@holmes-lab/holmes-kit 0.19.6 → 0.20.1

package/dist/holmes/mcp/handlers.js

@@ -38,7 +38,16 @@ exports.isHandlerRefusal = isHandlerRefusal;
 exports.unreadableAmong = unreadableAmong;
 exports.makeHandlers = makeHandlers;
 exports.collectDecisions = collectDecisions;
-// @implements A-SPEC-599
+// @implements A-SPEC-629, A-SPEC-628, A-SPEC-599, A-SPEC-603, A-SPEC-604, A-SPEC-605, A-SPEC-606, A-SPEC-607, A-SPEC-608, A-SPEC-609, A-SPEC-610, A-SPEC-611, A-SPEC-612, A-SPEC-613, A-SPEC-614, A-SPEC-615, A-SPEC-616, A-SPEC-617, A-SPEC-618, A-SPEC-621, A-SPEC-622, A-SPEC-624, A-SPEC-625, A-SPEC-627
+// @implements A-SPEC-643
+// @implements A-SPEC-642
+// @implements A-SPEC-642
+// @implements A-SPEC-632
+const entity_integration_1 = require("./handlers/entity-integration");
+const entity_renumber_1 = require("./handlers/entity-renumber");
+const entity_store_1 = require("./handlers/entity-store");
+const execution_context_1 = require("../project/execution-context");
+const workspace_identity_1 = require("../project/workspace-identity");
 // @implements A-SPEC-293
 // @implements A-SPEC-292
 // @implements A-SPEC-290
@@ -47,46 +56,34 @@ exports.collectDecisions = collectDecisions;
 // @implements A-SPEC-269
 // @implements A-SPEC-267
 // @implements A-SPEC-573.4 — shared with the benchmark so the two cannot drift.
-const defuse_bound_1 = require("./defuse-bound");
 const fs = __importStar(require("node:fs"));
 const http = __importStar(require("node:http"));
-const assoc_arm_1 = require("../assoc/assoc-arm");
-// @implements A-SPEC-478 — the semantic tier runtime, resolved HERE (the async edge) and injected
-// into the sync analysis; the replay harness injects nothing, keeping every pin untouched.
-const tier_1 = require("../semantic/tier");
-const vector_cache_1 = require("../semantic/vector-cache");
-const embedder_1 = require("../semantic/embedder");
-// @implements A-SPEC-496 — policy parity: the direct localization path reranks with the exact
-// A-SPEC-478 math, extracted pure.
-const hit_rerank_1 = require("../semantic/hit-rerank");
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const crypto = __importStar(require("node:crypto"));
-// @implements A-SPEC-378
-const temporal_prior_1 = require("../review/temporal-prior");
-// @implements A-SPEC-388
-const commit_text_1 = require("../review/commit-text");
-const node_child_process_1 = require("node:child_process");
-const spec_parser_1 = require("../spec/spec-parser");
-const validator_1 = require("../spec/validator");
-const rtm_check_1 = require("../rtm/rtm-check");
 const test_scope_1 = require("../rtm/test-scope");
-const gap_analyzer_1 = require("../rtm/gap-analyzer");
-const test_runner_1 = require("../review/test-runner");
-const kills_1 = require("../spec/kills");
-const mutate_1 = require("../review/mutate");
-const test_evidence_1 = require("../review/test-evidence");
-const test_outcomes_1 = require("../review/test-outcomes");
-const localize_1 = require("../rtm/localize");
-const maintenance_analyze_1 = require("./maintenance-analyze");
-const maintenance_evidence_1 = require("./maintenance-evidence");
-const impact_gate_1 = require("../guardrail/impact-gate");
-const phase_1 = require("../guardrail/phase");
-const spec_types_1 = require("../spec/spec-types");
-const legacy_format_1 = require("../spec/legacy-format");
+const maintenance_evidence_1 = require("./handlers/maintenance-evidence");
+const spec_queries_1 = require("./handlers/spec-queries");
+const spec_authoring_1 = require("./handlers/spec-authoring");
+const spec_lifecycle_1 = require("./handlers/spec-lifecycle");
+const spec_approval_1 = require("./handlers/spec-approval");
+const workspace_identity_2 = require("./handlers/workspace-identity");
+const operator_inspection_1 = require("./handlers/operator-inspection");
+const phase_queries_1 = require("./handlers/phase-queries");
+const risk_assessment_1 = require("./handlers/risk-assessment");
+const adoption_1 = require("./handlers/adoption");
+const slice_orchestration_1 = require("./handlers/slice-orchestration");
+const workspace_queries_1 = require("./handlers/workspace-queries");
+const test_execution_1 = require("./handlers/test-execution");
+const review_evidence_1 = require("./handlers/review-evidence");
+const review_queries_1 = require("./handlers/review-queries");
+const graph_operations_1 = require("./handlers/graph-operations");
+// @implements A-SPEC-632 — the rebuild paths discharge shares with reindex.
+const graph_operations_2 = require("./handlers/graph-operations");
+const maintenance_analysis_1 = require("./handlers/maintenance-analysis");
+const taint_screening_1 = require("./handlers/taint-screening");
 const cpg_scanner_1 = require("../cpg/cpg-scanner");
 const scan_cache_1 = require("../cpg/scan-cache");
-const root_1 = require("../project/root");
 // N7: every whole-tree scan goes through the file-key incremental cache under the PROJECT root's
 // .ax/cpg_cache — unchanged files (content-hash hit) skip the tree-sitter parse entirely.
 // The cache lives under the RESOLVED project root, not the raw scan root: scanning a SUBDIRECTORY
@@ -98,73 +95,14 @@ const root_1 = require("../project/root");
 // under that tree stopped at the minted marker. This is the harm §8 closed for `review_record`,
 // left open on the scan path. When the store is bound, the cache is the bound project's; otherwise
 // only an anchored answer may be written to, and an unanchored one falls back to a temp cache.
-// @implements A-SPEC-534.8
-// The governed source file a `kills` mutation targets: one that @implements the A-SPEC AND contains
-// the `where` literal. Bounded walk, skips vendored/test/hidden dirs. null when none qualifies.
-function sourceFileWithMutation(root, aspecId, where) {
-    if (!where)
-        return null;
-    const SOURCE = /\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs|py|go|rs|java|kt|cs|rb|php|swift)$/;
-    let found = null;
-    const walk = (d) => {
-        if (found)
-            return;
-        let entries;
-        try {
-            entries = fs.readdirSync(d, { withFileTypes: true });
-        }
-        catch {
-            return;
-        }
-        for (const e of entries) {
-            if (found)
-                return;
-            if (e.name === 'node_modules' || e.name === 'dist' || e.name === 'reference'
-                || e.name === 'vendor' || e.name === 'third_party' || e.name.startsWith('.'))
-                continue;
-            const p = path.join(d, e.name);
-            if (e.isDirectory()) {
-                walk(p);
-                continue;
-            }
-            if (!SOURCE.test(e.name) || /\.test\./.test(e.name))
-                continue;
-            let text;
-            try {
-                text = fs.readFileSync(p, 'utf8');
-            }
-            catch {
-                continue;
-            }
-            if (text.includes(`@implements ${aspecId}`) && text.includes(where)) {
-                found = p;
-                return;
-            }
-        }
-    };
-    walk(root);
-    return found;
-}
 const cacheDirFor = (root) => {
-    const r = (0, root_2.resolveProjectRoot)(root);
+    const r = (0, root_1.resolveProjectRoot)(root);
     if (r.marker !== 'given')
         return path.join(r.root, '.ax', 'cpg_cache');
     if (fs.existsSync(path.join(r.root, '.ax')))
         return path.join(r.root, '.ax', 'cpg_cache');
     return path.join(os.tmpdir(), `holmes-cpg-cache-${crypto.createHash('sha256').update(r.root).digest('hex').slice(0, 16)}`);
 };
-// @implements A-SPEC-283 — bumped whenever the graph's node/edge shape changes, so a store written
-// by an older build is rebuilt rather than read with new assumptions.
-// @implements A-SPEC-568.1 — /3: nodes gained the intent `summary` column.
-const RTM_GRAPH_SCHEMA = 'rtm-graph/3';
-// @implements A-SPEC-569.3 — how many impacted specs get their intent sentence attached. A prose
-// constant, never a verdict input: the impacted list itself is never truncated.
-const SUMMARY_CAP = 40;
-// @implements A-SPEC-569.1 (revision) — /2: pre-fix 0.16.0 builds could persist forged structural
-// characters in the summary column, and every other basis field would still match after upgrading.
-// A-SPEC-283's own rule applies to us too: an older build's artifact is rebuilt, never read with
-// new assumptions.
-const RTM_EXTRACTOR_VERSION = 'holmes-rtm/2';
 const cachedScan = (root, repoRoot = root) => new cpg_scanner_1.CpgScanner(undefined, new scan_cache_1.ScanFileCache(cacheDirFor(root))).scan(root, repoRoot);
 // @implements A-SPEC-131
 // Same scan, with the skip report kept: the callers that make honesty claims (cpg_scan's surface,
@@ -174,45 +112,14 @@ const cachedScanWithReport = (root, repoRoot = root) => {
     const scanned = scanner.scan(root, repoRoot);
     return { scanned, skipped: scanner.scanSkipped() };
 };
-const rtm_builder_1 = require("../rtm/rtm-builder");
-const rtm_graph_1 = require("../rtm/rtm-graph");
-const taint_1 = require("../rtm/taint");
-const incremental_1 = require("../rtm/incremental");
-const graph_store_1 = require("../rtm/graph-store");
-const hash_cache_1 = require("../cpg/hash-cache");
-const bundler_1 = require("../context/bundler");
-const scope_1 = require("../review/scope");
-const review_targets_1 = require("../review/review-targets");
-const coverage_1 = require("../review/coverage");
 const basis_1 = require("./basis");
 const write_target_1 = require("../guardrail/write-target");
 const spec_store_1 = require("../spec/spec-store");
-const yaml_scalar_1 = require("../spec/yaml-scalar");
-const findings_1 = require("../review/findings");
-const package_1 = require("../review/package");
-const risk_classifier_1 = require("../guardrail/risk-classifier");
 const risk_gate_1 = require("../guardrail/risk-gate");
 const elicit_approval_1 = require("./elicit-approval");
-const autonomy_1 = require("../governance/autonomy");
-const anchor_comment_1 = require("../rtm/anchor-comment");
-const consistency_lints_1 = require("../cpg/consistency-lints");
 const approval_queue_1 = require("../governance/approval-queue");
 const approval_grants_1 = require("../governance/approval-grants");
-const spec_digest_1 = require("../spec/spec-digest");
-const spec_store_2 = require("../spec/spec-store");
-const breaking_change_1 = require("../spec/breaking-change");
-const compat_impact_1 = require("../spec/compat-impact");
-const approval_blockers_1 = require("../spec/approval-blockers");
-const approval_status_1 = require("../spec/approval-status");
-const ledger_timeline_1 = require("../governance/ledger-timeline");
-const version_conflict_1 = require("../spec/version-conflict");
 const ledger_store_1 = require("../governance/ledger-store");
-const provenance_chain_1 = require("../governance/provenance-chain");
-// @implements A-SPEC-574.3 — the caller owns the store and hands the chain the question.
-const ledger_store_2 = require("../governance/ledger-store");
-const ledger_lock_1 = require("../governance/ledger-lock");
-const decision_ledger_1 = require("../guardrail/decision-ledger");
-const cspec_change_1 = require("../guardrail/cspec-change");
 /**
  * @implements A-SPEC-189 §7 (round 10)
  * A DELIBERATE refusal, distinguished by construction rather than by class.
@@ -249,17 +156,11 @@ function isHandlerRefusal(e) {
     return !!e && typeof e === 'object' && e.holmesRefusal === true;
 }
 // @implements A-SPEC-128
-const root_2 = require("../project/root");
+const root_1 = require("../project/root");
 const change_source_1 = require("../project/change-source");
-const baseline_1 = require("../project/baseline");
 const ignore_1 = require("../project/ignore");
 // @implements A-SPEC-126
-const scan_1 = require("../reverse/scan");
-const draft_1 = require("../reverse/draft");
-const renumber_1 = require("../spec/renumber");
 const adr_refs_1 = require("../spec/adr-refs");
-const spec_id_guard_1 = require("./spec-id-guard");
-const anchor_1 = require("../reverse/anchor");
 // @implements A-SPEC-128
 // Where a project begins, for tools that only walk the tree.
 //
@@ -294,6 +195,15 @@ function resolveHandlerApproval(rootArg, store, envApproval, action, now) {
     if (root === undefined) {
         return (0, risk_gate_1.approvalCovers)(envApproval, action, now) ? { approval: envApproval, source: 'env' } : undefined;
     }
+    // @implements A-SPEC-642 — no channel is consulted while the merged ledger holds an unreconciled
+    // cross-replica double-spend: the authority channel itself is what is in question, so every act
+    // that would spend authority (seal, unseal, retire, review resolution, entity apply/recover/abandon)
+    // refuses with the nonce and the reconciliation act. The reconciliation act is the one exit.
+    if (action.kind !== 'ledger-reconcile') {
+        const conflict = (0, ledger_store_1.ledgerConflictReason)(path.join(root, '.ax', 'ledger'));
+        if (conflict)
+            throw new ledger_store_1.LedgerConflictRefusal(conflict);
+    }
     const r = (0, approval_grants_1.resolveApproval)(root, envApproval, action, now);
     return r ? { ...r, root } : undefined;
 }
@@ -312,7 +222,7 @@ function refusalQueueHint(rootArg, store, req) {
     }
 }
 function projectRootOf(root) {
-    return (0, root_2.resolveProjectRoot)(root).root;
+    return (0, root_1.resolveProjectRoot)(root).root;
 }
 // @implements A-SPEC-191 §10 — WHERE a single-use approval is spent must not be a caller's choice.
 // r8 measured all three escapes at once: a second `root`, a `root` naming a subdirectory, and an
@@ -378,7 +288,7 @@ function specStoreBlindReason(store, root, loaded) {
     // Compared through realpath: on macOS a temp root is `/var/...` while the same directory resolves
     // to `/private/var/...`, and a plain string compare calls the correctly-bound store foreign.
     const real = (p) => { try {
-        return (0, root_2.canonicalPath)(p);
+        return (0, root_1.canonicalPath)(p);
     }
     catch {
         return path.resolve(p);
@@ -416,7 +326,9 @@ function assertSpecStoreReachable(tool, store, root) {
     // The tool name is NOT prefixed here: the raw-handler wrapper already prefixes it, and doing it
     // twice produced `spec_list: spec_list: ...` in the installed server (seen in the probe).
     void tool;
-    throw new HandlerRefusal(`이 서버가 바인딩된 스펙 디렉터리 ${store.specsRoot} 가 존재하지 않습니다 —`
+    // @implements A-SPEC-652.2 — the ABSOLUTE path, so the operator can see which directory was tried
+    // (a relative `.ax/specs` in this message told nobody where the server had looked, 2026-09-14).
+    throw new HandlerRefusal(`이 서버가 바인딩된 스펙 디렉터리 ${path.resolve(store.specsRoot)} 가 존재하지 않습니다 —`
         + ` 요청한 root ${root} 에는 스펙 저장소가 있습니다. 빈 답을 돌려주면 '스펙이 없다'로 읽히므로`
         + ' 거부합니다. 서버를 프로젝트 루트에서 시작하거나 HOLMES_SPECS 로 스펙 경로를 지정하십시오.');
 }
@@ -448,13 +360,13 @@ function boundNonceLedger(store) {
         // `--specs-dir docs/specs` an ordinary review_record could still plant `docs/specs/.ax` and move
         // every consumed nonce, every audit line, and spec_approve's notion of "this project" with it.
         const storeReal = (() => { try {
-            return (0, root_2.canonicalPath)(store.specsRoot);
+            return (0, root_1.canonicalPath)(store.specsRoot);
         }
         catch {
             return store.specsRoot;
         } })();
         const derivedReal = (() => { try {
-            return (0, root_2.canonicalPath)(derived);
+            return (0, root_1.canonicalPath)(derived);
         }
         catch {
             return derived;
@@ -463,7 +375,9 @@ function boundNonceLedger(store) {
             return null;
         if (!fs.existsSync(path.join(derived, '.ax')))
             return null;
-        return path.join(derived, '.ax', 'ledger', 'provenance.jsonl');
+        // @implements A-SPEC-643 — the writer's replica chain, not the legacy single file: two machines
+        // consuming into `provenance.jsonl` cannot converge through Git (measured: CONFLICT add/add).
+        return (0, ledger_store_1.writerChainFile)(path.join(derived, '.ax', 'ledger'));
     }
     catch {
         return null;
@@ -487,13 +401,13 @@ function boundFindingsLedger(store, root) {
     try {
         const derived = projectRootOf(store.specsRoot);
         const storeReal = (() => { try {
-            return (0, root_2.canonicalPath)(store.specsRoot);
+            return (0, root_1.canonicalPath)(store.specsRoot);
         }
         catch {
             return store.specsRoot;
         } })();
         const derivedReal = (() => { try {
-            return (0, root_2.canonicalPath)(derived);
+            return (0, root_1.canonicalPath)(derived);
         }
         catch {
             return derived;
@@ -552,6 +466,10 @@ function buildContentSource(specs, scanned) {
 // the review/graph. `toolName` is passed through to assertRepoTopLevel so
 // the thrown error names the actual caller.
 async function deriveChangedContext(store, rootArg, a, toolName) {
+    // @implements A-SPEC-614 — bind specs and source before discovering changes or writing evidence.
+    const foreign = foreignRootReason(store, rootArg);
+    if (foreign)
+        throw new HandlerRefusal(foreign);
     const root = projectRootOf(rootArg);
     const source = makeChangeSource(root, a);
     const resolved = source.changes();
@@ -613,8 +531,21 @@ function unreadableAmong(listed, created) {
 function makeHandlers(store, opts) {
     const raw = makeRawHandlers(store, opts);
     const wrapped = {};
+    const run = (0, execution_context_1.createExecutionScope)(store instanceof spec_store_1.LocalMarkdownRepository ? store.specsRoot : undefined, opts?.observeInvocation);
     for (const [name, fn] of Object.entries(raw)) {
-        wrapped[name] = (0, basis_1.withBasis)(fn, (a) => basisFor(a?.root));
+        const scoped = name === 'workspace_identity' ? fn : async (a) => {
+            try {
+                return await run(a?.root, () => fn(a));
+            }
+            catch (e) {
+                if (e instanceof workspace_identity_1.WorkspaceIdentityError)
+                    return { ok: false, code: e.code, reason: e.message };
+                if (e instanceof ledger_store_1.LedgerConflictRefusal)
+                    return { ok: false, code: e.code, reason: e.message }; // A-SPEC-642
+                throw e;
+            }
+        };
+        wrapped[name] = (0, basis_1.withBasis)(scoped, (a) => basisFor(a?.root));
     }
     wrapped.basis_detail = async (a) => {
         const b = basisFor(a?.root, true);
@@ -744,7 +675,69 @@ function collectDecisions(root, scanned, specs) {
     return { decisions, citations };
 }
 function makeRawHandlers(store, opts) {
+    // @implements A-SPEC-100.2, A-SPEC-102.1, A-SPEC-111.1, A-SPEC-121.2, A-SPEC-121.3, A-SPEC-121.4, A-SPEC-128, A-SPEC-130, A-SPEC-131, A-SPEC-189, A-SPEC-233, A-SPEC-419, A-SPEC-433, A-SPEC-614
+    // @implements A-SPEC-616, A-SPEC-100.2, A-SPEC-102.1, A-SPEC-121.2, A-SPEC-121.3, A-SPEC-128, A-SPEC-130, A-SPEC-189, A-SPEC-233, A-SPEC-419, A-SPEC-433, A-SPEC-534.5, A-SPEC-534.8, A-SPEC-578.4, A-SPEC-614
+    const testExecution = (0, test_execution_1.createTestExecutionHandlers)({
+        defaultBaseline: DEFAULT_BASELINE,
+        deriveChangedContext: (root, args, tool) => deriveChangedContext(store, root, args, tool),
+    });
+    const reviewQueries = (0, review_queries_1.createReviewQueryHandlers)({
+        listSpecs: () => store.list(),
+        assertStoreReachable: (tool, root) => assertSpecStoreReachable(tool, store, root),
+        foreignRootReason: root => foreignRootReason(store, root),
+        refusal: reason => new HandlerRefusal(reason),
+        projectRootOf,
+        cachedScan,
+        buildContentSource,
+        deriveChangedContext: (root, args, tool) => deriveChangedContext(store, root, args, tool),
+    });
+    // @implements A-SPEC-100.2, A-SPEC-121.2, A-SPEC-128, A-SPEC-139, A-SPEC-189, A-SPEC-280, A-SPEC-282, A-SPEC-283, A-SPEC-419, A-SPEC-433, A-SPEC-469, A-SPEC-478, A-SPEC-568.1, A-SPEC-568.2, A-SPEC-569.1, A-SPEC-569.2, A-SPEC-569.3, A-SPEC-589
+    const graphOperations = (0, graph_operations_1.createGraphOperationsHandlers)({
+        listSpecs: () => store.list(),
+        assertStoreReachable: (tool, root) => assertSpecStoreReachable(tool, store, root),
+        foreignRootReason: root => foreignRootReason(store, root),
+        refusal: reason => new HandlerRefusal(reason),
+        projectRootOf,
+        cachedScan,
+        cacheDirFor,
+        deriveChangedContext: (root, args, tool) => deriveChangedContext(store, root, args, tool),
+    });
+    // @implements A-SPEC-100.2, A-SPEC-128, A-SPEC-189, A-SPEC-267, A-SPEC-268, A-SPEC-269, A-SPEC-277, A-SPEC-283, A-SPEC-290, A-SPEC-292, A-SPEC-293, A-SPEC-378, A-SPEC-388, A-SPEC-418, A-SPEC-478, A-SPEC-571.2, A-SPEC-573.4, A-SPEC-578.5
+    const maintenanceAnalysis = (0, maintenance_analysis_1.createMaintenanceAnalysisHandlers)({
+        listSpecs: () => store.list(),
+        foreignRootReason: root => foreignRootReason(store, root),
+        refusal: reason => new HandlerRefusal(reason),
+        projectRootOf,
+        basisFor,
+        collectDecisions,
+        buildContentSource,
+        specStoreBlindReason: (root, count) => specStoreBlindReason(store, root, count),
+        fileDigestOf,
+    });
     const resolver = (specs) => (id) => specs.find((s) => s.id === id) ?? null;
+    // @implements A-SPEC-100.2, A-SPEC-128, A-SPEC-138, A-SPEC-140.2, A-SPEC-189, A-SPEC-461, A-SPEC-512.2, A-SPEC-513.1, A-SPEC-524.1
+    const taintScreening = (0, taint_screening_1.createTaintScreeningHandlers)({
+        listSpecs: () => store.list(),
+        foreignRootReason: root => foreignRootReason(store, root),
+        projectRootOf,
+        cachedScan,
+    });
+    // @implements A-SPEC-121.2, A-SPEC-128, A-SPEC-131, A-SPEC-146, A-SPEC-189, A-SPEC-419, A-SPEC-461, A-SPEC-496, A-SPEC-506.1, A-SPEC-100.2
+    const workspaceQueries = (0, workspace_queries_1.createWorkspaceQueryHandlers)({
+        listSpecs: () => store.list(),
+        foreignRootReason: root => foreignRootReason(store, root),
+        projectRootOf,
+        cachedScan,
+        cachedScanWithReport,
+        assertStoreReachable: (tool, root) => assertSpecStoreReachable(tool, store, root),
+    });
+    // @implements A-SPEC-618, A-SPEC-100.2, A-SPEC-128, A-SPEC-151, A-SPEC-169, A-SPEC-189, A-SPEC-420, A-SPEC-174, A-SPEC-252, A-SPEC-188, A-SPEC-146, A-SPEC-184
+    const specAuthoring = (0, spec_authoring_1.createSpecAuthoringHandlers)({ store, projectRootOf, resolver });
+    const specQueries = (0, spec_queries_1.createSpecQueryHandlers)({
+        listSpecs: () => store.list(),
+        assertStoreReachable: (tool, root) => assertSpecStoreReachable(tool, store, root),
+        resolver,
+    });
     // @implements A-SPEC-263.1
     // The in-session approval channel: ask ONLY when (a) an elicitor was injected (the server wires
     // one iff the client advertised the elicitation capability — handlers never see the server), and
@@ -777,6 +770,20 @@ function makeRawHandlers(store, opts) {
         token: crypto.randomUUID(),
         rationale: reason ?? 'elicitation grant',
     });
+    // @implements A-SPEC-617, A-SPEC-100.2, A-SPEC-102.1, A-SPEC-133, A-SPEC-135, A-SPEC-141, A-SPEC-157, A-SPEC-160, A-SPEC-189, A-SPEC-191, A-SPEC-244, A-SPEC-245, A-SPEC-263.1, A-SPEC-497.1
+    const reviewEvidence = (0, review_evidence_1.createReviewEvidenceHandlers)({
+        foreignRootReason: root => foreignRootReason(store, root),
+        refusal: reason => new HandlerRefusal(reason),
+        boundFindingsLedger: root => boundFindingsLedger(store, root),
+        boundNonceLedger: () => boundNonceLedger(store),
+        projectRootOf,
+        basisFor,
+        hasElicitor: () => Boolean(opts?.elicit),
+        tryElicit,
+        elicitApproval,
+        resolveHandlerApproval: (root, approval, action, now) => resolveHandlerApproval(root, store, approval, action, now),
+        refusalQueueHint: (root, request) => refusalQueueHint(root, store, request),
+    });
     // @implements A-SPEC-532.2 — the autonomous channel: the SAME synthesized-Approval shape that
     // rides the existing seal path, but its actor names `autonomous:<client>` so an audit can tell a
     // self-approved seal from a human-approved (elicitation) or operator (env/grant) one. Single-use
@@ -787,6 +794,13 @@ function makeRawHandlers(store, opts) {
         // @implements A-SPEC-587 — an upstream grade is DERIVED; the audit line names the A-SPECs it came from.
         rationale: `autonomous grant (${'HOLMES_AUTONOMOUS_APPROVAL'} enabled, spec grade auto${derivedFrom && derivedFrom.length > 0 ? ` — derived from ${derivedFrom.join(', ')}` : ''})`,
     });
+    // @implements A-SPEC-622, A-SPEC-100.2, A-SPEC-128, A-SPEC-132, A-SPEC-133, A-SPEC-151, A-SPEC-188, A-SPEC-189, A-SPEC-244, A-SPEC-245
+    const specApproval = (0, spec_approval_1.createSpecApprovalHandlers)({
+        store, resolver, projectRootOf, cachedScan, tryElicit, elicitApproval, autonomousApproval,
+        resolveHandlerApproval: (root, approval, action, now) => resolveHandlerApproval(root, store, approval, action, now),
+        refusalQueueHint: (root, request) => refusalQueueHint(root, store, request),
+        foreignRootReason: (root) => foreignRootReason(store, root),
+    });
     /**
      * Where the audit record for a governance act belongs — resolved BEFORE the act writes anything.
      *
@@ -826,3119 +840,124 @@ function makeRawHandlers(store, opts) {
         }
         return { ok: true, root: projectRootOf(root) };
     };
+    // @implements A-SPEC-538.2, A-SPEC-538.3, A-SPEC-545.3, A-SPEC-572.1, A-SPEC-574.2, A-SPEC-574.5
+    // These contracts also depend on the root/store/fetch capabilities still implemented here.
+    // Keep this composition obligation as well as the moved method-body anchors: a shared-helper
+    // change must retain their existing contract tests even when call-graph resolution is incomplete.
+    // @implements A-SPEC-621, A-SPEC-100.2, A-SPEC-128, A-SPEC-151, A-SPEC-222, A-SPEC-538.1, A-SPEC-255, A-SPEC-133, A-SPEC-188, A-SPEC-189, A-SPEC-244, A-SPEC-245
+    const specLifecycle = (0, spec_lifecycle_1.createSpecLifecycleHandlers)({
+        store,
+        resolveLedgerRoot,
+        resolveHandlerApproval: (root, approval, action, now) => resolveHandlerApproval(root, store, approval, action, now),
+        refusalQueueHint: (root, request) => refusalQueueHint(root, store, request),
+    });
+    const operatorInspection = (0, operator_inspection_1.createOperatorInspectionHandlers)({
+        listSpecs: () => store.list(),
+        readSpec: (id) => store.read(id),
+        specsRoot: () => store.specsRoot,
+        assertStoreReachable: (tool, root) => assertSpecStoreReachable(tool, store, root),
+        resolver,
+        resolveLedgerRoot,
+        fetchJson,
+        resolveHandlerApproval: (root, approval, action, now) => resolveHandlerApproval(root, store, approval, action, now),
+        refusalQueueHint: (root, request) => refusalQueueHint(root, store, request),
+    });
+    // @implements A-SPEC-189, A-SPEC-100.2 — shared store/root capabilities retain phase contracts.
+    const phaseQueries = (0, phase_queries_1.createPhaseQueryHandlers)({
+        listSpecs: () => store.list(),
+        boundSpecsRoot: () => store instanceof spec_store_1.LocalMarkdownRepository ? store.specsRoot : undefined,
+        projectRootOf,
+    });
+    // @implements A-SPEC-125.4, A-SPEC-128, A-SPEC-133, A-SPEC-189, A-SPEC-191, A-SPEC-225
+    // Risk contracts still depend on the shared store, root, scan and bound-ledger capabilities.
+    const riskAssessment = (0, risk_assessment_1.createRiskAssessmentHandlers)({
+        listSpecs: () => store.list(),
+        projectRootOf,
+        cachedScan,
+        boundNonceLedger: () => boundNonceLedger(store),
+    });
+    // @implements A-SPEC-203, A-SPEC-204, A-SPEC-298, A-SPEC-299, A-SPEC-536.1, A-SPEC-546.1, A-SPEC-565.2, A-SPEC-587.2, A-SPEC-501.1, A-SPEC-100.2, A-SPEC-156
+    const sliceOrchestration = (0, slice_orchestration_1.createSliceOrchestrationHandlers)({
+        listSpecs: () => store.list(),
+        unreadableAmong,
+        rawHandlersForStore: rawStore => makeRawHandlers(rawStore),
+    });
+    // @implements A-SPEC-126, A-SPEC-129, A-SPEC-181, A-SPEC-182, A-SPEC-184, A-SPEC-188, A-SPEC-189, A-SPEC-299
+    // Adoption contracts retain their shared root and configured-store obligations here.
+    const adoption = (0, adoption_1.createAdoptionHandlers)({
+        listSpecs: () => store.list(),
+        writeSpec: (...args) => store.write(...args),
+        assertReadableRoot,
+        occupiedTarget: (specs) => store instanceof spec_store_1.LocalMarkdownRepository
+            ? specs.map((s) => store.targetPathFor(s)).find((p) => fs.existsSync(p))
+            : undefined,
+    });
     return {
-        async spec_create(a) {
-            // @implements A-SPEC-169
-            // `root` is a CONTROL argument. Without excluding it, the catch-all below stores it as
-            // frontmatter and a machine-local absolute path lands in a git-shared document. A blacklist,
-            // not a whitelist: domain fields (`priority`, `slice`, …) must keep flowing through without
-            // anyone maintaining a list of them.
-            const { type, id, title, depends_on = [], root: reqRoot, ...extra } = a;
-            // The server binds its spec store once, so a `root` naming another project cannot be honoured.
-            // Silently writing to this one is a data-integrity problem; refusing says so. Compared by
-            // resolved identity (A-SPEC-163) — `<root>//.` is the same directory, not a different project.
-            // @implements A-SPEC-189 §9 (round 11) — the question is "same PROJECT?", and this asked "does
-            // `<root>/.ax/specs` equal the bound store?" — the default layout hardcoded. On the first-class
-            // `--specs-dir docs/specs` deployment no root could ever satisfy it: measured, the project's own
-            // root was refused as another project's, so `spec_create` was unusable there. `spec_approve`
-            // learned this in round 3 and compares at project level; this is the same comparison.
-            // @implements A-SPEC-189 §16 (round 13) — the siblings all ask "did the derivation actually
-            // FIND a marker?" before speaking for a project (spec_approve, phase_status,
-            // foreignRootReason). Without it, a store whose derivation lands on itself (an absolute
-            // `--specs-dir` outside any `.ax` tree) calls itself the bound project and refuses the
-            // project's real root — the inverse defect rounds 3/9/11 fixed elsewhere.
-            // 파생은 이 분기 안에서만, 그리고 실패는 '표지를 못 찾았다'로 읽는다 — 스펙 트리를 이제
-            // 만들려는 참이라 스토어 경로가 아직 없을 수 있고, 그것이 예외가 되어선 안 된다.
-            const boundSpecsRoot = store instanceof spec_store_1.LocalMarkdownRepository ? store.specsRoot : null;
-            const derivedForCreate = (() => {
-                if (boundSpecsRoot === null)
-                    return null;
-                try {
-                    const d = projectRootOf(boundSpecsRoot);
-                    return fs.existsSync(path.join(d, '.ax')) ? d : null;
-                }
-                catch {
-                    return null;
-                }
-            })();
-            if (typeof reqRoot === 'string' && reqRoot !== '' && derivedForCreate !== null) {
-                const asked = (0, write_target_1.resolveTarget)(projectRootOf(reqRoot), '.');
-                const bound = (0, write_target_1.resolveTarget)(derivedForCreate, '.');
-                if (asked !== bound) {
-                    return {
-                        ok: false,
-                        // A-SPEC-169: 두 경로를 모두 이름한다 — 어느 저장소가 묶여 있는지 호출자가 보아야 한다.
-                        reason: `이 서버는 ${bound} 프로젝트(스펙 저장소 ${boundSpecsRoot})에 바인딩되어 있습니다`
-                            + ` — 요청한 root ${reqRoot}는 ${asked}를 가리킵니다.`
-                            + ' 다른 프로젝트를 조용히 수정하지 않기 위해 거부합니다.',
-                    };
-                }
-            }
-            // @implements A-SPEC-420
-            // The branch above steps aside when the server's spec directory does not exist yet, so that a
-            // project can create its first spec. Right intent, but the gap let something else through:
-            // measured against the INSTALLED server from a cwd outside any project, `spec_create` with
-            // `root` naming an established other project wrote REQ-990 into the SERVER's directory and
-            // answered `{"created":"REQ-990"}`. The caller's project gained nothing and was told it had.
-            //
-            // Layout-independent on purpose: the test is not "<root>/.ax/specs equals my store" — that
-            // hardcodes the default layout and, as the note above records, made `--specs-dir docs/specs`
-            // deployments refuse their own root. It is "you named a project that already exists, and my
-            // store is not inside it", which is true whatever the specs directory is called.
-            if (typeof reqRoot === 'string' && reqRoot !== '' && derivedForCreate === null && boundSpecsRoot !== null) {
-                const real = (p2) => { try {
-                    return fs.realpathSync(p2);
-                }
-                catch {
-                    return path.resolve(p2);
-                } };
-                let askedRoot = null;
-                try {
-                    askedRoot = real(projectRootOf(reqRoot));
-                }
-                catch {
-                    askedRoot = null;
-                }
-                if (askedRoot !== null && fs.existsSync(path.join(askedRoot, '.ax'))
-                    && !real(boundSpecsRoot).startsWith(askedRoot + path.sep)) {
-                    return {
-                        ok: false,
-                        reason: `이 서버의 스펙 저장소 ${boundSpecsRoot} 는 아직 만들어지지 않았고 ${askedRoot} 안에도`
-                            + ' 있지 않습니다 — 요청한 root 는 이미 스펙 저장소를 가진 다른 프로젝트입니다.'
-                            + ' 여기서 만들면 파일은 호출자가 지정한 곳이 아니라 이 서버 쪽에 생깁니다.'
-                            + ' 서버를 그 프로젝트에서 시작하거나 HOLMES_SPECS 로 그 프로젝트의 스펙 경로를 지정하십시오.',
-                    };
-                }
-            }
-            // @implements A-SPEC-174
-            // Refuse what can never become valid; accept what is merely not filled in yet.
-            //
-            // Measured 2026-08-12 against the installed server: `REQ-7`, `hello`, `A-SPEC-7.1` and four
-            // more were all created and are all refused at approval on `bad-id`. The id IS the filename,
-            // so the author's only repair is to delete the spec and start over — after writing the body.
-            // The stubs below are the opposite case: they are placeholders BY DESIGN, and blocking
-            // approval until someone answers them is what they are for (A-SPEC-146).
-            //
-            // Every judgement here quotes SPEC_TYPES, which is what approval reads. A second statement of
-            // the rule drifts, and the drift is either this defect again or its worse inverse — refused
-            // at creation, accepted at approval.
-            const def = spec_types_1.SPEC_TYPES[type];
-            if (!def) {
-                return { ok: false, reason: `알 수 없는 스펙 타입 "${String(type)}" — 유효한 타입: ${spec_types_1.SPEC_ORDER.join(', ')}` };
-            }
-            if (!def.idRegex.test(String(id))) {
-                return {
-                    ok: false,
-                    reason: `id "${String(id)}"는 ${def.type}의 형식 ${def.idRegex}에 맞지 않습니다 — 예: ${def.example}.`
-                        + ' 승인 시점에 거부될 값이므로 지금 거부합니다(id는 파일명이라 나중에 고칠 수 없습니다).',
-                };
-            }
-            for (const pid of depends_on) {
-                // The parent is judged WITHOUT resolving it: not existing yet is a legitimate state an
-                // author reaches by creating the child first. A wrong type is wrong forever.
-                const ptype = (0, spec_types_1.specTypeOfId)(String(pid));
-                if (ptype === null) {
-                    return { ok: false, reason: `depends_on "${String(pid)}"는 어떤 스펙 타입의 id 형식에도 맞지 않습니다 — 그 id를 가진 스펙은 존재할 수 없습니다.` };
-                }
-                if (!def.parents.includes(ptype)) {
-                    return { ok: false, reason: `depends_on "${String(pid)}"는 ${ptype}입니다 — ${def.type}의 부모는 ${def.parents.join('|') || '없음(빈 depends_on)'}이어야 합니다.` };
-                }
-            }
-            // @implements A-SPEC-252
-            // A new id may not LEAP past the sequence. spec_slice_init assigns nextId = max(base)+1, which
-            // is only predictable while numbering stays sequential; a hand-picked wild id (REQ-1403) once
-            // dragged max to 1403 and every slice after jumped to 1404. Refused here, at the one door that
-            // lets a manual id in — so max+1 can never be poisoned again. After the shape check on purpose:
-            // an id whose base cannot be read is the shape check's to name, not this guard's.
-            const corpus = await store.list();
-            const seq = (0, spec_id_guard_1.sequentialIdVerdict)(String(id), corpus.map((s) => s.id));
-            if (!seq.ok)
-                return { ok: false, reason: seq.reason };
-            // @implements A-SPEC-188
-            // Creation creates. Probed before this check existed: spec_create over an approved+sealed
-            // REQ returned {"created"} while the disk went draft / seal gone / prose gone — the sanctioned
-            // door destroying what risk_check guards every shell path against. Checked AFTER the format
-            // refusals on purpose: a malformed id must keep its own message (order is pinned by test).
-            // Legacy (typeless) documents count as existing too — overwriting one makes the store's
-            // orphan removal delete the differently-named original file along with its history.
-            const existing = corpus.find((s) => s.id === id);
-            if (existing) {
-                const sealed = existing.status === 'approved' || Boolean(existing.frontmatter?.approved_digest);
-                const kind = existing.type ? `${existing.type} (status: ${existing.status})` : `옛 형식 문서 (status: ${existing.status})`;
-                return {
-                    ok: false,
-                    reason: `${id}은(는) 이미 존재합니다 — ${kind}. `
-                        + (sealed
-                            ? '봉인(approved)된 문서이므로, 내용을 바꾸려면 파일을 편집한 뒤 spec_approve로 재봉인하십시오. '
-                            : '그 문서를 고치려는 것이면 파일을 직접 편집하십시오. ')
-                        + '새 문서를 만들려는 것이면 다른 id를 쓰십시오. 생성은 아무것도 덮어쓰지 않습니다.',
-                };
-            }
-            const sections = Object.fromEntries(def.requiredSections.map((s) => [s, spec_types_1.FIELD_PLACEHOLDER]));
-            // Stub the required FRONTMATTER too, not just the sections. Without this every created spec
-            // fails the project's own `spec_validate` on `missing-field` the moment it is written, and
-            // the author has to rediscover the per-type field list by reading spec-types.ts. Caller-
-            // supplied values win; `coverage` needs a shaped default because T-SPEC reads its keys.
-            // `source` is a citation LIST, so a bare 'TODO' string would fail the shape check the moment
-            // the spec is written. The stub is validly shaped but obviously unfilled: it validates while
-            // the REQ is drafted and blocks approval until a real origin replaces the placeholder.
-            const stub = (f) => {
-                if (f === 'coverage')
-                    return { normal: false, corner: false, negative: false, boundary: false };
-                if (f === 'source')
-                    return [{ kind: 'other', ref: spec_types_1.CITATION_PLACEHOLDER, note: 'cite the real origin before approval' }];
-                return spec_types_1.FIELD_PLACEHOLDER;
-            };
-            const required = Object.fromEntries(def.requiredFields.filter((f) => !(f in extra)).map((f) => [f, stub(f)]));
-            // @implements A-SPEC-146
-            // Scaffolded but not required by `validateSpec` — see SpecTypeDef.stubOnlyFields for why the
-            // gap exists. The stub value is `TODO`, which is NOT an accepted grade, so the field is
-            // visible to the author while the approval still refuses until it is actually answered.
-            // Pre-filling `none` would be easier and would make the formulaic answer the default, which is
-            // exactly what ADR-013 recorded as its revisit trigger.
-            const stubOnly = Object.fromEntries((def.stubOnlyFields ?? []).filter((f) => !(f in extra)).map((f) => [f, stub(f)]));
-            const spec = { id, type, title, status: 'draft', dependsOn: depends_on, frontmatter: { ...required, ...stubOnly, ...extra }, sections };
-            // @implements A-SPEC-188 — existence is a PATH question, not only a list() question.
-            // Round-2 review probed the gap: list() drops unparseable files, so a prose note or
-            // broken-YAML document sitting at the exact target path was invisible to the id check above
-            // and got silently overwritten — with the refusal text elsewhere promising the opposite.
-            // A file the store cannot read as this id is a file a human must look at first.
-            if (store instanceof spec_store_1.LocalMarkdownRepository) {
-                const target = store.targetPathFor(spec);
-                if (fs.existsSync(target)) {
-                    return {
-                        ok: false,
-                        reason: `${id}의 목적지(${target})에 파일이 이미 있는데 스토어가 이 id의 스펙으로 읽지 못합니다`
-                            + ' — 손으로 쓰던 초안이거나 깨진 문서일 수 있습니다. 사람이 확인해 옮기거나 고치기 전까지 덮어쓰지 않습니다'
-                            + ' (doctor가 읽을 수 없는 스펙 파일을 보고합니다).',
-                    };
-                }
-            }
-            try {
-                await store.write(spec);
-            }
-            catch (e) {
-                // The pre-write path check above makes this a narrow race backstop; the store guard is the
-                // authority and this act relays it in the same wording the other writers use.
-                if (e instanceof spec_store_1.TargetPathOccupiedError) {
-                    return {
-                        ok: false,
-                        reason: `${id}의 목적지(${e.occupiedPath})에 스토어가 읽지 못하는 파일이 이미 있습니다 — 덮어쓰지 않습니다.`
-                            + ' 사람이 확인해 옮기거나 고친 뒤 다시 시도하십시오.',
-                    };
-                }
-                throw e;
-            }
-            return { created: id };
-        },
-        async spec_validate(a) {
-            const specs = await store.list();
-            const spec = specs.find((s) => s.id === a.id);
-            if (!spec)
-                return { ok: false, findings: [{ level: 'error', code: 'not-found', message: a.id }] };
-            return (0, validator_1.validateSpec)(spec, resolver(specs));
-        },
-        /**
-         * @implements A-SPEC-132
-         * Approval as an ACT: validate → seal → flip → ledger, in one call. This is the designed
-         * reversal of "no approval tool exists" (which promote-slice documented while it was true) —
-         * the act now includes digest computation a hand edit cannot perform honestly. Fail-closed on
-         * the SERVER-environment approval: nothing in the request payload can substitute, because the
-         * agent authors the payload and the operator authors the environment.
-         */
-        /**
-         * @implements A-SPEC-184
-         * Raise ONE named document from an older spec format to the current one.
-         *
-         * The compatibility policy this implements: older documents are read and left alone by default,
-         * and rise only when a human points at the one they intend to use. There is deliberately no bulk
-         * path — 155 documents here and 90 in the measured adoption target, and which of them are still
-         * live specifications is a judgement only a person holds.
-         *
-         * It declares a KIND. It does not confer approval: 37 of this repository's legacy documents read
-         * `status: Approved`, and carrying that across would mint approvals that never passed the sealing
-         * act. The old value is preserved as evidence and the document restarts at `draft`.
-         *
-         * Takes no `root`: the store is bound at server construction, exactly as `spec_create` is.
-         */
-        async spec_upgrade(a) {
-            // @implements A-SPEC-188 — same read-then-write shape as spec_approve, so the same window
-            // AND the same duplicate hazard: read() resolves the last-walked copy, and the write's orphan
-            // removal would delete the other. Refuse rather than pick a side.
-            if ((await store.list()).filter((s) => s.id === a.id).length > 1) {
-                return {
-                    ok: false,
-                    reason: `${a.id}이(가) 스토어에 두 번 이상 존재합니다 — 어느 사본이 진본인지 도구가 고를 수 없어 보강 전에 거부합니다.`
-                        + ' doctor로 중복 파일을 확인해 하나로 정리한 뒤 다시 시도하십시오.',
-                };
-            }
-            const cur = await store.read(a.id);
-            if (!cur)
-                return { ok: false, reason: `spec ${a.id} not found` };
-            const spec = cur.spec;
-            const plan = (0, legacy_format_1.upgradePlan)(spec);
-            if (!plan) {
-                const why = (0, legacy_format_1.legacyMessage)(spec);
-                // No plan for two opposite reasons. Already current is success and writes nothing — a second
-                // run must not churn the file. An unsupported kind is a refusal, and its wording must not
-                // send the holder after a type that does not exist.
-                return why ? { ok: false, reason: why } : { ok: true, upgraded: false, reason: `${a.id}은(는) 이미 현행 양식입니다` };
-            }
-            const upgraded = {
-                ...spec,
-                type: plan.type,
-                status: 'draft',
-                frontmatter: (0, legacy_format_1.upgradedFrontmatter)(spec, plan),
-            };
-            try {
-                await store.write(upgraded, { expectedVersion: cur.version });
-            }
-            catch (e) {
-                if (e instanceof spec_store_2.SpecVersionConflictError) {
-                    return {
-                        ok: false,
-                        reason: `보강 진행 중 ${a.id}이(가) 바뀌었습니다 — 바뀐 내용을 확인하고 다시 시도하십시오.`
-                            + ' 이번 보강은 아무것도 쓰지 않았습니다.',
-                    };
-                }
-                // @implements A-SPEC-188 — the upgrade RELOCATES by design (legacy filename → canonical),
-                // so an unreadable file at the canonical path is the store's occupied-target refusal.
-                if (e instanceof spec_store_1.TargetPathOccupiedError) {
-                    return {
-                        ok: false,
-                        reason: `${a.id}의 목적지(${e.occupiedPath})에 스토어가 읽지 못하는 파일이 이미 있습니다 — 덮어쓰지 않습니다.`
-                            + ' 사람이 확인해 옮기거나 고친 뒤 다시 시도하십시오. 이번 보강은 아무것도 쓰지 않았습니다.',
-                    };
-                }
-                throw e;
-            }
-            // Report what still stands between this document and approval. Silence would read as "done",
-            // and a legacy document typically lacks most required sections.
-            const after = await store.list();
-            const remaining = (0, validator_1.validateSpec)(upgraded, resolver(after)).findings.filter((f) => f.level === 'error');
-            return { ok: true, upgraded: true, type: plan.type, legacyStatus: plan.legacyStatus, remaining };
-        },
-        /**
-         * Move a document to `outdated` — the only path there.
-         *
-         * @implements A-SPEC-222
-         * `outdated` was in SPEC_STATUSES with no code writing it and no document carrying it: a
-         * declared state nothing could reach. That mattered the moment 23 deprecated REQs needed
-         * cleaning up, because the only transition tool sends everything to `draft`, and calling a
-         * retired document "draft" is a worse lie than the non-canonical word it replaced.
-         *
-         * Retirement withdraws authority rather than granting it, so it does NOT need the approval key
-         * by default. Two cases invert that, and the threshold follows the RISK rather than the name of
-         * the act:
-         *
-         *  - A sealed document. The code gate demands an approved T-SPEC naming the target A-SPEC;
-         *    retiring that T-SPEC removes the demand. Unguarded, retirement is an approval bypass.
-         *  - A document an APPROVED spec depends on. That chain is holding something up right now.
-         */
-        async spec_retire(a) {
-            const all = await store.list();
-            if (all.filter((s) => s.id === a.id).length > 1) {
+        spec_create: specAuthoring.spec_create,
+        spec_validate: specQueries.spec_validate,
+        spec_upgrade: specAuthoring.spec_upgrade,
+        spec_retire: specLifecycle.spec_retire,
+        spec_renumber: specLifecycle.spec_renumber,
+        spec_unseal: specLifecycle.spec_unseal,
+        approval_status: operatorInspection.approval_status,
+        ledger_timeline: operatorInspection.ledger_timeline,
+        rtm_dashboard: operatorInspection.rtm_dashboard,
+        spec_approve: specApproval.spec_approve,
+        spec_list: specQueries.spec_list,
+        spec_next: specQueries.spec_next,
+        rtm_check: workspaceQueries.rtm_check,
+        citation_pin: specApproval.citation_pin,
+        phase_status: phaseQueries.phase_status,
+        phase_check: phaseQueries.phase_check,
+        cpg_scan: workspaceQueries.cpg_scan,
+        taint_scan: taintScreening.taint_scan,
+        test_run: testExecution.test_run,
+        issue_localize: workspaceQueries.issue_localize,
+        maintenance_analyze: maintenanceAnalysis.maintenance_analyze,
+        ...(0, maintenance_evidence_1.createMaintenanceEvidenceHandlers)({
+            foreignRootReason: root => foreignRootReason(store, root),
+            projectRootOf,
+            refusal: reason => new HandlerRefusal(reason),
+            fileDigestOf,
+        }),
+        // @implements A-SPEC-642 — placed in the one slot no public-key-order pin covers (the handler suites pin
+        // spec_create..spec_upgrade, spec_retire..spec_unseal, spec_unseal+5, spec_approve+4, spec_next+3,
+        // citation_pin+4, phase_check+3, cpg_scan+3, taint_scan..issue_localize, test_run+3, issue_localize+3,
+        // rtm_impact+4, rtm_reindex..review_record, review_prepare..risk_check, risk_check±, and the tail).
+        ledger_reconcile: operatorInspection.ledger_reconcile,
+        rtm_impact: graphOperations.rtm_impact,
+        rtm_reindex: graphOperations.rtm_reindex,
+        context_bundle: reviewQueries.context_bundle,
+        review_scope: reviewQueries.review_scope,
+        review_prepare: reviewQueries.review_prepare,
+        review_record: reviewEvidence.review_record,
+        review_status: reviewEvidence.review_status,
+        risk_check: riskAssessment.risk_check,
+        reverse_scan: adoption.reverse_scan,
+        reverse_draft: adoption.reverse_draft,
+        reverse_anchor: adoption.reverse_anchor,
+        spec_slice_init: sliceOrchestration.spec_slice_init,
+        spec_slice_approve: sliceOrchestration.spec_slice_approve,
+        spec_remediate: sliceOrchestration.spec_remediate,
+        // @implements A-SPEC-623 — append the capability while preserving existing tool neighbors.
+        ...(0, workspace_identity_2.createWorkspaceIdentityHandlers)({
+            foreignRootReason: (root) => foreignRootReason(store, root),
+            storeRoot: store instanceof spec_store_1.LocalMarkdownRepository ? store.specsRoot : undefined,
+        }),
+        ...(0, entity_store_1.createEntityStoreHandlers)({ storeRoot: store instanceof spec_store_1.LocalMarkdownRepository ? store.specsRoot : undefined }),
+        ...(0, entity_renumber_1.createEntityRenumberHandlers)({ storeRoot: store instanceof spec_store_1.LocalMarkdownRepository ? store.specsRoot : undefined }),
+        ...(0, entity_integration_1.createEntityIntegrationHandlers)({
+            storeRoot: store instanceof spec_store_1.LocalMarkdownRepository ? store.specsRoot : undefined,
+            // @implements A-SPEC-632 — discharge rebuilds through the same publication and warming paths
+            // rtm_reindex uses; the impact population (approved-only) so the next rtm_impact reuses it.
+            rebuildFor: (root) => {
+                let scanned;
+                const scan = () => (scanned ??= cachedScan(root));
                 return {
-                    ok: false,
-                    reason: `${a.id}이(가) 스토어에 두 번 이상 존재합니다 — 어느 사본이 진본인지 도구가 고를 수 없어 폐기 전에 거부합니다.`,
+                    publishGraph: async () => (0, graph_operations_2.publishCurrentGraph)(root, (await store.list()).filter((s) => s.status === 'approved'), scan()),
+                    warmSemantic: () => (0, graph_operations_2.warmSemanticCache)(root, scan()),
                 };
-            }
-            const cur = await store.read(a.id);
-            if (!cur)
-                return { ok: false, reason: `spec ${a.id} not found` };
-            const spec = cur.spec;
-            // @implements A-SPEC-222 — a document with no `type:` cannot be filed: the store derives its
-            // folder from the kind, and there is none. Refuse rather than infer, because a wrongly
-            // inferred kind MOVES the document into another folder. Measured 2026-08-21: without this the
-            // store threw `Cannot read properties of undefined (reading 'folder')` on the first of the 23
-            // legacy documents this tool was built for — every unit fixture carried `type:`, which is how
-            // it got through. Declaring the kind is `spec_upgrade`'s job, so the refusal names it.
-            if (!spec.type) {
-                return {
-                    ok: false,
-                    reason: `${a.id}에는 \`type:\` 선언이 없습니다(구형식 문서) — 어느 폴더에 속하는지 알 수 없어 폐기할 수 없습니다.`
-                        + ' 종류를 추론하지 않는 이유는 잘못 추론한 종류가 문서를 다른 폴더로 옮기기 때문입니다.'
-                        + ` 먼저 spec_upgrade({ id: "${a.id}" })로 형식을 올린 뒤 다시 폐기하십시오 — 그 도구가 이전 status를 legacy_status로 보존합니다.`,
-                };
-            }
-            // Idempotent, and it writes NOTHING on the second call: overwriting the first retirement's
-            // reason would make the record graffiti rather than history.
-            if (spec.status === 'outdated') {
-                return { ok: true, retired: false, id: a.id, dependents: [], reason: `${a.id}은(는) 이미 outdated 입니다` };
-            }
-            const approvalRaw = process.env.HOLMES_APPROVAL;
-            let approval;
-            try {
-                approval = approvalRaw ? JSON.parse(approvalRaw) : undefined;
-            }
-            catch {
-                approval = undefined;
-            }
-            const retireResolved = resolveHandlerApproval(a.root, store, approval, { kind: 'spec-approve', target: a.id }, new Date().toISOString());
-            const covered = retireResolved !== undefined;
-            const sealed = typeof spec.frontmatter.approved_digest === 'string';
-            if (sealed && !covered) {
-                return {
-                    ok: false,
-                    reason: `${a.id}은(는) 봉인된 문서입니다 — 폐기는 이 행위를 덮는 유효한 대역외 HOLMES_APPROVAL 이 필요합니다.`
-                        + ' 코드 게이트를 막고 있는 approved T-SPEC 을 폐기하면 그 게이트가 열리므로, 폐기가 승인 우회 경로가 되지 않도록 fail-closed 로 막습니다.'
-                        + ' (범위를 쓰면 kind "spec-approve")'
-                        + refusalQueueHint(a.root, store, { kind: 'spec-approve', target: a.id, why: '봉인된 스펙의 폐기' }),
-                };
-            }
-            // @implements A-SPEC-245 — a grant that authorized breaking a seal is spent by it.
-            if (sealed && retireResolved?.source === 'grant' && retireResolved.root && retireResolved.approval.nonce) {
-                (0, approval_grants_1.consumeGrantFile)(retireResolved.root, retireResolved.approval.nonce);
-            }
-            const dependents = all.filter((s) => s.id !== a.id && s.dependsOn.includes(a.id));
-            const blocking = dependents.filter((s) => s.status === 'approved').map((s) => s.id);
-            if (blocking.length > 0) {
-                return {
-                    ok: false,
-                    reason: `${a.id}을(를) 폐기하면 approved 문서 ${blocking.join(', ')}의 사슬이 끊깁니다 — 지금 무언가를 지탱하고 있는 사슬이므로 거부합니다.`
-                        + ' 해당 문서를 먼저 폐기하거나 부모를 다른 문서로 옮기십시오.',
-                };
-            }
-            // Destination BEFORE the write, the order A-SPEC-188 fixed for spec_approve: a resolution
-            // failure must leave nothing behind.
-            const dest = resolveLedgerRoot(a.root);
-            if (!dest.ok)
-                return { ok: false, reason: dest.reason };
-            const ledgerRoot = dest.root;
-            const fm = { ...spec.frontmatter };
-            // Blank is omitted, never written: `retired_reason: ""` asserts a ground that does not exist,
-            // the same rule `legacy_status` follows. A document already carrying `superseded_by` has
-            // answered "why" already and is not asked twice.
-            const reason = typeof a.reason === 'string' ? a.reason.trim() : '';
-            if (reason && fm.superseded_by === undefined)
-                fm.retired_reason = reason;
-            try {
-                await store.write({ ...spec, status: 'outdated', frontmatter: fm }, { expectedVersion: cur.version });
-            }
-            catch (e) {
-                if (e instanceof spec_store_2.SpecVersionConflictError) {
-                    return { ok: false, reason: `폐기 진행 중 ${a.id}이(가) 바뀌었습니다 — 확인 후 다시 시도하십시오. 이번 폐기는 아무것도 쓰지 않았습니다.` };
-                }
-                throw e;
-            }
-            new ledger_store_1.FileLedgerStore(path.join(ledgerRoot, '.ax', 'ledger')).append({
-                ts: new Date().toISOString(),
-                actor: approval?.actor ?? 'unattributed',
-                kind: 'spec-retired',
-                summary: `retired ${a.id}${reason ? ` — ${reason}` : ''}`,
-                inputs: [a.id],
-                rationale: reason || (approval?.rationale ?? 'retired'),
-                ...(approval ? { authorization: (0, provenance_chain_1.authorizationRef)(approval.actor, approval.token) } : {}),
-            });
-            return { ok: true, retired: true, id: a.id, dependents: dependents.map((s) => s.id) };
-        },
-        /**
-         * @implements A-SPEC-538.1
-         * The inverse of spec_approve: returns a SEALED (approved) spec to an editable `draft`, clearing
-         * `approved_digest` and `parent_digests` in ONE act, and records `spec-unsealed`. Hand-editing
-         * only `status` leaves seal residue that later trips validation; this atomizes the reverse.
-         *
-         * Un-sealing WITHDRAWS a seal, so — like retiring a sealed document — it demands a covering
-         * out-of-band HOLMES_APPROVAL (fail-closed): un-sealing an approved T-SPEC removes the code
-         * gate's demand, so an unguarded un-seal would be an approval bypass. And it refuses when an
-         * APPROVED spec depends on the target, because that dependent's `parent_digests` — the snapshot
-         * drift detection compares against — would silently go stale.
-         */
-        // @implements A-SPEC-255 — the WIRING only. The judgment is `planRenumber`, which is pure and
-        // tested directly; this handler adds no rules of its own. Re-sealing is deliberately absent:
-        // `spec_approve` is the only sealer, so the plan reports the two ORDERS and the caller runs them.
-        // @implements A-SPEC-255 — WIRING only. The judgment lives in `planRenumber`, which is pure and
-        // tested directly; nothing here adds a rule. Re-sealing is deliberately absent: `spec_approve`
-        // is the only sealer (a second sealer becomes a second truth), so the plan reports the two
-        // ORDERS and the caller runs them. `dryRun` defaults to true — a renumber is read before it runs.
-        async spec_renumber(a) {
-            const specsRoot = store.specsRoot;
-            if (typeof specsRoot !== 'string')
-                return { ok: false, reason: '파일 스토어에 묶인 서버에서만 리넘버할 수 있습니다.' };
-            const projectRoot = path.resolve(specsRoot, '..', '..');
-            const plan = (0, renumber_1.planRenumber)({
-                specs: (0, renumber_1.readSpecsForRenumber)(specsRoot),
-                sources: (0, renumber_1.readSourcesForRenumber)(projectRoot),
-                oldBase: String(a.oldBase), newBase: String(a.newBase),
-            });
-            if (plan.refusal)
-                return { ok: false, reason: plan.refusal };
-            if (a.dryRun !== false)
-                return { ok: true, dryRun: true, plan };
-            const movedSpecs = (0, renumber_1.applyRenumber)(specsRoot, { ...plan, anchors: [] });
-            (0, renumber_1.applyRenumber)(projectRoot, { ...plan, moves: [], dependsOn: [], slices: [] });
-            new ledger_store_1.FileLedgerStore(path.join(projectRoot, '.ax', 'ledger')).append({
-                ts: new Date().toISOString(),
-                actor: 'spec_renumber',
-                kind: 'spec-renumbered',
-                summary: `renumbered base ${a.oldBase} -> ${a.newBase}: ${movedSpecs} spec(s), ${plan.anchors.length} anchored file(s), ${plan.proseCandidates.length} prose candidate(s) left for a human`,
-                inputs: plan.moves.map((m) => `${m.oldId}->${m.newId}`),
-            });
-            return { ok: true, dryRun: false, movedSpecs, plan };
-        },
-        async spec_unseal(a) {
-            const all = await store.list();
-            if (all.filter((s) => s.id === a.id).length > 1) {
-                return {
-                    ok: false,
-                    reason: `${a.id}이(가) 스토어에 두 번 이상 존재합니다 — 어느 사본이 진본인지 도구가 고를 수 없어 봉인 해제 전에 거부합니다.`,
-                };
-            }
-            const cur = await store.read(a.id);
-            if (!cur) {
-                const dir = store.specsRoot;
-                const unreadable = typeof dir === 'string' ? (0, spec_store_1.unreadableSpecFiles)(dir) : [];
-                return { ok: false, reason: (0, spec_store_1.notFoundReason)(a.id, unreadable) };
-            }
-            const spec = cur.spec;
-            if (!spec.type) {
-                return {
-                    ok: false,
-                    reason: `${a.id}에는 \`type:\` 선언이 없습니다(구형식 문서) — 어느 폴더에 속하는지 알 수 없어 봉인 해제할 수 없습니다.`
-                        + ` 먼저 spec_upgrade({ id: "${a.id}" })로 형식을 올린 뒤 다시 시도하십시오.`,
-                };
-            }
-            // Sealed ⇔ carries approved_digest. Un-sealing an already-draft spec writes NOTHING (a second
-            // un-seal is history, not graffiti) — mirrors spec_retire's idempotent no-op.
-            const sealed = typeof spec.frontmatter.approved_digest === 'string';
-            if (!sealed) {
-                return { ok: true, unsealed: false, id: a.id, dependents: [], reason: `${a.id}은(는) 이미 미봉인(draft) 상태입니다` };
-            }
-            const approvalRaw = process.env.HOLMES_APPROVAL;
-            let approval;
-            try {
-                approval = approvalRaw ? JSON.parse(approvalRaw) : undefined;
-            }
-            catch {
-                approval = undefined;
-            }
-            const resolved = resolveHandlerApproval(a.root, store, approval, { kind: 'spec-approve', target: a.id }, new Date().toISOString());
-            if (resolved === undefined) {
-                return {
-                    ok: false,
-                    reason: `${a.id}은(는) 봉인된 문서입니다 — 봉인 해제는 이 행위를 덮는 유효한 대역외 HOLMES_APPROVAL 이 필요합니다.`
-                        + ' 봉인을 해제하면 코드 게이트가 요구하던 approved 스펙의 봉인이 사라지므로, 해제가 승인 우회 경로가 되지 않도록 fail-closed 로 막습니다.'
-                        + ' (범위를 쓰면 kind "spec-approve")'
-                        + refusalQueueHint(a.root, store, { kind: 'spec-approve', target: a.id, why: '봉인된 스펙의 해제' }),
-                };
-            }
-            // @implements A-SPEC-245 — a grant that authorized breaking a seal is spent by it.
-            if (resolved.source === 'grant' && resolved.root && resolved.approval.nonce) {
-                (0, approval_grants_1.consumeGrantFile)(resolved.root, resolved.approval.nonce);
-            }
-            const dependents = all.filter((s) => s.id !== a.id && s.dependsOn.includes(a.id));
-            const blocking = dependents.filter((s) => s.status === 'approved').map((s) => s.id);
-            if (blocking.length > 0) {
-                return {
-                    ok: false,
-                    reason: `${a.id}의 봉인을 해제하면 approved 문서 ${blocking.join(', ')}의 parent_digests 가 stale 이 됩니다 — 지금 그 사슬을 지탱하고 있으므로 거부합니다.`
-                        + ' 해당 문서를 먼저 해제/폐기하거나 부모를 다른 문서로 옮기십시오.',
-                };
-            }
-            // Destination BEFORE the write (A-SPEC-188 order): a resolution failure leaves nothing behind.
-            const dest = resolveLedgerRoot(a.root);
-            if (!dest.ok)
-                return { ok: false, reason: dest.reason };
-            const ledgerRoot = dest.root;
-            const fm = { ...spec.frontmatter };
-            delete fm.approved_digest; // the seal this act withdraws
-            delete fm.parent_digests;
-            try {
-                await store.write({ ...spec, status: 'draft', frontmatter: fm }, { expectedVersion: cur.version });
-            }
-            catch (e) {
-                if (e instanceof spec_store_2.SpecVersionConflictError) {
-                    return { ok: false, reason: `봉인 해제 진행 중 ${a.id}이(가) 바뀌었습니다 — 확인 후 다시 시도하십시오. 이번 해제는 아무것도 쓰지 않았습니다.` };
-                }
-                throw e;
-            }
-            new ledger_store_1.FileLedgerStore(path.join(ledgerRoot, '.ax', 'ledger')).append({
-                ts: new Date().toISOString(),
-                actor: approval?.actor ?? 'unattributed',
-                kind: 'spec-unsealed',
-                summary: `unsealed ${a.id}`,
-                inputs: [a.id],
-                rationale: approval?.rationale ?? 'unsealed',
-                ...(approval ? { authorization: (0, provenance_chain_1.authorizationRef)(approval.actor, approval.token) } : {}),
-            });
-            return { ok: true, unsealed: true, id: a.id, dependents: dependents.map((s) => s.id) };
-        },
-        /**
-         * @implements A-SPEC-538.2
-         * Read-only: report a spec's approval/seal state — sealed?, approved_digest, each parent's seal
-         * state, and the concrete blockers still standing between it and approval — so a caller need not
-         * parse files to ask "what is the approval state right now". Reuses `sealOf` and `approvalBlockers`
-         * (the same predicates the code gate and spec_approve read) so the report cannot drift from the
-         * acts it describes. No writes, no ledger append.
-         */
-        async approval_status(a) {
-            assertSpecStoreReachable('approval_status', store, a.root); // @implements A-SPEC-419
-            const all = await store.list();
-            if (all.filter((s) => s.id === a.id).length > 1) {
-                return {
-                    ok: false,
-                    reason: `${a.id}이(가) 스토어에 두 번 이상 존재합니다 — 어느 사본의 상태를 물었는지 도구가 고를 수 없어 거부합니다.`,
-                };
-            }
-            const cur = await store.read(a.id);
-            if (!cur) {
-                const dir = store.specsRoot;
-                const unreadable = typeof dir === 'string' ? (0, spec_store_1.unreadableSpecFiles)(dir) : [];
-                return { ok: false, reason: (0, spec_store_1.notFoundReason)(a.id, unreadable) };
-            }
-            // @implements A-SPEC-572.1
-            // The graph advisory, delivered at DESIGN time. Measured on our own work: A-SPEC-571.1's
-            // sealing advisory named the exact cluster three regressions then landed in — and by then
-            // the design was done. The calculation was never the gap; the delivery time was. So the
-            // read-only "what is blocking this right now" tool also answers "what will this scope leak,
-            // and where is it dense" — using the SAME functions spec_approve calls, so the preview can
-            // never disagree with the seal. Read-only stays read-only: no scan, no build, no ledger
-            // append (a query must not pollute the observation denominator), and every failure degrades
-            // to an absent field on an otherwise identical response.
-            let graphPreview;
-            try {
-                if (cur.spec.type === 'A-SPEC' && a.root) {
-                    const dbPath = path.join(a.root, '.ax', 'rtm.sqlite');
-                    if (fs.existsSync(dbPath)) {
-                        const { declaredImpactGap } = require('../rtm/impact-advisory');
-                        const { anchorDensityFindings } = require('../rtm/anchor-density');
-                        const { filesToTouch } = require('../spec/compat-impact');
-                        const { RtmGraph } = require('../rtm/rtm-graph');
-                        const graph = new RtmGraph(dbPath);
-                        try {
-                            const ftt = filesToTouch(cur.spec);
-                            const impact = declaredImpactGap(ftt, graph, (rel) => { try {
-                                return fs.readFileSync(path.join(a.root, rel), 'utf8');
-                            }
-                            catch {
-                                return null;
-                            } });
-                            const density = anchorDensityFindings(ftt, graph.implementsAnchorCounts());
-                            // @implements A-SPEC-574.2 — the computation lives in cycle-detect; this file holds
-                            // the wiring only (measured: 85 anchors here against a p90 of 7).
-                            const { cycleAdvisory, classifyEdgeByTarget, CYCLE_ADVISORY_NOTE } = require('../cpg/cycle-detect');
-                            const readCache = new Map();
-                            const readSource = (rel) => {
-                                const hit = readCache.get(rel);
-                                if (hit !== undefined)
-                                    return hit;
-                                // A read failure degrades to the conservative kind rather than losing the finding.
-                                let text = '';
-                                try {
-                                    text = fs.readFileSync(path.join(a.root, rel), 'utf8');
-                                }
-                                catch {
-                                    text = '';
-                                }
-                                readCache.set(rel, text);
-                                return text;
-                            };
-                            const cycleFindings = cycleAdvisory(ftt, graph.importEdges().map((edge) => ({
-                                ...edge,
-                                kind: classifyEdgeByTarget(readSource(edge.from), edge.from, edge.to),
-                            })));
-                            // @implements A-SPEC-574.5 — the same import edges the cycle pass already read, plus
-                            // the parent-time symbol spans the graph already holds. No new scan, no new parse.
-                            const { architectureObservation } = require('../cpg/arch-observe');
-                            const { TreeSitterTsParser } = require('../cpg/language-parser');
-                            const { langForPath } = require('../cpg/cpg-scanner');
-                            // Bounded to the DECLARED files, whose text is read once and used for both numbers.
-                            const archParser = new TreeSitterTsParser();
-                            const archText = new Map();
-                            const readArch = (f) => {
-                                if (!archText.has(f)) {
-                                    try {
-                                        archText.set(f, fs.readFileSync(path.join(a.root, f), 'utf8'));
-                                    }
-                                    catch {
-                                        archText.set(f, null);
-                                    }
-                                }
-                                return archText.get(f) ?? null;
-                            };
-                            const spans = new Map(ftt.map((f) => {
-                                const text = readArch(f);
-                                if (text === null)
-                                    return [f, []];
-                                try {
-                                    return [f, archParser.extractSymbols(text, langForPath(f))
-                                            .filter((sy) => sy.kind !== 'class')
-                                            .map((sy) => ({ startLine: sy.startLine, endLine: sy.endLine }))];
-                                }
-                                catch {
-                                    return [f, []];
-                                }
-                            }));
-                            const arch = architectureObservation(ftt, spans, graph.importEdges(), (f) => { const t = readArch(f); return t === null ? null : t.split('\n').length; });
-                            if (impact || density.length > 0 || cycleFindings.length > 0 || arch.length > 0) {
-                                const graphAsOf = (() => { try {
-                                    return fs.statSync(dbPath).mtime.toISOString();
-                                }
-                                catch {
-                                    return undefined;
-                                } })();
-                                graphPreview = {
-                                    ...(impact ? { impact } : {}),
-                                    ...(density.length > 0 ? { density } : {}),
-                                    ...(cycleFindings.length > 0
-                                        ? { cycles: { findings: cycleFindings, note: CYCLE_ADVISORY_NOTE } } : {}),
-                                    ...(arch.length > 0 ? { architecture: arch } : {}),
-                                    ...(graphAsOf ? { graphAsOf } : {}),
-                                };
-                            }
-                        }
-                        finally {
-                            graph.close();
-                        }
-                    }
-                }
-            }
-            catch {
-                graphPreview = undefined;
-            }
-            return { ok: true, ...(0, approval_status_1.describeApproval)(cur.spec, resolver(all)), ...(graphPreview ? { graphPreview } : {}) };
-        },
-        /**
-         * @implements A-SPEC-538.3
-         * Read-only: return the provenance ledger's events in time order (optionally narrowed to one
-         * spec) so the governance history — approved / unsealed / retired / review-needed … — is legible
-         * at a glance without reading raw JSONL. Reuses FileLedgerStore.loadAll(); the ordering/filtering/
-         * projection is the pure `timelineFrom`. No writes. An absent ledger is an empty history, not an
-         * error.
-         */
-        async ledger_timeline(a) {
-            const dest = resolveLedgerRoot(a.root);
-            if (!dest.ok)
-                return { ok: false, reason: dest.reason };
-            const dir = path.join(dest.root, '.ax', 'ledger');
-            const events = fs.existsSync(dir) ? new ledger_store_1.FileLedgerStore(dir).loadAll() : [];
-            return { ok: true, events: (0, ledger_timeline_1.timelineFrom)(events, a.id) };
-        },
-        // @implements A-SPEC-545.3 — "show me the RTM dashboard" launches (idempotently) the server the
-        // agent would otherwise start by hand, and returns its URL plus an honesty census of what it shows.
-        async rtm_dashboard(a) {
-            const dest = resolveLedgerRoot(a.root);
-            if (!dest.ok)
-                return { ok: false, reason: dest.reason };
-            try {
-                const { startDashboardServer } = await Promise.resolve().then(() => __importStar(require('../server/dashboard')));
-                const { ensureDashboard, dashboardCensus } = await Promise.resolve().then(() => __importStar(require('../server/dashboard-launcher')));
-                const launch = await ensureDashboard(dest.root, a.port, (opts) => startDashboardServer(opts));
-                const rtm = await fetchJson(`${launch.url}/api/rtm`);
-                const heatmap = await fetchJson(`${launch.url}/api/rtm/heatmap`);
-                return { ok: true, url: launch.url, running: launch.running, census: dashboardCensus(rtm, heatmap) };
-            }
-            catch (err) {
-                return { ok: false, reason: `대시보드 기동 실패: ${err?.message ?? String(err)}` };
-            }
-        },
-        async spec_approve(a) {
-            const approvalRaw = process.env.HOLMES_APPROVAL;
-            let approval;
-            try {
-                approval = approvalRaw ? JSON.parse(approvalRaw) : undefined;
-            }
-            catch {
-                approval = undefined;
-            }
-            // covers, not merely well-formed (round-3 escalation: a token scoped to review-resolve — or
-            // expired outright — completed a FULL SEAL here, so A-SPEC-133's narrowing was decorative at
-            // the most consequential consumer). Unscoped {actor,token,rationale} stays the session key.
-            let approveResolved = resolveHandlerApproval(a.root, store, approval, { kind: 'spec-approve', target: a.id }, new Date().toISOString());
-            // @implements A-SPEC-263.1 — asked ONLY after the existing channels failed to cover (an open
-            // door never summons a human), and only about a spec that exists (a question about a missing
-            // id helps no one — the standard refusal handles it).
-            let elicitExpiredMs;
-            if (approveResolved === undefined) {
-                const target = await store.read(a.id).catch(() => null);
-                if (target) {
-                    // @implements A-SPEC-532.2 — the autonomous gate sits BEFORE the human ask: when the
-                    // out-of-band autonomy switch is on AND the spec is low/mid-risk (never gate-behavior, an
-                    // architecture/taint file, or an upstream REQ/H/C — those stay human), the agent seals it
-                    // itself. The switch is env-only and an agent cannot set it (pre-tool-use blocks that,
-                    // A-SPEC-532.2). Off, or a hitl-classed spec, falls straight through to the elicitor
-                    // unchanged — the autonomous-OFF path is byte-identical to before.
-                    // @implements A-SPEC-553.1 — autonomy is the out-of-band env switch OR a valid, non-expired
-                    // session envelope marker under this project's `.ax/state/` (which an agent cannot write).
-                    const autonomyOn = (0, autonomy_1.autonomousApprovalEnabled)(process.env, a.root, new Date().toISOString());
-                    // @implements A-SPEC-587 — an upstream REQ/H-SPEC is graded by the A-SPECs beneath it, so
-                    // the store is consulted for its descendants (only then: the list is a cost the auto-grade
-                    // A-SPEC/T-SPEC path does not pay). Unknown scope (none yet) keeps the human answer.
-                    const upstream = target.spec.type === 'REQ' || target.spec.type === 'H-SPEC';
-                    const below = autonomyOn && upstream ? (0, autonomy_1.descendantAspecs)(target.spec, await store.list()) : undefined;
-                    if (autonomyOn
-                        && (0, autonomy_1.specApprovalAutonomy)(target.spec, resolver([target.spec]), below) === 'auto') {
-                        approveResolved = { approval: autonomousApproval(below?.map((s) => s.id)), source: 'autonomous' };
-                    }
-                    else if (autonomyOn) {
-                        // @implements A-SPEC-551.1 — hitl-grade spec under autonomy: the in-session elicitation
-                        // dialog is auto-acceptable by an auto-mode client (the protocol cannot tell a human
-                        // from an auto-accept), so a governance-critical spec is never offered it. Do nothing
-                        // here — approveResolved stays undefined and the fail-closed refuse+enqueue path below
-                        // routes the act to the out-of-band human queue (holmes-kit approve). The A-SPEC-532.1
-                        // bound ("governance-critical specs never leave the human channel") thus becomes
-                        // ENFORCED, not aspirational. Autonomy OFF (the else) and the auto-grade branch above
-                        // stay byte-identical to before.
-                    }
-                    else {
-                        const resealing = typeof target.spec.frontmatter.approved_digest === 'string';
-                        // The MODEL text is capped BEFORE the server markers are appended (round-2): a ~185+ char
-                        // title pushed '(재봉인)' past the dialog's 200-char summary cap, dressing a re-seal (the
-                        // more consequential act) as a first approval. The cap cuts the title, never the marker.
-                        const out = await tryElicit('spec-approve', a.id, `${a.id} — ${target.spec.title.slice(0, 120)}${resealing ? ' (재봉인)' : ''}`);
-                        if (out.kind === 'answered' && out.decision.granted) {
-                            approveResolved = { approval: elicitApproval(out.decision.reason), source: 'elicitation' };
-                        }
-                        else if (out.kind === 'answered') {
-                            // The human ANSWERED (deny/question/decline): the answer is the message, and no queue
-                            // entry is filed — a decided request is not a pending one (REQ-246 visibility).
-                            return { ok: false, reason: `spec_approve: 세션에서 거부됨 — ${out.decision.reason ?? '(사유 없음)'}. 사유를 해소한 뒤 다시 시도하십시오.` };
-                        }
-                        else if (out.kind === 'expired') {
-                            // @implements A-SPEC-497.1 — only the expiry earns a name: the notice LEADS the same
-                            // fail-closed refusal + queue path, so the semantics stay refusal+queue and only the
-                            // message learned to say what happened.
-                            elicitExpiredMs = out.waitedMs;
-                        }
-                        // silent: the channel gave no answer — fall through to the byte-identical refusal.
-                    }
-                }
-            }
-            if (approveResolved === undefined) {
-                return { ok: false, reason: (elicitExpiredMs !== undefined ? (0, elicit_approval_1.expiredNotice)(elicitExpiredMs) : '')
-                        + 'spec_approve requires an out-of-band HOLMES_APPROVAL that COVERS this act — a request-payload approval is not a channel, and an expired or elsewhere-scoped token does not open this door (scoped approvals need kind "spec-approve"). (fail-closed)'
-                        + refusalQueueHint(a.root, store, { kind: 'spec-approve', target: a.id, why: '스펙 봉인 승인' }) };
-            }
-            // @implements A-SPEC-188 — destination BEFORE seal.
