tickmarkr 1.86.0 → 1.89.0

package/dist/compile/collateral.js

@@ -121,14 +121,14 @@ export function collateralLints(tasks, repoRoot) {
                 continue;
             if (mentions(text, needles))
                 hits.push(tf);
-            if (hits.length >= MAX_HITS_PER_TASK)
-                break;
         }
         if (!hits.length)
             continue;
         // deterministic: walk already sorted; stable list
-        const listed = hits.join(", ");
-        const tail = hits.length >= MAX_HITS_PER_TASK ? " (capped)" : "";
+        const listed = hits.slice(0, MAX_HITS_PER_TASK).join(", ");
+        const tail = hits.length > MAX_HITS_PER_TASK
+            ? ` (${hits.length} total; capped at ${MAX_HITS_PER_TASK} shown)`
+            : "";
         lines.push(`${t.id}: likely collateral tests not in files[]: ${listed}${tail}`);
     }
     return lines;

package/dist/compile/index.d.ts

@@ -1,4 +1,15 @@
-import type { RunGraph } from "../graph/schema.js";
-type SourceType = "speckit" | "gsd" | "prd" | "native";
-export declare function compileSource(src: string, type?: SourceType, root?: string): RunGraph;
+import { type RunGraph, type SpecSource } from "../graph/schema.js";
+type SourceType = SpecSource;
+export type PlanIR = {
+    version: RunGraph["version"];
+    source: RunGraph["spec"]["source"];
+    paths: RunGraph["spec"]["paths"];
+    hash: RunGraph["spec"]["hash"];
+    base?: RunGraph["spec"]["base"];
+    mode?: RunGraph["mode"];
+    tasks: RunGraph["tasks"];
+};
+export type PlanFinalizationHook = (plan: PlanIR) => PlanIR;
+export declare function finalizePlan(plan: PlanIR, src: string): RunGraph;
+export declare function compileSource(src: string, type?: SourceType, root?: string, beforeFinalize?: PlanFinalizationHook): RunGraph;
 export {};

package/dist/compile/index.js

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
+import { validateGraph } from "../graph/schema.js";
 import { taskUnitContractErrors } from "./collateral.js";
 import { CompileError } from "./common.js";
 import { compileGsd, isGsdPhaseDir } from "./gsd.js";
@@ -39,15 +40,40 @@ function enforceTaskUnitContract(g, src) {
     }
     return g;
 }
-export function compileSource(src, type, root) {
+export function finalizePlan(plan, src) {
+    const graph = validateGraph({
+        version: plan.version,
+        ...(plan.mode !== undefined ? { mode: plan.mode } : {}),
+        spec: {
+            source: plan.source,
+            paths: plan.paths,
+            hash: plan.hash,
+            ...(plan.base !== undefined ? { base: plan.base } : {}),
+        },
+        tasks: plan.tasks,
+    });
+    return enforceTaskUnitContract(graph, src);
+}
+function compilePlan(src, type, root) {
     const kind = type ?? detect(src);
-    if (kind === "speckit")
-        return enforceTaskUnitContract(compileSpecKit(src), src);
-    if (kind === "gsd")
-        return enforceTaskUnitContract(compileGsd(src, root), src);
-    if (kind === "native")
-        return enforceTaskUnitContract(compileNative(src), src);
-    if (kind === "prd")
-        return enforceTaskUnitContract(compilePrd(src), src);
-    throw new CompileError(`cannot detect spec type for ${src} — pass a Spec Kit feature dir (with tasks.md), a GSD phase dir (with *-PLAN.md), or a marked native/generic PRD .md file, or use --type speckit|prd|gsd|native`);
+    const graph = kind === "speckit" ? compileSpecKit(src)
+        : kind === "gsd" ? compileGsd(src, root)
+            : kind === "native" ? compileNative(src)
+                : kind === "prd" ? compilePrd(src)
+                    : null;
+    if (!graph) {
+        throw new CompileError(`cannot detect spec type for ${src} — pass a Spec Kit feature dir (with tasks.md), a GSD phase dir (with *-PLAN.md), or a marked native/generic PRD .md file, or use --type speckit|prd|gsd|native`);
+    }
+    return {
+        version: graph.version,
+        source: graph.spec.source,
+        paths: graph.spec.paths,
+        hash: graph.spec.hash,
+        ...(graph.spec.base !== undefined ? { base: graph.spec.base } : {}),
+        ...(graph.mode !== undefined ? { mode: graph.mode } : {}),
+        tasks: graph.tasks,
+    };
+}
+export function compileSource(src, type, root, beforeFinalize = (plan) => plan) {
+    return finalizePlan(beforeFinalize(compilePlan(src, type, root)), src);
 }

