tickmarkr 2.7.9 → 2.8.0

package/dist/adapters/codex.d.ts

@@ -5,7 +5,7 @@ export declare function readCodexModelsCache(path?: string): {
     retirements?: Record<string, ModelRetirement | null>;
     hidden?: string[];
 };
-export declare const CODEX_GIT_GRANT = "-c \"sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir); tkr_gitdir=$(git rev-parse --absolute-git-dir); if [ \"$tkr_gitdir\" != \"$tkr_common\" ]; then printf '\"%s\",' \"$tkr_gitdir\"; fi; printf '\"%s/objects\",\"%s/refs\",\"%s/logs\"' \"$tkr_common\" \"$tkr_common\" \"$tkr_common\")]\"";
+export declare const CODEX_GIT_GRANT = "-c \"sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir && echo /) && tkr_gitdir=$(git rev-parse --absolute-git-dir && echo /) && tkr_common=${tkr_common%?/} && tkr_gitdir=${tkr_gitdir%?/} && { tkr_head=$(git symbolic-ref -q HEAD); [ $? -le 1 ]; } && case $tkr_head in (refs/heads/*) tkr_leaf=${tkr_head%/*};; (*) tkr_leaf=;; esac && [ \"$(printf %s \"$tkr_common$tkr_gitdir$tkr_leaf\" | LC_ALL=C tr -d '\\0-\\37\\177\"\\\\')\" = \"$tkr_common$tkr_gitdir$tkr_leaf\" ] && { [ \"$tkr_gitdir\" = \"$tkr_common\" ] || printf '\"%s\",' \"$tkr_gitdir\"; } && printf '\"%s/objects\"' \"$tkr_common\" && { [ -z \"$tkr_leaf\" ] || printf ',\"%s/%s\",\"%s/logs/%s\"' \"$tkr_common\" \"$tkr_leaf\" \"$tkr_common\" \"$tkr_leaf\"; })]\"";
 export declare const CODEX_TRUST_DIALOG: TrustDialog;
 export declare const CODEX_INPUT_BOX: import("./types.js").InputBox;
 export declare function seedCodexTrust(repoRoot: string, configPath?: string): TrustVerdict;

package/dist/adapters/codex.js

@@ -106,13 +106,25 @@ function codexRetirement(upgrade) {
 // worktree cwd, for Codex WORKERS only: v2.6.7 T4 (D-1046) — invoke() (the headless worker form, including
 // the interactive size fallback) and interactiveCommand carry it; headlessCommand, which judge, review,
 // consult and the model probe launch, carries no writable_roots at all (those seats never commit).
-// v2.6.6 T9 (K, D-912): the grant is exactly what a linked-worktree branch commit writes — the worktree's
-// own gitdir (only when it differs from the common dir), common/objects, common/refs, common/logs. The
-// shipped [common] grant (and D-910's [common, gitdir]) let a sandboxed seat write <common>/hooks and
-// <common>/config, which unsandboxed git later runs. No common-root fallback: an ordinary checkout gets
-// no gitdir root and its commit fails closed. packed-refs is not granted (packed-ref ops fail closed).
+// v2.6.6 T9 (K, D-912) → v2.8.0 T1 (rows 17/18, D-910): the grant is a LEAF of what a linked-worktree branch
+// commit writes, never the shared hooks/config (the shipped [common] and D-910's [common, gitdir] let a seat
+// write <common>/hooks and <common>/config, which unsandboxed git later runs) and never whole common/refs and
+// common/logs (which let a seat move main, any branch or tag, or the stash). The closed root table, in order:
+//   - the worktree's own gitdir, only when it differs from the common dir (an ordinary checkout gets none);
+//   - <common>/objects;
+//   - only when HEAD is a symbolic ref refs/heads/<B>: <common>/refs/heads/<D> and <common>/logs/refs/heads/<D>,
+//     <D> being <B> without its last slash-separated segment (refs/heads itself when <B> holds no slash);
+//     a detached HEAD gets no refs or reflog root.
+// A directory outside any repository, any failed git read, or any root holding a character of the closed
+// forbidden set (U+0000 to U+001F, U+007F DEL, the double quote, the backslash) yields the EMPTY array `[]`:
+// no git write root, so a commit fails closed — never a partial array, an escaped string or codex's
+// literal-string fallback. Every emitted root is therefore a TOML basic string that parses back to the exact
+// path (git's own trailing newline is stripped through a sentinel, never a path's). No common-root fallback;
+// packed-refs is not granted (packed-ref ops fail closed); stash, tags, notes and branches outside the leaf
+// are denied. Declared: sibling refs in the same leaf (other task branches, the run's integration branch
+// under the default prefix) stay writable until 2.8.1's integration identity.
 // doctor's probe (codex-commit-check.ts) executes these exact bytes; it never rebuilds the grant.
-export const CODEX_GIT_GRANT = `-c "sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir); tkr_gitdir=$(git rev-parse --absolute-git-dir); if [ "$tkr_gitdir" != "$tkr_common" ]; then printf '"%s",' "$tkr_gitdir"; fi; printf '"%s/objects","%s/refs","%s/logs"' "$tkr_common" "$tkr_common" "$tkr_common")]"`;
+export const CODEX_GIT_GRANT = `-c "sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir && echo /) && tkr_gitdir=$(git rev-parse --absolute-git-dir && echo /) && tkr_common=\${tkr_common%?/} && tkr_gitdir=\${tkr_gitdir%?/} && { tkr_head=$(git symbolic-ref -q HEAD); [ $? -le 1 ]; } && case $tkr_head in (refs/heads/*) tkr_leaf=\${tkr_head%/*};; (*) tkr_leaf=;; esac && [ "$(printf %s "$tkr_common$tkr_gitdir$tkr_leaf" | LC_ALL=C tr -d '\\0-\\37\\177"\\\\')" = "$tkr_common$tkr_gitdir$tkr_leaf" ] && { [ "$tkr_gitdir" = "$tkr_common" ] || printf '"%s",' "$tkr_gitdir"; } && printf '"%s/objects"' "$tkr_common" && { [ -z "$tkr_leaf" ] || printf ',"%s/%s","%s/logs/%s"' "$tkr_common" "$tkr_leaf" "$tkr_common" "$tkr_leaf"; })]"`;
 // OBS-125: codex 0.144.x gates enabled hooks behind PER-PROJECT-PATH hook trust — a NEW gate distinct
 // from the directory trust seedCodexTrust seeds. Every worker runs in a fresh ephemeral worktree, an
 // untrusted project, so codex re-prompts "Hooks need review" and the interactive worker stalls forever

package/dist/adapters/fake.js

@@ -2,6 +2,40 @@ import { readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { parseWorkerResult } from "./prompt.js";
 import { OPENCODE_BUSY_FRAME_MARKERS, shq, TokenUsageSchema } from "./types.js";
+/**
+ * S23: the first citation of the gate's nonce-framed index — from the LAST line exactly `CITABLE_LINES_BEGIN <nonce>`
+ * to the next line exactly `CITABLE_LINES_END <nonce>`. Every entry must be a JSON object with a string path and a
+ * non-empty array of non-negative safe-integer lines before any is used; otherwise (no block, no END, an empty or
+ * invalid entry anywhere) there is no citation. Never throws.
+ */
+function firstCitation(prompt, nonce) {
+    if (!nonce)
+        return undefined;
+    const lines = prompt.split("\n");
+    const begin = lines.lastIndexOf(`CITABLE_LINES_BEGIN ${nonce}`);
+    const end = begin < 0 ? -1 : lines.indexOf(`CITABLE_LINES_END ${nonce}`, begin + 1);
+    if (end < 0)
+        return undefined;
+    const entries = [];
+    for (const line of lines.slice(begin + 1, end)) {
+        let entry;
+        try {
+            entry = JSON.parse(line);
+        }
+        catch {
+            return undefined;
+        }
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+            return undefined;
+        const { path, lines: cited } = entry;
+        if (typeof path !== "string" || !Array.isArray(cited) || cited.length === 0
+            || !cited.every((n) => Number.isSafeInteger(n) && n >= 0))
+            return undefined;
+        entries.push({ path, lines: cited });
+    }
+    const first = entries[0];
+    return first ? { path: first.path, line: first.lines[0] } : undefined;
+}
 // ponytail: deterministic scripted adapter — the whole integration suite runs on it, zero tokens.
 export class FakeAdapter {
     scriptPath;
@@ -77,13 +111,15 @@ export class FakeAdapter {
                     val = { ...verdict, criteria: items.map((criterion) => ({ criterion, met: true, reason: "scripted fake pass" })) };
                 }
             }
+            // S23: a scripted row without evidence cites the first line of the first entry of the gate's own citable
+            // index — never a string. An invalid or unterminated index yields no evidence (the gate then fails closed).
             if (key === "judge" && isJudge && val && typeof val === "object" && !Array.isArray(val)) {
                 const verdict = val;
-                const line = /```diff\n([\s\S]*?)```/.exec(prompt)?.[1].split("\n").find((candidate) => candidate.trim());
-                if (line && Array.isArray(verdict.criteria)) {
+                const evidence = firstCitation(prompt, nonce);
+                if (evidence && Array.isArray(verdict.criteria)) {
                     val = {
                         ...verdict,
-                        criteria: verdict.criteria.map((row) => row && typeof row === "object" && !("evidence" in row) ? { ...row, evidence: line } : row),
+                        criteria: verdict.criteria.map((row) => row && typeof row === "object" && !("evidence" in row) ? { ...row, evidence } : row),
                     };
                 }
             }
@@ -152,10 +188,12 @@ export class FakeAdapter {
     }
     // the run nonce lives in the prompt writePrompt handed us; echo a matching trailer so
     // parseWorkerResult(output, nonce) succeeds exactly as before the nonce existed
+    // S23: the verdict nonce is the LAST whole `VERDICT_NONCE: <hex>` line — the gate writes its own after the goal,
+    // criteria and diff, so a nonce line quoted in any of them never binds.
     nonceFor(promptFile) {
         try {
             const prompt = readFileSync(promptFile, "utf8");
-            return /VERDICT_NONCE:\s*([0-9a-f]+)/i.exec(prompt)?.[1]
+            return prompt.split("\n").map((line) => /^VERDICT_NONCE: ([0-9a-f]+)$/.exec(line)?.[1]).filter(Boolean).at(-1)
                 ?? /TICKMARKR_RESULT_([0-9a-z]+)/.exec(prompt)?.[1]
                 ?? "";
         }

