@evo-dev/core 0.0.1-alpha.2 → 0.0.1-alpha.20

package/src/{knowledge → evolution/knowledge}/index.ts

@@ -2,13 +2,54 @@ import { createHash } from "node:crypto";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { resolveEvoDevPaths } from "../config/paths.ts";
+import { resolveEvoDevPaths } from "../../config/paths.ts";
+import { readRuntimeInjectionSettings } from "../../config/settings.ts";
 import {
-  type EvolutionDistillationBatch,
-  type EvolutionEvosCase,
-  type EvolutionKnowledgeRecord,
-  listEvolutionEvosCases,
-} from "../evolution/index.ts";
+  canonicalizeProjectKey,
+  listEquivalentProjectKeys,
+  listProjectAliases,
+} from "../../projects/index.ts";
+import { createStableId, normalizeTimestamp } from "../../utils/index.ts";
+import { listEvolutionEvosCases } from "../candidates/index.ts";
+import {
+  detectSessionMemorySensitivity,
+  redactSessionMemoryCredentialText,
+  redactSessionMemoryCredentials,
+} from "../evidence/session-memory/sensitivity.ts";
+import type {
+  EvolutionDistillationBatch,
+  EvolutionEvosCase,
+  EvolutionKnowledgeRecord,
+} from "../schema.ts";
+import { REVIEW_STATES } from "../shared.ts";
+import {
+  type OkfKnowledgeChangeCandidateV1,
+  createOkfKnowledgeChangeCandidate,
+  readOkfKnowledgeChangeCandidate,
+  writeOkfKnowledgeChangeCandidate,
+} from "./change-store.ts";
+import {
+  type OkfKnowledgeChangeClassificationResult,
+  classifyOkfKnowledgeCandidate,
+  createOkfKnowledgeRevision,
+  createOkfKnowledgeRuntimeProjectionFromConcept,
+} from "./changes.ts";
+import {
+  type OkfKnowledgeFreshness,
+  type OkfKnowledgeVerificationSnapshotV1,
+  createOkfKnowledgeVerificationSnapshot,
+  deriveOkfKnowledgeFreshness,
+} from "./freshness.ts";
+import { type OkfKnowledgeSupportRef, isDirectKnowledgeSupport } from "./support.ts";
+
+export type {
+  OkfKnowledgeDelivery,
+  OkfKnowledgeRuntimeEligibility,
+  OkfKnowledgeSourceStatus,
+  OkfKnowledgeSupportKind,
+  OkfKnowledgeSupportRef,
+} from "./support.ts";
+export { resolveOkfKnowledgeRuntimeEligibility } from "./support.ts";
 
 export type OkfKnowledgeDecision =
   | "auto-accept"
@@ -16,7 +57,8 @@ export type OkfKnowledgeDecision =
   | "create"
   | "update"
   | "skip"
-  | "needs-human";
+  | "needs-human"
+  | "revoke";
 export type OkfKnowledgeTargetStore = "okf" | "repo-asset-proposal" | "evo-eval-set" | "none";
 export type OkfKnowledgeReviewState =
   | "auto-accepted"
@@ -64,7 +106,7 @@ export interface OkfKnowledgePrivacyCheck {
   sourceDumpsStored: false;
   rawCommandOutputStored: false;
   secretsStored: false;
-  internalLinksStored: false;
+  internalLinksStored: boolean;
 }
 
 export interface OkfKnowledgeOverlayUpdate {
@@ -128,6 +170,7 @@ export interface OkfKnowledgePlanCandidate {
   scores: OkfKnowledgeCandidateScores;
   decisionReason: string;
   evidenceRefs: string[];
+  supportRef?: OkfKnowledgeSupportRef;
   reviewState: OkfKnowledgeReviewState;
   verificationNotApplicableReason?: string;
   evalSetRefs?: string[];
@@ -209,6 +252,7 @@ export interface OkfKnowledgeActivationResult {
   overlayPaths: string[];
   skippedCandidates: string[];
   needsHumanCandidates: string[];
+  pendingChangeIds: string[];
   indexPaths: string[];
   derivedIndexPaths: string[];
   logPaths: string[];
@@ -220,6 +264,23 @@ export interface OkfKnowledgeLifecycleMutationResult {
   indexPaths: string[];
 }
 
+export interface LegacyGeneratedKnowledgeCleanupPreview {
+  generatedAt: string;
+  conceptPaths: string[];
+  evosCasePaths: string[];
+  overlayPathsToQuarantine: string[];
+  overlayPathsToRewrite: string[];
+  totalArtifacts: number;
+}
+
+export interface LegacyGeneratedKnowledgeCleanupResult
+  extends LegacyGeneratedKnowledgeCleanupPreview {
+  quarantineDir: string | null;
+  manifestPath: string | null;
+  okfIndexPaths: string[];
+  evosIndexPath: string | null;
+}
+
 export interface OkfKnowledgeConcept {
   id: string;
   path: string;
@@ -229,6 +290,8 @@ export interface OkfKnowledgeConcept {
   reviewState: OkfKnowledgeReviewState;
   lifecycle: OkfKnowledgeLifecycle;
   lifecyclePersisted: boolean;
+  verificationSnapshot: OkfKnowledgeVerificationSnapshotV1 | null;
+  supportRef: OkfKnowledgeSupportRef | null;
   title: string;
   description: string;
   tags: string[];
@@ -265,6 +328,8 @@ export interface OkfKnowledgeContextItem {
   score?: number;
   title: string;
   summary: string;
+  freshness: OkfKnowledgeFreshness;
+  runtimeExcerpt: string | null;
   matchReasons: string[];
 }
 
@@ -308,6 +373,20 @@ export interface ScopedKnowledgeContextPackItem {
   section: OkfKnowledgeContextSection;
   rank: number;
   title: string;
+  freshness: OkfKnowledgeFreshness;
+  loader:
+    | {
+        kind: "knowledge-show";
+        conceptId: string;
+      }
+    | {
+        kind: "none";
+        conceptId: null;
+      };
+  delivery: {
+    mode: "inline" | "reference";
+    excerpt: string | null;
+  };
   matchReasons: string[];
 }
 
@@ -324,13 +403,13 @@ export interface ScopedKnowledgeContextPack {
   id: string;
   okfIndexRevision: string;
   scope: ScopedKnowledgeContextPackScope;
-  queryText?: string;
+  queryHash?: string;
   items: ScopedKnowledgeContextPackItem[];
   warnings: string[];
   rawContentStored: false;
 }
 
-export type ContextInjectionTrigger = "team-startup" | "hook-safe-point";
+export type ContextInjectionTrigger = "team-startup" | "hook-safe-point" | "ordinary-session";
 
 export interface ContextInjectionReceipt {
   version: 1;
@@ -338,9 +417,17 @@ export interface ContextInjectionReceipt {
   okfIndexRevision: string;
   scope: ScopedKnowledgeContextPackScope;
   itemIds: string[];
+  queryHash: string | null;
   injectedAt: string;
   hookEventId: string | null;
   trigger: ContextInjectionTrigger;
+  outcome: null | {
+    status: "verified";
+    eventId: string;
+    observedAt: string;
+    summaryHash: string;
+    rawContentStored: false;
+  };
   rawContentStored: false;
 }
 
@@ -353,6 +440,7 @@ interface OkfPaths {
 
 interface KnowledgeQueryScope {
   projectKey?: string;
+  projectKeys?: string[];
   roleId?: string;
   workflowId?: string;
   paths: string[];
@@ -386,6 +474,7 @@ export interface OkfActiveKnowledgeIndex {
     roleTags: string[];
     workflowTags: string[];
     targetPath: string;
+    semanticFingerprint: string;
   }>;
 }
 
@@ -401,12 +490,6 @@ export interface OkfKnowledgePlanContext {
 }
 
 const RESERVED_OKF_FILENAMES = new Set(["index.md", "log.md"]);
-const FORBIDDEN_OKF_TEXT =
-  /\b(secret|token|password|passwd|api[_-]?key|apikey|credential|credentials|secret[\s_-]*token(?:[\s_-]*repro)?|raw[\s_-]*(?:log|logs|output|source|prompt)(?:[\s_-]*repro)?|shell[\s_-]*history|command[\s_-]*history)\b/i;
-const FORBIDDEN_OKF_FIELD =
-  /^\s*(?:commandHistory|commandOutput|credential|credentials|env|memoryBody|password|privateKey|prompt|promptBody|promptText|rawCommand|rawCommandOutput|rawLog|rawLogs|rawOutput|rawPayload|rawPrompt|secret|secretValue|sourceBody|sourceCode|sourceContent|sourceText|stderr|stdout|token|transcript|transcriptBody|transcriptText)\s*:/im;
-const PRIVATE_OR_INTERNAL_URL =
-  /https?:\/\/\S*(?:internal|private|corp|localhost|127\.0\.0\.1)\S*/i;
 const HUMAN_REVIEW_DOMAIN_PATTERN =
   /(^|[^a-z0-9])(?:security|privacy|release|architecture|cross[\s_-]*(?:repo|repository)|model[\s_-]*reflection|reflection[\s_-]*based)([^a-z0-9]|$)/i;
 const OKF_PRIVACY_FLAG_KEYS = [
@@ -418,7 +501,11 @@ const OKF_PRIVACY_FLAG_KEYS = [
   "internalLinksStored",
 ] as const;
 const OKF_QUERY_PRIVACY_FLAG_KEYS = [
-  ...OKF_PRIVACY_FLAG_KEYS,
+  "rawPromptsStored",
+  "rawLogsStored",
+  "sourceDumpsStored",
+  "rawCommandOutputStored",
+  "secretsStored",
   "rawOutputStored",
   "sourceContentStored",
 ] as const;
@@ -449,6 +536,7 @@ const OKF_DECISIONS: readonly OkfKnowledgeDecision[] = [
   "update",
   "skip",
   "needs-human",
+  "revoke",
 ];
 const ACTIVE_OKF_DECISIONS: readonly OkfKnowledgeDecision[] = ["auto-accept", "create", "update"];
 const BEHAVIOR_CHANGE_KINDS = new Set([
@@ -579,6 +667,69 @@ export function createOkfKnowledgePlanFromDistillationBatch(
   };
 }
 
+/**
+ * Re-scores a curator/model-produced plan against the local evidence and active OKF index. Model
+ * scores and active decisions are advisory only; this function owns the automatic-write decision.
+ */
+export function finalizeCuratedKnowledgePlan(input: {
+  homeDir: string;
+  plan: OkfKnowledgePlan;
+  evidenceWindow: EvolutionDistillationBatch["evidenceWindow"];
+}): OkfKnowledgePlan {
+  if (
+    input.plan.projectKey !== input.evidenceWindow.projectKey ||
+    input.plan.runId !== input.evidenceWindow.runId ||
+    input.plan.evidenceWindowId !== input.evidenceWindow.id
+  ) {
+    throw new Error("Curated knowledge plan identity does not match its evidence window.");
+  }
+  const batch: EvolutionDistillationBatch = {
+    schemaVersion: 1,
+    id: createStableId("batch", [input.evidenceWindow.id, input.plan.createdAt, "curation"]),
+    projectKey: input.evidenceWindow.projectKey,
+    runId: input.evidenceWindow.runId,
+    createdAt: input.plan.createdAt,
+    evidenceWindow: input.evidenceWindow,
+    knowledgeRecords: [],
+    evosCases: [],
+    repoProposals: [],
+    warnings: [],
+  };
+  const context: OkfKnowledgePlanContext = {
+    batch,
+    activeIndex: loadActiveOkfKnowledgeIndex({ homeDir: input.homeDir }),
+  };
+  const candidates = input.plan.candidates.map((candidate) => {
+    if (candidate.decision === "no_write" || candidate.decision === "skip") return candidate;
+    if (candidate.decision === "needs-human" || candidate.decision === "revoke") return candidate;
+    return decideOkfKnowledgeCandidate(
+      {
+        ...candidate,
+        decision: "create",
+        reviewState: "auto-stored/unreviewed",
+      },
+      context,
+    );
+  });
+  const conflicts = candidates.flatMap((candidate) =>
+    /conflict|duplicate/i.test(candidate.decisionReason)
+      ? [{ candidateId: candidate.id, reason: candidate.decisionReason }]
+      : [],
+  );
+  const finalized = {
+    ...input.plan,
+    summary:
+      candidates.filter((candidate) => ACTIVE_OKF_DECISIONS.includes(candidate.decision)).length ===
+      0
+        ? "No reusable OKF knowledge candidate passed local activation gates."
+        : input.plan.summary,
+    candidates,
+    conflicts,
+  };
+  assertOkfKnowledgePlanContract(finalized, { homeDir: input.homeDir });
+  return finalized;
+}
+
 function attachGeneratedEvalSetsForBehaviorChanges(
   candidates: OkfKnowledgePlanCandidate[],
   batch: EvolutionDistillationBatch,
@@ -673,13 +824,15 @@ export function parseKnowledgeDistillationOutput(
     conflicts: normalizeConflicts(output.conflicts ?? []),
     privacyCheck: normalizePrivacyCheck(output.privacyCheck, "privacyCheck"),
   };
+  plan.privacyCheck.internalLinksStored =
+    detectSessionMemorySensitivity(plan).reasons.includes("url");
   assertOkfKnowledgePlanContract(plan, { homeDir: options.homeDir });
   return plan;
 }
 
 export function validateOkfKnowledgePlanContract(
   plan: OkfKnowledgePlan,
-  _options: { homeDir?: string } = {},
+  options: { homeDir?: string; allowReviewedHighRisk?: boolean } = {},
 ): OkfKnowledgePlanValidationResult {
   const findings: OkfKnowledgePlanValidationFinding[] = [];
   const add = (
@@ -731,7 +884,9 @@ export function validateOkfKnowledgePlanContract(
     add("candidates", "plan.candidates", "Plan candidates must be an array.");
   } else {
     plan.candidates.forEach((candidate, index) =>
-      validateCandidateContract(candidate, `candidates[${index}]`, evalSetIds, add),
+      validateCandidateContract(candidate, `candidates[${index}]`, evalSetIds, add, {
+        allowReviewedHighRisk: options.allowReviewedHighRisk === true,
+      }),
     );
   }
 
