tickmarkr 2.6.6 → 2.6.8

package/dist/gates/test-manifest.d.ts

@@ -87,6 +87,17 @@ export declare function verifyManifestReport(opts: {
 /** How much longer than its baseline measurement one file may legitimately run before it is a hang. */
 export declare const FILE_HANG_SLACK = 3;
 export declare const DEFAULT_FILE_HANG_BUDGET_MS = 60000;
+/**
+ * No measured-green file is a hang before this much active time, whatever its baseline says (the battery ceiling still wins
+ * below it). A fast suite's per-file timings are a few ms, so 3 × its own killed a slower file that would have passed.
+ */
+export declare const MIN_FILE_HANG_BUDGET_MS = 10000;
+/** Tests of the baseline-derived budget's kill mechanics opt out of the floor; production never does. */
+export declare const setHangBudgetFloorForTests: (ms: number) => void;
+export declare const resetHangBudgetFloorForTests: () => void;
+/** v2.6.8 P4 (prospectively superseding v2.5.5's "untimed = 3 × longest"): only the file's OWN usable green duration K
+ * buys measured slack, max(3 × K, L) with L the longest usable entry (red included) or legacy longestFile. An untimed,
+ * baseline-red or legacy longest-only file has no measure of its runtime and gets the finite battery ceiling. */
 export declare function fileHangBudgetMs(file: string, baselineDurations?: readonly BaselineFileDuration[] | null, ceilingMs?: number, longestFile?: BaselineFileDuration | null): number;
 /**
  * OBS-953 (+add): a per-file hang budget counted in raw wall time charged a lid-close to the file that
@@ -122,6 +133,37 @@ export declare function classifyPollGap(prev: {
     wall: number;
     mono: number;
 }, pollMs: number): HostInterruption | undefined;
+/**
+ * v2.6.8 P4: an overdue poll on Darwin asks the kernel when it last slept and woke (`sysctl -n kern.sleeptime
+ * kern.waketime`), synchronously and bounded, before that poll's hang decision; the segment's overlap with the gap is
+ * credited as `host-suspend`. Unreadable evidence is unknown and credits 0. NAMED RESIDUAL: the kernel keeps only the
+ * MOST RECENT segment, so a gap holding several sleeps or maintenance DarkWakes credits only the last one — that
+ * under-credit fails closed: the file can still be killed as a hang, as on 2.6.7.
+ */
+export interface SleepSegment {
+    sleep: number;
+    wake: number;
+}
+export interface SleepEvidence {
+    platform: () => NodeJS.Platform;
+    /** The synchronous OS-command boundary (spawnSync's shape). */
+    command: (file: string, args: string[], opts: {
+        encoding: "utf8";
+        timeout: number;
+        maxBuffer: number;
+        killSignal: "SIGKILL";
+    }) => {
+        status: number | null;
+        signal: NodeJS.Signals | null;
+        stdout?: string;
+        stderr?: string;
+        error?: Error;
+    };
+    /** Replaces the default sysctl reader; production supplies none. */
+    reader?: () => SleepSegment | undefined;
+}
+export declare const setSleepEvidenceForTests: (evidence: Partial<SleepEvidence>) => void;
+export declare const resetSleepEvidenceForTests: () => void;
 export declare const runWithInterruptionSink: <T>(sink: (interruption: HostInterruption) => void, run: () => Promise<T>) => Promise<T>;
 export interface ManifestRunResult {
     evidenceReceipt: GateEvidenceReceipt;

package/dist/gates/test-manifest.js

@@ -1,9 +1,11 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { spawnSync } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { existsSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { performance } from "node:perf_hooks";
+import { verificationPhase, withVerificationJob } from "../run/verification-job.js";
 import { TEST_REPORTER_SOURCE } from "./test-reporter.js";
 import { shq } from "../adapters/types.js";
 import { beginGateEvidence, redactGateOutput } from "./baseline.js";
@@ -329,15 +331,30 @@ export function verifyManifestReport(opts) {
 /** How much longer than its baseline measurement one file may legitimately run before it is a hang. */
 export const FILE_HANG_SLACK = 3;
 export const DEFAULT_FILE_HANG_BUDGET_MS = 60_000;
+/**
+ * No measured-green file is a hang before this much active time, whatever its baseline says (the battery ceiling still wins
+ * below it). A fast suite's per-file timings are a few ms, so 3 × its own killed a slower file that would have passed.
