[squid-protocol]

Fixes #4758

Root cause

The refresh job passes both sweeps (non-Db2 + Db2) to det_coverage_ledger.py update, but evidence_report.py --refresh --live takes no sweep (the report's sweeps are the frozen measured block). For a Db2 case with no sweep row and no det_sweep_baseline.json entry, proof_blockers.judge_equivalence adds "not proven in CI", which the report rendered as "det port not run" -> L1, although the ledger already held that case's coverage.

Design (persistent, ledger-based)

• The ledger holds an entry only for a case its last sweep proved. The report now reads a Db2 case's verdict from that entry ("equal", source: the Db2 det sweep as the ledger last recorded it) when there is no sweep row and no baseline entry, while the entry is readable (det_coverage() / last_coverage() from Evidence report: keep the last measured level, marked stale, on harness / oracle staleness #4734: current, or stale on harness/oracle only). A blocking change (case, corpus) makes it "not run" again.
• Push refreshes skip Db2 and leave its ledger entries alone, so the last Db2 level persists, marked stale (L3*) once its inputs move (evidence report: keep a program's last measured level marked stale instead of dropping L3/L4 to zero on any harness change #4730). A local sweep row still takes precedence (unchanged path).
• det_coverage_ledger.py update now drops the entry of a case a sweep ran and did NOT prove (cases it did not run are kept), so "entry = last sweep proved it" is an invariant, not a convention.
• Found while verifying: a LINKed run would take its case's (main program's) ledger coverage, contrary to COBOL translator: CICS command breadth (START/RETRIEVE, channels/containers, GETMAIN, LOAD, CONVERSE, INQUIRE, ASSIGN, counters, HANDLE ABEND PROGRAM) #4270 -- masked before because no LINKed Db2 run was ever equal (e.g. GenApp LGSTSQ jumped to L4 from LGACDB02's coverage). A LINKed run now never takes coverage; it is L2 at most, stale with the ledger verdict it rests on.
• Workflow: comment only (no sweep needs passing to the report build). actionlint + zizmor clean.

Local verification (--refresh --live levels, not committed)

With the #4756 Db2 ledger, fingerprints refreshed to this tree (= what a full refresh at HEAD writes):

estate	before	after
GenApp	L0 6, L1 20, L2 5	L0 6, L1 0, L2 12, L3 11, L4 2
CBSA	L0 14, L1 15, L4 2	L0 14, L1 9, L2 3, L3 2, L4 3
CardDemo	L1 5, L2 11, L3 3, L4 11	L1 4, L2 12, L3 3, L4 11 (COTRTUPC L1->L2)
Mortgage	L1 1, L2 2	L1 0, L2 3 (EPSCMORT L1->L2)
zECS	unchanged	unchanged

The #4756 ledger as-is against this tree (harness moved since: a push run): the same levels, every Db2-derived one marked stale (*), e.g. GenApp lgacus01 L1 -> L3* (3/3 paragraphs, 4/8 branches), UPDACC L1 -> L4*. Main's current ledger gives the same histogram, all Db2 levels stale.

Note: once this lands, --check --live (release gate) will list stale Db2 levels until the next nightly full refresh makes them current -- intended #4730 behaviour (they were L1 before).

Tests

tests/tools/test_evidence_report.py: Db2 with no sweep/no entry stays "not run"; Db2 verdict from a sweep input (L3, local sweep); persistence from the ledger on a run without Db2 (L3 current); stale ledger entry -> L3* with stale inputs; baseline/sweep outrank the ledger; LINKed program never inherits coverage and is stale with its ledger verdict. tests/tools/test_det_coverage_ledger.py: update drops a not-proven swept case, keeps an unswept one. 106 passed (1 skip: the advisory committed-reports check).

Gates: pr_gates --fast 5/5 pass; --ratchets 6 pass, ports FAIL from the shared cics-crucible checkout being off its v0.6.0 pin (environment; no ports/generator code touched).

🤖 Generated with Claude Code

https://claude.ai/code/session_01MQNoe4wPJgr7dbUvs3DG6D

[github-actions]

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab