grading follow-ups: fixture pinning (#640), export temp-file gap (#646), outcome margins and dedup durability (#648/#650)

[solomonneas]

Non-urgent findings from the post-merge grading review of PRs #640, #646, #648, #650. Batched; none blocks anything.

#640 reader fixture (test-only)

• The fixture omits v0.25.0's finished_at-implies-terminal rule, so the paused variant never pins the one compat property it exists for (deleting the finished_at pop at aboyeur.py:2491 stays green). Add the property.
• The "legacy" snapshot variant is a four-key dict the v0.25.0 writer could never have produced (it always emitted cwd, dry_run, read_only, ...). Generate it from the real writer shape.
• parse_behavior asserts are tautological (fixture constants asserted against the fixture).
• derived_from.commit records the tag object SHA (949d6df7) instead of the commit (5c1dcba).

#646 checkpoint export stripping

• Strip and assert cover only .json: a crashed checkpoint temp (.checkpoint..tmp, run_checkpoint.py:568) holding a full private body is copied and passes the assert. Extend both to the temp pattern.
• A checkpoint whose filename does not match its content hash makes _expected_verify_archive_manifest raise, leaving that verify run permanently unprunable (fail-closed but unbounded retention). Bound it.

#648 regression forgiveness

• The non-scorecard decide path installs on a margin of one (helped=2, hurt=1) with no statistical gate. Consider helped >= hurt + install_min_helped or a Wilson floor, especially while pre-fix(outcome): attribute capture to the exercised skill, not brigade-work #647 ledgers still hold mixed-signal generic buckets.

#650 reused-receipt dedup

• Legacy-row canonicalization depends on the reused receipt file still existing on disk; once receipts are pruned the double count silently returns. Persist the canonical ref (or a resolved marker) instead of re-deriving per read.
• Every rank/score/reconcile now performs O(rows) receipt-file opens (1,600+ on the live ledger); add a cache.
• The ledger row for a reused capture no longer references the reused receipt itself; that provenance lives only in the receipts dir.

From the post-merge grading review. Refs #637, #636, #629, #634.

[solomonneas]

Scope narrowing: the #646 section is done (verified 2026-08-03 on ad5ae46f)

Both #646 checkpoint export stripping bullets have landed via PR #668. Striking that section; the other three remain.

Bullet 1, temp files copied with a full private body. Fixed. src/brigade/work_cmd/verification.py:615 now matches the temp pattern explicitly and omits it before reading the body:

is_temp = name.startswith(".checkpoint.") and name.endswith(".tmp")
...
if is_temp:
    expected.pop(relative)
    omissions.append({"category": "checkpoint-crashed-temp", "relative": relative})
    continue

The omission happens before any decode, which is the stronger version of what the bullet asked for: a crashed temp's arbitrary bytes are never parsed at all.

Bullet 2, hash mismatch leaves a verify run permanently unprunable. Fixed, and the fix is a behavior change worth noting. _expected_verify_archive_manifest no longer raises on a filename/content mismatch. It omits and continues (verification.py:644):

sha = hashlib.sha256(raw).hexdigest()
if path.name != f"{sha}.json":
    expected.pop(relative)
    omissions.append({"category": "checkpoint-hash-mismatch", "relative": relative})
    continue

Retention is now bounded. The mismatch is still recorded rather than swallowed, so the fail-closed intent survives without the unbounded-retention side effect.

What remains

• test(runs): pin previous-release run.json reader to v0.25.0 fixture #640 reader fixture (4 sub-items, test-only): the missing finished_at-implies-terminal property, the synthetic four-key "legacy" snapshot, the tautological parse_behavior asserts, and the derived_from.commit tag-vs-commit SHA.
• fix(outcome): forgive candidate regressions when clears outnumber them #648 regression forgiveness (1 sub-item): the non-scorecard decide path still installs on a margin of one.
• fix(outcome): dedupe reused verify receipts via reused_from #650 reused-receipt dedup (3 sub-items): on-disk dependence for legacy-row canonicalization, the O(rows) receipt-file opens with no cache, and the missing provenance on the ledger row.

I checked for a receipt cache while verifying this and found none, so the #650 performance sub-item is definitely still live. None of the three blocks 0.26.0.