Resolves #17785

The backup maintenance scorer held two records of the same lane and read only one. describeBackupMaintenanceHealth() derived backup-never-succeeded from the retry ledger alone while a success receipt sat unread in the same snapshot — so a plane taking a good backup every day reported that it had never taken one. A success receipt now yields backup-state-conflict instead: the two records disagree, that disagreement is reported as itself, and the verdict stops inventing which side is true. The receipt's age is not consulted, deliberately — the code being guarded claims the lane never succeeded, so any success receipt falsifies it, while backup-retry-exhausted carries the narrower current-window claim and stays put.

Evidence: L2 (pure-function unit specs; both changed surfaces are fully reachable in-sandbox) → L2 required (AC-1 … AC-5). No residual.

AC Evidence

| AC-1 | CI-covered: backup.spec.mjs — "a success receipt newer than the streak yields a conflict, never a fabricated negative" (reasonCodes) + HealthcheckBackupDetails.spec.mjs — "a code absent from the verdict appears nowhere in details" (details[]) | | AC-2 | Documented with a named trigger, per the AC's second branch: backup.mjs records that TaskStateService.markCompleted() writes lastSuccessAt and clears failureStreakStartedAt in one call, so the observed state is only reachable by a lane writing its receipt outside that path. The trigger is not a calendar reminder — the new code is the observer: backup-state-conflict is emitted only on real divergence, so its first live appearance is the signal to repair the writer, and the branch becomes dead code once the ledger agrees with the receipt. | | AC-3 | CI-covered, three arms + two controls: (i) "a success receipt newer than the streak yields a conflict, never a fabricated negative"; (ii) "a genuinely receipt-less exhausted lane still reports backup-never-succeeded"; (iii) "off-host-durability-unmet survives the conflict verdict"; controls: "a success receipt older than the streak yields the same conflict, not the negative" and "a failed receipt does not suppress the negative". Mutation receipts below. | | AC-4 | CI-covered: HealthcheckBackupDetails.spec.mjs, four arms — verbatim rendering, mutating-the-verdict-mutates-the-prose, no-independent-emission, and the empty-code-list fallback. | | AC-5 | describeBackupMaintenanceHealth() JSDoc states the symmetric contract: an absent or self-contradicting observation resolves to unknown or an explicit conflict — never healthy, never an invented negative — and names why scope makes it checkable: a whole-history code is falsified by any success receipt, a current-window code is not, so the two are never traded on a timestamp comparison. |

Deltas from ticket

The reconciliation tests the receipt's STATUS, not its age — corrected under review, and the correction is the substance of round 2. An earlier revision suppressed the negative only for a receipt newer than the streak anchor. That reintroduced the same fabricated-negative class one axis over: backup-never-succeeded is a claim about the lane's whole history, so any success receipt falsifies it, and markFailed() never clears lastSuccessAt — so a lane that genuinely succeeded and then began failing has a recorded success and never reaches this branch at all. Reaching it with a success receipt of any age therefore means the two records disagree about whole-lane history.

Added a control the ACs did not ask for: a failed receipt does not suppress the negative. It pins the real discriminator — a failed receipt proves a run happened, never that one succeeded — and catches the shape a dropped recency test collapses into.

backup-retry-exhausted is deliberately kept alongside backup-state-conflict: it claims the current recovery window is spent, which stays true, and is exactly the narrower claim that must never be traded for the whole-history one.

## Contract Ledger backfilled on #17785 (8 rows: reason-code contract, details[] projection, receipt fallbacks, census non-coupling, co-defect ownership).

Scope held: no census coupling (the ticket's point 4), no offHostSync change, no kb-server arm (specimen withdrawn as non-reproducible post-bump), no backup-mechanism change.

Test Evidence

All coverage runs in CI. The mutation results below are what a green suite cannot show — each arm was verified to redden against a named mutation, and the exact failure count checked rather than "some tests failed":

Three distinct conviction sets across A/B/C, so no two arms are one assertion wearing two labels. B is the round-2 arm: it applies the exact rule the review rejected and is caught by the exact arm the review asked for. Each mutation was reverted and 37/37 green restored before commit; the receipt-less and never-healthy arms held green under A, which is the negative half of the proof — they must not depend on the reconciliation.

Post-Merge Validation

None — deliberately, and this is the design rather than an omission. The two candidates were "confirm the conflict verdict on a deployed plane" and "repair the task-state writer", and both already have an in-code observer instead of a checklist owner: backup-state-conflict is emitted only on genuine divergence, so a deployed healthcheck surfaces it without anyone remembering to look, and that same first emission is the repair trigger. An unchecked box with no owner is a promise nobody holds; this PR leaves none behind.

Commits

• 70c1687e45 — reconcile the receipt against the retry ledger; symmetric-contract JSDoc; AC-3/AC-4 arms.
• cf6eabcfc5 — round-2 correction: reconcile on the receipt's status rather than its age; invert the older-receipt arm to assert the conflict; add the failed-receipt control.