+ */
+export const MIN_FILE_HANG_BUDGET_MS = 10_000;
+let hangBudgetFloorMs = MIN_FILE_HANG_BUDGET_MS;
+/** Tests of the baseline-derived budget's kill mechanics opt out of the floor; production never does. */
+export const setHangBudgetFloorForTests = (ms) => { hangBudgetFloorMs = ms; };
+export const resetHangBudgetFloorForTests = () => { hangBudgetFloorMs = MIN_FILE_HANG_BUDGET_MS; };
 const usable = (n) => n !== undefined && Number.isFinite(n) && n > 0;
+/** v2.6.8 P4 (prospectively superseding v2.5.5's "untimed = 3 × longest"): only the file's OWN usable green duration K
+ * buys measured slack, max(3 × K, L) with L the longest usable entry (red included) or legacy longestFile. An untimed,
+ * baseline-red or legacy longest-only file has no measure of its runtime and gets the finite battery ceiling. */
 export function fileHangBudgetMs(file, baselineDurations, ceilingMs = DEFAULT_FILE_HANG_BUDGET_MS, longestFile) {
     const ceiling = usable(ceilingMs) ? ceilingMs : DEFAULT_FILE_HANG_BUDGET_MS;
     const timings = baselineDurations?.filter((d) => usable(d.durationMs)) ?? [];
-    const longest = Math.max(0, ...timings.map((d) => d.durationMs), usable(longestFile?.durationMs) ? longestFile.durationMs : 0);
-    if (!longest)
+    // A file that was RED in the baseline ended early there: its duration is no measure of its green runtime. The
+    // failure is read from EVERY entry, before the usable-duration filter can drop a 0 ms or non-finite red one.
+    const red = baselineDurations?.some((d) => d.file === file && d.failed) ?? false;
+    const known = red ? undefined : timings.find((d) => d.file === file)?.durationMs;
+    if (known === undefined)
         return ceiling;
-    const known = timings.find((d) => d.file === file)?.durationMs;
-    return Math.min(ceiling, known === undefined ? FILE_HANG_SLACK * longest : Math.max(FILE_HANG_SLACK * known, longest));
+    const longest = Math.max(...timings.map((d) => d.durationMs), usable(longestFile?.durationMs) ? longestFile.durationMs : 0);
+    return Math.min(ceiling, Math.max(FILE_HANG_SLACK * known, longest));
 }
 /**
  * OBS-953 (+add): a per-file hang budget counted in raw wall time charged a lid-close to the file that
@@ -364,8 +381,29 @@ export function classifyPollGap(prev, now, pollMs) {
         return { kind: "unknown", ...gap, subtractedMs: 0 };
     return undefined;
 }
-/** The detected suspend a file started at `startedAt` sat through. */
-const suspendedSince = (interruptions, startedAt) => interruptions.reduce((sum, i) => sum + Math.min(i.subtractedMs, Math.max(0, i.to - Math.max(i.from, startedAt))), 0);
+const systemSleepEvidence = { platform: () => process.platform, command: (file, args, opts) => spawnSync(file, args, opts) };
+let sleepEvidence = systemSleepEvidence;
+export const setSleepEvidenceForTests = (evidence) => { sleepEvidence = { ...systemSleepEvidence, ...evidence }; };
+export const resetSleepEvidenceForTests = () => { sleepEvidence = systemSleepEvidence; };
+const SYSCTL_TIMEOUT_MS = 1_000, SYSCTL_MAX_BYTES = 4_096;
+const SYSCTL_STAMP = /^\{ sec = (\d{1,15}), usec = (\d{1,6}) \} [A-Z][a-z]{2} [A-Z][a-z]{2} +\d{1,2} \d{2}:\d{2}:\d{2} \d{4}$/;
+/** Lazy: runs only from an overdue poll, never at import. A timeout or overrun of 1000 ms, a signal, nonzero exit, more
+ * than 4096 combined output bytes, or a truncated, unparseable or reversed pair is unknown. spawnSync SIGKILLs the child
+ * at either bound and joins it: a child ignoring SIGTERM cannot hold the poll, so hang enforcement still runs. */
+function readDarwinSleepSegment() {
+    const startedMs = hangClocks.mono();
+    const r = sleepEvidence.command("sysctl", ["-n", "kern.sleeptime", "kern.waketime"], { encoding: "utf8", timeout: SYSCTL_TIMEOUT_MS, maxBuffer: SYSCTL_MAX_BYTES, killSignal: "SIGKILL" });
+    const out = r.stdout ?? "", err = r.stderr ?? "";
