@linxin666/dsh-client-ui-task-board 0.4.5 → 0.4.6

package/lib/types/core/verification-budget.d.ts

@@ -0,0 +1,52 @@
+/** Judge calls one acceptance issues: every criterion, every round. */
+export declare const ACCEPTANCE_JUDGE_CALLS: number;
+/**
+ * Per-judge-call ceiling used when the row names none: two and a half minutes
+ * for a reasoning model reading an 80,000 character trace with a 16,384 token
+ * output cap. The former 120s constant was tight enough that a slow but healthy
+ * route produced a wall of per-call timeouts, and every one of them was charged
+ * as an acceptance anomaly against a budget that then failed the card.
+ */
+export declare const DEFAULT_VERIFICATION_CALL_TIMEOUT_SECONDS = 150;
+/** Shortest accepted per-call ceiling: below this no useful judge answers. */
+export declare const VERIFICATION_CALL_TIMEOUT_MIN_SECONDS = 30;
+/** Longest accepted per-call ceiling, ten minutes. */
+export declare const VERIFICATION_CALL_TIMEOUT_MAX_SECONDS = 600;
+/**
+ * Total ceiling of one acceptance attempt, covering evidence rendering and
+ * every judge call including retries. Derived from the per-call default rather
+ * than pinned, because a total budget smaller than
+ * {@link ACCEPTANCE_JUDGE_CALLS} times the per-call ceiling guarantees that no
+ * acceptance can ever finish.
+ */
+export declare const DEFAULT_VERIFICATION_BUDGET_SECONDS: number;
+/** Shortest accepted total budget: long enough for at least one judge call. */
+export declare const VERIFICATION_BUDGET_MIN_SECONDS = 120;
+/** Longest accepted total budget, thirty minutes. */
+export declare const VERIFICATION_BUDGET_MAX_SECONDS = 1800;
+/** The default total budget in milliseconds, the face the abort timer takes. */
+export declare const DEFAULT_VERIFICATION_BUDGET_MS: number;
+/**
+ * The effective per-judge-call ceiling.
+ * @param seconds - configured seconds, or undefined for the default.
+ * @returns the effective ceiling in seconds.
+ */
+export declare function normalizeVerificationCallTimeoutSeconds(seconds: number | undefined): number;
+/**
+ * The effective per-judge-call ceiling the timer face takes.
+ * @param seconds - configured seconds, or undefined for the default.
+ * @returns the effective ceiling in milliseconds.
+ */
+export declare function verificationCallTimeoutMs(seconds: number | undefined): number;
+/**
+ * The effective total budget of one acceptance attempt.
+ * @param seconds - configured seconds, or undefined for the default.
+ * @returns the effective budget in seconds.
+ */
+export declare function normalizeVerificationBudgetSeconds(seconds: number | undefined): number;
+/**
+ * The effective total budget the abort face takes.
+ * @param seconds - configured seconds, or undefined for the default.
+ * @returns the effective budget in milliseconds.
+ */
+export declare function verificationBudgetMs(seconds: number | undefined): number;

package/lib/types/core/verification.d.ts

@@ -37,10 +37,66 @@ export declare const MAX_QUALITY_ATTEMPTS = 2;
 /**
  * Anomaly budget of one cycle. A timeout, an authentication failure or an
  * unparseable judge answer is not a quality verdict, so it never consumes a
- * quality attempt; it is still bounded, so an unusable judge route can never
- * turn the completion gate into an unbounded retry loop.
+ * quality attempt.
+ *
+ * Reaching it does NOT judge the card: an unusable judge route is a property of
+ * the environment, not of the work, so a card must never be failed for it. The
+ * gate instead HOLDS the cycle open and runs no further judge call until the
+ * recorded anomalies are cleared by an explicit user action (see
+ * {@link withoutAcceptanceAnomalies}), which is what keeps the bound: one cycle
+ * spends at most this many judge rounds, and clearing them is a human decision.
  */
 export declare const MAX_EXCEPTION_ATTEMPTS = 2;
+/**
+ * Retries of an INVALID acceptance: a quality veto whose required evidence is
+ * missing, unlocatable, or aimed at the empty-work baseline is not a judgement
+ * of the work, so it is recorded in its own stage and spent against this
+ * bound instead of the quality budget. Reaching it stops the judge calls and
+ * HOLDS the cycle for a human, exactly like a spent anomaly budget: an
+ * evidence-free veto must never fail a card, and it must never re-run forever.
