@legionworks/facet 1.9.0 → 1.10.0

package/src/shared/contracts/commands/results.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 
-import { Tier1ResultSchema, VerdictSchema } from "../validation";
+import { Tier1ResultSchema, VerdictSchema, RenderStatusSchema } from "../validation";
 import { ArtifactTypeSchema, RendererSchema } from "../artifact";
 import { EvidenceImageFormatSchema } from "../../evidence-image";
 import { ExportFormatSchema } from "./requests";
@@ -64,6 +64,25 @@ export const ListResultSchema = BaseResultSchema.extend({
 });
 export type ListResult = z.infer<typeof ListResultSchema>;
 
+export const TemplatesResultSchema = BaseResultSchema.extend({
+  command: z.literal("templates"),
+  templates: z.array(
+    z.object({
+      name: z.string().min(1),
+      artifactId: z.string().min(1),
+      revisionId: z.string().min(1),
+      revisionSha: z.string().regex(/^[a-f0-9]{64}$/),
+      promotedBy: z.string().min(1),
+      promotedAt: z.string().datetime({ offset: true }),
+      promotionOverride: z.string().nullable(),
+      sourceVerdict: z
+        .object({ status: RenderStatusSchema, tier: z.union([z.literal(0), z.literal(1)]) })
+        .nullable(),
+    }),
+  ),
+});
+export type TemplatesResult = z.infer<typeof TemplatesResultSchema>;
+
 /**
  * Read-back result embeds the canonical `VerdictSchema` from
  * `validation.ts`. The two definitions are the SAME object so a

package/src/shared/contracts/promotion.ts

@@ -0,0 +1,16 @@
+import type { RenderStatus } from "./validation";
+
+export const PROMOTION_GATE = {
+  ok: "allow",
+  error: "refuse",
+  "partial:layout_unverified": "allow",
+  "partial:opaque_content": "allow",
+  "partial:external_resources": "allow",
+  "partial:unstable": "allow",
+  "partial:empty_render": "refuse",
+  tampered: "refuse",
+  timeout: "refuse",
+  shim_only: "refuse",
+  probe_only: "refuse",
+  "insecure:unvalidated": "refuse",
+} as const satisfies Record<RenderStatus, "allow" | "refuse">;

package/src/shared/contracts/validation.ts

@@ -36,6 +36,7 @@ export const RenderStatusSchema = z.enum([
   "partial:opaque_content",
   "partial:external_resources",
   "partial:unstable",
+  "partial:empty_render",
   "tampered",
   "timeout",
   "shim_only",
@@ -134,9 +135,14 @@ export type LexicalCounters = z.infer<typeof LexicalCountersSchema>;
 const ObservedCountShape = Object.fromEntries(
   OBSERVED_COUNT_KEYS.map((key) => [key, z.number().int().nonnegative()]),
 ) as Record<(typeof OBSERVED_COUNT_KEYS)[number], z.ZodNumber>;
+const RenderedContentShape = {
+  // Legacy stored observations lack this TSX-only probe; absence never proves an empty render.
+  emptyRendererRoot: z.boolean().optional(),
+};
 
 export const VerdictObservedSchema = z.object({
   ...ObservedCountShape,
+  ...RenderedContentShape,
   html: HtmlStructureCountsSchema.optional(),
   viewBoxes: z.array(z.string()).optional(),
   errorCount: z.number().int().nonnegative(),
@@ -288,6 +294,7 @@ export type Tier1Result = z.infer<typeof Tier1ResultSchema>;
  */
 export const ProtocolObservationSchema = z.object({
   ...ObservedCountShape,
+  ...RenderedContentShape,
   html: HtmlStructureCountsSchema.optional(),
   viewBoxes: z.array(z.string()),
   errorCount: z.number().int().nonnegative(),

