@duckcodeailabs/dql-cli 1.14.0 → 1.14.2

package/dist/local-runtime.js

@@ -1,6 +1,6 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { execFileSync, execSync } from "node:child_process";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { gzip } from "node:zlib";
 import { createServer } from "node:http";
 import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, watch, writeFileSync, } from "node:fs";
@@ -23,9 +23,10 @@ import { getRunner as getLLMRunner } from './llm/index.js';
 import { rethrowIfCancelled } from './llm/cancellation.js';
 import { fetchLatestPublishedDqlVersion, resolveDqlRuntimeVersionStatus } from './version-status.js';
 import { resolveRetrievalHealthStatus } from './retrieval-health.js';
-import { createDqlAgentProviderRunner, resolveAgentFollowUpContext } from './llm/providers/dql-agent-provider.js';
+import { applyFinding, createResearchState, narrationMaxTokensForFacts, nextHypothesis, rerankCandidates, synthesizeResearchNarrative, AgenticExecutionCapabilityGate, createAgenticSqlExecutionCapability, mintFinalSqlAuthorization, verifyAgenticSqlExecutionCapability, qualifyAuthorizationReferences, scopeContextPackToExploratoryCandidateClosure, validateSqlAgainstLocalContext as validateAuthorizedSqlReferences, verifyFinalSql, } from '@duckcodeailabs/dql-agent';
+import { applyEvalCassette, createDqlAgentProviderRunner, createEvalCassetteReplayProvider, createGovernedTextProvider, resolveAgentFollowUpContext } from './llm/providers/dql-agent-provider.js';
 import { listRemoteMcpSettings, saveRemoteMcpSettings } from './llm/mcp-config.js';
-import { ClaudeProvider, ConversationStore, advanceThreadState, buildConversationSnapshot, conversationHistoryFromContext, recallRelevantTurns, renderConversationEnvelopeForPrompt, GeminiProvider, MemoryStore, OllamaProvider, OpenAIProvider, buildBlockBusinessFingerprint, buildBlockSqlFingerprints, buildAnalysisQuestionPlan, composeSemanticQueryForQuestion, aggregationIntegrityIssuesForSql, buildAggregationSafetyProof, buildLocalContextPack, applyContextPackCompatibility, toAgentRetrievalEvidence, prepareConversationPath, defaultMemoryPath, ensureDefaultMemoryFiles, ensureAgentProjectReady, isAgentProjectIndexReady, currentMetadataFingerprint, ensureMetadataCatalogFresh, readIndexedDomainKnowledge, readIndexedKnowledge360, compactSemanticRuntimeFailure, classifyAnalyticalFailure, normalizeWarehouseSqlFailure, parseProposal, propose, proposePlan, recordGovernedCorrection, HintStore, defaultHintIndexPath, ensureHintIndexFresh, listHintsFromGit, getHintEvaluationFromGit, getCorrectionTraceFromGit, inspectGovernedHint, editGovernedHintCandidate, reopenGovernedHint, retireHint, supersedeHint, hintsConflict, mineJoinPatterns, reviewGovernedHint, AgentRunEngine, SqliteAgentRunStore, defaultAgentRunGates, createLlmAgentRunPlanner, createHybridRouter, computeResultStats, buildDeterministicDashboardStory, synthesizeAnswer, streamOrGenerate, narrateResult, buildProposePreview, buildFromPrompt, internalRelationIdsInSql, defaultAgentRunStorePath, defaultAgentRunSqlitePath, resolveLocalOwner, resolveProposeConfig, recordQueryRun, recordRuntimeSchemaSnapshot, latestRuntimeSchemaSnapshotForProject, loadSkills, migrateLegacySkills, configuredSkillsPath, skillsDir, draftDomainSkillBootstrap, buildDomainSkillBootstrapPrompt, mergeDomainSkillBootstrapEnrichment, writeSkill, previewSkillChange, buildContextAuthoringProposal, contextAuthoringDependencyClosure, FileContextAuthoringProposalStore, deleteSkill, deriveGeneratedDraftSlug, deriveAnalyticalRepair, reindexProject, invalidateAgentProjectState, recordAgentRuntimeVersion, resolveDomainContextEnvelope, projectEmbeddingProvider, isHashedEmbeddingProvider, clearProjectEmbeddingCache, upgradeVectorIndexForProject, openMetadataCatalog, defaultKgPath, planAppFromPrompt, KGStore, planResearch, loadSemanticMetrics, cascadeTraceToEvidenceRouteSteps, createCascadeAnswerResult, createCascadeTrace, routeReasoningEffort, createAgentRunBudget, routeForCascadeAnswerTier, clampReasoningEffort, bumpReasoningEffort, resolveThinkingMode, coerceThinkingMode, upsertGeneratedDqlArtifactDraft, loadAgentSemanticLayer, isTrustedConversationTurn, resolveInternalRelationIds, analyticalError, tagAnalyticalError, withAnalyticalErrorOrigin, withAnalyticalErrorOriginSync, assertProviderPayloadAllowed, createProviderDispatchEgressReceipt, prepareProviderWireEnvelopeForDispatch, markProviderMetadataArray, createProviderEgressReceipt, redactProviderResultRows, composeVerifiedAnalyticalNarrative, buildCoverageGap, capResearchBranches, buildResearchEvidenceLedger, buildAnalyticalTurnPlan, DEFAULT_ASK_ROW_EGRESS_POLICY, ZERO_ROW_EGRESS_POLICY, resolveProviderResultRowEgressPolicy, normalizeCanonicalQueryResult, normalizeAnalyticalExecutionFingerprint, normalizeAnalyticalExecutionReceipt, createAgentRunCancellationError, } from '@duckcodeailabs/dql-agent';
+import { composeBusinessExplanation, ClaudeProvider, ConversationStore, advanceThreadState, buildConversationSnapshot, conversationHistoryFromContext, recallRelevantTurns, renderConversationEnvelopeForPrompt, GeminiProvider, MemoryStore, OllamaProvider, OpenAIProvider, buildBlockBusinessFingerprint, buildBlockSqlFingerprints, buildAnalysisQuestionPlan, composeSemanticQueryForQuestion, aggregationIntegrityIssuesForSql, buildAggregationSafetyProof, buildLocalContextPack, applyContextPackCompatibility, toAgentRetrievalEvidence, prepareConversationPath, defaultMemoryPath, ensureDefaultMemoryFiles, ensureAgentProjectReady, isAgentProjectIndexReady, currentMetadataFingerprint, ensureMetadataCatalogFresh, readIndexedDomainKnowledge, readIndexedKnowledge360, compactSemanticRuntimeFailure, classifyAnalyticalFailure, normalizeWarehouseSqlFailure, parseProposal, propose, proposePlan, recordGovernedCorrection, HintStore, defaultHintIndexPath, ensureHintIndexFresh, listHintsFromGit, getHintEvaluationFromGit, getCorrectionTraceFromGit, inspectGovernedHint, editGovernedHintCandidate, reopenGovernedHint, retireHint, supersedeHint, hintsConflict, mineJoinPatterns, reviewGovernedHint, AgentRunEngine, SqliteAgentRunStore, defaultAgentRunGates, createLlmAgentRunPlanner, createHybridRouter, computeResultStats, buildDeterministicDashboardStory, synthesizeAnswer, streamOrGenerate, narrateResult, buildProposePreview, buildFromPrompt, internalRelationIdsInSql, defaultAgentRunStorePath, defaultAgentRunSqlitePath, resolveLocalOwner, resolveProposeConfig, recordQueryRun, recordRuntimeSchemaSnapshot, latestRuntimeSchemaSnapshotForProject, loadSkills, migrateLegacySkills, configuredSkillsPath, skillsDir, draftDomainSkillBootstrap, buildDomainSkillBootstrapPrompt, mergeDomainSkillBootstrapEnrichment, writeSkill, previewSkillChange, buildContextAuthoringProposal, contextAuthoringDependencyClosure, FileContextAuthoringProposalStore, deleteSkill, deriveGeneratedDraftSlug, deriveAnalyticalRepair, reindexProject, invalidateAgentProjectState, recordAgentRuntimeVersion, resolveDomainContextEnvelope, projectEmbeddingProvider, isHashedEmbeddingProvider, clearProjectEmbeddingCache, upgradeVectorIndexForProject, openMetadataCatalog, defaultKgPath, planAppFromPrompt, KGStore, planResearch, loadSemanticMetrics, cascadeTraceToEvidenceRouteSteps, createCascadeAnswerResult, createCascadeTrace, routeReasoningEffort, createAgentRunBudget, isProbeSafeColumn, deadlineScale, routeForCascadeAnswerTier, clampReasoningEffort, bumpReasoningEffort, resolveThinkingMode, coerceThinkingMode, upsertGeneratedDqlArtifactDraft, loadAgentSemanticLayer, isTrustedConversationTurn, resolveInternalRelationIds, analyticalError, tagAnalyticalError, withAnalyticalErrorOrigin, withAnalyticalErrorOriginSync, assertProviderPayloadAllowed, createProviderDispatchEgressReceipt, prepareProviderWireEnvelopeForDispatch, markProviderMetadataArray, createProviderEgressReceipt, redactProviderResultRows, composeVerifiedAnalyticalNarrative, classifyProviderFailure, buildCoverageGap, capResearchBranches, buildResearchEvidenceLedger, buildResearchEvidenceLedgerV2, buildResearchHypothesisPlanV2, inferResearchValidatorKind, buildAnalyticalTurnPlan, buildAnalyticalRequirementSet, resolveTopRankedRegionDependency, DEFAULT_ASK_ROW_EGRESS_POLICY, ZERO_ROW_EGRESS_POLICY, resolveProviderResultRowEgressPolicy, normalizeCanonicalQueryResult, normalizeAnalyticalExecutionFingerprint, normalizeAnalyticalExecutionReceipt, createAgentRunCancellationError, } from '@duckcodeailabs/dql-agent';
 import { addSqlResultFilter, dashboardFilterableResultColumns, filterableResultColumns, replaceBlockStudioSql } from './sql-result-filter.js';
 import { gatherProposeEnrichment } from './propose-enrich.js';
 import { handleAppsApi, proposeAppAiBuild, recommendVisualization, } from './apps-api.js';
@@ -313,10 +314,14 @@ export function parseAgentRunRequestBody(body) {
             selectedObject,
             executionTarget,
             workspaceContext,
-            conversationContext: sanitizeClientConversationContext(agentRunRecord(record.conversationContext)),
+            conversationContext: sanitizeClientConversationContext(agentRunRecord(record.conversationContext), {
+                stripStructuredSelectionEnvelope: Boolean(agentRunString(record.selectedEvidenceId)),
+            }),
             history: parseAgentRunHistory(record.history),
             threadId: agentRunString(record.threadId),
-            runId: agentRunString(record.runId),
+            // `runId` is deliberately absent at public ingress. It scopes the
+            // controller, persisted run, SSE operation, and one-shot SQL capability,
+            // so a browser-supplied value must never become execution authority.
             reasoningEffort: parseAgentRunReasoningEffort(record.reasoningEffort),
             analysisDepth: parseAgentRunAnalysisDepth(record.analysisDepth) ?? parseAgentRunAnalysisDepth(record.depth),
             thinkingMode: coerceThinkingMode(record.thinkingMode),
@@ -328,13 +333,26 @@ const CLIENT_PLAN_AUTHORITY_KEYS = new Set([
     'priorResolvedAnalyticalPlan',
     'resolvedAnalyticalPlan',
     'analyticalFrame',
+    // Only the local compound executor may inject this after it has derived a
+    // canonical parent result binding. A browser-provided lookalike cannot become
+    // a child filter or skip ordinary member validation.
+    'analyticalTaskDependencyBinding',
+]);
+// A no-thread embedding may retain ordinary conversation context, but a
+// selectedEvidenceId is a structured server continuation—not a client plan
+// hint. Strip this state only for that selection path, while always stripping
+// the host-only authority marker below.
+const CLIENT_STRUCTURED_SELECTION_AUTHORITY_KEYS = new Set([
+    'conversationEnvelope',
+    'serverSnapshot',
+    'serverIssuedClarificationSelection',
 ]);
 /**
  * Browser/embedding context is useful retrieval and history input, but it is
  * not a plan-authority channel. Remove plan-shaped fields recursively at HTTP
  * ingress; server-retained thread context is added afterwards from local state.
  */
-function sanitizeClientConversationContext(context) {
+function sanitizeClientConversationContext(context, options = {}) {
     if (!context)
         return undefined;
     const sanitize = (value) => {
@@ -343,7 +361,14 @@ function sanitizeClientConversationContext(context) {
         const record = agentRunRecord(value);
         if (!record)
             return value;
-        return Object.fromEntries(Object.entries(record).flatMap(([key, nested]) => CLIENT_PLAN_AUTHORITY_KEYS.has(key) ? [] : [[key, sanitize(nested)]]));
+        return Object.fromEntries(Object.entries(record).flatMap(([key, nested]) => {
+            const isHostOnlySelectionAuthority = key === 'serverIssuedClarificationSelection';
+            const isUntrustedSelectionEnvelope = options.stripStructuredSelectionEnvelope
+                && CLIENT_STRUCTURED_SELECTION_AUTHORITY_KEYS.has(key);
+            return CLIENT_PLAN_AUTHORITY_KEYS.has(key) || isHostOnlySelectionAuthority || isUntrustedSelectionEnvelope
+                ? []
+                : [[key, sanitize(nested)]];
+        }));
     };
     return sanitize(context);
 }
@@ -378,6 +403,52 @@ export function agentRunDeadlineMs(request, env = process.env, activeProviderId)
         ? AGENT_RESEARCH_DEADLINE_MS
         : AGENT_LOOKUP_DEADLINE_MS;
 }
+/**
+ * Run ready independent compound clauses concurrently, but wait for a typed
+ * parent result before executing a declared dependent clause. The scheduler
+ * itself has no authority to query or filter; callers supply both execution and
+ * a dependency resolver so immutable-plan and SQL guards remain unchanged.
+ */
+export async function scheduleCompoundAnalyticalTasks(input) {
+    const pending = [...input.tasks];
+    const settled = new Map();
+    while (pending.length > 0) {
+        const ready = pending.filter((task) => task.dependencies.every((dependencyId) => settled.has(dependencyId)));
+        if (ready.length === 0) {
+            for (const task of pending.splice(0)) {
+                settled.set(task.id, {
+                    task,
+                    error: 'The compound task dependency graph could not be resolved.',
+                    dependencyError: {
+                        ok: false,
+                        code: 'RESULT_CONTRACT_MISMATCH',
+                        message: 'The dependent task could not run because its parent dependency was unresolved.',
+                    },
+                });
+            }
+            break;
+        }
+        for (const task of ready)
+            pending.splice(pending.indexOf(task), 1);
+        const batch = await Promise.all(ready.map(async (task) => {
+            if (!task.dependency || task.dependency.kind !== 'top_ranked_region')
+                return input.runTask(task);
+            const parent = settled.get(task.dependency.sourceTaskId);
+            const resolution = input.resolveDependency(task, parent);
+            if (!resolution.ok) {
+                const dependencyError = resolution;
+                return { task, error: dependencyError.message, dependencyError };
+            }
+            return input.runTask(task, resolution.binding);
+        }));
+        for (const result of batch)
+            settled.set(result.task.id, result);
+    }
+    return input.tasks.map((task) => settled.get(task.id) ?? {
+        task,
+        error: 'The compound task did not produce an outcome.',
+    });
+}
 /**
  * Decide how a settled answer gets its business-facing prose.
  *
@@ -420,11 +491,64 @@ export function shouldSynthesizeAgentRunAnswer(governedAnswer, requestedMode = '
         rowEgress: DEFAULT_ASK_ROW_EGRESS_POLICY,
     }).mode !== 'skip';
 }
+/**
+ * A receipt may be rendered in the local inspector and exported into evaluation
+ * output. Keep only stable validation codes there; provider error messages can
+ * contain a prompt excerpt, result value, or connector detail and must not
+ * become user-visible durable data.
+ */
+function narrationIntegrityFailureCodes(failures) {
+    return [...new Set(failures.map((failure) => {
+            const match = failure.trim().match(/^([A-Z][A-Z0-9_]{1,80})/);
+            return match?.[1] ?? 'NARRATION_VALIDATION_FAILED';
+        }).filter(Boolean))].slice(0, 8);
+}
 /**
  * AGT-010 — the semantic route label is descriptive, while the exact
  * route-specific aggregation proof is authoritative for governed trust.
  * Missing proof remains blocked for legacy or malformed results.
  */
+/**
+ * Trust for ONE answer, by the same rule the single-answer path uses: a route
+ * label is not authority, and a semantic route earns `governed` only when its
+ * aggregation proof actually passed.
