tickmarkr 2.5.7 → 2.5.8

package/dist/run/journal.d.ts

@@ -132,6 +132,42 @@ export declare function repairReachSinceApproval(events: JournalEvent[], taskId:
 export declare function repairsSinceApproval(events: JournalEvent[], taskId: string): number;
 /** Recheck releases not yet enacted by a battery (or by a legacy worker launch). */
 export declare function pendingRechecks(events: JournalEvent[]): Set<string>;
+/**
+ * OBS-1075: what an accepted approval still authorises, typed by its release. `worker` funds one
+ * dispatch (plain, attempt-cap, review-upheld, scope-request); `battery` funds the recheck battery
+ * and no worker; `waiver` satisfies exactly its named gate; `inert` authorises nothing.
+ */
+export type PendingApprovalAction = {
+    taskId: string;
+    ts: string;
+    authority: "worker";
+    release: "plain" | typeof ATTEMPT_CAP_RELEASE | typeof REVIEW_UPHELD_RELEASE | "scope-request";
+} | {
+    taskId: string;
+    ts: string;
+    authority: "battery";
+    release: typeof RECHECK_RELEASE;
+} | {
+    taskId: string;
+    ts: string;
+    authority: "waiver";
+    release: typeof GATE_SATISFIED_RELEASE;
+    gate: GateName;
+} | {
+    taskId: string;
+    ts: string;
+    authority: "inert";
+    release: unknown;
+};
+/**
+ * Per task, the newest task-approved row no later enactment has consumed. Pure: events in, typed
+ * actions out. Acceptance is not enactment and a run boundary is not enactment — only the row the
+ * release causes consumes it (ENACTED_BY), so an approval accepted just before an abnormal exit
+ * survives every restart until it is enacted. A later approval supersedes an earlier one. An unknown
+ * release, or a waiver without a known gate, is inert: it supersedes, authorises nothing, and no row
+ * enacts it.
+ */
+export declare function pendingApprovalActions(events: JournalEvent[]): Map<string, PendingApprovalAction>;
 /**
  * Why the last attempt failed, one row per journaled cause, in the daemon's own `source: details`
  * shape. The daemon builds that brief in a loop-local variable, which dies with the process: a resumed
@@ -240,6 +276,7 @@ export declare const TelemetryRowSchema: z.ZodObject<{
         "gate-fail": "gate-fail";
         quota: "quota";
         infra: "infra";
+        "scope-request": "scope-request";
         dispatch: "dispatch";
         "human-gate": "human-gate";
         "reroute-exhausted": "reroute-exhausted";
@@ -247,7 +284,6 @@ export declare const TelemetryRowSchema: z.ZodObject<{
         "merge-conflict": "merge-conflict";
         "tip-moved": "tip-moved";
         authoring: "authoring";
-        "scope-request": "scope-request";
         "diff-cap": "diff-cap";
     }>>;
     tokens: z.ZodCatch<z.ZodOptional<z.ZodObject<{

package/dist/run/journal.js

@@ -620,6 +620,49 @@ export function pendingRechecks(events) {
     }
     return pending;
 }
+const ENACTED_BY = {
+    worker: ["task-dispatch", "worker-launch"],
+    battery: ["recheck-battery"],
+    waiver: ["worktree-recreation"],
+};
+/**
+ * Per task, the newest task-approved row no later enactment has consumed. Pure: events in, typed
+ * actions out. Acceptance is not enactment and a run boundary is not enactment — only the row the
+ * release causes consumes it (ENACTED_BY), so an approval accepted just before an abnormal exit
+ * survives every restart until it is enacted. A later approval supersedes an earlier one. An unknown
+ * release, or a waiver without a known gate, is inert: it supersedes, authorises nothing, and no row
+ * enacts it.
+ */
+export function pendingApprovalActions(events) {
+    const pending = new Map();
+    for (const e of events) {
+        if (!e.taskId)
+            continue;
+        if (e.event === "task-approved") {
+            pending.set(e.taskId, approvalAction(e.taskId, e));
+            continue;
+        }
+        const action = pending.get(e.taskId);
+        if (action && action.authority !== "inert" && ENACTED_BY[action.authority].includes(e.event))
+            pending.delete(e.taskId);
+    }
+    return pending;
+}
+function approvalAction(taskId, e) {
+    const { release, gate } = e.data;
+    const base = { taskId, ts: e.ts };
+    if (release === undefined)
+        return { ...base, authority: "worker", release: "plain" };
+    if (release === ATTEMPT_CAP_RELEASE || release === REVIEW_UPHELD_RELEASE || release === "scope-request") {
+        return { ...base, authority: "worker", release };
+    }
+    if (release === RECHECK_RELEASE)
+        return { ...base, authority: "battery", release };
+    if (release === GATE_SATISFIED_RELEASE && typeof gate === "string" && GATE_NAMES.includes(gate)) {
+        return { ...base, authority: "waiver", release, gate: gate };
+    }
+    return { ...base, authority: "inert", release };
+}
 // Both retry decisions below govern exactly ONE dispatch: the next one. So both are read back from the
 // journal at the moment that dispatch is built, never carried in a process variable — a stop between
 // the decision and the dispatch (OBS-254's shape, one layer up) would otherwise send a normal prompt

