feat(ci-carry): jobs-mapped lanes, aliases, narrow-lane counts, --simulate proof, policy-base check on carried (GST-1189, GST-1190)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

bin/gstack-ci-carry

@@ -14,10 +14,9 @@
  * carried, 3 still running or no run. Logic: lib/ci-carry.ts; the run checks are lib/run-evidence.ts.
  */
 import { spawnSync } from 'node:child_process';
-import { findCarry, waitForRun } from '../lib/ci-carry';
+import { findCarry, laneMapping, mappingCoverage, waitForRun } from '../lib/ci-carry';
 import { isConfigUnavailable, loadConfigFromBase } from '../lib/pregate/config';
 import { buildRunCheck } from '../lib/pregate/run-check';
-import { runInventory } from '../lib/run-evidence';
 import { wtreeFingerprint } from '../lib/script-invocation';
 import { resolveBaseBranch } from '../lib/ship-policy';
 
@@ -48,8 +47,8 @@ const base = resolveBaseBranch(root, flag('--base'));
 const loaded = loadConfigFromBase(root, base);
 if (isConfigUnavailable(loaded) || loaded.errors.length) { out(`CI_CARRY: none (profiles_unavailable: origin/${base}'s .gstack/pregate.json is unreadable or invalid)`); process.exit(1); }
 const command = flag('--command');
-const mapping = command !== undefined ? loaded.config.ship_lanes_from[command] : undefined;
-if (command !== undefined && !mapping) { out(`CI_CARRY: none (not_mapped: ${JSON.stringify(command)} is not a key of origin/${base}'s ship_lanes_from)`); process.exit(1); }
+const mapping = command !== undefined ? laneMapping(loaded.config.ship_lanes_from, command) : undefined;
+if (command !== undefined && !mapping) { out(`CI_CARRY: none (not_mapped: ${JSON.stringify(command)} is neither a key nor a declared alias in origin/${base}'s ship_lanes_from)`); process.exit(1); }
 if (mapping && !argv.includes('--allow-repo-commands')) usage('--command runs the mapping\'s inventory, a pin-file command: pass --allow-repo-commands');
 const profiles = all('--profile').length ? all('--profile') : mapping ? mapping.profiles : [...new Set(Object.values(loaded.config.ship_lanes_from).flatMap(m => m.profiles))];
 if (!profiles.length) { out(`CI_CARRY: none (no_profile: origin/${base} maps no lane in ship_lanes_from; pass --profile <name>)`); process.exit(1); }
@@ -60,7 +59,7 @@ const tree = git(['rev-parse', 'HEAD^{tree}']);
 
 function find(): number {
   const wtree = () => { const fp = wtreeFingerprint({ cwd: root }); return 'tree' in fp ? fp.tree : null; };
-  const v = findCarry(check as Exclude<typeof check, { error: string }>, { profiles, head, tree, wtree, ...(mapping ? { inventory: () => runInventory(mapping.inventory, root) } : {}) });
+  const v = findCarry(check as Exclude<typeof check, { error: string }>, { profiles, head, tree, wtree, ...(mapping ? mappingCoverage(mapping, root) : {}) });
   if (argv.includes('--json')) out(JSON.stringify(v));
   else out(v.ok ? `CI_CARRY: accepted ${v.receipt}` : `CI_CARRY: none (${v.reason}: ${v.detail})`);
   return v.ok ? 0 : 1;

bin/gstack-evidence

@@ -6,7 +6,7 @@
  *   gstack-evidence run [--reuse [--max-age <hours>]] --label <L> -- <cmd...>
  *   gstack-evidence record-ci --label <L> --base <base> -- <cmd>
  *   gstack-evidence passed -- <cmd>
- *   gstack-evidence carried [--json]
+ *   gstack-evidence carried [--base <branch>] [--json]
  *   gstack-evidence check [--label <L> [--expect-cmd <exact string>]]... | --all
  *                         [--max-age <hours>] [--allow-paths <csv>]
  *   gstack-evidence bundle --out <file> [--label <L>]... [--require <csv>] [--selection L=<text>]...
@@ -66,8 +66,11 @@
  * `record-ci` writes the explicit CI-sourced row for a lane CI carried: it
  * finds and verifies the run itself (lib/ci-carry.ts) for a command the base's
  * ship_lanes_from maps, then records source "ci", the runs and profiles, the
- * run's finish time as ts, bound to HEAD's clean tree; `carried` lists those
- * rows at the current tree for the ship receipt.
+ * run's finish time as ts, bound to HEAD's clean tree, and the policy that
+ * mapped it (`origin/<base>@<sha>:…`); `carried` lists those rows at the
+ * current tree for the ship receipt, only when that policy is origin/<the
+ * receipt's base> (GST-1190: a row a run against another base wrote never
+ * counts).
  *
  * MACHINE-LOCAL by design: neither the ledger nor the logs are brain-synced.
  * A synced record citing an unsynced log would grade FRESH on a machine where
@@ -91,10 +94,9 @@ import { resultLine } from "../lib/result-codes";
 import { isUnavailable, loadPolicyFromBase, resolveBaseBranch } from "../lib/ship-policy";
 import { versionAtRef } from "../lib/restamp";
 import { bashCommandInvocation, runScriptSync, wtreeFingerprint } from "../lib/script-invocation";
-import { findCarry } from "../lib/ci-carry";
+import { findCarry, laneMapping, mappingCoverage } from "../lib/ci-carry";
 import { isConfigUnavailable, loadConfigFromBase } from "../lib/pregate/config";
 import { buildRunCheck } from "../lib/pregate/run-check";
-import { runInventory } from "../lib/run-evidence";
 
 const BIN_DIR = dirname(Bun.fileURLToPath(import.meta.url));
 const LOG_MAX_BYTES = 2 * 1024 * 1024;
@@ -123,10 +125,14 @@ interface EvidenceRecord {
   source?: "ci";
   runs?: string[];
   profiles?: string[];
+  /** The CI jobs a jobs-mapped lane carried from (record-ci, GST-1189); tests_ran is then "n/a". */
+  jobs?: string[];
   /** The base policy that mapped a carried lane (record-ci), as `origin/<base>@<sha>:.gstack/pregate.json`. */
   policy?: string;
   /** The runner's own test count (executed for bun/jest/vitest/pytest/rspec; ran with skips included for gstack's shard runner and the remote gate), 0 for ZERO-RUN, or "unknown" when no supported summary was seen. */
-  tests_ran?: number | "unknown";
+  tests_ran?: number | "unknown" | "n/a";
+  /** "files" when a carried narrow lane's tests_ran counts its inventory files the run covered (record-ci), not tests. */
+  tests_unit?: "files";
 }
 
 /** Bytes of streamed output kept for the tests_ran parse (the 2MB log would truncate the summary). */
@@ -678,16 +684,15 @@ function cmdRecordCi(argv: string[]): number {
   const loaded = loadConfigFromBase(cwd, base);
   if (isConfigUnavailable(loaded)) return none("config_unavailable", loaded.detail);
   if (loaded.errors.length) return none("config_invalid", loaded.errors.map((x) => `${x.path}: ${x.message}`).join("; "));
-  const from = loaded.config.ship_lanes_from;
-  if (!Object.prototype.hasOwnProperty.call(from, command)) return none("not_mapped", `the command is not a key of origin/${base}'s ship_lanes_from`);
-  const m = from[command]!;
+  const m = laneMapping(loaded.config.ship_lanes_from, command);
+  if (!m) return none("not_mapped", `the command is neither a key nor a declared alias in origin/${base}'s ship_lanes_from`);
   const check = buildRunCheck(cwd, null, true, base);
   if ("error" in check) return none("profiles_unavailable", check.error);
   const head = git(["rev-parse", "HEAD"]);
   const tree = git(["rev-parse", "HEAD^{tree}"]);
   if (!head || !tree) return none("no_head", "HEAD is unreadable");
   const wtree = () => { const fp = wtreeFingerprint({ cwd, timeoutMs: 30000 }); return "tree" in fp ? fp.tree : null; };
-  const v = findCarry(check, { profiles: m.profiles, head, tree, wtree, inventory: () => runInventory(m.inventory, cwd) });
+  const v = findCarry(check, { profiles: m.profiles, head, tree, wtree, ...mappingCoverage(m, cwd) });
   if (!v.ok) return none(v.reason, v.detail);
   let paths: ReturnType<typeof ledgerPath>;
   try {
@@ -700,15 +705,21 @@ function cmdRecordCi(argv: string[]): number {
   const runs = v.runs.map((r) => `${r.run_id}/${r.run_attempt}`);
   const rec: EvidenceRecord = {
     ts: new Date(v.runs.map((r) => r.finished_at).sort()[0]!).toISOString(), label, command, cmd_sha256: sha256(command), exit: 0, duration_s: 0,
-    commit: head, tree, dirty: false, wtree: tree, tests_ran: v.tests, source: "ci", runs, profiles: m.profiles, policy: loaded.label,
+    commit: head, tree, dirty: false, wtree: tree, tests_ran: v.tests, source: "ci", runs, profiles: m.profiles, policy: loaded.label, ...(m.jobs ? { jobs: m.jobs } : {}), ...(v.unit ? { tests_unit: v.unit } : {}),
   };
   appendJsonl(paths.file, rec, { mode: 0o600 });
-  console.error(`gstack-evidence: recorded label=${label} exit=0 tests_ran=${v.tests} log=- source=ci runs=${runs.join(",")} policy=${loaded.label}`);
+  console.error(`gstack-evidence: recorded label=${label} exit=0 tests_ran=${v.tests}${v.unit ? ` unit=${v.unit}` : ""} log=- source=ci runs=${runs.join(",")} policy=${loaded.label}`);
   return 0;
 }
 
-/** `carried`: each label's newest row when it is a CI-sourced row at the current working tree, as the receipt's ci_carried entries. */
+/**
+ * `carried`: each label's newest row when it is a CI-sourced row at the current working tree whose mapping policy is
+ * origin/<base> (the receipt's base; default the resolved base branch), as the receipt's ci_carried entries.
+ */
 function cmdCarried(argv: string[]): number {
+  const at = argv.indexOf("--base");
+  if (at >= 0 && !argv[at + 1]) { console.error("usage: gstack-evidence carried [--base <branch>] [--json]"); return 2; }
+  const policyRef = `origin/${(at >= 0 ? argv[at + 1]! : resolveBaseBranch(git(["rev-parse", "--show-toplevel"]) ?? process.cwd())).replace(/^origin\//, "")}@`;
   let records: EvidenceRecord[] = [];
   try {
     records = readJsonl<EvidenceRecord>(ledgerPath().file);
@@ -718,7 +729,7 @@ function cmdCarried(argv: string[]): number {
   const wtree = currentWtree();
   const latest = new Map<string, EvidenceRecord>();
   for (const r of records) latest.set(r.label, r);
-  const carried = [...latest.values()].filter((r) => r.source === "ci" && !!wtree && r.wtree === wtree && Array.isArray(r.runs))
+  const carried = [...latest.values()].filter((r) => r.source === "ci" && !!wtree && r.wtree === wtree && Array.isArray(r.runs) && typeof r.policy === "string" && r.policy.startsWith(policyRef))
     .flatMap((r) => r.runs!.map((ref) => { const [run, attempt] = ref.split("/").map(Number); return { lane: r.label, run, attempt, tree: r.wtree! }; }));
   if (argv.includes("--json")) console.log(JSON.stringify(carried));
   else for (const c of carried) console.log(`CI_CARRIED: ${c.lane} run=${c.run}/${c.attempt} tree=${c.tree.slice(0, 12)}`);
@@ -783,10 +794,10 @@ function cmdCheck(argv: string[]): number {
       allFresh = false;
       continue;
     }
-    const testsRan = typeof latest.tests_ran === "number" ? latest.tests_ran : "unknown";
+    const testsRan = typeof latest.tests_ran === "number" || latest.tests_ran === "n/a" ? latest.tests_ran : "unknown";
     const changedDuringRun = Array.isArray(latest.wtree_changed) ? latest.wtree_changed.filter((p): p is string => typeof p === "string" && p !== "" && !/[\u0000-\u001f\u007f]/.test(p)).slice(0, 5) : [];
     const ci = latest.source === "ci" && Array.isArray(latest.runs) ? ` source=ci runs=${latest.runs.filter((s) => /^\d+\/\d+$/.test(s)).join(",")}` : "";
-    const detail = `label=${label} exit=${latest.exit} tests_ran=${testsRan} ts=${latest.ts}${latest.log_path ? ` log=${latest.log_path}` : ""}${ci}`;
+    const detail = `label=${label} exit=${latest.exit} tests_ran=${testsRan}${latest.tests_unit === "files" ? " unit=files" : ""} ts=${latest.ts}${latest.log_path ? ` log=${latest.log_path}` : ""}${ci}`;
     let verdict: "FRESH" | "STALE" | "ZERO-RUN" = "FRESH";
     let reason = "";
     if (latest.exit !== 0) {

bin/gstack-ship-receipt

@@ -172,9 +172,9 @@ function reviewedProduct(repoRoot: string, base: string, head: string, pregateFi
   return typeof id === 'string' ? { head_tree: tree, product_patch_id: id || 'none' } : { head_tree: tree };
 }
 