+ */
+export function trustStateForAgentAnswer(answer) {
+    if (answer.certification === 'certified' || answer.kind === 'certified')
+        return 'certified';
+    return semanticAnswerHasPassedAggregationProof(answer) ? 'governed' : 'review_required';
+}
+const TRUST_RANK = {
+    certified: 3,
+    governed: 2,
+    grounded: 1,
+    review_required: 0,
+};
+/**
+ * A compound answer is exactly as trustworthy as its WEAKEST successful child.
+ *
+ * The previous rule was `every child completed ? 'governed' : 'review_required'`,
+ * which stamped `governed` on a parent whose children were review-required
+ * generated SQL — completion is not proof. That is a governance violation and
+ * the worst possible failure for this product: the reader is told a number
+ * carries governed authority when nothing proved it.
+ *
+ * `certified` is deliberately NOT reachable here. Certified trust is granted
+ * only by executing the exact certified artifact; a parent that merely
+ * assembled certified children did not execute one, so it caps at `governed`.
+ */
+export function compoundTrustState(childTrust) {
+    if (childTrust.length === 0)
+        return 'review_required';
+    const weakest = childTrust.reduce((low, current) => (TRUST_RANK[current] ?? 0) < (TRUST_RANK[low] ?? 0) ? current : low);
+    return weakest === 'certified' ? 'governed' : weakest;
+}
+/** Neutral parent outcome: governed only when every child completed governed. */
+export function compoundStopReason(completedCount, childCount, trustState) {
+    return completedCount === childCount && childCount > 0 && trustState === 'governed'
+        ? 'governed_compound_answer'
+        : 'human_review_required';
+}
 export function semanticAnswerHasPassedAggregationProof(governedAnswer) {
     return governedAnswer.route?.tier === 'semantic_metric'
         && governedAnswer.aggregationSafetyProof?.status === 'safe';
@@ -433,6 +557,18 @@ export function agentAnswerHasExecutionFailure(governedAnswer) {
     return typeof governedAnswer.executionError === 'string'
         && governedAnswer.executionError.trim().length > 0;
 }
+/**
+ * Return only a router/producer-issued analytical gap witness.
+ *
+ * `terminalOutcome.kind === 'modeling_gap'` is deliberately insufficient to
+ * claim a relationship problem. Older receipts and generic tuple failures
+ * return `undefined`; callers render generic coverage guidance for those.
+ */
+export function persistedAnalyticalGapWitness(routeDecision) {
+    return routeDecision?.terminalOutcome?.kind === 'modeling_gap'
+        ? routeDecision.terminalOutcome.gap
+        : undefined;
+}
 /** Rebuild the immutable failed-run input from the artifact retained by API-007. */
 export function analyticalFailedRunFromAgentRun(run) {
     for (const artifact of run.artifacts) {
@@ -784,7 +920,7 @@ function businessNarrativeGaps(warnings) {
 // When a run carries a threadId, the persisted thread is the authoritative
 // source of prior turns (survives refresh); the client-built context remains
 // the fallback for embedders that never send a threadId.
-async function conversationContextFromThread(store, threadId, clientContext, question) {
+async function conversationContextFromThread(store, threadId, clientContext, question, preservePendingClarification = false) {
     // Token-budget backstop: six verbatim turns with per-field caps. Older turns
     // remain reachable through the rolling summary + semantic recall below —
     // carrying more raw prose mostly slows every provider call on follow-ups.
@@ -832,7 +968,10 @@ async function conversationContextFromThread(store, threadId, clientContext, que
     const thread = store.getThread(threadId);
     // Bounded structured snapshot (working state + rolling summary + topic relation)
     // for the answer loop's conversation-state prompt section.
-    const serverSnapshot = buildConversationSnapshot(store, threadId, { question });
+    const serverSnapshot = buildConversationSnapshot(store, threadId, {
+        question,
+        preservePendingClarification,
+    });
     if (serverSnapshot && question) {
         // Semantic recall over OLDER turns (the recent window is already verbatim).
         serverSnapshot.recalledTurns = await recallRelevantTurns(store, threadId, question, {
@@ -840,12 +979,26 @@ async function conversationContextFromThread(store, threadId, clientContext, que
             excludeTurnIds: serverSnapshot.recentTurns.map((turn) => turn.id),
         });
     }
+    const pendingSelection = serverSnapshot?.pendingClarification?.selection;
+    const pendingSourceTurnId = serverSnapshot?.pendingClarification?.sourceTurnId;
+    // This value never crosses the HTTP boundary from a client. It is rebuilt
+    // only after the local conversation store has resolved the requested thread,
+    // and the router requires it for every selectedEvidenceId continuation.
+    const serverIssuedClarificationSelection = pendingSelection?.snapshotId && pendingSourceTurnId
+        ? {
+            version: 1,
+            threadId,
+            sourceTurnId: pendingSourceTurnId,
+            snapshotId: pendingSelection.snapshotId,
+        }
+        : undefined;
     return {
         ...(sanitizeClientConversationContext(clientContext) ?? {}),
         conversationStateVersion: 1,
         threadId,
         ...(serverSnapshot ? { conversationEnvelope: serverSnapshot } : {}),
         ...(serverSnapshot ? { serverSnapshot } : {}),
+        ...(serverIssuedClarificationSelection ? { serverIssuedClarificationSelection } : {}),
         ...(thread?.rollingSummary ? { conversationSummary: thread.rollingSummary } : {}),
         // `activeTurnId` is the FOLLOW-UP ANCHOR: the turn whose filters, prior DQL
         // artifact, and source SQL the next question builds on. Anchoring it to the
@@ -1015,6 +1168,40 @@ export function conversationTurnInputFromRun(run) {
     const contextPack = agentRunRecord(payload?.contextPack);
     const questionPlan = agentRunRecord(contextPack?.questionPlan);
     const requestedShape = agentRunRecord(questionPlan?.requestedShape);
+    // A structured clarification choice must survive reload/restart with the
+    // exact option IDs and typed requirements that rendered it. This is stored
+    // inside the existing JSON contract envelope so older conversation rows stay
+    // readable; the router treats it as reject-only continuity evidence and
+    // always rechecks the current snapshot before it can freeze a plan.
+    // Most analytical clarifications retain the router-owned cascade requirement
+    // set. Evidence-only ambiguity deliberately has no frozen cascade, however,
+    // and its first rendered options still need a typed, reload-safe contract.
+    // Derive that narrow fallback from the immutable original question and the
+    // already-resolved intent—not from a later click or client context—so the
+    // first valid structured selection can be revalidated without weakening the
+    // server-issued-envelope requirement.
+    const clarificationRequirements = run.diagnosticReceiptV3?.cascade?.requirements
+        ?? run.routeDecision?.analyticalCascadeDecision?.requirements
+        ?? (run.status === 'needs_clarification' && (run.clarificationOptions?.length ?? 0) > 0
+            ? buildAnalyticalRequirementSet({
+                question: run.question,
+                parsedIntent: run.routeDecision?.meaningResolution?.queryIntent,
+            })
+            : undefined);
+    const clarificationSelection = run.status === 'needs_clarification'
+        && (run.clarificationOptions?.length ?? 0) > 0
+        ? {
+            version: 1,
+            optionIds: [...new Set(run.clarificationOptions.map((option) => option.id).filter(Boolean))].slice(0, 16),
+            ambiguityCandidateIds: [...new Set(run.clarificationOptions.map((option) => option.id).filter(Boolean))].slice(0, 16),
+            ...(clarificationRequirements
+                ? { requirements: clarificationRequirements }
+                : {}),
+            ...(run.routeDecision?.retrievalEvidence?.snapshotId
+                ? { snapshotId: run.routeDecision.retrievalEvidence.snapshotId }
+                : {}),
+        }
+        : undefined;
     const rowCountRaw = result?.rowCount;
     const measureColumns = conversationMeasureColumns(columns, requestedShape, rows);
     return {
@@ -1023,7 +1210,13 @@ export function conversationTurnInputFromRun(run) {
         answerSummary: run.answer ?? run.summary,
         answerText: run.answer,
         route: run.route,
-        trustLabel: agentRunString(payload?.trustLabel) ?? run.trustState,
+        // A route/context label is presentation metadata, not the terminal trust
+        // authority. In particular, a certified run can retain a `mixed` context
+        // label from candidates considered before the certified tuple froze. Using
+        // that label here made the persisted conversation contradict the immutable
+        // run. Persist the canonical run state unless the answer itself has
+        // multiple materially different answer sections.
+        trustLabel: conversationTrustLabelFromRun(run, payload),
         runStatus: run.status,
         stopReason: run.stopReason,
         // Persisted so a later turn can tell a refusal from an answer. `runStatus`
@@ -1039,6 +1232,7 @@ export function conversationTurnInputFromRun(run) {
         sql: agentRunString(payload?.proposedSql) ?? agentRunString(payload?.sql),
         dqlArtifact: agentRunRecord(payload?.dqlArtifact),
         cascade: agentRunRecord(payload?.cascade),
+        narrationIntegrityReceipt: run.narrationIntegrityReceipt,
         result: columns.length > 0 || rows.length > 0
             ? {
                 columns,
@@ -1048,9 +1242,41 @@ export function conversationTurnInputFromRun(run) {
                 rowCount: typeof rowCountRaw === 'number' ? rowCountRaw : rows.length || undefined,
             }
             : undefined,
-        contract: requestedShape,
+        contract: {
+            ...(requestedShape ?? {}),
+            ...(clarificationSelection ? { clarificationSelection } : {}),
+        },
     };
 }
+function conversationTrustLabelFromRun(run, payload) {
+    if (!isCanonicalConversationTrustState(run.trustState)) {
+        return agentRunString(payload?.trustLabel);
+    }
+    return hasMixedAnswerSectionTrust(run.artifacts) ? 'mixed' : run.trustState;
+}
+function isCanonicalConversationTrustState(value) {
+    return value === 'certified'
+        || value === 'governed'
+        || value === 'grounded'
+        || value === 'review_required'
+        || value === 'blocked'
+        || value === 'not_applicable';
+}
+/**
+ * `mixed` is meaningful only when the durable answer contains sections with
+ * materially different trust states. Supporting artifacts such as a DQL draft
+ * or a diagnostics receipt do not turn one certified answer into mixed trust.
+ */
+function hasMixedAnswerSectionTrust(artifacts) {
+    const states = new Set(artifacts
+        .filter((artifact) => artifact.kind === 'answer' || artifact.kind === 'research_run')
+        .map((artifact) => artifact.trustState)
+        .filter((state) => state === 'certified'
+        || state === 'governed'
+        || state === 'grounded'
+        || state === 'review_required'));
+    return states.size > 1;
+}
 function conversationResultColumns(value) {
     if (!Array.isArray(value))
         return [];
@@ -1062,10 +1288,24 @@ function conversationResultColumns(value) {
         .slice(0, 24);
 }
 function conversationMeasureColumns(columns, requestedShape, rows) {
+    // A requested phrase is not evidence that the execution returned that
+    // measure.  In particular, an incomplete certified block used to persist
+    // `revenue` beside its actual `lifetime_spend` output merely because the
+    // request said revenue.  Retain an exact requested column only when it is
+    // actually present in the result contract.
     const requested = conversationStringArray(requestedShape?.measures) ?? [];
+    const canonical = (value) => value.toLowerCase()
+        .replace(/[_./:-]+/g, ' ')
+        .replace(/[^a-z0-9 ]+/g, ' ')
+        .replace(/\s+/g, ' ')
+        .trim();
+    const actualRequestedColumns = columns.filter((column) => {
+        const identity = canonical(column);
+        return identity.length > 0 && requested.some((measure) => canonical(measure) === identity);
+    });
     const numericColumns = columns.filter((column) => rows.some((row) => typeof row[column] === 'number' && Number.isFinite(row[column])));
     const metricNamedColumns = columns.filter((column) => /\b(revenue|sales|amount|total|count|average|avg|sum|spend|cost|margin|profit|value|points?|score|quantity|units?|rate|volume)\b/i.test(column.replace(/_/g, ' ')));
-    const unique = Array.from(new Set([...requested, ...numericColumns, ...metricNamedColumns]
+    const unique = Array.from(new Set([...actualRequestedColumns, ...numericColumns, ...metricNamedColumns]
         .map((value) => value.trim())
         .filter(Boolean)));
     return unique.length > 0 ? unique.slice(0, 24) : undefined;
@@ -1166,12 +1406,7 @@ export class RunScopedProviderDispatchEvidence {
      * from what it already has.
      */
     expectedDispatchMs() {
-        if (this.observedDispatchDurations.length === 0)
-            return ASSUMED_PROVIDER_DISPATCH_MS;
-        const sorted = [...this.observedDispatchDurations].sort((left, right) => left - right);
-        // The slowest observed call is the honest predictor: an optimistic median
-        // still admits a dispatch that the deadline then kills.
-        return sorted[sorted.length - 1];
+        return predictDispatchMs(this.observedDispatchDurations);
     }
     /** True when the remaining wall clock cannot fit another provider call. */
     cannotFitAnotherDispatch() {
@@ -1364,6 +1599,50 @@ function mergeRunScopedProviderDispatchEvidence(run, evidence) {
         diagnosticReceiptV2,
     };
 }
+/**
+ * Final physical generated-SQL boundary.
+ *
+ * This receives the exact prepared statement immediately before the connector
+ * callback.  It intentionally validates before invoking `execute`: a bad
+ * capability or unproven prepared reference must result in zero warehouse
+ * calls, not a post-execution warning.  It is module-exported only for the
+ * local-runtime boundary harness; it is never an HTTP API or durable artifact.
+ *
+ * @internal
+ */
+export async function executePreparedAgenticSqlBoundary(input) {
+    const capability = input.capability;
+    if (capability) {
+        const authorization = mintFinalSqlAuthorization({
+            sql: input.preparedSql,
+            proven: capability.provenIdentifiers.map((identifier) => ({
+                identifier,
+                evidence: capability.evidence[identifier] ?? 'catalog',
+            })),
+            runId: capability.runId,
+            executionId: capability.executionId,
+            snapshotId: capability.snapshotId,
+            planId: capability.planId,
+            targetFingerprint: capability.targetFingerprint,
+            bindings: input.bindings,
+        });
+        const validation = validateAuthorizedSqlReferences(input.preparedSql, undefined);
+        const verdict = verifyFinalSql(authorization, input.preparedSql, qualifyAuthorizationReferences(input.preparedSql, {
+            relations: validation.referencedRelations ?? [],
+            columns: validation.referencedColumns ?? [],
+        }), {
+            ...input.scope,
+            bindings: input.bindings,
+        });
+        if (process.env.DQL_ORCHESTRATOR_TRACE) {
+            console.warn(`[dql] execution authorization: ${verdict.ok ? 'admitted' : 'REFUSED'} proven=${authorization.provenIdentifiers.length}${verdict.ok ? '' : ` reason=${verdict.reason}`}`);
+        }
+        if (!verdict.ok) {
+            throw analyticalError(verdict.reason ?? 'The statement was not authorized for execution.', { origin: 'governance_gate', stage: 'execute', code: 'unauthorized_sql' });
+        }
+    }
+    return input.execute();
+}
 export async function startLocalServer(opts) {
     const { rootDir, executor, connection: rawConnection, preferredPort, projectRoot = process.cwd() } = opts;
     const bindHost = opts.host ?? process.env.DQL_HOST ?? '127.0.0.1';
@@ -2061,6 +2340,9 @@ export async function startLocalServer(opts) {
         });
     };
     async function runGovernedAgentAnswerForRun(request, repair, route = 'generated_answer', onProgress, routeDecision) {
+        return runGovernedAgentAnswerForRunInner(request, repair, route, onProgress, routeDecision);
+    }
+    async function runGovernedAgentAnswerForRunInner(request, repair, route = 'generated_answer', onProgress, routeDecision) {
         const governed = resolveGovernedAnswerRunner(projectRoot);
         let resolvedProvider = governed?.provider ?? null;
         let runner = governed?.runner ?? null;
@@ -2081,11 +2363,12 @@ export async function startLocalServer(opts) {
             runner = createDqlAgentProviderRunner('ollama', deterministicProvider);
         }
         if (!resolvedProvider || !runner) {
-            throw new Error('No AI provider is configured. Configure a subscription (Claude Code / Codex), OpenAI, Gemini, Ollama, or a custom OpenAI-compatible endpoint in Settings.');
+            throw Object.assign(new Error('No AI provider is configured. Configure a subscription (Claude Code / Codex), OpenAI, Gemini, Ollama, or a custom OpenAI-compatible endpoint in Settings.'), { code: 'AUTHENTICATION_FAILED', providerPhase: 'preflight' });
         }
         let governedAnswer;
         let providerError;
         let providerDispatchEvidence;
+        let providerBoundaryDiagnostic;
         const isRepair = (repair?.attempt ?? 0) > 0 && Boolean(repair?.repairHint);
         // The chat composer sends a `thinkingMode` (auto/low/medium/high); resolve it
         // into the effort+depth bundle it stands for. An explicit `reasoningEffort` /
@@ -2152,6 +2435,37 @@ export async function startLocalServer(opts) {
         const requestedPurpose = agentRunWorkspaceValue(request, 'purpose');
         const requestedModelAreaId = agentRunWorkspaceValue(request, 'modelAreaId');
         const runProjectSnapshot = projectSnapshot();
+        // Keep the execution callback on the exact ranked context pack that the
+        // router used.  The engine can invoke the executor after the router's
+        // asynchronous evidence phase, so looking the pack up lazily inside the
+        // callback occasionally observed an empty WeakMap entry and sent an
+        // authored leaf relation straight to the connector.  That bypassed the
+        // same-snapshot qualified relation binding despite retrieval having proved
+        // (for example) `jaffle_shop.dev.dim_customers`.