package/dist/compile/native.js

@@ -82,14 +82,27 @@ export function compileNative(file) {
     const drafts = [];
     let plainCount = 0; // v1.19: plain-string acceptance items compiled as judge oracles (compat) — warn once
     let specMode;
-    for (const line of content.split("\n")) {
+    let specBase;
+    for (const [index, line] of content.split("\n").entries()) {
         const heading = line.match(HEAD_RE);
         if (heading) {
-            drafts.push({ id: heading[1], title: heading[2].trim(), fields: {}, acceptance: [], gates: [], hasGates: false, list: null, continuationField: null });
+            drafts.push({ id: heading[1], title: heading[2].trim(), fields: {}, acceptanceRaw: [], acceptance: [], gates: [], hasGates: false, list: null, itemOpen: false, continuationField: null });
             continue;
         }
         const draft = drafts.at(-1);
         if (!draft) {
+            const base = line.match(/^base:\s*(.*)$/);
+            if (base) {
+                const value = base[1].trim();
+                if (!value) {
+                    throw new CompileError("spec front-matter base must not be empty — repair: write lower-case base: <commit-or-ref> at column zero");
+                }
+                specBase = value;
+                continue;
+            }
+            if (/^Base:\s*/.test(line)) {
+                throw new CompileError("native task unit contract rejects column-zero Base: as untyped prose — repair: write lower-case base: <commit-or-ref>");
+            }
             // v1.51 T2: spec front-matter — a top-level `mode: <name>` line before the first task heading
             // declares the engagement's routing mode (loses only to an explicit run flag).
             const fm = line.match(/^mode:\s*(\S+)\s*$/);
@@ -107,6 +120,7 @@ export function compileNative(file) {
             if (!FIELDS.has(name))
                 invalid(draft.id, field[1], "is unknown");
             const value = field[2].trim();
+            draft.itemOpen = false;
             if (name === "acceptance" || name === "gates") {
                 if (value)
                     invalid(draft.id, field[1], "must be a nested list");
@@ -155,31 +169,51 @@ export function compileNative(file) {
             const value = nested[1].trim();
             if (!value)
                 invalid(draft.id, draft.list, "must not contain empty entries");
-            // v1.19: only the acceptance list parses typed oracle prefixes; gates stay plain names.
-            if (draft.list === "acceptance") {
-                const typed = value.match(ORACLE_RE);
-                if (typed) {
-                    const [, kind, body] = typed;
-                    if (!body.trim())
-                        invalid(draft.id, "acceptance", `${kind} oracle must carry a value`);
-                    draft.acceptance.push(kind === "command" ? { oracle: "command", command: body.trim() }
-                        : kind === "test" ? { oracle: "test", test: body.trim() }
-                            : { oracle: "judge", text: body.trim() });
-                }
-                else {
-                    plainCount++;
-                    draft.acceptance.push(value);
-                }
-            }
-            else {
-                draft[draft.list].push(value);
-            }
+            (draft.list === "acceptance" ? draft.acceptanceRaw : draft.gates).push(value);
+            draft.itemOpen = true;
+            continue;
+        }
+        // OBS-488: a deeper-indented non-item line under a list item is that item's wrapped
+        // continuation — join with a single space, exactly as OBS-60/OBS-308 guarantee for fields.
+        // 1.87.0 dropped these lines silently: 53/78 of run-551's criteria compiled to first-line
+        // stubs and every falsifier tail was invisible to the judge.
+        if (draft.list && draft.itemOpen && (line.startsWith(" ") || line.startsWith("\t")) && line.trim()) {
+            const items = draft.list === "acceptance" ? draft.acceptanceRaw : draft.gates;
+            items[items.length - 1] += ` ${line.trim()}`;
             continue;
         }
         if (line.startsWith("- "))
             invalid(draft.id, "field", `bullet is malformed: ${JSON.stringify(line)}`);
-        if (line.trim() && !line.startsWith(" "))
-            draft.list = null;
+        if (!line.trim()) {
+            draft.itemOpen = false;
+            continue;
+        }
+        // OBS-488 fail-closed invariant: a non-blank line inside a task block that no rule consumes
+        // is an error, never a silent drop — dropping author bytes is the meta-defect that hid the
+        // criterion truncation for months.
+        throw new CompileError(`Task ${draft.id} line ${index + 1}: no parse rule consumes this line: ${JSON.stringify(line)}.\n` +
+            `A non-blank line in a task block must be a "- field:" bullet, a "  - " list item, or an\n` +
+            `indented continuation of the preceding field or list item. tickmarkr refuses to silently\n` +
+            `drop spec bytes (OBS-488) — move prose above the first task heading or into a field.`);
+    }
+    // OBS-488: typed-oracle prefixes parse on the COMPLETE joined item text, never its first
+    // physical line — a wrapped `command:` body or falsifier tail is part of the criterion.
+    for (const draft of drafts) {
+        for (const raw of draft.acceptanceRaw) {
+            const typed = raw.match(ORACLE_RE);
+            if (typed) {
+                const [, kind, body] = typed;
+                if (!body.trim())
+                    invalid(draft.id, "acceptance", `${kind} oracle must carry a value`);
+                draft.acceptance.push(kind === "command" ? { oracle: "command", command: body.trim() }
+                    : kind === "test" ? { oracle: "test", test: body.trim() }
+                        : { oracle: "judge", text: body.trim() });
+            }
+            else {
+                plainCount++;
+                draft.acceptance.push(raw);
+            }
+        }
     }
     if (!drafts.length) {
         throw new CompileError(`${file} has no task sections. Expected "## T1: Title" headings with field bullets.`);
@@ -358,7 +392,12 @@ export function compileNative(file) {
     const result = validateGraph({
         version: 1,
         ...(specMode ? { mode: specMode } : {}),
-        spec: { source: "native", paths: [file], hash: sha256(content) },
+        spec: {
+            source: "native",
+            paths: [file],
+            hash: sha256(content),
+            ...(specBase !== undefined ? { base: specBase } : {}),
+        },
         tasks,
     });
     // v1.19 read-old/write-new: a plain-string acceptance item compiles as a judge oracle. This is the
@@ -378,7 +417,7 @@ export function compileNative(file) {
     // OBS-170/OBS-184: warn per unreachable context: entry, classified by the action its author must
     // take. Warn-only by operator ruling (2026-08-03) — fail-closed would have refused to compile the
     // spec that shipped green. Fails open when git cannot answer, so non-repo fixtures stay silent.
-    const repo = trackedAtHead(dirname(file));
+    const repo = tasks.some((task) => task.context.length > 0) ? trackedAtHead(dirname(file)) : undefined;
     if (repo) {
         const unreachable = [];
         for (const t of tasks) {
@@ -419,6 +458,8 @@ acceptance is required on every task (a nested list of observable outcomes).
   Spec front-matter (top-level, before the first task heading):
     mode: partner-led | risk-based | staff-led — this engagement's routing mode
           (loses only to an explicit \`run --mode\` flag)
+    base: commit-or-ref — optional declared source base; the declaration must begin at column zero
+                          (runtime enforcement happens before a run)
 
   Fields available per task:
     goal:        outcome the task must achieve (defaults to the title if omitted)
@@ -450,6 +491,10 @@ acceptance is required on every task (a nested list of observable outcomes).
   WHAT MAKES A CRITERION REAL:
     - "test:" must name a real test asserting on recorded state, journal lines, or drawn frames, and its
       title must match the criterion string verbatim. It also needs a collectable test path in files[].
+    - A "test:" oracle must name a TOP-LEVEL test case, never one nested under describe(). Vitest prefixes
+      nested cases with every suite title, while the acceptance gate builds an anchored pattern that
+      vitest -t applies against the FULL runner-visible name; the verbatim leaf title then selects ZERO
+      tests and the gate parks even though the suite is green. Measured: two parks in one run.
     - NO criterion may be satisfiable by an absence, a rename, a source-text grep, or an empty collection.
       "no file references X" is not a criterion — it passes in a repo where the feature was never built.
     - "goal:" is NEVER verification. Prose in the goal enforces nothing: every obligation needs an
@@ -457,6 +502,35 @@ acceptance is required on every task (a nested list of observable outcomes).
       task that owns both the thing it checks and the fixture it checks against.
     - A source-only obligation (a comment or doc that a change makes false) has no lawful "test:" — verify
       it with "judge:", which reads the DIFF and must cite a changed line in a file the task owns.
+    - A criterion that pins the SHAPE of a fix must also pin the CONDITIONS under which it runs, or a
+      correctly-shaped fix that runs SOMETIMES satisfies it. "cleanup is try/finally at all four sites"
+      is satisfied by \`finally { if (cond) cleanup() }\` — the shape is present and the fix is inert in
+      production. Say UNCONDITIONAL, or name the branch that may not exist.
+    - Ask of every criterion: COULD THIS BE SATISFIED BY CODE THAT NOTHING OUTSIDE THE TEST SUITE CALLS?
+      A criterion naming a CAPABILITY is satisfiable by a stub whose only caller is its own test, and the
+      judge cannot catch it — it reads the DIFF, and a stub's hunks are real. Name the PRODUCTION CALLER
+      that must exercise the capability, and the path it runs on; "X is supported" ships as dead code.
+    - Enumerating one axis exhaustively is what hides the others. A spec that guards PARTIAL coverage
+      site-by-site, member-by-member, can be defeated wholesale by CONDITIONAL coverage, which leaves
+      every enumeration satisfied. After you enumerate, ask what a single flag would do to the whole set.
+    - A criterion that names a behaviour must name the VALUE AT WHICH IT WOULD BREAK. Every criterion is a
+      claim about a variable — a status, a width, a count, an arrival time — and if it does not say which
+      value of that variable is the hard one, THE TEST WILL CHOOSE THE EASY ONE AND BE GREEN. Measured: a
+      grace-window criterion whose tests pinned pane status to "working" when the defect needed "blocked";
+      a width criterion tested at 2-cell task ids when the schema permits 64; a fork-budget criterion
+      tested only where concurrency <= cores when config accepts every positive integer. Each was
+      satisfied exactly as written, and each shipped the defect. State six things per criterion:
+        1. the PRODUCTION ENTRY POINT and the FINAL OBSERVABLE — what a caller invokes, what a reader sees;
+        2. the AUTHORITATIVE SOURCE of each value, never a nearby re-derivation that can disagree with it;
+        3. the QUANTIFIER, or the closed subject set the claim ranges over;
+        4. the VARIABLE whose change could falsify the claim;
+        5. TWO DISCRIMINATING CASES that vary that variable — or the invariance relation, if the claim is
+           that varying it changes nothing — drawn from the FULL domain the system accepts, never a
+           convenient subrange, because the domain is chosen by whoever must satisfy the criterion;
+        6. the concrete FALSE-CLEAN case: what a passing test would look like if the mechanism were absent.
+      A criterion that cannot name (4) is a claim about nothing and its test cannot fail. If (5) has no
+      hard value anywhere in the domain, the criterion asserts a universal that may be FALSE ABOUT THE
+      WORLD — bound it or say where it stops holding, rather than demanding a value that does not exist.
 
