tickmarkr 2.8.7 → 2.8.8

package/dist/report/bundle.d.ts

@@ -1,7 +1,8 @@
 import type { EvidenceCitation } from "../gates/acceptance.js";
 import type { RunEnvironment } from "../run/environment.js";
 import type { JournalEvent } from "../run/journal.js";
-export declare const BUNDLE_SCHEMA_VERSION = 2;
+import { type SessionEnvironment } from "./compare.js";
+export declare const BUNDLE_SCHEMA_VERSION = 3;
 export declare const gateDeclined: (data: Record<string, unknown>) => boolean;
 export declare const KNOWN_LIMITS: readonly string[];
 export type BundleEvidence = string | EvidenceCitation;
@@ -18,6 +19,7 @@ export interface BundleGateResult {
     /** T11: true when the gate declined to run (journaled skipped:true, e.g. review below its
      * complexity threshold) — neither a pass nor a fail; the details carry the reason. */
     declined?: boolean;
+    held?: boolean;
     details: string;
 }
 export interface BundleTask {
@@ -28,7 +30,7 @@ export interface BundleTask {
     judgeCriteria: BundleJudgeCriterion[];
 }
 export interface BundleContentHashes {
-    /** sha256 of the canonical JSON of the source journal events used to build this packet. */
+    /** Queue 35 (D-2134 R6): sha256 of JSON.stringify of the parsed source events. */
     journal: string;
     /** graphDefinitionHash from run-start when recorded. */
     graphDefinitionHash?: string;
@@ -38,6 +40,7 @@ export interface ProofBundle {
     schemaVersion: number;
     runId: string;
     environment?: RunEnvironment;
+    environments: SessionEnvironment[];
     contentHashes: BundleContentHashes;
     tasks: BundleTask[];
     /** Plain-language known limits — this is not an unconditional proof of correctness. */

package/dist/report/bundle.js

@@ -4,11 +4,13 @@
 // redactSecrets seam. No I/O and no network: the caller (report CLI) owns the write.
 import { createHash } from "node:crypto";
 import { redactSecrets } from "../run/redact.js";
-import { recordedEnvironment } from "./compare.js";
+import { normalizeGateOutcome } from "../run/outcome.js";
+import { recordedEnvironment, recordedEnvironments } from "./compare.js";
 // Bump when the packet shape changes in a way a future reader must branch on before parsing.
 // 2 (T11): gates gained `declined`, and `pass` narrowed from "the gate did not fail" to "the gate
 // ran and passed" — a schema-1 reader would read a decline as a plain failure.
-export const BUNDLE_SCHEMA_VERSION = 2;
+// Queue 35 (D-2134 R6): held gates and session environments change the packet's meaning.
+export const BUNDLE_SCHEMA_VERSION = 3;
 // T11: the one predicate every decline surface shares — the record, the text tickmark rate, the
 // comparison metrics and this packet must agree on what "never ran" means. Modern runs journal
 // `skipped: true`; runs from before that field carry the same decline only in the details prefix
@@ -19,7 +21,7 @@ export const gateDeclined = (data) => data.skipped === true || /^skipped\b/.test
 export const KNOWN_LIMITS = [
     "This packet is a portable snapshot of journaled run facts, not an independent re-verification of the work or its gates.",
     "Judge evidence citations are copied from the journal as the judge recorded them; this packet does not re-validate citations against the judged diff.",
-    "Content hashes bind this packet to the journal bytes used to build it; they do not prove the underlying gates, merges, or tip verification were correct.",
+    "Content hashes bind this packet to the JSON.stringify serialization of parsed journal events used to build it; they do not prove the underlying gates, merges, or tip verification were correct.",
     "Secret-shaped strings are redacted by local pattern matching only; redaction is not a formal security audit.",
     "Producing this packet never contacts a network and never uploads anything.",
 ];
@@ -135,11 +137,13 @@ export function buildProofBundle(runId, events) {
         const judgeCriteria = [];
         for (const g of gateEvents) {
             const gate = typeof g.data.gate === "string" ? g.data.gate : "unknown";
-            // T11: a declined gate never ran — flagged declined, never a pass.
+            // Queue 35 (D-2134 R6): a passing screen remains held until its full suite speaks.
             const declined = gateDeclined(g.data);
-            const pass = g.data.pass === true && !declined;
+            const outcome = normalizeGateOutcome(g.data);
+            const held = outcome.kind === "held";
+            const pass = outcome.kind === "passed" && !declined;
             const details = typeof g.data.details === "string" ? g.data.details : "";
-            gates.push({ gate, pass, ...(declined ? { declined: true } : {}), details });
+            gates.push({ gate, pass, ...(declined ? { declined: true } : {}), ...(held ? { held: true } : {}), details });
             if (gate === "acceptance") {
                 for (const c of parseJudgeCriteria(g.data))
                     judgeCriteria.push(c);
@@ -156,6 +160,7 @@ export function buildProofBundle(runId, events) {
         schemaVersion: BUNDLE_SCHEMA_VERSION,
         runId,
         ...(environment ? { environment } : {}),
+        environments: recordedEnvironments(events),
         contentHashes: {
             journal: journalHash,
             ...(gHash ? { graphDefinitionHash: gHash } : {}),