+ */
+export declare const MAX_INVALID_ATTEMPTS = 2;
+/**
+ * Capacity bound of the per-attempt acceptance detail — the repair/review
+ * material the acceptance mechanism itself creates. It is deliberately the
+ * ONLY large acceptance-only material this mechanism persists: findings are
+ * capped in count and rendered size, so nothing here needs an extra full
+ * evidence copy. It is removed by the automatic cleanup once the execution
+ * passed and settled (see {@link withAcceptanceDetailCleared}).
+ */
+export declare const VERIFICATION_DETAIL_MAX_FINDINGS = 12;
+/** Longest verbatim citation kept from one judge finding. */
+export declare const VERIFICATION_DETAIL_MAX_QUOTE_CHARS = 600;
+/** Longest rendered detail kept for one attempt, across every finding. */
+export declare const VERIFICATION_DETAIL_MAX_CHARS = 16000;
+/**
+ * Shortest citation a veto may rest on. A one- or two-character quote matches
+ * almost any trace, so it cannot locate anything.
+ */
+export declare const VERIFICATION_MIN_QUOTE_CHARS = 12;
+/** Shortest requirement/observation/gap text that states a real difference. */
+export declare const VERIFICATION_MIN_PROBLEM_CHARS = 4;
+/**
+ * Longest criterion identifier one persisted finding may name. An identifier,
+ * not prose: the reader rejects anything longer instead of clipping it, because
+ * a mangled id would silently detach the finding from the criterion it judges.
+ */
+export declare const VERIFICATION_DETAIL_MAX_CRITERION_ID_CHARS = 64;
+/**
+ * Longest requirement / observation / gap / suggested-action text one finding
+ * keeps. Shared by the WRITER (which clips the judge's attributes to it) and the
+ * READER (which clips a hand-edited document back to it), so the acceptance
+ * detail has one capacity bound rather than two that can drift.
+ */
+export declare const VERIFICATION_DETAIL_MAX_PROBLEM_CHARS = 400;
+/**
+ * Attempts one execution's acceptance cleanup may spend. Cleanup is started
+ * only after the pass record and the settlement are durable, is idempotent,
+ * and a failure never revokes the pass; the bound keeps a permanently failing
+ * filesystem from retrying forever, and the Host retries the remainder on its
+ * next start.
+ */
+export declare const MAX_CLEANUP_ATTEMPTS = 3;
 /** The fixed baseline a session acceptance measures itself against. */
 export declare const EMPTY_WORK_BASELINE = "(No useful work or verification was performed.)";
 /** Ground-truth note prepended to every judge prompt. */
@@ -61,6 +117,18 @@ export interface VerificationCriterion {
 export declare const CODING_CRITERIA: readonly VerificationCriterion[];
 /** Rating scale text rendered into every judge prompt. */
 export declare const SCALE_DESCRIPTION: string;
+/**
+ * Which trajectory slot holds the WORK during one round.
+ *
+ * The even round (0) puts the work in slot A and the empty-work baseline in
+ * slot B; the odd round (1) swaps them, which is how the acceptance cancels
+ * position bias. The judge prompt ALWAYS introduces the work as
+ * `location="TRAJECTORY_B"`, because that is the slot the work occupies in the
+ * prompt's own framing; the parser maps the cited slot back through this table.
+ * @param round - the round index (0-based).
+ * @returns the slot letter the work occupies in that round.
+ */
+export declare function workSlotOfRound(round: number): 'A' | 'B';
 /** A-T letters in scale order (A = best). */
 export declare const LETTERS: readonly string[];
 /**
@@ -119,7 +187,13 @@ export declare function evidenceNonce(...parts: readonly string[]): string;
  *   byte-identical for a deployment that serves no change service.
  * @returns the rendered prompt.
  */
-export declare function buildAcceptancePrompt(problem: string, traceA: string, traceB: string, criterion: VerificationCriterion, groundTruthNote?: string, context?: string): string;
+export declare function buildAcceptancePrompt(problem: string, traceA: string, traceB: string, criterion: VerificationCriterion, groundTruthNote?: string, context?: string, 
+/**
+ * The trajectory slot that holds the WORK this round. The judge is told the
+ * slot explicitly, so the citation it returns names the work whichever way
+ * the A/B slots were arranged. Defaults to A (round 0's arrangement).
