[mike-thompson-day8]

Fixes the eight findings of the correctness review of two Story slices: story execution (rf2-lgzco.18, five findings) and the story UI workspace (rf2-lgzco.19, three findings). Every one was reproduced at trunk before it was fixed.

Story execution (rf2-lgzco.18)

1. P2, privacy. :rf.assert/sub-equals wrote a registration-classified sub's raw output into :expected, :actual, :payload and :reason. evaluate-sub-equals now passes the value through core's re-frame.classification/project-sub-value (raw value, sub-vec, frame) and then through the existing args-path redact-at. The comparison still uses the raw value, the record carries the projected one, and the :rf/redacted sentinel rule is unchanged. No core change. tools/story/spec/004-Assertions.md §Privacy rule 1 drops the "tracked separately" propagation sentence.
2. P2. A terminal DOM-family atom, run under a runner that claims :dom on a host with no DOM, recorded nothing, so the run read :pass. exec-assert-dom-atom! now records the skip as a :cannot-run record, the same shape exec-assert-browser-atom! records. The in-script step result is marked :recorded?, so the refusal is counted once.
3. P3. A check whose atom was refused before evaluation read :pass. check-record now aggregates its group together with every :unmet refusal whose :unit is one of the check's atoms, which attributes the refusal to the check (017 §:cannot-run). record-matches-atom? moved to re-frame.story.assertions so the scrubber (below) can share it.
4. P3, ruled (c). Check atoms, own and inherited, now count toward the plan's :required-runner, so {:runner :auto} escalates for them. A fixed runner never chooses its runner from that slot, so it refuses such an atom :cannot-run, attributed to the check, as before. tools/story/spec/017-Testing-Story.md §Requirement inference gains the ruling sentence. The sidebar runner chip (sidebar-signals/resolved-body → ::check-atoms) follows the same rule. The Tests pane "required" badge reads the result's :required-runner, so it follows automatically. This changes :plan-hash for every variant whose checks carry a token. No golden in the tree pins one.
5. P3. An :error result from a throw inside the phase chain carried the frame's whole epoch ring, so its evidence and :run-hash drifted across identical re-runs. The phase 0 baseline is now read back from the frame when the thrown ctx has lost it. The decorator refusal also stamps the baseline before it throws. The play chain's rejection path now threads its ctx's :plan, :runner-selection and :epoch-baseline.

Story UI workspace (rf2-lgzco.19)

1. P3. Controls built their widgets from the raw story and variant bodies, so an argtype inherited through :extends or received through :compose was dropped. resolve-argtypes now reads the compiled plan's merged [:world :argtypes], memoized beside the view-args schema in re-frame.story.view-args (compiled-argtypes). If the plan cannot compile it falls back to the variant's own body. ui/docs.cljc (the same defect, owned by rf2-lgzco.20) is untouched.
2. P3. A run refused before evaluation showed "0 cannot-run of 0", and the chrome widget had no cannot-run chip. This shares a cause with finding 18#3: a refusal lives only in the :cannot-run slot. Finding 2's record fixes the reviewer's scenario on its own. The new test-mode.pure/pane-summary covers the rest: it counts each refused unit that no record carries, once per distinct :unit. The reviewer's (count (:cannot-run result)) would have counted a refused atom twice, once for its record and once for its refusal row, and an in-script step up to three times. The widget renders ⊘ N when the count is positive, and the spec/009 selector row says so.
3. P4. Each scrubber tick now takes its own record, matched by record-matches-atom? and taken first-unconsumed, instead of the next record in order. An [:assert …] checkpoint's record no longer colours the next dispatched assertion's tick.

Quality gates

Each exit code below is the runner's own, captured to a file.

• Story JVM clojure -M:test in tools/story: exit 0. Run inside scripts/test-jvm-tools.sh on the rebased tree: 1161 tests / 3097 assertions.
• scripts/test-jvm-tools.sh on the rebased tree: exit 0.
• npm run test:cljs: exit 0 before the rebase (6812 tests / 19900 assertions). Inside the spine on the rebased tree: 0 failures (6815 / 19958). The new CLJS tests are confirmed compiled into the build.
• scripts/test-fast-pr.sh on the rebased tree: exit 0, PASS fast PR spine, gate root this worktree. It ran the docs tier, pinned clj-kondo (0 errors) and the node tier.
• scripts/check_doc_slugs.py: exit 0. A broken anchor planted in the new 004 sentence went red (exit 1, BROKEN ANCHOR) and was restored.
• The final-base gate is this PR's CI.

Tests

Every new JVM test failed against the pre-fix tools/story/src and passes now. Delta against the trunk baseline (1151 tests / 3058 assertions): +10 tests / +39 assertions (1161 / 3097), exactly as predicted from the diff. One existing test pinned the old no-DOM behaviour: substrate_boundary_cljs_test's settled terminal atom expected zero records. It now expects the atom's own no-DOM :cannot-run, and the timeout case asserts the settle's flush-timeout reason, so the test still tells an honoured settle failure from a dropped one.

Plants, restored and verified by blob hash against HEAD:

• 18#1: without project-sub-value, the raw PARTNER-KEY-SECRET appears in :expected, :actual and :payload. The public-sub control is green in both runs.
• 18#2: with the pre-fix runner_events.cljc, the no-DOM terminal run reads :pass again under {:runner :dom} and {:runner :auto}.

Part of rf2-lgzco.18 and rf2-lgzco.19.