tickmarkr 2.8.0 → 2.8.2

package/dist/run/git.d.ts

@@ -198,16 +198,29 @@ export declare function shGitOk(cmd: string, cwd: string, own?: OwnGitOptions):
  * A step raced by a commondir change is refused by name before the next one runs, and what the add created is rolled
  * back through the trusted common directory derived here once (dropWorktree), even while that commondir stays hostile.
  */
-export declare function addDetachedWorktree(cwd: string, dir: string, commitish: string, timeoutMs?: number): Promise<ShResult>;
+export declare function addDetachedWorktree(cwd: string, dir: string, commitish: string, timeoutMs?: number, { logHead }?: {
+    logHead?: boolean | undefined;
+}): Promise<ShResult>;
+/**
+ * 2.8.1 T1 (ANL-023 §7.1): the reflog witness W(dir, ref) — read-only, the newest entry first. It is valid for a commit
+ * x only when the exit is 0, at least one line came back and the first is x: exit 0 with no lines is git's answer for
+ * a missing or unreadable log, so an empty witness is a refusal, never an accepted empty.
+ */
+export declare function reflogWitness(dir: string, ref: string): Promise<{
+    code: number;
+    lines: string[];
+}>;
 export declare function npmDependencyManifestChanged(cwd: string, baselineRef: string): Promise<boolean>;
 export declare function npmDependencyInstallCommand(cwd: string): string;
 export declare function gitHead(cwd: string): Promise<string>;
 export declare const sanitizeBranch: (branch: string) => string;
 export declare const WORKTREES_DIR = "worktrees.noindex";
 export declare const worktreePath: (repo: string, branch: string) => string;
-/** OBS-28: remove this run's recorded worktrees; tolerates already-gone paths. */
+/**
+ * OBS-28: remove this run's recorded task worktrees; tolerates already-gone paths. 2.8.1 T2: a run keeps no
+ * integration checkout, and a 2.8.0 run's legacy one is never removed here (it may hold the only view of a merge).
+ */
 export declare function cleanupRunWorktrees(repo: string, branch: string, opts: {
-    removeIntegration: boolean;
     removeTaskIds: string[];
 }): Promise<void>;
 export declare function resolveIntegrationBranch(_repo: string, branch: string): Promise<string>;

package/dist/run/git.js

@@ -607,7 +607,10 @@ export async function shGitOk(cmd, cwd, own = {}) {
  * A step raced by a commondir change is refused by name before the next one runs, and what the add created is rolled
  * back through the trusted common directory derived here once (dropWorktree), even while that commondir stays hostile.
  */
-export async function addDetachedWorktree(cwd, dir, commitish, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS) {
+export async function addDetachedWorktree(cwd, dir, commitish, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS, { logHead = false } = {}) {
+    // 2.8.1 T1 (ANL-023 §7.1): `logHead` writes the new checkout's HEAD reflog whatever the repository's
+    // core.logAllRefUpdates says, so a later HEAD move by any command is appended to an established witness.
+    const git = logHead ? "git -c core.logAllRefUpdates=always" : "git";
     // the authority this operation keeps, rollback included: derived once from the trusted layout, never a commondir
     const store = trustedCommonDir(cwd);
