tickmarkr 2.5.8 → 2.5.9

package/dist/run/daemon.js

@@ -35,7 +35,7 @@ import { classifyRepairDisposition, resolveScopeHints } from "./repair-dispositi
 import { applyScopeAmendments, activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingApprovalActions, pendingRechecks, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
 import { isDiffCapPark, pickReviewer } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
-import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
+import { ensureIntegration, integrationBranch, integrationHead, mergeTask, reusedTipEvidence, verifyIntegrationTip } from "./merge.js";
 import { climbChannel, marginalCostRank, nextChannel, route } from "../route/router.js";
 import { desiredPanes } from "./reconcile.js";
 import { readTierLiveness, readWatchBoard, supervisionBeatPath } from "./supervision.js";
@@ -164,6 +164,27 @@ export function resolveRunMode(repoRoot, opts = {}) {
         : undefined;
     return { cfg: resolved.cfg, mode: resolved.mode, source, ...(conflict ? { conflict } : {}) };
 }
+// Bind approval context before dispatch consumes the release. Restore reconstructs the same
+// binding from journal order; a newer approval, including one without a reason, supersedes it.
+function approvalReviewContext(events, taskId, restore = false) {
+    let pending;
+    let bound;
+    let approved = false;
+    for (const row of events) {
+        if (row.taskId !== taskId)
+            continue;
+        if (row.event === "task-approved") {
+            pending = typeof row.data.reason === "string" ? row.data.reason.trim() || undefined : undefined;
+            approved = true;
+        }
+        else if (row.event === "task-dispatch" || (row.event === "recheck-battery" && approved)) {
+            bound = pending;
+            pending = undefined;
+            approved = false;
+        }
+    }
+    return restore && !approved ? bound : pending;
+}
 // T14: the events that prove an approval was ENACTED — narrowly causal, never merely subsequent.
 // Ordinary, attempt-cap and review-upheld approvals buy a WORKER, so their proof is a dispatch;
 // recheck has its own battery enactment below. Generic terminal events are deliberately NOT proof: an approved human-gate
@@ -664,7 +685,7 @@ function lastVerifyCycle(events) {
         if (e.event === "tip-verify-start") {
             const { tip, cmdHash } = e.data;
             cur = typeof tip === "string" && typeof cmdHash === "string"
-                ? { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [e.data.capacity] }
+                ? { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [e.data.capacity], evidenceByGate: new Map() }
                 : undefined;
             afterRunEnd = false;
             continue;
@@ -687,7 +708,7 @@ function lastVerifyCycle(events) {
             continue;
         }
         if (!cur || afterRunEnd || cur.tip !== tip || cur.cmdHash !== cmdHash) {
-            cur = { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [] };
+            cur = { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [], evidenceByGate: new Map() };
         }
         afterRunEnd = false;
         // T7: EVERY verdict row's own capacity, not just the start row's. The start row is a statement of
@@ -699,6 +720,7 @@ function lastVerifyCycle(events) {
             cur.failed = true;
         else {
             cur.gates.add(gate);
+            cur.evidenceByGate.set(gate, e.data);
             // Q121s review M1: a forgiven green depends on the baseline that forgave it. Baselines are not
             // part of the cache key, so a forgiven cycle is NEVER cache-eligible — an unchanged tip whose
             // baseline later vanishes or changes must re-run the full verify, not inherit the green.
@@ -909,7 +931,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
         // pass — `cached: true` keeps it honest about not having re-run the command.