   ORDERING AND OWNERSHIP:
     - Every path has exactly ONE owning task. Two tasks writing one file must be ORDERED by deps, or the
@@ -467,6 +541,15 @@ acceptance is required on every task (a nested list of observable outcomes).
       mechanism DOES for them; the most dangerous consumer is a file no task owns, because nothing fixes it
       and no edge can order it.
 
+  EVIDENCE DISCIPLINE THE REVIEWERS ENFORCE (write criteria assuming these; violations are material):
+    - A result row whose shape is unknown, mixed, or internally contradictory is MALFORMED and must fail
+      closed. Recognizing one discriminator never licenses ignoring the rest of the row; malformed input
+      may never normalize to passed or any other gate-satisfying outcome.
+    - Preserve machine evidence according to the producer's protocol: never trim, discard, or change
+      delimiters before validation. Git path evidence MUST use -z and NUL parsing with bytes preserved;
+      inspect timeout, signal, and exit status before interpreting output, because a failed or timed-out
+      producer may never normalize to an empty successful result.
+
   "timeout:" IS A KILL CEILING, NOT AN ESTIMATE. Never read a sum of timeouts as a predicted duration.
 -->
 

package/dist/drivers/subprocess.d.ts

@@ -1,7 +1,12 @@
 import type { ExecutorDriver, NotifyOpts, Slot } from "./types.js";
 export declare const MAX_BUF: number;
 export declare const HERDR_CONTROL_VARS: readonly ["HERDR_ENV", "HERDR_SOCKET_PATH"];
-/** Copy of worker env with the fork cap applied and herdr control-plane vars stripped. */
+/**
+ * Copy of worker env with the fork cap applied and herdr control-plane vars stripped.
+ * The cap is the one the enclosing run resolved (resolvedForkCap) — a worker's suites divide the
+ * same machine the gate shells do, so both seams have to read the same run-owned number rather
+ * than a flat constant. The operator's own export still wins.
+ */
 export declare function sealHerdrEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 /** Pane/login-shell form of the same worker env seal (herdr seed + daemon setup). */
 export declare function herdrSealShellPrefix(env?: NodeJS.ProcessEnv): string;

package/dist/drivers/subprocess.js

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { shq } from "../adapters/types.js";
-import { createWorktree, DEFAULT_FORK_CAP, FORK_CAP_ENV } from "../run/git.js";
+import { createWorktree, FORK_CAP_ENV, resolvedForkCap } from "../run/git.js";
 // HARD-03: cap retained worker output so a chatty worker can't grow tickmarkr's heap unbounded.
 // 2MB is safe against BOTH consumers: the largest read() call site asks for 1000 lines
 // (daemon.ts:217/247), and every marker (TICKMARKR_RESULT, TICKMARKR_EXIT_<nonce>) is emitted at the
@@ -13,18 +13,23 @@ export const MAX_BUF = 2 * 1024 * 1024;
 // (and its own herdr driver CLI calls) keep the live session. Socket path is the wire; HERDR_ENV
 // is the "I am inside herdr" gate every agent skill checks before mutating panes.
 export const HERDR_CONTROL_VARS = ["HERDR_ENV", "HERDR_SOCKET_PATH"];
-/** Copy of worker env with the fork cap applied and herdr control-plane vars stripped. */
+/**
+ * Copy of worker env with the fork cap applied and herdr control-plane vars stripped.
+ * The cap is the one the enclosing run resolved (resolvedForkCap) — a worker's suites divide the
+ * same machine the gate shells do, so both seams have to read the same run-owned number rather
+ * than a flat constant. The operator's own export still wins.
+ */
 export function sealHerdrEnv(env = process.env) {
     const out = { ...env };
     if (!(FORK_CAP_ENV in out))
-        out[FORK_CAP_ENV] = DEFAULT_FORK_CAP;
+        out[FORK_CAP_ENV] = resolvedForkCap();
     for (const k of HERDR_CONTROL_VARS)
         delete out[k];
     return out;
 }
 /** Pane/login-shell form of the same worker env seal (herdr seed + daemon setup). */
 export function herdrSealShellPrefix(env = process.env) {
-    const forkCap = sealHerdrEnv(env)[FORK_CAP_ENV] ?? DEFAULT_FORK_CAP;
+    const forkCap = sealHerdrEnv(env)[FORK_CAP_ENV] ?? resolvedForkCap();
     return `export ${FORK_CAP_ENV}=${shq(forkCap)}; ` +
         HERDR_CONTROL_VARS.map((k) => `unset ${k}`).join("; ") + "; ";
 }

