tickmarkr 2.8.0 → 2.8.2

package/dist/adapters/codex.js

@@ -121,8 +121,9 @@ function codexRetirement(upgrade) {
 // literal-string fallback. Every emitted root is therefore a TOML basic string that parses back to the exact
 // path (git's own trailing newline is stripped through a sentinel, never a path's). No common-root fallback;
 // packed-refs is not granted (packed-ref ops fail closed); stash, tags, notes and branches outside the leaf
-// are denied. Declared: sibling refs in the same leaf (other task branches, the run's integration branch
-// under the default prefix) stay writable until 2.8.1's integration identity.
+// are denied. Declared (queue row 151): sibling refs in the same leaf (other task branches, the run's integration
+// branch under the default prefix) stay writable; since 2.8.1 a write to the integration ref parks the merge and is
+// never published.
 // doctor's probe (codex-commit-check.ts) executes these exact bytes; it never rebuilds the grant.
 export const CODEX_GIT_GRANT = `-c "sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir && echo /) && tkr_gitdir=$(git rev-parse --absolute-git-dir && echo /) && tkr_common=\${tkr_common%?/} && tkr_gitdir=\${tkr_gitdir%?/} && { tkr_head=$(git symbolic-ref -q HEAD); [ $? -le 1 ]; } && case $tkr_head in (refs/heads/*) tkr_leaf=\${tkr_head%/*};; (*) tkr_leaf=;; esac && [ "$(printf %s "$tkr_common$tkr_gitdir$tkr_leaf" | LC_ALL=C tr -d '\\0-\\37\\177"\\\\')" = "$tkr_common$tkr_gitdir$tkr_leaf" ] && { [ "$tkr_gitdir" = "$tkr_common" ] || printf '"%s",' "$tkr_gitdir"; } && printf '"%s/objects"' "$tkr_common" && { [ -z "$tkr_leaf" ] || printf ',"%s/%s","%s/logs/%s"' "$tkr_common" "$tkr_leaf" "$tkr_common" "$tkr_leaf"; })]"`;
 // OBS-125: codex 0.144.x gates enabled hooks behind PER-PROJECT-PATH hook trust — a NEW gate distinct

