tickmarkr 2.5.7 → 2.5.9

package/dist/run/journal.d.ts

@@ -43,6 +43,15 @@ export interface StructuredFinding {
     note: string;
     rationale?: string;
     fingerprint: string;
+    /** Closed list of spellings actually observed on this chain, including the current one. */
+    observedFingerprints?: string[];
+    /** Prior id validated against the reviewer's reraised list by the review gate. */
+    reraisedFrom?: string;
+    /** Resolved definition AND defect identity; bare symbol spelling is never lineage. */
+    codeIdentity?: {
+        definition: string;
+        defect: string;
+    };
 }
 declare const CONSULT_ACTIONS: readonly ["retry", "reroute", "decompose", "human"];
 export type ConsultGuidanceAction = (typeof CONSULT_ACTIONS)[number];
@@ -132,6 +141,42 @@ export declare function repairReachSinceApproval(events: JournalEvent[], taskId:
 export declare function repairsSinceApproval(events: JournalEvent[], taskId: string): number;
 /** Recheck releases not yet enacted by a battery (or by a legacy worker launch). */
 export declare function pendingRechecks(events: JournalEvent[]): Set<string>;
+/**
+ * OBS-1075: what an accepted approval still authorises, typed by its release. `worker` funds one
+ * dispatch (plain, attempt-cap, review-upheld, scope-request); `battery` funds the recheck battery
+ * and no worker; `waiver` satisfies exactly its named gate; `inert` authorises nothing.
+ */
+export type PendingApprovalAction = {
+    taskId: string;
+    ts: string;
+    authority: "worker";
+    release: "plain" | typeof ATTEMPT_CAP_RELEASE | typeof REVIEW_UPHELD_RELEASE | "scope-request";
+} | {
+    taskId: string;
+    ts: string;
+    authority: "battery";
+    release: typeof RECHECK_RELEASE;
+} | {
+    taskId: string;
+    ts: string;
+    authority: "waiver";
+    release: typeof GATE_SATISFIED_RELEASE;
+    gate: GateName;
+} | {
+    taskId: string;
+    ts: string;
+    authority: "inert";
+    release: unknown;
+};
+/**
+ * Per task, the newest task-approved row no later enactment has consumed. Pure: events in, typed
+ * actions out. Acceptance is not enactment and a run boundary is not enactment — only the row the
+ * release causes consumes it (ENACTED_BY), so an approval accepted just before an abnormal exit
+ * survives every restart until it is enacted. A later approval supersedes an earlier one. An unknown
+ * release, or a waiver without a known gate, is inert: it supersedes, authorises nothing, and no row
+ * enacts it.
+ */
+export declare function pendingApprovalActions(events: JournalEvent[]): Map<string, PendingApprovalAction>;
 /**
  * Why the last attempt failed, one row per journaled cause, in the daemon's own `source: details`
  * shape. The daemon builds that brief in a loop-local variable, which dies with the process: a resumed
@@ -151,6 +196,11 @@ export declare function pendingRechecks(events: JournalEvent[]): Set<string>;
  * because every approval erased exactly the finding the fresh attempt was funded to fix.
  */
 export declare function journaledFailureBrief(events: JournalEvent[], taskId: string): string[];
+/** Never infer a cross-path alias from a symbol, sentence, or hash. */
+export declare function reviewFingerprintMatches(candidate: unknown, fingerprint: string): boolean;
+export declare function observedReviewFingerprints(finding: StructuredFinding): string[];
+/** Re-seat only an unambiguous, positively linked chain; retain the newest evidence path. */
+export declare function carryReviewFindings(priors: readonly StructuredFinding[], rows: readonly StructuredFinding[]): StructuredFinding[];
 /**
  * T6: the review findings still OUTSTANDING on a task. A review finding is a property of the TASK,
  * not of the attempt that drew it: it stays outstanding until a later review PASSES on the task (or
@@ -172,7 +222,8 @@ export declare function journaledFailureBrief(events: JournalEvent[], taskId: st
  * other gate settled that gate, not this one. Reading "approved" as "settled" is how a still-open
  * finding was dropped at the exact moment the operator paid for another attempt to fix it. A review
  * that DECLINED (`skipped`) is not a verdict and neither adds nor retires — fail closed. Findings are
- * keyed by fingerprint, so a reviewer restating one across rounds carries it once, not once per round.