@@ -783,7 +938,7 @@ export function validateOkfKnowledgePlanContract(
 
 export function assertOkfKnowledgePlanContract(
   plan: OkfKnowledgePlan,
-  options: { homeDir?: string } = {},
+  options: { homeDir?: string; allowReviewedHighRisk?: boolean } = {},
 ): void {
   const result = validateOkfKnowledgePlanContract(plan, options);
   if (!result.ok) {
@@ -828,6 +983,10 @@ function normalizePlanCandidate(value: unknown, path: string): OkfKnowledgePlanC
       readRequiredString(input.decisionReason, `${path}.decisionReason`),
     ),
     evidenceRefs: readStringArray(input.evidenceRefs, `${path}.evidenceRefs`).map(sanitizeOkfText),
+    supportRef:
+      input.supportRef === undefined
+        ? undefined
+        : normalizeKnowledgeSupportRef(input.supportRef, `${path}.supportRef`),
     reviewState: parseOkfReviewState(readRequiredString(input.reviewState, `${path}.reviewState`)),
     verificationNotApplicableReason:
       typeof input.verificationNotApplicableReason === "string"
@@ -844,6 +1003,8 @@ function normalizePlanCandidate(value: unknown, path: string): OkfKnowledgePlanC
     bodySections: normalizeBodySections(input.bodySections, `${path}.bodySections`),
     privacyCheck: normalizePrivacyCheck(input.privacyCheck, `${path}.privacyCheck`),
   };
+  candidate.privacyCheck.internalLinksStored =
+    detectSessionMemorySensitivity(candidate).reasons.includes("url");
   return candidate;
 }
 
@@ -852,6 +1013,7 @@ function validateCandidateContract(
   path: string,
   evalSetIds: Set<string>,
   add: (path: string, code: string, message: string, severity?: "error" | "warning") => void,
+  options: { allowReviewedHighRisk: boolean },
 ): void {
   if (!isRecord(candidate)) {
     add(path, "candidate.object", "Candidate must be an object.");
@@ -909,6 +1071,7 @@ function validateCandidateContract(
   validateStringArrayValue(candidate.pathScopes, `${path}.pathScopes`, add);
   validateStringArrayValue(candidate.relatedConceptLinks, `${path}.relatedConceptLinks`, add);
   validateStringArrayValue(candidate.evidenceRefs, `${path}.evidenceRefs`, add);
+  validateKnowledgeSupportRefValue(candidate.supportRef, `${path}.supportRef`, add);
   validateOverlayUpdatesValue(candidate.overlayUpdates, `${path}.overlayUpdates`, add);
   validateScoresValue(candidate.scores, `${path}.scores`, add);
   validatePrivacyCheckValue(candidate.privacyCheck, `${path}.privacyCheck`, add);
@@ -939,7 +1102,7 @@ function validateCandidateContract(
         "Active writes require metadata-only evidence.",
       );
     }
-    if (hasHighRiskHumanReviewSignal(candidate)) {
+    if (hasHighRiskHumanReviewSignal(candidate) && !options.allowReviewedHighRisk) {
       add(
         path,
         "candidate.active.highRiskHumanReview",
@@ -998,6 +1161,47 @@ function validateCandidateContract(
       );
     }
   }
+  if (decision === "revoke") {
+    if (candidate.targetStore !== "okf") {
+      add(
+        `${path}.targetStore`,
+        "candidate.revoke.targetStore",
+        "Knowledge revocation must target OKF.",
+      );
+    }
+    if (candidate.reviewState !== "needs-human") {
+      add(
+        `${path}.reviewState`,
+        "candidate.revoke.reviewState",
+        "Knowledge revocation must enter human review.",
+      );
+    }
+    if (candidate.metadataOnlyEvidence !== true) {
+      add(
+        `${path}.metadataOnlyEvidence`,
+        "candidate.revoke.metadataOnlyEvidence",
+        "Knowledge revocation requires metadata-only evidence.",
+      );
+    }
+    if (!Array.isArray(candidate.evidenceRefs) || candidate.evidenceRefs.length === 0) {
+      add(
+        `${path}.evidenceRefs`,
+        "candidate.revoke.evidenceRefs",
+        "Knowledge revocation requires evidenceRefs.",
+      );
+    }
+    const verification =
+      isRecord(candidate.bodySections) && Array.isArray(candidate.bodySections.verification)
+        ? candidate.bodySections.verification
+        : [];
+    if (verification.length === 0 && !isNonEmptyString(candidate.verificationNotApplicableReason)) {
+      add(
+        `${path}.bodySections.verification`,
+        "candidate.revoke.verification",
+        "Knowledge revocation requires verification or an explicit not-applicable reason.",
+      );
+    }
+  }
   if (noOp && (!isNonEmptyString(candidate.id) || !isNonEmptyString(candidate.decisionReason))) {
     add(path, "candidate.noop.metadata", "No-op candidates require safe skip metadata.");
   }
@@ -1142,7 +1346,7 @@ function normalizePrivacyCheck(value: unknown, path: string): OkfKnowledgePrivac
       `${path}.rawCommandOutputStored`,
     ),
     secretsStored: readRequiredFalse(input.secretsStored, `${path}.secretsStored`),
-    internalLinksStored: readRequiredFalse(
+    internalLinksStored: readRequiredBoolean(
       input.internalLinksStored,
       `${path}.internalLinksStored`,
     ),
@@ -1202,6 +1406,33 @@ function normalizeBasis(value: string): "direct" | "inferred" {
   return value;
 }
 
+function normalizeKnowledgeSupportRef(value: unknown, path: string): OkfKnowledgeSupportRef {
+  const input = assertRecordValue(value, path) as Record<string, unknown>;
+  const kind = readRequiredString(input.kind, `${path}.kind`);
+  if (
+    kind !== "user-declaration" &&
+    kind !== "repo-policy" &&
+    kind !== "state-observation" &&
+    kind !== "verified-outcome" &&
+    kind !== "semantic-inference"
+  ) {
+    throw new Error(`${path}.kind is invalid.`);
+  }
+  const observedAt = readRequiredString(input.observedAt, `${path}.observedAt`);
+  if (!Number.isFinite(Date.parse(observedAt))) throw new Error(`${path}.observedAt is invalid.`);
+  const subjectFingerprint =
+    input.subjectFingerprint === null
+      ? null
+      : sanitizeOkfText(readRequiredString(input.subjectFingerprint, `${path}.subjectFingerprint`));
+  return {
+    id: sanitizeOkfText(readRequiredString(input.id, `${path}.id`)),
+    kind,
+    sourceRefId: sanitizeOkfText(readRequiredString(input.sourceRefId, `${path}.sourceRefId`)),
+    subjectFingerprint,
+    observedAt: new Date(observedAt).toISOString(),
+  };
+}
+
 function normalizeEvalSetDecision(value: string): OkfKnowledgeEvalSet["decision"] {
   const normalized = value === "no-write" ? "no_write" : value;
   if (
@@ -1371,6 +1602,45 @@ function validateStringArrayValue(
   });
 }
 
+function validateKnowledgeSupportRefValue(
+  value: unknown,
+  path: string,
+  add: (path: string, code: string, message: string, severity?: "error" | "warning") => void,
+): void {
+  if (value === undefined) return;
+  if (!isRecord(value)) {
+    add(path, "supportRef.object", "Candidate supportRef must be an object.");
+    return;
+  }
+  if (!isNonEmptyString(value.id)) add(`${path}.id`, "supportRef.id", "supportRef id is required.");
+  if (
+    value.kind !== "user-declaration" &&
+    value.kind !== "repo-policy" &&
+    value.kind !== "state-observation" &&
+    value.kind !== "verified-outcome" &&
+    value.kind !== "semantic-inference"
+  ) {
+    add(`${path}.kind`, "supportRef.kind", "supportRef kind is invalid.");
+  }
+  if (!isNonEmptyString(value.sourceRefId)) {
+    add(`${path}.sourceRefId`, "supportRef.sourceRefId", "supportRef sourceRefId is required.");
+  }
+  if (value.subjectFingerprint !== null && !isNonEmptyString(value.subjectFingerprint)) {
+    add(
+      `${path}.subjectFingerprint`,
+      "supportRef.subjectFingerprint",
+      "supportRef subjectFingerprint must be null or a non-empty string.",
+    );
+  }
+  if (!isNonEmptyString(value.observedAt) || !Number.isFinite(Date.parse(value.observedAt))) {
+    add(
+      `${path}.observedAt`,
+      "supportRef.observedAt",
+      "supportRef observedAt must be an ISO timestamp.",
+    );
+  }
+}
+
 function validateOverlayUpdatesValue(
   value: unknown,
   path: string,
@@ -1428,8 +1698,15 @@ function validatePrivacyCheckValue(
     return;
   }
   for (const key of OKF_PRIVACY_FLAG_KEYS) {
-    if (value[key] !== false)
+    if (key === "internalLinksStored") {
+      if (typeof value[key] !== "boolean") {
+        add(`${path}.${key}`, "privacy.boolean", "internalLinksStored must be boolean.");
+      }
+      continue;
+    }
+    if (value[key] !== false) {
       add(`${path}.${key}`, "privacy.false", "Privacy fields must be false.");
+    }
   }
 }
 
@@ -1518,6 +1795,9 @@ export function loadActiveOkfKnowledgeIndex(input: { homeDir: string }): OkfActi
       roleTags: parsed.roleTags,
       workflowTags: parsed.workflowTags,
       targetPath: parsed.sourceLink.replace(/^\//u, ""),
+      semanticFingerprint: createSemanticFingerprint(
+        `${parsed.title} ${parsed.description} ${extractSummarySection(parsed.body)}`,
+      ),
     });
   }
   return {
@@ -1532,9 +1812,8 @@ export function findCandidateConflictOrDuplicate(
   const targetPath = candidate.targetPath.replace(/^\/+/u, "");
   const duplicate = index.concepts.find(
     (concept) =>
-      concept.stableKey === candidate.stableKey ||
-      concept.targetPath === targetPath ||
-      concept.sourceLink === `/${targetPath}`,
+      concept.stableKey !== candidate.stableKey &&
+      (concept.targetPath === targetPath || concept.sourceLink === `/${targetPath}`),
   );
   if (duplicate !== undefined) {
     return {
@@ -1544,6 +1823,24 @@ export function findCandidateConflictOrDuplicate(
     };
   }
 