package/dist/cli/commands/approve.js

@@ -5,6 +5,7 @@ import { allAdapters } from "../../adapters/registry.js";
 import { channelKey } from "../../adapters/types.js";
 import { loadConfig } from "../../config/config.js";
 import { integrationBranch } from "../../run/merge.js";
+import { integrationAnchor } from "../../run/daemon.js";
 import { separabilityErrors, surfaceErrors, taskBudgetErrors } from "../../compile/collateral.js";
 import { GATE_NAMES } from "../../graph/schema.js";
 import { applyScopeAmendments, bindingToken, captureOwedCheck, engagementComparable, engagementReleased, failedGateBeforePark, parseBindingToken, physicalLine, ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal, RECHECK_RELEASE, REVIEW_UPHELD_RELEASE } from "../../run/journal.js";
@@ -168,6 +169,11 @@ export async function approve(argv, cwd = process.cwd()) {
     const serialization = await acquireApprovalSerialization(cwd, runId);
     try {
         const journal = Journal.open(cwd, runId);
+        // 2.8.1 T3 (ANL-023 §7.3): a marked run's recheck counts against its journal anchor; an unreadable one admits nothing.
+        const anchor = integrationAnchor(journal.read());
+        if (recheck && anchor && "unreadable" in anchor) {
+            throw new Error(`refusing to recheck ${taskId} in ${runId}: its journal names no readable published tip (${anchor.unreadable})`);
+        }
         const status = journal.replayStatuses().get(taskId);
         if (status === undefined) {
             throw new Error(`task ${taskId} has no events in run ${runId} — unknown task or never dispatched`);
@@ -308,12 +314,12 @@ export async function approve(argv, cwd = process.cwd()) {
             // daemon's boundary never observes the decision without its obligation (or a second write).
             // The seats a review discharge may resolve to are this repository's declared channels, recorded on
             // the row so every later fold reads the same table whatever process or checkout it runs in.
-            let integrationRef = "unknown";
+            let byName = "unknown";
             let declared;
             let owedTask;
             try {
                 const cfg = loadConfig(cwd);
-                integrationRef = integrationBranch(cfg, runId);
+                byName = integrationBranch(cfg, runId);
                 declared = allAdapters().flatMap((a) => a.channels(cfg)).map((c) => ({ key: channelKey(c), vendor: c.vendor }));
             }
             catch { /* an unreadable config binds no range and declares no seat: unknown */ }
@@ -321,11 +327,15 @@ export async function approve(argv, cwd = process.cwd()) {
                 owedTask = loadGraph(cwd).tasks.find((t) => t.id === taskId);
             }
             catch { /* recorded as unknown criteria and scope */ }
-            const obligation = captureOwedCheck({
+            const integration = integrationBase(journal.read(), () => byName);
+            const owed = captureOwedCheck({
                 cwd, runId, taskId, gate: failedGate, events, acceptance: owedTask?.acceptance, files: owedTask?.files, declared,
                 cause: reason ?? `operator waived failed ${failedGate} gate`, // the row's own park field binds the park
-                taskRef: `${integrationRef}--${taskId}`, integrationRef,
+                taskRef: `${integration.branch}--${taskId}`, integrationRef: integration.base,
             });
+            // An unreadable anchor still records the waive, its obligation unknown: the debt is never silently known.
+            const obligation = integration.unreadable === undefined ? owed
+                : { ...owed, known: false, unknownReason: `its journal names no readable published tip (${integration.unreadable})` };
             journal.append("task-approved", taskId, {
                 by,
                 ...(reason ? { reason } : {}),
@@ -370,6 +380,20 @@ export async function approve(argv, cwd = process.cwd()) {
         serialization.release();
     }
 }
+/**
+ * 2.8.1 T3 (ANL-023 §7.3): the integration branch and base a decision reads. A marked run (run-start
+ * `integrationAnchor: "journal"`) takes its branch from run-start, never the current config, and its base is the
+ * journal anchor A (`unreadable` when the journal names none); an unmarked run reads the branch by name, as before.
+ */
+function integrationBase(events, byName) {
+    const anchor = integrationAnchor(events);
+    if (!anchor) {
+        const branch = byName();
+        return { branch, base: branch };
+    }
+    const branch = String(events.find((e) => e.event === "run-start").data.branch);
+    return "anchor" in anchor ? { branch, base: anchor.anchor } : { branch, base: "unknown", unreadable: anchor.unreadable };
+}
 /** The row a decision on this task answers right now: its newest failure when failed, else its newest park. */
 function openDecision(journal, taskId) {
     const { events, sourceIndexes } = readJournalEvents(journal);
@@ -391,11 +415,12 @@ function requireBound(runId, taskId, bound, open, what) {
  * OBS-1022: what a failed task has landed. A preserved snapshot is authoritative only when it contains
  * the current task-branch tip; an older preservation can remain in the journal after a later retry has
  * advanced/rebuilt the branch. Missing task branches may still recover from a preserved ref. The selected
- * ref is counted against the run's integration branch; unreadable refs count as zero and fail closed.
+ * ref is counted against the run's integration base (integrationBase); unreadable refs count as zero and fail closed.
+ * `base` names the branch the text prints; the count reads `integration.base`.
  */
 function failedTaskCommitsAhead(cwd, journal, runId, taskId) {
-    const cfg = loadConfig(cwd);
-    const base = integrationBranch(cfg, runId);
+    const integration = integrationBase(journal.read(), () => integrationBranch(loadConfig(cwd), runId));
+    const base = integration.branch;
     const taskRef = `${base}--${taskId}`;
     const preserved = [...journal.read()].reverse().find((e) => e.taskId === taskId && e.event === "worktree-preserved" && typeof e.data.ref === "string");
     const preservedRef = preserved?.data.ref;
@@ -416,7 +441,7 @@ function failedTaskCommitsAhead(cwd, journal, runId, taskId) {
         }
     }
     try {
-        const out = execFileSync("git", ["rev-list", "--count", `${base}..${ref}`], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+        const out = execFileSync("git", ["rev-list", "--count", `${integration.base}..${ref}`], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
         return { ref, base, count: Number.parseInt(out.trim(), 10) || 0 };
     }
     catch {