+ * linked by validated lineage across paths; observed spellings remain a closed list. Repeating the
+ * same row carries it once, while distinct defects sharing a symbol retain separate fingerprints.
  *
  * v2.1.5 T2: a passing review settles the findings it BLOCKED on. It does not settle the ones it
  * DEFERRED — those it saw, declined to block on, and recorded a rationale for, and nothing has fixed
@@ -240,6 +291,7 @@ export declare const TelemetryRowSchema: z.ZodObject<{
         "gate-fail": "gate-fail";
         quota: "quota";
         infra: "infra";
+        "scope-request": "scope-request";
         dispatch: "dispatch";
         "human-gate": "human-gate";
         "reroute-exhausted": "reroute-exhausted";
@@ -247,7 +299,6 @@ export declare const TelemetryRowSchema: z.ZodObject<{
         "merge-conflict": "merge-conflict";
         "tip-moved": "tip-moved";
         authoring: "authoring";
-        "scope-request": "scope-request";
         "diff-cap": "diff-cap";
     }>>;
     tokens: z.ZodCatch<z.ZodOptional<z.ZodObject<{
@@ -276,8 +327,8 @@ export declare const TelemetryRowSchema: z.ZodObject<{
     }>>;
     kind: z.ZodOptional<z.ZodLiteral<"judge">>;
     judgeOutcome: z.ZodOptional<z.ZodEnum<{
-        parseable: "parseable";
         unparseable: "unparseable";
+        parseable: "parseable";
     }>>;
 }, z.core.$strip>;
 export type TelemetryRow = z.infer<typeof TelemetryRowSchema>;

package/dist/run/journal.js

@@ -620,6 +620,49 @@ export function pendingRechecks(events) {
     }
     return pending;
 }
+const ENACTED_BY = {
+    worker: ["task-dispatch", "worker-launch"],
+    battery: ["recheck-battery"],
+    waiver: ["worktree-recreation"],
+};
+/**
+ * Per task, the newest task-approved row no later enactment has consumed. Pure: events in, typed
+ * actions out. Acceptance is not enactment and a run boundary is not enactment — only the row the
+ * release causes consumes it (ENACTED_BY), so an approval accepted just before an abnormal exit
+ * survives every restart until it is enacted. A later approval supersedes an earlier one. An unknown
+ * release, or a waiver without a known gate, is inert: it supersedes, authorises nothing, and no row
+ * enacts it.
+ */
+export function pendingApprovalActions(events) {
+    const pending = new Map();
+    for (const e of events) {
+        if (!e.taskId)
+            continue;
+        if (e.event === "task-approved") {
+            pending.set(e.taskId, approvalAction(e.taskId, e));
+            continue;
+        }
+        const action = pending.get(e.taskId);
+        if (action && action.authority !== "inert" && ENACTED_BY[action.authority].includes(e.event))
+            pending.delete(e.taskId);
+    }
+    return pending;
+}
+function approvalAction(taskId, e) {
+    const { release, gate } = e.data;
+    const base = { taskId, ts: e.ts };
+    if (release === undefined)
+        return { ...base, authority: "worker", release: "plain" };
+    if (release === ATTEMPT_CAP_RELEASE || release === REVIEW_UPHELD_RELEASE || release === "scope-request") {
+        return { ...base, authority: "worker", release };
+    }
+    if (release === RECHECK_RELEASE)
+        return { ...base, authority: "battery", release };
+    if (release === GATE_SATISFIED_RELEASE && typeof gate === "string" && GATE_NAMES.includes(gate)) {
+        return { ...base, authority: "waiver", release, gate: gate };
+    }
+    return { ...base, authority: "inert", release };
+}
 // Both retry decisions below govern exactly ONE dispatch: the next one. So both are read back from the
 // journal at the moment that dispatch is built, never carried in a process variable — a stop between
