@graphrefly/ts 0.0.1 → 0.0.2

package/dist/solutions/work-item/actions.cjs

@@ -44,181 +44,132 @@ function depBatch(ctx, depIndex) {
   return flattened.length === 0 ? [] : flattened;
 }
 
-// src/solutions/work-item/scheduling.ts
-function validateAcceptanceCriteria(criteria, opts = {}) {
-  const out = [];
+// src/orchestration/work-item-runtime-shared.ts
+function emitWorkItemAdmissionIssue(ctx, state, key, code, message, subjectId, sourceRefs2) {
+  if (state.issueKeys.has(key)) return;
+  state.issueKeys.add(key);
+  state.issueSeq += 1;
+  state.statusSeq += 1;
+  state.auditSeq += 1;
+  const issue2 = dataIssue(code, message, { subjectId, refs: sourceRefs2 });
+  const status = {
+    kind: "work-item-status",
+    statusId: `${subjectId ?? "work-item"}:mapping-issue:${state.statusSeq}`,
+    workItemId: subjectId ?? "unknown",
+    state: "mapping-issue",
+    sourceRefs: sourceRefs2,
+    issues: [issue2]
+  };
+  const audit = {
+    id: `${subjectId ?? "work-item"}:${code}:${state.auditSeq}`,
+    kind: "work-item-domain-action-admission-issue",
+    subjectId,
+    issueCode: code,
+    message,
+    sourceRefs: sourceRefs2
+  };
+  ctx.down([
+    ["DATA", { kind: "issue", issue: issue2 }],
+    ["DATA", { kind: "status", status }],
+    ["DATA", { kind: "audit", audit }]
+  ]);
+}
+function emptyWorkItemDomainActionAdmissionState() {
+  return {
+    proposals: /* @__PURE__ */ new Map(),
+    policies: /* @__PURE__ */ new Map(),
+    decisions: /* @__PURE__ */ new Map(),
+    admissionsById: /* @__PURE__ */ new Map(),
+    admissionsByProposal: /* @__PURE__ */ new Map(),
+    terminalDecisionIds: /* @__PURE__ */ new Set(),
+    issueKeys: /* @__PURE__ */ new Set(),
+    statusSeq: 0,
+    issueSeq: 0,
+    auditSeq: 0
+  };
+}
+function freezeWorkItemDomainActionAdmissionViews(state) {
+  return {
+    admissionsByProposal: new Map(state.admissionsByProposal),
+    admissionsByWorkItem: new Map(
+      Array.from(state.admissionsByWorkItem, ([key, value]) => [key, Object.freeze([...value])])
+    ),
+    issues: Object.freeze([...state.issues]),
+    audit: Object.freeze([...state.audit])
+  };
+}
+function workItemAdmissionProposalRefs(proposal) {
+  return uniqueSourceRefs([
+    ref("work-item", proposal.workItemId),
+    ref("work-item-domain-action-proposal", proposal.proposalId),
+    ref("effect-run", proposal.effectRunId),
+    ref("effect-run-result", proposal.effectRunResultId),
+    ref("work-item-evidence", proposal.evidenceId),
+    ref("work-item-effect-mapping-policy", proposal.policyId),
+    ...proposal.sourceRefs ?? []
+  ]);
+}
+function workItemAdmissionDecisionRefs(decision, proposal, policy) {
+  return uniqueSourceRefs([
+    ...proposal === void 0 ? [] : workItemAdmissionProposalRefs(proposal),
+    ref("work-item-domain-action-admission-decision", decision.decisionId),
+    ref("work-item-domain-action-admission", decision.admissionId),
+    ref("work-item-domain-action-proposal", decision.proposalId),
+    ...decision.policyId === void 0 ? [] : [ref("work-item-domain-action-admission-policy", decision.policyId)],
+    ...policy === void 0 ? [] : [ref("work-item-domain-action-admission-policy", policy.policyId)],
+    ...decision.targetProposalId === void 0 ? [] : [ref("work-item-domain-action-proposal", decision.targetProposalId)],
+    ...decision.targetAdmissionId === void 0 ? [] : [ref("work-item-domain-action-admission", decision.targetAdmissionId)],
+    ...decision.sourceRefs ?? []
+  ]);
+}
+function uniqueSourceRefs(sourceRefs2) {
   const seen = /* @__PURE__ */ new Set();
-  for (const criterion of criteria) {
-    if (!isRecord(criterion)) {
-      out.push(issue("malformed-draft", "AcceptanceCriterion must be an object", opts.workItemId));
-      continue;
-    }
-    if (typeof criterion.criterionId !== "string" || criterion.criterionId === "") {
-      out.push(
-        issue(
-          "missing-required-field",
-          "AcceptanceCriterion.criterionId is required",
-          opts.workItemId
-        )
-      );
-      continue;
-    }
-    if (seen.has(criterion.criterionId)) {
-      out.push(
-        issue(
-          "duplicate-id",
-          `Duplicate acceptance criterion id '${criterion.criterionId}'`,
-          opts.workItemId,
-          { criterionId: criterion.criterionId }
-        )
-      );
-    }
-    seen.add(criterion.criterionId);
-    if (typeof criterion.statement !== "string" || criterion.statement.trim() === "") {
-      out.push(
-        issue(
-          "missing-required-field",
-          "AcceptanceCriterion.statement is required",
-          opts.workItemId,
-          { criterionId: criterion.criterionId }
-        )
-      );
-    }
+  const unique = [];
+  for (const sourceRef of sourceRefs2) {
+    const key = sourceRefKey(sourceRef);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    unique.push(sourceRef);
   }
-  return out;
+  return unique;
 }
-function validateVerificationPlan(plan, criteria = [], opts = {}) {
-  const out = [];
-  if (!isRecord(plan) || !Array.isArray(plan.steps)) {
-    return [issue("malformed-draft", "VerificationPlan.steps must be an array", opts.workItemId)];
-  }
-  const criterionIds = new Set(criteria.map((criterion) => criterion.criterionId));
-  const stepIds = /* @__PURE__ */ new Set();
-  const modes = new Set(opts.allowedModes ?? ["auto", "manual", "hybrid"]);
-  const effectKinds = new Set(opts.allowedEffectKinds ?? ["verification"]);
-  for (const step of plan.steps) {
-    if (!isRecord(step)) {
-      out.push(issue("malformed-draft", "VerificationStep must be an object", opts.workItemId));
-      continue;
-    }
-    if (typeof step.stepId !== "string" || step.stepId === "") {
-      out.push(
-        issue("missing-required-field", "VerificationStep.stepId is required", opts.workItemId)
-      );
-      continue;
-    }
-    if (stepIds.has(step.stepId)) {
-      out.push(
-        issue("duplicate-id", `Duplicate verification step id '${step.stepId}'`, opts.workItemId, {
-          stepId: step.stepId
-        })
-      );
-    }
-    stepIds.add(step.stepId);
-    if (typeof step.mode !== "string" || !modes.has(step.mode)) {
-      out.push(
-        issue(
-          "unsupported-mode",
-          `Unsupported verification step mode '${step.mode}'`,
-          opts.workItemId,
-          { stepId: step.stepId }
-        )
-      );
-    }
-    if (step.effectKind !== void 0 && (typeof step.effectKind !== "string" || !effectKinds.has(step.effectKind))) {
-      out.push(
-        issue(
-          "unsupported-effect-kind",
-          `Unsupported verification effect kind '${step.effectKind}'`,
-          opts.workItemId,
-          { stepId: step.stepId }
-        )
-      );
-    }
-    const verifiesCriteriaIds = Array.isArray(step.verifiesCriteriaIds) ? step.verifiesCriteriaIds : [];
-    for (const criterionId of verifiesCriteriaIds) {
-      if (!criterionIds.has(criterionId)) {
-        out.push(
-          issue("dangling-ref", `Unknown acceptance criterion '${criterionId}'`, opts.workItemId, {
-            stepId: step.stepId,
-            criterionId
-          })
-        );
-      }
-    }
-  }
-  for (const step of plan.steps) {
-    if (!isRecord(step) || typeof step.stepId !== "string") continue;
-    const dependsOnStepIds = Array.isArray(step.dependsOnStepIds) ? step.dependsOnStepIds : [];
-    for (const depId of dependsOnStepIds) {
-      if (!stepIds.has(depId)) {
-        out.push(
-          issue("dangling-ref", `Unknown verification dependency '${depId}'`, opts.workItemId, {
-            stepId: step.stepId
-          })
-        );
+function sourceRefKey(sourceRef) {
+  return `${sourceRef.kind}:${sourceRef.id}:${JSON.stringify(sourceRef.metadata ?? {})}`;
+}
+function projectRuntimeFact(graph, runtime, name, factory, pick) {
+  return graph.node(
+    [runtime],
+    (ctx) => {
+      for (const fact of depBatch(ctx, 0) ?? []) {
+        const typed = fact;
+        const value = pick(typed);
+        if (value !== void 0) ctx.down([["DATA", value]]);
       }
-    }
-  }
-  const cycle = findCycle(
-    plan.steps.filter(
-      (step) => isRecord(step) && typeof step.stepId === "string" && Array.isArray(step.dependsOnStepIds)
-    )
+    },
+    { name, factory }
   );
-  if (cycle !== void 0) {
-    out.push(
-      issue(
-        "cyclic-dependency",
-        `Verification step cycle detected: ${cycle.join(" -> ")}`,
-        opts.workItemId,
-        { stepId: cycle[0] }
-      )
-    );
-  }
-  return out;
 }
-function findCycle(steps) {
-  const byId = new Map(steps.map((step) => [step.stepId, step.dependsOnStepIds ?? []]));
-  const visiting = /* @__PURE__ */ new Set();
-  const visited = /* @__PURE__ */ new Set();
-  const stack = [];
-  const visit = (id) => {
-    if (visiting.has(id)) return [...stack.slice(stack.indexOf(id)), id];
-    if (visited.has(id)) return void 0;
-    visiting.add(id);
-    stack.push(id);
-    for (const dep of byId.get(id) ?? []) {
-      if (!byId.has(dep)) continue;
-      const cycle = visit(dep);
-      if (cycle !== void 0) return cycle;
-    }
-    stack.pop();
-    visiting.delete(id);
-    visited.add(id);
-    return void 0;
-  };
-  for (const step of steps) {
-    const cycle = visit(step.stepId);
-    if (cycle !== void 0) return cycle;
+function forEachPolicyDepBatch(ctx, start, count, fn) {
+  for (let i = 0; i < count; i += 1) {
+    for (const value of depBatch(ctx, start + i) ?? []) fn(value);
   }
-  return void 0;
 }
-function issue(code, message, workItemId, metadata) {
+function dataIssue(code, message, opts = {}) {
   return {
     kind: "issue",
     code,
     message,
-    severity: "error",
-    source: "work-item-scheduling",
-    subjectId: workItemId,
-    metadata
+    severity: opts.severity ?? "error",
+    subjectId: opts.subjectId,
+    refs: opts.refs?.map((r) => `${r.kind}:${r.id}`),
+    details: opts.details
   };
 }
-function isRecord(value) {
-  return value !== null && typeof value === "object";
+function ref(kind, id) {
+  return { kind, id };
 }
 
-// src/orchestration/work-item-runtime.ts
+// src/orchestration/work-item-runtime-admission.ts
 function workItemDomainActionAdmissionProjector(graph, opts) {
   const name = opts.name ?? "workItemDomainActionAdmissions";
   const policyDeps = opts.admissionPolicies ?? [];
@@ -596,131 +547,86 @@ function workItemAdmissionStatusState(state) {
   if (state === "deferred") return "domain-action-deferred";
   return "domain-action-merged";
 }
-function emitWorkItemAdmissionIssue(ctx, state, key, code, message, subjectId, sourceRefs2) {
-  if (state.issueKeys.has(key)) return;
-  state.issueKeys.add(key);
-  state.issueSeq += 1;
-  state.statusSeq += 1;
-  state.auditSeq += 1;
-  const issue2 = dataIssue(code, message, { subjectId, refs: sourceRefs2 });
-  const status = {
-    kind: "work-item-status",
-    statusId: `${subjectId ?? "work-item"}:mapping-issue:${state.statusSeq}`,
-    workItemId: subjectId ?? "unknown",
-    state: "mapping-issue",
-    sourceRefs: sourceRefs2,
-    issues: [issue2]
-  };
-  const audit = {
-    id: `${subjectId ?? "work-item"}:${code}:${state.auditSeq}`,
-    kind: "work-item-domain-action-admission-issue",
-    subjectId,
-    issueCode: code,
-    message,
-    sourceRefs: sourceRefs2
-  };
-  ctx.down([
-    ["DATA", { kind: "issue", issue: issue2 }],
-    ["DATA", { kind: "status", status }],
-    ["DATA", { kind: "audit", audit }]
-  ]);
-}
-function emptyWorkItemDomainActionAdmissionState() {
-  return {
-    proposals: /* @__PURE__ */ new Map(),
-    policies: /* @__PURE__ */ new Map(),
-    decisions: /* @__PURE__ */ new Map(),
-    admissionsById: /* @__PURE__ */ new Map(),
-    admissionsByProposal: /* @__PURE__ */ new Map(),
-    terminalDecisionIds: /* @__PURE__ */ new Set(),
-    issueKeys: /* @__PURE__ */ new Set(),
-    statusSeq: 0,
-    issueSeq: 0,
-    auditSeq: 0
-  };
-}
-function freezeWorkItemDomainActionAdmissionViews(state) {
+
+// src/solutions/work-item/actions-shared.ts
+function auditRecord(kind, seq, status) {
   return {
-    admissionsByProposal: new Map(state.admissionsByProposal),
-    admissionsByWorkItem: new Map(
-      Array.from(state.admissionsByWorkItem, ([key, value]) => [key, Object.freeze([...value])])
-    ),
-    issues: Object.freeze([...state.issues]),
-    audit: Object.freeze([...state.audit])
+    id: `${kind}:${seq}`,
+    kind,
+    subjectId: status.workItemId,
+    message: status.message,
+    issueCode: status.code,
+    sourceRefs: status.sourceRefs,
+    metadata: {
+      statusId: status.statusId,
+      state: status.state,
+      proposalId: status.proposalId,
+      admissionId: status.admissionId,
+      actionKind: status.actionKind,
+      ...status.metadata ?? {}
+    }
   };
 }
-function workItemAdmissionProposalRefs(proposal) {
-  return uniqueSourceRefs([
-    ref("work-item", proposal.workItemId),
-    ref("work-item-domain-action-proposal", proposal.proposalId),
-    ref("effect-run", proposal.effectRunId),
-    ref("effect-run-result", proposal.effectRunResultId),
-    ref("work-item-evidence", proposal.evidenceId),
-    ref("work-item-effect-mapping-policy", proposal.policyId),
-    ...proposal.sourceRefs ?? []
-  ]);
-}
-function workItemAdmissionDecisionRefs(decision, proposal, policy) {
-  return uniqueSourceRefs([
-    ...proposal === void 0 ? [] : workItemAdmissionProposalRefs(proposal),
-    ref("work-item-domain-action-admission-decision", decision.decisionId),
-    ref("work-item-domain-action-admission", decision.admissionId),
-    ref("work-item-domain-action-proposal", decision.proposalId),
-    ...decision.policyId === void 0 ? [] : [ref("work-item-domain-action-admission-policy", decision.policyId)],
-    ...policy === void 0 ? [] : [ref("work-item-domain-action-admission-policy", policy.policyId)],
-    ...decision.targetProposalId === void 0 ? [] : [ref("work-item-domain-action-proposal", decision.targetProposalId)],
-    ...decision.targetAdmissionId === void 0 ? [] : [ref("work-item-domain-action-admission", decision.targetAdmissionId)],
-    ...decision.sourceRefs ?? []
-  ]);
-}
-function uniqueSourceRefs(sourceRefs2) {
-  const seen = /* @__PURE__ */ new Set();
-  const unique = [];
-  for (const sourceRef of sourceRefs2) {
-    const key = sourceRefKey(sourceRef);
-    if (seen.has(key)) continue;
-    seen.add(key);
-    unique.push(sourceRef);
-  }
-  return unique;
-}
-function sourceRefKey(sourceRef) {
-  return `${sourceRef.kind}:${sourceRef.id}:${JSON.stringify(sourceRef.metadata ?? {})}`;
-}
-function projectRuntimeFact(graph, runtime, name, factory, pick) {
+function project(graph, runtime, name, factory, select) {
   return graph.node(
     [runtime],
     (ctx) => {
-      for (const fact of depBatch(ctx, 0) ?? []) {
-        const typed = fact;
-        const value = pick(typed);
-        if (value !== void 0) ctx.down([["DATA", value]]);
+      for (const raw of depBatch(ctx, 0) ?? []) {
+        const selected = select(raw);
+        if (selected !== void 0) ctx.down([["DATA", selected]]);
       }
     },
-    { name, factory }
+    { name, factory, partial: true, completeWhenDepsComplete: false, errorWhenDepsError: false }
   );
 }
-function forEachPolicyDepBatch(ctx, start, count, fn) {
-  for (let i = 0; i < count; i += 1) {
-    for (const value of depBatch(ctx, start + i) ?? []) fn(value);
-  }
-}
-function dataIssue(code, message, opts = {}) {
+function dataIssue2(code, message, opts = {}) {
   return {
     kind: "issue",
     code,
     message,
-    severity: opts.severity ?? "error",
+    severity: "error",
+    source: "work-item-actions",
     subjectId: opts.subjectId,
-    refs: opts.refs?.map((r) => `${r.kind}:${r.id}`),
-    details: opts.details
+    refs: opts.refs?.map((sourceRef) => `${sourceRef.kind}:${sourceRef.id}`),
+    metadata: opts.metadata
   };
 }
-function ref(kind, id) {
+function uniqueSourceRefs2(sourceRefs2) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const sourceRef of sourceRefs2) {
+    const key = `${sourceRef.kind}:${sourceRef.id}:${JSON.stringify(sourceRef.metadata ?? {})}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(sourceRef);
+  }
+  return out;
+}
+function sourceRefs(value) {
+  if (!Array.isArray(value)) return void 0;
+  return value.filter(
+    (item) => isRecord(item) && typeof item.kind === "string" && typeof item.id === "string"
+  );
+}
+function numberMetadata(metadata, key) {
+  const value = metadata?.[key];
+  return typeof value === "number" ? value : void 0;
+}
+function stringMetadata(metadata, key) {
+  const value = metadata?.[key];
+  return typeof value === "string" ? value : void 0;
+}
+function ref2(kind, id) {
   return { kind, id };