package/dist/cli/commands/verify.js

@@ -13,7 +13,7 @@ import { runGates } from "../../gates/run-gates.js";
 import { getTask, loadGraph } from "../../graph/graph.js";
 import { GATE_NAMES } from "../../graph/schema.js";
 import { executionSignal } from "../../run/execution-budget.js";
-import { addDetachedWorktree, linkNodeModules, removeWorktree, shGit, shGitOk } from "../../run/git.js";
+import { addDetachedWorktree, linkNodeModules, reflogWitness, removeWorktree, shGit, shGitOk } from "../../run/git.js";
 import { foldOwedChecks, integrationMapped, owedCriteria, Journal, OWED_DISCHARGE_EVENT } from "../../run/journal.js";
 import { describeLeaseWait, withRepositoryLease } from "../../run/lease.js";
 import { isPidLive } from "../../run/lock.js";
@@ -200,16 +200,24 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
     }
     const cfg = loadConfig(fileRoot("config.yaml"));
     const head = (await shGitOk("git rev-parse HEAD", cwd)).trim();
-    // Git appends every move of HEAD to its reflog — one a gate command makes and undoes itself included —
-    // so the log as of this capture is the subject's witness: any later difference is a move (fail closed).
-    const headLogPath = resolve(cwd, (await shGitOk("git rev-parse --git-path logs/HEAD", cwd)).trim());
-    const headLog = () => { try {
-        return readFileSync(headLogPath, "utf8");
+    // The latch reads HEAD's reflog through git as a validated witness, refuses before capture when it
+    // is absent or invalid, and compares it line for line at every subject check.
+    const witnessFault = (witness, commit) => {
+        if (witness.code !== 0)
+            return `exit ${witness.code}`;
+        const newest = witness.lines[0];
+        if (newest === undefined)
+            return "no reflog";
+        if (newest !== commit)
+            return `newest is ${newest.slice(0, 12)}`;
+        return undefined;
+    };
+    const capturedWitness = await reflogWitness(cwd, "HEAD");
+    const fault = witnessFault(capturedWitness, head);
+    if (fault) {
+        throw new Error(`verify refused: HEAD's reflog cannot witness the candidate (${fault}) — record HEAD moves in this checkout, then verify again`);
     }
-    catch {
-        return "";
-    } };
-    const headLogAtCapture = headLog();
+    const headReflogAtCapture = capturedWitness.lines.join("\n");
     const baseTip = (await shGitOk(`git rev-parse '${values.base}'`, cwd).catch(() => {
         throw new Error(`--base ${values.base} is not a resolvable ref — pass --base <ref> naming the branch this diff targets`);
     })).trim();
@@ -501,9 +509,13 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
     let subjectLatch;
     const subjectChange = async () => {
         const now = await shGitOk("git rev-parse HEAD", cwd).then((out) => out.trim(), () => undefined);
+        // The latch reads HEAD's reflog through git as a validated witness, refuses before capture when it
+        // is absent or invalid, and compares it line for line at every subject check.
+        const witness = now === head ? await reflogWitness(cwd, "HEAD") : undefined;
+        const reflogMoved = witness !== undefined && (witness.code !== 0 || witness.lines.join("\n") !== headReflogAtCapture || witness.lines[0] !== head);
         const why = now === undefined ? "HEAD is unreadable"
             : now !== head ? `HEAD moved from ${head.slice(0, 12)} to ${now.slice(0, 12)}`
-                : headLog() !== headLogAtCapture ? `HEAD moved and was restored to ${head.slice(0, 12)} (its reflog recorded the move)`
+                : reflogMoved ? `HEAD moved and was restored to ${head.slice(0, 12)} (its reflog recorded the move)`
                     : await candidateDirt();
         if (why)
             subjectLatch ??= why;

package/dist/gates/baseline.js

@@ -363,9 +363,9 @@ const VOCAB_RE = /\b(?:error|fail(?:ed|ure|ing)?)\b/i;
 // OBS-791: `[vitest-worker]: Timeout calling "<method>"` is the SAME birpc mechanism one layer up.
 // Vitest's bundled birpc has a fixed 60s DEFAULT_TIMEOUT with no override (fixed upstream only in
 // vitest 4.x), so a suite whose tests all pass can still die at teardown when the worker->host RPC
-// window closes. `.github/workflows/release.yml` has forgiven this exact fingerprint since 2026-08-11
-// while this classifier called it a regression — the product charged a worker for the failure the
-// release gate was written to forgive. The METHOD NAME IS DELIBERATELY NOT PINNED: the timeout is a
+// window closes. Public CI's proof forgives this exact fingerprint (the RPC-only rule; since v2.8.2 decided
+// from the run's own record, queue rows 148 and 149) and this classifier once called it a regression — the
+// product charged a worker for the failure its own release proof forgives. The METHOD NAME IS DELIBERATELY NOT PINNED: the timeout is a
 // property of the RPC window, not of `onTaskUpdate`, and pinning one method would forgive a run and
 // charge its sibling for the same infrastructure event. This stays a CLOSED signature — the
 // `[vitest-worker]: ` prefix is vitest's own RPC layer and never user assertion text — and the