 // the decision and the dispatch (OBS-254's shape, one layer up) would otherwise send a normal prompt
@@ -687,6 +730,83 @@ export function journaledFailureBrief(events, taskId) {
     }
     return rows;
 }
+/** Never infer a cross-path alias from a symbol, sentence, or hash. */
+export function reviewFingerprintMatches(candidate, fingerprint) {
+    return typeof candidate === "string"
+        && candidate.replace(/^\s*fingerprint\s*:\s*/i, "").replace(/\s+/g, "") === fingerprint.replace(/\s+/g, "");
+}
+export function observedReviewFingerprints(finding) {
+    const observed = Array.isArray(finding.observedFingerprints)
+        ? finding.observedFingerprints.filter((id) => typeof id === "string") : [];
+    return [...new Set([finding.fingerprint, ...observed])];
+}
+const reviewNoteIdentity = (note) => note.replace(LINE_REF_RE, "").replace(/\s+/g, " ").trim();
+function distinctReviewFinding(row) {
+    const identity = JSON.stringify([reviewNoteIdentity(row.note), row.codeIdentity ?? null]);
+    const symbol = `${row.symbol}#${createHash("sha256").update(identity).digest("hex").slice(0, 12)}`;
+    return { ...row, symbol, fingerprint: `${row.class}|${row.path}|${symbol}` };
+}
+/** Re-seat only an unambiguous, positively linked chain; retain the newest evidence path. */
+export function carryReviewFindings(priors, rows) {
+    const open = [...priors];
+    for (const row of rows) {
+        const identity = row.codeIdentity;
+        const matches = open.filter((prior) => {
+            if (prior.class !== row.class)
+                return false;
+            if (row.reraisedFrom)
+                return rows.filter((other) => other.reraisedFrom === row.reraisedFrom).length === 1
+                    && observedReviewFingerprints(prior).includes(row.reraisedFrom);
+            if (identity?.definition && identity.defect && prior.codeIdentity) {
+                return prior.codeIdentity.definition === identity.definition && prior.codeIdentity.defect === identity.defect;
+            }
+            return prior.fingerprint === row.fingerprint && reviewNoteIdentity(prior.note) === reviewNoteIdentity(row.note);
+        });
+        if (matches.length === 1) {
+            const prior = matches[0];
+            // Positive lineage does not grant this chain another open defect's display spelling.
+            let newest = row;
+            while (open.some((other) => other !== prior && observedReviewFingerprints(other).includes(newest.fingerprint))) {
+                newest = distinctReviewFinding(newest);
+            }
+            const observed = [...new Set([...observedReviewFingerprints(prior), ...observedReviewFingerprints(newest)])];
+            open[open.indexOf(prior)] = {
+                ...newest,
+                ...(prior.codeIdentity && !newest.codeIdentity ? { codeIdentity: prior.codeIdentity } : {}),
+                ...(observed.length > 1 ? { observedFingerprints: observed } : {}),
+            };
+        }
+        else {
+            // Two defects may name the same definition. Preserve both, with a copyable full triple.
+            // Deferrals intentionally replace their rationale without changing their note.
+            const collision = open.some((prior) => observedReviewFingerprints(prior).includes(row.fingerprint));
+            if (collision) {
+                let distinct = distinctReviewFinding(row);
+                // A generated spelling may itself belong to a chain that has since moved away.
+                // Reuse only a matching row; otherwise keep minting until the spelling is unowned.