package/src/shared/errors/facet-error.ts

@@ -12,6 +12,7 @@ export const FacetErrorCodes = {
   database_busy: true,
   disk_full: true,
   duplicate_revision: true,
+  template_name_taken: true,
   foreign_key: true,
   immutable_revision: true,
   migration_failed: true,
@@ -27,6 +28,7 @@ export const FacetErrorCodes = {
   artifact_not_found: true,
   revision_not_found: true,
   template_not_found: true,
+  promotion_refused: true,
   evidence_unavailable: true,
   output_unwritable: true,
   revision_capacity_pinned: true,

package/src/shared/errors/store-error.ts

@@ -18,6 +18,7 @@ export type StoreErrorCode = Extract<
   | "database_busy"
   | "disk_full"
   | "duplicate_revision"
+  | "template_name_taken"
   | "foreign_key"
   | "immutable_revision"
   | "migration_failed"
@@ -62,6 +63,9 @@ export function asStoreError(error: unknown): FacetStoreError {
     return new FacetStoreError("foreign_key", message, { cause: error });
   }
   if (lower.includes("unique constraint")) {
+    if (lower.includes("templates.name")) {
+      return new FacetStoreError("template_name_taken", message, { cause: error });
+    }
     return new FacetStoreError("duplicate_revision", message, { cause: error });
   }
   return new FacetStoreError("constraint", message, { cause: error });

package/src/shared/html/artifact-main.ts

@@ -0,0 +1,3 @@
+export function artifactMainAttributes(artifactType: string): string {
+  return `id="artifact" data-facet-artifact-type="${artifactType}"`;
+}

package/src/shared/storage-version.ts

@@ -1,2 +1,2 @@
 /** Latest schema migration applied by the service. */
-export const CURRENT_STORAGE_VERSION = 9 as const;
+export const CURRENT_STORAGE_VERSION = 10 as const;

package/src/validation/tier0/dom-shim.ts

@@ -1,12 +1,9 @@
 /**
  * linkedom-based DOM shim for the Tier 0 worker.
  *
- * Mermaid and other browser-shaped libraries perform import-time
- * initialization against `globalThis.document`, `window`, and the
- * `implementation.createHTMLDocument` API. Bun's worker process has
- * none of these by default, so a naive `import mermaid from "mermaid"`
- * throws `DOMPurify.addHook is not a function` (or its equivalent)
- * before the parser ever sees source.
+ * Mermaid needs a minimal DOM for import and parsing in the worker.
+ * Tier 0 does not render labels; their sanitization is a render concern
+ * verified by Tier 1.
  *
  * This module installs the shim at IMPORT TIME (top-level) so any
  * subsequent `import "mermaid"` sees a DOM. It is structural only —
@@ -24,17 +21,6 @@ function installDomShim(): void {
   installed = true;
   const { document, window } = parseHTML("<!DOCTYPE html><html><body></body></html>");
   domShimDocument = document as unknown as Document;
-  // DOMPurify's isSupported check looks for `implementation.createHTMLDocument`.
-  // linkedom ships without an implementation object; we attach a minimal shim
-  // that returns a freshly-parsed document. This is structural only —
-  // we never serialize against this DOM.
-  const fakeImpl = {
-    createHTMLDocument: (html: string): Document => {
-      const r = parseHTML(html);
-      return r.document as unknown as Document;
-    },
-  };
-  Object.defineProperty(document, "implementation", { value: fakeImpl, configurable: true });
   const g = globalThis as unknown as Record<string, unknown>;
   g["document"] = document;
   g["window"] = window;
@@ -43,7 +29,6 @@ function installDomShim(): void {
   g["Node"] = window.Node;
   g["DocumentFragment"] = window.DocumentFragment;
   g["HTMLTemplateElement"] = window.HTMLTemplateElement;
-  g["NodeFilter"] = window.NodeFilter;
 }
 
