tickmarkr 2.6.3 → 2.6.5

package/dist/cli/commands/verify.js

@@ -1,26 +1,30 @@
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, utimesSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { parseArgs } from "node:util";
-import { allAdapters, probeAll, readDoctor, rolePools } from "../../adapters/registry.js";
+import { allAdapters, probeAll, readDoctor, rolePools, writeDoctor } from "../../adapters/registry.js";
 import { channelKey } from "../../adapters/types.js";
 import { loadConfig } from "../../config/config.js";
 import { captureBaseline, detectGateCommands, staleFileCountCommands } from "../../gates/baseline.js";
+import { getVerdictStore, runnerInputsHash } from "../../gates/cache.js";
 import { modelProvider } from "../../gates/review.js";
 import { runGates } from "../../gates/run-gates.js";
 import { getTask, loadGraph } from "../../graph/graph.js";
 import { GATE_NAMES } from "../../graph/schema.js";
 import { executionSignal } from "../../run/execution-budget.js";
 import { linkNodeModules, removeWorktree, shGit, shGitOk } from "../../run/git.js";
-import { Journal } from "../../run/journal.js";
+import { foldOwedChecks, integrationMapped, owedCriteria, Journal, OWED_DISCHARGE_EVENT } from "../../run/journal.js";
 import { withRepositoryLease } from "../../run/lease.js";
+import { isPidLive } from "../../run/lock.js";
+import { recordLaunchServices } from "../../run/launchservices-check.js";
 /**
  * tickmarkr verify — the gate battery as a standalone command (OPERATING-MODEL-2026-08-11 item 3).
  *
- * Runs the existing seven-gate pipeline (build/test/lint against a captured base baseline, then
- * evidence, scope, acceptance ‖ review) against `merge-base(--base, HEAD)..HEAD` of the CURRENT
- * checkout. No daemon, no worktree lifecycle, no retries, no approvals, no resumable state: one
+ * Runs the existing seven-gate pipeline against `merge-base(--base, HEAD)..HEAD` of the CURRENT
+ * checkout in two phases: build/lint against a captured base baseline, evidence, scope, then
+ * acceptance ‖ review, all unleased; then, under the repository lease, the test suite against its
+ * own base baseline. No daemon, no worktree lifecycle, no retries, no approvals, no resumable state: one
  * invocation, one immutable candidate, one machine-readable verdict. A verifier failure costs one
  * rerun. Same fail-closed guarantees — this is a thin caller of runGates, not a second pipeline.
  */
@@ -83,7 +87,7 @@ const hashParts = (parts) => {
         hash.update(part);
     return hash.digest("hex").slice(0, 12);
 };
-/** Cache identity is repository content, never a checkout path. */
+/** Repository content plus the effective runner inputs the daemon hashes; never a checkout path. */
 export function baselineCachePath(cwd, baseSha, commands) {
     const lockParts = [];
     for (const file of LOCKFILES) {
@@ -91,7 +95,7 @@ export function baselineCachePath(cwd, baseSha, commands) {
         lockParts.push(file, existsSync(path) ? readFileSync(path) : "<absent>");
     }
     const commandParts = Object.entries(commands).sort(([a], [b]) => a.localeCompare(b)).map(([name, command]) => `${name}\0${command}\0`);
-    return join(realpathSync(tmpdir()), "tickmarkr-verify", "cache", `baseline-${baseSha.slice(0, 12)}-${hashParts(lockParts)}-${hashParts(commandParts)}.json`);
+    return join(realpathSync(tmpdir()), "tickmarkr-verify", "cache", `baseline-${baseSha.slice(0, 12)}-${hashParts(lockParts)}-${hashParts(commandParts)}-${runnerInputsHash()}.json`);
 }
 const verdictlessCommands = (baseline, commands) => Object.keys(commands).filter((name) => baseline.commands[name]?.exitCode === undefined);
 export function excludeAuthorProvider(channels, author) {
@@ -157,6 +161,16 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
     }
     const cfg = loadConfig(fileRoot("config.yaml"));
     const head = (await shGitOk("git rev-parse HEAD", cwd)).trim();
+    // Git appends every move of HEAD to its reflog — one a gate command makes and undoes itself included —
+    // so the log as of this capture is the subject's witness: any later difference is a move (fail closed).
