tickmarkr 2.7.7 → 2.7.9

package/dist/cli/commands/fleet.js

@@ -1,4 +1,5 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
 import { homedir } from "node:os";
 import { dirname, join, relative } from "node:path";
 import { parseArgs } from "node:util";
@@ -92,6 +93,131 @@ function formatFleetSteering(cfg) {
 // T10: what every review says about where its bytes land and when they take effect
 const REPO_DESTINATION_NOTE = (path) => `destination: the repository overlay ${path} holds this repository's routing.allow/deny membership, so the edit lands there — the file is tracked: Fleet never stages or commits it; commit it to share the change`;
 const FUTURE_LOADS_NOTE = "the save changes future config loads only — a tickmarkr run already in progress keeps the config it loaded";
+// Queue 134: routing.mode, review.prefer, consult.prefer and judge each follow the overlay that holds
+// them. A YAML merge holds one only when that merge supplies it — an unrelated sibling merge does not —
+// and the review refuses a write through a supplying merge (D-987). A scalar alias key is the name it
+// resolves to, at the alias's own line; a parent alias is refused because the writer cannot update
+// through it without replacing its siblings. A merge sequence is shallow and first-source-wins.
+// Membership stays on heldLine.
+const CONTROL_PATH = {
+    "routing.mode": ["routing", "mode"],
+    "review.prefer": ["review", "prefer"],
+    "consult.prefer": ["consult", "prefer"],
+    judge: ["judge"],
+};
+const CONTROL_NAMES = new Set(Object.keys(CONTROL_PATH));
+const { isAlias: yamlIsAlias, isMap: yamlIsMap, isNode: yamlIsNode, isScalar: yamlIsScalar, isSeq: yamlIsSeq, parseDocument: yamlParseDocument, } = createRequire(import.meta.url)("yaml");
+const controlHoldMemo = new Map();
+const controlLineOf = (bytes, offset) => bytes.slice(0, offset).split("\n").length;
+const resolveYaml = (doc, node) => yamlIsAlias(node) ? node.resolve(doc) : node;
+// A plain scalar, or a scalar alias (`*modeKey` resolving to mode). The merge key `<<` is a symbol
+// and is not a name. Callers that report a line keep the key node's own range — the alias as written,
+// never the anchor it points at.
+const scalarKeyName = (doc, key) => {
+    const resolved = resolveYaml(doc, key);
+    if (!yamlIsScalar(resolved) || typeof resolved.value === "symbol" || resolved.value == null)
+        return undefined;
+    return String(resolved.value);
+};
+const namedPair = (doc, map, name) => map.items.find((item) => scalarKeyName(doc, item.key) === name);
+const mergePair = (map) => map.items.find((item) => yamlIsScalar(item.key) && typeof item.key.value === "symbol");
+const mergeShapeOf = (bytes, value) => {
+    const range = yamlIsNode(value) ? value.range : null;
+    const text = range ? bytes.slice(range[0], range[1]).trim().replace(/\s+/g, " ") : "…";
+    return `<<: ${text}`;
+};
+const mergeSources = (doc, value) => {
+    const node = resolveYaml(doc, value);
+    return yamlIsSeq(node) ? node.items.map((item) => resolveYaml(doc, item)) : [node];
+};
+// YAML 1.1 merge: an explicit key wins over `<<`, and a sequence is shallow — the first source that
+// declares a key owns that key whole. A later source's prefer or mode does not survive an earlier
+// source that already declared the parent mapping. `seen` stops a merge that aliases itself.
+const definesKey = (doc, node, key, seen) => {
+    const here = resolveYaml(doc, node);
+    if (!yamlIsMap(here) || seen.has(here))
+        return false;
+    if (namedPair(doc, here, key))
+        return true;
+    const merge = mergePair(here);
+    if (!merge)
+        return false;
+    const next = new Set(seen);
+    next.add(here);
+    return mergeSources(doc, merge.value).some((source) => definesKey(doc, source, key, next));
+};
+const controlSupplied = (doc, node, rest, seen = new Set()) => {
+    const here = resolveYaml(doc, node);
+    if (!yamlIsMap(here) || seen.has(here))
+        return false;
+    if (rest.length === 0)
+        return true;
+    const [head, ...tail] = rest;
+    if (head === undefined)
+        return false;
+    const pair = namedPair(doc, here, head);
+    if (pair) {
+        const value = resolveYaml(doc, pair.value);
+        if (yamlIsScalar(value) && value.value === null)
+            return true;
+        if (tail.length === 0)
+            return true;
+        const next = new Set(seen);
+        next.add(here);
+        return controlSupplied(doc, value, tail, next);
+    }
+    const merge = mergePair(here);
+    if (!merge)
+        return false;
+    const next = new Set(seen);
+    next.add(here);
+    for (const source of mergeSources(doc, merge.value)) {
+        if (!definesKey(doc, source, head, next))
+            continue;
+        return controlSupplied(doc, source, rest, next);
+    }
+    return false;
+};
+/** The repository (or user) overlay holds a control at its own key, at a null mask at it or above, or at a
+ * merge key that supplies it. An explicit key wins over a sibling merge. Parse errors hold nothing. */
+function controlHold(bytes, path) {
+    const key = `${path.join(".")}\0${bytes}`;
+    if (controlHoldMemo.has(key))
+        return controlHoldMemo.get(key);
+    if (controlHoldMemo.size > 256)
+        controlHoldMemo.clear();
+    const doc = yamlParseDocument(bytes);
+    const hold = doc.errors.length ? undefined : walkControl(doc, bytes, doc.contents, path);
+    controlHoldMemo.set(key, hold);
+    return hold;
+}
+function walkControl(doc, bytes, node, rest) {
+    const here = resolveYaml(doc, node);
+    if (!yamlIsMap(here) || rest.length === 0)
+        return undefined;
+    const [head, ...tail] = rest;
+    const pair = head === undefined ? undefined : namedPair(doc, here, head);
+    if (pair) {
+        const range = yamlIsNode(pair.key) ? pair.key.range : null;
+        if (!range)
+            return undefined;
+        const line = controlLineOf(bytes, range[0]);
+        const value = resolveYaml(doc, pair.value);
+        if (yamlIsScalar(value) && value.value === null) {
+            return { line, via: yamlIsAlias(pair.key) && tail.length > 0 ? "alias-parent" : "mask" };
+        }
+        if (tail.length === 0)
+            return { line, via: "declared" };
+        const nested = walkControl(doc, bytes, value, tail);
+        return nested && yamlIsAlias(pair.key) ? { line, via: "alias-parent" } : nested;
+    }
+    const merge = mergePair(here);
+    if (!merge || !yamlIsScalar(merge.key) || !merge.key.range)
+        return undefined;
+    if (!controlSupplied(doc, here, rest))
+        return undefined;
+    return { line: controlLineOf(bytes, merge.key.range[0]), via: "merge", shape: mergeShapeOf(bytes, merge.value) };
+}
 const MODE_GLOSS = {
     "partner-led": "every shape frontier · explore off",
     "risk-based": "risk-tiered default floors",
@@ -224,8 +350,10 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
 export async function assembleFleetEditor(cwd, adapters, io, opts) {
     const globalDir = opts.globalDir;
     // B2: the editor's choices are the operator's MACHINE choices — a save lands in the USER overlay,
-    // which every repository on this machine inherits. T10 (D-925/D-926): except a membership edit the
-    // repository overlay holds — it lands where it is effective (destinationEdits below).
+    // which every repository on this machine inherits. T10 (D-925/D-926): a membership edit and a
+    // routing.mode, review.prefer, consult.prefer or judge edit each land in the overlay that holds
+    // them (destinationEdits below) — the repository overlay when it declares the key or masks it
+    // with null at it or above, else the user overlay.
     const userPath = join(globalDir, "config.yaml");
     const repoPath = repoOverlayPath(cwd);
     const currentUserText = () => (existsSync(userPath) ? readFileSync(userPath, "utf8") : "");
@@ -552,11 +680,12 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     const home = homedir();
     const shown = (path) => (path.startsWith(`${home}/`) ? `~${path.slice(home.length)}` : path);
     const holderOf = (dotted) => {
-        const path = dotted.split(".");
-        const repoLine = heldLine(currentRepoOverlayText(cwd), path);
+        const control = dotted in CONTROL_PATH ? CONTROL_PATH[dotted] : undefined;
+        const lineIn = (text) => control ? controlHold(text, control)?.line : heldLine(text, dotted.split("."));
+        const repoLine = lineIn(currentRepoOverlayText(cwd));
         if (repoLine !== undefined)
             return `${relative(cwd, repoPath)}:${repoLine}`;
-        const userLine = heldLine(currentUserText(), path);
+        const userLine = lineIn(currentUserText());
         return userLine === undefined ? undefined : `${shown(userPath)}:${userLine}`;
     };
     // the allow + flat-deny family is ONE coupled write (the allow form is
@@ -615,7 +744,14 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         }
         if (JSON.stringify(initial.efforts ?? {}) !== JSON.stringify(staged.efforts ?? {}))
             edits.push({ name: "model efforts", destination: "user" });
-        return [...edits, ...controls.map((name) => ({ name, destination: "user" }))];
+        // a control lands where it is held. A merge that supplies it is still the repository (the review
+        // then refuses the write); review.prefer and consult.prefer are two edits, never one
+        const controlDestination = (name) => {
+            if (!(name in CONTROL_PATH))
+                return "user";
+            return controlHold(currentRepoOverlayText(cwd), CONTROL_PATH[name]) !== undefined ? "repo" : "user";
+        };
+        return [...edits, ...controls.map((name) => ({ name, destination: controlDestination(name) }))];
     };
     // ONE review confirms ONE destination; a batch needing both is refused before any write (no
     // multi-file transaction) and names what to save in separate sessions
@@ -800,8 +936,8 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             parts.push(`${unroutable} unroutable`);
         return `  mix: ${mix} — ${parts.join(" · ")}`;
     };
-    // B2: the floors the candidate user-layer bytes resolve to — the same config the routed mix ranks
-    // against, so a repo-declared mode that shadows the user's pick previews no floor change
+    // Floors come from the candidate the chosen destination would load. A routing.mode the repository
+    // holds is previewed there, so those floors move; an unheld mode is previewed in the user overlay.
     const floorPreview = (mode, map, deny, stage) => {
         if (mode === rm.mode.mode)
             return [];
@@ -818,9 +954,9 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
                 : ["    (no floor changes)"]),
         ];
     };
-    // B2: `resolution` is the candidate user-layer bytes' own mode resolution — a repo-declared mode that
-    // shadows the user's pick keeps its provenance, never an operator pin the loader would not apply
-    // B2: `entry` is the slot the candidate's loader applies — a staged slot a repo declaration shadows
+    // `resolution` is the candidate destination's mode. A routing.mode the repository holds is written
+    // into that preview, so a changed mode pins the floors the loader will apply.
+    // `entry` is the slot the candidate's loader applies — a staged slot a repo declaration shadows
     // is no operator pin here; the repo's winning declaration keeps its provenance
     const whyDeclaration = (shape, resolution, entry, mapProducedValue) => {
         const mapChanged = JSON.stringify(mapSlot(entry)) !== JSON.stringify(mapSlot(editable.map[shape]));
@@ -1154,7 +1290,9 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         // the diff and asks for confirmation, but owns neither filesystem access nor a writer.
         // B2: defaults/user/repo are re-read here, at review. T10: so is the destination.
         const modeChanged = state.selectedMode !== rm.mode.mode;
-        const steeringChanged = ["review", "consult"].some((key) => JSON.stringify(state.steering[key]) !== JSON.stringify(initialSteering[key]));
+        const reviewChanged = JSON.stringify(state.steering.review) !== JSON.stringify(initialSteering.review);
+        const consultChanged = JSON.stringify(state.steering.consult) !== JSON.stringify(initialSteering.consult);
+        const steeringChanged = reviewChanged || consultChanged;
         const judgeSeat = state.judgeSeat;
         const judgeChanged = judgeSeat !== undefined
             && `${judgeSeat.adapter}:${judgeSeat.model}` !== initialJudge;
@@ -1162,11 +1300,14 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             pendingWrite = null;
             return { kind: "empty" };
         }
-        const chosen = chooseDestination(destinationEdits(staged, metadata.seeds, [
+        const controlNames = [
             ...(modeChanged ? ["routing.mode"] : []),
-            ...(steeringChanged ? ["review/consult prefer"] : []),
+            ...(reviewChanged ? ["review.prefer"] : []),
+            ...(consultChanged ? ["consult.prefer"] : []),
             ...(judgeChanged ? ["judge"] : []),
-        ]));
+        ];
+        const edits = destinationEdits(staged, metadata.seeds, controlNames);
+        const chosen = chooseDestination(edits);
         if (!chosen.ok) {
             pendingWrite = null;
             return { kind: "refused", reason: chosen.reason };
@@ -1174,6 +1315,43 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         const destination = chosen.destination;
         const user = currentUserText();
         const repo = currentRepoOverlayText(cwd);
+        // A merge that supplies a control or an alias used as its parent is a holder, but the writer
+        // cannot update through either key. Refuse before any bytes change, naming the key's own line.
+        if (destination === "repo") {
+            const refusals = edits.flatMap((edit) => {
+                if (!(edit.name in CONTROL_PATH))
+                    return [];
+                const hold = controlHold(repo, CONTROL_PATH[edit.name]);
+                if (hold?.via === "merge") {
+                    const shape = hold.shape ?? "<<: …";
+                    return [`${edit.name} takes keys through the YAML merge key \`${shape}\` at ${holderOf(edit.name)} — Fleet does not write through merge keys; inline the merged keys there by hand, then save again`];
+                }
+                if (hold?.via === "alias-parent") {
+                    return [`${edit.name} takes keys through a YAML alias parent key at ${holderOf(edit.name)} — Fleet does not write through alias parent keys; replace that key with its scalar name, then save again`];
+                }
+                return [];
+            });
+            if (refusals.length) {
+                pendingWrite = null;
+                return { kind: "refused", reason: refusals.join("; ") };
+            }
+        }
+        // clearing a repository-held prefer writes an explicit empty sequence, so a lower user list cannot
+        // reappear. A user-held or unheld clear stays undefined and the writer deletes the key, as before.
+        const steeringEdited = { ...state.steering };
+        if (destination === "repo") {
+            for (const key of ["review", "consult"]) {
+                if (JSON.stringify(steeringEdited[key]) === JSON.stringify(initialSteering[key]))
+                    continue;
+                const chain = steeringEdited[key];
+                if (chain != null && chain.length > 0)
+                    continue;
+                const name = `${key}.prefer`;
+                const hold = controlHold(repo, CONTROL_PATH[name]);
+                if (hold !== undefined && hold.via !== "merge")
+                    steeringEdited[key] = [];
+            }
+        }
         const before = destination === "repo" ? repo : user;
         const path = pathOf(destination);
         const lower = lowerLayers(destination);
@@ -1186,7 +1364,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
                 lowerOverrides: lowerOverrides[destination],
                 ...(modeChanged ? { mode: state.selectedMode } : {}),
                 ...(judgeChanged && judgeSeat ? { judge: judgeSeat } : {}),
-                steering: { initial: initialSteering, edited: state.steering },
+                steering: { initial: initialSteering, edited: steeringEdited },
             });
             after = renderFleetOverlayWrite(before, write); // T10 (D-987): a merge-key path refuses here
         }
@@ -1211,9 +1389,19 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         catch {
             poolNotes = [];
         }
+        const controlEdits = edits.filter((edit) => CONTROL_NAMES.has(edit.name));
+        const controlNote = controlEdits.length === 0
+            ? undefined
+            : `destination: ${controlEdits.map((edit) => `${edit.name} at ${holderOf(edit.name)}`).join("; ")} — the file is tracked and Fleet never commits it`;
         const notes = [
-            // T10: the review names where the edit lands and what that file is
-            ...(destination === "repo" ? [REPO_DESTINATION_NOTE(repoPath)] : repoShadowNotes(before, after)),
+            // T10: a membership edit keeps the membership destination note. Every repository-destined
+            // control in the same batch is named beside it, path:line from holderOf, file tracked.
+            ...(destination === "repo"
+                ? [
+                    ...(edits.some((edit) => !CONTROL_NAMES.has(edit.name)) ? [REPO_DESTINATION_NOTE(repoPath)] : []),
+                    ...(controlNote ? [controlNote] : []),
+                ]
+                : repoShadowNotes(before, after)),
             FUTURE_LOADS_NOTE,
             ...(lower.ok ? [] : [`${lower.error} — y will be refused`]),
             ...poolNotes,