 }
+function recordString(value, key) {
+  return isRecord(value) && typeof value[key] === "string" ? value[key] : void 0;
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object";
+}
 
-// src/solutions/work-item/actions.ts
+// src/solutions/work-item/actions-types.ts
 var patchFieldKeys = /* @__PURE__ */ new Set([
   "summary",
   "detail",
@@ -735,103 +641,239 @@ var patchFieldKeys = /* @__PURE__ */ new Set([
   "sourceRefs",
   "metadata"
 ]);
-function workItemDomainActionProposal(proposalId, workItemId, actionKind, opts = {}) {
-  return {
-    kind: "work-item-domain-action-proposal",
-    proposalId,
-    workItemId,
-    actionKind,
-    effectRunId: opts.effectRunId ?? `domain-action:${proposalId}:effect-run`,
-    effectRunResultId: opts.effectRunResultId ?? `domain-action:${proposalId}:effect-run-result`,
-    evidenceId: opts.evidenceId ?? `domain-action:${proposalId}:evidence`,
-    policyId: opts.policyId ?? "domain-action-proposal",
-    payload: opts.payload,
-    reason: opts.reason,
-    sourceRefs: opts.sourceRefs,
-    proposedAtMs: opts.proposedAtMs,
-    metadata: opts.metadata
-  };
+
+// src/solutions/work-item/scheduling-shared.ts
+function normalizePlanFromUnknown(draft) {
+  const verificationPlan = draft.verificationPlan;
+  if (verificationPlan !== void 0) {
+    if (!isRecord2(verificationPlan) || !Array.isArray(verificationPlan.steps)) {
+      return { planId: "malformed", steps: [] };
+    }
+    return verificationPlan;
+  }
+  const verificationSteps = draft.verificationSteps;
+  if (verificationSteps !== void 0) {
+    if (!Array.isArray(verificationSteps)) return { planId: "malformed", steps: [] };
+    return { planId: "default", steps: verificationSteps };
+  }
+  return void 0;
 }
-function workItemDomainActionProposalIntake(proposalId, workItemId, actionKind, opts = {}) {
-  return {
-    kind: "work-item-domain-action-proposal-intake",
-    proposalId,
-    workItemId,
-    actionKind,
-    payload: opts.payload,
-    reason: opts.reason,
-    policyId: opts.policyId,
-    effectRunId: opts.effectRunId,
-    effectRunResultId: opts.effectRunResultId,
-    evidenceId: opts.evidenceId,
-    proposedAtMs: opts.proposedAtMs,
-    sourceRefs: opts.sourceRefs,
-    metadata: opts.metadata
-  };
+function isVerificationPlanShape(value) {
+  return isRecord2(value) && typeof value.planId === "string" && Array.isArray(value.steps);
 }
-function workItemDomainActionApplyPolicy(policyId, opts = {}) {
+function issue(code, message, workItemId, metadata) {
   return {
-    kind: "work-item-domain-action-apply-policy",
-    policyId,
-    actionKinds: opts.actionKinds,
-    patch: opts.patch,
-    spawn: opts.spawn,
-    metadata: opts.metadata
+    kind: "issue",
+    code,
+    message,
+    severity: "error",
+    source: "work-item-scheduling",
+    subjectId: workItemId,
+    metadata
   };
 }
-function workItemDomainActionProposalIntakeProjector(graph, opts) {
-  const name = opts.name ?? "workItemDomainActionIntake";
-  const now = opts.now ?? Date.now;
-  const runtime = graph.node(
-    [opts.proposals],
-    (ctx) => {
-      const state = ctx.state.get() ?? {
-        proposals: /* @__PURE__ */ new Set(),
-        statusSeq: 0,
-        auditSeq: 0
-      };
-      for (const raw of depBatch(ctx, 0) ?? []) reduceProposalIntake(ctx, state, raw, now());
-      ctx.state.set(state);
-    },
-    {
-      name: `${name}/runtime`,
-      factory: "workItemDomainActionProposalIntakeProjector",
-      partial: true,
-      completeWhenDepsComplete: false,
-      errorWhenDepsError: false
-    }
-  );
-  return {
-    proposals: project(
-      graph,
-      runtime,
-      `${name}/proposals`,
-      "workItemDomainActionProposals",
-      (fact) => fact.kind === "proposal" ? fact.value : void 0
-    ),
-    status: project(
-      graph,
-      runtime,
-      `${name}/status`,
-      "workItemDomainActionStatus",
-      (fact) => fact.kind === "status" ? fact.value : void 0
-    ),
-    issues: project(
-      graph,
-      runtime,
-      `${name}/issues`,
-      "workItemDomainActionIssues",
-      (fact) => fact.kind === "issue" ? fact.value : void 0
-    ),
-    audit: project(
-      graph,
-      runtime,
-      `${name}/audit`,
-      "workItemDomainActionAudit",
-      (fact) => fact.kind === "audit" ? fact.value : void 0
+function isRecord2(value) {
+  return value !== null && typeof value === "object";
+}
+
+// src/solutions/work-item/scheduling-validation.ts
+function validateWorkItemDraft(draft, opts = {}) {
+  const out = [];
+  if (!isRecord2(draft)) {
+    return [issue("malformed-draft", "WorkItemDraft must be an object", opts.workItemId)];
+  }
+  if (typeof draft.summary !== "string") {
+    out.push(issue("missing-required-field", "WorkItemDraft.summary is required", opts.workItemId));
+  } else if (draft.summary.trim() === "") {
+    out.push(issue("missing-required-field", "WorkItemDraft.summary is required", opts.workItemId));
+  }
+  const criteria = draft.acceptanceCriteria === void 0 || Array.isArray(draft.acceptanceCriteria) ? draft.acceptanceCriteria : void 0;
+  if (draft.acceptanceCriteria !== void 0 && criteria === void 0) {
+    out.push(
+      issue(
+        "malformed-draft",
+        "WorkItemDraft.acceptanceCriteria must be an array",
+        opts.workItemId
+      )
+    );
+  }
+  out.push(...validateAcceptanceCriteria(criteria ?? [], opts));
+  if (draft.verificationPlan !== void 0 && !isVerificationPlanShape(draft.verificationPlan)) {
+    out.push(
+      issue("malformed-draft", "WorkItemDraft.verificationPlan is malformed", opts.workItemId)
+    );
+  }
+  if (draft.verificationSteps !== void 0 && !Array.isArray(draft.verificationSteps)) {
+    out.push(
+      issue("malformed-draft", "WorkItemDraft.verificationSteps must be an array", opts.workItemId)
+    );
+  }
+  const plan = normalizePlanFromUnknown(draft);
+  if (plan !== void 0) {
+    out.push(...validateVerificationPlan(plan, criteria ?? [], opts));
+  }
+  return out;
+}
+function validateAcceptanceCriteria(criteria, opts = {}) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const criterion of criteria) {
+    if (!isRecord2(criterion)) {
+      out.push(issue("malformed-draft", "AcceptanceCriterion must be an object", opts.workItemId));
+      continue;
+    }
+    if (typeof criterion.criterionId !== "string" || criterion.criterionId === "") {
+      out.push(
+        issue(
+          "missing-required-field",
+          "AcceptanceCriterion.criterionId is required",
+          opts.workItemId
+        )
+      );
+      continue;
+    }
+    if (seen.has(criterion.criterionId)) {
+      out.push(
+        issue(
+          "duplicate-id",
+          `Duplicate acceptance criterion id '${criterion.criterionId}'`,
+          opts.workItemId,
+          { criterionId: criterion.criterionId }
+        )
+      );
+    }
+    seen.add(criterion.criterionId);
+    if (typeof criterion.statement !== "string" || criterion.statement.trim() === "") {
+      out.push(
+        issue(
+          "missing-required-field",
+          "AcceptanceCriterion.statement is required",
+          opts.workItemId,
+          { criterionId: criterion.criterionId }
+        )
+      );
+    }
+  }
+  return out;
+}
+function validateVerificationPlan(plan, criteria = [], opts = {}) {
+  const out = [];
+  if (!isRecord2(plan) || !Array.isArray(plan.steps)) {
+    return [issue("malformed-draft", "VerificationPlan.steps must be an array", opts.workItemId)];
+  }
+  const criterionIds = new Set(criteria.map((criterion) => criterion.criterionId));
+  const stepIds = /* @__PURE__ */ new Set();
+  const modes = new Set(opts.allowedModes ?? ["auto", "manual", "hybrid"]);
+  const effectKinds = new Set(opts.allowedEffectKinds ?? ["verification"]);
+  for (const step of plan.steps) {
+    if (!isRecord2(step)) {
+      out.push(issue("malformed-draft", "VerificationStep must be an object", opts.workItemId));
+      continue;
+    }
+    if (typeof step.stepId !== "string" || step.stepId === "") {
+      out.push(
+        issue("missing-required-field", "VerificationStep.stepId is required", opts.workItemId)
+      );
+      continue;
+    }
+    if (stepIds.has(step.stepId)) {
+      out.push(
+        issue("duplicate-id", `Duplicate verification step id '${step.stepId}'`, opts.workItemId, {
+          stepId: step.stepId
+        })
+      );
+    }
+    stepIds.add(step.stepId);
+    if (typeof step.mode !== "string" || !modes.has(step.mode)) {
+      out.push(
+        issue(
+          "unsupported-mode",
+          `Unsupported verification step mode '${step.mode}'`,
+          opts.workItemId,
+          { stepId: step.stepId }
+        )
+      );
+    }
+    if (step.effectKind !== void 0 && (typeof step.effectKind !== "string" || !effectKinds.has(step.effectKind))) {
+      out.push(
+        issue(
+          "unsupported-effect-kind",
+          `Unsupported verification effect kind '${step.effectKind}'`,
+          opts.workItemId,
+          { stepId: step.stepId }
+        )
+      );
+    }
+    const verifiesCriteriaIds = Array.isArray(step.verifiesCriteriaIds) ? step.verifiesCriteriaIds : [];
+    for (const criterionId of verifiesCriteriaIds) {
+      if (!criterionIds.has(criterionId)) {
+        out.push(
+          issue("dangling-ref", `Unknown acceptance criterion '${criterionId}'`, opts.workItemId, {
+            stepId: step.stepId,
+            criterionId
+          })
+        );
+      }
+    }
+  }
+  for (const step of plan.steps) {
+    if (!isRecord2(step) || typeof step.stepId !== "string") continue;
+    const dependsOnStepIds = Array.isArray(step.dependsOnStepIds) ? step.dependsOnStepIds : [];
+    for (const depId of dependsOnStepIds) {
+      if (!stepIds.has(depId)) {
+        out.push(
+          issue("dangling-ref", `Unknown verification dependency '${depId}'`, opts.workItemId, {
+            stepId: step.stepId
+          })
+        );
+      }
+    }
+  }
+  const cycle = findCycle(
+    plan.steps.filter(
+      (step) => isRecord2(step) && typeof step.stepId === "string" && Array.isArray(step.dependsOnStepIds)
     )
+  );
+  if (cycle !== void 0) {
+    out.push(
+      issue(
+        "cyclic-dependency",
+        `Verification step cycle detected: ${cycle.join(" -> ")}`,
+        opts.workItemId,
+        { stepId: cycle[0] }
+      )
+    );
+  }
+  return out;
+}
+function findCycle(steps) {
+  const byId = new Map(steps.map((step) => [step.stepId, step.dependsOnStepIds ?? []]));
+  const visiting = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  const stack = [];
+  const visit = (id) => {
+    if (visiting.has(id)) return [...stack.slice(stack.indexOf(id)), id];
+    if (visited.has(id)) return void 0;
+    visiting.add(id);
+    stack.push(id);
+    for (const dep of byId.get(id) ?? []) {
+      if (!byId.has(dep)) continue;
+      const cycle = visit(dep);
+      if (cycle !== void 0) return cycle;
+    }
+    stack.pop();
+    visiting.delete(id);
+    visited.add(id);
+    return void 0;
   };
+  for (const step of steps) {
+    const cycle = visit(step.stepId);
+    if (cycle !== void 0) return cycle;
+  }
+  return void 0;
 }
+
+// src/solutions/work-item/actions-application.ts
 function workItemDomainActionApplicationProjector(graph, opts) {
   const name = opts.name ?? "workItemDomainActionApplication";
   const deps = opts.applyPolicies === void 0 ? [opts.proposals, opts.admissions, opts.workItems] : [opts.proposals, opts.admissions, opts.workItems, opts.applyPolicies];
@@ -940,1216 +982,1355 @@ function workItemDomainActionApplicationProjector(graph, opts) {
     )
   };
 }
-function workItemDomainActionCapabilityGuardProjector(graph, opts) {
-  const name = opts.name ?? "workItemDomainActionCapabilityGuard";
-  const deps = opts.capabilityAdmissionStatus === void 0 ? [opts.proposals, opts.capabilityAdmissions, opts.guardPolicies] : [
-    opts.proposals,
-    opts.capabilityAdmissions,
-    opts.guardPolicies,
-    opts.capabilityAdmissionStatus
-  ];
-  const statusIndex = opts.capabilityAdmissionStatus === void 0 ? -1 : 3;
-  const now = opts.now ?? Date.now;
-  const runtime = graph.node(
-    deps,
-    (ctx) => {
-      const state = ctx.state.get() ?? {
-        proposals: /* @__PURE__ */ new Map(),
-        admissionsByCapability: /* @__PURE__ */ new Map(),
-        issueStatusesByCapability: /* @__PURE__ */ new Map(),
-        issueStatusesWithoutCapability: [],
-        policies: /* @__PURE__ */ new Map(),
-        emittedProposalDecisions: /* @__PURE__ */ new Set(),
-        emittedStatusKeys: /* @__PURE__ */ new Set(),
-        issueKeys: /* @__PURE__ */ new Set(),
-        statusSeq: 0,
-        auditSeq: 0
-      };
-      for (const raw of depBatch(ctx, 2) ?? []) {
-        const policyIssue = capabilityGuardPolicyIssue(raw);
-        if (policyIssue !== void 0) {
-          emitCapabilityGuardIssue(
-            ctx,
-            state,
-            `malformed-policy:${recordString(raw, "policyId") ?? "unknown"}`,
-            policyIssue
-          );
-          continue;
-        }
-        const policy = raw;
-        state.policies.set(policy.policyId, policy);
+function applyAdmission(ctx, state, admission) {
+  if (state.appliedAdmissions.has(admission.admissionId)) return;
+  const proposal = state.proposals.get(admission.proposalId);
+  if (proposal === void 0) {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `missing-proposal:${admission.admissionId}:${admission.proposalId}`,
+      "dangling-ref",
+      `Admission '${admission.admissionId}' cannot apply without proposal '${admission.proposalId}'`,
+      admission.workItemId,
+      admissionRefs(admission)
+    );
+    return;
+  }
+  if (admission.state !== "admitted") {
+    state.appliedAdmissions.add(admission.admissionId);
+    emitApplication(ctx, state, admission, proposal, admission.state, []);
+    return;
+  }
+  const mismatch = admissionProposalMismatch(admission, proposal);
+  if (mismatch !== void 0) {
+    state.appliedAdmissions.add(admission.admissionId);
+    emitApplicationIssue(
+      ctx,
+      state,
+      `admission-proposal-mismatch:${admission.admissionId}:${mismatch.field}`,
+      "dangling-ref",
+      mismatch.message,
+      admission.workItemId,
+      admissionRefs(admission, proposal),
+      {
+        field: mismatch.field,
+        admissionValue: mismatch.admissionValue,
+        proposalValue: mismatch.proposalValue
       }
-      for (const raw of depBatch(ctx, 1) ?? []) {
-        const admissionIssue = capabilityAdmissionIssue(raw);
-        if (admissionIssue !== void 0) {
-          emitCapabilityGuardIssue(
-            ctx,
-            state,
-            `malformed-admission:${recordString(raw, "admissionId") ?? "unknown"}`,
-            admissionIssue
-          );
-          continue;
-        }
-        const admission = raw;
-        const capabilityKey = capabilityBoundaryRefId(admission.capability);
-        const byCapability = state.admissionsByCapability.get(capabilityKey) ?? [];
-        if (!byCapability.some((item) => item.admissionId === admission.admissionId)) {
-          state.admissionsByCapability.set(capabilityKey, [...byCapability, admission]);
-        }
-      }
-      if (statusIndex >= 0) {
-        for (const raw of depBatch(ctx, statusIndex) ?? []) {
-          const statusIssue = capabilityAdmissionStatusIssue(raw);
-          if (statusIssue !== void 0) {
-            emitCapabilityGuardIssue(
-              ctx,
-              state,
-              `malformed-capability-status:${recordString(raw, "statusId") ?? "unknown"}`,
-              statusIssue
-            );
-            continue;
-          }
-          const status = raw;
-          if (status.state !== "capability-admission-issue") continue;
-          const capabilityId = status.capabilityId;
-          const capabilityKind = status.capabilityKind;
-          if (capabilityId !== void 0 && capabilityKind !== void 0) {
-            const capabilityKey = capabilityBoundaryRefId({
-              id: capabilityId,
-              kind: capabilityKind
-            });
-            const statuses = state.issueStatusesByCapability.get(capabilityKey) ?? [];
-            if (!statuses.some((item) => item.statusId === status.statusId)) {
-              state.issueStatusesByCapability.set(capabilityKey, [...statuses, status]);
-            }
-          } else if (!state.issueStatusesWithoutCapability.some((item) => item.statusId === status.statusId)) {
-            state.issueStatusesWithoutCapability.push(status);
-          }
-          for (const proposal of state.proposals.values())
-            emitCapabilityStatusIssueForProposal(ctx, state, proposal, status);