package/dist/gates/run-gates.js

@@ -19,7 +19,7 @@ import { discoverTestManifest, evaluateManifestedTest, isVitestTestCommand, mani
 import { RUNNER_INFRA_DIAGNOSTIC_RE, timeoutShaped } from "./timeout-shaped.js";
 import { executionSignal } from "../run/execution-budget.js";
 import { failureDisposition } from "../run/recovery.js";
-import { dependencyLinkRefusal, preserveWorktree, producerFields, readCapacity, shGit, resolvedCapacity, sameCapacity, verificationProtocol } from "../run/git.js";
+import { dependencyLinkRefusal, preserveWorktree, producerFields, readCapacity, reflogWitness, shGit, resolvedCapacity, sameCapacity, verificationProtocol } from "../run/git.js";
 import { withJudgeInvocationEvidence } from "../run/journal.js";
 import { computeVerificationIdentity, verificationIdentityKey, formatReusedRow, getVerdictStore, isInfraResult, resolveStateDir, reusedIdentity, } from "./cache.js";
 const productionLoadProvider = () => loadavg()[0] ?? 0;
@@ -437,6 +437,49 @@ export async function judgeContradictions(worktree, head, fresh, priors) {
     }
     return found;
 }
+const SUBJECT_LEG_TEXT = {
+    moved: "moved", restored: "moved and restored", witness: "could not be witnessed", unreadable: "is unreadable",
+};
+/** ANL-023 §7.4 S0, read-only: HEAD's symbolic state and its reflog W(HEAD) — plus, when attached, its branch's
+ * W(R) — each valid for the sampled `commit`. A move made inside the checkout writes both logs, a branch move from
+ * another worktree only the branch's, a same-commit retarget only HEAD's, so both are kept. */
+async function openSubjectWitness(dir, commit) {
+    const sym = await shGit("git symbolic-ref -q HEAD", dir);
+    if (sym.code !== 0 && sym.code !== 1)
+        return { leg: "unreadable" };
+    const ref = sym.code === 0 ? sym.stdout.trim() : undefined;
+    const logs = [];
+    for (const name of ref ? ["HEAD", ref] : ["HEAD"]) {
+        const w = await reflogWitness(dir, name);
+        if (w.code !== 0 || w.lines[0] !== commit)
+            return { leg: "witness" };
+        logs.push(w.lines.join("\n"));
+    }
+    return { ref, logs };
+}
+/** ANL-023 §7.4, after the seat returns: HEAD = `commit`, its symbolic state and referent unchanged, and both logs
+ * line for line as S0 found them — or the leg that changed, with the HEAD it found. */
+async function adjudicationSubjectChange(dir, commit, s0) {
+    const head = await shGit("git rev-parse HEAD", dir);
+    if (head.code !== 0)
+        return { leg: "unreadable", found: "unreadable" };
+    const found = head.stdout.trim();
+    if (found !== commit)
+        return { leg: "moved", found };
+    const sym = await shGit("git symbolic-ref -q HEAD", dir);
+    if (sym.code !== 0 && sym.code !== 1)
+        return { leg: "unreadable", found: "unreadable" };
+    if ((sym.code === 0 ? sym.stdout.trim() : undefined) !== s0.ref)
+        return { leg: "moved", found };
+    for (const [i, name] of (s0.ref ? ["HEAD", s0.ref] : ["HEAD"]).entries()) {
+        const w = await reflogWitness(dir, name);
+        if (w.code !== 0)
+            return { leg: "unreadable", found: "unreadable" };
+        if (w.lines.join("\n") !== s0.logs[i])
+            return { leg: "restored", found };
+    }
+    return undefined;
+}
 export async function runGates(task, ctx) {
     const results = [];
     const evidence = {
@@ -1147,6 +1190,11 @@ export async function runGates(task, ctx) {
         // reused. Only a criterion that REVERSES the newest prior ruling on the same subject key over
         // identical cited blobs needs a second, distinct judge; agreement stands (a sound FAIL included),
         // and a split, no distinct eligible seat or an unreadable adjudication parks for the operator.
+        // 2.8.1 T4 (ANL-023 §7.4): the record names the commit it judged, under a validated subject witness. Only when
+        // a second seat is about to run, the subject witness (HEAD's reflog and, when attached, its branch's reflog) is
+        // validated for the sampled HEAD before the second seat runs, read-only, and re-read after it returns with HEAD
+        // and its symbolic state; a move, a move-and-restore or an unwitnessable (or unreadable) subject parks infra with
+        // no record stamped and no worker charge.
         const adjudicate = async (fresh) => {
             const primary = String(fresh.meta?.judge ?? channelKey({ adapter: ctx.cfg.judge.adapter, model: ctx.cfg.judge.model }));
             const head = await shGit("git rev-parse HEAD", ctx.worktree);
@@ -1179,7 +1227,19 @@ export async function runGates(task, ctx) {
             const seatVia = via
                 ? { driver: via.driver, keep: via.keep, onSlot: via.onSlot, name: via.nameFor("judge", seatAdapter.id) + "-r2", label: via.labelFor("judge") }
                 : undefined;
+            const subjectPark = (leg, found, ran) => ({
+                gate: "acceptance", pass: false,
+                details: `the adjudication subject ${SUBJECT_LEG_TEXT[leg]}: sampled ${commit.slice(0, 12)}, found ${found.slice(0, 12)} (${leg}); parked for an operator ruling, no worker charge`,
+                meta: { classification: "infra", infra: true, retryable: false, cause: "subject-moved", judge: primary,
+                    adjudication: { primary, ...(ran ? { adjudicator: ran } : {}), sampled: commit, found, leg } },
+            });
+            const s0 = await openSubjectWitness(ctx.worktree, commit);
+            if ("leg" in s0)
+                return subjectPark(s0.leg, s0.leg === "unreadable" ? "unreadable" : commit);
             const second = await invokeJudge(seatAdapter, seat.model, seatVia, configuredEffort(ctx.cfg, seat));
+            const changed = await adjudicationSubjectChange(ctx.worktree, commit, s0);
+            if (changed)
+                return subjectPark(changed.leg, changed.found, adjudicator);
             const rulings = Array.isArray(second.meta?.judgment) ? second.meta.judgment : undefined;
             // A citation-less ruling cannot be compared, so it confirms nothing (invented evidence is already unparseable,
             // and an internally inconsistent verdict carries no judgment rows at all).

