A non-ok doctor check states its conclusion without the observation that produced it

[MongLong0214]

A non-ok doctor check states its conclusion without the observation that produced it. The exit code a probe returned, the path that was actually executed, the counts a verdict rests on — all of it is either interpolated into the detail sentence or discarded. A machine consumer gets prose; a human pasting a bug report gets whatever the sentence happened to include.

Why this exists

The defect history of this command is a history of missing evidence:

• the hook could be redirected to any executable and doctor still said ok #49 — the hook was redirected to an arbitrary executable and doctor said ok. The recorded target was the observation that would have exposed it; the fix surfaced it into prose, and prose is where it still lives.
• doctor: PreToolUse hook runtime reports exit 127 for a working hook on a binary-only install (checks a synthesised path, not the recorded command) #128 / doctor reports a working PreToolUse hook as broken: it probes a synthesised scripts/commitlore-run.sh path instead of the configured command #149 — doctor failed a working hook by probing a synthesized path that appeared in no settings file. A row that records what was actually executed makes that class of bug visible on first read of the report.
• doctor and hooks status report a stale hook pin as ok: commit-msg still bound to v0.5.0 after upgrading to 0.6.0 #382 — the stale hook pin was printed inside doctor's own ok line: "doctor prints the stale path in its own ok line, so it has the value in hand and does not act on it." Values in hand belong in a field a test can assert on.
• doctor's own fix breaks git fetch and git pull, then reports ok #63 — the second doctor run reported ok over a fetch it had just broken; the fetch exit code was the evidence.
• index ingests any key: value line as a trailer; doctor reports 106 records where git has 0, and context serves commit subjects to the agent #335 / doctor reports a healthy install on a repository where every capture has been silently dropped for 8 days #458 — an ok built on counting the wrong thing ("109 trailers" that were another convention's vocabulary). Counts in evidence make the claim inspectable.

PRD §1.3 makes evidence a rule; ADR-0032 §8.3 makes it an invariant: "No claim without evidence."

Scope

Populate evidence: Record<string, string> in every check path. Keys snake_case, values strings (PRD §1.3).

• A bounded-excerpt helper for process output: first line, hard cap 200 characters, paired <stream>_truncated: "true" | "false" key (PRD §1.3 rule 2). The excerpt stays because hook-runtime and inject-runtime diagnose from stderr first lines — ADR-0032 explicitly rejected collapsing evidence to present/empty.
• A home-relative path helper: no evidence value carries an absolute $HOME prefix; paths render ~/... (PRD §1.3 rule 3).
• Minimum keys per check (more are allowed; these are the floor a reviewer checks):

check	minimum evidence
cli-runtime	entry (the resolved artifact probed — the #40 lesson), version on ok; exit_code, stderr_first_line, stderr_truncated on fail
notes-refspec	remotes; missing / forced when non-empty; per-remote fetch exit_code on the could-not-verify path
notes-push	remote, local_sha; remote_sha or ls_remote_stderr_first_line
commit-msg-hook	hook_path, the recorded target fields (bin, node as recorded), commitlore_bin_override when set — the #49 surface
hook-runtime	exit_code, stderr_first_line, stderr_truncated on non-ok
inject-runtime	executable (what was actually spawned — the #149 surface), exit_code, stderr_first_line on non-ok
inject-version	executable, theirs, mine — the #382 surface
mcp-lifecycle	unfinished_count, last_pid, last_at on warn
pending-backlog	stranded, staged_expired, oldest on warn
git-trailers	git_version, parsed on fail
history-depth	shallow: "true" on warn
index-health	trailers, commits, last_indexed_sha, head_sha, fts
squash-conservation	candidates, checked, uncheckable, lost_count on non-skip

• Detail strings and text output stay byte-identical: evidence is a --json surface until the text ticket adds --verbose.

Acceptance criteria

• Suite-wide invariant, exactly as PRD §1.3 rule 1 words it: "A status with empty evidence and a non-ok value fails the test suite" — asserted over every fixture report in the suite.
• Every process-output evidence value is a first line, ≤ 200 characters, with its paired _truncated key.
• No evidence value contains the absolute $HOME prefix (walk all fixture reports with HOME pointed at the fixture parent).
• The minimum-keys table above is satisfied per check per status path.
• Evidence values are strings — numbers stringified, the record flat, no nesting.
• Text output byte-identical; --json gains only new keys; existing doctor tests pass without edits.

Tests that must exist

case	what it catches
a hook printing 10KB of stderr yields a ≤200-char excerpt with stderr_truncated "true"	unbounded evidence — the exact PRD §1.3.2 warning: "the bound exists so --json output size is independent of what a broken tool prints". This is the fails-if-wrong-the-way-the-PRD-warns case
inject-runtime failure names the executable it spawned	the #149 regression: evidence must be the configured command actually executed, never a reconstructed path
commit-msg-hook surfaces the recorded target and any COMMITLORE_BIN override	the #49 channel going quiet again
inject-version rows carry theirs and mine	the #382 skew becoming prose-only again
paths under HOME render home-relative	$HOME leaking into pasted bug reports (PRD §1.3.3)
non-ok with empty evidence fails the suite (the invariant itself, exercised by a deliberately-broken test-only row)	any future check path that reaches a verdict without recording an observation — ADR-0032 §8.3

Depends on

• A doctor check row cannot say which subsystem it speaks for, and nothing prevents building an inconsistent one #462 (evidence field), runDoctor is a hand-written array of ad-hoc functions: one throwing check kills the whole command, and nothing is timed #463 (crash rows already carry error), Why doctor skipped a check exists only as prose: ten skip sites, zero machine-readable reasons #464 (skip rows are typed before evidence rules harden around them).

Out of scope

• --verbose rendering (text ticket), the envelope, changing any status decision or detail string, the squash-conservation truncation counters (branches_seen/branches_checked belong to the performance ticket, PRD §10.3).

Traceability: PRD §1.3; ADR-0032 §8.3 and the rejected "present/empty" collapse.

[MongLong0214]

Closed by #487, merged to dev. Thirteen of thirteen rows carry evidence, no value contains an absolute home path, and the text report is byte-identical — the pinned snapshot is what says so.

Two deliberate departures from the Swift reference are recorded in the commit: process output stays a bounded excerpt rather than collapsing to present-or-empty, because these checks diagnose from the stderr first line and the reference sanitises there instead; and paths render home-relative so a pasted bug report does not carry someone's directory layout.

Stated limit: evidence answers what was observed, not whether the observation was the right one to make. #335's wrong count would now be visible in a field rather than prevented.