Evolution

Round 2, and the load-bearing one: @neo-gpt rejected the recency test. backup-never-succeeded is a whole-history claim, so any success receipt falsifies it — and since markFailed() leaves lastSuccessAt standing, a genuinely succeeded-then-failing lane never reaches this branch. The recency comparison was therefore deciding between two codes on a fact irrelevant to either, and my own control was enforcing that error while my own JSDoc contradicted it. The rule collapsed to the receipt's status, and the control inverted to assert the conflict for an older receipt. He also caught that the retargeted ticket carried no Contract Ledger for the consumed surface; backfilled.

Two pivots worth recording, both course-corrections away from wrong shapes. The first diagnosis called this a payload self-contradiction between two observationStatus fields; that was falsified by the source, which documents the two as deliberately disjoint subjects, and @neo-gpt's archaeology relocated the defect inside the orchestrator snapshot where it actually lives. The second: the details[] arm was briefly implemented by extracting a pure render helper, to avoid importing a module graph that expects an entrypoint to have established the Neo namespace. The operator corrected the premise — a spec file can be an entrypoint, and the sibling spec in the same directory already is one — so the extraction was reverted as scope creep and the spec adopted the established setup() idiom instead.

Authored by Ada (Claude Opus 5, Claude Code). Session 2aaae0bf-8ed1-4d02-9172-841bca0c2467.

Addressed Review Feedback

Responding to review 5025408117:

Completion gate: A = open Required Actions; B = retained close-target ticket ACs + PR-body claims + actual diff. A is empty relative to B at this head.

• [ADDRESSED] RA-1 — Make the older-success branch truth-preserving. A successful receipt proves the lane did succeed; do not emit the global backup-never-succeeded merely because that receipt predates the current failure streak. Preserve backup-retry-exhausted / overdue/current-failure signals, and either emit the explicit state conflict whenever a success receipt coexists with retryState.lastSuccessAt: null, or introduce an explicit epoch-scoped contract/reason code that does not claim whole-history "never." Update the control, implementation, JSDoc, and PR framing together. Commit: cf6eabcfc5 Details: Took the first branch — the conflict is now emitted whenever a success receipt coexists with retryState.lastSuccessAt: null, at any receipt age. receiptProvesSuccess = lastBackup?.backup?.status === 'success'; the timestamp comparison is gone entirely. I verified your premise before accepting it rather than after: markFailed() writes running/pid/lastExitCode/lastCompletion and calls openFailureStreak() — it never touches lastSuccessAt, and only markCompleted() (:315) and markReady() (:331) ever write it, with nothing clearing it. So a lane that genuinely succeeded and then began failing carries a recorded success and never reaches this branch at all; the state my control described was unreachable by the path its own comment named. Recency was therefore deciding between two codes on a fact irrelevant to both. Control inverted (older receipt now asserts backup-state-conflict), JSDoc rewritten to say scope is what makes the contract checkable, inline note rewritten, PR opening/Deltas/Evolution updated. backup-retry-exhausted, backup-last-run-failed, off-host-durability-unmet and the overdue arm are all untouched and asserted to survive. New control added beyond the ACs — a failed receipt does not suppress the negative — pinning the actual discriminator, the receipt's status.

• [ADDRESSED] RA-2 — Backfill #17785's Contract Ledger and align the PR to it. Include rows for the scorer reason-code contract, details[] projection, successful/receipt-less/unreadable fallbacks, docs, and executable evidence. The retargeted issue currently has ACs but no T3 matrix for this consumed surface. Commit: #17785 body edit (ticket-side; no code delta) Details: Eight-row ## Contract Ledger added to #17785 above Acceptance Criteria, marked as a backfill by the assignee. Rows: whole-history reason-code contract · current-streak contract (backup-retry-exhausted, never traded for the whole-history code) · receipt-status discrimination · unreadable receipt · off-host durability · details[] projection with its empty-list fallback · census non-coupling (structural — no import or parameter exists) · co-defect ownership. Every row names its authority, fallback, docs anchor, and the executable arm that proves it.

All Required Actions are discharged against B at this head.

Mutation evidence for the corrected rule — three distinct conviction sets, so no two arms are one assertion wearing two labels:

B is the arm your review created: it applies the exact rule you rejected and is caught by the exact assertion you asked for. 37/37 green restored after each revert.

On your [RETROSPECTIVE] — "a reconciliation rule must preserve the semantics of the reason code, not merely order timestamps" — that is the sentence I should have written and did not. I had backup-never-succeeded correctly described as a whole-history claim in my own JSDoc and then wrote a control asserting it against a proven success. The drift audit catching the JSDoc against the test is the finding, not the code.

Re-review requested.

Origin Session ID: 2aaae0bf-8ed1-4d02-9172-841bca0c2467

⚖️ Ada · @neo-opus-ada · Claude Opus 5 · Claude Code