@@ -8,16 +8,9 @@ showed did not mean what it looked like.
 
 ### Behaviour changes
 
-No flag, config key or API shape is removed. What changes is what a run REPORTS,
-and two of these move an exit code.
-
-- **A teams run whose halves are all green now reports
-  `success_with_failures` instead of `failure` when a task escalated.**
-  `Result.Success` drives the exit code, so a run that exited non-zero for this
-  can now exit zero. `FailedTasks` still carries the count, the outcome is never
-  plain `success`, and a warning names both the evidence and the seam it does
-  not cover. An UNVERIFIED half never counts, so a run with a half that was
-  never proved still fails flat.
+No flag, config key or API shape is removed, and no exit code moves. What
+changes is what a run REPORTS.
+
 - **A team gate reports UNVERIFIED, not RED, when the project defines no such
   check** — `npm error Missing script: "build"` no longer fails a team. A gate
   that used to be red is now grey, and reds are no longer raised as tickets for
@@ -180,34 +173,28 @@ and two of these move an exit code.
 
 ### Changed — what a teams run reports
 
-- **Both halves proving themselves is now a license to report
-  `success_with_failures` instead of flat failure.** Measured live: two
-  implementation tasks done, `team backend-go is green`, `team frontend-react is
-  green`, and the run reported **failure** because a seam *tester* escalated
-  after a local reviewer scored its prose 0. The software was built and each
-  half was proved by its own command; the user was told it failed.
-
-  The escalation refusal already had one exception — the objective gate measured
-  green — on the stated principle that when a planner's guess at a decomposition
-  and a measurement disagree, the measurement wins. Every team proving its own
-  half is a measurement of exactly that kind: an exit status on the real tree,
-  not a model's opinion of a write-up. It was simply being thrown away.
-
-  This is **not** a relaxation of the refusal:
-
-  - the escalated task stays escalated on the board, and `FailedTasks` keeps the
-    count;
-  - the outcome is never plain `success` — `success_with_failures` exists to be
-    told apart from a clean board, and the summary names the escalation;
-  - an **UNVERIFIED** gate is never counted. A command that could not run said
-    nothing about that half, and rounding it up here would undo that
-    distinction at the one place it decides the headline verdict;
-  - fewer than two proved halves proves nothing — one team doing all the work is
-    not a teams run.
-
-  A warning says so explicitly, naming the halves that were proved and the gap
-  that remains: those commands do not check the **seam**, which is the thing a
-  seam task existed to verify.
+- **A failing teams run now says which halves nonetheless proved themselves.**
+  The verdict is untouched: the run failed, the exit code stands, and whatever
+  refused it did so for a reason. What a person needs and did not get is the
+  SHAPE of the failure — "everything is broken" and "both halves compile and
+  pass their own tests, and what failed is the join between them" call for
+  completely different next moves, and the summary said only the first.
+  Measured live: `team backend-go is green`, `team frontend-react is green`,
+  two implementation tasks done, reported as a flat failure indistinguishable
+  from a run where nothing worked at all.
+
+  An UNVERIFIED half is never named as proved — a command that could not run
+  said nothing about that half, which is the whole reason UNVERIFIED is
+  separate from RED.
+
+  *A stronger version of this was written and withdrawn.* It let both-halves-
+  green license reporting `success_with_failures` instead of `failure` when a
+  task had escalated, by analogy with the objective gate's existing licence.
+  A wiring test showed it did not fix the case it was built for: that run was
+  refused by a **tester rejection**, which is a different and stronger refusal
+  — the tester found an unresolved defect — and one that should keep winning.
+  Changing the exit code on the strength of a scenario never actually observed
+  was not worth the risk, so only the reporting was kept.
 
 ### Known limitation — the seam task
 
 
@@ -501,29 +501,24 @@ nothing:
 The result is on the board, per team: **proved green**, **half is red**, or
 **unverified** with the reason.
 
-### Both halves green changes the run's verdict
+### A failing run says which halves were proved
 
-A task that escalates normally fails the whole run — the escalation is exactly
-the signal a human should look. There is one long-standing exception: the
-objective command measured green, on the principle that when a planner's guess
-at a decomposition and a measurement disagree, the measurement wins.
-
-Every team proving its own half is a measurement of that kind. So a run whose
-halves are all green reports `success_with_failures` rather than `failure`, and
-says why:
+A task that escalates fails the whole run — the escalation is exactly the signal
+a human should look at. That does not change. What does is the SHAPE of the
+failure being visible:
 
 ```text
-verify  reporting success_with_failures over 1 task(s) needing human review:
-        every half proved itself (backend-go, frontend-react), which is a
-        measured exit status rather than a planner's guess — but the SEAM
-        between them is not what those commands check, so look at the
-        escalation before trusting the join
+verify  the run failed, but 2 half/halves proved themselves against their own
+        acceptance command (backend-go, frontend-react) — those halves compile
+        and pass what they declare, so start at what failed BETWEEN them rather
+        than inside them
 ```
 
