tickmarkr 1.81.0 → 1.84.0

package/dist/gates/acceptance.js

@@ -3,7 +3,7 @@ import { channelKey, shq } from "../adapters/types.js";
 import { DEFAULT_DIFF_CAP } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { sh } from "../run/git.js";
-import { checkDiffCap, fetchTaskDiff } from "./review.js";
+import { checkDiffCap, fetchTaskDiff, isProtectedEvidence, setAsideReceiptPath } from "./review.js";
 import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
 // Fable F4: acceptance judge shares review's 900s timeout — 300s default killed frontier judges on cap-sized diffs.
 const JUDGE_TIMEOUT_MS = 900_000;
@@ -172,22 +172,51 @@ function compressLines(lines) {
     }
     return parts.join(", ");
 }
+const DIFF_SECTIONS = /(?=^diff --git )/m;
+// the a-side path of a whole-file deletion section, or null if this section is not one.
+function deletedPath(section) {
+    if (!/^deleted file mode /m.test(section))
+        return null;
+    const oldPath = /^--- (.+)$/m.exec(section)?.[1]
+        ?? /^Binary files (.+) and \/dev\/null differ$/m.exec(section)?.[1];
+    if (!oldPath || oldPath === "/dev/null")
+        return null;
+    const unquoted = oldPath.startsWith('"') && oldPath.endsWith('"') ? oldPath.slice(1, -1) : oldPath;
+    return unquoted.replace(/^a\//, "");
+}
 // OBS-134: whole-file deletions are already fully described by their path. Sending every removed line
 // spends the cap and judge context on content that cannot exist after the change. Added and modified
 // sections pass through byte-for-byte, so their anti-flooding budget is unchanged.
+// v1.82 T1 clause 5: two exemptions, because this filter triggers on the very `deleted file mode` line
+// the set-aside preserves. Protected evidence (the frozen anchors, the captured journals) bypasses the
+// collapse so its deletion half reaches the measured text and the judge complete; and a section already
+// set aside is never reduced a second time, or this filter would erase the receipt that replaced it.
 function judgeRelevantDiff(diff) {
-    return diff.split(/(?=^diff --git )/m).map((section) => {
-        if (!/^deleted file mode /m.test(section))
+    return diff.split(DIFF_SECTIONS).map((section) => {
+        if (setAsideReceiptPath(section))
             return section;
-        const oldPath = /^--- (.+)$/m.exec(section)?.[1]
-            ?? /^Binary files (.+) and \/dev\/null differ$/m.exec(section)?.[1];
-        if (!oldPath || oldPath === "/dev/null")
+        const path = deletedPath(section);
+        if (!path || isProtectedEvidence(path))
             return section;
-        const unquoted = oldPath.startsWith('"') && oldPath.endsWith('"') ? oldPath.slice(1, -1) : oldPath;
-        const path = unquoted.replace(/^a\//, "");
         return `deleted file: ${path}\n`;
     }).join("");
 }
+// v1.82 T1 clause 7: the two shapes this task creates carry no changed hunk, so a judge asked to cite a
+// changed line has nothing to cite — three review rounds died here. Each yields ONE citable operation
+// fact, `{path, line: 0}`, read back from the judged text itself. Only these RECORDED facts make line 0
+// citable; a zero line on any other path is still rejected as fabricated. Ordinary whole-file deletions
+// stay uncitable deliberately: the relevance filter collapses them before this runs, and repairing that
+// pre-existing limitation is outside this contract.
+const OPERATION_FACT_LINE = 0;
+function operationFactPaths(diff) {
+    return diff.split(DIFF_SECTIONS).flatMap((section) => {
+        const receipt = setAsideReceiptPath(section);
+        if (receipt)
+            return [receipt];
+        const path = deletedPath(section);
+        return path && isProtectedEvidence(path) ? [path] : [];
+    });
+}
 // A citation is valid evidence iff the cited line falls inside a changed hunk of the cited file (OBS-129:
 // changed-hunk span, not exact-added-line). A legacy free-text quote (string) keeps v1.64's substring
 // check — non-empty and present somewhere in the diff.
@@ -252,6 +281,16 @@ export async function acceptanceGate(task, worktree, baseRef, judge, via, opts =
     // OBS-129: give the judge the exact citable new-file line numbers per changed file, so it grounds each
     // citation in a real changed line instead of miscounting. Validated below against this same `changed`.
     const changed = changedLinesByFile(diff);
+    // clause 7: fold the recorded operation facts into the same index the validator checks, so a change
+    // made only of set-aside captures or removed protected evidence still yields citable evidence.
+    for (const path of operationFactPaths(diff)) {
+        let set = changed.get(path);
+        if (!set) {
+            set = new Set();
+            changed.set(path, set);
+        }
+        set.add(OPERATION_FACT_LINE);
+    }
     const citable = [...changed.entries()].map(([p, set]) => `- ${p}: ${compressLines([...set])}`).join("\n");
     const nonce = generateVerdictNonce();
     const prompt = `TICKMARKR-JUDGE
@@ -274,6 +313,9 @@ ${diff}
 