-        }
-      }
-      for (const raw of depBatch(ctx, 0) ?? []) {
-        const proposalIssue = capabilityGuardProposalIssue(raw);
-        if (proposalIssue !== void 0) {
-          emitCapabilityGuardIssue(
-            ctx,
-            state,
-            `malformed-proposal:${recordString(raw, "proposalId") ?? "unknown"}`,
-            proposalIssue
-          );
-          continue;
-        }
-        const proposal = raw;
-        state.proposals.set(proposal.proposalId, proposal);
-      }
-      for (const proposal of state.proposals.values())
-        evaluateCapabilityGuardProposal(ctx, state, proposal, now());
-      ctx.state.set(state);
-    },
-    {
-      name: `${name}/runtime`,
-      factory: "workItemDomainActionCapabilityGuardProjector",
-      partial: true,
-      completeWhenDepsComplete: false,
-      errorWhenDepsError: false
-    }
-  );
-  return {
-    decisions: project(
-      graph,
-      runtime,
-      `${name}/decisions`,
-      "workItemDomainActionCapabilityGuardDecisions",
-      (fact) => fact.kind === "decision" ? fact.value : void 0
-    ),
-    status: project(
-      graph,
-      runtime,
-      `${name}/status`,
-      "workItemDomainActionCapabilityGuardStatus",
-      (fact) => fact.kind === "status" ? fact.value : void 0
-    ),
-    issues: project(
-      graph,
-      runtime,
-      `${name}/issues`,
-      "workItemDomainActionCapabilityGuardIssues",
-      (fact) => fact.kind === "issue" ? fact.value : void 0
-    ),
-    audit: project(
-      graph,
-      runtime,
-      `${name}/audit`,
-      "workItemDomainActionCapabilityGuardAudit",
-      (fact) => fact.kind === "audit" ? fact.value : void 0
-    )
-  };
-}
-function evaluateCapabilityGuardProposal(ctx, state, proposal, decidedAtMs) {
-  if (state.emittedProposalDecisions.has(proposal.proposalId)) return;
-  const policy = selectCapabilityGuardPolicy(state, proposal);
-  if (typeof policy === "string") {
-    emitCapabilityGuardIssue(
+    );
+    emitApplication(ctx, state, admission, proposal, "rejected", [], {
+      code: "dangling-ref",
+      message: mismatch.message
+    });
+    return;
+  }
+  const workItem = state.workItems.get(admission.workItemId);
+  if (workItem === void 0) {
+    emitApplicationIssue(
       ctx,
       state,
-      `policy:${proposal.proposalId}:${policy}`,
-      dataIssue2(policy, capabilityGuardPolicyMessage(policy, proposal), {
-        subjectId: proposal.workItemId,
-        refs: [ref2("work-item-domain-action-proposal", proposal.proposalId)]
-      })
+      `missing-work-item:${admission.admissionId}:${admission.workItemId}`,
+      "dangling-ref",
+      `Admission '${admission.admissionId}' references unknown WorkItem '${admission.workItemId}'`,
+      admission.workItemId,
+      admissionRefs(admission, proposal)
     );
     return;
   }
-  for (const status of state.issueStatusesWithoutCapability)
-    emitCapabilityStatusIssueForProposal(ctx, state, proposal, status);
-  for (const capabilityRef of policy.capabilityRefs) {
-    for (const status of state.issueStatusesByCapability.get(
-      capabilityBoundaryRefId(capabilityRef)
-    ) ?? [])
-      emitCapabilityStatusIssueForProposal(ctx, state, proposal, status);
-  }
-  const admissions = policy.capabilityRefs.map(
-    (capabilityRef) => latestCapabilityAdmission(state, policy, capabilityRef)
-  );
-  const missingCapabilityRefs = policy.capabilityRefs.filter(
-    (_, index) => admissions[index] === void 0
-  );
-  const deferredCapabilityRefs = admissions.filter((admission) => admission !== void 0).filter((admission) => admission.state === "deferred").map((admission) => capabilityBoundaryRefId(admission.capability));
-  if (missingCapabilityRefs.length > 0 || deferredCapabilityRefs.length > 0) {
-    emitCapabilityGuardStatusOnce(
+  const metadataConflict = conflictingApplicationMetadata(proposal, admission);
+  if (metadataConflict !== void 0) {
+    state.appliedAdmissions.add(admission.admissionId);
+    emitApplicationIssue(
       ctx,
       state,
-      `deferred:${proposal.proposalId}:${policy.policyId}:missing=${missingCapabilityRefs.map(capabilityBoundaryRefId).join(",")}:deferred=${deferredCapabilityRefs.join(",")}`,
+      `metadata-conflict:${admission.admissionId}:${metadataConflict.field}`,
+      metadataConflict.code,
+      metadataConflict.message,
+      admission.workItemId,
+      admissionRefs(admission, proposal),
       {
-        state: "deferred",
-        workItemId: proposal.workItemId,
-        proposalId: proposal.proposalId,
-        actionKind: proposal.actionKind,
-        policyId: policy.policyId,
-        capabilityRefs: policy.capabilityRefs,
-        admissionSubjectIds: policy.admissionSubjectIds,
-        message: "WorkItem domain action is waiting for capability admission",
-        sourceRefs: capabilityGuardRefs(proposal, policy, admissions),
-        metadata: {
-          missingCapabilityRefs: missingCapabilityRefs.map(capabilityBoundaryRefId),
-          deferredCapabilityRefs
-        }
+        field: metadataConflict.field,
+        admissionValue: metadataConflict.admissionValue,
+        proposalValue: metadataConflict.proposalValue
       }
     );
+    emitApplication(ctx, state, admission, proposal, "rejected", [], {
+      code: metadataConflict.code,
+      message: metadataConflict.message
+    });
     return;
   }
-  const presentAdmissions = admissions.filter(
-    (admission) => admission !== void 0
-  );
-  const blocked = presentAdmissions.filter((admission) => admission.state === "blocked");
-  const outcome = blocked.length === 0 ? "admit" : "reject";
-  const decision = {
-    kind: "work-item-domain-action-admission-decision",
-    decisionId: `capability-guard:${proposal.proposalId}:decision`,
-    admissionId: `capability-guard:${proposal.proposalId}:admission`,
-    proposalId: proposal.proposalId,
-    outcome,
-    reason: blocked.length === 0 ? "Capability guard admitted required capabilities" : "Capability guard rejected blocked capabilities",
-    decidedAtMs,
-    sourceRefs: capabilityGuardRefs(proposal, policy, presentAdmissions),
-    metadata: {
-      capabilityGuardPolicyId: policy.policyId,
-      capabilityRefs: policy.capabilityRefs.map(capabilityBoundaryRefId),
-      admissionSubjectIds: policy.admissionSubjectIds,
-      blockedCapabilityRefs: blocked.map(
-        (admission) => capabilityBoundaryRefId(admission.capability)
-      )
-    }
-  };
-  state.emittedProposalDecisions.add(proposal.proposalId);
-  emitCapabilityGuard(ctx, "decision", decision);
-  emitCapabilityGuardStatus(ctx, state, {
-    state: outcome === "admit" ? "admitted" : "rejected",
-    workItemId: proposal.workItemId,
-    proposalId: proposal.proposalId,
-    actionKind: proposal.actionKind,
-    policyId: policy.policyId,
-    capabilityRefs: policy.capabilityRefs,
-    admissionSubjectIds: policy.admissionSubjectIds,
-    admissionIds: presentAdmissions.map((admission) => admission.admissionId),
-    sourceRefs: decision.sourceRefs,
-    metadata: { decisionId: decision.decisionId, admissionId: decision.admissionId }
-  });
-}
-function capabilityGuardProposalIssue(proposal) {
-  if (!isRecord2(proposal) || proposal.kind !== "work-item-domain-action-proposal" || typeof proposal.proposalId !== "string" || proposal.proposalId.length === 0 || typeof proposal.workItemId !== "string" || proposal.workItemId.length === 0 || typeof proposal.actionKind !== "string" || proposal.actionKind.length === 0 || proposal.sourceRefs !== void 0 && !isSourceRefArray(proposal.sourceRefs)) {
-    return dataIssue2(
-      "malformed-work-item-domain-action-capability-guard-proposal",
-      "WorkItem domain action capability guard requires valid proposal DATA facts",
-      { subjectId: recordString(proposal, "workItemId") }
-    );
-  }
-  return void 0;
-}
-function capabilityGuardPolicyIssue(policy) {
-  if (!isRecord2(policy) || policy.kind !== "work-item-domain-action-capability-guard-policy" || typeof policy.policyId !== "string" || policy.policyId.length === 0 || !Array.isArray(policy.capabilityRefs) || policy.capabilityRefs.length === 0 || !policy.capabilityRefs.every(isBoundaryCapabilityRef) || !Array.isArray(policy.admissionSubjectIds) || policy.admissionSubjectIds.length === 0 || !policy.admissionSubjectIds.every((id) => typeof id === "string" && id.length > 0) || policy.actionKinds !== void 0 && (!Array.isArray(policy.actionKinds) || !policy.actionKinds.every((kind) => typeof kind === "string" && kind.length > 0))) {
-    return dataIssue2(
-      "malformed-work-item-domain-action-capability-guard-policy",
-      "WorkItem domain action capability guard policy requires policyId, capabilityRefs, and admissionSubjectIds",
-      {
-        subjectId: recordString(policy, "policyId")
-      }
+  const stale = staleRevision(proposal, admission, workItem);
+  if (stale !== void 0) {
+    state.appliedAdmissions.add(admission.admissionId);
+    emitApplicationIssue(
+      ctx,
+      state,
+      `stale:${admission.admissionId}:${stale.kind}:${stale.expected}:${stale.current}`,
+      stale.kind,
+      `Admission '${admission.admissionId}' targets stale WorkItem revision`,
+      admission.workItemId,
+      admissionRefs(admission, proposal),
+      { expected: stale.expected, current: stale.current }
     );
+    emitApplication(ctx, state, admission, proposal, "rejected", [], {
+      code: stale.kind,
+      message: "Stale WorkItem revision"
+    });
+    return;
   }
-  return void 0;
-}
-function capabilityAdmissionIssue(admission) {
-  if (!isRecord2(admission) || admission.kind !== "capability-admission" || typeof admission.admissionId !== "string" || admission.admissionId.length === 0 || typeof admission.proposalId !== "string" || admission.proposalId.length === 0 || typeof admission.subjectId !== "string" || admission.subjectId.length === 0 || !isBoundaryCapabilityRef(admission.capability) || !isCapabilityAdmissionState(admission.state) || typeof admission.decisionId !== "string" || admission.decisionId.length === 0 || admission.sourceRefs !== void 0 && !isSourceRefArray(admission.sourceRefs)) {
-    return dataIssue2(
-      "malformed-capability-admission",
-      "WorkItem domain action capability guard requires valid CapabilityAdmission DATA facts",
-      { subjectId: recordString(admission, "subjectId") }
+  const policyResult = selectApplyPolicy(state, proposal, admission);
+  if (typeof policyResult === "string") {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `policy:${admission.admissionId}:${policyResult}`,
+      policyResult,
+      applyPolicyMessage(policyResult, proposal, admission),
+      admission.workItemId,
+      admissionRefs(admission, proposal)
     );
+    return;
   }
-  return void 0;
-}
-function capabilityAdmissionStatusIssue(status) {
-  if (!isRecord2(status) || status.kind !== "capability-admission-status" || typeof status.statusId !== "string" || status.statusId.length === 0 || !isCapabilityAdmissionStatusState(status.state)) {
-    return dataIssue2(
-      "malformed-capability-admission-status",
-      "WorkItem domain action capability guard requires valid CapabilityAdmissionStatus DATA facts",
-      { subjectId: recordString(status, "subjectId") }
-    );
+  const output = lowerAction(ctx, state, workItem, proposal, admission, policyResult);
+  if (output === void 0) {
+    state.appliedAdmissions.add(admission.admissionId);
+    emitApplication(ctx, state, admission, proposal, "rejected", [], {
+      code: "invalid-action",
+      message: "WorkItem domain action application rejected; see emitted issues",
+      policyId: policyResult.policyId
+    });
+    return;
   }
-  const hasCapabilityId = status.capabilityId !== void 0;
-  const hasCapabilityKind = status.capabilityKind !== void 0;
-  if (hasCapabilityId !== hasCapabilityKind || hasCapabilityId && (typeof status.capabilityId !== "string" || status.capabilityId.length === 0 || !isBoundaryCapabilityKind(status.capabilityKind)) || status.sourceRefs !== void 0 && !isSourceRefArray(status.sourceRefs) || status.issues !== void 0 && !isDataIssueArray(status.issues)) {
-    return dataIssue2(
-      "malformed-capability-admission-status",
-      "WorkItem domain action capability guard requires valid CapabilityAdmissionStatus DATA facts",
-      { subjectId: recordString(status, "subjectId") }
+  const duplicateFactId = firstDuplicateFactId(state, output.facts);
+  if (duplicateFactId !== void 0) {
+    state.appliedAdmissions.add(admission.admissionId);
+    emitApplicationIssue(
+      ctx,
+      state,
+      `duplicate-authoring-fact:${admission.admissionId}:${duplicateFactId}`,
+      "duplicate-suppressed",
+      `WorkItem domain action application '${admission.admissionId}' would duplicate authoring fact '${duplicateFactId}'`,
+      admission.workItemId,
+      admissionRefs(admission, proposal, policyResult),
+      { eventId: duplicateFactId }
     );
+    emitApplication(ctx, state, admission, proposal, "duplicate", [], {
+      code: "duplicate-suppressed",
+      message: "Duplicate WorkItem authoring fact suppressed atomically",
+      policyId: policyResult.policyId
+    });
+    return;
   }
-  return void 0;
-}
-function isCapabilityAdmissionState(value) {
-  return value === "allowed" || value === "blocked" || value === "deferred";
-}
-function isCapabilityAdmissionStatusState(value) {
-  return value === "capability-admission-allowed" || value === "capability-admission-blocked" || value === "capability-admission-deferred" || value === "capability-admission-issue";
-}
-function isSourceRefArray(value) {
-  return Array.isArray(value) && value.every(
-    (item) => isRecord2(item) && typeof item.kind === "string" && typeof item.id === "string"
-  );
-}
-function isDataIssueArray(value) {
-  return Array.isArray(value) && value.every(isDataIssue);
-}
-function isDataIssue(value) {
-  return isRecord2(value) && value.kind === "issue" && typeof value.code === "string" && value.code.length > 0 && typeof value.message === "string" && value.message.length > 0;
-}
-function isBoundaryCapabilityRef(value) {
-  return isRecord2(value) && typeof value.id === "string" && value.id.length > 0 && isBoundaryCapabilityKind(value.kind) && typeof value.required === "boolean" && (value.sourceRefs === void 0 || Array.isArray(value.sourceRefs) && value.sourceRefs.every((sourceRef) => typeof sourceRef === "string"));
-}
-function isBoundaryCapabilityKind(value) {
-  return value === "auth" || value === "permission" || value === "config" || value === "resource";
-}
-function selectCapabilityGuardPolicy(state, proposal) {
-  const explicitId = stringMetadata(proposal.metadata, "capabilityGuardPolicyId") ?? proposal.sourceRefs?.find(
-    (sourceRef) => sourceRef.kind === "work-item-domain-action-capability-guard-policy"
-  )?.id;
-  if (explicitId !== void 0)
-    return state.policies.get(explicitId) ?? "unknown-work-item-domain-action-capability-guard-policy";
-  const matching = [...state.policies.values()].filter(
-    (policy) => policy.actionKinds === void 0 || policy.actionKinds.includes(proposal.actionKind)
-  );
-  if (matching.length === 0) return "missing-policy";
-  if (matching.length > 1) return "policy-mismatch";
-  return matching[0];
+  state.appliedAdmissions.add(admission.admissionId);
+  for (const fact of output.facts) claimFactId(state, fact.eventId);
+  for (const fact of output.facts) emitApplicationFact(ctx, "authoring-fact", fact);
+  emitApplication(ctx, state, admission, proposal, output.state, output.facts, {
+    code: output.code,
+    message: output.message,
+    policyId: policyResult.policyId
+  });
 }
-function latestCapabilityAdmission(state, policy, capabilityRef) {
-  const admissions = state.admissionsByCapability.get(capabilityBoundaryRefId(capabilityRef)) ?? [];
-  for (let index = admissions.length - 1; index >= 0; index -= 1) {
-    const admission = admissions[index];
-    if (admission !== void 0 && policy.admissionSubjectIds.includes(admission.subjectId))
-      return admission;
+function lowerAction(ctx, state, workItem, proposal, admission, policy) {
+  if (!policyAllowsAction(policy, proposal.actionKind)) {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `policy-action:${admission.admissionId}:${policy.policyId}:${proposal.actionKind}`,
+      "policy-mismatch",
+      `Apply policy '${policy.policyId}' does not allow actionKind '${proposal.actionKind}'`,
+      proposal.workItemId,
+      admissionRefs(admission, proposal, policy)
+    );
+    return { state: "policy-rejected", facts: [], code: "policy-mismatch" };
   }
-  return void 0;
-}