+ */
+workSlot?: 'A' | 'B'): string;
 /** Where the judge route of one execution came from. */
 export type VerificationRouteSource = 'inherit' | 'explicit';
 /** The resolved judge route of one execution's acceptance. */
@@ -222,13 +296,70 @@ export interface VerificationEvidenceSummary {
     /** Files of host-observed workspace changes rendered into the prompt (0 = none). */
     workspaceFiles?: number;
 }
-/** One recorded acceptance attempt: a quality verdict or an anomaly. */
+/**
+ * One judge finding, structured against the requirement it vetoes.
+ *
+ * The acceptance only counts a criterion as vetoed when the judge names that
+ * criterion, states the requirement, the observation and the difference, and
+ * cites a passage that really occurs in THIS acceptance's evidence (the task
+ * text, the candidate's own trajectory, or the host's workspace record). A
+ * finding that names the empty-work baseline, another criterion, or a passage
+ * that is not in the reviewed evidence is dropped here, so it can never become
+ * the evidence for a veto.
+ */
+export interface VerificationCriterionFinding {
+    /** Criterion id this finding vetoes. */
+    criterionId: string;
+    /** The requirement the criterion demands of the work. */
+    requirement: string;
+    /** What was actually observed in the evidence. */
+    observation: string;
+    /** The difference: why that observation does not satisfy the requirement. */
+    gap: string;
+    /** Verbatim citation from the evidence; verified to occur in it. */
+    quote: string;
+    /**
+     * Which part of the reviewed evidence the citation was located in.
+     * `baseline` means the judge cited the empty-work baseline, which is never
+     * the work's own evidence and can never veto a criterion.
+     */
+    location: 'task' | 'trajectory' | 'workspace' | 'baseline' | 'unknown';
+    /** Optional suggested action from the judge. */
+    action?: string;
+}
+/** Why an acceptance produced no valid quality verdict. */
+export type VerificationInvalidReason = 
+/** The failing criteria have no structured finding of their own. */
+'missing-finding'
+/** A finding's citation does not occur in the evidence the judge saw. */
+ | 'unlocatable-quote'
+/** A finding vetoes the empty-work baseline instead of the work. */
+ | 'baseline-finding'
+/** A finding's text is empty or a generic evaluation. */
+ | 'vacuous-finding'
+/** The judged evidence was truncated and cannot substantiate the veto. */
+ | 'insufficient-evidence';
+/** One recorded acceptance attempt: a quality verdict, an anomaly, a budget stop, or an invalid veto. */
 export interface VerificationAttempt {
     /** 1-based ordinal within its own stage. */
     index: number;
     /** When the attempt ran (ms epoch). */
     at: number;
-    stage: 'quality' | 'exception';
+    /**
+     * `budget` records an acceptance the time budget ended before it could
+     * reach a verdict. It is neither a quality verdict nor an environment
+     * anomaly: the judge route may be perfectly healthy, the machine simply had
+     * no time left, so it is charged to no budget at all and cleared by the same
+     * explicit user action that clears anomalies.
+     *
+     * `invalid` records an acceptance that produced no usable quality verdict
+     * because the veto's required evidence was missing, unlocatable, or aimed at
+     * the empty-work baseline. It is neither a judgement of the work nor an
+     * environment anomaly: it consumes its own bounded retry budget, fails
+     * nothing, and is cleared by the same explicit user action that clears
+     * anomalies.
+     */
+    stage: 'quality' | 'exception' | 'budget' | 'invalid';
     /** Quality: whether the work passed. A recorded anomaly is never a pass. */
     passed: boolean;
     /** Total score of the task's own work (0 for an anomaly). */
@@ -246,6 +377,14 @@ export interface VerificationAttempt {
     rounds: number;
     /** Anomaly reason; absent on a quality verdict. */
     error?: string;
+    /**
+     * Structured, locatable findings of a QUALITY attempt, keyed by criterion.
+     * A veto is only counted when the failing criterion appears here with a
+     * verified citation; otherwise the attempt is recorded as invalid instead.