-Nothing is swallowed. The task stays escalated, the count stays on the result,
-the outcome is never plain `success`, and an **unverified** half never counts —
-a command that could not run is not evidence, which is the whole reason
-UNVERIFIED is separate from RED.
+"Everything is broken" and "both halves are sound and the join is not" call for
+completely different next moves, and the summary said only the first. An
+**unverified** half is never named here: a command that could not run said
+nothing about that half, which is the whole reason UNVERIFIED is separate from
+RED.
 
 ---
 
 
@@ -1,28 +1,55 @@
 package orchestrator
 
 import (
+	"context"
+	"strings"
+	"sync"
 	"testing"
+	"time"
 
+	"github.com/UnicoLab/slmcode/pkg/config"
+	"github.com/UnicoLab/slmcode/pkg/plan"
+	"github.com/UnicoLab/slmcode/pkg/quality"
 	"github.com/UnicoLab/slmcode/pkg/squads"
 )
 
-func gatedOrchestrator(t *testing.T, gates ...TeamGate) *Orchestrator {
+// selectiveGate answers each command on its own merits, which is the only way
+// to build the shape under test: both TEAM commands green while the run as a
+// whole fails.
+type selectiveGate struct{ green map[string]bool }
+
+func (g *selectiveGate) run(_ context.Context, _, cmd string, _ time.Duration) quality.SmokeResult {
+	ok := g.green[cmd]
+	sr := quality.SmokeResult{Ran: true, Command: cmd, OK: ok}
+	if ok {
+		sr.Summary = quality.SmokePassedMarker + ": " + cmd
+	} else {
+		sr.Summary = quality.SmokeFailedMarker
+	}
+	return sr
+}
+
+func halvesPlan() *squads.Plan {
+	return &squads.Plan{Squads: []squads.Squad{
+		{ID: "backend-go", Owns: []string{"cmd/**"}, Acceptance: "go build ./..."},
+		{ID: "frontend-react", Owns: []string{"web/**"}, Acceptance: "npm run build"},
+	}}
+}
+
+func gatedPlanOrchestrator(t *testing.T, gates ...TeamGate) *Orchestrator {
 	t.Helper()
-	o := &Orchestrator{squadPlan: &squads.Plan{Squads: []squads.Squad{
-		{ID: "backend-go"}, {ID: "frontend-react"},
-	}}}
+	o := &Orchestrator{squadPlan: halvesPlan()}
 	for _, g := range gates {
 		o.teamGates.set(g)
 	}
 	return o
 }
 
-// The measured case: two tasks done, both halves green by their own commands,
-// and the run reported flat FAILURE because a seam tester escalated after a
-// local reviewer scored its prose 0. The software was built and each half was
-// proved; the user was told it failed.
+// Two halves, each proved by running its own acceptance command, is measured
+// evidence: an exit status on the real tree rather than a model's opinion of a
+// write-up.
 func TestBothHalvesGreenIsMeasuredEvidence(t *testing.T) {
-	o := gatedOrchestrator(t,
+	o := gatedPlanOrchestrator(t,
 		TeamGate{Team: "backend-go", Ran: true, OK: true},
 		TeamGate{Team: "frontend-react", Ran: true, OK: true})
 
@@ -35,9 +62,8 @@ func TestBothHalvesGreenIsMeasuredEvidence(t *testing.T) {
 }
 
 // An UNVERIFIED gate is the case this must never round up. A command that could
-// not run said nothing about that half, and the whole point of separating
-// UNVERIFIED from RED is that it is not evidence in either direction —
-// counting it here would undo that at the one place it decides the verdict.
+// not run said NOTHING about that half — that is the entire reason UNVERIFIED
+// is separate from RED — so it is not evidence in either direction.
 func TestAnUnverifiedHalfIsNotEvidence(t *testing.T) {
 	for name, gates := range map[string][]TeamGate{
 		"one half never ran its check": {
@@ -52,30 +78,107 @@ func TestAnUnverifiedHalfIsNotEvidence(t *testing.T) {
 			{Team: "backend-go", Ran: false},
 			{Team: "frontend-react", Ran: false},
 		},
+		"only one half reported at all": {
+			{Team: "backend-go", Ran: true, OK: true},
+		},
 	} {
-		if gatedOrchestrator(t, gates...).allHalvesProved() {
-			t.Errorf("%s: was counted as proof", name)
+		if gatedPlanOrchestrator(t, gates...).allHalvesProved() {
+			t.Errorf("%s: was counted as proof of both halves", name)
 		}
 	}
 }
 