-function emitCapabilityStatusIssueForProposal(ctx, state, proposal, status) {
-  const policy = selectCapabilityGuardPolicy(state, proposal);
-  if (typeof policy === "string") return;
-  if (status.subjectId !== void 0 && !policy.admissionSubjectIds.includes(status.subjectId))
-    return;
-  const capabilityId = status.capabilityId;
-  const capabilityKind = status.capabilityKind;
-  const statusCapabilityKey = capabilityId === void 0 || capabilityKind === void 0 ? void 0 : capabilityBoundaryRefId({ id: capabilityId, kind: capabilityKind });
-  if (statusCapabilityKey !== void 0 && !policy.capabilityRefs.some(
-    (capabilityRef) => capabilityBoundaryRefId(capabilityRef) === statusCapabilityKey
-  ))
-    return;
-  const issue2 = status.issues?.[0] ?? dataIssue2(
-    "capability-admission-status-issue",
-    "Capability admission status reported an issue",
-    { subjectId: proposal.workItemId }
-  );
-  emitCapabilityGuardIssue(
+  if (proposal.actionKind === "patch") {
+    const lowered = lowerPatchAction(ctx, state, workItem, proposal, admission, policy);
+    if (lowered === void 0) return void 0;
+    return { state: "applied", facts: lowered };
+  }
+  if (proposal.actionKind === "mark-verified" || proposal.actionKind === "require-review") {
+    return {
+      state: "proposal-only",
+      facts: [],
+      code: "domain-fact-unimplemented",
+      message: `Action '${proposal.actionKind}' recorded as visible application status only; no WorkItem domain mutation fact was emitted`
+    };
+  }
+  if (proposal.actionKind === "spawn-proposed" || proposal.actionKind === "spawn-child") {
+    return lowerSpawnAction(ctx, state, proposal, admission, policy);
+  }
+  emitApplicationIssue(
     ctx,
     state,
-    `capability-status:${proposal.proposalId}:${status.statusId}`,
-    dataIssue2(issue2.code, issue2.message, {
-      subjectId: proposal.workItemId,
-      refs: uniqueSourceRefs2([
-        ...capabilityGuardRefs(proposal, policy),
-        ...status.sourceRefs ?? []
-      ]),
-      metadata: {
-        ...statusCapabilityKey === void 0 ? {} : { capabilityRef: statusCapabilityKey },
-        capabilityAdmissionStatusId: status.statusId
-      }
-    })
+    `unsupported-action:${admission.admissionId}:${proposal.actionKind}`,
+    "unsupported-effect-kind",
+    `Unsupported WorkItem domain actionKind '${proposal.actionKind}'`,
+    proposal.workItemId,
+    admissionRefs(admission, proposal, policy)
   );
+  return { state: "rejected", facts: [], code: "unsupported-effect-kind" };
 }
-function capabilityGuardPolicyMessage(code, proposal) {
-  if (code === "missing-policy")
-    return `WorkItem domain action '${proposal.proposalId}' has no capability guard policy`;
-  if (code === "unknown-work-item-domain-action-capability-guard-policy")
-    return `WorkItem domain action '${proposal.proposalId}' references a missing capability guard policy`;
-  return `WorkItem domain action '${proposal.proposalId}' matches multiple capability guard policies`;
-}
-function capabilityGuardRefs(proposal, policy, admissions = []) {
-  return uniqueSourceRefs2([
-    ref2("work-item", proposal.workItemId),
-    ref2("work-item-domain-action-proposal", proposal.proposalId),
-    ref2("work-item-domain-action-capability-guard-policy", policy.policyId),
-    ...admissions.filter((admission) => admission !== void 0).flatMap((admission) => [
-      ref2("capability-admission", admission.admissionId),
-      ref2("capability-admission-proposal", admission.proposalId),
-      ref2("boundary-capability", capabilityBoundaryRefId(admission.capability)),
-      ...admission.sourceRefs ?? []
-    ]),
-    ...proposal.sourceRefs ?? []
-  ]);
-}
-function capabilityBoundaryRefId(capability) {
-  return `${capability.kind}:${capability.id}`;
-}
-function emitCapabilityGuardStatus(ctx, state, status) {
-  state.statusSeq += 1;
-  const statusFact = {
-    kind: "work-item-domain-action-capability-guard-status",
-    statusId: `work-item-domain-action-capability-guard-status:${state.statusSeq}`,
-    ...status
-  };
-  emitCapabilityGuard(ctx, "status", statusFact);
-  state.auditSeq += 1;
-  emitCapabilityGuard(ctx, "audit", {
-    id: `work-item-domain-action-capability-guard-status:${state.auditSeq}`,
-    kind: "work-item-domain-action-capability-guard-status",
-    subjectId: status.workItemId,
-    message: status.message,
-    sourceRefs: status.sourceRefs,
-    metadata: {
-      statusId: statusFact.statusId,
-      state: status.state,
-      proposalId: status.proposalId,
-      policyId: status.policyId,
-      ...status.metadata ?? {}
+function lowerPatchAction(ctx, state, workItem, proposal, admission, policy) {
+  const payload = normalizePatchPayload(proposal.payload);
+  if (typeof payload === "string") {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `invalid-patch:${admission.admissionId}`,
+      "invalid-patch",
+      payload,
+      proposal.workItemId,
+      admissionRefs(admission, proposal, policy)
+    );
+    return void 0;
+  }
+  const splitPayload = splitDedicatedPatchFields(payload, workItem);
+  const facts = [];
+  if (splitPayload.patch !== void 0) {
+    const invalid = invalidPatchKeys(splitPayload.patch, policy);
+    if (invalid.length > 0) {
+      emitApplicationIssue(
+        ctx,
+        state,
+        `invalid-patch-fields:${admission.admissionId}:${invalid.join(",")}`,
+        "invalid-patch",
+        `Patch action uses unsupported fields: ${invalid.join(", ")}`,
+        proposal.workItemId,
+        admissionRefs(admission, proposal, policy),
+        { invalidFields: invalid }
+      );
+      return void 0;
     }
-  });
-}
-function emitCapabilityGuardStatusOnce(ctx, state, key, status) {
-  if (state.emittedStatusKeys.has(key)) return;
-  state.emittedStatusKeys.add(key);
-  emitCapabilityGuardStatus(ctx, state, status);
-}
-function emitCapabilityGuardIssue(ctx, state, key, issue2) {
-  if (state.issueKeys.has(key)) return;
-  state.issueKeys.add(key);
-  emitCapabilityGuard(ctx, "issue", issue2);
-  emitCapabilityGuardStatus(ctx, state, {
-    state: "issue",
-    workItemId: issue2.subjectId,
-    issues: [issue2],
-    message: issue2.message,
-    metadata: { issueCode: issue2.code }
-  });
-}
-function emitCapabilityGuard(ctx, kind, value) {
-  ctx.down([["DATA", { kind, value }]]);
-}
-function reduceProposalIntake(ctx, state, input, proposedAtMs) {
-  const proposal = normalizeProposal(input, proposedAtMs);
-  if (typeof proposal === "string") {
-    const issue2 = dataIssue2("malformed-domain-action-proposal", proposal);
-    emitIntake(ctx, "issue", issue2);
-    emitIntakeStatus(ctx, state, {
-      state: "rejected",
-      code: issue2.code,
-      message: issue2.message
+    facts.push({
+      kind: "work-item-patched",
+      eventId: splitPayload.eventId ?? `${admission.admissionId}:work-item-patched`,
+      workItemId: workItem.workItemId,
+      patch: splitPayload.patch,
+      executionRelevantFields: splitPayload.executionRelevantFields ?? policy.patch?.executionRelevantFields,
+      authorId: splitPayload.authorId,
+      sourceRefs: actionSourceRefs(admission, proposal, policy),
+      metadata: { ...splitPayload.metadata ?? {}, actionKind: proposal.actionKind }
     });
-    return;
   }
-  if (state.proposals.has(proposal.proposalId)) {
-    emitIntakeStatus(ctx, state, {
-      state: "duplicate",
-      code: "duplicate-suppressed",
-      workItemId: proposal.workItemId,
-      proposalId: proposal.proposalId,
-      actionKind: proposal.actionKind,
-      message: `Duplicate WorkItem domain action proposal '${proposal.proposalId}' suppressed`
+  if (splitPayload.acceptanceCriteria !== void 0) {
+    if (!allowsAcceptanceCriteria(policy)) {
+      emitApplicationIssue(
+        ctx,
+        state,
+        `ac-policy:${admission.admissionId}`,
+        "policy-mismatch",
+        `Apply policy '${policy.policyId}' does not allow acceptance criteria changes`,
+        proposal.workItemId,
+        admissionRefs(admission, proposal, policy)
+      );
+      return void 0;
+    }
+    const issues = validateAcceptanceCriteria(splitPayload.acceptanceCriteria, {
+      workItemId: workItem.workItemId
+    });
+    if (issues.length > 0) {
+      for (const item of issues) emitApplicationFact(ctx, "issue", item);
+      emitApplicationStatus(ctx, state, {
+        state: "rejected",
+        code: issues[0]?.code,
+        message: issues[0]?.message,
+        workItemId: workItem.workItemId,
+        proposalId: proposal.proposalId,
+        admissionId: admission.admissionId,
+        actionKind: proposal.actionKind,
+        sourceRefs: admissionRefs(admission, proposal, policy)
+      });
+      return void 0;
+    }
+    facts.push({
+      kind: "acceptance-criteria-changed",
+      eventId: `${admission.admissionId}:acceptance-criteria-changed`,
+      workItemId: workItem.workItemId,
+      acceptanceCriteria: splitPayload.acceptanceCriteria,
+      authorId: splitPayload.authorId,
+      sourceRefs: actionSourceRefs(admission, proposal, policy),
+      metadata: { ...splitPayload.metadata ?? {}, actionKind: proposal.actionKind }
     });
-    return;
-  }
-  state.proposals.add(proposal.proposalId);
-  emitIntake(ctx, "proposal", proposal);
-  emitIntakeStatus(ctx, state, {
-    state: "proposed",
-    workItemId: proposal.workItemId,
-    proposalId: proposal.proposalId,
-    actionKind: proposal.actionKind,
-    sourceRefs: proposal.sourceRefs
-  });
-}
-function normalizeProposal(input, proposedAtMs) {
-  if (!isRecord2(input)) return "WorkItemDomainActionProposal intake must be an object";
-  if (input.kind !== "work-item-domain-action-proposal" && input.kind !== "work-item-domain-action-proposal-intake")
-    return "WorkItemDomainActionProposal intake has unsupported kind";
-  if (typeof input.proposalId !== "string" || input.proposalId.trim() === "")
-    return "WorkItemDomainActionProposal.proposalId is required";
-  if (typeof input.workItemId !== "string" || input.workItemId.trim() === "")
-    return "WorkItemDomainActionProposal.workItemId is required";
-  if (typeof input.actionKind !== "string" || input.actionKind.trim() === "")
-    return "WorkItemDomainActionProposal.actionKind is required";
-  if (input.kind === "work-item-domain-action-proposal") {
-    if (typeof input.effectRunId !== "string")
-      return "WorkItemDomainActionProposal.effectRunId is required";
-    if (typeof input.effectRunResultId !== "string")
-      return "WorkItemDomainActionProposal.effectRunResultId is required";
-    if (typeof input.evidenceId !== "string")
-      return "WorkItemDomainActionProposal.evidenceId is required";
-    if (typeof input.policyId !== "string")
-      return "WorkItemDomainActionProposal.policyId is required";
-    return input;
   }
-  return workItemDomainActionProposal(
-    input.proposalId,
-    input.workItemId,
-    input.actionKind,
-    {
-      payload: input.payload,
-      reason: typeof input.reason === "string" ? input.reason : void 0,
-      policyId: typeof input.policyId === "string" ? input.policyId : void 0,
-      effectRunId: typeof input.effectRunId === "string" ? input.effectRunId : void 0,
-      effectRunResultId: typeof input.effectRunResultId === "string" ? input.effectRunResultId : void 0,
-      evidenceId: typeof input.evidenceId === "string" ? input.evidenceId : void 0,
-      proposedAtMs: typeof input.proposedAtMs === "number" ? input.proposedAtMs : proposedAtMs,
-      sourceRefs: sourceRefs(input.sourceRefs),
-      metadata: isRecord2(input.metadata) ? input.metadata : void 0
+  if (splitPayload.verificationPlan !== void 0) {
+    if (!allowsVerificationPlan(policy)) {
+      emitApplicationIssue(
+        ctx,
+        state,
+        `plan-policy:${admission.admissionId}`,
+        "policy-mismatch",
+        `Apply policy '${policy.policyId}' does not allow verification plan changes`,
+        proposal.workItemId,
+        admissionRefs(admission, proposal, policy)
+      );
+      return void 0;
     }
-  );
-}
-function applyAdmission(ctx, state, admission) {
-  if (state.appliedAdmissions.has(admission.admissionId)) return;
-  const proposal = state.proposals.get(admission.proposalId);
-  if (proposal === void 0) {
+    const issues = validateVerificationPlan(
+      splitPayload.verificationPlan,
+      splitPayload.acceptanceCriteria ?? workItem.acceptanceCriteria ?? [],
+      { workItemId: workItem.workItemId }
+    );
+    if (issues.length > 0) {
+      for (const item of issues) emitApplicationFact(ctx, "issue", item);
+      emitApplicationStatus(ctx, state, {
+        state: "rejected",
+        code: issues[0]?.code,
+        message: issues[0]?.message,
+        workItemId: workItem.workItemId,
+        proposalId: proposal.proposalId,
+        admissionId: admission.admissionId,
+        actionKind: proposal.actionKind,
+        sourceRefs: admissionRefs(admission, proposal, policy)
+      });
+      return void 0;
+    }
+    facts.push({
+      kind: "verification-plan-changed",
+      eventId: `${admission.admissionId}:verification-plan-changed`,
+      workItemId: workItem.workItemId,
+      verificationPlan: splitPayload.verificationPlan,
+      authorId: splitPayload.authorId,
+      sourceRefs: actionSourceRefs(admission, proposal, policy),
+      metadata: { ...splitPayload.metadata ?? {}, actionKind: proposal.actionKind }
+    });
+  }
+  if (facts.length === 0) {
     emitApplicationIssue(
       ctx,
       state,
-      `missing-proposal:${admission.admissionId}:${admission.proposalId}`,
-      "dangling-ref",
-      `Admission '${admission.admissionId}' cannot apply without proposal '${admission.proposalId}'`,
-      admission.workItemId,
-      admissionRefs(admission)
+      `empty-patch:${admission.admissionId}`,
+      "invalid-patch",
+      "Patch action payload did not contain patch, acceptanceCriteria, or verificationPlan",
+      proposal.workItemId,
+      admissionRefs(admission, proposal, policy)
     );
-    return;
+    return void 0;
   }
-  if (admission.state !== "admitted") {
-    state.appliedAdmissions.add(admission.admissionId);
-    emitApplication(ctx, state, admission, proposal, admission.state, []);
-    return;
+  return facts;
+}
+function lowerSpawnAction(ctx, state, proposal, admission, policy) {
+  if (policy.spawn?.create !== true) {
+    return {
+      state: "proposal-only",
+      facts: [],
+      message: "Spawn action remains proposal/admission only without explicit create policy"
+    };
   }
-  const mismatch = admissionProposalMismatch(admission, proposal);
-  if (mismatch !== void 0) {
-    state.appliedAdmissions.add(admission.admissionId);
+  const policyIssue = validateSpawnCreatePolicy(policy, proposal);
+  if (policyIssue !== void 0) {
     emitApplicationIssue(
       ctx,
       state,
-      `admission-proposal-mismatch:${admission.admissionId}:${mismatch.field}`,
-      "dangling-ref",
-      mismatch.message,
-      admission.workItemId,
-      admissionRefs(admission, proposal),
-      {
-        field: mismatch.field,
-        admissionValue: mismatch.admissionValue,
-        proposalValue: mismatch.proposalValue
-      }
+      `spawn-create-policy:${admission.admissionId}:${policy.policyId}:${policyIssue.field}`,
+      "policy-mismatch",
+      policyIssue.message,
+      proposal.workItemId,
+      admissionRefs(admission, proposal, policy),
+      { field: policyIssue.field }
     );
-    emitApplication(ctx, state, admission, proposal, "rejected", [], {
-      code: "dangling-ref",
-      message: mismatch.message
-    });
-    return;
+    return {
+      state: "policy-rejected",
+      facts: [],
+      code: "policy-mismatch",
+      message: policyIssue.message
+    };
   }
-  const workItem = state.workItems.get(admission.workItemId);
-  if (workItem === void 0) {
+  const payload = normalizeSpawnPayload(proposal.payload);
+  if (typeof payload === "string") {
     emitApplicationIssue(
       ctx,
       state,
-      `missing-work-item:${admission.admissionId}:${admission.workItemId}`,
-      "dangling-ref",
-      `Admission '${admission.admissionId}' references unknown WorkItem '${admission.workItemId}'`,
-      admission.workItemId,
-      admissionRefs(admission, proposal)
+      `invalid-spawn-payload:${admission.admissionId}`,
+      "invalid-patch",
+      payload,
+      proposal.workItemId,
+      admissionRefs(admission, proposal, policy)
     );
-    return;
+    return { state: "rejected", facts: [], code: "invalid-patch", message: payload };
   }
-  const metadataConflict = conflictingApplicationMetadata(proposal, admission);
-  if (metadataConflict !== void 0) {
-    state.appliedAdmissions.add(admission.admissionId);