package/dist/gates/baseline.d.ts

@@ -39,11 +39,11 @@ export type RedactionCounts = NonNullable<GateEvidenceReceipt["redaction"]["coun
  * span counted once under its highest-priority member — token, assignment, secret environment, benign
  * HOME/TMPDIR — so precedence never depends on which match starts first. Counts only: never a value.
  */
-export declare function classifyGateOutput(text: string, env: NodeJS.ProcessEnv): {
+export declare function classifyGateOutput(text: string, env: NodeJS.ProcessEnv, command?: string, inheritedEnv?: NodeJS.ProcessEnv): {
     text: string;
     counts: RedactionCounts;
 };
-export declare function redactGateOutput(text: string, env: NodeJS.ProcessEnv): string;
+export declare function redactGateOutput(text: string, env: NodeJS.ProcessEnv, command?: string): string;
 /** Material means bytes were withheld; a benign location substitution withholds nothing. */
 export declare const redactionMaterial: (c: RedactionCounts) => boolean;
 /** Resolve a snapshot reference against actual bytes: eviction never fabricates a live artifact. */
@@ -103,6 +103,11 @@ export interface BaselineCommand {
      */
     exitCode?: number;
     fingerprints: string[];
+    /**
+     * S22: `2` when captureBaseline wrote one table-T / layout-L fingerprint per occurrence. Absent on every
+     * earlier and every hand-built entry (LEGACY, compared exactly as 2.7.8 did); any other value is unreadable.
+     */
+    fingerprintVersion?: number;
     missingCommand?: boolean;
     /** Why a capture returned no verdict. */
     invalidCause?: "ceiling-kill" | "resource-exhaustion" | "infra";
@@ -186,16 +191,40 @@ export declare function classifyFailureOutput(output: string): FailureClassifica
 export declare function classifiedFileDurations(entry: BaselineCommand | undefined): BaselineFileDuration[] | null | undefined;
 export declare const UNRECOGNIZED_FAILURE = "<unrecognized failure output>";
 export declare function fingerprint(output: string): string[];
-/**
- * Q121s: the battery's forgiveness math, exported so tip-verify applies the IDENTICAL rule.
- * Returns the failure fingerprints of `raw` that are NOT in the baseline entry (fresh), and
- * whether the output carried no recognizable failure shape at all.
- */
-export declare function freshFailures(entry: BaselineCommand | undefined, raw: string): {
+/** Which reading of a baseline entry decided forgiveness (S22). Only `legacy` and `v2` carry a forgivable verdict. */
+export type BaselineEntryState = "missing" | "unreadable" | "legacy" | "v2" | "no-verdict";
+export interface FreshFailureVerdict {
+    /** Fresh failure identities, each once. */
     failing: string[];
+    /** The output carried no recognizable failure shape at all. */
     unreadable: boolean;
+    /** Baseline-recorded identities this output repeated, each once. */
     forgiven: string[];
-};
+    /** The ORIGINAL runner lines behind the fresh identities: classification, host-starved and diagnostics read these, never the keys. */
+    failingLines: string[];
+    state: BaselineEntryState;
+    /** Why an `unreadable` entry could not be read. */
+    why?: string;
+    /** The one shared forgiveness decision both readers extend: the entry recorded a red VERDICT. */
+    baselineRed: boolean;
+}
+/** The red reason a missing or unreadable entry owes in BOTH readers; undefined for every other state. */
+export declare function baselineEntryRefusal(gate: string, verdict: Pick<FreshFailureVerdict, "state" | "why">): string | undefined;
+/**
+ * Q121s / S22: the battery's forgiveness math, exported so tip verify applies the IDENTICAL rule, and
+ * the one place an entry's state is decided — each reader renders its reason, neither re-derives it.
+ *
+ * A LEGACY entry (no fingerprintVersion) compares exactly as 2.7.8 did: set membership over lines whose
+ * every digit run is masked. A v2 entry is a MULTISET under two closed grammars (ANL-021 S22):
+ * - table T: only whole tokens of a closed volatile shape (durations, numbers, positions, ratios, ISO
+ *   times, key=number, hex addresses) lose their digits; every other token keeps them. Declared cost: a
+ *   volatile token outside T stays verbatim, so its change reads fresh (a closed false red, not a defect).
+ * - layout L: a stylish error row is keyed by its stream label and the header layout L proves (blank or
+ *   nothing before it, rows right after it). Declared costs: a row outside every proven block is never
+ *   forgiven, and a header printed under a realpath variant of the cwd compares as a different header.
+ * f is fresh when the candidate repeats it more often than the capture recorded it.
+ */
+export declare function freshFailures(entry: BaselineCommand | undefined, raw: string): FreshFailureVerdict;
 export type PackageManager = "npm" | "pnpm" | "yarn" | "bun";
 /**
  * Operator directive 2026-08-12 (D-OBS-10): tickmarkr is package-manager agnostic.

