[Bug]: Review receipt generator sources reviewed-evidence from a stale pre-fix run, yielding verdict=incomplete on accepted finishes

[orenlab]

CodeClone version

2.1.0a2 (branch fix/baseline-v3-migration, epoch HEAD 1b780d9c)

Affected area

MCP server

What happened?

During the Phase 39B landing, two consecutive finish_controlled_change cycles produced durable receipts with verdict: "incomplete" even though their patch trails show scope_check=clean and verification=accepted, and intent_cleared=true.

Root cause (observed, not yet code-located): the receipt generator populates reviewed_evidence (and apparently health/provenance) from a stale pre-fix analysis run instead of the run that the finish verification actually used. Both receipts show reviewed_evidence: {reviewed_count: 0, total_gate_relevant: 1} — the single gate-relevant finding was a dead-code finding (_is_semantic_marker_name leftover) that the very change being finished removed. The finish pipeline accepted the removal; the receipt still counted the finding as gate-relevant-and-unreviewed, downgrading the verdict.

Observed instances (durable, retrievable via get_review_receipt from root /Users/***/PycharmProjects/codeclone):

1. run a9f4075e (dead-code correction cycle), receipt digest 359a9ad4580291c89fc9b6bcbe041df421f572f155becf7fe0d9c4da363fb795 — verdict=incomplete, provenance.baseline_status=not_loaded, generated_at 2026-07-13T17:28:08Z vs finish created_at 17:30:44Z; patch trail 92919b29f11bfe05af5ace3d541288dbab6fc78649eaab5b6986ce62bd411f90 says verification=accepted.
2. run 1a6baa14 (documentation-only amendment cycle running while the finding was still live), receipt digest bc1e79ef9ccfd162a79354969b77decad0de791178856f29d93781d0715e3714 — same total_gate_relevant: 1, verdict=incomplete on a docs-only patch whose structural checks are not applicable.

What did you expect instead?

The receipt must be generated from the same evidence snapshot the finish verification used: if verification=accepted and the gate-relevant finding set at finish time is empty (or the finding was eliminated by the verified patch), reviewed_evidence.total_gate_relevant should not count it and the verdict should be clean. A receipt whose verdict contradicts its own accepted verification is a trust-surface inconsistency: honest agents get an incomplete durable receipt for a correct fix.

Minimal reproduction (code snippet)

# Conceptual reproduction (multi-step MCP workflow, not a single snippet):
# 1. analyze_repository(root)                      -> run R1 contains exactly one
#    gate-relevant finding F (e.g. one dead-code symbol).
# 2. start_controlled_change(scope covering F's file)
# 3. remove the dead symbol (the fix eliminates F)
# 4. analyze_repository(root)                      -> run R2, F gone
# 5. finish_controlled_change(intent, after_run_id=R2)
#    -> verification: accepted
#    -> receipt: verdict=incomplete, reviewed_evidence.total_gate_relevant == 1  # BUG:
#       receipt counted F from R1 (pre-fix) instead of R2 (the verified after-run)

Additional context

• Baseline status during instance 1 was mid fp2-cutover (baseline_status: not_loaded), which may be a contributing condition but instance 2 had baseline_status: trusted, so the stale-run sourcing is the common factor.
• Engineering Memory incident records: mem-526a2c7c5f6f4ebc93f0ced1dd75d0b1 (agent-side incident), plus controller validation notes from the 39B acceptance review.
• Impact: cosmetic-but-corrosive — completion gates that read only the receipt verdict would misclassify accepted work; auditors must cross-read the patch trail to learn the truth.

[orenlab]

Third instance, materially worse severity class.

Phase 39E final verification cycle (run f098d10e, receipt da011cd43bc9bf7ef238ca624d4f66d4f0d409ea8ddfd0c0e235aebf55a59864, root /Users/***/PycharmProjects/codeclone):

• Patch trail (same run, same created_at): scope_check=clean, verification=accepted.
• Receipt: verdict=needs_attention, but crucially patch_contract.status: "violated" with contract_violations: ["structural_regressions"] and structural_delta: {verdict: "regressed", regressions: 9}, reviewed_evidence.total_gate_relevant: 9.

The 9 regressions are phantoms. Independently verified at controller review:

1. Fresh canonical run 174c051f on the merged tree: 18 findings, 0 new vs trusted baseline, health 91/A, delta 0.
2. compare_runs(before=d4e17e00 [pre-39E], after=174c051f [post-39E], focus=structural) → comparable: true, regressions: [], improvements: [], unchanged: 18, verdict: stable.
3. The commit-time codeclone . --ci hook passed on the same bytes.

Contributing condition: the intent was a no-edit verification restart that used a coverage-joined canonical run as both the WIP-baseline and the after evidence — the receipt generator appears to have compared across non-comparable run projections (coverage-joined vs plain), fabricating gate-relevant regressions.

Severity note: instances 1–2 downgraded honest work to incomplete. This instance makes the durable receipt assert patch_contract: violated for a finish the controller accepted — a durable artifact now claims a contract violation that never happened. Anything trusting receipt verdicts (dashboards, completion gates, future audits) inherits a false violation. Suggested acceptance criterion for the fix: the receipt's patch_contract/structural_delta/reviewed_evidence must be derived from the exact before/after run pair the finish verification used, and refuse generation (typed error) when the pair is non-comparable, rather than emitting fabricated deltas.