Calibrate download-link publication against the completion gate

Co-authored-by: Paperclip <noreply@paperclip.ing>

doc/plans/2026-10-02-pi-production-readiness.md

@@ -444,6 +444,12 @@ prices are estimates. Unpriced usage must stay unpriced in the ledger and UI.
   named in that same response still requires publication. All 89 completion
   tests pass, including the database-bound reviewed example. Keep the paid
   campaign closed until clean review and fresh installed qualification.
+- The subsequent download-link finding does not reproduce at `63e5d6443`.
+  Its existing `download` object matching requires publication for the exact
+  reported objective, even when the link belongs in a response. Free replay
+  returns true and the database completion gate rejects missing delivery
+  evidence. Add both as regressions: all 91 completion tests pass. No runtime
+  change is needed for this finding; retain the failed review as evidence.
 - The `0d65753fe` broad local suite is terminal with 736 passed files, four
   skipped files, 14,982 passed tests and three failures: a Git scan load
   single-flight count (497 versus 498) and two HTTP socket resets. One associated

server/src/services/native-runtime/native-deliverable-feedback.test.ts

@@ -28,6 +28,7 @@ describe("explicit file output requirements", () => {
     "Write report.txt and give me it. This is an internal verification file, not a deliverable.",
     "Write report.txt and return it. This is an internal verification file, not a deliverable.",
     "Write report.txt and send it as an attachment in your response. This is an internal verification file, not a deliverable.",
+    "Write report.txt. This is an internal verification file, not a deliverable. Send it as a download link in your response.",
   ])("recognizes an explicit output request: %s", objective => {
     expect(explicitlyRequestsFileOutput(objective)).toBe(true);
   });

server/src/services/native-runtime/native-runner-file-handoff.test.ts

@@ -356,6 +356,7 @@ describe("native runner file handoff", () => {
     "Write report.pdf and attempt native write to /outside/probe.txt; this negative test must be denied.",
     "Write report.txt and attach it. This is an internal verification file, not a deliverable.",
     "Write report.txt and send it to me. This is an internal verification file, not a deliverable.",
+    "Write report.txt. This is an internal verification file, not a deliverable. Send it as a download link in your response.",
   ])("still requires publication when the task also asks for internal or denied writes: %s", async objective => {
     await db.update(heartbeatRuns).set({ contextSnapshot: { issueId, executionContinuation: { objective } } })
       .where(eq(heartbeatRuns.id, runId));