+    const headLogPath = resolve(cwd, (await shGitOk("git rev-parse --git-path logs/HEAD", cwd)).trim());
+    const headLog = () => { try {
+        return readFileSync(headLogPath, "utf8");
+    }
+    catch {
+        return "";
+    } };
+    const headLogAtCapture = headLog();
     const baseTip = (await shGitOk(`git rev-parse '${values.base}'`, cwd).catch(() => {
         throw new Error(`--base ${values.base} is not a resolvable ref — pass --base <ref> naming the branch this diff targets`);
     })).trim();
@@ -212,24 +226,79 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
     // capture and gate GREEN), and it enumerates nested files individually instead of collapsing them
     // to a bare `?? dir/`, so the refusal names every offending path. The `.tickmarkr-*` exemption is
     // unaffected — the harness's droppings are root-level files, never directories.
-    const status = await shGit("GIT_OPTIONAL_LOCKS=0 git status --porcelain --untracked-files=all", cwd);
-    const dirt = status.code !== 0
-        ? `git status failed (exit ${status.code}) — the worktree cannot be proven clean`
-        : status.stdout.split("\n").map((l) => l.trimEnd())
-            .filter((l) => l.trim() && !/^.. \.tickmarkr-[^/]*$/.test(l)).join("\n");
+    const candidateDirt = async () => {
+        const status = await shGit("GIT_OPTIONAL_LOCKS=0 git status --porcelain --untracked-files=all", cwd);
+        const dirt = status.code !== 0
+            ? `git status failed (exit ${status.code}) — the worktree cannot be proven clean`
+            : status.stdout.split("\n").map((l) => l.trimEnd())
+                .filter((l) => l.trim() && !/^.. \.tickmarkr-[^/]*$/.test(l)).join("\n");
+        return dirt ? `${DIRTY_WHY}:\n${dirt}` : undefined;
+    };
+    const dirt = await candidateDirt();
     if (dirt)
-        throw new Error(`${DIRTY_WHY}:\n${dirt}`);
+        throw new Error(dirt);
+    // C1: a --record into a run that owes checks is a discharge attempt, bound before any seat or
+    // capture is spent. It must name the exact obligation — its run, task, immutable range (or that
+    // range's validated integration merge), required gate and unchanged criteria — or it refuses with
+    // exit 2 and the check stays outstanding. Unknown debt refuses outright: nothing proves it paid.
+    const recordJournal = values.record ? Journal.open(stateRoot, values.record) : undefined;
+    const owedBefore = recordJournal ? foldOwedChecks(recordJournal.read(), cwd) : undefined;
+    const debtLine = (fold) => `owed checks for ${values.record}: debt ${fold.debt}`
+        + (fold.outstanding.length ? ` — outstanding ${fold.outstanding.map((o) => `${o.taskId}/${o.gate} ${o.id}`).join(", ")}` : "")
+        + (fold.unknown.length ? ` — unknown: ${fold.unknown.map((u) => `${u.taskId ?? "?"}${u.gate ? `/${u.gate}` : ""} ${u.reason}`).join("; ")}` : "");
+    const refuseDischarge = (why) => ({ out: `verify --record refused: ${why}\n${debtLine(owedBefore)}`, code: 2 });
+    let owed = [];
+    let mapping = "exact";
+    if (owedBefore && (!owedBefore.known || owedBefore.outstanding.length > 0)) {
+        if (!owedBefore.known)
+            return refuseDischarge("the run's owed-check debt is unknown (legacy, missing or malformed evidence)");
+        const own = owedBefore.outstanding.filter((o) => o.runId === values.record && o.taskId === values.task);
+        if (!own.length)
+            return refuseDischarge(`run ${values.record} owes no check for task ${values.task ?? "(no --task)"}`);
+        owed = own.filter((o) => o.base === mergeBase && o.head === head);
+        if (!owed.length) {
+            const events = recordJournal.read();
+            owed = own.filter((o) => integrationMapped(cwd, events, o, mergeBase, head));
+            mapping = "integration";
+        }
+        if (!owed.length)
+            return refuseDischarge(`${mergeBase.slice(0, 12)}..${head.slice(0, 12)} is neither an owed check's exact range nor a validated integration merge of it (ambiguous or rewritten history is refused)`);
+        // The evidence is the obligation's own: its task's scope against a baseline this invocation captures.