+    if (hangClocks.mono() - startedMs >= SYSCTL_TIMEOUT_MS || r.error || r.signal || r.status !== 0
+        || Buffer.byteLength(out) + Buffer.byteLength(err) > SYSCTL_MAX_BYTES)
+        return undefined;
+    const [sleep, wake, ...rest] = out.replace(/\n$/, "").split("\n").map((line) => SYSCTL_STAMP.exec(line))
+        .map((m) => m ? Number(m[1]) * 1000 + Number(m[2]) / 1000 : NaN);
+    return !rest.length && sleep < wake ? { sleep: sleep, wake: wake } : undefined;
+}
+/** Per gap, a file started at `startedAt` is credited the larger of the offset it sat through and its own overlap with
+ * the kernel segment: the same suspend is never counted twice, and nothing before the file started is credited. */
+const suspendedSince = (credits, startedAt) => credits.reduce((sum, c) => sum + Math.max(Math.min(c.offsetMs, Math.max(0, c.to - Math.max(c.from, startedAt))), Math.max(0, c.wake - Math.max(c.sleep, startedAt))), 0);
 // The daemon journals each interruption where it ran (task gate, tip verify); no sink, no journal row.
 const interruptionSink = new AsyncLocalStorage();
 export const runWithInterruptionSink = (sink, run) => interruptionSink.run(sink, run);
@@ -384,13 +422,33 @@ export function runManifestedTest(cmd, cwd, opts) {
     let hangWallMs;
     let poll;
     const interruptions = [];
+    const credits = [];
+    let creditedUntil = -Infinity;
     const sink = interruptionSink.getStore();
     let last = { wall: hangClocks.wall(), mono: hangClocks.mono() };
     const checkHang = (atCeiling = false) => {
         const at = { wall: hangClocks.wall(), mono: hangClocks.mono() };
-        const gap = classifyPollGap(last, at, pollMs);
+        let gap = classifyPollGap(last, at, pollMs);
         last = at;
         if (gap) {
+            let os;
+            if (sleepEvidence.platform() === "darwin") {
+                try {
+                    os = (sleepEvidence.reader ?? readDarwinSleepSegment)();
+                }
+                catch {
+                    os = undefined;
+                }
+                last = { wall: hangClocks.wall(), mono: hangClocks.mono() }; // the bounded read itself is no poll gap
+            }
+            // Clipped to this gap and past any segment already credited, so a repeated pair never credits twice.
+            const sleep = Math.max(os?.sleep ?? Infinity, gap.from, creditedUntil), wake = Math.min(os?.wake ?? -Infinity, gap.to);
+            const osMs = wake > sleep ? wake - sleep : 0;
+            if (osMs)
+                creditedUntil = wake;
+            credits.push({ from: gap.from, to: gap.to, offsetMs: gap.subtractedMs, ...(osMs ? { sleep, wake } : { sleep: 0, wake: 0 }) });
+            if (osMs > gap.subtractedMs)
+                gap = { ...gap, kind: "host-suspend", subtractedMs: osMs };
             interruptions.push(gap);
             sink?.(gap);
         }
@@ -401,9 +459,9 @@ export function runManifestedTest(cmd, cwd, opts) {
             const startedAt = report.started[file];
             if (startedAt === undefined || file in report.completed)
                 continue;
-            const budget = fileHangBudgetMs(file, opts.baselineDurations, overallCeilingMs, opts.longestFile);
+            const budget = Math.min(overallCeilingMs, Math.max(hangBudgetFloorMs, fileHangBudgetMs(file, opts.baselineDurations, overallCeilingMs, opts.longestFile)));
             const wallMs = at.wall - startedAt;
-            const activeMs = wallMs - suspendedSince(interruptions, startedAt);
+            const activeMs = wallMs - suspendedSince(credits, startedAt);
             if (activeMs >= budget || (atCeiling && budget === overallCeilingMs)) {
                 killedFile = file;
                 hangBudgetMs = budget;
@@ -532,9 +590,14 @@ function strandedSingleForkFiles(files, nonce, run) {
     const parallel = files.filter(f => !scheduling[f].singleFork);