 ## Citable evidence lines (new-file line numbers inside the changed hunks above)
 ${citable || "(the diff changes no lines)"}
+Line 0 is a recorded file-operation fact, not a hunk line: the diff states what happened to that file
+(a set-aside regenerable capture, or a removed protected file) without carrying its content. Cite it as
+{"path": "<that path>", "line": 0} when a criterion is about that file.
 
 ${verdictNonceLine(nonce)}
 

package/dist/gates/llm.js

@@ -180,26 +180,41 @@ export function dewrapPaneVerdict(out, nonce) {
     if (!out.includes(nonce))
         return out;
     const lines = out.split("\n");
-    const start = lines.findIndex((line) => /^\s*(?:[•*-]\s+)?\{/.test(line));
-    if (start < 0)
-        return out;
-    for (let end = start; end < lines.length; end++) {
-        const joined = lines
-            .slice(start, end + 1)
-            .map((line, i) => (i === 0 ? line.replace(/^\s*(?:[•*-]\s+)?/, "") : line.replace(/^\s+/, "")))
-            .join("")
-            .trimEnd();
-        if (!joined.endsWith("}"))
-            continue;
-        try {
-            const parsed = JSON.parse(joined);
-            // the nonce IS the acceptance test — never reconstruct a verdict this call did not ask for
-            if (parsed && typeof parsed === "object" && parsed.nonce === nonce) {
-                return `${out}\n${joined}`;
+    // OBS-209: EVERY brace-start is a candidate, scanned newest-first. findIndex took only the first,
+    // so any earlier line beginning with `{` — a quoted snippet, a lone brace in the reviewer's own
+    // reasoning — captured the scan, and the real verdict below it was unreachable no matter how far
+    // the join extended. Measured on run-20260728-110135 T1: kimi's nonce-bound APPROVAL sat at line
+    // 382 behind a bare `{` at line 189, so a passing review was recorded `malformed-verdict` and
+    // parked the task. Newest-first matches extractJson, which takes the LAST balanced object.
+    const starts = [];
+    for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(?:[•*-]\s+)?\{/.test(lines[i]))
+            starts.push(i);
+    }
+    for (let si = starts.length - 1; si >= 0; si--) {
+        const start = starts[si];
+        for (let end = start; end < lines.length; end++) {
+            const joined = lines
+                .slice(start, end + 1)
+                .map((line, i) => (i === 0 ? line.replace(/^\s*(?:[•*-]\s+)?/, "") : line.replace(/^\s+/, "")))
+                .join("")
+                .trimEnd();
+            // ponytail: no verdict is a megabyte; abandon a runaway candidate rather than rejoin the
+            // whole transcript once per brace-start. Raise the ceiling if a real verdict ever exceeds it.
+            if (joined.length > 1_000_000)
+                break;
+            if (!joined.endsWith("}"))
+                continue;
+            try {
+                const parsed = JSON.parse(joined);
+                // the nonce IS the acceptance test — never reconstruct a verdict this call did not ask for
+                if (parsed && typeof parsed === "object" && parsed.nonce === nonce) {
+                    return `${out}\n${joined}`;
+                }
+            }
+            catch {
+                /* not yet a complete object — keep extending within the bounded region */
             }
-        }
-        catch {
-            /* not yet a complete object — keep extending within the bounded region */
         }
     }
     return out;