         for (const gate of gates) {
             const cmd = gate === "test" && commands.tipTest ? commands.tipTest : commands[gate];
-            journal.append("tip-verify", undefined, { gate, cmd, pass: true, exitCode: 0, cached: true, tip, cmdHash, capacity });
+            journal.append("tip-verify", undefined, { ...reusedTipEvidence(last.evidenceByGate.get(gate) ?? {}), gate, cmd, pass: true, exitCode: 0, cached: true, tip, cmdHash, capacity });
         }
         return false;
     }
@@ -918,12 +940,22 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
         ? cancellableTipBattery(intWt, commands, journal.dir, opts.baseline, opts.signal)
         : verifyIntegrationTip(intWt, commands, journal.dir, opts.baseline))) {
         const measuredCapacity = r.capacity ?? capacity;
+        const evidence = r.reused ? reusedTipEvidence(r) : {
+            ...(r.originRunRoot ? { originRunRoot: r.originRunRoot } : {}),
+            ...(r.cause ? { cause: r.cause } : {}),
+            ...(r.evidenceReceipt ? { evidenceReceipt: r.evidenceReceipt } : {}),
+            ...(r.evidenceReceipts ? { evidenceReceipts: r.evidenceReceipts } : {}),
+            ...(r.evidenceAbsence ? { evidenceAbsence: r.evidenceAbsence } : {}),
+            ...Object.fromEntries(["nonce", "stdoutPath", "stderrPath"]
+                .filter(key => r[key] !== undefined).map(key => [key, r[key]])),
+        };
         if (r.pass) {
             // Q121s: a forgiven pass journals its fingerprints — honest about what was carried, never a silent green.
-            journal.append("tip-verify", undefined, { gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.reused ? { cached: true } : {}), ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash, capacity: measuredCapacity });
+            journal.append("tip-verify", undefined, { ...evidence, gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.reused ? { cached: true } : {}), ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash, capacity: measuredCapacity });
         }
         else {
             journal.append("tip-verify-failed", undefined, {
+                ...evidence,
                 gate: r.gate,
                 cmd: r.cmd,
                 exitCode: r.exitCode,
@@ -2550,6 +2582,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // run; a park-instead policy can come later if it ever bites.
                     }
                     const taskHistory = journal.read().filter((e) => e.taskId === t.id);
+                    // Lifetime identity counts every dispatch, including legacy and unchargeable rows. Releases
+                    // reset the budget below, never this counter; observational annotations do not consume it.
+                    let nextWorkerDispatchOrdinal = taskHistory.filter((e) => e.event === "task-dispatch").length;
                     const lastApproval = taskHistory.map((e) => e.event).lastIndexOf("task-approved");
                     const priorClimb = taskHistory.slice(lastApproval + 1).reverse().find((e) => e.event === "tier-escalated");
                     if (!hintsChanged && priorClimb && taskHistory.indexOf(priorClimb) > taskHistory.map((e) => e.event).lastIndexOf("task-dispatch")) {
@@ -2566,7 +2601,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // exclusion-list-equality oracle. Daemon-side append only — no journal.ts write-path change (Phase 48
                     // stays unblocked); inert to replayStatuses (unknown events ignored, pinned at journal.test.ts:70-80).
                     if (rs)
-                        journal.append("resume-restore", t.id, { attempts: rs.attempts, tried: [...tried], assignment });
+                        journal.append("resume-restore", t.id, {
+                            attempts: rs.attempts, tried: [...tried], assignment,
+                            workerDispatchOrdinal: previousDispatch?.data.workerDispatchOrdinal ?? null,
+                        });
                     // Keep one live list: recovery retries must see exclusions added by onGate during the round.
                     const badReviewers = [...replayedReviewerExclusions];
                     const noteReviewEvent = (e) => {
@@ -2733,6 +2771,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // every recalibration this telemetry funds, a gap is honest and a zero is a lie. The
                             // seven-gate closed set is asserted end-to-end in tests/run/gate-telemetry.test.ts.
                             ...gateMeasurement(g.meta),
+                            // Fresh producer evidence is copied verbatim; absent/historical evidence is never minted here.