     if (!single.length || !parallel.length || single.some(f => Object.hasOwn(r.started, f) || Object.hasOwn(r.completed, f)))
         return;
-    if (parallel.some(f => !Object.hasOwn(r.started, f)
-        || !["passed", "skipped"].includes(r.completed[f]?.status ?? "")
-        || (r.completed[f]?.tests?.failed ?? 0) !== 0))
+    if (parallel.some(f => {
+        const completion = r.completed[f];
+        if (!Object.hasOwn(r.started, f) || !completion)
+            return true;
+        if (completion.status === "failed")
+            return !completion.failures?.length || !(completion.tests && completion.tests.failed > 0);
+        return !["passed", "skipped"].includes(completion.status) || (completion.tests?.failed ?? 0) !== 0;
+    }))
         return;
     return single;
 }
@@ -561,115 +624,137 @@ export async function evaluateManifestedTest(cmd, cwd, opts) {
     const dir = opts.artifactDir ?? mkdtempSync(join(tmpdir(), "tickmarkr-test-report-"));
     let nonce = randomBytes(16).toString("hex");
     let reportPath = join(dir, `test-manifest-report-${nonce}.json`);
-    const reporterPath = join(dir, `test-reporter-${nonce}.mjs`);
-    const evidenceReceipts = [];
-    let spawnedCommand = cmd;
-    let manifestPath;
-    let recovery;
-    const { env, verification } = manifestEnvironment(cwd);
     try {
-        const invocation = await discoverTestManifest(cmd, cwd, { dir, nonce, env, overallCeilingMs: opts.overallCeilingMs, evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir } });
-        evidenceReceipts.push(...invocation.evidenceReceipts);
-        const files = invocation.files;
-        // R41: the EXPECTED manifest is evidence in its own right — persisted beside the report with the
-        // exact discovery invocation, so a later reader can tell what this invocation was asked to prove
-        // without reconstructing it from the runner's own claims.
-        manifestPath = join(dir, `test-manifest-expected-${nonce}.json`);
-        writeFileSync(manifestPath, JSON.stringify({
-            nonce, verification, listingCommand: invocation.listing, listingExit: invocation.listingExit,
-            listingStdoutSha256: createHash("sha256").update(invocation.listingStdout).digest("hex"),
-            discoveredAt: Date.now(), files,
-        }, null, 2) + "\n");
-        writeFileSync(reporterPath, TEST_REPORTER_SOURCE);
-        spawnedCommand = `${cmd}${invocation.separator} --reporter=${shq(reporterPath)} --outputFile=${shq(reportPath)}`;
-        let invoked = await runManifestedTest(spawnedCommand, cwd, {
-            evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir }, manifest: files, nonce, reportPath, env,
-            baselineDurations: opts.baselineDurations?.map((d) => ({ ...d, file: toManifestPath(d.file, cwd) })),
-            longestFile: opts.longestFile,
-            overallCeilingMs: opts.overallCeilingMs ?? DEFAULT_FILE_HANG_BUDGET_MS,
-            pollMs: 20,
-        });
-        let verdict = verifyManifestReport({ manifest: files, nonce, exitCode: invoked.exitCode,
-            report: invoked.report, killedFile: invoked.killedFile, hangBudgetMs: invoked.hangBudgetMs,
-            hangActiveMs: invoked.hangActiveMs, hangWallMs: invoked.hangWallMs });
-        evidenceReceipts.push(...invoked.evidenceReceipts);
-        const interruptions = [...invoked.interruptions];
-        const stranded = opts.allowStrandedRecovery === false ? undefined : strandedSingleForkFiles(files, nonce, invoked);
-        if (stranded) {
-            const first = invoked.report;
-            const retryNonce = randomBytes(16).toString("hex");
-            recovery = { firstNonce: nonce, firstReportPath: reportPath, retryNonce, files: stranded };
-            nonce = retryNonce;
-            reportPath = join(dir, `test-manifest-report-${nonce}.json`);
-            const retryCommand = singleForkRetryCommand(opts.retryBaseCommand ?? cmd, cwd, stranded, files.filter(f => !stranded.includes(f)));