package/dist/run/merge.d.ts

@@ -12,6 +12,8 @@ export interface TipVerifyResult {
     spawnedCommand?: string;
     /** Q121s: nonzero exit whose failures are ALL baseline-recorded — forgiven exactly as the battery forgives. */
     forgiven?: boolean;
+    /** D-131: carried from a persisted per-gate verdict — this cycle did NOT execute the command. */
+    reused?: true;
     /**
      * OBS-534: what a nonzero exit is evidence OF, taken from the battery's own readers — `ceilingKillResult`
      * for a kill, the shared runner classifier for everything else. `infra` means nothing was verified.

package/dist/run/merge.js

@@ -184,6 +184,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
                 gate,
                 cmd,
                 pass: hit.pass,
+                reused: true,
                 exitCode: hit.exitCode ?? 0,
                 fingerprints: hit.meta?.fingerprints ?? [],
                 ...(hit.meta?.forgiven ? { forgiven: true } : {}),

package/dist/run/repair-disposition.d.ts

@@ -0,0 +1,41 @@
+import type { GateResult } from "../gates/types.js";
+/** Pure decision table of the scope-red disposition (OBS-1077, OBS-1074 residual): no filesystem,
+ * process, clock or journal. The caller supplies the inventory and performs every side effect. */
+export type RepairDispositionKind = "fund-repair" | "scope-request" | "authoring" | "none";
+export interface RepairDisposition {
+    kind: RepairDispositionKind;
+    /** validated inventory paths only — the sole paths a caller may put in an executable command */
+    paths: string[];
+    reason: string;
+    /** which evidence decided: a gate name, "worker" for a refusal, absent for the ordinary disposition */
+    source?: string;
+    /** an independent classification that kept priority over path prose */
+    blocker?: "infra" | "scope-collateral";
+    /** candidates that bound to nothing, or to more than one path; evidence, never approval advice */
+    diagnostics: ScopeHintDiagnostic[];
+}
+export interface ScopeHintDiagnostic {
+    candidate: string;
+    kind: "unresolved" | "ambiguous";
+    matches: string[];
+    reason: string;
+}
+export interface ScopeHintResolution {
+    resolved: string[];
+    diagnostics: ScopeHintDiagnostic[];
+}
+export interface RepairDispositionInput {
+    /** the failing gate results (passing rows are ignored) */
+    results: readonly GateResult[];
+    files: readonly string[];
+    /** the worker's refusal summary — present only when the worker reported ok:false */
+    refusalSummary?: string;
+    /** task tree plus diff, deleted tracked paths included */
+    inventory: Iterable<string>;
+}
+/** Lexing never starts in the middle of a word (same lexer as the daemon's scope-red disposition). */
+export declare const namedPaths: (text: string) => string[];
+/** Binds candidates to the SUPPLIED inventory and nothing else: an exact path, else a unique
+ * path-suffix. Anything unbound or bound twice comes back as a non-executable diagnostic. */
+export declare function resolveScopeHints(candidates: Iterable<string>, inventory: Iterable<string>): ScopeHintResolution;
+export declare function classifyRepairDisposition(input: RepairDispositionInput): RepairDisposition;

