fix(verify-pr): define the launch gate's reference side and isolate per-tree artifacts

Review on 21014c30d6 (R1-1/R1-2/R1-3, RC1-RC5): the gate compared dist
against an unnamed source, so a self-consistent mutant build passed it;
"PR anchor" was undefined and collided with the mutation-anchor sense;
the control proved liveness, not refusal; the gate had no carve-out for
the producing row's own run; and tree isolation stopped at the checkout
while the workspace links, the shared sandbox tag, and the single Maven
repository stayed host-global.

Name the reference side as a sha256 manifest of each measurement arm's
clean dist recorded before the matrix starts, retire the undefined
anchor term, require the gate to refuse a known-mutant build, exempt the
producing row's own launches, and extend isolation to node_modules, the
sandbox image tag, and the Maven repository. Replace the fragment pins
with the whole bullet pinned inside its section plus the whole pointer
line; a 17-row mutation acceptance goes red on every row, and a
real-file M8 run turned the suite red before a byte-identical restore.

.qwen/skills/verify-pr/SKILL.md

@@ -1263,16 +1263,28 @@ results in both directions.
 - Give the mutation matrix a tree of its own — never the tree a live cell
   is measured on. Restoring the source after each row is not enough: a
   build inside a row propagates the mutant into `dist/`, and a daemon
-  started mid-row loads it. Gate every daemon or dist-level harness launch
-  on a scripted `dist`-versus-source anchor check that covers every PR
-  anchor plus a control proving the check can report a mismatch, and
-  refuse the launch when it fails. Never hand-patch `dist/` to repair a
-  contaminated build; rebuild from source you have verified clean.
-  Measured example: a round interleaved its mutation matrix with 80 live
-  daemon cells on one tree, then hand-patched the mutant it found in
-  `dist/`; the patched build still carried the mutant expression, so every
-  live cell and the whole matrix were withdrawn and the round shipped as
-  `inconclusive`.
+  started mid-row loads it. Isolate every artifact a launch resolves, not
+  just the checkout: `cp -al` the round's `node_modules` into the matrix
+  tree and assert each `@qwen-code/*` link resolves inside it (a nested
+  tree without its own `node_modules` walks up to the round's), build the
+  sandbox image under a per-tree tag and export `QWEN_SANDBOX_IMAGE` for
+  that tree's cells only (the tag in `packages/cli/package.json` is one
+  shared name any tree's build retags), and give Java rows their own
+  `-Dmaven.repo.local` copied from the warmed repository. Before the
+  matrix starts, record a sha256 manifest of each measurement arm's
+  clean `dist/`, and gate every daemon or dist-level harness launch
+  outside the row that produced it on a scripted comparison against that
+  manifest — never against the matrix tree's live source, which mid-row
+  is the mutant and agrees with its own build. Prove the gate live by
+  requiring it to refuse a known-mutant build, not merely to report a
+  fabricated mismatch. Never hand-patch `dist/` to repair a contaminated
+  build; rebuild from source you have verified clean and re-record the
+  manifest from that build — a hand-patch that restores only the visible
+  sites leaves the rest of the build mutant. Measured example: a round
+  interleaved its mutation matrix with 80 live daemon cells on one tree,
+  then hand-patched the mutant it found in `dist/`; the patched build
+  still carried the mutant expression, so every live cell and the whole
+  matrix were withdrawn and the round shipped as `inconclusive`.
 - Stop processes only by the PIDs you recorded. After every batch, list
   orphaned (ppid 1) processes under the rig path and expect zero.
 - Restore the tree and tear the rig down before exiting. `process.exit()`

scripts/tests/qwen-triage-workflow.test.js

@@ -4995,14 +4995,48 @@ describe('qwen-triage verify hardening round 2', () => {
     // PR #13748 local round (2026-10-31): the mutation matrix and 80 live
     // daemon cells shared one tree; a hand-patched dist still carried the
     // mutant expression, and the whole round was withdrawn as inconclusive.
-    expect(flat).toContain('Give the mutation matrix a tree of its own');
-    expect(flat).toContain('propagates the mutant into `dist/`');
-    expect(flat).toContain('refuse the launch when it fails');
-    expect(flat).toContain('Never hand-patch `dist/`');
-    // Review on 0d06209b2d: the four pins above left the anchor-coverage and
-    // mismatch-control clauses unasserted — deleting either still passed.
-    expect(flat).toContain('covers every PR anchor');
-    expect(flat).toContain('a control proving the check can report a mismatch');
+    // Review on 21014c30d6: fragment pins left the operative clauses and the
+    // measured example unasserted, so the bullet is pinned whole inside its
+    // section: deleting any clause, flipping the exclusion, or moving the
+    // bullet out of Rig hygiene turns this red.
+    const rigHygiene = flat.slice(
+      flat.indexOf('### Rig hygiene (local rounds)'),
+      flat.indexOf('### Targeted gates'),
+    );
+    expect(rigHygiene).toContain(
+      'Give the mutation matrix a tree of its own — never the tree a live ' +
+        'cell is measured on. Restoring the source after each row is not ' +
+        'enough: a build inside a row propagates the mutant into `dist/`, and a ' +
+        'daemon started mid-row loads it. Isolate every artifact a launch ' +
+        "resolves, not just the checkout: `cp -al` the round's `node_modules` " +
+        'into the matrix tree and assert each `@qwen-code/*` link resolves ' +
+        'inside it (a nested tree without its own `node_modules` walks up to ' +
+        "the round's), build the sandbox image under a per-tree tag and export " +
+        "`QWEN_SANDBOX_IMAGE` for that tree's cells only (the tag in " +
+        "`packages/cli/package.json` is one shared name any tree's build " +
+        'retags), and give Java rows their own `-Dmaven.repo.local` copied from ' +
+        'the warmed repository. Before the matrix starts, record a sha256 ' +
+        "manifest of each measurement arm's clean `dist/`, and gate every " +
+        'daemon or dist-level harness launch outside the row that produced it ' +
+        'on a scripted comparison against that manifest — never against the ' +
+        "matrix tree's live source, which mid-row is the mutant and agrees with " +
+        'its own build. Prove the gate live by requiring it to refuse a ' +
+        'known-mutant build, not merely to report a fabricated mismatch. Never ' +
+        'hand-patch `dist/` to repair a contaminated build; rebuild from source ' +
+        'you have verified clean and re-record the manifest from that build — a ' +
+        'hand-patch that restores only the visible sites leaves the rest of the ' +
+        'build mutant. Measured example: a round interleaved its mutation ' +
+        'matrix with 80 live daemon cells on one tree, then hand-patched the ' +
+        'mutant it found in `dist/`; the patched build still carried the mutant ' +
+        'expression, so every live cell and the whole matrix were withdrawn and ' +
+        'the round shipped as `inconclusive`.',
+    );
+    expect(flat).toContain(
+      'Runner hygiene (time caps, PID-only kills, restoring the tree, a tree ' +
+        'of its own apart from every live cell, the clean-`dist` launch gate, ' +
+        'syntax checks that do not execute) is in **Rig hygiene (local ' +
+        'rounds)** below.',
+    );
     expect(flat).toContain('`process.exit()` skips `finally`');
     expect(flat).toContain('with `node --check`, never `import()`');
     expect(flat).toContain('Do not edit a shell runner while it executes');