tickmarkr 1.87.0 → 1.90.0

package/dist/gates/acceptance.js

@@ -1,11 +1,15 @@
+import { readdirSync } from "node:fs";
+import { join } from "node:path";
 import { z } from "zod";
 import { channelKey, shq } from "../adapters/types.js";
+import { compileNative } from "../compile/native.js";
 import { DEFAULT_DIFF_CAP } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { sh } from "../run/git.js";
-import { checkDiffCap, fetchTaskDiff, isProtectedEvidence, setAsideReceiptPath } from "./review.js";
+import { checkTaskDiffCaps, fetchTaskDiff, isProtectedEvidence, setAsideReceiptPath } from "./review.js";
 import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
 import { classifyVerdictCause } from "./verdict-cause.js";
+import { reviewableLogicDiff } from "./artifact-manifest.js";
 // Fable F4: acceptance judge shares review's 900s timeout — 300s default killed frontier judges on cap-sized diffs.
 const JUDGE_TIMEOUT_MS = 900_000;
 const CitationSchema = z.object({ path: z.string(), line: z.number().int() });
@@ -70,16 +74,75 @@ const isJudge = (a) => typeof a === "string" || (typeof a === "object" && a.orac
 function escapeRegExp(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+// v1.89 T6: Vitest applies -t to the runner-visible full name (enclosing describe titles and the test
+// title, space-joined). Escaping preserves literal criteria; anchoring makes equality, rather than
+// substring containment, the named-test contract.
+export function testFilterPattern(name) {
+    return `^${escapeRegExp(name)}$`;
+}
 // OBS-55: when the base command already contains `--`, append -t after forwarded args — a second `--`
 // makes vitest treat -t as a positional file filter and the name filter is dropped.
 export function testFiltered(testCmd, name) {
-    const pattern = escapeRegExp(name);
+    const pattern = testFilterPattern(name);
     const wrapped = /^\s*(npm|yarn|pnpm|npx)\b/.test(testCmd);
     if (wrapped && /\s--\s/.test(testCmd))
         return `${testCmd} -t ${shq(pattern)}`;
     const fwd = wrapped ? "-- " : "";
     return `${testCmd} ${fwd}-t ${shq(pattern)}`;
 }
+function corpusSpecPaths(root) {
+    const paths = [];
+    const visit = (dir) => {
+        for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            const path = join(dir, entry.name);
+            if (entry.isDirectory())
+                visit(path);
+            else if (entry.isFile() && entry.name.endsWith(".spec.md"))
+                paths.push(path);
+        }
+    };
+    visit(root);
+    return paths;
+}
+// v1.89 T6: mechanically bind the complete spec-corpus denominator to the runner's all-project JSON
+// listing. Every discovered path contributes either all parser-produced acceptance items or one named
+// parse failure; exceptions are evidence, never permission to shrink the corpus silently.
+export function auditAcceptanceCorpus(corpusRoot, listedTests) {
+    const runnerNames = listedTests.map((listed) => ({
+        listed,
+        fullName: listed.name.split(" > ").join(" "),
+    }));
+    const results = [];
+    for (const specPath of corpusSpecPaths(corpusRoot)) {
+        try {
+            const graph = compileNative(specPath);
+            for (const task of graph.tasks) {
+                for (const item of task.acceptance) {
+                    results.push({
+                        specPath,
+                        status: "parsed",
+                        item,
+                        ...(typeof item === "object" && item.oracle === "test"
+                            ? {
+                                namedTest: {
+                                    criterion: item.test,
+                                    matches: runnerNames
+                                        .filter(({ fullName }) => fullName === item.test)
+                                        .map(({ listed }) => listed),
+                                },
+                            }
+                            : {}),
+                    });
+                }
+            }
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            results.push({ specPath, status: "parse-failed", error: `${specPath}: ${message}` });
+        }
+    }
+    return results;
+}
 // vitest/jest summary: "Tests  N passed | M skipped (T)" — count passed+failed as actually ran.
 function testsRan(output) {
     const lines = output.replace(/\x1b\[[\d;#]*[A-Za-z]/g, "").split("\n");
@@ -185,23 +248,6 @@ function deletedPath(section) {
     const unquoted = oldPath.startsWith('"') && oldPath.endsWith('"') ? oldPath.slice(1, -1) : oldPath;
     return unquoted.replace(/^a\//, "");
 }
-// OBS-134: whole-file deletions are already fully described by their path. Sending every removed line
-// spends the cap and judge context on content that cannot exist after the change. Added and modified
-// sections pass through byte-for-byte, so their anti-flooding budget is unchanged.
