test(evals): give every fixed evidence refusal a closed diagnostic code

Packaging, sealing and report-asset refusals that were not in the closed table
surfaced as 'unclassified', so a refused attempt said nothing about why. Add a
code for each fixed message and a test that keeps the table complete.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/runner-e2e/private-attempt-diagnostic.test.ts

@@ -120,3 +120,14 @@ it("retains each remaining fixed scanner reason without dynamic text", () => {
   expect(diagnostic.carrierReasons).toEqual(reasons.map(reason => ({ source: "reporter", carrier: "embedded-html", reason, count: 1 })));
   expect(JSON.stringify(diagnostic)).not.toMatch(/private-filename|private-error|html-report/);
 });
+
+import { readFileSync } from "node:fs";
+it("gives every fixed packaging, sealing and report-asset refusal a closed finalization code", () => {
+  const messages = ["manual-private-handoff.ts", "evidence.ts", "manual-private-report-assets.ts"].flatMap(file =>
+    [...readFileSync(new URL(`./${file}`, import.meta.url), "utf8").matchAll(/(?:new Error|budgetFailure)\("([^"$`]+)"/g)].map(match => match[1]!));
+  expect(messages.length).toBeGreaterThan(20);
+  for (const message of messages) {
+    const diagnostic = privateAttemptDiagnostic({ stage: "seal-original", error: new Error(message) });
+    expect(diagnostic.finalization, message).not.toBe("unclassified");
+  }
+});

tests/runner-e2e/private-attempt-diagnostic.ts

@@ -50,6 +50,42 @@ function carrierReasons(input: unknown, source: "reporter" | "packaging") {
     }));
 }
 const failures = new Map([
+  ["Invalid private evidence preflight custody", "invalid-private-evidence-preflight-custody"],
+  ["Private evidence preflight does not match this exact attempt", "private-evidence-preflight-does-not-match"],
+  ["Invalid private evidence staging ownership", "invalid-private-evidence-staging-ownership"],
+  ["Invalid original framework result", "invalid-original-framework-result"],
+  ["Private evidence execution is outside preflight", "private-evidence-execution-is-outside-preflight"],
+  ["Invalid original standard evidence root", "invalid-original-standard-evidence-root"],
+  ["Private original handoff escaped its preflight root", "private-original-handoff-escaped-its-preflight"],
+  ["Original evidence contains an unsupported entry", "original-evidence-contains-an-unsupported-entry"],
+  ["Original evidence exceeds depth allowance", "original-evidence-exceeds-depth-allowance"],
+  ["Original evidence escaped its owned root", "original-evidence-escaped-its-owned-root"],
+  ["Original evidence changed during handoff", "original-evidence-changed-during-handoff"],
+  ["Original evidence copy stopped", "original-evidence-copy-stopped"],
+  ["Original evidence failed unchanged privacy or required-file checks", "original-evidence-failed-unchanged-privacy-or"],
+  ["Packaged evidence escaped its owned root", "packaged-evidence-escaped-its-owned-root"],
+  ["Invalid packaged evidence entry", "invalid-packaged-evidence-entry"],
+  ["Unsupported packaged evidence carrier", "unsupported-packaged-evidence-carrier"],
+  ["Complete packaged evidence exceeds allowance", "complete-packaged-evidence-exceeds-allowance"],
+  ["No genuine packaged evidence was produced", "no-genuine-packaged-evidence-was-produced"],
+  ["Packaged evidence contains credential contamination", "packaged-evidence-contains-credential-contamination"],
+  ["Packaged evidence changed during handoff", "packaged-evidence-changed-during-handoff"],
+  ["Invalid private cell packaging layout", "invalid-private-cell-packaging-layout"],
+  ["Invalid private cell evidence byte accounting", "invalid-private-cell-evidence-byte-accounting"],
+  ["Private framework attachment requires redaction", "private-framework-attachment-requires-redaction"],
+  ["Invalid canonical report allowance", "invalid-canonical-report-allowance"],
+  ["Invalid report package identity", "invalid-report-package-identity"],
+  ["Invalid canonical report directory", "invalid-canonical-report-directory"],
+  ["Canonical report closure exceeds entry allowance", "canonical-report-closure-exceeds-entry-allowance"],
+  ["Invalid canonical report closure", "invalid-canonical-report-closure"],
+  ["Empty canonical report closure", "empty-canonical-report-closure"],
+  ["Invalid private cell report owner", "invalid-private-cell-report-owner"],
+  ["Invalid private cell report custody", "invalid-private-cell-report-custody"],
+  ["Unverified private cell report owner", "unverified-private-cell-report-owner"],
+  ["Private cell report custody changed", "private-cell-report-custody-changed"],
+  ["Cell report escaped private staging", "cell-report-escaped-private-staging"],
+  ["Invalid private cell report directory", "invalid-private-cell-report-directory"],
+  ["Overlapping private cell report directories", "overlapping-private-cell-report-directories"],
   ["Credential-contaminated original evidence cannot be retained", "credential-contamination"],
   ["Unsupported original evidence carrier cannot be retained", "unsupported-carrier"],
   ["Complete original evidence exceeds byte allowance", "byte-bound"],