tickmarkr 2.7.8 → 2.8.0

package/dist/gates/run-gates.js

@@ -7,7 +7,7 @@ import { TIER_RANK } from "../config/config.js";
 import { getAdapter } from "../adapters/registry.js";
 import { GATE_NAMES } from "../graph/schema.js";
 import { acceptanceGate } from "./acceptance.js";
-import { classifiedFileDurations, compareToBaseline, effectiveCeilingMs, waitForCalmWindow, calmWindowReady } from "./baseline.js";
+import { classifiedFileDurations, compareToBaseline, effectiveCeilingMs, waitForCalmWindow, calmWindowReady, SIGNAL_EXIT_RE } from "./baseline.js";
 import { evidenceGate } from "./evidence.js";
 import { captureLlmOutput, SeatLaunchError } from "./llm.js";
 import { withLaunchGuard } from "../drivers/orca.js";
@@ -364,30 +364,36 @@ export async function reobserveTestFiles(worktree, testCmd, baseline, files, art
     return r.meta?.recovery === undefined ? r
         : { ...r, pass: false, meta: { ...r.meta, classification: "infra", infra: true, retryable: false, recoveryRefused: true } };
 }
-const SIGNAL_EXIT_RE = /\b(?:SIGTERM|SIGKILL|signal\s+(?:9|15)|exit(?:s|ed|\s+code)?\s+(?:137|143))\b/i;
 const FAILURE_IDENTITY_RE = /\b(?:AssertionError|FAIL\s+\S|Tests?\s+\d+\s+failed|expected\s+.+\s+to\s+)\b/i;
 /** D1: apply the daemon's signal-only rider before either battery cache read or write. Its onGate
  * classification happens after persistence, too late to keep a scripted runner's non-verdict out.
  * Keep named failures as work verdicts and preserve details for failure-policy fingerprinting.
  * A baseline-forgiven "green" whose runner was signal-killed is the same non-verdict: a killed job
- * completed no suite, so forgiveness never publishes or caches it green. The authoritative termination
- * receipt decides, never the verdict text: a signal-terminated job is killed whatever its details say, and
- * a green stands only on a receipt showing a normal exit — a receiptless CACHED one (an older or planted
- * entry) is unavailable proof, so a fresh job measures instead. A fresh row is this invocation's own: every
- * production runner attaches its receipt, and the manifest path's verdict already requires a clean exit
+ * completed no suite. The termination receipt decides first: a signal-terminated job is killed whatever its
+ * details say, and a green stands only on a receipt showing a normal exit — a receiptless CACHED one (an
+ * older or planted entry) is unavailable proof, so a fresh job measures instead. A normal exit 1 can still
+ * be a kill (a wrapper reports its killed worker and exits 1), and a forgiven green's details never carry
+ * the runner's output, so this rider cannot see it: S19m4 — the shared forgiveness decision
+ * (baseline.ts freshFailures) reads kill text beside a forgiven pass itself, turns one into infra that is
+ * never cached, and marks the green it does publish `killTextRead`. A cached forgiven green without that
+ * marker was written by an engine that never read kill text, so it is refused here — a normal exit 1
+ * receipt included — and the job runs again. A fresh row is this invocation's own: every production
+ * runner attaches its receipt, and the manifest path's verdict already requires a clean exit
  * (test-manifest.ts verifyManifestReport). A no-command skip ran nothing and claims none. */
 function classifySignalOnlyTest(g, cached = false) {
     const termination = g.evidenceReceipt?.termination.kind;
     const exitCode = g.evidenceReceipt?.termination.exitCode;
     const killed = termination === "signal" || exitCode === 137 || exitCode === 143 || (!g.pass && SIGNAL_EXIT_RE.test(g.details));
-    const unproven = g.pass && g.meta?.skipped !== true && termination !== "exit" && (cached || termination !== undefined);
+    const killTextUnread = cached && Array.isArray(g.meta?.forgivenFingerprints) && g.meta.killTextRead !== true;
+    const unproven = g.pass && g.meta?.skipped !== true && (killTextUnread || termination !== "exit" && (cached || termination !== undefined));
     if (g.gate !== "test" || g.meta?.infra === true || !(killed || unproven))
         return;
     const named = Array.isArray(g.meta?.failingTests) && g.meta.failingTests.length > 0;
     if (!g.pass && (named || FAILURE_IDENTITY_RE.test(g.details)))
         return;
     g.pass = false;
-    g.meta = { ...g.meta, classification: "infra", infra: true, retryable: false, kind: killed || termination ? "signal-exit" : "no-exit-receipt" };
+    g.meta = { ...g.meta, classification: "infra", infra: true, retryable: false,
+        kind: killed || (termination && termination !== "exit") ? "signal-exit" : termination ? "kill-text-unread" : "no-exit-receipt" };
 }
 /** OBS-1151: a criterion's comparable subject — its canonical text, the task's declared bounds and the
  * operator context. The cited files' blobs are compared separately, over the union of both citations. */
@@ -1193,7 +1199,7 @@ export async function runGates(task, ctx) {
         // details. The v1.1 badReviewers precedent's TIMING can't transfer: its failover lands on the NEXT
         // worker attempt — exactly what this fix forbids; only its meta-carries-channel pattern is mirrored.
         // Straight-line single `if` — NO loop/counter/knob: exactly-once by construction (a knob is a
-        // fail-closed weakening vector); a second garbage verdict fails the gate closed exactly as today.
+        // fail-closed weakening vector); a second garbage verdict fails the gate closed as terminal infra (S23-F11).
         // T6: exclusion mirrors consult reroute semantics — the flaked channel's whole adapter is banned, not
         // just its exact channel key, so an outage window cannot re-select the vendor being routed around.
         // If no other adapter is live, the exclusion degrades to a channel-level reroute within the same
@@ -1226,8 +1232,11 @@ export async function runGates(task, ctx) {
         }
         // OBS-1168(b): the re-routed seat could not launch either — no seat produced a verdict, so this is
         // an infra park over whatever the deterministic gates proved, never a charge against the worker.
-        if (a.meta?.cause === "seat-launch-failed")
+        // S23-F11: the same holds for a retry whose verdict is still unparseable: two seats delivered no readable
+        // verdict, which judges nothing about the worker's diff, so the row is terminal infra, never a charged red.
+        if (a.meta?.cause === "seat-launch-failed" || (a.meta?.judgeRetry !== undefined && a.meta.unparseable === true)) {
             a = { ...a, meta: { ...a.meta, classification: "infra", infra: true, retryable: false } };
+        }
         else if (!cancelled && Array.isArray(a.meta?.judgment))
             a = await adjudicate(a);
         // No dispatch, no key: a deterministic-oracle round writes no `invocations` field rather than an

package/dist/gates/test-manifest.js

@@ -719,8 +719,8 @@ export async function evaluateManifestedTest(cmd, cwd, opts) {
                 const evidenceRoot = opts.evidence?.artifactDir ?? dir;
                 const stdoutPath = join(evidenceRoot, evidenceReceipt.stdout.path);
                 const stderrPath = join(evidenceRoot, evidenceReceipt.stderr.path);
-                const stdoutTail = Buffer.from(redactGateOutput(invoked.stdout, env)).subarray(-16 * 1024);
-                const stderrTail = Buffer.from(redactGateOutput(invoked.stderr, env)).subarray(-16 * 1024);
+                const stdoutTail = Buffer.from(redactGateOutput(invoked.stdout, env, spawnedCommand)).subarray(-16 * 1024);
+                const stderrTail = Buffer.from(redactGateOutput(invoked.stderr, env, spawnedCommand)).subarray(-16 * 1024);
                 const report = invoked.report?.nonce === nonce ? invoked.report : undefined;
                 const neverStarted = report ? files.filter(file => !(file in report.started)).length : "unknown";
                 const errors = report?.certificate?.errors;

package/dist/run/git.d.ts

@@ -154,6 +154,8 @@ export interface ShResult {
     durationMs?: number;
     /** T7: the capacity THIS child ran under, stamped where its environment was built (see `shell`). */
     capacity?: RunCapacity;
+    /** Queue row 142: stdout exactly as the child wrote it, present only when the own-git caller asked for bytes. */
+    stdoutBytes?: Buffer;
 }
 export declare const setSpawnForTests: (fn: typeof spawn) => void;
 export declare const resetSpawnForTests: () => void;
@@ -168,6 +170,8 @@ export interface ShellOptions {
     onReceipt?: (receipt: ShellReceipt) => void;
     /** Called once per invocation (1-based), including each pre-spawn retry. */
     receiptAttribution?: (invocation: number) => CommandReceiptAttribution;
+    /** Queue row 142: also keep stdout as raw bytes (ShResult.stdoutBytes); only shGit's byte readers opt in. */
+    bytes?: boolean;
 }
 /** Shared command seam, including invocation-bound manifested runners. A PAYLOAD entry: its children keep the
  * operator's git config (hooks, fsmonitor) and get no checkout pin — ownership follows the entry, never `login`
@@ -180,7 +184,7 @@ export declare function shell(cmd: string, cwd: string, timeoutMs: number, login
  */
 export type OwnGitOptions = OwnGitCapability;
 export declare function sh(cmd: string, cwd: string, timeoutMs?: number, options?: ShellOptions): Promise<ShResult>;
-export declare function shGit(cmd: string, cwd: string, timeoutMs?: number, own?: OwnGitOptions): Promise<ShResult>;
+export declare function shGit(cmd: string, cwd: string, timeoutMs?: number, own?: OwnGitOptions, options?: Pick<ShellOptions, "bytes">): Promise<ShResult>;
 export declare function shOk(cmd: string, cwd: string): Promise<string>;
 export declare function shGitOk(cmd: string, cwd: string, own?: OwnGitOptions): Promise<string>;
 /**

package/dist/run/git.js

@@ -386,6 +386,7 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation, ownGit)
             throw error;
         }
         let stdout = "", stderr = "";
+        const stdoutChunks = [];
         const stdoutDecoder = new StringDecoder("utf8");
         const stderrDecoder = new StringDecoder("utf8");
         let timedOut = false, reapedGroup = false, done = false, started = false, outputSeen = false;
@@ -419,6 +420,7 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation, ownGit)
                 timedOut,
                 durationMs: Date.now() - startedAt,
                 capacity,
+                ...(options.bytes ? { stdoutBytes: Buffer.concat(stdoutChunks) } : {}),
                 ...(reapedGroup ? { reapedGroup: true } : {}),
                 ...(reapError ? { reapError } : {}),
             });
@@ -485,6 +487,8 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation, ownGit)
         p.stdout.on("data", (d) => {
             if (d.length > 0)
                 outputSeen = true;
+            if (options.bytes)
+                stdoutChunks.push(d);
             stdout += stdoutDecoder.write(d);
         });
         p.stderr.on("data", (d) => {
@@ -576,9 +580,9 @@ export function sh(cmd, cwd, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS, options = {})
 }
 // Git plumbing never needs an operator profile; skip login-shell startup and its side effects.
 // v2.6.8 T2: the explicit OWN-GIT entry — forced inert hooks/fsmonitor and, in a linked checkout, the trusted-path and
-// ref-store pin.
-export function shGit(cmd, cwd, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS, own = {}) {
-    return shellEntry(cmd, cwd, timeoutMs, false, {}, own);
+// ref-store pin. Queue row 142: `bytes` is the one opt-in raw-stdout capture; every other caller's output is unchanged.
+export function shGit(cmd, cwd, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS, own = {}, options = {}) {
+    return shellEntry(cmd, cwd, timeoutMs, false, options, own);
 }
 export async function shOk(cmd, cwd) {
     const r = await sh(cmd, cwd);

package/dist/run/journal.d.ts

@@ -455,9 +455,9 @@ export declare const TelemetryRowSchema: z.ZodObject<{
     signalBasis: z.ZodOptional<z.ZodEnum<{
         "judge-only": "judge-only";
         skipped: "skipped";
+        legacy: "legacy";
         proved: "proved";
         "review-agree": "review-agree";
-        legacy: "legacy";
         vacuous: "vacuous";
     }>>;
     kind: z.ZodOptional<z.ZodLiteral<"judge">>;

package/dist/run/launchservices-check.d.ts

@@ -33,12 +33,34 @@ export type ProbeTimer = (fire: () => void, ms: number) => () => void;
 interface ProbeSeam {
     platform: NodeJS.Platform;
     spawn: typeof spawn;
+    spawnTop?: typeof spawn;
     setTimer: ProbeTimer;
     signal?: AbortSignal;
 }
 export declare const setLaunchServicesProbeForTests: (s: Partial<ProbeSeam>) => void;
 export declare const resetLaunchServicesProbeForTests: () => void;
 export declare function observeLaunchServices(s?: ProbeSeam): Promise<LaunchServicesObservation>;
+export declare const LAUNCHSERVICES_PORT_ADVISORY = 100000;
+export declare const LAUNCHSERVICES_PORT_STOP = 200000;
+export type LaunchServicesPorts = {
+    status: "skipped" | "non-darwin";
+} | {
+    status: "unknown";
+    pid?: number;
+} | {
+    status: "read";
+    pid: number;
+    count: number;
+};
+/** Closed top format: PID COMMAND #PORTS, then the next non-empty row for this pid and launchservicesd. */
+export declare function parseTopPortCount(stdout: string, pid: number): number | null;
+/** One identity read and, only for a readable Darwin identity, one bounded top child. */
+export declare function probeLaunchServicesPorts(options?: {
+    requireTop?: boolean;
+}): Promise<{
+    observation?: LaunchServicesObservation;
+    ports: LaunchServicesPorts;
+}>;
 export declare function launchServicesAdvisory(prior: LaunchServicesIdentity, now: LaunchServicesIdentity): string;
 /** Pure: the table row for one observation against the held record, and the record to hold next. */
 export declare function classifyLaunchServices(prior: Partial<LaunchServicesRecord> | undefined, observed: LaunchServicesObservation): {
@@ -48,7 +70,7 @@ export declare function classifyLaunchServices(prior: Partial<LaunchServicesReco
 };
 /** Observe, classify against the first record of `prior`, and hold the result on the first record of `health`.
  *  Returns `health` itself when nothing changed, else a copy — the argument is never mutated. */
-export declare function recordLaunchServices(prior: Record<string, AuthHealth> | null, health: Record<string, AuthHealth>): Promise<{
+export declare function recordLaunchServices(prior: Record<string, AuthHealth> | null, health: Record<string, AuthHealth>, observation?: LaunchServicesObservation): Promise<{
     status: LaunchServicesStatus;
     health: Record<string, AuthHealth>;
     line?: string;

package/dist/run/launchservices-check.js

@@ -27,12 +27,14 @@ export function parsePsIdentity(stdout) {
 const production = () => ({
     platform: process.platform,
     spawn,
+    spawnTop: spawn,
     setTimer: (fire, ms) => { const t = setTimeout(fire, ms); return () => clearTimeout(t); },
 });
 // ponytail: default-off under the test runner (the catalogRefreshAllowed precedent) so an unowned doctor
 // test never takes a real host reading or changes its doctor.json bytes; tests opt in through the seam.
+// The legacy identity-only seam leaves spawnTop unset, so old /bin/ps fixtures never touch the host top.
 let seam;
-export const setLaunchServicesProbeForTests = (s) => { seam = { ...production(), ...s }; };
+export const setLaunchServicesProbeForTests = (s) => { seam = { ...production(), ...s, spawnTop: s.spawnTop }; };
 export const resetLaunchServicesProbeForTests = () => { seam = undefined; };
 const activeSeam = () => seam ?? (process.env.VITEST === "true" ? undefined : production());
 /** One /bin/ps call that owns only its child, killed at the ceiling or on cancellation and reaped before it resolves. */
@@ -78,6 +80,88 @@ function readIdentity(s) {
 export function observeLaunchServices(s = production()) {
     return s.platform === "darwin" ? readIdentity(s) : Promise.resolve({ status: "non-darwin" });
 }
+export const LAUNCHSERVICES_PORT_ADVISORY = 100_000;
+export const LAUNCHSERVICES_PORT_STOP = 200_000;
+const TOP_BYTES = 1024 * 1024;
+/** Closed top format: PID COMMAND #PORTS, then the next non-empty row for this pid and launchservicesd. */
+export function parseTopPortCount(stdout, pid) {
+    const lines = stdout.split(/\r?\n/);
+    const header = lines.findIndex((line) => line.trim().split(/\s+/).join(" ") === "PID COMMAND #PORTS");
+    if (header < 0)
+        return null;
+    const row = lines.slice(header + 1).find((line) => line.trim() !== "");
+    if (!row)
+        return null;
+    const tokens = row.trim().split(/\s+/);
+    if (tokens.length !== 3 || tokens[0] !== String(pid) || tokens[1] !== "launchservicesd" || !/^[0-9]+[+-]?$/.test(tokens[2]))
+        return null;
+    const count = Number(tokens[2].replace(/[+-]$/, ""));
+    return Number.isSafeInteger(count) ? count : null;
+}
+// The captured macOS top layout is closed: only a matching three-token row after the exact header
+// yields a count. 100000 ports is a doctor advisory; 200000 stops standalone verify before gates.
+// Unknown (including an unreadable identity, malformed top output, or a killed child) never stops.
+function readPortCount(s, pid) {
+    return new Promise((resolve) => {
+        const unknown = () => resolve({ status: "unknown", pid });
+        if (s.signal?.aborted) {
+            unknown();
+            return;
+        }
+        if (!s.spawnTop) {
+            unknown();
+            return;
+        }
+        let child;
+        try {
+            child = s.spawnTop("/usr/bin/top", ["-l", "1", "-stats", "pid,command,ports", "-pid", String(pid)], { stdio: ["ignore", "pipe", "ignore"], env: { ...process.env, LC_ALL: "C" } });
+        }
+        catch {
+            unknown();
+            return;
+        }
+        let out = "";
+        let bytes = 0;
+        let failed = false;
+        const retire = () => { if (!failed) {
+            failed = true;
+            child.kill("SIGKILL");
+        } };
+        const clear = s.setTimer(retire, LAUNCHSERVICES_PROBE_CEILING_MS);
+        s.signal?.addEventListener("abort", retire, { once: true });
+        child.stdout?.on("data", (chunk) => {
+            if (failed)
+                return;
+            bytes += chunk.length;
+            if (bytes > TOP_BYTES) {
+                retire();
+                return;
+            }
+            out += chunk.toString("utf8");
+        });
+        child.once("error", () => { failed = true; });
+        child.once("close", (code) => {
+            clear();
+            s.signal?.removeEventListener("abort", retire);
+            if (failed || code !== 0)
+                return unknown();
+            const count = parseTopPortCount(out, pid);
+            return count === null ? unknown() : resolve({ status: "read", pid, count });
+        });
+    });
+}
+/** One identity read and, only for a readable Darwin identity, one bounded top child. */
+export async function probeLaunchServicesPorts(options = {}) {
+    const s = activeSeam();
+    if (!s || (options.requireTop && !s.spawnTop))
+        return { ports: { status: "skipped" } };
+    const observation = await observeLaunchServices(s);
+    if (observation.status === "non-darwin")
+        return { observation, ports: { status: "non-darwin" } };
+    if (observation.status === "unreadable")
+        return { observation, ports: { status: "unknown" } };
+    return { observation, ports: await readPortCount(s, observation.identity.pid) };
+}
 // doctor.json is never schema-validated: a malformed held record is no identity at all.
 const knownPrior = (prior) => typeof prior?.pid === "number" && typeof prior.start === "string";
 export function launchServicesAdvisory(prior, now) {
@@ -106,10 +190,11 @@ export function classifyLaunchServices(prior, observed) {
 }
 /** Observe, classify against the first record of `prior`, and hold the result on the first record of `health`.
  *  Returns `health` itself when nothing changed, else a copy — the argument is never mutated. */
-export async function recordLaunchServices(prior, health) {
+export async function recordLaunchServices(prior, health, observation) {
     const held = prior ? Object.values(prior)[0]?.launchServices : undefined;
     const s = activeSeam();
-    const r = s ? classifyLaunchServices(held, await observeLaunchServices(s)) : { status: "skipped", next: knownPrior(held) ? held : undefined };
+    const r = observation ? classifyLaunchServices(held, observation)
+        : s ? classifyLaunchServices(held, await observeLaunchServices(s)) : { status: "skipped", next: knownPrior(held) ? held : undefined };
     const holder = Object.keys(health)[0];
     if (!holder || !r.next || JSON.stringify(health[holder].launchServices) === JSON.stringify(r.next))
         return { ...r, health };

package/dist/run/merge.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { shq } from "../adapters/types.js";
-import { beginGateEvidence, ceilingKillResult, classifyFreshRunnerOutput, classifyRunnerOutput, fileCountDeficit, waitForCalmWindow, effectiveCeilingMs, classifiedFileDurations, fingerprint, freshFailures, } from "../gates/baseline.js";
+import { baselineEntryRefusal, beginGateEvidence, ceilingKillResult, classifyFreshRunnerOutput, classifyRunnerOutput, fileCountDeficit, waitForCalmWindow, effectiveCeilingMs, classifiedFileDurations, fingerprint, freshFailures, } from "../gates/baseline.js";
 import { evaluateManifestedTest, isVitestTestCommand } from "../gates/test-manifest.js";
 import { computeVerificationIdentity, formatReusedDetails, getVerdictStore, getWorktreeTree, resolveStateDir, isInfraResult, } from "../gates/cache.js";
 import { tickmarkrDir } from "../graph/graph.js";
@@ -216,7 +216,9 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
         // Persistent reuse requires the run's durable journal. Without it there is no
         // recorded cycle provenance to reconcile with the caller's capacity checks.
         const hit = journalFound ? store.get(id) : undefined;
-        if (hit && id && hit.pass && !isInfraResult(hit)) {
+        // S19m4: a forgiven test green written before the tip read kill text never proves the suite completed.
+        const killTextUnread = gate === "test" && hit?.meta?.forgiven === true && hit.meta.killTextRead !== true;
+        if (hit && id && hit.pass && !isInfraResult(hit) && !killTextUnread) {
             results.push({
                 gate,
                 cmd,
@@ -339,7 +341,10 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
             });
             continue;
         }
-        const { failing, unreadable } = freshFailures(entry, stripped);
+        const verdict = freshFailures(entry, stripped, gate === "test");
+        const { failing, unreadable } = verdict;
+        // S22: a missing or unreadable entry forgives nothing; the red names it rather than a bare exit code.
+        const refusal = baselineEntryRefusal(gate, verdict);
         const deficit = fileCountDeficit(entry, stripped);
         const cause = deficit ? "infra" : classifyFreshRunnerOutput(entry, stripped, r.code);
         const greenTeardown = classifyRunnerOutput(stripped, r.code) === "green-teardown";
@@ -354,7 +359,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
         // fingerprintable yet OBS-42-exempt from rejecting, so `failing` comes back empty, `unreadable`
         // false and the cause reads "regression" — every other guard satisfied, and a real red forgiven
         // against a capture that never finished asking the question.
-        const baselineRed = entry !== undefined && entry.infra !== true && (entry.exitCode ?? 1) !== 0;
+        const baselineRed = verdict.baselineRed;
         // Battery parity on the infra rule too (T9): infrastructure-only output means the runner never
         // completed a suite — nothing was verified, so nothing is forgivable, however familiar its
         // fingerprints. Stricter-than-battery edge kept: unreadable output never forgives.
@@ -363,8 +368,12 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
         // often the previous session's — so a capture taken under a different resolved capacity forgives
         // nothing at the tip either. An absent capacity is a pre-T7 baseline and keeps today's verdict.
         const comparable = sameCapacity(entry?.capacity, r.capacity);
-        const forgiven = r.code !== 0 && baselineRed && failing.length === 0 && !unreadable && cause !== "infra"
+        const forgivable = r.code !== 0 && baselineRed && failing.length === 0 && !unreadable && cause !== "infra"
             && comparable;
+        // S19m4 (battery parity): kill text beside forgivable failures means the suite never completed — red, infra.
+        const killLine = forgivable && !greenTeardown && !deficit ? verdict.killLine : undefined;
+        const forgiven = forgivable && killLine === undefined;
+        const rowCause = killLine !== undefined ? "infra" : cause;
         const pass = !deficit && (r.code === 0 || greenTeardown || forgiven);
         if (!pass)
             writeTipLog(artifact, raw);
@@ -375,16 +384,20 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
             evidenceReceipt, evidenceReceipts,
             exitCode: r.code,
             fingerprints: r.code !== 0 && !greenTeardown ? fingerprint(stripped) : [],
-            details: `${cause === "infra" ? "infra; " : ""}${rerun ? `${rerun}: ` : ""}` + (deficit?.replace(/^infra; /, "") ?? (r.code === 0 ? "exit 0"
+            details: `${rowCause === "infra" ? "infra; " : ""}${rerun ? `${rerun}: ` : ""}` + (deficit?.replace(/^infra; /, "") ?? (r.code === 0 ? "exit 0"
                 : greenTeardown ? `exit ${r.code} after a green suite summary; only the runner's teardown fingerprint followed it`
                     : forgiven ? `exit ${r.code} but only baseline-recorded failures (forgiven vs baseline)`
-                        : !comparable && baselineRed && failing.length === 0
-                            ? `exit ${r.code}; every failure is baseline-recorded, but that capture ran under `
-                                + `${describeCapacity(entry?.capacity)} and this verification ran under ${describeCapacity(r.capacity)} `
-                                + `— forgiveness across a changed capacity is not evidence`
-                            : `exit ${r.code}`)),
+                        : killLine !== undefined ? `exit ${r.code}; every failure is baseline-recorded, but the runner printed kill text — `
+                            + `it never completed a suite, so nothing is forgiven: ${killLine}`
+                            : !comparable && baselineRed && failing.length === 0
+                                ? `exit ${r.code}; every failure is baseline-recorded, but that capture ran under `
+                                    + `${describeCapacity(entry?.capacity)} and this verification ran under ${describeCapacity(r.capacity)} `
+                                    + `— forgiveness across a changed capacity is not evidence`
+                                : `exit ${r.code}`))
+                // S22: every red here names a missing or unreadable entry beside its own cause, deficit included
+                + (!pass && refusal ? `; ${refusal}` : ""),
             ...(forgiven && !deficit ? { forgiven: true, ...(baseline?.provenance ? { baselineProvenance: baseline.provenance } : {}) } : {}),
-            ...(cause ? { cause } : {}),
+            ...(rowCause ? { cause: rowCause } : {}),
             ...(pass ? {} : { artifact }),
         };
         results.push(tipResult);
@@ -403,6 +416,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
         if (id && id.tree === completedTree && !isInfraResult(result)) {
             store.set(id, { ...result, meta: {
                     fingerprints: result.fingerprints, forgiven: result.forgiven, baselineProvenance: result.baselineProvenance,
+                    ...(result.forgiven && result.gate === "test" ? { killTextRead: true } : {}),
                     reportPath: result.reportPath, spawnedCommand: result.spawnedCommand,
                     artifact: result.artifact,
                     evidenceReceipt: result.evidenceReceipt, evidenceReceipts: result.evidenceReceipts,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.7.8",
+  "version": "2.8.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",