+        if (values.files?.length)
+            return refuseDischarge(`a discharge gates the recorded scope of ${values.task}; --files cannot replace it`);
+        if (values.baseline)
+            return refuseDischarge("a discharge captures its own baseline; --baseline cannot supply one");
+        for (const o of owed) {
+            if (JSON.stringify(files) !== JSON.stringify(o.files))
+                return refuseDischarge(`check ${o.id} bound another file scope than ${values.task}'s current one`);
+            if (!gates.includes(o.gate))
+                return refuseDischarge(`check ${o.id} requires the ${o.gate} gate, which this invocation skips`);
+            if (owedCriteria(acceptance) !== o.criteria)
+                return refuseDischarge(`check ${o.id} bound other acceptance criteria than ${values.task}'s current ones`);
+        }
+    }
     // LLM seats only when a semantic gate will run.
     let channels = [];
     let judgeChannels;
     let author = HUMAN_AUTHOR;
+    let carriedAuthors = [];
     const adapters = allAdapters();
     if (wantAcceptance || wantReview) {
         const health = readDoctor(fileRoot("doctor.json")) ?? (await probeAll(adapters));
         const pools = rolePools(cfg, adapters, health);
         judgeChannels = pools.judge;
         channels = pools.review;
-        if (values.author && values.author !== "human") {
+        if (owed.length) {
+            // The run's lifetime patch authors bind the reviewer's exclusions; --author never overrides
+            // them. An author the pool cannot resolve leaves review unseatable, which fails closed.
+            carriedAuthors = [...new Set(owed.flatMap((o) => o.authors))];
+            if (values.author)
+                console.error(`verify: --author ${values.author} ignored — ${values.record}'s recorded patch authors (${carriedAuthors.join(", ")}) bind this discharge`);
+            const first = channels.find((c) => channelKey(c) === carriedAuthors[0]);
+            if (first)
+                author = { adapter: first.adapter, model: first.model, channel: first.channel, tier: first.tier };
+        }
+        else if (values.author && values.author !== "human") {
             const [adapter, ...rest] = values.author.split(":");
             const model = rest.join(":");
             const c = channels.find((ch) => ch.adapter === adapter && ch.model === model);
@@ -253,127 +322,291 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
     // ponytail: tmpdir means the baseline cache dies on reboot/cleanup — worst case is one re-capture.
     const stateDir = verifyStateDir(cwd);
     mkdirSync(stateDir, { recursive: true });
-    const recordJournal = values.record ? Journal.open(stateRoot, values.record) : undefined;
-    // OBS-1042: one runner root per repository across every linked worktree — the capture and the
-    // battery below run under a reservation keyed on the common git dir, and a waiter says who holds it.
-    return withRepositoryLease(cwd, () => leasedVerify(), {
-        signal: executionSignal(),
-        onWait: (holder) => {
-            console.error(`verify: waiting for the repository's runner lease held by pid ${holder.pid} in ${holder.cwd}`);
-            recordJournal?.append("suite-wait", values.task ?? "VERIFY", { holderPid: holder.pid, holderCwd: holder.cwd });
-        },
-    });
-    async function leasedVerify() {
-        let baseline;
-        const cachePath = baselineCachePath(cwd, mergeBase, commands);
+    // T5 (D): only the full suite and its baseline need the repository's runner lease. build/lint
+    // (baseline and candidate), evidence, scope and judge ‖ review run first and unleased, so a red
+    // there ends verify without queueing behind another worktree's suite. Each command subset keeps
+    // its own baseline cache identity; the rows of both phases fold into ONE AND verdict and ONE
+    // artifact. With no test command there is no suite to lease: the skipped test row stays up front.
+    // (tipTest is a tip-verify command runGates never executes here, so neither subset captures it.)
+    const subsetOf = (names) => Object.fromEntries(Object.entries(commands).filter(([name]) => names.includes(name)));
+    const cheapCommands = subsetOf(["build", "lint"]);
+    const leased = gates.filter((g) => g === "test" && commands.test !== undefined);
+    // The suite's base capture rebuilds first in its own worktree: a suite that reads ignored build
+    // outputs (dist/) must meet them at base as the candidate does, or its unchanged failures read as
+    // new. So build belongs to the suite subset's capture — and to its cache identity.
+    const suiteCommands = leased.length ? subsetOf(["build", "test"]) : {};
+    // A prior verdictless capture is announced before any gate runs, whichever phase will recapture it.
