tickmarkr 2.8.0 → 2.8.1

package/dist/run/git.d.ts

@@ -198,16 +198,29 @@ export declare function shGitOk(cmd: string, cwd: string, own?: OwnGitOptions):
  * A step raced by a commondir change is refused by name before the next one runs, and what the add created is rolled
  * back through the trusted common directory derived here once (dropWorktree), even while that commondir stays hostile.
  */
-export declare function addDetachedWorktree(cwd: string, dir: string, commitish: string, timeoutMs?: number): Promise<ShResult>;
+export declare function addDetachedWorktree(cwd: string, dir: string, commitish: string, timeoutMs?: number, { logHead }?: {
+    logHead?: boolean | undefined;
+}): Promise<ShResult>;
+/**
+ * 2.8.1 T1 (ANL-023 §7.1): the reflog witness W(dir, ref) — read-only, the newest entry first. It is valid for a commit
+ * x only when the exit is 0, at least one line came back and the first is x: exit 0 with no lines is git's answer for
+ * a missing or unreadable log, so an empty witness is a refusal, never an accepted empty.
+ */
+export declare function reflogWitness(dir: string, ref: string): Promise<{
+    code: number;
+    lines: string[];
+}>;
 export declare function npmDependencyManifestChanged(cwd: string, baselineRef: string): Promise<boolean>;
 export declare function npmDependencyInstallCommand(cwd: string): string;
 export declare function gitHead(cwd: string): Promise<string>;
 export declare const sanitizeBranch: (branch: string) => string;
 export declare const WORKTREES_DIR = "worktrees.noindex";
 export declare const worktreePath: (repo: string, branch: string) => string;
-/** OBS-28: remove this run's recorded worktrees; tolerates already-gone paths. */
+/**
+ * OBS-28: remove this run's recorded task worktrees; tolerates already-gone paths. 2.8.1 T2: a run keeps no
+ * integration checkout, and a 2.8.0 run's legacy one is never removed here (it may hold the only view of a merge).
+ */
 export declare function cleanupRunWorktrees(repo: string, branch: string, opts: {
-    removeIntegration: boolean;
     removeTaskIds: string[];
 }): Promise<void>;
 export declare function resolveIntegrationBranch(_repo: string, branch: string): Promise<string>;

package/dist/run/git.js

@@ -607,7 +607,10 @@ export async function shGitOk(cmd, cwd, own = {}) {
  * A step raced by a commondir change is refused by name before the next one runs, and what the add created is rolled
  * back through the trusted common directory derived here once (dropWorktree), even while that commondir stays hostile.
  */
-export async function addDetachedWorktree(cwd, dir, commitish, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS) {
+export async function addDetachedWorktree(cwd, dir, commitish, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS, { logHead = false } = {}) {
+    // 2.8.1 T1 (ANL-023 §7.1): `logHead` writes the new checkout's HEAD reflog whatever the repository's
+    // core.logAllRefUpdates says, so a later HEAD move by any command is appended to an established witness.