+  const candidateFingerprint = createSemanticFingerprint(
+    `${candidate.title} ${candidate.description} ${candidate.claim}`,
+  );
+  const semanticDuplicate = index.concepts.find(
+    (concept) =>
+      concept.stableKey !== candidate.stableKey &&
+      candidateFingerprint !== "" &&
+      candidateFingerprint === concept.semanticFingerprint &&
+      scopesOverlap(candidate.repoTags, concept.repoTags),
+  );
+  if (semanticDuplicate !== undefined) {
+    return {
+      kind: "duplicate",
+      conceptId: semanticDuplicate.id,
+      reason: `Duplicate active OKF concept ${semanticDuplicate.id} already covers the same normalized claim.`,
+    };
+  }
+
   const candidateTitle = normalizeComparableText(candidate.title);
   const conflict = index.concepts.find((concept) => {
     if (normalizeComparableText(concept.title) !== candidateTitle) return false;
@@ -1574,8 +1871,14 @@ export function scoreOkfKnowledgeCandidate(
     ) &&
     context.batch.evidenceWindow.events.every((event) => event.rawContentStored === false);
   const privacyRisk = hasUnsafeCandidateContent(candidate) ? 5 : metadataOnly ? 1 : 3;
+  const semanticShape = hasReusableSemanticShape(candidate);
+  const ephemeralIdentity = hasEphemeralKnowledgeIdentity(candidate);
   const evidenceStrength =
-    candidate.basis === "direct" && candidate.confidence === "high" && metadataOnly
+    candidate.basis === "direct" &&
+    candidate.confidence === "high" &&
+    metadataOnly &&
+    candidate.evidenceRefs.length > 0 &&
+    semanticShape
       ? hasVerification
         ? 5
         : 4
@@ -1583,20 +1886,31 @@ export function scoreOkfKnowledgeCandidate(
         ? 3
         : 2;
   const actionability =
-    candidate.howToApply.trim() !== "" &&
-    candidate.bodySections.guidance.some((item) => item.trim() !== "")
+    semanticShape &&
+    candidate.howToApply.trim().length >= 16 &&
+    candidate.bodySections.appliesWhen.some((item) => item.trim().length >= 8) &&
+    candidate.bodySections.guidance.some((item) => item.trim().length >= 16)
       ? 4
       : 2;
   const reuseValue =
-    candidate.kind === "evos-case" || candidate.roleTags.length > 0 || candidate.repoTags.length > 0
+    semanticShape &&
+    !ephemeralIdentity &&
+    (candidate.roleTags.length > 0 || candidate.repoTags.length > 0)
       ? 4
-      : 3;
+      : 2;
   const stability = /hard policy|hard rule|must always|never allow/i.test(
     `${candidate.claim} ${candidate.howToApply}`,
   )
     ? 2
     : 4;
-  const duplicationRisk = conflict === null ? 1 : conflict.kind === "duplicate" ? 5 : 4;
+  const duplicationRisk =
+    ephemeralIdentity || isLegacyTemplateKnowledge(candidate)
+      ? 5
+      : conflict === null
+        ? 1
+        : conflict.kind === "duplicate"
+          ? 5
+          : 4;
   return {
     evidenceStrength,
     reuseValue,
@@ -1628,10 +1942,14 @@ export function decideOkfKnowledgeCandidate(
     hasHighRiskHumanReviewSignal(candidate) || hasHighRiskHumanReviewSignal(sanitized);
   const autoAcceptEligible =
     !highRiskRequiresHuman &&
+    !isLegacyTemplateKnowledge(sanitized) &&
+    !hasEphemeralKnowledgeIdentity(sanitized) &&
+    hasReusableSemanticShape(sanitized) &&
     conflict === null &&
     localActiveTarget &&
     sanitized.targetStore === "okf" &&
     sanitized.basis === "direct" &&
+    isDirectKnowledgeSupport(sanitized.supportRef) &&
     sanitized.metadataOnlyEvidence &&
     hasVerification &&
     hasScopeTags &&
@@ -1653,13 +1971,34 @@ export function decideOkfKnowledgeCandidate(
     };
   }
 
+  if (isLegacyTemplateKnowledge(sanitized) || hasEphemeralKnowledgeIdentity(sanitized)) {
+    return {
+      ...sanitized,
+      decision: "no_write",
+      scores,
+      reviewState: "auto-stored/unreviewed",
+      decisionReason:
+        "No write: run-local metadata templates and ephemeral identifiers are not reusable knowledge.",
+    };
+  }
+
   if (highRiskRequiresHuman) {
+    const reviewEligible =
+      !originalUnsafe &&
+      hasReusableSemanticShape(sanitized) &&
+      localActiveTarget &&
+      sanitized.metadataOnlyEvidence &&
+      hasVerification &&
+      hasScopeTags &&
+      scores.privacyRisk <= 2;
     return {
       ...sanitized,
-      decision: "needs-human",
+      decision: reviewEligible ? "needs-human" : "no_write",
       scores,
-      reviewState: "needs-human",
-      decisionReason: "Needs human review: high-risk domain requires review.",
+      reviewState: reviewEligible ? "needs-human" : "auto-stored/unreviewed",
+      decisionReason: reviewEligible
+        ? "Needs human review: the candidate changes a sensitive engineering domain."
+        : "No write: high-risk knowledge did not pass the privacy, verification, or scope gates.",
     };
   }
 
@@ -1677,12 +2016,12 @@ export function decideOkfKnowledgeCandidate(
   if (reusable) {
     return {
       ...sanitized,
-      decision: "needs-human",
+      decision: "no_write",
       scores,
-      reviewState: "needs-human",
+      reviewState: "auto-stored/unreviewed",
       decisionReason:
         conflict?.reason ??
-        explainNeedsHumanDecision(sanitized, scores, hasVerification, hasScopeTags),
+        explainAutomaticNoWriteDecision(sanitized, scores, hasVerification, hasScopeTags),
     };
   }
 
@@ -1695,19 +2034,103 @@ export function decideOkfKnowledgeCandidate(
   };
 }
 
+async function readAuthorizedReviewedKnowledgeChange(input: {
+  homeDir: string;
+  plan: OkfKnowledgePlan;
+  changeId: string;
+}): Promise<OkfKnowledgeChangeCandidateV1> {
+  const { change } = await readOkfKnowledgeChangeCandidate({
+    homeDir: input.homeDir,
+    changeId: input.changeId,
+  });
+  if (change.state !== "accepted" || change.decision?.state !== "accepted") {
+    throw new Error("Reviewed knowledge change must be accepted before activation.");
+  }
+  if (change.operation === "revoke") {
+    throw new Error("Reviewed knowledge revocation must use the lifecycle decision path.");
+  }
+  if (
+    input.plan.projectKey !== change.projectKey ||
+    input.plan.runId !== change.runId ||
+    input.plan.evidenceWindowId !== change.provenance.evidenceWindowId
+  ) {
+    throw new Error("Reviewed knowledge change identity does not match the activation plan.");
+  }
+  if (input.plan.candidates.length !== 1) {
+    throw new Error("Reviewed knowledge activation must contain exactly one candidate.");
+  }
+  const candidate = input.plan.candidates[0] as OkfKnowledgePlanCandidate;
+  const expectedCandidate: OkfKnowledgePlanCandidate = {
+    ...change.candidate.planCandidate,
+    decision: change.operation === "update" ? "update" : "create",
+    reviewState: "accepted",
+    targetPath:
+      change.operation === "update" && change.base !== null
+        ? change.base.sourceLink.replace(/^\/+/u, "")
+        : change.targetPath,
+  };
+  if (stableJsonStringify(candidate) !== stableJsonStringify(expectedCandidate)) {
+    throw new Error("Reviewed knowledge candidate does not match the accepted change.");
+  }
+  if (
+    stableJsonStringify(input.plan.evoEvalSets) !== stableJsonStringify(change.candidate.evalSets)
+  ) {
+    throw new Error("Reviewed knowledge eval sets do not match the accepted change.");
+  }
+  const expectedEvidenceRefs = change.provenance.evidenceRefs.map((id) => ({
+    id,
+    kind: "knowledge-change-evidence",
+    source: `knowledge-change:${change.id}`,
+    rawContentStored: false,
+    externalContentCopied: false,
+  }));
+  if (
+    stableJsonStringify(input.plan.evidenceRefs) !== stableJsonStringify(expectedEvidenceRefs) ||
+    stableJsonStringify(input.plan.privacyCheck) !==
+      stableJsonStringify(expectedCandidate.privacyCheck)
+  ) {
+    throw new Error("Reviewed knowledge provenance does not match the accepted change.");
+  }
+  return change;
+}
+
+function assertReviewedKnowledgeClassification(
+  change: OkfKnowledgeChangeCandidateV1,
+  classification: OkfKnowledgeChangeClassificationResult,
+): void {
+  if (
+    classification.classification !== change.operation ||
+    classification.baseRevision !== (change.base?.revision ?? null) ||
+    classification.candidateRevision !== change.candidate.revision
+  ) {
+    throw new Error("Reviewed knowledge classification changed before activation.");
+  }
+}
+
 export async function activateOkfKnowledgePlan(input: {
   homeDir: string;
   plan: OkfKnowledgePlan;
   overwrite?: boolean;
   evidenceWindowPath?: string | null;
+  reviewedChangeId?: string;
 }): Promise<OkfKnowledgeActivationResult> {
-  const validation = validateOkfKnowledgePlanContract(input.plan);
   const projectKey =
     isRecord(input.plan) && isNonEmptyString(input.plan.projectKey)
       ? input.plan.projectKey
       : "unknown";
   const runId =
     isRecord(input.plan) && isNonEmptyString(input.plan.runId) ? input.plan.runId : "unknown";
+  const reviewedChange =
+    input.reviewedChangeId === undefined
+      ? null
+      : await readAuthorizedReviewedKnowledgeChange({
+          homeDir: input.homeDir,
+          plan: input.plan,
+          changeId: input.reviewedChangeId,
+        });
+  const validation = validateOkfKnowledgePlanContract(input.plan, {
+    allowReviewedHighRisk: reviewedChange !== null,
+  });
   if (!validation.ok) {
     await writeFailedOkfKnowledgePlanArtifact({
       homeDir: input.homeDir,
@@ -1720,7 +2143,7 @@ export async function activateOkfKnowledgePlan(input: {
     });
     throw new Error("OKF knowledge plan contract validation failed.");
   }
-  validateOkfKnowledgePlan(input.plan);
+  validateOkfKnowledgePlan(input.plan, { allowReviewedHighRisk: reviewedChange !== null });
   const paths = resolveOkfKnowledgePaths(input.homeDir);
   const tmpRunDir = join(paths.tmpDir, `${input.plan.projectKey}-${input.plan.runId}`);
   const planPath = join(tmpRunDir, "knowledge-plan.json");
@@ -1737,35 +2160,149 @@ export async function activateOkfKnowledgePlan(input: {
   const overlayPaths: string[] = [];
   const skippedCandidates: string[] = [];
   const needsHumanCandidates: string[] = [];
+  const pendingChangeIds: string[] = [];
   const affectedDirectories = new Set<string>([paths.okfDir]);
 
   try {
+    const settings = await readRuntimeInjectionSettings(input.homeDir);
+    const existingConcepts = await listOkfKnowledgeConcepts({ homeDir: input.homeDir });
+    const existingByStableKey = new Map(
+      existingConcepts
+        .filter(
+          (concept) =>
+            isActiveOkfReviewState(concept.reviewState) && concept.lifecycle.status === "active",
+        )
+        .map((concept) => [concept.stableKey, concept]),
+    );
+    const writeCandidates: OkfKnowledgePlanCandidate[] = [];
+    const existingByCandidateId = new Map<string, OkfKnowledgeConcept>();
     for (const candidate of input.plan.candidates) {
       if (candidate.decision === "no_write" || candidate.decision === "skip") {
         skippedCandidates.push(candidate.id);
         continue;
       }
-      if (candidate.decision === "needs-human") {
-        await writeNeedsHumanKnowledgeCandidate({
-          homeDir: input.homeDir,
-          plan: input.plan,
+      if (candidate.targetStore !== "okf") {
+        skippedCandidates.push(candidate.id);
+        continue;
+      }
+      const existing = existingByStableKey.get(candidate.stableKey) ?? null;
+      const classification = classifyOkfKnowledgeCandidate({
+        candidate,
+        existingConcept: existing,
+      });
+      if (reviewedChange !== null) {
+        assertReviewedKnowledgeClassification(reviewedChange, classification);
+      }
+      const needsReview =
+        reviewedChange === null &&
+        (candidate.decision === "needs-human" ||
+          classification.classification === "revoke" ||
+          classification.classification === "supersede" ||
+          (classification.classification === "update" && settings.reviewKnowledgeUpdates));
+      if (needsReview) {
+        const operation =
+          classification.classification === "supersede" ||
+          classification.classification === "revoke"
+            ? classification.classification
+            : existing === null
+              ? "create"
+              : "update";
+        const beforeFreshness =
+          existing === null ? null : deriveOkfKnowledgeFreshness({ concept: existing }).freshness;
+        const verificationSnapshot = createOkfKnowledgeVerificationSnapshot({
           candidate,
+          verifiedAt: input.plan.createdAt,
+          projectKey: input.plan.projectKey,
+        });
+        const change = createOkfKnowledgeChangeCandidate({
+          projectKey: input.plan.projectKey,
+          runId: input.plan.runId,
+          operation,
+          stableKey: candidate.stableKey,
+          targetPath: candidate.targetPath,
+          base:
+            existing === null || classification.baseProjection === null
+              ? null
+              : {
+                  conceptId: existing.id,
+                  sourceLink: existing.sourceLink,
+                  revision:
+                    classification.baseRevision ??
+                    createOkfKnowledgeRevision(
+                      createOkfKnowledgeRuntimeProjectionFromConcept(existing),
+                    ),
+                  runtimeProjection: classification.baseProjection,
+                },
+          candidateRevision: classification.candidateRevision,
+          planCandidate: candidate,
+          evalSets: input.plan.evoEvalSets.filter((evalSet) =>
+            (candidate.evalSetRefs ?? []).includes(evalSet.id),
+          ),
+          diff: classification.diff,
+          freshness: {
+            before: beforeFreshness,
+            after:
+              classification.classification === "revoke"
+                ? "stale"
+                : verificationSnapshot === null
+                  ? "unknown"
+                  : "verified",
+            reason:
+              candidate.decision === "needs-human" || candidate.decision === "revoke"
+                ? candidate.decisionReason
+                : classification.reason,
+          },
+          evidenceWindowId: input.plan.evidenceWindowId,
+          evidenceRefs: candidate.evidenceRefs,
+          createdAt: input.plan.createdAt,
         });
-        needsHumanCandidates.push(candidate.id);
+        await writeOkfKnowledgeChangeCandidate({ homeDir: input.homeDir, change });
+        pendingChangeIds.push(change.id);
+        if (candidate.decision === "needs-human" || candidate.decision === "revoke") {
+          needsHumanCandidates.push(candidate.id);
+        }
         continue;
       }
-      if (candidate.targetStore !== "okf") {
+      if (classification.classification === "no_write") {
         skippedCandidates.push(candidate.id);
         continue;
       }
-
-      const targetPath = resolveOkfTargetPath(paths.okfDir, candidate.targetPath);
-      const exists = await pathExists(targetPath);
+      if (classification.classification === "supersede") {
+        writeCandidates.push({
+          ...candidate,
+          decision: "create",
+          reviewState: "accepted",
+        });
+        continue;
+      }
+      if (classification.classification === "revoke") {
+        throw new Error("Knowledge revocation must be applied through its reviewed change.");
+      }
       if (
-        exists &&
-        input.overwrite !== true &&
-        (candidate.decision === "create" || candidate.decision === "auto-accept")
+        classification.classification === "update" ||
+        classification.classification === "refresh"
       ) {
+        if (existing === null) {
+          throw new Error(`Knowledge ${classification.classification} requires an active concept.`);
+        }
+        const effectiveCandidate: OkfKnowledgePlanCandidate = {
+          ...candidate,
+          decision: "update",
+          targetPath: existing.sourceLink.replace(/^\/+/u, ""),
+          reviewState: candidate.reviewState === "auto-accepted" ? "auto-accepted" : "accepted",
+        };
+        writeCandidates.push(effectiveCandidate);
+        existingByCandidateId.set(effectiveCandidate.id, existing);
+        continue;
+      }
+      writeCandidates.push(candidate);
+    }
+
+    const targetStates = await preflightOkfConceptTargets(paths.okfDir, writeCandidates);
+    for (const candidate of writeCandidates) {
+      const targetPath = resolveOkfTargetPath(paths.okfDir, candidate.targetPath);
+      const targetState = targetStates.get(targetPath);
+      if (targetState?.action === "skip-existing") {
         skippedCandidates.push(candidate.id);
         await appendOkfLog(
           paths.okfDir,
@@ -1775,7 +2312,11 @@ export async function activateOkfKnowledgePlan(input: {
       }
 