package/dist/gates/review.d.ts

@@ -20,6 +20,13 @@ export interface ReviewVerdict {
         body: string;
     }>;
 }
+export declare const REGENERABLE_CAPTURE_PATHS: readonly string[];
+export declare const PROTECTED_EVIDENCE_PREFIXES: readonly ["tests/fixtures/cockpit/anchors/", "tests/fixtures/cockpit/sources/", "tests/fixtures/cockpit/colour/sources/"];
+export declare function isProtectedEvidence(path: string): boolean;
+/** The `{path}` a set-aside receipt names, or null if this section carries no receipt. */
+export declare function setAsideReceiptPath(section: string): string | null;
+/** Replace the content of every section confined to the regenerable frame corpora with a receipt. */
+export declare function setAsideRegenerableCaptures(diff: string): string;
 export declare function fetchTaskDiff(worktree: string, baseRef: string): Promise<{
     full: string;
     forCap: string;
@@ -30,4 +37,5 @@ export declare function diffCapParkReason(results: GateResult[]): string | null;
 export declare function modelId(model: string): string;
 export declare function pickReviewer(author: Assignment, channels: BillingChannel[], exclude?: string[], // v1.1 failover: reviewer channels that already produced garbage for this task
 prefer?: string[]): BillingChannel | null;
-export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[]): Promise<GateResult>;
+export type ReviewUnparseableCause = "empty-output" | "no-verdict" | "malformed-verdict";
+export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string): Promise<GateResult>;