-// v1.82 T1 clause 5: two exemptions, because this filter triggers on the very `deleted file mode` line
-// the set-aside preserves. Protected evidence (the frozen anchors, the captured journals) bypasses the
-// collapse so its deletion half reaches the measured text and the judge complete; and a section already
-// set aside is never reduced a second time, or this filter would erase the receipt that replaced it.
-function judgeRelevantDiff(diff) {
-    return diff.split(DIFF_SECTIONS).map((section) => {
-        if (setAsideReceiptPath(section))
-            return section;
-        const path = deletedPath(section);
-        if (!path || isProtectedEvidence(path))
-            return section;
-        return `deleted file: ${path}\n`;
-    }).join("");
-}
 // v1.82 T1 clause 7: the two shapes this task creates carry no changed hunk, so a judge asked to cite a
 // changed line has nothing to cite — three review rounds died here. Each yields ONE citable operation
 // fact, `{path, line: 0}`, read back from the judged text itself. Only these RECORDED facts make line 0
@@ -272,10 +318,9 @@ export async function acceptanceGate(task, worktree, baseRef, judge, via, opts =
         ? "WARNING: only judge oracles — no deterministic command/test oracle guards this task (deterministic preferred, spec §2).\n"
         : "";
     const fetched = await fetchTaskDiff(worktree, baseRef);
-    const diff = judgeRelevantDiff(fetched.full);
-    const forCap = judgeRelevantDiff(fetched.forCap);
+    const diff = reviewableLogicDiff(fetched.full);
     const diffCap = opts.diffCap ?? DEFAULT_DIFF_CAP;
-    const capFail = checkDiffCap("acceptance", forCap.length, diffCap, warn + detBlock);
+    const capFail = checkTaskDiffCaps("acceptance", fetched, diffCap, warn + detBlock);
     if (capFail)
         return capFail;
     const expectedIds = judgeItems.map((_, index) => judgeCriterionId(index));

package/dist/gates/artifact-manifest.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Generated artifacts are not inferred from their directory or extension. A
+ * path receives capture accounting only when its manifest row names a
+ * registered producer and repeats that producer's current provenance exactly.
+ */
+export type CaptureProducerProvenance = {
+    readonly source: string;
+    readonly entrypoint: string;
+    readonly revision: string;
+};
+export type CaptureProducerRegistration = {
+    readonly id: string;
+    readonly provenance: CaptureProducerProvenance;
+};
+export type CaptureArtifactManifestEntry = {
+    readonly path: string;
+    readonly producer: string;
+    readonly provenance: CaptureProducerProvenance;
+};
+export type CaptureArtifactManifest = {
+    readonly version: 1;
+    readonly producers: readonly CaptureProducerRegistration[];
+    readonly artifacts: readonly CaptureArtifactManifestEntry[];
+};
+export declare const CAPTURE_PRODUCERS: readonly [{
+    readonly id: "cockpit-golden-frames";
+    readonly provenance: {
+        readonly source: "src/tui/cockpit/capture.ts";
+        readonly entrypoint: "regenerateGoldenFrames";
+        readonly revision: "golden-frame-v1";
+    };
+}, {
+    readonly id: "cockpit-colour-frames";
+    readonly provenance: {
+        readonly source: "src/tui/cockpit/capture.ts";
+        readonly entrypoint: "regenerateColourFrames";
+        readonly revision: "colour-frame-v1";
+    };
+}];
+export declare const CAPTURE_ARTIFACT_MANIFEST: {
+    readonly version: 1;
+    readonly producers: readonly [{
+        readonly id: "cockpit-golden-frames";
+        readonly provenance: {
+            readonly source: "src/tui/cockpit/capture.ts";
+            readonly entrypoint: "regenerateGoldenFrames";
+            readonly revision: "golden-frame-v1";
+        };
+    }, {
+        readonly id: "cockpit-colour-frames";
+        readonly provenance: {
+            readonly source: "src/tui/cockpit/capture.ts";
+            readonly entrypoint: "regenerateColourFrames";
+            readonly revision: "colour-frame-v1";
+        };
+    }];
+    readonly artifacts: readonly ({
+        path: string;
+        producer: string;
+        provenance: CaptureProducerProvenance;
+    } | {
+        path: string;
+        producer: string;
+        provenance: CaptureProducerProvenance;
+    })[];
+};
+/** Compatibility name for the pre-manifest gate API; now derived from one manifest. */
+export declare const REGENERABLE_CAPTURE_PATHS: readonly string[];
+export declare const PROTECTED_EVIDENCE_PREFIXES: readonly ["tests/fixtures/cockpit/anchors/", "tests/fixtures/cockpit/sources/", "tests/fixtures/cockpit/colour/sources/"];
+export declare function isProtectedEvidence(path: string): boolean;
+export type ArtifactPathClassification = {
+    readonly path: string;
+    readonly kind: "logic";
+    readonly reason: "protected-evidence" | "unmanifested" | "malformed-manifest" | "missing-producer" | "stale-provenance";
+    readonly error?: string;
+} | {
+    readonly path: string;
+    readonly kind: "capture";
+    readonly reason: "manifest-provenance";
+    readonly producer: string;
+    readonly provenance: CaptureProducerProvenance;
+};
+export declare function classifyArtifactPath(path: string, manifest?: unknown): ArtifactPathClassification;
+/** The path named by a citable capture receipt, or null when there is none. */
+export declare function setAsideReceiptPath(section: string): string | null;
+/**
+ * Whole-file source deletions retain their operation fact instead of spending
+ * the reader cap on bytes that no longer exist. Capture receipts and protected
+ * evidence are deliberately exempt from this older reduction.
+ */
+export declare function reviewableLogicDiff(diff: string): string;
+export type ArtifactDiffSection = {
+    readonly paths: readonly string[];
+    readonly kind: "capture" | "logic";
+    readonly reason: string;
+    readonly producer?: string;
+    readonly provenance?: CaptureProducerProvenance;
+    /** UTF-8 bytes left for a reviewer to read, including any receipt. */
+    readonly logicBytes: number;
+    /** UTF-8 bytes withheld behind the finite capture bound. */
+    readonly captureBytes: number;
+};
+export type ArtifactDiffMeasurement = {
+    readonly rendered: string;
+    readonly logicBytes: number;
+    readonly captureBytes: number;
+    readonly sections: readonly ArtifactDiffSection[];
+};
+/**
+ * Classify and compact a Git diff once. Invalid manifest facts remain ordinary
+ * logic. Valid capture content is replaced by one citable receipt, while its
+ * exact UTF-8 payload remains charged to the separate capture bucket.
+ */
+export declare function measureArtifactDiff(diff: string, manifest?: unknown): ArtifactDiffMeasurement;
+/** The original API now delegates to the provenance-backed measurement. */
+export declare function setAsideRegenerableCaptures(diff: string): string;
+export declare const MIN_CAPTURE_DIFF_CAP = 1000000;
+export declare const CAPTURE_DIFF_CAP_MULTIPLIER = 4;
+export declare function captureDiffCapFor(logicCap: number): number;

package/dist/gates/artifact-manifest.js

@@ -0,0 +1,357 @@
+/**
+ * Generated artifacts are not inferred from their directory or extension. A
+ * path receives capture accounting only when its manifest row names a
+ * registered producer and repeats that producer's current provenance exactly.