       await mkdir(dirname(targetPath), { recursive: true });
-      await writeFile(targetPath, renderOkfConcept(candidate, input.plan), "utf8");
+      await writeFile(
+        targetPath,
+        renderOkfConcept(candidate, input.plan, existingByCandidateId.get(candidate.id)),
+        "utf8",
+      );
       conceptPaths.push(targetPath);
       affectedDirectories.add(dirname(targetPath));
 
@@ -1816,6 +2357,7 @@ export async function activateOkfKnowledgePlan(input: {
       overlayPaths,
       skippedCandidates,
       needsHumanCandidates,
+      pendingChangeIds,
       indexPaths,
       derivedIndexPaths,
       logPaths,
@@ -1847,6 +2389,68 @@ export async function activateOkfKnowledgePlan(input: {
   }
 }
 
+async function preflightOkfConceptTargets(
+  okfDir: string,
+  candidates: OkfKnowledgePlanCandidate[],
+): Promise<Map<string, { action: "write" | "skip-existing" }>> {
+  const targets = new Map<string, { action: "write" | "skip-existing"; candidateId: string }>();
+  for (const candidate of candidates) {
+    if (
+      candidate.targetStore !== "okf" ||
+      candidate.decision === "no_write" ||
+      candidate.decision === "skip" ||
+      candidate.decision === "needs-human"
+    ) {
+      continue;
+    }
+    const targetPath = resolveOkfTargetPath(okfDir, candidate.targetPath);
+    const sibling = targets.get(targetPath);
+    if (sibling !== undefined) {
+      throw new Error(
+        `OKF candidates ${sibling.candidateId} and ${candidate.id} resolve to the same concept path.`,
+      );
+    }
+
+    if (!(await pathExists(targetPath))) {
+      if (candidate.decision === "update") {
+        throw new Error(`OKF update target does not exist: ${candidate.targetPath}`);
+      }
+      targets.set(targetPath, { action: "write", candidateId: candidate.id });
+      continue;
+    }
+
+    const existing = parseOkfConceptFile(okfDir, targetPath, await readFile(targetPath, "utf8"));
+    if (existing === null) {
+      throw new Error(
+        `OKF concept target is occupied by an unrecognized file: ${candidate.targetPath}`,
+      );
+    }
+    if (existing.stableKey !== candidate.stableKey) {
+      throw new Error(
+        `OKF concept target ${candidate.targetPath} belongs to stable key ${existing.stableKey}; refusing overwrite from ${candidate.stableKey}.`,
+      );
+    }
+    if (
+      existing.lifecycle.status === "deprecated" ||
+      existing.lifecycle.status === "revoked" ||
+      existing.lifecycle.status === "superseded" ||
+      existing.reviewState === "deprecated" ||
+      existing.reviewState === "revoked" ||
+      existing.reviewState === "superseded" ||
+      existing.reviewState === "rejected"
+    ) {
+      throw new Error(
+        `OKF concept target ${candidate.targetPath} retains inactive lifecycle history and cannot be overwritten.`,
+      );
+    }
+    targets.set(targetPath, {
+      action: candidate.decision === "update" ? "write" : "skip-existing",
+      candidateId: candidate.id,
+    });
+  }
+  return new Map([...targets.entries()].map(([path, state]) => [path, { action: state.action }]));
+}
+
 export async function readFailedOkfKnowledgePlan(input: {
   homeDir: string;
   projectKey: string;
@@ -2028,6 +2632,134 @@ export async function rebuildOkfKnowledgeIndexes(input: { homeDir: string }): Pr
   return pathsWritten;
 }
 
+/**
+ * Finds only the run-local templates emitted by EvoDev's pre-semantic distiller. The preview is
+ * intentionally exact and read-only so user-authored knowledge is never selected by resemblance.
+ */
+export async function previewLegacyGeneratedKnowledgeCleanup(input: {
+  homeDir: string;
+  now?: string | Date;
+}): Promise<LegacyGeneratedKnowledgeCleanupPreview> {
+  return toLegacyCleanupPreview(
+    await createLegacyGeneratedKnowledgeCleanupPlan(input.homeDir, normalizeTimestamp(input.now)),
+  );
+}
+
+/**
+ * Moves legacy generated templates into local state instead of deleting them. A manifest and the
+ * original bytes are retained under state/evolution/knowledge-quarantine for recovery.
+ */
+export async function quarantineLegacyGeneratedKnowledge(input: {
+  homeDir: string;
+  now?: string | Date;
+}): Promise<LegacyGeneratedKnowledgeCleanupResult> {
+  const generatedAt = normalizeTimestamp(input.now);
+  const evoDevPaths = resolveEvoDevPaths(input.homeDir);
+  const processLockPath = join(evoDevPaths.stateDir, "evolution", ".process.lock");
+  await mkdir(dirname(processLockPath), { recursive: true });
+  try {
+    await writeFile(
+      processLockPath,
+      `${JSON.stringify({ version: 1, kind: "knowledge-cleanup", acquiredAt: generatedAt, pid: process.pid })}\n`,
+      { encoding: "utf8", flag: "wx" },
+    );
+  } catch (error) {
+    if (isAlreadyExistsError(error)) {
+      throw new Error("Evolution processing is active; legacy knowledge cleanup was not started.");
+    }
+    throw error;
+  }
+
+  try {
+    const plan = await createLegacyGeneratedKnowledgeCleanupPlan(input.homeDir, generatedAt);
+    const preview = toLegacyCleanupPreview(plan);
+    if (preview.totalArtifacts === 0) {
+      return {
+        ...preview,
+        quarantineDir: null,
+        manifestPath: null,
+        okfIndexPaths: [],
+        evosIndexPath: null,
+      };
+    }
+
+    const quarantineDir = join(
+      evoDevPaths.stateDir,
+      "evolution",
+      "knowledge-quarantine",
+      generatedAt.replace(/[:.]/gu, "-"),
+    );
+    if (await pathExists(quarantineDir)) {
+      throw new Error(`Knowledge quarantine already exists: ${quarantineDir}`);
+    }
+    const manifestPath = join(quarantineDir, "manifest.json");
+    const manifestItems = [
+      ...plan.concepts.map((artifact) => createLegacyCleanupManifestItem(artifact, quarantineDir)),
+      ...plan.evosCases.map((artifact) => createLegacyCleanupManifestItem(artifact, quarantineDir)),
+      ...plan.overlaysToQuarantine.map((artifact) =>
+        createLegacyCleanupManifestItem(artifact, quarantineDir),
+      ),
+      ...plan.overlaysToRewrite.map((artifact) =>
+        createLegacyCleanupManifestItem(artifact, quarantineDir),
+      ),
+    ];
+    const manifestBase = {
+      schemaVersion: 1,
+      kind: "legacy-generated-knowledge-quarantine",
+      createdAt: generatedAt,
+      rootDir: evoDevPaths.rootDir,
+      items: manifestItems,
+    } as const;
+    await writeJson(
+      manifestPath,
+      { ...manifestBase, status: "planned", completedAt: null },
+      { overwrite: false },
+    );
+
+    for (const artifact of [...plan.concepts, ...plan.evosCases, ...plan.overlaysToQuarantine]) {
+      const targetPath = resolveLegacyCleanupQuarantinePath(quarantineDir, artifact);
+      await mkdir(dirname(targetPath), { recursive: true });
+      await rename(artifact.sourcePath, targetPath);
+    }
+    for (const overlay of plan.overlaysToRewrite) {
+      const targetPath = resolveLegacyCleanupQuarantinePath(quarantineDir, overlay);
+      await mkdir(dirname(targetPath), { recursive: true });
+      await writeFile(targetPath, overlay.content, { encoding: "utf8", flag: "wx" });
+      await writeFile(overlay.sourcePath, overlay.cleanedContent, "utf8");
+    }
+
+    const okfPaths = resolveOkfKnowledgePaths(input.homeDir);
+    await prependLogEntry(
+      join(okfPaths.okfDir, "log.md"),
+      `**Cleanup**: Quarantined ${plan.concepts.length} legacy generated concept(s), ${plan.evosCases.length} evos case(s), and adjusted ${plan.overlaysToQuarantine.length + plan.overlaysToRewrite.length} overlay(s).`,
+    );
+    const directoryIndexPaths = await regenerateOkfDirectoryIndexes(okfPaths.okfDir);
+    const derivedIndexPaths = await rebuildOkfKnowledgeIndexes({ homeDir: input.homeDir });
+    const evosIndexPath = await rebuildEvolutionEvosIndexForCleanup(input.homeDir, generatedAt);
+    await writeJson(
+      manifestPath,
+      {
+        ...manifestBase,
+        status: "completed",
+        completedAt: generatedAt,
+        okfIndexPaths: [...directoryIndexPaths, ...derivedIndexPaths],
+        evosIndexPath,
+      },
+      { overwrite: true },
+    );
+
+    return {
+      ...preview,
+      quarantineDir,
+      manifestPath,
+      okfIndexPaths: [...directoryIndexPaths, ...derivedIndexPaths],
+      evosIndexPath,
+    };
+  } finally {
+    await rm(processLockPath, { force: true });
+  }
+}
+
 export async function listOkfKnowledgeConcepts(input: {
   homeDir: string;
   projectKey?: string;
@@ -2037,6 +2769,13 @@ export async function listOkfKnowledgeConcepts(input: {
 }): Promise<OkfKnowledgeConcept[]> {
   const okfDir = resolveOkfKnowledgePaths(input.homeDir).okfDir;
   if (!(await pathExists(okfDir))) return [];
+  const equivalentProjectKeys =
+    input.projectKey === undefined
+      ? undefined
+      : await listEquivalentProjectKeys({
+          homeDir: input.homeDir,
+          projectKey: input.projectKey,
+        });
   const files = await listMarkdownFiles(okfDir);
   const concepts: OkfKnowledgeConcept[] = [];
   for (const file of files) {
@@ -2046,7 +2785,7 @@ export async function listOkfKnowledgeConcepts(input: {
     if (parsed !== null) concepts.push(parsed);
   }
   return concepts
-    .filter((concept) => matchesConceptFilters(concept, input))
+    .filter((concept) => matchesConceptFilters(concept, input, equivalentProjectKeys))
     .sort((left, right) => left.id.localeCompare(right.id));
 }
 
@@ -2076,7 +2815,7 @@ export async function queryOkfKnowledge(input: {
   now?: string | Date;
 }): Promise<OkfKnowledgeQueryResult> {
   const okfDir = resolveOkfKnowledgePaths(input.homeDir).okfDir;
-  const scope = normalizeKnowledgeQueryScope(input);
+  const scope = await normalizeKnowledgeQueryScope(input);
   const queryText = normalizeKnowledgeQueryText(input.queryText);
   const now = normalizeQueryNow(input.now);
   const warnings: string[] = [];
@@ -2157,17 +2896,26 @@ export async function queryOkfKnowledge(input: {
       return left.concept.id.localeCompare(right.concept.id);
     })
     .slice(0, limit)
-    .map<OkfKnowledgeContextItem>((candidate, index) => ({
-      id: candidate.concept.id,
-      sourceType: "okf",
-      sourceLink: candidate.concept.sourceLink,
-      section: candidate.section,
-      rank: index + 1,
-      score: candidate.score,
-      title: candidate.concept.title,
-      summary: candidate.concept.description || candidate.concept.title,
-      matchReasons: candidate.matchReasons.length === 0 ? ["generic"] : candidate.matchReasons,
-    }));
+    .map<OkfKnowledgeContextItem>((candidate, index) => {
+      const freshness = deriveOkfKnowledgeFreshness({
+        concept: candidate.concept,
+        now,
+      }).freshness;
+      return {
+        id: candidate.concept.id,
+        sourceType: "okf",
+        sourceLink: candidate.concept.sourceLink,
+        section: candidate.section,
+        rank: index + 1,
+        score: candidate.score,
+        title: candidate.concept.title,
+        summary: candidate.concept.description || candidate.concept.title,
+        freshness,
+        runtimeExcerpt:
+          freshness === "verified" ? createBoundedOkfRuntimeExcerpt(candidate.concept) : null,
+        matchReasons: candidate.matchReasons.length === 0 ? ["generic"] : candidate.matchReasons,
+      };
+    });
 
   return {
     projectKey: scope.projectKey,
@@ -2375,17 +3123,39 @@ export async function queryScopedOkfKnowledgeContext(input: {
   now?: string | Date;
 }): Promise<OkfKnowledgeQueryResult> {
   const result = await queryOkfKnowledge(input);
-  const evosCases = await listEvolutionEvosCases({
-    homeDir: input.homeDir,
-    projectKey: input.projectKey,
-    roleId: input.roleId,
-    reviewStates: ["accepted", "auto-accepted"],
-  });
+  const equivalentProjectKeys =
+    result.projectKey === undefined
+      ? [undefined]
+      : await listEquivalentProjectKeys({
+          homeDir: input.homeDir,
+          projectKey: result.projectKey,
+        });
+  const evosResults = await Promise.all(
+    equivalentProjectKeys.map((projectKey) =>
+      listEvolutionEvosCases({
+        homeDir: input.homeDir,
+        ...(projectKey === undefined ? {} : { projectKey }),
+        roleId: input.roleId,
+        reviewStates: ["accepted", "auto-accepted"],
+      }),
+    ),
+  );
+  const evosCases = {
+    cases: [
+      ...new Map(
+        evosResults
+          .flatMap((entry) => entry.cases)
+          .map((evosCase) => [`${evosCase.projectKey}\0${evosCase.id}`, evosCase]),
+      ).values(),
+    ],
+    warnings: [...new Set(evosResults.flatMap((entry) => entry.warnings))],
+  };
   return mergeAcceptedEvosCasesIntoKnowledgeQuery(
     result,
     evosCases.cases,
     evosCases.warnings,
     input.limit,
+    equivalentProjectKeys.flatMap((projectKey) => (projectKey === undefined ? [] : [projectKey])),
   );
 }
 
@@ -2394,6 +3164,7 @@ export function mergeAcceptedEvosCasesIntoKnowledgeQuery(
   cases: EvolutionEvosCase[],
   warnings: string[] = [],
   limit?: number,
+  equivalentProjectKeys: string[] = [],
 ): OkfKnowledgeQueryResult {
   const startRank = result.items.length + 1;
   const evosItems = cases.flatMap<OkfKnowledgeContextItem>((evosCase, index) => {
@@ -2408,8 +3179,10 @@ export function mergeAcceptedEvosCasesIntoKnowledgeQuery(
         : []),
     ];
     const structuredScore =
-      (result.projectKey !== undefined && evosCase.projectKey === result.projectKey ? 100 : 0) +
-      (result.roleId !== undefined && evosCase.roleTags.includes(result.roleId) ? 100 : 0);
+      (result.projectKey !== undefined &&
+      [result.projectKey, ...equivalentProjectKeys].includes(evosCase.projectKey)
+        ? 100
+        : 0) + (result.roleId !== undefined && evosCase.roleTags.includes(result.roleId) ? 100 : 0);
     return [
       {
         id: evosCase.id,
@@ -2420,6 +3193,8 @@ export function mergeAcceptedEvosCasesIntoKnowledgeQuery(
         score: structuredScore + lexical.score,
         title: evosCase.title,
         summary: evosCase.expectedFutureBehavior || evosCase.result.summary || evosCase.title,
+        freshness: "unknown",
+        runtimeExcerpt: null,
         matchReasons:
           lexical.reasons.length === 0
             ? structuredReasons
@@ -2446,36 +3221,56 @@ export async function createScopedKnowledgeContextPack(input: {
   paths?: string[];
   queryText?: string;
   limit?: number;
+  inlineOnly?: boolean;
 }): Promise<ScopedKnowledgeContextPack | null> {
-  const result = await queryScopedOkfKnowledgeContext(input);
-  if (result.items.length === 0) return null;
+  const result = await queryScopedOkfKnowledgeContext({
+    ...input,
+    limit: input.inlineOnly === true ? Math.max(input.limit ?? 3, 50) : input.limit,
+  });
+  const selectedItems =
+    input.inlineOnly === true
+      ? result.items.filter((item) => item.runtimeExcerpt !== null).slice(0, input.limit ?? 3)
+      : result.items;
+  if (selectedItems.length === 0) return null;
   const scope: ScopedKnowledgeContextPackScope = {
     ...(result.projectKey === undefined ? {} : { projectKey: result.projectKey }),
     ...(result.roleId === undefined ? {} : { roleId: result.roleId }),
     ...(result.workflowId === undefined ? {} : { workflowId: result.workflowId }),
     paths: result.paths,
   };
-  const items = result.items.map<ScopedKnowledgeContextPackItem>((item) => ({
+  const items = selectedItems.map<ScopedKnowledgeContextPackItem>((item) => ({
     id: item.id,
     sourceType: item.sourceType,
     sourceLink: item.sourceLink,
     section: item.section,
     rank: item.rank,
     title: sanitizeOkfText(item.title),
+    freshness: item.freshness,
+    loader:
+      item.sourceType === "okf"
+        ? { kind: "knowledge-show", conceptId: item.id }
+        : { kind: "none", conceptId: null },
+    delivery: {
+      mode: item.runtimeExcerpt === null ? "reference" : "inline",
+      excerpt: item.runtimeExcerpt,
+    },
     matchReasons: uniqueStrings(item.matchReasons.map(sanitizeLexicalReason)),
   }));
   const okfIndexRevision = createKnowledgeContextRevision(items);
   const queryText = normalizeKnowledgeQueryText(result.queryText);
+  const queryHash = queryText === undefined ? undefined : sha256Short(queryText);
   const packSeed = stableJsonStringify({
     okfIndexRevision,
     scope,
-    queryText: queryText ?? null,
+    queryHash: queryHash ?? null,
     items: items.map((item) => ({
       id: item.id,
       sourceType: item.sourceType,
       sourceLink: item.sourceLink,
       section: item.section,
-      rank: item.rank,
+      freshness: item.freshness,
+      loader: item.loader,
+      delivery: item.delivery,
       matchReasons: item.matchReasons,
     })),
   });
@@ -2485,7 +3280,7 @@ export async function createScopedKnowledgeContextPack(input: {
     id: `ctxpack-${sha256Short(packSeed)}`,
     okfIndexRevision,
     scope,
-    ...(queryText === undefined ? {} : { queryText }),
+    ...(queryHash === undefined ? {} : { queryHash }),
     items,
     warnings:
       result.warnings.length === 0
@@ -2504,13 +3299,22 @@ export function formatScopedKnowledgePromptBlock(pack: ScopedKnowledgeContextPac
     `Project: ${pack.scope.projectKey ?? "all"}`,
     `Role: ${pack.scope.roleId ?? "any"}`,
     `Workflow: ${pack.scope.workflowId ?? "any"}`,
-    ...(pack.queryText === undefined ? [] : [`Query: ${sanitizeOkfText(pack.queryText)}`]),
     `Paths: ${pack.scope.paths.length === 0 ? "all" : pack.scope.paths.join(", ")}`,
     "Raw content stored: false",
+    "Freshness is determined by EvoDev lifecycle and verification metadata; do not infer validity from timestamps.",
     "",
     "Applicable items:",
     ...pack.items.flatMap((item) => [
-      `- ${item.rank}. ${sanitizeOkfText(item.id)} (${item.section}; ${item.sourceType})`,
+      `- ${item.rank}. ${sanitizeOkfText(item.title)} (${item.section}; ${item.sourceType})`,
+      `  Identity: ${sanitizeOkfText(item.id)}`,
+      `  Freshness: ${item.freshness}`,
+      `  Delivery: ${item.delivery.mode}`,
+      ...(item.delivery.excerpt === null
+        ? ["  Guidance: load on demand; do not treat this reference as a standing constraint."]
+        : [`  Guidance: ${sanitizeOkfText(item.delivery.excerpt)}`]),
+      ...(item.loader.kind === "knowledge-show"
+        ? [`  Load: evodev knowledge show ${sanitizeOkfText(item.loader.conceptId)}`]
+        : []),
       `  Source: ${sanitizeOkfText(item.sourceLink)}`,
       `  Match: ${item.matchReasons.length === 0 ? "generic" : item.matchReasons.join(", ")}`,
     ]),
@@ -2560,9 +3364,11 @@ export async function writeContextInjectionReceipt(input: {
     okfIndexRevision: input.pack.okfIndexRevision,
     scope: input.pack.scope,
     itemIds: input.pack.items.map((item) => item.id),
+    queryHash: input.pack.queryHash ?? null,
     injectedAt: input.injectedAt ?? new Date().toISOString(),
     hookEventId: input.hookEventId ?? null,
     trigger: input.trigger,
+    outcome: null,
     rawContentStored: false,
   };
   const path = resolveContextInjectionReceiptPath({
@@ -2574,6 +3380,57 @@ export async function writeContextInjectionReceipt(input: {
   return { path, receipt };
 }
 
+export async function recordContextInjectionOutcome(input: {
+  homeDir: string;
+  sessionKey: string;
+  eventId: string;
+  observedAt: string;
+  summary: string;
+}): Promise<string[]> {
+  const stateDir = resolveEvoDevPaths(input.homeDir).stateDir;
+  const directory = join(
+    stateDir,
+    "context-injections",
+    sanitizeReceiptPathSegment(input.sessionKey),
+  );
+  let names: string[];
+  try {
+    names = await readdir(directory);
+  } catch {
+    return [];
+  }
+  const paths: string[] = [];
+  for (const name of names.filter((item) => item.endsWith(".json")).sort()) {
+    const path = join(directory, name);
+    let receipt: ContextInjectionReceipt;
+    try {
+      receipt = JSON.parse(await readFile(path, "utf8")) as ContextInjectionReceipt;
+    } catch {
+      continue;
+    }
+    if (
+      receipt.version !== 1 ||
+      receipt.rawContentStored !== false ||
+      (receipt.outcome !== null && receipt.outcome !== undefined)
+    ) {
+      continue;
+    }
+    const updated: ContextInjectionReceipt = {
+      ...receipt,
+      outcome: {
+        status: "verified",
+        eventId: sanitizeReceiptPathSegment(input.eventId),
+        observedAt: normalizeTimestamp(input.observedAt),
+        summaryHash: sha256Short(input.summary),
+        rawContentStored: false,
+      },
+    };
+    await writeJson(path, updated, { overwrite: true });
+    paths.push(path);
+  }
+  return paths;
+}
+
 export async function markOkfKnowledgeConceptStale(input: {
   homeDir: string;
   conceptId: string;
@@ -2795,8 +3652,8 @@ async function appendLifecycleLogs(input: {
 function validateLifecycleReason(value: string): string {
   const reason = value.trim();
   if (reason === "") throw new Error("Lifecycle revoke requires a non-empty reason.");
-  if (FORBIDDEN_OKF_TEXT.test(reason) || PRIVATE_OR_INTERNAL_URL.test(reason)) {
-    throw new Error("Lifecycle revoke reason contains unsafe raw or sensitive text.");
+  if (detectSessionMemorySensitivity(reason).classification === "credential") {
+    throw new Error("Lifecycle revoke reason contains a credential.");
   }
   return sanitizeOkfText(reason);
 }
@@ -2868,8 +3725,8 @@ export async function lintOkfKnowledge(input: {
     if (reviewState === "auto-stored/unreviewed") {
       warnings.push(`Concept missing active lifecycle reviewState: ${rel}`);
     }
-    if (FORBIDDEN_OKF_TEXT.test(content))
-      errors.push(`Concept contains forbidden sensitive text: ${rel}`);
+    if (detectSessionMemorySensitivity(content).classification === "credential")
+      errors.push(`Concept contains a credential: ${rel}`);
     if (input.stale === true) {
       const concept = parseOkfConceptFile(paths.okfDir, file.path, content);
       if (concept !== null) {
@@ -2925,7 +3782,7 @@ export function formatOkfKnowledgeQuery(result: OkfKnowledgeQueryResult): string
           ? ["- none"]
           : items.map(
               (item) =>
-                `- ${item.summary}\n  Source: ${item.sourceLink}\n  Match: ${item.matchReasons.join(", ")}\n  Rank: ${item.rank}`,
+                `- ${item.summary}\n  Freshness: ${item.freshness}\n  ${item.sourceType === "okf" ? `Load: evodev knowledge show ${item.id}\n  ` : ""}Source: ${item.sourceLink}\n  Match: ${item.matchReasons.join(", ")}\n  Rank: ${item.rank}`,
             )),
         "",
       ];
@@ -3165,97 +4022,37 @@ function createOverlayUpdates(
   ];
 }
 