-// "Both halves proved" needs both halves to exist and be proved. One team doing
-// all the work is not a teams run, and a single green gate must not license
-// walking past an escalation.
-func TestOneProvedHalfIsNotBothHalves(t *testing.T) {
-	o := gatedOrchestrator(t, TeamGate{Team: "backend-go", Ran: true, OK: true})
-	if o.allHalvesProved() {
-		t.Error("a single green half licensed an escalation walk-past")
-	}
-}
-
 func TestNoSquadPlanProvesNothing(t *testing.T) {
-	o := &Orchestrator{}
-	if o.allHalvesProved() {
+	if (&Orchestrator{}).allHalvesProved() {
 		t.Error("a run without teams claimed both halves were proved")
 	}
 	var nilO *Orchestrator
 	if nilO.allHalvesProved() {
 		t.Error("a nil orchestrator claimed proof")
 	}
 }
+
+// escalatedTeamsBoard is the measured shape: both teams' implementation tasks
+// done, and a seam TESTER escalated to the human backlog.
+func escalatedTeamsBoard() *plan.Board {
+	b := doneBoard()
+	b.Tasks[0].Squad = "backend-go"
+	b.Tasks = append(b.Tasks,
+		plan.Task{ID: "T2", Title: "render the todos", Column: plan.ColDone,
+			Role: plan.RoleWorker, Squad: "frontend-react"},
+		plan.Task{ID: "T3", Title: "verify the halves meet", Column: plan.ColToScope,
+			Role: plan.RoleTester, Error: "review rejected after max retries"})
+	return b
+}
+
+// A failing teams run must say which halves were nonetheless PROVED.
+//
+// The verdict is untouched — the run failed and the exit code stands. What a
+// person needs is the SHAPE of the failure: "everything is broken" and "both
+// halves compile and pass their own tests, and what failed is the join between
+// them" call for completely different next moves, and the summary said only the
+// first. Measured live: `team backend-go is green`, `team frontend-react is
+// green`, reported as a flat failure indistinguishable from a run where nothing
+// worked at all.
+func TestAFailingRunSaysWhichHalvesWereProved(t *testing.T) {
+	// Both halves' own commands pass; everything else — including the QA
+	// objective — does not. That is the measured shape.
+	gate := &selectiveGate{green: map[string]bool{
+		"go build ./...": true, "npm run build": true,
+	}}
+	o := objectiveOrch(t, gate, &countingExec{},
+		func(c *config.Config) { c.QAGate = true })
+	sink := newMsgSink(o)
+	o.squadPlan = halvesPlan()
+
+	res := finalize(t, o, escalatedTeamsBoard())
+
+	if res.Success {
+		t.Fatal("the verdict changed — this must only ADD information to a failure")
+	}
+	joined := sink.text()
+	if !strings.Contains(joined, "backend-go") || !strings.Contains(joined, "frontend-react") {
+		t.Errorf("a failing run did not name the halves that proved themselves:\n%s", joined)
+	}
+	if !strings.Contains(joined, "BETWEEN them") {
+		t.Errorf("the shape of the failure was not stated:\n%s", joined)
+	}
+}
+
+// Nothing claimed when nothing proved itself.
+func TestNoHalvesProvedSaysNothing(t *testing.T) {
+	// Nothing green anywhere, so no half can claim to have proved itself.
+	o := objectiveOrch(t, &selectiveGate{green: map[string]bool{}}, &countingExec{}, nil)
+	sink := newMsgSink(o)
+	o.squadPlan = halvesPlan()
+
+	finalize(t, o, escalatedTeamsBoard())
+
+	if joined := sink.text(); strings.Contains(joined, "proved themselves") {
+		t.Errorf("claimed a half proved itself when none did:\n%s", joined)
+	}
+}
+
+// msgSink collects emitted messages. The orchestrator fires events from several
+// goroutines, so this needs a lock — without one the race detector fails the
+// test rather than the code.
+type msgSink struct {
+	mu   sync.Mutex
+	msgs []string
+}
+
+func newMsgSink(o *Orchestrator) *msgSink {
+	s := &msgSink{}
+	o.onEvent = func(e Event) {
+		s.mu.Lock()
+		defer s.mu.Unlock()
+		s.msgs = append(s.msgs, e.Message)
+	}
+	return s
+}
+
+func (s *msgSink) text() string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return strings.Join(s.msgs, "\n")
+}