tickmarkr 1.86.0 → 1.89.0

package/dist/gates/artifact-manifest.js

@@ -0,0 +1,357 @@
+/**
+ * Generated artifacts are not inferred from their directory or extension. A
+ * path receives capture accounting only when its manifest row names a
+ * registered producer and repeats that producer's current provenance exactly.
+ */
+const GOLDEN_PROVENANCE = {
+    source: "src/tui/cockpit/capture.ts",
+    entrypoint: "regenerateGoldenFrames",
+    revision: "golden-frame-v1",
+};
+const COLOUR_PROVENANCE = {
+    source: "src/tui/cockpit/capture.ts",
+    entrypoint: "regenerateColourFrames",
+    revision: "colour-frame-v1",
+};
+export const CAPTURE_PRODUCERS = [
+    { id: "cockpit-golden-frames", provenance: GOLDEN_PROVENANCE },
+    { id: "cockpit-colour-frames", provenance: COLOUR_PROVENANCE },
+];
+const goldenFrameNames = [
+    "run.width-stacked.80x24.txt",
+    "run.width-folded-keys.100x24.txt",
+    "run.width-three-column.140x24.txt",
+    "run.height-14.140x14.txt",
+    "run.height-18.140x18.txt",
+    "run.height-24.140x24.txt",
+    "run.height-40.140x40.txt",
+    "run.no-colour.140x24.txt",
+    "run.non-tty.140x24.txt",
+    "run.ci.140x24.txt",
+    "setup.width-stacked.80x24.txt",
+    "setup.width-folded-keys.100x24.txt",
+    "setup.width-three-column.140x24.txt",
+    "setup.height-14.140x14.txt",
+    "setup.height-18.140x18.txt",
+    "setup.height-24.140x24.txt",
+    "setup.height-40.140x40.txt",
+    "setup.no-colour.140x24.txt",
+    "setup.non-tty.140x24.txt",
+    "setup.ci.140x24.txt",
+];
+const colourFrameNames = [
+    "run-20260718-000943.colour.140x24.txt",
+    "run-20260718-000943.no-colour.140x24.txt",
+    "run-20260725-025004.interrupted.colour.140x24.txt",
+];
+const provenanceCopy = (provenance) => ({ ...provenance });
+export const CAPTURE_ARTIFACT_MANIFEST = {
+    version: 1,
+    producers: CAPTURE_PRODUCERS,
+    artifacts: [
+        ...goldenFrameNames.map((fixture) => ({
+            path: `tests/fixtures/cockpit/frames/${fixture}`,
+            producer: "cockpit-golden-frames",
+            provenance: provenanceCopy(GOLDEN_PROVENANCE),
+        })),
+        ...colourFrameNames.map((fixture) => ({
+            path: `tests/fixtures/cockpit/colour/${fixture}`,
+            producer: "cockpit-colour-frames",
+            provenance: provenanceCopy(COLOUR_PROVENANCE),
+        })),
+    ],
+};
+/** Compatibility name for the pre-manifest gate API; now derived from one manifest. */
+export const REGENERABLE_CAPTURE_PATHS = CAPTURE_ARTIFACT_MANIFEST.artifacts
+    .map((artifact) => artifact.path);
+export const PROTECTED_EVIDENCE_PREFIXES = [
+    "tests/fixtures/cockpit/anchors/",
+    "tests/fixtures/cockpit/sources/",
+    "tests/fixtures/cockpit/colour/sources/",
+];
+export function isProtectedEvidence(path) {
+    return PROTECTED_EVIDENCE_PREFIXES.some((prefix) => path.startsWith(prefix));
+}
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function isCanonicalRepoPath(value) {
+    if (typeof value !== "string" || value.length === 0)
+        return false;
+    if (value.startsWith("/") || value.includes("\\"))
+        return false;
+    const parts = value.split("/");
+    return parts.every((part) => part.length > 0 && part !== "." && part !== "..");
+}
+function parseProvenance(value) {
+    if (!isRecord(value))
+        return null;
+    const { source, entrypoint, revision } = value;
+    if (!isCanonicalRepoPath(source))
+        return null;
+    if (typeof entrypoint !== "string" || !/^[A-Za-z_$][\w$]*$/.test(entrypoint))
+        return null;
+    if (typeof revision !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(revision))
+        return null;
+    return { source, entrypoint, revision };
+}
+const sameProvenance = (left, right) => left.source === right.source
+    && left.entrypoint === right.entrypoint
+    && left.revision === right.revision;