package/dist/report/compare.d.ts

@@ -8,11 +8,18 @@ export type EnvironmentCompare = {
     comparable: false;
     reason: "mismatch";
     recorded: string;
+    mixedSessions?: true;
 } | {
     comparable: false;
     reason: "unbound";
 };
 export declare function hasRunStart(events: JournalEvent[]): boolean;
+export interface SessionEnvironment {
+    event: "run-start" | "run-resume";
+    ts: string;
+    environment?: RunEnvironment;
+}
+export declare function recordedEnvironments(events: JournalEvent[]): SessionEnvironment[];
 export declare function recordedEnvironment(events: JournalEvent[]): RunEnvironment | undefined;
 export declare function environmentComparable(baselineEnv: RunEnvironment | undefined, currentEnv: RunEnvironment | undefined): EnvironmentCompare;
 export interface RunMetrics {
@@ -21,6 +28,7 @@ export interface RunMetrics {
     gateFail: number;
     gateTotal: number;
     costUsd: number | undefined;
+    costPartial: boolean;
     tokensTotal: number | undefined;
 }
 export declare function runMetrics(events: JournalEvent[], rows?: TelemetryRow[], cost?: CostConfig): RunMetrics;
@@ -28,6 +36,7 @@ export interface RunDelta {
     durationMs: number | undefined;
     gateFail: number;
     costUsd: number | undefined;
+    costPartial: boolean;
     tokensTotal: number | undefined;
 }
 export type CompareOutcome = {