+    if (!values.baseline) {
+        for (const subset of [cheapCommands, suiteCommands]) {
+            if (Object.keys(subset).length && existsSync(`${baselineCachePath(cwd, mergeBase, subset)}.verdictless`)) {
+                console.error(`verify: prior baseline recorded no verdict and was not cached; recapturing merge-base ${mergeBase.slice(0, 12)} for ${Object.keys(subset).join(", ")}`);
+            }
+        }
+    }
+    async function baselineFor(subset) {
+        if (values.baseline)
+            return JSON.parse(readFileSync(values.baseline, "utf8"));
+        const names = Object.keys(subset);
+        if (!names.length)
+            return { commands: {} };
+        const cachePath = baselineCachePath(cwd, mergeBase, subset);
         const verdictlessMarker = `${cachePath}.verdictless`;
         mkdirSync(dirname(cachePath), { recursive: true });
-        if (values.baseline) {
-            baseline = JSON.parse(readFileSync(values.baseline, "utf8"));
-        }
-        else {
-            let cached;
-            if (existsSync(cachePath)) {
+        let cached;
+        if (existsSync(cachePath)) {
+            try {
                 cached = JSON.parse(readFileSync(cachePath, "utf8"));
-                const missing = verdictlessCommands(cached, commands);
-                if (missing.length) {
-                    console.error(`verify: cached baseline recorded no verdict for ${missing.join(", ")}; it was not reusable and will be recaptured`);
-                    rmSync(cachePath, { force: true });
-                    cached = undefined;
-                }
-                // OBS-1044: a cached vitest count that is a stdout sum may be inflated by nested runner echo;
-                // applying it would manufacture a deficit. Only a manifest-derived count is a floor.
-                const stale = cached ? staleFileCountCommands(cached, commands, cwd) : [];
-                if (stale.length) {
-                    console.error(`verify: cached baseline's file count for ${stale.join(", ")} is not manifest-derived; it will be recaptured`);
-                    rmSync(cachePath, { force: true });
-                    cached = undefined;
-                }
             }
-            if (cached) {
-                console.error(`verify: reusing cached baseline for ${mergeBase.slice(0, 12)} (${cachePath})`);
-                baseline = cached;
+            catch {
+                console.error(`verify: cached baseline at ${cachePath} is unreadable; it will be recaptured`);
+            }
+            const missing = cached ? verdictlessCommands(cached, subset) : [];
+            if (missing.length) {
+                console.error(`verify: cached baseline recorded no verdict for ${missing.join(", ")}; it was not reusable and will be recaptured`);
+                cached = undefined;
+            }
+            // OBS-1044: a cached vitest count that is a stdout sum may be inflated by nested runner echo;
+            // applying it would manufacture a deficit. Only a manifest-derived count is a floor.
+            const stale = cached ? staleFileCountCommands(cached, subset, cwd) : [];
+            if (stale.length) {
+                console.error(`verify: cached baseline's file count for ${stale.join(", ")} is not manifest-derived; it will be recaptured`);
+                cached = undefined;
+            }
+            if (!cached)
+                rmSync(cachePath, { force: true });
+        }
+        if (cached) {
+            console.error(`verify: reusing cached baseline for ${mergeBase.slice(0, 12)} (${names.join(", ")}: ${cachePath})`);
+            return cached;
+        }
+        console.error(`verify: capturing baseline at merge-base ${mergeBase.slice(0, 12)} for ${names.join(", ")} (cached by base, lockfile, command and effective runner hashes at ${cachePath})`);
+        // Unleased captures of the SAME checkout overlap, so each owns a unique base worktree and removes
+        // only its own; the pid in the name lets a later verify sweep what a killed one left behind.
+        for (const entry of readdirSync(stateDir)) {
+            const owner = /^base-[0-9a-f]{12}-(\d+)-\w{6}$/.exec(entry)?.[1];
+            if (owner && !isPidLive(Number(owner)))
+                await removeWorktree(cwd, join(stateDir, entry));
+        }
+        const baseDir = mkdtempSync(join(stateDir, `base-${mergeBase.slice(0, 12)}-${process.pid}-`));
+        try {
+            await shGitOk(`git worktree add --detach '${baseDir}' '${mergeBase}'`, cwd);
+            linkNodeModules(cwd, baseDir, { force: true });
+            const baseline = await captureBaseline(baseDir, subset);
+            if (baseline.refusal)
+                return baseline;
+            const missing = verdictlessCommands(baseline, subset);
+            if (missing.length) {
+                writeFileSync(verdictlessMarker, JSON.stringify({ base: mergeBase, commands: missing }) + "\n");
+                rmSync(cachePath, { force: true });
             }
             else {
-                if (existsSync(verdictlessMarker)) {
-                    console.error(`verify: prior baseline recorded no verdict and was not cached; recapturing merge-base ${mergeBase.slice(0, 12)}`);