+    const git = logHead ? "git -c core.logAllRefUpdates=always" : "git";
     // the authority this operation keeps, rollback included: derived once from the trusted layout, never a commondir
     const store = trustedCommonDir(cwd);
     const resolved = await shGit(`git rev-parse --verify --end-of-options ${shq(`${commitish}^{commit}`)}`, cwd, timeoutMs);
@@ -616,12 +619,12 @@ export async function addDetachedWorktree(cwd, dir, commitish, timeoutMs = DEFAU
     const oid = resolved.stdout.trim();
     // under a ref payload git also resolves its new-HEAD stub into a shared refs/heads/.invalid; it is deleted again
     const rollback = { dir, branch: { name: ".invalid" } };
-    const added = await shellEntry(`git worktree add --no-checkout --detach ${shq(dir)} ${shq(oid)}`, cwd, timeoutMs, false, {}, { createsWorktree: "detached", rollback });
+    const added = await shellEntry(`${git} worktree add --no-checkout --detach ${shq(dir)} ${shq(oid)}`, cwd, timeoutMs, false, {}, { createsWorktree: "detached", rollback });
     if (added.code !== 0)
         return added;
     let repaired;
     try {
-        repaired = await shGit(`git update-ref --no-deref HEAD ${shq(oid)} && git update-ref -d refs/heads/.invalid && git reset -q --hard --no-recurse-submodules`, dir, timeoutMs);
+        repaired = await shGit(`${git} update-ref --no-deref HEAD ${shq(oid)} && ${git} update-ref -d refs/heads/.invalid && ${git} reset -q --hard --no-recurse-submodules`, dir, timeoutMs);
     }
     catch (error) {
         await dropWorktree(store, rollback, timeoutMs).catch((failure) => { throw rollbackFailed(error, failure); });
@@ -631,6 +634,15 @@ export async function addDetachedWorktree(cwd, dir, commitish, timeoutMs = DEFAU
         await dropWorktree(store, rollback, timeoutMs);
     return repaired;
 }
+/**
+ * 2.8.1 T1 (ANL-023 §7.1): the reflog witness W(dir, ref) — read-only, the newest entry first. It is valid for a commit
+ * x only when the exit is 0, at least one line came back and the first is x: exit 0 with no lines is git's answer for
+ * a missing or unreadable log, so an empty witness is a refusal, never an accepted empty.
+ */
+export async function reflogWitness(dir, ref) {
+    const r = await shGit(`git reflog show --no-abbrev --format=%H ${shq(ref)}`, dir);
+    return { code: r.code, lines: r.stdout.split("\n").map((line) => line.trim()).filter(Boolean) };
+}
 /** A failed rollback is never swallowed: it rides on the error the operation already throws (a refusal stays one). */
 function rollbackFailed(error, failure) {
     const why = `; its rollback failed, so what it created may remain: ${failure instanceof Error ? failure.message : String(failure)}`;
@@ -738,10 +750,11 @@ const sanitize = sanitizeBranch;
 // once after this rename — the same one-time per-install cost as the v1.38 state-dir rename.
 export const WORKTREES_DIR = "worktrees.noindex";
 export const worktreePath = (repo, branch) => join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
-/** OBS-28: remove this run's recorded worktrees; tolerates already-gone paths. */
+/**
+ * OBS-28: remove this run's recorded task worktrees; tolerates already-gone paths. 2.8.1 T2: a run keeps no
+ * integration checkout, and a 2.8.0 run's legacy one is never removed here (it may hold the only view of a merge).
+ */
 export async function cleanupRunWorktrees(repo, branch, opts) {
-    if (opts.removeIntegration)
-        await removeWorktree(repo, worktreePath(repo, branch));
     for (const id of opts.removeTaskIds)
         await removeWorktree(repo, worktreePath(repo, `${branch}--${id}`));
 }

package/dist/run/merge.d.ts

@@ -1,5 +1,6 @@
 import type { TickmarkrConfig } from "../config/config.js";
 import { type Baseline, type BaselineProvenance, type GateEvidenceOptions, type FailureClassification } from "../gates/baseline.js";
+import { type VerificationIdentity } from "../gates/cache.js";
 import type { GateEvidenceReceipt } from "./protocol.js";
 export interface TipVerifyResult {
     evidenceReceipt?: GateEvidenceReceipt;
@@ -30,18 +31,124 @@ export interface TipVerifyResult {
      * for a kill, the shared runner classifier for everything else. `infra` means nothing was verified.
      */
     cause?: FailureClassification;
+    /** 2.8.1 T1: with `deferVerdicts`, the verdict-store write this result would have made, left to the caller. */
+    deferredVerdict?: {
+        id: VerificationIdentity;
+        verdict: TipVerifyResult & {
+            meta: Record<string, unknown>;
+        };
+    };
 }
 /** Carry execution evidence without minting an invocation or rebasing its artifact paths. */
 export declare function reusedTipEvidence(source: Partial<TipVerifyResult>): Partial<TipVerifyResult>;
 export declare function integrationBranch(cfg: TickmarkrConfig, runId: string): string;
+/**
+ * 2.8.1 T2 (ANL-023 §7.2): creates the integration ref create-only at `baseRef` (the empty old value means "must not
+ * exist") and returns the published tip E. The run keeps no checkout of the branch: every later publication is a
+ * compare-and-swap of the ref from `repo` (mergeTask). An existing or uncreatable ref throws — the fatal path's text.