+  const childWorkItemId = payload.childWorkItemId ?? payload.workItemId ?? policy.spawn.childWorkItemId ?? (policy.spawn.childIdPrefix === void 0 ? void 0 : `${policy.spawn.childIdPrefix}${admission.admissionId}`);
+  if (childWorkItemId === void 0 || childWorkItemId.trim() === "") {
+    const message = "Spawn create action requires a childWorkItemId or create policy child id";
     emitApplicationIssue(
       ctx,
       state,
-      `metadata-conflict:${admission.admissionId}:${metadataConflict.field}`,
-      metadataConflict.code,
-      metadataConflict.message,
-      admission.workItemId,
-      admissionRefs(admission, proposal),
-      {
-        field: metadataConflict.field,
-        admissionValue: metadataConflict.admissionValue,
-        proposalValue: metadataConflict.proposalValue
-      }
+      `missing-spawn-child-id:${admission.admissionId}`,
+      "missing-required-field",
+      message,
+      proposal.workItemId,
+      admissionRefs(admission, proposal, policy)
     );
-    emitApplication(ctx, state, admission, proposal, "rejected", [], {
-      code: metadataConflict.code,
-      message: metadataConflict.message
-    });
-    return;
+    return { state: "rejected", facts: [], code: "missing-required-field", message };
   }
-  const stale = staleRevision(proposal, admission, workItem);
-  if (stale !== void 0) {
-    state.appliedAdmissions.add(admission.admissionId);
+  if (state.workItems.has(childWorkItemId)) {
+    const message = `Spawn create action would duplicate WorkItem '${childWorkItemId}'`;
     emitApplicationIssue(
       ctx,
       state,
-      `stale:${admission.admissionId}:${stale.kind}:${stale.expected}:${stale.current}`,
-      stale.kind,
-      `Admission '${admission.admissionId}' targets stale WorkItem revision`,
-      admission.workItemId,
-      admissionRefs(admission, proposal),
-      { expected: stale.expected, current: stale.current }
+      `duplicate-spawn-child:${admission.admissionId}:${childWorkItemId}`,
+      "duplicate-id",
+      message,
+      childWorkItemId,
+      admissionRefs(admission, proposal, policy)
     );
-    emitApplication(ctx, state, admission, proposal, "rejected", [], {
-      code: stale.kind,
-      message: "Stale WorkItem revision"
-    });
-    return;
+    return { state: "duplicate", facts: [], code: "duplicate-id", message };
   }
-  const policyResult = selectApplyPolicy(state, proposal, admission);
-  if (typeof policyResult === "string") {
+  if (payload.draft === void 0) {
+    const message = "Spawn create action requires a draft payload";
     emitApplicationIssue(
       ctx,
       state,
-      `policy:${admission.admissionId}:${policyResult}`,
-      policyResult,
-      applyPolicyMessage(policyResult, proposal, admission),
-      admission.workItemId,
-      admissionRefs(admission, proposal)
+      `missing-spawn-draft:${admission.admissionId}`,
+      "missing-required-field",
+      message,
+      childWorkItemId,
+      admissionRefs(admission, proposal, policy)
     );
-    return;
+    return { state: "rejected", facts: [], code: "missing-required-field", message };
   }
-  const output = lowerAction(ctx, state, workItem, proposal, admission, policyResult);
-  if (output === void 0) {
-    state.appliedAdmissions.add(admission.admissionId);
-    emitApplication(ctx, state, admission, proposal, "rejected", [], {
-      code: "invalid-action",
-      message: "WorkItem domain action application rejected; see emitted issues",
-      policyId: policyResult.policyId
-    });
-    return;
+  const issues = validateWorkItemDraft(payload.draft, { workItemId: childWorkItemId });
+  if (issues.length > 0) {
+    for (const item of issues) emitApplicationFact(ctx, "issue", item);
+    return {
+      state: "rejected",
+      facts: [],
+      code: issues[0]?.code,
+      message: issues[0]?.message
+    };
   }
-  const duplicateFactId = firstDuplicateFactId(state, output.facts);
-  if (duplicateFactId !== void 0) {
-    state.appliedAdmissions.add(admission.admissionId);
-    emitApplicationIssue(
-      ctx,
-      state,
-      `duplicate-authoring-fact:${admission.admissionId}:${duplicateFactId}`,
-      "duplicate-suppressed",
-      `WorkItem domain action application '${admission.admissionId}' would duplicate authoring fact '${duplicateFactId}'`,
-      admission.workItemId,
-      admissionRefs(admission, proposal, policyResult),
-      { eventId: duplicateFactId }
-    );
-    emitApplication(ctx, state, admission, proposal, "duplicate", [], {
-      code: "duplicate-suppressed",
-      message: "Duplicate WorkItem authoring fact suppressed atomically",
-      policyId: policyResult.policyId
-    });
-    return;
+  const metadata = {
+    ...payload.metadata ?? {},
+    actionKind: proposal.actionKind,
+    parentWorkItemId: policy.spawn.linkParent === true ? proposal.workItemId : void 0,
+    sourceProposalId: proposal.proposalId,
+    idempotencyKey: payload.idempotencyKey ?? policy.spawn.idempotencyKey
+  };
+  const created = {
+    kind: "work-item-created",
+    eventId: payload.eventId ?? `${admission.admissionId}:work-item-created:${childWorkItemId}`,
+    workItemId: childWorkItemId,
+    draft: payload.draft,
+    authorId: payload.authorId,
+    sourceRefs: actionSourceRefs(admission, proposal, policy),
+    metadata
+  };
+  return { state: "applied", facts: [created] };
+}
+function validateSpawnCreatePolicy(policy, proposal) {
+  if (policy.spawn?.idempotencyKey === void 0 || policy.spawn.idempotencyKey.trim() === "") {
+    return {
+      field: "idempotencyKey",
+      message: `Spawn create policy '${policy.policyId}' requires an idempotencyKey`
+    };
   }
-  state.appliedAdmissions.add(admission.admissionId);
-  for (const fact of output.facts) claimFactId(state, fact.eventId);
-  for (const fact of output.facts) emitApplicationFact(ctx, "authoring-fact", fact);
-  emitApplication(ctx, state, admission, proposal, output.state, output.facts, {
-    code: output.code,
-    message: output.message,
-    policyId: policyResult.policyId
-  });
+  if (policy.spawn.maxChildrenPerAdmission === void 0 || policy.spawn.maxChildrenPerAdmission < 1) {
+    return {
+      field: "maxChildrenPerAdmission",
+      message: `Spawn create policy '${policy.policyId}' requires maxChildrenPerAdmission >= 1`
+    };
+  }
+  if (proposal.actionKind === "spawn-child" && policy.spawn.linkParent !== true) {
+    return {
+      field: "linkParent",
+      message: `Spawn child create policy '${policy.policyId}' requires linkParent: true`
+    };
+  }
+  return void 0;
 }
-function lowerAction(ctx, state, workItem, proposal, admission, policy) {
-  if (!policyAllowsAction(policy, proposal.actionKind)) {
-    emitApplicationIssue(
-      ctx,
-      state,
-      `policy-action:${admission.admissionId}:${policy.policyId}:${proposal.actionKind}`,
-      "policy-mismatch",
-      `Apply policy '${policy.policyId}' does not allow actionKind '${proposal.actionKind}'`,
-      proposal.workItemId,
-      admissionRefs(admission, proposal, policy)
-    );
-    return { state: "policy-rejected", facts: [], code: "policy-mismatch" };
+function normalizeSpawnPayload(payload) {
+  if (!isRecord(payload)) return "Spawn action payload must be an object";
+  if ("draft" in payload && payload.draft !== void 0 && !isRecord(payload.draft)) {
+    return "Spawn action payload.draft must be an object";
   }
-  if (proposal.actionKind === "patch") {
-    const lowered = lowerPatchAction(ctx, state, workItem, proposal, admission, policy);
-    if (lowered === void 0) return void 0;
-    return { state: "applied", facts: lowered };
+  if ("metadata" in payload && payload.metadata !== void 0 && !isRecord(payload.metadata)) {
+    return "Spawn action payload.metadata must be an object";
   }
-  if (proposal.actionKind === "mark-verified" || proposal.actionKind === "require-review") {
+  return payload;
+}
+function normalizePatchPayload(payload) {
+  if (!isRecord(payload)) return "Patch action payload must be an object";
+  if ("patch" in payload || "acceptanceCriteria" in payload || "verificationPlan" in payload || "executionRelevantFields" in payload) {
+    if ("patch" in payload && payload.patch !== void 0 && !isRecord(payload.patch))
+      return "Patch action payload.patch must be an object";
+    if ("acceptanceCriteria" in payload && payload.acceptanceCriteria !== void 0 && !Array.isArray(payload.acceptanceCriteria))
+      return "Patch action payload.acceptanceCriteria must be an array";
+    if ("verificationPlan" in payload && payload.verificationPlan !== void 0 && !isRecord(payload.verificationPlan))
+      return "Patch action payload.verificationPlan must be an object";
+    const inlinePatch = inlinePatchFields(payload);
+    const explicitPatch = isRecord(payload.patch) ? payload.patch : void 0;
+    const patch = explicitPatch === void 0 ? inlinePatch : { ...inlinePatch, ...explicitPatch };
     return {
-      state: "proposal-only",
-      facts: [],
-      code: "domain-fact-unimplemented",
-      message: `Action '${proposal.actionKind}' recorded as visible application status only; no WorkItem domain mutation fact was emitted`
+      ...payload,
+      patch: Object.keys(patch).length === 0 ? void 0 : patch
     };
   }
-  if (proposal.actionKind === "spawn-proposed" || proposal.actionKind === "spawn-child") {
-    return lowerSpawnAction(ctx, state, proposal, admission, policy);
+  return { patch: payload };
+}
+function inlinePatchFields(payload) {
+  const patch = {};
+  for (const [key, value] of Object.entries(payload)) {
+    if (key === "metadata") continue;
+    if (patchFieldKeys.has(key)) patch[key] = value;
   }
-  emitApplicationIssue(
-    ctx,
-    state,
-    `unsupported-action:${admission.admissionId}:${proposal.actionKind}`,
-    "unsupported-effect-kind",
-    `Unsupported WorkItem domain actionKind '${proposal.actionKind}'`,
-    proposal.workItemId,
-    admissionRefs(admission, proposal, policy)
+  return patch;
+}
+function splitDedicatedPatchFields(payload, workItem) {
+  if (!isRecord(payload.patch)) return payload;
+  const patchRecord = payload.patch;
+  const patch = {};
+  for (const [key, value] of Object.entries(patchRecord)) {
+    if (key === "acceptanceCriteria" || key === "verificationPlan" || key === "verificationSteps")
+      continue;
+    patch[key] = value;
+  }
+  const acceptanceCriteria = payload.acceptanceCriteria ?? (Array.isArray(patchRecord.acceptanceCriteria) ? patchRecord.acceptanceCriteria : void 0);
+  const verificationPlan = payload.verificationPlan ?? (isRecord(patchRecord.verificationPlan) ? patchRecord.verificationPlan : Array.isArray(patchRecord.verificationSteps) ? {
+    ...workItem.verificationPlan ?? { planId: "default" },
+    steps: patchRecord.verificationSteps
+  } : void 0);
+  return {
+    ...payload,
+    patch: Object.keys(patch).length === 0 ? void 0 : patch,
+    acceptanceCriteria,
+    verificationPlan
+  };
+}
+function invalidPatchKeys(patch, policy) {
+  const allowed = new Set(policy.patch?.allowedFields ?? Array.from(patchFieldKeys));
+  return Object.keys(patch).filter((key) => !patchFieldKeys.has(key) || !allowed.has(key));
+}
+function allowsAcceptanceCriteria(policy) {
+  if (policy.patch?.allowAcceptanceCriteria === false) return false;
+  const allowed = policy.patch?.allowedFields;
+  return allowed === void 0 || allowed.includes("acceptanceCriteria") || policy.patch?.allowAcceptanceCriteria === true;
+}
+function allowsVerificationPlan(policy) {
+  if (policy.patch?.allowVerificationPlan === false) return false;
+  const allowed = policy.patch?.allowedFields;
+  return allowed === void 0 || allowed.includes("verificationPlan") || allowed.includes("verificationSteps") || policy.patch?.allowVerificationPlan === true;
+}
+function selectApplyPolicy(state, proposal, admission) {
+  const explicitId = explicitApplyPolicyId(proposal, admission);
+  if (explicitId !== void 0)
+    return state.policies.get(explicitId) ?? "unknown-work-item-domain-action-apply-policy";
+  const matching = Array.from(state.policies.values()).filter(
+    (policy) => policyAllowsAction(policy, proposal.actionKind)
+  );
+  if (matching.length === 0) return "missing-policy";
+  if (matching.length > 1) return "policy-mismatch";
+  return matching[0];
+}
+function explicitApplyPolicyId(proposal, admission) {
+  const metadataPolicy = stringMetadata(admission.metadata, "applyPolicyId") ?? stringMetadata(proposal.metadata, "applyPolicyId");
+  if (metadataPolicy !== void 0) return metadataPolicy;
+  return [...admission.sourceRefs ?? [], ...proposal.sourceRefs ?? []].find(
+    (sourceRef) => sourceRef.kind === "work-item-domain-action-apply-policy"
+  )?.id;
+}
+function policyAllowsAction(policy, actionKind) {
+  return policy.actionKinds === void 0 || policy.actionKinds.includes(actionKind);
+}
+function admissionProposalMismatch(admission, proposal) {
+  if (admission.workItemId !== proposal.workItemId)
+    return {
+      field: "workItemId",
+      admissionValue: admission.workItemId,
+      proposalValue: proposal.workItemId,
+      message: `Admission '${admission.admissionId}' workItemId does not match proposal '${proposal.proposalId}'`
+    };
+  if (admission.actionKind !== proposal.actionKind)
+    return {
+      field: "actionKind",
+      admissionValue: admission.actionKind,
+      proposalValue: proposal.actionKind,
+      message: `Admission '${admission.admissionId}' actionKind does not match proposal '${proposal.proposalId}'`
+    };
+  return void 0;
+}
+function conflictingApplicationMetadata(proposal, admission) {
+  const authoringRevision = conflictingMetadataNumber(proposal, admission, "authoringRevision");
+  if (authoringRevision !== void 0)
+    return {
+      field: "authoringRevision",
+      code: "stale-revision",
+      ...authoringRevision,
+      message: `Admission '${admission.admissionId}' carries conflicting authoringRevision metadata`
+    };
+  const executionInputRevision = conflictingMetadataNumber(
+    proposal,
+    admission,
+    "executionInputRevision"
+  );
+  if (executionInputRevision !== void 0)
+    return {
+      field: "executionInputRevision",
+      code: "stale-execution-input",
+      ...executionInputRevision,
+      message: `Admission '${admission.admissionId}' carries conflicting executionInputRevision metadata`
+    };
+  const applyPolicyId = conflictingMetadataString(proposal, admission, "applyPolicyId");
+  if (applyPolicyId !== void 0)
+    return {
+      field: "applyPolicyId",
+      code: "policy-mismatch",
+      ...applyPolicyId,
+      message: `Admission '${admission.admissionId}' carries conflicting applyPolicyId metadata`
+    };
+  return void 0;
+}
+function conflictingMetadataNumber(proposal, admission, key) {
+  const proposalValue = numberMetadata(proposal.metadata, key);
+  const admissionValue = numberMetadata(admission.metadata, key);
+  if (proposalValue === void 0 || admissionValue === void 0 || proposalValue === admissionValue)
+    return void 0;
+  return { proposalValue, admissionValue };
+}
+function conflictingMetadataString(proposal, admission, key) {
+  const proposalValue = stringMetadata(proposal.metadata, key);
+  const admissionValue = stringMetadata(admission.metadata, key);
+  if (proposalValue === void 0 || admissionValue === void 0 || proposalValue === admissionValue)
+    return void 0;
+  return { proposalValue, admissionValue };
+}
+function staleRevision(proposal, admission, workItem) {
+  const authoringRevision = numberMetadata(admission.metadata, "authoringRevision") ?? numberMetadata(proposal.metadata, "authoringRevision");
+  if (authoringRevision !== void 0 && authoringRevision !== workItem.authoringRevision)
+    return {
+      kind: "stale-revision",
+      expected: authoringRevision,
+      current: workItem.authoringRevision
+    };
+  const executionInputRevision = numberMetadata(admission.metadata, "executionInputRevision") ?? numberMetadata(proposal.metadata, "executionInputRevision");
+  if (executionInputRevision !== void 0 && executionInputRevision !== workItem.executionInputRevision)
+    return {
+      kind: "stale-execution-input",
+      expected: executionInputRevision,
+      current: workItem.executionInputRevision
+    };
+  return void 0;
+}
+function applyPolicyMessage(code, proposal, admission) {
+  if (code === "missing-policy")
+    return `Admitted action '${admission.admissionId}' requires an explicit apply policy`;
+  if (code === "unknown-work-item-domain-action-apply-policy")
+    return `Admitted action '${admission.admissionId}' references a missing apply policy`;
+  return `Admitted action '${proposal.proposalId}' matches multiple apply policies`;