package/dist/report/compare.js

@@ -1,43 +1,50 @@
+import { normalizeGateOutcome } from "../run/outcome.js";
 import { estimateCosts } from "./cost.js";
 export function hasRunStart(events) {
     return events.some((e) => e.event === "run-start");
 }
-// First run-start's environment, fail-closed on a missing or malformed stamp.
-export function recordedEnvironment(events) {
-    for (const e of events) {
-        if (e.event !== "run-start")
-            continue;
-        const env = e.data.environment;
-        if (!env || typeof env !== "object" || Array.isArray(env))
-            return undefined;
-        const o = env;
-        if (typeof o.tickmarkrVersion !== "string" || typeof o.configHash !== "string")
-            return undefined;
-        if (!o.adapterVersions || typeof o.adapterVersions !== "object" || Array.isArray(o.adapterVersions))
+// Queue 35 (D-2134 R6): validate each session's stamp before folding the run's identity.
+function parseEnvironment(env) {
+    if (!env || typeof env !== "object" || Array.isArray(env))
+        return undefined;
+    const o = env;
+    if (typeof o.tickmarkrVersion !== "string" || !o.tickmarkrVersion.trim()
+        || typeof o.configHash !== "string" || !o.configHash.trim())
+        return undefined;
+    if (!o.adapterVersions || typeof o.adapterVersions !== "object" || Array.isArray(o.adapterVersions))
+        return undefined;
+    const adapterVersions = {};
+    for (const [k, v] of Object.entries(o.adapterVersions)) {
+        if (typeof v !== "string")
             return undefined;
-        const adapterVersions = {};
-        for (const [k, v] of Object.entries(o.adapterVersions)) {
-            if (typeof v !== "string")
-                return undefined;
-            adapterVersions[k] = v;
-        }
-        // Capacity arrived in v2.0 as a pair. Two absent fields are an honest older record; one without
-        // the other is a malformed new record and fails closed instead of being compared as legacy.
-        const hasCores = Object.hasOwn(o, "cores");
-        const hasForkCap = Object.hasOwn(o, "forkCap");
-        if (hasCores !== hasForkCap)
-            return undefined;
-        if (hasCores && (typeof o.cores !== "number" || !Number.isFinite(o.cores) || o.cores <= 0
-            || typeof o.forkCap !== "number" || !Number.isFinite(o.forkCap) || o.forkCap <= 0))
-            return undefined;
-        return {
-            tickmarkrVersion: o.tickmarkrVersion,
-            configHash: o.configHash,
-            adapterVersions,
-            ...(hasCores ? { cores: o.cores, forkCap: o.forkCap } : {}),
-        };
+        adapterVersions[k] = v;
     }
-    return undefined;
+    // Capacity arrived in v2.0 as a pair. Two absent fields are an honest older record; one without
+    // the other is a malformed new record and fails closed instead of being compared as legacy.
+    const hasCores = Object.hasOwn(o, "cores");
+    const hasForkCap = Object.hasOwn(o, "forkCap");
+    if (hasCores !== hasForkCap)
+        return undefined;
+    if (hasCores && (typeof o.cores !== "number" || !Number.isFinite(o.cores) || o.cores <= 0
+        || typeof o.forkCap !== "number" || !Number.isFinite(o.forkCap) || o.forkCap <= 0))
+        return undefined;
+    return {
+        tickmarkrVersion: o.tickmarkrVersion,
+        configHash: o.configHash,
+        adapterVersions,
+        ...(hasCores ? { cores: o.cores, forkCap: o.forkCap } : {}),
+    };
+}
+export function recordedEnvironments(events) {
+    return events.flatMap((e) => e.event === "run-start" || e.event === "run-resume"
+        ? [{ event: e.event, ts: e.ts, environment: parseEnvironment(e.data.environment) }]
+        : []);
+}
+export function recordedEnvironment(events) {
+    const sessions = recordedEnvironments(events);
+    const first = sessions[0]?.environment;
+    return first && sessions.every(({ environment }) => environment && envEqual(first, environment))
+        ? first : undefined;
 }
 // Canonical identity string for the `recorded` field — configHash is the axis the acceptance
 // criteria name; full environment equality still decides .comparable.
@@ -81,12 +88,14 @@ export function runMetrics(events, rows = [], cost = {}) {
             durationMs = to - from;
     }
     const gates = events.filter((e) => e.event === "gate-result");
-    const gatePass = gates.filter((e) => e.data.pass === true).length;
-    const gateFail = gates.filter((e) => e.data.pass === false).length;
+    const gatePass = gates.filter((e) => normalizeGateOutcome(e.data).kind === "passed").length;
+    const gateFail = gates.filter((e) => normalizeGateOutcome(e.data).kind === "failed").length;
     let costUsd;
     let costSum = 0;
     let hasCost = false;
-    for (const p of estimateCosts(rows, cost)) {
+    const prices = estimateCosts(rows, cost);
+    const costPartial = prices.some((p) => p.partialMetering);
+    for (const p of prices) {
         if (p.apiUsd !== undefined) {
             costSum += p.apiUsd;
             hasCost = true;
@@ -110,7 +119,7 @@ export function runMetrics(events, rows = [], cost = {}) {
     }
     if (hasTokens)
         tokensTotal = tokenSum;
-    return { durationMs, gatePass, gateFail, gateTotal: gates.length, costUsd, tokensTotal };
+    return { durationMs, gatePass, gateFail, gateTotal: gates.length, costUsd, costPartial, tokensTotal };
 }
 const n = (x) => x.toLocaleString("en-US");
 const EM = "—";
@@ -161,6 +170,9 @@ function comparabilityLine(cmp, baselineEnv, currentEnv) {
     if (cmp.reason === "unbound") {
         return "comparability caveat — one or both runs lack a recorded environment identity; not apples-to-apples";
     }
+    if (cmp.mixedSessions) {
+        return "comparability caveat — environment identity disagrees across mixed sessions; not apples-to-apples";
+    }
     const base = baselineEnv?.configHash ?? EM;
     const cur = currentEnv?.configHash ?? EM;
     return `comparability caveat — environment identity disagrees (baseline configHash=${base} ≠ current configHash=${cur}; recorded baseline ${cmp.recorded}); not apples-to-apples`;
@@ -182,7 +194,7 @@ export function renderComparison(opts) {
         `| duration | ${fmtDuration(baseline.durationMs)} | ${fmtDuration(current.durationMs)} | ${fmtSignedDuration(delta.durationMs)} |`,
         `| gate failures | ${fmtInt(baseline.gateFail)} | ${fmtInt(current.gateFail)} | ${fmtSignedInt(delta.gateFail)} |`,
         `| gate pass rate | ${baseline.gateTotal ? `${baseline.gatePass}/${baseline.gateTotal}` : EM} | ${current.gateTotal ? `${current.gatePass}/${current.gateTotal}` : EM} | ${EM} |`,
-        `| cost | ${fmtUsd(baseline.costUsd)} | ${fmtUsd(current.costUsd)} | ${fmtSignedUsd(delta.costUsd)} |`,
+        `| cost | ${fmtUsd(baseline.costUsd)}${baseline.costPartial ? " (partial)" : ""} | ${fmtUsd(current.costUsd)}${current.costPartial ? " (partial)" : ""} | ${fmtSignedUsd(delta.costUsd)}${delta.costPartial ? " (partial)" : ""} |`,
         `| tokens | ${fmtInt(baseline.tokensTotal)} | ${fmtInt(current.tokensTotal)} | ${fmtSignedInt(delta.tokensTotal)} |`,
         "",
     ];
@@ -208,10 +220,16 @@ export function compareRuns(opts) {
     }
     const baselineEnv = recordedEnvironment(opts.baselineEvents);
     const currentEnv = recordedEnvironment(opts.events);
-    const comparability = environmentComparable(baselineEnv, currentEnv);
+    const sessions = [...recordedEnvironments(opts.baselineEvents), ...recordedEnvironments(opts.events)];
+    const comparability = sessions.some((s) => !s.environment)
+        ? { comparable: false, reason: "unbound" }
+        : !baselineEnv || !currentEnv
+            ? { comparable: false, reason: "mismatch", recorded: baselineEnv?.configHash ?? "mixed sessions", mixedSessions: true }
+            : environmentComparable(baselineEnv, currentEnv);
     const baseline = runMetrics(opts.baselineEvents, opts.baselineRows ?? [], opts.cost ?? {});
     const current = runMetrics(opts.events, opts.rows ?? [], opts.cost ?? {});
     const delta = {
+        costPartial: current.costPartial || baseline.costPartial,
         durationMs: current.durationMs !== undefined && baseline.durationMs !== undefined
             ? current.durationMs - baseline.durationMs
             : undefined,