+ */
 export declare function ensureIntegration(repo: string, branch: string, baseRef: string): Promise<string>;
-export declare function integrationHead(intWt: string): Promise<string>;
-export declare function mergeTask(intWt: string, taskBranch: string, message: string, gatedCommit: string): Promise<{
-    ok: boolean;
-    conflict?: string;
-    tipMoved?: {
+/** 2.8.1 T1 (ANL-023 §7.1): the closed states of the integration ref, as R(ref) reads them. */
+export type IntegrationRefState = {
+    kind: "regular";
+    commit: string;
+} | {
+    kind: "missing";
+} | {
+    kind: "symbolic";
+    target: string;
+    commit?: string;
+} | {
+    kind: "unreadable";
+    read: string;
+};
+export type IntegrationLeg = "symbolic" | "missing" | "value" | "unreadable";
+/**
+ * R(ref): the integration ref read from `repo` through the own-git runner, never its reflog. The exact ref only —
+ * a descendant ref (`refs/heads/<branch>/x`) is not this ref, and a ref that exists but names no commit is unreadable.
+ */
+export declare function readIntegrationRef(repo: string, branch: string): Promise<IntegrationRefState>;
+/** I(x): holds iff the ref is regular at x; otherwise the leg, with the state the repair text is chosen by. */
+export declare function checkIntegrationIdentity(repo: string, branch: string, expected: string): Promise<{
+    ok: true;
+    state: IntegrationRefState;
+} | {
+    ok: false;
+    leg: IntegrationLeg;
+    state: IntegrationRefState;
+}>;
+/**
+ * The repair text (shared by run end's failure row, the merge park and the resume refusal): backticked commands run
+ * from the repository root in order, stopping at the first that fails. A found commit is preserved create-only under
+ * refs/tickmarkr/found/<runId>/<F> before a no-deref compare-and-swap restores the ref; a symbolic found ref or one
+ * already holding another commit stops the sequence before the restore. Dangling and unreadable print no command.
+ */
+export declare function integrationRepairText(state: IntegrationRefState, branch: string, runId: string, expected: string): string;
+type GitResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+/** The merge's git steps after the identity check, in order; `publish` is the compare-and-swap. */
+export type MergeStep = "ancestry" | "merge-tree" | "commit-tree" | "publish";
+/** Test-only: runs before each step; a returned result replaces that step's git result (never `publish`'s). */
+export type MergeSeam = (step: MergeStep) => Promise<GitResult | void> | GitResult | void;
+export interface IntegrationMove {
+    branch: string;
+    expected: string;
+    found: string | null;
+    leg: IntegrationLeg;
+    target?: string;
+    stage: "check" | "publish";
+}
+export type MergeOutcome = {
+    ok: true;
+    commit: string;
+    from: string;
+} | {
+    ok: true;
+    alreadyMerged: string;
+} | {
+    ok: false;
+    tipMoved: {
         gatedCommit: string;
         branchTip: string;
     };
-}>;
-export declare function verifyIntegrationTip(intWt: string, commands: Record<string, string>, runDir: string, baseline?: Baseline, evidenceOptions?: GateEvidenceOptions): Promise<TipVerifyResult[]>;
+} | {
+    ok: false;
+    conflict: string;
+} | {
+    ok: false;
+    integrationMoved: IntegrationMove;
+    state: IntegrationRefState;
+} | {
+    ok: false;
+    alreadyIntegrated: {
+        gated: string;
+        tip: string;
+    };
+} | {
+    ok: false;
+    infra: {
+        step: MergeStep;
+        message: string;
+    };
+};
+/**
+ * 2.8.1 T2 (ANL-023 §7.2): publishes `gated` onto the integration ref by compare-and-swap from the stored tip
+ * `expected`, all git from `repo` — no checkout. (1) the task-tip check; (2) I(expected); (3) ancestry; (4) merge-tree;
+ * (5) commit-tree; (6) `update-ref --no-deref` from `expected`; (7) `onPublished(M)` in the same synchronous
+ * continuation as (6)'s result, so the caller's rows land in publication order. `merged` is the task's recorded merge
+ * commits, newest first: a gated commit already in the history is done only through its own recorded merge.