+                            ...(g.meta?.reused ? {} : {
+                                ...(g.evidenceReceipt ? { evidenceReceipt: g.evidenceReceipt } : {}),
+                                ...(g.evidenceReceipts ? { evidenceReceipts: g.evidenceReceipts } : {}),
+                                ...Object.fromEntries(["nonce", "stdoutPath", "stderrPath", "classification"]
+                                    .filter(key => g.meta?.[key] !== undefined).map(key => [key, g.meta[key]])),
+                            }),
                             // T7: the capacity the gate's own command child ran under, lifted verbatim from the result
                             // the battery produced — read where the shell built that child's environment, never
                             // re-derived from the run's own budget, which would answer a different number than the
@@ -3066,6 +3111,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 continue;
                             priorResults.set(e.data.gate, e);
                         }
+                        const declaredGates = GATE_NAMES.filter((gate) => t.gates.includes(gate));
+                        const reused = [];
                         let remainingGates;
                         if (recheck) {
                             remainingGates = GATE_NAMES.filter((gate) => t.gates.includes(gate));
@@ -3119,48 +3166,40 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 });
                             }
                             let reusable = sameWorld && sameProtocol && (exactCurrentCommit || canonicalCurrentCommit || recreatedLegacyCommit);
-                            const reused = [];
-                            const declaredGates = GATE_NAMES.filter((gate) => t.gates.includes(gate));
                             for (const gate of declaredGates) {
                                 if (!reusable || replayedGates.results.get(gate) !== true)
                                     reusable = false;
                                 else
                                     reused.push(gate);
                             }
-                            // OBS-1049: build outputs are not commits. A replayed build verdict says the tree WAS green;
-                            // it says nothing about whether the RECREATED checkout holds what that build produced (dist),
-                            // and the host's npm lifecycle (ignore-scripts) may never rebuild it before the suite runs.
-                            // So a replayed build re-runs its own command here as provisioning, journaled by name; a red
-                            // provisioning is not reused — build (and everything behind it) re-enters the battery as a gate.
-                            // Every resume on this path recreates the checkout (recreateTaskWorktree above), so "reused
-                            // build" is exactly "build replayed onto a recreated tree".
-                            // Journal order is the criterion's order: a GREEN provisioning is recorded AFTER the reuse
-                            // rows it belongs to (gate-reused build, then gate-provisioned build); a RED provisioning is
-                            // recorded alone, and no reuse row follows it.
-                            let provisionedRow;
-                            if (reused.includes("build") && commands.build !== undefined) {
-                                // Provisioning is a verification command like any gate: it waits for the run's baseline and
-                                // takes the command lease (suite admission), never a bare shell beside sibling gates.
-                                await waitForBaseline(t.id);
-                                const startedAt = Date.now();
-                                const provisioned = await withCommandContext(t.id, () => sh(commands.build, wt));
-                                provisionedRow = {
-                                    gate: "build", commit: replayedGates.commit, exitCode: provisioned.code, durationMs: Date.now() - startedAt,
-                                };
-                                if (provisioned.code !== 0) {
-                                    reused.splice(reused.indexOf("build"));
-                                    journal.append("gate-provisioned", t.id, provisionedRow);
-                                    provisionedRow = undefined;
-                                }
-                            }
-                            for (const gate of reused) {
-                                journal.append("gate-reused", t.id, { gate, commit: replayedGates.commit });
-                            }
-                            if (provisionedRow !== undefined)
-                                journal.append("gate-provisioned", t.id, provisionedRow);
                             remainingGates = declaredGates.slice(reused.length);
                         }
+                        // OBS-1094/1049: every replay recreates the checkout, but build outputs are not commits.
+                        // Provision whenever build will not run as a gate, including an operator waiver restore.
+                        // Defer reuse rows until provisioning succeeds: green keeps reuse-then-provision order;
+                        // red records only provisioning and puts build and every declared successor back in gates,
+                        // unless build itself was waived: provisioning must not undo the operator's release.