-            // The old order (seal at :481, resolve the ledger at :483) produced both measured harms: a
-            // bad root left a standing seal with no ledger entry anywhere while the CALLER WAS TOLD IT
-            // FAILED, and a foreign root filed the only audit record in another project's ledger. This
-            // repository lived the first one — REQ-182's chain was approved rootless on 2026-08-13 and
-            // the missing entries were found two review rounds later.
-            //
-            // The destination is DERIVED from the store the server was bound to (same principle as
-            // spec_create's A-SPEC-163 guard); a supplied `root` is a confirmation that must match. Any
-            // failure here is a refusal with nothing written.
-            let ledgerRoot;
-            try {
-                if (store instanceof spec_store_1.LocalMarkdownRepository) {
-                    // Compared at PROJECT level, through the same walk-up the old code used: a root pointing
-                    // anywhere INSIDE this project (the specs dir, a subdirectory) resolves to the same
-                    // project and is accepted — round-2 review caught the first cut refusing those with a
-                    // message that printed the identical path on both sides. Only a root resolving to a
-                    // DIFFERENT project is refused, and the message names both projects.
-                    //
-                    // Round-3 caught the fallback: resolveProjectRoot returns its INPUT when no .ax ancestor
-                    // exists, so a custom HOLMES_SPECS outside any .ax tree "derived" the specs dir itself as
-                    // the project — a rootless approval then minted .ax/ledger INSIDE the spec store, and the
-                    // correct explicit root was refused as a "different project". Derivation only counts when
-                    // the walk actually found a marker; otherwise the old contract stands: root is required
-                    // and names the project.
-                    const derived = projectRootOf(store.specsRoot);
-                    const derivationFoundMarker = fs.existsSync(path.join(derived, '.ax'));
-                    if (derivationFoundMarker) {
-                        ledgerRoot = derived;
-                        if (typeof a.root === 'string' && a.root !== '') {
-                            const askedProject = (0, write_target_1.resolveTarget)(projectRootOf(a.root), '.');
-                            const boundProject = (0, write_target_1.resolveTarget)(ledgerRoot, '.');
-                            if (askedProject !== boundProject) {
-                                return {
-                                    ok: false,
-                                    reason: `이 서버는 ${boundProject} 프로젝트에 바인딩되어 있습니다 — 요청한 root ${a.root}는 ${askedProject} 프로젝트를 가리킵니다.`
-                                        + ' 다른 프로젝트의 원장에 기록하지 않기 위해 봉인 전에 거부합니다.',
-                                };
-                            }
-                        }
-                    }
-                    else if (typeof a.root === 'string' && a.root !== '') {
-                        ledgerRoot = projectRootOf(a.root);
-                    }
-                    else {
-                        return {
-                            ok: false,
-                            reason: '스토어 위치에서 프로젝트를 파생할 수 없습니다(.ax 상위 디렉터리 없음) — 원장을 어디에 둘지 알 수 없어 봉인 전에 거부합니다. root를 지정하십시오.',
-                        };
-                    }
-                }
-                else {
-                    if (typeof a.root !== 'string' || a.root === '') {
-                        return { ok: false, reason: 'root가 없고 스토어에서 원장 위치를 파생할 수도 없습니다 — 봉인 전에 거부합니다. root를 지정하십시오.' };
-                    }
-                    ledgerRoot = projectRootOf(a.root);
-                }
-            }
-            catch (e) {
-                return {
-                    ok: false,
-                    reason: `원장 위치를 확정할 수 없어 봉인 전에 거부합니다: ${String(e.message)}.`
-                        + ' 올바른 root를 지정하거나, 파일 스토어에 바인딩된 서버에서는 root를 생략하십시오.',
-                };
-            }
-            const specs = await store.list();
-            // @implements A-SPEC-188 — with DUPLICATE ids the tool cannot know which copy is canonical:
-            // read() resolves the last-walked file while list().find sees the first, so approving would
-            // seal a stray's content and delete the canonical file — success reported, edit destroyed
-            // (round-2 review reproduced exactly that). Duplicates are a recognized invalid state
-            // (doctor detects them); the act refuses rather than picking a side.
-            // @implements A-SPEC-188 — the spec this act validates and seals is the one read NOW, with
-            // its version captured for the optimistic write below. Basing the candidate on the list()
-            // element instead leaves a window in which an external edit is silently destroyed and the
-            // STALE content gets sealed (measured: 17 of 40 concurrent edits lost, 35-55ms window).
-            const cur = await store.read(a.id);
-            // @implements A-SPEC-536.1 — BUG-1: a spec whose YAML is broken is dropped by read()/list(),
-            // so a bare "not found" hid that the file EXISTS but cannot be parsed. Surface the skipped
-            // files when there are any; byte-identical to the legacy message when there are none. The
-            // store's specsRoot is read through the same cast the reachability checks use (A-SPEC-169).
-            if (!cur) {
-                const dir = store.specsRoot;
-                const unreadable = typeof dir === 'string' ? (0, spec_store_1.unreadableSpecFiles)(dir) : [];
-                return { ok: false, reason: (0, spec_store_1.notFoundReason)(a.id, unreadable) };
-            }
-            const spec = cur.spec;
-            // @implements A-SPEC-188 — duplicates make the id ambiguous, for the SPEC and for its
-            // PARENTS alike. Round-3 probed the parent half: with a stray duplicate of the parent
-            // walking first, the child's parent_digests sealed the stray's (forged) digest — the very
-            // snapshot drift detection compares against — while the refusal principle stated one field
-            // away was "the tool does not pick a copy". Refuse for every ambiguous id in the act.
-            const ambiguous = [a.id, ...spec.dependsOn].filter((id) => specs.filter((s) => s.id === id).length > 1);
-            if (ambiguous.length > 0) {
-                return {
-                    ok: false,
-                    reason: `${[...new Set(ambiguous)].join(', ')}이(가) 스토어에 두 번 이상 존재합니다 — 어느 사본이 진본인지 도구가 고를 수 없어 봉인 전에 거부합니다.`
-                        + ' doctor로 중복 파일을 확인해 하나로 정리한 뒤 다시 승인하십시오.',
-                };
-            }
-            // @implements A-SPEC-168
-            // A child may not be approved under a parent that is not. The chain's meaning is that each
-            // layer is justified by the one above it, and measured 2026-08-08 that failed in four places —
-            // including A-SPEC-100.1/100.2, the core MCP guardrail, whose design H-SPEC-100 nobody ever
-            // approved. The obligation is on the ACT: existing approvals are untouched, because making it
-            // a state rule is what REQ-146 measured turning 302 specs into violations at once.
-            // @implements A-SPEC-182
-            // Shared with the gate rather than restated. Adversarial review found this check living ONLY
-            // here: the gate reported "nothing blocks" for a draft under a draft parent — the modal state
-            // of top-down authoring — and the author learned otherwise only by attempting the approval.
-            const parentIssues = (0, approval_blockers_1.parentBlockers)(spec, resolver(specs));
-            if (parentIssues.length > 0)
-                return { ok: false, reason: parentIssues[0] };
-            // Validate AS IT WILL BE — approved. Approval-gated checks (placeholder citations, 4-quadrant
-            // GWT) must fire NOW, not one turn after the seal exists.
-            const candidate = { ...spec, status: 'approved', frontmatter: { ...spec.frontmatter } };
-            delete candidate.frontmatter.approved_digest; // seals are recomputed by this act, never inherited
-            delete candidate.frontmatter.parent_digests;
-            const prevalidation = (0, validator_1.validateSpec)(candidate, resolver(specs));
-            const blocking = prevalidation.findings.filter((f) => f.level === 'error' && !approval_blockers_1.SUPPLIED_BY_APPROVAL.has(f.code) // this act supplies exactly those
-            );
-            if (blocking.length > 0)
-                return { ok: false, reason: 'validation errors block approval', findings: blocking };
-            // @implements A-SPEC-146
-            // ADR-013's duty is owed by the ACT, not by the document's static validity. Measured: putting
-            // this in `validateSpec`'s requiredFields produced 38 ART-3 violations and a Stop hook that
-            // blocked every turn, because all 38 governed A-SPECs are already approved. Here it constrains
-            // the future without invalidating the past — and a re-approval, which by definition means the
-            // content changed, is exactly when the question is due.
-            const breakingIssue = (0, breaking_change_1.checkBreakingChangeDeclared)(candidate);
-            if (breakingIssue)
-                return { ok: false, reason: breakingIssue };
-            // @implements A-SPEC-565.1 — the compat declaration duty rides the SAME act (REQ-565): sealing
-            // is when "did you consider the three harnesses and the three OSes" is due, and act-time is
-            // what keeps 512 already-approved specs out of retroactive violation (the 38-violation incident
-            // above). The bound reader feeds the OS cross-check from this root's working tree.
-            const compatIssue = (0, compat_impact_1.checkCompatDeclared)(candidate, {
-                // No root → no working tree to read: the OS cross-check skips file-by-file (fail-open),
-                // while the declaration syntax itself is still enforced — the duty never depends on `root`.
-                readFile: (rel) => { try {
-                    return a.root ? fs.readFileSync(path.join(a.root, rel), 'utf8') : null;
-                }
-                catch {
-                    return null;
-                } },
-            });
-            if (compatIssue)
-                return { ok: false, reason: compatIssue };
-            // @implements A-SPEC-182
-            // A document whose prose is still the generator's placeholder must not be sealed. Measured
-            // 2026-08-13 on a brownfield adoption: H-SPEC-100 took `status: approved` and an
-            // `approved_digest` with all seven prose sections reading "TODO — a human writes this" —
-            // while its own first line said approving is the point a description becomes normative.
-            // Placed on the ACT, not in `validateSpec`, for the reason A-SPEC-146 measured: a static
-            // predicate turns every already-approved spec into a violation and bricks the harness.
-            const stubs = (0, approval_blockers_1.placeholderSections)(candidate);
-            if (stubs.length > 0) {
-                return { ok: false, reason: (0, approval_blockers_1.placeholderMessage)(stubs) };
-            }
-            // @implements A-SPEC-505.1 — acceptance substance, judged at the ACT on the same candidate
-            // the seal would freeze, like the placeholder gate above (154/428 approved REQs here are
-            // non-stated legacy; a validateSpec predicate would brick them all). Judged HERE and not
-            // before the approval channels: an earlier extra read shifts the optimistic-concurrency
-            // window and lets a mid-approval edit get sealed (store-integrity contract: edits win,
-            // approvals lose). The post-grant refusal it costs is the standing property of every
-            // act-time blocker in this block (breaking_change, placeholder) — one ordering, one truth.
-            const unactionable = (0, approval_blockers_1.unactionableCriteriaBlocker)(candidate);
-            if (unactionable)
-                return { ok: false, reason: unactionable };
-            // Parents-first: a sealed child snapshotting an unsealed parent would pin nothing. This loop
-            // exists to COLLECT the digests; the refusal inside it is now a backstop, because
-            // `parentBlockers` above already returns for the same condition with the same sentence. Kept
-            // rather than deleted so a future change to that function cannot silently let an unsealed
-            // parent through — but note the wording lives there, and only there, if it is ever edited.
-            const parentDigests = {};
-            for (const pid of spec.dependsOn) {
-                const parent = specs.find((s) => s.id === pid);
-                if (parent && parent.status === 'approved') {
-                    const parentSeal = (0, spec_digest_1.sealOf)(parent).approvedDigest;
-                    if (!parentSeal)
-                        return { ok: false, reason: (0, approval_blockers_1.unsealedParentMessage)(pid) };
-                    parentDigests[pid] = parentSeal;
-                }
-            }
-            // @implements A-SPEC-135
-            // Detect seal MOVEMENT before overwriting: the prior on-disk seal, if any, is what "moved from".
-            const priorDigest = (0, spec_digest_1.sealOf)(spec).approvedDigest;
-            const digest = (0, spec_digest_1.specDigest)(candidate);
-            candidate.frontmatter.approved_digest = digest;
-            candidate.frontmatter.parent_digests = parentDigests;
-            // @implements A-SPEC-188 — the seal is written only at the version this act READ. On
-            // conflict the EDIT wins and the APPROVAL loses: the edit is what a person just wrote; the
-            // approval is an act that can simply be retried. The reverse (the old behaviour) sealed
-            // stale content over a destroyed edit with no notice.
-            try {
-                await store.write(candidate, { expectedVersion: cur.version });
-            }
-            catch (e) {
-                if (e instanceof spec_store_2.SpecVersionConflictError) {
-                    // @implements A-SPEC-538.4 — the refusal is unchanged (refuse, write nothing, the edit
-                    // wins); it now also CARRIES the conflict: the version this act read, the version now on
-                    // disk, and what to retry. Re-read to learn the current version (null if it vanished).
-                    const now = await store.read(a.id).catch(() => null);
-                    return {
-                        ok: false,
-                        reason: `승인 진행 중 ${a.id}이(가) 바뀌었습니다 — 바뀐 내용을 확인하고 다시 승인하십시오.`
-                            + ' 이번 승인은 아무것도 쓰지 않았습니다.',
-                        conflict: (0, version_conflict_1.conflictDetail)({ id: a.id, expected: cur.version, current: now?.version ?? null }),
-                    };
-                }
-                // @implements A-SPEC-188 — approval can RELOCATE the file (req_type classification moves
-                // an H-SPEC into its subfolder). Round-3 probed that landing on an unreadable human note
-                // destroyed it with success reported; the store now refuses, and this act relays why.
-                if (e instanceof spec_store_1.TargetPathOccupiedError) {
-                    return {
-                        ok: false,
-                        reason: `${a.id}의 목적지(${e.occupiedPath})에 스토어가 읽지 못하는 파일이 이미 있습니다 — 덮어쓰지 않습니다.`
-                            + ' 사람이 확인해 옮기거나 고친 뒤 다시 승인하십시오. 이번 승인은 아무것도 쓰지 않았습니다.',
-                    };
-                }
-                throw e;
-            }
-            // @implements A-SPEC-148 — writes go to THIS replica's chain; the legacy file is read-only now.
-            const chain = new ledger_store_1.FileLedgerStore(path.join(ledgerRoot, '.ax', 'ledger'));
-            chain.append({
-                ts: new Date().toISOString(),
-                actor: approveResolved.approval.actor,
-                kind: 'spec-approved',
-                summary: `approved ${a.id} sealing ${digest}`,
-                inputs: [a.id, digest],
-                rationale: approveResolved.approval.rationale,
-                authorization: (0, provenance_chain_1.authorizationRef)(approveResolved.approval.actor, approveResolved.approval.token),
-            });
-            // @implements A-SPEC-135
-            // P4 routing signal: a re-approval whose content CHANGED (prior seal existed and differs) mints
-            // a `review-needed` entry naming the anchored source files — the exact set a targeted review must
-            // re-examine against the new content. A first approval or an idempotent re-seal is not drift and
-            // mints nothing. This ROUTES review; it never verdicts the code. Best-effort: a missed route is
-            // not a broken seal, so an append failure does not fail the approval.
-            if (priorDigest && priorDigest !== digest) {
-                try {
-                    const files = (0, review_targets_1.anchoredForReview)(a.id, cachedScan(ledgerRoot, ledgerRoot), specs);
-                    chain.append({
-                        ts: new Date().toISOString(), actor: approveResolved.approval.actor, kind: 'review-needed',
-                        summary: `targeted review needed: ${a.id} content moved — re-examine ${files.length} anchored file(s) against the new spec content`,
-                        inputs: [a.id, priorDigest, digest, ...files],
-                        rationale: approveResolved.approval.rationale, authorization: '',
-                    });
-                }
-                catch { /* a missed routing signal is not a broken seal */ }
-            }
-            // @implements A-SPEC-245 — single-use: the grant is spent by the seal it authorized.
-            if (approveResolved.source === 'grant' && approveResolved.root && approveResolved.approval.nonce) {
-                (0, approval_grants_1.consumeGrantFile)(approveResolved.root, approveResolved.approval.nonce);
-            }
-            // @implements A-SPEC-566.2 — the impact advisory rides the SUCCESS, after the seal is done:
-            // the verdict is already committed, so nothing here can change it (advisory, never gate —
-            // Judgments must not be budgeted). Reuses the persisted graph READ-ONLY; it never scans,
-            // parses or builds (scan:build measured 20~38x — an approval must not pay that), and every
-            // failure below degrades to "no advisory field" on an otherwise identical response.
-            let impactAdvisory;
-            let anchorDensity;
-            try {
-                if (spec.type === 'A-SPEC' && a.root) {
-                    const dbPath = path.join(a.root, '.ax', 'rtm.sqlite');
-                    if (fs.existsSync(dbPath)) {
-                        const { declaredImpactGap, appendImpactAdvisory } = require('../rtm/impact-advisory');
-                        const { filesToTouch } = require('../spec/compat-impact');
-                        const { RtmGraph } = require('../rtm/rtm-graph');
-                        // Closed in finally (high-effort review F4): this handler lives in a long-running MCP
-                        // server, and an unclosed native handle per approval accumulates for the process
-                        // lifetime — and on Windows can hold rtm.sqlite locked against the next rebuild.
-                        const graph = new RtmGraph(dbPath);
-                        try {
-                            const ftt = filesToTouch(candidate);
-                            const gap = declaredImpactGap(ftt, graph, (rel) => { try {
-                                return fs.readFileSync(path.join(a.root, rel), 'utf8');
-                            }
-                            catch {
-                                return null;
-                            } });
-                            if (gap) {
-                                const graphAsOf = (() => { try {
-                                    return fs.statSync(dbPath).mtime.toISOString();
-                                }
-                                catch {
-                                    return undefined;
-                                } })();
-                                impactAdvisory = { ...gap, ...(graphAsOf ? { graphAsOf } : {}) };
-                                appendImpactAdvisory(a.root, {
-                                    aspec: a.id, files: gap.files.map((f) => f.path), more: gap.more,
-                                    ...(graphAsOf ? { graphAsOf } : {}), ts: new Date().toISOString(),
-                                });
-                            }
-                            // @implements A-SPEC-569.5 — anchor-density OBSERVATION, same reopened graph, same
-                            // no-scan contract, same lifecycle as the advisory above (observe → ledger → measure
-                            // before anyone proposes promotion). Never a verdict input: the seal is already done,
-                            // and its own failure degrades to "no field" on an otherwise identical response.
-                            try {
-                                const { anchorDensityFindings, appendAnchorDensity } = require('../rtm/anchor-density');
-                                const findings = anchorDensityFindings(ftt, graph.implementsAnchorCounts());
-                                if (findings.length > 0) {
-                                    anchorDensity = findings;
-                                    appendAnchorDensity(a.root, {
-                                        aspec: a.id, files: findings.map((f) => ({ path: f.path, anchors: f.anchors })),
-                                        p90: findings[0].p90, ts: new Date().toISOString(),
-                                    });
-                                }
-                            }
-                            catch {
-                                anchorDensity = undefined;
-                            }
-                        }
-                        finally {
-                            graph.close();
-                        }
-                    }
-                }
-            }
-            catch {
-                impactAdvisory = undefined;
-                anchorDensity = undefined;
-            }
-            return { approved: a.id, digest, ...(impactAdvisory ? { impactAdvisory } : {}), ...(anchorDensity ? { anchorDensity } : {}) };
-        },
-        async spec_list(a) {
-            assertSpecStoreReachable('spec_list', store, a.root); // @implements A-SPEC-419
-            const specs = await store.list();
-            // @implements A-SPEC-186
-            // The parent travels with the id because a bare one cannot be read. Measured: a reader took
-            // `T-SPEC-1841` for a count of 1,841 documents. The old-habit ids this repository once held
-            // have since all been renamed or upgraded (measured 2026-08-15: zero remain), but ADOPTED
-            // repositories still write them, so the parent keeps traveling alongside.
-            //
-            // Read from `depends_on`, NEVER parsed out of the id — parsing would answer `A-SPEC-129` for
-            // a `T-SPEC-1291` that actually hangs off something else, which is the tool committing the
-            // very misreading this exists to prevent. Omitted rather than emptied when there is none:
-            // an empty value cannot be told apart from "we looked and failed".
-            const parentOf = (s) => {
-                // @implements A-SPEC-192 §6R (round 10) — the row became format-aware in the `legacy` field
-                // only; `parent` still keyed off the DECLARED type, so an old-format document that never
-                // declared one showed no parent even when its depends_on names one. The inferred kind
-                // answers the same question the legacy mark already asks.
-                const state = (0, legacy_format_1.formatStateOf)({ id: s.id, type: s.type });
-                const kind = s.type ?? (state.kind === 'legacy' ? state.inferred : undefined);
-                const kinds = (0, spec_types_1.specTypeDef)(kind)?.parents ?? [];
-                return s.dependsOn?.find((d) => kinds.some((k) => d.startsWith(`${k}-`)));
-            };
-            // @implements A-SPEC-192 — a non-canonical status must not dress like a governed row:
-            // measured 155 of 483 rows ('Approved', 'Proposed', 'deprecated'…) rendered identically to canonical
-            // ones, and an adopter read capital-A 'Approved' as an approval. Absence of the key marks the
-            // canonical row (the same omission convention as `parent` above). The set derives from the
-            // SPEC_STATUSES runtime list — a hand-copy here was a second truth the compiler cannot police.
-            const CANONICAL_STATUSES = new Set(spec_types_1.SPEC_STATUSES);
-            return {
-                specs: specs
-                    .filter((s) => !a?.type || s.type === a.type)
-                    .map((s) => {
-                    const parent = parentOf(s);
-                    // @implements A-SPEC-192 §5R (round 9) — the mark asks 'is this row a GOVERNED spec?',
-                    // and status alone could not answer it: an old-format document that never declared a
-                    // `type` came through with a lone `approved` and dressed exactly like a canonical row —
-                    // the misreading this REQ exists to prevent. Format and status are both grounds.
-                    const legacyFormat = (0, legacy_format_1.formatStateOf)({ id: s.id, type: s.type }).kind !== 'current';
-                    return {
-                        id: s.id, type: s.type, status: s.status,
-                        ...(parent ? { parent } : {}),
-                        ...(CANONICAL_STATUSES.has(s.status) && !legacyFormat ? {} : { legacy: true }),
-                    };
-                }),
-            };
-        },
-        async spec_next() {
-            const specs = await store.list();
-            // 다음에 작성 가능한 첫 미승인 단계
-            for (const t of spec_types_1.SPEC_ORDER) {
-                const has = specs.some((s) => s.type === t && s.status === 'approved');
-                if (!has)
-                    return { next: t };
-            }
-            return { next: null };
-        },
-        async rtm_check(a) {
-            // @implements A-SPEC-461 — a root that names a different project would check THIS project's
-            // specs against THAT project's files and report clean — A-SPEC-191 §15. foreignRootReason
-            // returns null for an absent or matching root, so the spec-only and correct-root paths are
-            // unaffected. Shared guard (citation_pin/maintenance_analyze use it), not a copy (A-SPEC-449).
-            {
-                const foreign = foreignRootReason(store, a?.root);
-                if (foreign)
-                    return { ok: false, reason: foreign };
-            }
-            const specs = await store.list();
-            // rtm_check runs on the GOVERNED set only (excludes archived legacy +
-            // JOB specs, which otherwise flood orphan/dangling results; see
-            // ADR-010).
-            const issues = (0, rtm_check_1.rtmCheck)((0, spec_types_1.filterGoverned)(specs));
-            // @implements A-SPEC-146 — a REPORT, not a verdict: ADR-013 named formulaic `none` a
-            // revisit trigger for a human, and `(unset)` shows how far the corpus has converged.
-            const breakingChangeDistribution_ = (0, breaking_change_1.breakingChangeDistribution)((0, spec_types_1.filterGoverned)(specs));
-            if (a?.root) {
-                // @implements A-SPEC-189 §14 (round 13) — the derivation was computed and discarded, so the
-                // advertised "a subdirectory resolves up to it" held for `taint_scan` and no one else.
-                const root = projectRootOf(a.root);
-                // Citation drift: a REQ's cited source may have been edited since it was read, which silently
-                // invalidates the requirement derived from it. Only refs that resolve to a file INSIDE the
-                // repo are re-hashed — an unresolvable ref (external ticket, no adapter configured) is not
-                // evidence of drift, and a path escaping the repo is not ours to read.
-                const readLocal = (ref) => {
-                    const abs = path.resolve(root, ref);
-                    if (!abs.startsWith(path.resolve(root) + path.sep))
-                        return null;
-                    try {
-                        return fs.readFileSync(abs, 'utf8');
-                    }
-                    catch {
-                        return null;
-                    }
-                };
-                for (const s of specs) {
-                    if (s.type !== 'REQ' || s.frontmatter.source == null)
-                        continue;
-                    for (const d of (0, validator_1.verifyCitationDigests)(s.frontmatter.source, readLocal)) {
-                        issues.push({ level: d.level, code: d.code, message: `${s.id}: ${d.message}` });
-                    }
-                }
-                const scanned = cachedScan(root, root);
-                // checkImplements checks @implements A-SPEC refs against the FULL
-                // spec id set (not filterGoverned) — it's an existence check: any
-                // existing spec id is a valid anchor target.
-                issues.push(...(0, rtm_check_1.checkImplements)(scanned, specs));
-                // L6 convergence gaps (ADVISORY, not issues): where implementation and the governed spec set
-                // have drifted apart — unimplemented approved specs, unanchored source, untested specs. Feeds
-                // the convergence loop's "pick next work"; an unimplemented spec is normal mid-development.
-                const gaps = (0, gap_analyzer_1.computeConvergenceGaps)(scanned, (0, spec_types_1.filterGoverned)(specs), (0, test_scope_1.scanTestAnchors)(root));
-                return { issues, gaps, breakingChangeDistribution: breakingChangeDistribution_ };
-            }
-            return { issues, breakingChangeDistribution: breakingChangeDistribution_ };
-        },
-        /**
-         * Pin a REQ's citations: compute the content digest of every cited source that resolves inside
-         * the repo and record it as `rev`, so an author never hashes a file by hand and the digest is
-         * always derived from what is actually on disk.
-         *
-         * Explicit-invocation only, dry-run by DEFAULT, and never overwrites an existing digest — a
-         * re-pin would replace evidence of upstream drift with a fresh-looking value, converting the
-         * detector into a concealer.
-         */
-        async citation_pin(a) {
-            // @implements A-SPEC-189 §15 (round 13) — every sibling that reads or writes on behalf of a
-            // project refuses a foreign root (spec_create, phase_status, review_record, review_status,
-            // spec_approve). `citation_pin` did not, and it SEALS what it read: the sha256 of another
-            // project's file was written into this store's REQ frontmatter as evidence, permanently —
-            // the design deliberately never overwrites an existing digest.
-            const foreignPin = foreignRootReason(store, a.root);
-            if (foreignPin !== null)
-                return { ok: false, reason: `citation_pin: ${foreignPin}` };
-            // @implements A-SPEC-189 §14 (round 13) — the derivation was computed and discarded, so the
-            // advertised "a subdirectory resolves up to it" held for `taint_scan` and no one else.
-            const root = projectRootOf(a.root);
-            // @implements A-SPEC-188 — the third writer, same duplicate hazard as approve/upgrade:
-            // read() resolves the last-walked copy and the write's orphan sweep deletes the other.