     const resolved = await shGit(`git rev-parse --verify --end-of-options ${shq(`${commitish}^{commit}`)}`, cwd, timeoutMs);
@@ -616,12 +619,12 @@ export async function addDetachedWorktree(cwd, dir, commitish, timeoutMs = DEFAU
     const oid = resolved.stdout.trim();
     // under a ref payload git also resolves its new-HEAD stub into a shared refs/heads/.invalid; it is deleted again
     const rollback = { dir, branch: { name: ".invalid" } };
-    const added = await shellEntry(`git worktree add --no-checkout --detach ${shq(dir)} ${shq(oid)}`, cwd, timeoutMs, false, {}, { createsWorktree: "detached", rollback });
+    const added = await shellEntry(`${git} worktree add --no-checkout --detach ${shq(dir)} ${shq(oid)}`, cwd, timeoutMs, false, {}, { createsWorktree: "detached", rollback });
     if (added.code !== 0)
         return added;
     let repaired;
     try {
-        repaired = await shGit(`git update-ref --no-deref HEAD ${shq(oid)} && git update-ref -d refs/heads/.invalid && git reset -q --hard --no-recurse-submodules`, dir, timeoutMs);
+        repaired = await shGit(`${git} update-ref --no-deref HEAD ${shq(oid)} && ${git} update-ref -d refs/heads/.invalid && ${git} reset -q --hard --no-recurse-submodules`, dir, timeoutMs);
     }
     catch (error) {
         await dropWorktree(store, rollback, timeoutMs).catch((failure) => { throw rollbackFailed(error, failure); });
@@ -631,6 +634,15 @@ export async function addDetachedWorktree(cwd, dir, commitish, timeoutMs = DEFAU
         await dropWorktree(store, rollback, timeoutMs);
     return repaired;
 }
+/**
+ * 2.8.1 T1 (ANL-023 §7.1): the reflog witness W(dir, ref) — read-only, the newest entry first. It is valid for a commit
+ * x only when the exit is 0, at least one line came back and the first is x: exit 0 with no lines is git's answer for
+ * a missing or unreadable log, so an empty witness is a refusal, never an accepted empty.
+ */
+export async function reflogWitness(dir, ref) {
+    const r = await shGit(`git reflog show --no-abbrev --format=%H ${shq(ref)}`, dir);
+    return { code: r.code, lines: r.stdout.split("\n").map((line) => line.trim()).filter(Boolean) };
+}
 /** A failed rollback is never swallowed: it rides on the error the operation already throws (a refusal stays one). */
 function rollbackFailed(error, failure) {
     const why = `; its rollback failed, so what it created may remain: ${failure instanceof Error ? failure.message : String(failure)}`;
@@ -738,10 +750,11 @@ const sanitize = sanitizeBranch;
 // once after this rename — the same one-time per-install cost as the v1.38 state-dir rename.
 export const WORKTREES_DIR = "worktrees.noindex";
 export const worktreePath = (repo, branch) => join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
-/** OBS-28: remove this run's recorded worktrees; tolerates already-gone paths. */
+/**
+ * OBS-28: remove this run's recorded task worktrees; tolerates already-gone paths. 2.8.1 T2: a run keeps no
+ * integration checkout, and a 2.8.0 run's legacy one is never removed here (it may hold the only view of a merge).
+ */
 export async function cleanupRunWorktrees(repo, branch, opts) {
-    if (opts.removeIntegration)
-        await removeWorktree(repo, worktreePath(repo, branch));
     for (const id of opts.removeTaskIds)
         await removeWorktree(repo, worktreePath(repo, `${branch}--${id}`));
 }

