Run Measurement Truth — cumulative execution record

One anchor per landed node. Each entry records the commit, the gate measure as executed, the tests, and anything negative found on the way. The evergreen plan holds the design; this record holds what actually happened.

Stream measures (stream-derived duration, token deltas, typed diff stats)

Commit fe1497ffa354a45bb3177e712c876da222c327eb (2026-08-16, worker codex-c, wall 1221 s, 254 insertions / 60 deletions over reckon/crew.py, reckon/ledger.py and two test files; fast-forwarded).

• Duration truth. Completed records carry worker_seconds derived from first-to-last timestamped stream events, a separate wall_seconds, and a stalled boolean at a 2× time-budget boundary; effort_report counts and excludes stalled records. Measure: a 2700 s stream inside a 96120 s wall records both figures with stalled=true and is excluded from aggregation.
• Per-run token deltas. Promotion differences the session-cumulative counters against the previous run on the same session, retaining <counter>_cumulative; the same treatment applies to cost_usd. Measure: deltas 100+50 sum to the cumulative 150 (input), 10+5 to 15 (output), 1.25+0.75 to 2.0 (cost).
• Typed diff stats. Every commit-bearing promotion recomputes changed_lines from base_sha through the last recorded commit within declared write paths; unresolvable revisions record {available:false, reason:unresolvable_revision}, other failures {available:false, reason:diff_unavailable} — never git stderr or placeholders.

Tests: 3 added, 2 boundary assertions strengthened; full suite 1889 passed, 0 failed; initial run had 1 failure, repaired in-node before commit. Logs: ~/.config/reckon/crew/runs/r-20260816T212844387456-stream-measures/.

Negative finding. Real codex stream events carry no timestamps (thread.started / item.completed objects only), so the first promotion after this landing recorded worker_seconds: null for a healthy 1221 s run — the duration signal calibration consumes would go dark for every timestamp-less backend. Corrective node duration-fallback restores it.

Duration fallback (labelled worker-duration sources for timestamp-less streams)

Corrective node for the negative finding above. Commit 2b1acae2997a7057a101c78adc163034d7b12cbd (2026-08-16, worker codex-c, 549 s, 58 insertions / 6 deletions over reckon/crew.py, reckon/ledger.py, tests/test_ledger.py; fast-forwarded).

• Every completed record now carries worker_seconds_source: stream_events (timestamped streams, first-to-last), wall_fallback (timestamp-less stream within budget), or stalled (typed absence, excluded from aggregation).
• Measures, on the real codex type/item event shape: an unstalled 300 s timestamp-less run records worker_seconds=wall_seconds=300 (wall_fallback) and appears in effort_report at 5.0 measured minutes; the same shape at 3906 s against a 20 m budget records a typed absence with stalled=true and excluded_stalled=1; a timestamped 2700 s stream still measures 2700 independently of its 96120 s wall.
• The fix demonstrated itself at promotion: this run's own ledger record reads worker_seconds=549, source=wall_fallback where the previous node's had been null.

Tests: 2 added; focused 144 passed; full suite 1890 passed, 0 failed. Logs: ~/.config/reckon/crew/runs/r-20260816T215111162417-duration-fallback/logs/.

Vocabulary discipline (one completion-source set, outcome refusal, durable manifests, canonical identifiers)

Commit 0d9751754770bb7c1e8cb46ae609643ecbd27f57 (2026-08-17, worker codex-c, 818 s, 290 insertions / 37 deletions over reckon/ledger.py, reckon/capabilities.py, reckon/calibration.py, reckon/crew.py and four test files; fast-forwarded).

• One completion-source vocabulary. effort_report, derive_capabilities and calibration._observation share the usable set terminal_event, stream_mtime, provided, with exclusions centralized in ledger.measurement_exclusion_reason. Measure: a run promoted with --completed-at (provided) appears in all three consumers with unusable_completion=0.
• Outcome discipline. failed and not-run promotions with an empty --outcome refuse before any pointer mutation, and the message instructs the caller to write what failed or why evidence could not be produced.
• Durable delivery. A caller-named tmpfs manifest (/dev/shm fixture) draws exactly one warning naming the durable run-directory manifest as the alternative.
• Identifier normalization and lineage. Five spellings of the same section value normalize to one canonical form at write time; a redispatched node id records attempt=2 with previous and root run ids, persisting into the completed ledger record.

Tests: 13 added; focused 176 passed; full suite 1903 passed, 0 failed; ruff clean on all eight changed paths. Logs: ~/.config/reckon/crew/runs/r-20260816T220217750008-vocabulary-discipline/logs/.