+     */
+    criterionFindings?: VerificationCriterionFinding[];
+    /** Why an invalid attempt carried no usable verdict; absent on other stages. */
+    invalidReason?: VerificationInvalidReason;
 }
 /** Persisted acceptance state of one execution. */
 export interface ExecutionVerification {
@@ -259,19 +398,143 @@ export interface ExecutionVerification {
      * out of the gate (`TaskRecord.skipVerification`), `goal-unavailable` when
      * the run never became a goal run (so no completion gate could ever fire),
      * and `team-member` for a teammate execution (the Lead's acceptance covers
-     * the team's aggregated evidence).
+     * the team's aggregated evidence), and `goal-disabled` when the GLOBAL
+     * native /goal switch was off at start, so this execution never became a
+     * goal run and its completion gate can never fire.
      */
-    applicability: 'enforced' | 'disabled' | 'skipped' | 'goal-unavailable' | 'team-member';
+    applicability: 'enforced' | 'disabled' | 'skipped' | 'goal-unavailable' | 'team-member' | 'goal-disabled';
     /** Set when the cycle is spent and the execution must fail. */
     failedReason?: string;
     failedAt?: number;
+    /**
+     * Retention record of the acceptance-only detail this execution created.
+     *
+     * An execution that PASSED and settled has its bulky acceptance-only material
+     * (attempt findings, invalid diagnostics, judge metadata beyond the audit
+     * summary) removed automatically; this record is the lightweight audit trail
+     * that proves the cleanup happened and preserves the minimal credential
+     * (verdict, scores, time, model, evidence hash) the completion gate needs.
+     * Absent means nothing has been cleaned for this execution.
+     */
+    cleanup?: AcceptanceCleanupRecord;
 }
-/** UI/board phase of one execution's acceptance. */
-export type VerificationPhase = 'off' | 'executing' | 'verifying' | 'repairing' | 'passed' | 'failed';
+/** Permanent, lightweight acceptance credential kept after a passed execution settles. */
+export interface AcceptanceAuditRecord {
+    /** Stage of the attempt the credential describes. */
+    stage: VerificationAttempt['stage'];
+    /** Whether the attempt passed. */
+    passed: boolean;
+    /** When the attempt ran (ms epoch). */
+    at: number;
+    /** Total score of the task's own work. */
+    score: number;
+    /** Empty-work baseline score. */
+    baseline: number;
+    /** Per-criterion scores and thresholds. */
+    criteria: VerificationCriterionScore[];
+    /** Digest of the judged evidence; binds the pass record to what was reviewed. */
+    evidenceHash: string;
+    /** Judge route of the attempt. */
+    route: VerificationRoute;
+    /** Anomaly or invalid reason, when the attempt carried one. */
+    error?: string;
+    /** One-line problem summary kept for the audit trail. */
+    findingSummary?: string;
+    /** Token accounting of the attempt. */
+    usage: VerificationUsage;
+}
+/**
+ * State of the automatic acceptance-detail cleanup of one execution.
+ *
+ * `state` is `pending` until the cleanup actually removed the detail (or found
+ * nothing left to remove); `failed` records the last failure so a Host restart
+ * can retry it. The pass record and the settlement are durable before a cleanup
+ * starts, so a failure here never revokes a valid pass.
+ */
+export interface AcceptanceCleanupRecord {
+    state: 'pending' | 'cleaned' | 'failed';
+    /** Attempts spent; bounded by {@link MAX_CLEANUP_ATTEMPTS}. */
+    attempts: number;
+    /** When the cleanup first ran (ms epoch). */
+    startedAt: number;
+    /** When the detail was actually removed (ms epoch); absent while pending. */
+    cleanedAt?: number;
+    /** Why the last attempt failed; absent when none did. */
+    lastError?: string;
+    /** Minimal credential kept for every attempt this execution recorded. */
+    audit: AcceptanceAuditRecord[];
+}
+/**
+ * UI/board phase of one execution's acceptance.
+ *
+ * `invalid` is its own phase, not a variant of `failed`: the cycle spent its
+ * invalid-acceptance budget without a usable veto, so the judge is no longer
+ * called and a human decision is required. A reader must never read it as a
+ * quality rejection.