+}
+function emitApplication(ctx, state, admission, proposal, applicationState, facts, opts = {}) {
+  const producedFactIds = facts.map((fact) => fact.eventId);
+  const application = {
+    kind: "work-item-domain-action-application",
+    applicationId: `${admission.admissionId}:application`,
+    admissionId: admission.admissionId,
+    proposalId: proposal.proposalId,
+    workItemId: proposal.workItemId,
+    actionKind: proposal.actionKind,
+    state: applicationState,
+    producedFactIds,
+    reason: admission.reason ?? proposal.reason,
+    sourceRefs: admissionRefs(admission, proposal),
+    metadata: { policyId: opts.policyId, code: opts.code }
+  };
+  emitApplicationFact(ctx, "application", application);
+  emitApplicationStatus(ctx, state, {
+    state: applicationState,
+    code: opts.code,
+    message: opts.message,
+    workItemId: proposal.workItemId,
+    proposalId: proposal.proposalId,
+    admissionId: admission.admissionId,
+    actionKind: proposal.actionKind,
+    sourceRefs: application.sourceRefs,
+    metadata: { producedFactIds, policyId: opts.policyId }
+  });
+}
+function emitApplicationIssue(ctx, state, key, code, message, workItemId, sourceRefs2, metadata) {
+  if (state.issueKeys.has(key)) return;
+  state.issueKeys.add(key);
+  const item = dataIssue2(code, message, { subjectId: workItemId, refs: sourceRefs2, metadata });
+  emitApplicationFact(ctx, "issue", item);
+  emitApplicationStatus(ctx, state, {
+    state: code === "missing-policy" ? "missing-policy" : "rejected",
+    code,
+    message,
+    workItemId,
+    sourceRefs: sourceRefs2,
+    metadata
+  });
+}
+function emitApplicationStatus(ctx, state, status) {
+  state.statusSeq += 1;
+  const statusFact = {
+    kind: "work-item-domain-action-status",
+    statusId: `work-item-domain-action-application-status:${state.statusSeq}`,
+    ...status
+  };
+  emitApplicationFact(ctx, "status", statusFact);
+  emitApplicationAudit(ctx, state, "work-item-domain-action-application-status", statusFact);
+}
+function emitApplicationAudit(ctx, state, kind, status) {
+  state.auditSeq += 1;
+  emitApplicationFact(ctx, "audit", auditRecord(kind, state.auditSeq, status));
+}
+function emitApplicationFact(ctx, kind, value) {
+  ctx.down([["DATA", { kind, value }]]);
+}
+function firstDuplicateFactId(state, facts) {
+  const pending = /* @__PURE__ */ new Set();
+  for (const fact of facts) {
+    if (state.emittedFactIds.has(fact.eventId) || pending.has(fact.eventId)) return fact.eventId;
+    pending.add(fact.eventId);
+  }
+  return void 0;
+}
+function claimFactId(state, factId) {
+  if (state.emittedFactIds.has(factId)) return false;
+  state.emittedFactIds.add(factId);
+  return true;
+}
+function admissionRefs(admission, proposal, policy) {
+  return uniqueSourceRefs2([
+    ref2("work-item-domain-action-admission", admission.admissionId),
+    ref2("work-item-domain-action-proposal", admission.proposalId),
+    ...proposal === void 0 ? [] : [
+      ref2("work-item", proposal.workItemId),
+      ref2("work-item-evidence", proposal.evidenceId),
+      ...proposal.sourceRefs ?? []
+    ],
+    ...policy === void 0 ? [] : [ref2("work-item-domain-action-apply-policy", policy.policyId)],
+    ...admission.sourceRefs ?? []
+  ]);
+}
+function actionSourceRefs(admission, proposal, policy) {
+  return admissionRefs(admission, proposal, policy);
+}
+
+// src/solutions/work-item/actions-builders.ts
+function workItemDomainActionProposal(proposalId, workItemId, actionKind, opts = {}) {
+  return {
+    kind: "work-item-domain-action-proposal",
+    proposalId,
+    workItemId,
+    actionKind,
+    effectRunId: opts.effectRunId ?? `domain-action:${proposalId}:effect-run`,
+    effectRunResultId: opts.effectRunResultId ?? `domain-action:${proposalId}:effect-run-result`,
+    evidenceId: opts.evidenceId ?? `domain-action:${proposalId}:evidence`,
+    policyId: opts.policyId ?? "domain-action-proposal",
+    payload: opts.payload,
+    reason: opts.reason,
+    sourceRefs: opts.sourceRefs,
+    proposedAtMs: opts.proposedAtMs,
+    metadata: opts.metadata
+  };
+}
+function workItemDomainActionProposalIntake(proposalId, workItemId, actionKind, opts = {}) {
+  return {
+    kind: "work-item-domain-action-proposal-intake",
+    proposalId,
+    workItemId,
+    actionKind,
+    payload: opts.payload,
+    reason: opts.reason,
+    policyId: opts.policyId,
+    effectRunId: opts.effectRunId,
+    effectRunResultId: opts.effectRunResultId,
+    evidenceId: opts.evidenceId,
+    proposedAtMs: opts.proposedAtMs,
+    sourceRefs: opts.sourceRefs,
+    metadata: opts.metadata
+  };
+}
+function workItemDomainActionApplyPolicy(policyId, opts = {}) {
+  return {
+    kind: "work-item-domain-action-apply-policy",
+    policyId,
+    actionKinds: opts.actionKinds,
+    patch: opts.patch,
+    spawn: opts.spawn,
+    metadata: opts.metadata
+  };
+}
+
+// src/solutions/work-item/actions-capability-guard.ts
+function workItemDomainActionCapabilityGuardProjector(graph, opts) {
+  const name = opts.name ?? "workItemDomainActionCapabilityGuard";
+  const deps = opts.capabilityAdmissionStatus === void 0 ? [opts.proposals, opts.capabilityAdmissions, opts.guardPolicies] : [
+    opts.proposals,
+    opts.capabilityAdmissions,
+    opts.guardPolicies,
+    opts.capabilityAdmissionStatus
+  ];
+  const statusIndex = opts.capabilityAdmissionStatus === void 0 ? -1 : 3;
+  const now = opts.now ?? Date.now;
+  const runtime = graph.node(
+    deps,
+    (ctx) => {
+      const state = ctx.state.get() ?? {
+        proposals: /* @__PURE__ */ new Map(),
+        admissionsByCapability: /* @__PURE__ */ new Map(),
+        issueStatusesByCapability: /* @__PURE__ */ new Map(),
+        issueStatusesWithoutCapability: [],
+        policies: /* @__PURE__ */ new Map(),
+        emittedProposalDecisions: /* @__PURE__ */ new Set(),
+        emittedStatusKeys: /* @__PURE__ */ new Set(),
+        issueKeys: /* @__PURE__ */ new Set(),
+        statusSeq: 0,
+        auditSeq: 0
+      };
+      for (const raw of depBatch(ctx, 2) ?? []) {
+        const policyIssue = capabilityGuardPolicyIssue(raw);
+        if (policyIssue !== void 0) {
+          emitCapabilityGuardIssue(
+            ctx,
+            state,
+            `malformed-policy:${recordString(raw, "policyId") ?? "unknown"}`,
+            policyIssue
+          );
+          continue;
+        }
+        const policy = raw;
+        state.policies.set(policy.policyId, policy);
+      }
+      for (const raw of depBatch(ctx, 1) ?? []) {
+        const admissionIssue = capabilityAdmissionIssue(raw);
+        if (admissionIssue !== void 0) {
+          emitCapabilityGuardIssue(
+            ctx,
+            state,
+            `malformed-admission:${recordString(raw, "admissionId") ?? "unknown"}`,
+            admissionIssue
+          );
+          continue;
+        }
+        const admission = raw;
+        const capabilityKey = capabilityBoundaryRefId(admission.capability);
+        const byCapability = state.admissionsByCapability.get(capabilityKey) ?? [];
+        if (!byCapability.some((item) => item.admissionId === admission.admissionId)) {
+          state.admissionsByCapability.set(capabilityKey, [...byCapability, admission]);
+        }
+      }
+      if (statusIndex >= 0) {
+        for (const raw of depBatch(ctx, statusIndex) ?? []) {
+          const statusIssue = capabilityAdmissionStatusIssue(raw);
+          if (statusIssue !== void 0) {
+            emitCapabilityGuardIssue(
+              ctx,
+              state,
+              `malformed-capability-status:${recordString(raw, "statusId") ?? "unknown"}`,
+              statusIssue
+            );
+            continue;
+          }
+          const status = raw;
+          if (status.state !== "capability-admission-issue") continue;
+          const capabilityId = status.capabilityId;
+          const capabilityKind = status.capabilityKind;
+          if (capabilityId !== void 0 && capabilityKind !== void 0) {
+            const capabilityKey = capabilityBoundaryRefId({
+              id: capabilityId,
+              kind: capabilityKind
+            });
+            const statuses = state.issueStatusesByCapability.get(capabilityKey) ?? [];
+            if (!statuses.some((item) => item.statusId === status.statusId)) {
+              state.issueStatusesByCapability.set(capabilityKey, [...statuses, status]);
+            }
+          } else if (!state.issueStatusesWithoutCapability.some((item) => item.statusId === status.statusId)) {
+            state.issueStatusesWithoutCapability.push(status);
+          }
+          for (const proposal of state.proposals.values())
+            emitCapabilityStatusIssueForProposal(ctx, state, proposal, status);
+        }
+      }
+      for (const raw of depBatch(ctx, 0) ?? []) {
+        const proposalIssue = capabilityGuardProposalIssue(raw);
+        if (proposalIssue !== void 0) {
+          emitCapabilityGuardIssue(
+            ctx,
+            state,
+            `malformed-proposal:${recordString(raw, "proposalId") ?? "unknown"}`,
+            proposalIssue
+          );
+          continue;
+        }
+        const proposal = raw;
+        state.proposals.set(proposal.proposalId, proposal);
+      }
+      for (const proposal of state.proposals.values())
+        evaluateCapabilityGuardProposal(ctx, state, proposal, now());
+      ctx.state.set(state);
+    },
+    {
+      name: `${name}/runtime`,
+      factory: "workItemDomainActionCapabilityGuardProjector",
+      partial: true,
+      completeWhenDepsComplete: false,
+      errorWhenDepsError: false
+    }
+  );
+  return {
+    decisions: project(
+      graph,
+      runtime,
+      `${name}/decisions`,
+      "workItemDomainActionCapabilityGuardDecisions",
+      (fact) => fact.kind === "decision" ? fact.value : void 0
+    ),
+    status: project(
+      graph,
+      runtime,
+      `${name}/status`,
+      "workItemDomainActionCapabilityGuardStatus",
+      (fact) => fact.kind === "status" ? fact.value : void 0
+    ),
+    issues: project(
+      graph,
+      runtime,
+      `${name}/issues`,
+      "workItemDomainActionCapabilityGuardIssues",
+      (fact) => fact.kind === "issue" ? fact.value : void 0
+    ),
+    audit: project(
+      graph,
+      runtime,
+      `${name}/audit`,
+      "workItemDomainActionCapabilityGuardAudit",
+      (fact) => fact.kind === "audit" ? fact.value : void 0
+    )
+  };
+}
+function evaluateCapabilityGuardProposal(ctx, state, proposal, decidedAtMs) {
+  if (state.emittedProposalDecisions.has(proposal.proposalId)) return;
+  const policy = selectCapabilityGuardPolicy(state, proposal);
+  if (typeof policy === "string") {
+    emitCapabilityGuardIssue(
+      ctx,
+      state,
+      `policy:${proposal.proposalId}:${policy}`,
+      dataIssue2(policy, capabilityGuardPolicyMessage(policy, proposal), {
+        subjectId: proposal.workItemId,
+        refs: [ref2("work-item-domain-action-proposal", proposal.proposalId)]
+      })
+    );
+    return;
+  }
+  for (const status of state.issueStatusesWithoutCapability)
+    emitCapabilityStatusIssueForProposal(ctx, state, proposal, status);
+  for (const capabilityRef of policy.capabilityRefs) {
+    for (const status of state.issueStatusesByCapability.get(
+      capabilityBoundaryRefId(capabilityRef)
+    ) ?? [])
+      emitCapabilityStatusIssueForProposal(ctx, state, proposal, status);
+  }
+  const admissions = policy.capabilityRefs.map(
+    (capabilityRef) => latestCapabilityAdmission(state, policy, capabilityRef)
+  );
+  const missingCapabilityRefs = policy.capabilityRefs.filter(
+    (_, index) => admissions[index] === void 0
   );
-  return { state: "rejected", facts: [], code: "unsupported-effect-kind" };
-}
-function lowerPatchAction(ctx, state, workItem, proposal, admission, policy) {
-  const payload = normalizePatchPayload(proposal.payload);
-  if (typeof payload === "string") {
-    emitApplicationIssue(
+  const deferredCapabilityRefs = admissions.filter((admission) => admission !== void 0).filter((admission) => admission.state === "deferred").map((admission) => capabilityBoundaryRefId(admission.capability));
+  if (missingCapabilityRefs.length > 0 || deferredCapabilityRefs.length > 0) {
+    emitCapabilityGuardStatusOnce(
       ctx,
       state,
-      `invalid-patch:${admission.admissionId}`,
-      "invalid-patch",
-      payload,
-      proposal.workItemId,
-      admissionRefs(admission, proposal, policy)
-    );
-    return void 0;
-  }
-  const splitPayload = splitDedicatedPatchFields(payload, workItem);
-  const facts = [];
-  if (splitPayload.patch !== void 0) {
-    const invalid = invalidPatchKeys(splitPayload.patch, policy);
-    if (invalid.length > 0) {
-      emitApplicationIssue(
-        ctx,
-        state,
-        `invalid-patch-fields:${admission.admissionId}:${invalid.join(",")}`,
-        "invalid-patch",
-        `Patch action uses unsupported fields: ${invalid.join(", ")}`,
-        proposal.workItemId,
-        admissionRefs(admission, proposal, policy),
-        { invalidFields: invalid }
-      );
-      return void 0;
-    }
-    facts.push({
-      kind: "work-item-patched",
-      eventId: splitPayload.eventId ?? `${admission.admissionId}:work-item-patched`,
-      workItemId: workItem.workItemId,
-      patch: splitPayload.patch,
-      executionRelevantFields: splitPayload.executionRelevantFields ?? policy.patch?.executionRelevantFields,
-      authorId: splitPayload.authorId,
-      sourceRefs: actionSourceRefs(admission, proposal, policy),
-      metadata: { ...splitPayload.metadata ?? {}, actionKind: proposal.actionKind }
-    });
-  }
-  if (splitPayload.acceptanceCriteria !== void 0) {
-    if (!allowsAcceptanceCriteria(policy)) {
-      emitApplicationIssue(
-        ctx,
-        state,
-        `ac-policy:${admission.admissionId}`,
-        "policy-mismatch",
-        `Apply policy '${policy.policyId}' does not allow acceptance criteria changes`,
-        proposal.workItemId,
-        admissionRefs(admission, proposal, policy)
-      );
-      return void 0;
-    }
-    const issues = validateAcceptanceCriteria(splitPayload.acceptanceCriteria, {
-      workItemId: workItem.workItemId
-    });
-    if (issues.length > 0) {
-      for (const item of issues) emitApplicationFact(ctx, "issue", item);
-      emitApplicationStatus(ctx, state, {
-        state: "rejected",
-        code: issues[0]?.code,
-        message: issues[0]?.message,
-        workItemId: workItem.workItemId,
+      `deferred:${proposal.proposalId}:${policy.policyId}:missing=${missingCapabilityRefs.map(capabilityBoundaryRefId).join(",")}:deferred=${deferredCapabilityRefs.join(",")}`,
+      {
+        state: "deferred",
+        workItemId: proposal.workItemId,
         proposalId: proposal.proposalId,
-        admissionId: admission.admissionId,
         actionKind: proposal.actionKind,
-        sourceRefs: admissionRefs(admission, proposal, policy)
-      });
-      return void 0;
-    }
-    facts.push({
-      kind: "acceptance-criteria-changed",
-      eventId: `${admission.admissionId}:acceptance-criteria-changed`,
-      workItemId: workItem.workItemId,
-      acceptanceCriteria: splitPayload.acceptanceCriteria,
-      authorId: splitPayload.authorId,
-      sourceRefs: actionSourceRefs(admission, proposal, policy),
-      metadata: { ...splitPayload.metadata ?? {}, actionKind: proposal.actionKind }
-    });
+        policyId: policy.policyId,
+        capabilityRefs: policy.capabilityRefs,
+        admissionSubjectIds: policy.admissionSubjectIds,
+        message: "WorkItem domain action is waiting for capability admission",
+        sourceRefs: capabilityGuardRefs(proposal, policy, admissions),
+        metadata: {
+          missingCapabilityRefs: missingCapabilityRefs.map(capabilityBoundaryRefId),
+          deferredCapabilityRefs
+        }
+      }
+    );
+    return;
   }
-  if (splitPayload.verificationPlan !== void 0) {
-    if (!allowsVerificationPlan(policy)) {
-      emitApplicationIssue(
-        ctx,
-        state,
-        `plan-policy:${admission.admissionId}`,
-        "policy-mismatch",
-        `Apply policy '${policy.policyId}' does not allow verification plan changes`,
-        proposal.workItemId,
-        admissionRefs(admission, proposal, policy)
-      );
-      return void 0;
+  const presentAdmissions = admissions.filter(
+    (admission) => admission !== void 0
+  );
+  const blocked = presentAdmissions.filter((admission) => admission.state === "blocked");
+  const outcome = blocked.length === 0 ? "admit" : "reject";
+  const decision = {
+    kind: "work-item-domain-action-admission-decision",
