fix(test): keep pytest run evidence durable

TESTING.md

@@ -125,18 +125,23 @@ stale per-run dirs from every known root (`/dev/shm`, `/realm/tmp/polylogue-pyte
 `/tmp/polylogue-pytest`, plus any explicit configured root) — never based on
 age alone: each managed basetemp carries a PID plus process-start identity,
 and a directory whose exact owner process is still alive is never removed
-regardless of age. An owner that cannot be confirmed dead (no marker) gets a
-multi-hour grace period rather than the normal ~30-minute one. The sweeper
+regardless of age. A tree without a valid managed claim or whose owner cannot
+be confirmed dead is never removed. The thirty-minute age threshold applies
+only after a positive managed claim identifies a dead owner. The sweeper
 restores owner-write permission only after a tree is adjudicated stale, so
 published read-only fixture copies cannot leak tmpfs indefinitely. Shared
 `pytest-polylogue-*-seeded-*` caches are never touched by the sweep — they
 are shared, reused, and built once behind their own `.build.done` guard.
 
 Managed verification refuses to start below 1 GiB available memory instead of
-falling back to the pathological disk lane. Passing-test roots are reclaimed at
-teardown; the external supervisor and parent runner independently remove the
-whole run root on completion or termination, with startup stale-root cleanup as
-recovery after an uncatchable process kill or reboot.
+falling back to the pathological disk lane. Every per-test `tmp_path` tree is
+reclaimed in fixture teardown, including failures and interruptions; node
+failure evidence remains in the managed event, longrepr, summary, and resource
+receipts. The controller removes only the exact basetemp it created. An
+explicit `--basetemp` is retained for targeted filesystem diagnosis. The
+external supervisor and parent runner independently remove the whole run root
+on completion or termination, with startup stale-root cleanup as recovery
+after an uncatchable process kill or reboot.
 
 An affected run that selects zero tests is accepted only when no executable,
 test, dependency, or harness path changed. A zero selection after such a change
@@ -163,6 +168,9 @@ and a postmortem diagnosis. The latest run is mirrored to
 - `.cache/verify/current-pytest-resources.jsonl`
 - `.cache/verify/current-pytest-postmortem.json`
 - `.cache/verify/current-pytest-containment.json`
+- `.cache/verify/current-pytest-statistics.json` — derived phase
+  distributions, worker count, storage, resource peaks, and cleanup outcome;
+  the same file is retained under each run's `steps/*/statistics.json`.
 - `.cache/verify/current-pytest-output.log`
 
 The devtools process drains pytest output, prints periodic heartbeat lines, and
@@ -195,9 +203,13 @@ IDs by default (`POLYLOGUE_PYTEST_SELECTION_NODEID_LIMIT`, default 500) so
 broad collection does not retain or write unbounded node-id lists in controller
 or worker processes.
 
-`devtools workspace tasks recent` shows the run id, diagnosis, and peak pytest
-RSS when the current run metadata is available. `devtools workspace tasks stats
---resources` aggregates recorded pytest memory peaks over time.
+The detailed artifacts above are checkout-local and disposable. Each `devtools
+verify` or `devtools test` invocation automatically appends its compact run
+summary to `$XDG_STATE_HOME/polylogue/devtools/verify-history.jsonl` (or the
+corresponding `~/.local/state` path), shared across linked worktrees without a
+separate recording command. `devtools verify --history` prints the recent
+cross-worktree runs. Setup, call, and teardown timings come only from pytest
+reports in the event stream.
 
 `devtools test` uses the same pytest progress plugin and process supervisor for
 focused selections. During or after a run, inspect

devtools/evidence_dashboard.py

@@ -9,7 +9,7 @@
 - pytest health from ``.cache/verify/last-pytest.json``;
 - coverage from ``.coverage`` / ``coverage.xml`` when present;
 - benchmark/SLO catalog rows and their required-artifact coverage;
-- static gate status from ``.cache/verify-history.jsonl``;
+- static gate status from the shared XDG verify history;
 - witness lifecycle counts;
 - mutation/benchmark campaign freshness.
 