+        //
+        // Building only when this request has no prepared entry retains the normal
+        // single-retrieval path.  A frozen certified plan below rejects a pack whose
+        // snapshot/fingerprint does not match the router decision rather than
+        // borrowing a newer catalog to make an old plan executable.
+        const preparedContextPack = preparedAgentContextPacks.get(request)
+            ?? await buildAgentRunContextPack(request).catch(() => undefined);
+        const preparedQualifiedSchemaContext = preparedContextPack
+            ? buildAgentSchemaContextFromContextPack(request.question, preparedContextPack)
+            : [];
+        const selectedExploratoryAttempt = routeDecision?.analyticalCascadeDecision?.attempts.find((attempt) => attempt.tier === 'exploratory_sql');
+        // The exploratory candidate set belongs to the router's immutable
+        // same-snapshot cascade decision.  Build its physical prompt/execution
+        // closure once here; the broad retrieved pack remains receipt-only and is
+        // never handed to SQL validation for this selected tier.
+        const exploratoryCandidateIds = routeDecision?.analyticalCascadeDecision?.selectedTier === 'exploratory_sql'
+            ? selectedExploratoryAttempt?.candidateIds ?? []
+            : [];
+        const preparedExploratoryContextPack = exploratoryCandidateIds.length > 0
+            ? scopeContextPackToExploratoryCandidateClosure(preparedContextPack, exploratoryCandidateIds)
+            : undefined;
+        const preparedExploratoryQualifiedSchemaContext = preparedExploratoryContextPack
+            ? buildAgentSchemaContextFromContextPack(request.question, preparedExploratoryContextPack, { includeUnscored: true, limit: 80 })
+            : [];
         const domainContext = requestedDomain
             ? resolveUiDomainContext({
                 manifest: runProjectSnapshot.manifest,
@@ -2163,6 +2477,146 @@ export async function startLocalServer(opts) {
                 snapshotId: runProjectSnapshot.snapshotId,
             })
             : undefined;
+        // Local to this exact answer invocation. Compound children each enter this
+        // function separately, so no child can consume another child's capability.
+        const agenticExecutionCapabilityGate = new AgenticExecutionCapabilityGate();
+        const prepareExploratorySqlExecution = async (sql) => {
+            const cascade = routeDecision?.analyticalCascadeDecision;
+            const selectedAttempt = selectedExploratoryAttempt;
+            if (!cascade
+                || cascade.selectedTier !== 'exploratory_sql'
+                || cascade.planFrozen
+                || !selectedAttempt
+                || selectedAttempt.outcome !== 'executable'
+                || selectedAttempt.candidateIds.length === 0) {
+                throw analyticalError('The generated SQL no longer matches the router-selected exploratory path, so DQL did not authorize execution.', {
+                    origin: 'governance_gate', stage: 'validation', code: 'unauthorized_sql',
+                });
+            }
+            if (!request.runId || !semanticConnection || !preparedContextPack || !preparedExploratoryContextPack) {
+                throw analyticalError('DQL could not bind the selected exploratory query to this run, target, and metadata snapshot, so it was not executed.', {
+                    origin: 'governance_gate', stage: 'validation', code: 'unauthorized_sql',
+                });
+            }
+            const retrievalSnapshotId = routeDecision?.retrievalEvidence?.snapshotId;
+            const retrievalSourceFingerprint = routeDecision?.retrievalEvidence?.sourceFingerprint;
+            const retrievalFreezeSnapshotId = retrievalSnapshotId ?? preparedContextPack.knowledgeLens.snapshotId;
+            if ((retrievalSnapshotId && retrievalSnapshotId !== preparedContextPack.knowledgeLens.snapshotId)
+                || (retrievalSourceFingerprint
+                    && preparedContextPack.freshness.fingerprint
+                    && retrievalSourceFingerprint !== preparedContextPack.freshness.fingerprint)) {
+                throw analyticalError('The selected exploratory query no longer matches its retrieval snapshot or source fingerprint, so it was not executed.', {
+                    origin: 'governance_gate', stage: 'validation', code: 'snapshot_drift',
+                });
+            }
+            projectSnapshot();
+            projectSnapshots.assertCurrent(runProjectSnapshot.snapshotId);
+            const target = await observeWarehouseTargetIdentity(executor, semanticConnection);
+            if (generatedProposalTargetIdentity?.identityFingerprint
+                && target.identityFingerprint !== generatedProposalTargetIdentity.identityFingerprint) {
+                throw analyticalError('The selected exploratory query no longer matches the observed execution target, so it was not executed.', {
+                    origin: 'governance_gate', stage: 'validation', code: 'unauthorized_sql',
+                });
+            }
+            const validation = validateAuthorizedSqlReferences(sql, preparedExploratoryContextPack, {
+                ...(semanticDriver ? { dialect: semanticDriver } : {}),
+                runtimeSchema: preparedExploratoryQualifiedSchemaContext,
+            });
+            if (!validation.ok) {
+                throw analyticalError('The selected exploratory query did not pass the host SQL/context validation, so it was not executed.', {
+                    origin: 'governance_gate', stage: 'validation', code: 'unauthorized_sql',
+                });
+            }
+            const normalizeIdentifier = (value) => value
+                .trim()
+                .split('.')
+                .map((part) => part.trim().replace(/^["`\[]|["`\]]$/g, '').toLowerCase())
+                .filter(Boolean)
+                .join('.');
+            const allowedExploratoryRelations = new Set(preparedExploratoryQualifiedSchemaContext.map((table) => normalizeIdentifier(table.relation)));
+            const outsideClosure = validation.referencedRelations.filter((relation) => !allowedExploratoryRelations.has(normalizeIdentifier(relation)));
+            if (outsideClosure.length > 0) {
+                throw analyticalError('The generated SQL references a relation outside the router-selected physical closure, so it was not executed.', {
+                    origin: 'governance_gate', stage: 'validation', code: 'unauthorized_sql',
+                });
+            }
+            const runtimeByRelation = new Map(preparedExploratoryQualifiedSchemaContext.map((table) => [normalizeIdentifier(table.relation), table]));
+            const qualifiedReferences = qualifyAuthorizationReferences(sql, {
+                relations: validation.referencedRelations,
+                columns: validation.referencedColumns,
+            });
+            const proofs = new Map();
+            for (const relation of validation.referencedRelations) {
+                const table = runtimeByRelation.get(normalizeIdentifier(relation));
+                if (!table) {
+                    throw analyticalError('The selected exploratory query references a relation that was not proven by the live runtime schema, so it was not executed.', {
+                        origin: 'governance_gate', stage: 'validation', code: 'unauthorized_sql',
+                    });
+                }
+                proofs.set(table.relation, 'schema_tool');
+            }
+            for (const reference of qualifiedReferences) {
+                const normalizedReference = normalizeIdentifier(reference);
+                const table = [...runtimeByRelation.entries()].find(([relation]) => normalizedReference.startsWith(`${relation}.`));
+                if (!table)
+                    continue;
+                const [, runtimeTable] = table;
+                const column = normalizedReference.slice(`${table[0]}.`.length);
+                if (!column || !runtimeTable.columns.some((candidate) => normalizeIdentifier(candidate.name) === column)) {
+                    throw analyticalError('The selected exploratory query references a column that was not proven by the live runtime schema, so it was not executed.', {
+                        origin: 'governance_gate', stage: 'validation', code: 'unauthorized_sql',
+                    });
+                }
+                proofs.set(`${runtimeTable.relation}.${column}`, 'schema_tool');
+            }
+            const candidateIds = [...selectedAttempt.candidateIds];
+            const sqlFingerprint = executionFingerprint(sql);
+            const planFingerprint = executionFingerprint(stableExecutionValue({
+                version: 1,
+                tier: 'exploratory_sql',
+                snapshotId: retrievalFreezeSnapshotId,
+                executionSnapshotId: runProjectSnapshot.snapshotId,
+                sourceFingerprint: preparedContextPack.freshness.fingerprint,
+                targetFingerprint: target.identityFingerprint,
+                candidateIds,
+                sqlFingerprint,
+            }));
+            const planId = `exploratory-${planFingerprint.slice(0, 24)}`;
+            const capability = createAgenticSqlExecutionCapability({
+                sql,
+                proven: [...proofs.entries()].map(([identifier, evidence]) => ({ identifier, evidence })),
+                runId: request.runId,
+                executionId: `${request.runId}:exploratory:${sqlFingerprint.slice(0, 16)}`,
+                snapshotId: runProjectSnapshot.snapshotId,
+                planId,
+                targetFingerprint: target.identityFingerprint,
+                // Keep the capability binding shape identical to the direct execution
+                // boundary below. An omitted generated-artifact binding is represented
+                // there as `{ sqlParams: [], variables: {} }`, not `{}`; minting the
+                // latter made a fully validated immutable proposal fail only after its
+                // exploratory plan had frozen.
+                bindings: { sqlParams: [], variables: {} },
+            });
+            if (!capability) {
+                throw analyticalError('DQL could not mint a request-scoped exploratory execution capability, so it was not executed.', {
+                    origin: 'governance_gate', stage: 'validation', code: 'unauthorized_sql',
+                });
+            }
+            return {
+                capability,
+                freeze: {
+                    version: 1,
+                    selectedTier: 'exploratory_sql',
+                    planId,
+                    planFingerprint,
+                    snapshotId: retrievalFreezeSnapshotId,
+                    targetFingerprint: target.identityFingerprint,
+                    sqlFingerprint: capability.candidateSqlFingerprint,
+                    candidateIds,
+                    authorization: 'capability_minted',
+                },
+            };
+        };
         await runner.run({
             provider: resolvedProvider,
             ...(agentRunProviderEvidenceContext.getStore()
@@ -2187,10 +2641,21 @@ export async function startLocalServer(opts) {
             },
             reasoningEffort,
             ...(analysisDepth ? { analysisDepth } : {}),
+            orchestrationMode: route === 'research' ? 'research' : 'ask',
             allowProviderSemanticMemberSelection: route === 'research',
             researchResultRowsOptIn: route === 'research' && request.researchResultRowsOptIn === true,
             projectRoot,
-            preparedContextPack: preparedAgentContextPacks.get(request),
+            // Keys the execution authorization, so the proofs the analyst loop
+            // gathers can be checked against the statement this run executes.
+            ...(request.runId ? { agentRunId: request.runId } : {}),
+            preparedContextPack,
+            // This closure is derived only from the router-owned cascade attempt
+            // above. It is intentionally not sourced from the HTTP request: a
+            // client or provider cannot widen the relations the exploratory prompt
+            // or capability may use.
+            ...(preparedExploratoryContextPack
+                ? { preparedExploratoryContextPack }
+                : {}),
             domainContext,
             projectSnapshot: { snapshotId: runProjectSnapshot.snapshotId, manifest: runProjectSnapshot.manifest },
             assertProjectSnapshot: (snapshotId) => {
@@ -2351,12 +2816,73 @@ export async function startLocalServer(opts) {
             ...(routeDecision?.resolvedAnalyticalPlan
                 ? { resolvedAnalyticalPlan: routeDecision.resolvedAnalyticalPlan }
                 : {}),
+            ...(routeDecision?.analyticalCascadeDecision?.selectedTier
+                ? { selectedCascadeTier: routeDecision.analyticalCascadeDecision.selectedTier }
+                : {}),
+            ...(exploratoryCandidateIds.length > 0
+                ? { exploratoryCandidateIds }
+                : {}),
             ...(generatedProposalTargetIdentity?.identityFingerprint
                 ? { generatedProposalTargetFingerprint: generatedProposalTargetIdentity.identityFingerprint }
                 : {}),
             analyticalReferenceInstant: new Date().toISOString(),
-            executeCertifiedBlock: (node, invocation) => executeCertifiedBlockForAgent(node, invocation, semanticConnection, semanticConnectionName),
+            // A frozen certified artifact may use the human-friendly leaf relation
+            // authored in its DQL.  Its execution must still bind to the exact
+            // same-snapshot physical relation that retrieval inspected.  This is
+            // deliberately narrower than exploratory preflight: it only qualifies
+            // an unambiguous FROM/JOIN leaf already present in the artifact and it
+            // never supplies a missing table, join, or column.
+            executeCertifiedBlock: (node, invocation) => {
+                const frozenCertifiedPlan = routeDecision?.analyticalCascadeDecision?.planFrozen === true
+                    && routeDecision.analyticalCascadeDecision.selectedTier === 'certified'
+                    && routeDecision.resolvedAnalyticalPlan?.capability === 'certified_execution';
+                if (frozenCertifiedPlan) {
+                    const plan = routeDecision.resolvedAnalyticalPlan;
+                    const retrievedSourceFingerprint = routeDecision.retrievalEvidence?.sourceFingerprint;
+                    const retrievedSnapshotId = routeDecision.retrievalEvidence?.snapshotId;
+                    // A certified stamp is valid only for the exact router snapshot
+                    // and retrieval source that selected this block. The runner's
+                    // standard guard separately confirms the current host snapshot
+                    // immediately before this callback. Do not re-fingerprint the
+                    // mutable local cache here: cache refresh is not a source edit.
+                    if (retrievedSnapshotId && plan.snapshotId !== retrievedSnapshotId) {
+                        throw analyticalError('The selected certified plan no longer matches the retrieval snapshot that froze it. Refresh the answer before retrying.', { origin: 'governance_gate', stage: 'validation', code: 'snapshot_drift' });
+                    }
+                    if (plan.sourceFingerprint && retrievedSourceFingerprint
+                        && plan.sourceFingerprint !== retrievedSourceFingerprint) {
+                        throw analyticalError('The selected certified plan no longer matches the retrieval source that froze it. Refresh the answer before retrying.', { origin: 'governance_gate', stage: 'validation', code: 'snapshot_drift' });
+                    }
+                    if (!preparedContextPack
+                        || plan.snapshotId !== preparedContextPack.knowledgeLens.snapshotId) {
+                        throw analyticalError('The selected certified plan no longer matches the retrieved metadata snapshot. Refresh the answer before retrying.', { origin: 'governance_gate', stage: 'validation', code: 'snapshot_drift' });
+                    }
+                    const preparedSourceFingerprint = preparedContextPack.freshness.fingerprint;
+                    if (plan.sourceFingerprint && preparedSourceFingerprint
+                        && plan.sourceFingerprint !== preparedSourceFingerprint) {
+                        throw analyticalError('The selected certified plan no longer matches the retrieved metadata source. Refresh the answer before retrying.', { origin: 'governance_gate', stage: 'validation', code: 'snapshot_drift' });
+                    }
+                }
+                const certifiedSchemaContext = frozenCertifiedPlan
+                    ? buildFrozenCertifiedSchemaContext(preparedContextPack, runProjectSnapshot.manifest)
+                    : preparedQualifiedSchemaContext;
+                return executeCertifiedBlockForAgent(node, invocation, semanticConnection, semanticConnectionName, certifiedSchemaContext, frozenCertifiedPlan);
+            },
             executeGeneratedSql: (sql, artifact) => executeGeneratedArtifactForAgent(request.question, sql, artifact, semanticConnection, semanticConnectionName),
+            prepareExploratorySqlExecution,
+            executeAgenticGeneratedSql: async (capability, sql, artifact) => {
+                if (!agenticExecutionCapabilityGate.consume(capability)) {
+                    throw analyticalError('This analyst execution capability was already consumed; DQL did not retry it with stale proof.', {
+                        origin: 'governance_gate', stage: 'execute', code: 'unauthorized_sql',
+                    });
+                }
+                return executeGeneratedArtifactForAgent(request.question, sql, artifact, semanticConnection, semanticConnectionName, capability, {
+                    runId: request.runId,
+                    executionId: capability.executionId,
+                    snapshotId: runProjectSnapshot.snapshotId,
+                    planId: capability.planId,
+                    targetFingerprint: capability.targetFingerprint,
+                });
+            },
             executeDqlArtifact: (artifact) => executeArtifactReferenceForAgent(artifact, request.question, semanticConnection, semanticConnectionName),
             getSchemaContext: (question, preparedContextPack) => getSchemaContextForAgent(question, preparedContextPack, semanticConnection, request.executionTarget?.target === 'connection'
                 ? request.executionTarget.connectionName
@@ -2371,10 +2897,14 @@ export async function startLocalServer(opts) {
             if (turn.kind === 'error') {
                 providerError = turn.message;
                 providerDispatchEvidence = turn.dispatchEvidence;
+                providerBoundaryDiagnostic = turn.providerDiagnostic;
             }
         }, runSignal);
         if (!governedAnswer) {
-            throw Object.assign(new Error(providerError ?? 'The AI provider did not return a governed answer.'), ...(providerDispatchEvidence ? [{ providerDispatchEvidence }] : []));
+            throw Object.assign(new Error(providerError ?? 'The AI provider did not return a governed answer.'), {
+                ...(providerDispatchEvidence ? { providerDispatchEvidence } : {}),
+                ...(providerBoundaryDiagnostic ? { providerDiagnostic: providerBoundaryDiagnostic } : {}),
+            });
         }
         return governedAnswer;
     }
@@ -2412,6 +2942,68 @@ export async function startLocalServer(opts) {
     function resolvedRunRouteFromAnswer(governedAnswer) {
         return routeForCascadeAnswerTier(governedAnswer.route?.tier);
     }
+    /**
+     * Return the route the router already froze. This is intentionally derived
+     * from the typed cascade/plan, never from an answer-loop route label.
