@gobing-ai/knowledge-kit 0.1.10 → 0.1.12

package/plugins/kk/scripts/daily-stages.ts

@@ -57,6 +57,7 @@ import {
     copyFileSync,
     existsSync,
     mkdirSync,
+    readdirSync,
     readFileSync,
     renameSync,
     rmSync,
@@ -64,7 +65,7 @@ import {
     unlinkSync,
     writeFileSync,
 } from 'node:fs';
-import { basename, join, resolve } from 'node:path';
+import { basename, isAbsolute, join, resolve } from 'node:path';
 import {
     ADMISSION_CRITERIA,
     applyTopicBoundary,
@@ -88,7 +89,6 @@ import {
     PII_FINDING_CATEGORY,
     pluginsArgs,
     readJson,
-    readSafetyReviseCount,
     readTopicBoundary,
     requireJson,
     requireSidecar,
@@ -135,11 +135,42 @@ export function dailyQcContent(args: string[]): void {
     const annotated = join(workDir, '21-plan', `${runDate}_04_quality-control-content_annotated.json`);
     const exclusions = join(workDir, '21-plan', `${runDate}_04_quality-control-content_exclusions.json`);
     const planContent = join(workDir, '21-plan', `${runDate}_03_plan_content.json`);
+    const cachePath = `${candidates}.cache.json`;
+    const fingerprint = stageCacheFingerprint(planContent, {
+        qcCategories,
+        minQuality,
+        minImportance,
+        minUrgency,
+        minImpact,
+        minEpisodeItems,
+        minMinutes,
+        vdriver,
+    });
+    let recomputed = false;
     timed(workDir, 'quality-control-content', () => {
-        if (isFile(candidates)) {
+        // Voice1's standalone QC tests and old workspaces may carry a candidates artifact without
+        // the newer plan input or sidecar. Preserve that explicitly cache-only surface; voice2
+        // always has planContent, so its stale/malformed cache is recomputed below.
+        const legacyCandidatesCache = isFile(candidates) && !isFile(planContent) && !isFile(cachePath);
+        if (stageCacheMatches(candidates, cachePath, fingerprint) || legacyCandidatesCache) {
             console.log(`candidates cached: ${candidates}`);
             return;
         }
+        if (isFile(candidates)) {
+            const descendants = authoredPlanDescendants(workDir, runDate);
+            if (descendants.length > 0) {
+                failWith(
+                    1,
+                    `QC cache changed after downstream artifacts were authored; refusing to pair new candidates with stale outputs (${descendants.join(', ')})`,
+                );
+            }
+            console.log(`candidates cache stale: ${candidates}`);
+        }
+        for (const stale of [exclusions, `${runDate}_04_quality-control-content_floor-refusal.json`].map((name) =>
+            name.startsWith('/') ? name : join(workDir, '21-plan', name),
+        )) {
+            if (isFile(stale)) unlinkSync(stale);
+        }
         sted('write', annotated, () => writeJqText(annotated, metadataOf(readJson(planContent)).docs ?? null));
         kk(
             [
@@ -164,6 +195,9 @@ export function dailyQcContent(args: string[]): void {
                 },
             },
         );
+        if (!isFile(candidates)) failWith(1, `quality-control-content: ${candidates} not written`);
+        sted('write', cachePath, () => writeStageCache(cachePath, fingerprint));
+        recomputed = true;
     });
     // Topic boundary (task 0189 R2) runs on every invocation — re-applying to already-filtered
     // candidates is a no-op, so cached reruns stay idempotent while a crash between the candidates
@@ -212,7 +246,48 @@ export function dailyQcContent(args: string[]): void {
     // already produced. 2026-10-22 cleared the floor on a 4-item pool (21.0 min estimated) that the
     // topic boundary then cut to 3 (14.4 min), so the run paid for a full synthesis the measured
     // gate refused. Covered here it also re-runs on a cached-rerun, which the timed block skipped.
-    applyFloorGate(candidates, workDir, runDate, minMinutes, vdriver);
+    applyFloorGate(candidates, workDir, runDate, minMinutes, vdriver, recomputed);
+}
+
+/**
+ * Cache only deterministic stage inputs. The source bytes are part of the key so a new collect
+ * pool or translated plan cannot inherit a prior run's refusal; the invocation parameters cover
+ * every threshold that changes the QC/floor result.
+ */
+function stageCacheFingerprint(sourcePath: string, inputs: Record<string, unknown>): string {
+    const source = isFile(sourcePath) ? readFileSync(sourcePath, 'utf-8') : '<missing>';
+    return createHash('sha256')
+        .update(JSON.stringify({ version: 1, source, inputs }))
+        .digest('hex');
+}
+
+function stageCacheMatches(outputPath: string, cachePath: string, fingerprint: string): boolean {
+    if (!isFile(outputPath) || !isFile(cachePath)) return false;
+    try {
+        const cache = JSON.parse(readFileSync(cachePath, 'utf-8')) as { version?: unknown; fingerprint?: unknown };
+        return cache.version === 1 && cache.fingerprint === fingerprint;
+    } catch {
+        return false;
+    }
+}
+
+function writeStageCache(path: string, fingerprint: string): void {
+    writeJsonText(path, { version: 1, fingerprint });
+}
+
+function authoredPlanDescendants(workDir: string, runDate: string): string[] {
+    const descendants: string[] = [];
+    for (const directory of ['22-article', '23-cover', '24-script', '30-audio', '31-publish']) {
+        const root = join(workDir, directory);
+        if (!existsSync(root)) continue;
+        // The directory contents are stage-owned artifacts. A date-prefixed file means that a
+        // previous non-empty run already authored downstream material that must not be silently
+        // paired with a newly generated plan.
+        for (const entry of readdirSync(root)) {
+            if (entry.startsWith(`${runDate}_`)) descendants.push(join(root, entry));
+        }
+    }
+    return descendants;
 }
 
 /**
@@ -261,18 +336,26 @@ function applyFloorGate(
     runDate: string,
     minMinutes: string,
     vdriver: string,
+    clearStaleRefusal = false,
 ): void {
+    const refusal = join(workDir, '21-plan', `${runDate}_04_quality-control-content_floor-refusal.json`);
     const floor = Number(minMinutes);
-    if (minMinutes === '' || !Number.isFinite(floor) || floor <= 0) return;
+    if (minMinutes === '' || !Number.isFinite(floor) || floor <= 0) {
+        if (clearStaleRefusal && isFile(refusal)) unlinkSync(refusal);
+        return;
+    }
     const content = readJson(candidates);
     const docs = metadataOf(content).docs;
-    if (!Array.isArray(docs) || docs.length === 0) return;
+    if (!Array.isArray(docs) || docs.length === 0) {
+        if (clearStaleRefusal && isFile(refusal)) unlinkSync(refusal);
+        return;
+    }
     const { minutes: estimatedMinutes, seconds: estimatedSeconds, chars } = estimateSpokenMinutes(docs, vdriver);
     if (estimatedSeconds >= floor * 60) {
+        if (clearStaleRefusal && isFile(refusal)) unlinkSync(refusal);
         console.log(`floor gate: estimated ${estimatedMinutes} min from ${chars} chars — above the ${floor} min floor`);
         return;
     }
-    const refusal = join(workDir, '21-plan', `${runDate}_04_quality-control-content_floor-refusal.json`);
     const ids = docs.map((doc) => String((doc as Record<string, unknown> | null)?.id ?? ''));
     sted('write', refusal, () =>
         writeJqText(refusal, {
@@ -632,13 +715,23 @@ function refuseScriptBelowFloor(
 }
 
 export function dailyEpisodeDuration(args: string[]): void {
-    const [workDir = '', runDate = '', minArg = '', maxArg = '', vdriver = ''] = args;
+    const [workDir = '', runDate = '', minArg = '', maxArg = '', vdriver = '', runId = ''] = args;
     if (!workDir) fail('missing work_dir');
     if (!runDate) fail('missing run_date');
     const minMinutes = Number(minArg);
     const maxMinutes = Number(maxArg);
     if (!Number.isFinite(minMinutes) || minMinutes <= 0) fail(`invalid min_minutes: ${minArg || '(empty)'}`);
     if (!Number.isFinite(maxMinutes) || maxMinutes < minMinutes) fail(`invalid max_minutes: ${maxArg || '(empty)'}`);
+    // 0329 F06: the publish path must not survive a refusal. The pool-gate token flips to EMPTY so
+    // this run's own remaining fan-out skips, and a stale bundle.json from an earlier run (whose
+    // runs[] a publish window could still consume) is dropped.
+    const invalidatePublishPath = (): void => {
+        if (runId !== '') {
+            const token = join('.spur', 'run', `${runId}-pool-gate.status`);
+            if (isFile(token)) sted('write', token, () => writeRaw(token, 'EMPTY\n'));
+        }
+        rmSync(join(workDir, 'bundle.json'), { force: true });
+    };
     const contentPath = join(workDir, '30-audio', `${runDate}_11_generate_content.json`);
     if (!isFile(contentPath)) failWith(1, `episode-duration: audio content not found: ${contentPath}`);
     let raw: unknown;
@@ -667,7 +760,8 @@ export function dailyEpisodeDuration(args: string[]): void {
         // let the pool-gated publish fan package a sub-floor episode — so finish the emptying here.
         if (isFile(refusal)) {
             if (docs.length > 0) emptyCandidates(workDir, runDate);
-            console.log(`episode-duration: duration refusal already recorded (${refusal}) — nothing to do`);
+            invalidatePublishPath();
+            console.error(`episode-duration: duration refusal already recorded (${refusal}) — nothing to do`);
             return;
         }
         const estimated = estimateSpokenMinutes(docs, vdriver);
@@ -683,6 +777,7 @@ export function dailyEpisodeDuration(args: string[]): void {
             }),
         );
         emptyCandidates(workDir, runDate);
+        invalidatePublishPath();
         console.error(
             `episode-duration: episode ran ${shown} min (estimate ${estimated.minutes} min), below the ${minMinutes}–${maxMinutes} min requirement — candidates emptied, the run closes as no-content (see ${refusal})`,
         );
@@ -1511,11 +1606,28 @@ export function dailyPlan(args: string[]): void {
     // translation. Voice1 omits the arg and still materializes the file (its translate node has no
     // skip guard and overwrites it).
     const deferDocs = deferPlanDocs === 'true';
+    const target = deferDocs ? planContent : planDocs;
+    const targetCache = `${target}.cache.json`;
+    const fingerprint = stageCacheFingerprint(blended, {
+        runDate,
+        planMaxItems,
+        deferPlanDocs,
+    });
     timed(workDir, 'plan', () => {
-        if (deferDocs ? isFile(planContent) : isFile(planDocs)) {
+        if (stageCacheMatches(target, targetCache, fingerprint)) {
             console.log(`plan cached: ${deferDocs ? planContent : planDocs}`);
             return;
         }
+        if (isFile(target)) {
+            const descendants = authoredPlanDescendants(workDir, runDate);
+            if (descendants.length > 0) {
+                failWith(
+                    1,
+                    `plan cache changed after downstream artifacts were authored; refusing to pair a new plan with stale outputs (${descendants.join(', ')})`,
+                );
+            }
+            console.log(`plan cache stale: ${target}`);
+        }
         kk(
             ['executor', 'run', 'episode-plan-gen', '--in', blended, '--out', planContent, ...pluginsArgs(pluginsPath)],
             {
@@ -1524,9 +1636,17 @@ export function dailyPlan(args: string[]): void {
         );
         const docs = metadataOf(readJson(planContent)).docs;
         if (!Array.isArray(docs) || docs.length === 0) failWith(1, 'plan: content.metadata.docs missing or empty');
-        if (deferDocs) return;
-        sted('write', planDocs, () => writeJsonText(planDocs, docs));
-        if (!isFile(planDocs)) failWith(1, `plan: ${planDocs} not written after episode-plan-gen`);
+        if (deferDocs) {
+            // A translated plan is a descendant of this content plan. Remove only the stale
+            // translation when no authored downstream artifact exists; otherwise the guard above
+            // fails closed and leaves the operator a reviewable workspace.
+            if (isFile(planDocs)) unlinkSync(planDocs);
+            if (isFile(`${planDocs}.cache.json`)) unlinkSync(`${planDocs}.cache.json`);
+        } else {
+            sted('write', planDocs, () => writeJsonText(planDocs, docs));
+            if (!isFile(planDocs)) failWith(1, `plan: ${planDocs} not written after episode-plan-gen`);
+        }
+        sted('write', targetCache, () => writeStageCache(targetCache, fingerprint));
     });
 }
 