+                        let provisionedRow;
+                        if (!remainingGates.includes("build") && commands.build !== undefined) {
+                            await waitForBaseline(t.id);
+                            const startedAt = Date.now();
+                            const provisioned = await withCommandContext(t.id, () => sh(commands.build, wt));
+                            provisionedRow = {
+                                gate: "build", commit: !satisfiedGate && !recheck ? replayedGates.commit : currentTaskSubject,
+                                exitCode: provisioned.code, durationMs: Date.now() - startedAt,
+                            };
+                            if (provisioned.code !== 0 && satisfiedGate !== "build") {
+                                reused.length = 0;
+                                remainingGates = ["build", ...declaredGates.filter((gate) => gate !== "build")];
+                            }
+                        }
+                        for (const gate of reused) {
+                            journal.append("gate-reused", t.id, { gate, commit: replayedGates.commit });
+                        }
+                        if (provisionedRow !== undefined)
+                            journal.append("gate-provisioned", t.id, provisionedRow);
                         const resumedTask = { ...t, gates: remainingGates };
+                        const operatorContext = approvalReviewContext(journal.read(), t.id, true);
                         gateLoop: while (true) {
                             fatalStop.signal.throwIfAborted();
                             executionSignal()?.throwIfAborted();
@@ -3178,6 +3217,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             journal.phaseStart(t.id, "gates");
                             const { results } = await withCommandContext(t.id, () => runReviewRecovery(resumedTask, {
                                 carriedFindings: outstandingReviewFindings(journal.read(), t.id),
+                                operatorContext,
                                 worktree: wt, baseRef: taskBase, result: priorResult, author: gateAuthor,
                                 commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
                                 collateral: collateral.get(t.id) ?? [],
@@ -3425,6 +3465,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // fresh re-dispatches. Read from the JOURNAL, before this dispatch's own event lands: a run that
                         // stopped between funding the repair and sending it resumes still carrying the findings.
                         const journaledSoFar = journal.read(); // read BEFORE this dispatch's own event lands
+                        const operatorContext = approvalReviewContext(journaledSoFar, t.id);
                         let repairFindings = pendingRepairFindings(journaledSoFar, t.id);
                         // OBS-254, one layer below the upheld brief: the ordinary gate-fail brief was loop-local, so any
                         // path that rebuilt this task's state (a resume, `--retry-failed`, a fresh daemon) dispatched a
@@ -3515,9 +3556,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // ledger cannot tell a carried dispatch from an amnesiac one — the exact question a run that
                         // spends two frontier attempts re-deriving a known defect has to be able to answer afterwards.
                         fatalStop.signal.throwIfAborted();
+                        const workerDispatchOrdinal = nextWorkerDispatchOrdinal++;
                         journal.append("task-dispatch", t.id, {
                             ...(scopeApproval?.data.release === "scope-request" ? { files: t.files, graphDefinitionHash: graphDefinitionHash(graph) } : {}),
-                            assignment, attempt, provenance: dispatchProvenance([
+                            assignment, attempt, workerDispatchOrdinal, provenance: dispatchProvenance([
                                 channelKey(assignment) === channelKey(r.assignment) ? r.provenance
                                     : t.routingHints?.pin ? `pin ${t.routingHints.pin.via}:${t.routingHints.pin.model} not re-tried` : "ladder assignment",
                                 `dispatch ${channelKey(assignment)}`, climbProvenance,
@@ -3624,7 +3666,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // anything the live brief holds beyond the journaled findings (a consult's guidance) is kept:
                             // a repair adds the diff and the fix-only contract, it never subtracts what was already known.
                             feedback = feedback && !brief.includes(feedback) ? `${brief}\n\n${feedback}` : brief;
-                            journal.append("repair-dispatch", t.id, { diffBytes: Buffer.byteLength(diff, "utf8"), capped, ...(capped ? { droppedFiles } : {}) });
+                            journal.append("repair-dispatch", t.id, { workerDispatchOrdinal, diffBytes: Buffer.byteLength(diff, "utf8"), capped, ...(capped ? { droppedFiles } : {}) });
                         }
                         if (feedback || priorNamed.length > 0) {
                             feedback = augmentRetryBrief(feedback, { attempted: commitsToCarry, carried: carriedCommits, present: presentCommits });
@@ -5093,6 +5135,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             else {
                                 ({ results, commits } = await withCommandContext(t.id, () => runReviewRecovery(t, {
                                     carriedFindings: outstandingFindings,
+                                    operatorContext,
                                     worktree: wt, baseRef: taskBase, result, author: assignment,
                                     commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
                                     collateral: collateral.get(t.id) ?? [],

package/dist/run/journal.d.ts

@@ -43,6 +43,15 @@ export interface StructuredFinding {
     note: string;
     rationale?: string;
     fingerprint: string;
+    /** Closed list of spellings actually observed on this chain, including the current one. */
+    observedFingerprints?: string[];
+    /** Prior id validated against the reviewer's reraised list by the review gate. */
+    reraisedFrom?: string;
+    /** Resolved definition AND defect identity; bare symbol spelling is never lineage. */
+    codeIdentity?: {
+        definition: string;
+        defect: string;
+    };
 }
 declare const CONSULT_ACTIONS: readonly ["retry", "reroute", "decompose", "human"];
 export type ConsultGuidanceAction = (typeof CONSULT_ACTIONS)[number];
@@ -187,6 +196,11 @@ export declare function pendingApprovalActions(events: JournalEvent[]): Map<stri
  * because every approval erased exactly the finding the fresh attempt was funded to fix.