+    decisionId: `capability-guard:${proposal.proposalId}:decision`,
+    admissionId: `capability-guard:${proposal.proposalId}:admission`,
+    proposalId: proposal.proposalId,
+    outcome,
+    reason: blocked.length === 0 ? "Capability guard admitted required capabilities" : "Capability guard rejected blocked capabilities",
+    decidedAtMs,
+    sourceRefs: capabilityGuardRefs(proposal, policy, presentAdmissions),
+    metadata: {
+      capabilityGuardPolicyId: policy.policyId,
+      capabilityRefs: policy.capabilityRefs.map(capabilityBoundaryRefId),
+      admissionSubjectIds: policy.admissionSubjectIds,
+      blockedCapabilityRefs: blocked.map(
+        (admission) => capabilityBoundaryRefId(admission.capability)
+      )
     }
-    const issues = validateVerificationPlan(
-      splitPayload.verificationPlan,
-      splitPayload.acceptanceCriteria ?? workItem.acceptanceCriteria ?? [],
-      { workItemId: workItem.workItemId }
+  };
+  state.emittedProposalDecisions.add(proposal.proposalId);
+  emitCapabilityGuard(ctx, "decision", decision);
+  emitCapabilityGuardStatus(ctx, state, {
+    state: outcome === "admit" ? "admitted" : "rejected",
+    workItemId: proposal.workItemId,
+    proposalId: proposal.proposalId,
+    actionKind: proposal.actionKind,
+    policyId: policy.policyId,
+    capabilityRefs: policy.capabilityRefs,
+    admissionSubjectIds: policy.admissionSubjectIds,
+    admissionIds: presentAdmissions.map((admission) => admission.admissionId),
+    sourceRefs: decision.sourceRefs,
+    metadata: { decisionId: decision.decisionId, admissionId: decision.admissionId }
+  });
+}
+function capabilityGuardProposalIssue(proposal) {
+  if (!isRecord(proposal) || proposal.kind !== "work-item-domain-action-proposal" || typeof proposal.proposalId !== "string" || proposal.proposalId.length === 0 || typeof proposal.workItemId !== "string" || proposal.workItemId.length === 0 || typeof proposal.actionKind !== "string" || proposal.actionKind.length === 0 || proposal.sourceRefs !== void 0 && !isSourceRefArray(proposal.sourceRefs)) {
+    return dataIssue2(
+      "malformed-work-item-domain-action-capability-guard-proposal",
+      "WorkItem domain action capability guard requires valid proposal DATA facts",
+      { subjectId: recordString(proposal, "workItemId") }
     );
-    if (issues.length > 0) {
-      for (const item of issues) emitApplicationFact(ctx, "issue", item);
-      emitApplicationStatus(ctx, state, {
-        state: "rejected",
-        code: issues[0]?.code,
-        message: issues[0]?.message,
-        workItemId: workItem.workItemId,
-        proposalId: proposal.proposalId,
-        admissionId: admission.admissionId,
-        actionKind: proposal.actionKind,
-        sourceRefs: admissionRefs(admission, proposal, policy)
-      });
-      return void 0;
-    }
-    facts.push({
-      kind: "verification-plan-changed",
-      eventId: `${admission.admissionId}:verification-plan-changed`,
-      workItemId: workItem.workItemId,
-      verificationPlan: splitPayload.verificationPlan,
-      authorId: splitPayload.authorId,
-      sourceRefs: actionSourceRefs(admission, proposal, policy),
-      metadata: { ...splitPayload.metadata ?? {}, actionKind: proposal.actionKind }
-    });
   }
-  if (facts.length === 0) {
-    emitApplicationIssue(
-      ctx,
-      state,
-      `empty-patch:${admission.admissionId}`,
-      "invalid-patch",
-      "Patch action payload did not contain patch, acceptanceCriteria, or verificationPlan",
-      proposal.workItemId,
-      admissionRefs(admission, proposal, policy)
+  return void 0;
+}
+function capabilityGuardPolicyIssue(policy) {
+  if (!isRecord(policy) || policy.kind !== "work-item-domain-action-capability-guard-policy" || typeof policy.policyId !== "string" || policy.policyId.length === 0 || !Array.isArray(policy.capabilityRefs) || policy.capabilityRefs.length === 0 || !policy.capabilityRefs.every(isBoundaryCapabilityRef) || !Array.isArray(policy.admissionSubjectIds) || policy.admissionSubjectIds.length === 0 || !policy.admissionSubjectIds.every((id) => typeof id === "string" && id.length > 0) || policy.actionKinds !== void 0 && (!Array.isArray(policy.actionKinds) || !policy.actionKinds.every((kind) => typeof kind === "string" && kind.length > 0))) {
+    return dataIssue2(
+      "malformed-work-item-domain-action-capability-guard-policy",
+      "WorkItem domain action capability guard policy requires policyId, capabilityRefs, and admissionSubjectIds",
+      {
+        subjectId: recordString(policy, "policyId")
+      }
     );
-    return void 0;
   }
-  return facts;
+  return void 0;
 }
-function lowerSpawnAction(ctx, state, proposal, admission, policy) {
-  if (policy.spawn?.create !== true) {
-    return {
-      state: "proposal-only",
-      facts: [],
-      message: "Spawn action remains proposal/admission only without explicit create policy"
-    };
+function capabilityAdmissionIssue(admission) {
+  if (!isRecord(admission) || admission.kind !== "capability-admission" || typeof admission.admissionId !== "string" || admission.admissionId.length === 0 || typeof admission.proposalId !== "string" || admission.proposalId.length === 0 || typeof admission.subjectId !== "string" || admission.subjectId.length === 0 || !isBoundaryCapabilityRef(admission.capability) || !isCapabilityAdmissionState(admission.state) || typeof admission.decisionId !== "string" || admission.decisionId.length === 0 || admission.sourceRefs !== void 0 && !isSourceRefArray(admission.sourceRefs)) {
+    return dataIssue2(
+      "malformed-capability-admission",
+      "WorkItem domain action capability guard requires valid CapabilityAdmission DATA facts",
+      { subjectId: recordString(admission, "subjectId") }
+    );
   }
-  emitApplicationIssue(
-    ctx,
-    state,
-    `spawn-create-policy:${admission.admissionId}:${policy.policyId}`,
-    "policy-mismatch",
-    `Spawn create policy '${policy.policyId}' is incomplete: child creation requires an explicit create/link/idempotency policy surface`,
-    proposal.workItemId,
-    admissionRefs(admission, proposal, policy),
-    {
-      requires: ["linkParent", "idempotencyKey", "maxChildrenPerAdmission", "link-fact-vocabulary"]
-    }
-  );
-  return {
-    state: "proposal-only",
-    facts: [],
-    code: "policy-mismatch",
-    message: "Spawn action remains proposal/admission only until explicit create/link policy is available"
-  };
+  return void 0;
 }
-function normalizePatchPayload(payload) {
-  if (!isRecord2(payload)) return "Patch action payload must be an object";
-  if ("patch" in payload || "acceptanceCriteria" in payload || "verificationPlan" in payload || "executionRelevantFields" in payload) {
-    if ("patch" in payload && payload.patch !== void 0 && !isRecord2(payload.patch))
-      return "Patch action payload.patch must be an object";
-    if ("acceptanceCriteria" in payload && payload.acceptanceCriteria !== void 0 && !Array.isArray(payload.acceptanceCriteria))
-      return "Patch action payload.acceptanceCriteria must be an array";
-    if ("verificationPlan" in payload && payload.verificationPlan !== void 0 && !isRecord2(payload.verificationPlan))
-      return "Patch action payload.verificationPlan must be an object";
-    const inlinePatch = inlinePatchFields(payload);
-    const explicitPatch = isRecord2(payload.patch) ? payload.patch : void 0;
-    const patch = explicitPatch === void 0 ? inlinePatch : { ...inlinePatch, ...explicitPatch };
-    return {
-      ...payload,
-      patch: Object.keys(patch).length === 0 ? void 0 : patch
-    };
+function capabilityAdmissionStatusIssue(status) {
+  if (!isRecord(status) || status.kind !== "capability-admission-status" || typeof status.statusId !== "string" || status.statusId.length === 0 || !isCapabilityAdmissionStatusState(status.state)) {
+    return dataIssue2(
+      "malformed-capability-admission-status",
+      "WorkItem domain action capability guard requires valid CapabilityAdmissionStatus DATA facts",
+      { subjectId: recordString(status, "subjectId") }
+    );
   }
-  return { patch: payload };
-}
-function inlinePatchFields(payload) {
-  const patch = {};
-  for (const [key, value] of Object.entries(payload)) {
-    if (key === "metadata") continue;
-    if (patchFieldKeys.has(key)) patch[key] = value;
+  const hasCapabilityId = status.capabilityId !== void 0;
+  const hasCapabilityKind = status.capabilityKind !== void 0;
+  if (hasCapabilityId !== hasCapabilityKind || hasCapabilityId && (typeof status.capabilityId !== "string" || status.capabilityId.length === 0 || !isBoundaryCapabilityKind(status.capabilityKind)) || status.sourceRefs !== void 0 && !isSourceRefArray(status.sourceRefs) || status.issues !== void 0 && !isDataIssueArray(status.issues)) {
+    return dataIssue2(
+      "malformed-capability-admission-status",
+      "WorkItem domain action capability guard requires valid CapabilityAdmissionStatus DATA facts",
+      { subjectId: recordString(status, "subjectId") }
+    );
   }
-  return patch;
+  return void 0;
 }
-function splitDedicatedPatchFields(payload, workItem) {
-  if (!isRecord2(payload.patch)) return payload;
-  const patchRecord = payload.patch;
-  const patch = {};
-  for (const [key, value] of Object.entries(patchRecord)) {
-    if (key === "acceptanceCriteria" || key === "verificationPlan" || key === "verificationSteps")
-      continue;
-    patch[key] = value;
-  }
-  const acceptanceCriteria = payload.acceptanceCriteria ?? (Array.isArray(patchRecord.acceptanceCriteria) ? patchRecord.acceptanceCriteria : void 0);
-  const verificationPlan = payload.verificationPlan ?? (isRecord2(patchRecord.verificationPlan) ? patchRecord.verificationPlan : Array.isArray(patchRecord.verificationSteps) ? {
-    ...workItem.verificationPlan ?? { planId: "default" },
-    steps: patchRecord.verificationSteps
-  } : void 0);
-  return {
-    ...payload,
-    patch: Object.keys(patch).length === 0 ? void 0 : patch,
-    acceptanceCriteria,
-    verificationPlan
-  };
+function isCapabilityAdmissionState(value) {
+  return value === "allowed" || value === "blocked" || value === "deferred";
 }
-function invalidPatchKeys(patch, policy) {
-  const allowed = new Set(policy.patch?.allowedFields ?? Array.from(patchFieldKeys));
-  return Object.keys(patch).filter((key) => !patchFieldKeys.has(key) || !allowed.has(key));
+function isCapabilityAdmissionStatusState(value) {
+  return value === "capability-admission-allowed" || value === "capability-admission-blocked" || value === "capability-admission-deferred" || value === "capability-admission-issue";
 }
-function allowsAcceptanceCriteria(policy) {
-  if (policy.patch?.allowAcceptanceCriteria === false) return false;
-  const allowed = policy.patch?.allowedFields;
-  return allowed === void 0 || allowed.includes("acceptanceCriteria") || policy.patch?.allowAcceptanceCriteria === true;
+function isSourceRefArray(value) {
+  return Array.isArray(value) && value.every(
+    (item) => isRecord(item) && typeof item.kind === "string" && typeof item.id === "string"
+  );
 }
-function allowsVerificationPlan(policy) {
-  if (policy.patch?.allowVerificationPlan === false) return false;
-  const allowed = policy.patch?.allowedFields;
-  return allowed === void 0 || allowed.includes("verificationPlan") || allowed.includes("verificationSteps") || policy.patch?.allowVerificationPlan === true;
+function isDataIssueArray(value) {
+  return Array.isArray(value) && value.every(isDataIssue);
 }
-function selectApplyPolicy(state, proposal, admission) {
-  const explicitId = explicitApplyPolicyId(proposal, admission);
+function isDataIssue(value) {
+  return isRecord(value) && value.kind === "issue" && typeof value.code === "string" && value.code.length > 0 && typeof value.message === "string" && value.message.length > 0;
+}
+function isBoundaryCapabilityRef(value) {
+  return isRecord(value) && typeof value.id === "string" && value.id.length > 0 && isBoundaryCapabilityKind(value.kind) && typeof value.required === "boolean" && (value.sourceRefs === void 0 || Array.isArray(value.sourceRefs) && value.sourceRefs.every((sourceRef) => typeof sourceRef === "string"));
+}
+function isBoundaryCapabilityKind(value) {
+  return value === "auth" || value === "permission" || value === "config" || value === "resource";
+}
+function selectCapabilityGuardPolicy(state, proposal) {
+  const explicitId = stringMetadata(proposal.metadata, "capabilityGuardPolicyId") ?? proposal.sourceRefs?.find(
+    (sourceRef) => sourceRef.kind === "work-item-domain-action-capability-guard-policy"
+  )?.id;
   if (explicitId !== void 0)
-    return state.policies.get(explicitId) ?? "unknown-work-item-domain-action-apply-policy";
-  const matching = Array.from(state.policies.values()).filter(
-    (policy) => policyAllowsAction(policy, proposal.actionKind)
+    return state.policies.get(explicitId) ?? "unknown-work-item-domain-action-capability-guard-policy";
+  const matching = [...state.policies.values()].filter(
+    (policy) => policy.actionKinds === void 0 || policy.actionKinds.includes(proposal.actionKind)
   );
   if (matching.length === 0) return "missing-policy";
   if (matching.length > 1) return "policy-mismatch";
   return matching[0];
 }
-function explicitApplyPolicyId(proposal, admission) {
-  const metadataPolicy = stringMetadata(admission.metadata, "applyPolicyId") ?? stringMetadata(proposal.metadata, "applyPolicyId");
-  if (metadataPolicy !== void 0) return metadataPolicy;
-  return [...admission.sourceRefs ?? [], ...proposal.sourceRefs ?? []].find(
-    (sourceRef) => sourceRef.kind === "work-item-domain-action-apply-policy"
-  )?.id;
-}
-function policyAllowsAction(policy, actionKind) {
-  return policy.actionKinds === void 0 || policy.actionKinds.includes(actionKind);
-}
-function admissionProposalMismatch(admission, proposal) {
-  if (admission.workItemId !== proposal.workItemId)
-    return {
-      field: "workItemId",
-      admissionValue: admission.workItemId,
-      proposalValue: proposal.workItemId,
-      message: `Admission '${admission.admissionId}' workItemId does not match proposal '${proposal.proposalId}'`
-    };
-  if (admission.actionKind !== proposal.actionKind)
-    return {
-      field: "actionKind",
-      admissionValue: admission.actionKind,
-      proposalValue: proposal.actionKind,
-      message: `Admission '${admission.admissionId}' actionKind does not match proposal '${proposal.proposalId}'`
-    };
+function latestCapabilityAdmission(state, policy, capabilityRef) {
+  const admissions = state.admissionsByCapability.get(capabilityBoundaryRefId(capabilityRef)) ?? [];
+  for (let index = admissions.length - 1; index >= 0; index -= 1) {
+    const admission = admissions[index];
+    if (admission !== void 0 && policy.admissionSubjectIds.includes(admission.subjectId))
+      return admission;
+  }
   return void 0;
 }
-function conflictingApplicationMetadata(proposal, admission) {
-  const authoringRevision = conflictingMetadataNumber(proposal, admission, "authoringRevision");
-  if (authoringRevision !== void 0)
-    return {
-      field: "authoringRevision",
-      code: "stale-revision",
-      ...authoringRevision,
-      message: `Admission '${admission.admissionId}' carries conflicting authoringRevision metadata`
-    };
-  const executionInputRevision = conflictingMetadataNumber(
-    proposal,
-    admission,
-    "executionInputRevision"
+function emitCapabilityStatusIssueForProposal(ctx, state, proposal, status) {
+  const policy = selectCapabilityGuardPolicy(state, proposal);
+  if (typeof policy === "string") return;
+  if (status.subjectId !== void 0 && !policy.admissionSubjectIds.includes(status.subjectId))
+    return;
+  const capabilityId = status.capabilityId;
+  const capabilityKind = status.capabilityKind;
+  const statusCapabilityKey = capabilityId === void 0 || capabilityKind === void 0 ? void 0 : capabilityBoundaryRefId({ id: capabilityId, kind: capabilityKind });
+  if (statusCapabilityKey !== void 0 && !policy.capabilityRefs.some(
+    (capabilityRef) => capabilityBoundaryRefId(capabilityRef) === statusCapabilityKey
+  ))
+    return;
+  const issue2 = status.issues?.[0] ?? dataIssue2(
+    "capability-admission-status-issue",
+    "Capability admission status reported an issue",
+    { subjectId: proposal.workItemId }
+  );
+  emitCapabilityGuardIssue(
+    ctx,
+    state,
+    `capability-status:${proposal.proposalId}:${status.statusId}`,
+    dataIssue2(issue2.code, issue2.message, {
+      subjectId: proposal.workItemId,
+      refs: uniqueSourceRefs2([
+        ...capabilityGuardRefs(proposal, policy),
+        ...status.sourceRefs ?? []
+      ]),
+      metadata: {
