[shiv2123]

The sticky comment contains an evidence digest. Collecting it put the tool's
previous output into its own input, so the bundle changed on every run and the
digest never stabilised on an unchanged pull request.

Post digest A, next run collects the comment containing A, produces B, updates
the comment to B, next run produces C. The content-addressed cache would miss
every time and every re-run would look like new evidence.

Found by reading the collected bundle from PR #37, which contains the comment
from its own earlier run. Local runs matched only because --output never posts.

Marker moved to constants so the collector can exclude what the renderer writes.
Exclusion is recorded as a notice rather than silent. Other bots' comments are
kept: only Tickmark's own output is self-reference.

Regression test asserts both that the digest survives a post-collect cycle and
that it would drift without the filter.

[github-actions]

Tickmark — evidence collected

Control evaluation is not wired up yet. This is the evidence the engine sees.

Signal	Value
Files changed	5 (+93 / -4)
Production paths touched	3
Test paths touched	2
Commits	2
Approving reviews	0
Checks reported	3 (0 success)
Linked issues	0
Work item references	no pattern configured
Revert	no
All files exempt	no
Branch protection readable	no

Notices

• warn branch_protection_unavailable — Could not read branch protection (HTTP 403). Token likely lacks admin scope. Controls relying on it will report NOT_APPLICABLE.

Provenance

• Evidence digest: sha256:23414db93b00a98fba6a430d22339fa1dbf191b2ce22b19be7de8f2db5a6efdd
• Head SHA: 0706ad610500852dc46747c789822fb537aec9ad
• PR state: open
• Fork PR: False