package/dist/run/daemon.d.ts

@@ -5,8 +5,9 @@ import { type ExecutorDriver, type Slot } from "../drivers/types.js";
 import { type Baseline, type BaselineProvenance, type GateEvidenceOptions } from "../gates/baseline.js";
 import type { GateResult } from "../gates/types.js";
 import { type RunGraph, type Task } from "../graph/schema.js";
-import { type PreserveProducer } from "./git.js";
+import { type PreserveProducer, type RunCapacity } from "./git.js";
 import { Journal, type JournalEvent } from "./journal.js";
+import { type IntegrationLeg, type IntegrationRefState, type TipVerifyResult } from "./merge.js";
 export declare function closeLiveSlot(liveSlots: Set<Slot>, driver: Pick<ExecutorDriver, "close">, slot: Slot): Promise<void>;
 export declare function setContactUnreadableDeadlineMsForTests(ms: number): void;
 export declare function resetContactUnreadableDeadlineMsForTests(): void;
@@ -246,23 +247,86 @@ export interface TipProof {
 export declare function runEndTipProof(events: readonly JournalEvent[]): TipProof;
 /** The close notification's statement of the proof — one clause per kind. */
 export declare function formatTipProof(p: TipProof): string;
+/** 2.8.1 T1 (ANL-023 §7.1): what run end checks the integration ref against; `expected` absent = the opening read. */
+export interface TipIdentity {
+    repo: string;
+    branch: string;
+    expected?: string;
+}
+export type IdentityLeg = IntegrationLeg | "setup" | "witness" | "checkout";
+type DeferredVerdict = NonNullable<TipVerifyResult["deferredVerdict"]>;
+/** One close under an identity: `expected` is what the closing check must find; `identityFailed` skips it. */
+export interface TipClose {
+    failed: boolean;
+    expected?: string;
+    identityFailed: boolean;
+    deferred: DeferredVerdict[];
+}
+interface TipVerifyOptions {
+    lastMergedTask?: string;
+    baseline?: Baseline;
+    signal?: AbortSignal;
+    evidence?: GateEvidenceOptions;
+}
+/**
+ * 2.8.1 T3 (ANL-023 §7.3): anchor A of a run whose run-start carries `integrationAnchor: "journal"` — the newest merge
+ * row's commit (that row must carry a `from`), else the run-start base; any of them not an object id is unreadable.
+ * No marker: undefined (legacy-ref). Resume and approve both read it.
+ */
+export declare function integrationAnchor(events: readonly JournalEvent[]): {
+    anchor: string;
+} | {
+    unreadable: string;
+} | undefined;
+/** The ref legs' details: the leg, both commits, the symbolic target and the repair text. */
+export declare function identityDetails(leg: IntegrationLeg, state: IntegrationRefState, branch: string, runId: string, expected: string | undefined): string;
+/**
+ * The one closed outcome row for every identity leg: an integration `tip-verify-failed` (preceded by a start row
+ * with no gates when this close appended none), which runEndTipProof and every consumer already read as failure.
+ */
+export declare function appendIdentityFailure(journal: Journal, f: {
+    started: boolean;
+    branch: string;
+    expected?: string;
+    leg: IdentityLeg;
+    details: string;
+    state?: IntegrationRefState;
+    cmdHash: string;
+    capacity: RunCapacity;
+    infra?: boolean;
+}): void;