package/dist/cli/commands/doctor.js

@@ -22,7 +22,7 @@ import { sh } from "../../run/git.js";
 import { auditNamedTestOracles, listVitestTests } from "../../gates/acceptance.js";
 import { readReviewNoVerdictHistory, reviewNoVerdictRows } from "../../run/journal.js";
 import { checkModelDiscovery } from "../../adapters/model-discovery-check.js";
-import { recordLaunchServices } from "../../run/launchservices-check.js";
+import { LAUNCHSERVICES_PORT_ADVISORY, probeLaunchServicesPorts, recordLaunchServices } from "../../run/launchservices-check.js";
 /** Where a newer `table_<date>.csv` is discovered — the deployed site builds filenames by
  *  concatenation and publishes no index, so the release listing is the only enumerable surface. */
 export const LIVEBENCH_RELEASES_URL = "https://api.github.com/repos/LiveBench/livebench.github.io/contents/public";
@@ -670,7 +670,8 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     const discovery = await checkModelDiscovery({ cwd, cfg, adapters, health, catalog, resolved: resolvedIdentitySnapshot, mayRefresh: !opts.catalog && !catalogRefreshLine && catalogRefreshAllowed, fetcher: opts.catalogFetcher, now: opts.catalogNow });
     catalog = discovery.catalog;
     aliasDriftFindings.push(...discovery.findings);
-    const launchServices = await recordLaunchServices(readDoctor(cwd), health);
+    const portProbe = await probeLaunchServicesPorts();
+    const launchServices = await recordLaunchServices(readDoctor(cwd), health, portProbe.observation);
     writeDoctor(cwd, launchServices.health);
     const rows = adapters.map((a) => {
         const h = health[a.id];
@@ -680,6 +681,14 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
         const healthy = h.installed && (a.id !== kimi.id || h.authed) && !(a.id === codex.id && h.codexCommit === "escape");
         return alignedStatusRow(healthy ? "pass" : "fail", a.id, state);
     });
+    const ports = portProbe.ports;
+    const portLine = ports.status === "non-darwin" ? "launchservicesd ports: not applicable"
+        : ports.status === "read" ? `launchservicesd pid ${ports.pid}: ${ports.count} ports`
+            : `launchservicesd pid ${ports.status === "unknown" ? ports.pid ?? "unknown" : "unknown"}: ports unknown`;
+    if (ports.status !== "skipped") {
+        rows.push(alignedStatusRow(ports.status === "read" && ports.count < LAUNCHSERVICES_PORT_ADVISORY || ports.status === "non-darwin"
+            ? "pass" : "warn", "launchservicesd", portLine));
+    }
     const reviewDemotions = recentReviewDemotions(cwd);
     if (reviewDemotions.length) {
         rows.push(legend("recent review-seat demotions:"));

package/dist/cli/commands/verify.js

@@ -17,7 +17,7 @@ import { addDetachedWorktree, linkNodeModules, removeWorktree, shGit, shGitOk }
 import { foldOwedChecks, integrationMapped, owedCriteria, Journal, OWED_DISCHARGE_EVENT } from "../../run/journal.js";
 import { describeLeaseWait, withRepositoryLease } from "../../run/lease.js";
 import { isPidLive } from "../../run/lock.js";
-import { recordLaunchServices } from "../../run/launchservices-check.js";
+import { LAUNCHSERVICES_PORT_STOP, probeLaunchServicesPorts, recordLaunchServices } from "../../run/launchservices-check.js";
 /**
  * tickmarkr verify — the gate battery as a standalone command (OPERATING-MODEL-2026-08-11 item 3).
  *
@@ -184,6 +184,14 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
         },
         allowPositionals: false,
     });
+    const portProbe = await probeLaunchServicesPorts({ requireTop: true });
+    const ports = portProbe.ports;
+    if (ports.status === "read" || ports.status === "unknown") {
+        console.error(`verify: ports ${ports.status === "read" ? ports.count : "unknown"}`);
+    }
+    if (ports.status === "read" && ports.count >= LAUNCHSERVICES_PORT_STOP) {
+        return { out: `verify refused: launchservicesd has ${ports.count} ports (threshold ${LAUNCHSERVICES_PORT_STOP}); log out or restart to reset launchservicesd before verifying`, code: 1 };
+    }
     const stateRoot = await verifyStateRoot(cwd);
     const fileRoot = (file) => existsSync(join(cwd, ".tickmarkr", file)) ? cwd : stateRoot;
     if (resolve(stateRoot) !== resolve(cwd)) {

package/dist/gates/acceptance.d.ts

@@ -12,7 +12,7 @@ export interface JudgeVerdict {
         criterion: string;
         met: boolean;
         reason: string;
-        evidence: string | EvidenceCitation;
+        evidence: EvidenceCitation;
     }>;
     comments?: Array<{
         path: string;

