process-gap(orchestrator+adversary): mandated probe hygiene makes a completed review indistinguishable from an unstarted one — stall recovery misdiagnoses and orders duplicate work

## Summary

Mandated probe hygiene makes a COMPLETED adversarial review externally indistinguishable from an UNSTARTED one — and that blind spot caused an orchestrator to misdiagnose a finished review as never-begun, order a restart, and pay for a full duplicate battery.

## What happened

An adversarial reviewer completed its entire pass (warmup, isolation + full suite runs, multiple mutation probes) and then executed its hygiene mandate exactly as written: every probe restored via checkout (shasum-proven), all /tmp scratch removed. It then stalled before delivering its report (a separate, known infra failure mode — the stall class tracked in the silent-idle issue).

The orchestrator's stall-recovery protocol ran its standard disk check: worktree pristine at the fixed HEAD, porcelain empty, **zero /tmp artifacts**. Every prior stall in the same window had left an evidence trail, so the empty /tmp read as "died before starting." The resume nudge ASSERTED a clean start ("you went idle before starting — execute your dispatch from the top"). The agent — correctly — re-executed the entire review and noted in its eventual report: "a finished review is externally indistinguishable from an unstarted one; I restore every probe and rm all scratch by mandate."

Cost: one full duplicate battery (two suite runs + re-run probes). Benefit lost: the partial-delivery license (the recovery protocol's core cost-saver) was structurally unavailable because the evidence that would have activated it had been deleted by the hygiene mandate itself.

## Root cause

The hygiene mandate and the recovery protocol have contradictory evidence requirements: hygiene says "leave no trace"; recovery says "I diagnose your state from your traces." When both are in force, a post-hygiene stall is forensically identical to a pre-work death.

## Remedies (adopted locally, validated over the subsequent passes)

1. **Retention split**: run-OUTPUT files (suite/probe result logs in /tmp) are retained until the orchestrator confirms report receipt; only probe SCRATCH (mutated-file backups, temp fixtures) is cleaned immediately. Restores of target files remain immediate and shasum-proven. This preserves the anti-contamination properties hygiene exists for while keeping the forensic record.
2. **Nudges ask, never assert**: resume nudges state the disk evidence and ask "if complete, deliver the report; if mid-work, finish only what remains" — they never assert the agent's position. Validated immediately: the next stalled agent answered a survivor-disclosure demand from its retained outputs without re-running anything.

## Cross-refs

Silent-idle/stall recovery family (#457 — this is the diagnosis-layer failure of that protocol), #683 (declared-vs-actual agent behavior — adjacent but distinct: here the behavior was exactly as declared; the declaration itself created the blind spot).

The issue describes a protocol conflict between the orchestrator's stall-recovery and the adversary's hygiene mandate. Look at the orchestrator's recovery protocol (likely in a scheduler or monitor module) and the adversary's cleanup logic. The fix involves splitting retention of output logs from scratch cleanup. Check cross-referenced issues #457 and #683 for context. 'Done' means the orchestrator can correctly diagnose a post-hygiene stall without ordering duplicate work.

Written by the indexing model from the issue text.