+                while (true) {
+                    const owners = open.filter((prior) => observedReviewFingerprints(prior).includes(distinct.fingerprint));
+                    if (owners.length === 0) {
+                        open.push(distinct);
+                        break;
+                    }
+                    if (owners.length === 1 && reviewNoteIdentity(owners[0].note) === reviewNoteIdentity(row.note)) {
+                        const prior = owners[0];
+                        open[open.indexOf(prior)] = {
+                            ...prior, ...distinct,
+                            observedFingerprints: [...new Set([...observedReviewFingerprints(prior), ...observedReviewFingerprints(distinct)])],
+                        };
+                        break;
+                    }
+                    distinct = distinctReviewFinding(distinct);
+                }
+            }
+            else
+                open.push(row);
+        }
+    }
+    return open;
+}
 /**
  * T6: the review findings still OUTSTANDING on a task. A review finding is a property of the TASK,
  * not of the attempt that drew it: it stays outstanding until a later review PASSES on the task (or
@@ -708,7 +828,8 @@ export function journaledFailureBrief(events, taskId) {
  * other gate settled that gate, not this one. Reading "approved" as "settled" is how a still-open
  * finding was dropped at the exact moment the operator paid for another attempt to fix it. A review
  * that DECLINED (`skipped`) is not a verdict and neither adds nor retires — fail closed. Findings are
- * keyed by fingerprint, so a reviewer restating one across rounds carries it once, not once per round.
+ * linked by validated lineage across paths; observed spellings remain a closed list. Repeating the
+ * same row carries it once, while distinct defects sharing a symbol retain separate fingerprints.
  *
  * v2.1.5 T2: a passing review settles the findings it BLOCKED on. It does not settle the ones it
  * DEFERRED — those it saw, declined to block on, and recorded a rationale for, and nothing has fixed
@@ -724,34 +845,44 @@ export function journaledFailureBrief(events, taskId) {
  * row. N rounds of the same concern therefore carry the newest accepted explanation once, not N rows.
  */
 export function outstandingReviewFindings(events, taskId) {
-    const open = new Map();
+    let open = [];
     for (const e of events) {
         if (e.taskId !== taskId)
             continue;
         if (e.event === "task-approved") {
             if (e.data.release === GATE_SATISFIED_RELEASE && e.data.gate === "review")
-                open.clear();
+                open = [];
             continue;
         }
         if (e.event !== "gate-result" || e.data.gate !== "review" || e.data.skipped === true)
             continue;
+        // Rejected or missing verdicts carry diagnostics, not accepted findings or closures.
+        if (e.data.unparseable === true || e.data.noVerdict === true || e.data.cause !== undefined)
+            continue;
+        // A failed review can resolve one chain while re-raising another. Only observed, uniquely
+        // matched spellings retire a chain; skipped/no-verdict rows were excluded above.
+        if (Array.isArray(e.data.resolved)) {
+            const resolved = e.data.resolved;
+            const settled = new Set(resolved.flatMap((id) => {
+                const matches = open.filter((finding) => finding.class === "review:material"
+                    && observedReviewFingerprints(finding).some((fp) => reviewFingerprintMatches(id, fp)));
+                return matches.length === 1 ? matches : [];
+            }));
+            open = open.filter((finding) => !settled.has(finding));
+        }
         if (e.data.pass !== false) {
             // a later review PASSED on this task: every finding it BLOCKED on is settled …
-            for (const [key, finding] of open)
-                if (!isDeferredFinding(finding))
-                    open.delete(key);
+            open = open.filter(isDeferredFinding);
             // … and no deferral is, whether or not this pass restated it. A pass is silent about a
             // deferral it does not mention: the concern is unfixed either way, and the reviewer that
             // waved it through is not the release that accepts it. Retiring on omission would drop it on
             // the very next round — the same silent drop by a different door.