  */
 export declare function journaledFailureBrief(events: JournalEvent[], taskId: string): string[];
+/** Never infer a cross-path alias from a symbol, sentence, or hash. */
+export declare function reviewFingerprintMatches(candidate: unknown, fingerprint: string): boolean;
+export declare function observedReviewFingerprints(finding: StructuredFinding): string[];
+/** Re-seat only an unambiguous, positively linked chain; retain the newest evidence path. */
+export declare function carryReviewFindings(priors: readonly StructuredFinding[], rows: readonly StructuredFinding[]): StructuredFinding[];
 /**
  * T6: the review findings still OUTSTANDING on a task. A review finding is a property of the TASK,
  * not of the attempt that drew it: it stays outstanding until a later review PASSES on the task (or
@@ -208,7 +222,8 @@ export declare function journaledFailureBrief(events: JournalEvent[], taskId: st
  * other gate settled that gate, not this one. Reading "approved" as "settled" is how a still-open
  * finding was dropped at the exact moment the operator paid for another attempt to fix it. A review
  * that DECLINED (`skipped`) is not a verdict and neither adds nor retires — fail closed. Findings are
- * keyed by fingerprint, so a reviewer restating one across rounds carries it once, not once per round.
+ * linked by validated lineage across paths; observed spellings remain a closed list. Repeating the
+ * same row carries it once, while distinct defects sharing a symbol retain separate fingerprints.
  *
  * v2.1.5 T2: a passing review settles the findings it BLOCKED on. It does not settle the ones it
  * DEFERRED — those it saw, declined to block on, and recorded a rationale for, and nothing has fixed
@@ -312,8 +327,8 @@ export declare const TelemetryRowSchema: z.ZodObject<{
     }>>;
     kind: z.ZodOptional<z.ZodLiteral<"judge">>;
     judgeOutcome: z.ZodOptional<z.ZodEnum<{
-        parseable: "parseable";
         unparseable: "unparseable";
+        parseable: "parseable";
     }>>;
 }, z.core.$strip>;
 export type TelemetryRow = z.infer<typeof TelemetryRowSchema>;

package/dist/run/journal.js

@@ -730,6 +730,83 @@ export function journaledFailureBrief(events, taskId) {
     }
     return rows;
 }
+/** Never infer a cross-path alias from a symbol, sentence, or hash. */
+export function reviewFingerprintMatches(candidate, fingerprint) {
+    return typeof candidate === "string"
+        && candidate.replace(/^\s*fingerprint\s*:\s*/i, "").replace(/\s+/g, "") === fingerprint.replace(/\s+/g, "");
+}
+export function observedReviewFingerprints(finding) {
+    const observed = Array.isArray(finding.observedFingerprints)
+        ? finding.observedFingerprints.filter((id) => typeof id === "string") : [];
+    return [...new Set([finding.fingerprint, ...observed])];
+}
+const reviewNoteIdentity = (note) => note.replace(LINE_REF_RE, "").replace(/\s+/g, " ").trim();
+function distinctReviewFinding(row) {
+    const identity = JSON.stringify([reviewNoteIdentity(row.note), row.codeIdentity ?? null]);
+    const symbol = `${row.symbol}#${createHash("sha256").update(identity).digest("hex").slice(0, 12)}`;
+    return { ...row, symbol, fingerprint: `${row.class}|${row.path}|${symbol}` };
+}
+/** Re-seat only an unambiguous, positively linked chain; retain the newest evidence path. */
+export function carryReviewFindings(priors, rows) {
+    const open = [...priors];
+    for (const row of rows) {
+        const identity = row.codeIdentity;
+        const matches = open.filter((prior) => {
+            if (prior.class !== row.class)
+                return false;
+            if (row.reraisedFrom)
+                return rows.filter((other) => other.reraisedFrom === row.reraisedFrom).length === 1
+                    && observedReviewFingerprints(prior).includes(row.reraisedFrom);
+            if (identity?.definition && identity.defect && prior.codeIdentity) {
+                return prior.codeIdentity.definition === identity.definition && prior.codeIdentity.defect === identity.defect;
+            }
+            return prior.fingerprint === row.fingerprint && reviewNoteIdentity(prior.note) === reviewNoteIdentity(row.note);
+        });
+        if (matches.length === 1) {
+            const prior = matches[0];
+            // Positive lineage does not grant this chain another open defect's display spelling.
