[garrytan]

The private evaluator's Lane R ran the real gstack-cso helper end to end against the staged runtime images. It found four runtime verification defects, each reproduced locally on amd64 with images from staging run 37555192492.

Defects fixed

• Python repairs never replayed. Offline preparation wrote timestamped .pyc bytecode, so two preparations of the same app hashed differently, and replay reported changed preparation inputs. Preparation now sets SOURCE_DATE_EPOCH, so venv, ensurepip and pip write checked-hash .pyc files. Two preparations now differ in 0 files.
• Rails replays drifted the same way. RubyGems and mini_portile build logs (gem_make.out, mkmf.log, ext/**/tmp/**/*.log) record random build directories. They're now left out of the prepared identity. Compiled extensions stay in it.
• Rails verification couldn't finish on 4 vCPU. An attempt prepares the app twice, about 245 s each because native extensions compile. The attempt watchdog, the Docker executor and the assertion witness each capped the attempt at 300 s. They now share one bound, MAX_VERIFICATION_ATTEMPT_MS: 900 s for Rails attempts and replays, still capped by the run deadline. Other stacks keep 300 s.
• A killed helper left scratch behind. resume and finish now reclaim the attempt's supervision, preparation-execution, archive-staging, archive-materializations and verification scratch. They do this under the run lock, and only once the watchdog has recorded cleanup.

Validation

On the tree merged with main (f67c478):

• typecheck is clean;
• the CSO suites plus the version and skill-docs tests pass (824 pass, 0 fail);
• new tests cover the witness bound, scratch reclaim and preparation determinism.

Not yet confirmed: arm64, and the evaluator's full Lane R run on CI. Those happen in the next staging run and dry run after merge.

[trunk-io]

😎 This pull request was merged.

[github-actions]

E2E Evals: ✅ PASS

[test:paid] VERDICT GREEN — lane gate/pr, attempt 1
  rule 0/0 · behavior 0/0 · judge 0/0 · quarantined 0 (0 failing the lane)
  SKIPPED 0 · INFRA 0 · INCOMPLETE 0 · unattributed 0 · ACTION REQUIRED 0
  wall 0m00s · cost $0.00

0 executed, 0 reused rule/judge records | 0 manual accepted (unscored; no score-cache credit) | $0 rule/judge cost | reconcile exit: 0

Profile: pr / mode pr; selected behaviors: 0, judges: 0. Deferred to scheduled/release coverage: 3 behaviors and 0 changed prompt files. Deferred checks did not run and receive no PR-pass credit.

Rule and judge shards

Shard	Automated result	Manual/unscored	Executed	Reused	Status	Cost

Fail-closed reconciliation

[test:paid] report: 1/1 slices, 0 planned shards, tier=gate, attempt 1
[test:paid] coverage: profile=pr mode=pr; selected E2E=0, judges=0
[test:paid] deferred: 3 broad behaviors, 0 changed prompts without quick live coverage; these are not PR passes
[test:paid] collector final outcomes: 0 executed, 0 reused; 0 passed, 0 failed, 0 manual accepted (unscored; no score-cache credit) (0 attempt records from 0 collectors; every record counts)
[test:paid] VERDICT GREEN — lane gate/pr, attempt 1
  rule 0/0 · behavior 0/0 · judge 0/0 · quarantined 0 (0 failing the lane)
  SKIPPED 0 · INFRA 0 · INCOMPLETE 0 · unattributed 0 · ACTION REQUIRED 0
  wall 0m00s · cost $0.00
[test:paid] report: every planned shard accounted and passed

---

Sliced lane: planner → duration-packed executors → fail-closed report. Behavior cases run a pre-registered 3-trial panel (PASS at 2/3 with no contract violation); a PASS 2/3 is shown with its failed trial, never as a clean pass. Reused results retain their original provenance and expiry.