-/** The lanes CI carried at the checked-out tree, from this machine's evidence ledger (gstack-evidence carried); undefined when none. */
-function ciCarried(): ShipReceipt['ci_carried'] {
-  const r = runScriptSync(path.join(path.dirname(Bun.fileURLToPath(import.meta.url)), 'gstack-evidence'), ['carried', '--json'], { encoding: 'utf8', timeout: 60_000 });
+/** The lanes CI carried at the checked-out tree under origin/<base>'s mapping, from this machine's evidence ledger (gstack-evidence carried); undefined when none. */
+function ciCarried(base: string): ShipReceipt['ci_carried'] {
+  const r = runScriptSync(path.join(path.dirname(Bun.fileURLToPath(import.meta.url)), 'gstack-evidence'), ['carried', '--base', base, '--json'], { encoding: 'utf8', timeout: 60_000 });
   try { const list = JSON.parse(r.stdout); return Array.isArray(list) && list.length ? list : undefined; } catch { return undefined; }
 }
 
@@ -268,7 +268,7 @@ function cmdWrite(rest: string[], json: boolean): number {
       version: flag(rest, '--version') ?? receiptVersion(repoRoot, head, base), base,
       gated_tree: flag(rest, '--gated-tree') ?? tree?.gated_tree, predecessor: flag(rest, '--predecessor') ?? tree?.predecessor?.recorded_head ?? undefined,
       tree: tree?.tree, gate_reuse: tree ? `${tree.gate_reuse} (${tree.gate_reuse_reason})` : undefined,
-      gate: jsonArg(flag(rest, '--gate')), ci: jsonArg(flag(rest, '--ci')), ci_carried: ciCarried(),
+      gate: jsonArg(flag(rest, '--gate')), ci: jsonArg(flag(rest, '--ci')), ci_carried: ciCarried(base),
       spend_usd: flag(rest, '--spend-usd') !== undefined ? (Number.isFinite(Number(flag(rest, '--spend-usd'))) ? Number(flag(rest, '--spend-usd')) : flag(rest, '--spend-usd')) : undefined,
       session_kind: sessionKind, artifacts_consumed: flag(rest, '--artifacts-consumed'), run: flag(rest, '--run'), thread: flag(rest, '--thread'),
       policy: flag(rest, '--policy') ?? tree?.policy, queue_mode: flag(rest, '--queue-mode'), preregistration: flag(rest, '--preregistration'), history: flag(rest, '--history'),

changelog.d/gsta258-l6-guard-carry.md

@@ -1,5 +1,15 @@
 - A pregate guard whose exact command already passed at this tree no longer runs again (GST-1186). When the base branch's `ship_lanes_from` maps the command, it is carried from the verified CI run through the same `gstack-evidence record-ci` path /ship lanes use (`GUARD: <id> carried runs=…`); otherwise a counted ledger pass of that command at the same working tree stands (`GUARD: <id> reused …`, and the new read-only `gstack-evidence passed -- <command>`). Repos whose suites are guards, like founderstar, stop rerunning about six minutes of suites per /ship. See docs/pregate.md#guard-carry.
 - Known limit: `ship_lanes_from` is still read from `origin/<base>` only, so the PR that adds a mapping cannot carry from it.
+- A `ship_lanes_from` entry can name the CI jobs that run a lane instead of an inventory command: `{ "profiles": [...], "jobs": ["verify", "typecheck"] }`, exactly one of the two (GST-1189). It carries only when every named job succeeded in the newest attempt of the verified run at HEAD's tree, through the same `verifyRun` job check. A missing job refuses as `job_missing` and a skipped one as the new `job_skipped`. Lanes with no test files, like gbrain's verify and typecheck (run 41564913688) or harness-evals' `bunx tsc --noEmit`, can now carry, and they record `tests_ran=n/a`. Fake `check:<command>` entries in `tree.json` can move to this form. A repo declaring `jobs` should raise its `min_gstack_version` to this release first, since older gstack rejects the key. See docs/pregate.md#ship-lanes-jobs.
+
+- A `ship_lanes_from` entry can declare `aliases`, other exact spellings of the same lane such as `env -u ANTHROPIC_API_KEY bun test tests/` (GST-1190). gstack never strips env prefixes on its own, since an `env -i` run is a different environment.
+- A carried lane no longer reports the whole run's test count. An inventory lane reports how many of its files the run covered, labeled as a file count (alphaclaw's 46-test guards lane recorded 9677 before).
+- `gstack-ship-preflight --tests-only --policy-from head --simulate` proves a new mapping before it lands: every line starts `SIMULATION:`, nothing runs, no evidence row is written and nothing clears. A branch's own map never carries, so the first pull request that adopts a mapping pays its full lanes.
+- `gstack-evidence carried`, which the ship receipt reads, lists only rows the receipt base's policy mapped, so a run against another base never lands in a receipt.
+- An unknown `.gstack/pregate.json` key under a `min_gstack_version` above the running gstack now says `needs gstack >= <version>; upgrade` (`PREGATE_GSTACK_TOO_OLD`). It still refuses.
+- docs/pregate.md#prove-a-mapping documents the proof route, the version floors, and that `tree.json` writers using Bun's JUnit must take the root `testsuite` count.
 
 ### Tests
 - `test/ship-ci-carry.test.ts`: in founderstar's shape (guards only, no lanes), `check-quick` carries from CI, `play-through` reuses a same-tree ledger pass, `assets` runs, and a dirty tree carries nothing. It fails without the guard carry.
+- `test/ship-ci-carry.test.ts`: a lane mapped by `jobs` carries when every named job passed at the same tree with no test files, and refuses for a missing job, a skipped job, a rerun whose newest attempt skipped the job, and another tree's run. Those five fail without the change.
+- `test/ship-ci-carry.test.ts` (GST-1190): an alias carries and an undeclared env prefix does not; a narrow lane reports its covered file count, not 9677; a jobs-mapped `bunx tsc --noEmit` guard carries with `n/a`; the newer-gstack message; `--simulate` writes and clears nothing and the branch's own map never carries; `carried` drops a row another base mapped. Six of these fail without the change.

docs/pregate.md

@@ -90,7 +90,7 @@ the byte-pinned `/ship` renders in `test/fixtures/golden/`).
 | `remote_gate` | the repo's remote test gate command; under 8 cores the local test tier becomes a `requires-remote` obligation naming it, and `--remote` runs it (see [remote gate](#remote-gate)) |
 | `run_profiles` | name → `{ workflow, events, jobs, artifact, max_age_hours?, os? }`: the GitHub Actions runs `clear --run` verifies as evidence on the identical tree; a profile named after a lane (`free-tests.yml/macos-named-regressions`) clears that lane (see [run evidence](#run-evidence)). `--from-run` and the main-push reuse job verify runs against them too ([from-run](#from-run), [CI reuse](#ci-reuse)) |
 | `remote_gate_runs` | `{ profiles, inventory, skipped? }`: the run profiles that together clear `pregate.json/remote_gate`, the command that prints the remote gate's test files, one per line, which their runs must cover, and an optional command that prints which selected files the gate itself never runs (see [run evidence](#run-evidence)) |
-| `ship_lanes_from` | maps each exact /ship lane command to `{ profiles, inventory }`: the run profiles whose verified runs at HEAD's clean tree carry that lane instead of running it, and the command listing its test files, which their runs must cover (see [CI carry](#ci-carry)); read from the base branch only |
+| `ship_lanes_from` | maps each exact /ship lane command to `{ profiles, inventory }` or `{ profiles, jobs }`, with optional `aliases`: the run profiles whose verified runs at HEAD's clean tree carry that lane instead of running it, and either the command listing its test files, which their runs must cover, or the CI jobs that must have succeeded (see [CI carry](#ci-carry)); read from the base branch only |
 | `allowlist` | `[{ finding, paths?, pattern?, reason }]`: benign findings the `secrets` check accepts and names as allowlisted, by gstack-redact finding id or non-secret category, path globs and a pattern anchored at the finding; never `env.value` (see [allowlist](#allowlist)) |
 
 Only the `origin/<base>` copy or the user-owned file below is honoured, so a
@@ -785,7 +785,7 @@ Then, for the lane:
 Any API or git error refuses. Each refusal prints `REUSE: refused
 reason=<code> — …` as `PREGATE_RECEIPT_INVALID`, and a run that fails
 verification is named with its own reason (`fork_run`, `event_mismatch`,
-`run_not_success`, `job_missing`, `artifact_mismatch`, `artifact_reused`,
+`run_not_success`, `job_missing`, `job_skipped`, `artifact_mismatch`, `artifact_reused`,
 `tree_mismatch`, `newer_run_vetoes`, `run_changed`, `run_stale`,
 `os_mismatch`, `api_error`, …); the clear-level codes are `base_mismatch`,
 `no_verified_run`, `tree_mismatch` (runs on different trees),
@@ -933,8 +933,9 @@ it accepts a run only when all of these hold:
   tree. A `pull_request` run counts only when the pull request already
   contained its base.
 - Every run executed tests, and with an inventory command, the runs'
-  `tree.json` files cover every file it prints. Each run is read once more
-  afterward (`run_changed`).
+  `tree.json` files cover every file it prints. A lane mapped by `jobs`
+  instead needs no test count: each named job succeeded in the run's newest
+  attempt. Each run is read once more afterward (`run_changed`).
 