+function indexManifest(manifest) {
+    if (!isRecord(manifest) || manifest.version !== 1) {
+        return "artifact manifest version must be 1";
+    }
+    if (!Array.isArray(manifest.producers) || !Array.isArray(manifest.artifacts)) {
+        return "artifact manifest producers and artifacts must be arrays";
+    }
+    const producers = new Map();
+    for (const [index, raw] of manifest.producers.entries()) {
+        if (!isRecord(raw) || typeof raw.id !== "string" || !raw.id.trim()) {
+            return `artifact manifest producer ${index} is malformed`;
+        }
+        const provenance = parseProvenance(raw.provenance);
+        if (!provenance)
+            return `artifact manifest producer ${raw.id} has malformed provenance`;
+        if (producers.has(raw.id))
+            return `artifact manifest producer ${raw.id} is duplicated`;
+        producers.set(raw.id, { id: raw.id, provenance });
+    }
+    const artifacts = new Map();
+    for (const [index, raw] of manifest.artifacts.entries()) {
+        if (!isRecord(raw) || !isCanonicalRepoPath(raw.path)
+            || typeof raw.producer !== "string" || !raw.producer.trim()) {
+            return `artifact manifest entry ${index} is malformed`;
+        }
+        const provenance = parseProvenance(raw.provenance);
+        if (!provenance)
+            return `artifact manifest entry ${raw.path} has malformed provenance`;
+        if (artifacts.has(raw.path))
+            return `artifact manifest path ${raw.path} is duplicated`;
+        artifacts.set(raw.path, { path: raw.path, producer: raw.producer, provenance });
+    }
+    return { producers, artifacts };
+}
+export function classifyArtifactPath(path, manifest = CAPTURE_ARTIFACT_MANIFEST) {
+    // Protected evidence wins even over a forged manifest row.
+    if (isProtectedEvidence(path)) {
+        return { path, kind: "logic", reason: "protected-evidence" };
+    }
+    const indexed = indexManifest(manifest);
+    if (typeof indexed === "string") {
+        return { path, kind: "logic", reason: "malformed-manifest", error: indexed };
+    }
+    const artifact = indexed.artifacts.get(path);
+    if (!artifact)
+        return { path, kind: "logic", reason: "unmanifested" };
+    const producer = indexed.producers.get(artifact.producer);
+    if (!producer) {
+        return {
+            path,
+            kind: "logic",
+            reason: "missing-producer",
+            error: `capture producer ${artifact.producer} is not registered`,
+        };
+    }
+    if (!sameProvenance(artifact.provenance, producer.provenance)) {
+        return {
+            path,
+            kind: "logic",
+            reason: "stale-provenance",
+            error: `capture provenance for ${path} does not match producer ${producer.id}`,
+        };
+    }
+    return {
+        path,
+        kind: "capture",
+        reason: "manifest-provenance",
+        producer: producer.id,
+        provenance: producer.provenance,
+    };
+}
+const SET_ASIDE_RECEIPT = /^set aside: regenerable capture (.+?) — \d+ bytes withheld\b/m;
+/** The path named by a citable capture receipt, or null when there is none. */
+export function setAsideReceiptPath(section) {
+    return SET_ASIDE_RECEIPT.exec(section)?.[1] ?? null;
+}
+const DIFF_SECTIONS = /(?=^diff --git )/m;
+function deletedPath(section) {
+    if (!/^deleted file mode /m.test(section))
+        return null;
+    const oldPath = /^--- (.+)$/m.exec(section)?.[1]
+        ?? /^Binary files (.+) and \/dev\/null differ$/m.exec(section)?.[1];
+    if (!oldPath || oldPath === "/dev/null")
+        return null;
+    return unquoteGitPath(oldPath).replace(/^a\//, "");
+}
+/**
+ * Whole-file source deletions retain their operation fact instead of spending
+ * the reader cap on bytes that no longer exist. Capture receipts and protected
+ * evidence are deliberately exempt from this older reduction.
+ */
+export function reviewableLogicDiff(diff) {
+    return diff.split(DIFF_SECTIONS).map((section) => {
+        if (setAsideReceiptPath(section))
+            return section;
+        const path = deletedPath(section);
+        if (!path || isProtectedEvidence(path))
+            return section;
+        return `deleted file: ${path}\n`;
+    }).join("");
+}
+function unquoteGitPath(raw) {
+    const value = raw.trim();
+    if (!value.startsWith('"') || !value.endsWith('"'))
+        return value;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return value.slice(1, -1);
+    }
+}
+function diffSidePath(raw) {
+    const value = unquoteGitPath(raw);
+    if (value === "/dev/null")
+        return null;
+    return value.replace(/^[ab]\//, "");
+}
+function gitHeaderTokens(raw) {
+    return raw.match(/"(?:\\.|[^"\\])*"|\S+/g) ?? [];
+}
+function parseContentSection(section) {
+    const lines = section.split("\n");
+    const minus = lines.findIndex((line) => line.startsWith("--- "));
+    if (minus === -1 || !lines[minus + 1]?.startsWith("+++ "))
+        return null;
+    const body = lines.slice(minus + 2);
+    if (!body.some((line) => line.startsWith("@@ ")))
+        return null;
+    return {
+        lines,
+        minus,
+        sides: [
+            diffSidePath(lines[minus].slice(4)),
+            diffSidePath(lines[minus + 1].slice(4)),
+        ],
+        body,
+    };
+}
+function sectionPaths(section, parsed) {
+    if (parsed)
+        return [...new Set(parsed.sides.filter((path) => path !== null))];
+    const renamedFrom = /^rename from (.+)$/m.exec(section)?.[1];
+    const renamedTo = /^rename to (.+)$/m.exec(section)?.[1];
+    if (renamedFrom || renamedTo) {
+        return [...new Set([renamedFrom, renamedTo].filter((path) => path !== undefined).map(unquoteGitPath))];
+    }
+    const header = /^diff --git (.+)$/m.exec(section)?.[1];
+    if (!header)
+        return [];
+    const tokens = gitHeaderTokens(header);
+    if (tokens.length !== 2)
+        return [];
+    return [...new Set(tokens.map(diffSidePath).filter((path) => path !== null))];
+}
+function hunkPayload(body, sign) {
+    return body
+        .filter((line) => line.startsWith(sign) || line.startsWith("\\"))
+        .map((line) => line[0] === sign ? line.slice(1) : line)
+        .join("\n");
+}
+function kindOnlyPaths(sections) {
+    const removed = new Map();
+    const added = new Map();
+    for (const section of sections) {
+        const parsed = parseContentSection(section);
+        if (!parsed)
+            continue;
+        const [before, after] = parsed.sides;
+        if (before && !after)
+            removed.set(before, hunkPayload(parsed.body, "-"));
+        else if (after && !before)
+            added.set(after, hunkPayload(parsed.body, "+"));
+    }
+    return new Set([...removed]
+        .filter(([path, payload]) => added.get(path) === payload)
+        .map(([path]) => path));
+}
+function sameCaptureProducer(classifications) {
+    if (!classifications.length || classifications.some((row) => row.kind !== "capture"))
+        return false;
+    const [first] = classifications;
+    return first !== undefined && classifications.every((row) => row.kind === "capture"
+        && row.producer === first.producer
+        && sameProvenance(row.provenance, first.provenance));
+}
+/**
+ * Classify and compact a Git diff once. Invalid manifest facts remain ordinary
+ * logic. Valid capture content is replaced by one citable receipt, while its
+ * exact UTF-8 payload remains charged to the separate capture bucket.