-            if ((await store.list()).filter((s) => s.id === a.id).length > 1) {
-                return {
-                    ok: false,
-                    reason: `${a.id}이(가) 스토어에 두 번 이상 존재합니다 — 어느 사본이 진본인지 도구가 고를 수 없어 기록 전에 거부합니다.`
-                        + ' doctor로 중복 파일을 확인해 하나로 정리한 뒤 다시 시도하십시오.',
-                };
-            }
-            // @implements A-SPEC-151
-            // `read` now yields the spec together with the version it was read at, so a write can say
-            // "only if nobody touched this since". citation_pin uses it: the pin is derived from what was
-            // read, and writing it back over someone else's edit would silently discard their change.
-            const found = await store.read(a.id);
-            if (!found)
-                return { ok: false, reason: `spec ${a.id} not found` };
-            const { spec, version } = found;
-            if (spec.type !== 'REQ')
-                return { ok: false, reason: `citations live on REQ; ${a.id} is ${spec.type}` };
-            if (spec.frontmatter.source == null)
-                return { ok: false, reason: `${a.id} has no source to pin` };
-            const readLocal = (ref) => {
-                const abs = path.resolve(root, ref);
-                // A ref that escapes the repository is not ours to read, and following it would let a spec
-                // pull arbitrary host files into the provenance record.
-                if (!abs.startsWith(path.resolve(root) + path.sep))
-                    return null;
-                try {
-                    return fs.readFileSync(abs, 'utf8');
-                }
-                catch {
-                    return null;
-                }
-            };
-            const { citations, pinned, findings } = (0, validator_1.pinCitations)(spec.frontmatter.source, readLocal);
-            const dryRun = a.dryRun !== false; // opt IN to writing
-            if (!dryRun && pinned.length > 0) {
-                try {
-                    try {
-                        await store.write({ ...spec, frontmatter: { ...spec.frontmatter, source: citations } }, { expectedVersion: version });
-                    }
-                    catch (e) {
-                        if (e instanceof spec_store_1.TargetPathOccupiedError) {
-                            return {
-                                ok: false,
-                                reason: `${a.id}의 목적지(${e.occupiedPath})에 스토어가 읽지 못하는 파일이 이미 있습니다 — 덮어쓰지 않습니다.`
-                                    + ' 사람이 확인해 옮기거나 고친 뒤 다시 시도하십시오.',
-                            };
-                        }
-                        throw e;
-                    }
-                }
-                catch (err) {
-                    if (err instanceof spec_store_2.SpecVersionConflictError) {
-                        return { ok: false, reason: `${a.id} changed while its citations were being pinned — re-read and retry (${err.message})` };
-                    }
-                    throw err;
-                }
-            }
-            return { ok: true, id: a.id, dryRun, pinned, findings, citations };
-        },
-        async phase_status(a) {
-            // @implements A-SPEC-189 §6 — `root` was advertised and never read, so a call naming another
-            // project (or a path that does not exist) got THIS server's corpus in a success shape and the
-            // caller derived its phase from someone else's specs. Same anchor discipline as spec_approve.
-            if (typeof a?.root === 'string' && a.root !== '' && store instanceof spec_store_1.LocalMarkdownRepository) {
-                let asked;
-                let bound;
-                let derivationFoundMarker = false;
-                try {
-                    asked = (0, write_target_1.resolveTarget)(projectRootOf(a.root), '.');
-                    const derived = projectRootOf(store.specsRoot);
-                    derivationFoundMarker = fs.existsSync(path.join(derived, '.ax'));
-                    bound = (0, write_target_1.resolveTarget)(derived, '.');
-                }
-                catch (e) {
-                    return { ok: false, reason: `root를 해석할 수 없습니다: ${String(e.message)}` };
-                }
-                // @implements A-SPEC-189 §7 (round 10) — spec_approve's round-3 lesson, copied here at last:
-                // resolveProjectRoot returns its INPUT when no `.ax` ancestor exists, so a custom
-                // HOLMES_SPECS outside any project "derived" the spec store itself as the project and this
-                // guard then refused the CORRECT root. Only a derivation that actually found a marker
-                // speaks for a project.
-                if (derivationFoundMarker && asked !== bound) {
-                    return {
-                        ok: false,
-                        reason: `이 서버는 ${bound} 프로젝트에 바인딩되어 있습니다 — 요청한 root ${a.root}는 ${asked} 를 가리킵니다.`
-                            + ' 다른 프로젝트의 코퍼스를 이 서버가 대신 답하지 않습니다.',
-                    };
-                }
-            }
-            const specs = await store.list();
-            return { specs: specs.map((s) => ({ id: s.id, type: s.type, status: s.status })), note: 'derive phase via phase_check' };
-        },
-        async phase_check(a) {
-            const specs = await store.list();
-            const action = a.action ?? (0, phase_1.classifyAction)(a.target);
-            if (!action)
-                return { decision: 'allow', note: 'unclassified target' };
-            return (0, phase_1.phaseCheck)(action, { specs, targetAspecId: a.targetAspecId });
-        },
-        async cpg_scan(a) {
-            // @implements A-SPEC-189 §14 (round 13) — the derivation was computed and discarded, so the
-            // advertised "a subdirectory resolves up to it" held for `taint_scan` and no one else.
-            const root = projectRootOf(a.root);
-            // @implements A-SPEC-131
-            // The skip report is part of the answer: a caller cannot distinguish "clean tree" from "tree
-            // with casualties" by counts alone. Bounded listing (50), complete count.
-            const { scanned, skipped } = cachedScanWithReport(root);
-            const symbols = scanned.reduce((n, f) => n + f.symbols.length, 0);
-            const base = { files: scanned.length, symbols, skipped: skipped.slice(0, 50), skippedCount: skipped.length };
-            if (!a.lints)
-                return base;
-            // @implements A-SPEC-506.1 — opt-in consistency lints (P-G/P-J field incidents): WARNING
-            // signals only, additive field only, Python only; the default path above is byte-identical.
-            const defined = new Set();
-            for (const f of scanned)
-                for (const s of f.symbols) {
-                    defined.add(s.name);
-                    const last = s.name.split('.').pop();
-                    if (last)
-                        defined.add(last);
-                }
-            const dynamicRef = [];
-            const asyncBlocking = [];
-            for (const f of scanned) {
-                if (!f.sourcePath.endsWith('.py'))
-                    continue;
-                let code;
-                try {
-                    code = fs.readFileSync(path.join(root, f.sourcePath), 'utf8');
-                }
-                catch {
-                    continue;
-                }
-                for (const hit of (0, consistency_lints_1.dynamicRefFindings)(code, defined))
-                    dynamicRef.push({ file: f.sourcePath, ...hit });
-                for (const hit of (0, consistency_lints_1.asyncBlockingFindings)(code))
-                    asyncBlocking.push({ file: f.sourcePath, ...hit });
-            }
-            return { ...base, lints: { dynamicRef, asyncBlocking, limits: [...consistency_lints_1.LINT_LIMITS] } };
-        },
-        /**
-         * @implements A-SPEC-138
-         * Call-graph taint REACHABILITY screen: source-named functions that reach sink-named functions
-         * through call edges. A SCREENING signal that routes a security review, NOT a data-flow proof —
-         * the result always carries the honesty envelope (kind + limits) and phrases pairs as "reaches",
-         * never "vulnerable".
-         */
-        async taint_scan(a) {
-            // @implements A-SPEC-461 — same §15 defence as rtm_check: refuse a root that is not this
-            // server's project rather than scanning it against the bound store's specs.
-            {
-                const foreign = foreignRootReason(store, a.root);
-                if (foreign)
-                    return { ok: false, reason: foreign };
-            }
-            const root = projectRootOf(a.root);
-            const scanned = cachedScan(root, root);
-            const g = new rtm_graph_1.RtmGraph();
-            try {
-                (0, rtm_builder_1.buildRtm)(await store.list(), scanned, g);
-                const cfg = taint_1.DEFAULT_TAINT_CONFIG;
-                const { pairs, truncated } = (0, taint_1.taintReachability)(g, cfg);
-                const base = { kind: 'call-reachability', limits: [...taint_1.TAINT_LIMITS], maxPaths: cfg.maxPaths, truncated, pairs };
-                if (a.dataFlow !== true)
-                    return base;
-                // @implements A-SPEC-512.2
-                // OPT-IN def-use lane. Measured 2026-09-02: extracting data-flow facts over this
-                // repository costs 7.6s on top of the scan, which is why this follows the `cpg_scan
-                // lints:true` precedent instead of running by default. Before this slice the engine
-                // (A-SPEC-140.1, with its own 13-case benchmark) had NO caller at all — capability
-                // present, unreachable. Findings are filtered by reaching definitions: inter-procedural
-                // arrival is preserved, and only what the DDG positively refutes is dropped.
-                const { TreeSitterTsParser } = require('../cpg/language-parser');
-                const { taintDataFlow, DATAFLOW_LIMITS } = require('../rtm/dataflow-taint');
-                const { filterFindingsForFile } = require('../rtm/reaching-def-filter');
-                // @implements A-SPEC-513.1 — vocabulary is SELECTED per file language, never unioned:
-                // Python's `input(` must not taint a TypeScript `input`, and `req.body` means nothing in
-                // Python. Measured on jarvis: the shipped (JS) list missed `subprocess.run`, `os.environ`
-                // and `input(` entirely, so a Python repository could only ever report zero.
-                const { vocabularyFor } = require('../rtm/taint-vocabulary');
-                const parser = new TreeSitterTsParser();
-                const factSet = [];
-                // @implements A-SPEC-524.1 — every non-TS language with a CFG takes the flow-sensitive
-                // lane, each judged with ITS OWN vocabulary. The TS family keeps the facts+reaching-defs
-                // lane (its interprocedural propagation lives there).
-                const FLOW_EXT = [
-                    [/\.py$/i, 'python'], [/\.go$/i, 'go'], [/\.rs$/i, 'rust'],
-                    [/\.java$/i, 'java'], [/\.cs$/i, 'csharp'], [/\.(cpp|cc|cxx|hpp|h)$/i, 'cpp'],
-                ];
-                const flowLangFiles = new Map();
-                for (const f of scanned) {
-                    const vocab = vocabularyFor(f.sourcePath);
-                    if (!vocab)
-                        continue;
-                    const flowLang = FLOW_EXT.find(([re]) => re.test(f.sourcePath))?.[1];
-                    if (flowLang !== undefined) {
-                        flowLangFiles.set(flowLang, [...(flowLangFiles.get(flowLang) ?? []), f.sourcePath]);
-                        continue;
-                    }
-                    let src;
-                    try {
-                        src = fs.readFileSync(path.join(root, f.sourcePath), 'utf8');
-                    }
-                    catch {
-                        continue;
-                    }
-                    const facts = parser.extractDataFlow(src, f.sourcePath.endsWith('x') ? 'tsx' : 'typescript');
-                    if (facts)
-                        factSet.push({ file: f.sourcePath, facts });
-                }
-                const tsVocab = vocabularyFor('x.ts');
-                const raw = taintDataFlow(factSet, tsVocab);
-                const byFile = new Map();
-                for (const fnd of raw.findings)
-                    byFile.set(fnd.file, [...(byFile.get(fnd.file) ?? []), fnd]);
-                const kept = [];
-                let refuted = 0;
-                for (const [rel, fs2] of byFile) {
-                    const out = await filterFindingsForFile(root, rel, fs2, tsVocab);
-                    kept.push(...out.kept.map((f) => ({ ...f, lane: 'facts+reaching-defs' })));
-                    refuted += out.removed.length;
-                }
-                // @implements A-SPEC-513.1 / A-SPEC-524.1 — the flow-sensitive lane, generalized from
-                // Python-only to every language whose CFG/DDG landed in P2. The judgement engine is
-                // language-agnostic; only the vocabulary is selected per language.
-                const flowLangsAnalysed = [];
-                if (flowLangFiles.size > 0) {
-                    const { parseAst } = require('../cpg/foundation/ast-store');
-                    const { cfgOf, functionsIn } = require('../cpg/foundation/cfg');
-                    const { ddgOf } = require('../cpg/foundation/ddg');
-                    const { flowSensitiveTaint } = require('../rtm/flow-sensitive-taint');
-                    for (const [flowLang, files] of flowLangFiles) {
-                        flowLangsAnalysed.push(flowLang);
-                        for (const rel of files) {
-                            let src;
-                            try {
-                                src = fs.readFileSync(path.join(root, rel), 'utf8');
-                            }
-                            catch {
-                                continue;
-                            }
-                            const vocab = vocabularyFor(rel);
-                            const ast = await parseAst(src, rel);
-                            if (!ast || ast.errorCount > 0)
-                                continue;
-                            for (const fn of functionsIn(ast)) {
-                                const fcfg = cfgOf(ast, fn, src);
-                                if ('unsupported' in fcfg)
-                                    continue;
-                                const fddg = ddgOf(ast, fcfg, fn, src);
-                                if ('unsupported' in fddg)
-                                    continue;
-                                const r = flowSensitiveTaint({ ast, cfg: fcfg, ddg: fddg, source: src, fnName: rel, config: vocab });
-                                for (const f of r.findings)
-                                    kept.push({ ...f, file: rel, lane: 'flow-sensitive' });
-                            }
-                        }
-                    }
-                }
-                return {
-                    ...base,
-                    dataFlow: {
-                        findings: kept,
-                        /** Findings the reaching-definition evidence positively refuted (dead or fully sanitized). */
-                        refutedByReachingDefs: refuted,
-                        limits: [...DATAFLOW_LIMITS],
-                        converged: raw.converged,
-                        truncated: raw.truncated,
-                        /** Which languages this run could actually judge, so a zero is readable. */
-                        languagesAnalysed: [...new Set([factSet.length > 0 ? 'typescript' : null, ...flowLangsAnalysed].filter(Boolean))],
-                    },
-                };
-            }
-            finally {
-                g.close();
-            }
-        },
-        async test_run(a) {
-            // Closes the decision->execution loop: scope -> run -> durable per-A-SPEC EXECUTION evidence
-            // (what the constitution's ART-4 prefers over the syntactic count).
-            const { root, specs, scanned, changedFiles, changedSymbols, changeSource, scopeFallback, anchorImpactedSpecs, changedTestFiles, unresolvedFiles } = await deriveChangedContext(store, a.root, a, 'test_run');
-            // @implements A-SPEC-534.8 — `mutate`: run a T-SPEC's declared `kills` mutations against the
-            // A-SPEC's source and report which SURVIVED (a discriminating-power gap). Selective, opt-in via
-            // the argument; absent → the ordinary run below is untouched.
-            if (a.mutate) {
-                const tspec = specs.find((s) => s.id === a.mutate && s.type === 'T-SPEC');
-                const kills = tspec ? (0, kills_1.parseKills)(tspec.frontmatter) : [];
-                const aspecId = tspec?.dependsOn[0];
-                const anchors = (0, test_scope_1.scanTestAnchors)(root);
-                const coveringFiles = aspecId
-                    ? Object.entries(anchors).filter(([, ids]) => ids.includes(aspecId)).map(([f]) => f) : [];
-                const results = kills.map((m) => {
-                    const src = aspecId ? sourceFileWithMutation(root, aspecId, m.where) : null;
-                    if (!src)
-                        return { mutation: m, applied: false, reason: 'no governed source anchors this A-SPEC and contains `where`' };
-                    const r = (0, mutate_1.runKillsOnFile)(src, m, coveringFiles, (files) => (0, test_runner_1.runJestOutcomes)(files, root));
-                    return { mutation: m, ...r };
-                });
-                const survivors = results.filter((r) => r.verdict === 'survived').map((r) => r.mutation);
-                return { mutate: { tspec: a.mutate, aspec: aspecId, coveringFiles, results, survivors } };
-            }
-            const g = new rtm_graph_1.RtmGraph();
-            let testScope;
-            try {
-                (0, rtm_builder_1.buildRtm)(specs, scanned, g);
-                const scope = (0, scope_1.computeReviewScope)(g, specs, changedSymbols);
-                // @implements A-SPEC-130
-                // Lane 2 widens the impacted set with file-anchor edges the symbol walk cannot see; lanes 3
-                // and the unresolved remainder ride in through extras. A nonempty change set can end in a
-                // scoped run or a full run — never in "nothing to do".
-                const widenedImpacted = [...new Set([...scope.impactedSpecs, ...anchorImpactedSpecs])];
-                // @implements A-SPEC-233 — the architecture axis of `assessRisk` already calls these changes
-                // `hard-hitl`; until now nothing on the test side consumed that verdict, so the most
-                // dangerous change could receive the narrowest run (measured 2026-08-22: tier `unit`, one
-                // test file, against `hard-hitl`).
-                testScope = (0, test_scope_1.computeTestScope)(widenedImpacted, (0, test_scope_1.scanTestAnchors)(root), specs, scope.coverageGaps, undefined, { changedTestFiles, unresolvedFiles, architectureTouched: (0, test_scope_1.architectureGoverningFiles)(changedFiles), obligationGaps: scope.obligationGaps });
-                // @implements A-SPEC-128
-                // No change set means no basis for narrowing. Widening is the same fail-safe direction
-                // computeTestScope already takes when no anchored test resolves — never a silently narrow run.
-                if (scopeFallback === 'full') {
-                    testScope = { ...testScope, tier: 'full', reason: `${changeSource.reason ?? 'no change set'} — cannot narrow safely, full regression` };
-                }
-            }
-            finally {
-                g.close();
-            }
-            const result = (0, test_runner_1.runTestScope)(testScope, root);
-            const anchors = (0, test_scope_1.scanTestAnchors)(root);
-            const executedByAspec = (0, test_evidence_1.computeExecutedByAspec)(result.executedByFile ?? {}, anchors);
-            let head = '';
-            try {
-                head = (0, node_child_process_1.execFileSync)('git', ['-C', root, 'rev-parse', 'HEAD'], { encoding: 'utf8', env: (0, root_1.cleanSubprocessEnv)(), stdio: ['ignore', 'pipe', 'pipe'] }).trim();
-            }
-            catch { /* non-git */ }
-            // Record ONLY an actually-executed, GREEN run (review C4/C7): a red suite must not stand as
-            // coverage evidence at the moment the code is broken, and a no-op run must not overwrite a real
-            // record with a dishonest `passed: true` over an empty result.
-            // @implements A-SPEC-578.4 — read BEFORE the write below replaces it: the calibration window
-            // is "since the previous evidence run", and this line is the only moment that value exists.
-            const previousEvidenceTs = (0, test_evidence_1.readTestEvidence)(root)?.ts;
-            const verified = (0, baseline_1.shouldRecordBaseline)(result);
-            if (verified) {
-                (0, test_evidence_1.writeTestEvidence)(root, { ts: new Date().toISOString(), head, tier: testScope.tier, passed: true, executedByAspec });
-            }
-            // @implements A-SPEC-534.5 — RED-first outcome evidence for ART-8. Recorded UNCONDITIONALLY,
-            // unlike the green-only baseline above: a red-assertion recorded before the code is exactly what
-            // the red→green sequence needs. Append-only, one record per (A-SPEC, outcome) at this HEAD.
-            if (result.outcomeByFile) {
-                (0, test_outcomes_1.appendOutcomes)(root, (0, test_outcomes_1.buildOutcomeRecords)(result.outcomeByFile, anchors, head, new Date().toISOString()));
-            }
-            // @implements A-SPEC-128
-            // The baseline is written under EXACTLY the condition that already gates evidence: a run that
-            // actually executed and passed. A red or skipped run must never become the reference point for
-            // "since the last verified state" — that would silently narrow every later scope against a
-            // state nobody verified.
-            // @implements A-SPEC-578.4 — close the calibration loop on real work.
-            // The window is the PREVIOUS evidence run's timestamp, read before this run overwrote it —
-            // an analysis older than that belonged to a previous slice, and attributing today's changes
-            // to it would be contamination rather than measurement. Its own try: an observation that
-            // could change `passed` would be a gate wearing another name.
-            let calibrationClosed;
-            try {
-                const closed = (0, maintenance_evidence_1.closeOpenArtifacts)(path.join(root, maintenance_evidence_1.EVIDENCE_DIR), { files: changedFiles }, new Date().toISOString(), previousEvidenceTs).closed;
-                if (closed.length > 0)
-                    calibrationClosed = closed;
-            }
-            catch { /* the loop is observation; it never touches the verdict */ }
-            // @implements A-SPEC-128
-            let baseline;
-            if (verified) {
-                baseline = a.mark ?? DEFAULT_BASELINE;
-                // A-SPEC-256.2 round-4 — surfaced to the report below
-                const ig = (0, ignore_1.loadIgnore)(root); // parse .gitignore ONCE, not per file (round-10)
-                (0, baseline_1.writeBaseline)(root, baseline, (0, change_source_1.hashTree)(root, { isIgnored: (p) => ig.isIgnored(p) }));
-            }
-            return { tier: testScope.tier, mode: result.mode, passed: result.passed, skipped: result.skipped,
-                ranFiles: result.ranFiles, executedByAspec, tail: result.tail,
-                // @implements A-SPEC-130 — the remediation rides in the answer: these are the files to anchor.
-                unresolvedFiles: testScope.unresolvedFiles,
-                changeSource, ...(scopeFallback ? { scopeFallback } : {}), ...(baseline ? { baselineRecorded: baseline } : {}),
-                ...(calibrationClosed ? { calibrationClosed } : {}) };
-        },
-        async issue_localize(a) {
-            assertSpecStoreReachable('issue_localize', store, a.root); // @implements A-SPEC-419
-            // N1: deterministic localization report — CPG lexical match fused with the RTM spec hop.
-            // @implements A-SPEC-189 §14 (round 13) — `projectRootOf(a.root)` was called as a bare
-            // statement: its only effect was to throw on a bad path, and the advertised contract ("a
-            // subdirectory resolves up to it") was dropped on the floor. `taint_scan` one function away
-            // honours it, so the same argument answered about two different trees depending on which tool
-            // was asked. Bind the derivation and use it.
-            const root = projectRootOf(a.root);
-            const scanned = cachedScan(root, root);
-            const specs = await store.list();
-            const governed = (0, spec_types_1.filterGoverned)(specs);
-            const report = (0, localize_1.localizeIssue)(a.issue, scanned, governed, a.topN ?? 10);
-            // @implements A-SPEC-496 — parity with A-SPEC-478: the SAME uncited gate, the SAME math
-            // (cached vectors only, set fixed, covered hits move, why-line attached). Any missing
-            // signal — no tier, no key, cold cache, embed failure — leaves the report untouched;
-            // localization itself never fails because of the semantic layer.
-            //
-            // A spec-intent-vector assist (REQ-568 S3) was wired ahead of localizeIssue here and REVERTED
-            // on its pre-registered replay — see rtm/localize.ts at the matchedSpecs join for the numbers.
-            try {
-                if (report.hits.length > 1
-                    && (0, localize_1.citationsIn)(a.issue, new Set(governed.map((s) => s.id))).cited.length === 0) {
-                    const rt = (0, embedder_1.makeTierEmbedder)((0, tier_1.resolveSemanticTier)(), new vector_cache_1.VectorCache(root));
-                    if (rt !== null) {
-                        const qv = await rt.embedQuery(a.issue);
-                        const docTextOf = new Map(scanned.map((f) => [f.sourcePath,
-                            (f.sourcePath + ' ' + f.symbols.map((sy) => sy.qualifiedName).join(' ')).slice(0, 2000)]));
-                        (0, hit_rerank_1.rerankHitsBySemantic)(report.hits, qv, (file) => {
-                            const dt = docTextOf.get(file);
-                            return dt !== undefined ? rt.cachedDocVector(dt) : null;
-                        }, rt.label);
-                    }
-                }
-            }
-            catch { /* semantic layer is additive — never block the report */ }
-            return report;
-        },
-        async maintenance_analyze(a) {
-            const foreign = foreignRootReason(store, a.root);
-            if (foreign)
-                throw new HandlerRefusal(foreign);
-            const root = projectRootOf(a.root);
-            // This tool is advertised as read-only. Do not attach ScanFileCache: its normal save/prune
-            // behavior mutates `.ax/cpg_cache` even though the analysis itself is observational.
-            const scanner = new cpg_scanner_1.CpgScanner();
-            const scanned = scanner.scan(root, root);
-            const skipped = scanner.scanSkipped();
-            const specs = (0, spec_types_1.filterGoverned)(await store.list());
-            const anchors = (0, test_scope_1.scanTestAnchors)(root);
-            const detail = basisFor(root, true);
-            let head = '';
-            try {
-                head = (0, node_child_process_1.execFileSync)('git', ['-C', root, 'rev-parse', 'HEAD'], { encoding: 'utf8', env: (0, root_1.cleanSubprocessEnv)(), stdio: ['ignore', 'pipe', 'pipe'] }).trim();
-            }
-            catch { /* non-git */ }
-            const supportedExtensions = new Set(cpg_scanner_1.SCANNABLE_EXTENSIONS);
-            const knownCodeExtensions = new Set(['.rb', '.php', '.kt', '.kts', '.swift', '.scala', '.sh', '.ex', '.exs', '.lua', '.r']);
-            const unsupportedLanguages = new Set();
-            try {
-                const files = (0, node_child_process_1.execFileSync)('git', ['-C', root, 'ls-files', '-z', '--cached', '--others', '--exclude-standard'], { encoding: 'utf8', env: (0, root_1.cleanSubprocessEnv)(), maxBuffer: 8 * 1024 * 1024 }).split('\0');
-                for (const file of files) {
-                    const ext = path.extname(file).toLowerCase();
-                    if (knownCodeExtensions.has(ext) && !supportedExtensions.has(ext))
-                        unsupportedLanguages.add(ext);
-                }
-            }
-            catch {
-                // A non-git tree cannot be enumerated cheaply without reimplementing the scanner's ignore
-                // rules. Surface the missing axis rather than claiming every language was covered.
-                unsupportedLanguages.add('not-enumerated(non-git)');
-            }
-            const graph = new rtm_graph_1.RtmGraph();
-            try {
-                // @implements A-SPEC-292 — the resolution loop's own tally of what it declined to link.
-                const { resolution } = (0, rtm_builder_1.buildRtm)(specs, scanned, graph);
-                // @implements A-SPEC-293 — what constrains this change, not just what it touches.
-                const { decisions, citations } = collectDecisions(root, scanned, specs);
-                (0, rtm_builder_1.addDecisionEdges)(decisions, citations, graph);
-                const common = {
-                    request: a.request,
-                    scanned,
-                    specs,
-                    graph,
-                    testAnchors: anchors,
-                    basis: {
-                        head,
-                        loadedBuild: detail.loadedBuild,
-                        diskBuild: detail.diskBuild ?? 'unknown',
-                        specFingerprint: `count:${specs.length}/fp:${detail.specs ?? 'unknown'}`,
-                    },
-                    changedFiles: a.changedFiles,
-                    // @implements A-SPEC-290 — the stored run record. Freshness is judged inside the analysis
-                    // against its own basis, so a record from another commit is reported as stale rather than
-                    // quietly used.
-                    runtimeEvidence: (0, test_evidence_1.readTestEvidence)(root),
-                    resolution,
-                    coverage: {
-                        scannedFiles: scanned.length,
-                        skippedFiles: skipped.map((entry) => entry.file),
-                        unsupportedLanguages: [...unsupportedLanguages],
-                        historyStatus: 'not-requested',
-                    },
-                };
-                // @implements A-SPEC-478 — resolve the tier and precompute the query vector at the
-                // async edge; the sync analysis receives only a closure over cached vectors. Any failure
-                // (no tier, no module, no key, embed error) leaves `semantic` undefined = today's behavior.
-                let semantic;
-                try {
-                    const rt = (0, embedder_1.makeTierEmbedder)((0, tier_1.resolveSemanticTier)(), new vector_cache_1.VectorCache(root));
-                    if (rt !== null) {
-                        const qv = await rt.embedQuery(a.request);
-                        semantic = { label: rt.label, queryVector: qv, cachedDocVector: rt.cachedDocVector };
-                    }
-                }
-                catch { /* the hot path never breaks on the semantic layer */ }
-                const preliminary = (0, maintenance_analyze_1.analyzeMaintenance)({ ...common, history: [], semantic });
-                const candidateFiles = preliminary.candidates.map((candidate) => candidate.file);
-                const limit = Math.max(0, Math.min(100, Math.floor(a.historyLimit ?? 20)));
-                const history = [];
-                let historyStatus = limit === 0 || candidateFiles.length === 0 ? 'not-requested' : 'unavailable';
-                if (limit > 0 && candidateFiles.length > 0) {
-                    try {
-                        const raw = (0, node_child_process_1.execFileSync)('git', ['-C', root, 'log', `-${limit}`, '--date=short', '--format=%H%x00%ad%x00%s', '--name-only', '--', ...candidateFiles], { encoding: 'utf8', env: (0, root_1.cleanSubprocessEnv)(), maxBuffer: 2 * 1024 * 1024 });
-                        let current = null;
-                        for (const line of raw.split('\n')) {
-                            if (line.includes('\0')) {
-                                const [commit, date, subject] = line.split('\0');
-                                current = { commit, date, subject, files: [] };
-                                history.push(current);
-                            }
-                            else if (current && line.trim() !== '') {
-                                // git C-quotes any non-ASCII pathname here (core.quotepath). Left raw, it never
-                                // matched a candidate file, so the rationale came back empty while historyStatus
-                                // still reported `available` — a silent false negative with confident provenance.
-                                current.files.push((0, maintenance_analyze_1.unquoteGitPath)(line.trim()));
-                            }
-                        }
-                        historyStatus = 'available';
-                    }
-                    catch { /* history is evidence enrichment, not a prerequisite */ }
-                }
-                // Preserve localization rank for context: `impacts.direct` is deliberately sorted for a
-                // stable evidence contract, but sorting is not relevance. Seeding from it once selected a
-                // lexically earlier vendored symbol while the first ranked hit correctly named live code.
-                const directSeed = preliminary.candidates
-                    .flatMap((candidate) => candidate.symbols)
-                    .flatMap((qualifiedName) => graph.codeNodeIds(qualifiedName))[0];
-                const specSeed = preliminary.candidateSpecs.find((id) => id.startsWith('A-SPEC-'));
-                const seedId = directSeed ?? (specSeed ? `SPEC:${specSeed}` : undefined);
-                const budget = Math.max(100, Math.min(10_000, Math.floor(a.contextBudget ?? 2_000)));
-                const contextBundle = seedId
-                    ? new bundler_1.ContextBundler(graph, buildContentSource(specs, scanned)).getContextBundle(seedId, budget)
-                    : null;
-                // @implements A-SPEC-378
-                // Change recency over a WIDE window and ALL files — the enrichment history above is
-                // deliberately narrow (candidate files, 20 commits) and cannot serve as a prior: a file the
-                // lexical layer never ranked has no history there, which is precisely the file recency is
-                // supposed to promote. Failure is silent and total: no prior means the previous ranking,
-                // never a partial one, because a prior built from half the history would reorder on evidence
-                // nobody could audit.
-                const changePrior = {};
-                try {
-                    const prior = (0, temporal_prior_1.temporalPrior)(root, 'HEAD', 300);
-                    for (const [file, age] of prior.recency)
-                        changePrior[file] = 1 + Math.pow(0.5, age / 10);
-                }
-                catch { /* no history, no prior — the ranking falls back to lexical evidence alone */ }
-                // @implements A-SPEC-388
-                // What each file's commits have SAID, normalised to 0..1. Measured on history sampled away
-                // from the benchmarker's own recent work (A-SPEC-387): Top-1 0.244 -> 0.333 here and 0.400 ->
-                // 0.500 on a second repository, Top-10 recall 0.393 -> 0.601 there. Precision falls on both,
-                // and that is the trade, not a footnote to it.
-                const commitTextBoost = {};
-                try {
-                    const profile = (0, commit_text_1.commitTextProfile)(root, 'HEAD', 400);
-                    const ranked = (0, commit_text_1.rankByCommitText)(a.request, profile, 300);
-                    const top = ranked[0]?.score ?? 0;
-                    if (top > 0)
-                        for (const hit of ranked)
-                            commitTextBoost[hit.file] = hit.score / top;
-                }
-                catch { /* no history, no boost — the ranking falls back to lexical evidence alone */ }
-                const analyzeWith = (defUse) => (0, maintenance_analyze_1.analyzeMaintenance)({
-                    semantic,
-                    ...common,
-                    coverage: { ...common.coverage, historyStatus },
-                    history,
-                    changePrior,
-                    commitTextBoost,
-                    contextBundle,
-                    groundTruth: a.groundTruth,
-                    defUse,
-                });
-                // @implements A-SPEC-573.4 — def-use for the TOP CANDIDATES ONLY. Extracting it for the whole
-                // repository costs +88.8% (measured 2026-09-08), well past this slice's budget; the first pass
-                // says which handful of files are worth parsing, and the second pass reads their data flow.
-                // Every step is fail-open: a parse failure, an unsupported language or a missing file leaves
-                // the candidate's symbols exactly as the first pass produced them.
-                const firstPass = analyzeWith();
-                const analysis = (() => {
-                    const targets = firstPass.candidates.slice(0, defuse_bound_1.DEFUSE_TOP_FILES).map((c) => c.file);
-                    if (targets.length === 0)
-                        return firstPass;
-                    const defUse = {};
-                    try {
-                        const { TreeSitterTsParser, hasDataFlowWalk } = require('../cpg/language-parser');
-                        const { langForPath } = require('../cpg/cpg-scanner');
-                        const parser = new TreeSitterTsParser();
-                        for (const file of targets) {
-                            try {
-                                // The LANGUAGE matters: the first wiring omitted it and parsed Python as TypeScript,
-                                // which produced wrong facts and cost the second corpus 0.2376 -> 0.1741 on the
-                                // symbol axis. A language with no walk is skipped rather than guessed at.
-                                const lang = langForPath(file);
-                                if (!hasDataFlowWalk(lang))
-                                    continue;
-                                const facts = parser.extractDataFlow(fs.readFileSync(path.join(root, file), 'utf8'), lang);
-                                if (facts !== undefined)
-                                    defUse[file] = facts;
-                            }
-                            catch { /* one unreadable or unparseable file must not cost the other nine */ }
-                        }
-                    }
-                    catch {
-                        return firstPass;
-                    }
-                    return Object.keys(defUse).length === 0 ? firstPass : analyzeWith(defUse);
-                })();
-                // @implements A-SPEC-268 — persistence is OPT-IN. The tool is advertised read-only, and a
-                // regression pins that a cold project gains no `.ax/cpg_cache`; writing evidence by default
-                // would break that contract for every caller who only wanted to look.
-                // One shape either way: `persistedTo` is present-or-undefined rather than a union, so a
-                // caller never has to narrow the result to ask whether anything was written.
-                const result = { ...analysis };
-                // @implements A-SPEC-418 — first line, because everything below it was computed without specs.
-                const blind = specStoreBlindReason(store, root, specs.length);
-                if (blind !== null)
-                    result.unknowns = [blind, ...result.unknowns];
-                if (a.persist) {
-                    // @implements A-SPEC-277 — record WHAT WAS ANALYSED, not just which paths. HEAD cannot see
-                    // an uncommitted edit to the analysed file; a content digest can.
-                    const fileDigests = {};
-                    for (const file of analysis.impacts.files) {
-                        const digest = fileDigestOf(root, file);
-                        if (digest)
-                            fileDigests[file] = digest;
-                    }
-                    // The artifact takes the WHOLE analysis, never the bounded one below: a file has no
-                    // context window, and the calibration that scores this prediction must score what the
-                    // product actually predicted.
-                    result.persistedTo = (0, maintenance_evidence_1.writeArtifact)(path.join(root, maintenance_evidence_1.EVIDENCE_DIR), (0, maintenance_evidence_1.artifactFrom)(analysis, new Date().toISOString(), fileDigests));
-                }
-                // @implements A-SPEC-578.5 — the response, and only the response, is bounded. Measured
-                // 2026-09-09: the full shape is 187,174 characters (~47k tokens) and the harness refuses
-                // it, which is why AGENTS.md step 3 had never once been obeyed with `persist: true`.
-                // `persistedTo` rides along so the caller knows where the whole thing is.
-                const bounded = (0, maintenance_analyze_1.boundAnalysis)(result);
-                if (JSON.stringify(bounded).length !== JSON.stringify(result).length)
-                    bounded.bounded = true;
-                return bounded;
-            }
-            finally {
-                graph.close();
-            }
-        },
-        // @implements A-SPEC-268
-        async maintenance_outcome(a) {
-            const foreign = foreignRootReason(store, a.root);
-            if (foreign)
-                throw new HandlerRefusal(foreign);
-            const root = projectRootOf(a.root);
-            return (0, maintenance_evidence_1.recordOutcome)(path.join(root, maintenance_evidence_1.EVIDENCE_DIR), a.digest, {
-                actualFiles: a.actualFiles,
-                actualSymbols: a.actualSymbols,
-                actualTests: a.actualTests,
-                actualClassification: a.actualClassification,
-            }, new Date().toISOString());
-        },
-        // @implements A-SPEC-277
-        async impact_gate_check(a) {
-            const foreign = foreignRootReason(store, a.root);
-            if (foreign)
-                throw new HandlerRefusal(foreign);
-            const root = projectRootOf(a.root);
-            let head = '';
-            try {
-                head = (0, node_child_process_1.execFileSync)('git', ['-C', root, 'rev-parse', 'HEAD'], { encoding: 'utf8', env: (0, root_1.cleanSubprocessEnv)(), stdio: ['ignore', 'pipe', 'pipe'] }).trim();
-            }
-            catch { /* non-git */ }
-            let artifact = null;
-            if (a.digest) {
-                const file = path.join(root, maintenance_evidence_1.EVIDENCE_DIR, (0, maintenance_evidence_1.digestFilename)(a.digest));
-                // A digest naming an artifact this project never stored is NOT the same as no evidence at
-                // all — say which one happened rather than collapsing both into "refused".
-                if (!fs.existsSync(file))
-                    throw new HandlerRefusal(`이 프로젝트에 저장된 분석이 아닙니다: ${a.digest}`);
-                artifact = JSON.parse(fs.readFileSync(file, 'utf8'));
-            }
-            return (0, impact_gate_1.evaluateEditEvidence)({
-                target: a.target.replace(/\\/g, '/'),
-                artifact,
-                currentHead: head,
-                currentTargetDigest: fileDigestOf(root, a.target),
-            });
-        },
-        // @implements A-SPEC-268
-        async maintenance_calibration(a) {
-            const foreign = foreignRootReason(store, a.root);
-            if (foreign)
-                throw new HandlerRefusal(foreign);
-            const root = projectRootOf(a.root);
-            const read = (0, maintenance_evidence_1.readArtifacts)(path.join(root, maintenance_evidence_1.EVIDENCE_DIR));
-            // Corrupt and off-schema records travel WITH the score. A calibration that quietly dropped
-            // them would report a clean number over an unstated subset of the evidence.
-            return {
-                ...(0, maintenance_evidence_1.computeCalibration)(read.artifacts, { minSamples: a.minSamples }),
-                artifacts: read.artifacts.length,
-                unreadable: read.unreadable,
-                skippedSchema: read.skippedSchema,
-            };
-        },
-        async rtm_impact(a) {
-            assertSpecStoreReachable('rtm_impact', store, a.root); // @implements A-SPEC-433
-            // @implements A-SPEC-189 §14 (round 13) — `projectRootOf(a.root)` was called as a bare
-            // statement: its only effect was to throw on a bad path, and the advertised contract ("a
-            // subdirectory resolves up to it") was dropped on the floor. `taint_scan` one function away
-            // honours it, so the same argument answered about two different trees depending on which tool
-            // was asked. Bind the derivation and use it.
-            const root = projectRootOf(a.root);
-            const scanned = cachedScan(root);
-            // @implements A-SPEC-569.2 — the impact/advisory graph is APPROVED-ONLY. A draft needs no
-            // approval to exist, and the 0.16.0 adversarial round showed one reaching the agent-visible
-            // channels (impacted closure, advisory anchor summaries) — the trust boundary for those
-            // channels is the act of approval. NOT filterGoverned: that predicate passes drafts (it only
-            // drops outdated/legacy), which is exactly what let this in. Diagnosis (rtm_check) and
-            // matching (issue_localize / maintenance_analyze) keep their own populations — the replay
-            // pins were measured on them.
-            const specs = (await store.list()).filter((s) => s.status === 'approved');
-            // @implements A-SPEC-283
-            // Reuse the persisted graph when its basis still holds. Measured: on the warm path the graph
-            // build is ~81% of the cost and reopening is ~0ms. `scanDigest` is the field that makes this
-            // safe — an uncommitted edit never moves HEAD, so a commit-only basis would happily serve a
-            // graph describing content the working tree no longer has.
-            let head = '';
-            try {
-                head = (0, node_child_process_1.execFileSync)('git', ['-C', root, 'rev-parse', 'HEAD'], { encoding: 'utf8', env: (0, root_1.cleanSubprocessEnv)(), stdio: ['ignore', 'pipe', 'pipe'] }).trim();
-            }
-            catch { /* non-git */ }
-            const opened = (0, graph_store_1.openReusableGraph)(path.join(root, '.ax', 'rtm.sqlite'), {
-                graphSchema: RTM_GRAPH_SCHEMA,
-                extractorVersion: RTM_EXTRACTOR_VERSION,
-                sourceCommit: head,
-                specFingerprint: (0, graph_store_1.specFingerprint)(specs),
-                scanDigest: (0, graph_store_1.scanDigest)(scanned),
-            });
-            const g = opened.graph;
-            try {
-                if (!opened.reusable) {
-                    (0, rtm_builder_1.buildRtm)(specs, scanned, g);
-                    opened.commitBasis();
-                }
-                // explainImpact, not impactedBy: the bounds and the breadth signal must reach the caller.
-                // An impact set is not just a list — a broad one means "review the contract", and a consumer
-                // that cannot tell the difference will try to bundle two hundred call sites.
-                const { specs: impactedRaw, reachedByDepth, stoppedAt, seedIsHub } = (0, rtm_builder_1.explainImpact)(g, a.changed);
-                // @implements A-SPEC-569.2 — the closure walks EDGES, and an implements edge is owned by
-                // the code file, so an anchor naming a draft (or a spec nobody wrote) still emits one —
-                // deliberately, for rtm_check's dangling diagnosis. The CHANNEL filter is node existence:
-                // approved-only specs were given nodes above, so only sealed intent reaches the caller.
-                const impacted = impactedRaw.filter((id) => g.hasNode(id));
-                // @implements A-SPEC-469 — the graded FILE surface beside the spec closure, same code path
-                // as the S-484 measurement (identity, not reimplementation). Seeds are the changed symbols'
-                // nodes; the files that own them are excluded — a prediction naming the change itself is
-                // vacuously true. The closure fields above stay exactly as they were: mass never enters a
-                // gate decision.
-                const riSeeds = new Map(a.changed.flatMap((qn) => g.codeNodeIds(qn)).map((id) => [id, 1]));
-                const riExclude = new Set([...riSeeds.keys()]
-                    .map((id) => (id.includes('@') ? id.slice(id.lastIndexOf('@') + 1) : ''))
-                    .filter((f) => f !== ''));
-                const rankedImpact = (0, assoc_arm_1.pprImpactRanked)((0, assoc_arm_1.graphViewOf)(g.dumpCanonical()), riSeeds, riExclude, assoc_arm_1.RANKED_IMPACT_K, assoc_arm_1.RANKED_IMPACT_CONFIG);
-                // @implements A-SPEC-568.2 — the intent sentence beside every impacted spec id, same order
-                // as `impacted` (which stays a bare id list for its existing consumers). Information only:
-                // nothing reads it back into the walk, the ranking or any gate.
-                // @implements A-SPEC-569.3 — capped: measured on this repository, uncapped summaries were
-                // 94% of a 104,706-byte response (a hub-grade impact of 339 specs). The omission is COUNTED,
-                // never silent, and `impacted` itself stays complete — only the annotation is bounded.
-                const shownSummaries = impacted.slice(0, SUMMARY_CAP);
-                const impactedSummaries = shownSummaries.map((id) => {
-                    let summary = null;
-                    try {
-                        summary = g.summaryOf(id);
-                    }
-                    catch { /* summary stays null */ }
-                    return { id, summary };
-                });
-                const summariesOmitted = impacted.length - shownSummaries.length;
-                return {
-                    impacted,
-                    impactedSummaries,
-                    ...(summariesOmitted > 0 ? { summariesOmitted } : {}),
-                    rankedImpact,
-                    reachedByDepth,
-                    bounded: stoppedAt.length > 0 ? stoppedAt.slice(0, 20) : undefined,
-                    ...(seedIsHub ? {
-                        breadthWarning: `a changed symbol has ${seedIsHub.callers} callers (hub threshold ${seedIsHub.threshold}) — this is a CONTRACT change; review the contract and its tests rather than bundling every impacted spec`,
-                    } : {}),
-                };
-            }
-            finally {
-                g.close(); // release native SQLite handle even if build/query throws
-            }
-        },
-        async rtm_reindex(a) {
-            assertSpecStoreReachable('rtm_reindex', store, a.root); // @implements A-SPEC-419
-            // Removal/re-derivation of changedFiles/changedSymbols is not needed
-            // here (rtm_reindex works off changes/specs/scanned/bySourcePath
-            // directly), but the guard+diff+scan prologue is identical to
-            // review_scope/review_prepare — see deriveChangedContext.
-            const { root, changes, specs, scanned, bySourcePath, changeSource } = await deriveChangedContext(store, a.root, a, 'rtm_reindex');
-            const changed = changes.added.length + changes.modified.length + changes.deleted.length + changes.renamed.length;
-            const scanOne = (relPath) => bySourcePath.get(relPath) ?? null;
-            // HashCache skip: for add/modify entries, if the file's current content
-            // hash matches what's on record, the file is dropped from the set
-            // handed to applyIncremental — its subgraph is left untouched rather
-            // than being torn down and rebuilt for no reason (e.g. a spurious
-            // `git diff` entry, a mode-only change, or a re-run over the same
-            // range). Deletes and renames are always applied: a delete has no
-            // "content" to compare, and a rename's `from` side must be removed
-            // regardless of whether `to`'s content matches something previously
-            // hashed under a different path.
-            const cache = new hash_cache_1.HashCache(cacheDirFor(root)); // @implements A-SPEC-128 — project-root cache, no subdir leak
-            const skipUnchanged = (files) => files.filter((relPath) => {
-                let content;
-                try {
-                    content = fs.readFileSync(path.join(root, relPath), 'utf8');
-                }
-                catch {
-                    return true; // unreadable (e.g. already gone) — let applyIncremental/scanOne handle it
-                }
-                if (cache.unchanged(relPath, content))
-                    return false; // skip: content identical to last recorded hash
-                cache.put(relPath, content);
-                return true;
-            });
-            const changesToApply = {
-                added: skipUnchanged(changes.added),
-                modified: skipUnchanged(changes.modified),
-                deleted: changes.deleted,
-                renamed: changes.renamed,
-            };
-            let head = '';
-            try {
-                head = (0, node_child_process_1.execFileSync)('git', ['-C', root, 'rev-parse', 'HEAD'], { encoding: 'utf8', env: (0, root_1.cleanSubprocessEnv)(), stdio: ['ignore', 'pipe', 'pipe'] }).trim();
-            }
-            catch { /* non-git */ }
-            const graphPath = path.join(root, '.ax', 'rtm.sqlite');
-            const tempGraphPath = `${graphPath}.tmp-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
-            const opened = (0, graph_store_1.openReusableGraph)(tempGraphPath, {
-                graphSchema: RTM_GRAPH_SCHEMA,
-                extractorVersion: RTM_EXTRACTOR_VERSION,
-                sourceCommit: head,
-                specFingerprint: (0, graph_store_1.specFingerprint)(specs),
-                scanDigest: (0, graph_store_1.scanDigest)(scanned),
-            });
-            const g = opened.graph;
-            let result;
-            try {
-                // Explicit reindex is a persistence operation: discard the previous contents, rebuild the
-                // complete graph, then commit the matching basis before releasing the file (A-SPEC-589).
-                g.clear();
-                (0, rtm_builder_1.buildRtm)(specs, scanned, g);
-                // Scaffold note: `g` was just full-built at HEAD, so applying the
-                // diff on top of it is currently an idempotent no-op in practice
-                // (the affected subgraphs are already correct). This call exists to
-                // exercise/validate the incremental machinery end-to-end now, ahead
-                // of a FUTURE persisted-graph reindex — build the graph once, then
-                // apply diffs across calls without a full rebuild — that will
-                // actually depend on this path being correct. Not load-bearing today.
-                // @implements A-SPEC-280 — the whole scan, so call edges are re-resolved and the reindexed
-                // graph equals what a full rebuild would have produced. Measured: without this, rtm_reindex
-                // returned a graph with no call edges at all.
-                (0, incremental_1.applyIncremental)(g, changesToApply, { repoRoot: root, specs, scanOne, allScanned: () => scanned });
-                opened.commitBasis();
-                // @implements A-SPEC-478 — the semantic cache WARMING lives here, in the explicit heavy
-                // operation, so the ranking hot path only ever LOOKS UP vectors. Idempotent through the
-                // cache; a tier of none (the shipped default) computes nothing.
-                let semanticWarm;
-                try {
-                    const tier = (0, tier_1.resolveSemanticTier)();
-                    const rt = (0, embedder_1.makeTierEmbedder)(tier, new vector_cache_1.VectorCache(root));
-                    if (rt !== null) {
-                        const docTexts = scanned.map((f) => (f.sourcePath + ' ' + f.symbols.map((sy) => sy.qualifiedName).join(' ')).slice(0, 2000));
-                        const w = await rt.warm(docTexts);
-                        semanticWarm = { tier: rt.label, ...w };
-                    }
-                }
-                catch { /* warming is best-effort; reindex's own result is unaffected */ }
-                result = { changed, nodes: g.nodeCount(), edges: g.edgeCount(), changeSource,
-                    ...(semanticWarm !== undefined ? { semanticWarm } : {}) };
-            }
-            finally {
-                g.close(); // release native SQLite handle even if build/apply throws
-            }
-            // Publish only after the complete temporary graph is closed. Rename the old file aside so a
-            // Windows reader either keeps the old complete graph or sees the new complete graph; it never
-            // observes a partially built database or a basis that belongs to another file (A-SPEC-589).
-            const backupPath = `${graphPath}.bak-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
-            const hadOld = fs.existsSync(graphPath);
-            try {
-                if (hadOld)
-                    fs.renameSync(graphPath, backupPath);
-                fs.renameSync(tempGraphPath, graphPath);
-                if (hadOld)
-                    fs.rmSync(backupPath, { force: true });
-            }
-            catch (error) {
-                try {
-                    if (!fs.existsSync(graphPath) && fs.existsSync(backupPath))
-                        fs.renameSync(backupPath, graphPath);
-                }
-                catch { /* preserve the publication error; the old path is reported as unavailable */ }
-                throw error;
-            }
-            finally {
-                try {
-                    fs.rmSync(tempGraphPath, { force: true });
-                }
-                catch { /* already renamed or retained for diagnosis */ }
-            }
-            return result;
-        },
-        async context_bundle(a) {
-            assertSpecStoreReachable('context_bundle', store, a.root); // @implements A-SPEC-433
-            const foreign = foreignRootReason(store, a.root);
-            if (foreign)
-                throw new HandlerRefusal(foreign);
-            const root = projectRootOf(a.root);
-            const specs = await store.list();
-            const scanned = cachedScan(root, root);
-            const content = buildContentSource(specs, scanned);
-            const g = new rtm_graph_1.RtmGraph();
-            try {
-                (0, rtm_builder_1.buildRtm)(specs, scanned, g);
-                return new bundler_1.ContextBundler(g, content).getContextBundle(a.seedId, a.budget);
-            }
-            finally {
-                g.close(); // release native SQLite handle even if bundling throws
-            }
-        },
-        async review_scope(a) {
-            assertSpecStoreReachable('review_scope', store, a.root); // @implements A-SPEC-419
-            // Guard+diff+scan+changedFiles/changedSymbols prologue: see
-            // deriveChangedContext (shared with review_prepare/rtm_reindex).
-            const { root, specs, scanned, changedFiles, changedSymbols, changeSource, scopeFallback, anchorImpactedSpecs, changedTestFiles, unresolvedFiles } = await deriveChangedContext(store, a.root, a, 'review_scope');
-            const g = new rtm_graph_1.RtmGraph();
-            try {
-                (0, rtm_builder_1.buildRtm)(specs, scanned, g);
-                const scope = (0, scope_1.computeReviewScope)(g, specs, changedSymbols);
-                // Intelligent regression test-scope (target-arch §5). Test files are scanned SEPARATELY for
-                // their @implements anchors (the CPG scan excludes tests), coverage gaps feed the safety
-                // fallback, and impactedSpecs are the graph's SPEC:-prefixed ids (stripped inside).
-                // @implements A-SPEC-130 — the same widened set as test_run, so review packaging and test
-                // scoping cannot disagree about what a change touches.
-                const widenedImpacted = [...new Set([...scope.impactedSpecs, ...anchorImpactedSpecs])];
-                const testScope = (0, test_scope_1.computeTestScope)(widenedImpacted, (0, test_scope_1.scanTestAnchors)(root), specs, scope.coverageGaps, undefined, { changedTestFiles, unresolvedFiles, architectureTouched: (0, test_scope_1.architectureGoverningFiles)(changedFiles), obligationGaps: scope.obligationGaps });
-                // Honest signal (REQ-124 gate 2a): which changed files the CpgScanner
-                // did NOT ingest (e.g. non-.ts files), computed from the same
-                // changedFiles/scanned already derived above — no new git/scan calls.
-                const { unscanned: unscannedChangedFiles } = (0, coverage_1.partitionChangedFiles)(changedFiles, scanned.map((f) => f.sourcePath));
-                return { ...scope, unscannedChangedFiles, testScope, changeSource, ...(scopeFallback ? { scopeFallback } : {}) };
-            }
-            finally {
-                g.close(); // release native SQLite handle even if scope computation throws
-            }
-        },
-        async review_prepare(a) {
-            assertSpecStoreReachable('review_prepare', store, a.root); // @implements A-SPEC-419
-            // Guard+diff+scan+changedFiles/changedSymbols prologue: see
-            // deriveChangedContext (shared with review_scope/rtm_reindex).
-            const { root, specs, scanned, changedFiles, changedSymbols, changeSource, scopeFallback } = await deriveChangedContext(store, a.root, a, 'review_prepare');
-            // ContentSource factory shared with context_bundle: see buildContentSource.
-            const content = buildContentSource(specs, scanned);
-            const g = new rtm_graph_1.RtmGraph();
-            try {
-                (0, rtm_builder_1.buildRtm)(specs, scanned, g);
-                const pkg = (0, package_1.assembleReviewPackage)(g, specs, changedSymbols, content, a.budget ?? 4000);
-                // Honest signal (REQ-124 gate 2a): which changed files the CpgScanner
-                // did NOT ingest, computed from the same changedFiles/scanned already
-                // derived above — no new git/scan calls.
-                const { unscanned: unscannedChangedFiles } = (0, coverage_1.partitionChangedFiles)(changedFiles, scanned.map((f) => f.sourcePath));
-                return { package: pkg, unscannedChangedFiles, changeSource, ...(scopeFallback ? { scopeFallback } : {}) };
-            }
-            finally {
-                g.close(); // release native SQLite handle even if assembly throws
-            }
-        },
-        async review_record(a) {
-            // @implements A-SPEC-189 §8 (round 11) — §15 shut the door the merge gate READS through and
-            // left the one it is WRITTEN through wide open. Measured: `review_record` joined the caller's
-            // `root` straight into a path and created `.ax/ledger/findings.jsonl` in any directory on the
-            // machine, answering `{recorded: N}` — while `review_status`, bound to this server's project,
-            // could never see those findings. An open critical filed at the wrong root is worse than none:
-            // it reads as recorded and gates nothing. The two doors now ask the same question.
-            const foreignWrite = foreignRootReason(store, a.root);
-            if (foreignWrite !== null)
-                throw new HandlerRefusal(`review_record: ${foreignWrite}`);
-            // MCP input is unvalidated JSON: an out-of-enum severity or status
-            // (e.g. a typo like "blocker") would land in the ledger as a stray
-            // value that review_status's counts never match, so it counts toward
-            // neither its own bucket nor `blocked` — a mislabeled critical could
-            // silently pass the gate. Validate up front so the gate's counts stay
-            // trustworthy.
-            const validSeverities = new Set(['critical', 'important', 'minor']);
-            const validStatuses = new Set(['open', 'resolved']);
-            for (const f of a.findings) {
-                if (!validSeverities.has(f.severity)) {
-                    throw new HandlerRefusal(`review_record: finding ${f.id} has invalid severity ${JSON.stringify(f.severity)} (must be one of critical|important|minor)`);
-                }
-                if (!validStatuses.has(f.status)) {
-                    throw new HandlerRefusal(`review_record: finding ${f.id} has invalid status ${JSON.stringify(f.status)} (must be one of open|resolved)`);
-                }
-            }
-            // @implements A-SPEC-191 (§4e) — the ledger's meaning is guarded at RECORD time, where the
-            // collision actually happens. Measured: conventional ids (C1…) recur across review rounds, so
-            // one round's resolve of "C1" silently lifted the gate over ANOTHER round's unfixed critical;
-            // and a severity-downgrade re-open cleared ART-7 with no resolution at all. Both die at one
-            // door: an id whose latest state is open cannot be opened again — resolve first, then
-            // re-record. Lifting an open CRITICAL requires the out-of-band approval channel (ART-5's
-            // principle): the blocked party must not be able to pull its own teeth in-band. A resolved
-            // record for an id never opened lifts nothing and stays approval-free (found-and-fixed audit
-            // records keep working).
-            // The guard and the append hold ONE lock (round-6: the read→judge→append section was a
-            // cross-process TOCTOU — two sessions both recorded open under the same id, silencing an
-            // open critical at both readers; consumeNonceExclusively already earned this discipline).
-            const findingsFile = boundFindingsLedger(store, a.root);
-            // @implements A-SPEC-263.1 — elicitation happens BEFORE the lock: the human may take up to
-            // the wiring's timeout to answer, and holding the findings ledger lock for that long starves
-            // every other writer (the lock callback is synchronous by design). This is a best-effort
-            // PRE-SCAN over an unlocked snapshot: for each finding that LOOKS like an open-critical lift
-            // not covered by env/grant, ask now and carry the grant into the lock as data. TOCTOU folds
-            // fail-closed — state moved so the lift is no longer needed → the grant is simply unused;
-            // state moved so a lift IS needed that the snapshot missed → no grant → the standard refusal.
-            const elicitGrants = new Map();
-            // A DENY at pre-scan is carried as data too (round-1): throwing here judged a stale snapshot —
-            // a finding concurrently resolved by someone else no longer needs a lift inside the lock, and
-            // the human's "no" must not abort a batch that never needed the question. The deny bites only
-            // at the in-lock site, and only if the lift is ACTUALLY needed there.
-            const elicitDenials = new Map();
-            // @implements A-SPEC-497.1 — an expiry is carried as data like a denial: it bites only at the
-            // in-lock refusal site, where it prefixes the standard message so the agent can tell the user
-            // a session dialog died (instead of the anonymous "no approval" the old null-fold produced).
-            const elicitExpiries = new Map();
-            if (opts?.elicit) {
-                try {
-                    const snapshot = new Map();
-                    for (const f of new findings_1.FindingsLedger(findingsFile).list())
-                        snapshot.set(f.id, f);
-                    for (const f of a.findings) {
-                        const last = snapshot.get(f.id);
-                        if (!(f.status === 'resolved' && last?.status === 'open' && last.severity === 'critical'))
-                            continue;
-                        const raw0 = process.env.HOLMES_APPROVAL;
-                        let env0;
-                        try {
-                            env0 = raw0 ? JSON.parse(raw0) : undefined;
-                        }
-                        catch {
-                            env0 = undefined;
-                        }
-                        if (resolveHandlerApproval(a.root, store, env0, { kind: 'review-resolve', target: f.id }, new Date().toISOString()) !== undefined)
-                            continue; // an open door never summons a human
-                        const out = await tryElicit('review-resolve', f.id, `열린 치명 발견 ${f.id} 의 해소 기록`);
-                        if (out.kind === 'answered' && out.decision.granted)
-                            elicitGrants.set(f.id, elicitApproval(out.decision.reason));
-                        else if (out.kind === 'answered')
-                            elicitDenials.set(f.id, out.decision.reason ?? '(사유 없음)');
-                        else if (out.kind === 'expired')
-                            elicitExpiries.set(f.id, out.waitedMs);
-                    }
-                }
-                catch {
-                    // A pre-scan failure is never worse than no channel: fall through with no grants.
-                }
-            }
-            (0, ledger_lock_1.withLedgerLock)(findingsFile, () => {
-                const ledger = new findings_1.FindingsLedger(findingsFile);
-                const latest = new Map();
-                const liftedCriticals = [];
-                const envLiftedCriticals = []; // lifts the ENV approval authorized (round-1: nonce charges only these)
-                const grantConsumptions = []; // spent AFTER the batch validates (round-2)
-                const elicitationLifts = []; // ledgered per lift (round-5: the promised audit trace)
-                for (const f of ledger.list())
-                    latest.set(f.id, f);
-                for (const f of a.findings) {
-                    if (!f.id || !f.id.trim()) {
-                        throw new HandlerRefusal('review_record: finding id 가 비어 있습니다 — 모든 발견은 원장에서 유일하게 식별될 id 가 필요합니다');
-                    }
-                    // Round-5: pre-round-4 ads declared `message`, but the ledger whitelist persists only
-                    // `summary` — clients following the OLD ad lost their text with zero signal. A pointed
-                    // refusal turns that silent loss into the one-line fix it needs.
-                    // Round-9: `=== undefined` let `summary: null` through, so the ledger dropped the text
-                    // and the caller saw success — the very silence this guard exists to end. Absence is
-                    // null OR undefined here, as everywhere else in this validator's vocabulary.
-                    if ('message' in f && (f.summary === undefined || f.summary === null)) {
-                        throw new HandlerRefusal(`review_record: finding ${f.id} 의 message 는 폐지된 광고 키입니다 — 원장은 summary 만 보존합니다. 같은 내용을 summary 로 보내십시오`);
-                    }
-                    const last = latest.get(f.id);
-                    if (f.status === 'open' && last?.status === 'open') {
-                        throw new HandlerRefusal(`review_record: id ${f.id} 는 이미 미해소(open) 상태입니다 — 다른 발견이면 새 id 를 쓰고, 같은 발견의 갱신이면 먼저 resolved 를 기록한 뒤 재기록하십시오 (id 충돌이 남의 critical 을 침묵시키는 것을 막는 문입니다)`);
-                    }
-                    if (f.status === 'resolved' && last?.status === 'open' && last.severity === 'critical') {
-                        // @implements A-SPEC-191 §11 — checked BEFORE any approval is resolved or consumed
-                        // (round-2): with the guard after resolution, a single-use elicitation grant (or grant
-                        // file) was spent on the FIRST lift, so the second occurrence saw "no approval" and
-                        // surfaced a bogus set-HOLMES_APPROVAL message plus a queue entry for an act a human
-                        // already decided. The double-lift is named honestly on EVERY channel, and nothing
-                        // single-use is touched by a batch that dies here.
-                        if (liftedCriticals.includes(f.id)) {
-                            throw new HandlerRefusal(`review_record: 한 배치에서 같은 발견(${f.id})의 치명 해소를 두 번 들 수 없습니다 — 승인은 행위마다 필요합니다`);
-                        }
-                        const raw = process.env.HOLMES_APPROVAL;
-                        let approval;
-                        try {
-                            approval = raw ? JSON.parse(raw) : undefined;
-                        }
-                        catch {
-                            approval = undefined;
-                        }
-                        // covers, not merely well-formed (round-2): A-SPEC-133 built the seam so one token is
-                        // not a master key — an EXPIRED or elsewhere-scoped approval must not lift a critical.
-                        // An unscoped {actor,token,rationale} stays the operator's session key (unchanged).
-                        const nowTs = new Date().toISOString();
-                        let rrResolved = resolveHandlerApproval(a.root, store, approval, { kind: 'review-resolve', target: f.id }, nowTs);
-                        // @implements A-SPEC-263.1 — the second (and last) elicitable kind. The HUMAN was asked
-                        // BEFORE the lock (pre-scan above — a lock must not wait on a person); in here the grant
-                        // is plain data, consumed synchronously and at most once per id.
-                        if (rrResolved === undefined) {
-                            const g = elicitGrants.get(f.id);
-                            if (g) {
-                                elicitGrants.delete(f.id);
-                                rrResolved = { approval: g, source: 'elicitation' };
-                                elicitationLifts.push({ id: f.id, approval: g });
-                            }
-                        }
-                        if (rrResolved === undefined) {
-                            // A pre-scan DENY surfaces HERE — only when the lift is genuinely needed at lock time
-                            // (round-1). The human decided, so the answer is the message and nothing is queued.
-                            const denied = elicitDenials.get(f.id);
-                            if (denied !== undefined) {
-                                throw new HandlerRefusal(`review_record: 세션에서 거부됨 — ${denied}. 사유를 해소한 뒤 다시 기록하십시오.`);
-                            }
-                            // @implements A-SPEC-497.1 — an expired dialog leads the refusal by name; silence
-                            // keeps the pre-elicitation face.
-                            const expiredMs = elicitExpiries.get(f.id);
-                            throw new HandlerRefusal((expiredMs !== undefined ? (0, elicit_approval_1.expiredNotice)(expiredMs) : '')
-                                + `review_record: id ${f.id} 의 열린 치명 발견을 해소하는 기록은 이 행위를 덮는 유효한 대역외 승인이 필요합니다 — 차단당한 쪽이 스스로 이빨을 뽑을 수 없어야 하고, 만료·다른 범위의 승인은 덮지 않습니다. HOLMES_APPROVAL='{"actor":"<you>","token":"<any>","rationale":"<why fixed>"}' (범위를 쓰면 kind "review-resolve") 를 서버 환경에 설정하고 다시 기록하십시오`
-                                + refusalQueueHint(a.root, store, { kind: 'review-resolve', target: f.id, why: '열린 치명 발견의 해소 기록' }));
-                        }
-                        // Grant-file consumption is DEFERRED past the loop (round-2): consuming here burned the
-                        // single-use file when a LATER finding in the batch failed validation — nothing was
-                        // recorded, yet the operator's legitimate grant was gone and the retry refused. Same
-                        // harm class the env nonce fixed in its round-4; collected now, spent only once the
-                        // whole batch has validated (directly before the append, like the nonce block).
-                        if (rrResolved.source === 'grant' && rrResolved.root && rrResolved.approval.nonce) {
-                            grantConsumptions.push({ root: rrResolved.root, nonce: rrResolved.approval.nonce });
-                        }
-                        liftedCriticals.push(f.id);
-                        // The nonce block below enforces single-use on the ENV approval — so it must key on the
-                        // lifts the ENV approval actually authorized (round-1): before elicitation existed,
-                        // reaching it implied env/grant coverage, but an elicitation-authorized lift flows past
-                        // it with a possibly unrelated env token in the environment. Charging THAT token burned
-                        // an innocent nonce, misattributed the ledger line, and a stale env nonce made a
-                        // human-approved lift permanently refusable.
-                        if (rrResolved.source === 'env')
-                            envLiftedCriticals.push(f.id);
-                    }
-                    latest.set(f.id, f); // 한 배치 안의 순서도 기록 순서다
-                }
-                // A-SPEC-133 promises nonce = single-use "consumed on the ledger, a replay is denied".
-                // Consumed AFTER the whole batch validates and ONCE per call (round-4: consuming inside
-                // the loop burned the grant when a LATER row failed validation — the audit trail asserted
-                // an act that never happened, the retry was refused, and two resolves in one batch would
-                // have double-spent). Consumption directly precedes the append; the only failure between
-                // them is the append itself, which throws loudly.
-                // ONE NONCE, ONE ACT — on the grant channel too (round-4): the round-2 deferral removed the
-                // arity the in-loop spend had accidentally enforced, so a wide-scoped single-use grant
-                // backed N lifts in one batch while the same lifts split across calls refused after the
-                // first (the §13 batch-shape dependence). Checked BEFORE anything is spent (round-3 order
-                // doctrine: every throwable validation precedes every single-use spend).
-                {
-                    const liftsPerNonce = new Map();
-                    for (const g of grantConsumptions)
-                        liftsPerNonce.set(g.nonce, (liftsPerNonce.get(g.nonce) ?? 0) + 1);
-                    for (const [, n] of liftsPerNonce) {
-                        if (n > 1) {
-                            throw new HandlerRefusal(`review_record: 단일 사용 승인(grant)은 한 건의 치명 해소만 authorize 합니다 — 이 배치는 한 grant 로 ${n}건을 듭니다. 한 건씩 보내십시오`);
-                        }
-                    }
-                }
-                // The elicitation channel's AUDIT TRACE (round-5, repositioned round-6): the trust model
-                // admits review-resolve at a boundary closer than env/grant BECAUSE every grant is ledgered
-                // under an `elicitation:<client>` actor. This append is throwable I/O (chain lock
-                // contention, disk faults), so it stands BEFORE every single-use spend — round-5 placed it
-                // between the env-nonce spend and the findings append, and a lock-contended mixed batch
-                // burned the operator's env nonce with nothing recorded (the §7 doctrine regression). A
-                // failure HERE burns nothing; an orphaned event left when a LATER step throws stays honest,
-                // because it records the AUTHORIZATION, which already happened at pre-scan.
-                if (elicitationLifts.length > 0) {
-                    const chain = new ledger_store_1.FileLedgerStore(path.join(projectRootOf(a.root), '.ax', 'ledger'));
-                    for (const lift of elicitationLifts) {
-                        chain.append({
-                            ts: new Date().toISOString(), actor: lift.approval.actor, kind: 'review-resolve-authorized',
-                            summary: `elicitation grant authorized lifting open critical ${lift.id}`.slice(0, 200),
-                            inputs: [lift.id], rationale: lift.approval.rationale,
-                            authorization: (0, provenance_chain_1.authorizationRef)(lift.approval.actor, lift.approval.token),
-                        });
-                    }
-                }
-                // Keyed on the lifts the ENV approval AUTHORIZED, not on the ambient env var (round-1):
-                // an elicitation- or grant-authorized lift must not charge — or be blocked by — an env
-                // token that never covered the act. When env authorized nothing, its nonce is untouched.
-                if (envLiftedCriticals.length > 0) {
-                    const raw = process.env.HOLMES_APPROVAL;
-                    let approval;
-                    try {
-                        approval = raw ? JSON.parse(raw) : undefined;
-                    }
-                    catch {
-                        approval = undefined;
-                    }
-                    if ((0, provenance_chain_1.blankNonce)(approval?.nonce)) {
-                        throw new HandlerRefusal('review_record: 승인이 단일 사용(nonce)을 선언했으나 값이 비어 있습니다 — 1회성을 집행할 수 없어 거부합니다');
-                    }
-                    // @implements A-SPEC-191 §13 — 1회용 승인은 한 번의 행위를 authorize 한다. 9라운드
-                    // 실측: 서로 다른 id 의 치명 해소 N 건이 한 배치에서 nonce 한 장으로 통과했고,
-                    // 같은 세 건을 세 호출로 나누면 두 번째부터 거부됐다 — 판정이 묶음 방식에 의존했다.
-                    if ((0, provenance_chain_1.nonceDeclared)(approval?.nonce) && envLiftedCriticals.length > 1) {
-                        throw new HandlerRefusal(`review_record: 단일 사용 승인(nonce)은 한 건의 치명 해소만 authorize 합니다 — 이 배치는 ${envLiftedCriticals.length}건(${envLiftedCriticals.join(', ')})을 듭니다. 한 건씩 보내십시오`);
-                    }
-                    if ((0, provenance_chain_1.nonceDeclared)(approval?.nonce)) {
-                        // @implements A-SPEC-191 §10 — the same bound anchor as risk_check: two consumers must
-                        // spend into ONE ledger, or a nonce spent here reopens the gate there (and back).
-                        const ledgerFile = boundNonceLedger(store);
-                        if (ledgerFile === null) {
-                            throw new HandlerRefusal('review_record: 단일 사용 승인(nonce)을 기록할 프로젝트 원장을 확정할 수 없습니다 — 1회성을 보장할 수 없어 거부합니다');
-                        }
-                        const won = (0, provenance_chain_1.consumeNonceExclusively)(String(approval.nonce), ledgerFile, {
-                            ts: new Date().toISOString(), actor: approval.actor, kind: 'nonce-consumed',
-                            summary: `consumed single-use approval for: review-resolve ${envLiftedCriticals.join(', ')}`.slice(0, 200),
-                            inputs: [(0, provenance_chain_1.nonceFingerprint)(String(approval.nonce))], rationale: approval.rationale,
-                            authorization: (0, provenance_chain_1.authorizationRef)(approval.actor, approval.token),
-                        }, { isNonceConsumed: (0, ledger_store_2.nonceConsumedIn)(ledgerFile) });
-                        if (!won) {
-                            throw new HandlerRefusal(`review_record: 단일 사용 승인(nonce)이 이미 소비되었습니다 — 재사용은 거부됩니다. 새 승인을 발급받으십시오`);
-                        }
-                    }
-                }
-                // Deferred single-use spends — LAST, after every throwable validation including the
-                // env-nonce block above (round-3: placed before it, a mixed batch's env-nonce refusal
-                // burned the grant with nothing recorded — the exact harm the round-2 deferral was written
-                // to fix, reintroduced through the env throw path). Only the append itself follows, and it
-                // fails loudly.
-                for (const g of grantConsumptions)
-                    (0, approval_grants_1.consumeGrantFile)(g.root, g.nonce);
-                // @implements A-SPEC-157 — the server's OWN observation, not anything the caller sent.
-                // @implements A-SPEC-160 — the ONLY caller that reads the on-disk build, so the divergence
-                // marker can be sealed. Append INSIDE the same lock as the guard (round-6 TOCTOU).
-                ledger.record(a.findings, (0, basis_1.basisDigest)(basisFor(a.root, true)));
-            });
-            return { recorded: a.findings.length };
-        },
-        async review_status(a) {
-            // @implements A-SPEC-191 §15 — the merge gate must not answer about a project it did not read.
-            const foreign = foreignRootReason(store, a.root);
-            if (foreign !== null)
-                throw new HandlerRefusal(`review_status: ${foreign}`);
-            // @implements A-SPEC-191 (§4f) — counted on the LATEST record per id, the same folding the
-            // constitution's ART-7 uses. Line-based counting could never decrease on an append-only
-            // ledger, so the canonical exit (a resolved line) left `blocked: true` forever while the Stop
-            // gate passed — two official verdicts about one ledger, disagreeing permanently (measured).
-            const all = new findings_1.FindingsLedger(boundFindingsLedger(store, a.root)).list();
-            const latest = new Map();
-            // Severity of the LATEST open row per id — a forever-sticky "ever critical" set resurrected
-            // a properly-closed critical when a later minor re-finding got a diverged resolve (r6).
-            const lastOpenCritical = new Map();
-            for (const f of all) {
-                latest.set(f.id, f);
-                if (f.status === 'open')
-                    lastOpenCritical.set(f.id, f.severity === 'critical');
-            }
-            // SAME ledger meaning as ART-7 (round-3: the two official readers disagreed): a resolution
-            // sealed on a diverged build does not close a critical here either. What it keeps open is
-            // the CRITICAL it failed to close — bucketing by the resolved line's own severity let a
-            // severity-downgraded diverged resolve report blocked:false while the Stop gate blocked
-            // (round-4 HIGH), and a severity-less row minted an "undefined" bucket.
-            const counts = { critical: 0, important: 0, minor: 0 };
-            for (const f of latest.values()) {
-                if (f.status === 'open') {
-                    if (Object.prototype.hasOwnProperty.call(counts, f.severity))
-                        counts[f.severity]++; // in-체크는 프로토타입 키(toString)로 새었다(r6)
-                    continue;
-                }
-                if (f.status === 'resolved' && lastOpenCritical.get(f.id) === true && (0, basis_1.basisDiverged)(f.basis))
-                    counts.critical++;
-            }
-            // @implements A-SPEC-135
-            // Surface outstanding P4 routing signals: specs whose approved content moved, with the anchored
-            // files awaiting targeted review. This is a backlog to route human attention, NOT a hard block —
-            // the review layer decides severity — so it does not touch `blocked`.
-            // @implements A-SPEC-189 §12 (round 12) — the findings moved onto the bound project in §8 and
-            // this line stayed on the caller's raw root, so the SAME project answered with or without a
-            // P4 routing backlog depending on how its root was spelled (a subdirectory passes the
-            // project-level foreign check). One question, one tree.
-            const reviewNeeded = (0, review_targets_1.readReviewNeeded)(path.join(path.dirname(boundFindingsLedger(store, a.root)), 'provenance.jsonl'));
-            return { blocked: counts.critical > 0 || counts.important > 0, open: counts, reviewNeeded };
-        },
-        // @implements A-SPEC-125.4
-        async risk_check(a) {
-            const action = { ...a.action };
-            if (a.root && a.changedSymbols && a.changedSymbols.length) {
-                // @implements A-SPEC-189 §14 (round 13) — the derivation was computed and discarded, so the
-                // advertised "a subdirectory resolves up to it" held for `taint_scan` and no one else.
-                const root = projectRootOf(a.root);
-                const specs = await store.list();
-                const scanned = cachedScan(root, root);
-                const g = new rtm_graph_1.RtmGraph();
-                try {
-                    (0, rtm_builder_1.buildRtm)(specs, scanned, g);
-                    const impacted = (0, rtm_builder_1.impactedBy)(g, a.changedSymbols);
-                    action.blastRadius = { impactedSpecCount: impacted.length, hitsFoundational: impacted.some((id) => id.startsWith('SPEC:REQ-')) };
-                }
-                finally {
-                    g.close(); // release native SQLite handle even if build/query throws
-                }
-            }
-            // @implements A-SPEC-225 — the flag that raises this action's risk is COMPUTED here, not
-            // taken from the party being judged. Measured 2026-08-22: nothing in the repository ever set
-            // `cspecConstraintChange`, so the hard-hitl branch guarding C-SPEC constraints could only fire
-            // if the actor changing them volunteered that they had. The precedent is one field away —
-            // `blastRadius` above is derived from the store rather than accepted from the caller — and the
-            // principle is the one `findings.ts` states for `basis`: a judge that stamps its own evidence
-            // turns the field into self-report.
-            //
-            // OR, never assignment: a caller may raise its own risk (that is their business) but may not
-            // lower the server's verdict.
-            const cspecId = (0, cspec_change_1.cspecTargetId)(typeof action.target === 'string' ? action.target : '');
-            if (cspecId !== null) {
-                const stored = (await store.list()).find((sp) => sp.id === cspecId);
-                const current = stored ? (0, spec_parser_1.serializeSpec)(stored) : null;
-                const proposed = typeof action.stagedContent === 'string' ? action.stagedContent : null;
-                action.cspecConstraintChange = (0, cspec_change_1.cspecConstraintChanged)(current, proposed) || action.cspecConstraintChange === true;
-            }
-            const assessment = (0, risk_classifier_1.assessRisk)(action);
-            // @implements A-SPEC-133 — coverage (scope + expiry), not mere well-formedness, decides whether
-            // this approval authorizes THIS action. An out-of-scope or expired token no longer unblocks.
-            const coverTarget = { kind: action.kind, target: typeof action.target === 'string' ? action.target : String(action.target ?? '') };
-            let gate = (0, risk_gate_1.riskGate)(assessment, a.approval, a.enforcement, { action: coverTarget, now: a.ts });
-            const covers = (0, risk_gate_1.approvalCovers)(a.approval, coverTarget, a.ts);
-            // @implements A-SPEC-133 — the hard-hitl branch HONORS a nonce by SPENDING it (r7-191 HIGH:
-            // this consumer accepted single-use approvals and spent nothing — 'N-RISK' unblocked three
-            // times; a replayed approval must deny exactly as an absent one would).
-            // @implements A-SPEC-191 §13 — 승인이 실제로 문을 여는 경우에만 승인의 하자를 따진다.
-            // 9라운드 실측: 승인이 아예 필요 없던 낮은 판정까지 환경에 놓인 토큰의 모양 때문에
-            // 차단됐다 — 승인을 쥔 쪽이 안 쥔 쪽보다 나빠지는 역전이다.
-            const wouldBlockWithout = (0, risk_gate_1.riskGate)(assessment, undefined, a.enforcement, { action: coverTarget, now: a.ts }).blocked;
-            if (!gate.blocked && covers && wouldBlockWithout && (0, provenance_chain_1.blankNonce)(a.approval?.nonce)) {
-                gate = { ...gate, blocked: true, reasons: [...gate.reasons, '승인이 단일 사용(nonce)을 선언했으나 값이 비어 있거나 문자열이 아닙니다 — 1회성을 집행할 수 없어 거부합니다'] };
-            }
-            // 묶인 프로젝트가 없으면 개방을 기록할 수 없다 — 기록되지 않는 개방은 개방하지 않는다.
-            if (!gate.blocked && covers && wouldBlockWithout && boundNonceLedger(store) === null) {
-                gate = { ...gate, blocked: true, reasons: [...gate.reasons, '개방을 기록할 프로젝트 원장을 확정할 수 없습니다 — 기록 없는 개방은 하지 않습니다(.ax 를 가진 프로젝트에 바인딩된 서버에서 호출하십시오)'] };
-            }
-            if (assessment.level === 'hard-hitl' && !gate.blocked && covers && (0, provenance_chain_1.nonceDeclared)(a.approval?.nonce)) {
-                const ledgerFile = boundNonceLedger(store);
-                let won = false;
-                try {
-                    won = ledgerFile !== null && (0, provenance_chain_1.consumeNonceExclusively)(String(a.approval.nonce), ledgerFile, {
-                        ts: a.ts, actor: a.approval.actor, kind: 'nonce-consumed',
-                        summary: `consumed single-use approval for: ${coverTarget.kind} ${(0, provenance_chain_1.redactTarget)('command', coverTarget.target)}`.slice(0, 200),
-                        inputs: [(0, provenance_chain_1.nonceFingerprint)(String(a.approval.nonce))], rationale: a.approval.rationale,
-                        authorization: (0, provenance_chain_1.authorizationRef)(a.approval.actor, a.approval.token),
-                    }, { isNonceConsumed: (0, ledger_store_2.nonceConsumedIn)(ledgerFile) });
-                }
-                catch {
-                    won = false;
-                } // 배타 확보 실패 = 허용 불가(fail-closed)
-                if (!won) {
-                    gate = { ...gate, blocked: true, reasons: [...gate.reasons, ledgerFile === null
-                                ? '단일 사용 승인(nonce)을 기록할 프로젝트 원장을 확정할 수 없습니다 — 1회성을 보장할 수 없어 거부합니다(.ax 를 가진 프로젝트에 바인딩된 서버에서 호출하십시오)'
-                                : '단일 사용 승인(nonce)이 이미 소비되었습니다 — 재사용은 부재와 같이 거부됩니다'] };
-                }
-            }
-            // Honest provenance: a confirm-level action that was NOT blocked but received no COVERING
-            // approval must NOT be recorded as 'approved' (nobody authorized it for this action) — it
-            // 'proceeded unconfirmed'. Only a genuine covering out-of-band approval yields 'approved'.
-            const decision = gate.blocked
-                ? 'blocked'
-                : covers
-                    ? 'approved'
-                    : gate.requiresApproval
-                        ? 'proceeded-unconfirmed'
-                        : 'auto';
-            const evt = { ts: a.ts, actor: a.actor ?? a.approval?.actor ?? 'unknown', action, level: assessment.level, decision, rationale: a.rationale ?? a.approval?.rationale ?? '', reasons: assessment.reasons };
-            // @implements A-SPEC-191 §10 — a bound server files its decisions in the project it is bound
-            // to. r8: the audit line for a nonce-replay opening landed in the caller's scratch directory,
-            // so the project whose gate was opened held no trace of it.
-            const bound = boundNonceLedger(store);
-            const decisionsFile = bound !== null
-                ? path.join(path.dirname(bound), 'decisions.jsonl')
-                : path.join(a.root ?? '.', '.ax', 'ledger', 'decisions.jsonl');
-            // @implements A-SPEC-191 §11 — an audit write must not swallow a verdict the caller already
-            // earned (the hook has said this since N3). The nonce is spent for an opening that DOES reach
-            // the caller; a disk failure here loses the record, not the decision.
-            try {
-                new decision_ledger_1.DecisionLedger(decisionsFile).record([evt]);
-            }
-            catch { /* 기록 실패가 이미 계산된 판정을 뒤집지 않는다 */ }
-            // @implements A-SPEC-133 — 'Every gate opening records a provenance approved-action entry.'
-            // r8: the promise was kept in the hook and broken here — a covering approval that unblocked a
-            // hard-hitl risk_check left only `nonce-consumed` (and nothing at all when it carried no
-            // nonce), so the master key's use was invisible in the chain the audit reads.
-            const wouldBlock = wouldBlockWithout;
-            const bnl = boundNonceLedger(store);
-            if (!gate.blocked && covers && wouldBlock && bnl !== null) {
-                try {
-                    new provenance_chain_1.ProvenanceChain(bnl).append({
-                        ts: a.ts, actor: a.approval?.actor ?? 'unknown', kind: 'approved-action',
-                        summary: `approved action: risk_check ${coverTarget.kind} ${(0, provenance_chain_1.redactTarget)('command', coverTarget.target)}`.slice(0, 300),
-                        inputs: ['risk_check', (0, provenance_chain_1.redactTarget)('command', coverTarget.target), (0, provenance_chain_1.approvalMarkers)(a.approval)],
-                        rationale: a.approval?.rationale ?? '',
-                        authorization: a.approval ? (0, provenance_chain_1.authorizationRef)(a.approval.actor, a.approval.token) : undefined,
-                    });
-                }
-                catch { /* 감사 기록 실패가 판정을 바꾸지 않는다 */ }
-            }
-            return { assessment, gate };
-        },
-        // @implements A-SPEC-126
-        // Brownfield reverse engineering. Three explicitly-invoked tools, nothing running as a side
-        // effect of an ordinary session, and every write path opt-in: scan writes nothing at all, draft
-        // and anchor are dry-run by DEFAULT.
-        /**
-         * Read-only inventory of a brownfield target: candidate clusters, coverage, and what the scan
-         * could not resolve. Deliberately does NOT call assertRepoTopLevel — a target that is not a git
-         * repository is a supported case here, reported as `isGit: false`.
-         */
-        async reverse_scan(a) {
-            // @implements A-SPEC-189 §10 (round 11) — `reverse_scan`/`reverse_draft` never call
-            // `projectRootOf`, so §7's refusal marker never reached them and their own POINTED sentence
-            // ("<root> is not a directory") arrived at the wire as a raw -32603 fault. A refusal about the
-            // caller's own argument is a refusal wherever it is authored.
-            assertReadableRoot('reverse_scan', a.root);
-            // `surfaceByCluster` is drafting evidence, not reading material. On the calibration target it
-            // is 11,460 characters across 15 clusters, and this response enters context on every scan —
-            // paying that to READ what only DRAFTING consumes. `reverse_draft` reads it in-process instead.
-            const { surfaceByCluster: _drafting, ...response } = (0, scan_1.reverseScan)(a.root, { maxFlagged: a.maxFlagged });
-            return response;
-        },
-        /**
-         * Draft H-SPEC/A-SPEC/T-SPEC documents for the recovered clusters under an EXISTING parent REQ.
-         *
-         * The REQ is the human's to write and this tool refuses without one — a requirement states
-         * business intent, which is not in the code. Everything emitted is `status: draft`, and writing
-         * requires an explicit `dryRun: false`.
-         *
-         * WHERE THE DOCUMENTS LAND: in the SERVER's configured spec store (`HOLMES_SPECS`, default
-         * `.ax/specs` relative to the server's working directory) — not inside `root`. In the intended
-         * adoption the two are the same directory, because the server runs inside the target it governs;
-         * pointing `root` at a different repository drafts that repository's slices into THIS store,
-         * which is a governance decision the caller has to make deliberately.
-         */
-        async reverse_draft(a) {
-            assertReadableRoot('reverse_draft', a.root);
-            if (typeof a.parentReqId !== 'string' || a.parentReqId.trim() === '') {
-                return {
-                    ok: false,
-                    reason: 'parentReqId is required. A REQ states business intent, which does not exist in the code ' +
-                        'and cannot be recovered from it — write the REQ first, then re-run with its id.',
-                };
-            }
-            const parentReqId = a.parentReqId.trim();
-            const specs = await store.list();
-            const req = specs.find((s) => s.id === parentReqId);
-            // An unresolvable parent would emit an orphan H-SPEC: a chain that only looks complete.
-            if (!req)
-                return { ok: false, reason: `parent REQ ${parentReqId} was not found in the spec store — create it first` };
-            // @implements A-SPEC-184
-            // A document with no `type:` is not a wrong-kind parent — it is an older-format one, and saying
-            // "is a undefined" left the adopter holding a visible document with nowhere to go. When the type
-            // IS declared, `legacyMessage` returns null and the original wording stands: that path was
-            // already accurate and REQ-184 does not touch it.
-            const formatWhy = (0, legacy_format_1.legacyMessage)(req);
-            if (formatWhy)
-                return { ok: false, reason: formatWhy };
-            if (req.type !== 'REQ')
-                return { ok: false, reason: `${parentReqId} is a ${req.type}; drafts must hang off a REQ` };
-            const report = (0, scan_1.reverseScan)(a.root);
-            // A cluster already drafted is recognised by the `reverse_cluster` key its documents carry, so
-            // re-running over the same tree never duplicates a slice.
-            const alreadyDrafted = new Set(specs.map((s) => s.frontmatter.reverse_cluster).filter((k) => typeof k === 'string'));
-            const selected = a.cluster ? report.clusters.filter((c) => (0, draft_1.clusterKeyOf)(c) === a.cluster) : report.clusters;
-            // A key that matches nothing must not read as success: "drafted 0" is indistinguishable from
-            // "everything was already drafted", so a mistyped key would silently skip the work.
-            if (a.cluster && selected.length === 0) {
-                const keys = report.clusters.map(draft_1.clusterKeyOf);
-                return {
-                    ok: false,
-                    reason: `no cluster matches key "${a.cluster}" — reverse_scan reports ${keys.length} cluster(s)`,
-                    availableClusters: keys.slice(0, 50),
-                };
-            }
-            let base = (0, draft_1.nextIdBase)(specs.map((s) => s.id));
-            const drafted = [];
-            const skipped = [];
-            const refused = [];
-            for (const cluster of selected) {
-                const key = (0, draft_1.clusterKeyOf)(cluster);
-                if (alreadyDrafted.has(key)) {
-                    skipped.push({ clusterKey: key, reason: 'already drafted' });
-                    continue;
-                }
-                const d = (0, draft_1.draftSpecs)(cluster, req.id, String(base), {
-                    surface: report.surfaceByCluster[key] ?? [],
-                    testFiles: cluster.testFiles ?? [],
-                    testsUnmatched: report.coverage.testsUnmatched,
-                });
-                if (!d.ok) {
-                    refused.push({ clusterKey: key, reason: d.reason });
-                    continue;
-                }
-                // Validate BEFORE writing: a draft that fails the project's own validator is not evidence of
-                // anything, and emitting one would put a broken document into the chain.
-                const known = [...specs, ...drafted.flatMap((x) => x.specs), ...d.specs];
-                const resolve = (id) => known.find((s) => s.id === id) ?? null;
-                const errors = d.specs.flatMap((s) => (0, validator_1.validateSpec)(s, resolve).findings.filter((f) => f.level === 'error').map((f) => ({ spec: s.id, ...f })));
-                if (errors.length) {
-                    refused.push({ clusterKey: key, reason: 'drafted documents failed validation', findings: errors });
-                    continue;
-                }
-                drafted.push(d);
-                base++;
-            }
-            const dryRun = a.dryRun !== false; // opt IN to writing
-            // @implements A-SPEC-188 — the minted id sits above every PARSEABLE id, but a file list()
-            // cannot read is invisible to nextIdBase, so its path can collide with a fresh draft. Same
-            // rule as spec_create: a path already occupied is a human's to look at, never overwritten.
-            // The whole cluster moves to `refused` — a partially-written chain only looks complete.
-            // Judged in the DRY RUN too (round-3): a preview that lists a cluster as drafted which the
-            // real run would refuse is a preview that lies.
-            const written = [];
-            for (const d of drafted) {
-                const clash = store instanceof spec_store_1.LocalMarkdownRepository
-                    ? d.specs.map((s) => store.targetPathFor(s)).find((p) => fs.existsSync(p))
-                    : undefined;
-                if (clash) {
-                    refused.push({ clusterKey: d.clusterKey, reason: `초안 목적지(${clash})에 스토어가 읽지 못하는 파일이 이미 있습니다 — 덮어쓰지 않습니다. 사람이 확인해 옮기거나 고친 뒤 다시 실행하십시오.` });
-                    continue;
-                }
-                if (!dryRun) {
-                    try {
-                        for (const s of d.specs)
-                            await store.write(s);
-                    }
-                    catch (e) {
-                        if (e instanceof spec_store_1.TargetPathOccupiedError) {
-                            refused.push({ clusterKey: d.clusterKey, reason: `초안 목적지(${e.occupiedPath})에 스토어가 읽지 못하는 파일이 이미 있습니다 — 덮어쓰지 않습니다. 사람이 확인해 옮기거나 고친 뒤 다시 실행하십시오.` });
-                            continue;
-                        }
-                        throw e;
-                    }
-                }
-                written.push(d);
-            }
-            // @implements A-SPEC-299
-            // Deliberately NOT changed. This looked like the same false pass as spec_slice_approve, but an
-            // approved store-integrity test pins `ok: true` for a run that refused every cluster because a
-            // destination held an unreadable file: nothing was written, nothing was damaged, and `ok` here
-            // means the call completed without harm. That is a defensible contract, and the case against
-            // it was analogy rather than an observed failure. Evidence beats symmetry.
-            return { ok: true, dryRun, parentReqId: req.id, clusters: report.clusters.length, drafted: written, skipped, refused };
-        },
-        /**
-         * Insert `@implements` anchors into source files. Dry-run by DEFAULT, and anchoring to a
-         * non-approved A-SPEC is refused — a reverse-engineered draft describes code; description does
-         * not confer approval.
-         */
-        async reverse_anchor(a) {
-            const specs = await store.list();
-            const approved = specs.filter((s) => s.type === 'A-SPEC' && s.status === 'approved').map((s) => s.id);
-            const plan = (0, anchor_1.planAnchors)(a.root, a.mapping ?? [], approved);
-            // @implements A-SPEC-182
-            // The third place the harness refuses over an unapproved A-SPEC. Enriched HERE rather than
-            // inside planAnchors, which is a pure planner holding only the approved-id list — this is the
-            // boundary that has the spec objects, so the planner stays testable without them.
-            const byId = new Map(specs.map((s) => [s.id, s]));
-            // ONE payload per distinct A-SPEC, on a sibling field — not appended to every refused entry.
-            // Review measured the first attempt, which memoized only the COMPUTATION: 149 files mapped to
-            // one draft A-SPEC still concatenated the same 361-character sentence 149 times, 48 KB of pure
-            // duplication in a single tool result. The comment claimed a property the code did not have,
-            // which is how it survived a round of review — hence the size assertion in the test.
-            const blockers = {};
-            for (const r of plan.refused) {
-                if (!/is not approved$/.test(r.reason) || blockers[r.aspec] !== undefined)
-                    continue;
-                const why = (0, approval_blockers_1.blockerSummary)(byId.get(r.aspec), (id) => byId.get(id) ?? null, r.aspec);
-                if (why)
-                    blockers[r.aspec] = why.trim();
-            }
-            const applied = (0, anchor_1.applyAnchors)(a.root, plan.edits, { dryRun: a.dryRun !== false });
-            return { ...plan, ...applied, blockers };
-        },
-        async spec_slice_init(a) {
-            const root = a.root ? (0, root_2.resolveProjectRoot)(a.root).root : process.cwd();
-            const specsDir = path.join(root, '.ax', 'specs');
-            const existing = await store.list();
-            // @implements A-SPEC-546.1 — align with the sibling reverse-draft path (nextIdBase, floor 100)
-            // instead of a hard-coded 200 floor, so a fresh project starts at REQ-100, not REQ-201. Existing
-            // projects are unchanged: nextIdBase returns max(existing)+1, which dominates the floor.
-            const nextId = (0, draft_1.nextIdBase)(existing.map((s) => s.id));
-            const reqId = `REQ-${nextId}`;
-            const hspecId = `H-SPEC-${nextId}`;
-            const aspecId = `A-SPEC-${nextId}`;
-            const tspecId = `T-SPEC-${nextId}`;
-            const reqContent = `---
-source:
-  - kind: user-request
-    ref: ${(0, yaml_scalar_1.yamlScalar)(a.title, 4)}
-    retrieved: ${new Date().toISOString().split('T')[0]}
-    note: ${(0, yaml_scalar_1.yamlScalar)(a.objective, 4)}
-created: ${new Date().toISOString()}
-id: ${reqId}
-type: REQ
-title: ${(0, yaml_scalar_1.yamlScalar)(a.title)}
-status: draft
-depends_on: []
----
-
-## Problem / Need
-${a.objective}
-
-## Desired Outcome
-${a.objective}
-
-## Constraints
-- Standard project governance rules.
-
-## Success Criteria
-
-## Out of Scope
-- Unrelated feature changes.
-`;
-            const hspecContent = `---
-created: ${new Date().toISOString()}
-id: ${hspecId}
-type: H-SPEC
-title: ${(0, yaml_scalar_1.yamlScalar)(`Functional Specification for ${a.title}`)}
-status: draft
-req_type: functional
-owner: me
-depends_on:
-  - ${reqId}
----
-
-## Intent
-Implement ${a.title}.
-
-## Scope (In / Out)
-In Scope: ${a.title}.
-Out of Scope: None.
-
-## Design Overview
-High level design for ${a.title}.
-
-## Interfaces / Contracts
-- Target files: ${a.filesToTouch.join(', ')}
-
-## Acceptance Criteria
-- Code written and tests passing.
-
-## Non-Functional
-- Performance and stability maintained.
-
-## Assumptions
-- Environment configured properly.
-
-## Open Questions
-- None.
-`;
-            const aspecContent = `---
-created: ${new Date().toISOString()}
-id: ${aspecId}
-type: A-SPEC
-title: ${(0, yaml_scalar_1.yamlScalar)(`Architecture Specification for ${a.title}`)}
-status: draft
-slice: ${(0, yaml_scalar_1.yamlScalar)(a.sliceName)}
-priority: P1
-independent_test: true
-depends_on:
-  - ${hspecId}
-breaking_change: 'none'
-harness_impact: 'none: TODO — 3하네스(claude/codex/agy) 영향 검토 후 기술'
-os_impact: 'none: TODO — 3OS(windows/mac/linux) 영향 검토 후 기술'
----
-
-## Objective
-${a.objective}
-
-## Component Design
-1. Target Component:
-   - Modifies ${a.filesToTouch.join(', ')}.
-
-## Inputs / Outputs
-- Inputs: Tool calls / developer modifications.
-- Outputs: Working implementation.
-
-## Behavior
-- Implements desired behavior cleanly.
-
-## Test Points
-- Unit tests in test suite.
-
-## Files to Touch
-${a.filesToTouch.map((f) => `- ${f}`).join('\n')}
-
-## Done When
-- All tests pass 100%.
-`;
-            const tspecContent = `---
-coverage:
-  normal: true
-  corner: true
-  negative: true
-  boundary: true
-id: ${tspecId}
-type: T-SPEC
-title: ${(0, yaml_scalar_1.yamlScalar)(`Test Specification for ${a.title}`)}
-status: draft
-depends_on:
-  - ${aspecId}
----
-
-## Normal Cases
-- Given valid inputs
-  When operation is performed
-  Then correct behavior is observed
-
-## Corner Cases
-- Given edge cases
-  When operation is performed
-  Then system handles gracefully
-
-## Negative Cases
-- Given invalid inputs
-  When operation is performed
-  Then appropriate error is returned
-
-## Boundary Cases
-- Given boundary conditions
-  When operation is performed
-  Then boundary limits are respected
-`;
-            fs.mkdirSync(path.join(specsDir, '01_req'), { recursive: true });
-            fs.mkdirSync(path.join(specsDir, '02_h-spec', 'functional'), { recursive: true });
-            fs.mkdirSync(path.join(specsDir, '03_a-spec'), { recursive: true });
-            fs.mkdirSync(path.join(specsDir, '05_t-spec'), { recursive: true });
-            fs.writeFileSync(path.join(specsDir, '01_req', `${reqId}.md`), reqContent);
-            fs.writeFileSync(path.join(specsDir, '02_h-spec', 'functional', `${hspecId}.md`), hspecContent);
-            fs.writeFileSync(path.join(specsDir, '03_a-spec', `${aspecId}.md`), aspecContent);
-            fs.writeFileSync(path.join(specsDir, '05_t-spec', `${tspecId}.md`), tspecContent);
-            // @implements A-SPEC-299
-            // Read back what was just written. S-298 fixed one cause of unparseable frontmatter; this
-            // closes the class. `list()` silently skips documents it cannot parse, so "created" and
-            // "present in the store" can diverge without anything throwing — which is exactly how a
-            // requirement went missing on 2026-08-28 while the tool reported four specs created.
-            const specsCreated = [reqId, hspecId, aspecId, tspecId];
-            const unreadable = unreadableAmong(await new spec_store_1.LocalMarkdownRepository(specsDir).list(), specsCreated);
-            // The files stay on disk on purpose: deleting the evidence turns a diagnosable bug into a
-            // mystery, and a half-written slice is something a person should see.
-            return { ok: unreadable.length === 0, specsCreated, unreadable };
-        },
-        async spec_slice_approve(a) {
-            const root = a.root ? (0, root_2.resolveProjectRoot)(a.root).root : process.cwd();
-            const rawStore = new spec_store_1.LocalMarkdownRepository(path.join(root, '.ax', 'specs'));
-            const specs = await rawStore.list();
-            const inSlice = specs.filter((s) => {
-                if (s.frontmatter?.slice === a.sliceName)
-                    return true;
-                if (s.id === a.sliceName)
-                    return true;
-                return false;
-            });
-            const idsToApprove = [];
-            if (inSlice.length > 0) {
-                const aspec = inSlice.find((s) => s.type === 'A-SPEC') ?? inSlice[0];
-                const mainId = (id) => id.split('.')[0].replace(/\D/g, '');
-                const req = specs.find((s) => aspec.dependsOn.includes(s.id) || mainId(s.id) === mainId(aspec.id));
-                const hspec = specs.find((s) => s.type === 'H-SPEC' && (s.dependsOn.includes(req?.id ?? '') || mainId(s.id) === mainId(aspec.id)));
-                const tspec = specs.find((s) => s.type === 'T-SPEC' && (s.dependsOn.includes(aspec.id) || mainId(s.id) === mainId(aspec.id)));
-                if (req)
-                    idsToApprove.push(req.id);
-                if (hspec)
-                    idsToApprove.push(hspec.id);
-                idsToApprove.push(aspec.id);
-                if (tspec)
-                    idsToApprove.push(tspec.id);
-            }
-            else {
-                const matches = specs.filter((s) => s.id.includes(a.sliceName));
-                idsToApprove.push(...matches.map((s) => s.id));
-            }
-            const rawHandlers = makeRawHandlers(rawStore);
-            const approvedSpecs = [];
-            const alreadySealed = [];
-            const refused = [];
-            if (idsToApprove.length === 0) {
-                // Reporting this as a success is how a caller ends up believing an unapproved slice was
-                // approved. Measured 2026-08-28: a broken-frontmatter REQ made the whole slice invisible
-                // here, and the tool answered `ok: true, approvedSpecs: []`.
-                return { ok: false, approvedSpecs, alreadySealed, refused: [{ id: a.sliceName, reason: 'no specs matched this slice name' }] };
-            }
-            // @implements A-SPEC-587.2 — a sealed spec is SKIPPED, not re-sealed: re-approving asked the
-            // human the same question again (same request id back in the queue) and stopped the chain
-            // there, so the H-SPEC was never even attempted (measured 2026-09-10, three slices).
-            const sealed = (id) => {
-                const s = specs.find((x) => x.id === id);
-                return s?.status === 'approved' && typeof s.frontmatter?.approved_digest === 'string';
-            };
-            for (const id of idsToApprove) {
-                if (sealed(id)) {
-                    alreadySealed.push(id);
-                    continue;
-                }
-                const res = (await rawHandlers.spec_approve({ root, id }));
-                if (res.approved || res.ok) {
-                    approvedSpecs.push(id);
-                    continue;
-                }
-                const findings = Array.isArray(res.findings)
-                    ? res.findings.map((f) => f.message).filter(Boolean).join('; ')
-                    : '';
-                refused.push({ id, reason: findings ? `${res.reason ?? 'refused'}: ${findings}` : (res.reason ?? 'refused') });
-                // The chain is topological: approving a child whose parent was refused would either fail
-                // again or, worse, succeed against an unsealed parent. Stop and say what is left.
-                break;
-            }
-            for (const id of idsToApprove.slice(approvedSpecs.length + alreadySealed.length + refused.length)) {
-                refused.push({ id, reason: 'not attempted — an earlier spec in the chain was refused' });
-            }
-            // `ok` means the slice is approved — freshly or already. Anything less is not a success.
-            return { ok: refused.length === 0 && approvedSpecs.length + alreadySealed.length > 0, approvedSpecs, alreadySealed, refused };
-        },
-        async spec_remediate(a) {
-            const root = a.root ? (0, root_2.resolveProjectRoot)(a.root).root : process.cwd();
-            const actionsTaken = [];
-            if (a.targetFile && a.aspecId) {
-                const fullPath = path.isAbsolute(a.targetFile) ? a.targetFile : path.join(root, a.targetFile);
-                if (fs.existsSync(fullPath)) {
-                    // @implements A-SPEC-501.1 — BUG-4 (dogfooded twice): the old unconditional
-                    // `// @implements` broke Python/YAML targets outright AND produced anchors the scanner
-                    // could not read. The syntax comes from the one map the scanner is aligned with, an
-                    // unknown syntax is an honest refusal, and the containment check is form-agnostic so a
-                    // `#` anchor is not double-injected.
-                    const anchorTag = (0, anchor_comment_1.anchorLineFor)(fullPath, a.aspecId);
-                    const content = fs.readFileSync(fullPath, 'utf8');
-                    if (anchorTag === null) {
-                        actionsTaken.push(`앵커 주입 거부: ${path.basename(fullPath)} — 이 확장자의 주석 문법을 모릅니다. 파일 관례에 맞는 주석으로 1행에 '@implements ${a.aspecId}'를 직접 추가하십시오`);
-                    }
-                    else if (!content.includes(`@implements ${a.aspecId}`)) {
-                        fs.writeFileSync(fullPath, `${anchorTag}\n${content}`);
-                        actionsTaken.push(`Injected ${anchorTag} on line 1 of ${a.targetFile}`);
-                    }
-                }
-            }
-            const rawStore = new spec_store_1.LocalMarkdownRepository(path.join(root, '.ax', 'specs'));
-            const rawHandlers = makeRawHandlers(rawStore);
-            const approveRes = await rawHandlers.spec_slice_approve({ root, sliceName: a.aspecId ?? 'slice' });
-            if (approveRes.approvedSpecs?.length > 0) {
-                actionsTaken.push(`Approved slice specs: ${approveRes.approvedSpecs.join(', ')}`);
-            }
-            // Same false-PASS as spec_slice_approve had, one layer up: this handler's whole purpose is to
-            // approve, so reporting success when approval was refused sends the caller into code with an
-            // unapproved slice behind it.
-            const refused = approveRes.refused ?? [];
-            for (const r of refused)
-                actionsTaken.push(`Refused ${r.id}: ${r.reason}`);
-            return { ok: refused.length === 0, actionsTaken, refused };
-        },
+            },
+        }),
     };
 }