package/dist/report/operator-record.js

@@ -37,15 +37,16 @@ export function formatRateBasis(row) {
 export function formatChannelMoney(row) {
     const prices = [];
     const bases = [];
+    const floor = row.partialMetering ? "≥ " : "";
     if (row.apiUsd !== undefined)
-        prices.push(`price: $${row.apiUsd.toFixed(6)}`);
+        prices.push(`price: ${floor}$${row.apiUsd.toFixed(6)}`);
     if (row.amortizedUsd !== undefined && row.subPlan !== undefined) {
         const [low, high] = row.amortizedUsd;
-        prices.push(`price: $${low.toFixed(6)}–$${high.toFixed(6)} amortized`);
+        prices.push(`price: ${floor}$${low.toFixed(6)}–$${high.toFixed(6)} amortized`);
         bases.push(`${n(row.attempts)} windows × $${row.subPlan.planMonthly}/month ÷ ${row.subPlan.windowsPerMonthHigh}–${row.subPlan.windowsPerMonthLow} windows/month`);
     }
     if (row.counterfactualUsd !== undefined)
-        prices.push(`API-equivalent: $${row.counterfactualUsd.toFixed(6)}`);
+        prices.push(`API-equivalent: ${floor}$${row.counterfactualUsd.toFixed(6)}`);
     const basis = formatRateBasis(row);
     if (basis)
         bases.push(basis);

package/dist/run/daemon.d.ts

@@ -3,6 +3,7 @@ import { type ModeResolution, type RoutingMode, type TickmarkrConfig } from "../
 import { type DriverChoice } from "../drivers/index.js";
 import { type ExecutorDriver, type Slot } from "../drivers/types.js";
 import { type Baseline, type BaselineProvenance, type GateEvidenceOptions } from "../gates/baseline.js";
+import { environmentFingerprint } from "../gates/cache.js";
 import type { GateResult } from "../gates/types.js";
 import { type RunGraph, type Task } from "../graph/schema.js";
 import { type PreserveProducer, type RunCapacity } from "./git.js";
@@ -226,6 +227,7 @@ export declare function resetHarvestSilentMsForTests(): void;
 export declare const HARVESTED_RESULT_SUMMARY = "harvested: the worktree carries committed work; the worker emitted no TICKMARKR_RESULT trailer";
 /** T4 (OBS-266): identity of the command SET a tip verify ran — a changed command is a different verify. */
 export declare function commandsHash(commands: Record<string, string>): string;
+type TipEnvironment = ReturnType<typeof environmentFingerprint>;
 export interface TipProof {
     kind: "fresh" | "reused" | "failed" | "incomplete";
     /** Each completed gate keeps its own execution provenance, even in a mixed cycle. */
@@ -261,6 +263,7 @@ export interface TipClose {
     expected?: string;
     identityFailed: boolean;
     deferred: DeferredVerdict[];
+    tipEnvironment?: TipEnvironment;
 }
 interface TipVerifyOptions {
     lastMergedTask?: string;
@@ -293,6 +296,7 @@ export declare function appendIdentityFailure(journal: Journal, f: {
     state?: IntegrationRefState;
     cmdHash: string;
     capacity: RunCapacity;
+    tipEnvironment?: TipEnvironment;
     infra?: boolean;
 }): void;
 /** O: I(expected) — or, with no expected value, the ref must be regular and its commit becomes the expected. */
@@ -309,9 +313,9 @@ export declare function openingIdentity(identity: TipIdentity, journal: Journal)
 /**
  * OBS-34's strict tip verify, but it stops re-paying for an unmoved tip (~334m corpus-wide; 69.5m in
  * one park-heavy run whose 18 resume cycles merged nothing new). The verify journals the SHA it
- * verified and the hash of the command set, so a later run-end can recognize the same verified state:
- * the expected commit equals the LAST green verified SHA and the commands are unchanged → journal
- * `tip-verify-cached` and skip, with no checkout. ANY doubt — moved tip, changed commands, a gate
+ * verified and the hash of the command set, so a later run-end can recognize the same verified state.
+ * Queue row 24 (D-2134): the last green also binds every row's stamped runner and environment identity
+ * and capacity before `tip-verify-cached` can skip with no checkout. ANY doubt — moved tip, changed commands, a gate
  * missing from that cycle's green set, a failure recorded in it, a cycle older than the last one —
  * runs the full verify. 2.8.1 T1 (ANL-023 §7.1): with `identity` (the daemon always passes it) run end
  * verifies a fresh detached checkout of the expected commit under a validated HEAD reflog, never the