@@ -28,12 +28,13 @@
 from typing import Any
 
 from devtools import repo_root as _get_root
+from devtools.verify_runs import VERIFY_HISTORY_PATH, git_dirty, git_head
+from devtools.verify_runs import worktree_fingerprint as _worktree_fingerprint
 
 ROOT = _get_root()
 
 # Artifact paths (relative to repo root).
 PYTEST_REPORT_REL = Path(".cache/verify/last-pytest.json")
-VERIFY_HISTORY_REL = Path(".cache/verify-history.jsonl")
 LAST_VERIFY_RESULT_REL = Path(".cache/last-verify-result.json")
 COVERAGE_DATA_REL = Path(".coverage")
 COVERAGE_XML_REL = Path("coverage.xml")
@@ -224,9 +225,37 @@ def _benchmark_slo(root: Path, *, now: datetime) -> dict[str, Any]:
 )
 
 
+def _static_evidence_is_bound(
+    entry: dict[str, Any],
+    *,
+    checkout_root: str,
+    checkout_head: str | None,
+    worktree_fingerprint: str,
+) -> bool:
+    """Accept only evidence tied to the exact checkout contents being viewed."""
+    steps = entry.get("steps")
+    stability_failed = isinstance(steps, list) and any(
+        isinstance(step, dict) and step.get("name") == "checkout stability" and step.get("exit") != 0 for step in steps
+    )
+    return (
+        not stability_failed
+        and entry.get("diagnosis") not in {"checkout_changed_during_verification", "checkout_fingerprint_unavailable"}
+        and entry.get("checkout_root") == checkout_root
+        and entry.get("git_head") == checkout_head
+        and entry.get("worktree_fingerprint") == worktree_fingerprint
+        and entry.get("final_worktree_fingerprint") == worktree_fingerprint
+    )
+
+
 def _static_gates(root: Path, *, now: datetime) -> dict[str, Any]:
-    history_path = root / VERIFY_HISTORY_REL
+    history_path = VERIFY_HISTORY_PATH
     last_result_path = root / LAST_VERIFY_RESULT_REL
+    checkout_root = str(root.resolve())
+    checkout_head = git_head(root)
+    checkout_dirty = git_dirty(root)
+    fingerprint = None if checkout_dirty or checkout_head is None else _worktree_fingerprint(root)
+    worktree_fingerprint = None if fingerprint == "unavailable" else fingerprint
+    identity_available = checkout_head is not None and worktree_fingerprint is not None
 
     # Prefer last-verify-result.json (the most recent run) then walk back through
     # history to find the last status for each gate.
@@ -236,7 +265,16 @@ def _static_gates(root: Path, *, now: datetime) -> dict[str, Any]:
         try:
             data = json.loads(last_result_path.read_text())
             result = data.get("result") if isinstance(data, dict) else None
-            if isinstance(result, dict):
+            if (
+                isinstance(result, dict)
+                and worktree_fingerprint is not None
+                and _static_evidence_is_bound(
+                    result,
+                    checkout_root=checkout_root,
+                    checkout_head=checkout_head,
+                    worktree_fingerprint=worktree_fingerprint,
+                )
+            ):
                 for step in result.get("steps", []):
                     if isinstance(step, dict) and isinstance(step.get("name"), str):
                         last_steps[step["name"]] = step
@@ -263,6 +301,13 @@ def _static_gates(root: Path, *, now: datetime) -> dict[str, Any]:
     # appearance in history.
     if history_entries:
         for entry in reversed(history_entries):
+            if worktree_fingerprint is None or not _static_evidence_is_bound(
+                entry,
+                checkout_root=checkout_root,
+                checkout_head=checkout_head,
+                worktree_fingerprint=worktree_fingerprint,
+            ):
+                continue
             steps = entry.get("steps", [])
             for step in steps:
                 if not isinstance(step, dict):
@@ -275,7 +320,14 @@ def _static_gates(root: Path, *, now: datetime) -> dict[str, Any]:
     for gate_name in _STATIC_GATE_NAMES:
         step = last_steps.get(gate_name)
         if step is None:
-            gates.append({"name": gate_name, "available": False, "reason": "no run observed in cached history"})
+            reason = (
+                "checkout has uncommitted changes"
+                if checkout_dirty
+                else "checkout Git identity is unavailable"
+                if not identity_available
+                else "no bound run observed in cached history"
+            )
+            gates.append({"name": gate_name, "available": False, "reason": reason})
             continue
         exit_code = step.get("exit", -1)
         gates.append(
@@ -290,8 +342,8 @@ def _static_gates(root: Path, *, now: datetime) -> dict[str, Any]:
         )
     failing = [g for g in gates if g.get("status") == "fail"]
     return {
-        "available": last_result_path.exists() or history_path.exists(),
-        "history_path": str(VERIFY_HISTORY_REL),
+        "available": bool(last_steps) and not checkout_dirty and identity_available,
+        "history_path": str(history_path),
         "last_result_path": str(LAST_VERIFY_RESULT_REL),
         "total_gates_tracked": len(_STATIC_GATE_NAMES),
         "gates_with_status": sum(1 for g in gates if g.get("available")),