@@ -1769,12 +1889,13 @@ export function buildSocialContent(
 
 /**
  * Length budgets the social authoring prompt targets, enforced here as a backstop (task 0327 R3).
- * X counts CJK at 2 (`weighted`); weibo and threads count characters.
+ * X counts CJK at 2 (`weighted`); weibo, threads and linkedin count characters.
  */
 const SOCIAL_LIMITS: Record<string, SocialLimit> = {
     x: { max: 280, weighted: true },
     weibo: { max: 2000 },
     threads: { max: 500 },
+    linkedin: { max: 3000 },
 };
 
 /** Variant key → file name: `social:x` becomes `social_x.content.json`. */
@@ -1783,27 +1904,36 @@ function variantFileName(key: string): string {
 }
 
 /**
- * `daily-bundle-variants <workDir> <runDate> <pluginsPath>` — the generate-side payload builder
- * (task 0327 R2/R3).
+ * `daily-bundle-variants <workDir> <runDate> <pluginsPath> [cardsEnabled] [coverEnabled]` — the
+ * generate-side payload builder (task 0327 R2/R3).
  *
  * Everything the publish side used to assemble inline is produced here instead, once, as bundle
  * variants under `30-variants/`. Links are the `{{article_url}}` / `{{podcast_url}}` placeholders,
  * because at generate time nothing is published yet; `publish-matrix-send` resolves them from the
  * tier-0 receipts. A variant whose source artifact is absent (channel disabled, cards never
  * rendered, social copy not authored) is skipped with a log line, never invented.
+ *
+ * 0329 F16: the caller forwards the run's `cards_enabled` / `cover_enabled` switches — a disabled
+ * producer's variant is a skip, not a stale re-read of a previous run's file — and every stale
+ * variant file is wiped before writing, so `30-variants/` after this stage contains only what
+ * THIS pass produced.
  */
 export function dailyBundleVariants(args: string[]): void {
-    const [workDir = '', runDate = '', _pluginsPath = ''] = args;
+    const [workDir = '', runDate = '', _pluginsPath = '', cardsEnabledArg = '', coverEnabledArg = ''] = args;
     timed(workDir, 'bundle-variants', () => {
         const outDir = join(workDir, '30-variants');
         sted('mkdir', outDir, () => mkdirSync(outDir, { recursive: true }));
+        // 0329 F16: a rerun after a thinner day must not leave yesterday's variants behind.
+        for (const entry of readdirSync(outDir)) {
+            if (entry.endsWith('.content.json')) rmSync(join(outDir, entry), { force: true });
+        }
         const articlePath = join(workDir, '22-article', `${runDate}_06_article_content.json`);
         const prepPath = join(workDir, '31-publish', `${runDate}_13_publish-prep_content.json`);
         const notesPath = join(workDir, '31-publish', `${runDate}_15_show-notes_show-notes.md`);
         const cardsPath = join(workDir, '25-xhs', 'content.json');
         const coverPath = join(workDir, '23-cover', `${runDate}_07_cover_cover.png`);
         const socialDir = join(workDir, '26-social');
-        const cover = isFile(coverPath) ? coverPath : undefined;
+        const cover = coverEnabledArg !== 'false' && isFile(coverPath) ? coverPath : undefined;
         const links = PLACEHOLDER_LINKS;
         const written: string[] = [];
         const skipped: string[] = [];
@@ -1857,9 +1987,12 @@ export function dailyBundleVariants(args: string[]): void {
             );
         }
 
-        const cards = readJson(cardsPath);
-        if (cards === null) skipped.push('cards (no rendered card series)');
-        else write('cards@xhs-pub', buildXhsCardsContent(cards, { publishStatus: 'draft' }));
+        if (cardsEnabledArg === 'false') skipped.push('cards (cards_enabled=false)');
+        else {
+            const cards = readJson(cardsPath);
+            if (cards === null) skipped.push('cards (no rendered card series)');
+            else write('cards@xhs-pub', buildXhsCardsContent(cards, { publishStatus: 'draft' }));
+        }
 
         for (const platform of Object.keys(SOCIAL_LIMITS)) {
             const copyPath = join(socialDir, `${platform}.md`);
@@ -1915,19 +2048,40 @@ export function readKeyPointItems(filePath: string): string[] | undefined {
     }
     const block = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw)?.[1];
     if (!block) return undefined;
-    // Slice from `key_points` to the first top-level key (or block end), then take the item lines
-    // (`- `), so folded (`>-`) and quoted single-line items both read once.
+    // Slice from `key_points` to the first top-level key (or block end), then read the item lines
+    // (`- `). Folded (`>-`) YAML items need their indented continuation lines joined before the
+    // strict scheduled validator can check the `Label — sentence` contract.
     const head = /^key_points:\n/m.exec(block);
     if (!head) return undefined;
     const body = block.slice(head.index + head[0].length);
     const endMatch = /^\S/m.exec(body);
     const list = endMatch ? body.slice(0, endMatch.index) : body;
-    // A quoted scalar's quotes are YAML syntax, not text — strip them so label lengths are real.
-    return list
-        .split('\n')
-        .filter((line) => /^[ \t]+- /.test(line))
-        .map((line) => line.replace(/^[ \t]+- /, '').trim())
-        .map((item) => item.replace(/^(["'])(.*)\1$/, '$2'));
+    const items: string[] = [];
+    let current: string | undefined;
+    let folded = false;
+    const flush = (): void => {
+        if (current === undefined) return;
+        // A quoted scalar's quotes are YAML syntax, not text — strip them so label lengths are real.
+        items.push(current.replace(/^(['"])(.*)\1$/, '$2').trim());
+        current = undefined;
+        folded = false;
+    };
+    for (const line of list.split('\n')) {
+        const item = /^[ \t]+- (.*)$/.exec(line);
+        if (item !== null) {
+            flush();
+            current = item[1].trim();
+            folded = current === '>' || current === '>-' || current === '|-' || current === '|';
+            // The block indicator is YAML syntax, not text: the item starts on the next line.
+            if (folded) current = '';
+            continue;
+        }
+        if (current === undefined || !folded) continue;
+        const continuation = line.trim();
+        if (continuation !== '') current = `${current} ${continuation}`;
+    }
+    flush();
+    return items;
 }
 
 /** Count `key_points` list items in a Surfing post's frontmatter; undefined when absent/unreadable. */
@@ -2113,36 +2267,662 @@ export function dailyPublishPrep(args: string[]): void {
     });
 }
 