package/dist/run/daemon.js

@@ -23,7 +23,7 @@ import { herdrSealShellPrefix, MAX_BUF, SubprocessDriver } from "../drivers/subp
 import { formatOwnedName } from "../drivers/types.js";
 import { captureBaseline, detectGateCommands, detectVacuousOracles } from "../gates/baseline.js";
 import { reobserveTestFiles, runGates } from "../gates/run-gates.js";
-import { getVerdictStore, isInfraResult, resolveStateDir } from "../gates/cache.js";
+import { environmentFingerprint, getVerdictStore, isInfraResult, resolveStateDir } from "../gates/cache.js";
 import { RUNNER_INFRA_DIAGNOSTIC_RE, timeoutShaped } from "../gates/timeout-shaped.js";
 import { filesGlob } from "../graph/files-glob.js";
 import { addEvidence, attributeBlocked, batteryPriority, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus, taskContentDigest, tickmarkrDir } from "../graph/graph.js";
@@ -34,7 +34,7 @@ import { executionSignal, remainingExecutionMs, withExecutionBudget, withoutExec
 import { repairSelectionDecision, repairSelectionEnabled } from "./repair-selection.js";
 import { failureDisposition, reserveInfrastructureRetry } from "./recovery.js";
 import { runEnvironment } from "./environment.js";
-import { addDetachedWorktree, changeRepresented, cleanupRunWorktrees, declaredBaseContainment, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, reflogWitness, removeWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shell, shGit, SUITE_PARENT_ENV, verificationProtocol, WorktreeAdminRaceError, WORKTREE_LAYOUT_CONTRACT, WORKTREES_DIR, worktreePath } from "./git.js";
+import { addDetachedWorktree, changeRepresented, cleanupRunWorktrees, declaredBaseContainment, dependencyLinkRefusal, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, reflogWitness, removeWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shell, shGit, SUITE_PARENT_ENV, verificationProtocol, WorktreeAdminRaceError, WORKTREE_LAYOUT_CONTRACT, WORKTREES_DIR, worktreePath } from "./git.js";
 import { MASK } from "./redact.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
 import { classifyRepairDisposition, namedPaths, resolveScopeHints } from "./repair-disposition.js";
@@ -883,6 +883,32 @@ export const HARVESTED_RESULT_SUMMARY = "harvested: the worktree carries committ
 export function commandsHash(commands) {
     return createHash("sha256").update(JSON.stringify(Object.entries(commands).sort())).digest("hex").slice(0, 12);
 }
+// Queue row 24 (D-2134): refuse links before npm probes; an unreadable identity stays absent for the battery's infra row.
+function measureTipEnvironment(worktree, capacity) {
+    if (dependencyLinkRefusal(worktree))
+        return undefined;
+    try {
+        return environmentFingerprint({ worktree, scope: "tip", capacity });
+    }
+    catch {
+        return undefined;
+    }
+}
+// Queue row 24 (D-2134): validate the parts too; a matching fingerprint alone cannot rescue a malformed stamp.
+function sameTipEnvironment(recorded, current) {
+    if (!current || !recorded || typeof recorded !== "object" || Array.isArray(recorded))
+        return false;
+    const { fingerprint, parts } = recorded;
+    if (fingerprint !== current.fingerprint || !parts || typeof parts !== "object" || Array.isArray(parts))
+        return false;
+    const p = parts;
+    const verification = p.verification;
+    return p.nodeRuntime === current.parts.nodeRuntime && p.runner === current.parts.runner
+        && p.lockfile === current.parts.lockfile && p.selectedSet === undefined
+        && p.capacity !== undefined && sameCapacity(p.capacity, current.parts.capacity)
+        && !!verification && (verification.source === "explicit" || verification.source === "npm-config")
+        && sameVerification(verification, current.parts.verification);
+}
 /**
  * T4 (OBS-266): the journal's LAST verification cycle — the (tip, cmdHash) pair the most recent run
  * of the verify commands spoke for, the gates it got a pass from, and whether anything failed in it.
@@ -904,7 +930,7 @@ function lastVerifyCycle(events) {
         if (e.event === "tip-verify-start") {
             const { tip, cmdHash } = e.data;
             cur = typeof tip === "string" && typeof cmdHash === "string"
-                ? { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [e.data.capacity], evidenceByGate: new Map() }
+                ? { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [e.data.capacity], tipEnvironments: [e.data.tipEnvironment], evidenceByGate: new Map() }
                 : undefined;
             afterRunEnd = false;
             continue;
@@ -927,7 +953,7 @@ function lastVerifyCycle(events) {
             continue;
         }
         if (!cur || afterRunEnd || cur.tip !== tip || cur.cmdHash !== cmdHash) {
-            cur = { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [], evidenceByGate: new Map() };
+            cur = { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [], tipEnvironments: [], evidenceByGate: new Map() };
         }
         afterRunEnd = false;
         // T7: EVERY verdict row's own capacity, not just the start row's. The start row is a statement of
@@ -935,6 +961,7 @@ function lastVerifyCycle(events) {
         // these rows, so a row whose capacity differs from the session's — or which is malformed — has to
         // be able to sink the cycle by itself.
         cur.capacities.push(e.data.capacity);
+        cur.tipEnvironments.push(e.data.tipEnvironment);
         if (e.event === "tip-verify-failed")
             cur.failed = true;
         else {
@@ -1204,13 +1231,13 @@ export function identityDetails(leg, state, branch, runId, expected) {
  */
 export function appendIdentityFailure(journal, f) {
     if (!f.started)
-        journal.append("tip-verify-start", undefined, { tip: f.expected, cmdHash: f.cmdHash, capacity: f.capacity, gates: [], cached: false });
+        journal.append("tip-verify-start", undefined, { tip: f.expected, cmdHash: f.cmdHash, capacity: f.capacity, tipEnvironment: f.tipEnvironment, gates: [], cached: false });
     const found = f.state?.kind === "regular" || f.state?.kind === "symbolic" ? f.state.commit : undefined;