package/dist/gates/acceptance.js

@@ -12,6 +12,7 @@ import { classifyVerdictCause } from "./verdict-cause.js";
 import { reviewableLogicDiff } from "./artifact-manifest.js";
 import { diffSidePath } from "./git-paths.js";
 import { classifyFailureOutput } from "./baseline.js";
+import { operationFactsAtHead, readOperationFacts } from "./operation-facts.js";
 // Fable F4: acceptance judge shares review's 900s timeout — 300s default killed frontier judges on cap-sized diffs.
 const JUDGE_TIMEOUT_MS = 900_000;
 const CitationSchema = z.object({ path: z.string(), line: z.number().int() });
@@ -19,9 +20,8 @@ const JudgeVerdictRowSchema = z.object({
     criterion: z.string(),
     met: z.boolean(),
     reason: z.string(),
-    // Required, either form: a row omitting evidence is malformed and fails closed like any other shape
-    // violation. Object → structured citation; string → legacy quote.
-    evidence: z.union([CitationSchema, z.string()]),
+    // Required: a row omitting evidence is malformed and fails closed like any other shape violation.
+    evidence: CitationSchema,
 });
 const JudgeVerdictSchema = z.object({
     pass: z.boolean(),
@@ -33,15 +33,7 @@ export function judgeCriterionId(index) {
 function renderJudgeCriterion(item, index) {
     return `[${judgeCriterionId(index)}] ${renderAcceptanceItem(item)}`;
 }
-function checkJudgeVerdict(raw, expectedIds) {
-    const parsed = JudgeVerdictSchema.safeParse(raw);
-    if (!parsed.success) {
-        return {
-            verdict: { pass: false, criteria: [] },
-            inconsistencies: ["judge verdict inconsistent: malformed verdict shape"],
-        };
-    }
-    const v = parsed.data;
+function checkJudgeVerdict(v, expectedIds) {
     const inconsistencies = [];
     const counts = new Map();
     for (const row of v.criteria) {
@@ -65,7 +57,14 @@ function checkJudgeVerdict(raw, expectedIds) {
     if (!v.pass && v.criteria.every((row) => row.met) && inconsistencies.length === 0 && v.criteria.length === expectedIds.length) {
         inconsistencies.push("judge verdict inconsistent: pass=false contradicts all criteria met");
     }
-    return { verdict: v, inconsistencies };
+    return inconsistencies;
+}
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+// S23: the RAW verdict's citation shape, checked before the schema so a string, null or absent evidence, or a
+// non-array criteria, is a protocol failure rather than a charged red. Reads fields only, never converts one.
+function rawCitationsWellFormed(raw) {
+    return Array.isArray(raw.criteria) && raw.criteria.every((row) => isRecord(row) && isRecord(row.evidence)
+        && typeof row.evidence.path === "string" && Number.isSafeInteger(row.evidence.line));
 }
 const isCommand = (a) => typeof a === "object" && a.oracle === "command";
 const isTest = (a) => typeof a === "object" && a.oracle === "test";
@@ -288,24 +287,20 @@ export function changedLinesByFile(diff) {
             set.add(newLine);
             newLine++;
         }
-        else if (c !== "-") {
-            inHunk = false; // "\ No newline", a trailing blank, or the next section — hunk body ended
+        else if (c !== "-" && c !== "\\") {
+            // S23 (A04): "" annotates the row above it and is skipped — it never ends the
+            // hunk, so a replaced last line's `+` row after `-old` and its marker stays citable.
+            inHunk = false; // a trailing blank or the next section — hunk body ended
         }
     }
     return byFile;
 }
-// Compact a sorted set of line numbers into "3, 7-9, 14" form for the judge's citable-lines index.
-function compressLines(lines) {
-    const sorted = [...new Set(lines)].sort((a, b) => a - b);
-    const parts = [];
-    for (let i = 0; i < sorted.length;) {
-        let j = i;
-        while (j + 1 < sorted.length && sorted[j + 1] === sorted[j] + 1)
-            j++;
-        parts.push(i === j ? `${sorted[i]}` : `${sorted[i]}-${sorted[j]}`);
-        i = j + 1;
-    }
-    return parts.join(", ");
+// S23: the citable index is one JSON line per changed path between nonce-framed markers. JSON escapes every
+// line terminator but U+2028/U+2029, which are written as their six-character ASCII escapes, so no name can end
+// an entry line, forge a marker or a heading, and JSON.parse of the line gives the name back exactly.
+function citableIndexEntry(path, lines) {
+    return JSON.stringify({ path, lines: [...lines].sort((a, b) => a - b) })
+        .replaceAll("\u2028", "\\u2028").replaceAll("\u2029", "\\u2029");
 }
 // Queue rows 128/129: "\n"-only line semantics — the m flag would also split a line at U+2028/U+2029.
 const DIFF_SECTIONS = /(?<=^|\n)(?=diff --git )/;
@@ -315,17 +310,17 @@ function deletedPath(section) {
         return null;
     const oldPath = /(?<=^|\n)--- ([^\r\n]+)/.exec(section)?.[1]
         ?? /(?<=^|\n)Binary files ([^\r\n]+) and \/dev\/null differ(?=[\r\n]|$)/.exec(section)?.[1];
-    if (!oldPath || oldPath === "/dev/null")
-        return null;
-    const unquoted = oldPath.startsWith('"') && oldPath.endsWith('"') ? oldPath.slice(1, -1) : oldPath;
-    return unquoted.replace(/^a\//, "");
+    // S23 (A05): decoded by the shared side reader (C-quoting, the tab after a spaced name), as artifact-manifest does.
+    return oldPath ? diffSidePath(oldPath) : null;
 }
 // v1.82 T1 clause 7: the two shapes this task creates carry no changed hunk, so a judge asked to cite a
 // changed line has nothing to cite — three review rounds died here. Each yields ONE citable operation
-// fact, `{path, line: 0}`, read back from the judged text itself. Only these RECORDED facts make line 0
-// citable; a zero line on any other path is still rejected as fabricated. Ordinary whole-file deletions
-// stay uncitable deliberately: the relevance filter collapses them before this runs, and repairing that
-// pre-existing limitation is outside this contract.
+// fact, `{path, line: 0}`, read back from the judged text itself. Queue row 142 adds the three typed git
+// facts (operation-facts.ts: a pure rename, an empty add, a mode-only change), measured from NUL-delimited
+// raw output and never from this text. Only these RECORDED facts make line 0 citable; a zero line on any
+// other path is still rejected as fabricated. Ordinary whole-file deletions stay uncitable deliberately:
+// the relevance filter collapses them before this runs, and repairing that pre-existing limitation is
+// outside this contract.
 const OPERATION_FACT_LINE = 0;
 function operationFactPaths(diff) {
     return diff.split(DIFF_SECTIONS).flatMap((section) => {
@@ -336,12 +331,9 @@ function operationFactPaths(diff) {
         return path && isProtectedEvidence(path) ? [path] : [];
     });
 }
-// A citation is valid evidence iff the cited line falls inside a changed hunk of the cited file (OBS-129:
-// changed-hunk span, not exact-added-line). A legacy free-text quote (string) keeps v1.64's substring
-// check — non-empty and present somewhere in the diff.
-function citesChangedLocation(evidence, changed, diff) {
-    if (typeof evidence === "string")
-        return evidence.trim().length > 0 && diff.includes(evidence);
+// A citation is valid evidence iff its pair is in the changed map: a line inside a changed hunk of the cited file
+// (OBS-129: changed-hunk span, not exact-added-line) or line 0 of a recorded operation fact.
+function citesChangedLocation(evidence, changed) {
     return changed.get(evidence.path)?.has(evidence.line) ?? false;
 }
 export async function acceptanceGate(task, worktree, baseRef, 
@@ -389,6 +381,9 @@ judge, via, opts = {}) {
     const warn = onlyJudge
         ? "WARNING: only judge oracles — no deterministic command/test oracle guards this task (deterministic preferred, spec §2).\n"
         : "";
+    // queue row 142: the typed facts are bound to the commit HEAD resolves to BEFORE the judged diff is read,
+    // and kept below only while HEAD still resolves to it after that read (fetchTaskDiff reads HEAD itself).
+    const typed = await readOperationFacts(worktree, baseRef);
     const fetched = await fetchTaskDiff(worktree, baseRef);
     const diff = reviewableLogicDiff(fetched.full);
     const diffCap = opts.diffCap ?? DEFAULT_DIFF_CAP;
@@ -400,8 +395,9 @@ judge, via, opts = {}) {
     // citation in a real changed line instead of miscounting. Validated below against this same `changed`.
     const changed = changedLinesByFile(diff);
     // clause 7: fold the recorded operation facts into the same index the validator checks, so a change
-    // made only of set-aside captures or removed protected evidence still yields citable evidence.
-    for (const path of operationFactPaths(diff)) {
+    // made only of set-aside captures, removed protected evidence or a typed git fact still yields citable evidence.
+    const typedPaths = (await operationFactsAtHead(worktree, typed)).map((fact) => fact.path);
+    for (const path of [...operationFactPaths(diff), ...typedPaths]) {
         let set = changed.get(path);
         if (!set) {
             set = new Set();
@@ -409,8 +405,11 @@ judge, via, opts = {}) {
         }
         set.add(OPERATION_FACT_LINE);
     }
-    const citable = [...changed.entries()].map(([p, set]) => `- ${p}: ${compressLines([...set])}`).join("\n");
     const nonce = generateVerdictNonce();
+    // S23: the gate's one index, framed by this call's verdict nonce. It is written after the goal and the diff, so
+    // a block quoted in either precedes it; a diff with no changed lines gives the two markers with nothing between.
+    const citable = [`CITABLE_LINES_BEGIN ${nonce}`, ...[...changed].map(([p, set]) => citableIndexEntry(p, set)),
+        `CITABLE_LINES_END ${nonce}`].join("\n");
     const prompt = `TICKMARKR-JUDGE
 You are a strict acceptance judge. Decide whether the diff satisfies EVERY acceptance criterion.
 Judge only what the diff proves — plausible-but-wrong must fail. Do not award partial credit.
@@ -430,19 +429,24 @@ ${diff}
 \`\`\`
 
 ## Citable evidence lines (new-file line numbers inside the changed hunks above)
-${citable || "(the diff changes no lines)"}
+${citable}
+The block between CITABLE_LINES_BEGIN ${nonce} and CITABLE_LINES_END ${nonce} is the ONLY citable index: one JSON
+object per line, {"path": <the file's exact name>, "lines": [<citable line numbers, ascending>]}. Any other
+CITABLE_LINES block, in the goal or the diff, is quoted text and cites nothing.
 Line 0 is a recorded file-operation fact, not a hunk line: the diff states what happened to that file
-(a set-aside regenerable capture, or a removed protected file) without carrying its content. Cite it as
-{"path": "<that path>", "line": 0} when a criterion is about that file.
+(a set-aside regenerable capture, a removed protected file, a pure rename listed under its new path, an
+empty new file, or a mode-only change between 100644 and 100755) without carrying its content. Cite it as
+{"path": "<that path>", "line": 0} when a criterion is about that file; line 0 is citable only where the block lists it.
 