 // Top-level install — runs synchronously when this module is first

package/src/validation/tier0/markdown.ts

@@ -30,6 +30,7 @@ import { Lexer, type Token, type Tokens } from "marked";
 
 import type { DiscriminativeError, VerdictObserved } from "../../shared/contracts/validation";
 import { countMermaidNodeDeclarations } from "../../shared/util/mermaid-nodes";
+import { parseMermaidText } from "./mermaid";
 
 export interface MarkdownParseOk {
   readonly status: "ok";
@@ -54,6 +55,7 @@ interface MarkdownCounts {
   hasScript: boolean;
   hasOnHandler: boolean;
   hasExternalRef: boolean;
+  mermaidBodies: string[];
 }
 
 function isExternalHttpsUrl(value: string): boolean {
@@ -102,6 +104,7 @@ function walkTokens(tokens: Token[], counts: MarkdownCounts): void {
       counts.totalFenced += 1;
       const lang = (code.lang ?? "").trim().toLowerCase();
       if (lang === "mermaid") {
+        counts.mermaidBodies.push(code.text);
         counts.mermaidFenced += 1;
         counts.rendererRoots += 1;
         const nodes = countMermaidNodeDeclarations(code.text);
@@ -161,12 +164,11 @@ function walkTokens(tokens: Token[], counts: MarkdownCounts): void {
 }
 
 /**
- * Parse the source bytes as markdown. Pure tokenization — no DOM, no
- * render, no script execution. Raw HTML is counted (it must NOT
- * execute, and we surface structural red flags if it tries to smuggle
- * one) but never interpreted.
+ * Tokenize Markdown and grammar-check Mermaid fences without rendering
+ * or executing source. Raw HTML is counted and checked for structural
+ * red flags, but never interpreted.
  */
-export function parseMarkdown(bytes: Uint8Array): MarkdownParseResult {
+export async function parseMarkdown(bytes: Uint8Array): Promise<MarkdownParseResult> {
   const text = new TextDecoder("utf-8", { fatal: false }).decode(bytes);
   const counts: MarkdownCounts = {
     totalFenced: 0,
@@ -178,6 +180,7 @@ export function parseMarkdown(bytes: Uint8Array): MarkdownParseResult {
     hasScript: false,
     hasOnHandler: false,
     hasExternalRef: false,
+    mermaidBodies: [],
   };
   let lexError: unknown = null;
   let tokens: Token[] = [];
@@ -189,6 +192,26 @@ export function parseMarkdown(bytes: Uint8Array): MarkdownParseResult {
     lexError = error;
   }
 
+  for (let i = 0; i < counts.mermaidBodies.length; i += 1) {
+    const message = await parseMermaidText(counts.mermaidBodies[i]!);
+    if (message !== null) {
+      // Fence grammar errors take precedence over lexer and hostile-HTML errors.
+      return {
+        status: "error",
+        observed: {
+          rendererRootSvgCount: counts.rendererRoots,
+          graphCount: counts.mermaidFenced,
+          mermaidNodeCount: counts.mermaidNodeCount ?? 0,
+          visibleSvgCount: 0,
+          externalImageCount: counts.externalImageCount,
+          errorCount: 1,
+          opaqueRegionCount: 0,
+        },
+        errors: [{ code: "mermaid_parse_error", message, location: `mermaid fence ${i}` }],
+      };
+    }
+  }
+
   if (lexError !== null) {
     const message = lexError instanceof Error ? lexError.message : String(lexError);
     return {

package/src/validation/tier0/mermaid.ts

@@ -8,10 +8,12 @@
  * DOM (DOMPurify, etc.) at IMPORT TIME.
  *
  * `dom-shim.ts` installs a linkedom-based structural DOM stub BEFORE
- * this module imports mermaid, so the library's import-time
- * DOMPurify check succeeds. The shim is structural: it never executes
- * artifact source against the DOM. netns ensures any library-initiated
- * network egress cannot reach a host.
+ * this module imports mermaid, so the library can initialize. DOMPurify
+ * deliberately reports itself unsupported under the stub and passes label
+ * text through unsanitized: Tier 0 never renders or keeps that text, and
+ * sanitization is verified at Tier 1 in a real browser. The shim never
+ * executes artifact source against the DOM. netns ensures any
+ * library-initiated network egress cannot reach a host.
  */
 
 import "./dom-shim";
@@ -33,6 +35,15 @@ export interface MermaidParseFail {
 
 export type MermaidParseResult = MermaidParseOk | MermaidParseFail;
 