     journal.append("tip-verify-failed", undefined, {
         gate: "integration", cmd: "", exitCode: 1, fingerprints: [], details: f.details, ...(f.infra ? { infra: true } : {}),
         integration: { branch: f.branch, expected: f.expected ?? null, found: found ?? null, leg: f.leg,
             ...(f.state?.kind === "symbolic" ? { target: f.state.target } : {}) },
-        tip: f.expected, cmdHash: f.cmdHash, capacity: f.capacity,
+        tip: f.expected, cmdHash: f.cmdHash, capacity: f.capacity, tipEnvironment: f.tipEnvironment,
     });
 }
 /** O: I(expected) — or, with no expected value, the ref must be regular and its commit becomes the expected. */
@@ -1271,16 +1298,12 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
     opts.signal?.throwIfAborted();
     const cmdHash = commandsHash(commands);
     const { identity } = opts;
-    // T7: the capacity this session's verify children WOULD run under — the third thing a carried
-    // green must match, beside the tip and the command set. A cached verdict is the one place a green
-    // crosses a session boundary with nothing re-run, and a session resumed at a different capacity
-    // divides the machine by a different number: that green was established in another world, so it is
-    // not carried forward and the commands run again. A pre-T7 cycle records no capacity and keeps
-    // exactly the behaviour it has today.
+    // Queue row 24 (D-2134): measure once against the repository whose installed packages the verifier receives.
     const capacity = resolvedCapacity();
+    const tipEnvironment = measureTipEnvironment(identity?.repo ?? intWt, capacity);
     const identityFailure = (f) => {
-        appendIdentityFailure(journal, { ...f, branch: identity.branch, cmdHash, capacity });
-        return { failed: true, identityFailed: true, deferred: [] };
+        appendIdentityFailure(journal, { ...f, branch: identity.branch, cmdHash, capacity, tipEnvironment });
+        return { failed: true, identityFailed: true, deferred: [], tipEnvironment };
     };
     let tip;
     let clean = true; // with `identity` the battery runs in a fresh checkout and K checks tracked content
@@ -1299,25 +1322,30 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
     const gates = Object.keys(commands).filter((g) => g !== "tipTest");
     if (!gates.includes("test") && commands.tipTest)
         gates.push("test");
+    // Queue row 24 (D-2134 R2/Q6/Q7): carry requires tip, commands, every gate and capacity AND the stamped runner
+    // and environment identity with a measured lifecycle on every row. An unstamped cycle re-verifies once.
+    // Package content drift under equal lockfile and links is the declared residual, as in per-gate reuse.
     const cached = last !== undefined && !last.failed && !last.forgiven && last.tip === tip && last.cmdHash === cmdHash
         && gates.every((g) => last.gates.has(g))
-        && last.capacities.every((recorded) => sameCapacity(recorded, capacity));
+        && last.capacities.every((recorded) => sameCapacity(recorded, capacity))
+        && last.tipEnvironments.every((recorded) => sameTipEnvironment(recorded, tipEnvironment))
+        && !dependencyLinkRefusal(identity?.repo ?? intWt);
     // A pair can be verified red and then green without either SHA or command hash changing (for
     // example, an external service or ignored fixture recovers). Delimit attempts explicitly so that
     // the earlier red cannot remain latched into the later complete green cycle.
-    journal.append("tip-verify-start", undefined, { tip, cmdHash, capacity, gates, cached: clean && cached });
+    journal.append("tip-verify-start", undefined, { tip, cmdHash, capacity, tipEnvironment, gates, cached: clean && cached });
     opts.signal?.throwIfAborted();
     if (clean && cached) {
-        journal.append("tip-verify-cached", undefined, { tip, cmdHash, capacity, gates });
+        journal.append("tip-verify-cached", undefined, { tip, cmdHash, capacity, tipEnvironment, gates });
         // The skip must not read as a red. Every surface derives the tip's verdict from this cycle's
         // `tip-verify` events (cockpit derive.ts tipVerificationPassed: a run-end claiming "passed" with
         // ZERO events is fail-closed to FALSE), so a carried-forward green still journals its per-gate
         // pass — `cached: true` keeps it honest about not having re-run the command.
         for (const gate of gates) {
             const cmd = gate === "test" && commands.tipTest ? commands.tipTest : commands[gate];
-            journal.append("tip-verify", undefined, { ...reusedTipEvidence(last.evidenceByGate.get(gate) ?? {}), gate, cmd, pass: true, exitCode: 0, cached: true, tip, cmdHash, capacity });
+            journal.append("tip-verify", undefined, { ...reusedTipEvidence(last.evidenceByGate.get(gate) ?? {}), gate, cmd, pass: true, exitCode: 0, cached: true, tip, cmdHash, capacity, tipEnvironment });
         }
-        return identity ? { failed: false, expected: tip, identityFailed: false, deferred: [] } : false;
+        return identity ? { failed: false, expected: tip, identityFailed: false, deferred: [], tipEnvironment } : false;
     }
     const battery = async (dir) => {
         let tipFailed = false;
@@ -1340,7 +1368,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
             };
             if (r.pass) {
                 // Q121s: a forgiven pass journals its fingerprints — honest about what was carried, never a silent green.
-                journal.append("tip-verify", undefined, { ...evidence, gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.reused ? { cached: true } : {}), ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints, ...(r.baselineProvenance ? { baselineProvenance: r.baselineProvenance } : {}) } : {}), tip, cmdHash, capacity: measuredCapacity });
+                journal.append("tip-verify", undefined, { ...evidence, gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.reused ? { cached: true } : {}), ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints, ...(r.baselineProvenance ? { baselineProvenance: r.baselineProvenance } : {}) } : {}), tip, cmdHash, capacity: measuredCapacity, tipEnvironment });