package/dist/run/merge.d.ts

@@ -1,5 +1,6 @@
 import type { TickmarkrConfig } from "../config/config.js";
 import { type Baseline, type BaselineProvenance, type GateEvidenceOptions, type FailureClassification } from "../gates/baseline.js";
+import { type VerificationIdentity } from "../gates/cache.js";
 import type { GateEvidenceReceipt } from "./protocol.js";
 export interface TipVerifyResult {
     evidenceReceipt?: GateEvidenceReceipt;
@@ -30,18 +31,124 @@ export interface TipVerifyResult {
      * for a kill, the shared runner classifier for everything else. `infra` means nothing was verified.
      */
     cause?: FailureClassification;
+    /** 2.8.1 T1: with `deferVerdicts`, the verdict-store write this result would have made, left to the caller. */
+    deferredVerdict?: {
+        id: VerificationIdentity;
+        verdict: TipVerifyResult & {
+            meta: Record<string, unknown>;
+        };
+    };
 }
 /** Carry execution evidence without minting an invocation or rebasing its artifact paths. */
 export declare function reusedTipEvidence(source: Partial<TipVerifyResult>): Partial<TipVerifyResult>;
 export declare function integrationBranch(cfg: TickmarkrConfig, runId: string): string;
+/**
+ * 2.8.1 T2 (ANL-023 §7.2): creates the integration ref create-only at `baseRef` (the empty old value means "must not
+ * exist") and returns the published tip E. The run keeps no checkout of the branch: every later publication is a
+ * compare-and-swap of the ref from `repo` (mergeTask). An existing or uncreatable ref throws — the fatal path's text.
+ */
 export declare function ensureIntegration(repo: string, branch: string, baseRef: string): Promise<string>;
-export declare function integrationHead(intWt: string): Promise<string>;
-export declare function mergeTask(intWt: string, taskBranch: string, message: string, gatedCommit: string): Promise<{
-    ok: boolean;
-    conflict?: string;
-    tipMoved?: {
+/** 2.8.1 T1 (ANL-023 §7.1): the closed states of the integration ref, as R(ref) reads them. */
+export type IntegrationRefState = {
+    kind: "regular";
+    commit: string;
+} | {
+    kind: "missing";
+} | {
+    kind: "symbolic";
+    target: string;
+    commit?: string;
+} | {
+    kind: "unreadable";
+    read: string;
+};
+export type IntegrationLeg = "symbolic" | "missing" | "value" | "unreadable";
+/**
+ * R(ref): the integration ref read from `repo` through the own-git runner, never its reflog. The exact ref only —
+ * a descendant ref (`refs/heads/<branch>/x`) is not this ref, and a ref that exists but names no commit is unreadable.
+ */
+export declare function readIntegrationRef(repo: string, branch: string): Promise<IntegrationRefState>;
+/** I(x): holds iff the ref is regular at x; otherwise the leg, with the state the repair text is chosen by. */
+export declare function checkIntegrationIdentity(repo: string, branch: string, expected: string): Promise<{
+    ok: true;
+    state: IntegrationRefState;
+} | {
+    ok: false;
+    leg: IntegrationLeg;
+    state: IntegrationRefState;
+}>;
+/**
+ * The repair text (shared by run end's failure row, the merge park and the resume refusal): backticked commands run
+ * from the repository root in order, stopping at the first that fails. A found commit is preserved create-only under
+ * refs/tickmarkr/found/<runId>/<F> before a no-deref compare-and-swap restores the ref; a symbolic found ref or one
+ * already holding another commit stops the sequence before the restore. Dangling and unreadable print no command.
+ */
+export declare function integrationRepairText(state: IntegrationRefState, branch: string, runId: string, expected: string): string;
+type GitResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+/** The merge's git steps after the identity check, in order; `publish` is the compare-and-swap. */
+export type MergeStep = "ancestry" | "merge-tree" | "commit-tree" | "publish";
+/** Test-only: runs before each step; a returned result replaces that step's git result (never `publish`'s). */
+export type MergeSeam = (step: MergeStep) => Promise<GitResult | void> | GitResult | void;
+export interface IntegrationMove {
+    branch: string;
+    expected: string;
+    found: string | null;
+    leg: IntegrationLeg;
+    target?: string;
+    stage: "check" | "publish";
+}
+export type MergeOutcome = {
+    ok: true;
+    commit: string;
+    from: string;
+} | {
+    ok: true;
+    alreadyMerged: string;
+} | {
+    ok: false;
+    tipMoved: {
         gatedCommit: string;
         branchTip: string;
     };
-}>;
-export declare function verifyIntegrationTip(intWt: string, commands: Record<string, string>, runDir: string, baseline?: Baseline, evidenceOptions?: GateEvidenceOptions): Promise<TipVerifyResult[]>;
+} | {
+    ok: false;
+    conflict: string;
+} | {
+    ok: false;
+    integrationMoved: IntegrationMove;
+    state: IntegrationRefState;
+} | {
+    ok: false;
+    alreadyIntegrated: {
+        gated: string;
+        tip: string;
+    };
+} | {
+    ok: false;
+    infra: {
+        step: MergeStep;
+        message: string;
+    };
+};
+/**
+ * 2.8.1 T2 (ANL-023 §7.2): publishes `gated` onto the integration ref by compare-and-swap from the stored tip
+ * `expected`, all git from `repo` — no checkout. (1) the task-tip check; (2) I(expected); (3) ancestry; (4) merge-tree;
+ * (5) commit-tree; (6) `update-ref --no-deref` from `expected`; (7) `onPublished(M)` in the same synchronous
+ * continuation as (6)'s result, so the caller's rows land in publication order. `merged` is the task's recorded merge
+ * commits, newest first: a gated commit already in the history is done only through its own recorded merge.
+ * `ancestorOnly` (a replay that ran no gates): a gated commit not in E is refused `infra`, never published.
+ */
+export declare function mergeTask(repo: string, { branch, expected, merged, ancestorOnly }: {
+    branch: string;
+    expected: string;
+    merged?: readonly string[];
+    ancestorOnly?: boolean;
+}, taskBranch: string, message: string, gated: string, onPublished: (commit: string) => void, seam?: MergeSeam): Promise<MergeOutcome>;
+export declare function verifyIntegrationTip(intWt: string, commands: Record<string, string>, runDir: string, baseline?: Baseline, evidenceOptions?: GateEvidenceOptions, { deferVerdicts }?: {
+    deferVerdicts?: boolean;
+}): Promise<TipVerifyResult[]>;
+export {};