+            let newest = row;
+            while (open.some((other) => other !== prior && observedReviewFingerprints(other).includes(newest.fingerprint))) {
+                newest = distinctReviewFinding(newest);
+            }
+            const observed = [...new Set([...observedReviewFingerprints(prior), ...observedReviewFingerprints(newest)])];
+            open[open.indexOf(prior)] = {
+                ...newest,
+                ...(prior.codeIdentity && !newest.codeIdentity ? { codeIdentity: prior.codeIdentity } : {}),
+                ...(observed.length > 1 ? { observedFingerprints: observed } : {}),
+            };
+        }
+        else {
+            // Two defects may name the same definition. Preserve both, with a copyable full triple.
+            // Deferrals intentionally replace their rationale without changing their note.
+            const collision = open.some((prior) => observedReviewFingerprints(prior).includes(row.fingerprint));
+            if (collision) {
+                let distinct = distinctReviewFinding(row);
+                // A generated spelling may itself belong to a chain that has since moved away.
+                // Reuse only a matching row; otherwise keep minting until the spelling is unowned.
+                while (true) {
+                    const owners = open.filter((prior) => observedReviewFingerprints(prior).includes(distinct.fingerprint));
+                    if (owners.length === 0) {
+                        open.push(distinct);
+                        break;
+                    }
+                    if (owners.length === 1 && reviewNoteIdentity(owners[0].note) === reviewNoteIdentity(row.note)) {
+                        const prior = owners[0];
+                        open[open.indexOf(prior)] = {
+                            ...prior, ...distinct,
+                            observedFingerprints: [...new Set([...observedReviewFingerprints(prior), ...observedReviewFingerprints(distinct)])],
+                        };
+                        break;
+                    }
+                    distinct = distinctReviewFinding(distinct);
+                }
+            }
+            else
+                open.push(row);
+        }
+    }
+    return open;
+}
 /**
  * T6: the review findings still OUTSTANDING on a task. A review finding is a property of the TASK,
  * not of the attempt that drew it: it stays outstanding until a later review PASSES on the task (or
@@ -751,7 +828,8 @@ export function journaledFailureBrief(events, taskId) {
  * other gate settled that gate, not this one. Reading "approved" as "settled" is how a still-open
  * finding was dropped at the exact moment the operator paid for another attempt to fix it. A review
  * that DECLINED (`skipped`) is not a verdict and neither adds nor retires — fail closed. Findings are
- * keyed by fingerprint, so a reviewer restating one across rounds carries it once, not once per round.
+ * linked by validated lineage across paths; observed spellings remain a closed list. Repeating the
+ * same row carries it once, while distinct defects sharing a symbol retain separate fingerprints.
  *
  * v2.1.5 T2: a passing review settles the findings it BLOCKED on. It does not settle the ones it
  * DEFERRED — those it saw, declined to block on, and recorded a rationale for, and nothing has fixed
@@ -767,34 +845,44 @@ export function journaledFailureBrief(events, taskId) {
  * row. N rounds of the same concern therefore carry the newest accepted explanation once, not N rows.