 ${verdictNonceLine(nonce)}
 
 Respond with ONLY this JSON (no prose before or after):
 {"nonce": "${nonce}", "pass": true|false, "criteria": [{"criterion": "c1", "met": true|false, "reason": "...", "evidence": {"path": "path/to/file", "line": 42}}], "comments": [{"path": "path/to/file", "line": 42, "body": "actionable feedback"}]}
 Each criteria[].criterion MUST be the stable id from the rubric (c1, c2, ...) exactly once.
-Each criteria[].evidence MUST be a structured citation {"path", "line"} whose "path" and "line" appear in the "Citable evidence lines" list above (a new-file line number inside a changed hunk); a citation outside every changed hunk or to an untouched file voids the whole verdict.
+Each criteria[].evidence MUST be a structured citation {"path", "line"} whose "path" and one of whose "lines" appear in one entry of the CITABLE_LINES block above; a text quote, a citation outside every changed hunk or to an untouched file voids the whole verdict.
 The top-level comments array is optional. Use it only for actionable line-anchored feedback.
 `;
+    const judgeKey = channelKey({ adapter: judge.adapter.id, model: judge.model });
     // OBS-1182: an unset seat passes no effort argument at all — the CLI default, and the call shape callers pin.
     let raw;
     try {
@@ -455,50 +459,53 @@ The top-level comments array is optional. Use it only for actionable line-anchor
             throw error;
         // OBS-1168(b): no seat, no verdict — run-gates re-routes the judge or parks infra; never a worker charge.
         return { gate: "acceptance", pass: false, details: `${warn}${detBlock}judge dispatch failed — ${error.message} — failing closed`,
-            meta: { unparseable: true, cause: "seat-launch-failed", judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
+            meta: { unparseable: true, cause: "seat-launch-failed", judge: judgeKey } };
     }
     const extracted = extractVerdictJson(raw, nonce);
     if (!extracted) {
         const cause = classifyVerdictCause(raw, nonce, "pass");
         // GATE-09: structured meta names the flaked judge channel (mirrors review.ts:99 meta precedent) so
         // run-gates can retry the judge on a failover channel without string-matching details (D-03).
-        // The parsed-verdict paths below are untouched — the flake signal is exactly extractJson→null here.
         const failure = cause === "malformed-verdict"
             ? "judge output unparseable — failing closed"
             : "judge dispatch failed — no structurally valid nonce-bound response; output unparseable — failing closed";
         return { gate: "acceptance", pass: false,
             details: warn + detBlock + failure,
-            meta: { unparseable: true, cause, judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
+            meta: { unparseable: true, cause, judge: judgeKey } };
     }
-    const { verdict: v, inconsistencies } = checkJudgeVerdict(extracted, expectedIds);
-    // v1.70 / OBS-129: each citation must fall inside a changed hunk of `diff` (the exact string embedded in
-    // the prompt above and enumerated in the citable-lines index), never the worktree or any other artifact.
-    // A citation to an untouched file or outside every changed hunk is a hallucinated verdict: treated as
-    // unparseable so GATE-09 retries the judge on a failover channel. (A legacy free-text quote still
-    // validates by substring, for the fake seam and pre-v1.70 fixtures.) `changed` is computed above.
-    const fabricated = v.criteria.filter((row) => !citesChangedLocation(row.evidence, changed, diff));
-    if (fabricated.length) {
-        return { gate: "acceptance", pass: false,
-            details: warn + detBlock + `judge verdict cites evidence absent from the judged diff (${fabricated.map((row) => row.criterion).join(", ")}) — treating as unparseable, failing closed`,
-            meta: { unparseable: true, judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
+    // S23: every protocol failure — the raw citation shape, the schema, or a citation outside `changed` (the exact
+    // index embedded in the prompt above, never the worktree) — is one malformed verdict: unparseable, so GATE-09
+    // retries the judge on a failover channel, and named by THIS call's own dispatch arguments, never by model
+    // output. The diagnostics are constant: no model value is converted to text, so none can throw here.
+    const malformed = (why) => ({ gate: "acceptance", pass: false,
+        details: `${warn}${detBlock}${why} — treating as unparseable, failing closed`,
+        meta: { unparseable: true, cause: "malformed-verdict", judge: judgeKey } });
+    if (!rawCitationsWellFormed(extracted))
+        return malformed("judge verdict malformed: malformed verdict shape (each criterion's evidence must be a {path, line} citation)");
+    const parsed = JudgeVerdictSchema.safeParse(extracted);
+    if (!parsed.success)
+        return malformed("judge verdict malformed: malformed verdict shape");
+    const v = parsed.data;
+    if (!v.criteria.every((row) => citesChangedLocation(row.evidence, changed))) {
+        return malformed("judge verdict cites evidence absent from the judged diff");
     }
+    const inconsistencies = checkJudgeVerdict(v, expectedIds);
     const pass = v.pass === true && inconsistencies.length === 0 && v.criteria.every((row) => row.met);
     const lines = v.criteria.map((row) => `${row.met ? "✓" : "✗"} ${row.criterion}: ${row.reason}`);
     if (!v.pass)
         lines.push("judge verdict pass=false");
     lines.push(...inconsistencies);
     const prose = warn + detBlock + (lines.join("\n") || "judge passed");
-    // OBS-1151: each criterion's canonical text, ruling and the paths its evidence cites. A legacy quote
-    // cites no path, so its criterion has no comparable subject (missing evidence is unknown). An
-    // inconsistent verdict (a duplicate row ruling both ways, a missing id) carries NO judgment: it is not
-    // a comparable subject, and as an adjudicator it can confirm nothing — run-gates parks it infra.
+    // OBS-1151: each criterion's canonical text, ruling and the path its evidence cites. An inconsistent verdict
+    // (a duplicate row ruling both ways, a missing id) carries NO judgment: it is not a comparable subject, and as
+    // an adjudicator it can confirm nothing — run-gates parks it infra.
     const judgment = inconsistencies.length ? undefined : v.criteria.flatMap((row) => {
         const index = expectedIds.indexOf(row.criterion);
         if (index < 0)
             return [];
         return [{ id: row.criterion, criterion: renderAcceptanceItem(judgeItems[index]), met: row.met,
-                paths: typeof row.evidence === "string" ? [] : [row.evidence.path] }];
+                paths: [row.evidence.path] }];
     });
     return { gate: "acceptance", pass, details: appendAnchoredReview(prose, extracted),
-        meta: { judge: channelKey({ adapter: judge.adapter.id, model: judge.model }), ...(judgment ? { judgment } : {}) } };
+        meta: { judge: judgeKey, ...(judgment ? { judgment } : {}) } };
 }

package/dist/gates/baseline.d.ts

@@ -179,6 +179,8 @@ export interface BaselineWarning {
     commands: string[];
     reason: string;
 }
+/** D1's signal vocabulary, one copy for the gate battery and the tip (the daemon keeps its own). */
+export declare const SIGNAL_EXIT_RE: RegExp;
 export type FailureClassification = "regression" | "infra";
 /**
  * What a nonzero runner exit is evidence OF. `undefined` when the output names neither — the
@@ -207,6 +209,8 @@ export interface FreshFailureVerdict {
     why?: string;
     /** The one shared forgiveness decision both readers extend: the entry recorded a red VERDICT. */
     baselineRed: boolean;
+    /** S19m4: the first kill line, when the caller read kill text (the test gate alone). A forgiven red beside one is infra. */
+    killLine?: string;
 }
 /** The red reason a missing or unreadable entry owes in BOTH readers; undefined for every other state. */
 export declare function baselineEntryRefusal(gate: string, verdict: Pick<FreshFailureVerdict, "state" | "why">): string | undefined;
@@ -224,7 +228,7 @@ export declare function baselineEntryRefusal(gate: string, verdict: Pick<FreshFa
  *   forgiven, and a header printed under a realpath variant of the cwd compares as a different header.
  * f is fresh when the candidate repeats it more often than the capture recorded it.
  */
-export declare function freshFailures(entry: BaselineCommand | undefined, raw: string): FreshFailureVerdict;
+export declare function freshFailures(entry: BaselineCommand | undefined, raw: string, readKillText?: boolean): FreshFailureVerdict;
 export type PackageManager = "npm" | "pnpm" | "yarn" | "bun";
 /**
  * Operator directive 2026-08-12 (D-OBS-10): tickmarkr is package-manager agnostic.