package/dist/run/repair-disposition.js

@@ -0,0 +1,77 @@
+import { filesGlob } from "../graph/files-glob.js";
+const failed = (g) => !(g.pass || g.meta?.skipped === true) || g.meta?.infra === true;
+const REFUSAL_RE = /outside|out.of.scope|allowlist|scope expansion|not (?:in|own)|unowned/i;
+/** Lexing never starts in the middle of a word (same lexer as the daemon's scope-red disposition). */
+export const namedPaths = (text) => [...text.matchAll(/(?:^|[\s`'"])((?:[A-Za-z0-9_@.()[\]-]+\/)+[A-Za-z0-9_@.[\]-]+|[A-Za-z0-9_@-]+(?:\.[A-Za-z0-9_-]+)+)(?=$|[\s`'"),:;.!?])/g)]
+    .map((match) => match[1].replace(/^\.\//, "").replace(/\.$/, ""))
+    .filter((path) => !path.split("/").includes(".."));
+/** Binds candidates to the SUPPLIED inventory and nothing else: an exact path, else a unique
+ * path-suffix. Anything unbound or bound twice comes back as a non-executable diagnostic. */
+export function resolveScopeHints(candidates, inventory) {
+    const known = new Set(inventory);
+    const resolved = new Set();
+    const diagnostics = [];
+    for (const candidate of new Set(candidates)) {
+        if (known.has(candidate)) {
+            resolved.add(candidate);
+            continue;
+        }
+        const matches = [...known].filter((path) => path.endsWith(`/${candidate}`)).sort();
+        if (matches.length === 1)
+            resolved.add(matches[0]);
+        else
+            diagnostics.push(matches.length === 0
+                ? { candidate, kind: "unresolved", matches, reason: `scope hint resolves to nothing in the task tree: ${candidate}` }
+                : { candidate, kind: "ambiguous", matches, reason: `scope hint ${candidate} matches ${matches.length} paths: ${matches.join(", ")}` });
+    }
+    return { resolved: [...resolved].sort(), diagnostics };
+}
+export function classifyRepairDisposition(input) {
+    const reds = input.results.filter(failed);
+    const none = (reason, extra = {}) => ({ kind: "none", paths: [], reason, diagnostics: [], ...extra });
+    // Independent classifications first: prose naming a path never erases them.
+    const infra = reds.find((g) => g.meta?.infra === true);
+    if (infra)
+        return none(`${infra.gate}: infra red keeps its own classification`, { source: infra.gate, blocker: "infra" });
+    const verdict = reds.find((g) => g.gate === "scope")?.meta?.collateral;
+    if (verdict) {
+        return verdict.authoring
+            ? { kind: "authoring", paths: [...verdict.predicted], reason: verdict.repair, source: "scope", blocker: "scope-collateral", diagnostics: [] }
+            : none("scope: collateral verdict has unpredicted offenders — ordinary chargeable disposition", { source: "scope", blocker: "scope-collateral" });
+    }
+    if (input.files.length === 0)
+        return none("task declares no files[]");
+    const allowed = filesGlob([...input.files]);
+    const inventory = [...input.inventory];
+    const unowned = (text) => {
+        const r = resolveScopeHints(namedPaths(text).filter((path) => !allowed(path)), inventory);
+        return { paths: r.resolved.filter((path) => !allowed(path)), diagnostics: r.diagnostics };
+    };
+    const owned = (text) => resolveScopeHints(namedPaths(text), inventory).resolved.some(allowed);
+    const refusal = input.refusalSummary !== undefined && REFUSAL_RE.test(input.refusalSummary)
+        ? unowned(input.refusalSummary) : { paths: [], diagnostics: [] };
+    // A test gate names where the ASSERTION lives — a detection site, not the code that needs fixing.
+    const sites = reds.filter((g) => g.gate === "test").map((g) => unowned(g.details));
+    const others = reds.filter((g) => g.gate !== "test");
+    const hints = others.map((g) => unowned(g.details));
+    const diagnostics = [refusal, ...sites, ...hints].flatMap((r) => r.diagnostics)
+        .filter((d, i, all) => all.findIndex((o) => o.candidate === d.candidate) === i);
+    const uniq = (rs) => [...new Set(rs.flatMap((r) => r.paths))].sort();
+    if (refusal.paths.length) {
+        return { kind: "scope-request", paths: refusal.paths, source: "worker", diagnostics,
+            reason: `worker refusal names unowned paths: ${refusal.paths.join(", ")}` };
+    }
+    const repair = uniq(hints);
+    if (repair.length && !others.some((g) => owned(g.details))) {
+        const review = others.some((g) => g.gate === "review");
+        return { kind: review ? "scope-request" : "authoring", paths: repair, source: others[0].gate, diagnostics,
+            reason: `files[] repair hint: ${repair.join(", ")}` };
+    }
+    const detection = uniq(sites);
+    if (detection.length) {
+        return { kind: "fund-repair", paths: detection, source: "test", diagnostics,
+            reason: `test gate names a detection site, not an out-of-scope repair: ${detection.join(", ")}` };
+    }
+    // Unknown attribution never blocks funding: the ordinary chargeable disposition applies.
+    return none("no attributable out-of-scope repair — ordinary chargeable disposition", { diagnostics });
+}