package/dist/gates/review.js

@@ -1,8 +1,11 @@
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
 import { channelKey } from "../adapters/types.js";
 import { DEFAULT_DIFF_CAP, TIER_RANK } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
+import { redactSecrets } from "../run/redact.js";
 import { marginalCostRank } from "../route/router.js";
 import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
 // legacy flat `issues` shape — every issue blocks; the approve flag must agree with the list.
@@ -65,9 +68,152 @@ function classifyReviewFindings(findings) {
 // OBS-48: cap on zero-context diff bytes (git diff -U0), not context-padded full diff — scattered
 // one-line hunks no longer trip at ~370 diff-bytes per changed line. Full diff still goes to the judge.
 const DIFF_CAP_REMEDY = "split the task, or raise gates.diffCap";
+// v1.82 T1 — the cap bounds what a READER MUST READ, not what a run must write. A regeneration of the
+// frame corpora is ~134KB of `-U0` measurement before a source line changes, and nobody reads it: those
+// frames are asserted byte-for-byte by the corpus tests. Counting them is the category error this
+// removes. The two artifacts stay two (OBS-48: the cap measures -U0, the reader receives the full diff);
+// the exclusion is applied to both, identically, right here so BOTH measuring gates inherit it.
+//
+// Clause 1 — membership is an EXACT PATH match against the shipped capture manifest, the same lists the
+// regeneration path itself uses. Location, directory depth and file extension confer nothing: an
+// unmanifested file sitting beside real frames is measured and shown in full. (The anchors deliberately
+// share basenames with the frames; only the full path separates the oracle from its regenerable twin.)
+//
+// The members are LISTED here rather than imported from the manifest module, for one measured reason:
+// that module is the Ink/React renderer, and importing it puts the whole TUI in every gate's module
+// graph — which also memoises chalk's colour level at import time and turns the fleet suite red. A
+// drift test in tests/gates/diff-cap.test.ts asserts this list is exactly GOLDEN_FRAME_CASES +
+// COLOUR_FRAME_CASES and that every entry exists on disk, so it is a copy that cannot drift rather
+// than a second source of truth: add or rename a frame case and that test goes red until this matches.
+export const REGENERABLE_CAPTURE_PATHS = [
+    "tests/fixtures/cockpit/frames/run.width-stacked.80x24.txt",
+    "tests/fixtures/cockpit/frames/run.width-folded-keys.100x24.txt",
+    "tests/fixtures/cockpit/frames/run.width-three-column.140x24.txt",
+    "tests/fixtures/cockpit/frames/run.height-14.140x14.txt",
+    "tests/fixtures/cockpit/frames/run.height-18.140x18.txt",
+    "tests/fixtures/cockpit/frames/run.height-24.140x24.txt",
+    "tests/fixtures/cockpit/frames/run.height-40.140x40.txt",
+    "tests/fixtures/cockpit/frames/run.no-colour.140x24.txt",
+    "tests/fixtures/cockpit/frames/run.non-tty.140x24.txt",
+    "tests/fixtures/cockpit/frames/run.ci.140x24.txt",
+    "tests/fixtures/cockpit/frames/setup.width-stacked.80x24.txt",
+    "tests/fixtures/cockpit/frames/setup.width-folded-keys.100x24.txt",
+    "tests/fixtures/cockpit/frames/setup.width-three-column.140x24.txt",
+    "tests/fixtures/cockpit/frames/setup.height-14.140x14.txt",
+    "tests/fixtures/cockpit/frames/setup.height-18.140x18.txt",
+    "tests/fixtures/cockpit/frames/setup.height-24.140x24.txt",
+    "tests/fixtures/cockpit/frames/setup.height-40.140x40.txt",
+    "tests/fixtures/cockpit/frames/setup.no-colour.140x24.txt",
+    "tests/fixtures/cockpit/frames/setup.non-tty.140x24.txt",
+    "tests/fixtures/cockpit/frames/setup.ci.140x24.txt",
+    "tests/fixtures/cockpit/colour/run-20260718-000943.colour.140x24.txt",
+    "tests/fixtures/cockpit/colour/run-20260718-000943.no-colour.140x24.txt",
+    "tests/fixtures/cockpit/colour/run-20260725-025004.interrupted.colour.140x24.txt",
+];
+const CAPTURE_MANIFEST = new Set(REGENERABLE_CAPTURE_PATHS);
+// Clause 2 — the frozen appearance anchors and the captured engagement journals are NEVER set aside and
+// are exempt from every other reduction too (clause 5): they are reviewed, immutable evidence. The
+// anchors are the oracle this milestone declares, and the fixture law bans editing a captured journal to
+// satisfy an assertion — so both keep counting toward the cap and keep reaching a reader verbatim.
+export const PROTECTED_EVIDENCE_PREFIXES = [
+    "tests/fixtures/cockpit/anchors/",
+    "tests/fixtures/cockpit/sources/",
+    "tests/fixtures/cockpit/colour/sources/",
+];
+export function isProtectedEvidence(path) {
+    return PROTECTED_EVIDENCE_PREFIXES.some((prefix) => path.startsWith(prefix));
+}
+const SET_ASIDE_RECEIPT = /^set aside: regenerable capture (.+?) — \d+ bytes withheld\b/m;
+/** The `{path}` a set-aside receipt names, or null if this section carries no receipt. */
+export function setAsideReceiptPath(section) {
+    return SET_ASIDE_RECEIPT.exec(section)?.[1] ?? null;
+}
+// `--- a/x` / `+++ b/x` → "x"; "/dev/null" → null, which is the ABSENCE of a side, not a membership
+// failure (clause 3). git quotes paths carrying specials, so unquote before stripping the a/ b/ prefix.
+function diffSidePath(raw) {
+    const v = raw.trim();
+    if (v === "/dev/null")
+        return null;
+    const unquoted = v.startsWith('"') && v.endsWith('"') ? v.slice(1, -1) : v;
+    return unquoted.replace(/^[ab]\//, "");
+}
+// The `--- a/x` / `+++ b/x` header pair and the hunk lines below it. Clause 4 — null when the section
+// carries NO content hunk at all (a mode-only change, a pure rename, a binary marker): such a section is
+// left exactly as git wrote it rather than handed a manufactured receipt.
+function parseSection(section) {
+    const lines = section.split("\n");
+    const minus = lines.findIndex((l) => l.startsWith("--- "));
+    if (minus === -1 || !lines[minus + 1]?.startsWith("+++ "))
+        return null;
+    const body = lines.slice(minus + 2);
+    if (!body.some((l) => l.startsWith("@@ ")))
+        return null;
+    return { lines, minus, sides: [diffSidePath(lines[minus].slice(4)), diffSidePath(lines[minus + 1].slice(4))], body };
+}
+// The content a one-sided section carries: its hunk lines with the sign stripped, keeping git's
+// `` markers so a trailing-newline difference still reads as a content
+// difference. Hunk headers are dropped — a delete and an add of the same bytes never share them.
+function hunkPayload(body, sign) {
+    return body.filter((l) => l.startsWith(sign) || l.startsWith("\\")).map((l) => (l[0] === sign ? l.slice(1) : l)).join("\n");
+}
+// Clause 4 — a hunk is NOT proof of a content change. Git spells a KIND change (regular file ⇄ symlink)
+// as a delete plus an add of the SAME path, each carrying a hunk, so when the regular file's bytes are
+// exactly the link target both halves carry identical payloads: the kind changed and the content did
+// not. Nothing was withheld, so neither half earns a receipt — and neither half can see the other, so
+// the pairing is found across sections before any one of them is set aside.
+function kindOnlyPaths(sections) {
+    const removed = new Map();
+    const added = new Map();
+    for (const section of sections) {
+        const parsed = parseSection(section);
+        if (!parsed)
+            continue;
+        const [a, b] = parsed.sides;
+        if (a && !b)
+            removed.set(a, hunkPayload(parsed.body, "-"));
+        else if (b && !a)
+            added.set(b, hunkPayload(parsed.body, "+"));
+    }
+    return new Set([...removed].filter(([path, payload]) => added.get(path) === payload).map(([path]) => path));
+}
+function setAsideSection(section, kindOnly) {
+    const parsed = parseSection(section);
+    if (!parsed)
+        return section;
+    const { lines, minus, sides } = parsed;
+    // Clause 3 — the test is over the sides that name a real file. Requiring BOTH sides to be members
+    // makes every corpus addition (a-side /dev/null) and deletion (b-side /dev/null) ineligible, which is
+    // exactly the frames this milestone adds. A rename crossing the boundary in either direction has two
+    // real sides and one of them is not a member, so it stays whole — `rename from` line included.
+    const named = sides.filter((p) => p !== null);
+    if (!named.length || !named.every((p) => CAPTURE_MANIFEST.has(p)))
+        return section;
+    // Clause 4 — both halves of a content-identical kind change are left exactly as git wrote them. A
+    // kind change that DID move bytes is an ordinary content change and is set aside like any other.
+    if (named.some((p) => kindOnly.has(p)))
+        return section;
+    const withheld = lines.slice(minus).join("\n");
+    // Clause 6 — the claimed size is the UTF-8 BYTE length of what was withheld (the file headers and
+    // hunks this receipt replaces), never a JavaScript string length: box-drawing frames make the two
+    // disagree. And the receipt itself is part of the measured artifact, so N set-aside sections can never
+    // measure as nothing while producing an arbitrarily large reader payload.
+    const receipt = `set aside: regenerable capture ${named.at(-1)} — ${Buffer.byteLength(withheld, "utf8")} bytes withheld (regenerable frame corpus: asserted byte-for-byte by the corpus tests, never read)`;
+    // Clause 4 — everything git said happened survives verbatim: old/new mode, new file mode, deleted file
+    // mode, similarity index, rename from/to, index. Only content is replaced, so a deletion is never
