@@ -13,6 +13,7 @@
 import platform
 import re
 import shlex
+import shutil
 import subprocess
 
 
@@ -24,16 +25,32 @@ class AuditError(RuntimeError):
 
 
 def run(command, retain_output=True, **kwargs):
-    result = subprocess.run(command, text=True, stdout=subprocess.PIPE,
-                            stderr=subprocess.PIPE, timeout=120, **kwargs)
-    record = {'argv': command, 'returncode': result.returncode, 'stderr': result.stderr}
+    record = {'argv': command, 'returncode': None}
+    try:
+        environment = kwargs.get('env')
+        environment = os.environ if environment is None else environment
+        selected = shutil.which(command[0], path=environment.get('PATH', os.defpath))
+        if selected:
+            record['resolved_tool'] = str(Path(selected).resolve())
+    except (OSError, RuntimeError):
+        pass  # Optional tool metadata must not replace an inspection failure.
+    if 'input' in kwargs:
+        record['stdin'] = kwargs['input']
+    COMMANDS.append(record)
+    try:
+        result = subprocess.run(command, text=True, stdout=subprocess.PIPE,
+                                stderr=subprocess.PIPE, timeout=120, **kwargs)
+    except (OSError, subprocess.TimeoutExpired) as error:
+        record['error'] = str(error)
+        for key in ('stdout', 'stderr'):
+            output = getattr(error, key, None)
+            record[key] = output.decode(errors='replace') if isinstance(output, bytes) else output
+        raise
+    record.update(returncode=result.returncode, stderr=result.stderr)
     if retain_output:
         record['stdout'] = result.stdout
     else:
         record.update(stdout_sha256=hashlib.sha256(result.stdout.encode()).hexdigest(), stdout_bytes=len(result.stdout.encode()))
-    if 'input' in kwargs:
-        record['stdin'] = kwargs['input']
-    COMMANDS.append(record)
     if result.returncode:
         raise AuditError(f'command failed: {shlex.join(command)}: {result.stderr[-3000:]}')
     return result.stdout
@@ -213,7 +230,11 @@ def visit(path):
         cached = platform_leaf and not Path(identity).exists()
         nodes.append({'id': identity, 'provenance': 'OS/API-set platform leaf' if cached else 'platform inspector',
                       'sha256': None if cached else hashlib.sha256(Path(identity).read_bytes()).hexdigest()})
-        dependencies = [] if cached else inspector(identity)
+        try:
+            dependencies = [] if cached else inspector(identity)
+        except (AuditError, OSError, subprocess.TimeoutExpired) as error:
+            error.failed_artifact = {'id': identity, 'sha256': nodes[-1]['sha256']}
+            raise
         if not isinstance(dependencies, list):
             raise AuditError('incomplete inspector result: ' + path)
         for name, location in dependencies:
 
@@ -9,6 +9,7 @@
 import platform
 import shlex
 import shutil
+import subprocess
 import sys
 
 sys.path.insert(0, str(Path(__file__).parent / 'lib'))
@@ -24,6 +25,21 @@
 
 
 def package_lane(args, source, output, mode, inventory):
+    audit.COMMANDS.clear()
+    try:
+        return _package_lane(args, source, output, mode, inventory)
+    except (audit.AuditError, OSError, subprocess.TimeoutExpired) as error:
+        receipt = dict(violations=[str(error)], commands=audit.COMMANDS.copy())
+        if hasattr(error, 'failed_artifact'):
+            receipt['failed_artifact'] = error.failed_artifact
+        try:
+            (output / ('tls-' + mode) / 'audit-failure.json').write_text(json.dumps(receipt, indent=2) + '\n')
+        except OSError as persistence_error:
+            error.add_note('could not persist audit failure evidence: ' + str(persistence_error))
+        raise
+
+
+def _package_lane(args, source, output, mode, inventory):
     lane = output / ('tls-' + mode)
     build, prefix, consumer_dir = lane / 'build', lane / 'prefix', lane / 'consumer'
     for directory in (build, prefix, consumer_dir):
 