package/dist/gates/baseline.js

@@ -14,21 +14,44 @@ export const EVIDENCE_RUN_QUOTA_BYTES = DEFAULT_EVIDENCE_QUOTA_BYTES;
 /** Benign environment locations substituted by name; every other redaction is material. */
 const BENIGN_ENV_KEYS = ["HOME", "TMPDIR"];
 const REDACTION_CATEGORIES = ["token", "assignment", "secretEnv", "benignEnv"];
+/** Keep inherited, evidence, and inline values as separate pairs, including overridden values. */
+function gateEvidencePairs(env, command, inheritedEnv) {
+    const pairs = [...Object.entries(inheritedEnv), ...Object.entries(env)]
+        .filter((entry) => entry[1] !== undefined);
+    for (const match of command.matchAll(/(?:^|\s)([A-Za-z_][A-Za-z_0-9]*)=(?:'([^']*)'|"([^"$]*)"|([^\s;&|]+))/g)) {
+        pairs.push([match[1], match[2] ?? match[3] ?? match[4]]);
+    }
+    return pairs;
+}
 /**
  * OBS-1139: every category scans the ORIGINAL text on its own; overlapping spans then merge into one
  * span counted once under its highest-priority member — token, assignment, secret environment, benign
  * HOME/TMPDIR — so precedence never depends on which match starts first. Counts only: never a value.
  */
-export function classifyGateOutput(text, env) {
-    // HOME/TMPDIR substitute by name at any length; "/" alone would rewrite every path separator.
-    const benign = BENIGN_ENV_KEYS.flatMap(key => { const value = env[key]; return value && value.length > 1 ? [{ value, label: `$${key}` }] : []; });
-    // Short operational values (0, true, vi, test) occur throughout ordinary diagnostics.
-    // Only secret-named keys justify redacting short values. A secret-named value that happens to equal
-    // HOME/TMPDIR stays a secret candidate: precedence decides the span, never candidate pruning.
-    const secrets = [...new Set(Object.entries(env)
-            .filter(([key, value]) => !!value && !BENIGN_ENV_KEYS.includes(key)
-            && (value.length >= 8 || /KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH/i.test(key)))
-            .map(([, value]) => value))];
+export function classifyGateOutput(text, env, command = "", inheritedEnv = process.env) {
+    const benign = [];
+    const secrets = new Set();
+    // Closed pair rule, first match wins: HOME/TMPDIR is benign when longer than one; empty is nothing;
+    // length >= 8 is secret; a secret name with a flag literal (0, 1, true, false, yes, no, on, off)
+    // or all ASCII digits is nothing; another short secret-named value is secret; other short values
+    // are nothing. Cost: short all-digit secrets and flag literals are no longer withheld. Span
+    // precedence still makes a secret equal to HOME/TMPDIR win over the benign location label.
+    for (const [name, value] of gateEvidencePairs(env, command, inheritedEnv)) {
+        if (BENIGN_ENV_KEYS.includes(name)) {
+            if (value.length > 1)
+                benign.push({ value, label: `$${name}` });
+        }
+        else if (!value) {
+            continue;
+        }
+        else if (value.length >= 8) {
+            secrets.add(value);
+        }
+        else if (/KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH/i.test(name)
+            && !/^(?:0|1|true|false|yes|no|on|off)$/i.test(value) && !/^[0-9]+$/.test(value)) {
+            secrets.add(value);
+        }
+    }
     const literal = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const tokens = String.raw `\b(?:sk-[A-Za-z0-9_-]{12,}|gh[pousr]_[A-Za-z0-9_]{16,}|github_pat_[A-Za-z0-9_]{16,}|AKIA[A-Z0-9]{16}|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)\b`;
     const assignments = String.raw `(?:authorization\s*:\s*bearer|(?:api[_-]?key|token|password|secret)\s*[:=])\s*[^\s"']+`;
@@ -37,7 +60,7 @@ export function classifyGateOutput(text, env) {
     const scan = (source, rank, label) => [...text.matchAll(new RegExp(source, "gi"))].map(m => ({ start: m.index, end: m.index + m[0].length, rank, label }));
     const spans = [
         ...scan(tokens, 0), ...scan(assignments, 1),
-        ...secrets.flatMap(v => scan(literal(v), 2)),
+        ...[...secrets].flatMap(v => scan(literal(v), 2)),
         ...benign.flatMap(b => scan(literal(b.value), 3, b.label)),
     ].sort((a, b) => a.start - b.start || b.end - a.end);
     const merged = [];
@@ -64,8 +87,8 @@ export function classifyGateOutput(text, env) {
     }
     return { text: out + text.slice(at), counts };
 }
-export function redactGateOutput(text, env) {
-    return classifyGateOutput(text, env).text;
+export function redactGateOutput(text, env, command = "") {
+    return classifyGateOutput(text, env, command).text;
 }
 /** Material means bytes were withheld; a benign location substitution withholds nothing. */
 export const redactionMaterial = (c) => c.token + c.assignment + c.secretEnv > 0;
@@ -103,10 +126,8 @@ export function beginGateEvidence(cwd, gate, command, opts = {}, nonce) {
         catch { /* unknown subject */ }
     }
     const root = opts.artifactDir ?? join(tmpdir(), "tickmarkr-gate-evidence", createHash("sha256").update(cwd).digest("hex"));
-    const env = { ...process.env, ...opts.env };
-    for (const match of command.matchAll(/(?:^|\s)[A-Za-z_][A-Za-z_0-9]*=(?:'([^']*)'|"([^"$]*)"|([^\s;&|]+))/g)) {
-        env[`assignment_${match.index}`] = match[1] ?? match[2] ?? match[3];
-    }
+    const inheritedEnv = { ...process.env };
+    const evidenceEnv = { ...opts.env };
     let observed;
     let pendingId;
     const history = [];
@@ -131,7 +152,7 @@ export function beginGateEvidence(cwd, gate, command, opts = {}, nonce) {
                 exitCode: observed?.exitCode ?? null, signal: observed?.signal ?? null,
                 timedOut: observed ? observed.outcome === "timed-out" : null,
             };
-            const classified = [classifyGateOutput(stdout, env), classifyGateOutput(stderr, env)];
+            const classified = [classifyGateOutput(stdout, evidenceEnv, command, inheritedEnv), classifyGateOutput(stderr, evidenceEnv, command, inheritedEnv)];
             const clean = classified.map(c => c.text);
             const counts = { token: 0, assignment: 0, secretEnv: 0, benignEnv: 0 };
             for (const c of classified)
@@ -494,6 +515,102 @@ export function fingerprint(output) {
         return lines.some((l) => l.trim()) ? [UNRECOGNIZED_FAILURE] : [];
     return [...new Set(shaped.map(normalizeLine))];
 }
+// S22 table T (ANL-021): the ONLY whole-token shapes whose digits a v2 fingerprint canonicalizes, first
+// match wins. Every other token keeps its digits verbatim — TestParse1, TS2304, 1ms.js, my/no-1ms-timeout.
+const T4_PATH_POSITION_RE = /^(.*[^\d:])((?::\d+){1,2})$/;
+const T5_TSC_POSITION_RE = /^(.*)\((\d+),(\d+)\)$/;
+const TABLE_T = [
+    [/^(?:\d+h)?(?:\d+m(?!s))?(?:\d*\.)?\d+(?:ns|ps|us|µs|μs|ms|s|m|h)$/, () => "<dur>"], // T1 duration
+    [/^[+-]?(?:\d+(?:\.\d+)?|\.\d+)(?:[eE][+-]?\d+)?%?$/, () => "#"], // T2 number
+    [/^\d+(?:[:.]\d+)+$/, (m) => m[0].replace(/\d+/g, "#")], // T3 position, clock, version
+    [T4_PATH_POSITION_RE, (m) => m[1] + m[2].replace(/\d+/g, "#")], // T4 path with position
+    [T5_TSC_POSITION_RE, (m) => `${m[1]}(#,#)`], // T5 tsc position
+    [/^\d+\/\d+$/, () => "#/#"], // T6 ratio
+    [/^\d{4}-\d{2}-\d{2}(?:[T ]?\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?)?(?:Z|[+-]\d{2}:?\d{2})?$/, () => "<time>"], // T7 ISO date-time
+    [/^([A-Za-z_][\w.-]*)=([+-]?\d+(?:\.\d+)?)$/, (m) => `${m[1]}=#`], // T8 key=number
+    [/^0x[0-9a-fA-F]+$/, () => "0x#"], // T9 hex address
+];
+const canonical = (core, rows) => {
+    for (const [re, to] of rows) {
+        const m = re.exec(core);
+        if (m)
+            return to(m);
+    }
+    return undefined;
+};
+const canonicalToken = (token) => {
+    const trail = /[,;:.!?]+$/.exec(token)?.[0] ?? "";
+    const rest = token.slice(0, token.length - trail.length);
+    const positioned = canonical(rest, [TABLE_T[4], TABLE_T[3]]);
+    if (positioned !== undefined)
+        return positioned + trail;
+    const lead = /^[([{"']/.exec(rest)?.[0] ?? "";
+    const close = /[)\]}"']+$/.exec(rest.slice(lead.length))?.[0] ?? "";
+    const core = rest.slice(lead.length, rest.length - close.length);
+    const out = canonical(core, TABLE_T);
+    return out === undefined ? token : lead + out + close + trail;
+};
+/** A v2 line: every whitespace token canonicalized by table T, joined with one space. */
+const normalizeV2 = (l) => l.split(/\s+/).filter(Boolean).map(canonicalToken).join(" ");
+// S22 layout L: when a stylish header is PROVEN for an error row. A stream is keyed by its turbo-style
+// label (CONTENT keeps the runner's own indentation, unlike TURBO_PREFIX_RE); unlabelled output is one stream.
+const L_LABEL_RE = /^([\w@./-]+(?::[A-Za-z_][\w.-]*)+):(?: |$)/;
+const L_ROW_RE = /^\s+\d+:\d+\s+(?:error|warning)\s+\S/;
+const splitLabel = (l) => {
+    const m = L_LABEL_RE.exec(l);
+    return m ? { label: m[1], content: l.slice(m[0].length) } : { label: "", content: l };
+};
+/** Line index → proven header of every ROW inside a BLOCK (a header plus the maximal run of rows after it). */
+function stylishHeaders(lines) {