             }
             else {
                 journal.append("tip-verify-failed", undefined, {
@@ -1355,6 +1383,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
                     tip,
                     cmdHash,
                     capacity: measuredCapacity,
+                    tipEnvironment,
                 });
                 tipFailed = true;
             }
@@ -1372,7 +1401,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
         const changed = await checkoutChange(opened.dir, tip, opened.h0);
         if (changed)
             return identityFailure({ started: true, expected: tip, leg: "checkout", details: `verification checkout changed during the battery: ${changed}` });
-        return { failed: tipFailed, expected: tip, identityFailed: false, deferred };
+        return { failed: tipFailed, expected: tip, identityFailed: false, deferred, tipEnvironment };
     }
     finally {
         if (checkout)
@@ -3380,7 +3409,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                     const worker = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "worker-result");
                     const disposition = classifyRepairDisposition({
                         // OBS-1072 add.2: hints are lexed from the readable excerpt, never from terminal control bytes.
-                        results: results.map((g) => ({ ...g, details: readableExcerpt(g.details) })), files: t.files, inventory: changed,
+                        results: results.map((g) => ({ ...g, details: readableExcerpt(g.details),
+                            // Queue row 235 (D-2134): oracle output has the same readable boundary as gate details.
+                            ...(Array.isArray(g.meta?.oracles) ? { meta: { ...g.meta, oracles: g.meta.oracles.map((oracle) => oracle && typeof oracle === "object" && typeof oracle.output === "string"
+                                        ? { ...oracle, output: readableExcerpt(oracle.output) } : oracle) } } : {}),
+                        })), files: t.files, inventory: changed,
                         refusalSummary: worker?.data.ok === false && typeof worker.data.summary === "string" ? worker.data.summary : undefined,
                     });
                     for (const diagnostic of disposition.diagnostics) {
@@ -3895,8 +3928,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 ...(typeof g.meta.producerAttempt === "number" ? { producerAttempt: g.meta.producerAttempt } : {}),
                             } : {}),
                             ...((cfg.executionPolicy || repairSelection) && !g.pass ? { disposition: failureDisposition(g) } : {}),
-                            ...Object.fromEntries(["runnerInfraRerun", "hostStarvedRerun", "recoveryBlocked", "failingFiles", "selectionDecision", "failureEvidence",
-                                "forgivenFingerprints", "freshFingerprints", "baselineProvenance", "judgment", "adjudication", "judgeDisagreement", "interruptions"]
+                            ...Object.fromEntries(["runnerInfraRerun", "judgeIndependent", "hostStarvedRerun", "recoveryBlocked", "failingFiles", "selectionDecision", "failureEvidence",
+                                "forgivenFingerprints", "freshFingerprints", "baselineProvenance", "oracles", "judgment", "adjudication", "judgeDisagreement", "interruptions"]
                                 .filter((key) => g.meta?.[key] !== undefined).map((key) => [key, g.meta[key]])),
                             // OBS-540: preserve terminal-vs-retryable infra exactly. normalizeGateOutcome deliberately
                             // defaults a legacy infra row to retryable, so dropping an explicit false here reverses the
@@ -7478,8 +7511,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                             summary.tipProof = { kind: "incomplete" };
                         }
                         else {
-                            appendIdentityFailure(journal, { started: false, branch, ...opened, cmdHash: commandsHash(commands), capacity: resolvedCapacity() });
-                            tipClose = { failed: true, identityFailed: true, deferred: [] };
+                            const capacity = resolvedCapacity();
+                            const tipEnvironment = measureTipEnvironment(repoRoot, capacity);
+                            appendIdentityFailure(journal, { started: false, branch, ...opened, cmdHash: commandsHash(commands), capacity, tipEnvironment });
+                            tipClose = { failed: true, identityFailed: true, deferred: [], tipEnvironment };
                             summary.tipVerify = "failed";
                             summary.tipProof = runEndTipProof(journal.read());
                         }
@@ -7514,8 +7549,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                     if (!tipClose.identityFailed && tipClose.expected !== undefined) {
                         const closing = await checkIntegrationIdentity(repoRoot, branch, tipClose.expected);
                         if (!closing.ok) {
+                            const capacity = resolvedCapacity();
+                            const tipEnvironment = tipStarted ? tipClose.tipEnvironment : measureTipEnvironment(repoRoot, capacity);
                             appendIdentityFailure(journal, { started: tipStarted, branch, expected: tipClose.expected, leg: closing.leg, state: closing.state,
-                                details: identityDetails(closing.leg, closing.state, branch, runId, tipClose.expected), cmdHash: commandsHash(commands), capacity: resolvedCapacity() });
+                                details: identityDetails(closing.leg, closing.state, branch, runId, tipClose.expected), cmdHash: commandsHash(commands), capacity, tipEnvironment });
                             summary.tipVerify = "failed";
                             summary.tipProof = runEndTipProof(journal.read());
                         }