+ * `ancestorOnly` (a replay that ran no gates): a gated commit not in E is refused `infra`, never published.
+ */
+export declare function mergeTask(repo: string, { branch, expected, merged, ancestorOnly }: {
+    branch: string;
+    expected: string;
+    merged?: readonly string[];
+    ancestorOnly?: boolean;
+}, taskBranch: string, message: string, gated: string, onPublished: (commit: string) => void, seam?: MergeSeam): Promise<MergeOutcome>;
+export declare function verifyIntegrationTip(intWt: string, commands: Record<string, string>, runDir: string, baseline?: Baseline, evidenceOptions?: GateEvidenceOptions, { deferVerdicts }?: {
+    deferVerdicts?: boolean;
+}): Promise<TipVerifyResult[]>;
+export {};

package/dist/run/merge.js

@@ -4,8 +4,7 @@ import { shq } from "../adapters/types.js";
 import { baselineEntryRefusal, beginGateEvidence, ceilingKillResult, classifyFreshRunnerOutput, classifyRunnerOutput, fileCountDeficit, waitForCalmWindow, effectiveCeilingMs, classifiedFileDurations, fingerprint, freshFailures, } from "../gates/baseline.js";
 import { evaluateManifestedTest, isVitestTestCommand } from "../gates/test-manifest.js";
 import { computeVerificationIdentity, formatReusedDetails, getVerdictStore, getWorktreeTree, resolveStateDir, isInfraResult, } from "../gates/cache.js";
-import { tickmarkrDir } from "../graph/graph.js";
-import { dependencyLinkRefusal, describeCapacity, gitHead, linkNodeModules, resolveIntegrationBranch, resolvedCapacity, sameCapacity, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
+import { dependencyLinkRefusal, describeCapacity, resolveIntegrationBranch, resolvedCapacity, sameCapacity, sh, shGit } from "./git.js";
 import { executionSignal } from "./execution-budget.js";
 // Diagnostic convenience logs are observational, just like receipt persistence.
 function writeTipLog(path, text) {
@@ -32,42 +31,131 @@ export function reusedTipEvidence(source) {
 export function integrationBranch(cfg, runId) {
     return `${cfg.integrationBranchPrefix}${runId}`;
 }
-const sanitize = (branch) => branch.replace(/[^\w.-]+/g, "-");
+/**
+ * 2.8.1 T2 (ANL-023 §7.2): creates the integration ref create-only at `baseRef` (the empty old value means "must not
+ * exist") and returns the published tip E. The run keeps no checkout of the branch: every later publication is a
+ * compare-and-swap of the ref from `repo` (mergeTask). An existing or uncreatable ref throws — the fatal path's text.
+ */
 export async function ensureIntegration(repo, branch, baseRef) {
     branch = await resolveIntegrationBranch(repo, branch);
-    const dir = join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
-    if (!existsSync(join(dir, ".git"))) {
-        const exists = (await shGit(`git rev-parse --verify refs/heads/${shq(branch)}`, repo)).code === 0;
-        if (exists) {
-            await shGitOk(`git worktree add ${shq(dir)} ${shq(branch)}`, repo, { createsWorktree: "branch", rollback: { dir } });
-        }
-        else {
-            await shGitOk(`git worktree add -b ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo, { createsWorktree: "branch", rollback: { dir, branch: { name: branch } } });
-        }
-    }
-    linkNodeModules(repo, dir);
-    return dir;
+    // ponytail: no --create-reflog (ANL-023 §7.2 names it): the repository's own core.logAllRefUpdates decides, because
+    // nothing reads this reflog (X10) and run-end-integration's E-P10 builds its no-reflog legacy branch through a fresh
+    // run with logging disabled. Add the flag back once that fixture builds its legacy branch by hand.