+     */
+    function frozenAnalyticalRoute(routeDecision) {
+        if (!routeDecision)
+            return undefined;
+        const cascade = routeDecision.analyticalCascadeDecision;
+        if (cascade?.planFrozen) {
+            switch (cascade.selectedTier) {
+                case 'certified': return 'certified_answer';
+                case 'semantic': return 'semantic_answer';
+                case 'governed_relational':
+                case 'exploratory_sql': return 'generated_answer';
+                default: return undefined;
+            }
+        }
+        const plan = routeDecision.resolvedAnalyticalPlan;
+        if (plan?.mode !== 'authoritative')
+            return undefined;
+        switch (plan.capability) {
+            case 'certified_execution': return 'certified_answer';
+            case 'semantic_execution': return 'semantic_answer';
+            case 'governed_relational':
+            case 'bounded_exploration': return 'generated_answer';
+            default: return undefined;
+        }
+    }
+    /**
+     * A frozen tier may fail, but cannot silently substitute a result selected by
+     * a different answer-loop lane. The engine repeats this guard so host-injected
+     * executors receive the same protection.
+     */
+    function frozenPlanRouteFailure(route, routeDecision, reportedRoute) {
+        const message = `The frozen ${route.replaceAll('_', ' ')} plan could not execute as selected. DQL did not substitute another analytical tier.`;
+        return {
+            resolvedRoute: route,
+            status: 'blocked',
+            trustState: 'blocked',
+            stopReason: 'blocked',
+            // Keep the public refusal vocabulary stable; the artifact/evaluation
+            // below retains the precise route-integrity diagnostic.
+            answerRefusalCode: 'grounding_gap',
+            summary: message,
+            answer: message,
+            artifacts: [agentRunArtifact('answer', 'Frozen analytical plan could not execute', {
+                    kind: 'no_answer',
+                    refusalCode: 'grounding_gap',
+                    frozenPlanFailureCode: 'frozen_plan_route_mismatch',
+                    text: message,
+                    selectedTier: routeDecision?.analyticalCascadeDecision?.selectedTier,
+                    selectedConceptIds: routeDecision?.meaningResolution?.selectedConceptIds ?? [],
+                    ...(reportedRoute ? { reportedRoute } : {}),
+                }, undefined, 'blocked')],
+            evaluations: [agentRunEvaluation('frozen-plan-route-mismatch', 'Frozen analytical route', false, 'blocking', `The router froze ${route.replaceAll('_', ' ')}, but the answer executor reported ${reportedRoute?.replaceAll('_', ' ') ?? 'no matching route'}.`, {
+                    selectedRoute: route,
+                    reportedRoute,
+                    selectedTier: routeDecision?.analyticalCascadeDecision?.selectedTier,
+                    planId: routeDecision?.resolvedAnalyticalPlan?.planId,
+                })],
+        };
+    }
     function groundingGapRepairHint(governedAnswer) {
         const details = governedAnswer.refusalDetails;
         if (!details)
@@ -2625,10 +3217,20 @@ export async function startLocalServer(opts) {
         if (governedAnswer.result)
             delete governedAnswer.result.dqlArtifact;
     }
-    const answerRunExecutor = async ({ request, route, routeDecision, attempt, repairHint, emit }) => {
+    const answerRunExecutor = async ({ runId, request, route, routeDecision, attempt, repairHint, emit }) => {
+        // `AgentRunEngine` owns the canonical run ID when HTTP callers omit one.
+        // Bind that server-issued value to the same request object before the
+        // provider/SQL handoff: the prepared context pack is keyed by this object,
+        // while the exploratory capability must be scoped to the persisted run.
+        // Cloning here would lose the exact retrieval pack; accepting a missing ID
+        // would mint an unbound capability. This is server-side bookkeeping only,
+        // never client-provided execution authority.
+        if (!request.runId)
+            request.runId = runId;
         const runStartedAtMs = Date.now();
         const turnPlan = buildAnalyticalTurnPlan({
             question: request.question,
+            mode: route === 'research' ? 'research' : 'ask',
             turnId: request.runId,
             candidateIds: routeDecision?.retrievalEvidence?.candidateIds ?? [],
             frozen: routeDecision?.resolvedAnalyticalPlan?.mode === 'authoritative',
@@ -2641,18 +3243,27 @@ export async function startLocalServer(opts) {
         // is copied into several labels. Independent children share the parent's
         // signal/deadline and return truthful partial success.
         if (turnPlan.tasks.length > 1 && !childTurn && (attempt ?? 0) === 0) {
-            const childResults = await Promise.all(turnPlan.tasks.slice(0, 6).map(async (task) => {
+            const runChildTask = async (task, dependencyBinding) => {
                 if (request.signal?.aborted)
                     rethrowIfCancelled(request.signal.reason, request.signal);
                 try {
                     const childRequest = {
                         ...request,
                         question: task.question,
+                        ...(dependencyBinding ? {
+                            conversationContext: {
+                                ...(request.conversationContext ?? {}),
+                                // This is the complete parent-to-child data boundary: no
+                                // parent prose, SQL, or rows cross into a dependent clause.
+                                analyticalTaskDependencyBinding: dependencyBinding,
+                            },
+                        } : {}),
                         workspaceContext: {
                             ...(request.workspaceContext && typeof request.workspaceContext === 'object' ? request.workspaceContext : {}),
                             analyticalTaskChild: true,
                             analyticalParentRunId: request.runId,
                             analyticalTaskId: task.id,
+                            ...(dependencyBinding ? { analyticalTaskDependencyBinding: dependencyBinding } : {}),
                         },
                     };
                     const answer = await runGovernedAgentAnswerForRun(childRequest, { attempt: 0, repairHint }, route, (message) => emit({ type: 'executor.started', message: `Task ${task.id}: ${message}`, route }), undefined);
@@ -2679,6 +3290,42 @@ export async function startLocalServer(opts) {
                     rethrowIfCancelled(error, request.signal);
                     return { task, error: error instanceof Error ? error.message : String(error) };
                 }
+            };
+            const scheduledChildren = await scheduleCompoundAnalyticalTasks({
+                tasks: turnPlan.tasks.slice(0, 6),
+                runTask: async (task, binding) => {
+                    const child = await runChildTask(task, binding);
+                    return { task, value: child.answer, error: child.error };
+                },
+                resolveDependency: (task, parent) => {
+                    const sourceTaskId = task.dependency?.sourceTaskId ?? '';
+                    return resolveTopRankedRegionDependency(sourceTaskId, parent?.value?.result
+                        ? normalizeCanonicalQueryResult({
+                            ...parent.value.result,
+                            resultFingerprint: parent.value.result.resultFingerprint ?? parent.value.result.executionReceipt?.resultFingerprint,
+                            executionReceipt: parent.value.result.executionReceipt,
+                            answerTier: parent.value.route?.tier ?? parent.value.sourceTier,
+                        })
+                        : undefined, parent?.task);
+                },
+            });
+            const childResults = scheduledChildren.map(({ task, value, error, dependencyError }) => ({
+                task,
+                answer: value,
+                error,
+                ...(dependencyError ? {
+                    dependencyGap: buildCoverageGap({
+                        code: dependencyError.code,
+                        phase: 'planning',
+                        message: dependencyError.message,
+                        searchedSources: routeDecision?.retrievalEvidence?.candidateIds ?? [],
+                        attemptedRoutes: ['certified', 'semantic', 'governed_relational', 'generated'],
+                        missing: ['unambiguous_top_region'],
+                        recoverable: true,
+                        planFrozen: turnPlan.frozen,
+                        nextActions: ['Ask for a single top region or review the parent result before retrying the customer task.'],
+                    }),
+                } : {}),
             }));
             const outcomes = childResults.map(({ task, answer, error }) => ({
                 version: 1,
@@ -2687,7 +3334,7 @@ export async function startLocalServer(opts) {
                 ...(answer?.answer || answer?.text ? { summary: answer.answer ?? answer.text } : {}),
                 ...(answer?.result?.resultFingerprint ? { resultFingerprint: answer.result.resultFingerprint } : {}),
                 ...(error || answer?.kind === 'no_answer' ? {
-                    gap: buildCoverageGap({
+                    gap: childResults.find((candidate) => candidate.task.id === task.id)?.dependencyGap ?? buildCoverageGap({
                         code: answer?.refusalCode === 'ambiguous' ? 'AMBIGUOUS_MEANING' : 'EXECUTION_FAILED',
                         phase: answer?.executionError ? 'execution' : 'meaning',
                         message: error ?? answer?.answer ?? answer?.text ?? 'The task did not produce an accepted analytical result.',
@@ -2706,14 +3353,23 @@ export async function startLocalServer(opts) {
                 status: outcomes.find((outcome) => outcome.taskId === task.id)?.status === 'completed' ? 'completed' : 'gap',
             }));
             const answerText = childResults.map(({ task, answer, error }) => `${task.question}: ${error ?? answer?.answer ?? answer?.text ?? 'No accepted result was produced.'}`).join('\n\n');
+            const compoundTrust = compoundTrustState(childResults
+                .filter(({ answer, error }) => !error && answer && answer.kind !== 'no_answer')
+                .map(({ answer }) => trustStateForAgentAnswer(answer)));
             return {
                 summary: completedCount === outcomes.length
-                    ? `Answered ${completedCount} independent analytical clauses.`
+                    ? `Answered ${completedCount} analytical clauses.`
                     : `Answered ${completedCount} of ${outcomes.length} analytical clauses; the remaining clauses need review.`,
                 answer: answerText,
                 status: completedCount === outcomes.length ? 'completed' : completedCount > 0 ? 'needs_review' : 'needs_clarification',
-                trustState: completedCount === outcomes.length ? 'governed' : 'review_required',
-                stopReason: completedCount === outcomes.length ? 'governed_semantic_answer' : 'human_review_required',
+                // The parent is only as trustworthy as its weakest SUCCESSFUL child.
+                // Completion is not proof: the previous rule stamped `governed` on a
+                // parent assembled from review-required generated SQL.
+                trustState: compoundTrust,
+                // The stop reason has to agree with the trust it reports. Claiming a
+                // governed semantic answer over generated/certified children
+                // misrepresents provenance as much as the trust label does.
+                stopReason: compoundStopReason(completedCount, outcomes.length, compoundTrust),
                 artifacts: childResults.map(({ task, answer, error }) => agentRunArtifact('answer', `Task: ${task.question}`, {
                     taskId: task.id,
                     question: task.question,
@@ -2729,6 +3385,15 @@ export async function startLocalServer(opts) {
         let governedAnswer;
         try {
             governedAnswer = await runGovernedAgentAnswerForRun(request, { attempt, repairHint }, route, (message) => emit({ type: 'executor.started', message, route }), routeDecision);
+            const frozenRoute = frozenAnalyticalRoute(routeDecision);
+            const reportedRoute = resolvedRunRouteFromAnswer(governedAnswer);
+            // Do not let the legacy answer loop reselect meaning and overwrite the
+            // router's immutable tier through `resolvedRunRouteFromAnswer`. A frozen
+            // plan either executes on its selected route or returns a same-tier,
+            // inspectable terminal failure; it never downgrades to generated SQL.
+            if (frozenRoute && (frozenRoute !== route || (reportedRoute && reportedRoute !== frozenRoute))) {
+                return frozenPlanRouteFailure(frozenRoute, routeDecision, reportedRoute);
+            }
             // Keep the canonical result contract on the answer itself, not only on
             // the narration preview. Conversation persistence, follow-up member
             // resolution, Apply, and the notebook table all read this payload; if a
@@ -2903,6 +3568,33 @@ export async function startLocalServer(opts) {
             const message = dispatchBudgetExhausted
                 ? 'Ask reached its internal provider-dispatch limit before it froze one executable analytical plan. Nothing was run. Narrow the metric or dimension and retry; this is an orchestration-budget diagnostic, not a provider outage.'
                 : formatAgentRunInfrastructureError(error, 'AI answer provider');
+            const providerCode = error && typeof error === 'object'
+                ? String(error.code ?? '')
+                : '';
+            const boundaryProviderDiagnostic = error && typeof error === 'object'
+                ? error.providerDiagnostic
+                : undefined;
+            const providerDiagnostic = boundaryProviderDiagnostic
+                && typeof boundaryProviderDiagnostic === 'object'
+                && boundaryProviderDiagnostic.version === 1
+                ? boundaryProviderDiagnostic
+                : classifyProviderFailure({
+                    code: dispatchBudgetExhausted ? 'PROVIDER_DISPATCH_BUDGET' : providerCode,
+                    // Classification happens at the provider boundary before this error is
+                    // coalesced into the friendly headline. Persist the classifier output,
+                    // never this possibly sensitive raw message.
+                    message: error instanceof Error ? error.message : String(error ?? ''),
+                    phase: /no ai provider configured|not configured or reachable/i.test(message) ? 'preflight' : 'generation',
+                    providerFingerprint: agentRunWorkspaceValue(request, 'provider')
+                        ? `sha256:${createHash('sha256').update(agentRunWorkspaceValue(request, 'provider')).digest('hex')}`
+                        : undefined,
+                    modelFingerprint: agentRunWorkspaceValue(request, 'model')
+                        ? `sha256:${createHash('sha256').update(agentRunWorkspaceValue(request, 'model')).digest('hex')}`
+                        : undefined,
+                    baseOriginFingerprint: agentRunWorkspaceValue(request, 'providerBaseOrigin')
+                        ? `sha256:${createHash('sha256').update(agentRunWorkspaceValue(request, 'providerBaseOrigin')).digest('hex')}`
+                        : undefined,
+                });
             return {
                 summary: message,
                 status: 'blocked',
@@ -2920,11 +3612,12 @@ export async function startLocalServer(opts) {
                             code: dispatchBudgetExhausted ? 'orchestration_budget_exhausted' : 'AI_PROVIDER_FAILURE',
                             message,
                             recoverable: !dispatchBudgetExhausted,
+                            diagnostic: providerDiagnostic,
                         },
                     }, undefined, 'blocked')],
                 evaluations: [
                     agentRunEvaluation('route-decision', 'Route decision', true, 'info', routeDecision?.reason ?? 'Routed request to governed answer.'),
-                    agentRunEvaluation(dispatchBudgetExhausted ? 'orchestration-budget' : 'ai-provider', dispatchBudgetExhausted ? 'Internal orchestration budget' : 'AI provider', false, 'blocking', message, { originalErrorType: error instanceof Error ? error.name : typeof error }),
+                    agentRunEvaluation(dispatchBudgetExhausted ? 'orchestration-budget' : 'ai-provider', dispatchBudgetExhausted ? 'Internal orchestration budget' : 'AI provider', false, 'blocking', message, { originalErrorType: error instanceof Error ? error.name : typeof error, providerDiagnostic }),
                 ],
                 nextActions: [
                     ...(dispatchBudgetExhausted
@@ -2951,7 +3644,10 @@ export async function startLocalServer(opts) {
                 },
             };
         }
-        const answeredRoute = resolvedRunRouteFromAnswer(governedAnswer) ?? route;
+        // For an unfrozen legacy route, the answer loop can still describe which
+        // tier actually produced the answer. Once the router froze a cascade tier,
+        // that immutable route is the only durable provenance authority.
+        const answeredRoute = frozenAnalyticalRoute(routeDecision) ?? resolvedRunRouteFromAnswer(governedAnswer) ?? route;
         const isCertified = governedAnswer.certification === 'certified' || governedAnswer.kind === 'certified';
         const semanticRouteClaimed = governedAnswer.route?.tier === 'semantic_metric';
         const semanticAggregationProofPassed = semanticAnswerHasPassedAggregationProof(governedAnswer);
@@ -2990,9 +3686,14 @@ export async function startLocalServer(opts) {
             && route === 'generated_answer'
             && (request.requestedMode === undefined || request.requestedMode === 'auto' || request.requestedMode === 'ask')
             && routeDecision?.resolvedAnalyticalPlan?.mode !== 'authoritative';
+        // A generic `modeling_gap` says only that the complete analytical tuple did
+        // not prove out. Relationship-specific repair language is allowed solely
+        // when the router retained a structured coverage witness.
+        const persistedGapWitness = persistedAnalyticalGapWitness(routeDecision);
+        const relationshipSpecificGap = persistedGapWitness?.code === 'MISSING_RELATIONSHIP';
         const typedCoverageGap = (isGroundingGap || isModelDeclined)
             ? buildCoverageGap({
-                code: governedAnswer.refusalCode === 'modeling_gap' ? 'MISSING_RELATIONSHIP' : 'MISSING_RUNTIME_CAPABILITY',
+                code: persistedGapWitness?.code ?? 'MISSING_RUNTIME_CAPABILITY',
                 phase: 'planning',
                 message: governedAnswer.refusalDetails?.message
                     ?? (isModelDeclined
@@ -3000,17 +3701,21 @@ export async function startLocalServer(opts) {
                         : 'The retrieved context did not prove the metadata required for this analytical question.'),
                 searchedSources: ['certified_blocks', 'semantic_metrics', 'dbt_manifest', 'relationship_graph', 'warehouse_metadata'],
                 attemptedRoutes: ['certified', 'semantic', 'governed_relational', 'generated'],
-                missing: governedAnswer.refusalDetails?.offending
-                    ? [
-                        governedAnswer.refusalDetails.offending.relation,
-                        governedAnswer.refusalDetails.offending.column,
-                    ].filter((value) => Boolean(value))
-                    : ['an executable metric/dimension/relationship tuple'],
+                missing: persistedGapWitness?.missing.length
+                    ? persistedGapWitness.missing
+                    : governedAnswer.refusalDetails?.offending
+                        ? [
+                            governedAnswer.refusalDetails.offending.relation,
+                            governedAnswer.refusalDetails.offending.column,
+                        ].filter((value) => Boolean(value))
+                        : ['the complete requested analytical tuple'],
                 recoverable: canRecoverPreFreezeGap,
                 planFrozen: routeDecision?.resolvedAnalyticalPlan?.mode === 'authoritative',
                 nextActions: canRecoverPreFreezeGap
                     ? ['continue through DBT-grounded relational context', 'run review-required generated SQL', 'start bounded Research if coverage remains incomplete']
-                    : ['review the retained metadata gap', 'select a governed metric or dimension', 'repair modeling if the relationship is missing'],
+                    : relationshipSpecificGap
+                        ? ['review the retained relationship proof', 'repair the certified relationship in Modeling', 'retry after relationship validation']
+                        : ['review the retained metadata gap', 'select a governed metric or dimension', 'repair the missing metric, dimension, or output contract'],
             })
             : undefined;
         // Only a genuinely AMBIGUOUS question is surfaced as "needs clarification".
@@ -3062,7 +3767,34 @@ export async function startLocalServer(opts) {
             ? { ...preview, rows: redactProviderResultRows(preview.rows, narrationMaxRows) }
             : undefined;
         let narrationSource;
-        let narrationValidationFailures = [];
+        // The receipt is the durable source of truth for evaluation and inspector
+        // display. Do not reconstruct this later from rows or the reader-facing
+        // fallback sentence: both are presentation artifacts, not evidence that a
+        // fact-grounded narrator actually ran.
+        const verifiedFactNarration = narrationPlan.mode === 'verified_facts'
+            && Boolean(governedAnswer.analyticalFacts && governedAnswer.resolvedAnalyticalPlan?.analyticalFrame);
+        let narrationIntegrityReceipt = narrationPlan.mode === 'skip'
+            ? {
+                version: 1,
+                mode: 'skip',
+                outcome: 'skipped',
+                attempted: false,
+                factCount: 0,
+                maxRows: 0,
+                validationFailures: [],
+                skipReason: narrationPlan.reason,
+            }
+            : {
+                version: 1,
+                mode: verifiedFactNarration ? 'verified_facts' : 'preview_grounded',
+                // This is deliberately pessimistic until a narration outcome is
+                // observed, so an exception cannot be persisted as a silent skip.
+                outcome: 'error',
+                attempted: true,
+                factCount: verifiedFactNarration ? governedAnswer.analyticalFacts?.facts.length ?? 0 : 0,
+                maxRows: narrationPlan.maxRows,
+                validationFailures: [],
+            };
         if (narrationPlan.mode !== 'skip' && narrationProvider) {
             const narrationStartedAtMs = Date.now();
             const draft = governedAnswer.answer ?? governedAnswer.text;
@@ -3075,8 +3807,16 @@ export async function startLocalServer(opts) {
                     columnCount: providerPreview?.columns.length ?? 0,
                 },
             });
-            const narrationDispatchOptions = () => ({
-                maxTokens: 350,
+            const narrationDispatchOptions = (factCount = 0) => ({
+                // The ceiling has to grow with the result. Every claim must echo the
+                // fact ids it rests on, and a fact id is a long hex string that
+                // tokenizes badly — ten of them consume most of the budget before a
+                // word of prose is written. At a flat 350 a ten-row answer was
+                // truncated mid-sentence ("...Elizabeth Shea (875), and Dyl"), so the
+                // JSON never closed, BOTH attempts failed as UNPARSEABLE_CLAIMS, and
+                // the reader got "Verified narration was unavailable" above a robot
+                // dump of the very rows the model had just described correctly.
+                maxTokens: narrationMaxTokensForFacts(factCount),
                 temperature: 0.3,
                 maxProviderDispatches: 2,
                 ...(agentRunProviderEvidenceContext.getStore()
@@ -3093,10 +3833,19 @@ export async function startLocalServer(opts) {
                         factSet: governedAnswer.analyticalFacts,
                         question: request.question,
                         maxRows: narrationPlan.maxRows,
-                        complete: async ({ system, user }) => streamOrGenerate(narrationProvider, [{ role: 'system', content: system }, { role: 'user', content: user }], narrationDispatchOptions(), () => { }),
+                        complete: async ({ system, user }) => streamOrGenerate(narrationProvider, [{ role: 'system', content: system }, { role: 'user', content: user }], narrationDispatchOptions(governedAnswer.analyticalFacts?.facts.length ?? 0), () => { }),
                     });
                     narrationSource = composed.source;
-                    narrationValidationFailures = composed.validationFailures;
+                    narrationIntegrityReceipt = {
+                        ...narrationIntegrityReceipt,
+                        outcome: composed.source === 'llm' ? 'success' : 'deterministic_fallback',
+                        validationFailures: narrationIntegrityFailureCodes(composed.validationFailures),
+                    };
+                    if (process.env.DQL_ORCHESTRATOR_TRACE) {
+                        console.warn(`[dql] narration: source=${composed.source}${narrationIntegrityReceipt.validationFailures.length > 0
+                            ? ` rejected=${narrationIntegrityReceipt.validationFailures.join(',')}`
+                            : ''}`);
+                    }
                     synthesizedAnswer = composed.source === 'llm'
                         ? composed.narrative.text
                         // A verification failure is not silent: the deterministic join is a
@@ -3126,11 +3875,22 @@ export async function startLocalServer(opts) {
                     narrationSource = result.source;
                     if (result.text)
                         synthesizedAnswer = result.text;
+                    narrationIntegrityReceipt = {
+                        ...narrationIntegrityReceipt,
+                        outcome: result.source === 'llm' ? 'success' : 'deterministic_fallback',
+                        validationFailures: [],
+                    };
                 }
             }
             catch {
                 // Keep the governed draft on any narration failure.
                 synthesizedAnswer = undefined;
+                narrationIntegrityReceipt = {
+                    ...narrationIntegrityReceipt,
+                    outcome: 'error',
+                    validationFailures: [],
+                    errorCode: 'narration_error',
+                };
             }
             finally {
                 narrationDurationMs = Date.now() - narrationStartedAtMs;
@@ -3223,12 +3983,15 @@ export async function startLocalServer(opts) {
             : isTerminalFailure
                 ? terminalFailureActions
                 : isGroundingGap
-                    ? governedAnswer.refusalCode === 'modeling_gap'
+                    ? relationshipSpecificGap
                         ? [
-                            { id: 'fix-modeling-gap', label: 'Fix with Modeling AI', route: 'modeling_draft', artifactKind: 'modeling_change_proposal' },
+                            { id: 'repair-relationship-proof', label: 'Repair relationship proof in Modeling', route: 'modeling_draft', artifactKind: 'modeling_change_proposal' },
+                            { id: 'research-gap', label: 'Research missing metadata coverage', route: 'research', artifactKind: 'research_run' },
+                        ]
+                        : [
+                            { id: 'review-metadata-gap', label: 'Review missing metadata coverage', route: 'blocked' },
                             { id: 'research-gap', label: 'Research missing metadata coverage', route: 'research', artifactKind: 'research_run' },
                         ]
-                        : [{ id: 'research-gap', label: 'Research missing metadata coverage', route: 'research', artifactKind: 'research_run' }]
                     : [
                         { id: 'create-block', label: governedAnswer.dqlArtifact ? 'Review DQL draft' : 'Create DQL draft', route: 'dql_block_draft', artifactKind: 'dql_block_draft' },
                         { id: 'research-gap', label: 'Research deeper', route: 'research' },
@@ -3270,7 +4033,11 @@ export async function startLocalServer(opts) {
             trustState,
             stopReason,
             artifacts: isTerminalFailure
-                ? [agentRunArtifact('answer', 'Failed governed analytical run', governedAnswer, governedAnswer.sourceCertifiedBlock ?? governedAnswer.block?.name, 'blocked')]
+                ? [agentRunArtifact('answer', 
+                    // Was 'Failed governed analytical run' — internal orchestration state
+                    // used as the card heading a user reads. It names our pipeline, not
+                    // what happened to their question.
+                    terminalFailureTitle(governedAnswer), governedAnswer, governedAnswer.sourceCertifiedBlock ?? governedAnswer.block?.name, 'blocked')]
                 : governedAnswer.kind === 'no_answer'
                     // A refusal still keeps the DQL draft the answer loop produced (when any),
                     // so the "Review DQL draft" next-action isn't a dead link and the user can
@@ -3367,20 +4134,41 @@ export async function startLocalServer(opts) {
                 ...(governedAnswer.executionError ? [
                     agentRunEvaluation('execution-error', 'Execution error', false, 'warning', governedAnswer.executionError),
                 ] : []),
-                // A rejected narration must say WHY it was rejected. The failures were
-                // computed and then dropped, so a reader saw "Verified narration was
-                // unavailable" with no way to tell whether the model invented a number,
-                // cited a fact id that does not exist, or the provider simply failed.
-                // The fallback itself stays: this only makes its reason inspectable.
-                ...(narrationSource === 'deterministic' && narrationValidationFailures.length > 0 ? [
-                    agentRunEvaluation('narration-verification', 'Narration verification', false, 'warning', `The drafted narration was rejected against the result fact set, so the deterministic record was shown instead: ${narrationValidationFailures.join('; ')}`, { narrationSource, validationFailures: narrationValidationFailures }),
+                // Keep only the content-free receipt codes in the durable inspection
+                // record. Raw verifier prose can contain a result value, prompt excerpt,
+                // or provider error and is not safe evidence to surface or persist.
+                ...(narrationIntegrityReceipt.outcome === 'deterministic_fallback'
+                    && narrationIntegrityReceipt.validationFailures.length > 0 ? [
+                    agentRunEvaluation('narration-verification', 'Narration verification', false, 'warning', `The drafted narration was rejected against the result fact set, so the deterministic record was shown instead: ${narrationIntegrityReceipt.validationFailures.join(', ')}.`, { narrationSource, validationFailures: narrationIntegrityReceipt.validationFailures }),
                 ] : []),
             ],
             nextActions,
             providerEgressReceipts: finalProviderEgressReceipts,
             telemetry: finalTelemetry,
+            narrationIntegrityReceipt,
+            ...(governedAnswer.exploratoryExecutionFreeze
+                ? { analyticalExecutionFreeze: governedAnswer.exploratoryExecutionFreeze }
+                : {}),
         };
     };
+    /**
+     * A heading for a run that ended without an answer, in the user's terms.
+     *
+     * Says WHICH stage stopped, because "it failed" and "it was stopped before
+     * running" call for different next moves: one is worth retrying, the other
+     * needs the question or the model changed.
+     */
+    const terminalFailureTitle = (answer) => {
+        switch (answer.refusalCode) {
+            case 'policy_blocked': return 'Blocked by a governance policy';
+            case 'modeling_gap': return 'Not modeled yet';
+            case 'grounding_gap': return 'Not enough context to answer safely';
+            case 'model_declined': return 'The assistant declined to answer';
+            case 'provider_error': return 'The AI provider did not respond';
+            case 'ambiguous': return 'Needs one detail before running';
+            default: return 'No answer was produced';
+        }
+    };
     const conversationRunExecutor = async ({ request, routeDecision, emitAnswerDelta }) => {
         const kind = routeDecision?.conversationalKind ?? 'smalltalk';
         const isGeneralKnowledge = routeDecision?.category === 'general_knowledge';
@@ -3397,6 +4185,15 @@ export async function startLocalServer(opts) {
         let text = kind === 'answer_explanation'
             ? buildPriorAnswerExplanation(request.question, request.conversationContext)
             : undefined;
+        // A definitional question that NAMES a governed artifact is answerable from
+        // the catalog: the description, domain, and dimensions are already recorded.
+        // Reaching for a provider to paraphrase facts we hold can only add drift, and
+        // the generic conversational reply this replaces used none of them.
+        //
+        // Returns undefined unless the question names something real, so a turn that
+        // does not match keeps today's behaviour exactly.
+        if (!text)
+            text = buildGovernedObjectExplanation(request.question);
         if (text) {
             emitAnswerDelta?.(text);
         }
@@ -3863,10 +4660,18 @@ export async function startLocalServer(opts) {
             const conversationHistory = request.history?.length
                 ? request.history
                 : conversationHistoryFromContext(request.conversationContext);
+            // The provider that will plan the investigation as hypotheses. Absent or
+            // unreachable, `planResearch` keeps its deterministic template, so
+            // research never depends on a model being available.
+            const researchPlanner = resolveGovernedAnswerRunner(projectRoot);
+            const researchPlannerProvider = researchPlanner
+                ? createGovernedTextProvider(researchPlanner.provider, projectRoot)
+                : undefined;
             const plan = await planResearch({
                 question: request.question,
                 metrics,
                 blocks,
+                ...(researchPlannerProvider ? { provider: researchPlannerProvider } : {}),
                 intent: request.intent,
                 isFollowUp: conversationHistory.length > 0,
                 history: conversationHistory,
@@ -3881,6 +4686,38 @@ export async function startLocalServer(opts) {
             if (plan.done && !plan.followUp && request.requestedMode !== 'research') {
                 return answerRunExecutor(researchContext);
             }
+            // This is the executable, receipt-bound research plan. It carries the
+            // branch hypothesis/expectation/validator kind into every child rather
+            // than treating V2 as a presentation-only wrapper after the work ends.
+            const typedResearchPlan = buildResearchHypothesisPlanV2({
+                hypotheses: plan.steps.map((step, index) => ({
+                    id: `h${index + 1}`,
+                    statement: step.thought,
+                    expectation: step.expectation,
+                    targetId: step.action.target,
+                    validatorKind: inferResearchValidatorKind(step.thought, step.expectation),
+                })),
+            });
+            // The V2 contract is the executable branch authority: retain its stable
+            // hypothesis ID, wording, expectation, target, and validator kind while
+            // borrowing only the already-grounded action kind from the planner. This
+            // prevents a presentation-only V2 ledger from drifting away from the
+            // child runs that actually produced the receipts.
+            const executableResearchBranches = typedResearchPlan.hypotheses.flatMap((hypothesis) => {
+                const planned = plan.steps.find((step) => step.thought.trim() === hypothesis.statement
+                    && step.action.target === hypothesis.targetId)
+                    ?? plan.steps.find((step) => step.action.target === hypothesis.targetId);
+                if (!planned)
+                    return [];
+                return [{
+                        hypothesisId: hypothesis.id,
+                        validatorKind: hypothesis.validatorKind,
+                        thought: hypothesis.statement,
+                        expectation: hypothesis.expectation,
+                        action: { ...planned.action, target: hypothesis.targetId },
+                    }];
+            });
+            const typedHypothesesById = new Map(typedResearchPlan.hypotheses.map((hypothesis) => [hypothesis.id, hypothesis]));
             const needsClarification = Boolean(plan.followUp);
             const notebookPath = agentRunNotebookPath(request, runId);
             const researchIntent = agentRunResearchIntent(request);
@@ -3941,6 +4778,8 @@ export async function startLocalServer(opts) {
                         // attempt, not a fabricated successful finding; its durable status
                         // and receipt determine the ledger entry.
                         const fallbackBranch = {
+                            hypothesisId: 'fallback:context',
+                            validatorKind: 'counter_evidence',
                             thought: 'Inspect the requested analytical question against the frozen root context.',
                             action: {
                                 kind: 'lookup_metric',
@@ -3948,12 +4787,34 @@ export async function startLocalServer(opts) {
                             },
                             expectation: 'Whether the frozen context contains enough evidence for a bounded answer.',
                         };
-                        const branches = capResearchBranches(plan.steps.length > 0 ? plan.steps : [fallbackBranch], 6);
+                        const branches = capResearchBranches(executableResearchBranches.length > 0 ? executableResearchBranches : [fallbackBranch], 6);
+                        // The replan edge. Each branch tests one hypothesis; folding its
+                        // outcome back into the state is what lets the investigation stop
+                        // when the question is settled instead of grinding through a plan
+                        // frozen before any observation. `nextHypothesis` returning
+                        // undefined is how the loop learns to stop — it enforces the hop
+                        // budget and reports when nothing is open.
+                        let researchState = createResearchState(request.question, branches.map((branch, position) => ({
+                            id: `h${position + 1}`,
+                            statement: branch.thought,
+                            priorConfidence: 1 - position / (branches.length + 1),
+                        })));
                         for (let index = 0; index < branches.length; index += 1) {
                             const step = branches[index];
                             if (request.signal?.aborted)
                                 rethrowIfCancelled(request.signal.reason, request.signal);
-                            const branchId = `${step.action.kind}:${step.action.target}`;
+                            // A hypothesis an earlier finding already closed is not
+                            // re-investigated, and an exhausted hop budget stops the run.
+                            const stillOpen = nextHypothesis(researchState);
+                            if (!stillOpen) {
+                                emit({
+                                    type: 'executor.started',
+                                    message: `Stopping early: ${researchState.hopsUsed} of ${branches.length} branches settled what could be settled.`,
+                                    route: 'research',
+                                });
+                                break;
+                            }
+                            const branchId = step.hypothesisId;
                             const branchQuestion = `${request.question}\nResearch branch ${index + 1} (${branchId}): ${step.expectation}`;
                             const childId = `${created.id}:research:${index + 1}`;
                             const child = storage.createRun({
@@ -3974,6 +4835,9 @@ export async function startLocalServer(opts) {
                                     rootPlanId: plan.rootPlanId,
                                     branch: {
                                         id: branchId,
+                                        hypothesisId: step.hypothesisId,
+                                        hypothesis: step.thought,
+                                        validatorKind: step.validatorKind,
                                         index: index + 1,
                                         expectation: step.expectation,
                                         action: step.action,
@@ -3998,7 +4862,15 @@ export async function startLocalServer(opts) {
                                         ...researchContextEnvelope,
                                         rootRunId: created.id,
                                         rootPlanId: plan.rootPlanId,
-                                        branch: { id: branchId, index: index + 1, expectation: step.expectation, action: step.action },
+                                        branch: {
+                                            id: branchId,
+                                            hypothesisId: step.hypothesisId,
+                                            hypothesis: step.thought,
+                                            validatorKind: step.validatorKind,
+                                            index: index + 1,
+                                            expectation: step.expectation,
+                                            action: step.action,
+                                        },
                                     },
                                     executionConnection: researchExecutionConnection,
                                     executionConnectionName: researchExecutionConnectionName,
@@ -4007,7 +4879,27 @@ export async function startLocalServer(opts) {
                                     baselineDqlArtifact: researchSource?.dqlArtifact,
                                     baselineRunId: agentRunString(researchSource?.runId),
                                 });
-                                researchRuns.push(withNotebookResearchChecklist(executed));
+                                const branchRun = withNotebookResearchChecklist(executed);
+                                researchRuns.push(branchRun);
+                                // Observe, then decide. A branch that produced rows is evidence
+                                // for its hypothesis; one that did not is inconclusive, which is
+                                // a real outcome and not a failure.
+                                // Rows are not support. A branch that returned data has been
+                                // OBSERVED, not confirmed — deciding whether the observation
+                                // matches what the hypothesis predicted needs the expectation,
+                                // and nothing available at this layer can judge it. Recording
+                                // rows as `supports` would let the dossier report a driver the
+                                // evidence never established, which is the failure mode the
+                                // whole verified-fact chain exists to prevent.
+                                researchState = applyFinding(researchState, {
+                                    id: `f${index + 1}`,
+                                    hypothesisId: `h${index + 1}`,
+                                    verdict: 'inconclusive',
+                                    summary: branchRun.summary ?? '',
+                                    strength: (branchRun.resultPreview?.rows?.length ?? 0) > 0
+                                        ? 0.5
+                                        : 0.1,
+                                });
                             }
                             catch (error) {
                                 // A child is a real durable run even when cancellation stops the
@@ -4023,6 +4915,13 @@ export async function startLocalServer(opts) {
                                 const stopped = storage.getRun(child.id);
                                 if (stopped)
                                     researchRuns.push(withNotebookResearchChecklist(stopped));
+                                researchState = applyFinding(researchState, {
+                                    id: `f${index + 1}`,
+                                    hypothesisId: `h${index + 1}`,
+                                    verdict: 'inconclusive',
+                                    summary: message,
+                                    strength: 0,
+                                });
                                 rethrowIfCancelled(error, request.signal);
                             }
                         }
@@ -4099,10 +4998,50 @@ export async function startLocalServer(opts) {
                     ? 'not_started'
                     : researchRuns.some((run) => run.status === 'error')
                         ? 'insufficient_evidence'
-                        : plan.steps.length > 6
+                        : executableResearchBranches.length > 6
                             ? 'budget'
                             : 'completed',
             });
+            // V2 carries a verdict per bounded hypothesis and makes a deliberately
+            // small investigation visible to the caller. A returned row is still
+            // only an observation: without a deterministic expectation validator it
+            // remains inconclusive rather than being promoted to causal support.
+            const researchLedgerV2 = buildResearchEvidenceLedgerV2({
+                rootQuestion: request.question,
+                planId: plan.rootPlanId,
+                snapshotId: routeDecision?.resolvedAnalyticalPlan?.snapshotId,
+                groundableBranchCount: typedResearchPlan.hypotheses.length,
+                entries: researchLedger.entries.map((entry, index) => ({
+                    ...entry,
+                    hypothesis: typedHypothesesById.get(entry.branchId)?.statement ?? plan.steps[index]?.thought,
+                    verdict: entry.status === 'failed'
+                        ? 'failed'
+                        : entry.status === 'skipped'
+                            ? 'skipped'
+                            : entry.rowCount === 0
+                                ? 'contradicted'
+                                : 'inconclusive',
+                    ...(entry.status === 'observed' && entry.resultFingerprint
+                        ? {
+                            validator: {
+                                version: 1,
+                                kind: typedHypothesesById.get(entry.branchId)?.validatorKind
+                                    ?? inferResearchValidatorKind(plan.steps[index]?.thought ?? '', plan.steps[index]?.expectation ?? ''),
+                                // This proves that the branch completed the deterministic
+                                // receipt-bound observation. It deliberately does not claim
+                                // the hypothesis was true: rows/correlation alone remain
+                                // inconclusive until a stronger domain-specific predicate is
+                                // supplied by a future validator.
+                                evaluated: true,
+                                ...(entry.rowCount === 0 ? { outcome: 'contradicts_observation' } : {}),
+                                receiptFingerprints: [entry.resultFingerprint],
+                            },
+                        }
+                        : {}),
+                    counterEvidenceFactIds: entry.rowCount === 0 ? entry.facts.slice(0, 1) : [],
+                })),
+                stoppingReason: researchLedger.stoppingReason,
+            });
             // A query that ran and matched 0 rows STILL executed — treat it as a clean,
             // grounded execution (not "no result"), so an empty answer is surfaced as
             // "0 rows matched" rather than silently downgraded to review-required.
@@ -4121,22 +5060,46 @@ export async function startLocalServer(opts) {
                     reviewRequired: true,
                 }, request.researchResultRowsOptIn === true)
                 : undefined;
+            // The cross-branch story. Every branch tested a hypothesis and produced a
+            // finding; narrating only the one result the executor happened to carry
+            // reported a single fact and discarded the rest, which is the visible
+            // half of "research answers one question instead of telling a story".
+            const researchStory = !needsClarification && researchLedgerV2.entries.length > 0
+                ? synthesizeResearchNarrative({
+                    question: request.question,
+                    branches: researchLedgerV2.entries.map((entry) => ({
+                        statement: entry.hypothesis ?? entry.question,
+                        produced: entry.status === 'observed',
+                        verdict: entry.verdict,
+                        counterEvidenceFactIds: entry.counterEvidenceFactIds,
+                        ...(entry.error ? { summary: entry.error } : {}),
+                        status: entry.status,
+                    })),
+                })
+                : undefined;
             const summary = needsClarification
                 ? 'Needs clarification before running deeper research.'
-                : narration?.summary
-                    ?? (researchZeroRows
-                        ? 'The query executed cleanly against real data and matched 0 rows.'
-                        : researchRun?.status === 'ready'
-                            ? 'Saved a grounded research dossier with context evidence and next review actions.'
-                            : researchRun?.status === 'error'
-                                ? 'Saved a research dossier, but the preview needs review before promotion.'
-                                : researchWorkspaceError
-                                    ? 'Prepared a grounded research plan; durable research storage is unavailable in this runtime.'
-                                    : plan.done
-                                        ? 'Prepared a direct grounded-answer plan.'
-                                        : 'Prepared a grounded research plan over real DQL assets.');
+                // The story leads; the verified-fact narration follows it, so the
+                // numbers still come from the narrator that checks them.
+                : researchStory
+                    ? `${researchStory}${narration?.summary ? `\n\n${narration.summary}` : ''}`
+                    : narration?.summary
+                        ?? (researchZeroRows
+                            ? 'The query executed cleanly against real data and matched 0 rows.'
+                            : researchRun?.status === 'ready'
+                                ? 'Saved a grounded research dossier with context evidence and next review actions.'
+                                : researchRun?.status === 'error'
+                                    ? 'Saved a research dossier, but the preview needs review before promotion.'
+                                    : researchWorkspaceError
+                                        ? 'Prepared a grounded research plan; durable research storage is unavailable in this runtime.'
+                                        : plan.done
+                                            ? 'Prepared a direct grounded-answer plan.'
+                                            : 'Prepared a grounded research plan over real DQL assets.');
+            const scopedSummary = !needsClarification && researchLedgerV2.limitedScope
+                ? `Limited research scope: fewer than three groundable branches were available. ${summary}`
+                : summary;
             return {
-                summary,
+                summary: scopedSummary,
                 answer: plan.followUp?.question ?? narration?.summary
                     ?? (researchZeroRows ? 'The query executed cleanly and matched 0 rows.' : undefined)
                     ?? researchRun?.summary,
@@ -4147,7 +5110,9 @@ export async function startLocalServer(opts) {
                     ? []
                     : [agentRunArtifact('research_run', 'Research plan', {
                             plan,
+                            typedResearchPlan,
                             researchLedger,
+                            researchLedgerV2,
                             researchRun,
                             researchRuns,
                             researchRunId: researchRun?.id,
@@ -4176,6 +5141,9 @@ export async function startLocalServer(opts) {
                             ? 'The query executed cleanly against real data and matched 0 rows.'
                             : 'The query executed cleanly against real data and returned rows.')
                         : 'No executed result was available; the output stays exploratory pending review.', { rowCount: Array.isArray(researchResultRecord?.rows) ? researchResultRecord.rows.length : 0 }),
+                    agentRunEvaluation('research-scope', 'Research scope', !researchLedgerV2.limitedScope, researchLedgerV2.limitedScope ? 'warning' : 'info', researchLedgerV2.limitedScope
+                        ? `Limited research scope: ${researchLedgerV2.groundableBranchCount} of at least 3 branches produced groundable evidence.`
+                        : `${researchLedgerV2.groundableBranchCount} groundable branches were retained with verdicts and counter-evidence slots.`, { groundableBranchCount: researchLedgerV2.groundableBranchCount, limitedScope: researchLedgerV2.limitedScope }),
                 ],
                 nextActions: needsClarification
                     ? [{ id: 'answer-follow-up', label: 'Answer follow-up', route: 'research' }]
@@ -4482,6 +5450,22 @@ export async function startLocalServer(opts) {
     // lookup, and governed execution for the lifetime of a request. This removes
     // both positional catalog truncation and the previous duplicate retrieval pass.
     const preparedAgentContextPacks = new WeakMap();
+    /**
+     * Cross-encoder pass over the fused candidates, when a provider is available.
+     * Advisory throughout: it may only reorder ids retrieval returned, and any
+     * failure leaves retrieval's own ordering in place.
+     */
+    const agentRerankCandidates = (() => {
+        const governed = resolveGovernedAnswerRunner(projectRoot);
+        const provider = governed
+            ? createGovernedTextProvider(governed.provider, projectRoot)
+            : undefined;
+        if (!provider)
+            return undefined;
+        return (question, candidates) => rerankCandidates(provider, question, candidates, {
+            timeoutMs: Math.round(2_500 * deadlineScale()),
+        });
+    })();
     const pendingAgentContextPacks = new WeakMap();
     const buildAgentRunContextPack = async (request) => {
         const prepared = preparedAgentContextPacks.get(request);
@@ -4549,6 +5533,10 @@ export async function startLocalServer(opts) {
             },
             strictness: request.analysisDepth === 'deep' ? 'exploratory' : 'balanced',
             limit: request.analysisDepth === 'deep' ? 120 : 80,
+            // The runtime PRE-BUILDS this pack, so wiring the reranker only at the
+            // provider's own `buildLocalContextPack` left it unreachable on the
+            // common path — the prepared pack is used and that call never happens.
+            ...(agentRerankCandidates ? { rerankCandidates: agentRerankCandidates } : {}),
             domainContext: requestedDomain
                 ? resolveUiDomainContext({
                     manifest: snapshot.manifest,
@@ -4593,7 +5581,74 @@ export async function startLocalServer(opts) {
             durationMs: Date.now() - startedAt,
             truncated: pack.retrievalDiagnostics.topRejected.length > 0,
         });
-        return applyContextPackCompatibility(evidence, pack, request.selectedEvidenceId);
+        // Preserve real snapshot/lane outcomes for the router receipt. These are
+        // not reconstructed later from candidate IDs: a source with no selected
+        // card can be empty, stale, errored, or intentionally skipped.
+        const sourceCoverage = [];
+        const fusionLanes = pack.retrievalDiagnostics.fusion?.lanes;
+        const retrievalLaneStates = Object.values(fusionLanes ?? {});
+        const retrievalErrored = retrievalLaneStates.length > 0
+            && retrievalLaneStates.every((item) => item.status === 'error');
+        const retrievalSkipped = retrievalLaneStates.length > 0
+            && retrievalLaneStates.every((item) => item.status === 'skipped');
+        const snapshotStale = /\bstale\b|out[- ]of[- ]date/i.test(pack.warnings.join(' '));
+        const coverageStatus = (hasCandidate) => {
+            if (snapshotStale)
+                return 'stale';
+            if (hasCandidate)
+                return 'available';
+            if (retrievalErrored)
+                return 'errored';
+            if (retrievalSkipped)
+                return 'skipped';
+            return 'empty';
+        };
+        const sourceDescriptors = [
+            { source: 'certified', matches: (candidate) => candidate.kind === 'certified_block' },
+            { source: 'semantic', matches: (candidate) => candidate.kind === 'semantic_metric' || candidate.kind === 'semantic_member' || candidate.trustTier === 'semantic' },
+            { source: 'governed_relational', matches: (candidate) => candidate.kind === 'dql_modeling' || (candidate.relationshipEvidence?.length ?? 0) > 0 },
+            { source: 'exploratory', matches: (candidate) => candidate.kind === 'dbt_model' || candidate.kind === 'dbt_source' || candidate.kind === 'sql_table' || candidate.kind === 'sql_column' },
+            { source: 'dbt_manifest', matches: (candidate) => candidate.kind === 'dbt_model' || candidate.kind === 'dbt_source' },
+            { source: 'runtime_schema', matches: (candidate) => candidate.kind === 'sql_table' || candidate.kind === 'sql_column' },
+        ];
+        // `compatible` is declared immediately below. Build IDs from the adapter
+        // output first, then retain them unchanged through compatibility filtering.