+    const streams = new Map();
+    lines.forEach((line, index) => {
+        const { label, content } = splitLabel(line);
+        const stream = streams.get(label) ?? [];
+        stream.push({ index, content });
+        streams.set(label, stream);
+    });
+    const headers = new Map();
+    for (const stream of streams.values()) {
+        stream.forEach(({ content }, i) => {
+            const proven = /^\S/.test(content) && !L_ROW_RE.test(content) && !isFingerprintShaped(content)
+                && (i === 0 || stream[i - 1].content.trim() === "") && L_ROW_RE.test(stream[i + 1]?.content ?? "");
+            for (let j = i + 1; proven && j < stream.length && L_ROW_RE.test(stream[j].content); j++)
+                headers.set(stream[j].index, content);
+        });
+    }
+    return headers;
+}
+/**
+ * S22: one identity per failure OCCURRENCE (never deduplicated), each kept beside the original line it came
+ * from. Same filters as `fingerprint`; a stylish error ROW is emitted once, as its layout-L tuple.
+ */
+function fingerprintOccurrences(output) {
+    const all = withoutVitestEchoBlocks(output).map((l) => l.replace(ANSI_RE, ""));
+    const headers = stylishHeaders(all);
+    const occurrences = [];
+    let printed = false;
+    all.forEach((l, index) => {
+        if (PASS_LINE_RE.test(l) || OPERATOR_LINE_RE.test(l))
+            return;
+        printed ||= l.trim() !== "";
+        const stripped = stripTurboPrefix(l);
+        if (stripped !== undefined && OPERATOR_LINE_RE.test(stripped))
+            return; // OBS-888: operator prose under a turbo prefix
+        const { label, content } = splitLabel(l);
+        if (L_ROW_RE.test(content) && LINTER_ERROR_RE.test(content)) {
+            const header = headers.get(index) ?? null;
+            occurrences.push({ id: JSON.stringify(["stylish", label, header, normalizeV2(content)]), line: l, ...(header === null ? { unattributed: true } : {}) });
+            return;
+        }
+        if (isFingerprintShaped(l))
+            occurrences.push({ id: normalizeV2(l), line: l });
+        if (stripped !== undefined && !PASS_LINE_RE.test(stripped) && isFingerprintShaped(stripped))
+            occurrences.push({ id: normalizeV2(stripped), line: stripped });
+    });
+    if (!occurrences.length && printed)
+        return [{ id: UNRECOGNIZED_FAILURE, line: UNRECOGNIZED_FAILURE }];
+    return occurrences;
+}
 // The diagnostic channel for a runner we cannot read: raw output lines, never fingerprints, never a
 // verdict. They exist so the operator sees SOMETHING when a green command turns red unrecognizably.
 const unrecognizedEvidence = (raw) => raw
@@ -505,23 +622,78 @@ const unrecognizedEvidence = (raw) => raw
 // stored baselines may predate ANSI/pass-marker hardening — renormalize at compare time so existing
 // on-disk baseline.json files stay comparable without recapture (compat invariant, CLAUDE.md)
 const renormalize = (fp) => normalizeLine(fp.replace(ANSI_RE, ""));
+const entryState = (entry) => {
+    if (entry === undefined)
+        return { state: "missing" };
+    if (entry === null || typeof entry !== "object")
+        return { state: "unreadable", why: "entry is not an object" };
+    const version = entry.fingerprintVersion;
+    if (version !== undefined && version !== 2)
+        return { state: "unreadable", why: `fingerprintVersion ${JSON.stringify(version)} is not 2` };
+    const fps = entry.fingerprints;
+    // ponytail: an absent list keeps 2.7.8's `?? []` for legacy entries; a present one must be all strings
+    if ((fps !== undefined || version === 2) && !(Array.isArray(fps) && fps.every((f) => typeof f === "string"))) {
+        return { state: "unreadable", why: "fingerprints is not an array of strings" };
+    }
+    if (entry.infra === true)
+        return { state: "no-verdict" };
+    return { state: version === 2 ? "v2" : "legacy" };
+};
+/** The red reason a missing or unreadable entry owes in BOTH readers; undefined for every other state. */
+export function baselineEntryRefusal(gate, verdict) {
+    if (verdict.state === "missing")
+        return `no baseline entry for ${gate}`;
+    if (verdict.state === "unreadable")
+        return `baseline entry for ${gate} is unreadable (${verdict.why})`;
+    return undefined;
+}
+// OBS-42: diagnostic headings enrich fingerprints but cannot reject on their own.
+const rejects = (f) => !FAIL_ANCHOR_RE.test(f) || f.startsWith("FAIL ");
 /**
- * Q121s: the battery's forgiveness math, exported so tip-verify applies the IDENTICAL rule.
- * Returns the failure fingerprints of `raw` that are NOT in the baseline entry (fresh), and
- * whether the output carried no recognizable failure shape at all.
+ * Q121s / S22: the battery's forgiveness math, exported so tip verify applies the IDENTICAL rule, and
+ * the one place an entry's state is decided — each reader renders its reason, neither re-derives it.
+ *
+ * A LEGACY entry (no fingerprintVersion) compares exactly as 2.7.8 did: set membership over lines whose
+ * every digit run is masked. A v2 entry is a MULTISET under two closed grammars (ANL-021 S22):
+ * - table T: only whole tokens of a closed volatile shape (durations, numbers, positions, ratios, ISO
+ *   times, key=number, hex addresses) lose their digits; every other token keeps them. Declared cost: a
+ *   volatile token outside T stays verbatim, so its change reads fresh (a closed false red, not a defect).
+ * - layout L: a stylish error row is keyed by its stream label and the header layout L proves (blank or
+ *   nothing before it, rows right after it). Declared costs: a row outside every proven block is never
+ *   forgiven, and a header printed under a realpath variant of the cwd compares as a different header.
+ * f is fresh when the candidate repeats it more often than the capture recorded it.
  */
 export function freshFailures(entry, raw) {
+    const { state, why } = entryState(entry);
+    const baselineRed = (state === "legacy" || state === "v2") && (entry.exitCode ?? 1) !== 0;
+    if (state === "v2") {
+        const recorded = new Map();
+        for (const f of entry.fingerprints)
+            recorded.set(f, (recorded.get(f) ?? 0) + 1);
+        const occurrences = fingerprintOccurrences(raw);
+        const seen = new Map();
+        for (const o of occurrences)
+            seen.set(o.id, (seen.get(o.id) ?? 0) + 1);
+        const isFresh = (o) => o.id !== UNRECOGNIZED_FAILURE && rejects(o.id)
+            && (o.unattributed === true || seen.get(o.id) > (recorded.get(o.id) ?? 0));
+        const fresh = occurrences.filter(isFresh);
+        return {
+            failing: [...new Set(fresh.map((o) => o.id))],
+            unreadable: seen.has(UNRECOGNIZED_FAILURE),
+            forgiven: [...new Set(occurrences.filter((o) => o.unattributed !== true && seen.get(o.id) <= (recorded.get(o.id) ?? 0)).map((o) => o.id))],
+            failingLines: fresh.map((o) => o.line),
+            state, baselineRed,
+        };
+    }
     // OBS-534 (T2): an infra-recorded entry is a KILL, not a verdict — whatever fingerprints it carries
     // came from output flushed before the kill, over a suite that never finished. Nothing there is
-    // "pre-existing", so it forgives nothing. The rule lives here rather than in either caller, so the
-    // battery and tip verify inherit it from the one helper they already share.
-    const known = new Set(entry?.infra === true ? [] : (entry?.fingerprints ?? []).map(renormalize));
-    // OBS-42: diagnostic headings enrich fingerprints but cannot invalidate legacy baselines.
+    // "pre-existing", so it forgives nothing; neither does a missing or unreadable entry.
+    const known = new Set(state === "legacy" ? (entry.fingerprints ?? []).map(renormalize) : []);
     const current = fingerprint(raw);
-    const fresh = current.filter((f) => !known.has(f) && (!FAIL_ANCHOR_RE.test(f) || f.startsWith("FAIL ")));
+    const fresh = current.filter((f) => !known.has(f) && rejects(f) && f !== UNRECOGNIZED_FAILURE);
     // OBS-1123: the baseline-recorded half, named so a reader never has to infer it from the fresh half.
-    return { failing: fresh.filter((f) => f !== UNRECOGNIZED_FAILURE), unreadable: current.includes(UNRECOGNIZED_FAILURE),
-        forgiven: current.filter((f) => known.has(f)) };
+    return { failing: fresh, unreadable: current.includes(UNRECOGNIZED_FAILURE),
+        forgiven: current.filter((f) => known.has(f)), failingLines: fresh, state, ...(why ? { why } : {}), baselineRed };
 }
 /**
  * Operator directive 2026-08-12 (D-OBS-10): tickmarkr is package-manager agnostic.
@@ -785,8 +957,9 @@ export async function captureBaseline(cwd, commands, opts = {}) {
             exitCode: runnerVerdict === "green-teardown" ? 0 : r.code,
             ...(runnerVerdict === "green-teardown" ? { teardownFingerprint: true } : {}),
             // a command that exits 0 has no failures to fingerprint — recording any would be a lie the
-            // compare step then has to forgive
-            fingerprints: r.code === 0 || runnerVerdict === "green-teardown" ? [] : fingerprint(raw),