+ */
+export type VerificationPhase = 'off' | 'executing' | 'verifying' | 'repairing' | 'passed' | 'failed' | 'invalid';
 /** Quality attempts spent by this cycle. */
 export declare function qualityAttempts(verification: ExecutionVerification | undefined): VerificationAttempt[];
 /** Anomaly attempts spent by this cycle. */
 export declare function exceptionAttempts(verification: ExecutionVerification | undefined): VerificationAttempt[];
+/**
+ * Attempts the time budget ended before a verdict, charged to no budget. They
+ * are kept so the report can say WHY an acceptance produced nothing, and they
+ * are cleared by the same explicit user action that clears anomalies.
+ */
+export declare function budgetAttempts(verification: ExecutionVerification | undefined): VerificationAttempt[];
+/**
+ * Invalid acceptances spent by this cycle: a veto whose required evidence was
+ * missing, unlocatable, or aimed at the empty-work baseline. They are NOT
+ * quality verdicts, so they never close the cycle and never fail the card; the
+ * bound is what keeps an evidence-free judge from re-running forever.
+ */
+export declare function invalidAttempts(verification: ExecutionVerification | undefined): VerificationAttempt[];
+/** Whether this cycle still has invalid-acceptance budget left. */
+export declare function hasInvalidBudget(verification: ExecutionVerification | undefined): boolean;
+/**
+ * The acceptance block with every non-quality attempt dropped: the explicit
+ * reset a user performs after fixing the environment (issue #1828).
+ *
+ * Only attempts that are not a quality verdict are dropped. A quality verdict
+ * is the board's own judgement of the work and survives every reset, so this
+ * can never buy an extra acceptance or re-open a judged failure; it only lets
+ * the environment be judged again.
+ * @param verification - the persisted acceptance state.
+ * @returns the cleared block, or undefined when there is nothing to clear.
+ */
+export declare function withoutAcceptanceAnomalies(verification: ExecutionVerification): ExecutionVerification | undefined;
+/**
+ * The one-line problem summary a cleaned execution keeps: the failing criteria
+ * with their scores, plus how many locatable findings were removed. This is the
+ * lightweight audit material that survives the detail cleanup.
+ * @param attempt - the attempt whose detail is being removed.
+ * @returns the bounded summary line.
+ */
+export declare function findingSummaryOf(attempt: VerificationAttempt): string | undefined;
+/**
+ * The audit credential of one attempt: everything the completion gate, the
+ * report and a later review need, and nothing that makes the ledger heavy.
+ * @param attempt - the attempt being condensed.
+ * @returns the lightweight audit record.
+ */
+export declare function auditOf(attempt: VerificationAttempt): AcceptanceAuditRecord;
+/**
+ * Remove this execution's OWN acceptance-only detail while keeping the light
+ * audit record — the acceptance mechanism's side of requirement 2.
+ *
+ * Only material the acceptance mechanism itself created is removed: the
+ * per-attempt findings, the invalid diagnostics and the token/evidence detail
+ * beyond the summary. Everything a human needs to see the verdict survives
+ * (stage, pass flag, time, scores, evidence hash, judge route, usage totals),
+ * so the completion gate's pass record and a later review are unaffected, and
+ * NO user file, task artifact, raw session history or other execution's record
+ * is ever touched by this function.
+ * @param verification - the execution's acceptance block.
+ * @param now - cleanup instant (ms epoch).
+ * @returns the cleaned block, or undefined when there is nothing to remove.
+ */
+export declare function withAcceptanceDetailCleared(verification: ExecutionVerification, now: number): ExecutionVerification | undefined;
 /** The quality attempt that passed, when one did. */
 export declare function passedAttempt(verification: ExecutionVerification | undefined): VerificationAttempt | undefined;
 /**
@@ -284,12 +547,78 @@ export declare function passedAttempt(verification: ExecutionVerification | unde
  * @returns true when a pass record is required.
  */
 export declare function verificationRequired(verification: ExecutionVerification | undefined): boolean;
+/**
+ * Whether this execution's acceptance gate was never opened: acceptance was
+ * enforced, the judge recorded nothing at all, and no cycle ever closed. Zero
+ * attempts is therefore a fact about the RUN, not a verdict about the work — a
+ * session that narrated completion instead of calling
+ * `update_goal(action: complete)` produces exactly this shape, and its failure
+ * reason must stay distinguishable from a quality verdict (issue #1837).