+ */
+const GOLDEN_PROVENANCE = {
+    source: "src/tui/cockpit/capture.ts",
+    entrypoint: "regenerateGoldenFrames",
+    revision: "golden-frame-v1",
+};
+const COLOUR_PROVENANCE = {
+    source: "src/tui/cockpit/capture.ts",
+    entrypoint: "regenerateColourFrames",
+    revision: "colour-frame-v1",
+};
+export const CAPTURE_PRODUCERS = [
+    { id: "cockpit-golden-frames", provenance: GOLDEN_PROVENANCE },
+    { id: "cockpit-colour-frames", provenance: COLOUR_PROVENANCE },
+];
+const goldenFrameNames = [
+    "run.width-stacked.80x24.txt",
+    "run.width-folded-keys.100x24.txt",
+    "run.width-three-column.140x24.txt",
+    "run.height-14.140x14.txt",
+    "run.height-18.140x18.txt",
+    "run.height-24.140x24.txt",
+    "run.height-40.140x40.txt",
+    "run.no-colour.140x24.txt",
+    "run.non-tty.140x24.txt",
+    "run.ci.140x24.txt",
+    "setup.width-stacked.80x24.txt",
+    "setup.width-folded-keys.100x24.txt",
+    "setup.width-three-column.140x24.txt",
+    "setup.height-14.140x14.txt",
+    "setup.height-18.140x18.txt",
+    "setup.height-24.140x24.txt",
+    "setup.height-40.140x40.txt",
+    "setup.no-colour.140x24.txt",
+    "setup.non-tty.140x24.txt",
+    "setup.ci.140x24.txt",
+];
+const colourFrameNames = [
+    "run-20260718-000943.colour.140x24.txt",
+    "run-20260718-000943.no-colour.140x24.txt",
+    "run-20260725-025004.interrupted.colour.140x24.txt",
+];
+const provenanceCopy = (provenance) => ({ ...provenance });
+export const CAPTURE_ARTIFACT_MANIFEST = {
+    version: 1,
+    producers: CAPTURE_PRODUCERS,
+    artifacts: [
+        ...goldenFrameNames.map((fixture) => ({
+            path: `tests/fixtures/cockpit/frames/${fixture}`,
+            producer: "cockpit-golden-frames",
+            provenance: provenanceCopy(GOLDEN_PROVENANCE),
+        })),
+        ...colourFrameNames.map((fixture) => ({
+            path: `tests/fixtures/cockpit/colour/${fixture}`,
+            producer: "cockpit-colour-frames",
+            provenance: provenanceCopy(COLOUR_PROVENANCE),
+        })),
+    ],
+};
+/** Compatibility name for the pre-manifest gate API; now derived from one manifest. */
+export const REGENERABLE_CAPTURE_PATHS = CAPTURE_ARTIFACT_MANIFEST.artifacts
+    .map((artifact) => artifact.path);
+export const PROTECTED_EVIDENCE_PREFIXES = [
+    "tests/fixtures/cockpit/anchors/",
+    "tests/fixtures/cockpit/sources/",
+    "tests/fixtures/cockpit/colour/sources/",
+];
+export function isProtectedEvidence(path) {
+    return PROTECTED_EVIDENCE_PREFIXES.some((prefix) => path.startsWith(prefix));
+}
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function isCanonicalRepoPath(value) {
+    if (typeof value !== "string" || value.length === 0)
+        return false;
+    if (value.startsWith("/") || value.includes("\\"))
+        return false;
+    const parts = value.split("/");
+    return parts.every((part) => part.length > 0 && part !== "." && part !== "..");
+}
+function parseProvenance(value) {
+    if (!isRecord(value))
+        return null;
+    const { source, entrypoint, revision } = value;
+    if (!isCanonicalRepoPath(source))
+        return null;
+    if (typeof entrypoint !== "string" || !/^[A-Za-z_$][\w$]*$/.test(entrypoint))
+        return null;
+    if (typeof revision !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(revision))
+        return null;
+    return { source, entrypoint, revision };
+}
+const sameProvenance = (left, right) => left.source === right.source
+    && left.entrypoint === right.entrypoint
+    && left.revision === right.revision;
+function indexManifest(manifest) {
+    if (!isRecord(manifest) || manifest.version !== 1) {
+        return "artifact manifest version must be 1";
+    }
+    if (!Array.isArray(manifest.producers) || !Array.isArray(manifest.artifacts)) {
+        return "artifact manifest producers and artifacts must be arrays";
+    }
+    const producers = new Map();
+    for (const [index, raw] of manifest.producers.entries()) {
+        if (!isRecord(raw) || typeof raw.id !== "string" || !raw.id.trim()) {
+            return `artifact manifest producer ${index} is malformed`;
+        }
+        const provenance = parseProvenance(raw.provenance);
+        if (!provenance)
+            return `artifact manifest producer ${raw.id} has malformed provenance`;
+        if (producers.has(raw.id))
+            return `artifact manifest producer ${raw.id} is duplicated`;
+        producers.set(raw.id, { id: raw.id, provenance });
+    }
+    const artifacts = new Map();
+    for (const [index, raw] of manifest.artifacts.entries()) {
+        if (!isRecord(raw) || !isCanonicalRepoPath(raw.path)
+            || typeof raw.producer !== "string" || !raw.producer.trim()) {
+            return `artifact manifest entry ${index} is malformed`;
+        }
+        const provenance = parseProvenance(raw.provenance);
+        if (!provenance)
+            return `artifact manifest entry ${raw.path} has malformed provenance`;
+        if (artifacts.has(raw.path))
+            return `artifact manifest path ${raw.path} is duplicated`;
+        artifacts.set(raw.path, { path: raw.path, producer: raw.producer, provenance });
+    }
+    return { producers, artifacts };
+}
+export function classifyArtifactPath(path, manifest = CAPTURE_ARTIFACT_MANIFEST) {
+    // Protected evidence wins even over a forged manifest row.