 Security and advisory scans, the sealed guard, guards and every preflight-stage
 check always run; only test lanes carry.
@@ -986,8 +987,90 @@ it and the command that lists its test files:
 }
 ```
 
+<a id="ship-lanes-jobs"></a>A lane with no test files to list, such as a typecheck or a verify script,
+names the CI jobs that run it instead (GST-1189). Declare exactly one of
+`inventory` or `jobs`:
+
+```json
+"ship_lanes_from": {
+  "bun run verify": { "profiles": ["ci/test"], "jobs": ["verify", "typecheck"] }
+}
+```
+
+It carries only when every named job concluded `success` in the newest attempt
+of the verified run at HEAD's tree, read by the same `verifyRun` job check the
+profile's own `jobs` use. A job that is missing refuses as `job_missing`, a
+skipped one as `job_skipped`, any other conclusion as `job_not_success`, and a
+run of another tree as `tree_mismatch`. The receipt reads `ci-carry tree=…
+jobs=verify,typecheck runs=…`, and the ledger row records the jobs. gbrain run
+41564913688 (tree `13570abc`) is the case: its verify and typecheck jobs passed
+at the tree, but no inventory could name their files, so they ran again. The
+same form replaces fake `check:<command>` entries some repos wrote into
+`tree.json` to give a typecheck, a doc-freshness check or a lint an inventory
+(gstack-evals #180): name the job instead. A gstack older than the version that
+adds `jobs` rejects the key as invalid config, so a repo declaring it should
+first raise its `min_gstack_version` to that version.
+
+<a id="ship-lanes-aliases"></a>**Aliases.** A lane is keyed on its exact command, so
+`env -u ANTHROPIC_API_KEY bun test tests/` never matches a `bun test tests/` key.
+Declare the other spellings on the entry, read from the base like the rest of
+the map (GST-1190):
+
+```json
+"bun test tests/": { "profiles": ["ci/test"], "inventory": "…", "aliases": ["env -u ANTHROPIC_API_KEY bun test tests/"] }
+```
+
+An alias is a second exact command, never a pattern: gstack does not strip env
+prefixes on its own, because `env -i HOME=… PATH=… bun test tests/` runs in a
+different environment than the key. An alias that repeats a key or another
+entry's alias is invalid config. The ledger row binds the command the lane
+actually ran.
+
+**What `tests_ran` means on a carried lane.** No carried lane reports the whole
+run's count. A lane mapped by `inventory` reports how many of its inventory
+files the runs' `tree.json` covers, labeled as a file count (`tests_ran=14
+unit=files` on the ledger line, `tests_ran=14 (files)` on the `LANE:` line);
+alphaclaw's 14-file, 46-test guards lane used to record the run's 9677.
+`tree.json` has no per-file test counts yet, so the lane's own test count is
+not available. A lane mapped by `jobs` reports `tests_ran=n/a`. Only the
+pregate tests stage and `gstack-ci-carry find` without `--command`, which carry
+the whole run, report its test count.
+
+**`tree.json` counts from Bun's JUnit.** A writer that builds `tree.json` from
+Bun's JUnit report must take the root `testsuite` count. Nested `describe`
+suites repeat the file attribute, so summing every `testsuite` counts tests
+twice. harness-evals #240's `scripts/ci-tree-json.ts` does it right.
+
+<a id="prove-a-mapping"></a>**Proving a new mapping.** `ship_lanes_from` is read from `origin/<base>`
+only, so a branch that adds a mapping cannot carry from it, and running
+against `--base <PR branch>` fails (`BASE_CONTAINS_HEAD`). Prove it with the dry
+run instead:
+
+```bash
+gstack-ship-preflight --tests-only --base main --policy-from head --simulate --lane 'verify=bun run verify'
+```
+
+It reads the branch's own `ship_lanes_from` and `run_profiles`, checks each lane
+against the verified CI run at this tree exactly as a carry would, and prints
+`SIMULATION:` at the start of every line: `LANE: <label> would carry run=…`,
+`CI_CARRY: none label=<label> (<reason>)` or `not mapped`. It runs no lane and
+no pregate, writes no evidence or ledger row, and clears no obligation. It
+exits 0 when every mapped lane would carry. A branch's own map never carries,
+even when the base has no policy at all, because the pull request controls both
+the map and the CI that would satisfy it. So the first pull request that adopts
+a mapping pays its full lanes; the carry starts on the pull requests after it
+merges. `ship_lanes_from` itself needs `min_gstack_version` 1.94.0.0 or later in
+`.gstack/ship-policy.json`, and `jobs` and `aliases` need the release that ships
+them. With that floor set, an older gstack prints `needs gstack >= <version>;
+upgrade` (`PREGATE_GSTACK_TOO_OLD`) instead of a generic invalid-config error.
+
+As a second guard, every `record-ci` row names the policy that mapped it
+(`origin/<base>@<sha>:.gstack/pregate.json`), and `gstack-evidence carried`, which
+the ship receipt reads, lists only rows whose policy is `origin/<the receipt's
+base>`. A row written by a run against another base never lands in a receipt.
+
 A carried lane prints `LANE: <label> carried run=<id>/<attempt> tests_ran=<n>`
-and writes an explicit CI-sourced ledger row (`gstack-evidence record-ci
+(see above for what `<n>` counts) and writes an explicit CI-sourced ledger row (`gstack-evidence record-ci
 --label <label> --base <base> -- <command>`, which finds and verifies the run
 itself, so no caller hands it run ids or a test count: `source: "ci"`, its runs
 and profiles, the run's finish time as `ts`, bound to the clean tree), never a

docs/troubleshooting.md

@@ -3730,6 +3730,20 @@ the entry is reported as unverified, not `REGEN_STALE`.
 **Fix.** Run the printed install command (`bun install`, or the one matching the
 repository's lockfile), then rerun `gstack-regen check` or the pre-gate.
 
+<a id="pregate-gstack-too-old"></a>
+### `PREGATE_GSTACK_TOO_OLD`
+
+**Meaning.** `.gstack/pregate.json` uses a key this gstack does not know, and
+the same tree's `.gstack/ship-policy.json` sets `min_gstack_version` above this
+gstack. The key belongs to a newer gstack (for example `ship_lanes_from` before
+1.94.0.0), so the line reads `needs gstack >= <version>; upgrade`. The policy
+still refuses, exactly as `PREGATE_CONFIG_INVALID` would.
+
+**Fix.** Upgrade gstack on this machine to at least the version named
+(`bin/gstack-upgrade`, or the session install with `--for <skill>`), then
+rerun. A repo adopting a new key raises `min_gstack_version` first, so older
+gstacks print this instead of a generic invalid-config error.
+
 <a id="pregate-config-invalid"></a>
 ### `PREGATE_CONFIG_INVALID`
 

lib/ci-carry.ts

@@ -14,7 +14,9 @@
  *   max age, the run's own tree.json naming HEAD's tree);
  *   every run executed tests;
  *   with an inventory command, the runs' tree.json files cover every file it
- *   prints (a lane carries only what CI provably ran);
+ *   prints (a lane carries only what CI provably ran); with named jobs instead
+ *   (a lane with no test files, GST-1189), each of those jobs succeeded in the
+ *   run's newest attempt, read by verifyRun like the profile's own jobs;
  *   every run still stands after the inventory ran (runChanged).
  *
  * Anything else returns a refusal with a reason code, and the caller runs the
@@ -25,12 +27,17 @@
  * bounded by a timeout, and returns green, red with the failing jobs, still
  * running, or none.
  */
-import { runChanged, runReceiptFields, uncoveredFiles, verifyRun, type ApiRun, type RunDeps, type RunEvidence, type RunProfile, type RunSource } from './run-evidence';
+import { normalPath, runChanged, runInventory, runReceiptFields, uncoveredFiles, verifyRun, type ApiRun, type RunDeps, type RunEvidence, type RunProfile, type RunSource } from './run-evidence';
 
 export type CarryRefusal = 'dirty_tree' | 'no_profile' | 'no_run' | 'no_verified_run' | 'tree_mismatch' | 'no_tests'
   | 'inventory_failed' | 'inventory_empty' | 'inventory_uncovered' | 'run_changed' | 'tree_changed' | 'api_error';
 export type CarryRefused = { ok: false; reason: CarryRefusal; detail: string };
-export type CarryVerdict = { ok: true; runs: RunEvidence[]; tests: number; receipt: string } | CarryRefused;
+/**
+ * `tests` never claims a whole run's count for a narrow lane: with an inventory it is the number of the lane's inventory files
+ * the runs' tree.json covers (`unit: 'files'`; tree.json has no per-file test counts yet), with named jobs `n/a`, and only
+ * without either (the whole run carried) the runs' test count.
+ */
+export type CarryVerdict = { ok: true; runs: RunEvidence[]; tests: number | 'n/a'; unit?: 'files'; receipt: string } | CarryRefused;
 
 /** How many of HEAD's runs per workflow are tried, newest first. */
 const CANDIDATES = 10;
@@ -38,7 +45,8 @@ const no = (reason: CarryRefusal, detail: string): CarryRefused => ({ ok: false,
 const newestFirst = (a: ApiRun, b: ApiRun) => (b.created_at ?? '').localeCompare(a.created_at ?? '') || b.id - a.id;
 
 /** The newest run of `profile` on `head` that verifies; a refusal lists each candidate's reason, newest first. */
-function newestVerified(src: RunSource, name: string, profile: RunProfile, head: string): { ok: true; evidence: RunEvidence } | CarryRefused {
+function newestVerified(src: RunSource, name: string, profile: RunProfile, head: string, jobs: string[]): { ok: true; evidence: RunEvidence } | CarryRefused {
+  if (jobs.length) profile = { ...profile, jobs: [...new Set([...profile.jobs, ...jobs])] };
   const listed = src.deps.runsForHead(profile.workflow, head).filter(r => profile.events.includes(r.event)).sort(newestFirst).slice(0, CANDIDATES);
   if (!listed.length) return no('no_run', `no ${profile.workflow} run (${profile.events.join(', ')}) on ${head.slice(0, 12)} yet`);
   const refusals: string[] = [];
@@ -52,9 +60,12 @@ function newestVerified(src: RunSource, name: string, profile: RunProfile, head:
 
 /**
  * The CI evidence for HEAD's tree under `profiles` (one verified run each), or why there is none. `wtree` reads the
- * working-tree fingerprint (before the lookup and after it); `inventory` lists the files the runs must cover.
+ * working-tree fingerprint (before the lookup and after it); `inventory` lists the files the runs must cover, or `jobs`
+ * names the jobs that must have succeeded in each run's newest attempt (a lane with no test files; no test count needed).
  */
-export function findCarry(src: RunSource, o: { profiles: string[]; head: string; tree: string; wtree: () => string | null; inventory?: () => string[] | { error: string } }): CarryVerdict {
+export function findCarry(src: RunSource, o: { profiles: string[]; head: string; tree: string; wtree: () => string | null; inventory?: () => string[] | { error: string }; jobs?: string[] }): CarryVerdict {