+export async function parseMermaidText(text: string): Promise<string | null> {
+  try {
+    await (mermaid as { parse: (s: string) => Promise<MermaidResolved> }).parse(text);
+    return null;
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error);
+  }
+}
+
 /**
  * Count node declarations across the source. This is the lexical
  * counter the parser agrees with when the parse succeeds and disagrees
@@ -58,10 +69,8 @@ export async function parseMermaid(bytes: Uint8Array): Promise<MermaidParseResul
   const text = new TextDecoder("utf-8", { fatal: false }).decode(bytes);
   const lexicalNodes = countMermaidNodes(bytes);
   try {
-    const resolved = (await (mermaid as { parse: (s: string) => Promise<MermaidResolved> }).parse(
-      text,
-    )) as MermaidResolved;
-    void resolved;
+    const message = await parseMermaidText(text);
+    if (message !== null) throw new Error(message);
     return {
       status: "ok",
       observed: {

package/src/validation/tier0/worker-dispatch.ts

@@ -15,7 +15,7 @@ export async function runParser(input: WorkerInput): Promise<Tier0WorkerResult>
   };
   switch (input.artifactType) {
     case "markdown": {
-      const result = parseMarkdown(input.source);
+      const result = await parseMarkdown(input.source);
       const externalImageCount = result.observed.externalImageCount;
       return {
         ...base,

package/src/validation/tier1/entries/tsx.ts

@@ -1,3 +1,4 @@
+import "../../../gallery-web/frame/styles/artifact.css";
 import { renderTsx } from "../../../gallery-web/frame/renderers/tsx";
 import { createRendererRegistry } from "../../../gallery-web/frame/renderers/registry";
 import { startTier1Harness } from "../harness-entry";

package/src/validation/tier1/harness.ts

@@ -24,6 +24,7 @@ import { ARTIFACT_TYPES, type ArtifactType } from "../../gallery-web/frame/rende
 import frameChromeStyles from "../../gallery-web/frame/styles/frame.css" with { type: "text" };
 import { freshHarnessNonce } from "./nonce";
 import { frameBundlePlugins } from "../../shared/build/frame-bundle-plugins";
+import { artifactMainAttributes } from "../../shared/html/artifact-main";
 import { FROZEN_CSP_TEMPLATE as HARNESS_CSP } from "../../shared/security/frozen-csp";
 
 export { FROZEN_CSP_TEMPLATE as HARNESS_CSP } from "../../shared/security/frozen-csp";
@@ -135,7 +136,7 @@ export async function buildHarnessSrcdoc(artifactType: string): Promise<{
     `<style>${frameChromeStyles.replace(/<\/style/gi, "<\\/style")}</style>` +
     (styles.length === 0 ? "" : `<style>${styles.replace(/<\/style/gi, "<\\/style")}</style>`) +
     "</head><body>" +
-    `<main id="artifact" data-facet-nonce="${nonce}"></main>` +
+    `<main ${artifactMainAttributes(rendererType)} data-facet-nonce="${nonce}"></main>` +
     `<script type="module" nonce="${nonce}">${escaped}</script>` +
     "</body></html>";
   return { srcdoc, nonce, bundleBytes: bytes };

package/src/validation/tier1/isolated-probe.ts

@@ -26,6 +26,7 @@ import type { VerifierCdpSession } from "./browser-process";
 export async function probeIsolatedCounts(
   session: VerifierCdpSession,
   executionContextId: number,
+  observeContent = false,
 ): Promise<ProtocolObservation | null> {
   try {
     const selectors = Object.fromEntries(
@@ -47,6 +48,8 @@ export async function probeIsolatedCounts(
         "  var svgRoots = roots.filter(function(root){ return String(root.nodeName).toLowerCase() === 'svg'; });",
         "  var graphRoots = svgRoots.filter(function(root){ return root.getAttribute('data-facet-renderer-graph') === 'true'; });",
         "  var htmlRoots = roots.filter(function(root){ return String(root.nodeName).toLowerCase() !== 'svg'; });",
+        `  var observeContent = ${JSON.stringify(observeContent)};`,
+        "  var emptyRendererRoot = observeContent && htmlRoots.length === 1 ? Array.prototype.every.call(htmlRoots[0].childNodes, function(node){ return node.nodeType !== 1 && (node.nodeType !== 3 || !node.textContent.trim()); }) : undefined;",
         `  var selectors = ${JSON.stringify(selectors)};`,
         "  var html = htmlRoots.length === 0 ? null : {rendererRootCount:htmlRoots.length,headingCount:0,tableCount:0,listCount:0,imageCount:0,canvasCount:0,externalImageCount:0};",
         "  var externalImageCount = 0;",
@@ -82,6 +85,7 @@ export async function probeIsolatedCounts(
         "    opaqueRegionCount: opaqueRegionCount,",
         "    externalImageCount: externalImageCount,",
         "    discriminativeErrors: [],",
+        "    ...(emptyRendererRoot === undefined ? {} : {emptyRendererRoot: emptyRendererRoot}),",
         "    ...(html === null ? {} : {html: html})",
         "  };",
         "})()",

package/src/validation/tier1/protocol-probe.ts

@@ -30,6 +30,8 @@ export interface SnapshotDocument {
   readonly frameId: number;
   readonly nodes: {
     readonly nodeName: number[];
+    readonly nodeType?: readonly number[];
+    readonly nodeValue?: readonly number[];
     /** Parent node index for every entry in nodeName. */
     readonly parentIndex: readonly number[];
     /**
@@ -44,6 +46,23 @@ export interface SnapshotDocument {
   };
 }
 
+function snapshotRootEmpty(snapshot: SnapshotResponse, documentIndex: number): boolean | undefined {
+  const document = snapshot.documents[documentIndex];
+  if (document === undefined) return undefined;
+  const roots = htmlRootIndexes(snapshot, documentIndex);
+  if (roots.length !== 1) return undefined;
+  const root = roots[0];
+  if (root === undefined) return undefined;
+  for (let index = 0; index < document.nodes.nodeName.length; index += 1) {
+    if (document.nodes.parentIndex[index] !== root) continue;
+    const type = document.nodes.nodeType?.[index];
+    if (type === 1) return false;
+    if (type === 3 && readString(snapshot.strings, document.nodes.nodeValue?.[index] ?? -1).trim())
+      return false;
+  }
+  return true;
+}
+
 export interface SnapshotResponse {
   readonly documents: readonly SnapshotDocument[];
   readonly strings: readonly string[];
@@ -328,6 +347,7 @@ function findDocumentIndex(snapshot: SnapshotResponse, childFrameId: string): nu
 export async function probeProtocolSnapshot(