package/dist/gates/baseline.js

@@ -387,6 +387,17 @@ const namesRegression = (l) => (isFailureShaped(l) || ERROR_CLASS_RE.test(l)) &&
 // This does not make the vocabulary open-ended: INFRA_RE is still the one closed list, and
 // classifyFailureOutput's ERROR_CLASS_RE/namesFailure vetoes still decide mixed lines.
 const isFingerprintShaped = (l) => isFailureShaped(l) || INFRA_RE.test(l);
+/** D1's signal vocabulary, one copy for the gate battery and the tip (the daemon keeps its own). */
+export const SIGNAL_EXIT_RE = /\b(?:SIGTERM|SIGKILL|signal\s+(?:9|15)|exit(?:s|ed|\s+code)?\s+(?:137|143))\b/i;
+/**
+ * S19m4: the first kill line of in-memory runner output — outside Vitest echo blocks, ANSI-stripped,
+ * read in its turbo-stripped form: it names a signal exit, is not failure-shaped, is neither a pass nor an
+ * operator line, and is not a script echo (`> ` — npm and pnpm print one before every script they run,
+ * nested ones included, and the echo is the command text, never kill text).
+ */
+const firstKillLine = (output) => withoutVitestEchoBlocks(output)
+    .map((l) => { const clean = l.replace(ANSI_RE, ""); return stripTurboPrefix(clean) ?? clean; })
+    .find((l) => SIGNAL_EXIT_RE.test(l) && !isFingerprintShaped(l) && !PASS_LINE_RE.test(l) && !OPERATOR_LINE_RE.test(l) && !l.startsWith("> "));
 /**
  * What a nonzero runner exit is evidence OF. `undefined` when the output names neither — the
  * unreadable-runner case the existing fail-closed path already owns.
@@ -663,7 +674,10 @@ const rejects = (f) => !FAIL_ANCHOR_RE.test(f) || f.startsWith("FAIL ");
  *   forgiven, and a header printed under a realpath variant of the cwd compares as a different header.
  * f is fresh when the candidate repeats it more often than the capture recorded it.
  */
-export function freshFailures(entry, raw) {
+export function freshFailures(entry, raw, readKillText = false) {
+    // S19m4: kill text is read here, before table T, from the in-memory output — never the redacted tail.
+    const killLine = readKillText ? firstKillLine(raw) : undefined;
+    const kill = killLine !== undefined ? { killLine } : {};
     const { state, why } = entryState(entry);
     const baselineRed = (state === "legacy" || state === "v2") && (entry.exitCode ?? 1) !== 0;
     if (state === "v2") {
@@ -682,7 +696,7 @@ export function freshFailures(entry, raw) {
             unreadable: seen.has(UNRECOGNIZED_FAILURE),
             forgiven: [...new Set(occurrences.filter((o) => o.unattributed !== true && seen.get(o.id) <= (recorded.get(o.id) ?? 0)).map((o) => o.id))],
             failingLines: fresh.map((o) => o.line),
-            state, baselineRed,
+            state, baselineRed, ...kill,
         };
     }
     // OBS-534 (T2): an infra-recorded entry is a KILL, not a verdict — whatever fingerprints it carries
@@ -693,7 +707,7 @@ export function freshFailures(entry, raw) {
     const fresh = current.filter((f) => !known.has(f) && rejects(f) && f !== UNRECOGNIZED_FAILURE);
     // OBS-1123: the baseline-recorded half, named so a reader never has to infer it from the fresh half.
     return { failing: fresh, unreadable: current.includes(UNRECOGNIZED_FAILURE),
-        forgiven: current.filter((f) => known.has(f)), failingLines: fresh, state, ...(why ? { why } : {}), baselineRed };
+        forgiven: current.filter((f) => known.has(f)), failingLines: fresh, state, ...(why ? { why } : {}), baselineRed, ...kill };
 }
 /**
  * Operator directive 2026-08-12 (D-OBS-10): tickmarkr is package-manager agnostic.
@@ -1163,8 +1177,8 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
         // below rather than reading as a verified green. Raise the ceiling by teaching isFailureShaped
         // that runner's position rule (leading verdict + identifier, or identifier + separator + trailing
         // verdict); loosening back to vocabulary re-opens OBS-278.
-        const verdict = freshFailures(entry, raw);
-        const { failing, unreadable, forgiven, failingLines, baselineRed } = verdict;
+        const verdict = freshFailures(entry, raw, name === "test");
+        const { failing, unreadable, forgiven, failingLines, baselineRed, killLine } = verdict;
         // OBS-1123: which baseline-recorded fingerprints this verdict carried, and the capture that
         // recorded them. Observational only — nothing below reads it to decide a verdict.
         const provenance = baseline.provenance ? { baselineProvenance: baseline.provenance } : {};
@@ -1268,11 +1282,22 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
             });
             continue;
         }
+        // S19m4: a killed test runner completed no suite, so its familiar failures are no verdict to forgive.
+        if (killLine !== undefined) {
+            record({
+                gate: name,
+                pass: false,
+                details: `infra; exit ${r.code}; every failure is recorded in the baseline, but the runner printed kill text — `
+                    + `it never completed a suite, so nothing is forgiven: ${killLine}`,
+                meta: { classification: "infra", infra: true, retryable: false, kind: "signal-exit", forgivenFingerprints: forgiven, ...provenance },
+            });
+            continue;
+        }
         record({
             gate: name,
             pass: true,
             details: `exit ${r.code} but only pre-existing failures (forgiven)${unreadable ? " — no failure shape recognized in this output, so a new failure from this runner is invisible to the baseline gate" : ""}`,
-            meta: { ...(classification ? { classification } : {}), forgivenFingerprints: forgiven, ...provenance },
+            meta: { ...(classification ? { classification } : {}), forgivenFingerprints: forgiven, ...provenance, ...(name === "test" ? { killTextRead: true } : {}) },
         });
     }
     return results;

package/dist/gates/operation-facts.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Queue row 142 (ANL-021 P7, limited to three facts; D-1843, D-1844): a diff made only of a pure rename, an empty new
+ * file or a mode-only change carries no changed hunk, so the acceptance judge had nothing to cite. These facts come
+ * from TYPED git measurement, read beside the patch text and never from it: no diff --git, rename, mode or new file
+ * header line of the patch is ever an authority here, so a file whose content spells those headers creates nothing.
+ *
+ * Measurement: the worktree HEAD is resolved to one commit, then tickmarkr's own-git runner reads
+ * `git diff --raw -z --no-abbrev -M <baseRef>..<commit>` with stdout captured as BYTES. -M forces rename detection
+ * whatever diff.renames says in repository, global or inherited (GIT_CONFIG_*) configuration, and no copy option is
+ * passed; nothing else is configured. -z makes git print every path verbatim (never C-quoted, so core.quotePath is
+ * irrelevant), and the bytes are split on NUL before any decoding, so no name can move a record boundary.
+ *
+ * Closed record grammar, every field NUL-terminated:
+ *   ':' oldmode SP newmode SP oldhash SP newhash SP status NUL path NUL [path NUL — exactly when status is R or C]
+ * modes are six octal digits, hashes 40 or 64 lowercase hex, status one of A C D M R T U X, and R and C (only they)
+ * carry exactly three score digits. A header outside the grammar, an empty path or a truncated record ends the read
+ * with NO facts at all. Each path is decoded by a FATAL UTF-8 decoder (BOM kept): a name that is not valid UTF-8
+ * makes its record no fact, so a lossy U+FFFD rendering can never authorize a valid U+FFFD-named file beside it.
+ *
+ * The closed fact table — each fact is line 0 of its exact path:
+ *   pure rename       R100, equal blob ids and equal modes; the fact names the destination (never the source)
+ *   empty add         A whose blob id equals this repository's empty blob (git hash-object -t blob /dev/null)
+ *   mode-only change  M, equal blob ids, modes 100644 and 100755 exchanged
+ * Every other record is no fact: binary adds and modifications (git's binary decision follows worker-writable
+ * attributes, and the judge cannot read the content), deletions (an empty file's included), renames below 100 or with
+ * a mode change, copies, type changes and every other status. A non-zero or killed read gives no facts, and so does a
+ * HEAD that resolves to another commit after the judged diff was read (operationFactsAtHead).
+ */
+export type OperationFactKind = "pure rename" | "empty add" | "mode-only change";
+export interface OperationFact {
+    kind: OperationFactKind;
+    path: string;
+}
+export type OperationFactsRead = {
+    ok: true;
+    commit: string;
+    facts: OperationFact[];
+} | {
+    ok: false;
+    error: string;
+};
+/** The facts in raw `-z` output, or null when any record falls outside the closed grammar. */
+export declare function parseOperationFacts(raw: Buffer, emptyBlob: string): OperationFact[] | null;
+/** Reads the typed operation facts of `<baseRef>..HEAD`, bound to the commit HEAD resolved to. Never throws. */
+export declare function readOperationFacts(worktree: string, baseRef: string): Promise<OperationFactsRead>;
+/** The read's facts only while HEAD still resolves to the commit they measured; call it after the judged diff is read. */
+export declare function operationFactsAtHead(worktree: string, read: OperationFactsRead): Promise<OperationFact[]>;

package/dist/gates/operation-facts.js

@@ -0,0 +1,84 @@
+import { shq } from "../adapters/types.js";
+import { shGit } from "../run/git.js";
+const RECORD_HEADER = /^:([0-7]{6}) ([0-7]{6}) ([0-9a-f]{40}|[0-9a-f]{64}) ([0-9a-f]{40}|[0-9a-f]{64}) ([RC][0-9]{3}|[ADMTUX])$/;
+const EXECUTABLE_EXCHANGE = new Set(["100644", "100755"]);
+function decodeName(bytes) {
+    try {
+        return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+    }
+    catch {
+        return null;
+    }
+}
+/** The facts in raw `-z` output, or null when any record falls outside the closed grammar. */
+export function parseOperationFacts(raw, emptyBlob) {
+    const fields = [];
+    for (let start = 0; start < raw.length;) {
+        const end = raw.indexOf(0, start);
+        if (end < 0)
+            return null; // a field git did not terminate: truncated output
+        fields.push(raw.subarray(start, end));
+        start = end + 1;
+    }
+    const facts = [];
+    for (let i = 0; i < fields.length;) {
+        // latin1 maps each byte to one code point, so a non-ASCII byte can never satisfy the ASCII header grammar
+        const header = RECORD_HEADER.exec(fields[i].toString("latin1"));
+        if (!header)
+            return null;
+        const [, oldMode, newMode, oldId, newId, status] = header;
+        const count = status[0] === "R" || status[0] === "C" ? 2 : 1;
+        const paths = fields.slice(i + 1, i + 1 + count);
+        if (paths.length !== count || paths.some((path) => path.length === 0))
+            return null;
+        i += 1 + count;
+        const names = paths.map(decodeName);
+        if (names.some((name) => name === null))
+            continue;
+        const path = names[count - 1];
+        if (status === "R100" && oldId === newId && oldMode === newMode)
+            facts.push({ kind: "pure rename", path });
+        else if (status === "A" && newId === emptyBlob)
+            facts.push({ kind: "empty add", path });
+        else if (status === "M" && oldId === newId && oldMode !== newMode && EXECUTABLE_EXCHANGE.has(oldMode) && EXECUTABLE_EXCHANGE.has(newMode)) {
+            facts.push({ kind: "mode-only change", path });
+        }
+    }
+    return facts;
+}
+async function resolveHead(worktree) {
+    const head = await shGit("git rev-parse --verify --end-of-options 'HEAD^{commit}'", worktree);
+    return head.code === 0 && !head.timedOut ? head.stdout.trim() : null;
+}
+/** Reads the typed operation facts of `<baseRef>..HEAD`, bound to the commit HEAD resolved to. Never throws. */
+export async function readOperationFacts(worktree, baseRef) {
+    try {
+        const commit = await resolveHead(worktree);
+        if (!commit)
+            return { ok: false, error: "HEAD did not resolve to a commit" };
+        // --no-filters: the empty blob is git's, never a clean filter's output under a worker-written attribute
+        const empty = await shGit("git hash-object -t blob --no-filters /dev/null", worktree);
+        if (empty.code !== 0 || empty.timedOut)
+            return { ok: false, error: `git hash-object exited ${empty.code}` };
+        const raw = await shGit(`git diff --raw -z --no-abbrev -M ${shq(`${baseRef}..${commit}`)} --`, worktree, undefined, {}, { bytes: true });
+        if (raw.code !== 0 || raw.signalExit || raw.timedOut || !raw.stdoutBytes) {
+            return { ok: false, error: `git diff --raw exited ${raw.code}${raw.signalExit ? " (killed)" : ""}` };
+        }
+        const facts = parseOperationFacts(raw.stdoutBytes, empty.stdout.trim());
+        return facts ? { ok: true, commit, facts } : { ok: false, error: "a raw diff record is outside the closed grammar" };
+    }
+    catch (error) {
+        return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}
+/** The read's facts only while HEAD still resolves to the commit they measured; call it after the judged diff is read. */
+export async function operationFactsAtHead(worktree, read) {
+    if (!read.ok)
+        return [];
+    try {
+        return (await resolveHead(worktree)) === read.commit ? read.facts : [];
+    }
+    catch {
+        return [];
+    }
+}

package/dist/gates/run-gates.js

@@ -7,7 +7,7 @@ import { TIER_RANK } from "../config/config.js";
 import { getAdapter } from "../adapters/registry.js";
 import { GATE_NAMES } from "../graph/schema.js";
 import { acceptanceGate } from "./acceptance.js";
-import { classifiedFileDurations, compareToBaseline, effectiveCeilingMs, waitForCalmWindow, calmWindowReady } from "./baseline.js";
+import { classifiedFileDurations, compareToBaseline, effectiveCeilingMs, waitForCalmWindow, calmWindowReady, SIGNAL_EXIT_RE } from "./baseline.js";
 import { evidenceGate } from "./evidence.js";
 import { captureLlmOutput, SeatLaunchError } from "./llm.js";
 import { withLaunchGuard } from "../drivers/orca.js";
@@ -364,30 +364,36 @@ export async function reobserveTestFiles(worktree, testCmd, baseline, files, art
     return r.meta?.recovery === undefined ? r
         : { ...r, pass: false, meta: { ...r.meta, classification: "infra", infra: true, retryable: false, recoveryRefused: true } };
 }
-const SIGNAL_EXIT_RE = /\b(?:SIGTERM|SIGKILL|signal\s+(?:9|15)|exit(?:s|ed|\s+code)?\s+(?:137|143))\b/i;
 const FAILURE_IDENTITY_RE = /\b(?:AssertionError|FAIL\s+\S|Tests?\s+\d+\s+failed|expected\s+.+\s+to\s+)\b/i;
 /** D1: apply the daemon's signal-only rider before either battery cache read or write. Its onGate
  * classification happens after persistence, too late to keep a scripted runner's non-verdict out.
  * Keep named failures as work verdicts and preserve details for failure-policy fingerprinting.
  * A baseline-forgiven "green" whose runner was signal-killed is the same non-verdict: a killed job
- * completed no suite, so forgiveness never publishes or caches it green. The authoritative termination
- * receipt decides, never the verdict text: a signal-terminated job is killed whatever its details say, and
- * a green stands only on a receipt showing a normal exit — a receiptless CACHED one (an older or planted
- * entry) is unavailable proof, so a fresh job measures instead. A fresh row is this invocation's own: every
- * production runner attaches its receipt, and the manifest path's verdict already requires a clean exit
+ * completed no suite. The termination receipt decides first: a signal-terminated job is killed whatever its
+ * details say, and a green stands only on a receipt showing a normal exit — a receiptless CACHED one (an
+ * older or planted entry) is unavailable proof, so a fresh job measures instead. A normal exit 1 can still
+ * be a kill (a wrapper reports its killed worker and exits 1), and a forgiven green's details never carry
+ * the runner's output, so this rider cannot see it: S19m4 — the shared forgiveness decision
+ * (baseline.ts freshFailures) reads kill text beside a forgiven pass itself, turns one into infra that is
+ * never cached, and marks the green it does publish `killTextRead`. A cached forgiven green without that
+ * marker was written by an engine that never read kill text, so it is refused here — a normal exit 1
+ * receipt included — and the job runs again. A fresh row is this invocation's own: every production
+ * runner attaches its receipt, and the manifest path's verdict already requires a clean exit
  * (test-manifest.ts verifyManifestReport). A no-command skip ran nothing and claims none. */
 function classifySignalOnlyTest(g, cached = false) {
     const termination = g.evidenceReceipt?.termination.kind;
     const exitCode = g.evidenceReceipt?.termination.exitCode;
     const killed = termination === "signal" || exitCode === 137 || exitCode === 143 || (!g.pass && SIGNAL_EXIT_RE.test(g.details));
-    const unproven = g.pass && g.meta?.skipped !== true && termination !== "exit" && (cached || termination !== undefined);
+    const killTextUnread = cached && Array.isArray(g.meta?.forgivenFingerprints) && g.meta.killTextRead !== true;
+    const unproven = g.pass && g.meta?.skipped !== true && (killTextUnread || termination !== "exit" && (cached || termination !== undefined));
     if (g.gate !== "test" || g.meta?.infra === true || !(killed || unproven))
         return;
     const named = Array.isArray(g.meta?.failingTests) && g.meta.failingTests.length > 0;
     if (!g.pass && (named || FAILURE_IDENTITY_RE.test(g.details)))
         return;
     g.pass = false;
-    g.meta = { ...g.meta, classification: "infra", infra: true, retryable: false, kind: killed || termination ? "signal-exit" : "no-exit-receipt" };
+    g.meta = { ...g.meta, classification: "infra", infra: true, retryable: false,
+        kind: killed || (termination && termination !== "exit") ? "signal-exit" : termination ? "kill-text-unread" : "no-exit-receipt" };
 }
 /** OBS-1151: a criterion's comparable subject — its canonical text, the task's declared bounds and the
  * operator context. The cited files' blobs are compared separately, over the union of both citations. */
@@ -1193,7 +1199,7 @@ export async function runGates(task, ctx) {
         // details. The v1.1 badReviewers precedent's TIMING can't transfer: its failover lands on the NEXT
         // worker attempt — exactly what this fix forbids; only its meta-carries-channel pattern is mirrored.
         // Straight-line single `if` — NO loop/counter/knob: exactly-once by construction (a knob is a
-        // fail-closed weakening vector); a second garbage verdict fails the gate closed exactly as today.
+        // fail-closed weakening vector); a second garbage verdict fails the gate closed as terminal infra (S23-F11).
         // T6: exclusion mirrors consult reroute semantics — the flaked channel's whole adapter is banned, not
         // just its exact channel key, so an outage window cannot re-select the vendor being routed around.
         // If no other adapter is live, the exclusion degrades to a channel-level reroute within the same
@@ -1226,8 +1232,11 @@ export async function runGates(task, ctx) {
         }
         // OBS-1168(b): the re-routed seat could not launch either — no seat produced a verdict, so this is
         // an infra park over whatever the deterministic gates proved, never a charge against the worker.
-        if (a.meta?.cause === "seat-launch-failed")
+        // S23-F11: the same holds for a retry whose verdict is still unparseable: two seats delivered no readable
+        // verdict, which judges nothing about the worker's diff, so the row is terminal infra, never a charged red.
+        if (a.meta?.cause === "seat-launch-failed" || (a.meta?.judgeRetry !== undefined && a.meta.unparseable === true)) {
             a = { ...a, meta: { ...a.meta, classification: "infra", infra: true, retryable: false } };
+        }
         else if (!cancelled && Array.isArray(a.meta?.judgment))
             a = await adjudicate(a);
         // No dispatch, no key: a deterministic-oracle round writes no `invocations` field rather than an