+    // presented as a file that still exists and an addition is never presented as a modification.
+    return `${lines.slice(0, minus).join("\n")}\n${receipt}\n`;
+}
+/** Replace the content of every section confined to the regenerable frame corpora with a receipt. */
+export function setAsideRegenerableCaptures(diff) {
+    if (!diff.includes("diff --git "))
+        return diff;
+    const sections = diff.split(/(?=^diff --git )/m);
+    const kindOnly = kindOnlyPaths(sections);
+    return sections.map((s) => setAsideSection(s, kindOnly)).join("");
+}
 export async function fetchTaskDiff(worktree, baseRef) {
-    const full = await shOk(`git diff '${baseRef}..HEAD'`, worktree);
-    const forCap = await shOk(`git diff -U0 '${baseRef}..HEAD'`, worktree);
+    const full = setAsideRegenerableCaptures(await shOk(`git diff '${baseRef}..HEAD'`, worktree));
+    const forCap = setAsideRegenerableCaptures(await shOk(`git diff -U0 '${baseRef}..HEAD'`, worktree));
     return { full, forCap };
 }
 export function checkDiffCap(gate, measured, cap, prefix = "") {
@@ -119,15 +265,20 @@ prefer = []) {
         .filter((c) => c.vendor !== authorChannel.vendor && modelId(c.model) !== modelId(author.model) && !exclude.includes(channelKey(c)))
         .sort((a, b) => reviewPreferIndex(a, prefer) - reviewPreferIndex(b, prefer) || TIER_RANK[b.tier] - TIER_RANK[a.tier] || marginalCostRank(a) - marginalCostRank(b))[0] ?? null);
 }
-export async function reviewGate(task, worktree, baseRef, author, channels, adapters, cfg, via, excludeReviewers) {
+export async function reviewGate(task, worktree, baseRef, author, channels, adapters, cfg, via, excludeReviewers, 
+// OBS-196: run dir for raw-output persistence on an unparseable verdict; absent (older callers,
+// direct tests) skips persistence and changes nothing else.
+artifactDir) {
     if (task.complexity < cfg.review.complexityThreshold) {
         return { gate: "review", pass: true, details: `skipped — complexity ${task.complexity} < threshold ${cfg.review.complexityThreshold}`, meta: { skipped: true } };
     }
     const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? []);
     if (!reviewer) {
+        // meta.noEligibleReviewer lets run-gates' review-retry keep the ORIGINAL unparseable result when
+        // the retry finds no second seat — a truthful cause beats a synthetic no-reviewer failure.
         return cfg.review.required
-            ? { gate: "review", pass: false, details: "no cross-vendor reviewer available (diversity rule); set review.required:false to waive" }
-            : { gate: "review", pass: true, details: "WARNING: no cross-vendor reviewer available — review waived by config" };
+            ? { gate: "review", pass: false, details: "no cross-vendor reviewer available (diversity rule); set review.required:false to waive", meta: { noEligibleReviewer: true } }
+            : { gate: "review", pass: true, details: "WARNING: no cross-vendor reviewer available — review waived by config", meta: { noEligibleReviewer: true } };
     }
     const { full: diff, forCap } = await fetchTaskDiff(worktree, baseRef);
     const diffCap = cfg.gates.diffCap ?? DEFAULT_DIFF_CAP;
@@ -173,11 +324,26 @@ The top-level comments array is optional. Use it only for actionable line-anchor
     const findings = v && Array.isArray(v.findings) ? v.findings : null;
     // findings decides the verdict on its own; the legacy path still needs approve + issues to parse.
     if (!v || (findings === null && (typeof v.approve !== "boolean" || !Array.isArray(v.issues)))) {
+        // OBS-196: name the cause and persist the raw bytes — a ruled-on "unparseable" without its
+        // evidence cannot be audited, and a cutoff must never be indistinguishable from a parse defect.
+        const cause = raw.trim().length === 0
+            ? "empty-output"
+            : !raw.includes(nonce) ? "no-verdict" : "malformed-verdict";
+        let saved;
+        if (artifactDir) {
+            try {
+                saved = join(artifactDir, `review-raw-${task.id}-${Date.now()}.txt`);
+                writeFileSync(saved, redactSecrets(raw));
+            }
+            catch {
+                saved = undefined; // persistence is evidence, not a gate input — never fail the gate on it
+            }
+        }
         return {
             gate: "review",
             pass: false,
-            details: `review output unparseable (reviewer ${reviewer.adapter}:${reviewer.model}) — failing closed`,
-            meta: { reviewer: channelKey(reviewer) },
+            details: `review output unparseable (reviewer ${reviewer.adapter}:${reviewer.model}; cause: ${cause}${saved ? `; raw saved: ${saved}` : ""}) — failing closed`,
+            meta: { reviewer: channelKey(reviewer), unparseable: true, cause },
         };
     }
     const decided = findings !== null