-            for (const finding of findingRows(e, "review").filter(isDeferredFinding))
-                open.set(finding.fingerprint, finding);
+            open = carryReviewFindings(open, findingRows(e, "review").filter(isDeferredFinding));
         }
         else
-            for (const finding of findingRows(e, "review"))
-                open.set(finding.fingerprint, finding);
+            open = carryReviewFindings(open, findingRows(e, "review"));
     }
-    return [...open.values()];
+    return open;
 }
 /** The findings a funded repair must carry into the next dispatch, or undefined if none is pending. */
 export function pendingRepairFindings(events, taskId) {

package/dist/run/merge.d.ts

@@ -1,6 +1,15 @@
 import type { TickmarkrConfig } from "../config/config.js";
-import { type Baseline, type FailureClassification } from "../gates/baseline.js";
+import { type Baseline, type GateEvidenceOptions, type FailureClassification } from "../gates/baseline.js";
+import type { GateEvidenceReceipt } from "./protocol.js";
 export interface TipVerifyResult {
+    evidenceReceipt?: GateEvidenceReceipt;
+    evidenceReceipts?: GateEvidenceReceipt[];
+    evidenceAbsence?: "provenance-refused" | "not-started" | "historical-cache";
+    /** Absolute directory against which the original receipt artifact paths resolve. */
+    originRunRoot?: string;
+    nonce?: string;
+    stdoutPath?: string;
+    stderrPath?: string;
     gate: string;
     cmd: string;
     pass: boolean;
@@ -12,12 +21,16 @@ export interface TipVerifyResult {
     spawnedCommand?: string;
     /** Q121s: nonzero exit whose failures are ALL baseline-recorded — forgiven exactly as the battery forgives. */
     forgiven?: boolean;
+    /** D-131: carried from a persisted per-gate verdict — this cycle did NOT execute the command. */
+    reused?: true;
     /**
      * OBS-534: what a nonzero exit is evidence OF, taken from the battery's own readers — `ceilingKillResult`
      * for a kill, the shared runner classifier for everything else. `infra` means nothing was verified.
      */
     cause?: FailureClassification;
 }
+/** Carry execution evidence without minting an invocation or rebasing its artifact paths. */
+export declare function reusedTipEvidence(source: Partial<TipVerifyResult>): Partial<TipVerifyResult>;
 export declare function integrationBranch(cfg: TickmarkrConfig, runId: string): string;
 export declare function ensureIntegration(repo: string, branch: string, baseRef: string): Promise<string>;
 export declare function integrationHead(intWt: string): Promise<string>;
@@ -29,4 +42,4 @@ export declare function mergeTask(intWt: string, taskBranch: string, message: st
         branchTip: string;
     };
 }>;
-export declare function verifyIntegrationTip(intWt: string, commands: Record<string, string>, runDir: string, baseline?: Baseline): Promise<TipVerifyResult[]>;
+export declare function verifyIntegrationTip(intWt: string, commands: Record<string, string>, runDir: string, baseline?: Baseline, evidenceOptions?: GateEvidenceOptions): Promise<TipVerifyResult[]>;

package/dist/run/merge.js

@@ -1,11 +1,34 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { shq } from "../adapters/types.js";
-import { ceilingKillResult, classifyFreshRunnerOutput, classifyRunnerOutput, fileCountDeficit, waitForCalmWindow, effectiveCeilingMs, fingerprint, freshFailures, } from "../gates/baseline.js";
+import { beginGateEvidence, ceilingKillResult, classifyFreshRunnerOutput, classifyRunnerOutput, fileCountDeficit, waitForCalmWindow, effectiveCeilingMs, fingerprint, freshFailures, } from "../gates/baseline.js";
 import { evaluateManifestedTest, isVitestTestCommand } from "../gates/test-manifest.js";
 import { computeVerificationIdentity, formatReusedDetails, getVerdictStore, getWorktreeTree, resolveStateDir, isInfraResult, } from "../gates/cache.js";
 import { tickmarkrDir } from "../graph/graph.js";
 import { describeCapacity, gitHead, linkNodeModules, resolveIntegrationBranch, resolvedCapacity, sameCapacity, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
+import { executionSignal } from "./execution-budget.js";
+// Diagnostic convenience logs are observational, just like receipt persistence.