package/dist/tui/cockpit/home-view.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { Box, useInput } from "ink";
-import { useLayoutEffect, useState } from "react";
+import { useLayoutEffect, useRef, useState } from "react";
 import { GLYPHS } from "../../brand.js";
 import { BodyText, CockpitGrid, Panel, ProgressMeter, Sparkline, StateGlyph, } from "./components.js";
 import { ABSENT_FIELD, fieldReading } from "./derive.js";
@@ -146,75 +146,90 @@ export function HomeView({ model, width, focused = true, onOpenPark, onOpenDiagn
     const maxOffset = Math.max(0, model.activity.length - 1);
     const maxSelection = Math.max(0, model.activity.length - 1);
     const safeOffset = Math.min(offset, maxOffset);
+    // Keep input ahead of the next render/effect subscription, as in EvidenceView.
+    // Render reconciles the refs with model updates; each move writes before setting state.
+    const sectionRef = useRef(effectiveSection);
+    const needsYouIndexRef = useRef(effectiveNeedsYouIndex);
+    const activityIndexRef = useRef(effectiveActivityIndex);
+    sectionRef.current = effectiveSection;
+    needsYouIndexRef.current = effectiveNeedsYouIndex;
+    activityIndexRef.current = effectiveActivityIndex;
+    const moveSection = (next) => {
+        sectionRef.current = next;
+        setSection(next);
+    };
+    const moveNeedsYou = (index) => {
+        needsYouIndexRef.current = index;
+        setNeedsYouIndex(index);
+        setSelectedNeedsYouId(model.needsYou[index]?.id);
+    };
+    const moveActivity = (index) => {
+        activityIndexRef.current = index;
+        setActivityIndex(index);
+        setSelectedEvidenceId(model.activity[index]?.evidence.id);
+    };
     useInput((_input, key) => {
         if (key.leftArrow && model.needsYou.length > 0) {
-            if (effectiveSection === "needsYou") {
-                const nextIndex = (effectiveNeedsYouIndex + 1) % model.needsYou.length;
-                setNeedsYouIndex(nextIndex);
-                setSelectedNeedsYouId(model.needsYou[nextIndex]?.id);
+            if (sectionRef.current === "needsYou") {
+                const nextIndex = (needsYouIndexRef.current + 1) % model.needsYou.length;
+                moveNeedsYou(nextIndex);
             }
             else {
-                setSection("needsYou");
+                moveSection("needsYou");
             }
         }
         if (key.rightArrow)
-            setSection("activity");
+            moveSection("activity");
         if (key.upArrow) {
-            if (effectiveSection === "needsYou") {
+            if (sectionRef.current === "needsYou") {
                 if (model.needsYou.length > 0) {
-                    const nextIndex = (effectiveNeedsYouIndex - 1 + model.needsYou.length) % model.needsYou.length;
-                    setNeedsYouIndex(nextIndex);
-                    setSelectedNeedsYouId(model.needsYou[nextIndex]?.id);
+                    const nextIndex = (needsYouIndexRef.current - 1 + model.needsYou.length) % model.needsYou.length;
+                    moveNeedsYou(nextIndex);
                 }
             }
             else {
                 if (model.activity.length > 0) {