   session: VerifierCdpSession,
   childFrame: ResolvedChildFrame,
+  observeContent = false,
 ): Promise<ProtocolObservation> {
   const snapshot = (await session.send("DOMSnapshot.captureSnapshot", {
     computedStyles: [],
@@ -352,6 +372,7 @@ export async function probeProtocolSnapshot(
   const discriminativeErrors = collectDiscriminativeErrors(snapshot, documentIndex);
   const errorCount = discriminativeErrors.length;
   const htmlCounts = countSnapshotHtml(snapshot, documentIndex);
+  const emptyRendererRoot = observeContent ? snapshotRootEmpty(snapshot, documentIndex) : undefined;
   return {
     rendererRootSvgCount: rendererRoots.length,
     graphCount: graphRoots.length,
@@ -360,6 +381,7 @@ export async function probeProtocolSnapshot(
     opaqueRegionCount: countByName(snapshot, documentIndex, "canvas"),
     externalImageCount: htmlCounts?.externalImageCount ?? 0,
     ...(htmlCounts === undefined ? {} : { html: htmlCounts }),
+    ...(emptyRendererRoot === undefined ? {} : { emptyRendererRoot }),
     viewBoxes,
     errorCount,
     discriminativeErrors: discriminativeErrors.map((entry) => ({
@@ -378,6 +400,7 @@ export async function probeProtocolSnapshot(
 export async function probeProtocolGetDocument(
   session: VerifierCdpSession,
   childFrame: ResolvedChildFrame,
+  observeContent = false,
 ): Promise<ProtocolObservation> {
   const result = (await session.send("DOM.getDocument", {
     depth: -1,
@@ -402,6 +425,7 @@ export async function probeProtocolGetDocument(
   let opaqueRegionCount = 0;
   let visibleSvgCount = 0;
   let html: HtmlStructureCounts | undefined;
+  let emptyRendererRoot: boolean | undefined;
   const viewBoxes: string[] = [];
   const visit = (
     node: unknown,
@@ -413,6 +437,8 @@ export async function probeProtocolGetDocument(
     if (node === null || typeof node !== "object") return;
     const record = node as {
       nodeName?: string;
+      nodeType?: number;
+      nodeValue?: string;
       // DOM.Node attributes arrive as a FLAT string array
       // [name1, value1, name2, value2, …] — not {name, value} objects.
       attributes?: string[];
@@ -435,6 +461,16 @@ export async function probeProtocolGetDocument(
     const htmlRoot = name !== "svg" && markedRoot && !withinMarkedRoot;
     const graphRoot = rendererRoot && findAttr("data-facet-renderer-graph") === "true";
     if (htmlRoot) {
+      if (observeContent) {
+        const empty = !(record.children ?? []).some((child) => {
+          const direct = child as ProtocolDomNode & { nodeType?: number; nodeValue?: string };
+          return (
+            direct.nodeType === 1 ||
+            (direct.nodeType === 3 && (direct.nodeValue ?? "").trim().length > 0)
+          );
+        });
+        emptyRendererRoot = emptyRendererRoot === undefined ? empty : false;
+      }
       html ??= {
         rendererRootCount: 0,
         headingCount: 0,
@@ -511,6 +547,7 @@ export async function probeProtocolGetDocument(
     opaqueRegionCount,
     externalImageCount: html?.externalImageCount ?? 0,
     ...(html === undefined ? {} : { html }),
+    ...(emptyRendererRoot === undefined ? {} : { emptyRendererRoot }),
     viewBoxes,
     errorCount,
     discriminativeErrors:

package/src/validation/tier1/runner.ts

@@ -327,6 +327,7 @@ async function runTier1Attempt(
       artifactFrame,
       isolated.executionContextId,
       interactiveTsx ? runtimeExceptions!.errorsForFrame(artifactFrame.frameId) : [],
+      input.artifactType === "tsx",
     );
     const secondObservation = interactiveTsx
       ? await waitForStabilityObservation(
@@ -334,6 +335,7 @@ async function runTier1Attempt(
           artifactFrame,
           isolated.executionContextId,
           () => runtimeExceptions!.errorsForFrame(artifactFrame.frameId),
+          true,
         )
       : firstObservation;
     const protocolObservation = secondObservation.protocol;
@@ -350,6 +352,7 @@ async function runTier1Attempt(
         bootReady: shim.bootReady,
         renderComplete: shim.renderComplete,
         interactive: interactiveTsx,
+        tsx: input.artifactType === "tsx",
         channelDivergence,
         structureChanged:
           interactiveTsx && countsDiffer(firstObservation.protocol, secondObservation.protocol),
@@ -390,6 +393,9 @@ async function runTier1Attempt(
         errorCount: observed.errorCount,
         opaqueRegionCount: observed.opaqueRegionCount,
         externalImageCount: observed.externalImageCount,
+        ...(observed.emptyRendererRoot === undefined
+          ? {}
+          : { emptyRendererRoot: observed.emptyRendererRoot }),
         ...(observed.html === undefined ? {} : { html: observed.html }),
         discriminativeErrors: observed.discriminativeErrors,
       },
@@ -604,6 +610,12 @@ function mergeProtocol(
       message: `DOMSnapshot.externalImageCount=${snapshot.externalImageCount} vs DOM.getDocument.externalImageCount=${getDocument.externalImageCount}`,
     });
   }
+  if (snapshot.emptyRendererRoot !== getDocument.emptyRendererRoot) {
+    errors.push({
+      code: "protocol_divergence",
+      message: `DOMSnapshot.emptyRendererRoot=${snapshot.emptyRendererRoot} vs DOM.getDocument.emptyRendererRoot=${getDocument.emptyRendererRoot}`,
+    });
+  }
   const observedCounts = Object.fromEntries(
     OBSERVED_COUNT_KEYS.map((key) => [key, snapshot[key]]),
   ) as Pick<ProtocolObservation, ObservedCountKey>;
@@ -612,6 +624,9 @@ function mergeProtocol(
     viewBoxes: snapshot.viewBoxes,
     errorCount: snapshot.errorCount,
     ...(snapshot.html === undefined ? {} : { html: snapshot.html }),
+    ...(snapshot.emptyRendererRoot === undefined
+      ? {}
+      : { emptyRendererRoot: snapshot.emptyRendererRoot }),
     discriminativeErrors: errors,
   };
 }
@@ -717,10 +732,11 @@ async function observeArtifact(
   frame: { readonly frameId: string; readonly url: string },
   executionContextId: number,
   runtimeErrors: readonly { readonly code: string; readonly message: string }[],
+  observeContent = false,
 ): Promise<ArtifactObservation> {
-  const snapshot = await probeProtocolSnapshot(session, frame);
-  const document = await probeProtocolGetDocument(session, frame);
-  const isolated = await probeIsolatedCounts(session, executionContextId);
+  const snapshot = await probeProtocolSnapshot(session, frame, observeContent);
+  const document = await probeProtocolGetDocument(session, frame, observeContent);
+  const isolated = await probeIsolatedCounts(session, executionContextId, observeContent);
   return { protocol: mergeProtocol(snapshot, document, runtimeErrors), isolated };
 }
 
@@ -729,9 +745,10 @@ async function waitForStabilityObservation(
   frame: { readonly frameId: string; readonly url: string },
   executionContextId: number,
   runtimeErrors: () => readonly { readonly code: string; readonly message: string }[],
+  observeContent = false,
 ): Promise<ArtifactObservation> {
   await Bun.sleep(TSX_STABILITY_WINDOW_MS);
-  return observeArtifact(session, frame, executionContextId, runtimeErrors());
+  return observeArtifact(session, frame, executionContextId, runtimeErrors(), observeContent);
 }
 
 interface EvidenceCapture {

package/src/validation/tier1/verdict.ts

@@ -44,12 +44,12 @@ export type { ProtocolObservation };
  */
 export type PageShim = Pick<
   ProtocolObservation,
-  (typeof COUNT_COMPARISON_KEYS)[number] | "html" | "errorCount"
+  (typeof COUNT_COMPARISON_KEYS)[number] | "html" | "errorCount" | "emptyRendererRoot"
 >;
 
 export type CountsLike = Pick<
   ProtocolObservation,
-  (typeof COUNT_COMPARISON_KEYS)[number] | "html" | "errorCount"
+  (typeof COUNT_COMPARISON_KEYS)[number] | "html" | "errorCount" | "emptyRendererRoot"
 >;
 
 const COUNT_COMPARISON_KEYS = OBSERVED_COUNT_KEYS;
@@ -88,47 +88,21 @@ export interface LifecycleSummary {
   readonly channelDivergence?: boolean;
   /** Interactive TSX has no lexical HTML prediction and no trusted outer shim. */
   readonly interactive?: boolean;
+  /** Only TSX has a renderer-root emptiness claim from Tier 1. */
+  readonly tsx?: boolean;
 }
 