+    if (isProtectedEvidence(path)) {
+        return { path, kind: "logic", reason: "protected-evidence" };
+    }
+    const indexed = indexManifest(manifest);
+    if (typeof indexed === "string") {
+        return { path, kind: "logic", reason: "malformed-manifest", error: indexed };
+    }
+    const artifact = indexed.artifacts.get(path);
+    if (!artifact)
+        return { path, kind: "logic", reason: "unmanifested" };
+    const producer = indexed.producers.get(artifact.producer);
+    if (!producer) {
+        return {
+            path,
+            kind: "logic",
+            reason: "missing-producer",
+            error: `capture producer ${artifact.producer} is not registered`,
+        };
+    }
+    if (!sameProvenance(artifact.provenance, producer.provenance)) {
+        return {
+            path,
+            kind: "logic",
+            reason: "stale-provenance",
+            error: `capture provenance for ${path} does not match producer ${producer.id}`,
+        };
+    }
+    return {
+        path,
+        kind: "capture",
+        reason: "manifest-provenance",
+        producer: producer.id,
+        provenance: producer.provenance,
+    };
+}
+const SET_ASIDE_RECEIPT = /^set aside: regenerable capture (.+?) — \d+ bytes withheld\b/m;
+/** The path named by a citable capture receipt, or null when there is none. */
+export function setAsideReceiptPath(section) {
+    return SET_ASIDE_RECEIPT.exec(section)?.[1] ?? null;
+}
+const DIFF_SECTIONS = /(?=^diff --git )/m;
+function deletedPath(section) {
+    if (!/^deleted file mode /m.test(section))
+        return null;
+    const oldPath = /^--- (.+)$/m.exec(section)?.[1]
+        ?? /^Binary files (.+) and \/dev\/null differ$/m.exec(section)?.[1];
+    if (!oldPath || oldPath === "/dev/null")
+        return null;
+    return unquoteGitPath(oldPath).replace(/^a\//, "");
+}
+/**
+ * Whole-file source deletions retain their operation fact instead of spending
+ * the reader cap on bytes that no longer exist. Capture receipts and protected
+ * evidence are deliberately exempt from this older reduction.
+ */
+export function reviewableLogicDiff(diff) {
+    return diff.split(DIFF_SECTIONS).map((section) => {
+        if (setAsideReceiptPath(section))
+            return section;
+        const path = deletedPath(section);
+        if (!path || isProtectedEvidence(path))
+            return section;
+        return `deleted file: ${path}\n`;
+    }).join("");
+}
+function unquoteGitPath(raw) {
+    const value = raw.trim();
+    if (!value.startsWith('"') || !value.endsWith('"'))
+        return value;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return value.slice(1, -1);
+    }
+}
+function diffSidePath(raw) {
+    const value = unquoteGitPath(raw);
+    if (value === "/dev/null")
+        return null;
+    return value.replace(/^[ab]\//, "");
+}
+function gitHeaderTokens(raw) {
+    return raw.match(/"(?:\\.|[^"\\])*"|\S+/g) ?? [];
+}
+function parseContentSection(section) {
+    const lines = section.split("\n");
+    const minus = lines.findIndex((line) => line.startsWith("--- "));
+    if (minus === -1 || !lines[minus + 1]?.startsWith("+++ "))
+        return null;
+    const body = lines.slice(minus + 2);
+    if (!body.some((line) => line.startsWith("@@ ")))
+        return null;
+    return {
+        lines,
+        minus,
+        sides: [
+            diffSidePath(lines[minus].slice(4)),
+            diffSidePath(lines[minus + 1].slice(4)),
+        ],
+        body,
+    };
+}
+function sectionPaths(section, parsed) {
+    if (parsed)
+        return [...new Set(parsed.sides.filter((path) => path !== null))];
+    const renamedFrom = /^rename from (.+)$/m.exec(section)?.[1];
+    const renamedTo = /^rename to (.+)$/m.exec(section)?.[1];
+    if (renamedFrom || renamedTo) {
+        return [...new Set([renamedFrom, renamedTo].filter((path) => path !== undefined).map(unquoteGitPath))];
+    }
+    const header = /^diff --git (.+)$/m.exec(section)?.[1];
+    if (!header)
+        return [];
+    const tokens = gitHeaderTokens(header);
+    if (tokens.length !== 2)
+        return [];
+    return [...new Set(tokens.map(diffSidePath).filter((path) => path !== null))];
+}
+function hunkPayload(body, sign) {
+    return body
+        .filter((line) => line.startsWith(sign) || line.startsWith("\\"))
+        .map((line) => line[0] === sign ? line.slice(1) : line)