+  const jobs = o.jobs ?? [];
+  let covered: number | undefined;
   const before = o.wtree();
   if (before !== o.tree) return no('dirty_tree', `the working tree (${before ? before.slice(0, 12) : 'fingerprint unavailable'}) is not HEAD's committed tree ${o.tree.slice(0, 12)}; only a clean, committed tree carries`);
   if (!o.profiles.length) return no('no_profile', 'no run profile is named');
@@ -63,13 +74,13 @@ export function findCarry(src: RunSource, o: { profiles: string[]; head: string;
     for (const name of o.profiles) {
       const profile = src.profiles[name];
       if (!profile) return no('no_profile', `${name} is not a run_profiles name on the base branch`);
-      const v = newestVerified(src, name, profile, o.head);
+      const v = newestVerified(src, name, profile, o.head, jobs);
       if (!v.ok) return v;
       runs.push(v.evidence);
     }
     const other = runs.find(e => e.tree !== o.tree);
     if (other) return no('tree_mismatch', `run ${other.run_id} tested tree ${other.tree.slice(0, 12)}, not ${o.tree.slice(0, 12)}`);
-    const empty = runs.find(e => !e.files.length || e.tests === 0);
+    const empty = jobs.length ? undefined : runs.find(e => !e.files.length || e.tests === 0);
     if (empty) return no('no_tests', `run ${empty.run_id}'s tree.json ${empty.files.length ? 'records 0 tests' : 'lists no test files'}`);
     if (o.inventory) {
       const listed = o.inventory();
@@ -77,6 +88,7 @@ export function findCarry(src: RunSource, o: { profiles: string[]; head: string;
       if (!listed.length) return no('inventory_empty', 'the inventory command printed no files');
       const missing = uncoveredFiles(listed, runs);
       if (missing.length) return no('inventory_uncovered', `${missing.length} of ${listed.length} inventory file(s) are in no run's tree.json: ${missing.slice(0, 5).join(', ')}${missing.length > 5 ? ', …' : ''}`);
+      covered = new Set(listed.map(normalPath)).size;
     }
     for (const e of runs) {
       const changed = runChanged(src.deps, e.run_id, e.run_attempt);
@@ -87,6 +99,8 @@ export function findCarry(src: RunSource, o: { profiles: string[]; head: string;
   }
   const after = o.wtree();
   if (after !== o.tree) return no('tree_changed', `the working tree changed while the runs were verified (now ${after ? after.slice(0, 12) : 'unreadable'})`);
+  if (jobs.length) return { ok: true, runs, tests: 'n/a', receipt: `ci-carry tree=${o.tree.slice(0, 12)} jobs=${jobs.join(',')} ${runReceiptFields(runs, src.now)}` };
+  if (covered !== undefined) return { ok: true, runs, tests: covered, unit: 'files', receipt: `ci-carry tree=${o.tree.slice(0, 12)} files=${covered} ${runReceiptFields(runs, src.now)}` };
   const tests = runs.reduce((n, e) => n + (e.tests ?? e.files.length), 0);
   return { ok: true, runs, tests, receipt: `ci-carry tree=${o.tree.slice(0, 12)} tests=${tests} ${runReceiptFields(runs, src.now)}` };
 }
@@ -109,24 +123,54 @@ export async function waitForRun(deps: RunDeps, o: { workflow: string; events: s
   }
 }
 
-/** `ship_lanes_from` (base branch only): exact lane command → the profiles whose runs carry it and the command listing its test files. */
-export interface ShipLaneMapping { profiles: string[]; inventory: string }
+/**
+ * `ship_lanes_from` (base branch only): exact lane command → the profiles whose runs carry it and either the command listing
+ * its test files (`inventory`) or the CI jobs that run it (`jobs`, for a lane with no test files such as a typecheck; GST-1189).
+ */
+export interface ShipLaneMapping { profiles: string[]; inventory?: string; jobs?: string[]; aliases?: string[] }
+
+/**
+ * The `ship_lanes_from` entry for an exact lane command: the entry it keys, else the entry that declares it in `aliases`
+ * (GST-1190: the same lane run under another exact spelling, such as an env prefix). Never normalized: an alias is a
+ * second exact command the base's owner declared, not a pattern.
+ */
+export function laneMapping(from: Record<string, ShipLaneMapping>, command: string): ShipLaneMapping | undefined {
+  if (Object.prototype.hasOwnProperty.call(from, command)) return from[command];
+  return Object.values(from).find(m => m.aliases?.includes(command));
+}
+
+/** findCarry's coverage rule for one mapping: its inventory (a pin-file command run in `cwd`) or its named jobs. */
+export const mappingCoverage = (m: ShipLaneMapping, cwd: string): { inventory?: () => string[] | { error: string }; jobs?: string[] } =>
+  m.jobs ? { jobs: m.jobs } : { inventory: () => runInventory(m.inventory!, cwd) };
 
 /** `<path>: <message>` errors for `ship_lanes_from`; empty when valid. Shared with lib/pregate/config.ts. */
 export function shipLanesErrors(raw: unknown, profileNames: readonly string[]): Array<{ path: string; message: string }> {
   if (raw === undefined) return [];
-  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return [{ path: 'ship_lanes_from', message: 'must be an object of exact lane command → { profiles: [run_profiles names], inventory: command }' }];
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return [{ path: 'ship_lanes_from', message: 'must be an object of exact lane command → { profiles: [run_profiles names], inventory: command } or { profiles, jobs: [job names] }' }];
   const errors: Array<{ path: string; message: string }> = [];
   const oneLine = (s: unknown) => typeof s === 'string' && !!s.trim() && s.length <= 512 && !/[\0\r\n]/.test(s);
+  const declared = new Map<string, string>(Object.keys(raw as object).map(k => [k, 'a key']));
   for (const [command, m] of Object.entries(raw as Record<string, unknown>)) {
     const at = `ship_lanes_from[${JSON.stringify(command)}]`;
     if (!oneLine(command)) errors.push({ path: at, message: 'the key must be the exact lane command: one line under 512 characters' });
-    if (!m || typeof m !== 'object' || Array.isArray(m)) { errors.push({ path: at, message: 'must be { profiles, inventory }' }); continue; }
+    if (!m || typeof m !== 'object' || Array.isArray(m)) { errors.push({ path: at, message: 'must be { profiles, inventory } or { profiles, jobs }' }); continue; }
     const o = m as Record<string, unknown>;
-    for (const k of Object.keys(o)) if (k !== 'profiles' && k !== 'inventory') errors.push({ path: `${at}.${k}`, message: 'unknown key; valid keys: profiles, inventory' });
+    for (const k of Object.keys(o)) if (k !== 'profiles' && k !== 'inventory' && k !== 'jobs' && k !== 'aliases') errors.push({ path: `${at}.${k}`, message: 'unknown key; valid keys: profiles, inventory, jobs, aliases' });
+    if ('aliases' in o) {
+      const aliases = o.aliases;
+      if (!Array.isArray(aliases) || !aliases.length || aliases.some(a => !oneLine(a)) || new Set(aliases).size !== aliases.length) errors.push({ path: `${at}.aliases`, message: 'must be a non-empty array of distinct exact lane commands, each one line under 512 characters' });
+      else for (const a of aliases as string[]) {
+        if (declared.has(a)) errors.push({ path: `${at}.aliases`, message: `${JSON.stringify(a)} is already ${declared.get(a)}; each exact command maps to one entry` });
+        else declared.set(a, `an alias of ${JSON.stringify(command)}`);
+      }
+    }
     if (!Array.isArray(o.profiles) || !o.profiles.length || o.profiles.some(p => typeof p !== 'string')) errors.push({ path: `${at}.profiles`, message: 'must be a non-empty array of run_profiles names' });
     else for (const p of o.profiles as string[]) if (!profileNames.includes(p)) errors.push({ path: `${at}.profiles`, message: `${JSON.stringify(p)} is not a run_profiles name` });
-    if (!oneLine(o.inventory)) errors.push({ path: `${at}.inventory`, message: 'must be one command line under 512 characters that prints the lane\'s test files, one per line' });
+    if (('inventory' in o) === ('jobs' in o)) errors.push({ path: at, message: 'declare exactly one of inventory (a command listing the lane\'s test files) or jobs (the CI jobs that run it)' });
+    else if ('jobs' in o) {
+      const jobs = o.jobs;
+      if (!Array.isArray(jobs) || !jobs.length || jobs.some(j => typeof j !== 'string' || !oneLine(j) || j.length > 128) || new Set(jobs).size !== jobs.length) errors.push({ path: `${at}.jobs`, message: 'must be a non-empty array of distinct CI job names, each one line under 128 characters' });
+    } else if (!oneLine(o.inventory)) errors.push({ path: `${at}.inventory`, message: 'must be one command line under 512 characters that prints the lane\'s test files, one per line' });
   }
   return errors;
 }

lib/pregate/checks/guards.ts

@@ -21,6 +21,7 @@
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { laneMapping } from '../../ci-carry';
 import { matchesAny } from '../../ship-policy';
 import type { Guard } from '../config';
 import { baseInputs, sha256 } from '../context';
@@ -40,7 +41,7 @@ const EVIDENCE = path.resolve(import.meta.dir, '..', '..', '..', 'bin', 'gstack-
 function priorPass(ctx: PregateContext, guard: Guard): { prior?: string; carryNone?: string } {
   const evidence = (args: string[]) => runScriptSync(EVIDENCE, args, { cwd: ctx.repoRoot, env: ctx.env, encoding: 'utf8', timeout: 600_000 });
   let carryNone: string | undefined;
-  if (Object.prototype.hasOwnProperty.call(ctx.config.ship_lanes_from, guard.command)) {
+  if (laneMapping(ctx.config.ship_lanes_from, guard.command)) {
     const ci = evidence(['record-ci', '--label', `guard-${guard.id}`, '--base', ctx.base, '--', guard.command]);
     const runs = / source=ci runs=(\S+)/.exec(String(ci.stderr ?? ''))?.[1];
     if (ci.status === 0 && runs) return { prior: `carried runs=${runs}` };

lib/pregate/config.ts

@@ -46,9 +46,13 @@
  *                 tree, the command listing the gate's test files they must
  *                 cover, and the command naming the selected files the gate
  *                 itself never runs (gstack: paid files)
- *   ship_lanes_from exact /ship lane command → `{ profiles, inventory }`: the
- *                 run profiles whose verified runs at HEAD's tree carry that
- *                 lane, and the command listing its test files (lib/ci-carry.ts)
+ *   ship_lanes_from exact /ship lane command → `{ profiles, inventory }` or
+ *                 `{ profiles, jobs }`: the run profiles whose verified runs
+ *                 at HEAD's tree carry that lane, and either the command
+ *                 listing its test files or the CI jobs that run it (a lane
+ *                 with no test files, GST-1189), plus optional `aliases`:
+ *                 other exact commands for the same lane (GST-1190)
+ *                 (lib/ci-carry.ts)
