[Workstream C] PR 2 of 2: Post-abort partial-results export bound to receipt-authenticated findings #3097

Pipeline-hardening issue. Generated from the 2026-10-04/05 PR-review session retrospective; claims validated by independent reviewer + critic lanes at tree 1400cc0, then re-pinned against origin/master 5692faa on 2026-10-05. One issue = one PR. Ships before [Workstream S] PR 2/2 (independent surface, lighter integrity scope).

Summary

A review that legitimately ends via abort_pr_workflow (bounded recovery) has no authorized way to export its validated findings: the live handoff path requires an active gate and couples to feedback consent, and abort clears the gate. This PR adds a post-abort partial-results export bound per-item to receipt-authenticated findings — without implying review completion or feedback consent. Carries the abort-reason documentation rider (F2).

Validation provenance

• Round-2 reviewer: CORRECTED the original claim ("cannot produce a handoff" is false — the handoff JSON is written BEFORE the boundary check) but confirmed the live path still requires an active gate and consent coupling; a separate post-abort export is worthwhile.
• Round-2 critic: UPHELD MEDIUM with integrity constraints — "same integrity primitives, independent surface; export ships before F6 with two of the four constraints."

Problem (claims to verify; validated at 1400cc0, re-derive on master)

1. Entry check is only mode + head binding (write-pr-review-artifact.ts:413-421); the handoff record is built and atomically created (:860-878, :917-937) BEFORE the consent/boundary mark (:956-972, feedback-consent.json) — so the file exists, but registration requires post_critic and an active gate, and abort clears the gate.
2. src/tools/abort-pr-workflow.ts:25,44 (pinned at 5692faa): reason: z.string().trim().min(1).max(500) — the registered args surface the bound, but the description (:265) says only "one-line reason" (F2 rider).
3. Source-session observation: a tier-L review with 44 classified candidates and durable artifacts ended via abort with no export of its validated findings.

Acceptance criteria

• AC1: AFTER abort_pr_workflow clears a gate THE SYSTEM SHALL provide an export path producing a partial-results artifact bound per-item to receipt-authenticated findings with workflow/head provenance.
  • class: DISCRIMINATING
  • argv: bun test tests/unit/pr-review/post-abort-export.test.ts
  • expect: RED at 5692faa (no post-abort export exists).
  • files: tests/unit/pr-review/post-abort-export.test.ts (new)
• AC2: The export SHALL NOT imply review completion or feedback consent — it never calls the live handoff completion marker or touches the feedback-consent machinery.
  • class: DISCRIMINATING
• AC3: The export SHALL carry per-item disclosure (lane, severity, provenance from receipt fields) and silence-representation (assigned-but-receiptless families listed as untested).
  • class: DISCRIMINATING
• AC4: The export SHALL be labeled partial/non-authoritative in its artifact metadata and any rendered summary.
  • class: DISCRIMINATING
• AC5: The live handoff path SHALL be unchanged (existing handoff tests stay GREEN).
  • class: PRESERVING
• AC6: The abort tool description SHALL document the 500-character reason limit ("(max 500 chars)").
  • class: DISCRIMINATING (rider)

Constraints and invariants

• A recorded receipt IS terminality evidence for its lane's submission — do NOT require workflow-level terminality evidence for the export (that would defeat post-abort salvage).
• Silence-representation is mandatory: absence is listed, never smoothed over.
• The export issues no verdict — verdict semantics (downgrade-only rules, [Workstream S] PR 2/2) do not apply here and must not be imported.
• Bound to authenticated findings only; no lane self-attestation.

Suggested approach (non-binding)

Reuse the receipt-envelope reads from [Workstream V] PR 1/2's projection; render through the pure renderer from [Workstream C] PR 1/2 with a partial/non-authoritative wrapper; gate the export on the abort receipt's recorded head/PR identity.

Scope

• In scope: post-abort export path, disclosure/silence rendering, abort-description rider.
• Out of scope: N-of-M settlement ([Workstream S] PR 2/2); the live handoff/consent path.

Files expected to change

• src/tools/write-pr-review-artifact.ts (export branch) or a sibling tool module
• src/tools/abort-pr-workflow.ts (description rider only)
• tests/unit/pr-review/post-abort-export.test.ts (new)

Defect class and known siblings

• Class: legitimate-termination salvage gap (bounded-recovery exit discards validated work).
• Known siblings: the N-of-M settlement exit ([Workstream S] PR 2/2) addresses the parallel gap for in-flight settlement.
• Guard that should have caught it: an end-to-end test that aborts a partially-settled review and asserts the findings remain exportable.

Dependencies

• Depends on: none (soft: reuses [Workstream V] PR 1/2 receipt reads and [Workstream C] PR 1/2 renderer if landed — otherwise self-contained reads)
• Gated on: none
• Soft-shared: write-pr-review-artifact.ts with [Workstream V] PR 2/2 (rebase before merge)

Tier and risk triggers

• Tier: M
• Risk triggers: evidence integrity (per-item binding); consent boundary (must not imply feedback authorization)

Verification

• bun test tests/unit/pr-review/
• bun run check:invariants

Definition of done

• All ACs verified with evidence; issue-tracer full-resolution contract satisfied; PR body Closes #<n> with closure evidence.