-            const listed = await discoverTestManifest(retryCommand, cwd, { dir, nonce, env,
-                overallCeilingMs: opts.overallCeilingMs, evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir } });
-            evidenceReceipts.push(...listed.evidenceReceipts);
-            if (listed.files.length !== stranded.length || listed.files.some(f => !stranded.includes(f)))
-                throw new Error("single fork retry discovery does not match the stranded set");
-            writeFileSync(join(dir, `test-manifest-expected-${nonce}.json`), JSON.stringify({ nonce, files: stranded,
-                firstNonce: recovery.firstNonce, listingCommand: listed.listing, verification }, null, 2) + "\n");
-            spawnedCommand = `${retryCommand}${listed.separator} --reporter=${shq(reporterPath)} --outputFile=${shq(reportPath)}`;
-            invoked = await runManifestedTest(spawnedCommand, cwd, {
-                evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir }, manifest: stranded, nonce, reportPath, env,
-                baselineDurations: opts.baselineDurations?.map(d => ({ ...d, file: toManifestPath(d.file, cwd) })),
-                longestFile: opts.longestFile, overallCeilingMs: opts.overallCeilingMs ?? DEFAULT_FILE_HANG_BUDGET_MS, pollMs: 20,
-            });
-            evidenceReceipts.push(...invoked.evidenceReceipts);
-            interruptions.push(...invoked.interruptions);
-            verdict = verifyManifestReport({ manifest: stranded, nonce, exitCode: invoked.exitCode,
-                report: invoked.report, killedFile: invoked.killedFile, hangBudgetMs: invoked.hangBudgetMs,
-                hangActiveMs: invoked.hangActiveMs, hangWallMs: invoked.hangWallMs });
-            // An all-skipped retry may contribute lifecycle accounting, but only the combined manifest
-            // can establish executed success. Never rewrite either invocation's persisted certificate.
-            if (verdict.pass || verdict.meta.noExecutedModules) {
-                const retry = invoked.report;
-                if (retry.certificate?.errors !== 0 || !Array.isArray(retry.certificate.diagnostics) || retry.certificate.diagnostics.length)
-                    verdict = { kind: "fail-closed", pass: false, details: "single fork retry has unknown or nonempty runner diagnostics", meta: { classification: "infra", infra: true } };
-                else
-                    verdict = verifyManifestReport({ manifest: files, nonce, exitCode: invoked.exitCode, report: {
-                            ...retry, requested: files, started: { ...first.started, ...retry.started }, completed: { ...first.completed, ...retry.completed },
-                        } });
+        return await withVerificationJob(cmd, cwd, reportPath, opts.evidence, async () => {
+            const reporterPath = join(dir, `test-reporter-${nonce}.mjs`);
+            const evidenceReceipts = [];
+            let spawnedCommand = cmd;
+            let manifestPath;
+            let retainedFirstVerdict;
+            let recovery;
+            const { env, verification } = manifestEnvironment(cwd);
+            try {
+                const invocation = await verificationPhase("discovery", `${nonce}-listing`, join(dir, `listing-${nonce}.json`), () => discoverTestManifest(cmd, cwd, { dir, nonce, env, overallCeilingMs: opts.overallCeilingMs, evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir } }));
+                evidenceReceipts.push(...invocation.evidenceReceipts);
+                const files = invocation.files;
+                // R41: the EXPECTED manifest is evidence in its own right — persisted beside the report with the
+                // exact discovery invocation, so a later reader can tell what this invocation was asked to prove
+                // without reconstructing it from the runner's own claims.