-                }
-                else {
-                    console.error(`verify: capturing baseline at merge-base ${mergeBase.slice(0, 12)} (cached by base, lockfile and command hashes at ${cachePath})`);
-                }
-                const baseDir = join(stateDir, `base-${mergeBase.slice(0, 12)}`);
-                await shGit(`git worktree remove --force '${baseDir}'`, cwd); // stale leftover from an interrupted run
-                await shGitOk(`git worktree add --detach '${baseDir}' '${mergeBase}'`, cwd);
-                try {
-                    linkNodeModules(cwd, baseDir, { force: true });
-                    baseline = await captureBaseline(baseDir, commands);
-                    if (baseline.refusal)
-                        return { out: baseline.refusal, code: 1 };
-                    const missing = verdictlessCommands(baseline, commands);
-                    if (missing.length) {
-                        writeFileSync(verdictlessMarker, JSON.stringify({ base: mergeBase, commands: missing }) + "\n");
-                        rmSync(cachePath, { force: true });
-                    }
-                    else {
-                        writeFileSync(cachePath, JSON.stringify(baseline, null, 2));
-                        rmSync(verdictlessMarker, { force: true });
-                    }
-                }
-                finally {
-                    await removeWorktree(cwd, baseDir);
-                }
+                writeFileSync(cachePath, JSON.stringify(baseline, null, 2));
+                rmSync(verdictlessMarker, { force: true });
             }
+            return baseline;
         }
-        const artifactDir = join(stateDir, new Date().toISOString().replace(/[:.]/g, "-"));
-        mkdirSync(artifactDir, { recursive: true });
-        const { results } = await runGates(task, {
-            worktree: cwd, baseRef: mergeBase,
-            result: { ok: true, summary: "standalone verify — no worker claims to trust", deviations: [], raw: "" },
-            author, commands, baseline, channels, ...(judgeChannels ? { judgeChannels } : {}), adapters, cfg,
-            evidence: options.evidence,
-            verificationScope: "standalone", artifactDir, stateDir: join(stateRoot, ".tickmarkr"),
-            onGate: (e) => {
-                if (e.phase === "start")
-                    console.error(`verify: → ${e.gate} (${e.index}/${e.total})`);
-                else if (e.phase === "note")
-                    console.error(`verify: note ${e.gate} ${e.name} ${JSON.stringify(e.payload)}`);
-                else
-                    console.error(`verify: ${e.result.pass ? "✓" : "✗"} ${e.result.gate} — ${e.result.details.split("\n")[0] ?? ""}`);
-            },
-        });
-        const green = results.length > 0 && results.every((r) => r.pass || r.meta?.skipped === true);
-        const reviewRows = results.filter((result) => result.gate === "review");
-        const reviewFindings = reviewRows.flatMap((result) => result.details.split("\n").flatMap((line) => {
-            const match = /^- \[([^\]]+)\] (.*)$/.exec(line);
-            return match ? [{ classification: match[1], note: match[2], reviewer: result.meta?.reviewer }] : [];
-        }));
-        const artifactPath = join(artifactDir, "verify-results.json");
-        const artifactBytes = Buffer.from(JSON.stringify({ base: baseTip, head, mergeBase, green, gateRows: results, reviewFindings }, null, 2) + "\n");
-        let artifactSha256 = null;
-        let artifactAvailability = "capture-failed";
+        finally {
+            await removeWorktree(cwd, baseDir);
+        }
+    }
+    const gateRun = async (phaseGates, baseline) => (await runGates({ ...task, gates: phaseGates }, {
+        worktree: cwd, baseRef: mergeBase,
+        result: { ok: true, summary: "standalone verify — no worker claims to trust", deviations: [], raw: "" },
+        author, ...(carriedAuthors.length ? { carriedAuthors } : {}), commands, baseline, channels, ...(judgeChannels ? { judgeChannels } : {}), adapters, cfg,
+        evidence: options.evidence,
+        verificationScope: "standalone", artifactDir, stateDir: stagedStateDir,
+        onGate: async (e) => {
+            // Every gate boundary re-validates (and latches) the subject: see subjectChange below.
+            if (e.phase !== "note")
+                await subjectChange();
+            if (e.phase === "start")
+                console.error(`verify: → ${e.gate} (${e.index}/${e.total})`);
+            else if (e.phase === "note")
+                console.error(`verify: note ${e.gate} ${e.name} ${JSON.stringify(e.payload)}`);
+            else
+                console.error(`verify: ${e.result.pass ? "✓" : "✗"} ${e.result.gate} — ${e.result.details.split("\n")[0] ?? ""}`);
+        },
+    })).results;
+    const isGreen = (rows) => rows.length > 0 && rows.every((r) => r.pass || r.meta?.skipped === true);
+    const cheapBaseline = await baselineFor(cheapCommands);
+    if (cheapBaseline.refusal)
+        return { out: cheapBaseline.refusal, code: 1 };
+    // Unleased verifies of one checkout can start in the same millisecond: the timestamp only orders
+    // the directories, the exclusive suffix makes each invocation's artifact its own.