+ * @param verification - the execution's persisted acceptance state.
+ * @returns true when no acceptance attempt ever ran.
+ */
+export declare function verificationNeverInvoked(verification: ExecutionVerification | undefined): boolean;
+/**
+ * Whether this execution's acceptance produced no usable veto at all: it was
+ * enforced, the judge recorded attempts, and every one of them is INVALID.
+ *
+ * Such a run must never be described as an evidence-backed quality veto (issue
+ * #1837's sibling): the judge could not locate its own rejection, so the run
+ * ended for lack of a matching pass rather than because the work was judged
+ * and rejected. The settlement reason names that difference.
+ * @param verification - the execution's persisted acceptance state.
+ * @returns true when nothing but invalid acceptances were recorded.
+ */
+export declare function verificationOnlyInvalid(verification: ExecutionVerification | undefined): boolean;
 /** Whether this cycle still has quality budget left. */
 export declare function hasQualityBudget(verification: ExecutionVerification | undefined): boolean;
 /** Whether this cycle still has anomaly budget left. */
 export declare function hasExceptionBudget(verification: ExecutionVerification | undefined): boolean;
 /** Derived board phase of one execution's acceptance. */
 export declare function verificationPhase(verification: ExecutionVerification | undefined): VerificationPhase;
+/** The text of each evidence part one acceptance handed to the judge. */
+export interface AcceptanceEvidenceText {
+    /** The task statement block. */
+    task: string;
+    /** The candidate's own trajectory block (the WORK). */
+    trajectory: string;
+    /** The host's rendered workspace-change block; empty when none was served. */
+    workspace: string;
+}
+/** The input the program-level validity check reads from one finished attempt. */
+export interface AcceptanceValidityInput {
+    /** Per-criterion scores the attempt recorded. */
+    criteria: readonly VerificationCriterionScore[];
+    /** Structured findings the judge's answer produced. */
+    findings: readonly VerificationCriterionFinding[];
+    /** The exact evidence texts the judge was shown. */
+    evidence: AcceptanceEvidenceText;
+    /** Characters the evidence cap dropped from the trajectory. */
+    omittedCharacters: number;
+}
+/** The verdict of the program-level validity check. */
+export type AcceptanceValidity = {
+    valid: true;
+} | {
+    valid: false;
+    reason: VerificationInvalidReason;
+    detail: string;
+};
+/**
+ * Program-level validity of a REJECTING acceptance, decided before any quality
+ * verdict is booked (requirement 1: the rule cannot live in a prompt alone).
+ *
+ * A veto is only usable when every criterion that failed has its own structured
+ * finding carrying the requirement, the observation, the difference and a
+ * citation that really occurs in the evidence the judge saw. A citation aimed at
+ * the empty-work baseline, a citation that is not in the reviewed evidence, an
+ * empty or generic statement, and a truncated review that cannot substantiate
+ * the veto are all invalid acceptances: no quality verdict, no quality budget,
+ * and no card failure.
+ * @param input - the attempt's scores, findings and the evidence it judged.
+ * @returns valid, or the reason and detail of the invalidity.
+ */
+export declare function assessAcceptanceValidity(input: AcceptanceValidityInput): AcceptanceValidity;
 /**
  * The acceptance rule, mirrored from the verifier's `sessionAccepted`:
  * the work must BEAT the empty-work baseline, reach the total threshold, and
@@ -320,6 +649,8 @@ export declare function normalizeVerification(value: unknown): ExecutionVerifica
 export interface VerificationTotals {
     quality: number;
     exceptions: number;
+    /** Invalid acceptances: no usable veto, so no quality verdict and no card failure. */
+    invalid: number;
     calls: number;
     inputTokens: number;
     outputTokens: number;
@@ -338,6 +669,32 @@ export declare function verificationTotals(verification: ExecutionVerification |
  * @returns the model-facing feedback text.
  */
 export declare function qualityFeedback(attempt: VerificationAttempt, remaining: number): string;
+/**
+ * The feedback one INVALID acceptance returns.