  *   allowlist     `{ finding, paths?, pattern?, reason }` entries the `secrets`
  *                 check accepts as benign: a gstack-redact finding id or a
  *                 non-secret category, scoped by path globs and/or a regex
@@ -74,7 +78,8 @@ import { shipLanesErrors, type ShipLaneMapping } from '../ci-carry';
 import type { ResultCodeName } from '../result-codes';
 import { runProfileErrors, type RemoteGateRuns, type RunProfile } from '../run-evidence';
 import { sealedErrors } from '../sealed-guard';
-import { containedRelative, globToRegExp } from '../ship-policy';
+import { containedRelative, globToRegExp, runningGstackVersion, SHIP_POLICY_PATH } from '../ship-policy';
+import { cmpVersion, parseVersion } from '../version-source';
 
 export const PREGATE_CONFIG_PATH = '.gstack/pregate.json';
 export const PREGATE_CONFIG_SCHEMA = 'https://github.com/garrytan/gstack/docs/pregate.md#pregate-v1';
@@ -291,6 +296,22 @@ function git(cwd: string, args: string[]): { ok: boolean; out: string } {
   return { ok: r.status === 0 && !r.error, out: (r.stdout ?? '').trim() };
 }
 
+/**
+ * GST-1190: an unknown key in a policy whose project floor (min_gstack_version in the same tree's ship-policy.json) is
+ * above this gstack belongs to a newer gstack. It still refuses, but as an upgrade, not as a typo.
+ */
+function newerGstackErrors(parsed: { config: PregateConfig; errors: ConfigError[]; declaresLanes: boolean }, policyText: string | null): typeof parsed {
+  const unknown = (e: ConfigError) => e.message.startsWith('unknown key');
+  if (!policyText || !parsed.errors.some(unknown)) return parsed;
+  let min: unknown;
+  try { min = (JSON.parse(policyText) as Record<string, unknown> | null)?.min_gstack_version; } catch { return parsed; }
+  const running = runningGstackVersion();
+  const want = typeof min === 'string' ? parseVersion(min) : null;
+  const have = parseVersion(running);
+  if (!want || !have || cmpVersion(want, have) <= 0) return parsed;
+  return { ...parsed, errors: parsed.errors.map(e => unknown(e) ? { ...e, code: 'PREGATE_GSTACK_TOO_OLD' as const, message: `needs gstack >= ${min as string}; upgrade (this gstack is ${running} and does not know this key)` } : e) };
+}
+
 export function loadConfigFromBase(repoRoot: string, base: string, knownChecks: readonly string[] = []): ConfigLoad {
   const ref = `origin/${base.replace(/^origin\//, '')}`;
   const sha = git(repoRoot, ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`]);
@@ -302,13 +323,15 @@ export function loadConfigFromBase(repoRoot: string, base: string, knownChecks:
     if (!entry.ok || entry.out) return { unavailable: true, base: base.replace(/^origin\//, ''), detail: `${ref}:${PREGATE_CONFIG_PATH} could not be read and git cannot confirm it is absent` };
     return { config: DEFAULT_CONFIG, errors: [], present: false, label: `${ref}@${sha.out.slice(0, 12)} (no ${PREGATE_CONFIG_PATH})`, kind: 'none' };
   }
-  return { ...parseConfig(show.out, knownChecks), present: true, label: `${ref}@${sha.out.slice(0, 12)}:${PREGATE_CONFIG_PATH}`, kind: 'base' };
+  const policy = git(repoRoot, ['show', `${sha.out}:${SHIP_POLICY_PATH}`]);
+  return { ...newerGstackErrors(parseConfig(show.out, knownChecks), policy.ok ? policy.out : null), present: true, label: `${ref}@${sha.out.slice(0, 12)}:${PREGATE_CONFIG_PATH}`, kind: 'base' };
 }
 
 export function loadConfigFromHead(repoRoot: string, knownChecks: readonly string[] = []): ConfigLoad {
   const file = path.join(repoRoot, PREGATE_CONFIG_PATH);
   if (!fs.existsSync(file)) return { config: DEFAULT_CONFIG, errors: [], present: false, label: `head (no ${PREGATE_CONFIG_PATH})`, kind: 'none' };
-  return { ...parseConfig(fs.readFileSync(file, 'utf8'), knownChecks), present: true, label: `head (unreviewed) ${PREGATE_CONFIG_PATH}`, kind: 'head' };
+  const policy = path.join(repoRoot, SHIP_POLICY_PATH);
+  return { ...newerGstackErrors(parseConfig(fs.readFileSync(file, 'utf8'), knownChecks), fs.existsSync(policy) ? fs.readFileSync(policy, 'utf8') : null), present: true, label: `head (unreviewed) ${PREGATE_CONFIG_PATH}`, kind: 'head' };
 }
 
 /** A symlink to nothing on the way to `file` (a dotfiles link not yet cloned): a policy the user meant to have, not an absent one. */
@@ -365,7 +388,7 @@ export function explainConfig(): string {
     'remote_gate: the repo\'s remote test gate command; under 8 cores the test tier becomes a requires-remote obligation naming it, and gstack-pregate --remote runs it (it must print PREGATE_REMOTE: tree=<tree> tests=<n> failed=<n>) (docs/pregate.md#remote-gate)',
     'run_profiles: name → { workflow, events, jobs, artifact, max_age_hours?, os? }; the GitHub Actions runs gstack-pregate clear --run verifies as evidence on the identical tree (docs/pregate.md#run-evidence)',
     'remote_gate_runs: { profiles, inventory, skipped? }; the run profiles that together clear the remote gate obligation, the command listing the gate\'s test files they must cover, and an optional command printing which selected files (PREGATE_FILES_FILE) the gate itself does not run, which then need no run (docs/pregate.md#run-evidence)',
-    'ship_lanes_from: exact /ship lane command → { profiles, inventory }; a verified run of each profile at HEAD\'s clean tree whose tree.json covers the inventory carries the lane instead of running it again (docs/pregate.md#ci-carry)',
+    'ship_lanes_from: exact /ship lane command → { profiles, inventory } or { profiles, jobs }, with optional aliases (other exact commands for the same lane); a verified run of each profile at HEAD\'s clean tree whose tree.json covers the inventory, or whose newest attempt ran every named job to success, carries the lane instead of running it again (docs/pregate.md#ci-carry)',
     `allowlist: [{ finding, paths?, pattern?, reason }]: benign findings the secrets check accepts and names as allowlisted. finding is a gstack-redact id (env.kv, google.api_key, pii.phone.e164, …) or a category (${ALLOWLISTABLE_CATEGORIES.join(', ')}); paths are globs; pattern is a regex matched at the finding's position in the added line; one of the two is required, reason always. Never ${NON_ALLOWLISTABLE.join(' or ')} or engine.* (docs/pregate.md#allowlist)`,
     'no .gstack/pregate.json on the base: <state root>/projects/<slug>/pregate.json is read instead (state root: GSTACK_STATE_ROOT, else GSTACK_HOME, else GSTACK_STATE_DIR, else a gstack plugin data dir, else ~/.gstack, per docs/state-root.md; run --explain prints the resolved path; outside the repo, so a PR cannot reach it; a path inside the checkout is ignored)',
   ].join('\n') + '\n';

lib/pregate/run-check.ts

@@ -16,15 +16,16 @@ import { wtreeFingerprint } from '../script-invocation';
 import { resolveBaseBranch } from '../ship-policy';
 import { normalizeRemoteUrl } from '../ship-queue-train-record';
 import { REMOTE_GATE_LANE } from './checks/lanes';
-import { PREGATE_CONFIG_PATH, isConfigUnavailable, loadConfigFromBase } from './config';
+import { PREGATE_CONFIG_PATH, isConfigUnavailable, loadConfigFromBase, loadConfigFromHead } from './config';
 import type { RunCheck } from './index';
 
 /**
  * `profiled` says whether `lane` may have a run profile: an unreadable base counts as profiled, so a lane is
- * recorded unverified only once the base shows it has none.
+ * recorded unverified only once the base shows it has none. `policy: 'head'` reads the branch's profiles instead, only
+ * for gstack-ship-preflight --simulate, a dry run that records and clears nothing.
  */
-export function buildRunCheck(root: string, lane: string | null, allowRepoCommands: boolean, base = resolveBaseBranch(root)): RunCheck | { error: string; profiled?: boolean } {
-  const loaded = loadConfigFromBase(root, base);
+export function buildRunCheck(root: string, lane: string | null, allowRepoCommands: boolean, base = resolveBaseBranch(root), policy: 'base' | 'head' = 'base'): RunCheck | { error: string; profiled?: boolean } {
+  const loaded = policy === 'head' ? loadConfigFromHead(root) : loadConfigFromBase(root, base);
   if (isConfigUnavailable(loaded)) return { error: `the base branch's ${PREGATE_CONFIG_PATH} is unreadable (${loaded.detail}); run profiles come only from the base`, profiled: true };
   if (loaded.errors.length) return { error: `the base branch's ${PREGATE_CONFIG_PATH} is invalid: ${loaded.errors.map(e => `${e.path}: ${e.message}`).join('; ')}`, profiled: true };
   const origin = spawnSync('git', ['config', '--get', 'remote.origin.url'], { cwd: root, encoding: 'utf8', timeout: 30_000 });

lib/result-codes-release.ts

@@ -16,6 +16,11 @@ export const RELEASE_RESULT_CODES = {
     summary: 'the ship policy sets min_gstack_version above this gstack, so this gstack refuses to read it',
     fix: 'upgrade gstack (bin/gstack-upgrade, or the session install with --for <skill>) to the version named, then rerun',
   },
+  PREGATE_GSTACK_TOO_OLD: {
+    anchor: 'pregate-gstack-too-old',
+    summary: 'the pregate policy uses a key this gstack does not know, and the project floor (min_gstack_version in .gstack/ship-policy.json) is above this gstack, so the key belongs to a newer gstack; the policy stays refused',
+    fix: 'upgrade gstack (bin/gstack-upgrade, or the session install with --for <skill>) to at least the version named, then rerun',
+  },
   QUEUE_NOT_READY: {
     anchor: 'queue-not-ready',
     summary: 'the lane is not ready to report: the working tree, HEAD or CI state does not match the pushed PR head',

lib/run-evidence.ts

@@ -62,7 +62,7 @@ export interface RunDeps {
 }
 
 export type RunRefusal = 'run_ref_invalid' | 'other_repository' | 'fork_run' | 'workflow_mismatch' | 'event_mismatch' | 'run_in_progress'
-  | 'run_not_success' | 'job_missing' | 'job_ambiguous' | 'job_not_success' | 'artifact_missing' | 'artifact_mismatch'
+  | 'run_not_success' | 'job_missing' | 'job_ambiguous' | 'job_skipped' | 'job_not_success' | 'artifact_missing' | 'artifact_mismatch'
   | 'artifact_reused' | 'tree_mismatch' | 'newer_run_vetoes' | 'run_changed' | 'run_stale' | 'os_mismatch' | 'api_error';
 export interface RunEvidence { run_id: number; run_attempt: number; head_sha: string; tree: string; profile: string; event: string; finished_at: string; files: string[]; tests: number | null }
 export type RunVerdict = { ok: true; evidence: RunEvidence } | { ok: false; reason: RunRefusal; detail: string };
@@ -126,7 +126,7 @@ export function runProfileErrors(profiles: unknown, gateRuns: unknown): Array<{
 const fail = (reason: RunRefusal, detail: string): RunVerdict => ({ ok: false, reason, detail });
 /** When a run's newest attempt started. A run vetoes the candidate when it started at or after the second the candidate was created: a red re-run of an older run counts, and re-running the candidate does not hide a failure in between. */
 const started = (r: ApiRun): string => r.run_started_at ?? r.created_at ?? '';
-const normalPath = (f: string): string => f.replace(/^(\.\/)+/, '');
+export const normalPath = (f: string): string => f.replace(/^(\.\/)+/, '');
 
 /**
  * The verdict for run `runRef` under `profile`. `vetoHeads` are further heads
@@ -157,6 +157,7 @@ export function verifyRun(deps: RunDeps, o: { repo: string; runRef: string; prof
       const hits = jobs.filter(j => j.name === name);
       if (hits.length === 0) return fail('job_missing', `${at} has no job named ${name}`);
       if (hits.length > 1) return fail('job_ambiguous', `${at} has ${hits.length} jobs named ${name}`);
+      if (hits[0]!.conclusion === 'skipped') return fail('job_skipped', `${at}'s ${name} job was skipped`);
       if (hits[0]!.conclusion !== 'success') return fail('job_not_success', `${at}'s ${name} job concluded ${hits[0]!.conclusion}`);
     }
     const heads = [...new Set([run.head_sha, ...(o.vetoHeads ?? []).filter(h => SHA.test(h))])];

lib/ship-bin-common.ts

@@ -10,6 +10,7 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { fragmentSlug } from './changelog-fragments';
+import { laneMapping, type ShipLaneMapping } from './ci-carry';
 import { isConfigUnavailable, loadConfigFromBase } from './pregate/config';
 import { parseUnifiedDiff, versionAtRef } from './restamp';
 import { branchSides, stampOnlyLine } from './stamp-only';
@@ -173,13 +174,13 @@ export function laneConcurrency(mode: string | undefined, cpus = os.availablePar
 
 export interface LaneResult { label: string; exit: number | null; testsRan: string; log: string; carried?: string; reused?: string; carryNone?: string }
 
-/** The base branch's `ship_lanes_from` entry for each lane whose command is a key, byte for byte (the ledger binds its sha256). */
-export function mappedLanes(cwd: string, base: string, list: { label: string; command: string }[]): Map<string, { profiles: string[]; inventory: string }> {
+/** The base branch's `ship_lanes_from` entry for each lane whose command is a key or a declared alias, byte for byte (the ledger binds its sha256). */
+export function mappedLanes(cwd: string, base: string, list: { label: string; command: string }[]): Map<string, ShipLaneMapping> {
   const loaded = loadConfigFromBase(cwd, base);
-  const map = new Map<string, { profiles: string[]; inventory: string }>();
+  const map = new Map<string, ShipLaneMapping>();
   if (isConfigUnavailable(loaded) || loaded.errors.length) return map;
   const from = loaded.config.ship_lanes_from;
-  for (const l of list) if (Object.prototype.hasOwnProperty.call(from, l.command)) map.set(l.label, from[l.command]!);
+  for (const l of list) { const m = laneMapping(from, l.command); if (m) map.set(l.label, m); }
   return map;
 }
 
@@ -189,8 +190,8 @@ export function mappedLanes(cwd: string, base: string, list: { label: string; co
  */
 export function carryLane(cwd: string, base: string, l: { label: string; command: string }): LaneResult {
   const rec = bin(cwd, 'gstack-evidence', ['record-ci', '--label', l.label, '--base', base, '--', l.command], 600_000);
-  const got = / tests_ran=(\d+) log=- source=ci runs=(\S+)/.exec(rec.stderr);
-  if (rec.status === 0 && got) return { label: l.label, exit: 0, testsRan: got[1]!, log: '-', carried: got[2]! };
+  const got = / tests_ran=(\d+|n\/a)( unit=files)? log=- source=ci runs=(\S+)/.exec(rec.stderr);
+  if (rec.status === 0 && got) return { label: l.label, exit: 0, testsRan: got[2] ? `${got[1]} (files)` : got[1]!, log: '-', carried: got[3]! };
   return { label: l.label, exit: null, testsRan: 'unknown', log: '-', carryNone: /^CARRY_NONE: (.+)$/m.exec(rec.stderr)?.[1] ?? `record_failed: ${firstLine(rec.stderr)}` };
 }
 
@@ -201,7 +202,7 @@ export function carryLane(cwd: string, base: string, l: { label: string; command
  */
 export async function runLanes(cwd: string, list: { label: string; command: string }[], concurrency = Infinity, opts: { base?: string; reuse?: boolean } = {}): Promise<LaneResult[]> {
   const out: LaneResult[] = [];
-  const mapped = opts.base ? mappedLanes(cwd, opts.base, list) : new Map<string, { profiles: string[]; inventory: string }>();
+  const mapped = opts.base ? mappedLanes(cwd, opts.base, list) : new Map<string, ShipLaneMapping>();
   let next = 0;
   const worker = async () => {
     while (next < list.length) {

lib/ship-preflight.ts

@@ -8,8 +8,12 @@
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import { findCarry, laneMapping, mappingCoverage } from './ci-carry';
 import { defaultBaseBranch } from './default-base';
+import { isConfigUnavailable, loadConfigFromHead } from './pregate/config';
+import { buildRunCheck } from './pregate/run-check';
 import { classifyDiff } from './review-depth';
+import { wtreeFingerprint } from './script-invocation';
 import { audit } from './ship-audit';
 import { bin, carryNoneLine, firstLine, flagReader, gh, git, hostedOrigin, laneConcurrency, laneLine, lanes, Report, runLanes, shipPolicy, short } from './ship-bin-common';
 
@@ -20,6 +24,10 @@ export const PREFLIGHT_HELP = `gstack-ship-preflight — /ship Steps 1-3 and Ste
       --lanes serial|parallel   how Step 5 runs its lanes; unset, one at a time on 4 or fewer cores, all at once above
       --policy-from head   Step 5's pregate reads the branch's .gstack/pregate.json, which may only add test lanes
                            (a branch that adds the lane for a file it touches); anything else is PREGATE_HEAD_POLICY_LOOSENS
+  gstack-ship-preflight --tests-only --base <base> --policy-from head --simulate --lane <label>=<command>...
+      a dry run that proves a new ship_lanes_from mapping: which lanes the branch's own map would carry from a verified
+      CI run at this tree. Every line starts SIMULATION:; nothing runs, no evidence or ledger row is written and no
+      obligation clears (a real carry reads origin/<base>'s map only). Exit 0 when every mapped lane would carry, else 1
   gstack-ship-preflight --audit --base <base> --out <dir>   the single reads and Steps 7-8's deterministic audits
       (CONTEXT, TODOS, COVERAGE_MAP, Coverage, PLAN_*, READER: coverage=needed|none plan=needed|none)
 
@@ -164,6 +172,38 @@ async function tests(cwd: string, base: string, list: { label: string; command:
   r.next('Step 6: select eval suites for prompt-related changes with the project\'s selector, then Step 7');
 }
 
+/**
+ * --simulate (GST-1190): HEAD's ship_lanes_from and run_profiles, findCarry against this tree, nothing else. It never calls
+ * gstack-evidence or gstack-pregate, so it writes no row and clears no obligation: a PR controls both its own map and the
+ * CI that would satisfy it, so head policy never carries.
+ */
+function simulate(cwd: string, base: string, list: { label: string; command: string }[]): { text: string; exit: number } {
+  const lines: string[] = [];
+  const say = (s: string) => lines.push(`SIMULATION: ${s}`);
+  const done = (exit: number) => ({ text: lines.join('\n') + '\n', exit });
+  const loaded = loadConfigFromHead(cwd);
+  say(`policy ${isConfigUnavailable(loaded) ? 'unavailable' : loaded.label}; a dry run: nothing runs, no evidence or ledger row is written, nothing clears (a carry reads origin/${base}'s map only)`);
+  if (isConfigUnavailable(loaded) || loaded.errors.length) { say(`refused: ${isConfigUnavailable(loaded) ? loaded.detail : loaded.errors.map(e => `${e.path}: ${e.message}`).join('; ')}`); return done(1); }
+  const check = buildRunCheck(cwd, null, true, base, 'head');
+  if ('error' in check) { say(`refused: ${check.error}`); return done(1); }
+  const head = git(cwd, ['rev-parse', 'HEAD']).stdout.trim();
+  const tree = git(cwd, ['rev-parse', 'HEAD^{tree}']).stdout.trim();
+  const wtree = () => { const fp = wtreeFingerprint({ cwd }); return 'tree' in fp ? fp.tree : null; };
+  let mapped = 0;
+  let carried = 0;
+  for (const l of list) {
+    const m = laneMapping(loaded.config.ship_lanes_from, l.command);
+    if (!m) { say(`LANE: ${l.label} not mapped by the branch's ship_lanes_from; /ship would run it`); continue; }
+    mapped++;
+    const v = findCarry(check, { profiles: m.profiles, head, tree, wtree, ...mappingCoverage(m, cwd) });
+    if (!v.ok) { say(`CI_CARRY: none label=${l.label} (${v.reason}: ${v.detail})`); continue; }
+    carried++;
+    say(`LANE: ${l.label} would carry run=${v.runs.map(e => `${e.run_id}/${e.run_attempt}`).join(',')} tests_ran=${v.tests}${v.unit ? ` unit=${v.unit}` : ''}`);
+  }
+  say(`${carried} of ${mapped} mapped lane(s) would carry once origin/${base} holds this map`);
+  return done(mapped > 0 && carried === mapped ? 0 : 1);
+}
+
 export async function preflight(argv: readonly string[], cwd: string): Promise<{ text: string; exit: number }> {
   const { flag, has } = flagReader(argv);
   const base = flag('--base');
@@ -178,6 +218,7 @@ export async function preflight(argv: readonly string[], cwd: string): Promise<{
   if (!['base', 'head'].includes(policyFrom)) return { text: 'gstack-ship-preflight: --policy-from needs base|head\n', exit: 2 };
   if (!base || typeof list === 'string') return { text: `gstack-ship-preflight: ${typeof list === 'string' ? list : '--base <base> is required'}\n`, exit: 2 };
   if (has('--tests-only') && !list.length) return { text: 'gstack-ship-preflight: --tests-only needs at least one --lane <label>=<command>\n', exit: 2 };
+  if (has('--simulate')) return has('--tests-only') && policyFrom === 'head' && list.length ? simulate(cwd, base, list) : { text: 'gstack-ship-preflight: --simulate needs --tests-only --policy-from head and at least one --lane <label>=<command>\n', exit: 2 };
   const mode = flag('--lanes');
   const concurrency = has('--lanes') && mode === undefined ? '--lanes needs serial or parallel' : laneConcurrency(mode);
   if (typeof concurrency === 'string') return { text: `gstack-ship-preflight: ${concurrency}\n`, exit: 2 };

test/ci-carry.test.ts

@@ -40,9 +40,11 @@ describe('findCarry', () => {
     const v = findCarry(source([run(4)], { 4: record(4) }), { profiles: ['ci-reuse/free-tests'], head: HEAD, tree: TREE, wtree: clean, inventory: () => ['test/a.test.ts', 'test/b.test.ts'] });
     expect(v.ok).toBe(true);
     if (!v.ok) return;
-    expect(v.tests).toBe(40);
+    expect([v.tests, v.unit]).toEqual([2, 'files']);
     expect(v.runs.map(e => e.run_id)).toEqual([4]);
-    expect(v.receipt).toMatch(/^ci-carry tree=bbbbbbbbbbbb tests=40 runs=4\/1 profiles=ci-reuse\/free-tests heads=aaaaaaaaaaaa verified=/);
+    expect(v.receipt).toMatch(/^ci-carry tree=bbbbbbbbbbbb files=2 runs=4\/1 profiles=ci-reuse\/free-tests heads=aaaaaaaaaaaa verified=/);
+    const whole = findCarry(source([run(4)], { 4: record(4) }), { profiles: ['ci-reuse/free-tests'], head: HEAD, tree: TREE, wtree: clean });
+    expect(whole.ok && [whole.tests, whole.unit, whole.receipt.split(' ')[2]]).toEqual([40, undefined, 'tests=40']);
   });
 
   // Value: protects=A2, a carry binds to the working-tree fingerprint before and after; fails_when=a dirty tree or a tree edited during the lookup carries

test/evidence-reuse.test.ts

@@ -109,7 +109,7 @@ describe('gstack-evidence run --reuse (A5)', () => {
 describe('gstack-evidence record-ci and carried (A4)', () => {
   const ciRow = () => {
     const tree = wtree();
-    return { ts: new Date(Date.now() - 600_000).toISOString(), label: 'free', command: 'bun run test', cmd_sha256: createHash('sha256').update('bun run test').digest('hex'), exit: 0, duration_s: 0, commit: gitIn(repo, 'rev-parse HEAD').trim(), tree, dirty: false, wtree: tree, tests_ran: 900, source: 'ci', runs: ['41/2'], profiles: ['ci-reuse/free-tests'] };
+    return { ts: new Date(Date.now() - 600_000).toISOString(), label: 'free', command: 'bun run test', cmd_sha256: createHash('sha256').update('bun run test').digest('hex'), exit: 0, duration_s: 0, commit: gitIn(repo, 'rev-parse HEAD').trim(), tree, dirty: false, wtree: tree, tests_ran: 900, source: 'ci', runs: ['41/2'], profiles: ['ci-reuse/free-tests'], policy: 'origin/main@000000000000:.gstack/pregate.json' };
   };
 
   // Value: protects=a carried lane is an explicit CI row the FRESH check accepts by source, and the receipt lists it only at its own tree;
@@ -121,7 +121,8 @@ describe('gstack-evidence record-ci and carried (A4)', () => {
     expect(chk.status).toBe(0);
     expect(chk.stdout).toContain('EVIDENCE: FRESH label=free exit=0 tests_ran=900');
     expect(chk.stdout).toContain('source=ci runs=41/2');
-    expect(JSON.parse(run(['carried', '--json']).stdout)).toEqual([{ lane: 'free', run: 41, attempt: 2, tree: wtree() }]);
+    expect(JSON.parse(run(['carried', '--base', 'main', '--json']).stdout)).toEqual([{ lane: 'free', run: 41, attempt: 2, tree: wtree() }]);
+    expect(JSON.parse(run(['carried', '--base', 'release', '--json']).stdout)).toEqual([]);
     fs.writeFileSync(path.join(repo, 'src.txt'), 'v2\n');
     gitIn(repo, 'commit -qam two');
     expect(JSON.parse(run(['carried', '--json']).stdout)).toEqual([]);

test/helpers/fake-gh-runs.ts

@@ -7,6 +7,7 @@ import * as path from 'node:path';
 
 export interface FakeWorld {
   runs: Array<Record<string, unknown> & { id: number; run_attempt: number; head_sha: string; path: string }>;
+  /** Keyed `<run id>/<attempt>` for one attempt's jobs, else `<run id>` for every attempt. */
   jobs: Record<string, Array<{ name: string; conclusion: string | null; completed_at?: string }>>;
   trees: Record<string, Record<string, unknown>>;
 }
@@ -30,8 +31,8 @@ if (import.meta.main) {
       process.stdout.write(JSON.stringify(run));
     } else if ((m = /\/actions\/workflows\/([^/]+)\/runs$/.exec(route!))) {
       lines(world.runs.filter(r => r.head_sha === q.get('head_sha') && r.path === `.github/workflows/${m![1]}`));
-    } else if ((m = /\/actions\/runs\/(\d+)\/attempts\/\d+\/jobs$/.exec(route!))) {
-      lines(world.jobs[m[1]!] ?? []);
+    } else if ((m = /\/actions\/runs\/(\d+)\/attempts\/(\d+)\/jobs$/.exec(route!))) {
+      lines(world.jobs[`${m[1]}/${m[2]}`] ?? world.jobs[m[1]!] ?? []);
     } else if ((m = /\/actions\/runs\/(\d+)\/artifacts$/.exec(route!))) {
       lines(world.trees[m[1]!] ? [{ name: q.get('name'), size_in_bytes: 200, expired: false }] : []);
     } else { process.stderr.write(`fake gh: no route for ${p}`); process.exit(1); }

test/run-evidence.test.ts

@@ -64,7 +64,8 @@ describe('verifyRun', () => {
       ['run_stale', world({ run: { ...base.run, updated_at: '2026-10-28T10:00:00Z' } })],
       ['job_missing', world({ jobs: [{ name: 'lint', conclusion: 'success' }] })],
       ['job_ambiguous', world({ jobs: [{ name: 'full-suite', conclusion: 'success' }, { name: 'full-suite', conclusion: 'success' }] })],
-      ['job_not_success', world({ jobs: [{ name: 'full-suite', conclusion: 'skipped' }] })],
+      ['job_skipped', world({ jobs: [{ name: 'full-suite', conclusion: 'skipped' }] })],
+      ['job_not_success', world({ jobs: [{ name: 'full-suite', conclusion: 'cancelled' }] })],
       ['artifact_missing', world({ artifact: new Error('no artifact named full-suite-tree') })],
       ['artifact_mismatch', world({ artifact: { ...(base.artifact as TreeRecord), run_id: 99 } })],
       ['artifact_mismatch', world({ artifact: { ...(base.artifact as TreeRecord), run_attempt: 2 } })],

test/ship-ci-carry.test.ts

@@ -27,13 +27,14 @@ const runs = (f: ShipFx, name: string) => { const p = path.join(f.root, name); r
 const at = (minutesAgo: number) => new Date(Date.now() - minutesAgo * 60_000).toISOString();
 
 /** One run of free.yml at HEAD (id 7 unless named), green with a tree.json naming HEAD's tree, unless overridden. */
-function world(f: ShipFx, over: { run?: Record<string, unknown>; tree?: Record<string, unknown>; others?: Array<Record<string, unknown>>; jobs?: Array<{ name: string; conclusion: string | null }> } = {}): void {
+function world(f: ShipFx, over: { run?: Record<string, unknown>; tree?: Record<string, unknown>; others?: Array<Record<string, unknown>>; jobs?: Array<{ name: string; conclusion: string | null }>; attempts?: Record<string, Array<{ name: string; conclusion: string | null }>> } = {}): void {
   const head = f.git('rev-parse', 'HEAD').stdout.trim();
   const tree = f.git('rev-parse', 'HEAD^{tree}').stdout.trim();
   const run = { id: 7, run_attempt: 1, status: 'completed', conclusion: 'success', event: 'workflow_dispatch', head_sha: head, path: '.github/workflows/free.yml', created_at: at(20), run_started_at: at(20), updated_at: at(5), repository: { full_name: 'fx/fx' }, head_repository: { full_name: 'fx/fx' }, ...over.run };
   const w: FakeWorld = {
     runs: [run, ...((over.others ?? []).map(o => ({ ...run, ...o })))] as FakeWorld['runs'],
-    jobs: { 7: (over.jobs ?? [{ name: 'suite', conclusion: 'success' }]).map(j => ({ ...j, completed_at: at(5) })), 9: [{ name: 'suite', conclusion: 'failure', completed_at: at(1) }] },
+    jobs: { 7: (over.jobs ?? [{ name: 'suite', conclusion: 'success' }]).map(j => ({ ...j, completed_at: at(5) })), 9: [{ name: 'suite', conclusion: 'failure', completed_at: at(1) }],
+      ...Object.fromEntries(Object.entries(over.attempts ?? {}).map(([k, js]) => [k, js.map(j => ({ ...j, completed_at: at(5) }))])) },
     trees: { 7: { run_id: 7, run_attempt: 1, event: 'workflow_dispatch', sha: head, tree, files: ['test/a.test.ts', 'test/b.test.ts'], tests: 12, os: 'Linux', ...over.tree } },
   };
   const file = path.join(f.root, 'world.json');
@@ -51,7 +52,7 @@ describe('Step 5 lanes: CI carry and the tree cache', () => {
     world(f);
     const first = preflight(f);
     expect(first.status).toBe(0);
-    expect(lane(first.stdout, 'free')).toBe('LANE: free carried run=7/1 tests_ran=12');
+    expect(lane(first.stdout, 'free')).toBe('LANE: free carried run=7/1 tests_ran=2 (files)');
     expect(lane(first.stdout, 'unit')).toMatch(/^LANE: unit pass exit=0 tests_ran=2 log=\S+$/);
     expect([runs(f, 'free-runs'), runs(f, 'unit-runs')]).toEqual([0, 1]);
     const again = preflight(f);
@@ -103,7 +104,7 @@ describe('Step 5 lanes: CI carry and the tree cache', () => {
     expect(ev(['check', '--label', 'free', '--expect-cmd', FREE]).stdout).not.toContain('EVIDENCE: FRESH');
     expect(JSON.parse(ev(['carried', '--json']).stdout)).toEqual([]);
     const ok = ev(['record-ci', '--label', 'free', '--base', 'main', '--', FREE]);
-    expect([ok.status, ok.stderr]).toEqual([0, expect.stringContaining('tests_ran=12 log=- source=ci runs=7/1 policy=origin/main@')]);
+    expect([ok.status, ok.stderr]).toEqual([0, expect.stringContaining('tests_ran=2 unit=files log=- source=ci runs=7/1 policy=origin/main@')]);
     const row = JSON.parse(fs.readFileSync(findFilesBySuffix(path.join(f.state, 'projects'), '-evidence.jsonl')[0]!, 'utf8').trim().split('\n').at(-1)!);
     expect(row.policy).toMatch(/^origin\/main@[0-9a-f]{12}:\.gstack\/pregate\.json$/);
   });
@@ -151,8 +152,8 @@ describe('finish, push --early and accept (A1)', () => {
     world(f);
     const ok = f.run(RELEASE, ['accept', '--base', 'main', '--lane', `free=${FREE}`, '--wait', '0']);
     expect(ok.stdout).toContain('CI_WAIT: green ci/free run=7/1');
-    expect(lane(ok.stdout, 'free')).toBe('LANE: free carried run=7/1 tests_ran=12');
-    expect(lineOf(ok.stdout, 'EVIDENCE')).toMatch(/^EVIDENCE: FRESH label=free exit=0 tests_ran=12 .* source=ci runs=7\/1$/);
+    expect(lane(ok.stdout, 'free')).toBe('LANE: free carried run=7/1 tests_ran=2 (files)');
+    expect(lineOf(ok.stdout, 'EVIDENCE')).toMatch(/^EVIDENCE: FRESH label=free exit=0 tests_ran=2 unit=files .* source=ci runs=7\/1$/);
     expect(ok.stdout).toContain('CI_CARRY: accepted ci-carry tree=');
     expect(ok.stdout).toContain('NEXT: Step 18');
     expect(ok.status).toBe(0);
@@ -231,3 +232,151 @@ describe('GST-1186: pregate guards carry like lanes (founderstar shape: guards o
     expect(counts(f)).toEqual([1, 3, 3]);
   });
 });
+
+describe('GST-1189: a lane carries by named CI jobs instead of an inventory', () => {
+  // Value: protects=a ship_lanes_from entry that declares { profiles, jobs } carries only when every named job succeeded in the newest attempt
+  //   of the verified run at HEAD's tree, and refuses with a named reason otherwise; fails_when=a typecheck-only lane cannot carry (no test
+  //   files to inventory), or carries beside a missing, skipped or older-attempt job, or another tree's run;
+  //   why_new=gbrain run 41564913688 (tree 13570abc): verify and typecheck passed in CI but no inventory could name their files; seam=fake gh
+  const VERIFY = 'bun run verify';
+  const pregateJson = (entry: Record<string, unknown>) => JSON.stringify({ run_profiles: { 'ci/free': PROFILE }, ship_lanes_from: { [VERIFY]: { profiles: ['ci/free'], ...entry } } }, null, 2) + '\n';
+  const GBRAIN = { ...BASE, '.gstack/pregate.json': pregateJson({ jobs: ['verify', 'typecheck'] }) };
+  const ALL = [{ name: 'suite', conclusion: 'success' }, { name: 'verify', conclusion: 'success' }, { name: 'typecheck', conclusion: 'success' }];
+  const NO_FILES = { files: [], tests: 0 };
+  const gbrain = () => { const f = shipFixture(GBRAIN); fixtures.push(f); return f; };
+  const find = (f: ShipFx) => f.run(path.join(BIN, 'gstack-ci-carry'), ['find', '--base', 'main', '--command', VERIFY, '--allow-repo-commands']);
+
+  test('every named job green at the same tree carries, with no test files; record-ci records the jobs', () => {
+    const f = gbrain();
+    world(f, { jobs: ALL, tree: NO_FILES });
+    const ok = find(f);
+    expect([ok.status, ok.stdout]).toEqual([0, expect.stringMatching(/^CI_CARRY: accepted ci-carry tree=[0-9a-f]{12} jobs=verify,typecheck runs=7\/1 profiles=ci\/free /m)]);
+    const rec = f.run(path.join(BIN, 'gstack-evidence'), ['record-ci', '--label', 'verify', '--base', 'main', '--', VERIFY]);
+    expect([rec.status, rec.stderr]).toEqual([0, expect.stringContaining('tests_ran=n/a log=- source=ci runs=7/1')]);
+    const row = JSON.parse(fs.readFileSync(findFilesBySuffix(path.join(f.state, 'projects'), '-evidence.jsonl')[0]!, 'utf8').trim().split('\n').at(-1)!);
+    expect([row.jobs, row.tests_ran]).toEqual([['verify', 'typecheck'], 'n/a']);
+  });
+
+  test('a missing job refuses as job_missing', () => {
+    const f = gbrain();
+    world(f, { jobs: ALL.filter(j => j.name !== 'typecheck'), tree: NO_FILES });
+    expect(find(f).stdout).toContain('CI_CARRY: none (no_verified_run: ci/free: run 7: job_missing)');
+  });
+
+  test('a skipped job refuses as job_skipped', () => {
+    const f = gbrain();
+    world(f, { jobs: ALL.map(j => j.name === 'typecheck' ? { ...j, conclusion: 'skipped' } : j), tree: NO_FILES });
+    const r = find(f);
+    expect([r.status, r.stdout]).toEqual([1, expect.stringContaining('CI_CARRY: none (no_verified_run: ci/free: run 7: job_skipped)')]);
+  });
+
+  test('only the newest attempt counts: a rerun that passed carries, a rerun that skipped the job does not', () => {
+    const f = gbrain();
+    const failedFirst = ALL.map(j => j.name === 'typecheck' ? { ...j, conclusion: 'failure' } : j);
+    world(f, { run: { run_attempt: 2 }, tree: { ...NO_FILES, run_attempt: 2 }, attempts: { '7/1': failedFirst, '7/2': ALL } });
+    expect(find(f).stdout).toMatch(/^CI_CARRY: accepted ci-carry tree=[0-9a-f]{12} jobs=verify,typecheck runs=7\/2 /m);
+    world(f, { run: { run_attempt: 2 }, tree: { ...NO_FILES, run_attempt: 2 }, attempts: { '7/1': ALL, '7/2': ALL.map(j => j.name === 'typecheck' ? { ...j, conclusion: 'skipped' } : j) } });
+    expect(find(f).stdout).toContain('CI_CARRY: none (no_verified_run: ci/free: run 7: job_skipped)');
+  });
+
+  test('a run that tested another tree refuses as tree_mismatch', () => {
+    const f = gbrain();
+    world(f, { jobs: ALL, tree: { ...NO_FILES, tree: '1'.repeat(40) } });
+    expect(find(f).stdout).toContain('CI_CARRY: none (no_verified_run: ci/free: run 7: tree_mismatch)');
+  });
+
+  test('an entry declares exactly one of inventory or jobs', () => {
+    const both = shipFixture({ ...BASE, '.gstack/pregate.json': pregateJson({ jobs: ['verify'], inventory: 'printf x' }) }); fixtures.push(both);
+    world(both, { jobs: ALL, tree: NO_FILES });
+    expect(find(both).stdout).toContain('CI_CARRY: none (profiles_unavailable');
+    const neither = shipFixture({ ...BASE, '.gstack/pregate.json': pregateJson({}) }); fixtures.push(neither);
+    world(neither, { jobs: ALL, tree: NO_FILES });
+    expect(find(neither).stdout).toContain('CI_CARRY: none (profiles_unavailable');
+  });
+});
+
+describe('GST-1190: aliases, newer-gstack keys, narrow counts, and proving a mapping without carrying it', () => {
+  // Value: protects=a lane carries under an exact alias the base declares (never an implicit env-prefix rewrite); a narrow lane never reports
+  //   the whole run's test count; an unknown key under a project floor above this gstack says to upgrade; --simulate proves a head map while
+  //   writing and clearing nothing; carried never lists a row another base's policy mapped;
+  //   fails_when=an env-prefixed lane reruns beside a green run, a 46-test lane records 9677, a proof run's rows land in the PR's own receipt,
+  //   or a branch's own map carries; why_new=HARN-7 (harness-evals #240), ALPH-14 (alphaclaw #310), GEVA-235 (gstack-evals #180), GGST-15; seam=fake gh
+  const ev = (f: ShipFx, args: string[]) => f.run(path.join(BIN, 'gstack-evidence'), args);
+  const ledger = (f: ShipFx) => fs.existsSync(path.join(f.state, 'projects')) ? findFilesBySuffix(path.join(f.state, 'projects'), '-evidence.jsonl') : [];
+  const ALL = [{ name: 'suite', conclusion: 'success' }, { name: 'typecheck', conclusion: 'success' }];
+
+  test('a declared alias carries like its key; an undeclared env prefix does not', () => {
+    const TESTS = 'bun test tests/';
+    const ALIAS = 'env -u ANTHROPIC_API_KEY bun test tests/';
+    const f = shipFixture({ ...BASE, '.gstack/pregate.json': JSON.stringify({ run_profiles: { 'ci/free': PROFILE }, ship_lanes_from: { [TESTS]: { profiles: ['ci/free'], inventory: "printf 'test/a.test.ts\\n'", aliases: [ALIAS] } } }) + '\n' }); fixtures.push(f);
+    world(f);
+    const rec = ev(f, ['record-ci', '--label', 'tests', '--base', 'main', '--', ALIAS]);
+    expect([rec.status, rec.stderr]).toEqual([0, expect.stringContaining('tests_ran=1 unit=files log=- source=ci runs=7/1')]);
+    const find = (command: string) => f.run(path.join(BIN, 'gstack-ci-carry'), ['find', '--base', 'main', '--command', command, '--allow-repo-commands']).stdout;
+    expect(find(ALIAS)).toMatch(/^CI_CARRY: accepted ci-carry tree=[0-9a-f]{12} files=1 /m);
+    expect(find('env -i HOME=/tmp bun test tests/')).toContain('CI_CARRY: none (not_mapped');
+  });
+
+  test('an alias that repeats a key is invalid config', () => {
+    const f = shipFixture({ ...BASE, '.gstack/pregate.json': JSON.stringify({ run_profiles: { 'ci/free': PROFILE }, ship_lanes_from: { a: { profiles: ['ci/free'], jobs: ['suite'] }, b: { profiles: ['ci/free'], jobs: ['suite'], aliases: ['a'] } } }) + '\n' }); fixtures.push(f);
+    world(f);
+    expect(f.run(path.join(BIN, 'gstack-ci-carry'), ['find', '--base', 'main']).stdout).toContain('CI_CARRY: none (profiles_unavailable');
+  });
+
+  test('a carried narrow lane counts its covered inventory files, never the run total (alphaclaw: 46 tests recorded as 9677)', () => {
+    const f = fx();
+    world(f, { tree: { files: ['test/a.test.ts', 'test/b.test.ts', 'test/c.test.ts'], tests: 9677 } });
+    const rec = ev(f, ['record-ci', '--label', 'guards', '--base', 'main', '--', FREE]);
+    expect([rec.status, rec.stderr]).toEqual([0, expect.stringContaining('tests_ran=2 unit=files log=- source=ci')]);
+    expect(rec.stderr).not.toContain('9677');
+  });
+
+  test('a jobs-mapped guard carries in the guards stage (harness-evals: bunx tsc --noEmit) and reports n/a', () => {
+    const TSC = 'bunx tsc --noEmit';
+    const f = shipFixture({ ...BASE, '.gstack/pregate.json': JSON.stringify({ run_profiles: { 'ci/free': PROFILE }, ship_lanes_from: { [TSC]: { profiles: ['ci/free'], jobs: ['typecheck'] } }, guards: [{ id: 'typecheck', when: ['src/**'], command: TSC, fix: 'bunx tsc --noEmit' }] }) + '\n' }); fixtures.push(f);
+    world(f, { jobs: ALL, tree: { files: [], tests: 0 } });
+    const g = f.run(path.join(BIN, 'gstack-pregate'), ['--stage', 'guards', '--allow-repo-commands', '--base', 'main']);
+    expect([g.status, g.stdout]).toEqual([0, expect.stringContaining('GUARD: typecheck carried runs=7/1')]);
+    const row = JSON.parse(fs.readFileSync(ledger(f)[0]!, 'utf8').trim().split('\n').at(-1)!);
+    expect([row.tests_ran, row.jobs]).toEqual(['n/a', ['typecheck']]);
+  });
+
+  test('an unknown key under a project floor above this gstack says to upgrade; without the floor it stays the generic error', () => {
+    const conf = JSON.stringify({ future_lanes: {} }) + '\n';
+    const floor = shipFixture({}, { '.gstack/pregate.json': conf, '.gstack/ship-policy.json': JSON.stringify({ min_gstack_version: '99.0.0.0' }) + '\n' }); fixtures.push(floor);
+    const newer = floor.run(path.join(BIN, 'gstack-pregate'), ['validate']);
+    expect(newer.status).not.toBe(0);
+    expect(newer.stderr).toContain('needs gstack >= 99.0.0.0; upgrade');
+    expect(newer.stderr).toContain('(PREGATE_GSTACK_TOO_OLD)');
+    const plain = shipFixture({}, { '.gstack/pregate.json': conf }); fixtures.push(plain);
+    const typo = plain.run(path.join(BIN, 'gstack-pregate'), ['validate']);
+    expect([typo.stderr.includes('(PREGATE_CONFIG_INVALID)'), typo.stderr.includes('needs gstack')]).toEqual([true, false]);
+  });
+
+  test('--simulate proves the branch map: every line says SIMULATION, nothing is written, nothing clears, and head policy never carries', () => {
+    const VERIFY = 'bun run verify';
+    const head = JSON.stringify({ run_profiles: { 'ci/free': PROFILE }, ship_lanes_from: { [VERIFY]: { profiles: ['ci/free'], jobs: ['typecheck'] } } }) + '\n';
+    const f = shipFixture({ '.github/workflows/free.yml': BASE['.github/workflows/free.yml'] }, { '.gstack/pregate.json': head }); fixtures.push(f);
+    world(f, { jobs: ALL, tree: { files: [], tests: 0 } });
+    const sim = f.run(PREFLIGHT, ['--tests-only', '--base', 'main', '--policy-from', 'head', '--simulate', '--lane', `verify=${VERIFY}`, '--lane', `unit=${UNIT}`]);
+    const lines = sim.stdout.trim().split('\n');
+    expect(lines.every(l => l.startsWith('SIMULATION: ')), sim.stdout + sim.stderr).toBe(true);
+    expect(sim.stdout).toContain('SIMULATION: LANE: verify would carry run=7/1 tests_ran=n/a');
+    expect(sim.stdout).toContain('SIMULATION: LANE: unit not mapped');
+    expect([ledger(f), runs(f, 'unit-runs'), fs.existsSync(path.join(f.work, '.gstack', 'tmp', 'pregate.json'))]).toEqual([[], 0, false]);
+    expect(JSON.parse(ev(f, ['carried', '--json']).stdout)).toEqual([]);
+    const real = ev(f, ['record-ci', '--label', 'verify', '--base', 'main', '--', VERIFY]);
+    expect([real.status, real.stderr]).toEqual([1, expect.stringMatching(/^CARRY_NONE: not_mapped: /m)]);
+    expect(f.run(PREFLIGHT, ['--tests-only', '--base', 'main', '--simulate', '--lane', `verify=${VERIFY}`]).status).toBe(2);
+  });
+
+  test('carried lists only rows the receipt base mapped: a proof run against the PR branch never reaches its receipt', () => {
+    const f = fx();
+    expect(f.git('push', '-q', 'origin', 'feat').status).toBe(0);
+    world(f);
+    expect(ev(f, ['record-ci', '--label', 'free', '--base', 'feat', '--', FREE]).status).toBe(0);
+    expect(JSON.parse(ev(f, ['carried', '--base', 'main', '--json']).stdout)).toEqual([]);
+    expect(JSON.parse(ev(f, ['carried', '--base', 'feat', '--json']).stdout)).toEqual([expect.objectContaining({ lane: 'free', run: 7, attempt: 1 })]);
+    expect(JSON.parse(ev(f, ['carried', '--json']).stdout)).toEqual([]);
+  });
+});