package/dist/run/merge.js

@@ -4,8 +4,7 @@ import { shq } from "../adapters/types.js";
 import { baselineEntryRefusal, beginGateEvidence, ceilingKillResult, classifyFreshRunnerOutput, classifyRunnerOutput, fileCountDeficit, waitForCalmWindow, effectiveCeilingMs, classifiedFileDurations, fingerprint, freshFailures, } from "../gates/baseline.js";
 import { evaluateManifestedTest, isVitestTestCommand } from "../gates/test-manifest.js";
 import { computeVerificationIdentity, formatReusedDetails, getVerdictStore, getWorktreeTree, resolveStateDir, isInfraResult, } from "../gates/cache.js";
-import { tickmarkrDir } from "../graph/graph.js";
-import { dependencyLinkRefusal, describeCapacity, gitHead, linkNodeModules, resolveIntegrationBranch, resolvedCapacity, sameCapacity, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
+import { dependencyLinkRefusal, describeCapacity, resolveIntegrationBranch, resolvedCapacity, sameCapacity, sh, shGit } from "./git.js";
 import { executionSignal } from "./execution-budget.js";
 // Diagnostic convenience logs are observational, just like receipt persistence.
 function writeTipLog(path, text) {
@@ -32,42 +31,131 @@ export function reusedTipEvidence(source) {
 export function integrationBranch(cfg, runId) {
     return `${cfg.integrationBranchPrefix}${runId}`;
 }
-const sanitize = (branch) => branch.replace(/[^\w.-]+/g, "-");
+/**
+ * 2.8.1 T2 (ANL-023 §7.2): creates the integration ref create-only at `baseRef` (the empty old value means "must not
+ * exist") and returns the published tip E. The run keeps no checkout of the branch: every later publication is a
+ * compare-and-swap of the ref from `repo` (mergeTask). An existing or uncreatable ref throws — the fatal path's text.
+ */
 export async function ensureIntegration(repo, branch, baseRef) {
     branch = await resolveIntegrationBranch(repo, branch);
-    const dir = join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
-    if (!existsSync(join(dir, ".git"))) {
-        const exists = (await shGit(`git rev-parse --verify refs/heads/${shq(branch)}`, repo)).code === 0;
-        if (exists) {
-            await shGitOk(`git worktree add ${shq(dir)} ${shq(branch)}`, repo, { createsWorktree: "branch", rollback: { dir } });
-        }
-        else {
-            await shGitOk(`git worktree add -b ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo, { createsWorktree: "branch", rollback: { dir, branch: { name: branch } } });
-        }
-    }
-    linkNodeModules(repo, dir);
-    return dir;
+    // ponytail: no --create-reflog (ANL-023 §7.2 names it): the repository's own core.logAllRefUpdates decides, because
+    // nothing reads this reflog (X10) and run-end-integration's E-P10 builds its no-reflog legacy branch through a fresh
+    // run with logging disabled. Add the flag back once that fixture builds its legacy branch by hand.
+    const r = await shGit(`git update-ref --no-deref -m ${shq("tickmarkr: run start")} ${shq(`refs/heads/${branch}`)} ${shq(baseRef)} ""`, repo);
+    if (r.code !== 0)
+        throw new Error(`integration branch ${branch} already exists or cannot be created: ${(r.stderr || r.stdout).trim()}`);
+    return baseRef;
+}
+/**
+ * R(ref): the integration ref read from `repo` through the own-git runner, never its reflog. The exact ref only —
+ * a descendant ref (`refs/heads/<branch>/x`) is not this ref, and a ref that exists but names no commit is unreadable.
+ */
+export async function readIntegrationRef(repo, branch) {
+    const ref = `refs/heads/${branch}`;
+    const unreadable = (cmd, r) => ({ kind: "unreadable", read: `${cmd} exited ${r.code}${(r.stderr || r.stdout).trim() ? `: ${(r.stderr || r.stdout).trim()}` : ""}` });
+    const symbolic = await shGit(`git symbolic-ref -q ${shq(ref)}`, repo);
+    if (symbolic.code !== 0 && symbolic.code !== 1)
+        return unreadable("git symbolic-ref", symbolic);
+    const commit = await shGit(`git rev-parse --verify -q ${shq(`${ref}^{commit}`)}`, repo);
+    if (commit.code !== 0 && commit.code !== 1)
+        return unreadable("git rev-parse", commit);
+    const found = commit.code === 0 ? commit.stdout.trim() : undefined;
+    if (symbolic.code === 0)
+        return { kind: "symbolic", target: symbolic.stdout.trim(), ...(found ? { commit: found } : {}) };
+    if (found)
+        return { kind: "regular", commit: found };
+    const exists = await shGit(`git show-ref --verify -q ${shq(ref)}`, repo);
+    return exists.code === 1 ? { kind: "missing" } : unreadable("git show-ref", exists);
 }
-export function integrationHead(intWt) {
-    return gitHead(intWt);