+function writeTipLog(path, text) {
+    try {
+        writeFileSync(path, text);
+    }
+    catch { /* the command verdict remains authoritative */ }
+}
+/** Carry execution evidence without minting an invocation or rebasing its artifact paths. */
+export function reusedTipEvidence(source) {
+    return {
+        reused: true,
+        ...(source.evidenceReceipt ? { evidenceReceipt: source.evidenceReceipt } : {}),
+        ...(source.evidenceReceipts ? { evidenceReceipts: source.evidenceReceipts } : {}),
+        ...(source.originRunRoot ? { originRunRoot: source.originRunRoot } : {}),
+        ...(!source.evidenceReceipt
+            ? { evidenceAbsence: source.evidenceAbsence ?? "historical-cache" }
+            : source.evidenceAbsence ? { evidenceAbsence: source.evidenceAbsence } : {}),
+        ...(source.nonce !== undefined ? { nonce: source.nonce } : {}),
+        ...(source.stdoutPath !== undefined ? { stdoutPath: source.stdoutPath } : {}),
+        ...(source.stderrPath !== undefined ? { stderrPath: source.stderrPath } : {}),
+    };
+}
 export function integrationBranch(cfg, runId) {
     return `${cfg.integrationBranchPrefix}${runId}`;
 }
@@ -52,7 +75,7 @@ export async function mergeTask(intWt, taskBranch, message, gatedCommit) {
 // terminus unreachable by construction and misattributed the red to the last merged task.
 // Fail-closed edges kept: no baseline → strict; baseline green for that gate → strict; any fresh
 // fingerprint, or output with no recognizable failure shape, → failed.
-export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
+export async function verifyIntegrationTip(intWt, commands, runDir, baseline, evidenceOptions = {}) {
     const results = [];
     let runStartCommands;
     let journalFound = false;
@@ -109,7 +132,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
         for (const [gate, cmd] of gatesToRun) {
             const artifact = join(runDir, `tip-verify-${gate}.log`);
             const details = `tip verify could not establish command provenance: run-start evidence missing or malformed in journal`;
-            writeFileSync(artifact, details + "\n");
+            writeTipLog(artifact, details + "\n");
             results.push({
                 gate,
                 cmd,
@@ -117,6 +140,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
                 exitCode: 1,
                 fingerprints: [],
                 details,
+                evidenceAbsence: "provenance-refused",
                 artifact,
             });
         }
@@ -135,7 +159,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
             if (expectedCmd === undefined || cmd !== expectedCmd) {
                 const artifact = join(runDir, `tip-verify-${gate}.log`);
                 const details = `tip verify command "${cmd}" for gate "${gate}" was not named in run-start row`;
-                writeFileSync(artifact, details + "\n");
+                writeTipLog(artifact, details + "\n");
                 results.push({
                     gate,
                     cmd,
@@ -143,6 +167,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
                     exitCode: 1,
                     fingerprints: [],
                     details,
+                    evidenceAbsence: "provenance-refused",
                     artifact,
                 });
                 continue;
@@ -184,6 +209,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
                 gate,
                 cmd,
                 pass: hit.pass,
+                ...reusedTipEvidence(hit.meta ?? {}),
                 exitCode: hit.exitCode ?? 0,
                 fingerprints: hit.meta?.fingerprints ?? [],
                 ...(hit.meta?.forgiven ? { forgiven: true } : {}),
@@ -206,14 +232,21 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
                 longestFile: entry?.longestFile,
                 overallCeilingMs: effectiveCeilingMs(entry),
                 artifactDir: runDir,
+                evidence: { artifactDir: runDir, runId: runDir, ...evidenceOptions },
             });
             const artifact = join(runDir, `tip-verify-${gate}.log`);
             if (!outcome.pass)
-                writeFileSync(artifact, outcome.details);
+                writeTipLog(artifact, outcome.details);
             results.push({
                 gate,
                 cmd,
                 pass: outcome.pass,
+                evidenceReceipt: outcome.evidenceReceipt,
+                evidenceReceipts: outcome.evidenceReceipts,
+                ...(!outcome.evidenceReceipt ? { evidenceAbsence: "not-started" } : {}),
+                nonce: outcome.meta.nonce,
+                stdoutPath: outcome.meta.stdoutPath,
+                stderrPath: outcome.meta.stderrPath,
                 exitCode: outcome.exitCode,
                 reportPath: outcome.reportPath,
                 spawnedCommand: outcome.meta.spawnedCommand,
@@ -229,18 +262,41 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
         // `sh` defaults to. A suite whose capture measured 600007ms carries a recorded 1800021ms ceiling;
         // running it under 600000ms here SIGKILLed a green tip three times while every per-task gate passed.