package/dist/run/journal.js

@@ -2,7 +2,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmdirSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, isAbsolute, join } from "node:path";
 import { z } from "zod";
 import { channelKey, shq, TokenUsageSchema } from "../adapters/types.js";
 import { graphDefinitionHash, stateDirName, taskContentDigest, taskDefinitionFingerprint, tickmarkrDir } from "../graph/graph.js";
@@ -2744,7 +2744,16 @@ function dischargeProblem(row, o, events, cwd, memo) {
         return "discharge range does not bind the obligation";
     let artifact;
     try {
-        const bytes = readFileSync(String(d.artifactPath));
+        let artifactPath = String(d.artifactPath);
+        if (!isAbsolute(artifactPath)) {
+            // Queue row 31 / D-2134: resolve within the obligation's own run, with common-root fallback
+            // only when that run is absent locally; legacy absolute paths keep their original meaning.
+            const id = parseRunId(o.runId);
+            const localRun = join(runsDir(cwd), id);
+            const runDir = existsSync(localRun) ? localRun : join(runsDir(dirname(trustedCommonDir(cwd))), id);
+            artifactPath = join(runDir, artifactPath);
+        }
+        const bytes = readFileSync(artifactPath);
         if (createHash("sha256").update(bytes).digest("hex") !== d.artifactSha256)
             return "artifact hash mismatch";
         artifact = JSON.parse(bytes.toString("utf8")) ?? {};

package/dist/run/repair-disposition.d.ts

@@ -4,7 +4,7 @@ import type { GateResult } from "../gates/types.js";
 export type RepairDispositionKind = "fund-repair" | "scope-request" | "authoring" | "none";
 export interface RepairDisposition {
     kind: RepairDispositionKind;
-    /** validated inventory paths only — the sole paths a caller may put in an executable command */
+    /** Queue row 235 (D-2134): validated inventory paths or explicitly declared oracle landings. */
     paths: string[];
     reason: string;
     /** which evidence decided: a gate name, "worker" for a refusal, absent for the ordinary disposition */