+type SurfdashDeliveryState = 'missing' | 'success' | 'failure' | 'uncertain';
+
+interface SurfdashSendIntent {
+    version: 1;
+    target: 'surfdash-pub';
+    runDate: string;
+    payloadPath: string;
+    payloadSha256: string;
+    createdAt: string;
+}
+
+function surfdashPayloadSha256(path: string): string {
+    return createHash('sha256').update(readFileSync(path)).digest('hex');
+}
+
+function surfdashNotSentReceipt(resultPath: string, intentPath: string, runDate: string, reason: string): void {
+    const error = `surfdash publish was not sent: ${reason}`;
+    sted('write', resultPath, () =>
+        writeJsonText(resultPath, {
+            ok: false,
+            summary: { total: 1, succeeded: 0, failed: 1, skipped: 0 },
+            targets: [
+                {
+                    target: 'surfdash-pub',
+                    ok: false,
+                    status: 'failed',
+                    error,
+                    metadata: { deliveryState: 'not-sent', runDate, intentPath },
+                },
+            ],
+        }),
+    );
+    console.error(error);
+}
+
+function readSurfdashSendIntent(
+    path: string,
+): { kind: 'missing' } | { kind: 'valid'; value: SurfdashSendIntent } | { kind: 'invalid'; reason: string } {
+    if (!isFile(path)) return { kind: 'missing' };
+    const parsed = readJson(path);
+    if (parsed === null) return { kind: 'invalid', reason: 'send intent is unreadable or invalid JSON' };
+    if (
+        parsed.version !== 1 ||
+        parsed.target !== 'surfdash-pub' ||
+        typeof parsed.runDate !== 'string' ||
+        typeof parsed.payloadPath !== 'string' ||
+        typeof parsed.createdAt !== 'string' ||
+        typeof parsed.payloadSha256 !== 'string' ||
+        !/^[0-9a-f]{64}$/.test(parsed.payloadSha256)
+    ) {
+        return { kind: 'invalid', reason: 'send intent is malformed' };
+    }
+    return { kind: 'valid', value: parsed as unknown as SurfdashSendIntent };
+}
+
+function surfdashTargetEntries(result: Record<string, unknown> | null): Record<string, unknown>[] {
+    const targets = result?.targets;
+    if (!Array.isArray(targets)) return [];
+    return targets.filter(
+        (entry): entry is Record<string, unknown> =>
+            entry !== null && typeof entry === 'object' && (entry as Record<string, unknown>).target === 'surfdash-pub',
+    );
+}
+
+/** A push can have reached the remote even when the publisher reports a failed receipt. */
+function surfdashFailureMayHaveRemoteEffect(entry: Record<string, unknown>): boolean {
+    return (
+        entry.ok === false &&
+        entry.status === 'failed' &&
+        (entry.metadata as Record<string, unknown> | undefined)?.deliveryState !== 'not-sent'
+    );
+}
+
+function surfdashTargetState(result: Record<string, unknown> | null): SurfdashDeliveryState {
+    const matches = surfdashTargetEntries(result);
+    if (matches.length === 0) return 'missing';
+    // More than one receipt for the same target is ambiguous even when every row says success:
+    // retrying could duplicate a remote post. Preserve the uncertainty until reconciliation.
+    if (matches.length > 1) return 'uncertain';
+    if (
+        matches.some(
+            (entry) =>
+                (entry.metadata as Record<string, unknown> | undefined)?.deliveryState === 'uncertain' ||
+                surfdashFailureMayHaveRemoteEffect(entry),
+        )
+    ) {
+        return 'uncertain';
+    }
+    const target = matches[0];
+    if (target.ok === true && target.status === 'published') return 'success';
+    if (target.ok === false && target.status === 'failed') return 'failure';
+    return 'missing';
+}
+
+function writeSurfdashUncertainReceipt(
+    resultPath: string,
+    intentPath: string,
+    runDate: string,
+    payloadSha256: string | undefined,
+    currentPayloadSha256: string | undefined,
+    reason: string,
+    identity: { postPath?: string; localeFingerprint?: string } = {},
+): void {
+    const metadata: Record<string, unknown> = {
+        deliveryState: 'uncertain',
+        runDate,
+        intentPath,
+        ...(payloadSha256 ? { payloadSha256 } : {}),
+        ...(currentPayloadSha256 ? { currentPayloadSha256 } : {}),
+        ...(identity.postPath ? { postPath: identity.postPath } : {}),
+        ...(identity.localeFingerprint ? { localeFingerprint: identity.localeFingerprint } : {}),
+    };
+    const error = `surfdash delivery is uncertain: ${reason}; reconcile the dated remote post/commit before clearing this uncertainty and retrying`;
+    sted('write', resultPath, () =>
+        writeJsonText(resultPath, {
+            ok: false,
+            summary: { total: 1, succeeded: 0, failed: 1, skipped: 0 },
+            targets: [
+                {
+                    target: 'surfdash-pub',
+                    ok: false,
+                    status: 'failed',
+                    error,
+                    metadata,
+                },
+            ],
+        }),
+    );
+    console.error(error);
+}
+
+const SURFDASH_LOCALES = ['zh', 'en', 'ja'] as const;
+type SurfdashLocale = (typeof SURFDASH_LOCALES)[number];
+
+interface SurfdashLocaleValidationEvidence {
+    runDate: string;
+    postPath: string;
+    localePaths: Record<SurfdashLocale, string>;
+    localeDigests: Record<SurfdashLocale, string>;
+    fingerprint: string;
+}
+
+interface SurfdashPublishIdentity {
+    postPath: string;
+    payloadSha256: string;
+    localeFingerprint: string;
+}
+
+function surfdashPublishIdentity(entry: Record<string, unknown> | undefined): SurfdashPublishIdentity | undefined {
+    if (entry === undefined) return undefined;
+    const metadata = metadataOf(entry);
+    if (
+        typeof metadata.postPath !== 'string' ||
+        typeof metadata.payloadSha256 !== 'string' ||
+        !/^[0-9a-f]{64}$/.test(metadata.payloadSha256) ||
+        typeof metadata.localeFingerprint !== 'string' ||
+        !/^[0-9a-f]{64}$/.test(metadata.localeFingerprint)
+    ) {
+        return undefined;
+    }
+    return {
+        postPath: metadata.postPath,
+        payloadSha256: metadata.payloadSha256,
+        localeFingerprint: metadata.localeFingerprint,
+    };
+}
+
+function localeSiblingPaths(zhPostPath: string): Record<SurfdashLocale, string> | undefined {
+    if (!zhPostPath.includes('/zh/')) return undefined;
+    const en = zhPostPath.replace('/zh/', '/en/');
+    const ja = zhPostPath.replace('/zh/', '/ja/');
+    if (en === zhPostPath || ja === zhPostPath) return undefined;
+    return { zh: zhPostPath, en, ja };
+}
+
+function validateLocaleMarkers(workDir: string, runDate: string, zhPostPath: string, step: string): void {
+    const localePaths = localeSiblingPaths(zhPostPath);
+    if (localePaths === undefined) {
+        failWith(1, `${step}: zh post path does not contain a /zh/ locale segment: ${zhPostPath}`);
+    }
+    for (const locale of ['en', 'ja'] as const) {
+        const marker = join(workDir, '31-publish', `${runDate}_20_translate-localize_${locale}-post-path.txt`);
+        const markerPath = isFile(marker) ? readFileSync(marker, 'utf-8').trim() : '';
+        const expectedPath = localePaths[locale];
+        if (markerPath === '' || !isAbsolute(markerPath) || markerPath !== expectedPath || !isFile(expectedPath)) {
+            failWith(1, `${step}: ${locale} marker must name the absolute derived sibling ${expectedPath}: ${marker}`);
+        }
+    }
+}
+
+function surfdashLocaleValidationEvidence(
+    zhPostPath: string,
+    runDate: string,
+): { ok: true; evidence: SurfdashLocaleValidationEvidence } | { ok: false; reason: string } {
+    const localePaths = localeSiblingPaths(zhPostPath);
+    if (localePaths === undefined) {
+        return { ok: false, reason: `zh post path does not contain a /zh/ locale segment: ${zhPostPath}` };
+    }
+    const localeDigests = {} as Record<SurfdashLocale, string>;
+    for (const locale of SURFDASH_LOCALES) {
+        const path = localePaths[locale];
+        if (!isFile(path)) return { ok: false, reason: `${locale} locale file is missing: ${path}` };
+        try {
+            localeDigests[locale] = createHash('sha256').update(readFileSync(path)).digest('hex');
+        } catch (error: unknown) {
+            return {
+                ok: false,
+                reason: `${locale} locale file cannot be fingerprinted: ${error instanceof Error ? error.message : String(error)}`,
+            };
+        }
+    }
+    const identity = { runDate, postPath: zhPostPath, localePaths, localeDigests };
+    return {
+        ok: true,
+        evidence: {
+            ...identity,
+            fingerprint: createHash('sha256').update(JSON.stringify(identity)).digest('hex'),
+        },
+    };
+}
+
+function validateSurfdashLocaleGate(
+    validationPath: string,
+    prepareResultPath: string,
+    runDate: string,
+): { ok: true; evidence: SurfdashLocaleValidationEvidence } | { ok: false; reason: string } {
+    const validation = isFile(validationPath) ? readJson(validationPath) : null;
+    if (validation?.ok !== true || validation.target !== 'surfdash-pub' || validation.status !== 'validated') {
+        return { ok: false, reason: `missing or invalid validation receipt: ${validationPath}` };
+    }
+    const metadata = metadataOf(validation);
+    if (metadata.runDate !== runDate || typeof metadata.postPath !== 'string') {
+        return { ok: false, reason: `validation receipt date/path does not match run ${runDate}` };
+    }
+    const prepared = isFile(prepareResultPath) ? readJson(prepareResultPath) : null;
+    const preparedTargets = Array.isArray(prepared?.targets)
+        ? prepared.targets.filter(
+              (entry): entry is Record<string, unknown> =>
+                  entry !== null &&
+                  typeof entry === 'object' &&
+                  (entry as Record<string, unknown>).target === 'surfdash-pub',
+          )
+        : [];
+    if (
+        preparedTargets.length !== 1 ||
+        preparedTargets[0].ok !== true ||
+        preparedTargets[0].status !== 'prepared' ||
+        metadataOf(preparedTargets[0]).postPath !== metadata.postPath
+    ) {
+        return { ok: false, reason: `current Surfdash prepare receipt is missing or does not match ${validationPath}` };
+    }
+    const current = surfdashLocaleValidationEvidence(metadata.postPath, runDate);
+    if (!current.ok) return current;
+    const recordedPaths = metadata.localePaths;
+    const recordedDigests = metadata.localeDigests;
+    if (
+        recordedPaths === null ||
+        typeof recordedPaths !== 'object' ||
+        recordedDigests === null ||
+        typeof recordedDigests !== 'object' ||
+        typeof metadata.fingerprint !== 'string'
+    ) {
+        return { ok: false, reason: `validation receipt fingerprint is missing or malformed: ${validationPath}` };
+    }
+    if (
+        JSON.stringify(recordedPaths) !== JSON.stringify(current.evidence.localePaths) ||
+        JSON.stringify(recordedDigests) !== JSON.stringify(current.evidence.localeDigests) ||
+        metadata.fingerprint !== current.evidence.fingerprint
+    ) {
+        return { ok: false, reason: `locale files changed after validation; refresh ${validationPath}` };
+    }
+    return current;
+}
+
 export function dailyPublishSurfdash(args: string[]): void {
-    const [workDir = '', runDate = '', pluginsPath = ''] = args;
+    const [workDir = '', runDate = '', pluginsPath = '', requireLocaleValidation = 'false'] = args;
     const prep = join(workDir, '31-publish', `${runDate}_13_publish-prep_content.json`);
     const result = join(workDir, '31-publish', `${runDate}_14_publish-surfdash_result.json`);
+    const intentPath = join(workDir, '31-publish', `${runDate}_14_publish-surfdash_intent.json`);
+    const prepareResult = join(workDir, '31-publish', `${runDate}_14_publish-surfdash-prepare_result.json`);
+    const validationPath = join(workDir, '31-publish', `${runDate}_24_translate-validate_result.json`);
+    const preparedInput = join(workDir, '31-publish', `${runDate}_14_publish-surfdash_prepared_content.json`);
+    const transportResult = join(workDir, '31-publish', `${runDate}_14_publish-surfdash_transport_result.json`);
     timed(workDir, 'publish-surfdash', () => {
-        if (targetPublished(result, 'surfdash-pub')) {
+        const priorResult = readJson(result);
+        const priorTargets = surfdashTargetEntries(priorResult);
+        const priorState = surfdashTargetState(priorResult);
+        if (priorState === 'uncertain') {
+            const priorTarget = priorTargets[0];
+            if (
+                priorTarget !== undefined &&
+                (priorTarget.metadata as Record<string, unknown> | undefined)?.deliveryState !== 'uncertain'
+            ) {
+                const priorError =
+                    typeof priorTarget.error === 'string'
+                        ? priorTarget.error
+                        : 'publisher reported an ambiguous delivery failure';
+                writeSurfdashUncertainReceipt(result, intentPath, runDate, undefined, undefined, priorError);
+            }