         const ceilingMs = effectiveCeilingMs(entry);
-        let r = await sh(cmd, intWt, ceilingMs);
+        const evidenceReceipts = [];
+        const execute = async () => {
+            const evidence = beginGateEvidence(intWt, gate, cmd, { artifactDir: runDir, runId: runDir, ...evidenceOptions });
+            try {
+                const result = await sh(cmd, intWt, ceilingMs, { env: evidenceOptions.env, onReceipt: receipt => evidence.observe(receipt) });
+                evidenceReceipts.push(...evidence.history, evidence.finish(result.stdout, result.stderr));
+                return result;
+            }
+            catch (error) {
+                const receipt = evidence.finish();
+                if (receipt.termination.kind !== "not-started" || executionSignal()?.aborted)
+                    throw error;
+                evidenceReceipts.push(...evidence.history, receipt);
+                return { code: -1, stdout: "", stderr: String(error) };
+            }
+        };
+        let r = await execute();
         let raw = r.stdout + "\n" + r.stderr;
         let stripped = raw.split(intWt).join("");
         let rerun;
-        if (gate === "test" && !r.timedOut && !fileCountDeficit(entry, stripped)
+        if (evidenceReceipts.at(-1)?.termination.kind !== "not-started" && gate === "test" && !r.timedOut && !fileCountDeficit(entry, stripped)
             && classifyFreshRunnerOutput(entry, stripped, r.code) === "infra") {
             const waitedMs = await waitForCalmWindow();
             rerun = `runner-infra rerun after waiting ${waitedMs}ms for a calm load window`;
-            r = await sh(cmd, intWt, ceilingMs);
+            r = await execute();
             raw = r.stdout + "\n" + r.stderr;
             stripped = raw.split(intWt).join("");
         }
+        const evidenceReceipt = evidenceReceipts.at(-1);
+        if (evidenceReceipt.termination.kind === "not-started") {
+            results.push({ gate, cmd, pass: false, exitCode: r.code, fingerprints: [],
+                details: `infra; command failed to launch: ${r.stderr}`, cause: "infra",
+                evidenceReceipt, evidenceReceipts, evidenceAbsence: "not-started" });
+            continue;
+        }
         const artifact = join(runDir, `tip-verify-${gate}.log`);
         // Battery parity on the ceiling too (baseline.ts Q24): the kill is read BEFORE the exit code is
         // interpreted at all. A SIGKILLed battery never returned a verdict, so no line of its partial
@@ -248,11 +304,12 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
         // operator cannot act on. The kill reader's own text (ceiling + elapsed) and cause replace it.
         const killed = ceilingKillResult(gate, r, ceilingMs);
         if (killed) {
-            writeFileSync(artifact, raw);
+            writeTipLog(artifact, raw);
             results.push({
                 gate,
                 cmd,
                 pass: false,
+                evidenceReceipt, evidenceReceipts,
                 exitCode: r.code,
                 fingerprints: [],
                 details: `${rerun ? `infra; ${rerun}: ` : ""}${killed.details}`,
@@ -289,11 +346,12 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
             && comparable;
         const pass = !deficit && (r.code === 0 || greenTeardown || forgiven);
         if (!pass)
-            writeFileSync(artifact, raw);
+            writeTipLog(artifact, raw);
         const tipResult = {
             gate,
             cmd,
             pass,
+            evidenceReceipt, evidenceReceipts,
             exitCode: r.code,
             fingerprints: r.code !== 0 && !greenTeardown ? fingerprint(stripped) : [],
             details: `${cause === "infra" ? "infra; " : ""}${rerun ? `${rerun}: ` : ""}` + (deficit?.replace(/^infra; /, "") ?? (r.code === 0 ? "exit 0"
@@ -314,12 +372,17 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
     // spawns in the daemon child, and a command that changed the tree invalidates reuse.