package/dist/gates/acceptance.d.ts

@@ -1,5 +1,5 @@
 import { type WorkerAdapter } from "../adapters/types.js";
-import { type Task } from "../graph/schema.js";
+import { type AcceptanceItem, type Task } from "../graph/schema.js";
 import { type LlmVia } from "./llm.js";
 import type { GateResult } from "./types.js";
 export interface EvidenceCitation {
@@ -21,7 +21,27 @@ export interface JudgeVerdict {
     }>;
 }
 export declare function judgeCriterionId(index: number): string;
+export declare function testFilterPattern(name: string): string;
 export declare function testFiltered(testCmd: string, name: string): string;
+export interface VitestListedTest {
+    name: string;
+    file: string;
+    projectName?: string;
+}
+export type AcceptanceCorpusAuditResult = {
+    specPath: string;
+    status: "parse-failed";
+    error: string;
+} | {
+    specPath: string;
+    status: "parsed";
+    item: AcceptanceItem;
+    namedTest?: {
+        criterion: string;
+        matches: VitestListedTest[];
+    };
+};
+export declare function auditAcceptanceCorpus(corpusRoot: string, listedTests: readonly VitestListedTest[]): AcceptanceCorpusAuditResult[];
 export interface AcceptanceGateOpts {
     testCmd?: string;
     diffCap?: number;

package/dist/gates/acceptance.js

@@ -1,11 +1,15 @@
+import { readdirSync } from "node:fs";
+import { join } from "node:path";
 import { z } from "zod";
 import { channelKey, shq } from "../adapters/types.js";
+import { compileNative } from "../compile/native.js";
 import { DEFAULT_DIFF_CAP } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { sh } from "../run/git.js";
-import { checkDiffCap, fetchTaskDiff, isProtectedEvidence, setAsideReceiptPath } from "./review.js";
+import { checkTaskDiffCaps, fetchTaskDiff, isProtectedEvidence, setAsideReceiptPath } from "./review.js";
 import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
 import { classifyVerdictCause } from "./verdict-cause.js";
+import { reviewableLogicDiff } from "./artifact-manifest.js";
 // Fable F4: acceptance judge shares review's 900s timeout — 300s default killed frontier judges on cap-sized diffs.
 const JUDGE_TIMEOUT_MS = 900_000;
 const CitationSchema = z.object({ path: z.string(), line: z.number().int() });
@@ -70,16 +74,75 @@ const isJudge = (a) => typeof a === "string" || (typeof a === "object" && a.orac
 function escapeRegExp(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+// v1.89 T6: Vitest applies -t to the runner-visible full name (enclosing describe titles and the test
+// title, space-joined). Escaping preserves literal criteria; anchoring makes equality, rather than
+// substring containment, the named-test contract.
+export function testFilterPattern(name) {
+    return `^${escapeRegExp(name)}$`;
+}
 // OBS-55: when the base command already contains `--`, append -t after forwarded args — a second `--`
 // makes vitest treat -t as a positional file filter and the name filter is dropped.
 export function testFiltered(testCmd, name) {
-    const pattern = escapeRegExp(name);
+    const pattern = testFilterPattern(name);
     const wrapped = /^\s*(npm|yarn|pnpm|npx)\b/.test(testCmd);
     if (wrapped && /\s--\s/.test(testCmd))
         return `${testCmd} -t ${shq(pattern)}`;
     const fwd = wrapped ? "-- " : "";
     return `${testCmd} ${fwd}-t ${shq(pattern)}`;
 }
+function corpusSpecPaths(root) {
+    const paths = [];
+    const visit = (dir) => {
+        for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            const path = join(dir, entry.name);
+            if (entry.isDirectory())
+                visit(path);
+            else if (entry.isFile() && entry.name.endsWith(".spec.md"))
+                paths.push(path);
+        }
+    };
+    visit(root);
+    return paths;
+}
+// v1.89 T6: mechanically bind the complete spec-corpus denominator to the runner's all-project JSON
+// listing. Every discovered path contributes either all parser-produced acceptance items or one named
+// parse failure; exceptions are evidence, never permission to shrink the corpus silently.