+            console.log(`publish-surfdash blocked: uncertain delivery is sticky in ${result}`);
+            return;
+        }
+
+        // The two-phase voice2 workflow explicitly requires a successful local locale gate before
+        // the publisher can invoke refine/CMS/git. Legacy voice1/manual callers omit the fourth
+        // argument and retain their historical publish behavior.
+        let currentIdentity: SurfdashPublishIdentity | undefined;
+        let currentLocaleEvidence: SurfdashLocaleValidationEvidence | undefined;
+        if (requireLocaleValidation === 'true') {
+            const validation = validateSurfdashLocaleGate(validationPath, prepareResult, runDate);
+            if (!validation.ok) {
+                const detail = validation.reason;
+                if (priorState === 'success') {
+                    writeSurfdashUncertainReceipt(
+                        result,
+                        intentPath,
+                        runDate,
+                        undefined,
+                        undefined,
+                        `current locale validation is not the one used for the cached success: ${detail}`,
+                    );
+                } else {
+                    surfdashNotSentReceipt(result, intentPath, runDate, `blocked by locale validation: ${detail}`);
+                }
+                return;
+            }
+            currentLocaleEvidence = validation.evidence;
+            if (!isFile(prep)) {
+                const detail = `prepared payload is missing: ${prep}`;
+                if (priorState === 'success') {
+                    writeSurfdashUncertainReceipt(result, intentPath, runDate, undefined, undefined, detail);
+                } else {
+                    surfdashNotSentReceipt(result, intentPath, runDate, detail);
+                }
+                return;
+            }
+            currentIdentity = {
+                postPath: validation.evidence.postPath,
+                payloadSha256: surfdashPayloadSha256(prep),
+                localeFingerprint: validation.evidence.fingerprint,
+            };
+        }
+
+        if (priorState === 'success') {
+            // Voice1 and manual callers omit the locale-validation argument and historically
+            // treated a recorded success as a resume-safe cache hit. Voice2 supplies `true` and
+            // must keep the exact identity binding below; do not make the legacy surface depend
+            // on the new locale fingerprint receipt.
+            if (requireLocaleValidation !== 'true') {
+                console.log(`publish-surfdash cached: surfdash target ok in ${result}`);
+                return;
+            }
+            const cachedIdentity = surfdashPublishIdentity(priorTargets[0]);
+            if (
+                currentIdentity === undefined ||
+                cachedIdentity === undefined ||
+                cachedIdentity.postPath !== currentIdentity.postPath ||
+                cachedIdentity.payloadSha256 !== currentIdentity.payloadSha256 ||
+                cachedIdentity.localeFingerprint !== currentIdentity.localeFingerprint
+            ) {
+                writeSurfdashUncertainReceipt(
+                    result,
+                    intentPath,
+                    runDate,
+                    cachedIdentity?.payloadSha256,
+                    currentIdentity?.payloadSha256,
+                    'cached success has no exact postPath/payloadSha256/localeFingerprint identity for the current material',
+                    currentIdentity,
+                );
+                return;
+            }
             console.log(`publish-surfdash cached: surfdash target ok in ${result}`);
             return;
         }
-        kk(
-            [
-                'executor',
-                'fan-out',
-                '--content',
-                prep,
-                '--target',
-                'surfdash-pub',
-                '--out',
+
+        const intent = readSurfdashSendIntent(intentPath);
+        if (intent.kind === 'invalid') {
+            writeSurfdashUncertainReceipt(result, intentPath, runDate, undefined, undefined, intent.reason);
+            return;
+        }
+
+        let payloadSha256: string | undefined = currentIdentity?.payloadSha256;
+        if (intent.kind === 'valid') {
+            if (intent.value.runDate !== runDate) {
+                writeSurfdashUncertainReceipt(
+                    result,
+                    intentPath,
+                    runDate,
+                    intent.value.payloadSha256,
+                    undefined,
+                    `send intent run date ${intent.value.runDate} does not match requested run date ${runDate}`,
+                );
+                return;
+            }
+            // An existing intent binds this dated post to the original bytes. A changed payload is
+            // never allowed to overwrite the same slug after an interrupted remote send.
+            if (isFile(prep)) payloadSha256 = surfdashPayloadSha256(prep);
+            if (payloadSha256 !== undefined && payloadSha256 !== intent.value.payloadSha256) {
+                writeSurfdashUncertainReceipt(
+                    result,
+                    intentPath,
+                    runDate,
+                    intent.value.payloadSha256,
+                    payloadSha256,
+                    'prepared payload changed after the send intent',
+                );
+                return;
+            }
+            if (priorState === 'missing') {
+                writeSurfdashUncertainReceipt(
+                    result,
+                    intentPath,
+                    runDate,
+                    intent.value.payloadSha256,
+                    payloadSha256,
+                    'no publish result was recorded after the prior send intent',
+                );
+                return;
+            }
+            if (payloadSha256 === undefined) {
+                writeSurfdashUncertainReceipt(
+                    result,
+                    intentPath,
+                    runDate,
+                    intent.value.payloadSha256,
+                    undefined,
+                    'prepared payload is missing, so the original request cannot be replayed safely',
+                );
+                return;
+            }
+        } else {
+            if (!isFile(prep)) failWith(1, `publish-surfdash: required input not found: ${prep}`);
+            payloadSha256 = surfdashPayloadSha256(prep);
+            const sendIntent: SurfdashSendIntent = {
+                version: 1,
+                target: 'surfdash-pub',
+                runDate,
+                payloadPath: prep,
+                payloadSha256,
+                createdAt: new Date().toISOString(),
+            };
+            sted('write', intentPath, () => writeJsonText(intentPath, sendIntent));
+        }
+
+        if (requireLocaleValidation === 'true' && currentIdentity !== undefined) {
+            const prepared = requireJson(prep, 'publish-surfdash');
+            sted('write', preparedInput, () =>
+                writeJqText(preparedInput, {
+                    ...prepared,
+                    options: {
+                        operation: 'publish-prepared',
+                        postPath: currentIdentity.postPath,
+                        runDate,
+                        expectedPostSha256: currentLocaleEvidence.localeDigests.zh,
+                        expectedLocaleFingerprint: currentIdentity.localeFingerprint,
+                    },
+                }),
+            );
+            // `kk executor run` normally clears --out itself, but a discovery failure can return
+            // before the executor owns that path. Remove any previous transport receipt here so a
+            // stale success can never be promoted into this invocation's publish result.
+            rmSync(transportResult, { force: true });
+            kk(
+                [
+                    'executor',
+                    'run',
+                    'surfdash-pub',
+                    '--in',
+                    preparedInput,
+                    '--out',
+                    transportResult,
+                    ...pluginsArgs(pluginsPath),
+                ],
+                {
+                    unset: NESTED_SPUR_UNSET,
+                    env: { SURFDASH_LOCALE: 'zh' },
+                    soft: true,
+                },
+            );
+            const transported = readJson(transportResult);
+            const identityMetadata = {
+                postPath: currentIdentity.postPath,
+                payloadSha256: currentIdentity.payloadSha256,
+                localeFingerprint: currentIdentity.localeFingerprint,
+                runDate,
+            };
+            if (transported?.ok === true) {
+                sted('write', result, () =>
+                    writeJsonText(result, {
+                        ok: true,
+                        summary: { total: 1, succeeded: 1, failed: 0, skipped: 0 },
+                        targets: [
+                            {
+                                target: 'surfdash-pub',
+                                ok: true,
+                                status: 'published',
+                                ...(typeof transported.url === 'string' ? { url: transported.url } : {}),
+                                metadata: { ...metadataOf(transported), ...identityMetadata },
+                            },
+                        ],
+                    }),
+                );
+            } else if (transported?.ok === false && metadataOf(transported).deliveryState === 'not-sent') {
+                sted('write', result, () =>
+                    writeJsonText(result, {
+                        ok: false,
+                        summary: { total: 1, succeeded: 0, failed: 1, skipped: 0 },
+                        targets: [
+                            {
+                                target: 'surfdash-pub',
+                                ok: false,
+                                status: 'failed',
+                                error:
+                                    typeof transported.error === 'string'
+                                        ? transported.error
+                                        : 'publisher rejected the prepared post',
+                                metadata: {
+                                    ...metadataOf(transported),
+                                    ...identityMetadata,
+                                    deliveryState: 'not-sent',
+                                },
+                            },
+                        ],
+                    }),
+                );
+            } else {
+                writeSurfdashUncertainReceipt(
+                    result,
+                    intentPath,
+                    runDate,
+                    payloadSha256,
+                    payloadSha256,
+                    typeof transported?.error === 'string'
+                        ? `publisher reported an ambiguous delivery failure: ${transported.error}`
+                        : 'no publish result was recorded after prepared dispatch',
+                    currentIdentity,
+                );
+            }
+        } else {
+            kk(
+                [
+                    'executor',
+                    'fan-out',
+                    '--content',
+                    prep,
+                    '--target',
+                    'surfdash-pub',
+                    '--out',
+                    result,
+                    ...pluginsArgs(pluginsPath),
+                ],
+                {
+                    unset: NESTED_SPUR_UNSET,
+                    env: { SURFDASH_LOCALE: 'zh' },
+                    soft: true,
+                },
+            );
+        }
+
+        // A killed or unusable child can leave a real remote commit with no aggregate receipt. The
+        // intent now makes that state explicit; the next invocation will refuse to dispatch again.
+        const afterState = surfdashTargetState(readJson(result));
+        if (afterState === 'missing' || afterState === 'uncertain') {
+            const afterTarget = surfdashTargetEntries(readJson(result))[0];
+            const afterError =
+                afterState === 'uncertain' && afterTarget !== undefined && typeof afterTarget.error === 'string'
+                    ? `publisher reported an ambiguous delivery failure: ${afterTarget.error}`
+                    : 'no publish result was recorded after dispatch';
+            writeSurfdashUncertainReceipt(
                 result,
-                ...pluginsArgs(pluginsPath),
-            ],
-            {
-                unset: NESTED_SPUR_UNSET,
-                soft: true,
-            },
-        );
+                intentPath,
+                runDate,
+                payloadSha256,
+                payloadSha256,
+                afterError,
+                currentIdentity,
+            );
+        }
         console.log('publish-surfdash: surfdash target dispatched; classification happens after podcast publish');
     });
 }
 