+            // compare step then has to forgive. S22: one v2 identity per occurrence, sorted.
+            fingerprints: r.code === 0 || runnerVerdict === "green-teardown" ? [] : fingerprintOccurrences(raw).map((o) => o.id).sort(),
+            fingerprintVersion: 2,
             missingCommand: missingConfiguredCommand(cmd, r),
             durationMs,
             ...fileTiming(raw, durationMs),
@@ -840,15 +1013,20 @@ export async function detectVacuousOracles(cwd, tasks) {
 // drop a FAIL line that fingerprint-collides with baseline noise). No headline anchors → byte-identical
 // fallback to today's text (non-vitest runners lose nothing). RED-pinned by tests/gates/baseline.test.ts
 // "HYG-08: details headlines the failing test, not the noise".
-function headlineDetails(raw, fresh) {
+function headlineDetails(raw, fresh, freshLines) {
     const headlines = raw
         .split("\n")
         .map((l) => l.replace(ANSI_RE, ""))
         .filter((l) => namesFailureEitherForm(l) || SUMMARY_FAIL_RE.test(l));
+    // S22: the ORIGINAL runner lines behind v2 comparison keys are the diagnostic; the keys are secondary.
+    // A legacy entry's lines ARE its keys, so its details stay byte-identical.
+    const lines = [...new Set(freshLines)].join("\n");
+    const keys = `new failure fingerprints vs baseline (secondary):\n${fresh.join("\n")}`;
+    const same = lines === fresh.join("\n");
     if (!headlines.length)
-        return { details: `new failures vs baseline:\n${fresh.join("\n")}` };
+        return { details: same ? `new failures vs baseline:\n${lines}` : `new failures vs baseline:\n${lines}\n\n${keys}` };
     return {
-        details: `failing tests:\n${headlines.join("\n")}\n\nnew failure fingerprints vs baseline (secondary):\n${fresh.join("\n")}`,
+        details: `failing tests:\n${headlines.join("\n")}\n\n${same ? "" : `new failure lines vs baseline:\n${lines}\n\n`}${keys}`,
         meta: { failingTests: headlines.filter(namesFailureEitherForm) },
     };
 }
@@ -871,6 +1049,8 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
             continue;
         }
         const entry = baseline.commands[name];
+        const entryRead = entryState(entry);
+        const refusal = baselineEntryRefusal(name, entryRead);
         const ceilingMs = effectiveCeilingMs(entry);
         const evidence = beginGateEvidence(cwd, name, cmd, opts.evidence);
         let r;
@@ -902,6 +1082,12 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
         let recoveryBlocked;
         const record = (g) => {
             g = { ...g, evidenceReceipt, evidenceReceipts: [...evidence.history, evidenceReceipt] };
+            // S22: every red that read this command's output names a missing or unreadable entry, once, beside
+            // its own cause (infra, deficit, fresh). A ceiling kill is read before the output and forgives
+            // nothing either way; the tip's kill clause is queue row 19's, so neither reader appends it there.
+            if (!g.pass && refusal && g.meta?.kind !== "ceiling-kill") {
+                g = { ...g, details: g.details.includes(refusal) ? g.details : `${g.details}\n\n${refusal}`, meta: { ...g.meta, baselineEntry: entryRead.state } };
+            }
             if (recoveryBlocked)
                 g = { ...g, meta: { ...g.meta, recoveryBlocked } };
             const withReap = r.reapedGroup ? { ...g, meta: { ...g.meta, reapedGroup: true } } : g;
@@ -977,7 +1163,8 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
         // below rather than reading as a verified green. Raise the ceiling by teaching isFailureShaped
         // that runner's position rule (leading verdict + identifier, or identifier + separator + trailing
         // verdict); loosening back to vocabulary re-opens OBS-278.
-        const { failing, unreadable, forgiven } = freshFailures(entry, raw);
+        const verdict = freshFailures(entry, raw);
+        const { failing, unreadable, forgiven, failingLines, baselineRed } = verdict;
         // OBS-1123: which baseline-recorded fingerprints this verdict carried, and the capture that
         // recorded them. Observational only — nothing below reads it to decide a verdict.
         const provenance = baseline.provenance ? { baselineProvenance: baseline.provenance } : {};
@@ -1004,7 +1191,7 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
         // OBS-896: every fresh failure must be timeout-class, and the suite must take at least twice its
         // own baseline measurement. The first read buys one calm rerun here, never a worker repair.
         if (name === "test" && classification !== "infra" && failing.length && !rerunOf && !opts.infraRerun
-            && hostStarved(failing.join("\n"), r.durationMs ?? 0, entry?.durationMs)) {
+            && hostStarved(failingLines.join("\n"), r.durationMs ?? 0, entry?.durationMs)) {
             const waitedMs = await waitForCalmWindow(executionSignal());
             if (opts.authorizeRetry && !calmWindowReady()) {
                 recoveryBlocked = "calm window unavailable within the existing wait ceiling";
@@ -1021,8 +1208,8 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
             }
         }
         if (classification === "infra") {
-            const evidence = failing.length
-                ? failing.slice(0, 10).join("\n")
+            const evidence = failingLines.length
+                ? failingLines.slice(0, 10).join("\n")
                 : unrecognizedEvidence(raw) || raw.trim().split("\n").slice(0, 10).join("\n");
             record({
                 gate: name,
@@ -1035,17 +1222,19 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
         // OBS-534 (T2): only a recorded VERDICT can be forgiven. A green baseline has no red to forgive,
         // and neither has a capture that was killed at its ceiling — it recorded a cause instead, so it
         // fails closed on the same branch rather than reading as "only pre-existing failures". Legacy
-        // entries with no exitCode keep the `?? 1` red default both readers share (merge.ts:131).
-        const baselineRed = entry?.infra !== true && (entry?.exitCode ?? 1) !== 0;
+        // entries with no exitCode keep the `?? 1` red default both readers share (freshFailures'
+        // baselineRed); S22: a missing or unreadable entry forgives nothing and says so.
         if (!failing.length && !baselineRed) {
             const recordedCause = entry?.invalidCause === "infra"
                 ? "was invalidated by its recorded runner-infrastructure cause"
                 : entry?.invalidCause === "resource-exhaustion" || entry?.invalidatingLines?.length
                     ? `was invalidated by its recorded process/resource-exhaustion cause${entry.invalidatingLines?.[0] ? ` (${entry.invalidatingLines[0]})` : ""}`
                     : "was killed at its ceiling";
-            const closed = entry?.infra === true
-                ? `the baseline capture for this command ${recordedCause} and recorded no verdict, so nothing here is forgivable — it now exits ${r.code} with no recognizable failure lines — failing closed`
-                : `command was green at baseline but now exits ${r.code} with no recognizable failure lines — failing closed`;
+            const closed = refusal
+                ? `exit ${r.code}; ${refusal} — nothing is forgiven, failing closed`
+                : entry?.infra === true
+                    ? `the baseline capture for this command ${recordedCause} and recorded no verdict, so nothing here is forgivable — it now exits ${r.code} with no recognizable failure lines — failing closed`
+                    : `command was green at baseline but now exits ${r.code} with no recognizable failure lines — failing closed`;
             const evidence = unrecognizedEvidence(raw);
             record({
                 gate: name,
@@ -1056,7 +1245,7 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
             continue;
         }
         if (failing.length) {
-            const headlined = headlineDetails(raw, failing);
+            const headlined = headlineDetails(raw, failing, failingLines);
             // A fresh red beside baseline-recorded ones names both halves, so no reader shows the new one as forgiven.
             const meta = { ...headlined.meta, ...(classification ? { classification } : {}),
                 ...(forgiven.length ? { freshFingerprints: failing, forgivenFingerprints: forgiven, ...provenance } : {}) };
@@ -1171,7 +1360,7 @@ export function fileCountDeficit(entry, raw, opts) {
 export function classifyFreshRunnerOutput(entry, raw, code) {
     if (classifyRunnerOutput(raw, code) === "green-teardown")
         return undefined;
-    const { failing } = freshFailures(entry, raw);
-    const verdict = classifyRunnerOutput(failing.length ? failing.join("\n") : raw, code);
+    const { failingLines } = freshFailures(entry, raw);
+    const verdict = classifyRunnerOutput(failingLines.length ? failingLines.join("\n") : raw, code);
     return verdict === "infra" || verdict === "regression" ? verdict : undefined;
 }