+export function auditAcceptanceCorpus(corpusRoot, listedTests) {
+    const runnerNames = listedTests.map((listed) => ({
+        listed,
+        fullName: listed.name.split(" > ").join(" "),
+    }));
+    const results = [];
+    for (const specPath of corpusSpecPaths(corpusRoot)) {
+        try {
+            const graph = compileNative(specPath);
+            for (const task of graph.tasks) {
+                for (const item of task.acceptance) {
+                    results.push({
+                        specPath,
+                        status: "parsed",
+                        item,
+                        ...(typeof item === "object" && item.oracle === "test"
+                            ? {
+                                namedTest: {
+                                    criterion: item.test,
+                                    matches: runnerNames
+                                        .filter(({ fullName }) => fullName === item.test)
+                                        .map(({ listed }) => listed),
+                                },
+                            }
+                            : {}),
+                    });
+                }
+            }
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            results.push({ specPath, status: "parse-failed", error: `${specPath}: ${message}` });
+        }
+    }
+    return results;
+}
 // vitest/jest summary: "Tests  N passed | M skipped (T)" — count passed+failed as actually ran.
 function testsRan(output) {
     const lines = output.replace(/\x1b\[[\d;#]*[A-Za-z]/g, "").split("\n");
@@ -185,23 +248,6 @@ function deletedPath(section) {
     const unquoted = oldPath.startsWith('"') && oldPath.endsWith('"') ? oldPath.slice(1, -1) : oldPath;
     return unquoted.replace(/^a\//, "");
 }
-// OBS-134: whole-file deletions are already fully described by their path. Sending every removed line
-// spends the cap and judge context on content that cannot exist after the change. Added and modified
-// sections pass through byte-for-byte, so their anti-flooding budget is unchanged.
-// v1.82 T1 clause 5: two exemptions, because this filter triggers on the very `deleted file mode` line
-// the set-aside preserves. Protected evidence (the frozen anchors, the captured journals) bypasses the
-// collapse so its deletion half reaches the measured text and the judge complete; and a section already
-// set aside is never reduced a second time, or this filter would erase the receipt that replaced it.
-function judgeRelevantDiff(diff) {
-    return diff.split(DIFF_SECTIONS).map((section) => {
-        if (setAsideReceiptPath(section))
-            return section;
-        const path = deletedPath(section);
-        if (!path || isProtectedEvidence(path))
-            return section;
-        return `deleted file: ${path}\n`;
-    }).join("");
-}
 // v1.82 T1 clause 7: the two shapes this task creates carry no changed hunk, so a judge asked to cite a
 // changed line has nothing to cite — three review rounds died here. Each yields ONE citable operation
 // fact, `{path, line: 0}`, read back from the judged text itself. Only these RECORDED facts make line 0
@@ -272,10 +318,9 @@ export async function acceptanceGate(task, worktree, baseRef, judge, via, opts =
         ? "WARNING: only judge oracles — no deterministic command/test oracle guards this task (deterministic preferred, spec §2).\n"
         : "";
     const fetched = await fetchTaskDiff(worktree, baseRef);
-    const diff = judgeRelevantDiff(fetched.full);
-    const forCap = judgeRelevantDiff(fetched.forCap);
+    const diff = reviewableLogicDiff(fetched.full);
     const diffCap = opts.diffCap ?? DEFAULT_DIFF_CAP;
-    const capFail = checkDiffCap("acceptance", forCap.length, diffCap, warn + detBlock);
+    const capFail = checkTaskDiffCaps("acceptance", fetched, diffCap, warn + detBlock);
     if (capFail)
         return capFail;
     const expectedIds = judgeItems.map((_, index) => judgeCriterionId(index));