-                    const nextIndex = Math.max(0, effectiveActivityIndex - 1);
-                    setActivityIndex(nextIndex);
-                    setSelectedEvidenceId(model.activity[nextIndex]?.evidence.id);
+                    const nextIndex = Math.max(0, activityIndexRef.current - 1);
+                    moveActivity(nextIndex);
                 }
             }
         }
         if (key.downArrow) {
-            if (effectiveSection === "needsYou") {
+            if (sectionRef.current === "needsYou") {
                 if (model.needsYou.length > 0) {
-                    const nextIndex = (effectiveNeedsYouIndex + 1) % model.needsYou.length;
-                    setNeedsYouIndex(nextIndex);
-                    setSelectedNeedsYouId(model.needsYou[nextIndex]?.id);
+                    const nextIndex = (needsYouIndexRef.current + 1) % model.needsYou.length;
+                    moveNeedsYou(nextIndex);
                 }
             }
             else {
                 if (model.activity.length > 0) {
-                    const nextIndex = Math.min(maxSelection, effectiveActivityIndex + 1);
-                    setActivityIndex(nextIndex);
-                    setSelectedEvidenceId(model.activity[nextIndex]?.evidence.id);
+                    const nextIndex = Math.min(maxSelection, activityIndexRef.current + 1);
+                    moveActivity(nextIndex);
                 }
             }
         }
         if (key.pageDown) {
             setOffset((o) => Math.max(0, o - HOME_ACTIVITY_VISIBLE_ROWS));
             if (model.activity.length > 0) {
-                const nextIndex = Math.max(0, effectiveActivityIndex - HOME_ACTIVITY_VISIBLE_ROWS);
-                setActivityIndex(nextIndex);
-                setSelectedEvidenceId(model.activity[nextIndex]?.evidence.id);
+                const nextIndex = Math.max(0, activityIndexRef.current - HOME_ACTIVITY_VISIBLE_ROWS);
+                moveActivity(nextIndex);
             }
         }
         if (key.pageUp) {
             setOffset((o) => Math.min(maxOffset, o + HOME_ACTIVITY_VISIBLE_ROWS));
             if (model.activity.length > 0) {
-                const nextIndex = Math.min(maxSelection, effectiveActivityIndex + HOME_ACTIVITY_VISIBLE_ROWS);
-                setActivityIndex(nextIndex);
-                setSelectedEvidenceId(model.activity[nextIndex]?.evidence.id);
+                const nextIndex = Math.min(maxSelection, activityIndexRef.current + HOME_ACTIVITY_VISIBLE_ROWS);
+                moveActivity(nextIndex);
             }
         }
         if (key.return) {
-            if (effectiveSection === "needsYou") {
-                const target = selectedNeedsYou;
+            if (sectionRef.current === "needsYou") {
+                const target = selectNeedsYouTarget(model, needsYouIndexRef.current);
                 if (target)
                     (target.kind === "park" ? onOpenPark : onOpenDiagnostic)(target.id);
             }
             else {
-                const row = model.activity[effectiveActivityIndex];
+                const row = model.activity[activityIndexRef.current];
                 if (row)
                     onOpenEvidence(row.evidence);
             }