package/dist/gates/test-manifest.js

@@ -719,8 +719,8 @@ export async function evaluateManifestedTest(cmd, cwd, opts) {
                 const evidenceRoot = opts.evidence?.artifactDir ?? dir;
                 const stdoutPath = join(evidenceRoot, evidenceReceipt.stdout.path);
                 const stderrPath = join(evidenceRoot, evidenceReceipt.stderr.path);
-                const stdoutTail = Buffer.from(redactGateOutput(invoked.stdout, env)).subarray(-16 * 1024);
-                const stderrTail = Buffer.from(redactGateOutput(invoked.stderr, env)).subarray(-16 * 1024);
+                const stdoutTail = Buffer.from(redactGateOutput(invoked.stdout, env, spawnedCommand)).subarray(-16 * 1024);
+                const stderrTail = Buffer.from(redactGateOutput(invoked.stderr, env, spawnedCommand)).subarray(-16 * 1024);
                 const report = invoked.report?.nonce === nonce ? invoked.report : undefined;
                 const neverStarted = report ? files.filter(file => !(file in report.started)).length : "unknown";
                 const errors = report?.certificate?.errors;

package/dist/run/journal.d.ts

@@ -455,9 +455,9 @@ export declare const TelemetryRowSchema: z.ZodObject<{
     signalBasis: z.ZodOptional<z.ZodEnum<{
         "judge-only": "judge-only";
         skipped: "skipped";
+        legacy: "legacy";
         proved: "proved";
         "review-agree": "review-agree";
-        legacy: "legacy";
         vacuous: "vacuous";
     }>>;
     kind: z.ZodOptional<z.ZodLiteral<"judge">>;

package/dist/run/merge.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { shq } from "../adapters/types.js";
-import { beginGateEvidence, ceilingKillResult, classifyFreshRunnerOutput, classifyRunnerOutput, fileCountDeficit, waitForCalmWindow, effectiveCeilingMs, classifiedFileDurations, fingerprint, freshFailures, } from "../gates/baseline.js";
+import { baselineEntryRefusal, beginGateEvidence, ceilingKillResult, classifyFreshRunnerOutput, classifyRunnerOutput, fileCountDeficit, waitForCalmWindow, effectiveCeilingMs, classifiedFileDurations, fingerprint, freshFailures, } from "../gates/baseline.js";
 import { evaluateManifestedTest, isVitestTestCommand } from "../gates/test-manifest.js";
 import { computeVerificationIdentity, formatReusedDetails, getVerdictStore, getWorktreeTree, resolveStateDir, isInfraResult, } from "../gates/cache.js";
 import { tickmarkrDir } from "../graph/graph.js";
@@ -339,7 +339,10 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
             });
             continue;
         }
-        const { failing, unreadable } = freshFailures(entry, stripped);
+        const verdict = freshFailures(entry, stripped);
+        const { failing, unreadable } = verdict;
+        // S22: a missing or unreadable entry forgives nothing; the red names it rather than a bare exit code.
+        const refusal = baselineEntryRefusal(gate, verdict);
         const deficit = fileCountDeficit(entry, stripped);
         const cause = deficit ? "infra" : classifyFreshRunnerOutput(entry, stripped, r.code);
         const greenTeardown = classifyRunnerOutput(stripped, r.code) === "green-teardown";
@@ -354,7 +357,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
         // fingerprintable yet OBS-42-exempt from rejecting, so `failing` comes back empty, `unreadable`
         // false and the cause reads "regression" — every other guard satisfied, and a real red forgiven
         // against a capture that never finished asking the question.
-        const baselineRed = entry !== undefined && entry.infra !== true && (entry.exitCode ?? 1) !== 0;
+        const baselineRed = verdict.baselineRed;
         // Battery parity on the infra rule too (T9): infrastructure-only output means the runner never
         // completed a suite — nothing was verified, so nothing is forgivable, however familiar its
         // fingerprints. Stricter-than-battery edge kept: unreadable output never forgives.
@@ -382,7 +385,9 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
                             ? `exit ${r.code}; every failure is baseline-recorded, but that capture ran under `
                                 + `${describeCapacity(entry?.capacity)} and this verification ran under ${describeCapacity(r.capacity)} `
                                 + `— forgiveness across a changed capacity is not evidence`
-                            : `exit ${r.code}`)),
+                            : `exit ${r.code}`))
+                // S22: every red here names a missing or unreadable entry beside its own cause, deficit included
+                + (!pass && refusal ? `; ${refusal}` : ""),
             ...(forgiven && !deficit ? { forgiven: true, ...(baseline?.provenance ? { baselineProvenance: baseline.provenance } : {}) } : {}),
             ...(cause ? { cause } : {}),
             ...(pass ? {} : { artifact }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.7.7",
+  "version": "2.7.9",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",
@@ -94,6 +94,7 @@
         "skills/tickmarkr-auto/",
         "skills/tickmarkr-loop/",
         "skills/tickmarkr-overseer/",
+        "scripts/ci/",
         "src/",
         "tests/"
       ]

package/skills/tickmarkr-overseer/SKILL.md

@@ -1601,9 +1601,12 @@ Create specialist seats using `orca terminal create --worktree path:<repo> --com
 
    - **GRADE PUBLIC CI FROM JOB LOGS AT RUN-END ONLY (law 48).** A badge is not the grade, and
      `gh run view --job --log` is empty while the run is in progress. At run-end execute
-     `scripts/grade-ci.sh <run-id> <expected-count> <tag>` and require GREEN from both jobs; its
-     UNREADABLE state is a hard stop, not a green default. Derive the expected glob pathspec count with
-     `git ls-files ':(glob)tests/**/*.test.ts'` (including the `.tsx` sibling where present), never a bare
+     `scripts/grade-ci.sh <run-id> <expected-count> <tag>` and require GREEN from every job of the
+     declared inventory it prints first — serial `test` and `test-macos`, or sharded, per OS, the four
+     `suite <os> k/4` shards, `single-fork <os>` and `aggregate <os>`; a missing, duplicated or unknown
+     job reads UNREADABLE, never a skip. Its UNREADABLE state is a hard stop, not a green default.
+     Derive the expected glob pathspec count with `git ls-files ':(glob)tests/**/*.test.ts'`
+     (including the `.tsx` sibling where present), never a bare
      `tests/**/*.test.ts`: bare `**` is not a git glob (law 49).
 