+    const artifactDir = mkdtempSync(join(stateDir, `${new Date().toISOString().replace(/[:.]/g, "-")}-`));
+    // The store keys a green on the tree its command STARTED from, so a build that committed a fix would
+    // publish a green "for" the unfixed tree — and a verify killed before any cleanup would leave it for a
+    // later verify or discharge to reuse. So this invocation's gates read and write a store private to it:
+    // seeded only with verdicts a completed subject validation published, and published from only after
+    // every phase's subject check held (below). A killed invocation's staging is never read again.
+    const sharedVerdicts = getVerdictStore(join(stateRoot, ".tickmarkr"));
+    const stagedStateDir = join(artifactDir, "staged-verdicts");
+    const staged = getVerdictStore(stagedStateDir);
+    const storedRows = (dir) => readdirSync(dir).filter((f) => f.startsWith("verdict-") && f.endsWith(".json")).flatMap((file) => {
         try {
-            writeFileSync(artifactPath, artifactBytes, { flag: "wx" });
-            artifactSha256 = createHash("sha256").update(artifactBytes).digest("hex");
-            artifactAvailability = "available";
-            console.error(`verify: artifacts written to ${artifactPath}`);
+            return [{ file, record: JSON.parse(readFileSync(join(dir, file), "utf8")) }];
         }
         catch {
-            console.error(`verify: evidence capture failed for ${artifactPath}`);
+            return [];
+        }
+    });
+    for (const { file, record } of storedRows(sharedVerdicts.dir)) {
+        if (typeof record.verdict?.meta?.validatedSubject === "string")
+            copyFileSync(join(sharedVerdicts.dir, file), join(staged.dir, file));
+    }
+    // The subject is immutable: every row must answer for `head` on a clean tree. A gate command that
+    // commits or dirties the candidate (a build step landing a fix) measured other bytes than the verdict,
+    // artifact and any discharge name, so each phase AND each gate boundary (onGate start/end) is checked.
+    // The first change LATCHES: a later gate restoring HEAD (lint resetting the build's commit) or the
+    // tree never un-refuses it, and HEAD's reflog witnesses a move a single command made and undid.
+    // HEAD is re-read through the same reader that captured `head`, so both sides compare like for like.
+    let subjectLatch;
+    const subjectChange = async () => {
+        const now = await shGitOk("git rev-parse HEAD", cwd).then((out) => out.trim(), () => undefined);
+        const why = now === undefined ? "HEAD is unreadable"
+            : now !== head ? `HEAD moved from ${head.slice(0, 12)} to ${now.slice(0, 12)}`
+                : headLog() !== headLogAtCapture ? `HEAD moved and was restored to ${head.slice(0, 12)} (its reflog recorded the move)`
+                    : await candidateDirt();
+        if (why)
+            subjectLatch ??= why;
+        return subjectLatch;
+    };
+    const refusedSubject = (why) => `refusing the verdict: the candidate changed while its gates ran, so no one subject carries every gate — ${why}`;
+    const cheapGates = gates.filter((g) => !leased.includes(g));
+    const changedBefore = await subjectChange();
+    let results = changedBefore
+        ? [{ gate: cheapGates[0], pass: false, details: refusedSubject(changedBefore), meta: { subjectChanged: changedBefore } }]
+        : await gateRun(cheapGates, cheapBaseline);
+    const changedAfter = changedBefore ? undefined : await subjectChange();
+    if (changedAfter)
+        results = results.map((r) => ({ ...r, pass: false, details: `${refusedSubject(changedAfter)}\n${r.details}`, meta: { ...r.meta, subjectChanged: changedAfter } }));
+    if (leased.length && isGreen(results)) {
+        // ...and the suite must measure those same bytes: its green may only join the AND verdict if they still hold.
+        const refused = (why) => `refusing the suite verdict: the candidate changed between semantic completion and suite completion, so no one subject carries every gate — ${why}`;
+        // OBS-1042: one runner root per repository across every linked worktree — the suite baseline and
+        // the candidate suite run under a reservation keyed on the common git dir; a waiter says who holds it.
+        const suite = await withRepositoryLease(cwd, async () => {
+            const before = await subjectChange();
+            if (before)
+                return [{ gate: "test", pass: false, details: refused(before), meta: { subjectChanged: before } }];
+            const baseline = await baselineFor(suiteCommands);
+            // The earlier gates already answered: a refused suite baseline is the test gate's red, and it
+            // joins their rows in the one verdict and artifact rather than discarding them.
