics(out2, "pristine", pristine);
     }
     return 2;
   }
@@ -10381,8 +10952,8 @@ function runVerify(opts) {
         base,
         command: cmd,
         budget_secs: budget,
-        visible: { exit: visible.exit, secs: visible.secs },
-        pristine: { exit: pristine.exit, secs: pristine.secs },
+        visible: stageJson(visible),
+        pristine: stageJson(pristine),
         protected_restored: restored.length,
         added_protected_removed: removedAdded,
         verifier_backend: backendReport(),
@@ -10407,6 +10978,14 @@ function runVerify(opts) {
     out2(
       dependencyEnvironment ? `dependency environment: ${dependencyEnvironmentSummary(dependencyEnvironment)}` + (opts.allowDepDrift && dependencyEnvironment.status === "unattestable" ? " (operator override)" : "") : `dependency environment: verifier-owned by ${verifierBackend.image ?? "isolated image"}`
     );
+    if (verdict2 !== "VERIFIED") {
+      if (visible.exit !== 0 || visible.failure !== void 0) {
+        renderStageDiagnostics(out2, "visible", visible);
+      }
+      if (pristine.exit !== 0 || pristine.failure !== void 0) {
+        renderStageDiagnostics(out2, "pristine", pristine);
+      }
+    }
     if (signedOff)
       out2(
         `masked failure cleared by out-of-band approval (tamperward:allow:${signedOff}): a reviewer accepted that the original suite no longer applies to this change. Exit 0.`
@@ -10451,11 +11030,11 @@ function parseVerify(args) {
 }
 
 // src/cli/run.ts
-import { execFileSync as execFileSync10, spawn, spawnSync as spawnSync3 } from "node:child_process";
+import { execFileSync as execFileSync10, spawn, spawnSync as spawnSync4 } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { mkdtempSync as mkdtempSync3, readdirSync as readdirSync5, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync6, rmSync as rmSync4 } from "node:fs";
-import { tmpdir as tmpdir3 } from "node:os";
-import { join as join17, resolve as resolve8 } from "node:path";
+import { mkdtempSync as mkdtempSync4, readdirSync as readdirSync5, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync6, rmSync as rmSync5 } from "node:fs";
+import { tmpdir as tmpdir4 } from "node:os";
+import { join as join18, resolve as resolve8 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err2 = (s) => process.stderr.write(s + "\n");
 var AGENT_SUPERVISOR = String.raw`
@@ -10603,7 +11182,7 @@ function killAgentTree(pid) {
   if (!Number.isInteger(pid) || pid <= 1) return;
   if (process.platform === "win32") {
     try {
-      spawnSync3("taskkill", ["/pid", String(pid), "/t", "/f"], { stdio: "ignore", timeout: 5e3 });
+      spawnSync4("taskkill", ["/pid", String(pid), "/t", "/f"], { stdio: "ignore", timeout: 5e3 });
     } catch {
     }
     return;
@@ -10625,11 +11204,11 @@ function killAgentTree(pid) {
   }
 }
 function runAgentWithBudget(argv2, cwd, budgetSecs) {
-  const stateDir = mkdtempSync3(join17(tmpdir3(), "tw-agent-supervisor-"));
-  const resultFile = join17(stateDir, "result.json");
+  const stateDir = mkdtempSync4(join18(tmpdir4(), "tw-agent-supervisor-"));
+  const resultFile = join18(stateDir, "result.json");
   let supervisorTimedOut = false;
   try {
-    const supervisor = spawnSync3(
+    const supervisor = spawnSync4(
       process.execPath,
       ["-e", AGENT_SUPERVISOR, resultFile, String(budgetSecs * 1e3), ...argv2],
       {
@@ -10671,7 +11250,7 @@ function runAgentWithBudget(argv2, cwd, budgetSecs) {
       failure: state.failure ?? "agent supervisor did not produce a final status"
     };