+                manifestPath = join(dir, `test-manifest-expected-${nonce}.json`);
+                writeFileSync(manifestPath, JSON.stringify({
+                    nonce, verification, listingCommand: invocation.listing, listingExit: invocation.listingExit,
+                    listingStdoutSha256: createHash("sha256").update(invocation.listingStdout).digest("hex"),
+                    discoveredAt: Date.now(), files,
+                }, null, 2) + "\n");
+                writeFileSync(reporterPath, TEST_REPORTER_SOURCE);
+                spawnedCommand = `${cmd}${invocation.separator} --reporter=${shq(reporterPath)} --outputFile=${shq(reportPath)}`;
+                let invoked = await verificationPhase("first-pass", nonce, reportPath, () => runManifestedTest(spawnedCommand, cwd, {
+                    evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir }, manifest: files, nonce, reportPath, env,
+                    baselineDurations: opts.baselineDurations?.map((d) => ({ ...d, file: toManifestPath(d.file, cwd) })),
+                    longestFile: opts.longestFile,
+                    overallCeilingMs: opts.overallCeilingMs ?? DEFAULT_FILE_HANG_BUDGET_MS,
+                    pollMs: 20,
+                }));
+                let verdict = verifyManifestReport({ manifest: files, nonce, exitCode: invoked.exitCode,
+                    report: invoked.report, killedFile: invoked.killedFile, hangBudgetMs: invoked.hangBudgetMs,
+                    hangActiveMs: invoked.hangActiveMs, hangWallMs: invoked.hangWallMs });
+                evidenceReceipts.push(...invoked.evidenceReceipts);
+                const interruptions = [...invoked.interruptions];
+                const stranded = opts.allowStrandedRecovery === false ? undefined : strandedSingleForkFiles(files, nonce, invoked);
+                if (stranded) {
+                    const first = invoked.report;
+                    if (verdict.kind === "work")
+                        retainedFirstVerdict = verdict;
+                    const retryNonce = randomBytes(16).toString("hex");
+                    recovery = { firstNonce: nonce, firstReportPath: reportPath, retryNonce, files: stranded };
+                    nonce = retryNonce;
+                    reportPath = join(dir, `test-manifest-report-${nonce}.json`);
+                    const retryCommand = singleForkRetryCommand(opts.retryBaseCommand ?? cmd, cwd, stranded, files.filter(f => !stranded.includes(f)));
+                    const listed = await verificationPhase("continuation-discovery", `${nonce}-listing`, join(dir, `listing-${nonce}.json`), () => discoverTestManifest(retryCommand, cwd, { dir, nonce, env,
+                        overallCeilingMs: opts.overallCeilingMs, evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir } }), recovery.firstNonce);
+                    evidenceReceipts.push(...listed.evidenceReceipts);
+                    if (listed.files.length !== stranded.length || listed.files.some(f => !stranded.includes(f)))
+                        throw new Error("single fork retry discovery does not match the stranded set");
+                    writeFileSync(join(dir, `test-manifest-expected-${nonce}.json`), JSON.stringify({ nonce, files: stranded,
+                        firstNonce: recovery.firstNonce, listingCommand: listed.listing, verification }, null, 2) + "\n");
+                    spawnedCommand = `${retryCommand}${listed.separator} --reporter=${shq(reporterPath)} --outputFile=${shq(reportPath)}`;
+                    invoked = await verificationPhase("continuation", nonce, reportPath, () => runManifestedTest(spawnedCommand, cwd, {
+                        evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir }, manifest: stranded, nonce, reportPath, env,
+                        baselineDurations: opts.baselineDurations?.map(d => ({ ...d, file: toManifestPath(d.file, cwd) })),
+                        longestFile: opts.longestFile, overallCeilingMs: opts.overallCeilingMs ?? DEFAULT_FILE_HANG_BUDGET_MS, pollMs: 20,
+                    }), recovery.firstNonce);
+                    evidenceReceipts.push(...invoked.evidenceReceipts);
+                    interruptions.push(...invoked.interruptions);
+                    verdict = verifyManifestReport({ manifest: stranded, nonce, exitCode: invoked.exitCode,
+                        report: invoked.report, killedFile: invoked.killedFile, hangBudgetMs: invoked.hangBudgetMs,
+                        hangActiveMs: invoked.hangActiveMs, hangWallMs: invoked.hangWallMs });
+                    // An all-skipped retry may contribute lifecycle accounting, but only the combined manifest
+                    // can establish executed success. Never rewrite either invocation's persisted certificate.