    - **RE-READ THE REGISTRY BEFORE RULING (law 51).** A successful Release run and the first

package/skills/tickmarkr-overseer/scripts/grade-ci.sh

@@ -1,9 +1,36 @@
 #!/bin/bash
-# grade-ci.sh <run-id> <expected-count> [tag] — grade both public CI jobs from their JOB LOGS.
-# Grade only at run-end. A missing/in-progress/empty log is UNREADABLE, never evidence of green.
+# grade-ci.sh <run-id> <expected-count> [tag] — grade EVERY job of a public CI run's closed inventory from
+# its JOB LOG. Grade only at run-end. A missing/in-progress/empty log is UNREADABLE, never evidence of green.
 # Exit 0 GREEN, 1 RED, 2 UNREADABLE, 3 INFRA_KILLED: a job the GitHub runner shut down or cancelled with
 # no failed or timed-out test (the classifier's class, D-897) — never green, never a pass, only unproven.
 # UNREADABLE dominates a mixed result, then RED: a failure anywhere dominates a kill.
+#
+# Two CLOSED inventories (v2.7.8 T4; the workflow renders these names): serial {test, test-macos}; sharded,
+# for os in ubuntu-latest and macos-latest, `suite <os> k/4` for k 1..4, `single-fork <os>`, `aggregate <os>`.
+# A run holding any sharded name is graded against the sharded inventory, else the serial one. The first
+# line is `INVENTORY form=<serial|sharded> declared=<n> observed=<n>`; each missing, duplicated or unknown
+# name prints `INVENTORY_DEFECT kind=<missing|duplicate|unknown> job=<json-quoted name>` and makes the run
+# UNREADABLE: a job the inventory does not name is never skipped.
+#
+# A verdict line is read only from the log lines whose gh step column equals its declared step, exactly
+# once, else UNREADABLE — a line a test or any other step prints, before or after the real one, never decides:
+#   COUNT_ORACLE <GREEN|RED> expected=<n|UNREADABLE> actual=<n|UNREADABLE>   step `Assert collected test-file count`
+#   COVERAGE_FLOORS verdict=… floors=… failing=…  (T1's final floors line)   step `Recheck coverage floors`
+#   SET_ORACLE verdict=… expected=… actual=… defects=…  (T3's set oracle)     step `Assert collected test-file set`
+# ROLES — the shared classifier (classify-vitest-log.sh) stays the one log verdict:
+#   serial       the base rule (count oracle GREEN at the expected count, the classifier given that count
+#                reading CLEAN or RPC_ONLY, passed+skipped equal to it) AND exactly one COVERAGE_FLOORS
+#                verdict=GREEN, so a dropped floors step reads UNREADABLE.
+#   shard, single-fork
+#                GREEN only on conclusion success whose whole log the classifier, given no count, reads CLEAN
+#                or RPC_ONLY: their wrapper already applied the shard contract in-job.
+#   aggregate    GREEN only on conclusion success with exactly one COVERAGE_FLOORS verdict=GREEN, exactly one
+#                `SET_ORACLE verdict=GREEN expected=N actual=N defects=0`, and the lines of its step
+#                `Merge coverage (one threshold check per OS)` classified CLEAN or RPC_ONLY.
+# Exit annotations: SERIAL keeps the one exception run-ci-vitest.sh grants (a failure explained ONLY by steps
+# that exited exactly 1 on a log of their own the classifier reads RPC_ONLY); any other failing annotation is
+# never GREEN. Shard, single-fork and aggregate admit none — their wrapper applied the exception in-job.
+# INFRA_KILLED is the base rule for every role.
 set -u
 
 run=${1:?run id required}
@@ -14,34 +41,96 @@ repo=${TKR_GRADE_CI_REPO:-alzahrani-khalid/tickmarkr}
 out_dir=${TKR_GRADE_CI_DIR:-${TKR_STATE_DIR:-.tickmarkr}/overseer/diag}
 mkdir -p "$out_dir" || { echo "UNREADABLE: cannot create log directory $out_dir"; exit 2; }
 
+serial_inventory=$'test\ntest-macos'
+sharded_inventory=$(for os in ubuntu-latest macos-latest; do
+  for k in 1 2 3 4; do echo "suite $os $k/4"; done
+  echo "single-fork $os"
+  echo "aggregate $os"
+done)
+COUNT_STEP="Assert collected test-file count"
+FLOORS_STEP="Recheck coverage floors"
+SET_STEP="Assert collected test-file set"
+MERGE_STEP="Merge coverage (one threshold check per OS)"
+COUNT_FORMAT='COUNT_ORACLE (GREEN|RED) expected=([0-9]+|UNREADABLE) actual=([0-9]+|UNREADABLE)'
+FLOORS_FORMAT='COVERAGE_FLOORS verdict=(GREEN|RED|UNREADABLE) floors=([0-9]+|UNREADABLE) failing=([0-9]+|UNREADABLE)'
+SET_FORMAT='SET_ORACLE verdict=(GREEN|RED|UNREADABLE) expected=([0-9]+|UNREADABLE) actual=([0-9]+|UNREADABLE) defects=[0-9]+'
+
 verdict=0
 mark_unreadable() { verdict=2; }
 mark_red() { [ "$verdict" -eq 2 ] || verdict=1; }
 mark_killed() { [ "$verdict" -ne 0 ] || verdict=3; }
 field() { printf '%s\n' "$classified" | sed -n "s/^VITEST_LOG.* $1=\([^ ]*\).*/\1/p"; }
+count() { printf '%s' "$1" | grep -c ''; }
+# json <name> — one JSON string; awk -v decodes gh's @tsv escapes (\t \n \r \\) first
+json() {
+  LC_ALL=C awk -v s="$1" 'BEGIN {
+    for (i = 1; i < 32; i++) esc[sprintf("%c", i)] = sprintf("\\u%04x", i)
+    esc["\""] = "\\\""; esc["\\"] = "\\\\"
+    for (i = 1; i <= length(s); i++) { c = substr(s, i, 1); out = out (c in esc ? esc[c] : c) }
+    print "\"" out "\""
+  }'
+}
+defect() { echo "INVENTORY_DEFECT kind=$1 job=$(json "$2")"; mark_unreadable; }
+# step_log <log> <step> — the job-log lines gh's step column attributes to <step>, as gh printed them
+step_log() { awk -F'\t' -v s="$2" 'NF >= 3 && $2 == s' "$1"; }
+# verdict_line <log> <step> <family> <format> — the ONE <family> line <step> printed, in <format>;
+# else MISSING, MULTIPLE(n) or MALFORMED, each UNREADABLE
+verdict_line() {
+  local lines
+  lines=$(step_log "$1" "$2" | awk -v esc="$(printf '\033')" '{
+    gsub(/\^\[\[[0-9;]*m/, ""); gsub(esc "\\[[0-9;]*m", "")
+    sub(/^[^\t]*\t[^\t]*\t[0-9T:.-]+Z ?/, ""); sub(/[ \t\r]+$/, ""); print
+  }' | grep -E "^$3( |\$)")
+  case $(count "$lines") in
+    0) echo MISSING ;;
+    1) if printf '%s\n' "$lines" | grep -qxE "$4"; then printf '%s\n' "$lines"; else echo MALFORMED; fi ;;
+    *) echo "MULTIPLE($(count "$lines"))" ;;
+  esac
+}
+readable() { case $1 in MISSING|MULTIPLE*|MALFORMED) return 1 ;; esac; }
+floors_green() { printf '%s\n' "$1" | grep -qxE 'COVERAGE_FLOORS verdict=GREEN floors=[0-9]+ failing=0'; }
 
 jobs=$(gh run view "$run" --repo "$repo" --json jobs \
   --jq '.jobs[] | [.databaseId, .name, .status, (.conclusion // "")] | @tsv') \
   || { echo "UNREADABLE: job list"; exit 2; }
-[ -n "$jobs" ] || { echo "UNREADABLE: empty job list"; exit 2; }
+# an empty job list is an inventory like any other: serial, observed=0, every declared job missing
+
+names=$(printf '%s\n' "$jobs" | cut -f2)
+if printf '%s\n' "$names" | grep -qxF -f <(printf '%s\n' "$sharded_inventory"); then
+  form=sharded; declared=$sharded_inventory
+else
+  form=serial; declared=$serial_inventory
+fi
+echo "INVENTORY form=$form declared=$(count "$declared") observed=$(count "$names")"
+while IFS= read -r name; do
+  case $(printf '%s\n' "$names" | grep -cxF -- "$name") in
+    0) defect missing "$name" ;;
+    1) ;;
+    *) defect duplicate "$name" ;;
+  esac
+done <<< "$declared"
+while IFS= read -r name; do
+  printf '%s\n' "$declared" | grep -qxF -- "$name" || defect unknown "$name"
+done < <([ -z "$jobs" ] || printf '%s\n' "$names" | awk '!seen[$0]++')
 
-seen_test=0
-seen_macos=0
-while IFS=$'\t' read -r id name status conclusion; do
+[ -z "$jobs" ] || while IFS=$'\t' read -r id name status conclusion; do
+  # an unknown job has no role to grade: its INVENTORY_DEFECT already made the run UNREADABLE
+  printf '%s\n' "$declared" | grep -qxF -- "$name" || continue
   case "$name" in
-    test) seen_test=1 ;;
-    test-macos) seen_macos=1 ;;
-    *) continue ;;
+    test|test-macos) role=serial ;;
+    suite\ *) role=shard ;;
+    single-fork\ *) role=single-fork ;;
+    *) role=aggregate ;;
   esac
 
-  echo "$name: status=$status conclusion=${conclusion:-none} job=$id"
+  echo "$name: role=$role status=$status conclusion=${conclusion:-none} job=$id"
   if [ "$status" != "completed" ]; then
     echo "$name: UNREADABLE (job has not reached run-end)"
     mark_unreadable
     continue
   fi
 