+/** O: I(expected) — or, with no expected value, the ref must be regular and its commit becomes the expected. */
+export declare function openingIdentity(identity: TipIdentity, journal: Journal): Promise<{
+    ok: true;
+    expected: string;
+} | {
+    ok: false;
+    leg: IntegrationLeg;
+    state: IntegrationRefState;
+    expected?: string;
+    details: string;
+}>;
 /**
  * OBS-34's strict tip verify, but it stops re-paying for an unmoved tip (~334m corpus-wide; 69.5m in
  * one park-heavy run whose 18 resume cycles merged nothing new). The verify journals the SHA it
  * verified and the hash of the command set, so a later run-end can recognize the same verified state:
- * head equals the LAST green verified SHA, commands unchanged, tree clean → journal
- * `tip-verify-cached` and skip. ANY doubt — moved head, changed commands, dirty tree, a gate missing
- * from that cycle's green set, a failure recorded in it, a cycle older than the last one — runs the
- * full verify. The tip-verify-before-green law is untouched: a cached green is a verified green OF
- * THAT EXACT COMMIT, established by the most recent real run of the same commands.
- * Returns whether the tip is failing.
+ * the expected commit equals the LAST green verified SHA and the commands are unchanged → journal
+ * `tip-verify-cached` and skip, with no checkout. ANY doubt — moved tip, changed commands, a gate
+ * missing from that cycle's green set, a failure recorded in it, a cycle older than the last one —
+ * runs the full verify. 2.8.1 T1 (ANL-023 §7.1): with `identity` (the daemon always passes it) run end
+ * verifies a fresh detached checkout of the expected commit under a validated HEAD reflog, never the
+ * integration checkout; it checks tracked content after the battery (the battery-end check also proves
+ * the checkout's HEAD and its reflog unchanged), defers verdict-store writes to the caller, and the
+ * caller closes on an identity check taken after the approval serialization with no await before the
+ * run-end row. The opening check reads the ref before the cycle decision, so a cached green is carried
+ * only for the commit the ref holds now. A caller without `identity` keeps the integration checkout's
+ * head and clean tree as the cache key, exactly as before.
+ * Returns whether the tip is failing (without `identity`) or the close's TipClose (with it).
  */
-export declare function verifyIntegrationTipCached(intWt: string, commands: Record<string, string>, journal: Journal, opts?: {
-    lastMergedTask?: string;
-    baseline?: Baseline;
-    signal?: AbortSignal;
-    evidence?: GateEvidenceOptions;
-}): Promise<boolean>;
+export declare function verifyIntegrationTipCached(intWt: string, commands: Record<string, string>, journal: Journal, opts: TipVerifyOptions & {
+    identity: TipIdentity;
+}): Promise<TipClose>;
+export declare function verifyIntegrationTipCached(intWt: string, commands: Record<string, string>, journal: Journal, opts?: TipVerifyOptions): Promise<boolean>;
 type WorkerProcessTree = "empty" | "running" | "unmeasurable";
 export declare function observeWorkerProcessTree(marker: string, cwd: string): Promise<WorkerProcessTree>;
 type SuitePidProbe = (pid: number) => number | undefined;