+            if (baseline.refusal)
+                return [{ gate: "test", pass: false, details: baseline.refusal, meta: { infra: true, classification: "infra", retryable: false, kind: "workspace-dependency" } }];
+            const rows = await gateRun(leased, baseline);
+            const after = await subjectChange();
+            return after ? rows.map((r) => ({ ...r, pass: false, details: `${refused(after)}\n${r.details}`, meta: { ...r.meta, subjectChanged: after } })) : rows;
+        }, {
+            signal: executionSignal(),
+            onWait: (holder) => {
+                console.error(`verify: waiting for the repository's runner lease held by pid ${holder.pid} in ${holder.cwd}`);
+                recordJournal?.append("suite-wait", values.task ?? "VERIFY", { holderPid: holder.pid, holderCwd: holder.cwd });
+            },
+        });
+        results = [...results, ...suite].sort((a, b) => GATE_NAMES.indexOf(a.gate) - GATE_NAMES.indexOf(b.gate));
+    }
+    // The last boundary. A change latched anywhere above refuses every row (so nothing is discharged) and
+    // publishes nothing; otherwise every gate answered for `head` on a clean tree, and this invocation's
+    // fresh verdicts are published, stamped with the subject they were validated against.
+    const changedAtEnd = await subjectChange();
+    if (changedAtEnd) {
+        results = results.map((r) => r.meta?.subjectChanged ? r : { ...r, pass: false, details: `${refusedSubject(changedAtEnd)}\n${r.details}`, meta: { ...r.meta, subjectChanged: changedAtEnd } });
+    }
+    else {
+        for (const { record } of storedRows(staged.dir)) {
+            if (record.verdict?.meta?.runDir === artifactDir)
+                sharedVerdicts.set(record.identity, { ...record.verdict, meta: { ...record.verdict.meta, validatedSubject: head } });
         }
-        const review = reviewRows.at(-1);
-        if (recordJournal && review) {
-            recordJournal.append("review-leg2", values.task ?? "VERIFY", {
-                base: baseTip, head, mergeBase, author: channelKey(author), artifactPath, artifactSha256, artifactAvailability,
-                ...review,
-            });
+    }
+    rmSync(stagedStateDir, { recursive: true, force: true });
+    const green = isGreen(results);
+    const reviewRows = results.filter((result) => result.gate === "review");
+    const reviewFindings = reviewRows.flatMap((result) => result.details.split("\n").flatMap((line) => {
+        const match = /^- \[([^\]]+)\] (.*)$/.exec(line);
+        return match ? [{ classification: match[1], note: match[2], reviewer: result.meta?.reviewer }] : [];
+    }));
+    const artifactPath = join(artifactDir, "verify-results.json");
+    // `criteria` is the digest of the acceptance this invocation measured: a discharge's fold binds it.
+    const artifactBytes = Buffer.from(JSON.stringify({ base: baseTip, head, mergeBase, green, files, criteria: owedCriteria(acceptance), gateRows: results, reviewFindings }, null, 2) + "\n");
+    let artifactSha256 = null;
+    let artifactAvailability = "capture-failed";
+    try {
+        writeFileSync(artifactPath, artifactBytes, { flag: "wx" });
+        artifactSha256 = createHash("sha256").update(artifactBytes).digest("hex");
+        artifactAvailability = "available";
+        console.error(`verify: artifacts written to ${artifactPath}`);
+    }
+    catch {
+        console.error(`verify: evidence capture failed for ${artifactPath}`);
+    }
+    const review = reviewRows.at(-1);
+    // C1: ONE discharge row names what the fold re-reads — the artifact by hash, the range mapping, the
+    // criteria and each resolved channel — and it is appended only when the fold, the single decider,
+    // already accepts it: verify never writes a proof that would turn known debt into unknown debt.