+/** I(x): holds iff the ref is regular at x; otherwise the leg, with the state the repair text is chosen by. */
+export async function checkIntegrationIdentity(repo, branch, expected) {
+    const state = await readIntegrationRef(repo, branch);
+    if (state.kind === "regular" && state.commit === expected)
+        return { ok: true, state };
+    return { ok: false, leg: state.kind === "regular" ? "value" : state.kind, state };
 }
-export async function mergeTask(intWt, taskBranch, message, gatedCommit) {
-    const tip = await shGit(`git rev-parse --verify ${shq(`refs/heads/${taskBranch}`)}`, intWt);
+/**
+ * The repair text (shared by run end's failure row, the merge park and the resume refusal): backticked commands run
+ * from the repository root in order, stopping at the first that fails. A found commit is preserved create-only under
+ * refs/tickmarkr/found/<runId>/<F> before a no-deref compare-and-swap restores the ref; a symbolic found ref or one
+ * already holding another commit stops the sequence before the restore. Dangling and unreadable print no command.
+ */
+export function integrationRepairText(state, branch, runId, expected) {
+    const ref = `refs/heads/${branch}`;
+    const byHand = `inspect ${ref} and restore it to ${expected} by hand`;
+    const found = state.kind === "regular" ? state.commit : state.kind === "symbolic" ? state.commit : undefined;
+    if (found) {
+        const keep = `refs/tickmarkr/found/${runId}/${found}`;
+        return `\`test -z "$(git symbolic-ref -q ${keep})"\` then \`test "$(git rev-parse -q --verify ${keep})" = ${found} || git update-ref --no-deref ${keep} ${found} ""\` then \`git update-ref --no-deref ${ref} ${expected} ${found}\``;
+    }
+    if (state.kind === "missing")
+        return `\`git update-ref --no-deref ${ref} ${expected} ""\``;
+    if (state.kind === "symbolic")
+        return `symbolic to ${state.target}, which names no commit; ${byHand}`;
+    return state.kind === "unreadable" ? `${ref} is unreadable (${state.read}); ${byHand}` : byHand;
+}
+/**
+ * 2.8.1 T2 (ANL-023 §7.2): publishes `gated` onto the integration ref by compare-and-swap from the stored tip
+ * `expected`, all git from `repo` — no checkout. (1) the task-tip check; (2) I(expected); (3) ancestry; (4) merge-tree;
+ * (5) commit-tree; (6) `update-ref --no-deref` from `expected`; (7) `onPublished(M)` in the same synchronous
+ * continuation as (6)'s result, so the caller's rows land in publication order. `merged` is the task's recorded merge
+ * commits, newest first: a gated commit already in the history is done only through its own recorded merge.
+ * `ancestorOnly` (a replay that ran no gates): a gated commit not in E is refused `infra`, never published.
+ */
+export async function mergeTask(repo, { branch, expected, merged = [], ancestorOnly = false }, taskBranch, message, gated, onPublished, seam) {
+    const tip = await shGit(`git rev-parse --verify ${shq(`refs/heads/${taskBranch}`)}`, repo);
     if (tip.code !== 0)
         return { ok: false, conflict: tip.stderr || tip.stdout };
     const branchTip = tip.stdout.trim();
-    if (branchTip !== gatedCommit)
-        return { ok: false, tipMoved: { gatedCommit, branchTip } };
-    // Merge the verified hash, not the mutable branch name: a move after the comparison cannot land ungated content.
-    const r = await shGit(`git merge --no-ff ${shq(gatedCommit)} -m ${shq(message)}`, intWt);
-    if (r.code === 0)
-        return { ok: true };
-    const conflict = (await shGit("git status --porcelain", intWt)).stdout
-        .split("\n")
-        .filter((l) => l.startsWith("UU") || l.startsWith("AA"))
-        .join("\n") || r.stderr || r.stdout;
-    await shGit("git merge --abort", intWt);
-    return { ok: false, conflict };
+    if (branchTip !== gated)
+        return { ok: false, tipMoved: { gatedCommit: gated, branchTip } };
+    const moved = (leg, state, stage) => ({
+        ok: false, state, integrationMoved: { branch, expected, leg, stage,
+            found: (state.kind === "regular" || state.kind === "symbolic" ? state.commit : undefined) ?? null,
+            ...(state.kind === "symbolic" ? { target: state.target } : {}) },
+    });
+    const infra = (step, r) => ({ ok: false, infra: { step, message: (r.stderr || r.stdout).trim() || `exit ${r.code}` } });
+    const run = async (step, cmd) => (await seam?.(step)) || shGit(cmd, repo);
+    const held = await checkIntegrationIdentity(repo, branch, expected);
+    if (!held.ok)
+        return moved(held.leg, held.state, "check");