-async function writeNeedsHumanKnowledgeCandidate(input: {
-  homeDir: string;
-  plan: OkfKnowledgePlan;
-  candidate: OkfKnowledgePlanCandidate;
-}): Promise<string> {
-  const root = join(resolveEvoDevPaths(input.homeDir).stateDir, "evolution");
-  const targetDir = join(
-    root,
-    sanitizePlanStorageId("projectKey", input.plan.projectKey),
-    sanitizePlanStorageId("runId", input.plan.runId),
-    "review-candidates",
-  );
-  const targetPath = join(
-    targetDir,
-    `${sanitizePlanStorageId("candidateId", input.candidate.id)}.json`,
-  );
-  assertPathDescendant(root, targetPath, "reviewCandidatePath");
-  const candidateSnapshot = sanitizeReviewQueueValue(input.candidate);
-  await writeJson(
-    targetPath,
-    {
-      schemaVersion: 1,
-      kind: "evolution-review-candidate",
-      id: input.candidate.id,
-      projectKey: input.plan.projectKey,
-      runId: input.plan.runId,
-      createdAt: input.plan.createdAt,
-      candidateKind: input.candidate.kind,
-      title: sanitizeOkfText(input.candidate.title),
-      targetStore: input.candidate.targetStore,
-      targetPath: sanitizeOkfText(input.candidate.targetPath),
-      stableKey: sanitizeOkfText(input.candidate.stableKey),
-      reviewState: "needs-human",
-      reasons: [sanitizeOkfText(input.candidate.decisionReason)],
-      candidate: candidateSnapshot,
-      provenance: {
-        runId: input.plan.runId,
-        evidenceWindowId: input.plan.evidenceWindowId,
-        evidenceRefs: input.candidate.evidenceRefs.map(sanitizeOkfText),
-        createdBy: "evodev",
-        rawLogsStored: false,
-        rawPromptsStored: false,
-        sourceDumpsStored: false,
-        rawCommandOutputStored: false,
-      },
-      privacy: {
-        classification: "local-private",
-        rawPromptsStored: false,
-        rawLogsStored: false,
-        sourceDumpsStored: false,
-        rawCommandOutputStored: false,
-        secretsStored: false,
-        internalLinksStored: false,
-      },
-    },
-    { overwrite: true },
-  );
-  return targetPath;
-}
-
 function sanitizeOkfPlanCandidate(candidate: OkfKnowledgePlanCandidate): OkfKnowledgePlanCandidate {
   return sanitizeReviewQueueValue(candidate) as OkfKnowledgePlanCandidate;
 }
 
 function sanitizeReviewQueueValue(value: unknown): unknown {
+  return boundReviewQueueValue(redactSessionMemoryCredentials(value).value);
+}
+
+function boundReviewQueueValue(value: unknown): unknown {
   if (typeof value === "string") return sanitizeOkfText(value);
   if (value === null || value === undefined) return value;
-  if (Array.isArray(value)) return value.map(sanitizeReviewQueueValue);
+  if (Array.isArray(value)) return value.map(boundReviewQueueValue);
   if (typeof value !== "object") return value;
   return Object.fromEntries(
-    Object.entries(value).map(([key, child]) => [key, sanitizeReviewQueueValue(child)]),
+    Object.entries(value).map(([key, child]) => [key, boundReviewQueueValue(child)]),
   );
 }
 
 function sanitizeOkfText(value: string): string {
-  return value
-    .replace(new RegExp(PRIVATE_OR_INTERNAL_URL.source, "gi"), "[redacted]")
-    .replace(new RegExp(FORBIDDEN_OKF_TEXT.source, "gi"), "[redacted]")
-    .replace(/\s+/gu, " ")
-    .trim()
-    .slice(0, 800);
+  return redactSessionMemoryCredentialText(value).value.replace(/\s+/gu, " ").trim().slice(0, 800);
 }
 
 function hasUnsafeCandidateContent(candidate: OkfKnowledgePlanCandidate): boolean {
-  const content = JSON.stringify(candidate);
   return (
-    FORBIDDEN_OKF_TEXT.test(content) ||
-    FORBIDDEN_OKF_FIELD.test(content) ||
-    PRIVATE_OR_INTERNAL_URL.test(content) ||
+    detectSessionMemorySensitivity(candidate).classification === "credential" ||
     (candidate.privacyCheck !== undefined &&
-      Object.values(candidate.privacyCheck).some((value) => value !== false))
+      (candidate.privacyCheck.rawPromptsStored !== false ||
+        candidate.privacyCheck.rawLogsStored !== false ||
+        candidate.privacyCheck.sourceDumpsStored !== false ||
+        candidate.privacyCheck.rawCommandOutputStored !== false ||
+        candidate.privacyCheck.secretsStored !== false))
   );
 }
 
@@ -3292,7 +4089,7 @@ function hasHighRiskHumanReviewSignal(candidate: unknown): boolean {
   return HUMAN_REVIEW_DOMAIN_PATTERN.test(values.join(" "));
 }
 
-function explainNeedsHumanDecision(
+function explainAutomaticNoWriteDecision(
   candidate: OkfKnowledgePlanCandidate,
   scores: OkfKnowledgeCandidateScores,
   hasVerification: boolean,
@@ -3301,6 +4098,9 @@ function explainNeedsHumanDecision(
   const reasons: string[] = [];
   if (candidate.targetStore !== "okf") reasons.push("target is not user-local OKF");
   if (candidate.basis !== "direct") reasons.push("basis is inferred");
+  if (!isDirectKnowledgeSupport(candidate.supportRef)) {
+    reasons.push("structured direct support is missing");
+  }
   if (!candidate.metadataOnlyEvidence) reasons.push("evidence is not metadata-only");
   if (!hasVerification) reasons.push("verification evidence is missing");
   if (!hasScopeTags) reasons.push("repo or role tags are missing");
@@ -3308,7 +4108,7 @@ function explainNeedsHumanDecision(
   if (scores.privacyRisk > 2) reasons.push("privacy risk is above auto-accept");
   if (scores.stability < 3) reasons.push("stability is below auto-accept");
   if (scores.duplicationRisk > 2) reasons.push("duplication risk is above auto-accept");
-  return `Needs human review: ${reasons.join("; ") || "auto-accept gates were not all satisfied"}.`;
+  return `No write: ${reasons.join("; ") || "auto-accept gates were not all satisfied"}.`;
 }
 
 function resolveCandidateReviewStateForWrite(
@@ -3332,6 +4132,83 @@ function normalizeComparableText(value: string): string {
   return sanitizeSlug(value).replace(/[._/-]+/gu, "-");
 }
 
+function isLegacyTemplateKnowledge(candidate: OkfKnowledgePlanCandidate): boolean {
+  const text = [
+    candidate.title,
+    candidate.description,
+    candidate.claim,
+    candidate.howToApply,
+    candidate.bodySections.summary,
+    ...candidate.bodySections.guidance,
+  ].join(" ");
+  return /(?:Project run segment-run-|Run segment-run-.*evolution case|redacted (?:metadata )?evidence event|No failure signal was detected|Evolution distillation used (?:conditional|strong) trigger evidence|Future role agents should inspect accepted knowledge first|This record is derived from metadata-only evidence)/i.test(
+    text,
+  );
+}
+
+function hasEphemeralKnowledgeIdentity(candidate: OkfKnowledgePlanCandidate): boolean {
+  return /(?:segment-(?:run|evidence)-[a-f0-9]{8,}|(?:^|:)run-[a-f0-9]{8,}|(?:^|:)(?:evo|k)-[a-f0-9]{8,})/i.test(
+    `${candidate.stableKey} ${candidate.targetPath} ${candidate.title}`,
+  );
+}
+
+function hasReusableSemanticShape(candidate: OkfKnowledgePlanCandidate): boolean {
+  if (isLegacyTemplateKnowledge(candidate)) return false;
+  if (candidate.title.trim().length < 8 || candidate.claim.trim().length < 20) return false;
+  if (candidate.bodySections.summary.trim().length < 20) return false;
+  if (!candidate.bodySections.appliesWhen.some((item) => item.trim().length >= 8)) return false;
+  if (!candidate.bodySections.guidance.some((item) => item.trim().length >= 16)) return false;
+  return true;
+}
+
+function createSemanticFingerprint(value: string): string {
+  const tokens = value
+    .toLowerCase()
+    .replace(/segment-(?:run|evidence)-[a-f0-9]+/gu, " ")
+    .replace(/[^a-z0-9\p{L}\p{N}]+/gu, " ")
+    .split(/\s+/u)
+    .filter((token) => token.length >= 3)
+    .filter(
+      (token) =>
+        !new Set([
+          "the",
+          "and",
+          "for",
+          "with",
+          "this",
+          "that",
+          "when",
+          "from",
+          "should",
+          "knowledge",
+          "evodev",
+        ]).has(token),
+    );
+  return [...new Set(tokens)].sort().join(" ").slice(0, 600);
+}
+
+function extractSummarySection(body: string): string {
+  return body.match(/(?:^|\n)# Summary\s*\n+([\s\S]*?)(?=\n# |$)/u)?.[1]?.trim() ?? "";
+}
+
+function createBoundedOkfRuntimeExcerpt(concept: OkfKnowledgeConcept): string {
+  const projection = createOkfKnowledgeRuntimeProjectionFromConcept(concept);
+  return sanitizeOkfText(
+    [
+      projection.summary || concept.description,
+      ...projection.guidance.map((item) => `- ${item}`),
+      ...projection.verification.map((item) => `Verification: ${item}`),
+    ]
+      .filter((item) => item.trim() !== "")
+      .join("\n"),
+  ).slice(0, 1_200);
+}
+
+function scopesOverlap(left: string[], right: string[]): boolean {
+  if (left.length === 0 || right.length === 0) return true;
+  return left.some((tag) => right.includes(tag));
+}
+
 function listMarkdownFilesSync(root: string): Array<{ path: string; name: string }> {
   if (!existsSync(root)) return [];
   const entries = readdirSync(root, { withFileTypes: true });
@@ -3455,8 +4332,41 @@ async function ensureOverlayConcept(input: {
   );
 }
 
-function renderOkfConcept(candidate: OkfKnowledgePlanCandidate, plan: OkfKnowledgePlan): string {
+function renderOkfConcept(
+  candidate: OkfKnowledgePlanCandidate,
+  plan: OkfKnowledgePlan,
+  existing?: OkfKnowledgeConcept,
+): string {
   const scores = resolveCandidateScoresForWrite(candidate);
+  const reviewState = resolveCandidateReviewStateForWrite(candidate);
+  const nextLifecycle = createDefaultOkfLifecycle({
+    type: candidate.okfType,
+    path: candidate.targetPath,
+    tags: [
+      "evodev",
+      candidate.kind,
+      ...candidate.roleTags.map((tag) => `role:${tag}`),
+      ...candidate.repoTags.map((tag) => `repo:${tag}`),
+      ...candidate.workflowTags.map((tag) => `workflow:${tag}`),
+    ],
+    title: candidate.title,
+    reviewState,
+    createdAt: plan.createdAt,
+  });
+  const lifecycle =
+    existing === undefined
+      ? nextLifecycle
+      : {
+          ...nextLifecycle,
+          createdAt: existing.lifecycle.createdAt,
+          supersedes: existing.lifecycle.supersedes,
+          supersededBy: existing.lifecycle.supersededBy,
+        };
+  const verificationSnapshot = createOkfKnowledgeVerificationSnapshot({
+    candidate,
+    verifiedAt: plan.createdAt,
+    projectKey: plan.projectKey,
+  });
   return [
     "---",
     `type: ${yamlString(candidate.okfType)}`,
@@ -3475,24 +4385,10 @@ function renderOkfConcept(candidate: OkfKnowledgePlanCandidate, plan: OkfKnowled
     "evodev:",
     `  schema: ${yamlString("knowledge/v1")}`,
     `  stableKey: ${yamlString(candidate.stableKey)}`,
-    `  reviewState: ${yamlString(resolveCandidateReviewStateForWrite(candidate))}`,
-    renderLifecycleYaml(
-      "  ",
-      createDefaultOkfLifecycle({
-        type: candidate.okfType,
-        path: candidate.targetPath,
-        tags: [
-          "evodev",
-          candidate.kind,
-          ...candidate.roleTags.map((tag) => `role:${tag}`),
-          ...candidate.repoTags.map((tag) => `repo:${tag}`),
-          ...candidate.workflowTags.map((tag) => `workflow:${tag}`),
-        ],
-        title: candidate.title,
-        reviewState: resolveCandidateReviewStateForWrite(candidate),
-        createdAt: plan.createdAt,
-      }),
-    ),
+    `  reviewState: ${yamlString(reviewState)}`,
+    renderLifecycleYaml("  ", lifecycle),
+    renderKnowledgeSupportRefYaml("  ", candidate.supportRef ?? null),
+    renderVerificationSnapshotYaml("  ", verificationSnapshot),
     "  source:",
     `    kind: ${yamlString("trace-distillation")}`,
     `    projectKey: ${yamlString(plan.projectKey)}`,
@@ -3504,7 +4400,7 @@ function renderOkfConcept(candidate: OkfKnowledgePlanCandidate, plan: OkfKnowled
     renderYamlList("    roleTags", candidate.roleTags),
     renderYamlList("    workflowTags", candidate.workflowTags),
     renderYamlList("    pathScopes", candidate.pathScopes),
-    renderPrivacyYaml("  "),
+    renderPrivacyYaml("  ", candidate.privacyCheck),
     "  organizer:",
     `    lastAction: ${yamlString(candidate.decision)}`,
     `    lastRunId: ${yamlString(plan.runId)}`,
@@ -3523,17 +4419,27 @@ function renderOkfConcept(candidate: OkfKnowledgePlanCandidate, plan: OkfKnowled
     "",
     candidate.bodySections.summary,
     "",
+    "# Claim",
+    "",
+    candidate.claim,
+    "",
     "# Applies When",
     "",
     renderMarkdownList(candidate.bodySections.appliesWhen),
     "",
+    "# How to Apply",
+    "",
+    candidate.howToApply,
+    "",
     "# Guidance",
     "",
     renderMarkdownList(candidate.bodySections.guidance),
     "",
     "# Anti-Criteria",
     "",
-    renderMarkdownList(candidate.bodySections.antiCriteria),
+    renderMarkdownList(
+      uniqueStrings([...candidate.antiCriteria, ...candidate.bodySections.antiCriteria]),
+    ),
     "",
     "# Verification",
     "",
@@ -3759,6 +4665,8 @@ function parseOkfConceptFile(
     reviewState,
     lifecycle: lifecycleParsed.lifecycle,
     lifecyclePersisted: lifecycleParsed.persisted,
+    verificationSnapshot: parseOkfVerificationSnapshot(frontmatter),
+    supportRef: parseOkfKnowledgeSupportRef(frontmatter),
     title,
     description,
     tags,
@@ -3770,15 +4678,56 @@ function parseOkfConceptFile(
   };
 }
 
+function parseOkfKnowledgeSupportRef(frontmatter: string): OkfKnowledgeSupportRef | null {
+  const block = extractNestedYamlBlock(frontmatter, "evodev", "supportRef");
+  if (block === null) return null;
+  try {
+    return normalizeKnowledgeSupportRef(
+      {
+        id: readIndentedYamlScalar(block, "id"),
+        kind: readIndentedYamlScalar(block, "kind"),
+        sourceRefId: readIndentedYamlScalar(block, "sourceRefId"),
+        subjectFingerprint: readNullableLifecycleString(
+          readIndentedYamlScalar(block, "subjectFingerprint"),
+        ),
+        observedAt: readIndentedYamlScalar(block, "observedAt"),
+      },
+      "evodev.supportRef",
+    );
+  } catch {
+    return null;
+  }
+}
+
+function parseOkfVerificationSnapshot(
+  frontmatter: string,
+): OkfKnowledgeVerificationSnapshotV1 | null {
+  const block = extractNestedYamlBlock(frontmatter, "evodev", "verificationSnapshot");
+  if (block === null) return null;
+  const schemaVersion = readIndentedYamlScalar(block, "schemaVersion");
+  const verifiedAt = normalizeIsoDateString(readIndentedYamlScalar(block, "verifiedAt"));
+  if (schemaVersion !== "1" || verifiedAt === null) return null;
+  return {
+    schemaVersion: 1,
+    verifiedAt,
+    evidenceRefs: readYamlList(block, "evidenceRefs"),
+    repository: null,
+  };
+}
+
 function matchesConceptFilters(
   concept: OkfKnowledgeConcept,
   input: { projectKey?: string; roleId?: string; workflowId?: string; paths?: string[] },
+  equivalentProjectKeys?: string[],
 ): boolean {
+  const projectKeys = (equivalentProjectKeys ?? []).map(sanitizeSlug);
   if (
     input.projectKey !== undefined &&
     concept.repoTags.length > 0 &&
-    !concept.repoTags.includes(sanitizeSlug(input.projectKey)) &&
-    !concept.tags.includes(`repo:${sanitizeSlug(input.projectKey)}`)
+    ![sanitizeSlug(input.projectKey), ...projectKeys].some(
+      (projectKey) =>
+        concept.repoTags.includes(projectKey) || concept.tags.includes(`repo:${projectKey}`),
+    )
   ) {
     return false;
   }
@@ -3806,14 +4755,40 @@ function matchesConceptFilters(
   return true;
 }
 
-function normalizeKnowledgeQueryScope(input: {
+async function normalizeKnowledgeQueryScope(input: {
+  homeDir: string;
   projectKey?: string;
   roleId?: string;
   workflowId?: string;
   paths?: string[];
-}): KnowledgeQueryScope {
+}): Promise<KnowledgeQueryScope> {
+  const aliases =
+    input.projectKey === undefined
+      ? {}
+      : await listProjectAliases({
+          homeDir: input.homeDir,
+        });
+  const requestedProjectKey =
+    input.projectKey === undefined ? undefined : sanitizeSlug(input.projectKey);
+  const projectKey =
+    requestedProjectKey === undefined
+      ? undefined
+      : canonicalizeProjectKey(requestedProjectKey, aliases);
+  const projectKeys =
+    projectKey === undefined
+      ? undefined
+      : [
+          ...new Set([
+            projectKey,
+            requestedProjectKey ?? projectKey,
+            ...Object.keys(aliases).filter(
+              (alias) => canonicalizeProjectKey(alias, aliases) === projectKey,
+            ),
+          ]),
+        ].map(sanitizeSlug);
   return {
-    projectKey: input.projectKey === undefined ? undefined : sanitizeSlug(input.projectKey),
+    projectKey,
+    projectKeys,
     roleId: input.roleId === undefined ? undefined : sanitizeSlug(input.roleId),
     workflowId: input.workflowId === undefined ? undefined : sanitizeSlug(input.workflowId),
     paths: (input.paths ?? []).flatMap((path) => {
@@ -3839,6 +4814,9 @@ function createKnowledgeContextRevision(items: ScopedKnowledgeContextPackItem[])
         sourceLink: item.sourceLink,
         section: item.section,
         title: item.title,
+        freshness: item.freshness,
+        loader: item.loader,
+        delivery: item.delivery,
         matchReasons: item.matchReasons,
       })),
     ),
@@ -4011,10 +4989,8 @@ function summarizeLexicalBody(body: string): string {
 }
 
 function sanitizeLexicalReason(value: string): string {
-  return value
-    .toLowerCase()
-    .replace(new RegExp(PRIVATE_OR_INTERNAL_URL.source, "gi"), "redacted")
-    .replace(new RegExp(FORBIDDEN_OKF_TEXT.source, "gi"), "redacted")
+  return redactSessionMemoryCredentialText(value)
+    .value.toLowerCase()
     .replace(/[^a-z0-9:._/-]+/gu, "-")
     .replace(/-+/gu, "-")
     .replace(/^-+|-+$/gu, "")
@@ -4036,8 +5012,10 @@ function matchOkfConceptForContext(
 
   const repoTags = collectScopedTags(concept, "repo");
   if (scope.projectKey !== undefined) {
-    if (repoTags.length > 0 && !repoTags.includes(scope.projectKey)) return null;
-    if (repoTags.includes(scope.projectKey)) {
+    const projectKeys = scope.projectKeys ?? [scope.projectKey];
+    const matchedProjectKey = projectKeys.find((projectKey) => repoTags.includes(projectKey));
+    if (repoTags.length > 0 && matchedProjectKey === undefined) return null;
+    if (matchedProjectKey !== undefined) {
       reasons.push(`repo:${scope.projectKey}`);
       exactMatches += 1;
     }
@@ -4109,7 +5087,12 @@ function matchOverlayScope(
 ): "repo" | "role" | "workflow" | "none" | null {
   const [root, id] = conceptId.split("/");
   if (root === "repos") {
-    if (scope.projectKey !== undefined && id !== scope.projectKey) return null;
+    if (
+      scope.projectKey !== undefined &&
+      !(scope.projectKeys ?? [scope.projectKey]).includes(id ?? "")
+    ) {
+      return null;
+    }
     return scope.projectKey === undefined ? "none" : "repo";
   }
   if (root === "roles") {
@@ -4175,10 +5158,7 @@ function isUnsafeOkfQueryContent(content: string): boolean {
   if (OKF_QUERY_PRIVACY_FLAG_KEYS.some((key) => readOkfPrivacyBoolean(frontmatter, key) === true)) {
     return true;
   }
-  if (FORBIDDEN_OKF_FIELD.test(content)) return true;
-  if (FORBIDDEN_OKF_TEXT.test(content)) return true;
-  if (PRIVATE_OR_INTERNAL_URL.test(content)) return true;
-  return false;
+  return detectSessionMemorySensitivity(content).classification === "credential";
 }
 
 function isActiveOkfConcept(concept: OkfKnowledgeConcept): boolean {
@@ -4264,8 +5244,11 @@ function readIndentedYamlBoolean(frontmatter: string, key: string): boolean | nu
   return null;
 }
 
-function validateOkfKnowledgePlan(plan: OkfKnowledgePlan): void {
-  assertOkfKnowledgePlanContract(plan);
+function validateOkfKnowledgePlan(
+  plan: OkfKnowledgePlan,
+  options: { allowReviewedHighRisk?: boolean } = {},
+): void {
+  assertOkfKnowledgePlanContract(plan, options);
 }
 
 function validateFailedPlanArtifact(artifact: OkfKnowledgeFailedPlanArtifact): void {
@@ -4323,10 +5306,12 @@ function assertOkfPrivacy(privacy: OkfKnowledgePrivacyCheck): void {
     privacy.rawLogsStored !== false ||
     privacy.sourceDumpsStored !== false ||
     privacy.rawCommandOutputStored !== false ||
-    privacy.secretsStored !== false ||
-    privacy.internalLinksStored !== false
+    privacy.secretsStored !== false
   ) {
-    throw new Error("OKF knowledge privacy fields must all be false.");
+    throw new Error("OKF knowledge privacy fields must forbid raw content and credentials.");
+  }
+  if (typeof privacy.internalLinksStored !== "boolean") {
+    throw new Error("OKF knowledge internalLinksStored must be boolean.");
   }
 }
 
@@ -4481,6 +5466,35 @@ function renderLifecycleYaml(indent: string, lifecycle: OkfKnowledgeLifecycle):
   ].join("\n");
 }
 
+function renderVerificationSnapshotYaml(
+  indent: string,
+  snapshot: OkfKnowledgeVerificationSnapshotV1 | null,
+): string {
+  if (snapshot === null) return `${indent}verificationSnapshot: null`;
+  return [
+    `${indent}verificationSnapshot:`,
+    `${indent}  schemaVersion: 1`,
+    `${indent}  verifiedAt: ${yamlString(snapshot.verifiedAt)}`,
+    renderYamlList(`${indent}  evidenceRefs`, snapshot.evidenceRefs),
+    `${indent}  repository: null`,
+  ].join("\n");
+}
+
+function renderKnowledgeSupportRefYaml(
+  indent: string,
+  supportRef: OkfKnowledgeSupportRef | null,
+): string {
+  if (supportRef === null) return `${indent}supportRef: null`;
+  return [
+    `${indent}supportRef:`,
+    `${indent}  id: ${yamlString(supportRef.id)}`,
+    `${indent}  kind: ${yamlString(supportRef.kind)}`,
+    `${indent}  sourceRefId: ${yamlString(supportRef.sourceRefId)}`,
+    `${indent}  subjectFingerprint: ${yamlNullableString(supportRef.subjectFingerprint)}`,
+    `${indent}  observedAt: ${yamlString(supportRef.observedAt)}`,
+  ].join("\n");
+}
+
 function lifecycleStatusFromReviewState(
   reviewState: OkfKnowledgeReviewState,
 ): OkfKnowledgeLifecycleStatus {
@@ -4531,7 +5545,10 @@ function yamlNullableString(value: string | null): string {
   return value === null ? "null" : yamlString(value);
 }
 
-function renderPrivacyYaml(indent: string): string {
+function renderPrivacyYaml(
+  indent: string,
+  privacy: OkfKnowledgePrivacyCheck = createOkfPrivacyCheck(),
+): string {
   return [
     `${indent}privacy:`,
     `${indent}  classification: ${yamlString("local-private")}`,
@@ -4540,7 +5557,7 @@ function renderPrivacyYaml(indent: string): string {
     `${indent}  sourceDumpsStored: false`,
     `${indent}  rawCommandOutputStored: false`,
     `${indent}  secretsStored: false`,
-    `${indent}  internalLinksStored: false`,
+    `${indent}  internalLinksStored: ${privacy.internalLinksStored ? "true" : "false"}`,
   ].join("\n");
 }
 
@@ -4655,6 +5672,300 @@ function parseYamlValue(value: string): string {
   return trimmed.replace(/^['"]|['"]$/gu, "");
 }
 
+type LegacyCleanupArtifactKind = "okf-concept" | "evos-case" | "scope-overlay";
+type LegacyCleanupArtifactAction = "quarantine" | "rewrite";
+
+interface LegacyCleanupArtifact {
+  kind: LegacyCleanupArtifactKind;
+  action: LegacyCleanupArtifactAction;
+  sourcePath: string;
+  relativePath: string;
+  content: string;
+  sha256: string;
+}
+
+interface LegacyCleanupOverlayArtifact extends LegacyCleanupArtifact {
+  kind: "scope-overlay";
+  cleanedContent: string;
+}
+
+interface LegacyGeneratedKnowledgeCleanupPlan {
+  generatedAt: string;
+  concepts: LegacyCleanupArtifact[];
+  evosCases: LegacyCleanupArtifact[];
+  overlaysToQuarantine: LegacyCleanupOverlayArtifact[];
+  overlaysToRewrite: LegacyCleanupOverlayArtifact[];
+}
+
+async function createLegacyGeneratedKnowledgeCleanupPlan(
+  homeDir: string,
+  generatedAt: string,
+): Promise<LegacyGeneratedKnowledgeCleanupPlan> {
+  const evoDevPaths = resolveEvoDevPaths(homeDir);
+  const okfPaths = resolveOkfKnowledgePaths(homeDir);
+  const concepts: LegacyCleanupArtifact[] = [];
+  const conceptRoot = join(okfPaths.okfDir, "concepts", "evos");
+  for (const file of await listMarkdownFiles(conceptRoot)) {
+    if (RESERVED_OKF_FILENAMES.has(file.name)) continue;
+    const content = await readFile(file.path, "utf8");
+    if (!isLegacyGeneratedOkfConcept(file.name, content)) continue;
+    concepts.push(
+      createLegacyCleanupArtifact({
+        kind: "okf-concept",
+        action: "quarantine",
+        sourcePath: file.path,
+        rootDir: evoDevPaths.rootDir,
+        content,
+      }),
+    );
+  }
+
+  const evosCases: LegacyCleanupArtifact[] = [];
+  for (const file of await listJsonFiles(evoDevPaths.evosCasesDir)) {
+    const content = await readFile(file.path, "utf8");
+    if (!isLegacyGeneratedEvosCase(content)) continue;
+    evosCases.push(
+      createLegacyCleanupArtifact({
+        kind: "evos-case",
+        action: "quarantine",
+        sourcePath: file.path,
+        rootDir: evoDevPaths.rootDir,
+        content,
+      }),
+    );
+  }
+
+  const conceptLinks = new Set(
+    concepts.map((concept) => {
+      const okfRelative = relative(okfPaths.okfDir, concept.sourcePath).replace(/\\/gu, "/");
+      return `/${okfRelative}`;
+    }),
+  );
+  const overlaysToQuarantine: LegacyCleanupOverlayArtifact[] = [];
+  const overlaysToRewrite: LegacyCleanupOverlayArtifact[] = [];
+  for (const root of ["repos", "roles", "workflows"]) {
+    for (const file of await listMarkdownFiles(join(okfPaths.okfDir, root))) {
+      if (RESERVED_OKF_FILENAMES.has(file.name)) continue;
+      const content = await readFile(file.path, "utf8");
+      const cleanedContent = removeLegacyOverlayLinks(content, conceptLinks);
+      if (cleanedContent === content) continue;
+      const action = isGeneratedEmptyScopeOverlay(cleanedContent) ? "quarantine" : "rewrite";
+      const artifact = {
+        ...createLegacyCleanupArtifact({
+          kind: "scope-overlay",
+          action,
+          sourcePath: file.path,
+          rootDir: evoDevPaths.rootDir,
+          content,
+        }),
+        kind: "scope-overlay" as const,
+        cleanedContent,
+      };
+      if (action === "quarantine") overlaysToQuarantine.push(artifact);
+      else overlaysToRewrite.push(artifact);
+    }
+  }
+
+  const byPath = (left: LegacyCleanupArtifact, right: LegacyCleanupArtifact) =>
+    left.sourcePath.localeCompare(right.sourcePath);
+  return {
+    generatedAt,
+    concepts: concepts.sort(byPath),
+    evosCases: evosCases.sort(byPath),
+    overlaysToQuarantine: overlaysToQuarantine.sort(byPath),
+    overlaysToRewrite: overlaysToRewrite.sort(byPath),
+  };
+}
+
+function createLegacyCleanupArtifact(input: {
+  kind: LegacyCleanupArtifactKind;
+  action: LegacyCleanupArtifactAction;
+  sourcePath: string;
+  rootDir: string;
+  content: string;
+}): LegacyCleanupArtifact {
+  const relativePath = relative(input.rootDir, input.sourcePath).replace(/\\/gu, "/");
+  if (relativePath === "" || relativePath.startsWith("../") || isAbsolute(relativePath)) {
+    throw new Error(`Legacy cleanup path escaped EvoDev root: ${input.sourcePath}`);
+  }
+  return {
+    kind: input.kind,
+    action: input.action,
+    sourcePath: input.sourcePath,
+    relativePath,
+    content: input.content,
+    sha256: createHash("sha256").update(input.content).digest("hex"),
+  };
+}
+
+function toLegacyCleanupPreview(
+  plan: LegacyGeneratedKnowledgeCleanupPlan,
+): LegacyGeneratedKnowledgeCleanupPreview {
+  return {
+    generatedAt: plan.generatedAt,
+    conceptPaths: plan.concepts.map((artifact) => artifact.sourcePath),
+    evosCasePaths: plan.evosCases.map((artifact) => artifact.sourcePath),
+    overlayPathsToQuarantine: plan.overlaysToQuarantine.map((artifact) => artifact.sourcePath),
+    overlayPathsToRewrite: plan.overlaysToRewrite.map((artifact) => artifact.sourcePath),
+    totalArtifacts:
+      plan.concepts.length +
+      plan.evosCases.length +
+      plan.overlaysToQuarantine.length +
+      plan.overlaysToRewrite.length,
+  };
+}
+
+function createLegacyCleanupManifestItem(
+  artifact: LegacyCleanupArtifact,
+  quarantineDir: string,
+): {
+  kind: LegacyCleanupArtifactKind;
+  action: LegacyCleanupArtifactAction;
+  originalRelativePath: string;
+  quarantineRelativePath: string;
+  sha256: string;
+} {
+  const targetPath = resolveLegacyCleanupQuarantinePath(quarantineDir, artifact);
+  return {
+    kind: artifact.kind,
+    action: artifact.action,
+    originalRelativePath: artifact.relativePath,
+    quarantineRelativePath: relative(quarantineDir, targetPath).replace(/\\/gu, "/"),
+    sha256: artifact.sha256,
+  };
+}
+
+function resolveLegacyCleanupQuarantinePath(
+  quarantineDir: string,
+  artifact: LegacyCleanupArtifact,
+): string {
+  const filesDir = join(quarantineDir, "files");
+  const targetPath = join(filesDir, artifact.relativePath);
+  const targetRelative = relative(filesDir, targetPath);
+  if (targetRelative === "" || targetRelative.startsWith("..") || isAbsolute(targetRelative)) {
+    throw new Error(`Unsafe legacy cleanup quarantine path: ${artifact.relativePath}`);
+  }
+  return targetPath;
+}
+
+function isLegacyGeneratedOkfConcept(fileName: string, content: string): boolean {
+  const id = fileName.match(/^((?:k|evo)-[a-f0-9]{16})\.md$/u)?.[1];
+  if (id === undefined) return false;
+  if (!/^type: "EvoDev Evolution Case"$/mu.test(content)) return false;
+  if (!/^ {2}reviewState: "auto-accepted"$/mu.test(content)) return false;
+  if (!/^ {4}kind: "trace-distillation"$/mu.test(content)) return false;
+  if (!content.includes(`resource: "evodev://concepts/evos/${id}"`)) return false;
+  if (id.startsWith("k-")) {
+    return (
+      /^title: "Project run segment-run-[a-f0-9]{16} evidence summary"$/mu.test(content) &&
+      /^ {2}stableKey: "run-summary:[^"]+:k-[a-f0-9]{16}"$/mu.test(content) &&
+      content.includes(
+        "This record is derived from metadata-only evidence; active use depends on OKF plan review state.",
+      )
+    );
+  }
+  return (
+    /^title: "Run segment-run-[a-f0-9]{16} evolution case"$/mu.test(content) &&
+    /^ {2}stableKey: "evos:[^"]+:evo-[a-f0-9]{16}"$/mu.test(content) &&
+    content.includes(
+      "Future role agents should inspect accepted knowledge first and treat unreviewed cases as contextual evidence only.",
+    )
+  );
+}
+
+function isLegacyGeneratedEvosCase(content: string): boolean {
+  let value: unknown;
+  try {
+    value = JSON.parse(content) as unknown;
+  } catch {
+    return false;
+  }
+  if (!isRecord(value) || value.schemaVersion !== 1 || value.kind !== "evos-case") return false;
+  if (typeof value.id !== "string" || !/^evo-[a-f0-9]{16}$/u.test(value.id)) return false;
+  if (!isRecord(value.trigger) || typeof value.trigger.summary !== "string") return false;
+  if (!isRecord(value.intervention) || typeof value.intervention.summary !== "string") return false;
+  if (!isRecord(value.result) || typeof value.result.summary !== "string") return false;
+  if (!isRecord(value.provenance) || typeof value.provenance.runId !== "string") return false;
+  return (
+    /^Evolution distillation used (?:conditional|strong) trigger evidence: .+\.$/u.test(
+      value.trigger.summary,
+    ) &&
+    /^Collected \d+ metadata event\(s\) and \d+ episode\(s\) from EvoDev execution logs\.$/u.test(
+      value.intervention.summary,
+    ) &&
+    /^(?:No failure signal was detected in the redacted evidence summaries|\d+ potential failure or issue signal\(s\) were detected)\.$/u.test(
+      value.result.summary,
+    ) &&
+    value.expectedFutureBehavior ===
+      "Future role agents should inspect accepted knowledge first and treat unreviewed cases as contextual evidence only." &&
+    /^segment-run-[a-f0-9]{16}$/u.test(value.provenance.runId)
+  );
+}
+
+function removeLegacyOverlayLinks(content: string, conceptLinks: Set<string>): string {
+  if (conceptLinks.size === 0) return content;
+  const trailingNewline = content.endsWith("\n");
+  const lines = content.split("\n");
+  const filtered = lines.filter(
+    (line) =>
+      ![...conceptLinks].some(
+        (link) => line.trimStart().startsWith("- [") && line.includes(`](${link})`),
+      ),
+  );
+  const cleaned = filtered.join("\n");
+  return trailingNewline && !cleaned.endsWith("\n") ? `${cleaned}\n` : cleaned;
+}
+
+function isGeneratedEmptyScopeOverlay(content: string): boolean {
+  const frontmatter = extractFrontmatter(content);
+  if (frontmatter === null) return false;
+  if (!/type: "EvoDev (?:Repo|Role|Workflow) Attention"/u.test(frontmatter.frontmatter)) {
+    return false;
+  }
+  if (!/^ {4}kind: "okf-organizer"$/mu.test(frontmatter.frontmatter)) return false;
+  return (
+    frontmatter.body.replace(/\s+/gu, " ").trim() ===
+    "# Attention This overlay links scope-specific attention to canonical EvoDev knowledge. # Linked Core Knowledge"
+  );
+}
+
+async function rebuildEvolutionEvosIndexForCleanup(
+  homeDir: string,
+  updatedAt: string,
+): Promise<string> {
+  const paths = resolveEvoDevPaths(homeDir);
+  const result = await listEvolutionEvosCases({
+    homeDir,
+    reviewStates: [...REVIEW_STATES],
+  });
+  const grouped = new Map<
+    string,
+    Array<{ id: string; title: string; reviewState: EvolutionEvosCase["reviewState"] }>
+  >();
+  for (const evosCase of result.cases) {
+    grouped.set(evosCase.projectKey, [
+      ...(grouped.get(evosCase.projectKey) ?? []),
+      { id: evosCase.id, title: evosCase.title, reviewState: evosCase.reviewState },
+    ]);
+  }
+  await writeJson(
+    paths.evosIndexPath,
+    {
+      schemaVersion: 1,
+      updatedAt,
+      projects: [...grouped.entries()]
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([projectKey, cases]) => ({ projectKey, cases })),
+    },
+    { overwrite: true },
+  );
+  return paths.evosIndexPath;
+}
+
+function isAlreadyExistsError(error: unknown): boolean {
+  return error instanceof Error && "code" in error && error.code === "EEXIST";
+}
+
 async function listMarkdownFiles(root: string): Promise<Array<{ path: string; name: string }>> {
   if (!(await pathExists(root))) return [];
   const entries = await readdir(root, { withFileTypes: true });
@@ -4670,6 +5981,21 @@ async function listMarkdownFiles(root: string): Promise<Array<{ path: string; na
   return files;
 }
 
+async function listJsonFiles(root: string): Promise<Array<{ path: string; name: string }>> {
+  if (!(await pathExists(root))) return [];
+  const entries = await readdir(root, { withFileTypes: true });
+  const files: Array<{ path: string; name: string }> = [];
+  for (const entry of entries) {
+    const path = join(root, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...(await listJsonFiles(path)));
+    } else if (entry.isFile() && entry.name.endsWith(".json")) {
+      files.push({ path, name: entry.name });
+    }
+  }
+  return files;
+}
+
 async function listDirectories(root: string): Promise<string[]> {
   if (!(await pathExists(root))) return [];
   const entries = await readdir(root, { withFileTypes: true });