package/dist/tui/cockpit/live-store.d.ts

@@ -121,6 +121,7 @@ export declare function createLiveStore(options: LiveStoreOptions): {
                     oracle: "test";
                     test: string;
                     text?: string | undefined;
+                    landing?: string | undefined;
                 } | {
                     oracle: "judge";
                     text: string;
@@ -138,6 +139,14 @@ export declare function createLiveStore(options: LiveStoreOptions): {
                     confidence?: number | undefined;
                     reason?: string | undefined;
                 }[] | undefined;
+                pins?: ({
+                    kind: "literal";
+                    text: string;
+                    glob: string;
+                } | {
+                    kind: "fixture";
+                    paths: string[];
+                })[] | undefined;
                 routingHints?: {
                     pin?: {
                         via: string;
@@ -213,6 +222,7 @@ export declare function createLiveStore(options: LiveStoreOptions): {
                     oracle: "test";
                     test: string;
                     text?: string | undefined;
+                    landing?: string | undefined;
                 } | {
                     oracle: "judge";
                     text: string;
@@ -230,6 +240,14 @@ export declare function createLiveStore(options: LiveStoreOptions): {
                     confidence?: number | undefined;
                     reason?: string | undefined;
                 }[] | undefined;
+                pins?: ({
+                    kind: "literal";
+                    text: string;
+                    glob: string;
+                } | {
+                    kind: "fixture";
+                    paths: string[];
+                })[] | undefined;
                 routingHints?: {
                     pin?: {
                         via: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.5.7",
+  "version": "2.5.8",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/schema/rungraph.schema.json