+/**
+ * Prepare the local zh post before locale scaffolding/translation. This stage deliberately stops
+ * at the publisher's file-materialization seam; the normal `publish-surfdash` stage remains the
+ * only operation allowed to invoke Surfdash's refine/CMS/git publishing path.
+ */
+export function dailyPrepareSurfdash(args: string[]): void {
+    const [workDir = '', runDate = '', pluginsPath = ''] = args;
+    const prep = join(workDir, '31-publish', `${runDate}_13_publish-prep_content.json`);
+    const input = join(workDir, '31-publish', `${runDate}_14_publish-surfdash-prepare_content.json`);
+    const result = join(workDir, '31-publish', `${runDate}_14_publish-surfdash-prepare_result.json`);
+    const transportResult = join(workDir, '31-publish', `${runDate}_14_publish-surfdash-prepare-transport_result.json`);
+    timed(workDir, 'prepare-surfdash', () => {
+        try {
+            if (!isFile(prep)) failWith(1, `prepare-surfdash: required input not found: ${prep}`);
+            const content = requireJson(prep, 'prepare-surfdash');
+            sted('write', input, () => writeJqText(input, { ...content, options: { operation: 'prepare' } }));
+            kk(
+                [
+                    'executor',
+                    'run',
+                    'surfdash-pub',
+                    '--in',
+                    input,
+                    '--out',
+                    transportResult,
+                    ...pluginsArgs(pluginsPath),
+                ],
+                {
+                    unset: NESTED_SPUR_UNSET,
+                    // The scheduled source post is always zh. Do not let a caller's inherited
+                    // locale select an en/ja materialization and then make the sibling gate
+                    // compare the wrong source tree.
+                    env: { SURFDASH_LOCALE: 'zh' },
+                },
+            );
+            const prepared = readJson(transportResult);
+            const postPath = metadataOf(prepared).postPath;
+            if (prepared?.ok !== true || typeof postPath !== 'string') {
+                failWith(1, `prepare-surfdash: publisher did not return a prepared zh post path: ${transportResult}`);
+            }
+            if (postPath === '' || !isFile(postPath)) {
+                failWith(1, `prepare-surfdash: publisher did not return a prepared zh post path: ${result}`);
+            }
+            sted('write', result, () =>
+                writeJqText(result, {
+                    ok: true,
+                    summary: { total: 1, succeeded: 1, failed: 0, skipped: 0 },
+                    targets: [
+                        {
+                            target: 'surfdash-pub',
+                            ok: true,
+                            status: 'prepared',
+                            ...(typeof prepared?.url === 'string' ? { url: prepared.url } : {}),
+                            metadata: metadataOf(prepared),
+                        },
+                    ],
+                }),
+            );
+            console.log(`prepare-surfdash: prepared zh post ${postPath}`);
+        } catch (error: unknown) {
+            if (error instanceof StageFailure && error.status === 127) throw error;
+            const message = error instanceof Error ? error.message : String(error);
+            sted('write', result, () =>
+                writeJqText(result, {
+                    ok: false,
+                    summary: { total: 1, succeeded: 0, failed: 1, skipped: 0 },
+                    targets: [{ target: 'surfdash-pub', ok: false, status: 'failed', error: message }],
+                }),
+            );
+            console.error(message);
+        }
+    });
+}
+
 /**
  * WeChat MP: drive the console via `wechatmp-pub`'s browser transport and save the article to the
  * draft box (草稿箱). Draft by default; the 发表 flow runs only on an explicit launch-time
@@ -2327,6 +3107,30 @@ export function dailyQualityReport(args: string[]): void {
     });
 }
 