+        const compatible = applyContextPackCompatibility(evidence, pack, request.selectedEvidenceId);
+        for (const descriptor of sourceDescriptors) {
+            const ids = compatible.candidates
+                .filter(descriptor.matches)
+                .map((candidate) => candidate.qualifiedId ?? candidate.id)
+                .slice(0, 32);
+            sourceCoverage.push({
+                version: 1,
+                source: descriptor.source,
+                status: coverageStatus(ids.length > 0),
+                candidateIds: ids,
+                ...(snapshotStale ? { reason: 'The snapshot freshness warning marked this source stale.' } : {}),
+            });
+        }
+        const lane = pack.retrievalDiagnostics.fusion?.lanes?.vector;
+        if (lane) {
+            sourceCoverage.push({
+                version: 1,
+                source: 'vector',
+                status: lane.status === 'ok' ? 'available' : lane.status === 'error' ? 'errored' : lane.status === 'empty' ? 'empty' : 'skipped',
+                candidateIds: [],
+                ...(lane.error ? { reason: lane.error } : lane.skippedReason ? { reason: lane.skippedReason } : {}),
+            });
+        }
+        const hasConversation = Boolean(request.conversationContext && Object.keys(request.conversationContext).length > 0);
+        sourceCoverage.push({
+            version: 1,
+            source: 'conversation',
+            status: hasConversation ? 'available' : 'skipped',
+            candidateIds: [],
+            reason: hasConversation ? 'Persisted conversation context was supplied for this turn.' : 'No persisted conversation context was supplied for this turn.',
+        });
+        return {
+            ...compatible,
+            diagnostics: { ...compatible.diagnostics, sourceCoverage },
+        };
     };
     const buildRankedAgentRunCatalogContext = async (request) => {
         const evidence = await buildAgentRunEvidence(request);
@@ -4604,6 +5659,56 @@ export async function startLocalServer(opts) {
     };
     // Compact fallback used only for plain conversational replies. Analytical
     // turns use the structured, question-ranked evidence path above.
+    /**
+     * Explain a governed artifact the question names, from catalog metadata alone.
+     *
+     * Certified blocks are offered first: when a concept exists both as a
+     * certified block and a raw model, the certified one is the authored
+     * definition and the other is an implementation detail.
+     */
+    const buildGovernedObjectExplanation = (question) => {
+        try {
+            const blocks = collectPlanBlocks(projectRoot, { certifiedOnly: true });
+            const certifiedNames = new Set(blocks.map((block) => block.name));
+            const all = [
+                ...blocks.map((block) => ({ block, status: 'certified' })),
+                ...collectPlanBlocks(projectRoot, { certifiedOnly: false })
+                    .filter((block) => !certifiedNames.has(block.name))
+                    .map((block) => ({ block, status: 'draft' })),
+            ];
+            // Metrics as well as blocks. "How is revenue defined here?" names a
+            // semantic metric, not a block, and answering it from the metric's own
+            // description is the whole point of holding one.
+            const metricObjects = loadSemanticMetrics(projectRoot).map((metric) => ({
+                objectKey: `semantic:metric:${metric.name}`,
+                objectType: 'semantic_metric',
+                name: metric.name,
+                ...(metric.description ? { description: metric.description } : {}),
+                ...(metric.domain ? { domain: metric.domain } : {}),
+                status: 'governed',
+                payload: {},
+            }));
+            const explanation = composeBusinessExplanation(question, [
+                ...all.map(({ block, status }) => ({
+                    objectKey: `dql:block:${block.name}`,
+                    objectType: 'dql_block',
+                    name: block.name,
+                    ...(block.description ? { description: block.description } : {}),
+                    ...(block.domain ? { domain: block.domain } : {}),
+                    status,
+                    payload: {
+                        ...(block.dimensions?.length ? { dimensions: block.dimensions } : {}),
+                    },
+                })),
+                ...metricObjects,
+            ]);
+            return explanation?.text;
+        }
+        catch {
+            // Never let an explanation attempt break a conversational turn.
+            return undefined;
+        }
+    };
     const buildAgentRunCatalogContext = () => {
         try {
             const blocks = collectPlanBlocks(projectRoot, { certifiedOnly: true });
@@ -4912,6 +6017,16 @@ export async function startLocalServer(opts) {
             const semanticError = semanticCompose?.diagnostics.find((diagnostic) => diagnostic.severity === 'error')?.message;
             throw analyticalError(semanticError ?? `DQL artifact "${metadata.name ?? 'draft'}" produced no executable SQL.`, { origin: 'dql_compilation', stage: 'compile' });
         }
+        // A certified block is authored as DQL rather than warehouse-specific SQL.
+        // When its source uses an unqualified leaf relation, bind it only if the
+        // immutable context snapshot proves one unique physical relation.  Do not
+        // reuse broad exploratory repairs here: certified execution may not alter
+        // joins, aggregation, aliases, or any other frozen artifact semantics.
+        const compiledSql = semanticCompose?.sql ?? plan.sql;
+        const qualificationRepairs = [];
+        const executableSql = !semanticCompose?.sql && metadata.qualifiedSchemaContext?.length
+            ? qualifyUnambiguousSqlRelationsFromSchema(compiledSql, metadata.qualifiedSchemaContext, qualificationRepairs, activeConnection.driver)
+            : compiledSql;
         const app = loadRuntimeApp(projectRoot, activePersonaAppId());
         const sourceDomain = metadata.domain ?? source.match(/\bdomain\s*=\s*"([^"]+)"/i)?.[1];
         assertAppAccess({ app, domain: sourceDomain ?? app?.domain, level: 'execute' });
@@ -4920,7 +6035,7 @@ export async function startLocalServer(opts) {
             : undefined;
         const semanticExecutionHolder = { value: null };
         const execution = await analyticalExecutionService.execute({
-            sql: semanticCompose?.sql ?? plan.sql,
+            sql: executableSql,
             subject: 'DQL artifact query',
             connection: activeConnection,
             // Preserve the existing contract: previewed Ask artifacts are explicitly
@@ -4965,7 +6080,7 @@ export async function startLocalServer(opts) {
                 path: metadata.path ?? null,
                 domain: sourceDomain ?? null,
             })),
-            compiledSqlFingerprint: executionFingerprint(semanticCompose?.sql ?? plan?.sql ?? preparation.sourceSql),
+            compiledSqlFingerprint: executionFingerprint(executableSql ?? preparation.sourceSql),
             normalizedSqlFingerprint: executionFingerprint(preparation.decodedSql),
             parameterFingerprint: executionReceipt.parameterFingerprint,
             provenanceFingerprint: executionFingerprint(stableExecutionValue(invocation.resolvedParameters.map((parameter) => ({
@@ -4975,7 +6090,7 @@ export async function startLocalServer(opts) {
             targetFingerprint: targetGenerationFingerprint(activeConnection, executionConnectionName),
             snapshotFingerprint: executionFingerprint(projectSnapshot().snapshotId),
             planFingerprint: executionFingerprint(stableExecutionValue({
-                sqlFingerprint: executionFingerprint(semanticCompose?.sql ?? plan?.sql ?? preparation.sourceSql),
+                sqlFingerprint: executionFingerprint(executableSql ?? preparation.sourceSql),
                 parameterCount: plan?.sqlParams?.length ?? 0,
                 variableNames: Object.keys(plan?.variables ?? {}).sort(),
                 chartConfig: plan?.chartConfig ?? null,
@@ -5007,7 +6122,7 @@ export async function startLocalServer(opts) {
             } : {}),
         };
     };
-    const executeCertifiedBlockByNameForAgent = async (blockName, invocationInput, requireCertified = false, executionConnection, executionConnectionName) => {
+    const executeCertifiedBlockByNameForAgent = async (blockName, invocationInput, requireCertified = false, executionConnection, executionConnectionName, qualifiedSchemaContext) => {
         const manifest = buildManifest({ projectRoot });
         const block = manifest.blocks[blockName];
         if (!block) {
@@ -5022,6 +6137,7 @@ export async function startLocalServer(opts) {
             path: block.filePath,
             domain: block.domain,
             chartType: block.chartType,
+            ...(qualifiedSchemaContext?.length ? { qualifiedSchemaContext } : {}),
         }, invocationInput, executionConnection, executionConnectionName);
         return {
             ...result,
@@ -5044,11 +6160,11 @@ export async function startLocalServer(opts) {
             },
         };
     };
-    const executeCertifiedBlockForAgent = async (node, invocationInput, executionConnection, executionConnectionName) => {
+    const executeCertifiedBlockForAgent = async (node, invocationInput, executionConnection, executionConnectionName, qualifiedSchemaContext, requireCertified = false) => {
         if (node.kind !== 'block') {
             throw new Error(`Certified ${node.kind} "${node.name}" is a navigation artifact and cannot be executed as a block.`);
         }
-        return executeCertifiedBlockByNameForAgent(node.name || node.nodeId.replace(/^block:/, ''), invocationInput, false, executionConnection, executionConnectionName);
+        return executeCertifiedBlockByNameForAgent(node.name || node.nodeId.replace(/^block:/, ''), invocationInput, requireCertified, executionConnection, executionConnectionName, qualifiedSchemaContext);
     };
     // Secondary agent surfaces use this compatibility callback. Delegate to the
     // same artifact-first path as Ask so research/app/notebook execution cannot
@@ -5155,12 +6271,43 @@ export async function startLocalServer(opts) {
      * string, so the only remaining reasons to differ are the connection and the
      * governance gates, both of which report themselves honestly.
      */
-    const executeGeneratedSqlDirect = async (question, sql, seed, executionConnection, bindings, executionConnectionName) => {
+    const executeGeneratedSqlDirect = async (question, sql, seed, executionConnection, bindings, executionConnectionName, agenticCapability, agenticScope) => {
         const activeConnection = requireActiveConnection(executionConnection);
         const rowBound = clampAnalyticalRowBound(seed?.limit ?? 200);
         const trimmed = sql.trim().replace(/;\s*$/, '').trim();
         if (!trimmed)
             throw analyticalError('The generated SQL was empty.', { origin: 'host', stage: 'execute' });
+        const bindingValue = {
+            sqlParams: bindings?.sqlParams ?? [],
+            variables: bindings?.variables ?? {},
+        };
+        if (agenticCapability) {
+            // The proposal itself is immutable. A changed literal, comment, or
+            // whitespace is drift here rather than a benign formatting change.
+            const currentSnapshotId = projectSnapshot().snapshotId;
+            let targetFingerprint;
+            if (agenticCapability.targetFingerprint) {
+                try {
+                    targetFingerprint = (await observeWarehouseTargetIdentity(executor, activeConnection)).identityFingerprint;
+                }
+                catch {
+                    throw analyticalError('DQL could not re-confirm the selected execution target, so the analyst-approved query was not run.', {
+                        origin: 'governance_gate', stage: 'execute', code: 'unauthorized_sql',
+                    });
+                }
+            }
+            const capabilityVerdict = verifyAgenticSqlExecutionCapability(agenticCapability, sql, {
+                ...agenticScope,
+                bindings: bindingValue,
+                snapshotId: currentSnapshotId,
+                ...(targetFingerprint ? { targetFingerprint } : {}),
+            });
+            if (!capabilityVerdict.ok) {
+                throw analyticalError(capabilityVerdict.reason ?? 'The analyst-approved SQL no longer matches this execution.', {
+                    origin: 'governance_gate', stage: 'execute', code: 'unauthorized_sql',
+                });
+            }
+        }
         // RESOLVE FIRST, VALIDATE SECOND. Executing verbatim means executing the
         // statement the notebook would execute — and the notebook resolves
         // `@metric()` / `@dim()` refs and dbt macros before it runs anything.
@@ -5185,8 +6332,6 @@ export async function startLocalServer(opts) {
         // release denied; a governance boundary must not move as a side effect.
         const sourceDomain = seed?.source?.match(/\bdomain\s*=\s*"([^"]+)"/i)?.[1] ?? 'uncategorized';
         assertAppAccess({ app, domain: sourceDomain, level: 'execute' });
-        // A semantic query the loop already compiled (MetricFlow / dbt Cloud) must
-        // execute through its pinned target binding, not as loose SQL.
         const semanticExecutionHolder = { value: null };
         const execution = await analyticalExecutionService.execute({
             sql: semantic.sql,
@@ -5198,27 +6343,46 @@ export async function startLocalServer(opts) {
             variables: bindings?.variables,
             semanticRefs: semantic.semanticRefs,
             executePrepared: async (preparation) => {
-                const pinnedSemanticCompile = compiledSemanticQueries.get(executionFingerprint(preparation.preparedSql))
-                    ?? compiledSemanticQueries.get(executionFingerprint(trimmed));
-                if (pinnedSemanticCompile) {
-                    const semanticExecution = await executeTargetBoundSemanticQuery({
-                        executor,
-                        connection: activeConnection,
-                        projectRoot,
-                        plannedAdapter: pinnedSemanticCompile.engine,
-                        metricFlow: pinnedSemanticCompile.engine === 'metricflow-cli'
-                            ? resolveMetricFlowTargetMetadata(projectRoot, projectConfig)
-                            : undefined,
-                        compile: async () => pinnedSemanticCompile,
-                        prepareSql: () => ({ sql: preparation.executedSql, connection: preparation.connection }),
-                        rowBound,
-                    });
-                    if (semanticExecution) {
-                        semanticExecutionHolder.value = semanticExecution;
-                        return semanticExecution.result;
+                // Both the native executor and the target-bound semantic adapter can
+                // reach the warehouse from this callback. Admit the exact prepared
+                // bytes before either path so a matching cached semantic compile cannot
+                // bypass the generated proposal's capability.
+                return executePreparedAgenticSqlBoundary({
+                    capability: agenticCapability,
+                    preparedSql: preparation.executedSql,
+                    bindings: bindingValue,
+                    scope: {
+                        ...agenticScope,
+                        snapshotId: projectSnapshot().snapshotId,
+                        ...(agenticCapability ? { targetFingerprint: agenticCapability.targetFingerprint } : {}),
+                    },
+                    execute: async () => {
+                        // A semantic query the loop already compiled (MetricFlow / dbt
+                        // Cloud) must execute through its pinned target binding, not as
+                        // loose SQL.
+                        const pinnedSemanticCompile = compiledSemanticQueries.get(executionFingerprint(preparation.preparedSql))
+                            ?? compiledSemanticQueries.get(executionFingerprint(trimmed));
+                        if (pinnedSemanticCompile) {
+                            const semanticExecution = await executeTargetBoundSemanticQuery({
+                                executor,
+                                connection: activeConnection,
+                                projectRoot,
+                                plannedAdapter: pinnedSemanticCompile.engine,
+                                metricFlow: pinnedSemanticCompile.engine === 'metricflow-cli'
+                                    ? resolveMetricFlowTargetMetadata(projectRoot, projectConfig)
+                                    : undefined,
+                                compile: async () => pinnedSemanticCompile,
+                                prepareSql: () => ({ sql: preparation.executedSql, connection: preparation.connection }),
+                                rowBound,
+                            });
+                            if (semanticExecution) {
+                                semanticExecutionHolder.value = semanticExecution;
+                                return semanticExecution.result;
+                            }
+                        }
+                        return executor.executeQuery(preparation.executedSql, bindings?.sqlParams ?? [], runtimeVariables(bindings?.variables ?? {}), preparation.connection);
                     }
-                }
-                return executor.executeQuery(preparation.executedSql, bindings?.sqlParams ?? [], runtimeVariables(bindings?.variables ?? {}), preparation.connection);
+                });
             },
         });
         const semanticExecution = semanticExecutionHolder.value;
@@ -5276,14 +6440,19 @@ export async function startLocalServer(opts) {
             executableArtifact,
         };
     };
-    const executeGeneratedArtifactForAgent = async (question, sql, seed, executionConnection, executionConnectionName) => {
+    const executeGeneratedArtifactForAgent = async (question, sql, seed, executionConnection, executionConnectionName, agenticCapability, agenticScope) => {
         // A seed that is already a certified/saved artifact keeps the DQL-first
         // path: there the `.dql` source IS the contract, and its parameters and
         // semantic refs must be compiled, not bypassed.
         if (seed && seed.kind !== 'sql_block') {
+            if (agenticCapability) {
+                throw analyticalError('The analyst-approved SQL cannot be redirected through a saved artifact.', {
+                    origin: 'governance_gate', stage: 'execute', code: 'unauthorized_sql',
+                });
+            }
             return executeArtifactReferenceForAgent({ ...seed, limit: seed.limit ?? 200 }, question, executionConnection, executionConnectionName);
         }
-        return executeGeneratedSqlDirect(question, sql, seed, executionConnection, undefined, executionConnectionName);
+        return executeGeneratedSqlDirect(question, sql, seed, executionConnection, undefined, executionConnectionName, agenticCapability, agenticScope);
     };
     /**
      * EXP-001: execution host for the deliberately narrow non-governed lane.