-  log="$out_dir/CI-$tag-$name.log"
+  log="$out_dir/CI-$tag-$(printf '%s' "$name" | tr -c 'A-Za-z0-9._-' '-').log"
   gh run view --repo "$repo" --job "$id" --log > "$log" 2>/dev/null
   if [ ! -s "$log" ]; then
     echo "$name: UNREADABLE (empty log)"
@@ -49,24 +138,28 @@ while IFS=$'\t' read -r id name status conclusion; do
     continue
   fi
 
-  oracle=$(grep -oE 'COUNT_ORACLE [A-Z]+ expected=[0-9A-Z]+ actual=[0-9A-Z]+' "$log" | tail -1)
   files=$(grep -oE 'Test Files .*' "$log" | sed 's/[[:space:]]*$//')
   # OBS-1184: the log verdict comes from the ONE classifier the public CI wrapper also uses
   # (scripts/run-ci-vitest.sh), so the badge and this grade cannot disagree. Its rules — complete
   # summaries, failed/timed-out tests, coverage-threshold misses, and the RPC-timeout-only exception
   # to "any unhandled error is RED" (OBS-1058) — live in classify-vitest-log.sh, stated once there.
-  # The expected count is the job's declared file contract: both steps' summaries must collect it all.
-  classified=$(bash "$here/classify-vitest-log.sh" "$log" "$expected" 2>&1)
+  # A serial job's expected count is its declared file contract: both steps' summaries must collect it all.
+  # A shard or single-fork job carries no count: its wrapper held it to its plan in-job.
+  if [ "$role" = serial ]; then
+    classified=$(bash "$here/classify-vitest-log.sh" "$log" "$expected" 2>&1)
+  else
+    classified=$(bash "$here/classify-vitest-log.sh" "$log" 2>&1)
+  fi
   log_verdict=$(field verdict)
   passed=$(field passed); skipped=$(field skipped); failed=$(field failed); timedout=$(field timedout)
   unhandled=$(field unhandled); rpc=$(field runner_rpc_timeouts); coverage=$(field coverage_misses)
   kills=$(field runner_kills)
   errors=$(grep -oE '##\[error\].*' "$log" | sort | uniq -c | sed 's/^ *//' | tr '\n' ';')
   # The commands' own outcomes stand, as in the wrapper: GREEN needs a success conclusion with no step
-  # exit annotation, or a failure explained ONLY by steps that exited exactly 1 on a log of their own
-  # (gh's step column) that the classifier calls RPC_ONLY — the one exception run-ci-vitest.sh grants
-  # (a pre-wrapper run concludes failure on it). Any other code (2, a signal's 137), an unexplained
-  # failure, or a cancelled, timed-out or missing conclusion is RED.
+  # exit annotation, or — SERIAL only — a failure explained ONLY by steps that exited exactly 1 on a log
+  # of their own (gh's step column) that the classifier calls RPC_ONLY. Any other code (2, a signal's
+  # 137), any annotation on another role, an unexplained failure, or a cancelled, timed-out or missing
+  # conclusion is RED.
   exits=$(grep -E '##\[error\]Process completed with exit code [0-9]+' "$log")
   case "$conclusion" in
     success) outcome=ok ;;
@@ -76,9 +169,9 @@ while IFS=$'\t' read -r id name status conclusion; do
   if [ -n "$exits" ]; then
     while IFS= read -r exit_line; do
       code=$(printf '%s\n' "$exit_line" | sed -E 's/.*Process completed with exit code ([0-9]+).*/\1/')
-      if [ "$code" != 1 ]; then outcome="exit-$code"; break; fi
+      if [ "$code" != 1 ] || [ "$role" != serial ]; then outcome="exit-$code"; break; fi
       step=$(printf '%s\n' "$exit_line" | awk -F'\t' 'NF >= 3 { print $2 }')
-      awk -F'\t' -v s="$step" 'NF >= 3 && $2 == s' "$log" > "$log.step"
+      step_log "$log" "$step" > "$log.step"
       case $(bash "$here/classify-vitest-log.sh" "$log.step" 2>&1) in
         "VITEST_LOG verdict=RPC_ONLY "*) ;;
         *) outcome="exit-1-not-rpc-only"; break ;;
@@ -86,36 +179,60 @@ while IFS=$'\t' read -r id name status conclusion; do
     done <<< "$exits"
   fi
 
-  echo "$name: oracle=[${oracle:-MISSING}] files=[$(printf '%s' "$files" | tr '\n' '|')] passed=$passed skipped=$skipped failed=$failed timedout=$timedout unhandled=$unhandled runner_rpc_timeouts=$rpc coverage_misses=$coverage runner_kills=${kills:-?} log=[$(field reason)] outcome=[$outcome] errors=[$errors]"
-  # A killed runner skips the count step, so its missing oracle is the kill's, not an unreadable log:
+  oracles=
+  case $role in
+    serial)
+      oracle=$(verdict_line "$log" "$COUNT_STEP" COUNT_ORACLE "$COUNT_FORMAT")
+      floors=$(verdict_line "$log" "$FLOORS_STEP" COVERAGE_FLOORS "$FLOORS_FORMAT")
+      oracles="oracle=[$oracle] floors=[$floors] " ;;
+    aggregate)
+      floors=$(verdict_line "$log" "$FLOORS_STEP" COVERAGE_FLOORS "$FLOORS_FORMAT")
+      set_oracle=$(verdict_line "$log" "$SET_STEP" SET_ORACLE "$SET_FORMAT")
+      step_log "$log" "$MERGE_STEP" > "$log.merge"
+      merge=$(bash "$here/classify-vitest-log.sh" "$log.merge" 2>&1 | sed -n 's/^VITEST_LOG verdict=\([^ ]*\) reason=\([^ ]*\) .*/\1 \2/p')
+      oracles="floors=[$floors] set=[$set_oracle] merge=[$merge] " ;;
+  esac
+
+  echo "$name: ${oracles}files=[$(printf '%s' "$files" | tr '\n' '|')] passed=$passed skipped=$skipped failed=$failed timedout=$timedout unhandled=$unhandled runner_rpc_timeouts=$rpc coverage_misses=$coverage runner_kills=${kills:-?} log=[$(field reason)] outcome=[$outcome] errors=[$errors]"
+  # A killed runner skips the oracle steps, so a missing verdict line is the kill's, not an unreadable log:
   # INFRA_KILLED unless a step's own failing exit or a failed/timed-out test dominates it (then RED).
   if [ "$log_verdict" = INFRA_KILLED ] && [ "${outcome#exit-}" = "$outcome" ]; then
     echo "$name: INFRA_KILLED"
     mark_killed
+    continue
   elif [ "${kills:-0}" -gt 0 ] 2>/dev/null; then
-    echo "$name: RED"
-    mark_red
-  elif [ -z "$oracle" ] || [ -z "$files" ] || [ -z "$log_verdict" ]; then
-    echo "$name: UNREADABLE"
-    mark_unreadable
-  elif [ "$oracle" = "COUNT_ORACLE GREEN expected=$expected actual=$expected" ] \
-       && { [ "$log_verdict" = CLEAN ] || [ "$log_verdict" = RPC_ONLY ]; } && [ "$outcome" = ok ] \
-       && [ $((passed + skipped)) -eq "$expected" ]; then
-    echo "$name: GREEN"
+    grade=RED
+  elif [ -z "$log_verdict" ]; then
+    grade=UNREADABLE
   else
-    echo "$name: RED"
-    mark_red
+    case $log_verdict in CLEAN|RPC_ONLY) log_ok=1 ;; *) log_ok= ;; esac
+    grade=RED
+    case $role in
+      serial)
+        if ! readable "$oracle" || ! readable "$floors" || [ -z "$files" ]; then
+          grade=UNREADABLE
+        elif [ "$oracle" = "COUNT_ORACLE GREEN expected=$expected actual=$expected" ] && floors_green "$floors" \
+             && [ -n "$log_ok" ] && [ "$outcome" = ok ] && [ $((passed + skipped)) -eq "$expected" ]; then
+          grade=GREEN
+        fi ;;
+      shard|single-fork)
+        if [ "$outcome" = ok ] && [ "$conclusion" = success ] && [ -n "$log_ok" ]; then grade=GREEN; fi ;;
+      aggregate)
+        if ! readable "$floors" || ! readable "$set_oracle"; then
+          grade=UNREADABLE
+        elif [ "$outcome" = ok ] && [ "$conclusion" = success ] && floors_green "$floors" \
+             && [ "$set_oracle" = "SET_ORACLE verdict=GREEN expected=$expected actual=$expected defects=0" ] \
+             && { [ "${merge%% *}" = CLEAN ] || [ "${merge%% *}" = RPC_ONLY ]; }; then
+          grade=GREEN
+        fi ;;
+    esac
   fi
+  echo "$name: $grade"
+  case $grade in
+    RED) mark_red ;;
+    UNREADABLE) mark_unreadable ;;
+  esac
 done <<< "$jobs"
 
-if [ "$seen_test" -ne 1 ]; then
-  echo "test: UNREADABLE (job missing from run)"
-  mark_unreadable
-fi
-if [ "$seen_macos" -ne 1 ]; then
-  echo "test-macos: UNREADABLE (job missing from run)"
-  mark_unreadable
-fi
-
 echo "VERDICT rc=$verdict (0=all GREEN 1=RED 2=UNREADABLE 3=INFRA_KILLED)"
 exit "$verdict"