Hold a capture permission to the rule that carries it

[patchstackdave]

A capture permission belongs to a rule, not to the condition that matched.

The guard evaluates a rule and reports that the rule matched; it does not record which of the rule's conditions was responsible. So the permissions a rule carries apply to every match of it, whichever condition found one — and a rule that reads both the body and a named parameter, carrying a raw opt-in, attaches a prefix of the body to a match found only in that parameter.

The consequence for anyone writing rules: the source is the boundary. A rule that needs the body as evidence reads the body and nothing else. A rule reading a named parameter needs no raw opt-in, because a named value already travels with its detection.

What the cases hold

Rule reads	Reports	Does not report
one named parameter	that parameter's value, and the recorded plan	any part of the body
the body	a bounded prefix, flagged when cut	any value resolved from the request line

The named case asserts the evidence positively — the parameter's value is what comes back — rather than only that the body is absent, which would pass with named capture broken altogether.

What the query does reach

Key names, as query_keys: which fields were present, not what was in them. And a route carrying no query string. A value would have to come through capture, and a body rule permits none. Both are asserted.

A match past the bound

The opt-in bounds what may be shown, not what may match. So a detection arrives whose evidence does not contain what matched, and truncated is what separates that from a rule that matched nothing — a reader treating it as a false positive would retire a rule for matching something it was not permitted to show.

Test mechanics worth noting

Both non-matching cases send a matching request through the same guard, since "nothing was reported" is also what a guard reporting nothing at all looks like. The reporter's own completion signal is awaited rather than approximated with a sleep, and a guard that never calls its callback rejects rather than resolving a test that never ran.

Scope

This is the generic, rule-scoped capture invariant. It is not an execution gate for any particular rule set: every rule, marker and value here is synthetic, and pinning specific policies belongs wherever those policies are reviewed.

2328 tests pass; typecheck clean.

[coderbuds]

Comprehensive tests clearly validate capture boundaries for marker rules.

🎯 Quality: 94% Elite · 📦 Size: Medium

📈 This month: Your 179th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[patchstackdave]

/review