+/**
+ * 0329 F23 — the verdict half of `quality`. The report only printed, so a failed audio qc sailed
+ * on into show-notes, the bundle and the publish windows (2026-10-25: an episode at 41/100 was
+ * packaged and queued for tier-0 sends). Reads the same `metadata.qc` as `daily-quality-report`
+ * and fails loud when the verdict is missing or `passed` is false.
+ */
+export function dailyQualityVerdict(args: string[]): void {
+    const [workDir = '', runDate = ''] = args;
+    const content = join(workDir, '30-audio', `${runDate}_11_generate_content.json`);
+    timed(workDir, 'quality-verdict', () => {
+        if (!isFile(content)) failWith(1, `quality-verdict: no audio content: ${content}`);
+        const qc = metadataOf(readJson(content)).qc as Record<string, unknown> | undefined;
+        if (qc === undefined) failWith(1, `quality-verdict: no qc verdict in ${content}`);
+        if (qc.passed !== true) {
+            const issues = Array.isArray(qc.criticalIssues) ? qc.criticalIssues : [];
+            failWith(
+                1,
+                `quality-verdict: audio qc failed (overallScore ${String(qc.overallScore ?? '?')}) — ${issues.map(String).join('; ') || 'no issue detail on the verdict'}`,
+            );
+        }
+        console.log(`quality-verdict: audio qc passed (overallScore ${String(qc.overallScore ?? '?')})`);
+    });
+}
+
 /**
  * 0171 R3: Apple Podcasts reads the enclosure's ID3 tags, so the published MP3 carries
  * title/artist/album/date. `-c copy` moves the audio frames without a re-encode, and the temp
@@ -2357,18 +3161,19 @@ export function dailyQualityReport(args: string[]): void {
  * Fail-closed where it matters: a missing report, verdict or confidence still blocks.
  */
 export function dailySafetyGate(args: string[]): void {
-    const [workDir = '', runDate = '', maxReviseArg = '0'] = args;
+    const [workDir = '', runDate = '', maxReviseArg = '0', scopeDir = ''] = args;
+    const drafts = isDraftsScope(scopeDir);
     const maxRevise = Number.parseInt(maxReviseArg, 10);
-    const statusFile = safetyPath(workDir, runDate, 'safety-judge_status.txt');
-    const stampFile = safetyPath(workDir, runDate, 'safety-judge_stamp.json');
+    const statusFile = scopeArtifact(workDir, scopeDir, runDate, 'safety-judge_status.txt');
+    const stampFile = scopeArtifact(workDir, scopeDir, runDate, 'safety-judge_stamp.json');
     timed(workDir, 'safety-judge', () => {
-        const request = readJson(safetyPath(workDir, runDate, 'safety-review_request.json'));
-        const report = readJson(safetyPath(workDir, runDate, 'safety-review_report.json'));
-        const verdict = readJson(safetyPath(workDir, runDate, 'safety-judge_verdict.json'));
+        const request = readJson(scopeArtifact(workDir, scopeDir, runDate, 'safety-review_request.json'));
+        const report = readJson(scopeArtifact(workDir, scopeDir, runDate, 'safety-review_report.json'));
+        const verdict = readJson(scopeArtifact(workDir, scopeDir, runDate, 'safety-judge_verdict.json'));
         const platforms = Array.isArray(report?.platforms) ? (report.platforms as Record<string, unknown>[]) : [];
         const decisions = platforms.map((platform) => platform?.decision);
-        const digest = safetyDigest(workDir, runDate);
-        const revisions = readSafetyReviseCount(workDir);
+        const digest = scopeDigest(workDir, scopeDir, runDate);
+        const revisions = readScopeCounter(workDir, scopeDir);
         const platformFindings = (platform: Record<string, unknown>): Record<string, unknown>[] =>
             Array.isArray(platform?.findings) ? (platform.findings as Record<string, unknown>[]) : [];
         // 20261007 narrowing (operator decision): on a clean pass, only a finding the reviewer
@@ -2399,9 +3204,12 @@ export function dailySafetyGate(args: string[]): void {
         // data-handling), which is where an independent reviewer can grade it.
         const blockedPlatforms = platforms.filter((platform) => platform?.decision === 'BLOCK');
         const excludedPlatforms = blockedPlatforms.map((platform) => String(platform?.platform ?? '')).filter(Boolean);
-        const piiBlock = blockedPlatforms.some((platform) =>
-            platformFindings(platform).some((finding) => Number(finding?.category) === PII_FINDING_CATEGORY),
-        );
+        // 20261104: a category-3 `note` is the reviewer recording that it checked and found NO PII —
+        // counting it turned an admission-only BLOCK into a whole-run block. Any other disposition,
+        // or none (legacy reports), still counts: fail-closed.
+        const isPiiFinding = (finding: Record<string, unknown>): boolean =>
+            Number(finding?.category) === PII_FINDING_CATEGORY && finding?.disposition !== 'note';
+        const piiBlock = blockedPlatforms.some((platform) => platformFindings(platform).some(isPiiFinding));
         // A BLOCK that names no finding is a contract violation, not a signal: there is nothing to
         // remediate and nothing to exclude, so it blocks (fail-closed).
         const unnamedBlock =
@@ -2465,7 +3273,7 @@ export function dailySafetyGate(args: string[]): void {
                 status = 'block';
                 const named = blockedPlatforms
                     .flatMap((platform) => platformFindings(platform))
-                    .filter((finding) => Number(finding?.category) === PII_FINDING_CATEGORY)
+                    .filter(isPiiFinding)
                     .map((finding) => `${String(finding?.item ?? '?')}(category ${String(finding?.category)})`)
                     .join(', ');
                 const criteria = verdictFails.map((finding) => String(finding?.criterion)).join(', ');
@@ -2492,11 +3300,12 @@ export function dailySafetyGate(args: string[]): void {
         if (status === 'pass' || status === 'escalate' || status === 'exclude') {
             sted('write', stampFile, () => writeJsonText(stampFile, { digest, status, excludedPlatforms }));
         }
-        if (status === 'block' && !edited) {
+        if (status === 'block' && drafts && !edited) {
             // A quality block poisons the isFile() draft cache: every same-day retry would
             // re-fail on unchanged bytes (20261002 dogfood — two judge-fail runs replayed until
             // the drafts were moved by hand). Quarantine (mv, never rm) so the next run
             // regenerates from scratch; the 09_* verdict artifacts stay in 24-script for audit.
+            // Variants scope never quarantines: the bundle is regenerated, not hand-repaired.
             const q = join(workDir, '24-script', `.quarantine-${runDate}-judge-block`);
             mkdirSync(q, { recursive: true });
             for (const path of safetyDraftPaths(workDir, runDate)) {
@@ -2537,10 +3346,27 @@ export function dailyPreflight(args: string[]): void {
                 String(match[1]),
             ),
         );
+        // 0329 F21: the `publish-matrix-*` stages never appear in kk-workflow-stages' switch —
+        // `kk stage` routes them through apps/cli's publish-matrix-stage.ts — so without this
+        // roster every workflow invoking them died as runner-stale.
+        const PUBLISH_MATRIX_STAGES = [
+            'publish-matrix-plan',
+            'publish-matrix-check',
+            'publish-matrix-send',
+            'publish-matrix-classify',
+            'publish-matrix-bundle',
+            'publish-matrix-rss-gate',
+            'publish-matrix-wait-until',
+            'publish-matrix-validate',
+            'publish-matrix-settle',
+        ] as const;
+        for (const name of PUBLISH_MATRIX_STAGES) known.add(name);
         const missing: string[] = [];
         for (const file of files) {
             if (!isFile(file)) failWith(1, `daily-preflight.workflow-missing: ${file}`);
-            for (const match of readFileSync(file, 'utf-8').matchAll(/\bkk stage ([a-z][a-z0-9-]*)/g)) {
+            // 0329 F21: accept both spellings — `kk stage <name>` and the ADR-037 canonical
+            // `kk stage run <name>`.
+            for (const match of readFileSync(file, 'utf-8').matchAll(/\bkk stage (?:run )?([a-z][a-z0-9-]*)/g)) {
                 const name = String(match[1]);
                 if (!known.has(name)) missing.push(`${name} (needed by ${basename(file)})`);
             }
@@ -2571,11 +3397,12 @@ export function dailyPreflight(args: string[]): void {
  * offending value on stderr. Never exits non-zero: routing belongs to the transitions.
  */
 export function dailySafetyVerdict(args: string[]): void {
-    const [workDir = '', runDate = ''] = args;
-    const statusFile = safetyPath(workDir, runDate, 'safety-judge_status.txt');
-    const stampFile = safetyPath(workDir, runDate, 'safety-judge_stamp.json');
-    const decisionFile = safetyPath(workDir, runDate, 'safety-verdict.decision');
-    const token = safetyPath(workDir, runDate, 'safety-verdict.status');
+    const [workDir = '', runDate = '', scopeDir = ''] = args;
+    const drafts = isDraftsScope(scopeDir);
+    const statusFile = scopeArtifact(workDir, scopeDir, runDate, 'safety-judge_status.txt');
+    const stampFile = scopeArtifact(workDir, scopeDir, runDate, 'safety-judge_stamp.json');
+    const decisionFile = scopeArtifact(workDir, scopeDir, runDate, 'safety-verdict.decision');
+    const token = scopeArtifact(workDir, scopeDir, runDate, 'safety-verdict.status');
     const ADMITTED = new Set(['pass', 'escalate', 'exclude']);
     timed(workDir, 'safety-verdict-check', () => {
         const status = isFile(statusFile) ? readFileSync(statusFile, 'utf-8').trim() : '';
@@ -2595,8 +3422,51 @@ export function dailySafetyVerdict(args: string[]): void {
         } else if (!ADMITTED.has(verdict)) {
             refusal = `kk-daily-safety.judge.decision-refused: kk-safety-verdict [${verdict}] must admit pass|escalate|exclude, so these drafts must not publish`;
         }
+        // 0331 variants scope: an admitted outcome also writes the evidence the publish matrix
+        // freezes into the bundle — status, the exclusion record and the sha256 of every reviewed
+        // variant's CURRENT bytes. Recomputed here (not copied from the stamp) so bytes edited
+        // after the gate's verdict are caught at the last instant; a mismatch is a refusal, never
+        // silently re-bound evidence.
+        let evidence: Record<string, unknown> | null = null;
+        if (refusal === '' && !drafts) {
+            const stampJson = readJson(stampFile) as {
+                digest?: unknown;
+                status?: unknown;
+                excludedPlatforms?: unknown;
+            } | null;
+            const manifest = readManifest(workDir);
+            const hash = createHash('sha256');
+            const variants: Record<string, string> = {};
+            for (const key of Object.keys(manifest.variants).sort()) {
+                const path = join(workDir, manifest.variants[key].path);
+                if (!isFile(path)) {
+                    refusal = `kk-daily-safety.judge.verdict-refused: registered variant file is missing: ${path} — re-run the review on a fresh manifest`;
+                    break;
+                }
+                const sha = createHash('sha256').update(readFileSync(path)).digest('hex');
+                variants[key] = sha;
+                hash.update(key).update('\0').update(readFileSync(path)).update('\0');
+            }
+            const digest = hash.digest('hex');
+            if (refusal === '' && stampJson?.digest !== digest) {
+                refusal = `kk-daily-safety.judge.verdict-refused: variant bytes changed after the review (reviewed ${String(stampJson?.digest ?? 'missing')}, on disk ${digest}) — re-run the variants safety review`;
+            }
+            if (refusal === '') {
+                evidence = {
+                    status: stampJson?.status,
+                    digest,
+                    excludedPlatforms: Array.isArray(stampJson?.excludedPlatforms) ? stampJson.excludedPlatforms : [],
+                    variants,
+                };
+            }
+        }
         if (refusal !== '') console.error(refusal);
         sted('write', token, () => writeRaw(token, refusal === '' ? 'accept' : 'refuse'));
+        if (evidence !== null) {
+            const evidencePath = join(scopeDirOf(workDir, scopeDir), 'safety.json');
+            sted('write', evidencePath, () => writeJsonText(evidencePath, evidence));
+            console.log(`safety-verdict: evidence written to ${evidencePath}`);
+        }
     });
 }
 