+                    if (verdict.pass || verdict.meta.noExecutedModules) {
+                        const retry = invoked.report;
+                        if (retry.certificate?.errors !== 0 || !Array.isArray(retry.certificate.diagnostics) || retry.certificate.diagnostics.length)
+                            verdict = { kind: "fail-closed", pass: false, details: "single fork retry has unknown or nonempty runner diagnostics", meta: { classification: "infra", infra: true } };
+                        else
+                            verdict = verifyManifestReport({ manifest: files, nonce, exitCode: invoked.exitCode, report: {
+                                    ...retry, requested: files, started: { ...first.started, ...retry.started }, completed: { ...first.completed, ...retry.completed },
+                                } });
+                    }
+                    const firstFailures = verifyManifestReport({ manifest: files, nonce: recovery.firstNonce, exitCode: 1, report: first });
+                    if (firstFailures.kind === "work")
+                        verdict = { ...firstFailures,
+                            details: `${firstFailures.details}\ncontinuation: ${verdict.details}`,
+                            meta: { ...firstFailures.meta, continuation: verdict.meta,
+                                failingTests: [...new Set([...firstFailures.meta.failingTests, ...(verdict.meta.failingTests ?? [])])],
+                                failingFiles: [...new Set([...firstFailures.meta.failingFiles, ...(verdict.meta.failingFiles ?? [])])],
+                                failureEvidence: [...firstFailures.meta.failureEvidence, ...(verdict.meta.failureEvidence ?? [])] } };
+                    verdict.details = `single fork retry ${nonce} after worker RPC timeout in ${recovery.firstNonce}: ${verdict.details}`;
+                }
+                // Preserve the validator's verdict and classification; runner evidence only explains it.
+                const evidenceReceipt = invoked.evidenceReceipt;
+                const evidenceRoot = opts.evidence?.artifactDir ?? dir;
+                const stdoutPath = join(evidenceRoot, evidenceReceipt.stdout.path);
+                const stderrPath = join(evidenceRoot, evidenceReceipt.stderr.path);
+                const stdoutTail = Buffer.from(redactGateOutput(invoked.stdout, env)).subarray(-16 * 1024);
+                const stderrTail = Buffer.from(redactGateOutput(invoked.stderr, env)).subarray(-16 * 1024);
+                const report = invoked.report?.nonce === nonce ? invoked.report : undefined;
+                const neverStarted = report ? files.filter(file => !(file in report.started)).length : "unknown";
+                const errors = report?.certificate?.errors;
+                const reporterErrors = typeof errors === "number" && Number.isInteger(errors) && errors >= 0 ? errors : "unknown";
+                const reportedDiagnostics = report?.certificate?.diagnostics;
+                const runnerErrors = Array.isArray(reportedDiagnostics) ? reportedDiagnostics.filter(error => typeof error === "string") : [];
+                const diagnostics = !verdict.pass
+                    ? `\nclassification: ${verdict.meta.classification ?? "unknown"}; runner-level diagnostic: never-started ${neverStarted}; reporter errors ${reporterErrors}; runner vitest`
+                        + [...runnerErrors,
+                            stdoutTail.toString(), stderrTail.toString()].filter(Boolean).map(text => `\n${text}`).join("")
+                    : "";
+                // The interruption is reported beside the verdict, never folded into it or into raw wall service.
+                const interrupted = interruptions.length
+                    ? `\nhost interruptions: ${interruptions.map(i => `${i.kind} ${Math.round(i.wallMs)}ms wall / ${Math.round(i.monoMs)}ms monotonic, ${Math.round(i.subtractedMs)}ms subtracted`).join("; ")}`
+                    : "";
+                return { evidenceReceipt, evidenceReceipts, pass: verdict.pass, kind: verdict.kind,
+                    details: verdict.details + interrupted + diagnostics,
+                    classification: verdict.meta.classification,
+                    meta: { ...verdict.meta, nonce, manifest: files, manifestPath, listingCommand: invocation.listing, verification,
+                        ...(recovery ? { recovery, retryable: false } : {}), ...(interruptions.length ? { interruptions } : {}),
+                        spawnedCommand, processExit: invoked.exitCode, pid: invoked.pid, stdoutPath, stderrPath },
+                    exitCode: invoked.exitCode ?? -1, reportPath };
             }
-            verdict.details = `single fork retry ${nonce} after worker RPC timeout in ${recovery.firstNonce}: ${verdict.details}`;
-        }
-        // Preserve the validator's verdict and classification; runner evidence only explains it.
-        const evidenceReceipt = invoked.evidenceReceipt;
-        const evidenceRoot = opts.evidence?.artifactDir ?? dir;
-        const stdoutPath = join(evidenceRoot, evidenceReceipt.stdout.path);
-        const stderrPath = join(evidenceRoot, evidenceReceipt.stderr.path);
-        const stdoutTail = Buffer.from(redactGateOutput(invoked.stdout, env)).subarray(-16 * 1024);
-        const stderrTail = Buffer.from(redactGateOutput(invoked.stderr, env)).subarray(-16 * 1024);
-        const report = invoked.report?.nonce === nonce ? invoked.report : undefined;
-        const neverStarted = report ? files.filter(file => !(file in report.started)).length : "unknown";
-        const errors = report?.certificate?.errors;
-        const reporterErrors = typeof errors === "number" && Number.isInteger(errors) && errors >= 0 ? errors : "unknown";
-        const reportedDiagnostics = report?.certificate?.diagnostics;
-        const runnerErrors = Array.isArray(reportedDiagnostics) ? reportedDiagnostics.filter(error => typeof error === "string") : [];
-        const diagnostics = !verdict.pass
-            ? `\nclassification: ${verdict.meta.classification ?? "unknown"}; runner-level diagnostic: never-started ${neverStarted}; reporter errors ${reporterErrors}; runner vitest`
-                + [...runnerErrors,
-                    stdoutTail.toString(), stderrTail.toString()].filter(Boolean).map(text => `\n${text}`).join("")
-            : "";
-        // The interruption is reported beside the verdict, never folded into it or into raw wall service.
-        const interrupted = interruptions.length
-            ? `\nhost interruptions: ${interruptions.map(i => `${i.kind} ${Math.round(i.wallMs)}ms wall / ${Math.round(i.monoMs)}ms monotonic, ${Math.round(i.subtractedMs)}ms subtracted`).join("; ")}`
-            : "";
-        return { evidenceReceipt, evidenceReceipts, pass: verdict.pass, kind: verdict.kind,
-            details: verdict.details + interrupted + diagnostics,
-            classification: verdict.meta.classification,
-            meta: { ...verdict.meta, nonce, manifest: files, manifestPath, listingCommand: invocation.listing, verification,
-                ...(recovery ? { recovery, retryable: false } : {}), ...(interruptions.length ? { interruptions } : {}),
-                spawnedCommand, processExit: invoked.exitCode, pid: invoked.pid, stdoutPath, stderrPath },
-            exitCode: invoked.exitCode ?? -1, reportPath };
+            catch (error) {
+                const evidenceReceipt = error?.evidenceReceipt;
+                if (evidenceReceipt)
+                    evidenceReceipts.push(...(error.evidenceReceipts ?? [evidenceReceipt]));
+                return { evidenceReceipt, evidenceReceipts, pass: false, kind: retainedFirstVerdict ? "work" : "infra", classification: retainedFirstVerdict ? "regression" : "infra", exitCode: -1, reportPath,
+                    details: (retainedFirstVerdict ? `${retainedFirstVerdict.details}\n` : "") + (recovery ? `single fork retry ${recovery.retryNonce} after ${recovery.firstNonce}: ` : "") + (error instanceof Error ? error.message : String(error)),
+                    meta: { ...(retainedFirstVerdict?.meta ?? { classification: "infra", infra: true }), ...(retainedFirstVerdict ? { firstPass: retainedFirstVerdict.meta } : {}), manifestDiscoveryFailed: true, spawnedCommand, verification,
+                        ...(recovery ? { recovery, retryable: false } : {}), ...(manifestPath ? { manifestPath } : {}) } };
+            }
+        });
     }
     catch (error) {
-        const evidenceReceipt = error?.evidenceReceipt;
-        if (evidenceReceipt)
-            evidenceReceipts.push(...(error.evidenceReceipts ?? [evidenceReceipt]));
-        return { evidenceReceipt, evidenceReceipts, pass: false, kind: "infra", classification: "infra", exitCode: -1, reportPath,
-            details: (recovery ? `single fork retry ${recovery.retryNonce} after ${recovery.firstNonce}: ` : "") + (error instanceof Error ? error.message : String(error)),
-            meta: { classification: "infra", infra: true, manifestDiscoveryFailed: true, spawnedCommand, verification,
-                ...(recovery ? { recovery, retryable: false } : {}), ...(manifestPath ? { manifestPath } : {}) } };
+        const job = error;
+        return { pass: false, kind: "infra", classification: "infra", exitCode: -1, reportPath,
+            details: error instanceof Error ? error.message : String(error),
+            meta: { infra: true, classification: "infra", retryable: false,
+                verificationJobPath: job.verificationJobPath, verificationJob: job.verificationJob } };
     }
 }