@@ -2,6 +2,7 @@
 """Workflow dependencies and trust boundaries; execution contracts live beside runners."""
 from pathlib import Path
 import glob
+import importlib.util
 import json
 import os
 import re
@@ -276,6 +277,43 @@ def test_successful_evidence_recovery_merges_named_directory_in_place(self):
                 self.assertEqual((evidence / 'platform/FreeBSD.tar.gz').read_bytes(), b'platform proof')
                 self.assertFalse((evidence / folder).exists())
 
+    def test_early_inspection_receipt_survives_package_and_archive_failure_recovery(self):
+        spec = importlib.util.spec_from_file_location('installed_failure_fixture', ROOT / 'scripts/test-v3-installed-consumer.py')
+        fixture = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(fixture)
+        for name in self.workflows:
+            with self.subTest(workflow=name), tempfile.TemporaryDirectory() as directory:
+                root = Path(directory).resolve()
+                runner = root / 'runner'
+                package = name == self.workflows[0]
+                folder = 'package-evidence' if package else 'platform-evidence'
+                case = fixture.InstalledInspectionFailureTest()
+                try:
+                    case.setUp()
+                    case.output = runner / ('package-evidence/matrix' if package else 'platform/matrix')
+                    case.output.mkdir(parents=True)
+                    error = case.fail_lane()
+                    self.assertEqual(str(error), 'empty ELF dependency inspection')
+                    receipt = case.output / 'tls-no/audit-failure.json'
+                    self.assertTrue(receipt.is_file(), 'failed package lane must leave recoverable inspection evidence')
+                    original = receipt.read_bytes()
+                    document = json.loads(original)
+                    self.assertEqual(document['commands'][-1]['stdout'], case.dynamic)
+                    self.assertEqual(document['violations'], [str(error)])
+                    # Execute the existing EXIT copyback before the existing
+                    # recovery helper's real SCP peers, replacing SSH only.
+                    run, steps = self.guest_run(name, runner)
+                    preamble = run.split('# Guest root', 1)[0]
+                    result = subprocess.run(['sh', '-eu', '-c', preamble + '\nexit 1'], cwd=root,
+                        capture_output=True, text=True, timeout=10)
+                    self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+                    relative = Path('matrix/tls-no/audit-failure.json' if package else 'platform/matrix/tls-no/audit-failure.json')
+                    self.assertEqual((root / folder / relative).read_bytes(), original)
+                    recovered = self.recover(root, steps, runner, dict(os.environ))
+                    self.assertEqual((recovered / relative).read_bytes(), original)
+                finally:
+                    case.doCleanups()
+
 
 class WindowsGitPreflight(unittest.TestCase):
     def test_native_git_checkout_diagnostic_runs_before_provider_build(self):
 
@@ -199,6 +199,108 @@ def setUp(self):
         self.addCleanup(observation.stop)
 