package/dist/gates/artifact-manifest.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Generated artifacts are not inferred from their directory or extension. A
+ * path receives capture accounting only when its manifest row names a
+ * registered producer and repeats that producer's current provenance exactly.
+ */
+export type CaptureProducerProvenance = {
+    readonly source: string;
+    readonly entrypoint: string;
+    readonly revision: string;
+};
+export type CaptureProducerRegistration = {
+    readonly id: string;
+    readonly provenance: CaptureProducerProvenance;
+};
+export type CaptureArtifactManifestEntry = {
+    readonly path: string;
+    readonly producer: string;
+    readonly provenance: CaptureProducerProvenance;
+};
+export type CaptureArtifactManifest = {
+    readonly version: 1;
+    readonly producers: readonly CaptureProducerRegistration[];
+    readonly artifacts: readonly CaptureArtifactManifestEntry[];
+};
+export declare const CAPTURE_PRODUCERS: readonly [{
+    readonly id: "cockpit-golden-frames";
+    readonly provenance: {
+        readonly source: "src/tui/cockpit/capture.ts";
+        readonly entrypoint: "regenerateGoldenFrames";
+        readonly revision: "golden-frame-v1";
+    };
+}, {
+    readonly id: "cockpit-colour-frames";
+    readonly provenance: {
+        readonly source: "src/tui/cockpit/capture.ts";
+        readonly entrypoint: "regenerateColourFrames";
+        readonly revision: "colour-frame-v1";
+    };
+}];
+export declare const CAPTURE_ARTIFACT_MANIFEST: {
+    readonly version: 1;
+    readonly producers: readonly [{
+        readonly id: "cockpit-golden-frames";
+        readonly provenance: {
+            readonly source: "src/tui/cockpit/capture.ts";
+            readonly entrypoint: "regenerateGoldenFrames";
+            readonly revision: "golden-frame-v1";
+        };
+    }, {
+        readonly id: "cockpit-colour-frames";
+        readonly provenance: {
+            readonly source: "src/tui/cockpit/capture.ts";
+            readonly entrypoint: "regenerateColourFrames";
+            readonly revision: "colour-frame-v1";
+        };
+    }];
+    readonly artifacts: readonly ({
+        path: string;
+        producer: string;
+        provenance: CaptureProducerProvenance;
+    } | {
+        path: string;
+        producer: string;
+        provenance: CaptureProducerProvenance;
+    })[];
+};
+/** Compatibility name for the pre-manifest gate API; now derived from one manifest. */
+export declare const REGENERABLE_CAPTURE_PATHS: readonly string[];
+export declare const PROTECTED_EVIDENCE_PREFIXES: readonly ["tests/fixtures/cockpit/anchors/", "tests/fixtures/cockpit/sources/", "tests/fixtures/cockpit/colour/sources/"];
+export declare function isProtectedEvidence(path: string): boolean;
+export type ArtifactPathClassification = {
+    readonly path: string;
+    readonly kind: "logic";
+    readonly reason: "protected-evidence" | "unmanifested" | "malformed-manifest" | "missing-producer" | "stale-provenance";
+    readonly error?: string;
+} | {
+    readonly path: string;
+    readonly kind: "capture";
+    readonly reason: "manifest-provenance";
+    readonly producer: string;
+    readonly provenance: CaptureProducerProvenance;
+};
+export declare function classifyArtifactPath(path: string, manifest?: unknown): ArtifactPathClassification;
+/** The path named by a citable capture receipt, or null when there is none. */
+export declare function setAsideReceiptPath(section: string): string | null;
+/**
+ * Whole-file source deletions retain their operation fact instead of spending
+ * the reader cap on bytes that no longer exist. Capture receipts and protected
+ * evidence are deliberately exempt from this older reduction.
+ */
+export declare function reviewableLogicDiff(diff: string): string;
+export type ArtifactDiffSection = {
+    readonly paths: readonly string[];
+    readonly kind: "capture" | "logic";
+    readonly reason: string;
+    readonly producer?: string;
+    readonly provenance?: CaptureProducerProvenance;
+    /** UTF-8 bytes left for a reviewer to read, including any receipt. */
+    readonly logicBytes: number;
+    /** UTF-8 bytes withheld behind the finite capture bound. */
+    readonly captureBytes: number;
+};
+export type ArtifactDiffMeasurement = {
+    readonly rendered: string;
+    readonly logicBytes: number;
+    readonly captureBytes: number;
+    readonly sections: readonly ArtifactDiffSection[];
+};
+/**
+ * Classify and compact a Git diff once. Invalid manifest facts remain ordinary
+ * logic. Valid capture content is replaced by one citable receipt, while its
+ * exact UTF-8 payload remains charged to the separate capture bucket.
+ */
+export declare function measureArtifactDiff(diff: string, manifest?: unknown): ArtifactDiffMeasurement;
+/** The original API now delegates to the provenance-backed measurement. */
+export declare function setAsideRegenerableCaptures(diff: string): string;
+export declare const MIN_CAPTURE_DIFF_CAP = 1000000;
+export declare const CAPTURE_DIFF_CAP_MULTIPLIER = 4;
+export declare function captureDiffCapFor(logicCap: number): number;