+    const ancestry = await run("ancestry", `git merge-base --is-ancestor ${shq(gated)} ${shq(expected)}`);
+    if (ancestry.code === 0) {
+        // Ancestor or equal tip: only the task's own recorded merge (second parent = gated) makes it done. A resume replay
+        // hands the task's own gated commit here, never a tip recreated on E (runDaemon's resume gate replay).
+        for (const commit of merged) {
+            const second = await shGit(`git rev-parse --verify -q ${shq(`${commit}^2`)}`, repo);
+            if (second.code !== 0)
+                break; // a failed read (no second parent, no such object) is never passed over: fail closed
+            if (second.stdout.trim() === gated)
+                return { ok: true, alreadyMerged: commit };
+        }
+        return { ok: false, alreadyIntegrated: { gated, tip: expected } };
+    }
+    if (ancestry.code !== 1)
+        return infra("ancestry", ancestry);
+    // A caller that skipped the gates on its own ancestry proof (a resume replay) never reaches construction.
+    if (ancestorOnly)
+        return infra("ancestry", { code: 1, stdout: "", stderr: `${gated} is not in ${expected}; an ungated replay publishes nothing` });
+    const tree = await run("merge-tree", `git merge-tree --write-tree ${shq(expected)} ${shq(gated)}`);
+    if (tree.code === 1)
+        return { ok: false, conflict: (tree.stdout || tree.stderr).trim() };
+    if (tree.code !== 0)
+        return infra("merge-tree", tree);
+    const made = await run("commit-tree", `git commit-tree ${shq(tree.stdout.split("\n")[0].trim())} -p ${shq(expected)} -p ${shq(gated)} -m ${shq(message)}`);
+    if (made.code !== 0)
+        return infra("commit-tree", made);
+    const commit = made.stdout.trim();
+    await seam?.("publish");
+    const published = await shGit(`git update-ref --no-deref -m ${shq(message)} ${shq(`refs/heads/${branch}`)} ${shq(commit)} ${shq(expected)}`, repo);
+    if (published.code === 0) {
+        onPublished(commit); // no await between the compare-and-swap's result and the caller's rows
+        return { ok: true, commit, from: expected };
+    }
+    const state = await readIntegrationRef(repo, branch);
+    if (state.kind === "regular" && state.commit === expected)
+        return infra("publish", published);
+    return moved(state.kind === "regular" ? "value" : state.kind, state, "publish");
 }
 // OBS-34 ruled strict exit-code verify; Q121s (TRIAL T-OBS-1) narrows it: a red whose failure
 // fingerprints are ALL recorded in the run's baseline is forgiven with the battery's own math
@@ -75,7 +163,7 @@ export async function mergeTask(intWt, taskBranch, message, gatedCommit) {
 // terminus unreachable by construction and misattributed the red to the last merged task.
 // Fail-closed edges kept: no baseline → strict; baseline green for that gate → strict; any fresh
 // fingerprint, or output with no recognizable failure shape, → failed.
-export async function verifyIntegrationTip(intWt, commands, runDir, baseline, evidenceOptions = {}) {
+export async function verifyIntegrationTip(intWt, commands, runDir, baseline, evidenceOptions = {}, { deferVerdicts = false } = {}) {
     const results = [];
     let runStartCommands;
     let journalFound = false;
@@ -414,7 +502,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
         }
         const id = pending.get(result.gate);
         if (id && id.tree === completedTree && !isInfraResult(result)) {
-            store.set(id, { ...result, meta: {
+            const verdict = { ...result, meta: {
                     fingerprints: result.fingerprints, forgiven: result.forgiven, baselineProvenance: result.baselineProvenance,
                     ...(result.forgiven && result.gate === "test" ? { killTextRead: true } : {}),
                     reportPath: result.reportPath, spawnedCommand: result.spawnedCommand,
@@ -422,7 +510,12 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
                     evidenceReceipt: result.evidenceReceipt, evidenceReceipts: result.evidenceReceipts,
                     evidenceAbsence: result.evidenceAbsence, originRunRoot: result.originRunRoot,
                     nonce: result.nonce, stdoutPath: result.stdoutPath, stderrPath: result.stderrPath,
-                } });
+                } };
+            // 2.8.1 T1: a deferring caller (run end) writes the verdict itself, only after its closing identity check.
+            if (deferVerdicts)
+                result.deferredVerdict = { id, verdict };
+            else
+                store.set(id, verdict);
         }
     }
     return results;