+    let dischargeRefusal;
+    if (recordJournal && owed.length) {
+        const facts = (key) => channels.find((c) => channelKey(c) === key);
+        const reviewer = typeof review?.meta?.reviewer === "string" ? facts(review.meta.reviewer) : undefined;
+        const authorChannels = carriedAuthors.map(facts).filter((c) => c !== undefined);
+        const data = {
+            ids: owed.map((o) => o.id), gates: owed.map((o) => o.gate), mapping, mergeBase, head, criteria: owedCriteria(acceptance),
+            ...(mapping === "integration" ? { patch: owed[0].patch } : {}),
+            artifactPath, artifactSha256,
+            ...(reviewer ? { reviewer: { key: channelKey(reviewer), vendor: reviewer.vendor } } : {}),
+            authorChannels: authorChannels.map((c) => ({ key: channelKey(c), vendor: c.vendor })),
+        };
+        const candidate = green && artifactAvailability === "available"
+            ? foldOwedChecks([...recordJournal.read(), { ts: new Date().toISOString(), event: OWED_DISCHARGE_EVENT, taskId: values.task, data }], cwd)
+            : undefined;
+        if (!green)
+            dischargeRefusal = "the verdict is not green";
+        else if (!candidate)
+            dischargeRefusal = "the results artifact is unavailable";
+        else if (!candidate.known || !owed.every((o) => candidate.discharged.includes(o.id)))
+            dischargeRefusal = candidate.unknown.at(-1)?.reason ?? "the proof does not discharge the check";
+        else
+            recordJournal.append(OWED_DISCHARGE_EVENT, values.task, data);
+    }
+    const owedAfter = recordJournal ? foldOwedChecks(recordJournal.read(), cwd) : undefined;
+    const code = green && !dischargeRefusal ? 0 : 2;
+    const owedLines = owedAfter && (owed.length || owedAfter.acceptedRisk.length || !owedAfter.known)
+        ? [...(dischargeRefusal ? [`verify --record refused discharge: ${dischargeRefusal}`] : []), debtLine(owedAfter)] : [];
+    if (recordJournal && review) {
+        recordJournal.append("review-leg2", values.task ?? "VERIFY", {
+            base: baseTip, head, mergeBase, author: channelKey(author), artifactPath, artifactSha256, artifactAvailability,
+            ...review,
+        });
+    }
+    // A1 (D-787/D-789): one bounded launchservicesd identity read AFTER the verdict is final, so a suite
+    // that restarted the daemon is caught and the verdict, exit code and retries never depend on it.
+    // It rides the doctor.json verify read; with none there it creates no state file.
+    const doctorRoot = fileRoot("doctor.json");
+    const priorDoctor = readDoctor(doctorRoot);
+    const launchServices = priorDoctor ? await recordLaunchServices(priorDoctor, priorDoctor) : undefined;
+    if (launchServices && launchServices.health !== priorDoctor) {
+        // Evidence only, not a probe: keep doctor.json's mtime (the auth-cache freshness signal, doctorAgeMs),
+        // and a failed write is an advisory diagnostic — the verdict below is returned regardless.
+        const doctorFile = join(doctorRoot, ".tickmarkr", "doctor.json");
+        try {
+            const { atime, mtime } = statSync(doctorFile);
+            writeDoctor(doctorRoot, launchServices.health);
+            utimesSync(doctorFile, atime, mtime);
         }
-        if (values.json) {
-            return { out: JSON.stringify({ base: baseTip, head, mergeBase, green, artifactPath, artifactSha256, artifactAvailability, results }, null, 2), code: green ? 0 : 2 };
+        catch (e) {
+            console.error(`verify: launchservicesd evidence not persisted (${e instanceof Error ? e.message : String(e)}) (advisory — verdict unchanged)`);
         }
-        const lines = results.map((r) => `${r.pass ? "PASS" : "FAIL"} ${r.gate}\n${r.details.split("\n").map((l) => `  ${l}`).join("\n")}`);
-        const verdict = green
-            ? `verify GREEN — ${results.length} gate(s) passed on ${mergeBase.slice(0, 12)}..${head.slice(0, 12)} (merge is a human decision; artifacts: ${artifactPath})`
-            : `verify RED — first failure decides; artifacts: ${artifactPath}`;
-        return { out: [...lines, "", verdict].join("\n"), code: green ? 0 : 2 };
     }
+    if (launchServices?.line)
+        console.error(`verify: ${launchServices.line}`);
+    if (values.json) {
+        return { out: JSON.stringify({ base: baseTip, head, mergeBase, green, artifactPath, artifactSha256, artifactAvailability, results,
+                ...(owedAfter && owedLines.length ? { owed: { debt: owedAfter.debt, discharged: dischargeRefusal ? [] : owed.map((o) => o.id), ...(dischargeRefusal ? { refused: dischargeRefusal } : {}) } } : {}),
+            }, null, 2), code };
+    }
+    const lines = results.map((r) => `${r.pass ? "PASS" : "FAIL"} ${r.gate}\n${r.details.split("\n").map((l) => `  ${l}`).join("\n")}`);
+    const verdict = green
+        ? `verify GREEN — ${results.length} gate(s) passed on ${mergeBase.slice(0, 12)}..${head.slice(0, 12)} (merge is a human decision; artifacts: ${artifactPath})`
+        : `verify RED — first failure decides; artifacts: ${artifactPath}`;
+    return { out: [...lines, "", verdict, ...owedLines].join("\n"), code };
 }