+    const r = await shGit(`git update-ref --no-deref -m ${shq("tickmarkr: run start")} ${shq(`refs/heads/${branch}`)} ${shq(baseRef)} ""`, repo);
+    if (r.code !== 0)
+        throw new Error(`integration branch ${branch} already exists or cannot be created: ${(r.stderr || r.stdout).trim()}`);
+    return baseRef;
+}
+/**
+ * R(ref): the integration ref read from `repo` through the own-git runner, never its reflog. The exact ref only —
+ * a descendant ref (`refs/heads/<branch>/x`) is not this ref, and a ref that exists but names no commit is unreadable.
+ */
+export async function readIntegrationRef(repo, branch) {
+    const ref = `refs/heads/${branch}`;
+    const unreadable = (cmd, r) => ({ kind: "unreadable", read: `${cmd} exited ${r.code}${(r.stderr || r.stdout).trim() ? `: ${(r.stderr || r.stdout).trim()}` : ""}` });
+    const symbolic = await shGit(`git symbolic-ref -q ${shq(ref)}`, repo);
+    if (symbolic.code !== 0 && symbolic.code !== 1)
+        return unreadable("git symbolic-ref", symbolic);
+    const commit = await shGit(`git rev-parse --verify -q ${shq(`${ref}^{commit}`)}`, repo);
+    if (commit.code !== 0 && commit.code !== 1)
+        return unreadable("git rev-parse", commit);
+    const found = commit.code === 0 ? commit.stdout.trim() : undefined;
+    if (symbolic.code === 0)
+        return { kind: "symbolic", target: symbolic.stdout.trim(), ...(found ? { commit: found } : {}) };
+    if (found)
+        return { kind: "regular", commit: found };
+    const exists = await shGit(`git show-ref --verify -q ${shq(ref)}`, repo);
+    return exists.code === 1 ? { kind: "missing" } : unreadable("git show-ref", exists);
 }
-export function integrationHead(intWt) {
-    return gitHead(intWt);
+/** I(x): holds iff the ref is regular at x; otherwise the leg, with the state the repair text is chosen by. */
+export async function checkIntegrationIdentity(repo, branch, expected) {
+    const state = await readIntegrationRef(repo, branch);
+    if (state.kind === "regular" && state.commit === expected)
+        return { ok: true, state };
+    return { ok: false, leg: state.kind === "regular" ? "value" : state.kind, state };
 }
-export async function mergeTask(intWt, taskBranch, message, gatedCommit) {
-    const tip = await shGit(`git rev-parse --verify ${shq(`refs/heads/${taskBranch}`)}`, intWt);
+/**
+ * The repair text (shared by run end's failure row, the merge park and the resume refusal): backticked commands run
+ * from the repository root in order, stopping at the first that fails. A found commit is preserved create-only under
+ * refs/tickmarkr/found/<runId>/<F> before a no-deref compare-and-swap restores the ref; a symbolic found ref or one
+ * already holding another commit stops the sequence before the restore. Dangling and unreadable print no command.
+ */
+export function integrationRepairText(state, branch, runId, expected) {
+    const ref = `refs/heads/${branch}`;
+    const byHand = `inspect ${ref} and restore it to ${expected} by hand`;
+    const found = state.kind === "regular" ? state.commit : state.kind === "symbolic" ? state.commit : undefined;
+    if (found) {
+        const keep = `refs/tickmarkr/found/${runId}/${found}`;
+        return `\`test -z "$(git symbolic-ref -q ${keep})"\` then \`test "$(git rev-parse -q --verify ${keep})" = ${found} || git update-ref --no-deref ${keep} ${found} ""\` then \`git update-ref --no-deref ${ref} ${expected} ${found}\``;
+    }
+    if (state.kind === "missing")
+        return `\`git update-ref --no-deref ${ref} ${expected} ""\``;
+    if (state.kind === "symbolic")
+        return `symbolic to ${state.target}, which names no commit; ${byHand}`;
+    return state.kind === "unreadable" ? `${ref} is unreadable (${state.read}); ${byHand}` : byHand;
+}
+/**
+ * 2.8.1 T2 (ANL-023 §7.2): publishes `gated` onto the integration ref by compare-and-swap from the stored tip
+ * `expected`, all git from `repo` — no checkout. (1) the task-tip check; (2) I(expected); (3) ancestry; (4) merge-tree;
+ * (5) commit-tree; (6) `update-ref --no-deref` from `expected`; (7) `onPublished(M)` in the same synchronous
+ * continuation as (6)'s result, so the caller's rows land in publication order. `merged` is the task's recorded merge
+ * commits, newest first: a gated commit already in the history is done only through its own recorded merge.