@@ -149,6 +149,10 @@
                     "text": {
                       "type": "string",
                       "minLength": 1
+                    },
+                    "landing": {
+                      "type": "string",
+                      "minLength": 1
                     }
                   },
                   "required": [
@@ -201,6 +205,56 @@
               ]
             }
           },
+          "pins": {
+            "type": "array",
+            "items": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "literal"
+                    },
+                    "text": {
+                      "type": "string",
+                      "minLength": 1
+                    },
+                    "glob": {
+                      "type": "string",
+                      "minLength": 1
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "text",
+                    "glob"
+                  ]
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "const": "fixture"
+                    },
+                    "paths": {
+                      "minItems": 1,
+                      "type": "array",
+                      "items": {
+                        "type": "string",
+                        "minLength": 1
+                      }
+                    }
+                  },
+                  "required": [
+                    "kind",
+                    "paths"
+                  ]
+                }
+              ]
+            }
+          },
           "gates": {
             "default": [
               "build",

package/skills/tickmarkr-overseer/SKILL.md

@@ -288,6 +288,58 @@ journal tail to decide what happens next, or sweeping orphans — you have taken
 3. **Gate a mid-run fix at the base, not at a summary (law 47 / OBS-909).** A fix landed on main while a
    run is live is proved with `tickmarkr verify --base <main>`, never with a suite summary copied from a
    different tree. A release proof runs every CI-ordered step — including lint — before its suite.
+4. **Rescue a broken harness from OUTSIDE the run it broke — the daemon is NEVER asked to repair itself
+   as a task (v2.5.7 ledger D-59, D-64; OBS-1078).** When the harness is the defect — resume cannot be
+   relied on, a gate cannot be relied on, the binary every gate runs on is the thing that is wrong — no
+   task inside the run can fix it: the gates that would judge the repair are executed BY the suspect
+   binary, and the worktree the repair would run in is created by the same code. Dispatching
+   *"fix the daemon"* as a task of the run it broke buys a green gate from the defect and a repair nobody
+   can trust. The rescue route has three legs, each with its own record, and there is no fourth:
+   - **AN INDEPENDENTLY GATED EXTERNAL FIX LEG.** Its own checkout and branch off the run's base, its own
+     brief, its own `files[]`, its own battery — `tickmarkr verify --base <ref> --criteria <file>
+     --author <the seat that wrote it>` — plus the cross-vendor review its criterion names, all recorded
+     BEFORE the run consumes any of it. The leg's battery is scheduled at a boundary item 2 permits (the
+     run parked or ended, or the operator's recorded exception), and its reds are declared to the
+     contamination watcher in advance so they are classified instead of assumed.
+   - **AN EXPLICITLY RECORDED REBUILT BINARY AND RESTART — the provenance is written down in the same act,
+     or the rebuild did not happen.** Record: the fix leg's commit sha; the build command; the install
+     form (never `npm i -g .` on the repository directory — npm SYMLINKS a directory install and every
+     later build hot-swaps the machine-wide binary with no version change to notice it by); the
+     global-versus-repo **inode** comparison that proves a real install, which `tickmarkr version` cannot
+     do because it cannot go red when nothing is bumped; the version read-back; and the restart itself —
+     `tickmarkr resume <runId>`, the ORCHESTRATOR's command, never yours. An unrecorded rebuild leaves the
+     next seat arguing about which binary produced which journal rows, with nothing to read.
+   - **A SEPARATELY GATED UNION.** The rebuilt harness and the run's existing work are then gated
+     TOGETHER, on their own, at the one commit that carries both. A green fix leg beside a green run is
+     no proof of their union — see *a green leg beside a green parent*, under the release criterion
+     below — because the union's own conflict resolutions, ordering and collected-count changes are
+     exactly what neither green ever saw.
+   **NO BRANCH SURGERY: the run keeps its ORIGINAL base and its recorded baseline.** No rebase of the
+   integration branch, no re-cut `baseRef`, no re-baselining to make the rescue leg's diff read small.
+   Resume REPLAYS the journal's `baseRef`, so a rewritten one is a different run wearing the same id —
+   and a baseline re-recorded to suit the rescue launders every red the original baseline was there to
+   compare against.
+5. **A rebuilt binary is NOT a rebuilt tree: a claimed fix arrival needs ANCESTRY EVIDENCE naming the
+   actual task subject (v2.5.7 ledger D-80; OBS-1078).** Rebuilding and reinstalling `dist` changes the
+   daemon the orchestrator launches and nothing else. It puts no test, fixture, schema or skill byte into
+   any task worktree or into the integration branch: those trees were checked out from the integration tip
+   BEFORE the fix leg landed, and git does not retro-fill a checkout that already exists. So *"the fix has
+   reached the task checkouts"* is never accepted on a version read-back, a rebuild log, or the fixer's
+   say-so — require ancestry evidence naming the ACTUAL subjects, and read it before the claim, not after:
+   - **the TASK subject** — that task worktree's own branch and HEAD sha (`git -C <task-worktree> rev-parse
+     --abbrev-ref HEAD` and `git -C <task-worktree> rev-parse HEAD`), with the fix proven an ancestor of
+     THAT commit: `git -C <task-worktree> merge-base --is-ancestor <fix-sha> HEAD`, whose exit code is the
+     evidence, recorded beside all three shas;
+   - **the INTEGRATION subject** — the integration-branch commit that worktree was created from, named by
+     sha from the journal's `task-dispatch` row or `tickmarkr status`; never "the run", and never the
+     branch name alone, which moves while you are reading it;
+   - **and, where the fix is a FILE the tree must hold** — a new test, a fixture, a schema — its presence
+     at that commit: `git -C <task-worktree> cat-file -e <task-head>:<path>`. A fix that lives only in the
+     daemon's `dist` cannot make a worker's missing oracle appear, and a worker red on that missing file is
+     still a plan defect, not a retry.
+   A fix present in the daemon and absent from the task trees has been INSTALLED, not ARRIVED: say which
+   of the two you mean, and name the commit each half was read against. Evidence rule 13's baseRef trap is
+   the same defect wearing a diff instead of a claim.
 
