v0.14.4

[v0.14.4] - 2026-08-26

This patch release unblocks Bazel fail-to-pass proof on repositories with a
warm or shared Bazel cache. v0.14.3 cleared the two reported selection
blockers, but running the customer-shaped journey end to end surfaced a third,
independent defect: the broad-command parent proof abstained on every Bazel
repository whose cache was not cold, because Bazel console attestation refused
the stream that a cached run produces. Any operator passing
--bazel-cache-root, or simply running a second build, hit it.

Fixed

• Accept (cached) rows in Bazel console attestation. A cached row is an
  explicit per-target result Bazel attests for that action key, but the result
  regex matched only //label PASSED in Ns, so every cached row fell through
  to the unsupported-status branch and refused the whole stream. On a warm
  cache this refused the base and gold receipts for the unnarrowed command,
  and the declared-broad parent proof abstained with "base trial lacks exact
  command-bound output".
• Enforce Bazel closed-world coverage against the selected count rather than
  the executed count. Bazel reports Executed 3 out of 60 tests when 57
  targets hit the cache; requiring executed == selected made the parent
  proof structurally impossible under caching. Coverage is now proven by one
  unique explicit result row per selected target, so a stream carrying fewer
  rows than selected targets is still refused.
• Match Bazel's plural footer grammar. The footer pattern accepted only
  passes/fails, but Bazel conjugates with the count and writes
  57 tests pass and 3 fail locally for multi-test runs. Every footer above
  one test failed to parse, independent of caching.
• Read durable receipt copies when binding raw command-bound output. The raw
  fallback in the declared-broad admission path consulted only the receipt
  path the trial reported, which lives under a verifier scratch root that is
  already released by the time the binding runs, so the fallback could never
  rescue a stream no parser recognizes. It now consults the task-local copies
  under build_logs/worktree_verifier/ as well, still bound to the exact
  command.
• Restore targeted Bazel narrowing for repositories that configure a selector
  runner. A prior change upgraded command_intent to declared_broad for any
  explicitly loaded config carrying a test_selector block with no explicit
  intent, which made the broad command an immutable parent and disabled
  targeted fail-to-pass selection entirely: the customer-shaped Bazel journey
  abstained and ran bazel test //.... Only a route whose fallback is
  keep_broad now declares the broad parent; skip_task and every other
  fallback keep narrowing authority. The live tripwire again proves
  narrowed_proven_dynamic_f2p with exact labels.

Internal

• Move the Bazel cached result case from the attestation refusal table into
  accept coverage, and add regression tests for a partially cached run, a
  fully cached run, and raw binding after scratch release.