 
+class InstalledInspectionFailureTest(unittest.TestCase):
+    """Real lane/compile/inspector subprocesses with controlled producer tools.
+
+    Inspector text is deliberately unrecognized, not a FreeBSD format claim.
+    """
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name).resolve()
+        self.output = self.root / 'matrix'
+        self.output.mkdir()
+        self.source = self.root / 'source'
+        (self.source / 'test/installed').mkdir(parents=True)
+        (self.source / 'test/installed/package_consumer.cpp').write_text('int main() { return 0; }\n')
+        (self.source / 'examples').mkdir()
+        (self.source / 'examples/host_poll.hpp').write_text('// fixture\n')
+        spec = importlib.util.spec_from_file_location('installed_inspection_runner',
+            Path(__file__).with_name('check-v3-installed-consumer.py'))
+        self.runner = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(self.runner)
+        self.args = SimpleNamespace(compiler=os.environ.get('CXX', 'c++'), cc='cc', make='fixture-make',
+            jobs=1, prerequisite_prefix=[], pkg_config_dir=[], provider_prefix=self.root / 'provider',
+            toolchain_prefix=None, optimized=False)
+        self.dynamic = 'Dynamic section with unrecognized dependency syntax\n' + 'raw dynamic entry\n' * 400
+        self.diagnostic = 'inspector diagnostic\n'
+        self.inspector_exit = 0
+        self.popen = subprocess.Popen
+        environment = patch.dict(os.environ)
+        environment.start()
+        self.addCleanup(environment.stop)
+
+    def create_process(self, argv, **options):
+        if argv[0] == 'bash':
+            prefix = self.output / 'tls-no/prefix/lib/pkgconfig'
+            code = f'from pathlib import Path; p=Path({str(prefix)!r}); p.mkdir(parents=True); (p/"libhttpserver.pc").write_text("fixture metadata")'
+        elif argv[0] == 'fixture-make':
+            code = ''
+        elif argv[0] == 'pkg-config':
+            value = str(self.output / 'tls-no/prefix/lib/pkgconfig') if '--variable=pcfiledir' in argv else ''
+            code = f'print({value!r})'
+        elif argv[0] == 'readelf':
+            code = f'import sys; sys.stdout.write({self.dynamic!r}); sys.stderr.write({self.diagnostic!r}); sys.exit({self.inspector_exit})'
+        else:
+            return self.popen(argv, **options)
+        return self.popen([sys.executable, '-c', code], **options)
+
+    def fail_lane(self):
+        with patch.object(self.runner.audit.platform, 'system', return_value='FreeBSD'), \
+                patch.object(subprocess, 'Popen', side_effect=self.create_process):
+            with self.assertRaises(self.runner.audit.AuditError) as caught:
+                self.runner.package_lane(self.args, self.source, self.output, 'no', matrix.load())
+        return caught.exception
+
+    def test_early_graph_failure_persists_full_output_and_failed_consumer(self):
+        self.runner.audit.COMMANDS.append({'argv': ['stale-previous-lane-command']})
+        error = self.fail_lane()
+        self.assertEqual(str(error), 'empty ELF dependency inspection')
+        receipt_path = self.output / 'tls-no/audit-failure.json'
+        self.assertTrue(receipt_path.is_file(), 'early graph failure must persist inspection evidence')
+        receipt = json.loads(receipt_path.read_text())
+        consumer = self.output / ('tls-no/consumer/package_consumer' + ('.exe' if os.name == 'nt' else ''))
+        self.assertEqual(receipt['violations'], [str(error)])
+        self.assertEqual(receipt['failed_artifact'], dict(id=str(consumer),
+            sha256=hashlib.sha256(consumer.read_bytes()).hexdigest()))
+        command = receipt['commands'][-1]
+        self.assertEqual(len(receipt['commands']), 1)
+        self.assertEqual(command['argv'], ['readelf', '-d', str(consumer)])
+        self.assertEqual(command['returncode'], 0)
+        self.assertEqual(command['stdout'], self.dynamic)
+        self.assertEqual(command['stderr'], self.diagnostic)
+        selected_tool = shutil.which('readelf')
+        if selected_tool:
+            self.assertEqual(command['resolved_tool'], str(Path(selected_tool).resolve()))
+        else:
+            self.assertNotIn('resolved_tool', command)
+        self.assertFalse((self.output / 'tls-no/audit.json').exists())
+
+    def test_nonzero_inspector_remains_failed_with_actual_exit_evidence(self):
+        self.inspector_exit = 7
+        error = self.fail_lane()
+        self.assertIn('command failed: readelf', str(error))
+        receipt_path = self.output / 'tls-no/audit-failure.json'
+        self.assertTrue(receipt_path.is_file(), 'nonzero inspector must persist its actual result')
+        receipt = json.loads(receipt_path.read_text())
+        self.assertEqual(receipt['violations'], [str(error)])
+        self.assertEqual(receipt['commands'][-1]['returncode'], 7)
+        self.assertEqual(receipt['commands'][-1]['stdout'], self.dynamic)
+        self.assertEqual(receipt['commands'][-1]['stderr'], self.diagnostic)
+
+    def test_failure_receipt_write_error_keeps_original_graph_failure(self):
+        real_write = Path.write_text
+        def write(path, *args, **kwargs):
+            if path.name == 'audit-failure.json':
+                raise OSError('evidence disk unavailable')
+            return real_write(path, *args, **kwargs)
+        with patch.object(Path, 'write_text', write):
+            error = self.fail_lane()
+        self.assertEqual(str(error), 'empty ELF dependency inspection')
+        self.assertEqual(error.__notes__, ['could not persist audit failure evidence: evidence disk unavailable'])
+        self.assertEqual(self.runner.audit.COMMANDS[-1]['stdout'], self.dynamic)
+
+
 class MatrixTest(unittest.TestCase):
     def setUp(self):
         self.inventory = matrix.load()