     const completedTree = pending.size ? await getWorktreeTree(intWt) : undefined;
     for (const result of results) {
+        if (!result.reused && result.evidenceReceipt)
+            result.originRunRoot = resolve(evidenceOptions.artifactDir ?? runDir);
         const id = pending.get(result.gate);
         if (id && id.tree === completedTree && !isInfraResult(result)) {
             store.set(id, { ...result, meta: {
                     fingerprints: result.fingerprints, forgiven: result.forgiven,
                     reportPath: result.reportPath, spawnedCommand: result.spawnedCommand,
                     artifact: result.artifact,
+                    evidenceReceipt: result.evidenceReceipt, evidenceReceipts: result.evidenceReceipts,
+                    evidenceAbsence: result.evidenceAbsence, originRunRoot: result.originRunRoot,
+                    nonce: result.nonce, stdoutPath: result.stdoutPath, stderrPath: result.stderrPath,
                 } });
         }
     }

package/dist/run/protocol.d.ts

@@ -37,6 +37,88 @@ export declare const ShellReceiptSchema: z.ZodObject<{
     durationMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 export type ShellReceipt = z.infer<typeof ShellReceiptSchema>;
+export declare const EVIDENCE_AVAILABILITIES: readonly ["available", "not-started", "capture-failed", "killed", "expired", "missing"];
+export declare const EvidenceArtifactSchema: z.ZodObject<{
+    path: z.ZodString;
+    availability: z.ZodEnum<{
+        available: "available";
+        "not-started": "not-started";
+        "capture-failed": "capture-failed";
+        killed: "killed";
+        expired: "expired";
+        missing: "missing";
+    }>;
+    sha256: z.ZodNullable<z.ZodString>;
+    retainedBytes: z.ZodNumber;
+    droppedBytes: z.ZodNumber;
+    truncated: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const GateEvidenceReceiptSchema: z.ZodObject<{
+    invocationId: z.ZodString;
+    nonce: z.ZodOptional<z.ZodString>;
+    subject: z.ZodObject<{
+        runId: z.ZodString;
+        taskId: z.ZodNullable<z.ZodString>;
+        attempt: z.ZodNullable<z.ZodNumber>;
+        gate: z.ZodString;
+        subjectCommit: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    termination: z.ZodObject<{
+        kind: z.ZodEnum<{
+            unknown: "unknown";
+            signal: "signal";
+            "not-started": "not-started";
+            exit: "exit";
+            timeout: "timeout";
+        }>;
+        exitCode: z.ZodNullable<z.ZodNumber>;
+        signal: z.ZodNullable<z.ZodString>;
+        timedOut: z.ZodNullable<z.ZodBoolean>;
+    }, z.core.$strict>;
+    availability: z.ZodEnum<{
+        available: "available";
+        "not-started": "not-started";
+        "capture-failed": "capture-failed";
+        killed: "killed";
+        expired: "expired";
+        missing: "missing";
+    }>;
+    redaction: z.ZodObject<{
+        material: z.ZodBoolean;
+    }, z.core.$strict>;
+    stdout: z.ZodObject<{
+        path: z.ZodString;
+        availability: z.ZodEnum<{
+            available: "available";
+            "not-started": "not-started";
+            "capture-failed": "capture-failed";
+            killed: "killed";
+            expired: "expired";
+            missing: "missing";
+        }>;
+        sha256: z.ZodNullable<z.ZodString>;
+        retainedBytes: z.ZodNumber;
+        droppedBytes: z.ZodNumber;
+        truncated: z.ZodBoolean;
+    }, z.core.$strict>;
+    stderr: z.ZodObject<{
+        path: z.ZodString;
+        availability: z.ZodEnum<{
+            available: "available";
+            "not-started": "not-started";
+            "capture-failed": "capture-failed";
+            killed: "killed";
+            expired: "expired";
+            missing: "missing";
+        }>;
+        sha256: z.ZodNullable<z.ZodString>;
+        retainedBytes: z.ZodNumber;
+        droppedBytes: z.ZodNumber;
+        truncated: z.ZodBoolean;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type GateEvidenceReceipt = z.infer<typeof GateEvidenceReceiptSchema>;
+export type EvidenceArtifact = z.infer<typeof EvidenceArtifactSchema>;
 /** A task-build row must carry the entire caller-owned correlation, even before spawn. */
 export declare const CommandReceiptSchema: z.ZodObject<{
     outcome: z.ZodEnum<{