package/dist/run/wall-budget.js

@@ -74,7 +74,12 @@ export function wallBudget(events) {
             return;
         span("queue", opened, ts);
         // One open wait per owner, closed in journal order: the list stays sorted and non-overlapping.
-        queued.set(key, [...(queued.get(key) ?? []), [opened, ts]]);
+        // Appended in place: a copy per close made a run with n waits cost O(n^2) (ANL-022 §3 T1 #5).
+        const list = queued.get(key);
+        if (list)
+            list.push([opened, ts]);
+        else
+            queued.set(key, [[opened, ts]]);
         waits.delete(key);
     };
     const service = (gate, task, a, b) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.8.0",
+  "version": "2.8.2",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",
@@ -77,7 +77,6 @@
         "tsconfig.json",
         "vitest.config.ts",
         ".github/pull_request_template.md",
-        "scripts/assert-test-file-count.sh",
         "scripts/emit-schema.ts",
         "scripts/probe-rig.mjs",
         "scripts/run-ci-vitest.sh",

package/skills/tickmarkr-overseer/SKILL.md

@@ -503,6 +503,14 @@ journal tail to decide what happens next, or sweeping orphans — you have taken
    - **the INTEGRATION subject** — the integration-branch commit that worktree was created from, named by
      sha from the journal's `task-dispatch` row or `tickmarkr status`; never "the run", and never the
      branch name alone, which moves while you are reading it;
+   - **the operator view of that branch** — a live run has NO integration checkout: the daemon publishes
+     each merge onto `tickmarkr/<runId>` by compare-and-swap from the repository root. View it through a
+     detached snapshot (`git worktree add --detach <dir> tickmarkr/<runId>`), refreshed by removing it
+     (`git worktree remove <dir>`) and re-adding it; check the branch out attached only with the daemon
+     stopped (no live `graph.lock`) — an attached checkout taken while the run is live goes stale at the next
+     publication, and any write to the ref parks the next merge infra. Run `tickmarkr verify` and `report`
+     from the main checkout or a snapshot;
+     a legacy attached view from a 2.8.0 run is stale from the first publication;
    - **and, where the fix is a FILE the tree must hold** — a new test, a fixture, a schema — its presence
      at that commit: `git -C <task-worktree> cat-file -e <task-head>:<path>`. A fix that lives only in the
      daemon's `dist` cannot make a worker's missing oracle appear, and a worker red on that missing file is
@@ -683,12 +691,13 @@ subject of a release proof is never *"the run"* and never *"the fix leg"* — it
 the one commit that carries the run's work AND every leg merged into it. Name that commit's sha in the
 proof, in the same act as the grade, and the proof is bound to that sha alone. **When the subject moves — a
 later merge, a new integration tip, an amended or re-cut commit, a fresh export, a re-tag — the proof is
-VOID, and the new subject is graded from scratch**, count oracle included, since the oracle is derived from
-the merged tree and not from either parent. Two greens assembled into one verdict are two claims about two
-trees that never contained each other: the union's own conflict resolutions, its ordering and its
-collected-test total are exactly what neither green observed — which is why `RELEASING.md` step 4 matches
-the run's head SHA to the mirror's `HEAD` before a single job log is graded. This is the void-condition duty
-pointed at bytes: **a proof that names no commit cannot notice its subject leaving.**
+VOID, and the new subject is graded from scratch**, its tracked test set included, since that set is
+recomputed from the merged tree and not from either parent. Two greens assembled into one verdict are two
+claims about two trees that never contained each other: the union's own conflict resolutions, its ordering
+and its collected test set are exactly what neither green observed — which is why `RELEASING.md` step 4
+hands the grader the mirror's `HEAD` and the grader refuses a run of any other head before a single record
+is downloaded. This is the void-condition duty pointed at bytes: **a proof that names no commit cannot
+notice its subject leaving.**
 
 **THE RECIPROCAL DUTY, and it is yours because you write both documents:** when you issue a ruling that
 re-scopes, narrows, splits or re-owns anything, **the ruling must name every sealed document its subject
@@ -1051,7 +1060,8 @@ they are left implicit:
      test exists — the acceptance oracle runs the sentence as vitest `-t` and a paraphrase matches zero tests.
    - Every fix-leg verify carries `--author <the seat that wrote it>`; without it the author is HUMAN, every
      vendor stays eligible, and a same-vendor approval is not the cross-vendor review the criterion names.
-   - A grader change is proved on a captured REAL job log, never on a synthetic one.
+   - A grader change is proved on a recorded run — GitHub's structured run record and the proof groups its
+     jobs uploaded — never on a synthetic job log: the grader reads no log text at all.
    - A public-CI red is classified in a throttled Linux container first (`docker run --cpus=2 node:22`),
      by measurement: starvation on the base tree is not a defect on the branch.
 