+ */
+export function measureArtifactDiff(diff, manifest = CAPTURE_ARTIFACT_MANIFEST) {
+    if (!diff.includes("diff --git ")) {
+        return {
+            rendered: diff,
+            logicBytes: Buffer.byteLength(diff, "utf8"),
+            captureBytes: 0,
+            sections: [],
+        };
+    }
+    const rawSections = diff.split(/(?=^diff --git )/m);
+    const kindOnly = kindOnlyPaths(rawSections);
+    const rendered = [];
+    const measurements = [];
+    for (const section of rawSections) {
+        const parsed = parseContentSection(section);
+        const paths = sectionPaths(section, parsed);
+        const classifications = paths.map((path) => classifyArtifactPath(path, manifest));
+        const validCapture = sameCaptureProducer(classifications);
+        const producer = validCapture ? classifications[0] : undefined;
+        const isKindOnly = paths.some((path) => kindOnly.has(path));
+        if (!parsed || !validCapture || !producer || isKindOnly) {
+            rendered.push(section);
+            measurements.push({
+                paths,
+                kind: validCapture ? "capture" : "logic",
+                reason: validCapture
+                    ? parsed ? "content-identical-kind-change" : "file-operation-only"
+                    : classifications.map((row) => row.reason).join(",") || "unparsed-diff-section",
+                ...(producer ? { producer: producer.producer, provenance: producer.provenance } : {}),
+                logicBytes: Buffer.byteLength(section, "utf8"),
+                captureBytes: 0,
+            });
+            continue;
+        }
+        const withheld = parsed.lines.slice(parsed.minus).join("\n");
+        const captureBytes = Buffer.byteLength(withheld, "utf8");
+        const receiptPath = paths.at(-1);
+        const receipt = `set aside: regenerable capture ${receiptPath} — ${captureBytes} bytes withheld (producer ${producer.producer}; provenance ${producer.provenance.source}#${producer.provenance.entrypoint}@${producer.provenance.revision})`;
+        const compact = `${parsed.lines.slice(0, parsed.minus).join("\n")}\n${receipt}\n`;
+        rendered.push(compact);
+        measurements.push({
+            paths,
+            kind: "capture",
+            reason: "manifest-provenance",
+            producer: producer.producer,
+            provenance: producer.provenance,
+            logicBytes: Buffer.byteLength(compact, "utf8"),
+            captureBytes,
+        });
+    }
+    return {
+        rendered: rendered.join(""),
+        logicBytes: measurements.reduce((sum, row) => sum + row.logicBytes, 0),
+        captureBytes: measurements.reduce((sum, row) => sum + row.captureBytes, 0),
+        sections: measurements,
+    };
+}
+/** The original API now delegates to the provenance-backed measurement. */
+export function setAsideRegenerableCaptures(diff) {
+    return measureArtifactDiff(diff).rendered;
+}
+// The default corpus is about 134 KiB. Capture bytes are bounded, never free;
+// the floor avoids making a deliberately lowered logic cap reintroduce Q14.
+export const MIN_CAPTURE_DIFF_CAP = 1_000_000;
+export const CAPTURE_DIFF_CAP_MULTIPLIER = 4;
+export function captureDiffCapFor(logicCap) {
+    return Math.max(MIN_CAPTURE_DIFF_CAP, logicCap * CAPTURE_DIFF_CAP_MULTIPLIER);
+}

package/dist/gates/baseline.d.ts

@@ -14,6 +14,12 @@ export interface BaselineWarning {
     commands: string[];
     reason: string;
 }
+export type FailureClassification = "regression" | "infra";
+/**
+ * What a nonzero runner exit is evidence OF. `undefined` when the output names neither — the
+ * unreadable-runner case the existing fail-closed path already owns.
+ */
+export declare function classifyFailureOutput(output: string): FailureClassification | undefined;
 export declare const UNRECOGNIZED_FAILURE = "<unrecognized failure output>";
 export declare function fingerprint(output: string): string[];
 export declare function detectGateCommands(repoRoot: string, cfg: TickmarkrConfig): Record<string, string>;

package/dist/gates/baseline.js

@@ -57,6 +57,30 @@ const namesFailure = (l) => FAIL_ANCHOR_RE.test(l) || RUNNER_FAIL_RE.test(l) ||
 const isFailureShaped = (l) => namesFailure(l) || SUMMARY_FAIL_RE.test(l) || ERROR_ANCHOR_RE.test(l)
     || TSC_ERROR_RE.test(l) || LINTER_ERROR_RE.test(l);
 const VOCAB_RE = /\b(?:error|fail(?:ed|ure|ing)?)\b/i;
+// T9 — the infra/regression discriminator. A runner that died because the MACHINE ran out of
+// processes, file descriptors or memory never finished asking the question, so its nonzero exit is
+// not evidence about the work. But the reverse mistake is the expensive one: a real regression that
+// happens to be printed next to an errno token must never be laundered into "infra" and forgiven.
+// So the errno tokens below classify a line as infra only when NOTHING on that line also names a
+// test-level failure — "AssertionError after spawn EAGAIN" names one and is a regression; "spawn
+// EAGAIN" and "Error: spawn EAGAIN" name none and are infra. One regression line anywhere in the
+// output makes the whole output a regression, whatever else the runner printed.
+const INFRA_RE = /\bE(?:AGAIN|MFILE|NFILE|NOMEM|NOSPC)\b|JavaScript heap out of memory|Cannot allocate memory|Resource temporarily unavailable/;
+// A named error CLASS ("AssertionError", "TypeError", "MyDomainError") — never bare "Error", which
+// is what an errno report itself is headed with (`Error: spawn EAGAIN`). The prefix is required.
+const ERROR_CLASS_RE = /\b[A-Za-z][A-Za-z0-9]*Error\b/;
+const isInfraLine = (l) => INFRA_RE.test(l) && !ERROR_CLASS_RE.test(l) && !namesFailure(l) && !SUMMARY_FAIL_RE.test(l);
+const namesRegression = (l) => (isFailureShaped(l) || ERROR_CLASS_RE.test(l)) && !isInfraLine(l);
+/**
+ * What a nonzero runner exit is evidence OF. `undefined` when the output names neither — the
+ * unreadable-runner case the existing fail-closed path already owns.
+ */
+export function classifyFailureOutput(output) {
+    const lines = output.split("\n").map((l) => l.replace(ANSI_RE, "")).filter((l) => !PASS_LINE_RE.test(l));
+    if (lines.some(namesRegression))
+        return "regression";
+    return lines.some(isInfraLine) ? "infra" : undefined;
+}
 const normalizeLine = (l) => l.replace(/\d+/g, "#").replace(/\s+/g, " ").trim();
 // A failing command whose output holds no shape any runner here names. The marker is content-free and
 // constant: downstream consumers (tip verify journals fingerprint counts) still see that the command
@@ -205,6 +229,21 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
             continue;
         }
         const raw = (r.stdout + "\n" + r.stderr).split(cwd).join("");
+        // T9: classify BEFORE the baseline diff, and record it on every nonzero result. An infra-only
+        // exit means the runner never completed a suite, so there is nothing to forgive and nothing
+        // verified — it fails, and `meta.infra` marks it so the merge predicate cannot read it as a
+        // satisfied gate even if some future producer reports it as a pass. Baseline forgiveness stays
+        // exactly where it belongs: on failures the runner actually reported and the baseline already had.
+        const classification = classifyFailureOutput(raw);
+        if (classification === "infra") {
+            results.push({
+                gate: name,
+                pass: false,
+                details: `exit ${r.code} on infrastructure alone — the runner never completed a suite, so this gate verified nothing:\n${unrecognizedEvidence(raw) || raw.trim().split("\n").slice(0, 10).join("\n")}`,
+                meta: { classification, infra: true },
+            });
+            continue;
+        }
         const known = new Set((baseline.commands[name]?.fingerprints ?? []).map(renormalize));
         // OBS-42: diagnostic headings enrich fingerprints but cannot invalidate legacy baselines.
         const current = fingerprint(raw);
@@ -225,16 +264,22 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
                 gate: name,
                 pass: false,
                 details: evidence ? `${closed}\nunrecognized output:\n${evidence}` : closed,
+                ...(classification ? { meta: { classification } } : {}),
             });
             continue;
         }
-        results.push(failing.length
-            ? { gate: name, pass: false, ...headlineDetails(raw, failing) }
-            : {
-                gate: name,
-                pass: true,
-                details: `exit ${r.code} but only pre-existing failures (forgiven)${unreadable ? " — no failure shape recognized in this output, so a new failure from this runner is invisible to the baseline gate" : ""}`,
-            });
+        if (failing.length) {
+            const headlined = headlineDetails(raw, failing);
+            const meta = { ...headlined.meta, ...(classification ? { classification } : {}) };
+            results.push({ gate: name, pass: false, details: headlined.details, ...(Object.keys(meta).length ? { meta } : {}) });
+            continue;
+        }
+        results.push({
+            gate: name,
+            pass: true,
+            details: `exit ${r.code} but only pre-existing failures (forgiven)${unreadable ? " — no failure shape recognized in this output, so a new failure from this runner is invisible to the baseline gate" : ""}`,
+            ...(classification ? { meta: { classification } } : {}),
+        });
     }
     return results;
 }

package/dist/gates/llm.js

@@ -1,6 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes } from "node:crypto";
-import { mkdtempSync, writeFileSync } from "node:fs";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { formatOwnedName, parseOwnedName } from "../drivers/types.js";
@@ -104,36 +104,47 @@ export async function captureLlmOutput(run) {
     return { value, outputs };
 }
 export async function runHeadless(adapter, model, prompt, cwd, timeoutMs = 300000) {
-    const pf = join(mkdtempSync(join(tmpdir(), "tickmarkr-llm-")), "prompt.md");
-    writeFileSync(pf, prompt);
-    const r = await sh(adapter.headlessCommand(pf, model), cwd, timeoutMs);
-    return r.stdout + "\n" + r.stderr;
+    const dir = mkdtempSync(join(tmpdir(), "tickmarkr-llm-"));
+    try {
+        const pf = join(dir, "prompt.md");
+        writeFileSync(pf, prompt);
+        const r = await sh(adapter.headlessCommand(pf, model), cwd, timeoutMs);
+        return r.stdout + "\n" + r.stderr;
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
 }
 // v1.1 default path: the same headless CLI call, but dispatched through the driver
 // as a visible named agent (herdr pane), with the quote-split completion wrapper.
 export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs = 300000) {
     const dir = mkdtempSync(join(tmpdir(), "tickmarkr-llm-"));
-    const pf = join(dir, "prompt.md");
-    writeFileSync(pf, prompt);
-    const scriptPath = join(dir, "dispatch.sh");
-    // OBS-50: bootstrap in a script beside the prompt — pane sees one short bash line + banner, not the raw inline command
-    const nonce = extractPromptNonce(prompt) ?? generateVerdictNonce();
-    writeFileSync(scriptPath, [
-        "export BASH_SILENCE_DEPRECATION_WARNING=1",
-        bannerShell(),
-        adapter.headlessCommand(pf, model),
-        gateExitTrailer(nonce),
-    ].join("\n"));
-    const slot = await via.driver.slot(cwd, rolePaneNameFromPrompt(prompt, via.name), via.label ? { label: via.label } : undefined);
-    via.onSlot?.(slot);
-    await via.driver.run(slot, paneDispatchCommand(scriptPath));
-    // nonce-suffixed exit only: a displayed bare "TICKMARKR_EXIT:" or another call's marker must not
-    // false-complete — same guard the worker path uses (daemon.ts:330-331).
-    await via.driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, timeoutMs, { regex: true });
-    const out = await via.driver.read(slot, 400);
-    if (!via.keep)
-        await via.driver.close(slot);
-    return dewrapPaneVerdict(out, nonce);
+    try {
+        const pf = join(dir, "prompt.md");
+        writeFileSync(pf, prompt);
+        const scriptPath = join(dir, "dispatch.sh");
+        // OBS-50: bootstrap in a script beside the prompt — pane sees one short bash line + banner, not the raw inline command
+        const nonce = extractPromptNonce(prompt) ?? generateVerdictNonce();
+        writeFileSync(scriptPath, [
+            "export BASH_SILENCE_DEPRECATION_WARNING=1",
+            bannerShell(),
+            adapter.headlessCommand(pf, model),
+            gateExitTrailer(nonce),
+        ].join("\n"));
+        const slot = await via.driver.slot(cwd, rolePaneNameFromPrompt(prompt, via.name), via.label ? { label: via.label } : undefined);
+        via.onSlot?.(slot);
+        await via.driver.run(slot, paneDispatchCommand(scriptPath));
+        // nonce-suffixed exit only: a displayed bare "TICKMARKR_EXIT:" or another call's marker must not
+        // false-complete — same guard the worker path uses (daemon.ts:330-331).
+        await via.driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, timeoutMs, { regex: true });
+        const out = await via.driver.read(slot, 400);
+        if (!via.keep)
+            await via.driver.close(slot);
+        return dewrapPaneVerdict(out, nonce);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
 }
 // OBS-155: a TUI renders the verdict as a bullet and HARD-wraps it at pane width with a 2-space
 // continuation indent, splitting words mid-token — so literal newlines land inside JSON string

package/dist/gates/review.d.ts

@@ -4,6 +4,8 @@ import { type Task } from "../graph/schema.js";
 import { type GateVia } from "./llm.js";
 import type { GateResult } from "./types.js";
 import { type VerdictUnparseableCause } from "./verdict-cause.js";
+import { type ArtifactDiffMeasurement, type ArtifactDiffSection } from "./artifact-manifest.js";
+export { isProtectedEvidence, PROTECTED_EVIDENCE_PREFIXES, REGENERABLE_CAPTURE_PATHS, setAsideReceiptPath, setAsideRegenerableCaptures, } from "./artifact-manifest.js";
 export type ReviewSeverity = "material" | "minor";
 export interface ReviewFinding {
     note: string;
@@ -21,13 +23,6 @@ export interface ReviewVerdict {
         body: string;
     }>;
 }
-export declare const REGENERABLE_CAPTURE_PATHS: readonly string[];
-export declare const PROTECTED_EVIDENCE_PREFIXES: readonly ["tests/fixtures/cockpit/anchors/", "tests/fixtures/cockpit/sources/", "tests/fixtures/cockpit/colour/sources/"];
-export declare function isProtectedEvidence(path: string): boolean;
-/** The `{path}` a set-aside receipt names, or null if this section carries no receipt. */
-export declare function setAsideReceiptPath(section: string): string | null;
-/** Replace the content of every section confined to the regenerable frame corpora with a receipt. */
-export declare function setAsideRegenerableCaptures(diff: string): string;
 /**
  * The paths this task's diff ACTUALLY touched. `-z` so a path carrying spaces or non-ASCII bytes is
  * never mangled by git's quoting, `--no-renames` so a rename reports BOTH sides: a file renamed OUT of
@@ -35,11 +30,21 @@ export declare function setAsideRegenerableCaptures(diff: string): string;
  */
 export declare function changedPaths(worktree: string, baseRef: string): Promise<string[]>;
 export declare function mirrorsVersionOnly(worktree: string, baseRef: string, path: string): Promise<boolean>;
-export declare function fetchTaskDiff(worktree: string, baseRef: string): Promise<{
-    full: string;
-    forCap: string;
-}>;
+export type TaskDiffMeasurement = {
+    readonly full: string;
+    readonly forCap: string;
+    /** Strict-cap UTF-8 bytes left after capture payloads become receipts. */
+    readonly logicBytes: number;
+    /** UTF-8 bytes withheld by those receipts and charged to the larger cap. */
+    readonly captureBytes: number;
+    readonly classifications: readonly ArtifactDiffSection[];
+    readonly fullMeasurement: ArtifactDiffMeasurement;
+    readonly capMeasurement: ArtifactDiffMeasurement;
+};
+export declare function fetchTaskDiff(worktree: string, baseRef: string): Promise<TaskDiffMeasurement>;
 export declare function checkDiffCap(gate: string, measured: number, cap: number, prefix?: string): GateResult | null;
+/** Apply the strict reviewable-logic cap and the finite, larger capture cap independently. */
+export declare function checkTaskDiffCaps(gate: string, measured: Pick<TaskDiffMeasurement, "logicBytes" | "captureBytes">, logicCap: number, prefix?: string): GateResult | null;
 export declare function isDiffCapPark(result: GateResult): boolean;
 export declare function diffCapParkReason(results: GateResult[]): string | null;
 export declare function modelId(model: string): string;