@@ -5891,7 +7060,10 @@ export async function startLocalServer(opts) {
         let invocation;
         let plan;
         try {
-            const program = new Parser(repairedSource, '<bounded-dql-repair>').parse();
+            // The source label is echoed into parse errors, which reach the user.
+            // `<bounded-dql-repair>` is an internal artifact id and tells them nothing;
+            // it appeared verbatim in a reported failure card.
+            const program = new Parser(repairedSource, 'repaired query').parse();
             const blocks = program.statements.filter((statement) => statement.kind === NodeKind.BlockDecl);
             if (blocks.length !== 1 || program.statements.length !== 1) {
                 throw new Error('The repaired source must contain exactly one DQL block.');
@@ -9126,7 +10298,7 @@ export async function startLocalServer(opts) {
                     // state wins; the client-built context stays the no-threadId fallback).
                     const conversationStore = parsed.request.threadId ? getConversationStore() : null;
                     if (conversationStore && parsed.request.threadId && conversationStore.getThread(parsed.request.threadId)) {
-                        parsed.request.conversationContext = await conversationContextFromThread(conversationStore, parsed.request.threadId, parsed.request.conversationContext, parsed.request.question);
+                        parsed.request.conversationContext = await conversationContextFromThread(conversationStore, parsed.request.threadId, parsed.request.conversationContext, parsed.request.question, Boolean(parsed.request.selectedEvidenceId));
                         // The persisted thread is authoritative for prior turns. Raw client
                         // history would duplicate the same conversation into the prompt a
                         // second time — dropping it keeps follow-up prompts bounded.
@@ -9134,10 +10306,13 @@ export async function startLocalServer(opts) {
                             parsed.request.history = [];
                     }
                     const wantsStream = url.searchParams.get('stream') === '1' || url.searchParams.get('stream') === 'true';
-                    const runId = parsed.request.runId;
+                    // The public body may carry UI correlation data, but the run identity
+                    // is server-owned. Mint it before every controller/SSE/engine handoff
+                    // so no client-provided string can bind a SQL capability or operation.
+                    const runId = randomUUID();
+                    parsed.request.runId = runId;
                     const runController = new AbortController();
-                    if (runId)
-                        activeAgentRunControllers.set(runId, runController);
+                    activeAgentRunControllers.set(runId, runController);
                     let streamConnected = true;
                     res.on('close', () => { streamConnected = false; });
                     const writeStream = (event, data) => {
@@ -9158,13 +10333,13 @@ export async function startLocalServer(opts) {
                             'X-Accel-Buffering': 'no',
                         });
                     }
-                    const operation = runId ? operationCoordinator.create({
+                    const operation = operationCoordinator.create({
                         type: 'agent_run',
                         scope: `agent-run:${runId}`,
                         resourceRevision: parsed.request.threadId,
                         message: 'AI request accepted. You can change pages while it runs.',
                         cancellable: true,
-                    }) : null;
+                    });
                     if (wantsStream)
                         writeStream('agent-run-accepted', { runId, operationId: operation?.id });
                     let completedRun;
@@ -9256,8 +10431,7 @@ export async function startLocalServer(opts) {
                         res.end(serializeJSON({ run: slimAgentRunForTransport(completedRun) }));
                     }
                     finally {
-                        if (runId)
-                            activeAgentRunControllers.delete(runId);
+                        activeAgentRunControllers.delete(runId);
                     }
                 }
                 catch (error) {
@@ -18001,6 +19175,16 @@ export function resolveDefaultLLMProvider(projectRoot) {
  * answer envelope. Everything else uses the Settings-resolved default runner.
  */
 export function resolveGovernedAnswerRunner(projectRoot) {
+    // Runtime eval cassettes are an explicit, offline provider source. Resolve
+    // them before Settings because the CI fixture intentionally has no user
+    // provider configuration; otherwise Ask exits at this earlier gate and never
+    // reaches the cassette-wrapped provider used by the answer loop.
+    const cassetteProvider = createEvalCassetteReplayProvider(projectRoot);
+    if (cassetteProvider) {
+        const provider = governedRunnerProviderForCassette(cassetteProvider.name);
+        if (provider)
+            return { provider, runner: createDqlAgentProviderRunner(provider, cassetteProvider) };
+    }
     const active = getActiveProvider(projectRoot);
     if (isGovernedAnswerProviderId(active)) {
         return { provider: active, runner: createDqlAgentProviderRunner(active) };
@@ -18013,6 +19197,14 @@ export function resolveGovernedAnswerRunner(projectRoot) {
     }
     return null;
 }
+function governedRunnerProviderForCassette(name) {
+    switch (name) {
+        case 'claude': return 'anthropic';
+        case 'openai': return 'openai';
+        case 'gemini': return 'gemini';
+        case 'ollama': return 'ollama';
+    }
+}
 function isGovernedAnswerProviderId(value) {
     return value === 'anthropic'
         || value === 'openai'
@@ -21580,7 +22772,7 @@ export function buildAgentPreviewSql(sql, rowLimit = 200) {
  */
 export function repairExploratorySqlBeforeExecution(sql, schemaContext, question = '', dialect = 'duckdb') {
     const repairs = [];
-    let repairedSql = qualifyExploratoryRelationsFromSchema(sql, schemaContext, repairs, dialect);
+    let repairedSql = qualifyUnambiguousSqlRelationsFromSchema(sql, schemaContext, repairs, dialect);
     repairedSql = repairExploratoryRelationQualifiers(repairedSql, repairs, dialect);
     repairedSql = repairExploratoryLifetimeMeasureSelection(repairedSql, schemaContext, question, repairs, dialect);
     repairedSql = repairExploratoryMisleadingPercentAliases(repairedSql, question, repairs);
@@ -21639,7 +22831,13 @@ export function applyRequestedTopNToExploratorySql(sql, requestedTopN) {
     }
     return `${withoutTerminator}\nLIMIT ${requestedTopN}`;
 }
-function qualifyExploratoryRelationsFromSchema(sql, schemaContext, repairs, dialect = 'duckdb') {
+/**
+ * Bind an already-authored unqualified relation to a unique inspected physical
+ * relation.  The caller owns whether that binding is permitted (exploratory
+ * preflight or a frozen certified artifact); this helper itself never adds a
+ * relation, key, join, predicate, or column.
+ */
+export function qualifyUnambiguousSqlRelationsFromSchema(sql, schemaContext, repairs, dialect = 'duckdb') {
     const analysis = analyzeSqlReferences(sql, dialect);
     if (!analysis.parsed)
         return sql;
@@ -25778,6 +26976,14 @@ async function buildBlockStudioAiAssistSummary(projectRoot, action, candidate, v
     }
 }
 async function createBlockStudioAssistProvider(projectRoot, requestedProvider) {
+    // Runtime-driven evals intentionally start from a clean fixture with no user
+    // provider settings. When replay cassettes are explicitly enabled, their
+    // recorded identity is the authoritative provider and never performs network
+    // readiness checks. Normal product startup has no cassette env and follows
+    // the unchanged configured-provider path below.
+    const cassetteProvider = createEvalCassetteReplayProvider(projectRoot);
+    if (cassetteProvider)
+        return cassetteProvider;
     const settings = listProviderSettings(projectRoot);
     const activeProvider = getActiveProvider(projectRoot);
     // Subscription CLI providers (Claude Code / Codex) carry no API key — they're
@@ -25821,7 +27027,13 @@ async function createBlockStudioAssistProvider(projectRoot, requestedProvider) {
         default:
             return null;
     }
-    return await provider.available() ? provider : null;
+    // Route through the eval cassette too. This constructor serves the MEANING
+    // call and narration — the two dispatches that decide routing and wording —
+    // so leaving it unwrapped meant a recorded suite still hit a live model for
+    // exactly the calls whose non-determinism it was recorded to remove. A local
+    // baseline reproduced that: the same question blocked on one run and answered
+    // on the next, and zero cassettes were written.
+    return await provider.available() ? applyEvalCassette(provider, projectRoot) : null;
 }
 /** Convert a governed answer's result payload into a bounded synthesis preview. */
 function agentResultToSynthesisPreview(result) {
@@ -28658,7 +29870,45 @@ async function buildAgentSchemaContextFromCatalog(projectRoot, question, prepare
 const RUNTIME_SNAPSHOT_MAX_AGE_MS = 60 * 60 * 1000; // 1 hour
 // A resolver compares at most 12 compact cards and never performs tool calls;
 // ten seconds is the full allowance, not the start of another planning loop.
-const AGENT_MEANING_TIMEOUT_MS = 10_000;
+/**
+ * Ceiling on the one bounded meaning-resolution call.
+ *
+ * 10s assumes a hosted model. A local Ollama model needs ~7s for a ONE-WORD
+ * reply, so a 600-token resolution over a dozen candidates never lands: it
+ * aborts, the router falls back to its evidence-only decision, and
+ * `mayAssumeInterpretation` goes false — which sends every ambiguous question to
+ * the clarification gate (AGT-017). The effect is that a local model cannot
+ * answer anything ambiguous, in a product whose whole positioning is local-first.
+ *
+ * Scaled by the same `DQL_AGENT_DEADLINE_SCALE` as the run budget, so one
+ * setting moves the provider's whole time envelope together rather than leaving
+ * an inner bound to silently cap an outer one.
+ */
+/**
+ * Predict how long the next provider call will take, for admission control.
+ *
+ * With fewer than three samples the MAX is the only honest predictor: there is
+ * no distribution yet, and admitting a call the deadline then kills wastes the
+ * whole remaining budget.
+ *
+ * With a real sample, p75 rather than the max. One slow response — a cold model
+ * load, a retried connection — otherwise poisons admission control for the rest
+ * of the run: every later call is refused against a worst case that already
+ * passed. A recorded run tripped RUN_DEADLINE_INSUFFICIENT 6.4s into a 45s
+ * budget for exactly that reason. p75 still errs slow, so a genuinely slow
+ * provider is still respected.
+ */
+export function predictDispatchMs(observed, assumedMs = ASSUMED_PROVIDER_DISPATCH_MS) {
+    if (observed.length === 0)
+        return assumedMs;
+    const sorted = [...observed].sort((left, right) => left - right);
+    if (sorted.length < 3)
+        return sorted[sorted.length - 1];
+    const index = Math.max(0, Math.min(sorted.length - 1, Math.ceil(sorted.length * 0.75) - 1));
+    return sorted[index];
+}
+const AGENT_MEANING_TIMEOUT_BASE_MS = 10_000;
+const AGENT_MEANING_TIMEOUT_MS = AGENT_MEANING_TIMEOUT_BASE_MS * deadlineScale();
 export function boundedAgentMeaningSignal(signal, timeoutMs = AGENT_MEANING_TIMEOUT_MS) {
     const timeout = AbortSignal.timeout(Math.max(1, timeoutMs));
     return signal ? AbortSignal.any([signal, timeout]) : timeout;
@@ -29410,7 +30660,7 @@ function compactSqlForRunHistory(sql) {
     const clean = sql.replace(/\s+/g, ' ').trim();
     return clean.length > 1200 ? `${clean.slice(0, 1197)}...` : clean;
 }
-function buildAgentSchemaContextFromContextPack(question, contextPack) {
+function buildAgentSchemaContextFromContextPack(question, contextPack, options = {}) {
     const byRelation = new Map();
     const objectsByKey = new Map(contextPack.objects.map((object) => [object.objectKey, object]));
     const upsert = (table) => {
@@ -29464,11 +30714,75 @@ function buildAgentSchemaContextFromContextPack(question, contextPack) {
         table,
         score: scoreAgentSchemaTable(table, tokens) + (shouldProbeValues ? scoreAgentValueProbeTable(table) : 0),
     }))
-        .filter((entry) => entry.table.columns.length > 0 && entry.score > 0)
+        .filter((entry) => entry.table.columns.length > 0 && (options.includeUnscored || entry.score > 0))
         .sort((a, b) => b.score - a.score || a.table.relation.localeCompare(b.table.relation))
-        .slice(0, 12)
+        .slice(0, Math.max(1, options.limit ?? 12))
         .map((entry) => entry.table);
 }
+/**
+ * Exact frozen certified execution needs the physical relation closure from
+ * the same source snapshot, not only the twelve tables that happened to rank
+ * for the natural-language prompt.  An artifact may project `category` while
+ * its authored SQL says `FROM order_items`, so prompt relevance alone is not
+ * a safe authority to remove that relation from the execution handoff.
+ *
+ * This remains deliberately narrower than an exploratory repair: it exposes
+ * only snapshot-indexed dbt models plus the already retrieved local objects.
+ * `qualifyUnambiguousSqlRelationsFromSchema` still changes a leaf only when
+ * exactly one physical relation in that closure owns it.  Duplicate leaves
+ * therefore remain a same-tier certified failure rather than a guessed bind.
+ */
+function buildFrozenCertifiedSchemaContext(contextPack, manifest) {
+    const byRelation = new Map();
+    const upsert = (table) => {
+        if (!table.relation || !table.name)
+            return;
+        const key = table.relation.toLowerCase();
+        const existing = byRelation.get(key);
+        if (!existing) {
+            byRelation.set(key, {
+                ...table,
+                columns: dedupeAgentSchemaColumns(table.columns).slice(0, 80),
+            });
+            return;
+        }
+        byRelation.set(key, {
+            ...existing,
+            description: existing.description ?? table.description,
+            source: existing.source === table.source ? existing.source : 'local metadata catalog',
+            columns: dedupeAgentSchemaColumns([...existing.columns, ...table.columns]).slice(0, 80),
+        });
+    };
+    if (contextPack) {
+        for (const object of contextPack.objects) {
+            const table = metadataObjectToAgentSchemaTable(object);
+            if (table)
+                upsert(table);
+        }
+    }
+    for (const model of manifest.dbtImport?.dbtDag?.models ?? []) {
+        const relation = [model.database, model.schema, model.name].filter(Boolean).join('.');
+        // A bare dbt identity does not prove a physical catalog/schema and must
+        // not be promoted into a qualifier. It remains harmless context only.
+        if (!relation || relation === model.name)
+            continue;
+        upsert({
+            relation,
+            schema: model.schema,
+            name: model.name,
+            description: model.description,
+            columns: (model.columns ?? []).map((column) => ({
+                name: column.name,
+                type: column.type,
+                description: column.description,
+            })),
+            source: 'local metadata catalog',
+        });
+    }
+    return Array.from(byRelation.values())
+        .filter((table) => table.columns.length > 0)
+        .sort((left, right) => left.relation.localeCompare(right.relation));
+}
 function metadataObjectToAgentSchemaTable(object) {
     if (object.objectType === 'dbt_column' || object.objectType === 'runtime_column') {
         const relation = metadataPayloadString(object, 'relation');
@@ -30043,49 +31357,9 @@ function scoreAgentValueProbeColumn(table, column) {
     return score;
 }
 export function isAgentValueProbeColumn(column) {
-    const name = column.name.toLowerCase();
-    // Tokenize underscore/camel names before applying the hard deny-list. This is
-    // intentionally independent of an allowlist: secrets and free-text payloads
-    // can never be probed through automatic grounding.
-    const normalizedName = column.name
-        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
-        .replace(/[_-]+/g, ' ')
-        .toLowerCase();
-    if (/\b(password|secret|token|credential|hash|salt|notes?|comments?|description|message|body|payload|content)\b/.test(normalizedName))
-        return false;
-    if (/\bemail\b/.test(normalizedName))
-        return false;
-    if (!hasAgentSchemaToken(name, [
-        'account',
-        'category',
-        'channel',
-        'city',
-        'code',
-        'country',
-        'customer',
-        'email',
-        'full',
-        'id',
-        'key',
-        'member',
-        'name',
-        'number',
-        'product',
-        'region',
-        'segment',
-        'sku',
-        'state',
-        'status',
-        'subscriber',
-        'type',
-        'user',
-    ])) {
-        return false;
-    }
-    const type = column.type?.toLowerCase() ?? '';
-    if (!type)
-        return true;
-    return /\b(char|character|clob|email|string|text|uuid|varchar)\b/.test(type);
+    // Delegates to the canonical predicate in dql-agent. Two copies of a security
+    // rule drift, and the one that drifts is the one nobody is looking at.
+    return isProbeSafeColumn({ name: column.name, ...(column.type ? { type: column.type } : {}) });
 }
 export function buildAgentValueProbeSql(table, column, searchTerms, connection) {
     const relation = quoteAgentRelation(table.relation, connection);