[atomantic]

Summary

A dependency-audit recovery run continued the original PR branch, but goal-fidelity review saw only the Reactor checksum repair. The earlier dependency bumps and audit coverage were omitted because the prior-delivery helper required the earlier tip to be an exact merge parent.

Restore the complete retained change when the same task's captured earlier tip equals the retry window's base, its captured branch matches, and both source-baseline and current-head ancestry are proven. Use net current source so reverted updates cannot receive credit. Dependency-audit retries may also include the earlier agent's bounded execution report, explicitly identified as unverified claims. All evidence shares the existing cap; rubric and hold behavior are unchanged.

Test plan

• Real-git regressions cover the retained-branch reconstruction, archive lookup, missing/mismatched provenance, unrelated source, reverted updates, and the shared evidence budget.
• Public PR fix: update compatible dependencies and private uv bootstrap #15770 fixture replay with qwen3-coder:30b: the recovery window alone returns rethink; complete evidence returns ship; report-only and unrelated-change controls return rethink (4/4).
• Separate replay with the actual archived earlier execution report also returns ship; private run records are not included in the fixture.
• Focused goal-fidelity, finalization, screenshot, and reviewer tests pass.
• npm run pregate -- --base origin/main passed in a disposable clone with locked development installs. The assigned checkout's linked dependencies predate merged dependency updates; its preflight correctly refused them. The live checkout was not installed into.
• No local PR code review is configured for this task. Hosted CI remains required before merge.