+        ...statusCapabilityKey === void 0 ? {} : { capabilityRef: statusCapabilityKey },
+        capabilityAdmissionStatusId: status.statusId
+      }
+    })
   );
-  if (executionInputRevision !== void 0)
-    return {
-      field: "executionInputRevision",
-      code: "stale-execution-input",
-      ...executionInputRevision,
-      message: `Admission '${admission.admissionId}' carries conflicting executionInputRevision metadata`
-    };
-  const applyPolicyId = conflictingMetadataString(proposal, admission, "applyPolicyId");
-  if (applyPolicyId !== void 0)
-    return {
-      field: "applyPolicyId",
-      code: "policy-mismatch",
-      ...applyPolicyId,
-      message: `Admission '${admission.admissionId}' carries conflicting applyPolicyId metadata`
-    };
-  return void 0;
-}
-function conflictingMetadataNumber(proposal, admission, key) {
-  const proposalValue = numberMetadata(proposal.metadata, key);
-  const admissionValue = numberMetadata(admission.metadata, key);
-  if (proposalValue === void 0 || admissionValue === void 0 || proposalValue === admissionValue)
-    return void 0;
-  return { proposalValue, admissionValue };
-}
-function conflictingMetadataString(proposal, admission, key) {
-  const proposalValue = stringMetadata(proposal.metadata, key);
-  const admissionValue = stringMetadata(admission.metadata, key);
-  if (proposalValue === void 0 || admissionValue === void 0 || proposalValue === admissionValue)
-    return void 0;
-  return { proposalValue, admissionValue };
-}
-function staleRevision(proposal, admission, workItem) {
-  const authoringRevision = numberMetadata(admission.metadata, "authoringRevision") ?? numberMetadata(proposal.metadata, "authoringRevision");
-  if (authoringRevision !== void 0 && authoringRevision !== workItem.authoringRevision)
-    return {
-      kind: "stale-revision",
-      expected: authoringRevision,
-      current: workItem.authoringRevision
-    };
-  const executionInputRevision = numberMetadata(admission.metadata, "executionInputRevision") ?? numberMetadata(proposal.metadata, "executionInputRevision");
-  if (executionInputRevision !== void 0 && executionInputRevision !== workItem.executionInputRevision)
-    return {
-      kind: "stale-execution-input",
-      expected: executionInputRevision,
-      current: workItem.executionInputRevision
-    };
-  return void 0;
 }
-function applyPolicyMessage(code, proposal, admission) {
+function capabilityGuardPolicyMessage(code, proposal) {
   if (code === "missing-policy")
-    return `Admitted action '${admission.admissionId}' requires an explicit apply policy`;
-  if (code === "unknown-work-item-domain-action-apply-policy")
-    return `Admitted action '${admission.admissionId}' references a missing apply policy`;
-  return `Admitted action '${proposal.proposalId}' matches multiple apply policies`;
-}
-function emitApplication(ctx, state, admission, proposal, applicationState, facts, opts = {}) {
-  const producedFactIds = facts.map((fact) => fact.eventId);
-  const application = {
-    kind: "work-item-domain-action-application",
-    applicationId: `${admission.admissionId}:application`,
-    admissionId: admission.admissionId,
-    proposalId: proposal.proposalId,
-    workItemId: proposal.workItemId,
-    actionKind: proposal.actionKind,
-    state: applicationState,
-    producedFactIds,
-    reason: admission.reason ?? proposal.reason,
-    sourceRefs: admissionRefs(admission, proposal),
-    metadata: { policyId: opts.policyId, code: opts.code }
-  };
-  emitApplicationFact(ctx, "application", application);
-  emitApplicationStatus(ctx, state, {
-    state: applicationState,
-    code: opts.code,
-    message: opts.message,
-    workItemId: proposal.workItemId,
-    proposalId: proposal.proposalId,
-    admissionId: admission.admissionId,
-    actionKind: proposal.actionKind,
-    sourceRefs: application.sourceRefs,
-    metadata: { producedFactIds, policyId: opts.policyId }
-  });
-}
-function emitApplicationIssue(ctx, state, key, code, message, workItemId, sourceRefs2, metadata) {
-  if (state.issueKeys.has(key)) return;
-  state.issueKeys.add(key);
-  const item = dataIssue2(code, message, { subjectId: workItemId, refs: sourceRefs2, metadata });
-  emitApplicationFact(ctx, "issue", item);
-  emitApplicationStatus(ctx, state, {
-    state: code === "missing-policy" ? "missing-policy" : "rejected",
-    code,
-    message,
-    workItemId,
-    sourceRefs: sourceRefs2,
-    metadata
-  });
+    return `WorkItem domain action '${proposal.proposalId}' has no capability guard policy`;
+  if (code === "unknown-work-item-domain-action-capability-guard-policy")
+    return `WorkItem domain action '${proposal.proposalId}' references a missing capability guard policy`;
+  return `WorkItem domain action '${proposal.proposalId}' matches multiple capability guard policies`;
 }
-function emitIntakeStatus(ctx, state, status) {
-  state.statusSeq += 1;
-  const statusFact = {
-    kind: "work-item-domain-action-status",
-    statusId: `work-item-domain-action-intake-status:${state.statusSeq}`,
-    ...status
-  };
-  emitIntake(ctx, "status", statusFact);
-  emitIntakeAudit(ctx, state, "work-item-domain-action-intake-status", statusFact);
+function capabilityGuardRefs(proposal, policy, admissions = []) {
+  return uniqueSourceRefs2([
+    ref2("work-item", proposal.workItemId),
+    ref2("work-item-domain-action-proposal", proposal.proposalId),
+    ref2("work-item-domain-action-capability-guard-policy", policy.policyId),
+    ...admissions.filter((admission) => admission !== void 0).flatMap((admission) => [
+      ref2("capability-admission", admission.admissionId),
+      ref2("capability-admission-proposal", admission.proposalId),
+      ref2("boundary-capability", capabilityBoundaryRefId(admission.capability)),
+      ...admission.sourceRefs ?? []
+    ]),
+    ...proposal.sourceRefs ?? []
+  ]);
 }
-function emitApplicationStatus(ctx, state, status) {
+function capabilityBoundaryRefId(capability) {
+  return `${capability.kind}:${capability.id}`;
+}
+function emitCapabilityGuardStatus(ctx, state, status) {
   state.statusSeq += 1;
   const statusFact = {
-    kind: "work-item-domain-action-status",
-    statusId: `work-item-domain-action-application-status:${state.statusSeq}`,
+    kind: "work-item-domain-action-capability-guard-status",
+    statusId: `work-item-domain-action-capability-guard-status:${state.statusSeq}`,
     ...status
   };
-  emitApplicationFact(ctx, "status", statusFact);
-  emitApplicationAudit(ctx, state, "work-item-domain-action-application-status", statusFact);
-}
-function emitIntakeAudit(ctx, state, kind, status) {
-  state.auditSeq += 1;
-  emitIntake(ctx, "audit", auditRecord(kind, state.auditSeq, status));
-}
-function emitApplicationAudit(ctx, state, kind, status) {
+  emitCapabilityGuard(ctx, "status", statusFact);
   state.auditSeq += 1;
-  emitApplicationFact(ctx, "audit", auditRecord(kind, state.auditSeq, status));
-}
-function auditRecord(kind, seq, status) {
-  return {
-    id: `${kind}:${seq}`,
-    kind,
+  emitCapabilityGuard(ctx, "audit", {
+    id: `work-item-domain-action-capability-guard-status:${state.auditSeq}`,
+    kind: "work-item-domain-action-capability-guard-status",
     subjectId: status.workItemId,
     message: status.message,
-    issueCode: status.code,
     sourceRefs: status.sourceRefs,
     metadata: {
-      statusId: status.statusId,
+      statusId: statusFact.statusId,
       state: status.state,
       proposalId: status.proposalId,
-      admissionId: status.admissionId,
-      actionKind: status.actionKind,
+      policyId: status.policyId,
       ...status.metadata ?? {}
     }
-  };
+  });
 }
-function emitIntake(ctx, kind, value) {
-  ctx.down([["DATA", { kind, value }]]);
+function emitCapabilityGuardStatusOnce(ctx, state, key, status) {
+  if (state.emittedStatusKeys.has(key)) return;
+  state.emittedStatusKeys.add(key);
+  emitCapabilityGuardStatus(ctx, state, status);
 }
-function emitApplicationFact(ctx, kind, value) {
+function emitCapabilityGuardIssue(ctx, state, key, issue2) {
+  if (state.issueKeys.has(key)) return;
+  state.issueKeys.add(key);
+  emitCapabilityGuard(ctx, "issue", issue2);
+  emitCapabilityGuardStatus(ctx, state, {
+    state: "issue",
+    workItemId: issue2.subjectId,
+    issues: [issue2],
+    message: issue2.message,
+    metadata: { issueCode: issue2.code }
+  });
+}
+function emitCapabilityGuard(ctx, kind, value) {
   ctx.down([["DATA", { kind, value }]]);
 }
-function project(graph, runtime, name, factory, select) {
-  return graph.node(
-    [runtime],
+
+// src/solutions/work-item/actions-intake.ts
+function workItemDomainActionProposalIntakeProjector(graph, opts) {
+  const name = opts.name ?? "workItemDomainActionIntake";
+  const now = opts.now ?? Date.now;
+  const runtime = graph.node(
+    [opts.proposals],
     (ctx) => {
-      for (const raw of depBatch(ctx, 0) ?? []) {
-        const selected = select(raw);
-        if (selected !== void 0) ctx.down([["DATA", selected]]);
-      }
+      const state = ctx.state.get() ?? {
+        proposals: /* @__PURE__ */ new Set(),
+        statusSeq: 0,
+        auditSeq: 0
+      };
+      for (const raw of depBatch(ctx, 0) ?? []) reduceProposalIntake(ctx, state, raw, now());
+      ctx.state.set(state);
     },
-    { name, factory, partial: true, completeWhenDepsComplete: false, errorWhenDepsError: false }
+    {
+      name: `${name}/runtime`,
+      factory: "workItemDomainActionProposalIntakeProjector",
+      partial: true,
+      completeWhenDepsComplete: false,
+      errorWhenDepsError: false
+    }
   );
-}
-function firstDuplicateFactId(state, facts) {
-  const pending = /* @__PURE__ */ new Set();
-  for (const fact of facts) {
-    if (state.emittedFactIds.has(fact.eventId) || pending.has(fact.eventId)) return fact.eventId;
-    pending.add(fact.eventId);
-  }
-  return void 0;
-}
-function claimFactId(state, factId) {
-  if (state.emittedFactIds.has(factId)) return false;
-  state.emittedFactIds.add(factId);
-  return true;
-}
-function admissionRefs(admission, proposal, policy) {
-  return uniqueSourceRefs2([
-    ref2("work-item-domain-action-admission", admission.admissionId),
-    ref2("work-item-domain-action-proposal", admission.proposalId),
-    ...proposal === void 0 ? [] : [
-      ref2("work-item", proposal.workItemId),
-      ref2("work-item-evidence", proposal.evidenceId),
-      ...proposal.sourceRefs ?? []
-    ],
-    ...policy === void 0 ? [] : [ref2("work-item-domain-action-apply-policy", policy.policyId)],
-    ...admission.sourceRefs ?? []
-  ]);
-}
-function actionSourceRefs(admission, proposal, policy) {
-  return admissionRefs(admission, proposal, policy);
-}
-function dataIssue2(code, message, opts = {}) {
   return {
-    kind: "issue",
-    code,
-    message,
-    severity: "error",
-    source: "work-item-actions",
-    subjectId: opts.subjectId,
-    refs: opts.refs?.map((sourceRef) => `${sourceRef.kind}:${sourceRef.id}`),
-    metadata: opts.metadata
+    proposals: project(
+      graph,
+      runtime,
+      `${name}/proposals`,
+      "workItemDomainActionProposals",
+      (fact) => fact.kind === "proposal" ? fact.value : void 0
+    ),
+    status: project(
+      graph,
+      runtime,
+      `${name}/status`,
+      "workItemDomainActionStatus",
+      (fact) => fact.kind === "status" ? fact.value : void 0
+    ),
+    issues: project(
+      graph,
+      runtime,
+      `${name}/issues`,
+      "workItemDomainActionIssues",
+      (fact) => fact.kind === "issue" ? fact.value : void 0
+    ),
+    audit: project(
+      graph,
+      runtime,
+      `${name}/audit`,
+      "workItemDomainActionAudit",
+      (fact) => fact.kind === "audit" ? fact.value : void 0
+    )
   };
 }
-function uniqueSourceRefs2(sourceRefs2) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const sourceRef of sourceRefs2) {
-    const key = `${sourceRef.kind}:${sourceRef.id}:${JSON.stringify(sourceRef.metadata ?? {})}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
-    out.push(sourceRef);
+function reduceProposalIntake(ctx, state, input, proposedAtMs) {
+  const proposal = normalizeProposal(input, proposedAtMs);
+  if (typeof proposal === "string") {
+    const issue2 = dataIssue2("malformed-domain-action-proposal", proposal);
+    emitIntake(ctx, "issue", issue2);
+    emitIntakeStatus(ctx, state, {
+      state: "rejected",
+      code: issue2.code,
+      message: issue2.message
+    });
+    return;
   }
-  return out;
+  if (state.proposals.has(proposal.proposalId)) {
+    emitIntakeStatus(ctx, state, {
+      state: "duplicate",
+      code: "duplicate-suppressed",
+      workItemId: proposal.workItemId,
+      proposalId: proposal.proposalId,
+      actionKind: proposal.actionKind,
+      message: `Duplicate WorkItem domain action proposal '${proposal.proposalId}' suppressed`
+    });
+    return;
+  }
+  state.proposals.add(proposal.proposalId);
+  emitIntake(ctx, "proposal", proposal);
+  emitIntakeStatus(ctx, state, {
+    state: "proposed",
+    workItemId: proposal.workItemId,
+    proposalId: proposal.proposalId,
+    actionKind: proposal.actionKind,
+    sourceRefs: proposal.sourceRefs
+  });
 }
-function sourceRefs(value) {
-  if (!Array.isArray(value)) return void 0;
-  return value.filter(
-    (item) => isRecord2(item) && typeof item.kind === "string" && typeof item.id === "string"
+function normalizeProposal(input, proposedAtMs) {
+  if (!isRecord(input)) return "WorkItemDomainActionProposal intake must be an object";
+  if (input.kind !== "work-item-domain-action-proposal" && input.kind !== "work-item-domain-action-proposal-intake")
+    return "WorkItemDomainActionProposal intake has unsupported kind";
+  if (typeof input.proposalId !== "string" || input.proposalId.trim() === "")
+    return "WorkItemDomainActionProposal.proposalId is required";
+  if (typeof input.workItemId !== "string" || input.workItemId.trim() === "")
+    return "WorkItemDomainActionProposal.workItemId is required";
+  if (typeof input.actionKind !== "string" || input.actionKind.trim() === "")
+    return "WorkItemDomainActionProposal.actionKind is required";
+  if (input.kind === "work-item-domain-action-proposal") {
+    if (typeof input.effectRunId !== "string")
+      return "WorkItemDomainActionProposal.effectRunId is required";
+    if (typeof input.effectRunResultId !== "string")
+      return "WorkItemDomainActionProposal.effectRunResultId is required";
+    if (typeof input.evidenceId !== "string")
+      return "WorkItemDomainActionProposal.evidenceId is required";
+    if (typeof input.policyId !== "string")
+      return "WorkItemDomainActionProposal.policyId is required";
+    return input;
+  }
+  return workItemDomainActionProposal(
+    input.proposalId,
+    input.workItemId,
+    input.actionKind,
+    {
+      payload: input.payload,
+      reason: typeof input.reason === "string" ? input.reason : void 0,
+      policyId: typeof input.policyId === "string" ? input.policyId : void 0,
+      effectRunId: typeof input.effectRunId === "string" ? input.effectRunId : void 0,
+      effectRunResultId: typeof input.effectRunResultId === "string" ? input.effectRunResultId : void 0,
+      evidenceId: typeof input.evidenceId === "string" ? input.evidenceId : void 0,
+      proposedAtMs: typeof input.proposedAtMs === "number" ? input.proposedAtMs : proposedAtMs,
+      sourceRefs: sourceRefs(input.sourceRefs),
+      metadata: isRecord(input.metadata) ? input.metadata : void 0
+    }
   );
 }
-function numberMetadata(metadata, key) {
-  const value = metadata?.[key];
-  return typeof value === "number" ? value : void 0;
-}
-function stringMetadata(metadata, key) {
-  const value = metadata?.[key];
-  return typeof value === "string" ? value : void 0;
-}
-function ref2(kind, id) {
-  return { kind, id };
+function emitIntakeStatus(ctx, state, status) {
+  state.statusSeq += 1;
+  const statusFact = {
+    kind: "work-item-domain-action-status",
+    statusId: `work-item-domain-action-intake-status:${state.statusSeq}`,
+    ...status
+  };
+  emitIntake(ctx, "status", statusFact);
+  emitIntakeAudit(ctx, state, "work-item-domain-action-intake-status", statusFact);
 }
-function recordString(value, key) {
-  return isRecord2(value) && typeof value[key] === "string" ? value[key] : void 0;
+function emitIntakeAudit(ctx, state, kind, status) {
+  state.auditSeq += 1;
+  emitIntake(ctx, "audit", auditRecord(kind, state.auditSeq, status));
 }
-function isRecord2(value) {
-  return value !== null && typeof value === "object";
+function emitIntake(ctx, kind, value) {
+  ctx.down([["DATA", { kind, value }]]);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {