tickmarkr 2.7.9 → 2.8.1

package/dist/run/git.d.ts

@@ -154,6 +154,8 @@ export interface ShResult {
     durationMs?: number;
     /** T7: the capacity THIS child ran under, stamped where its environment was built (see `shell`). */
     capacity?: RunCapacity;
+    /** Queue row 142: stdout exactly as the child wrote it, present only when the own-git caller asked for bytes. */
+    stdoutBytes?: Buffer;
 }
 export declare const setSpawnForTests: (fn: typeof spawn) => void;
 export declare const resetSpawnForTests: () => void;
@@ -168,6 +170,8 @@ export interface ShellOptions {
     onReceipt?: (receipt: ShellReceipt) => void;
     /** Called once per invocation (1-based), including each pre-spawn retry. */
     receiptAttribution?: (invocation: number) => CommandReceiptAttribution;
+    /** Queue row 142: also keep stdout as raw bytes (ShResult.stdoutBytes); only shGit's byte readers opt in. */
+    bytes?: boolean;
 }
 /** Shared command seam, including invocation-bound manifested runners. A PAYLOAD entry: its children keep the
  * operator's git config (hooks, fsmonitor) and get no checkout pin — ownership follows the entry, never `login`
@@ -180,7 +184,7 @@ export declare function shell(cmd: string, cwd: string, timeoutMs: number, login
  */
 export type OwnGitOptions = OwnGitCapability;
 export declare function sh(cmd: string, cwd: string, timeoutMs?: number, options?: ShellOptions): Promise<ShResult>;
-export declare function shGit(cmd: string, cwd: string, timeoutMs?: number, own?: OwnGitOptions): Promise<ShResult>;
+export declare function shGit(cmd: string, cwd: string, timeoutMs?: number, own?: OwnGitOptions, options?: Pick<ShellOptions, "bytes">): Promise<ShResult>;
 export declare function shOk(cmd: string, cwd: string): Promise<string>;
 export declare function shGitOk(cmd: string, cwd: string, own?: OwnGitOptions): Promise<string>;
 /**
@@ -194,16 +198,29 @@ export declare function shGitOk(cmd: string, cwd: string, own?: OwnGitOptions):
  * A step raced by a commondir change is refused by name before the next one runs, and what the add created is rolled
  * back through the trusted common directory derived here once (dropWorktree), even while that commondir stays hostile.
  */
-export declare function addDetachedWorktree(cwd: string, dir: string, commitish: string, timeoutMs?: number): Promise<ShResult>;
+export declare function addDetachedWorktree(cwd: string, dir: string, commitish: string, timeoutMs?: number, { logHead }?: {
+    logHead?: boolean | undefined;
+}): Promise<ShResult>;
+/**
+ * 2.8.1 T1 (ANL-023 §7.1): the reflog witness W(dir, ref) — read-only, the newest entry first. It is valid for a commit
+ * x only when the exit is 0, at least one line came back and the first is x: exit 0 with no lines is git's answer for
+ * a missing or unreadable log, so an empty witness is a refusal, never an accepted empty.
+ */
+export declare function reflogWitness(dir: string, ref: string): Promise<{
+    code: number;
+    lines: string[];
+}>;
 export declare function npmDependencyManifestChanged(cwd: string, baselineRef: string): Promise<boolean>;
 export declare function npmDependencyInstallCommand(cwd: string): string;
 export declare function gitHead(cwd: string): Promise<string>;
 export declare const sanitizeBranch: (branch: string) => string;
 export declare const WORKTREES_DIR = "worktrees.noindex";
 export declare const worktreePath: (repo: string, branch: string) => string;
-/** OBS-28: remove this run's recorded worktrees; tolerates already-gone paths. */
+/**
+ * OBS-28: remove this run's recorded task worktrees; tolerates already-gone paths. 2.8.1 T2: a run keeps no
+ * integration checkout, and a 2.8.0 run's legacy one is never removed here (it may hold the only view of a merge).
+ */
 export declare function cleanupRunWorktrees(repo: string, branch: string, opts: {
-    removeIntegration: boolean;
     removeTaskIds: string[];
 }): Promise<void>;
 export declare function resolveIntegrationBranch(_repo: string, branch: string): Promise<string>;

package/dist/run/git.js

@@ -386,6 +386,7 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation, ownGit)
             throw error;
         }
         let stdout = "", stderr = "";
+        const stdoutChunks = [];
         const stdoutDecoder = new StringDecoder("utf8");
         const stderrDecoder = new StringDecoder("utf8");
         let timedOut = false, reapedGroup = false, done = false, started = false, outputSeen = false;
@@ -419,6 +420,7 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation, ownGit)
                 timedOut,
                 durationMs: Date.now() - startedAt,
                 capacity,
+                ...(options.bytes ? { stdoutBytes: Buffer.concat(stdoutChunks) } : {}),
                 ...(reapedGroup ? { reapedGroup: true } : {}),
                 ...(reapError ? { reapError } : {}),
             });
@@ -485,6 +487,8 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation, ownGit)
         p.stdout.on("data", (d) => {
             if (d.length > 0)
                 outputSeen = true;
+            if (options.bytes)
+                stdoutChunks.push(d);
             stdout += stdoutDecoder.write(d);
         });
         p.stderr.on("data", (d) => {
@@ -576,9 +580,9 @@ export function sh(cmd, cwd, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS, options = {})
 }
 // Git plumbing never needs an operator profile; skip login-shell startup and its side effects.
 // v2.6.8 T2: the explicit OWN-GIT entry — forced inert hooks/fsmonitor and, in a linked checkout, the trusted-path and
-// ref-store pin.
-export function shGit(cmd, cwd, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS, own = {}) {
-    return shellEntry(cmd, cwd, timeoutMs, false, {}, own);
+// ref-store pin. Queue row 142: `bytes` is the one opt-in raw-stdout capture; every other caller's output is unchanged.
+export function shGit(cmd, cwd, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS, own = {}, options = {}) {
+    return shellEntry(cmd, cwd, timeoutMs, false, options, own);
 }
 export async function shOk(cmd, cwd) {
     const r = await sh(cmd, cwd);
@@ -603,7 +607,10 @@ export async function shGitOk(cmd, cwd, own = {}) {
  * A step raced by a commondir change is refused by name before the next one runs, and what the add created is rolled
  * back through the trusted common directory derived here once (dropWorktree), even while that commondir stays hostile.
  */
-export async function addDetachedWorktree(cwd, dir, commitish, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS) {
+export async function addDetachedWorktree(cwd, dir, commitish, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS, { logHead = false } = {}) {
+    // 2.8.1 T1 (ANL-023 §7.1): `logHead` writes the new checkout's HEAD reflog whatever the repository's
+    // core.logAllRefUpdates says, so a later HEAD move by any command is appended to an established witness.
+    const git = logHead ? "git -c core.logAllRefUpdates=always" : "git";
     // the authority this operation keeps, rollback included: derived once from the trusted layout, never a commondir
     const store = trustedCommonDir(cwd);
     const resolved = await shGit(`git rev-parse --verify --end-of-options ${shq(`${commitish}^{commit}`)}`, cwd, timeoutMs);
@@ -612,12 +619,12 @@ export async function addDetachedWorktree(cwd, dir, commitish, timeoutMs = DEFAU
     const oid = resolved.stdout.trim();
     // under a ref payload git also resolves its new-HEAD stub into a shared refs/heads/.invalid; it is deleted again
     const rollback = { dir, branch: { name: ".invalid" } };
-    const added = await shellEntry(`git worktree add --no-checkout --detach ${shq(dir)} ${shq(oid)}`, cwd, timeoutMs, false, {}, { createsWorktree: "detached", rollback });
+    const added = await shellEntry(`${git} worktree add --no-checkout --detach ${shq(dir)} ${shq(oid)}`, cwd, timeoutMs, false, {}, { createsWorktree: "detached", rollback });
     if (added.code !== 0)
         return added;
     let repaired;
     try {
-        repaired = await shGit(`git update-ref --no-deref HEAD ${shq(oid)} && git update-ref -d refs/heads/.invalid && git reset -q --hard --no-recurse-submodules`, dir, timeoutMs);
+        repaired = await shGit(`${git} update-ref --no-deref HEAD ${shq(oid)} && ${git} update-ref -d refs/heads/.invalid && ${git} reset -q --hard --no-recurse-submodules`, dir, timeoutMs);
     }
     catch (error) {
         await dropWorktree(store, rollback, timeoutMs).catch((failure) => { throw rollbackFailed(error, failure); });
@@ -627,6 +634,15 @@ export async function addDetachedWorktree(cwd, dir, commitish, timeoutMs = DEFAU
         await dropWorktree(store, rollback, timeoutMs);
     return repaired;
 }
+/**
+ * 2.8.1 T1 (ANL-023 §7.1): the reflog witness W(dir, ref) — read-only, the newest entry first. It is valid for a commit
+ * x only when the exit is 0, at least one line came back and the first is x: exit 0 with no lines is git's answer for
+ * a missing or unreadable log, so an empty witness is a refusal, never an accepted empty.
+ */
+export async function reflogWitness(dir, ref) {
+    const r = await shGit(`git reflog show --no-abbrev --format=%H ${shq(ref)}`, dir);
+    return { code: r.code, lines: r.stdout.split("\n").map((line) => line.trim()).filter(Boolean) };
+}
 /** A failed rollback is never swallowed: it rides on the error the operation already throws (a refusal stays one). */
 function rollbackFailed(error, failure) {
     const why = `; its rollback failed, so what it created may remain: ${failure instanceof Error ? failure.message : String(failure)}`;
@@ -734,10 +750,11 @@ const sanitize = sanitizeBranch;
 // once after this rename — the same one-time per-install cost as the v1.38 state-dir rename.
 export const WORKTREES_DIR = "worktrees.noindex";
 export const worktreePath = (repo, branch) => join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
-/** OBS-28: remove this run's recorded worktrees; tolerates already-gone paths. */
+/**
+ * OBS-28: remove this run's recorded task worktrees; tolerates already-gone paths. 2.8.1 T2: a run keeps no
+ * integration checkout, and a 2.8.0 run's legacy one is never removed here (it may hold the only view of a merge).
+ */
 export async function cleanupRunWorktrees(repo, branch, opts) {
-    if (opts.removeIntegration)
-        await removeWorktree(repo, worktreePath(repo, branch));
     for (const id of opts.removeTaskIds)
         await removeWorktree(repo, worktreePath(repo, `${branch}--${id}`));
 }

package/dist/run/launchservices-check.d.ts

@@ -33,12 +33,34 @@ export type ProbeTimer = (fire: () => void, ms: number) => () => void;
 interface ProbeSeam {
     platform: NodeJS.Platform;
     spawn: typeof spawn;
+    spawnTop?: typeof spawn;
     setTimer: ProbeTimer;
     signal?: AbortSignal;
 }
 export declare const setLaunchServicesProbeForTests: (s: Partial<ProbeSeam>) => void;
 export declare const resetLaunchServicesProbeForTests: () => void;
 export declare function observeLaunchServices(s?: ProbeSeam): Promise<LaunchServicesObservation>;
+export declare const LAUNCHSERVICES_PORT_ADVISORY = 100000;
+export declare const LAUNCHSERVICES_PORT_STOP = 200000;
+export type LaunchServicesPorts = {
+    status: "skipped" | "non-darwin";
+} | {
+    status: "unknown";
+    pid?: number;
+} | {
+    status: "read";
+    pid: number;
+    count: number;
+};
+/** Closed top format: PID COMMAND #PORTS, then the next non-empty row for this pid and launchservicesd. */
+export declare function parseTopPortCount(stdout: string, pid: number): number | null;
+/** One identity read and, only for a readable Darwin identity, one bounded top child. */
+export declare function probeLaunchServicesPorts(options?: {
+    requireTop?: boolean;
+}): Promise<{
+    observation?: LaunchServicesObservation;
+    ports: LaunchServicesPorts;
+}>;
 export declare function launchServicesAdvisory(prior: LaunchServicesIdentity, now: LaunchServicesIdentity): string;
 /** Pure: the table row for one observation against the held record, and the record to hold next. */
 export declare function classifyLaunchServices(prior: Partial<LaunchServicesRecord> | undefined, observed: LaunchServicesObservation): {
@@ -48,7 +70,7 @@ export declare function classifyLaunchServices(prior: Partial<LaunchServicesReco
 };
 /** Observe, classify against the first record of `prior`, and hold the result on the first record of `health`.
  *  Returns `health` itself when nothing changed, else a copy — the argument is never mutated. */
-export declare function recordLaunchServices(prior: Record<string, AuthHealth> | null, health: Record<string, AuthHealth>): Promise<{
+export declare function recordLaunchServices(prior: Record<string, AuthHealth> | null, health: Record<string, AuthHealth>, observation?: LaunchServicesObservation): Promise<{
     status: LaunchServicesStatus;
     health: Record<string, AuthHealth>;
     line?: string;

package/dist/run/launchservices-check.js

@@ -27,12 +27,14 @@ export function parsePsIdentity(stdout) {
 const production = () => ({
     platform: process.platform,
     spawn,
+    spawnTop: spawn,
     setTimer: (fire, ms) => { const t = setTimeout(fire, ms); return () => clearTimeout(t); },
 });
 // ponytail: default-off under the test runner (the catalogRefreshAllowed precedent) so an unowned doctor
 // test never takes a real host reading or changes its doctor.json bytes; tests opt in through the seam.
+// The legacy identity-only seam leaves spawnTop unset, so old /bin/ps fixtures never touch the host top.
 let seam;
-export const setLaunchServicesProbeForTests = (s) => { seam = { ...production(), ...s }; };
+export const setLaunchServicesProbeForTests = (s) => { seam = { ...production(), ...s, spawnTop: s.spawnTop }; };
 export const resetLaunchServicesProbeForTests = () => { seam = undefined; };
 const activeSeam = () => seam ?? (process.env.VITEST === "true" ? undefined : production());
 /** One /bin/ps call that owns only its child, killed at the ceiling or on cancellation and reaped before it resolves. */
@@ -78,6 +80,88 @@ function readIdentity(s) {
 export function observeLaunchServices(s = production()) {
     return s.platform === "darwin" ? readIdentity(s) : Promise.resolve({ status: "non-darwin" });
 }
+export const LAUNCHSERVICES_PORT_ADVISORY = 100_000;
+export const LAUNCHSERVICES_PORT_STOP = 200_000;
+const TOP_BYTES = 1024 * 1024;
+/** Closed top format: PID COMMAND #PORTS, then the next non-empty row for this pid and launchservicesd. */
+export function parseTopPortCount(stdout, pid) {
+    const lines = stdout.split(/\r?\n/);
+    const header = lines.findIndex((line) => line.trim().split(/\s+/).join(" ") === "PID COMMAND #PORTS");
+    if (header < 0)
+        return null;
+    const row = lines.slice(header + 1).find((line) => line.trim() !== "");
+    if (!row)
+        return null;
+    const tokens = row.trim().split(/\s+/);
+    if (tokens.length !== 3 || tokens[0] !== String(pid) || tokens[1] !== "launchservicesd" || !/^[0-9]+[+-]?$/.test(tokens[2]))
+        return null;
+    const count = Number(tokens[2].replace(/[+-]$/, ""));
+    return Number.isSafeInteger(count) ? count : null;
+}
+// The captured macOS top layout is closed: only a matching three-token row after the exact header
+// yields a count. 100000 ports is a doctor advisory; 200000 stops standalone verify before gates.
+// Unknown (including an unreadable identity, malformed top output, or a killed child) never stops.
+function readPortCount(s, pid) {
+    return new Promise((resolve) => {
+        const unknown = () => resolve({ status: "unknown", pid });
+        if (s.signal?.aborted) {
+            unknown();
+            return;
+        }
+        if (!s.spawnTop) {
+            unknown();
+            return;
+        }
+        let child;
+        try {
+            child = s.spawnTop("/usr/bin/top", ["-l", "1", "-stats", "pid,command,ports", "-pid", String(pid)], { stdio: ["ignore", "pipe", "ignore"], env: { ...process.env, LC_ALL: "C" } });
+        }
+        catch {
+            unknown();
+            return;
+        }
+        let out = "";
+        let bytes = 0;
+        let failed = false;
+        const retire = () => { if (!failed) {
+            failed = true;
+            child.kill("SIGKILL");
+        } };
+        const clear = s.setTimer(retire, LAUNCHSERVICES_PROBE_CEILING_MS);
+        s.signal?.addEventListener("abort", retire, { once: true });
+        child.stdout?.on("data", (chunk) => {
+            if (failed)
+                return;
+            bytes += chunk.length;
+            if (bytes > TOP_BYTES) {
+                retire();
+                return;
+            }
+            out += chunk.toString("utf8");
+        });
+        child.once("error", () => { failed = true; });
+        child.once("close", (code) => {
+            clear();
+            s.signal?.removeEventListener("abort", retire);
+            if (failed || code !== 0)
+                return unknown();
+            const count = parseTopPortCount(out, pid);
+            return count === null ? unknown() : resolve({ status: "read", pid, count });
+        });
+    });
+}
+/** One identity read and, only for a readable Darwin identity, one bounded top child. */
+export async function probeLaunchServicesPorts(options = {}) {
+    const s = activeSeam();
+    if (!s || (options.requireTop && !s.spawnTop))
+        return { ports: { status: "skipped" } };
+    const observation = await observeLaunchServices(s);
+    if (observation.status === "non-darwin")
+        return { observation, ports: { status: "non-darwin" } };
+    if (observation.status === "unreadable")
+        return { observation, ports: { status: "unknown" } };
+    return { observation, ports: await readPortCount(s, observation.identity.pid) };
+}
 // doctor.json is never schema-validated: a malformed held record is no identity at all.
 const knownPrior = (prior) => typeof prior?.pid === "number" && typeof prior.start === "string";
 export function launchServicesAdvisory(prior, now) {
@@ -106,10 +190,11 @@ export function classifyLaunchServices(prior, observed) {
 }
 /** Observe, classify against the first record of `prior`, and hold the result on the first record of `health`.
  *  Returns `health` itself when nothing changed, else a copy — the argument is never mutated. */
-export async function recordLaunchServices(prior, health) {
+export async function recordLaunchServices(prior, health, observation) {
     const held = prior ? Object.values(prior)[0]?.launchServices : undefined;
     const s = activeSeam();
-    const r = s ? classifyLaunchServices(held, await observeLaunchServices(s)) : { status: "skipped", next: knownPrior(held) ? held : undefined };
+    const r = observation ? classifyLaunchServices(held, observation)
+        : s ? classifyLaunchServices(held, await observeLaunchServices(s)) : { status: "skipped", next: knownPrior(held) ? held : undefined };
     const holder = Object.keys(health)[0];
     if (!holder || !r.next || JSON.stringify(health[holder].launchServices) === JSON.stringify(r.next))
         return { ...r, health };

package/dist/run/merge.d.ts

@@ -1,5 +1,6 @@
 import type { TickmarkrConfig } from "../config/config.js";
 import { type Baseline, type BaselineProvenance, type GateEvidenceOptions, type FailureClassification } from "../gates/baseline.js";
+import { type VerificationIdentity } from "../gates/cache.js";
 import type { GateEvidenceReceipt } from "./protocol.js";
 export interface TipVerifyResult {
     evidenceReceipt?: GateEvidenceReceipt;
@@ -30,18 +31,124 @@ export interface TipVerifyResult {
      * for a kill, the shared runner classifier for everything else. `infra` means nothing was verified.
      */
     cause?: FailureClassification;
+    /** 2.8.1 T1: with `deferVerdicts`, the verdict-store write this result would have made, left to the caller. */
+    deferredVerdict?: {
+        id: VerificationIdentity;
+        verdict: TipVerifyResult & {
+            meta: Record<string, unknown>;
+        };
+    };
 }
 /** Carry execution evidence without minting an invocation or rebasing its artifact paths. */
 export declare function reusedTipEvidence(source: Partial<TipVerifyResult>): Partial<TipVerifyResult>;
 export declare function integrationBranch(cfg: TickmarkrConfig, runId: string): string;
+/**
+ * 2.8.1 T2 (ANL-023 §7.2): creates the integration ref create-only at `baseRef` (the empty old value means "must not
+ * exist") and returns the published tip E. The run keeps no checkout of the branch: every later publication is a
+ * compare-and-swap of the ref from `repo` (mergeTask). An existing or uncreatable ref throws — the fatal path's text.
+ */
 export declare function ensureIntegration(repo: string, branch: string, baseRef: string): Promise<string>;
-export declare function integrationHead(intWt: string): Promise<string>;
-export declare function mergeTask(intWt: string, taskBranch: string, message: string, gatedCommit: string): Promise<{
-    ok: boolean;
-    conflict?: string;
-    tipMoved?: {
+/** 2.8.1 T1 (ANL-023 §7.1): the closed states of the integration ref, as R(ref) reads them. */
+export type IntegrationRefState = {
+    kind: "regular";
+    commit: string;
+} | {
+    kind: "missing";
+} | {
+    kind: "symbolic";
+    target: string;
+    commit?: string;
+} | {
+    kind: "unreadable";
+    read: string;
+};
+export type IntegrationLeg = "symbolic" | "missing" | "value" | "unreadable";
+/**
+ * R(ref): the integration ref read from `repo` through the own-git runner, never its reflog. The exact ref only —
+ * a descendant ref (`refs/heads/<branch>/x`) is not this ref, and a ref that exists but names no commit is unreadable.
+ */
+export declare function readIntegrationRef(repo: string, branch: string): Promise<IntegrationRefState>;
+/** I(x): holds iff the ref is regular at x; otherwise the leg, with the state the repair text is chosen by. */
+export declare function checkIntegrationIdentity(repo: string, branch: string, expected: string): Promise<{
+    ok: true;
+    state: IntegrationRefState;
+} | {
+    ok: false;
+    leg: IntegrationLeg;
+    state: IntegrationRefState;
+}>;
+/**
+ * The repair text (shared by run end's failure row, the merge park and the resume refusal): backticked commands run
+ * from the repository root in order, stopping at the first that fails. A found commit is preserved create-only under
+ * refs/tickmarkr/found/<runId>/<F> before a no-deref compare-and-swap restores the ref; a symbolic found ref or one
+ * already holding another commit stops the sequence before the restore. Dangling and unreadable print no command.
+ */
+export declare function integrationRepairText(state: IntegrationRefState, branch: string, runId: string, expected: string): string;
+type GitResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+/** The merge's git steps after the identity check, in order; `publish` is the compare-and-swap. */
+export type MergeStep = "ancestry" | "merge-tree" | "commit-tree" | "publish";
+/** Test-only: runs before each step; a returned result replaces that step's git result (never `publish`'s). */
+export type MergeSeam = (step: MergeStep) => Promise<GitResult | void> | GitResult | void;
+export interface IntegrationMove {
+    branch: string;
+    expected: string;
+    found: string | null;
+    leg: IntegrationLeg;
+    target?: string;
+    stage: "check" | "publish";
+}
+export type MergeOutcome = {
+    ok: true;
+    commit: string;
+    from: string;
+} | {
+    ok: true;
+    alreadyMerged: string;
+} | {
+    ok: false;
+    tipMoved: {
         gatedCommit: string;
         branchTip: string;
     };
-}>;
-export declare function verifyIntegrationTip(intWt: string, commands: Record<string, string>, runDir: string, baseline?: Baseline, evidenceOptions?: GateEvidenceOptions): Promise<TipVerifyResult[]>;
+} | {
+    ok: false;
+    conflict: string;
+} | {
+    ok: false;
+    integrationMoved: IntegrationMove;
+    state: IntegrationRefState;
+} | {
+    ok: false;
+    alreadyIntegrated: {
+        gated: string;
+        tip: string;
+    };
+} | {
+    ok: false;
+    infra: {
+        step: MergeStep;
+        message: string;
+    };
+};
+/**
+ * 2.8.1 T2 (ANL-023 §7.2): publishes `gated` onto the integration ref by compare-and-swap from the stored tip
+ * `expected`, all git from `repo` — no checkout. (1) the task-tip check; (2) I(expected); (3) ancestry; (4) merge-tree;
+ * (5) commit-tree; (6) `update-ref --no-deref` from `expected`; (7) `onPublished(M)` in the same synchronous
+ * continuation as (6)'s result, so the caller's rows land in publication order. `merged` is the task's recorded merge
+ * commits, newest first: a gated commit already in the history is done only through its own recorded merge.
+ * `ancestorOnly` (a replay that ran no gates): a gated commit not in E is refused `infra`, never published.
+ */
+export declare function mergeTask(repo: string, { branch, expected, merged, ancestorOnly }: {
+    branch: string;
+    expected: string;
+    merged?: readonly string[];
+    ancestorOnly?: boolean;
+}, taskBranch: string, message: string, gated: string, onPublished: (commit: string) => void, seam?: MergeSeam): Promise<MergeOutcome>;
+export declare function verifyIntegrationTip(intWt: string, commands: Record<string, string>, runDir: string, baseline?: Baseline, evidenceOptions?: GateEvidenceOptions, { deferVerdicts }?: {
+    deferVerdicts?: boolean;
+}): Promise<TipVerifyResult[]>;
+export {};