devtools/merge_boundary.py

@@ -73,6 +73,7 @@
 import sys
 import tempfile
 import time
+import uuid
 from collections.abc import Iterator, Mapping
 from pathlib import Path
 from typing import Any
@@ -608,7 +609,13 @@ def cmd_merge(
         return 1
 
     head_sha = info["headRefOid"]
-    scope = merge_gate._scope_verdict(pr, info, head_sha=head_sha)
+    checkout_root = merge_gate._repository_root()
+    scope = merge_gate._scope_verdict(
+        pr,
+        info,
+        head_sha=head_sha,
+        checkout_root=checkout_root,
+    )
 
     if not scope.ok:
         print(f"REFUSING to merge PR #{pr}: invalid structured pr-scope carrier:", file=sys.stderr)
@@ -666,7 +673,12 @@ def cmd_merge(
             file=sys.stderr,
         )
         return 1
-    final_scope = merge_gate._scope_verdict(pr, final_info, head_sha=head_sha)
+    final_scope = merge_gate._scope_verdict(
+        pr,
+        final_info,
+        head_sha=head_sha,
+        checkout_root=checkout_root,
+    )
     initial_attestation = pr_scope.attestation_payload(
         scope, head_sha=head_sha, base_sha=merge_gate._base_sha(info)
     ).get("attestation_digest")
@@ -798,20 +810,30 @@ def cmd_record_full_verify(
     if execution_root is not None:
         argv = ["direnv", "exec", str(execution_root), *argv]
     started = verification_started_at
-    try:
-        result = subprocess.run(argv, capture_output=True, text=True, cwd=cwd)
-    except OSError as exc:
-        print(f"REFUSING: could not run {command!r}: {exc}", file=sys.stderr)
-        return 2
+    checkout_root = Path(cwd) if cwd is not None else Path.cwd()
+    invocation_id = uuid.uuid4().hex
+    with tempfile.TemporaryDirectory(prefix="polylogue-terminal-verify-") as temp_dir:
+        receipt_path = Path(temp_dir) / "run.json"
+        env = dict(os.environ)
+        env[merge_gate.VERIFICATION_INVOCATION_ID_ENV] = invocation_id
+        env[merge_gate.VERIFICATION_RECEIPT_PATH_ENV] = str(receipt_path)
+        try:
+            result = subprocess.run(argv, capture_output=True, text=True, cwd=checkout_root, env=env)
+        except OSError as exc:
+            print(f"REFUSING: could not run {command!r}: {exc}", file=sys.stderr)
+            return 2
+        receipt = merge_gate._invocation_receipt(
+            path=receipt_path,
+            invocation_id=invocation_id,
+            head_sha=target_sha,
+            command_exit=result.returncode,
+            checkout_root=checkout_root,
+        )
     duration_s = round(time.time() - started, 2)
-    release_allowed = merge_gate._release_baseline_permission(result.stdout)
-    verification_scope = merge_gate._verification_scope(result.stdout)
-    terminal_authorization = merge_gate._terminal_authorization(result.stdout)
-    try:
-        structured = json.loads(result.stdout)
-    except (TypeError, json.JSONDecodeError):
-        structured = None
-    verified_head = structured.get("git_head") if isinstance(structured, dict) else None
+    release_allowed = merge_gate._release_baseline_permission(receipt)
+    verification_scope = merge_gate._verification_scope(receipt)
+    terminal_authorization = merge_gate._terminal_authorization(receipt)
+    verified_head = receipt.get("git_head") if isinstance(receipt, dict) else None
     accepted = (
         result.returncode == 0
         and release_allowed is True