@@ -2607,41 +3477,183 @@ export function dailySafetyVerdict(args: string[]): void {
  * here fails inside the loop instead of at `wrap-docs`, after the run has moved on. A broken
  * revision spends the budget too: an unparsable draft must not be retried forever.
  */
+// ---- 0331 scope machinery -------------------------------------------------
+// The nested kk-daily-safety machine serves two review surfaces: the classic drafts scope
+// (article + VoiceScript under 24-script) and the variants scope (final publish variants under
+// 30-variants, registered by daily-safety-manifest, artifacts under 4-safety-variants). The scope
+// is ONE trailing `scope_dir` argument: `24-script` (or empty) keeps every path byte-identical to
+// the pre-0331 behavior, any other value re-roots the artifact set and switches the digest to the
+// manifest-listed variant bytes.
+
+export const SAFETY_VARIANTS_DIR = '4-safety-variants';
+
+function isDraftsScope(scopeDir: string): boolean {
+    const dir = scopeDir.trim();
+    return dir === '' || dir === '24-script';
+}
+
+function scopeDirOf(workDir: string, scopeDir: string): string {
+    return isDraftsScope(scopeDir) ? join(workDir, '24-script') : join(workDir, scopeDir.trim());
+}
+
+function scopeArtifact(workDir: string, scopeDir: string, runDate: string, name: string): string {
+    return join(scopeDirOf(workDir, scopeDir), `${runDate}_09_${name}`);
+}
+
+/** The remediation budget is per scope: a variants review never inherits the drafts pass count. */
+function scopeCounter(workDir: string, scopeDir: string): string {
+    return isDraftsScope(scopeDir)
+        ? join(workDir, SAFETY_REVISE_COUNT)
+        : join(workDir, `${SAFETY_REVISE_COUNT}-${scopeDir.trim().replace(/[^\w-]/g, '_')}`);
+}
+
+function readScopeCounter(workDir: string, scopeDir: string): number {
+    const path = scopeCounter(workDir, scopeDir);
+    if (!isFile(path)) return 0;
+    const value = Number.parseInt(readFileSync(path, 'utf-8'), 10);
+    return Number.isNaN(value) ? 0 : value;
+}
+
+interface SafetyManifest {
+    schemaVersion: number;
+    runDate: string;
+    variants: Record<string, { path: string; sha256: string }>;
+}
+
+function readManifest(workDir: string): SafetyManifest {
+    const path = join(workDir, SAFETY_VARIANTS_DIR, 'manifest.json');
+    const manifest = readJson(path) as SafetyManifest | null;
+    if (manifest === null || !manifest.variants || typeof manifest.variants !== 'object') {
+        failWith(
+            1,
+            `safety-variants: ${path} is missing or malformed — run "kk stage run daily-safety-manifest <work_dir> <run_date>" first`,
+        );
+    }
+    return manifest;
+}
+
+/** Digest over the exact bytes under review: drafts = safetyDigest; variants = sorted manifest keys + current bytes. */
+function scopeDigest(workDir: string, scopeDir: string, runDate: string): string {
+    if (isDraftsScope(scopeDir)) return safetyDigest(workDir, runDate);
+    const manifest = readManifest(workDir);
+    const hash = createHash('sha256');
+    for (const key of Object.keys(manifest.variants).sort()) {
+        const path = join(workDir, manifest.variants[key].path);
+        if (!isFile(path)) {
+            failWith(
+                1,
+                `safety-variants: registered variant file is missing: ${path} — re-run daily-bundle-variants and the manifest`,
+            );
+        }
+        hash.update(key).update('\0').update(readFileSync(path)).update('\0');
+    }
+    return hash.digest('hex');
+}
+
+/** The `content` array the review request hands the agents: what to read, per scope. */
+function scopeContent(workDir: string, scopeDir: string, runDate: string): unknown[] {
+    if (isDraftsScope(scopeDir)) return safetyDraftPaths(workDir, runDate);
+    return Object.entries(readManifest(workDir).variants)
+        .sort(([a], [b]) => (a < b ? -1 : 1))
+        .map(([key, entry]) => ({ key, path: entry.path, sha256: entry.sha256 }));
+}
+
+/**
+ * Register the run's final publish variants for the variants-scope safety review (0331): every
+ * `30-variants/*.content.json` becomes one manifest entry keyed by its file name with `_` read as
+ * the plugin.operation separator. The manifest is the review contract — the request digest, the
+ * gate's edit check and the bundle's frozen evidence all resolve through it, so an empty or
+ * missing variants directory fails here, before any reviewer spends tokens.
+ */
+export function dailySafetyManifest(args: string[]): void {
+    const [workDir = '', runDate = ''] = args;
+    timed(workDir, 'safety-manifest', () => {
+        const dir = join(workDir, '30-variants');
+        if (!existsSync(dir)) {
+            failWith(1, `safety-manifest: ${dir} does not exist — run the bundle-variants stage first`);
+        }
+        const files = readdirSync(dir)
+            .filter((file) => file.endsWith('.content.json'))
+            .sort();
+        if (files.length === 0) {
+            failWith(1, `safety-manifest: no *.content.json under ${dir} — nothing to review; was the bundle built?`);
+        }
+        const variants: Record<string, { path: string; sha256: string }> = {};
+        for (const file of files) {
+            const text = readFileSync(join(dir, file), 'utf-8');
+            variants[file.replace(/\.content\.json$/, '').replace(/_/g, ':')] = {
+                path: `30-variants/${file}`,
+                sha256: createHash('sha256').update(text).digest('hex'),
+            };
+        }
+        mkdirSync(join(workDir, SAFETY_VARIANTS_DIR), { recursive: true });
+        const manifestPath = join(workDir, SAFETY_VARIANTS_DIR, 'manifest.json');
+        sted('write', manifestPath, () => writeJsonText(manifestPath, { schemaVersion: 1, runDate, variants }));
+        console.log(`safety-manifest: ${files.length} variant(s) registered for review`);
+    });
+}
+
 /**
  * Open a content-safety review of the current drafts: drop every artifact of an earlier review
  * (a retry must be re-reviewed on its final version) and write the request the two agent.run
  * steps read. The program passes context only — platform policy lives in the kk:content-safety
- * skill's reference files, never here.
+ * skill's reference files, never here. 0331: an optional trailing scope_dir re-roots the whole
+ * artifact set for the variants review (see the scope machinery above).
  */
 export function dailySafetyPrep(args: string[]): void {
-    const [workDir = '', runDate = '', platforms = ''] = args;
+    const [workDir = '', runDate = '', platforms = '', scopeDir = ''] = args;
+    const drafts = isDraftsScope(scopeDir);
     timed(workDir, 'safety-review', () => {
-        const digest = safetyDigest(workDir, runDate);
-        // Structural snapshot of the VoiceScript BEFORE any remediation edit. `daily-safety-revise`
-        // restores it when the remediation pass changes the item-section structure without a recorded
-        // exclusion: the agent is allowed to drop a 播报形态 line, not an item the article kept,
-        // because `daily-wrap-docs` derives the spoken item sections from `gap_ms: 1200` and fails the
-        // run when they no longer match the episode's included items (2026-10-21 04:30 run: 3
-        // segments removed → 5 sections vs a 6-item plan → `generate` refused at 05:03 and the whole
-        // day published nothing).
-        const [, scriptPath] = safetyDraftPaths(workDir, runDate);
-        const snapshot = safetyPath(workDir, runDate, 'safety-prep_script-snapshot.yaml');
-        if (isFile(scriptPath)) sted('write', snapshot, () => writeRaw(snapshot, readFileSync(scriptPath, 'utf-8')));
+        const digest = scopeDigest(workDir, scopeDir, runDate);
+        if (drafts) {
+            // Structural snapshot of the VoiceScript BEFORE any remediation edit. `daily-safety-revise`
+            // restores it when the remediation pass changes the item-section structure without a recorded
+            // exclusion: the agent is allowed to drop a 播报形态 line, not an item the article kept,
+            // because `daily-wrap-docs` derives the spoken item sections from `gap_ms: 1200` and fails the
+            // run when they no longer match the episode's included items (2026-10-21 04:30 run: 3
+            // segments removed → 5 sections vs a 6-item plan → `generate` refused at 05:03 and the whole
+            // day published nothing).
+            const [, scriptPath] = safetyDraftPaths(workDir, runDate);
+            const snapshot = safetyPath(workDir, runDate, 'safety-prep_script-snapshot.yaml');
+            if (isFile(scriptPath))
+                sted('write', snapshot, () => writeRaw(snapshot, readFileSync(scriptPath, 'utf-8')));
+        } else {
+            // The remediation budget belongs to this scope's attempt, not to the day.
+            const counter = scopeCounter(workDir, scopeDir);
+            sted('write', counter, () => writeFileSync(counter, '0\n'));
+        }
         for (const name of [
             'safety-review_report.json',
             'safety-judge_verdict.json',
             'safety-judge_status.txt',
             'safety-judge_stamp.json',
+            'safety-verdict.decision',
+            'safety-verdict.status',
+            // A previous review's evidence must never survive into a new request: the bundle
+            // freezes exactly what the current request's verdict admits. Evidence is the one
+            // unprefixed artifact, so the runDate-prefixed sweep would miss it.
+            'safety.json',
         ]) {
-            const stale = safetyPath(workDir, runDate, name);
+            const stale =
+                name === 'safety.json' && !drafts
+                    ? join(scopeDirOf(workDir, scopeDir), name)
+                    : scopeArtifact(workDir, scopeDir, runDate, name);
             if (isFile(stale)) unlinkSync(stale);
         }
-        const request = safetyPath(workDir, runDate, 'safety-review_request.json');
+        const request = scopeArtifact(workDir, scopeDir, runDate, 'safety-review_request.json');
         const targets = platforms
             .split(',')
             .map((platform) => platform.trim())
             .filter(Boolean);
-        sted('write', request, () => writeJsonText(request, { digest, platforms: targets, mode: 'detect-only' }));
+        sted('write', request, () =>
+            writeJsonText(request, {
+                digest,
+                platforms: targets,
+                mode: 'detect-only',
+                scope: drafts ? 'drafts' : 'variants',
+                content: scopeContent(workDir, scopeDir, runDate),
+            }),
+        );
     });
 }
 