@@ -1595,19 +1605,31 @@ Create specialist seats using `orca terminal create --worktree path:<repo> --com
    - **RUN BOTH RELEASE PROOFS BEFORE STANDING DOWN.** The first is the exported-tree suite, which
      maintainers run from the private repo with its `verify:export` script — that tooling is deliberately
      not part of this package, so the command does not exist in a public checkout; it must install,
-     build, lint, and only then run the suite in the exported tree; then
-     `TICKMARKR_E2E=1 npx vitest run tests/e2e/orca-smoke.e2e.test.ts` must exercise the installed-Orca
-     smoke. A skipped smoke is not proof. Record both results before declaring the release complete.
-
-   - **GRADE PUBLIC CI FROM JOB LOGS AT RUN-END ONLY (law 48).** A badge is not the grade, and
-     `gh run view --job --log` is empty while the run is in progress. At run-end execute
-     `scripts/grade-ci.sh <run-id> <expected-count> <tag>` and require GREEN from every job of the
-     declared inventory it prints first — serial `test` and `test-macos`, or sharded, per OS, the four
-     `suite <os> k/4` shards, `single-fork <os>` and `aggregate <os>`; a missing, duplicated or unknown
-     job reads UNREADABLE, never a skip. Its UNREADABLE state is a hard stop, not a green default.
-     Derive the expected glob pathspec count with `git ls-files ':(glob)tests/**/*.test.ts'`
-     (including the `.tsx` sibling where present), never a bare
-     `tests/**/*.test.ts`: bare `**` is not a git glob (law 49).
+     build, lint, and only then run the suite in the exported tree, and only its zero exit writes the export
+     proof that `export-public.sh --onto` reads before it writes the mirror commit. Then the installed-Orca
+     smoke must exercise its live leg, decided from its own record and never from Vitest's exit status:
+     `TICKMARKR_CI_RECORD=/tmp/tickmarkr-orca-smoke.record.json TICKMARKR_E2E=1 npx --no-install vitest run tests/e2e/orca-smoke.e2e.test.ts`,
+     then
+     `npx --no-install tsx scripts/ci/cli.ts verdict --require-test 'tests/e2e/orca-smoke.e2e.test.ts::e2e: orca driver smoke > live: the real-orca terminal leg — vitest-skipped without the gate or a reachable runtime' /tmp/tickmarkr-orca-smoke.record.json`
+     must exit 0. The forced-stall proof (RELEASING.md step 6) is decided the same way: its record from
+     `TICKMARKR_CI_RECORD=/tmp/tickmarkr-forced-stall.record.json TICKMARKR_TEST_FORCE_STALL=1 npx --no-install vitest run tests/e2e/forced-stall.e2e.test.ts -t 'the enabled forced-stall release proof makes the integration tip verifier recover a real RPC-stranded serial file as parallel exit1 then serial-only exit0 under distinct nonces, so a helper-only green or a full-suite retry fails'`,
+     then
+     `npx --no-install tsx scripts/ci/cli.ts verdict --require-test 'tests/e2e/forced-stall.e2e.test.ts::the enabled forced-stall release proof makes the integration tip verifier recover a real RPC-stranded serial file as parallel exit1 then serial-only exit0 under distinct nonces, so a helper-only green or a full-suite retry fails' /tmp/tickmarkr-forced-stall.record.json`
+     must exit 0. A skipped smoke or stall leaf is not proof: Vitest exits 0 when the named leaf skips (the gate
+     unset, Orca unreachable, a drifted `-t` title), and the verdict reads it RED. Record both results before
+     declaring the release complete.
+
+   - **GRADE PUBLIC CI FROM ITS RUN RECORD AND PROOF GROUPS AT RUN-END ONLY (law 48).** A badge is not
+     the grade, and an in-progress run is never graded. At run-end execute
+     `scripts/grade-ci.sh <run-id> <mirror HEAD sha> <mirror clone> <tag>` and require GREEN from every job
+     of the declared inventory it prints first — serial `test` and `test-macos`; a missing, duplicated or
+     unknown job reads UNREADABLE, never a skip, and a sharded run reads UNREADABLE until its proof-group
+     selection ships (ANL-022 §7.4). The grader is bound to the head: a run of any other commit reads
+     UNREADABLE before anything is downloaded. It reads GitHub's structured step outcomes and conclusions and
+     recomputes each job's uploaded proof group (`proof-<job>`: the Vitest records and the floors sidecar)
+     against the test files that commit tracks in the mirror clone — there is no count to derive, and no job
+     log text is read, so a log gh labels `UNKNOWN STEP` or a test that prints timeout text cannot move the
+     grade. Its UNREADABLE state is a hard stop, not a green default.
 
    - **RE-READ THE REGISTRY BEFORE RULING (law 51).** A successful Release run and the first
      `npm view` are separate observations: registry propagation can briefly return the prior version.