package/dist/run/git.d.ts

@@ -154,6 +154,8 @@ export interface ShResult {
     durationMs?: number;
     /** T7: the capacity THIS child ran under, stamped where its environment was built (see `shell`). */
     capacity?: RunCapacity;
+    /** Queue row 142: stdout exactly as the child wrote it, present only when the own-git caller asked for bytes. */
+    stdoutBytes?: Buffer;
 }
 export declare const setSpawnForTests: (fn: typeof spawn) => void;
 export declare const resetSpawnForTests: () => void;
@@ -168,6 +170,8 @@ export interface ShellOptions {
     onReceipt?: (receipt: ShellReceipt) => void;
     /** Called once per invocation (1-based), including each pre-spawn retry. */
     receiptAttribution?: (invocation: number) => CommandReceiptAttribution;
+    /** Queue row 142: also keep stdout as raw bytes (ShResult.stdoutBytes); only shGit's byte readers opt in. */
+    bytes?: boolean;
 }
 /** Shared command seam, including invocation-bound manifested runners. A PAYLOAD entry: its children keep the
  * operator's git config (hooks, fsmonitor) and get no checkout pin — ownership follows the entry, never `login`
@@ -180,7 +184,7 @@ export declare function shell(cmd: string, cwd: string, timeoutMs: number, login
  */
 export type OwnGitOptions = OwnGitCapability;
 export declare function sh(cmd: string, cwd: string, timeoutMs?: number, options?: ShellOptions): Promise<ShResult>;
-export declare function shGit(cmd: string, cwd: string, timeoutMs?: number, own?: OwnGitOptions): Promise<ShResult>;
+export declare function shGit(cmd: string, cwd: string, timeoutMs?: number, own?: OwnGitOptions, options?: Pick<ShellOptions, "bytes">): Promise<ShResult>;
 export declare function shOk(cmd: string, cwd: string): Promise<string>;
 export declare function shGitOk(cmd: string, cwd: string, own?: OwnGitOptions): Promise<string>;
 /**

package/dist/run/git.js

@@ -386,6 +386,7 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation, ownGit)
             throw error;
         }
         let stdout = "", stderr = "";
+        const stdoutChunks = [];
         const stdoutDecoder = new StringDecoder("utf8");
         const stderrDecoder = new StringDecoder("utf8");
         let timedOut = false, reapedGroup = false, done = false, started = false, outputSeen = false;
@@ -419,6 +420,7 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation, ownGit)
                 timedOut,
                 durationMs: Date.now() - startedAt,
                 capacity,
+                ...(options.bytes ? { stdoutBytes: Buffer.concat(stdoutChunks) } : {}),
                 ...(reapedGroup ? { reapedGroup: true } : {}),
                 ...(reapError ? { reapError } : {}),
             });
@@ -485,6 +487,8 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation, ownGit)
         p.stdout.on("data", (d) => {
             if (d.length > 0)
                 outputSeen = true;
+            if (options.bytes)
+                stdoutChunks.push(d);
             stdout += stdoutDecoder.write(d);
         });
         p.stderr.on("data", (d) => {
@@ -576,9 +580,9 @@ export function sh(cmd, cwd, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS, options = {})
 }
 // Git plumbing never needs an operator profile; skip login-shell startup and its side effects.
 // v2.6.8 T2: the explicit OWN-GIT entry — forced inert hooks/fsmonitor and, in a linked checkout, the trusted-path and
-// ref-store pin.
-export function shGit(cmd, cwd, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS, own = {}) {
-    return shellEntry(cmd, cwd, timeoutMs, false, {}, own);
+// ref-store pin. Queue row 142: `bytes` is the one opt-in raw-stdout capture; every other caller's output is unchanged.
+export function shGit(cmd, cwd, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS, own = {}, options = {}) {
+    return shellEntry(cmd, cwd, timeoutMs, false, options, own);
 }
 export async function shOk(cmd, cwd) {
     const r = await sh(cmd, cwd);

package/dist/run/launchservices-check.d.ts

@@ -33,12 +33,34 @@ export type ProbeTimer = (fire: () => void, ms: number) => () => void;
 interface ProbeSeam {
     platform: NodeJS.Platform;
     spawn: typeof spawn;
+    spawnTop?: typeof spawn;
     setTimer: ProbeTimer;
     signal?: AbortSignal;
 }
 export declare const setLaunchServicesProbeForTests: (s: Partial<ProbeSeam>) => void;
 export declare const resetLaunchServicesProbeForTests: () => void;
 export declare function observeLaunchServices(s?: ProbeSeam): Promise<LaunchServicesObservation>;
+export declare const LAUNCHSERVICES_PORT_ADVISORY = 100000;
+export declare const LAUNCHSERVICES_PORT_STOP = 200000;
+export type LaunchServicesPorts = {
+    status: "skipped" | "non-darwin";
+} | {
+    status: "unknown";
+    pid?: number;
+} | {
+    status: "read";
+    pid: number;
+    count: number;
+};
+/** Closed top format: PID COMMAND #PORTS, then the next non-empty row for this pid and launchservicesd. */
+export declare function parseTopPortCount(stdout: string, pid: number): number | null;
+/** One identity read and, only for a readable Darwin identity, one bounded top child. */
+export declare function probeLaunchServicesPorts(options?: {
+    requireTop?: boolean;
+}): Promise<{
+    observation?: LaunchServicesObservation;
+    ports: LaunchServicesPorts;
+}>;
 export declare function launchServicesAdvisory(prior: LaunchServicesIdentity, now: LaunchServicesIdentity): string;
 /** Pure: the table row for one observation against the held record, and the record to hold next. */
 export declare function classifyLaunchServices(prior: Partial<LaunchServicesRecord> | undefined, observed: LaunchServicesObservation): {
@@ -48,7 +70,7 @@ export declare function classifyLaunchServices(prior: Partial<LaunchServicesReco
 };
 /** Observe, classify against the first record of `prior`, and hold the result on the first record of `health`.
  *  Returns `health` itself when nothing changed, else a copy — the argument is never mutated. */
-export declare function recordLaunchServices(prior: Record<string, AuthHealth> | null, health: Record<string, AuthHealth>): Promise<{
+export declare function recordLaunchServices(prior: Record<string, AuthHealth> | null, health: Record<string, AuthHealth>, observation?: LaunchServicesObservation): Promise<{
     status: LaunchServicesStatus;
     health: Record<string, AuthHealth>;
     line?: string;