package/dist/gates/run-gates.d.ts

@@ -26,6 +26,7 @@ export interface GateContext {
     cfg: TickmarkrConfig;
     via?: GateVia;
     excludeReviewers?: string[];
+    artifactDir?: string;
     onGate?: (e: GateEvent) => void | Promise<void>;
 }
 export declare function runGates(task: Task, ctx: GateContext): Promise<{

package/dist/gates/run-gates.js

@@ -128,7 +128,24 @@ export async function runGates(task, ctx) {
     // 5. cross-vendor review
     if (enabled("review")) {
         await emitStart("review");
-        await record(await reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, ctx.adapters, ctx.cfg, ctx.via, ctx.excludeReviewers));
+        let rv = await reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, ctx.adapters, ctx.cfg, ctx.via, ctx.excludeReviewers, ctx.artifactDir);
+        // OBS-193: an unparseable review verdict retries the REVIEW exactly once on a different reviewer —
+        // never the worker (GATE-09's judge-retry shape: straight-line single `if`, meta-only detection,
+        // the flaked verdict never enters results). The exclusion rides reviewGate's own excludeReviewers
+        // parameter, so pickReviewer's diversity rules still govern the retry seat; a fleet with no second
+        // eligible seat keeps the ORIGINAL result so the recorded cause stays truthful (OBS-196).
+        if (rv.meta?.unparseable === true && typeof rv.meta.reviewer === "string") {
+            const flaked = rv.meta.reviewer;
+            const retryVia = ctx.via
+                ? { ...ctx.via, nameFor: (role, adapter) => ctx.via.nameFor(role, adapter) + "-r1" }
+                : undefined;
+            const second = await reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, ctx.adapters, ctx.cfg, retryVia, [...(ctx.excludeReviewers ?? []), flaked], ctx.artifactDir);
+            if (second.meta?.noEligibleReviewer !== true) {
+                const retried = typeof second.meta?.reviewer === "string" ? second.meta.reviewer : "none";
+                rv = { ...second, meta: { ...second.meta, reviewRetry: { flaked, retried } } };
+            }
+        }
+        await record(rv);
     }
     return { results, commits };
 }