 ### What the ORCHESTRATOR does, and what you require of it
 
@@ -383,12 +435,67 @@ its own — **not because any instrument detected it.**
 > covers — and a re-scope of any named subject voids it AUTOMATICALLY, with no ruling required.**
 > A void condition that needs a ruling to fire is not a void condition; it is a second thing to forget.
 
+**⚡ ONE QUALIFICATION, PROSPECTIVE ONLY: A FUTURE SEAL MAY DECLARE THAT AN AUDITED FILES-ONLY AMENDMENT
+DOES NOT VOID IT — AND THAT DECLARATION HAS TO BE IN THE SEAL, WRITTEN AT ISSUE (v2.5.7 ledger D-80, D-83;
+OBS-1078).** The automatic-void rule above is QUALIFIED for seals issued after this clause, never deleted:
+it still fires on its own terms for every seal that does not carry the declaration. A requirements seal may
+declare, prospectively, that exactly one narrow class of change does not void it — an **AUDITED FILES-ONLY
+AMENDMENT**: a recorded amendment to a task's `files[]` and nothing else, which leaves all four of these
+UNTOUCHED.
+
+1. **the ACCEPTANCE TEXT** — every criterion's own words, byte for byte, a `test:` leaf title included;
+2. **the TASK IDENTITY** — which task is which: its id, its shape, its deps, the suites it owns;
+3. **the RUN IDENTITY** — the run, its base and its `baseRef`, the integration branch and its tip commit;
+4. **the SAFETY REQUIREMENTS** — the gates, bounds, refusals and contamination rules the run is held to.
+
+**Replay it both ways, because the clause is a procedure and not a mood:**
+- *A seal carrying that declaration, then an audited amendment adding one owned path to a task's `files[]`,
+  with all four invariants read and found unchanged* → **THE SEAL IS KEPT.** No successor seal and no
+  re-grade of what it already sealed: the declaration was the seal's own pre-commitment about this exact
+  change, made before the change existed — the only moment such a commitment can honestly be made. Read the
+  four invariants BEFORE ruling, and record the read beside the amendment.
+- *The same seal, then an amendment that changes the RUN IDENTITY — a new run id, a re-cut `baseRef`, a
+  different integration tip* → **THE SEAL IS VOID, on its own declaration's terms.** Run identity is one of
+  the four, so *"files-only"* does not describe that amendment; moving any one of the four puts the change
+  outside the declared class, and **any other change of any kind needs a SUCCESSOR SEAL** — a new document,
+  sealed before the work it grades, naming the subject as it now stands.
+
+**Three limits, and each one has been argued around:**
+- **The declaration is never retroactive and never inferred.** A seal issued BEFORE this change — one whose
+  own text does not carry the declaration — **stays governed by the existing void conditions above,
+  unmodified: any re-scope, narrowing, widening, split, merge or re-ownership of a named subject voids it
+  AUTOMATICALLY, with no ruling required.** So *"the acceptance text never changed, therefore the seal
+  still holds"* is **REFUSED** for such a seal once its SUBJECT has moved: unchanged acceptance text alone
+  preserves nothing over a changed subject, because a seal grades the subject it named, not the sentences
+  it happened to be written in. Retrofitting the declaration onto an already-sealed document is itself an
+  amendment to a sealed subject — write the successor seal instead.
+- **A files-only clause confers no amendment authority.** It says nothing about whether the amendment is
+  LAWFUL: compile's unit bounds still refuse an over-bound `files[]`, and no seal can widen what compile
+  will certify.
+- **AUDITED means recorded, or it did not happen.** The approval row carrying the amended files, the
+  before-and-after `files[]`, and the four-invariant read are what let the next seat replay your ruling
+  instead of trusting it. An unrecorded *"files-only"* amendment is indistinguishable from a re-scope, and
+  is voided as one.
+
 **⚡ IDENTIFY THE SUBJECT BY WHAT THE CLAIM IS ABOUT. Half of the failure above was a category error, and
 it is the cheap half to fix:** a graph hash identifies a **PLAN**, and a plan is recompiled, re-cut and
 re-owned as a matter of course. **A criterion about a SHIPPED TREE names the COMMIT** — or the tag, or the
 export tree hash — **never a graph hash, never a run id, never a task list.** Ask what a reader would have
 to hold in their hand to check the clause: if it is bytes, name the bytes.
 
+**⚡ A GREEN LEG BESIDE A GREEN PARENT IS NO PROOF OF THEIR UNION: THE RELEASE PROOF BINDS TO THE MERGED
+CANDIDATE'S COMMIT, AND IS VOID THE MOMENT THAT SUBJECT MOVES (v2.5.7 ledger D-80, D-83; OBS-1078).** The
+subject of a release proof is never *"the run"* and never *"the fix leg"* — it is the **MERGED candidate**:
+the one commit that carries the run's work AND every leg merged into it. Name that commit's sha in the
+proof, in the same act as the grade, and the proof is bound to that sha alone. **When the subject moves — a
+later merge, a new integration tip, an amended or re-cut commit, a fresh export, a re-tag — the proof is
+VOID, and the new subject is graded from scratch**, count oracle included, since the oracle is derived from
+the merged tree and not from either parent. Two greens assembled into one verdict are two claims about two
+trees that never contained each other: the union's own conflict resolutions, its ordering and its
+collected-test total are exactly what neither green observed — which is why `RELEASING.md` step 4 matches
+the run's head SHA to the mirror's `HEAD` before a single job log is graded. This is the void-condition duty
+pointed at bytes: **a proof that names no commit cannot notice its subject leaving.**
+
 **THE RECIPROCAL DUTY, and it is yours because you write both documents:** when you issue a ruling that
 re-scopes, narrows, splits or re-owns anything, **the ruling must name every sealed document its subject
 appears in** — and say, in the ruling, whether each one is now void. You are the only seat that can do