+ * `ancestorOnly` (a replay that ran no gates): a gated commit not in E is refused `infra`, never published.
+ */
+export async function mergeTask(repo, { branch, expected, merged = [], ancestorOnly = false }, taskBranch, message, gated, onPublished, seam) {
+    const tip = await shGit(`git rev-parse --verify ${shq(`refs/heads/${taskBranch}`)}`, repo);
     if (tip.code !== 0)
         return { ok: false, conflict: tip.stderr || tip.stdout };
     const branchTip = tip.stdout.trim();
-    if (branchTip !== gatedCommit)
-        return { ok: false, tipMoved: { gatedCommit, branchTip } };
-    // Merge the verified hash, not the mutable branch name: a move after the comparison cannot land ungated content.
-    const r = await shGit(`git merge --no-ff ${shq(gatedCommit)} -m ${shq(message)}`, intWt);
-    if (r.code === 0)
-        return { ok: true };
-    const conflict = (await shGit("git status --porcelain", intWt)).stdout
-        .split("\n")
-        .filter((l) => l.startsWith("UU") || l.startsWith("AA"))
-        .join("\n") || r.stderr || r.stdout;
-    await shGit("git merge --abort", intWt);
-    return { ok: false, conflict };
+    if (branchTip !== gated)
+        return { ok: false, tipMoved: { gatedCommit: gated, branchTip } };
+    const moved = (leg, state, stage) => ({
+        ok: false, state, integrationMoved: { branch, expected, leg, stage,
+            found: (state.kind === "regular" || state.kind === "symbolic" ? state.commit : undefined) ?? null,
+            ...(state.kind === "symbolic" ? { target: state.target } : {}) },
+    });
+    const infra = (step, r) => ({ ok: false, infra: { step, message: (r.stderr || r.stdout).trim() || `exit ${r.code}` } });
+    const run = async (step, cmd) => (await seam?.(step)) || shGit(cmd, repo);
+    const held = await checkIntegrationIdentity(repo, branch, expected);
+    if (!held.ok)
+        return moved(held.leg, held.state, "check");
+    const ancestry = await run("ancestry", `git merge-base --is-ancestor ${shq(gated)} ${shq(expected)}`);
+    if (ancestry.code === 0) {
+        // Ancestor or equal tip: only the task's own recorded merge (second parent = gated) makes it done. A resume replay
+        // hands the task's own gated commit here, never a tip recreated on E (runDaemon's resume gate replay).
+        for (const commit of merged) {
+            const second = await shGit(`git rev-parse --verify -q ${shq(`${commit}^2`)}`, repo);
+            if (second.code !== 0)
+                break; // a failed read (no second parent, no such object) is never passed over: fail closed
+            if (second.stdout.trim() === gated)
+                return { ok: true, alreadyMerged: commit };
+        }
+        return { ok: false, alreadyIntegrated: { gated, tip: expected } };
+    }
+    if (ancestry.code !== 1)
+        return infra("ancestry", ancestry);
+    // A caller that skipped the gates on its own ancestry proof (a resume replay) never reaches construction.
+    if (ancestorOnly)
+        return infra("ancestry", { code: 1, stdout: "", stderr: `${gated} is not in ${expected}; an ungated replay publishes nothing` });
+    const tree = await run("merge-tree", `git merge-tree --write-tree ${shq(expected)} ${shq(gated)}`);
+    if (tree.code === 1)
+        return { ok: false, conflict: (tree.stdout || tree.stderr).trim() };
+    if (tree.code !== 0)
+        return infra("merge-tree", tree);
+    const made = await run("commit-tree", `git commit-tree ${shq(tree.stdout.split("\n")[0].trim())} -p ${shq(expected)} -p ${shq(gated)} -m ${shq(message)}`);
+    if (made.code !== 0)
+        return infra("commit-tree", made);
+    const commit = made.stdout.trim();
+    await seam?.("publish");
+    const published = await shGit(`git update-ref --no-deref -m ${shq(message)} ${shq(`refs/heads/${branch}`)} ${shq(commit)} ${shq(expected)}`, repo);
+    if (published.code === 0) {
+        onPublished(commit); // no await between the compare-and-swap's result and the caller's rows
+        return { ok: true, commit, from: expected };
+    }
+    const state = await readIntegrationRef(repo, branch);
+    if (state.kind === "regular" && state.commit === expected)
+        return infra("publish", published);
+    return moved(state.kind === "regular" ? "value" : state.kind, state, "publish");
 }
 // OBS-34 ruled strict exit-code verify; Q121s (TRIAL T-OBS-1) narrows it: a red whose failure
 // fingerprints are ALL recorded in the run's baseline is forgiven with the battery's own math
@@ -75,7 +163,7 @@ export async function mergeTask(intWt, taskBranch, message, gatedCommit) {
 // terminus unreachable by construction and misattributed the red to the last merged task.
 // Fail-closed edges kept: no baseline → strict; baseline green for that gate → strict; any fresh
 // fingerprint, or output with no recognizable failure shape, → failed.
-export async function verifyIntegrationTip(intWt, commands, runDir, baseline, evidenceOptions = {}) {
+export async function verifyIntegrationTip(intWt, commands, runDir, baseline, evidenceOptions = {}, { deferVerdicts = false } = {}) {
     const results = [];
     let runStartCommands;
     let journalFound = false;
@@ -414,7 +502,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
         }
         const id = pending.get(result.gate);
         if (id && id.tree === completedTree && !isInfraResult(result)) {
-            store.set(id, { ...result, meta: {
+            const verdict = { ...result, meta: {
                     fingerprints: result.fingerprints, forgiven: result.forgiven, baselineProvenance: result.baselineProvenance,
                     ...(result.forgiven && result.gate === "test" ? { killTextRead: true } : {}),
                     reportPath: result.reportPath, spawnedCommand: result.spawnedCommand,
@@ -422,7 +510,12 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
                     evidenceReceipt: result.evidenceReceipt, evidenceReceipts: result.evidenceReceipts,
                     evidenceAbsence: result.evidenceAbsence, originRunRoot: result.originRunRoot,
                     nonce: result.nonce, stdoutPath: result.stdoutPath, stderrPath: result.stderrPath,
-                } });
+                } };
+            // 2.8.1 T1: a deferring caller (run end) writes the verdict itself, only after its closing identity check.
+            if (deferVerdicts)
+                result.deferredVerdict = { id, verdict };
+            else
+                store.set(id, verdict);
         }
     }
     return results;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.8.0",
+  "version": "2.8.1",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-overseer/SKILL.md

@@ -503,6 +503,14 @@ journal tail to decide what happens next, or sweeping orphans — you have taken
    - **the INTEGRATION subject** — the integration-branch commit that worktree was created from, named by
      sha from the journal's `task-dispatch` row or `tickmarkr status`; never "the run", and never the
      branch name alone, which moves while you are reading it;
+   - **the operator view of that branch** — a live run has NO integration checkout: the daemon publishes
+     each merge onto `tickmarkr/<runId>` by compare-and-swap from the repository root. View it through a
+     detached snapshot (`git worktree add --detach <dir> tickmarkr/<runId>`), refreshed by removing it
+     (`git worktree remove <dir>`) and re-adding it; check the branch out attached only with the daemon
+     stopped (no live `graph.lock`) — an attached checkout taken while the run is live goes stale at the next
+     publication, and any write to the ref parks the next merge infra. Run `tickmarkr verify` and `report`
+     from the main checkout or a snapshot;
+     a legacy attached view from a 2.8.0 run is stale from the first publication;
    - **and, where the fix is a FILE the tree must hold** — a new test, a fixture, a schema — its presence
      at that commit: `git -C <task-worktree> cat-file -e <task-head>:<path>`. A fix that lives only in the
      daemon's `dist` cannot make a worker's missing oracle appear, and a worker red on that missing file is