  */
 export function outstandingReviewFindings(events, taskId) {
-    const open = new Map();
+    let open = [];
     for (const e of events) {
         if (e.taskId !== taskId)
             continue;
         if (e.event === "task-approved") {
             if (e.data.release === GATE_SATISFIED_RELEASE && e.data.gate === "review")
-                open.clear();
+                open = [];
             continue;
         }
         if (e.event !== "gate-result" || e.data.gate !== "review" || e.data.skipped === true)
             continue;
+        // Rejected or missing verdicts carry diagnostics, not accepted findings or closures.
+        if (e.data.unparseable === true || e.data.noVerdict === true || e.data.cause !== undefined)
+            continue;
+        // A failed review can resolve one chain while re-raising another. Only observed, uniquely
+        // matched spellings retire a chain; skipped/no-verdict rows were excluded above.
+        if (Array.isArray(e.data.resolved)) {
+            const resolved = e.data.resolved;
+            const settled = new Set(resolved.flatMap((id) => {
+                const matches = open.filter((finding) => finding.class === "review:material"
+                    && observedReviewFingerprints(finding).some((fp) => reviewFingerprintMatches(id, fp)));
+                return matches.length === 1 ? matches : [];
+            }));
+            open = open.filter((finding) => !settled.has(finding));
+        }
         if (e.data.pass !== false) {
             // a later review PASSED on this task: every finding it BLOCKED on is settled …
-            for (const [key, finding] of open)
-                if (!isDeferredFinding(finding))
-                    open.delete(key);
+            open = open.filter(isDeferredFinding);
             // … and no deferral is, whether or not this pass restated it. A pass is silent about a
             // deferral it does not mention: the concern is unfixed either way, and the reviewer that
             // waved it through is not the release that accepts it. Retiring on omission would drop it on
             // the very next round — the same silent drop by a different door.
-            for (const finding of findingRows(e, "review").filter(isDeferredFinding))
-                open.set(finding.fingerprint, finding);
+            open = carryReviewFindings(open, findingRows(e, "review").filter(isDeferredFinding));
         }
         else
-            for (const finding of findingRows(e, "review"))
-                open.set(finding.fingerprint, finding);
+            open = carryReviewFindings(open, findingRows(e, "review"));
     }
-    return [...open.values()];
+    return open;
 }
 /** The findings a funded repair must carry into the next dispatch, or undefined if none is pending. */
 export function pendingRepairFindings(events, taskId) {

package/dist/run/merge.d.ts

@@ -1,6 +1,15 @@
 import type { TickmarkrConfig } from "../config/config.js";
-import { type Baseline, type FailureClassification } from "../gates/baseline.js";
+import { type Baseline, type GateEvidenceOptions, type FailureClassification } from "../gates/baseline.js";
+import type { GateEvidenceReceipt } from "./protocol.js";
 export interface TipVerifyResult {
+    evidenceReceipt?: GateEvidenceReceipt;
+    evidenceReceipts?: GateEvidenceReceipt[];
+    evidenceAbsence?: "provenance-refused" | "not-started" | "historical-cache";
+    /** Absolute directory against which the original receipt artifact paths resolve. */
+    originRunRoot?: string;
+    nonce?: string;
+    stdoutPath?: string;
+    stderrPath?: string;
     gate: string;
     cmd: string;
     pass: boolean;
@@ -20,6 +29,8 @@ export interface TipVerifyResult {
      */
     cause?: FailureClassification;
 }
+/** Carry execution evidence without minting an invocation or rebasing its artifact paths. */
+export declare function reusedTipEvidence(source: Partial<TipVerifyResult>): Partial<TipVerifyResult>;
 export declare function integrationBranch(cfg: TickmarkrConfig, runId: string): string;
 export declare function ensureIntegration(repo: string, branch: string, baseRef: string): Promise<string>;
 export declare function integrationHead(intWt: string): Promise<string>;
@@ -31,4 +42,4 @@ export declare function mergeTask(intWt: string, taskBranch: string, message: st
         branchTip: string;
     };
 }>;
-export declare function verifyIntegrationTip(intWt: string, commands: Record<string, string>, runDir: string, baseline?: Baseline): Promise<TipVerifyResult[]>;
+export declare function verifyIntegrationTip(intWt: string, commands: Record<string, string>, runDir: string, baseline?: Baseline, evidenceOptions?: GateEvidenceOptions): Promise<TipVerifyResult[]>;