   } finally {
-    rmSync4(stateDir, { recursive: true, force: true });
+    rmSync5(stateDir, { recursive: true, force: true });
   }
 }
 var waitCell = new Int32Array(new SharedArrayBuffer(4));
@@ -10688,8 +11267,8 @@ function pidAlive2(pid) {
   }
 }
 function supervisedObserverLog(cwd) {
-  const gd = gitDir(cwd) ?? join17(cwd, ".git");
-  return join17(
+  const gd = gitDir(cwd) ?? join18(cwd, ".git");
+  return join18(
     gd,
     "tamperward",
     `run-observer-${process.pid}-${Date.now()}-${randomBytes(4).toString("hex")}.jsonl`
@@ -10758,7 +11337,16 @@ function observerSummary(observer, telemetry) {
 }
 function collectObserverFindings(observer, telemetry, cwd, base, head, policy) {
   observerSummary(observer, telemetry);
-  const { events } = readEvents(observer.log, 0);
+  const strict = process.env.TAMPERWARD_TRANSIENT === "block";
+  const drained = drainEvents(observer.log, 0);
+  const { events } = drained;
+  if (!drained.complete) {
+    const issue = drained.issue ?? "read-stalled";
+    out(
+      `tamperward run \u2014 transient observer: telemetry was not fully classified (${issue}; ${drained.bytesRead}/${MAX_EVENT_SWEEP_BYTES} bytes read). ` + (strict ? "Strict transient policy fails closed." : "Observer telemetry remains advisory, so this degrades evidence but does not independently fail the envelope.")
+    );
+    if (strict) return { blocking: true };
+  }
   if (events.length === 0) return { blocking: false };
   let persistent = /* @__PURE__ */ new Set();
   try {
@@ -10771,9 +11359,9 @@ function collectObserverFindings(observer, telemetry, cwd, base, head, policy) {
     );
   } catch (e) {
     out(
-      `tamperward run \u2014 transient observer: recorded ${events.length} event(s), but could not classify them against the final diff (${e instanceof Error ? e.message : String(e)}).`
+      `tamperward run \u2014 transient observer: recorded ${events.length} event(s), but could not classify them against the final diff (${e instanceof Error ? e.message : String(e)}).` + (strict ? " Strict transient policy fails closed." : "")
     );
-    return { blocking: false };
+    return { blocking: strict };
   }
   const finalHash = (path) => {
     const e = inspectRel(cwd, path);
@@ -10925,7 +11513,7 @@ function runEnvelope(opts) {
   const rewritesBefore = objectRewriteState(cwd);
   const spawnTicks = nowTicks();
   const agentRun = opts.agentBudget === void 0 ? (() => {
-    const agent = spawnSync3(opts.argv[0], opts.argv.slice(1), { cwd, stdio: "inherit" });
+    const agent = spawnSync4(opts.argv[0], opts.argv.slice(1), { cwd, stdio: "inherit" });
     return {
       exit: agent.status ?? 1,
       timedOut: false,
@@ -10965,7 +11553,7 @@ tamperward run \u2014 agent exit ${agentExit}; DEPENDENCY_DRIFT \u2192 ENFORCEME
     err2("(--allow-dep-drift: proceeding anyway, on the operator's judgement.)");
   }
   const head = git3(["rev-parse", "HEAD"], cwd).trim();
-  const isAncestor = spawnSync3("git", ["merge-base", "--is-ancestor", base, head], { cwd, env: trustedGitEnv() });
+  const isAncestor = spawnSync4("git", ["merge-base", "--is-ancestor", base, head], { cwd, env: trustedGitEnv() });
   if (isAncestor.status !== 0) {
     err2(`tamperward run: HEAD ${head.slice(0, 10)} is not a descendant of the trusted base ${base.slice(0, 10)} \u2014`);
     err2("the agent rewrote history out from under the anchor. That is the finding.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.15.1",
+  "version": "2.16.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",