+ *
+ * The claim is refused (the board still has no pass record, so completion may
+ * not take effect) but the agent is NOT handed a repair instruction: there is
+ * no located problem to repair, and telling it to "fix" an evidence-free veto
+ * would be exactly the blind repair the requirement forbids. The text says what
+ * was missing, what happens next, and what the agent should do instead (make
+ * the missing output itself observable, or let a human look).
+ * @param attempt - the invalid attempt.
+ * @param remaining - invalid-acceptance attempts left after this one.
+ * @returns the model-facing text.
+ */
+export declare function invalidAcceptanceFeedback(attempt: VerificationAttempt, remaining: number): string;
+/**
+ * The reason one execution records when its invalid-acceptance budget is spent.
+ *
+ * Deliberately NOT a quality failure: no veto was ever substantiated, so the
+ * card stays open for a human and the reason says the acceptance is INVALID
+ * rather than rejected.
+ * @param used - invalid attempts spent.
+ * @returns the user- and model-facing text.
+ */
+export declare function invalidHoldReason(used: number): string;
+/** Human-readable text of one invalid reason. */
+export declare function invalidReasonText(reason: VerificationInvalidReason | undefined): string;
 /**
  * The reason one exhausted acceptance cycle records as the execution's final
  * failure. Unlike {@link qualityFeedback} — which the fixing agent reads while
@@ -352,6 +709,16 @@ export declare function qualityFeedback(attempt: VerificationAttempt, remaining:
  * @returns the model- and user-facing failure reason.
  */
 export declare function finalFailureReason(attempt: VerificationAttempt, used: number, threshold: number): string;
+/**
+ * The locatable problem lines of one attempt, structured findings first.
+ *
+ * A structured finding renders the requirement, the observed fact, the gap and
+ * the citation in a fixed order, so the fixing agent reads WHAT was required,
+ * WHAT was seen, WHY it falls short and WHERE to look — never a bare complaint.
+ * @param attempt - the attempt whose findings are rendered.
+ * @returns one line per finding, bounded.
+ */
+export declare function locatedFindingLines(attempt: VerificationAttempt): string[];
 /** `0.42` style percentage. */
 export declare function percent(value: number): string;
 /** Split a qualified `provider/model` route; undefined when it is not one. */

package/lib/types/host/verification-gate.d.ts

@@ -18,7 +18,21 @@
  * - an anomaly (timeout, authentication, unparseable answer, an unusable judge
  *   route) is recorded separately from a quality verdict and is never treated
  *   as one;
+ * - exhausting the anomaly budget does NOT judge the card: an environment that
+ *   cannot answer is not the work failing, so the cycle is held open with no
+ *   judge call until a user clears the recorded anomalies (issue #1828);
+ * - an attempt the time budget ends before any verdict is recorded as its own
+ *   stage and charged to no budget at all (issue #1828);
+ * - an INVALID acceptance (a veto whose required evidence is missing,
+ *   unlocatable, or aimed at the empty-work baseline) is recorded in its own
+ *   stage, spends its OWN bounded budget, and never consumes a quality attempt
+ *   or fails the card; when that budget is spent the cycle is held for a human
+ *   exactly like a spent anomaly budget;
  * - concurrent completion calls for one execution share one acceptance.
+
+ * The validity check itself is program-level (`assessAcceptanceValidity` in
+ * `core/verification.ts`), applied after the judge answers and BEFORE any
+ * quality verdict is written: a stronger prompt alone could not enforce it.
  */
 import type { PreToolDecision } from '@deepseek-ai/dsh-tools';
 import type { LlmRuntime } from '@deepseek-ai/dsh-llm';
@@ -51,6 +65,16 @@ export interface GoalVerificationGateDeps {
      * that serves none) simply means the judge sees the trajectory alone.
      */
     workspaceChanges?: () => WorkspaceChangeSource | undefined;
+    /**
+     * Ceiling of one judge request, read per acceptance (a row setting). Absent
+     * keeps the default, so a programmatic mount still judges.
+     */
+    callTimeoutMs?: () => number;
+    /**
+     * Total ceiling of one acceptance attempt, read per acceptance (a row
+     * setting). Absent keeps the default.
