GeezerVison

A production latch reported `reason: "unspecified"` because 44 call sites took
the default. The reason is the only thing that names which guard tripped, and a
refusal surfaces many frames later as one fixed sentence, so an unnamed latch is
undiagnosable — that is what left an incident's origin unidentified for a day.

Give each call site a literal that names its guard, add the 20 new literals to
the reason union, and sort them into the existing error/warn split: a guard that
should not trip on a healthy run reports at error, everything else stays at warn.
`log-creation-skipped` joins the by-design set since it fires on every run that
does not persist a log.

Make `reason` required on both `markIncomplete` and `markInputPathIncomplete`, so
omission is a compile error rather than a silent `unspecified`. A caller with
genuinely nothing to say now passes `'unspecified'` where a reviewer can see it.

The three remaining bare calls are on ResolvedSecretTraceProvenanceAccumulator,
a different class with no reason concept.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

…roduction

Cover what the reason set is for rather than only that it compiles: the
non-enumerable tool-params branch now asserts it names `tool-input-not-enumerable`,
which is the guard the production logs showed reporting `unspecified`, and every
new literal asserts which stream it reports on — error for a guard that cannot
trip on a healthy run, warn for one reachable without a fault, silent for the
by-design log-less session.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Two fields had grown into competing answers to the same question. `origin` is a
free-form label for which importer accepted an already-incomplete bundle; four
latches had started passing `markIncomplete('unspecified', { origin })`, using it
to stand in for a reason that did not exist yet. That splits one fact across a
closed enum and an open string, leaving neither worth alerting on.

Give those four the literal they were reaching for — none needed a new one — and
split the five reasons that covered genuinely different guards, so the reason
alone locates the site rather than needing an origin beside it. `origin` keeps its
narrow job, now documented: it disambiguates importers that share one guard, and a
latch that wants an origin because no reason fits should add a reason instead.

No production call site passes 'unspecified' any more.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Cursor Bugbot caught `backfill-checkpoint-*`: the guard covered four conditions
under one reason classified as an originating fault, and one of them — a state
persisted before the checkpoint contract existed — is what essentially every
legacy row looks like. A backfill over historical rows would have put one error
line per row into the stream the error/warn split exists to protect.

Auditing the rest of the error-level reasons for the same shape found a second:
a client tool invoked without a run id has no binding to unseal against, so it
took the `[null, null]` path and reported `client-tool-seal-failed` at error on an
ordinary configuration.

Split both along the line that matters — absent versus unusable, not attempted
versus failed — and classify each half: expected states warn, genuine faults keep
error. `backfill-scope-mismatch` is retired; it named one of its four conditions.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

cursor Bot left a comment