@graphrefly/ts 0.0.1 → 0.0.2

package/dist/solutions/work-item/actions.js

@@ -1,743 +1,722 @@
 import {
   validateAcceptanceCriteria,
-  validateVerificationPlan
-} from "../../chunk-6XAIOL3X.js";
-import {
-  workItemDomainActionAdmissionProjector
-} from "../../chunk-PC3BTTBE.js";
+  validateVerificationPlan,
+  validateWorkItemDraft
+} from "../../chunk-2KUAG2GZ.js";
 import {
   depBatch
 } from "../../chunk-WQIA3GFB.js";
 import "../../chunk-S6HXABGL.js";
 import "../../chunk-DGUM43GV.js";
 
-// src/solutions/work-item/actions.ts
-var patchFieldKeys = /* @__PURE__ */ new Set([
-  "summary",
-  "detail",
-  "detailRefs",
-  "kind",
-  "priority",
-  "tags",
-  "owner",
-  "assignee",
-  "deadlineMs",
-  "customFields",
-  "sourceRefs",
-  "metadata"
-]);
-function workItemDomainActionProposal(proposalId, workItemId, actionKind, opts = {}) {
-  return {
-    kind: "work-item-domain-action-proposal",
-    proposalId,
-    workItemId,
-    actionKind,
-    effectRunId: opts.effectRunId ?? `domain-action:${proposalId}:effect-run`,
-    effectRunResultId: opts.effectRunResultId ?? `domain-action:${proposalId}:effect-run-result`,
-    evidenceId: opts.evidenceId ?? `domain-action:${proposalId}:evidence`,
-    policyId: opts.policyId ?? "domain-action-proposal",
-    payload: opts.payload,
-    reason: opts.reason,
-    sourceRefs: opts.sourceRefs,
-    proposedAtMs: opts.proposedAtMs,
-    metadata: opts.metadata
+// src/orchestration/work-item-runtime-shared.ts
+function emitWorkItemAdmissionIssue(ctx, state, key, code, message, subjectId, sourceRefs2) {
+  if (state.issueKeys.has(key)) return;
+  state.issueKeys.add(key);
+  state.issueSeq += 1;
+  state.statusSeq += 1;
+  state.auditSeq += 1;
+  const issue = dataIssue(code, message, { subjectId, refs: sourceRefs2 });
+  const status = {
+    kind: "work-item-status",
+    statusId: `${subjectId ?? "work-item"}:mapping-issue:${state.statusSeq}`,
+    workItemId: subjectId ?? "unknown",
+    state: "mapping-issue",
+    sourceRefs: sourceRefs2,
+    issues: [issue]
+  };
+  const audit = {
+    id: `${subjectId ?? "work-item"}:${code}:${state.auditSeq}`,
+    kind: "work-item-domain-action-admission-issue",
+    subjectId,
+    issueCode: code,
+    message,
+    sourceRefs: sourceRefs2
   };
+  ctx.down([
+    ["DATA", { kind: "issue", issue }],
+    ["DATA", { kind: "status", status }],
+    ["DATA", { kind: "audit", audit }]
+  ]);
 }
-function workItemDomainActionProposalIntake(proposalId, workItemId, actionKind, opts = {}) {
+function emptyWorkItemDomainActionAdmissionState() {
   return {
-    kind: "work-item-domain-action-proposal-intake",
-    proposalId,
-    workItemId,
-    actionKind,
-    payload: opts.payload,
-    reason: opts.reason,
-    policyId: opts.policyId,
-    effectRunId: opts.effectRunId,
-    effectRunResultId: opts.effectRunResultId,
-    evidenceId: opts.evidenceId,
-    proposedAtMs: opts.proposedAtMs,
-    sourceRefs: opts.sourceRefs,
-    metadata: opts.metadata
+    proposals: /* @__PURE__ */ new Map(),
+    policies: /* @__PURE__ */ new Map(),
+    decisions: /* @__PURE__ */ new Map(),
+    admissionsById: /* @__PURE__ */ new Map(),
+    admissionsByProposal: /* @__PURE__ */ new Map(),
+    terminalDecisionIds: /* @__PURE__ */ new Set(),
+    issueKeys: /* @__PURE__ */ new Set(),
+    statusSeq: 0,
+    issueSeq: 0,
+    auditSeq: 0
   };
 }
-function workItemDomainActionApplyPolicy(policyId, opts = {}) {
+function freezeWorkItemDomainActionAdmissionViews(state) {
   return {
-    kind: "work-item-domain-action-apply-policy",
-    policyId,
-    actionKinds: opts.actionKinds,
-    patch: opts.patch,
-    spawn: opts.spawn,
-    metadata: opts.metadata
+    admissionsByProposal: new Map(state.admissionsByProposal),
+    admissionsByWorkItem: new Map(
+      Array.from(state.admissionsByWorkItem, ([key, value]) => [key, Object.freeze([...value])])
+    ),
+    issues: Object.freeze([...state.issues]),
+    audit: Object.freeze([...state.audit])
   };
 }
-function workItemDomainActionProposalIntakeProjector(graph, opts) {
-  const name = opts.name ?? "workItemDomainActionIntake";
-  const now = opts.now ?? Date.now;
-  const runtime = graph.node(
-    [opts.proposals],
+function workItemAdmissionProposalRefs(proposal) {
+  return uniqueSourceRefs([
+    ref("work-item", proposal.workItemId),
+    ref("work-item-domain-action-proposal", proposal.proposalId),
+    ref("effect-run", proposal.effectRunId),
+    ref("effect-run-result", proposal.effectRunResultId),
+    ref("work-item-evidence", proposal.evidenceId),
+    ref("work-item-effect-mapping-policy", proposal.policyId),
+    ...proposal.sourceRefs ?? []
+  ]);
+}
+function workItemAdmissionDecisionRefs(decision, proposal, policy) {
+  return uniqueSourceRefs([
+    ...proposal === void 0 ? [] : workItemAdmissionProposalRefs(proposal),
+    ref("work-item-domain-action-admission-decision", decision.decisionId),
+    ref("work-item-domain-action-admission", decision.admissionId),
+    ref("work-item-domain-action-proposal", decision.proposalId),
+    ...decision.policyId === void 0 ? [] : [ref("work-item-domain-action-admission-policy", decision.policyId)],
+    ...policy === void 0 ? [] : [ref("work-item-domain-action-admission-policy", policy.policyId)],
+    ...decision.targetProposalId === void 0 ? [] : [ref("work-item-domain-action-proposal", decision.targetProposalId)],
+    ...decision.targetAdmissionId === void 0 ? [] : [ref("work-item-domain-action-admission", decision.targetAdmissionId)],
+    ...decision.sourceRefs ?? []
+  ]);
+}
+function uniqueSourceRefs(sourceRefs2) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const sourceRef of sourceRefs2) {
+    const key = sourceRefKey(sourceRef);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    unique.push(sourceRef);
+  }
+  return unique;
+}
+function sourceRefKey(sourceRef) {
+  return `${sourceRef.kind}:${sourceRef.id}:${JSON.stringify(sourceRef.metadata ?? {})}`;
+}
+function projectRuntimeFact(graph, runtime, name, factory, pick) {
+  return graph.node(
+    [runtime],
     (ctx) => {
-      const state = ctx.state.get() ?? {
-        proposals: /* @__PURE__ */ new Set(),
-        statusSeq: 0,
-        auditSeq: 0
-      };
-      for (const raw of depBatch(ctx, 0) ?? []) reduceProposalIntake(ctx, state, raw, now());
-      ctx.state.set(state);
+      for (const fact of depBatch(ctx, 0) ?? []) {
+        const typed = fact;
+        const value = pick(typed);
+        if (value !== void 0) ctx.down([["DATA", value]]);
+      }
     },
-    {
-      name: `${name}/runtime`,
-      factory: "workItemDomainActionProposalIntakeProjector",
-      partial: true,
-      completeWhenDepsComplete: false,
-      errorWhenDepsError: false
-    }
+    { name, factory }
   );
+}
+function forEachPolicyDepBatch(ctx, start, count, fn) {
+  for (let i = 0; i < count; i += 1) {
+    for (const value of depBatch(ctx, start + i) ?? []) fn(value);
+  }
+}
+function dataIssue(code, message, opts = {}) {
   return {
-    proposals: project(
-      graph,
-      runtime,
-      `${name}/proposals`,
-      "workItemDomainActionProposals",
-      (fact) => fact.kind === "proposal" ? fact.value : void 0
-    ),
-    status: project(
-      graph,
-      runtime,
-      `${name}/status`,
-      "workItemDomainActionStatus",
-      (fact) => fact.kind === "status" ? fact.value : void 0
-    ),
-    issues: project(
-      graph,
-      runtime,
-      `${name}/issues`,
-      "workItemDomainActionIssues",
-      (fact) => fact.kind === "issue" ? fact.value : void 0
-    ),
-    audit: project(
-      graph,
-      runtime,
-      `${name}/audit`,
-      "workItemDomainActionAudit",
-      (fact) => fact.kind === "audit" ? fact.value : void 0
-    )
+    kind: "issue",
+    code,
+    message,
+    severity: opts.severity ?? "error",
+    subjectId: opts.subjectId,
+    refs: opts.refs?.map((r) => `${r.kind}:${r.id}`),
+    details: opts.details
   };
 }
-function workItemDomainActionApplicationProjector(graph, opts) {
-  const name = opts.name ?? "workItemDomainActionApplication";
-  const deps = opts.applyPolicies === void 0 ? [opts.proposals, opts.admissions, opts.workItems] : [opts.proposals, opts.admissions, opts.workItems, opts.applyPolicies];
+function ref(kind, id) {
+  return { kind, id };
+}
+
+// src/orchestration/work-item-runtime-admission.ts
+function workItemDomainActionAdmissionProjector(graph, opts) {
+  const name = opts.name ?? "workItemDomainActionAdmissions";
+  const policyDeps = opts.admissionPolicies ?? [];
+  const policyStart = 2;
+  const now = opts.now ?? Date.now;
   const runtime = graph.node(
-    deps,
+    [opts.proposals, opts.decisions, ...policyDeps],
     (ctx) => {
-      const state = ctx.state.get() ?? {
-        proposals: /* @__PURE__ */ new Map(),
-        admissions: /* @__PURE__ */ new Map(),
-        workItems: /* @__PURE__ */ new Map(),
-        policies: /* @__PURE__ */ new Map(),
-        appliedAdmissions: /* @__PURE__ */ new Set(),
-        emittedFactIds: /* @__PURE__ */ new Set(),
-        issueKeys: /* @__PURE__ */ new Set(),
-        statusSeq: 0,
-        auditSeq: 0
-      };
+      const state = ctx.state.get() ?? emptyWorkItemDomainActionAdmissionState();
       for (const raw of depBatch(ctx, 0) ?? []) {
         const proposal = raw;
         if (state.proposals.has(proposal.proposalId)) {
-          emitApplicationIssue(
+          emitWorkItemAdmissionIssue(
             ctx,
             state,
-            `duplicate-proposal:${proposal.proposalId}`,
-            "duplicate-suppressed",
-            `Duplicate WorkItem domain action proposal '${proposal.proposalId}' suppressed`,
+            `duplicate-admission-proposal:${proposal.proposalId}`,
+            "duplicate-work-item-domain-action-proposal",
+            `WorkItemDomainActionProposal '${proposal.proposalId}' was already seen by the admission projector`,
             proposal.workItemId,
-            proposal.sourceRefs
+            workItemAdmissionProposalRefs(proposal)
           );
           continue;
         }
         state.proposals.set(proposal.proposalId, proposal);
       }
-      for (const raw of depBatch(ctx, 2) ?? []) {
-        const workItem = raw;
-        state.workItems.set(workItem.workItemId, workItem);
-      }
-      if (opts.applyPolicies !== void 0) {
-        for (const raw of depBatch(ctx, 3) ?? []) {
-          const policy = raw;
-          state.policies.set(policy.policyId, policy);
-        }
-      }
+      forEachPolicyDepBatch(ctx, policyStart, policyDeps.length, (raw) => {
+        const policy = raw;
+        state.policies.set(policy.policyId, policy);
+      });
       for (const raw of depBatch(ctx, 1) ?? []) {
-        const admission = raw;
-        if (state.admissions.has(admission.admissionId)) {
-          emitApplicationIssue(
+        const decision = raw;
+        if (state.decisions.has(decision.decisionId)) {
+          emitWorkItemAdmissionIssue(
             ctx,
             state,
-            `duplicate-admission:${admission.admissionId}`,
-            "duplicate-suppressed",
-            `Duplicate WorkItem domain action admission '${admission.admissionId}' suppressed`,
-            admission.workItemId,
-            admissionRefs(admission)
+            `duplicate-admission-decision:${decision.decisionId}`,
+            "duplicate-work-item-domain-action-admission-decision",
+            `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' was already seen by the admission projector`,
+            decision.proposalId,
+            workItemAdmissionDecisionRefs(decision)
           );
           continue;
         }
-        state.admissions.set(admission.admissionId, admission);
+        state.decisions.set(decision.decisionId, decision);
       }
-      for (const admission of state.admissions.values()) applyAdmission(ctx, state, admission);
+      evaluateWorkItemDomainActionAdmissions(ctx, state, now());
       ctx.state.set(state);
     },
-    {
-      name: `${name}/runtime`,
-      factory: "workItemDomainActionApplicationProjector",
-      partial: true,
-      completeWhenDepsComplete: false,
-      errorWhenDepsError: false
-    }
+    { name: `${name}/runtime`, factory: "workItemDomainActionAdmissionProjector", partial: true }
   );
   return {
-    authoringFacts: project(
-      graph,
-      runtime,
-      `${name}/authoringFacts`,
-      "workItemDomainActionAuthoringFacts",
-      (fact) => fact.kind === "authoring-fact" ? fact.value : void 0
-    ),
-    applications: project(
+    admissions: projectRuntimeFact(
       graph,
       runtime,
-      `${name}/applications`,
-      "workItemDomainActionApplications",
-      (fact) => fact.kind === "application" ? fact.value : void 0
+      `${name}/admissions`,
+      "workItemDomainActionAdmissions",
+      (fact) => fact.kind === "admission" ? fact.admission : void 0
     ),
-    status: project(
+    status: projectRuntimeFact(
       graph,
       runtime,
       `${name}/status`,
-      "workItemDomainActionStatus",
-      (fact) => fact.kind === "status" ? fact.value : void 0
+      "workItemDomainActionAdmissionStatus",
+      (fact) => fact.kind === "status" ? fact.status : void 0
     ),
-    issues: project(
+    issues: projectRuntimeFact(
       graph,
       runtime,
       `${name}/issues`,
-      "workItemDomainActionIssues",
-      (fact) => fact.kind === "issue" ? fact.value : void 0
+      "workItemDomainActionAdmissionIssues",
+      (fact) => fact.kind === "issue" ? fact.issue : void 0
     ),
-    audit: project(
+    audit: projectRuntimeFact(
       graph,
       runtime,
       `${name}/audit`,
-      "workItemDomainActionAudit",
-      (fact) => fact.kind === "audit" ? fact.value : void 0
+      "workItemDomainActionAdmissionAudit",
+      (fact) => fact.kind === "audit" ? fact.audit : void 0
+    ),
+    views: graph.node(
+      [runtime],
+      (ctx) => {
+        const state = ctx.state.get() ?? {
+          admissionsByProposal: /* @__PURE__ */ new Map(),
+          admissionsByWorkItem: /* @__PURE__ */ new Map(),
+          issues: [],
+          audit: []
+        };
+        for (const raw of depBatch(ctx, 0) ?? []) {
+          const fact = raw;
+          if (fact.kind === "admission") {
+            const admission = fact.admission;
+            state.admissionsByProposal.set(admission.proposalId, admission);
+            const byWorkItem = state.admissionsByWorkItem.get(admission.workItemId) ?? [];
+            byWorkItem.push(admission);
+            state.admissionsByWorkItem.set(admission.workItemId, byWorkItem);
+          } else if (fact.kind === "issue") state.issues.push(fact.issue);
+          else if (fact.kind === "audit") state.audit.push(fact.audit);
+        }
+        ctx.state.set(state);
+        ctx.down([["DATA", freezeWorkItemDomainActionAdmissionViews(state)]]);
+      },
+      { name: `${name}/views`, factory: "workItemDomainActionAdmissionViews" }
     )
   };
 }
-function workItemDomainActionCapabilityGuardProjector(graph, opts) {
-  const name = opts.name ?? "workItemDomainActionCapabilityGuard";
-  const deps = opts.capabilityAdmissionStatus === void 0 ? [opts.proposals, opts.capabilityAdmissions, opts.guardPolicies] : [
-    opts.proposals,
-    opts.capabilityAdmissions,
-    opts.guardPolicies,
-    opts.capabilityAdmissionStatus
-  ];
-  const statusIndex = opts.capabilityAdmissionStatus === void 0 ? -1 : 3;
-  const now = opts.now ?? Date.now;
-  const runtime = graph.node(
-    deps,
-    (ctx) => {
-      const state = ctx.state.get() ?? {
-        proposals: /* @__PURE__ */ new Map(),
-        admissionsByCapability: /* @__PURE__ */ new Map(),
-        issueStatusesByCapability: /* @__PURE__ */ new Map(),
-        issueStatusesWithoutCapability: [],
-        policies: /* @__PURE__ */ new Map(),
-        emittedProposalDecisions: /* @__PURE__ */ new Set(),
-        emittedStatusKeys: /* @__PURE__ */ new Set(),
-        issueKeys: /* @__PURE__ */ new Set(),
-        statusSeq: 0,
-        auditSeq: 0
-      };
-      for (const raw of depBatch(ctx, 2) ?? []) {
-        const policyIssue = capabilityGuardPolicyIssue(raw);
-        if (policyIssue !== void 0) {
-          emitCapabilityGuardIssue(
-            ctx,
-            state,
-            `malformed-policy:${recordString(raw, "policyId") ?? "unknown"}`,
-            policyIssue
-          );
-          continue;
-        }
-        const policy = raw;
-        state.policies.set(policy.policyId, policy);
-      }
-      for (const raw of depBatch(ctx, 1) ?? []) {
-        const admissionIssue = capabilityAdmissionIssue(raw);
-        if (admissionIssue !== void 0) {
-          emitCapabilityGuardIssue(
-            ctx,
-            state,
-            `malformed-admission:${recordString(raw, "admissionId") ?? "unknown"}`,
-            admissionIssue
-          );
-          continue;
-        }
-        const admission = raw;
-        const capabilityKey = capabilityBoundaryRefId(admission.capability);
-        const byCapability = state.admissionsByCapability.get(capabilityKey) ?? [];
-        if (!byCapability.some((item) => item.admissionId === admission.admissionId)) {
-          state.admissionsByCapability.set(capabilityKey, [...byCapability, admission]);
-        }
-      }
-      if (statusIndex >= 0) {
-        for (const raw of depBatch(ctx, statusIndex) ?? []) {
-          const statusIssue = capabilityAdmissionStatusIssue(raw);
-          if (statusIssue !== void 0) {
-            emitCapabilityGuardIssue(
-              ctx,
-              state,
-              `malformed-capability-status:${recordString(raw, "statusId") ?? "unknown"}`,
-              statusIssue
-            );
-            continue;
-          }
-          const status = raw;
-          if (status.state !== "capability-admission-issue") continue;
-          const capabilityId = status.capabilityId;
-          const capabilityKind = status.capabilityKind;
-          if (capabilityId !== void 0 && capabilityKind !== void 0) {
-            const capabilityKey = capabilityBoundaryRefId({
-              id: capabilityId,
-              kind: capabilityKind
-            });
-            const statuses = state.issueStatusesByCapability.get(capabilityKey) ?? [];
-            if (!statuses.some((item) => item.statusId === status.statusId)) {
-              state.issueStatusesByCapability.set(capabilityKey, [...statuses, status]);
-            }
-          } else if (!state.issueStatusesWithoutCapability.some((item) => item.statusId === status.statusId)) {
-            state.issueStatusesWithoutCapability.push(status);
-          }
-          for (const proposal of state.proposals.values())
-            emitCapabilityStatusIssueForProposal(ctx, state, proposal, status);
-        }
-      }
-      for (const raw of depBatch(ctx, 0) ?? []) {
-        const proposalIssue = capabilityGuardProposalIssue(raw);
-        if (proposalIssue !== void 0) {
-          emitCapabilityGuardIssue(
-            ctx,
-            state,
-            `malformed-proposal:${recordString(raw, "proposalId") ?? "unknown"}`,
-            proposalIssue
-          );
-          continue;
-        }
-        const proposal = raw;
-        state.proposals.set(proposal.proposalId, proposal);
-      }
-      for (const proposal of state.proposals.values())
-        evaluateCapabilityGuardProposal(ctx, state, proposal, now());
-      ctx.state.set(state);
-    },
-    {
-      name: `${name}/runtime`,
-      factory: "workItemDomainActionCapabilityGuardProjector",
-      partial: true,
-      completeWhenDepsComplete: false,
-      errorWhenDepsError: false
+function evaluateWorkItemDomainActionAdmissions(ctx, state, admittedAtMs) {
+  let emitted = true;
+  let passes = 0;
+  while (emitted && passes <= state.decisions.size) {
+    emitted = false;
+    passes += 1;
+    for (const decision of state.decisions.values()) {
+      if (state.terminalDecisionIds.has(decision.decisionId)) continue;
+      emitted = evaluateWorkItemDomainActionAdmission(ctx, state, decision, admittedAtMs) || emitted;
     }
-  );
-  return {
-    decisions: project(
-      graph,
-      runtime,
-      `${name}/decisions`,
-      "workItemDomainActionCapabilityGuardDecisions",
-      (fact) => fact.kind === "decision" ? fact.value : void 0
-    ),
-    status: project(
-      graph,
-      runtime,
-      `${name}/status`,
-      "workItemDomainActionCapabilityGuardStatus",
-      (fact) => fact.kind === "status" ? fact.value : void 0
-    ),
-    issues: project(
-      graph,
-      runtime,
-      `${name}/issues`,
-      "workItemDomainActionCapabilityGuardIssues",
-      (fact) => fact.kind === "issue" ? fact.value : void 0
-    ),
-    audit: project(
-      graph,
-      runtime,
-      `${name}/audit`,
-      "workItemDomainActionCapabilityGuardAudit",
-      (fact) => fact.kind === "audit" ? fact.value : void 0
-    )
-  };
+  }
 }
-function evaluateCapabilityGuardProposal(ctx, state, proposal, decidedAtMs) {
-  if (state.emittedProposalDecisions.has(proposal.proposalId)) return;
-  const policy = selectCapabilityGuardPolicy(state, proposal);
+function evaluateWorkItemDomainActionAdmission(ctx, state, decision, admittedAtMs) {
+  const proposal = state.proposals.get(decision.proposalId);
+  const proposalRefs = workItemAdmissionDecisionRefs(decision, proposal);
+  const subjectId = proposal?.workItemId ?? decision.proposalId;
+  if (proposal === void 0) {
+    emitWorkItemAdmissionIssue(
+      ctx,
+      state,
+      `missing-admission-proposal:${decision.decisionId}:${decision.proposalId}`,
+      "missing-work-item-domain-action-admission-proposal",
+      `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' references missing proposal '${decision.proposalId}'`,
+      subjectId,
+      proposalRefs
+    );
+    return false;
+  }
+  const staleProposalRef = (decision.sourceRefs ?? []).find(
+    (sourceRef) => sourceRef.kind === "work-item-domain-action-proposal" && sourceRef.id !== decision.proposalId && sourceRef.id !== decision.targetProposalId
+  );
+  if (staleProposalRef !== void 0) {
+    emitWorkItemAdmissionIssue(
+      ctx,
+      state,
+      `stale-admission-proposal-ref:${decision.decisionId}:${staleProposalRef.id}`,
+      "stale-work-item-domain-action-admission-proposal-ref",
+      `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' carries stale proposal ref '${staleProposalRef.id}'`,
+      proposal.workItemId,
+      proposalRefs
+    );
+    state.terminalDecisionIds.add(decision.decisionId);
+    return false;
+  }
+  const policy = admissionPolicyForDecision(state, decision);
   if (typeof policy === "string") {
-    emitCapabilityGuardIssue(
+    emitWorkItemAdmissionIssue(
       ctx,
       state,
-      `policy:${proposal.proposalId}:${policy}`,
-      dataIssue(policy, capabilityGuardPolicyMessage(policy, proposal), {
-        subjectId: proposal.workItemId,
-        refs: [ref("work-item-domain-action-proposal", proposal.proposalId)]
-      })
+      `${policy}:${decision.decisionId}:${decision.policyId ?? "missing"}`,
+      policy,
+      admissionPolicyIssueMessage(policy, decision),
+      proposal.workItemId,
+      proposalRefs
     );
-    return;
+    if (policy === "stale-work-item-domain-action-admission-policy-ref")
+      state.terminalDecisionIds.add(decision.decisionId);
+    return false;
   }
-  for (const status of state.issueStatusesWithoutCapability)
-    emitCapabilityStatusIssueForProposal(ctx, state, proposal, status);
-  for (const capabilityRef of policy.capabilityRefs) {
-    for (const status of state.issueStatusesByCapability.get(
-      capabilityBoundaryRefId(capabilityRef)
-    ) ?? [])
-      emitCapabilityStatusIssueForProposal(ctx, state, proposal, status);
+  if (policy !== void 0) {
+    const policyIssue = validateWorkItemAdmissionPolicy(policy, decision, proposal);
+    if (policyIssue !== void 0) {
+      emitWorkItemAdmissionIssue(
+        ctx,
+        state,
+        `${policyIssue.code}:${decision.decisionId}:${policy.policyId}`,
+        policyIssue.code,
+        policyIssue.message,
+        proposal.workItemId,
+        workItemAdmissionDecisionRefs(decision, proposal, policy)
+      );
+      return false;
+    }
   }
-  const admissions = policy.capabilityRefs.map(
-    (capabilityRef) => latestCapabilityAdmission(state, policy, capabilityRef)
-  );
-  const missingCapabilityRefs = policy.capabilityRefs.filter(
-    (_, index) => admissions[index] === void 0
-  );
-  const deferredCapabilityRefs = admissions.filter((admission) => admission !== void 0).filter((admission) => admission.state === "deferred").map((admission) => capabilityBoundaryRefId(admission.capability));
-  if (missingCapabilityRefs.length > 0 || deferredCapabilityRefs.length > 0) {
-    emitCapabilityGuardStatusOnce(
+  const mergeIssue = validateWorkItemAdmissionMergeTarget(state, decision);
+  if (mergeIssue !== void 0) {
+    emitWorkItemAdmissionIssue(
       ctx,
       state,
-      `deferred:${proposal.proposalId}:${policy.policyId}:missing=${missingCapabilityRefs.map(capabilityBoundaryRefId).join(",")}:deferred=${deferredCapabilityRefs.join(",")}`,
-      {
-        state: "deferred",
-        workItemId: proposal.workItemId,
-        proposalId: proposal.proposalId,
-        actionKind: proposal.actionKind,
-        policyId: policy.policyId,
-        capabilityRefs: policy.capabilityRefs,
-        admissionSubjectIds: policy.admissionSubjectIds,
-        message: "WorkItem domain action is waiting for capability admission",
-        sourceRefs: capabilityGuardRefs(proposal, policy, admissions),
-        metadata: {
-          missingCapabilityRefs: missingCapabilityRefs.map(capabilityBoundaryRefId),
-          deferredCapabilityRefs
-        }
-      }
+      `${mergeIssue.code}:${decision.decisionId}:${decision.targetProposalId ?? ""}:${decision.targetAdmissionId ?? ""}`,
+      mergeIssue.code,
+      mergeIssue.message,
+      proposal.workItemId,
+      proposalRefs
     );
-    return;
+    if (mergeIssue.code !== "unknown-work-item-domain-action-admission-merge-target")
+      state.terminalDecisionIds.add(decision.decisionId);
+    return false;
   }
-  const presentAdmissions = admissions.filter(
-    (admission) => admission !== void 0
-  );
-  const blocked = presentAdmissions.filter((admission) => admission.state === "blocked");
-  const outcome = blocked.length === 0 ? "admit" : "reject";
-  const decision = {
-    kind: "work-item-domain-action-admission-decision",
-    decisionId: `capability-guard:${proposal.proposalId}:decision`,
-    admissionId: `capability-guard:${proposal.proposalId}:admission`,
+  if (state.admissionsById.has(decision.admissionId)) {
+    emitWorkItemAdmissionIssue(
+      ctx,
+      state,
+      `duplicate-admission-id:${decision.admissionId}`,
+      "duplicate-work-item-domain-action-admission",
+      `WorkItemDomainActionAdmission '${decision.admissionId}' was already emitted`,
+      proposal.workItemId,
+      proposalRefs
+    );
+    state.terminalDecisionIds.add(decision.decisionId);
+    return false;
+  }
+  if (state.admissionsByProposal.has(decision.proposalId)) {
+    emitWorkItemAdmissionIssue(
+      ctx,
+      state,
+      `duplicate-admission-proposal-decision:${decision.proposalId}:${decision.decisionId}`,
+      "duplicate-work-item-domain-action-admission-proposal",
+      `WorkItemDomainActionProposal '${decision.proposalId}' already has an admission decision`,
+      proposal.workItemId,
+      proposalRefs
+    );
+    state.terminalDecisionIds.add(decision.decisionId);
+    return false;
+  }
+  const admissionState = admissionStateForOutcome(decision.outcome);
+  if (admissionState === void 0) {
+    emitWorkItemAdmissionIssue(
+      ctx,
+      state,
+      `unsupported-admission-outcome:${decision.decisionId}:${String(decision.outcome)}`,
+      "unsupported-work-item-domain-action-admission-outcome",
+      `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' uses unsupported outcome '${String(decision.outcome)}'`,
+      proposal.workItemId,
+      proposalRefs
+    );
+    state.terminalDecisionIds.add(decision.decisionId);
+    return false;
+  }
+  const admission = {
+    kind: "work-item-domain-action-admission",
+    admissionId: decision.admissionId,
     proposalId: proposal.proposalId,
-    outcome,
-    reason: blocked.length === 0 ? "Capability guard admitted required capabilities" : "Capability guard rejected blocked capabilities",
-    decidedAtMs,
-    sourceRefs: capabilityGuardRefs(proposal, policy, presentAdmissions),
+    workItemId: proposal.workItemId,
+    actionKind: proposal.actionKind,
+    state: admissionState,
+    decisionId: decision.decisionId,
+    policyId: decision.policyId,
+    reason: decision.reason,
+    targetProposalId: decision.targetProposalId,
+    targetAdmissionId: decision.targetAdmissionId,
+    sourceRefs: workItemAdmissionDecisionRefs(decision, proposal, policy),
+    admittedAtMs: decision.decidedAtMs ?? admittedAtMs,
     metadata: {
-      capabilityGuardPolicyId: policy.policyId,
-      capabilityRefs: policy.capabilityRefs.map(capabilityBoundaryRefId),
-      admissionSubjectIds: policy.admissionSubjectIds,
-      blockedCapabilityRefs: blocked.map(
-        (admission) => capabilityBoundaryRefId(admission.capability)
-      )
+      ...proposal.metadata ?? {},
+      ...policy?.metadata ?? {},
+      ...decision.metadata ?? {}
     }
   };
-  state.emittedProposalDecisions.add(proposal.proposalId);
-  emitCapabilityGuard(ctx, "decision", decision);
-  emitCapabilityGuardStatus(ctx, state, {
-    state: outcome === "admit" ? "admitted" : "rejected",
+  state.admissionsById.set(admission.admissionId, admission);
+  state.admissionsByProposal.set(admission.proposalId, admission);
+  state.terminalDecisionIds.add(decision.decisionId);
+  state.statusSeq += 1;
+  state.auditSeq += 1;
+  const statusState = workItemAdmissionStatusState(admission.state);
+  const status = {
+    kind: "work-item-status",
+    statusId: `${proposal.workItemId}:${statusState}:${state.statusSeq}`,
     workItemId: proposal.workItemId,
+    state: statusState,
+    sourceRefs: admission.sourceRefs,
+    effectRunId: proposal.effectRunId,
+    evidenceId: proposal.evidenceId,
     proposalId: proposal.proposalId,
-    actionKind: proposal.actionKind,
-    policyId: policy.policyId,
-    capabilityRefs: policy.capabilityRefs,
-    admissionSubjectIds: policy.admissionSubjectIds,
-    admissionIds: presentAdmissions.map((admission) => admission.admissionId),
-    sourceRefs: decision.sourceRefs,
-    metadata: { decisionId: decision.decisionId, admissionId: decision.admissionId }
-  });
+    metadata: {
+      actionKind: proposal.actionKind,
+      admissionId: admission.admissionId,
+      decisionId: decision.decisionId,
+      policyId: decision.policyId
+    }
+  };
+  const audit = {
+    id: `${proposal.workItemId}:${statusState}:${state.auditSeq}`,
+    kind: `work-item-domain-action-${admission.state}`,
+    subjectId: proposal.workItemId,
+    sourceRefs: admission.sourceRefs,
+    metadata: {
+      actionKind: proposal.actionKind,
+      admissionId: admission.admissionId,
+      decisionId: decision.decisionId,
+      policyId: decision.policyId,
+      proposalId: proposal.proposalId
+    }
+  };
+  ctx.down([
+    ["DATA", { kind: "admission", admission }],
+    ["DATA", { kind: "status", status }],
+    ["DATA", { kind: "audit", audit }]
+  ]);
+  return true;
 }
-function capabilityGuardProposalIssue(proposal) {
-  if (!isRecord(proposal) || proposal.kind !== "work-item-domain-action-proposal" || typeof proposal.proposalId !== "string" || proposal.proposalId.length === 0 || typeof proposal.workItemId !== "string" || proposal.workItemId.length === 0 || typeof proposal.actionKind !== "string" || proposal.actionKind.length === 0 || proposal.sourceRefs !== void 0 && !isSourceRefArray(proposal.sourceRefs)) {
-    return dataIssue(
-      "malformed-work-item-domain-action-capability-guard-proposal",
-      "WorkItem domain action capability guard requires valid proposal DATA facts",
-      { subjectId: recordString(proposal, "workItemId") }
-    );
-  }
-  return void 0;
+function admissionPolicyForDecision(state, decision) {
+  if (decision.policyId === void 0) return void 0;
+  const stalePolicyRef = (decision.sourceRefs ?? []).find(
+    (sourceRef) => sourceRef.kind === "work-item-domain-action-admission-policy" && sourceRef.id !== decision.policyId
+  );
+  if (stalePolicyRef !== void 0) return "stale-work-item-domain-action-admission-policy-ref";
+  return state.policies.get(decision.policyId) ?? "missing-work-item-domain-action-admission-policy";
 }
-function capabilityGuardPolicyIssue(policy) {
-  if (!isRecord(policy) || policy.kind !== "work-item-domain-action-capability-guard-policy" || typeof policy.policyId !== "string" || policy.policyId.length === 0 || !Array.isArray(policy.capabilityRefs) || policy.capabilityRefs.length === 0 || !policy.capabilityRefs.every(isBoundaryCapabilityRef) || !Array.isArray(policy.admissionSubjectIds) || policy.admissionSubjectIds.length === 0 || !policy.admissionSubjectIds.every((id) => typeof id === "string" && id.length > 0) || policy.actionKinds !== void 0 && (!Array.isArray(policy.actionKinds) || !policy.actionKinds.every((kind) => typeof kind === "string" && kind.length > 0))) {
-    return dataIssue(
-      "malformed-work-item-domain-action-capability-guard-policy",
-      "WorkItem domain action capability guard policy requires policyId, capabilityRefs, and admissionSubjectIds",
-      {
-        subjectId: recordString(policy, "policyId")
-      }
-    );
+function admissionPolicyIssueMessage(code, decision) {
+  if (code === "missing-work-item-domain-action-admission-policy") {
+    return `WorkItemDomainActionAdmissionPolicy '${decision.policyId}' was referenced for WorkItem action admission but not present`;
   }
-  return void 0;
+  return `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' carries a stale admission policy source ref`;
 }
-function capabilityAdmissionIssue(admission) {
-  if (!isRecord(admission) || admission.kind !== "capability-admission" || typeof admission.admissionId !== "string" || admission.admissionId.length === 0 || typeof admission.proposalId !== "string" || admission.proposalId.length === 0 || typeof admission.subjectId !== "string" || admission.subjectId.length === 0 || !isBoundaryCapabilityRef(admission.capability) || !isCapabilityAdmissionState(admission.state) || typeof admission.decisionId !== "string" || admission.decisionId.length === 0 || admission.sourceRefs !== void 0 && !isSourceRefArray(admission.sourceRefs)) {
-    return dataIssue(
-      "malformed-capability-admission",
-      "WorkItem domain action capability guard requires valid CapabilityAdmission DATA facts",
-      { subjectId: recordString(admission, "subjectId") }
-    );
+function validateWorkItemAdmissionPolicy(policy, decision, proposal) {
+  if (policy.actionKinds !== void 0 && !policy.actionKinds.includes(proposal.actionKind)) {
+    return {
+      code: "work-item-domain-action-admission-policy-mismatch",
+      message: `WorkItemDomainActionAdmissionPolicy '${policy.policyId}' does not apply to actionKind '${proposal.actionKind}'`
+    };
+  }
+  if (policy.allowedOutcomes !== void 0 && !policy.allowedOutcomes.includes(decision.outcome)) {
+    return {
+      code: "unsupported-work-item-domain-action-admission-outcome",
+      message: `WorkItemDomainActionAdmissionPolicy '${policy.policyId}' does not allow outcome '${decision.outcome}'`
+    };
   }
   return void 0;
 }
-function capabilityAdmissionStatusIssue(status) {
-  if (!isRecord(status) || status.kind !== "capability-admission-status" || typeof status.statusId !== "string" || status.statusId.length === 0 || !isCapabilityAdmissionStatusState(status.state)) {
-    return dataIssue(
-      "malformed-capability-admission-status",
-      "WorkItem domain action capability guard requires valid CapabilityAdmissionStatus DATA facts",
-      { subjectId: recordString(status, "subjectId") }
-    );
-  }
-  const hasCapabilityId = status.capabilityId !== void 0;
-  const hasCapabilityKind = status.capabilityKind !== void 0;
-  if (hasCapabilityId !== hasCapabilityKind || hasCapabilityId && (typeof status.capabilityId !== "string" || status.capabilityId.length === 0 || !isBoundaryCapabilityKind(status.capabilityKind)) || status.sourceRefs !== void 0 && !isSourceRefArray(status.sourceRefs) || status.issues !== void 0 && !isDataIssueArray(status.issues)) {
-    return dataIssue(
-      "malformed-capability-admission-status",
-      "WorkItem domain action capability guard requires valid CapabilityAdmissionStatus DATA facts",
-      { subjectId: recordString(status, "subjectId") }
-    );
+function validateWorkItemAdmissionMergeTarget(state, decision) {
+  const hasTargetProposal = decision.targetProposalId !== void 0;
+  const hasTargetAdmission = decision.targetAdmissionId !== void 0;
+  if (decision.outcome !== "merge") {
+    if (hasTargetProposal || hasTargetAdmission) {
+      return {
+        code: "ambiguous-work-item-domain-action-admission-merge-target",
+        message: `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' carries a merge target for non-merge outcome '${decision.outcome}'`
+      };
+    }
+    return void 0;
   }
-  return void 0;
-}
-function isCapabilityAdmissionState(value) {
-  return value === "allowed" || value === "blocked" || value === "deferred";
-}
-function isCapabilityAdmissionStatusState(value) {
-  return value === "capability-admission-allowed" || value === "capability-admission-blocked" || value === "capability-admission-deferred" || value === "capability-admission-issue";
-}
-function isSourceRefArray(value) {
-  return Array.isArray(value) && value.every(
-    (item) => isRecord(item) && typeof item.kind === "string" && typeof item.id === "string"
-  );
-}
-function isDataIssueArray(value) {
-  return Array.isArray(value) && value.every(isDataIssue);
-}
-function isDataIssue(value) {
-  return isRecord(value) && value.kind === "issue" && typeof value.code === "string" && value.code.length > 0 && typeof value.message === "string" && value.message.length > 0;
-}
-function isBoundaryCapabilityRef(value) {
-  return isRecord(value) && typeof value.id === "string" && value.id.length > 0 && isBoundaryCapabilityKind(value.kind) && typeof value.required === "boolean" && (value.sourceRefs === void 0 || Array.isArray(value.sourceRefs) && value.sourceRefs.every((sourceRef) => typeof sourceRef === "string"));
-}
-function isBoundaryCapabilityKind(value) {
-  return value === "auth" || value === "permission" || value === "config" || value === "resource";
-}
-function selectCapabilityGuardPolicy(state, proposal) {
-  const explicitId = stringMetadata(proposal.metadata, "capabilityGuardPolicyId") ?? proposal.sourceRefs?.find(
-    (sourceRef) => sourceRef.kind === "work-item-domain-action-capability-guard-policy"
-  )?.id;
-  if (explicitId !== void 0)
-    return state.policies.get(explicitId) ?? "unknown-work-item-domain-action-capability-guard-policy";
-  const matching = [...state.policies.values()].filter(
-    (policy) => policy.actionKinds === void 0 || policy.actionKinds.includes(proposal.actionKind)
-  );
-  if (matching.length === 0) return "missing-policy";
-  if (matching.length > 1) return "policy-mismatch";
-  return matching[0];
-}
-function latestCapabilityAdmission(state, policy, capabilityRef) {
-  const admissions = state.admissionsByCapability.get(capabilityBoundaryRefId(capabilityRef)) ?? [];
-  for (let index = admissions.length - 1; index >= 0; index -= 1) {
-    const admission = admissions[index];
-    if (admission !== void 0 && policy.admissionSubjectIds.includes(admission.subjectId))
-      return admission;
+  if (hasTargetProposal === hasTargetAdmission) {
+    return {
+      code: "ambiguous-work-item-domain-action-admission-merge-target",
+      message: `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' must reference exactly one merge target`
+    };
+  }
+  if (decision.targetProposalId === decision.proposalId) {
+    return {
+      code: "ambiguous-work-item-domain-action-admission-merge-target",
+      message: `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' cannot merge a proposal into itself`
+    };
+  }
+  if (decision.targetProposalId !== void 0 && !state.proposals.has(decision.targetProposalId)) {
+    return {
+      code: "unknown-work-item-domain-action-admission-merge-target",
+      message: `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' references unknown target proposal '${decision.targetProposalId}'`
+    };
+  }
+  if (decision.targetAdmissionId !== void 0 && !state.admissionsById.has(decision.targetAdmissionId)) {
+    return {
+      code: "unknown-work-item-domain-action-admission-merge-target",
+      message: `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' references unknown target admission '${decision.targetAdmissionId}'`
+    };
   }
   return void 0;
 }
-function emitCapabilityStatusIssueForProposal(ctx, state, proposal, status) {
-  const policy = selectCapabilityGuardPolicy(state, proposal);
-  if (typeof policy === "string") return;
-  if (status.subjectId !== void 0 && !policy.admissionSubjectIds.includes(status.subjectId))
-    return;
-  const capabilityId = status.capabilityId;
-  const capabilityKind = status.capabilityKind;
-  const statusCapabilityKey = capabilityId === void 0 || capabilityKind === void 0 ? void 0 : capabilityBoundaryRefId({ id: capabilityId, kind: capabilityKind });
-  if (statusCapabilityKey !== void 0 && !policy.capabilityRefs.some(
-    (capabilityRef) => capabilityBoundaryRefId(capabilityRef) === statusCapabilityKey
-  ))
-    return;
-  const issue = status.issues?.[0] ?? dataIssue(
-    "capability-admission-status-issue",
-    "Capability admission status reported an issue",
-    { subjectId: proposal.workItemId }
-  );
-  emitCapabilityGuardIssue(
-    ctx,
-    state,
-    `capability-status:${proposal.proposalId}:${status.statusId}`,
-    dataIssue(issue.code, issue.message, {
-      subjectId: proposal.workItemId,
-      refs: uniqueSourceRefs([
-        ...capabilityGuardRefs(proposal, policy),
-        ...status.sourceRefs ?? []
-      ]),
-      metadata: {
-        ...statusCapabilityKey === void 0 ? {} : { capabilityRef: statusCapabilityKey },
-        capabilityAdmissionStatusId: status.statusId
-      }
-    })
-  );
-}
-function capabilityGuardPolicyMessage(code, proposal) {
-  if (code === "missing-policy")
-    return `WorkItem domain action '${proposal.proposalId}' has no capability guard policy`;
-  if (code === "unknown-work-item-domain-action-capability-guard-policy")
-    return `WorkItem domain action '${proposal.proposalId}' references a missing capability guard policy`;
-  return `WorkItem domain action '${proposal.proposalId}' matches multiple capability guard policies`;
-}
-function capabilityGuardRefs(proposal, policy, admissions = []) {
-  return uniqueSourceRefs([
-    ref("work-item", proposal.workItemId),
-    ref("work-item-domain-action-proposal", proposal.proposalId),
-    ref("work-item-domain-action-capability-guard-policy", policy.policyId),
-    ...admissions.filter((admission) => admission !== void 0).flatMap((admission) => [
-      ref("capability-admission", admission.admissionId),
-      ref("capability-admission-proposal", admission.proposalId),
-      ref("boundary-capability", capabilityBoundaryRefId(admission.capability)),
-      ...admission.sourceRefs ?? []
-    ]),
-    ...proposal.sourceRefs ?? []
-  ]);
+function admissionStateForOutcome(outcome) {
+  if (outcome === "admit") return "admitted";
+  if (outcome === "reject") return "rejected";
+  if (outcome === "defer") return "deferred";
+  if (outcome === "merge") return "merged";
+  return void 0;
 }
-function capabilityBoundaryRefId(capability) {
-  return `${capability.kind}:${capability.id}`;
+function workItemAdmissionStatusState(state) {
+  if (state === "admitted") return "domain-action-admitted";
+  if (state === "rejected") return "domain-action-rejected";
+  if (state === "deferred") return "domain-action-deferred";
+  return "domain-action-merged";
 }
-function emitCapabilityGuardStatus(ctx, state, status) {
-  state.statusSeq += 1;
-  const statusFact = {
-    kind: "work-item-domain-action-capability-guard-status",
-    statusId: `work-item-domain-action-capability-guard-status:${state.statusSeq}`,
-    ...status
-  };
-  emitCapabilityGuard(ctx, "status", statusFact);
-  state.auditSeq += 1;
-  emitCapabilityGuard(ctx, "audit", {
-    id: `work-item-domain-action-capability-guard-status:${state.auditSeq}`,
-    kind: "work-item-domain-action-capability-guard-status",
+
+// src/solutions/work-item/actions-shared.ts
+function auditRecord(kind, seq, status) {
+  return {
+    id: `${kind}:${seq}`,
+    kind,
     subjectId: status.workItemId,
     message: status.message,
+    issueCode: status.code,
     sourceRefs: status.sourceRefs,
     metadata: {
-      statusId: statusFact.statusId,
+      statusId: status.statusId,
       state: status.state,
       proposalId: status.proposalId,
-      policyId: status.policyId,
+      admissionId: status.admissionId,
+      actionKind: status.actionKind,
       ...status.metadata ?? {}
     }
-  });
-}
-function emitCapabilityGuardStatusOnce(ctx, state, key, status) {
-  if (state.emittedStatusKeys.has(key)) return;
-  state.emittedStatusKeys.add(key);
-  emitCapabilityGuardStatus(ctx, state, status);
-}
-function emitCapabilityGuardIssue(ctx, state, key, issue) {
-  if (state.issueKeys.has(key)) return;
-  state.issueKeys.add(key);
-  emitCapabilityGuard(ctx, "issue", issue);
-  emitCapabilityGuardStatus(ctx, state, {
-    state: "issue",
-    workItemId: issue.subjectId,
-    issues: [issue],
-    message: issue.message,
-    metadata: { issueCode: issue.code }
-  });
+  };
 }
-function emitCapabilityGuard(ctx, kind, value) {
-  ctx.down([["DATA", { kind, value }]]);
+function project(graph, runtime, name, factory, select) {
+  return graph.node(
+    [runtime],
+    (ctx) => {
+      for (const raw of depBatch(ctx, 0) ?? []) {
+        const selected = select(raw);
+        if (selected !== void 0) ctx.down([["DATA", selected]]);
+      }
+    },
+    { name, factory, partial: true, completeWhenDepsComplete: false, errorWhenDepsError: false }
+  );
 }
-function reduceProposalIntake(ctx, state, input, proposedAtMs) {
-  const proposal = normalizeProposal(input, proposedAtMs);
-  if (typeof proposal === "string") {
-    const issue = dataIssue("malformed-domain-action-proposal", proposal);
-    emitIntake(ctx, "issue", issue);
-    emitIntakeStatus(ctx, state, {
-      state: "rejected",
-      code: issue.code,
-      message: issue.message
-    });
-    return;
-  }
-  if (state.proposals.has(proposal.proposalId)) {
-    emitIntakeStatus(ctx, state, {
-      state: "duplicate",
-      code: "duplicate-suppressed",
-      workItemId: proposal.workItemId,
-      proposalId: proposal.proposalId,
-      actionKind: proposal.actionKind,
-      message: `Duplicate WorkItem domain action proposal '${proposal.proposalId}' suppressed`
-    });
-    return;
-  }
-  state.proposals.add(proposal.proposalId);
-  emitIntake(ctx, "proposal", proposal);
-  emitIntakeStatus(ctx, state, {
-    state: "proposed",
-    workItemId: proposal.workItemId,
-    proposalId: proposal.proposalId,
-    actionKind: proposal.actionKind,
-    sourceRefs: proposal.sourceRefs
-  });
+function dataIssue2(code, message, opts = {}) {
+  return {
+    kind: "issue",
+    code,
+    message,
+    severity: "error",
+    source: "work-item-actions",
+    subjectId: opts.subjectId,
+    refs: opts.refs?.map((sourceRef) => `${sourceRef.kind}:${sourceRef.id}`),
+    metadata: opts.metadata
+  };
 }
-function normalizeProposal(input, proposedAtMs) {
-  if (!isRecord(input)) return "WorkItemDomainActionProposal intake must be an object";
-  if (input.kind !== "work-item-domain-action-proposal" && input.kind !== "work-item-domain-action-proposal-intake")
-    return "WorkItemDomainActionProposal intake has unsupported kind";
-  if (typeof input.proposalId !== "string" || input.proposalId.trim() === "")
-    return "WorkItemDomainActionProposal.proposalId is required";
-  if (typeof input.workItemId !== "string" || input.workItemId.trim() === "")
-    return "WorkItemDomainActionProposal.workItemId is required";
-  if (typeof input.actionKind !== "string" || input.actionKind.trim() === "")
-    return "WorkItemDomainActionProposal.actionKind is required";
-  if (input.kind === "work-item-domain-action-proposal") {
-    if (typeof input.effectRunId !== "string")
-      return "WorkItemDomainActionProposal.effectRunId is required";
-    if (typeof input.effectRunResultId !== "string")
-      return "WorkItemDomainActionProposal.effectRunResultId is required";
-    if (typeof input.evidenceId !== "string")
-      return "WorkItemDomainActionProposal.evidenceId is required";
-    if (typeof input.policyId !== "string")
-      return "WorkItemDomainActionProposal.policyId is required";
-    return input;
+function uniqueSourceRefs2(sourceRefs2) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const sourceRef of sourceRefs2) {
+    const key = `${sourceRef.kind}:${sourceRef.id}:${JSON.stringify(sourceRef.metadata ?? {})}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(sourceRef);
   }
-  return workItemDomainActionProposal(
-    input.proposalId,
-    input.workItemId,
-    input.actionKind,
-    {
-      payload: input.payload,
-      reason: typeof input.reason === "string" ? input.reason : void 0,
-      policyId: typeof input.policyId === "string" ? input.policyId : void 0,
-      effectRunId: typeof input.effectRunId === "string" ? input.effectRunId : void 0,
-      effectRunResultId: typeof input.effectRunResultId === "string" ? input.effectRunResultId : void 0,
-      evidenceId: typeof input.evidenceId === "string" ? input.evidenceId : void 0,
-      proposedAtMs: typeof input.proposedAtMs === "number" ? input.proposedAtMs : proposedAtMs,
-      sourceRefs: sourceRefs(input.sourceRefs),
-      metadata: isRecord(input.metadata) ? input.metadata : void 0
-    }
-  );
+  return out;
 }
-function applyAdmission(ctx, state, admission) {
+function sourceRefs(value) {
+  if (!Array.isArray(value)) return void 0;
+  return value.filter(
+    (item) => isRecord(item) && typeof item.kind === "string" && typeof item.id === "string"
+  );
+}
+function numberMetadata(metadata, key) {
+  const value = metadata?.[key];
+  return typeof value === "number" ? value : void 0;
+}
+function stringMetadata(metadata, key) {
+  const value = metadata?.[key];
+  return typeof value === "string" ? value : void 0;
+}
+function ref2(kind, id) {
+  return { kind, id };
+}
+function recordString(value, key) {
+  return isRecord(value) && typeof value[key] === "string" ? value[key] : void 0;
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object";
+}
+
+// src/solutions/work-item/actions-types.ts
+var patchFieldKeys = /* @__PURE__ */ new Set([
+  "summary",
+  "detail",
+  "detailRefs",
+  "kind",
+  "priority",
+  "tags",
+  "owner",
+  "assignee",
+  "deadlineMs",
+  "customFields",
+  "sourceRefs",
+  "metadata"
+]);
+
+// src/solutions/work-item/actions-application.ts
+function workItemDomainActionApplicationProjector(graph, opts) {
+  const name = opts.name ?? "workItemDomainActionApplication";
+  const deps = opts.applyPolicies === void 0 ? [opts.proposals, opts.admissions, opts.workItems] : [opts.proposals, opts.admissions, opts.workItems, opts.applyPolicies];
+  const runtime = graph.node(
+    deps,
+    (ctx) => {
+      const state = ctx.state.get() ?? {
+        proposals: /* @__PURE__ */ new Map(),
+        admissions: /* @__PURE__ */ new Map(),
+        workItems: /* @__PURE__ */ new Map(),
+        policies: /* @__PURE__ */ new Map(),
+        appliedAdmissions: /* @__PURE__ */ new Set(),
+        emittedFactIds: /* @__PURE__ */ new Set(),
+        issueKeys: /* @__PURE__ */ new Set(),
+        statusSeq: 0,
+        auditSeq: 0
+      };
+      for (const raw of depBatch(ctx, 0) ?? []) {
+        const proposal = raw;
+        if (state.proposals.has(proposal.proposalId)) {
+          emitApplicationIssue(
+            ctx,
+            state,
+            `duplicate-proposal:${proposal.proposalId}`,
+            "duplicate-suppressed",
+            `Duplicate WorkItem domain action proposal '${proposal.proposalId}' suppressed`,
+            proposal.workItemId,
+            proposal.sourceRefs
+          );
+          continue;
+        }
+        state.proposals.set(proposal.proposalId, proposal);
+      }
+      for (const raw of depBatch(ctx, 2) ?? []) {
+        const workItem = raw;
+        state.workItems.set(workItem.workItemId, workItem);
+      }
+      if (opts.applyPolicies !== void 0) {
+        for (const raw of depBatch(ctx, 3) ?? []) {
+          const policy = raw;
+          state.policies.set(policy.policyId, policy);
+        }
+      }
+      for (const raw of depBatch(ctx, 1) ?? []) {
+        const admission = raw;
+        if (state.admissions.has(admission.admissionId)) {
+          emitApplicationIssue(
+            ctx,
+            state,
+            `duplicate-admission:${admission.admissionId}`,
+            "duplicate-suppressed",
+            `Duplicate WorkItem domain action admission '${admission.admissionId}' suppressed`,
+            admission.workItemId,
+            admissionRefs(admission)
+          );
+          continue;
+        }
+        state.admissions.set(admission.admissionId, admission);
+      }
+      for (const admission of state.admissions.values()) applyAdmission(ctx, state, admission);
+      ctx.state.set(state);
+    },
+    {
+      name: `${name}/runtime`,
+      factory: "workItemDomainActionApplicationProjector",
+      partial: true,
+      completeWhenDepsComplete: false,
+      errorWhenDepsError: false
+    }
+  );
+  return {
+    authoringFacts: project(
+      graph,
+      runtime,
+      `${name}/authoringFacts`,
+      "workItemDomainActionAuthoringFacts",
+      (fact) => fact.kind === "authoring-fact" ? fact.value : void 0
+    ),
+    applications: project(
+      graph,
+      runtime,
+      `${name}/applications`,
+      "workItemDomainActionApplications",
+      (fact) => fact.kind === "application" ? fact.value : void 0
+    ),
+    status: project(
+      graph,
+      runtime,
+      `${name}/status`,
+      "workItemDomainActionStatus",
+      (fact) => fact.kind === "status" ? fact.value : void 0
+    ),
+    issues: project(
+      graph,
+      runtime,
+      `${name}/issues`,
+      "workItemDomainActionIssues",
+      (fact) => fact.kind === "issue" ? fact.value : void 0
+    ),
+    audit: project(
+      graph,
+      runtime,
+      `${name}/audit`,
+      "workItemDomainActionAudit",
+      (fact) => fact.kind === "audit" ? fact.value : void 0
+    )
+  };
+}
+function applyAdmission(ctx, state, admission) {
   if (state.appliedAdmissions.has(admission.admissionId)) return;
   const proposal = state.proposals.get(admission.proposalId);
   if (proposal === void 0) {
@@ -1073,24 +1052,136 @@ function lowerSpawnAction(ctx, state, proposal, admission, policy) {
       message: "Spawn action remains proposal/admission only without explicit create policy"
     };
   }
-  emitApplicationIssue(
-    ctx,
-    state,
-    `spawn-create-policy:${admission.admissionId}:${policy.policyId}`,
-    "policy-mismatch",
-    `Spawn create policy '${policy.policyId}' is incomplete: child creation requires an explicit create/link/idempotency policy surface`,
-    proposal.workItemId,
-    admissionRefs(admission, proposal, policy),
-    {
-      requires: ["linkParent", "idempotencyKey", "maxChildrenPerAdmission", "link-fact-vocabulary"]
-    }
-  );
-  return {
-    state: "proposal-only",
-    facts: [],
-    code: "policy-mismatch",
-    message: "Spawn action remains proposal/admission only until explicit create/link policy is available"
+  const policyIssue = validateSpawnCreatePolicy(policy, proposal);
+  if (policyIssue !== void 0) {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `spawn-create-policy:${admission.admissionId}:${policy.policyId}:${policyIssue.field}`,
+      "policy-mismatch",
+      policyIssue.message,
+      proposal.workItemId,
+      admissionRefs(admission, proposal, policy),
+      { field: policyIssue.field }
+    );
+    return {
+      state: "policy-rejected",
+      facts: [],
+      code: "policy-mismatch",
+      message: policyIssue.message
+    };
+  }
+  const payload = normalizeSpawnPayload(proposal.payload);
+  if (typeof payload === "string") {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `invalid-spawn-payload:${admission.admissionId}`,
+      "invalid-patch",
+      payload,
+      proposal.workItemId,
+      admissionRefs(admission, proposal, policy)
+    );
+    return { state: "rejected", facts: [], code: "invalid-patch", message: payload };
+  }
+  const childWorkItemId = payload.childWorkItemId ?? payload.workItemId ?? policy.spawn.childWorkItemId ?? (policy.spawn.childIdPrefix === void 0 ? void 0 : `${policy.spawn.childIdPrefix}${admission.admissionId}`);
+  if (childWorkItemId === void 0 || childWorkItemId.trim() === "") {
+    const message = "Spawn create action requires a childWorkItemId or create policy child id";
+    emitApplicationIssue(
+      ctx,
+      state,
+      `missing-spawn-child-id:${admission.admissionId}`,
+      "missing-required-field",
+      message,
+      proposal.workItemId,
+      admissionRefs(admission, proposal, policy)
+    );
+    return { state: "rejected", facts: [], code: "missing-required-field", message };
+  }
+  if (state.workItems.has(childWorkItemId)) {
+    const message = `Spawn create action would duplicate WorkItem '${childWorkItemId}'`;
+    emitApplicationIssue(
+      ctx,
+      state,
+      `duplicate-spawn-child:${admission.admissionId}:${childWorkItemId}`,
+      "duplicate-id",
+      message,
+      childWorkItemId,
+      admissionRefs(admission, proposal, policy)
+    );
+    return { state: "duplicate", facts: [], code: "duplicate-id", message };
+  }
+  if (payload.draft === void 0) {
+    const message = "Spawn create action requires a draft payload";
+    emitApplicationIssue(
+      ctx,
+      state,
+      `missing-spawn-draft:${admission.admissionId}`,
+      "missing-required-field",
+      message,
+      childWorkItemId,
+      admissionRefs(admission, proposal, policy)
+    );
+    return { state: "rejected", facts: [], code: "missing-required-field", message };
+  }
+  const issues = validateWorkItemDraft(payload.draft, { workItemId: childWorkItemId });
+  if (issues.length > 0) {
+    for (const item of issues) emitApplicationFact(ctx, "issue", item);
+    return {
+      state: "rejected",
+      facts: [],
+      code: issues[0]?.code,
+      message: issues[0]?.message
+    };
+  }
+  const metadata = {
+    ...payload.metadata ?? {},
+    actionKind: proposal.actionKind,
+    parentWorkItemId: policy.spawn.linkParent === true ? proposal.workItemId : void 0,
+    sourceProposalId: proposal.proposalId,
+    idempotencyKey: payload.idempotencyKey ?? policy.spawn.idempotencyKey
+  };
+  const created = {
+    kind: "work-item-created",
+    eventId: payload.eventId ?? `${admission.admissionId}:work-item-created:${childWorkItemId}`,
+    workItemId: childWorkItemId,
+    draft: payload.draft,
+    authorId: payload.authorId,
+    sourceRefs: actionSourceRefs(admission, proposal, policy),
+    metadata
   };
+  return { state: "applied", facts: [created] };
+}
+function validateSpawnCreatePolicy(policy, proposal) {
+  if (policy.spawn?.idempotencyKey === void 0 || policy.spawn.idempotencyKey.trim() === "") {
+    return {
+      field: "idempotencyKey",
+      message: `Spawn create policy '${policy.policyId}' requires an idempotencyKey`
+    };
+  }
+  if (policy.spawn.maxChildrenPerAdmission === void 0 || policy.spawn.maxChildrenPerAdmission < 1) {
+    return {
+      field: "maxChildrenPerAdmission",
+      message: `Spawn create policy '${policy.policyId}' requires maxChildrenPerAdmission >= 1`
+    };
+  }
+  if (proposal.actionKind === "spawn-child" && policy.spawn.linkParent !== true) {
+    return {
+      field: "linkParent",
+      message: `Spawn child create policy '${policy.policyId}' requires linkParent: true`
+    };
+  }
+  return void 0;
+}
+function normalizeSpawnPayload(payload) {
+  if (!isRecord(payload)) return "Spawn action payload must be an object";
+  if ("draft" in payload && payload.draft !== void 0 && !isRecord(payload.draft)) {
+    return "Spawn action payload.draft must be an object";
+  }
+  if ("metadata" in payload && payload.metadata !== void 0 && !isRecord(payload.metadata)) {
+    return "Spawn action payload.metadata must be an object";
+  }
+  return payload;
 }
 function normalizePatchPayload(payload) {
   if (!isRecord(payload)) return "Patch action payload must be an object";
@@ -1109,338 +1200,871 @@ function normalizePatchPayload(payload) {
       patch: Object.keys(patch).length === 0 ? void 0 : patch
     };
   }
-  return { patch: payload };
+  return { patch: payload };
+}
+function inlinePatchFields(payload) {
+  const patch = {};
+  for (const [key, value] of Object.entries(payload)) {
+    if (key === "metadata") continue;
+    if (patchFieldKeys.has(key)) patch[key] = value;
+  }
+  return patch;
+}
+function splitDedicatedPatchFields(payload, workItem) {
+  if (!isRecord(payload.patch)) return payload;
+  const patchRecord = payload.patch;
+  const patch = {};
+  for (const [key, value] of Object.entries(patchRecord)) {
+    if (key === "acceptanceCriteria" || key === "verificationPlan" || key === "verificationSteps")
+      continue;
+    patch[key] = value;
+  }
+  const acceptanceCriteria = payload.acceptanceCriteria ?? (Array.isArray(patchRecord.acceptanceCriteria) ? patchRecord.acceptanceCriteria : void 0);
+  const verificationPlan = payload.verificationPlan ?? (isRecord(patchRecord.verificationPlan) ? patchRecord.verificationPlan : Array.isArray(patchRecord.verificationSteps) ? {
+    ...workItem.verificationPlan ?? { planId: "default" },
+    steps: patchRecord.verificationSteps
+  } : void 0);
+  return {
+    ...payload,
+    patch: Object.keys(patch).length === 0 ? void 0 : patch,
+    acceptanceCriteria,
+    verificationPlan
+  };
+}
+function invalidPatchKeys(patch, policy) {
+  const allowed = new Set(policy.patch?.allowedFields ?? Array.from(patchFieldKeys));
+  return Object.keys(patch).filter((key) => !patchFieldKeys.has(key) || !allowed.has(key));
+}
+function allowsAcceptanceCriteria(policy) {
+  if (policy.patch?.allowAcceptanceCriteria === false) return false;
+  const allowed = policy.patch?.allowedFields;
+  return allowed === void 0 || allowed.includes("acceptanceCriteria") || policy.patch?.allowAcceptanceCriteria === true;
+}
+function allowsVerificationPlan(policy) {
+  if (policy.patch?.allowVerificationPlan === false) return false;
+  const allowed = policy.patch?.allowedFields;
+  return allowed === void 0 || allowed.includes("verificationPlan") || allowed.includes("verificationSteps") || policy.patch?.allowVerificationPlan === true;
+}
+function selectApplyPolicy(state, proposal, admission) {
+  const explicitId = explicitApplyPolicyId(proposal, admission);
+  if (explicitId !== void 0)
+    return state.policies.get(explicitId) ?? "unknown-work-item-domain-action-apply-policy";
+  const matching = Array.from(state.policies.values()).filter(
+    (policy) => policyAllowsAction(policy, proposal.actionKind)
+  );
+  if (matching.length === 0) return "missing-policy";
+  if (matching.length > 1) return "policy-mismatch";
+  return matching[0];
+}
+function explicitApplyPolicyId(proposal, admission) {
+  const metadataPolicy = stringMetadata(admission.metadata, "applyPolicyId") ?? stringMetadata(proposal.metadata, "applyPolicyId");
+  if (metadataPolicy !== void 0) return metadataPolicy;
+  return [...admission.sourceRefs ?? [], ...proposal.sourceRefs ?? []].find(
+    (sourceRef) => sourceRef.kind === "work-item-domain-action-apply-policy"
+  )?.id;
+}
+function policyAllowsAction(policy, actionKind) {
+  return policy.actionKinds === void 0 || policy.actionKinds.includes(actionKind);
+}
+function admissionProposalMismatch(admission, proposal) {
+  if (admission.workItemId !== proposal.workItemId)
+    return {
+      field: "workItemId",
+      admissionValue: admission.workItemId,
+      proposalValue: proposal.workItemId,
+      message: `Admission '${admission.admissionId}' workItemId does not match proposal '${proposal.proposalId}'`
+    };
+  if (admission.actionKind !== proposal.actionKind)
+    return {
+      field: "actionKind",
+      admissionValue: admission.actionKind,
+      proposalValue: proposal.actionKind,
+      message: `Admission '${admission.admissionId}' actionKind does not match proposal '${proposal.proposalId}'`
+    };
+  return void 0;
+}
+function conflictingApplicationMetadata(proposal, admission) {
+  const authoringRevision = conflictingMetadataNumber(proposal, admission, "authoringRevision");
+  if (authoringRevision !== void 0)
+    return {
+      field: "authoringRevision",
+      code: "stale-revision",
+      ...authoringRevision,
+      message: `Admission '${admission.admissionId}' carries conflicting authoringRevision metadata`
+    };
+  const executionInputRevision = conflictingMetadataNumber(
+    proposal,
+    admission,
+    "executionInputRevision"
+  );
+  if (executionInputRevision !== void 0)
+    return {
+      field: "executionInputRevision",
+      code: "stale-execution-input",
+      ...executionInputRevision,
+      message: `Admission '${admission.admissionId}' carries conflicting executionInputRevision metadata`
+    };
+  const applyPolicyId = conflictingMetadataString(proposal, admission, "applyPolicyId");
+  if (applyPolicyId !== void 0)
+    return {
+      field: "applyPolicyId",
+      code: "policy-mismatch",
+      ...applyPolicyId,
+      message: `Admission '${admission.admissionId}' carries conflicting applyPolicyId metadata`
+    };
+  return void 0;
+}
+function conflictingMetadataNumber(proposal, admission, key) {
+  const proposalValue = numberMetadata(proposal.metadata, key);
+  const admissionValue = numberMetadata(admission.metadata, key);
+  if (proposalValue === void 0 || admissionValue === void 0 || proposalValue === admissionValue)
+    return void 0;
+  return { proposalValue, admissionValue };
+}
+function conflictingMetadataString(proposal, admission, key) {
+  const proposalValue = stringMetadata(proposal.metadata, key);
+  const admissionValue = stringMetadata(admission.metadata, key);
+  if (proposalValue === void 0 || admissionValue === void 0 || proposalValue === admissionValue)
+    return void 0;
+  return { proposalValue, admissionValue };
+}
+function staleRevision(proposal, admission, workItem) {
+  const authoringRevision = numberMetadata(admission.metadata, "authoringRevision") ?? numberMetadata(proposal.metadata, "authoringRevision");
+  if (authoringRevision !== void 0 && authoringRevision !== workItem.authoringRevision)
+    return {
+      kind: "stale-revision",
+      expected: authoringRevision,
+      current: workItem.authoringRevision
+    };
+  const executionInputRevision = numberMetadata(admission.metadata, "executionInputRevision") ?? numberMetadata(proposal.metadata, "executionInputRevision");
+  if (executionInputRevision !== void 0 && executionInputRevision !== workItem.executionInputRevision)
+    return {
+      kind: "stale-execution-input",
+      expected: executionInputRevision,
+      current: workItem.executionInputRevision
+    };
+  return void 0;
+}
+function applyPolicyMessage(code, proposal, admission) {
+  if (code === "missing-policy")
+    return `Admitted action '${admission.admissionId}' requires an explicit apply policy`;
+  if (code === "unknown-work-item-domain-action-apply-policy")
+    return `Admitted action '${admission.admissionId}' references a missing apply policy`;
+  return `Admitted action '${proposal.proposalId}' matches multiple apply policies`;
+}
+function emitApplication(ctx, state, admission, proposal, applicationState, facts, opts = {}) {
+  const producedFactIds = facts.map((fact) => fact.eventId);
+  const application = {
+    kind: "work-item-domain-action-application",
+    applicationId: `${admission.admissionId}:application`,
+    admissionId: admission.admissionId,
+    proposalId: proposal.proposalId,
+    workItemId: proposal.workItemId,
+    actionKind: proposal.actionKind,
+    state: applicationState,
+    producedFactIds,
+    reason: admission.reason ?? proposal.reason,
+    sourceRefs: admissionRefs(admission, proposal),
+    metadata: { policyId: opts.policyId, code: opts.code }
+  };
+  emitApplicationFact(ctx, "application", application);
+  emitApplicationStatus(ctx, state, {
+    state: applicationState,
+    code: opts.code,
+    message: opts.message,
+    workItemId: proposal.workItemId,
+    proposalId: proposal.proposalId,
+    admissionId: admission.admissionId,
+    actionKind: proposal.actionKind,
+    sourceRefs: application.sourceRefs,
+    metadata: { producedFactIds, policyId: opts.policyId }
+  });
+}
+function emitApplicationIssue(ctx, state, key, code, message, workItemId, sourceRefs2, metadata) {
+  if (state.issueKeys.has(key)) return;
+  state.issueKeys.add(key);
+  const item = dataIssue2(code, message, { subjectId: workItemId, refs: sourceRefs2, metadata });
+  emitApplicationFact(ctx, "issue", item);
+  emitApplicationStatus(ctx, state, {
+    state: code === "missing-policy" ? "missing-policy" : "rejected",
+    code,
+    message,
+    workItemId,
+    sourceRefs: sourceRefs2,
+    metadata
+  });
+}
+function emitApplicationStatus(ctx, state, status) {
+  state.statusSeq += 1;
+  const statusFact = {
+    kind: "work-item-domain-action-status",
+    statusId: `work-item-domain-action-application-status:${state.statusSeq}`,
+    ...status
+  };
+  emitApplicationFact(ctx, "status", statusFact);
+  emitApplicationAudit(ctx, state, "work-item-domain-action-application-status", statusFact);
+}
+function emitApplicationAudit(ctx, state, kind, status) {
+  state.auditSeq += 1;
+  emitApplicationFact(ctx, "audit", auditRecord(kind, state.auditSeq, status));
+}
+function emitApplicationFact(ctx, kind, value) {
+  ctx.down([["DATA", { kind, value }]]);
+}
+function firstDuplicateFactId(state, facts) {
+  const pending = /* @__PURE__ */ new Set();
+  for (const fact of facts) {
+    if (state.emittedFactIds.has(fact.eventId) || pending.has(fact.eventId)) return fact.eventId;
+    pending.add(fact.eventId);
+  }
+  return void 0;
+}
+function claimFactId(state, factId) {
+  if (state.emittedFactIds.has(factId)) return false;
+  state.emittedFactIds.add(factId);
+  return true;
+}
+function admissionRefs(admission, proposal, policy) {
+  return uniqueSourceRefs2([
+    ref2("work-item-domain-action-admission", admission.admissionId),
+    ref2("work-item-domain-action-proposal", admission.proposalId),
+    ...proposal === void 0 ? [] : [
+      ref2("work-item", proposal.workItemId),
+      ref2("work-item-evidence", proposal.evidenceId),
+      ...proposal.sourceRefs ?? []
+    ],
+    ...policy === void 0 ? [] : [ref2("work-item-domain-action-apply-policy", policy.policyId)],
+    ...admission.sourceRefs ?? []
+  ]);
+}
+function actionSourceRefs(admission, proposal, policy) {
+  return admissionRefs(admission, proposal, policy);
+}
+
+// src/solutions/work-item/actions-builders.ts
+function workItemDomainActionProposal(proposalId, workItemId, actionKind, opts = {}) {
+  return {
+    kind: "work-item-domain-action-proposal",
+    proposalId,
+    workItemId,
+    actionKind,
+    effectRunId: opts.effectRunId ?? `domain-action:${proposalId}:effect-run`,
+    effectRunResultId: opts.effectRunResultId ?? `domain-action:${proposalId}:effect-run-result`,
+    evidenceId: opts.evidenceId ?? `domain-action:${proposalId}:evidence`,
+    policyId: opts.policyId ?? "domain-action-proposal",
+    payload: opts.payload,
+    reason: opts.reason,
+    sourceRefs: opts.sourceRefs,
+    proposedAtMs: opts.proposedAtMs,
+    metadata: opts.metadata
+  };
+}
+function workItemDomainActionProposalIntake(proposalId, workItemId, actionKind, opts = {}) {
+  return {
+    kind: "work-item-domain-action-proposal-intake",
+    proposalId,
+    workItemId,
+    actionKind,
+    payload: opts.payload,
+    reason: opts.reason,
+    policyId: opts.policyId,
+    effectRunId: opts.effectRunId,
+    effectRunResultId: opts.effectRunResultId,
+    evidenceId: opts.evidenceId,
+    proposedAtMs: opts.proposedAtMs,
+    sourceRefs: opts.sourceRefs,
+    metadata: opts.metadata
+  };
+}
+function workItemDomainActionApplyPolicy(policyId, opts = {}) {
+  return {
+    kind: "work-item-domain-action-apply-policy",
+    policyId,
+    actionKinds: opts.actionKinds,
+    patch: opts.patch,
+    spawn: opts.spawn,
+    metadata: opts.metadata
+  };
+}
+
+// src/solutions/work-item/actions-capability-guard.ts
+function workItemDomainActionCapabilityGuardProjector(graph, opts) {
+  const name = opts.name ?? "workItemDomainActionCapabilityGuard";
+  const deps = opts.capabilityAdmissionStatus === void 0 ? [opts.proposals, opts.capabilityAdmissions, opts.guardPolicies] : [
+    opts.proposals,
+    opts.capabilityAdmissions,
+    opts.guardPolicies,
+    opts.capabilityAdmissionStatus
+  ];
+  const statusIndex = opts.capabilityAdmissionStatus === void 0 ? -1 : 3;
+  const now = opts.now ?? Date.now;
+  const runtime = graph.node(
+    deps,
+    (ctx) => {
+      const state = ctx.state.get() ?? {
+        proposals: /* @__PURE__ */ new Map(),
+        admissionsByCapability: /* @__PURE__ */ new Map(),
+        issueStatusesByCapability: /* @__PURE__ */ new Map(),
+        issueStatusesWithoutCapability: [],
+        policies: /* @__PURE__ */ new Map(),
+        emittedProposalDecisions: /* @__PURE__ */ new Set(),
+        emittedStatusKeys: /* @__PURE__ */ new Set(),
+        issueKeys: /* @__PURE__ */ new Set(),
+        statusSeq: 0,
+        auditSeq: 0
+      };
+      for (const raw of depBatch(ctx, 2) ?? []) {
+        const policyIssue = capabilityGuardPolicyIssue(raw);
+        if (policyIssue !== void 0) {
+          emitCapabilityGuardIssue(
+            ctx,
+            state,
+            `malformed-policy:${recordString(raw, "policyId") ?? "unknown"}`,
+            policyIssue
+          );
+          continue;
+        }
+        const policy = raw;
+        state.policies.set(policy.policyId, policy);
+      }
+      for (const raw of depBatch(ctx, 1) ?? []) {
+        const admissionIssue = capabilityAdmissionIssue(raw);
+        if (admissionIssue !== void 0) {
+          emitCapabilityGuardIssue(
+            ctx,
+            state,
+            `malformed-admission:${recordString(raw, "admissionId") ?? "unknown"}`,
+            admissionIssue
+          );
+          continue;
+        }
+        const admission = raw;
+        const capabilityKey = capabilityBoundaryRefId(admission.capability);
+        const byCapability = state.admissionsByCapability.get(capabilityKey) ?? [];
+        if (!byCapability.some((item) => item.admissionId === admission.admissionId)) {
+          state.admissionsByCapability.set(capabilityKey, [...byCapability, admission]);
+        }
+      }
+      if (statusIndex >= 0) {
+        for (const raw of depBatch(ctx, statusIndex) ?? []) {
+          const statusIssue = capabilityAdmissionStatusIssue(raw);
+          if (statusIssue !== void 0) {
+            emitCapabilityGuardIssue(
+              ctx,
+              state,
+              `malformed-capability-status:${recordString(raw, "statusId") ?? "unknown"}`,
+              statusIssue
+            );
+            continue;
+          }
+          const status = raw;
+          if (status.state !== "capability-admission-issue") continue;
+          const capabilityId = status.capabilityId;
+          const capabilityKind = status.capabilityKind;
+          if (capabilityId !== void 0 && capabilityKind !== void 0) {
+            const capabilityKey = capabilityBoundaryRefId({
+              id: capabilityId,
+              kind: capabilityKind
+            });
+            const statuses = state.issueStatusesByCapability.get(capabilityKey) ?? [];
+            if (!statuses.some((item) => item.statusId === status.statusId)) {
+              state.issueStatusesByCapability.set(capabilityKey, [...statuses, status]);
+            }
+          } else if (!state.issueStatusesWithoutCapability.some((item) => item.statusId === status.statusId)) {
+            state.issueStatusesWithoutCapability.push(status);
+          }
+          for (const proposal of state.proposals.values())
+            emitCapabilityStatusIssueForProposal(ctx, state, proposal, status);
+        }
+      }
+      for (const raw of depBatch(ctx, 0) ?? []) {
+        const proposalIssue = capabilityGuardProposalIssue(raw);
+        if (proposalIssue !== void 0) {
+          emitCapabilityGuardIssue(
+            ctx,
+            state,
+            `malformed-proposal:${recordString(raw, "proposalId") ?? "unknown"}`,
+            proposalIssue
+          );
+          continue;
+        }
+        const proposal = raw;
+        state.proposals.set(proposal.proposalId, proposal);
+      }
+      for (const proposal of state.proposals.values())
+        evaluateCapabilityGuardProposal(ctx, state, proposal, now());
+      ctx.state.set(state);
+    },
+    {
+      name: `${name}/runtime`,
+      factory: "workItemDomainActionCapabilityGuardProjector",
+      partial: true,
+      completeWhenDepsComplete: false,
+      errorWhenDepsError: false
+    }
+  );
+  return {
+    decisions: project(
+      graph,
+      runtime,
+      `${name}/decisions`,
+      "workItemDomainActionCapabilityGuardDecisions",
+      (fact) => fact.kind === "decision" ? fact.value : void 0
+    ),
+    status: project(
+      graph,
+      runtime,
+      `${name}/status`,
+      "workItemDomainActionCapabilityGuardStatus",
+      (fact) => fact.kind === "status" ? fact.value : void 0
+    ),
+    issues: project(
+      graph,
+      runtime,
+      `${name}/issues`,
+      "workItemDomainActionCapabilityGuardIssues",
+      (fact) => fact.kind === "issue" ? fact.value : void 0
+    ),
+    audit: project(
+      graph,
+      runtime,
+      `${name}/audit`,
+      "workItemDomainActionCapabilityGuardAudit",
+      (fact) => fact.kind === "audit" ? fact.value : void 0
+    )
+  };
+}
+function evaluateCapabilityGuardProposal(ctx, state, proposal, decidedAtMs) {
+  if (state.emittedProposalDecisions.has(proposal.proposalId)) return;
+  const policy = selectCapabilityGuardPolicy(state, proposal);
+  if (typeof policy === "string") {
+    emitCapabilityGuardIssue(
+      ctx,
+      state,
+      `policy:${proposal.proposalId}:${policy}`,
+      dataIssue2(policy, capabilityGuardPolicyMessage(policy, proposal), {
+        subjectId: proposal.workItemId,
+        refs: [ref2("work-item-domain-action-proposal", proposal.proposalId)]
+      })
+    );
+    return;
+  }
+  for (const status of state.issueStatusesWithoutCapability)
+    emitCapabilityStatusIssueForProposal(ctx, state, proposal, status);
+  for (const capabilityRef of policy.capabilityRefs) {
+    for (const status of state.issueStatusesByCapability.get(
+      capabilityBoundaryRefId(capabilityRef)
+    ) ?? [])
+      emitCapabilityStatusIssueForProposal(ctx, state, proposal, status);
+  }
+  const admissions = policy.capabilityRefs.map(
+    (capabilityRef) => latestCapabilityAdmission(state, policy, capabilityRef)
+  );
+  const missingCapabilityRefs = policy.capabilityRefs.filter(
+    (_, index) => admissions[index] === void 0
+  );
+  const deferredCapabilityRefs = admissions.filter((admission) => admission !== void 0).filter((admission) => admission.state === "deferred").map((admission) => capabilityBoundaryRefId(admission.capability));
+  if (missingCapabilityRefs.length > 0 || deferredCapabilityRefs.length > 0) {
+    emitCapabilityGuardStatusOnce(
+      ctx,
+      state,
+      `deferred:${proposal.proposalId}:${policy.policyId}:missing=${missingCapabilityRefs.map(capabilityBoundaryRefId).join(",")}:deferred=${deferredCapabilityRefs.join(",")}`,
+      {
+        state: "deferred",
+        workItemId: proposal.workItemId,
+        proposalId: proposal.proposalId,
+        actionKind: proposal.actionKind,
+        policyId: policy.policyId,
+        capabilityRefs: policy.capabilityRefs,
+        admissionSubjectIds: policy.admissionSubjectIds,
+        message: "WorkItem domain action is waiting for capability admission",
+        sourceRefs: capabilityGuardRefs(proposal, policy, admissions),
+        metadata: {
+          missingCapabilityRefs: missingCapabilityRefs.map(capabilityBoundaryRefId),
+          deferredCapabilityRefs
+        }
+      }
+    );
+    return;
+  }
+  const presentAdmissions = admissions.filter(
+    (admission) => admission !== void 0
+  );
+  const blocked = presentAdmissions.filter((admission) => admission.state === "blocked");
+  const outcome = blocked.length === 0 ? "admit" : "reject";
+  const decision = {
+    kind: "work-item-domain-action-admission-decision",
+    decisionId: `capability-guard:${proposal.proposalId}:decision`,
+    admissionId: `capability-guard:${proposal.proposalId}:admission`,
+    proposalId: proposal.proposalId,
+    outcome,
+    reason: blocked.length === 0 ? "Capability guard admitted required capabilities" : "Capability guard rejected blocked capabilities",
+    decidedAtMs,
+    sourceRefs: capabilityGuardRefs(proposal, policy, presentAdmissions),
+    metadata: {
+      capabilityGuardPolicyId: policy.policyId,
+      capabilityRefs: policy.capabilityRefs.map(capabilityBoundaryRefId),
+      admissionSubjectIds: policy.admissionSubjectIds,
+      blockedCapabilityRefs: blocked.map(
+        (admission) => capabilityBoundaryRefId(admission.capability)
+      )
+    }
+  };
+  state.emittedProposalDecisions.add(proposal.proposalId);
+  emitCapabilityGuard(ctx, "decision", decision);
+  emitCapabilityGuardStatus(ctx, state, {
+    state: outcome === "admit" ? "admitted" : "rejected",
+    workItemId: proposal.workItemId,
+    proposalId: proposal.proposalId,
+    actionKind: proposal.actionKind,
+    policyId: policy.policyId,
+    capabilityRefs: policy.capabilityRefs,
+    admissionSubjectIds: policy.admissionSubjectIds,
+    admissionIds: presentAdmissions.map((admission) => admission.admissionId),
+    sourceRefs: decision.sourceRefs,
+    metadata: { decisionId: decision.decisionId, admissionId: decision.admissionId }
+  });
+}
+function capabilityGuardProposalIssue(proposal) {
+  if (!isRecord(proposal) || proposal.kind !== "work-item-domain-action-proposal" || typeof proposal.proposalId !== "string" || proposal.proposalId.length === 0 || typeof proposal.workItemId !== "string" || proposal.workItemId.length === 0 || typeof proposal.actionKind !== "string" || proposal.actionKind.length === 0 || proposal.sourceRefs !== void 0 && !isSourceRefArray(proposal.sourceRefs)) {
+    return dataIssue2(
+      "malformed-work-item-domain-action-capability-guard-proposal",
+      "WorkItem domain action capability guard requires valid proposal DATA facts",
+      { subjectId: recordString(proposal, "workItemId") }
+    );
+  }
+  return void 0;
+}
+function capabilityGuardPolicyIssue(policy) {
+  if (!isRecord(policy) || policy.kind !== "work-item-domain-action-capability-guard-policy" || typeof policy.policyId !== "string" || policy.policyId.length === 0 || !Array.isArray(policy.capabilityRefs) || policy.capabilityRefs.length === 0 || !policy.capabilityRefs.every(isBoundaryCapabilityRef) || !Array.isArray(policy.admissionSubjectIds) || policy.admissionSubjectIds.length === 0 || !policy.admissionSubjectIds.every((id) => typeof id === "string" && id.length > 0) || policy.actionKinds !== void 0 && (!Array.isArray(policy.actionKinds) || !policy.actionKinds.every((kind) => typeof kind === "string" && kind.length > 0))) {
+    return dataIssue2(
+      "malformed-work-item-domain-action-capability-guard-policy",
+      "WorkItem domain action capability guard policy requires policyId, capabilityRefs, and admissionSubjectIds",
+      {
+        subjectId: recordString(policy, "policyId")
+      }
+    );
+  }
+  return void 0;
+}
+function capabilityAdmissionIssue(admission) {
+  if (!isRecord(admission) || admission.kind !== "capability-admission" || typeof admission.admissionId !== "string" || admission.admissionId.length === 0 || typeof admission.proposalId !== "string" || admission.proposalId.length === 0 || typeof admission.subjectId !== "string" || admission.subjectId.length === 0 || !isBoundaryCapabilityRef(admission.capability) || !isCapabilityAdmissionState(admission.state) || typeof admission.decisionId !== "string" || admission.decisionId.length === 0 || admission.sourceRefs !== void 0 && !isSourceRefArray(admission.sourceRefs)) {
+    return dataIssue2(
+      "malformed-capability-admission",
+      "WorkItem domain action capability guard requires valid CapabilityAdmission DATA facts",
+      { subjectId: recordString(admission, "subjectId") }
+    );
+  }
+  return void 0;
+}
+function capabilityAdmissionStatusIssue(status) {
+  if (!isRecord(status) || status.kind !== "capability-admission-status" || typeof status.statusId !== "string" || status.statusId.length === 0 || !isCapabilityAdmissionStatusState(status.state)) {
+    return dataIssue2(
+      "malformed-capability-admission-status",
+      "WorkItem domain action capability guard requires valid CapabilityAdmissionStatus DATA facts",
+      { subjectId: recordString(status, "subjectId") }
+    );
+  }
+  const hasCapabilityId = status.capabilityId !== void 0;
+  const hasCapabilityKind = status.capabilityKind !== void 0;
+  if (hasCapabilityId !== hasCapabilityKind || hasCapabilityId && (typeof status.capabilityId !== "string" || status.capabilityId.length === 0 || !isBoundaryCapabilityKind(status.capabilityKind)) || status.sourceRefs !== void 0 && !isSourceRefArray(status.sourceRefs) || status.issues !== void 0 && !isDataIssueArray(status.issues)) {
+    return dataIssue2(
+      "malformed-capability-admission-status",
+      "WorkItem domain action capability guard requires valid CapabilityAdmissionStatus DATA facts",
+      { subjectId: recordString(status, "subjectId") }
+    );
+  }
+  return void 0;
 }
-function inlinePatchFields(payload) {
-  const patch = {};
-  for (const [key, value] of Object.entries(payload)) {
-    if (key === "metadata") continue;
-    if (patchFieldKeys.has(key)) patch[key] = value;
-  }
-  return patch;
+function isCapabilityAdmissionState(value) {
+  return value === "allowed" || value === "blocked" || value === "deferred";
 }
-function splitDedicatedPatchFields(payload, workItem) {
-  if (!isRecord(payload.patch)) return payload;
-  const patchRecord = payload.patch;
-  const patch = {};
-  for (const [key, value] of Object.entries(patchRecord)) {
-    if (key === "acceptanceCriteria" || key === "verificationPlan" || key === "verificationSteps")
-      continue;
-    patch[key] = value;
-  }
-  const acceptanceCriteria = payload.acceptanceCriteria ?? (Array.isArray(patchRecord.acceptanceCriteria) ? patchRecord.acceptanceCriteria : void 0);
-  const verificationPlan = payload.verificationPlan ?? (isRecord(patchRecord.verificationPlan) ? patchRecord.verificationPlan : Array.isArray(patchRecord.verificationSteps) ? {
-    ...workItem.verificationPlan ?? { planId: "default" },
-    steps: patchRecord.verificationSteps
-  } : void 0);
-  return {
-    ...payload,
-    patch: Object.keys(patch).length === 0 ? void 0 : patch,
-    acceptanceCriteria,
-    verificationPlan
-  };
+function isCapabilityAdmissionStatusState(value) {
+  return value === "capability-admission-allowed" || value === "capability-admission-blocked" || value === "capability-admission-deferred" || value === "capability-admission-issue";
 }
-function invalidPatchKeys(patch, policy) {
-  const allowed = new Set(policy.patch?.allowedFields ?? Array.from(patchFieldKeys));
-  return Object.keys(patch).filter((key) => !patchFieldKeys.has(key) || !allowed.has(key));
+function isSourceRefArray(value) {
+  return Array.isArray(value) && value.every(
+    (item) => isRecord(item) && typeof item.kind === "string" && typeof item.id === "string"
+  );
 }
-function allowsAcceptanceCriteria(policy) {
-  if (policy.patch?.allowAcceptanceCriteria === false) return false;
-  const allowed = policy.patch?.allowedFields;
-  return allowed === void 0 || allowed.includes("acceptanceCriteria") || policy.patch?.allowAcceptanceCriteria === true;
+function isDataIssueArray(value) {
+  return Array.isArray(value) && value.every(isDataIssue);
 }
-function allowsVerificationPlan(policy) {
-  if (policy.patch?.allowVerificationPlan === false) return false;
-  const allowed = policy.patch?.allowedFields;
-  return allowed === void 0 || allowed.includes("verificationPlan") || allowed.includes("verificationSteps") || policy.patch?.allowVerificationPlan === true;
+function isDataIssue(value) {
+  return isRecord(value) && value.kind === "issue" && typeof value.code === "string" && value.code.length > 0 && typeof value.message === "string" && value.message.length > 0;
 }
-function selectApplyPolicy(state, proposal, admission) {
-  const explicitId = explicitApplyPolicyId(proposal, admission);
+function isBoundaryCapabilityRef(value) {
+  return isRecord(value) && typeof value.id === "string" && value.id.length > 0 && isBoundaryCapabilityKind(value.kind) && typeof value.required === "boolean" && (value.sourceRefs === void 0 || Array.isArray(value.sourceRefs) && value.sourceRefs.every((sourceRef) => typeof sourceRef === "string"));
+}
+function isBoundaryCapabilityKind(value) {
+  return value === "auth" || value === "permission" || value === "config" || value === "resource";
+}
+function selectCapabilityGuardPolicy(state, proposal) {
+  const explicitId = stringMetadata(proposal.metadata, "capabilityGuardPolicyId") ?? proposal.sourceRefs?.find(
+    (sourceRef) => sourceRef.kind === "work-item-domain-action-capability-guard-policy"
+  )?.id;
   if (explicitId !== void 0)
-    return state.policies.get(explicitId) ?? "unknown-work-item-domain-action-apply-policy";
-  const matching = Array.from(state.policies.values()).filter(
-    (policy) => policyAllowsAction(policy, proposal.actionKind)
+    return state.policies.get(explicitId) ?? "unknown-work-item-domain-action-capability-guard-policy";
+  const matching = [...state.policies.values()].filter(
+    (policy) => policy.actionKinds === void 0 || policy.actionKinds.includes(proposal.actionKind)
   );
   if (matching.length === 0) return "missing-policy";
   if (matching.length > 1) return "policy-mismatch";
   return matching[0];
 }
-function explicitApplyPolicyId(proposal, admission) {
-  const metadataPolicy = stringMetadata(admission.metadata, "applyPolicyId") ?? stringMetadata(proposal.metadata, "applyPolicyId");
-  if (metadataPolicy !== void 0) return metadataPolicy;
-  return [...admission.sourceRefs ?? [], ...proposal.sourceRefs ?? []].find(
-    (sourceRef) => sourceRef.kind === "work-item-domain-action-apply-policy"
-  )?.id;
-}
-function policyAllowsAction(policy, actionKind) {
-  return policy.actionKinds === void 0 || policy.actionKinds.includes(actionKind);
-}
-function admissionProposalMismatch(admission, proposal) {
-  if (admission.workItemId !== proposal.workItemId)
-    return {
-      field: "workItemId",
-      admissionValue: admission.workItemId,
-      proposalValue: proposal.workItemId,
-      message: `Admission '${admission.admissionId}' workItemId does not match proposal '${proposal.proposalId}'`
-    };
-  if (admission.actionKind !== proposal.actionKind)
-    return {
-      field: "actionKind",
-      admissionValue: admission.actionKind,
-      proposalValue: proposal.actionKind,
-      message: `Admission '${admission.admissionId}' actionKind does not match proposal '${proposal.proposalId}'`
-    };
+function latestCapabilityAdmission(state, policy, capabilityRef) {
+  const admissions = state.admissionsByCapability.get(capabilityBoundaryRefId(capabilityRef)) ?? [];
+  for (let index = admissions.length - 1; index >= 0; index -= 1) {
+    const admission = admissions[index];
+    if (admission !== void 0 && policy.admissionSubjectIds.includes(admission.subjectId))
+      return admission;
+  }
   return void 0;
 }
-function conflictingApplicationMetadata(proposal, admission) {
-  const authoringRevision = conflictingMetadataNumber(proposal, admission, "authoringRevision");
-  if (authoringRevision !== void 0)
-    return {
-      field: "authoringRevision",
-      code: "stale-revision",
-      ...authoringRevision,
-      message: `Admission '${admission.admissionId}' carries conflicting authoringRevision metadata`
-    };
-  const executionInputRevision = conflictingMetadataNumber(
-    proposal,
-    admission,
-    "executionInputRevision"
+function emitCapabilityStatusIssueForProposal(ctx, state, proposal, status) {
+  const policy = selectCapabilityGuardPolicy(state, proposal);
+  if (typeof policy === "string") return;
+  if (status.subjectId !== void 0 && !policy.admissionSubjectIds.includes(status.subjectId))
+    return;
+  const capabilityId = status.capabilityId;
+  const capabilityKind = status.capabilityKind;
+  const statusCapabilityKey = capabilityId === void 0 || capabilityKind === void 0 ? void 0 : capabilityBoundaryRefId({ id: capabilityId, kind: capabilityKind });
+  if (statusCapabilityKey !== void 0 && !policy.capabilityRefs.some(
+    (capabilityRef) => capabilityBoundaryRefId(capabilityRef) === statusCapabilityKey
+  ))
+    return;
+  const issue = status.issues?.[0] ?? dataIssue2(
+    "capability-admission-status-issue",
+    "Capability admission status reported an issue",
+    { subjectId: proposal.workItemId }
+  );
+  emitCapabilityGuardIssue(
+    ctx,
+    state,
+    `capability-status:${proposal.proposalId}:${status.statusId}`,
+    dataIssue2(issue.code, issue.message, {
+      subjectId: proposal.workItemId,
+      refs: uniqueSourceRefs2([
+        ...capabilityGuardRefs(proposal, policy),
+        ...status.sourceRefs ?? []
+      ]),
+      metadata: {
+        ...statusCapabilityKey === void 0 ? {} : { capabilityRef: statusCapabilityKey },
+        capabilityAdmissionStatusId: status.statusId
+      }
+    })
   );
-  if (executionInputRevision !== void 0)
-    return {
-      field: "executionInputRevision",
-      code: "stale-execution-input",
-      ...executionInputRevision,
-      message: `Admission '${admission.admissionId}' carries conflicting executionInputRevision metadata`
-    };
-  const applyPolicyId = conflictingMetadataString(proposal, admission, "applyPolicyId");
-  if (applyPolicyId !== void 0)
-    return {
-      field: "applyPolicyId",
-      code: "policy-mismatch",
-      ...applyPolicyId,
-      message: `Admission '${admission.admissionId}' carries conflicting applyPolicyId metadata`
-    };
-  return void 0;
-}
-function conflictingMetadataNumber(proposal, admission, key) {
-  const proposalValue = numberMetadata(proposal.metadata, key);
-  const admissionValue = numberMetadata(admission.metadata, key);
-  if (proposalValue === void 0 || admissionValue === void 0 || proposalValue === admissionValue)
-    return void 0;
-  return { proposalValue, admissionValue };
-}
-function conflictingMetadataString(proposal, admission, key) {
-  const proposalValue = stringMetadata(proposal.metadata, key);
-  const admissionValue = stringMetadata(admission.metadata, key);
-  if (proposalValue === void 0 || admissionValue === void 0 || proposalValue === admissionValue)
-    return void 0;
-  return { proposalValue, admissionValue };
-}
-function staleRevision(proposal, admission, workItem) {
-  const authoringRevision = numberMetadata(admission.metadata, "authoringRevision") ?? numberMetadata(proposal.metadata, "authoringRevision");
-  if (authoringRevision !== void 0 && authoringRevision !== workItem.authoringRevision)
-    return {
-      kind: "stale-revision",
-      expected: authoringRevision,
-      current: workItem.authoringRevision
-    };
-  const executionInputRevision = numberMetadata(admission.metadata, "executionInputRevision") ?? numberMetadata(proposal.metadata, "executionInputRevision");
-  if (executionInputRevision !== void 0 && executionInputRevision !== workItem.executionInputRevision)
-    return {
-      kind: "stale-execution-input",
-      expected: executionInputRevision,
-      current: workItem.executionInputRevision
-    };
-  return void 0;
 }
-function applyPolicyMessage(code, proposal, admission) {
+function capabilityGuardPolicyMessage(code, proposal) {
   if (code === "missing-policy")
-    return `Admitted action '${admission.admissionId}' requires an explicit apply policy`;
-  if (code === "unknown-work-item-domain-action-apply-policy")
-    return `Admitted action '${admission.admissionId}' references a missing apply policy`;
-  return `Admitted action '${proposal.proposalId}' matches multiple apply policies`;
-}
-function emitApplication(ctx, state, admission, proposal, applicationState, facts, opts = {}) {
-  const producedFactIds = facts.map((fact) => fact.eventId);
-  const application = {
-    kind: "work-item-domain-action-application",
-    applicationId: `${admission.admissionId}:application`,
-    admissionId: admission.admissionId,
-    proposalId: proposal.proposalId,
-    workItemId: proposal.workItemId,
-    actionKind: proposal.actionKind,
-    state: applicationState,
-    producedFactIds,
-    reason: admission.reason ?? proposal.reason,
-    sourceRefs: admissionRefs(admission, proposal),
-    metadata: { policyId: opts.policyId, code: opts.code }
-  };
-  emitApplicationFact(ctx, "application", application);
-  emitApplicationStatus(ctx, state, {
-    state: applicationState,
-    code: opts.code,
-    message: opts.message,
-    workItemId: proposal.workItemId,
-    proposalId: proposal.proposalId,
-    admissionId: admission.admissionId,
-    actionKind: proposal.actionKind,
-    sourceRefs: application.sourceRefs,
-    metadata: { producedFactIds, policyId: opts.policyId }
-  });
-}
-function emitApplicationIssue(ctx, state, key, code, message, workItemId, sourceRefs2, metadata) {
-  if (state.issueKeys.has(key)) return;
-  state.issueKeys.add(key);
-  const item = dataIssue(code, message, { subjectId: workItemId, refs: sourceRefs2, metadata });
-  emitApplicationFact(ctx, "issue", item);
-  emitApplicationStatus(ctx, state, {
-    state: code === "missing-policy" ? "missing-policy" : "rejected",
-    code,
-    message,
-    workItemId,
-    sourceRefs: sourceRefs2,
-    metadata
-  });
+    return `WorkItem domain action '${proposal.proposalId}' has no capability guard policy`;
+  if (code === "unknown-work-item-domain-action-capability-guard-policy")
+    return `WorkItem domain action '${proposal.proposalId}' references a missing capability guard policy`;
+  return `WorkItem domain action '${proposal.proposalId}' matches multiple capability guard policies`;
 }
-function emitIntakeStatus(ctx, state, status) {
-  state.statusSeq += 1;
-  const statusFact = {
-    kind: "work-item-domain-action-status",
-    statusId: `work-item-domain-action-intake-status:${state.statusSeq}`,
-    ...status
-  };
-  emitIntake(ctx, "status", statusFact);
-  emitIntakeAudit(ctx, state, "work-item-domain-action-intake-status", statusFact);
+function capabilityGuardRefs(proposal, policy, admissions = []) {
+  return uniqueSourceRefs2([
+    ref2("work-item", proposal.workItemId),
+    ref2("work-item-domain-action-proposal", proposal.proposalId),
+    ref2("work-item-domain-action-capability-guard-policy", policy.policyId),
+    ...admissions.filter((admission) => admission !== void 0).flatMap((admission) => [
+      ref2("capability-admission", admission.admissionId),
+      ref2("capability-admission-proposal", admission.proposalId),
+      ref2("boundary-capability", capabilityBoundaryRefId(admission.capability)),
+      ...admission.sourceRefs ?? []
+    ]),
+    ...proposal.sourceRefs ?? []
+  ]);
 }
-function emitApplicationStatus(ctx, state, status) {
+function capabilityBoundaryRefId(capability) {
+  return `${capability.kind}:${capability.id}`;
+}
+function emitCapabilityGuardStatus(ctx, state, status) {
   state.statusSeq += 1;
   const statusFact = {
-    kind: "work-item-domain-action-status",
-    statusId: `work-item-domain-action-application-status:${state.statusSeq}`,
+    kind: "work-item-domain-action-capability-guard-status",
+    statusId: `work-item-domain-action-capability-guard-status:${state.statusSeq}`,
     ...status
   };
-  emitApplicationFact(ctx, "status", statusFact);
-  emitApplicationAudit(ctx, state, "work-item-domain-action-application-status", statusFact);
-}
-function emitIntakeAudit(ctx, state, kind, status) {
-  state.auditSeq += 1;
-  emitIntake(ctx, "audit", auditRecord(kind, state.auditSeq, status));
-}
-function emitApplicationAudit(ctx, state, kind, status) {
+  emitCapabilityGuard(ctx, "status", statusFact);
   state.auditSeq += 1;
-  emitApplicationFact(ctx, "audit", auditRecord(kind, state.auditSeq, status));
-}
-function auditRecord(kind, seq, status) {
-  return {
-    id: `${kind}:${seq}`,
-    kind,
+  emitCapabilityGuard(ctx, "audit", {
+    id: `work-item-domain-action-capability-guard-status:${state.auditSeq}`,
+    kind: "work-item-domain-action-capability-guard-status",
     subjectId: status.workItemId,
     message: status.message,
-    issueCode: status.code,
     sourceRefs: status.sourceRefs,
     metadata: {
-      statusId: status.statusId,
+      statusId: statusFact.statusId,
       state: status.state,
       proposalId: status.proposalId,
-      admissionId: status.admissionId,
-      actionKind: status.actionKind,
+      policyId: status.policyId,
       ...status.metadata ?? {}
     }
-  };
+  });
 }
-function emitIntake(ctx, kind, value) {
-  ctx.down([["DATA", { kind, value }]]);
+function emitCapabilityGuardStatusOnce(ctx, state, key, status) {
+  if (state.emittedStatusKeys.has(key)) return;
+  state.emittedStatusKeys.add(key);
+  emitCapabilityGuardStatus(ctx, state, status);
 }
-function emitApplicationFact(ctx, kind, value) {
+function emitCapabilityGuardIssue(ctx, state, key, issue) {
+  if (state.issueKeys.has(key)) return;
+  state.issueKeys.add(key);
+  emitCapabilityGuard(ctx, "issue", issue);
+  emitCapabilityGuardStatus(ctx, state, {
+    state: "issue",
+    workItemId: issue.subjectId,
+    issues: [issue],
+    message: issue.message,
+    metadata: { issueCode: issue.code }
+  });
+}
+function emitCapabilityGuard(ctx, kind, value) {
   ctx.down([["DATA", { kind, value }]]);
 }
-function project(graph, runtime, name, factory, select) {
-  return graph.node(
-    [runtime],
+
+// src/solutions/work-item/actions-intake.ts
+function workItemDomainActionProposalIntakeProjector(graph, opts) {
+  const name = opts.name ?? "workItemDomainActionIntake";
+  const now = opts.now ?? Date.now;
+  const runtime = graph.node(
+    [opts.proposals],
     (ctx) => {
-      for (const raw of depBatch(ctx, 0) ?? []) {
-        const selected = select(raw);
-        if (selected !== void 0) ctx.down([["DATA", selected]]);
-      }
+      const state = ctx.state.get() ?? {
+        proposals: /* @__PURE__ */ new Set(),
+        statusSeq: 0,
+        auditSeq: 0
+      };
+      for (const raw of depBatch(ctx, 0) ?? []) reduceProposalIntake(ctx, state, raw, now());
+      ctx.state.set(state);
     },
-    { name, factory, partial: true, completeWhenDepsComplete: false, errorWhenDepsError: false }
+    {
+      name: `${name}/runtime`,
+      factory: "workItemDomainActionProposalIntakeProjector",
+      partial: true,
+      completeWhenDepsComplete: false,
+      errorWhenDepsError: false
+    }
   );
-}
-function firstDuplicateFactId(state, facts) {
-  const pending = /* @__PURE__ */ new Set();
-  for (const fact of facts) {
-    if (state.emittedFactIds.has(fact.eventId) || pending.has(fact.eventId)) return fact.eventId;
-    pending.add(fact.eventId);
-  }
-  return void 0;
-}
-function claimFactId(state, factId) {
-  if (state.emittedFactIds.has(factId)) return false;
-  state.emittedFactIds.add(factId);
-  return true;
-}
-function admissionRefs(admission, proposal, policy) {
-  return uniqueSourceRefs([
-    ref("work-item-domain-action-admission", admission.admissionId),
-    ref("work-item-domain-action-proposal", admission.proposalId),
-    ...proposal === void 0 ? [] : [
-      ref("work-item", proposal.workItemId),
-      ref("work-item-evidence", proposal.evidenceId),
-      ...proposal.sourceRefs ?? []
-    ],
-    ...policy === void 0 ? [] : [ref("work-item-domain-action-apply-policy", policy.policyId)],
-    ...admission.sourceRefs ?? []
-  ]);
-}
-function actionSourceRefs(admission, proposal, policy) {
-  return admissionRefs(admission, proposal, policy);
-}
-function dataIssue(code, message, opts = {}) {
   return {
-    kind: "issue",
-    code,
-    message,
-    severity: "error",
-    source: "work-item-actions",
-    subjectId: opts.subjectId,
-    refs: opts.refs?.map((sourceRef) => `${sourceRef.kind}:${sourceRef.id}`),
-    metadata: opts.metadata
+    proposals: project(
+      graph,
+      runtime,
+      `${name}/proposals`,
+      "workItemDomainActionProposals",
+      (fact) => fact.kind === "proposal" ? fact.value : void 0
+    ),
+    status: project(
+      graph,
+      runtime,
+      `${name}/status`,
+      "workItemDomainActionStatus",
+      (fact) => fact.kind === "status" ? fact.value : void 0
+    ),
+    issues: project(
+      graph,
+      runtime,
+      `${name}/issues`,
+      "workItemDomainActionIssues",
+      (fact) => fact.kind === "issue" ? fact.value : void 0
+    ),
+    audit: project(
+      graph,
+      runtime,
+      `${name}/audit`,
+      "workItemDomainActionAudit",
+      (fact) => fact.kind === "audit" ? fact.value : void 0
+    )
   };
 }
-function uniqueSourceRefs(sourceRefs2) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const sourceRef of sourceRefs2) {
-    const key = `${sourceRef.kind}:${sourceRef.id}:${JSON.stringify(sourceRef.metadata ?? {})}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
-    out.push(sourceRef);
+function reduceProposalIntake(ctx, state, input, proposedAtMs) {
+  const proposal = normalizeProposal(input, proposedAtMs);
+  if (typeof proposal === "string") {
+    const issue = dataIssue2("malformed-domain-action-proposal", proposal);
+    emitIntake(ctx, "issue", issue);
+    emitIntakeStatus(ctx, state, {
+      state: "rejected",
+      code: issue.code,
+      message: issue.message
+    });
+    return;
   }
-  return out;
+  if (state.proposals.has(proposal.proposalId)) {
+    emitIntakeStatus(ctx, state, {
+      state: "duplicate",
+      code: "duplicate-suppressed",
+      workItemId: proposal.workItemId,
+      proposalId: proposal.proposalId,
+      actionKind: proposal.actionKind,
+      message: `Duplicate WorkItem domain action proposal '${proposal.proposalId}' suppressed`
+    });
+    return;
+  }
+  state.proposals.add(proposal.proposalId);
+  emitIntake(ctx, "proposal", proposal);
+  emitIntakeStatus(ctx, state, {
+    state: "proposed",
+    workItemId: proposal.workItemId,
+    proposalId: proposal.proposalId,
+    actionKind: proposal.actionKind,
+    sourceRefs: proposal.sourceRefs
+  });
 }
-function sourceRefs(value) {
-  if (!Array.isArray(value)) return void 0;
-  return value.filter(
-    (item) => isRecord(item) && typeof item.kind === "string" && typeof item.id === "string"
+function normalizeProposal(input, proposedAtMs) {
+  if (!isRecord(input)) return "WorkItemDomainActionProposal intake must be an object";
+  if (input.kind !== "work-item-domain-action-proposal" && input.kind !== "work-item-domain-action-proposal-intake")
+    return "WorkItemDomainActionProposal intake has unsupported kind";
+  if (typeof input.proposalId !== "string" || input.proposalId.trim() === "")
+    return "WorkItemDomainActionProposal.proposalId is required";
+  if (typeof input.workItemId !== "string" || input.workItemId.trim() === "")
+    return "WorkItemDomainActionProposal.workItemId is required";
+  if (typeof input.actionKind !== "string" || input.actionKind.trim() === "")
+    return "WorkItemDomainActionProposal.actionKind is required";
+  if (input.kind === "work-item-domain-action-proposal") {
+    if (typeof input.effectRunId !== "string")
+      return "WorkItemDomainActionProposal.effectRunId is required";
+    if (typeof input.effectRunResultId !== "string")
+      return "WorkItemDomainActionProposal.effectRunResultId is required";
+    if (typeof input.evidenceId !== "string")
+      return "WorkItemDomainActionProposal.evidenceId is required";
+    if (typeof input.policyId !== "string")
+      return "WorkItemDomainActionProposal.policyId is required";
+    return input;
+  }
+  return workItemDomainActionProposal(
+    input.proposalId,
+    input.workItemId,
+    input.actionKind,
+    {
+      payload: input.payload,
+      reason: typeof input.reason === "string" ? input.reason : void 0,
+      policyId: typeof input.policyId === "string" ? input.policyId : void 0,
+      effectRunId: typeof input.effectRunId === "string" ? input.effectRunId : void 0,
+      effectRunResultId: typeof input.effectRunResultId === "string" ? input.effectRunResultId : void 0,
+      evidenceId: typeof input.evidenceId === "string" ? input.evidenceId : void 0,
+      proposedAtMs: typeof input.proposedAtMs === "number" ? input.proposedAtMs : proposedAtMs,
+      sourceRefs: sourceRefs(input.sourceRefs),
+      metadata: isRecord(input.metadata) ? input.metadata : void 0
+    }
   );
 }
-function numberMetadata(metadata, key) {
-  const value = metadata?.[key];
-  return typeof value === "number" ? value : void 0;
-}
-function stringMetadata(metadata, key) {
-  const value = metadata?.[key];
-  return typeof value === "string" ? value : void 0;
-}
-function ref(kind, id) {
-  return { kind, id };
+function emitIntakeStatus(ctx, state, status) {
+  state.statusSeq += 1;
+  const statusFact = {
+    kind: "work-item-domain-action-status",
+    statusId: `work-item-domain-action-intake-status:${state.statusSeq}`,
+    ...status
+  };
+  emitIntake(ctx, "status", statusFact);
+  emitIntakeAudit(ctx, state, "work-item-domain-action-intake-status", statusFact);
 }
-function recordString(value, key) {
-  return isRecord(value) && typeof value[key] === "string" ? value[key] : void 0;
+function emitIntakeAudit(ctx, state, kind, status) {
+  state.auditSeq += 1;
+  emitIntake(ctx, "audit", auditRecord(kind, state.auditSeq, status));
 }
-function isRecord(value) {
-  return value !== null && typeof value === "object";
+function emitIntake(ctx, kind, value) {
+  ctx.down([["DATA", { kind, value }]]);
 }
 export {
   workItemDomainActionAdmissionProjector,