@@ -2675,8 +3687,30 @@ export function dailySafetyPrep(args: string[]): void {
  * revision spends the budget too: an unparsable draft must not be retried forever.
  */
 export function dailySafetyRevise(args: string[]): void {
-    const [workDir = '', runDate = ''] = args;
+    const [workDir = '', runDate = '', scopeDir = ''] = args;
+    const drafts = isDraftsScope(scopeDir);
     timed(workDir, 'safety-revise', () => {
+        if (!drafts) {
+            // Variants scope: every manifest-listed file must stay parseable Content with the
+            // fields the publish half reads; the structural VoiceScript machinery does not apply.
+            for (const entry of Object.values(readManifest(workDir).variants)) {
+                const path = join(workDir, entry.path);
+                const value = requireJson(path, 'safety-revise') as {
+                    title?: unknown;
+                    body?: unknown;
+                };
+                for (const field of ['title', 'body'] as const) {
+                    if (typeof value[field] !== 'string' || String(value[field]).trim() === '') {
+                        failWith(1, `safety-revise: variant ${path} ${field} must be a non-empty string`);
+                    }
+                }
+            }
+            const counter = scopeCounter(workDir, scopeDir);
+            const next = readScopeCounter(workDir, scopeDir) + 1;
+            sted('write', counter, () => writeFileSync(counter, `${next}\n`));
+            console.log(`safety-revise: remediation pass ${next} applied to manifest variants; re-validated`);
+            return;
+        }
         const [articlePath, scriptPath] = safetyDraftPaths(workDir, runDate);
         const article = requireJson(articlePath, 'safety-revise');
         for (const field of ['title', 'body'] as const) {
@@ -2688,7 +3722,7 @@ export function dailySafetyRevise(args: string[]): void {
         assertScriptContent(scriptPath);
         restoreStructureIfBroken(workDir, runDate, scriptPath);
         const path = join(workDir, SAFETY_REVISE_COUNT);
-        const next = readSafetyReviseCount(workDir) + 1;
+        const next = readScopeCounter(workDir, scopeDir) + 1;
         sted('write', path, () => writeFileSync(path, `${next}\n`));
         console.log(`safety-revise: remediation pass ${next} applied; drafts re-validated`);
     });
@@ -3063,22 +4097,29 @@ export function dailyShowNotes(args: string[]): void {
  * deterministic mechanics — `scaffold-locale` for both target locales — while the
  * workflow `translate` state's agent step owns the LLM translation of the drafts.
  * Writes one marker file per locale (zh post path + en/ja draft paths); empty
- * marker = locale absent (callers skip). Reuses an existing on-disk draft as the
- * cache across run retries — re-scaffolding would erase the agent's translation.
+ * marker = locale absent (callers skip). Reuses an existing on-disk draft only when its
+ * source-hash sidecar matches the current zh post — a changed source must invalidate the
+ * translation cache before the next unattended run.
  */
 export function dailyTranslateLocalize(args: string[]): void {
     const [workDir = '', runDate = '', pluginsPath = ''] = args;
-    // Same seam as show-notes (task 0137): `_17_publish_result.json` is written later by
-    // publish-classify, which depends on translate-sync. Reading it here always saw no zh
-    // path, so en/ja were never scaffolded (2026-10-08 dogfood).
+    // The prepare result is available before translation; the final publish result is retained as
+    // a compatibility fallback for manual recovery of pre-two-phase workspaces.
+    const prepareResult = join(workDir, '31-publish', `${runDate}_14_publish-surfdash-prepare_result.json`);
     const result = join(workDir, '31-publish', `${runDate}_14_publish-surfdash_result.json`);
     const zhFile = join(workDir, '31-publish', `${runDate}_20_translate-localize_zh-post-path.txt`);
     timed(workDir, 'translate-localize', () => {
-        const postPath = firstPostPath(readJson(result), 'surfdash-pub');
+        const postPath =
+            firstPostPath(readJson(prepareResult), 'surfdash-pub') || firstPostPath(readJson(result), 'surfdash-pub');
         const zh = postPath.endsWith('index.md') ? postPath : '';
         sted('write', zhFile, () => writeRaw(zhFile, zh));
         if (zh === '') {
             for (const target of ['en', 'ja'] as const) {
+                const sourceHashFile = join(
+                    workDir,
+                    '31-publish',
+                    `${runDate}_20_translate-localize_${target}-source-sha256.txt`,
+                );
                 sted(
                     'write',
                     join(workDir, '31-publish', `${runDate}_20_translate-localize_${target}-post-path.txt`),
@@ -3088,18 +4129,37 @@ export function dailyTranslateLocalize(args: string[]): void {
                             '',
                         ),
                 );
+                sted('remove', sourceHashFile, () => rmSync(sourceHashFile, { force: true }));
             }
             console.log('no zh post path — skip localize');
             return;
         }
+        let sourceHash: string;
+        try {
+            sourceHash = createHash('sha256').update(readFileSync(zh)).digest('hex');
+        } catch (error: unknown) {
+            failWith(
+                1,
+                `translate-localize: cannot fingerprint zh source ${zh}: ${error instanceof Error ? error.message : String(error)}`,
+            );
+        }
         for (const target of ['en', 'ja'] as const) {
             const markerFile = join(workDir, '31-publish', `${runDate}_20_translate-localize_${target}-post-path.txt`);
             const existing = zh.replace('/zh/', `/${target}/`);
-            if (isFile(existing)) {
+            const sourceHashFile = join(
+                workDir,
+                '31-publish',
+                `${runDate}_20_translate-localize_${target}-source-sha256.txt`,
+            );
+            const cachedSourceHash = isFile(sourceHashFile) ? readFileSync(sourceHashFile, 'utf-8').trim() : '';
+            if (isFile(existing) && cachedSourceHash === sourceHash) {
                 sted('write', markerFile, () => writeRaw(markerFile, existing));
                 console.log(`${target} draft cached: ${existing}`);
                 continue;
             }
+            if (isFile(existing)) {
+                console.log(`${target} draft invalidated: zh source fingerprint changed or is missing`);
+            }
             const scaffold = join(workDir, '31-publish', `${runDate}_20_translate-localize_scaffold-${target}.json`);
             const scaffoldResult = join(
                 workDir,
@@ -3107,20 +4167,254 @@ export function dailyTranslateLocalize(args: string[]): void {
                 `${runDate}_20_translate-localize_scaffold-${target}-result.json`,
             );
             sted('write', scaffold, () =>
-                writeJqText(scaffold, { body: '', options: { operation: 'scaffold-locale', postPath: zh, target } }),
+                writeJqText(scaffold, {
+                    body: '',
+                    options: {
+                        operation: 'scaffold-locale',
+                        postPath: zh,
+                        target,
+                        ...(isFile(existing) ? { force: true } : {}),
+                    },
+                }),
+            );
+            try {
+                kk([
+                    'executor',
+                    'run',
+                    'surfdash-pub',
+                    '--in',
+                    scaffold,
+                    '--out',
+                    scaffoldResult,
+                    ...pluginsArgs(pluginsPath),
+                ]);
+                const draftPath = metadataOf(readJson(scaffoldResult)).draftPath;
+                const draft = typeof draftPath === 'string' ? draftPath : '';
+                sted('write', markerFile, () => writeRaw(markerFile, draft));
+                if (draft !== '') {
+                    sted('write', sourceHashFile, () => writeRaw(sourceHashFile, sourceHash));
+                } else {
+                    sted('remove', sourceHashFile, () => rmSync(sourceHashFile, { force: true }));
+                }
+            } catch (error: unknown) {
+                if (error instanceof StageFailure && error.status === 127) throw error;
+                const message = error instanceof Error ? error.message : String(error);
+                sted('write', markerFile, () => writeRaw(markerFile, ''));
+                sted('remove', sourceHashFile, () => rmSync(sourceHashFile, { force: true }));
+                console.error(`translate-localize: ${target} scaffold failed: ${message}`);
+            }
+        }
+    });
+}
+
+/**
+ * Run Surfdash's own refine command over the complete locale set before the validation fingerprint
+ * is written. This is deliberately a separate local-only phase: the final publish FSM also runs
+ * refine, but it must be idempotent by the time any CMS/git side effect is reachable.
+ */
+function normalizeTranslatedLocales(zhPostPath: string, failUnsafe = true): void {
+    for (const locale of ['zh', 'en', 'ja'] as const) {
+        const sibling = locale === 'zh' ? zhPostPath : zhPostPath.replace('/zh/', `/${locale}/`);
+        if (!isFile(sibling)) continue;
+        const raw = readFileSync(sibling, 'utf-8');
+        const { markdown, remaining } = normalizeSeriesNames(raw, locale);
+        if (failUnsafe && remaining.length > 0) {
+            failWith(1, `series-name normalization left unsafe names in ${locale}: ${remaining.join(' / ')}`);
+        }
+        if (markdown !== raw) sted('write', sibling, () => writeRaw(sibling, markdown));
+    }
+}
+
+/**
+ * The translate agents run with cwd = this repo, and both executor sandboxes (codex workspace-write,
+ * claude acceptEdits) refuse writes into the Surfdash checkout — on 2026-11-04 both exited 0 with
+ * en/ja untouched. So they write `<runDate>_21_translate_<locale>.md` under the work dir and this
+ * installs each over its scaffold. The output is consumed (renamed) so a rerun never clobbers an
+ * operator's later repair of the installed post.
+ */
+function installTranslatedLocales(workDir: string, runDate: string, zhPostPath: string): void {
+    for (const locale of ['en', 'ja'] as const) {
+        const translated = join(workDir, '31-publish', `${runDate}_21_translate_${locale}.md`);
+        if (!isFile(translated)) continue;
+        const target = zhPostPath.replace('/zh/', `/${locale}/`);
+        sted('write', target, () => writeRaw(target, readFileSync(translated, 'utf-8')));
+        renameSync(translated, `${translated}.installed`);
+    }
+}
+
+export function dailySurfdashRefine(args: string[]): void {
+    const [workDir = '', runDate = '', pluginsPath = ''] = args;
+    const marker = join(workDir, '31-publish', `${runDate}_20_translate-localize_zh-post-path.txt`);
+    const input = join(workDir, '31-publish', `${runDate}_24_surfdash-refine_content.json`);
+    const result = join(workDir, '31-publish', `${runDate}_24_surfdash-refine_result.json`);
+    timed(workDir, 'surfdash-refine', () => {
+        try {
+            const zhPostPath = isFile(marker) ? readFileSync(marker, 'utf-8').trim() : '';
+            if (zhPostPath === '' || !zhPostPath.startsWith('/') || !isFile(zhPostPath)) {
+                failWith(1, `surfdash-refine: zh marker must name an existing post: ${marker}`);
+            }
+            validateLocaleMarkers(workDir, runDate, zhPostPath, 'surfdash-refine');
+            installTranslatedLocales(workDir, runDate, zhPostPath);
+            // The validator is intentionally read-only. Repair known series spellings before
+            // site-owned refine computes managed fields, otherwise the final publisher would
+            // rewrite the refined bytes after the locale fingerprint was admitted.
+            normalizeTranslatedLocales(zhPostPath);
+            sted('write', input, () =>
+                writeJqText(input, {
+                    body: '',
+                    format: 'markdown',
+                    options: { operation: 'refine-prepared', postPath: zhPostPath, runDate },
+                }),
+            );
+            rmSync(result, { force: true });
+            kk(['executor', 'run', 'surfdash-pub', '--in', input, '--out', result, ...pluginsArgs(pluginsPath)], {
+                unset: NESTED_SPUR_UNSET,
+                env: { SURFDASH_LOCALE: 'zh' },
+            });
+            const refined = readJson(result);
+            if (refined?.ok !== true) {
+                failWith(1, `surfdash-refine: publisher did not return a successful refine receipt: ${result}`);
+            }
+            sted('write', result, () =>
+                writeJqText(result, {
+                    ok: true,
+                    summary: { total: 1, succeeded: 1, failed: 0, skipped: 0 },
+                    targets: [
+                        {
+                            target: 'surfdash-pub',
+                            ok: true,
+                            status: 'refined',
+                            metadata: metadataOf(refined),
+                        },
+                    ],
+                }),
+            );
+            console.log(`surfdash-refine: site-owned refine completed for ${zhPostPath}`);
+        } catch (error: unknown) {
+            if (error instanceof StageFailure && error.status === 127) throw error;
+            const message = error instanceof Error ? error.message : String(error);
+            sted('write', result, () =>
+                writeJqText(result, {
+                    ok: false,
+                    summary: { total: 1, succeeded: 0, failed: 1, skipped: 0 },
+                    targets: [{ target: 'surfdash-pub', ok: false, status: 'failed', error: message }],
+                }),
+            );
+            console.error(`surfdash-refine: ${message}`);
+        }
+    });
+}
+
+/** Validates locale siblings without contacting Surfdash or mutating their bytes. */
+function validateTranslatedLocales(zhPostPath: string, step: 'translate-validate' | 'translate-sync'): void {
+    const zhPoints = countKeyPoints(zhPostPath);
+    for (const locale of ['zh', 'en', 'ja'] as const) {
+        const sibling = locale === 'zh' ? zhPostPath : zhPostPath.replace('/zh/', `/${locale}/`);
+        if (!isFile(sibling)) {
+            if (locale !== 'zh' && step === 'translate-validate') {
+                failWith(1, `${step}: ${locale} draft is missing: ${sibling}`);
+            }
+            continue;
+        }
+        const problems: string[] = [];
+        const raw = readFileSync(sibling, 'utf-8');
+        const { markdown, remaining } = normalizeSeriesNames(raw, locale);
+        if (markdown !== raw) problems.push('series-name normalization is pending; run the refine preparation first');
+        if (remaining.length > 0) {
+            problems.push(`retired series names left after rewrite: ${remaining.join(' / ')}`);
+        }
+        const items = readKeyPointItems(sibling);
+        if (step === 'translate-validate') {
+            if (readFrontmatterScalar(sibling, 'refined') !== 'true') {
+                problems.push('site-owned refine has not completed (refined: true is required)');
+            }
+            if (items === undefined || items.length === 0) {
+                problems.push('key_points missing or malformed');
+            } else {
+                const malformed = items.filter((item) => {
+                    const separator = item.indexOf(' — ');
+                    return separator <= 0 || item.slice(separator + 3).trim() === '';
+                });
+                if (malformed.length > 0) problems.push('key_points missing or malformed');
+            }
+        }
+        if (locale !== 'zh') {
+            if (readFrontmatterScalar(sibling, 'description') === undefined) {
+                problems.push('description missing/empty');
+            }
+            const points = countKeyPoints(sibling);
+            if (zhPoints !== undefined && points !== undefined && points !== zhPoints) {
+                problems.push(`key_points count ${points} != zh ${zhPoints} (spliced or merged items)`);
+            }
+            // The scheduled path must not let an untranslated scaffold reach the strict CMS sync.
+            if (step === 'translate-validate' && readFrontmatterScalar(sibling, 'draft') !== 'false') {
+                problems.push('draft is still true — locale was scaffolded but not translated');
+            }
+            // Label discipline (same 2026-10-23 audit): a key_points item is `Label — sentence`
+            // and the label is a short phrase — ≤14 chars for ja, ≤28 for en — never a
+            // sentence and never an ellipsis-truncated fragment.
+            if (items !== undefined) {
+                const cap = locale === 'en' ? 28 : 14;
+                const overLimit = items.filter((item) => {
+                    const separator = item.indexOf(' — ');
+                    if (separator < 0) return false;
+                    const label = item.slice(0, separator);
+                    return label.includes('…') || Array.from(label).length > cap;
+                });
+                if (overLimit.length > 0) {
+                    problems.push(
+                        `key_points label over ${cap} chars or …-truncated: ${overLimit.length} of ${items.length} items`,
+                    );
+                }
+            }
+        }
+        if (problems.length > 0) {
+            failWith(
+                1,
+                `${step}: ${locale} draft failed the pre-sync structural check (${problems.join('; ')}) — repair ${sibling} per the translate stage contract before syncing`,
             );
-            kk([
-                'executor',
-                'run',
-                'surfdash-pub',
-                '--in',
-                scaffold,
-                '--out',
-                scaffoldResult,
-                ...pluginsArgs(pluginsPath),
-            ]);
-            const draftPath = metadataOf(readJson(scaffoldResult)).draftPath;
-            sted('write', markerFile, () => writeRaw(markerFile, typeof draftPath === 'string' ? draftPath : ''));
+        }
+    }
+}
+
+/** Local pre-CMS gate for the scheduled two-phase Surfdash flow. */
+export function dailyTranslateValidate(args: string[]): void {
+    const [workDir = '', runDate = '', _pluginsPath = '', zhPathFile = ''] = args;
+    const validationResult = join(workDir, '31-publish', `${runDate}_24_translate-validate_result.json`);
+    timed(workDir, 'translate-validate', () => {
+        const zhPostPath = isFile(zhPathFile) ? readFileSync(zhPathFile, 'utf-8').trim() : '';
+        try {
+            if (zhPathFile.endsWith('.md') || zhPostPath === '' || !zhPostPath.startsWith('/') || !isFile(zhPostPath)) {
+                failWith(
+                    1,
+                    `translate-validate: 4th argument must name an existing zh marker file (${runDate}_20_translate-localize_zh-post-path.txt)`,
+                );
+            }
+            validateLocaleMarkers(workDir, runDate, zhPostPath, 'translate-validate');
+            validateTranslatedLocales(zhPostPath, 'translate-validate');
+            const evidence = surfdashLocaleValidationEvidence(zhPostPath, runDate);
+            if (!evidence.ok) failWith(1, `translate-validate: ${evidence.reason}`);
+            sted('write', validationResult, () =>
+                writeJqText(validationResult, {
+                    ok: true,
+                    target: 'surfdash-pub',
+                    status: 'validated',
+                    metadata: evidence.evidence,
+                }),
+            );
+            console.log(`translate-validate: locale files ready for final Surfdash publish (${zhPostPath})`);
+        } catch (error: unknown) {
+            const message = error instanceof Error ? error.message : String(error);
+            sted('write', validationResult, () =>
+                writeJqText(validationResult, {
+                    ok: false,
+                    target: 'surfdash-pub',
+                    status: 'rejected',
+                    error: message,
+                    metadata: { postPath: zhPostPath },
+                }),
+            );
+            console.error(`translate-validate: ${message}`);
         }
     });
 }
@@ -3146,58 +4440,11 @@ export function dailyTranslateSync(args: string[]): void {
                 `translate-sync: 4th argument must be the zh marker file (${runDate}_20_translate-localize_zh-post-path.txt), not the post itself — '${zhPathFile}' holds ${zhPostPath.includes('\n') ? 'a multi-line document' : `'${zhPostPath}'`}`,
             );
         }
-        // The 2026-10-23 translate run published spliced en/ja description/key_points; the locale
-        // channel has no judge, so gate the structural minimum here before the CMS sync:
-        // a summary must exist and the key_points count must match the zh post (splices merge items).
-        // The same run also invented retired series names (毎日AIブレンド, "Daily AI Medley",
-        // zh-name listen links inside en/ja): normalizeSeriesNames rewrites the known bad set per
-        // locale deterministically (URLs untouched) and any leftover it cannot make safe fails the
-        // sync. The zh post rides the same sync, so it gets the same series-name pass.
-        const zhPoints = countKeyPoints(zhPostPath);
-        for (const locale of ['zh', 'en', 'ja'] as const) {
-            const sibling = locale === 'zh' ? zhPostPath : zhPostPath.replace('/zh/', `/${locale}/`);
-            if (!isFile(sibling)) continue;
-            const problems: string[] = [];
-            const raw = readFileSync(sibling, 'utf-8');
-            const { markdown, remaining } = normalizeSeriesNames(raw, locale);
-            if (markdown !== raw) sted('write', sibling, () => writeRaw(sibling, markdown));
-            if (remaining.length > 0) {
-                problems.push(`retired series names left after rewrite: ${remaining.join(' / ')}`);
-            }
-            if (locale !== 'zh') {
-                if (readFrontmatterScalar(sibling, 'description') === undefined) {
-                    problems.push('description missing/empty');
-                }
-                const points = countKeyPoints(sibling);
-                if (zhPoints !== undefined && points !== undefined && points !== zhPoints) {
-                    problems.push(`key_points count ${points} != zh ${zhPoints} (spliced or merged items)`);
-                }
-                // Label discipline (same 2026-10-23 audit): a key_points item is `Label — sentence`
-                // and the label is a short phrase — ≤14 chars for ja, ≤28 for en — never a
-                // sentence and never an ellipsis-truncated fragment.
-                const items = readKeyPointItems(sibling);
-                if (items !== undefined) {
-                    const cap = locale === 'en' ? 28 : 14;
-                    const overLimit = items.filter((item) => {
-                        const sep = item.indexOf(' — ');
-                        if (sep < 0) return false;
-                        const label = item.slice(0, sep);
-                        return label.includes('…') || Array.from(label).length > cap;
-                    });
-                    if (overLimit.length > 0) {
-                        problems.push(
-                            `key_points label over ${cap} chars or …-truncated: ${overLimit.length} of ${items.length} items`,
-                        );
-                    }
-                }
-            }
-            if (problems.length > 0) {
-                failWith(
-                    1,
-                    `translate-sync: ${locale} draft failed the pre-sync structural check (${problems.join('; ')}) — repair ${sibling} per the translate stage contract before syncing`,
-                );
-            }
-        }
+        // Preserve the legacy explicit sync repair behavior before the shared read-only gate.
+        normalizeTranslatedLocales(zhPostPath, false);
+        // The 2026-10-23 locale structural gate is shared with the scheduled two-phase validator.
+        // This explicit recovery command still performs the real CMS sync after validation.
+        validateTranslatedLocales(zhPostPath, 'translate-sync');
         sted('write', sync, () =>
             writeJqText(sync, { body: '', options: { operation: 'sync', postPath: zhPostPath } }),
         );