fix(reporting-governance): tighten ack truth-state promotion guardrail

plugins/reporting-governance/src/core/runtime-integrated.mjs

@@ -70,13 +70,23 @@ function resolveRuntimeRoute({ governance, runtime, repoRootOverride }) {
   return createNotAttemptedResult('runtime execution not attempted: no adapter_action matched an adapter runner route');
 }
 
+function canPromoteAckedFromSupervisor(supervisor) {
+  const ackedCount = Number(supervisor?.ackedCount ?? 0);
+  const blockedCount = Number(supervisor?.blockedCount ?? 0);
+  const pendingCount = Number(supervisor?.pendingCount ?? 0);
+
+  // Current runtime contract is a single notice settlement path.
+  // Only promote the overall truth state when the observed terminal set is fully acked.
+  return ackedCount > 0 && blockedCount === 0 && pendingCount === 0;
+}
+
 function promoteTruthStateFromRuntime(governance, routeResult) {
   const supervisor = routeResult.runtimeExecution?.result?.supervisor ?? null;
   if (!routeResult.attempted || !supervisor) {
     return governance;
   }
 
-  if ((supervisor.ackedCount ?? 0) > 0) {
+  if (canPromoteAckedFromSupervisor(supervisor)) {
     return {
       ...governance,
       planning: {
@@ -87,7 +97,7 @@ function promoteTruthStateFromRuntime(governance, routeResult) {
           delivery_state: 'acked',
           notes: [
             ...(Array.isArray(governance.planning?.receipt?.notes) ? governance.planning.receipt.notes : []),
-            'Runtime execution produced sender-backed ack evidence; truth state promoted to acked.'
+            'Runtime execution produced sender-backed ack evidence; truth state promoted to acked only after all observed terminal outcomes were fully acked.'
           ],
         },
       },
@@ -148,5 +158,6 @@ export const __testables = {
   ADAPTER_ACTION_RUNNER_ROUTES,
   createNotAttemptedResult,
   resolveRuntimeRoute,
+  canPromoteAckedFromSupervisor,
   promoteTruthStateFromRuntime,
 };