+     */
+    budgetMs?: () => number;
     logger: {
         warn(message: string, ...rest: unknown[]): void;
     };

package/lib/types/host/verification-runner.d.ts

@@ -15,18 +15,45 @@ export declare const VERIFICATION_MAX_TRACE_CHARS = 80000;
 export declare const VERIFICATION_MAX_ENTRY_CHARS = 4000;
 /** Largest per-finding text kept from one judge answer. */
 export declare const VERIFICATION_MAX_FINDING_CHARS = 400;
-/** Findings kept per judge answer and per acceptance. */
+/** Largest verbatim citation kept from one finding. */
+export declare const VERIFICATION_MAX_QUOTE_CHARS = 600;
+/** Largest requirement/observation/gap statement kept from one finding. */
+export declare const VERIFICATION_MAX_PROBLEM_CHARS = 400;
+/** Structured findings kept per judge answer and per acceptance. */
 export declare const VERIFICATION_MAX_FINDINGS_PER_CALL = 3;
-export declare const VERIFICATION_MAX_FINDINGS = 6;
-/** One judge request's ceiling and its retry budget. */
-export declare const VERIFICATION_CALL_TIMEOUT_MS = 120000;
+export declare const VERIFICATION_MAX_FINDINGS = 12;
+/**
+ * Default ceiling of ONE judge request. The effective ceiling is a row setting
+ * (`goalVerificationCallTimeoutSeconds`), read live by the gate, because 120s was
+ * tight for a reasoning model reading an 80,000 character trace with a 16,384
+ * token output cap: every timeout it produced was charged as an acceptance
+ * anomaly against a budget that then failed the card.
+ */
+export declare const VERIFICATION_CALL_TIMEOUT_MS = 150000;
 export declare const VERIFICATION_MAX_TOKENS = 16384;
 export declare const VERIFICATION_TEMPERATURE = 0.2;
 export declare const VERIFICATION_REQUEST_ATTEMPTS = 3;
 /** Redaction patterns, mirrored from the verifier's defaults. */
 export declare const VERIFICATION_REDACT_PATTERNS: readonly string[];
 /** Why one acceptance could not produce a verdict. */
-export type VerificationErrorKind = 'route-unavailable' | 'timeout' | 'auth' | 'parse' | 'request' | 'aborted';
+export type VerificationErrorKind = 'route-unavailable' | 'timeout' | 'auth' | 'parse' | 'request' | 'aborted' | 'budget';
+/**
+ * The time one acceptance attempt may still spend.
+ *
+ * `deadline` is the instant the whole attempt runs out; `callTimeoutMs` is the
+ * ceiling of a single judge call. The pair is what ties the retry budget to the
+ * acceptance budget: a call is not started unless its own ceiling still fits
+ * inside what is left, because starting one the outer budget will abort anyway
+ * only burns wall time and turns a slow machine into an anomaly.
+ */
+export interface AcceptanceBudget {
+    /** Absolute instant (ms epoch) the acceptance attempt runs out at. */
+    deadline: number;
+    /** Ceiling of one judge call in milliseconds. */
+    callTimeoutMs: number;
+    /** Clock the caller runs on, injected so tests drive it deterministically. */
+    now: () => number;
+}
 /** An acceptance anomaly: never a quality verdict, always recorded as one. */
 export declare class VerificationError extends Error {
     readonly kind: VerificationErrorKind;
@@ -89,8 +116,8 @@ export interface AcceptanceResult {
  * Run one acceptance: every criterion is judged twice, the odd round with the
  * A/B slots swapped, and the per-round scores are mapped back and averaged per
  * criterion.
- * @param input - the judge route, evidence, threshold and cancellation.
- * @returns the recorded attempt (quality verdict or anomaly).
+ * @param input - the judge route, evidence, threshold, time budget and cancellation.
+ * @returns the recorded attempt (quality verdict, anomaly, or budget stop).
  */
 export declare function runAcceptance(input: {
     llm: LlmRuntime;
@@ -99,6 +126,10 @@ export declare function runAcceptance(input: {
     threshold: number;
     index: number;
     signal: AbortSignal;
+    /** Instant (ms epoch) the attempt runs out at; defaults to now plus the default budget. */
+    deadline?: number;
+    /** Ceiling of one judge call; defaults to {@link VERIFICATION_CALL_TIMEOUT_MS}. */
+    callTimeoutMs?: number;
     /** Host-observed workspace changes, rendered as the prompt's reference context. */
     context?: string;
     /** How many changed files that context shows. */