package/dist/report/bundle.d.ts

@@ -1,7 +1,8 @@
 import type { EvidenceCitation } from "../gates/acceptance.js";
 import type { RunEnvironment } from "../run/environment.js";
 import type { JournalEvent } from "../run/journal.js";
-export declare const BUNDLE_SCHEMA_VERSION = 1;
+export declare const BUNDLE_SCHEMA_VERSION = 2;
+export declare const gateDeclined: (data: Record<string, unknown>) => boolean;
 export declare const KNOWN_LIMITS: readonly string[];
 export type BundleEvidence = string | EvidenceCitation;
 export interface BundleJudgeCriterion {
@@ -12,7 +13,11 @@ export interface BundleJudgeCriterion {
 }
 export interface BundleGateResult {
     gate: string;
+    /** true only when the gate actually ran and passed — a declined gate is never counted as passed. */
     pass: boolean;
+    /** T11: true when the gate declined to run (journaled skipped:true, e.g. review below its
+     * complexity threshold) — neither a pass nor a fail; the details carry the reason. */
+    declined?: boolean;
     details: string;
 }
 export interface BundleTask {

package/dist/report/bundle.js

@@ -6,7 +6,15 @@ import { createHash } from "node:crypto";
 import { redactSecrets } from "../run/redact.js";
 import { recordedEnvironment } from "./compare.js";
 // Bump when the packet shape changes in a way a future reader must branch on before parsing.
-export const BUNDLE_SCHEMA_VERSION = 1;
+// 2 (T11): gates gained `declined`, and `pass` narrowed from "the gate did not fail" to "the gate
+// ran and passed" — a schema-1 reader would read a decline as a plain failure.
+export const BUNDLE_SCHEMA_VERSION = 2;
+// T11: the one predicate every decline surface shares — the record, the text tickmark rate, the
+// comparison metrics and this packet must agree on what "never ran" means. Modern runs journal
+// `skipped: true`; runs from before that field carry the same decline only in the details prefix
+// ("skipped — complexity 4 < threshold 7"). The ^ anchor is load-bearing: a review that genuinely
+// ran can mention a skipped something mid-body, and that gate is a pass.
+export const gateDeclined = (data) => data.skipped === true || /^skipped\b/.test(String(data.details ?? ""));
 // Plain-language known limits — the packet is a journal snapshot, not an unconditional proof.
 export const KNOWN_LIMITS = [
     "This packet is a portable snapshot of journaled run facts, not an independent re-verification of the work or its gates.",
@@ -127,9 +135,11 @@ export function buildProofBundle(runId, events) {
         const judgeCriteria = [];
         for (const g of gateEvents) {
             const gate = typeof g.data.gate === "string" ? g.data.gate : "unknown";
-            const pass = g.data.pass === true;
+            // T11: a declined gate never ran — flagged declined, never a pass.
+            const declined = gateDeclined(g.data);
+            const pass = g.data.pass === true && !declined;
             const details = typeof g.data.details === "string" ? g.data.details : "";
-            gates.push({ gate, pass, details });
+            gates.push({ gate, pass, ...(declined ? { declined: true } : {}), details });
             if (gate === "acceptance") {
                 for (const c of parseJudgeCriteria(g.data))
                     judgeCriteria.push(c);

package/dist/run/daemon.d.ts

@@ -46,4 +46,9 @@ export declare const EARLY_LAUNCH_LIVENESS_MS = 60000;
 /** Test seam — lowers the empty-pane liveness window without sleeping 60s per case. */
 export declare function setEarlyLaunchLivenessMsForTests(ms: number): void;
 export declare function resetEarlyLaunchLivenessMsForTests(): void;
+export declare const NUDGEABLE_ADAPTERS: Set<string>;
+export declare const WORKER_NUDGE_MESSAGE = "tickmarkr liveness check: if the task is complete, print your TICKMARKR_RESULT completion trailer exactly as specified in your prompt now. If not, state your next concrete action and continue working.";
+/** Test seam — shrink the nudge gate and grace without minute-long sleeps. */
+export declare function setNudgeTimingForTests(silentMs: number, graceMs: number): void;
+export declare function resetNudgeTimingForTests(): void;
 export declare function runDaemon(repoRoot: string, opts?: RunOptions): Promise<RunSummary>;