+        .join("\n");
+}
+function kindOnlyPaths(sections) {
+    const removed = new Map();
+    const added = new Map();
+    for (const section of sections) {
+        const parsed = parseContentSection(section);
+        if (!parsed)
+            continue;
+        const [before, after] = parsed.sides;
+        if (before && !after)
+            removed.set(before, hunkPayload(parsed.body, "-"));
+        else if (after && !before)
+            added.set(after, hunkPayload(parsed.body, "+"));
+    }
+    return new Set([...removed]
+        .filter(([path, payload]) => added.get(path) === payload)
+        .map(([path]) => path));
+}
+function sameCaptureProducer(classifications) {
+    if (!classifications.length || classifications.some((row) => row.kind !== "capture"))
+        return false;
+    const [first] = classifications;
+    return first !== undefined && classifications.every((row) => row.kind === "capture"
+        && row.producer === first.producer
+        && sameProvenance(row.provenance, first.provenance));
+}
+/**
+ * Classify and compact a Git diff once. Invalid manifest facts remain ordinary
+ * logic. Valid capture content is replaced by one citable receipt, while its
+ * exact UTF-8 payload remains charged to the separate capture bucket.
+ */
+export function measureArtifactDiff(diff, manifest = CAPTURE_ARTIFACT_MANIFEST) {
+    if (!diff.includes("diff --git ")) {
+        return {
+            rendered: diff,
+            logicBytes: Buffer.byteLength(diff, "utf8"),
+            captureBytes: 0,
+            sections: [],
+        };
+    }
+    const rawSections = diff.split(/(?=^diff --git )/m);
+    const kindOnly = kindOnlyPaths(rawSections);
+    const rendered = [];
+    const measurements = [];
+    for (const section of rawSections) {
+        const parsed = parseContentSection(section);
+        const paths = sectionPaths(section, parsed);
+        const classifications = paths.map((path) => classifyArtifactPath(path, manifest));
+        const validCapture = sameCaptureProducer(classifications);
+        const producer = validCapture ? classifications[0] : undefined;
+        const isKindOnly = paths.some((path) => kindOnly.has(path));
+        if (!parsed || !validCapture || !producer || isKindOnly) {
+            rendered.push(section);
+            measurements.push({
+                paths,
+                kind: validCapture ? "capture" : "logic",
+                reason: validCapture
+                    ? parsed ? "content-identical-kind-change" : "file-operation-only"
+                    : classifications.map((row) => row.reason).join(",") || "unparsed-diff-section",
+                ...(producer ? { producer: producer.producer, provenance: producer.provenance } : {}),
+                logicBytes: Buffer.byteLength(section, "utf8"),
+                captureBytes: 0,
+            });
+            continue;
+        }
+        const withheld = parsed.lines.slice(parsed.minus).join("\n");
+        const captureBytes = Buffer.byteLength(withheld, "utf8");
+        const receiptPath = paths.at(-1);
+        const receipt = `set aside: regenerable capture ${receiptPath} — ${captureBytes} bytes withheld (producer ${producer.producer}; provenance ${producer.provenance.source}#${producer.provenance.entrypoint}@${producer.provenance.revision})`;
+        const compact = `${parsed.lines.slice(0, parsed.minus).join("\n")}\n${receipt}\n`;
+        rendered.push(compact);
+        measurements.push({
+            paths,
+            kind: "capture",
+            reason: "manifest-provenance",
+            producer: producer.producer,
+            provenance: producer.provenance,
+            logicBytes: Buffer.byteLength(compact, "utf8"),
+            captureBytes,
+        });
+    }
+    return {
+        rendered: rendered.join(""),
+        logicBytes: measurements.reduce((sum, row) => sum + row.logicBytes, 0),
+        captureBytes: measurements.reduce((sum, row) => sum + row.captureBytes, 0),
+        sections: measurements,
+    };
+}
+/** The original API now delegates to the provenance-backed measurement. */
+export function setAsideRegenerableCaptures(diff) {
+    return measureArtifactDiff(diff).rendered;
+}
+// The default corpus is about 134 KiB. Capture bytes are bounded, never free;
+// the floor avoids making a deliberately lowered logic cap reintroduce Q14.
+export const MIN_CAPTURE_DIFF_CAP = 1_000_000;
+export const CAPTURE_DIFF_CAP_MULTIPLIER = 4;
+export function captureDiffCapFor(logicCap) {
+    return Math.max(MIN_CAPTURE_DIFF_CAP, logicCap * CAPTURE_DIFF_CAP_MULTIPLIER);
+}

package/dist/gates/baseline.d.ts

@@ -1,12 +1,18 @@
 import type { TickmarkrConfig } from "../config/config.js";
 import type { AcceptanceItem } from "../graph/schema.js";
+import { type ShResult } from "../run/git.js";
 import type { GateResult } from "./types.js";
+export interface BaselineCommand {
+    exitCode: number;
+    fingerprints: string[];
+    missingCommand?: boolean;
+    /** What this command actually took at capture, on a pristine tree. Absent in pre-v1.90 baselines. */
+    durationMs?: number;
+    /** The ceiling that measurement implies, persisted so every later battery uses the same number. */
+    ceilingMs?: number;
+}
 export interface Baseline {
-    commands: Record<string, {
-        exitCode: number;
-        fingerprints: string[];
-        missingCommand?: boolean;
-    }>;
+    commands: Record<string, BaselineCommand>;
     warnings?: BaselineWarning[];
 }
 export interface BaselineWarning {
@@ -14,9 +20,43 @@ export interface BaselineWarning {
     commands: string[];
     reason: string;
 }
+export type FailureClassification = "regression" | "infra";
+/**
+ * What a nonzero runner exit is evidence OF. `undefined` when the output names neither — the
+ * unreadable-runner case the existing fail-closed path already owns.
+ */
+export declare function classifyFailureOutput(output: string): FailureClassification | undefined;
 export declare const UNRECOGNIZED_FAILURE = "<unrecognized failure output>";
 export declare function fingerprint(output: string): string[];
+/**
+ * Q121s: the battery's forgiveness math, exported so tip-verify applies the IDENTICAL rule.
+ * Returns the failure fingerprints of `raw` that are NOT in the baseline entry (fresh), and
+ * whether the output carried no recognizable failure shape at all.
+ */
+export declare function freshFailures(entry: BaselineCommand | undefined, raw: string): {
+    failing: string[];
+    unreadable: boolean;
+};
 export declare function detectGateCommands(repoRoot: string, cfg: TickmarkrConfig): Record<string, string>;
+/**
+ * The ceiling a battery runs under: whichever is larger of the shipped constant and the slack applied
+ * to what this command actually measured. A pre-v1.90 baseline (no measurement) gets exactly the
+ * shipped constant, so nothing regresses on an existing on-disk baseline.json — the same read-old
+ * compat rule the fingerprint renormalizer follows.
+ */
+export declare const effectiveCeilingMs: (entry?: Pick<BaselineCommand, "durationMs" | "ceilingMs">) => number;
+/**
+ * The ONLY producer of a `ceiling-kill` gate result. It is gated on `timedOut`, which git.ts sets in
+ * exactly one place — inside the timer callback that issues the SIGKILL — so a process that exited on
+ * its own can never reach this text however it exited: a slow red suite, an unreadable runner, exit
+ * 137 from a kill somebody ELSE sent. Returning `undefined` rather than a result keeps that structural:
+ * every caller must go on to the ordinary verdict path, it cannot fall through into this one.
+ *
+ * A kill is not a verdict. The battery was still running when the machine took it away, so its exit
+ * code is evidence about the ceiling and nothing about the work — which is why this reports `infra`
+ * and never enters baseline forgiveness (there is no runner output to forgive).
+ */
+export declare function ceilingKillResult(gate: string, r: ShResult, ceilingMs: number): GateResult | undefined;
 export declare function captureBaseline(cwd: string, commands: Record<string, string>): Promise<Baseline>;
 export interface VacuousOracleWarning {
     kind: "vacuous-oracle";