 /**
- * Compute the final `RenderStatus`. Order of precedence:
+ * Compute the final `RenderStatus`. Precedence, highest first:
+ * timeout → channel divergence/tampered → missing channels → protocol
+ * errors or lexical mismatch → missing TSX content observation →
+ * unstable → empty TSX root → missing declared opaque content/error →
+ * opaque content → external resources → unobservable SVG layout → ok.
  *
- *   1. Lifecycle: `renderComplete === false` → `timeout`
- *   2. Trust: shim disagrees with protocol → `tampered`
- *   3. Trust: isolated disagrees with protocol → `tampered`
- *   4. Channel availability: both shim AND isolated missing → `probe_only`
- *   5. Channel availability: only shim missing → `probe_only`
- *   6. Channel availability: only isolated missing → `shim_only`
- *   7. Opaque content: expected > 0 but protocol observed 0 → `error`
- *   8. Opaque content: protocol observed > 0 → `partial:opaque_content`
- *   9. External resources: expected external images > 0 → `partial:external_resources`
- *  10. Layout observability (non-HTML only): protocol visibleSvgCount === 0
- *      AND every viewBox is zeroed → `partial:layout_unverified`. The
- *      branch is gated on `expected.html === undefined` because HTML
- *      artifacts carry no viewBox axis — they have no SVG layout to
- *      verify against, so `partial:layout_unverified` is structurally
- *      unreachable for HTML. A clean HTML artifact with zero
- *      `visibleSvgCount` and zero `viewBoxes` returns `ok` when its
- *      counts match.
- *  11. Counts: protocol discriminativeErrors non-empty → `error`
- *  12. Counts: protocol observed !== expected lexical → `error`
- *  13. Otherwise → `ok`
- *
- * Tampered wins over partial: a forge attempt that hides layout
- * observability (no viewBoxes) is still a forge attempt.
- *
- * D11 addition: `partial:unstable` slots between step 6 and step 7,
- * i.e. AFTER the catastrophic statuses (timeout, tampered, channel
- * availability) and the count-mismatch error, but BEFORE the
- * single-snapshot partials (opaque_content, external_resources,
- * layout_unverified). The reasoning: when structure is changing
- * between the two observation snapshots, the verifier cannot
- * honestly claim "this artifact has structure X" — every
- * single-snapshot claim is moot. Unstable is a meta-claim about the
- * page's runtime behavior that dominates the structural claims.
- * Tampered stays above it because channel divergence (the page
- * contradicting protocol authority) is the more catastrophic
- * reading of the page's behavior.
+ * A changing page cannot support any single-snapshot content claim,
+ * including emptiness. HTML/TSX has no SVG viewBox axis, while TSX
+ * emptiness needs agreement from the two protocol paths and isolated
+ * world; the outer page shim has no authority to make that claim.
  */
 export function deriveVerdict(
   expected: LexicalCounters,
@@ -164,11 +138,19 @@ export function deriveVerdict(
 
   if (protocolObservation.discriminativeErrors.length > 0) return "error";
   if (!lifecycle.interactive && !matchesExpected(expected, protocolObservation)) return "error";
+  if (
+    lifecycle.tsx &&
+    (protocolObservation.emptyRendererRoot === undefined ||
+      isolatedObservation?.emptyRendererRoot === undefined)
+  )
+    return "probe_only";
   // D11: structure changed between the barrier and the stability
   // window. This is the only path that does not also depend on a
   // single observation — it depends on TWO observations, so it
   // dominates the single-snapshot partial statuses below.
   if (lifecycle.structureChanged === true) return "partial:unstable";
+  if (lifecycle.tsx && protocolObservation.emptyRendererRoot === true)
+    return "partial:empty_render";
   if (expected.opaqueRegionCount > 0 && protocolObservation.opaqueRegionCount === 0) {
     return "error";
   }
@@ -224,6 +206,9 @@ function htmlCountsDiffer(
 export function countsDiffer(left: CountsLike, right: CountsLike): boolean {
   return (
     COUNT_COMPARISON_KEYS.some((key) => left[key] !== right[key]) ||
+    (left.emptyRendererRoot !== undefined &&
+      right.emptyRendererRoot !== undefined &&
+      left.emptyRendererRoot !== right.emptyRendererRoot) ||
     left.errorCount !== right.errorCount ||
     htmlCountsDiffer(left.html, right.html)
   );