package/dist/run/launchservices-check.js

@@ -27,12 +27,14 @@ export function parsePsIdentity(stdout) {
 const production = () => ({
     platform: process.platform,
     spawn,
+    spawnTop: spawn,
     setTimer: (fire, ms) => { const t = setTimeout(fire, ms); return () => clearTimeout(t); },
 });
 // ponytail: default-off under the test runner (the catalogRefreshAllowed precedent) so an unowned doctor
 // test never takes a real host reading or changes its doctor.json bytes; tests opt in through the seam.
+// The legacy identity-only seam leaves spawnTop unset, so old /bin/ps fixtures never touch the host top.
 let seam;
-export const setLaunchServicesProbeForTests = (s) => { seam = { ...production(), ...s }; };
+export const setLaunchServicesProbeForTests = (s) => { seam = { ...production(), ...s, spawnTop: s.spawnTop }; };
 export const resetLaunchServicesProbeForTests = () => { seam = undefined; };
 const activeSeam = () => seam ?? (process.env.VITEST === "true" ? undefined : production());
 /** One /bin/ps call that owns only its child, killed at the ceiling or on cancellation and reaped before it resolves. */
@@ -78,6 +80,88 @@ function readIdentity(s) {
 export function observeLaunchServices(s = production()) {
     return s.platform === "darwin" ? readIdentity(s) : Promise.resolve({ status: "non-darwin" });
 }
+export const LAUNCHSERVICES_PORT_ADVISORY = 100_000;
+export const LAUNCHSERVICES_PORT_STOP = 200_000;
+const TOP_BYTES = 1024 * 1024;
+/** Closed top format: PID COMMAND #PORTS, then the next non-empty row for this pid and launchservicesd. */
+export function parseTopPortCount(stdout, pid) {
+    const lines = stdout.split(/\r?\n/);
+    const header = lines.findIndex((line) => line.trim().split(/\s+/).join(" ") === "PID COMMAND #PORTS");
+    if (header < 0)
+        return null;
+    const row = lines.slice(header + 1).find((line) => line.trim() !== "");
+    if (!row)
+        return null;
+    const tokens = row.trim().split(/\s+/);
+    if (tokens.length !== 3 || tokens[0] !== String(pid) || tokens[1] !== "launchservicesd" || !/^[0-9]+[+-]?$/.test(tokens[2]))
+        return null;
+    const count = Number(tokens[2].replace(/[+-]$/, ""));
+    return Number.isSafeInteger(count) ? count : null;
+}
+// The captured macOS top layout is closed: only a matching three-token row after the exact header
+// yields a count. 100000 ports is a doctor advisory; 200000 stops standalone verify before gates.
+// Unknown (including an unreadable identity, malformed top output, or a killed child) never stops.
+function readPortCount(s, pid) {
+    return new Promise((resolve) => {
+        const unknown = () => resolve({ status: "unknown", pid });
+        if (s.signal?.aborted) {
+            unknown();
+            return;
+        }
+        if (!s.spawnTop) {
+            unknown();
+            return;
+        }
+        let child;
+        try {
+            child = s.spawnTop("/usr/bin/top", ["-l", "1", "-stats", "pid,command,ports", "-pid", String(pid)], { stdio: ["ignore", "pipe", "ignore"], env: { ...process.env, LC_ALL: "C" } });
+        }
+        catch {
+            unknown();
+            return;
+        }
+        let out = "";
+        let bytes = 0;
+        let failed = false;
+        const retire = () => { if (!failed) {
+            failed = true;
+            child.kill("SIGKILL");
+        } };
+        const clear = s.setTimer(retire, LAUNCHSERVICES_PROBE_CEILING_MS);
+        s.signal?.addEventListener("abort", retire, { once: true });
+        child.stdout?.on("data", (chunk) => {
+            if (failed)
+                return;
+            bytes += chunk.length;
+            if (bytes > TOP_BYTES) {
+                retire();
+                return;
+            }
+            out += chunk.toString("utf8");
+        });
+        child.once("error", () => { failed = true; });
+        child.once("close", (code) => {
+            clear();
+            s.signal?.removeEventListener("abort", retire);
+            if (failed || code !== 0)
+                return unknown();
+            const count = parseTopPortCount(out, pid);
+            return count === null ? unknown() : resolve({ status: "read", pid, count });
+        });
+    });
+}
+/** One identity read and, only for a readable Darwin identity, one bounded top child. */
+export async function probeLaunchServicesPorts(options = {}) {
+    const s = activeSeam();
+    if (!s || (options.requireTop && !s.spawnTop))
+        return { ports: { status: "skipped" } };
+    const observation = await observeLaunchServices(s);
+    if (observation.status === "non-darwin")
+        return { observation, ports: { status: "non-darwin" } };
+    if (observation.status === "unreadable")
+        return { observation, ports: { status: "unknown" } };
+    return { observation, ports: await readPortCount(s, observation.identity.pid) };
+}
 // doctor.json is never schema-validated: a malformed held record is no identity at all.
 const knownPrior = (prior) => typeof prior?.pid === "number" && typeof prior.start === "string";
 export function launchServicesAdvisory(prior, now) {
@@ -106,10 +190,11 @@ export function classifyLaunchServices(prior, observed) {
 }
 /** Observe, classify against the first record of `prior`, and hold the result on the first record of `health`.
  *  Returns `health` itself when nothing changed, else a copy — the argument is never mutated. */
-export async function recordLaunchServices(prior, health) {
+export async function recordLaunchServices(prior, health, observation) {
     const held = prior ? Object.values(prior)[0]?.launchServices : undefined;
     const s = activeSeam();
-    const r = s ? classifyLaunchServices(held, await observeLaunchServices(s)) : { status: "skipped", next: knownPrior(held) ? held : undefined };
+    const r = observation ? classifyLaunchServices(held, observation)
+        : s ? classifyLaunchServices(held, await observeLaunchServices(s)) : { status: "skipped", next: knownPrior(held) ? held : undefined };
     const holder = Object.keys(health)[0];
     if (!holder || !r.next || JSON.stringify(health[holder].launchServices) === JSON.stringify(r.next))
         return { ...r, health };

package/dist/run/merge.js

@@ -216,7 +216,9 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
         // Persistent reuse requires the run's durable journal. Without it there is no
         // recorded cycle provenance to reconcile with the caller's capacity checks.
         const hit = journalFound ? store.get(id) : undefined;
-        if (hit && id && hit.pass && !isInfraResult(hit)) {
+        // S19m4: a forgiven test green written before the tip read kill text never proves the suite completed.
+        const killTextUnread = gate === "test" && hit?.meta?.forgiven === true && hit.meta.killTextRead !== true;
+        if (hit && id && hit.pass && !isInfraResult(hit) && !killTextUnread) {
             results.push({
                 gate,
                 cmd,
@@ -339,7 +341,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
             });
             continue;
         }
-        const verdict = freshFailures(entry, stripped);
+        const verdict = freshFailures(entry, stripped, gate === "test");
         const { failing, unreadable } = verdict;
         // S22: a missing or unreadable entry forgives nothing; the red names it rather than a bare exit code.
         const refusal = baselineEntryRefusal(gate, verdict);
@@ -366,8 +368,12 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
         // often the previous session's — so a capture taken under a different resolved capacity forgives
         // nothing at the tip either. An absent capacity is a pre-T7 baseline and keeps today's verdict.
         const comparable = sameCapacity(entry?.capacity, r.capacity);
-        const forgiven = r.code !== 0 && baselineRed && failing.length === 0 && !unreadable && cause !== "infra"
+        const forgivable = r.code !== 0 && baselineRed && failing.length === 0 && !unreadable && cause !== "infra"
             && comparable;
+        // S19m4 (battery parity): kill text beside forgivable failures means the suite never completed — red, infra.
+        const killLine = forgivable && !greenTeardown && !deficit ? verdict.killLine : undefined;
+        const forgiven = forgivable && killLine === undefined;
+        const rowCause = killLine !== undefined ? "infra" : cause;
         const pass = !deficit && (r.code === 0 || greenTeardown || forgiven);
         if (!pass)
             writeTipLog(artifact, raw);
@@ -378,18 +384,20 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
             evidenceReceipt, evidenceReceipts,
             exitCode: r.code,
             fingerprints: r.code !== 0 && !greenTeardown ? fingerprint(stripped) : [],
-            details: `${cause === "infra" ? "infra; " : ""}${rerun ? `${rerun}: ` : ""}` + (deficit?.replace(/^infra; /, "") ?? (r.code === 0 ? "exit 0"
+            details: `${rowCause === "infra" ? "infra; " : ""}${rerun ? `${rerun}: ` : ""}` + (deficit?.replace(/^infra; /, "") ?? (r.code === 0 ? "exit 0"
                 : greenTeardown ? `exit ${r.code} after a green suite summary; only the runner's teardown fingerprint followed it`
                     : forgiven ? `exit ${r.code} but only baseline-recorded failures (forgiven vs baseline)`
-                        : !comparable && baselineRed && failing.length === 0
-                            ? `exit ${r.code}; every failure is baseline-recorded, but that capture ran under `
-                                + `${describeCapacity(entry?.capacity)} and this verification ran under ${describeCapacity(r.capacity)} `
-                                + `— forgiveness across a changed capacity is not evidence`
-                            : `exit ${r.code}`))
+                        : killLine !== undefined ? `exit ${r.code}; every failure is baseline-recorded, but the runner printed kill text — `
+                            + `it never completed a suite, so nothing is forgiven: ${killLine}`
+                            : !comparable && baselineRed && failing.length === 0
+                                ? `exit ${r.code}; every failure is baseline-recorded, but that capture ran under `
+                                    + `${describeCapacity(entry?.capacity)} and this verification ran under ${describeCapacity(r.capacity)} `
+                                    + `— forgiveness across a changed capacity is not evidence`
+                                : `exit ${r.code}`))
                 // S22: every red here names a missing or unreadable entry beside its own cause, deficit included
                 + (!pass && refusal ? `; ${refusal}` : ""),
             ...(forgiven && !deficit ? { forgiven: true, ...(baseline?.provenance ? { baselineProvenance: baseline.provenance } : {}) } : {}),
-            ...(cause ? { cause } : {}),
+            ...(rowCause ? { cause: rowCause } : {}),
             ...(pass ? {} : { artifact }),
         };
         results.push(tipResult);
@@ -408,6 +416,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
         if (id && id.tree === completedTree && !isInfraResult(result)) {
             store.set(id, { ...result, meta: {
                     fingerprints: result.fingerprints, forgiven: result.forgiven, baselineProvenance: result.baselineProvenance,
+                    ...(result.forgiven && result.gate === "test" ? { killTextRead: true } : {}),
                     reportPath: result.reportPath, spawnedCommand: result.spawnedCommand,
                     artifact: result.artifact,
                     evidenceReceipt: result.evidenceReceipt, evidenceReceipts: result.evidenceReceipts,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.7.9",
+  "version": "2.8.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",