@ictechgy/context-guard 0.4.13 → 0.4.15

package/plugins/context-guard/bin/context-guard-experiments

@@ -11,6 +11,7 @@ from __future__ import annotations
 import argparse
 from dataclasses import asdict, dataclass
 from datetime import datetime, timezone
+import errno
 import http.client
 from http.server import BaseHTTPRequestHandler, HTTPServer
 import hashlib
@@ -26,6 +27,7 @@ import shlex
 import socket
 from socketserver import TCPServer
 from pathlib import Path
+import unicodedata
 import stat
 import sys
 import time
@@ -46,6 +48,7 @@ MAX_VISUAL_OCR_TEXT_BYTES = 64_000
 MAX_LEARNED_COMPRESSION_INPUT_BYTES = 128_000
 MAX_LEARNED_COMPRESSION_REPLACEMENT_BYTES = 64_000
 MAX_LEARNED_COMPRESSION_ARTIFACT_METADATA_BYTES = 64_000
+IMAGE_CONTEXT_PACK_MAX_DIMENSION = 16_384
 MAX_SELF_HOSTED_METRICS_INPUT_BYTES = 64_000
 SELF_HOSTED_METRICS_SCHEMA_VERSION = "contextguard.bench.self-hosted-metrics.v1"
 SELF_HOSTED_METRICS_KEY = "self_hosted_metrics"
@@ -67,6 +70,240 @@ LOCAL_PROXY_DIAGNOSTIC_SCHEMA_VERSION = "contextguard.experiments.local-proxy-fo
 LOCAL_PROXY_READY_SCHEMA_VERSION = "contextguard.experiments.local-proxy-ready.v1"
 LOCAL_PROXY_EXTERNAL_DESIGN_SCHEMA_VERSION = "contextguard.experiments.local-proxy-external-forwarding-design.v1"
 LOCAL_PROXY_RESPONSE_SANDBOX_SCHEMA_VERSION = "contextguard.experiments.local-proxy-response-sandbox.v1"
+IMAGE_CONTEXT_PACK_PLAN_SCHEMA_VERSION = "contextguard.experiments.image-context-pack-plan.v1"
+SEMANTIC_CHECKPOINT_PLAN_SCHEMA_VERSION = "contextguard.experiments.semantic-checkpoint-plan.v1"
+PROOF_CARRYING_CONTEXT_PLAN_SCHEMA_VERSION = "contextguard.experiments.proof-carrying-context-plan.v1"
+PROOF_CARRYING_CONTEXT_VERIFY_SCHEMA_VERSION = "contextguard.experiments.proof-carrying-context-verification.v1"
+PROOF_CARRYING_CONTEXT_UNIT_SCHEMA_VERSION = "contextguard.proof-unit.v1"
+PROOF_CARRYING_CONTEXT_DETAILED_UNIT_CAP = 64
+PROOF_CARRYING_CONTEXT_UNIT_JSON_BYTE_CAP = 8192
+PROOF_UNIT_JSON_MAX_DEPTH = 100
+PROOF_RECEIPT_METADATA_BYTE_CAP = 64_000
+PROOF_RECEIPT_CONTENT_BYTE_CAP = 100_000_000
+PROOF_RECEIPT_CONTENT_READ_CHUNK = 1_048_576
+SEMANTIC_GC_PLAN_SCHEMA_VERSION = "contextguard.experiments.semantic-gc-plan.v1"
+SEMANTIC_GC_UNIT_SCHEMA_VERSION = "contextguard.semantic-gc-unit.v1"
+SEMANTIC_GC_DETAILED_UNIT_CAP = 64
+SEMANTIC_GC_UNIT_JSON_BYTE_CAP = 8192
+SEMANTIC_GC_JSON_MAX_DEPTH = 100
+SEMANTIC_GC_PROCESS_EXIT_CONTRACT = (
+    "exit code 0 means ready_for_plan_review; exit code 2 means a blocked plan was emitted"
+)
+STATIC_RELEVANCE_PLAN_SCHEMA_VERSION = "contextguard.experiments.static-relevance-plan.v1"
+STATIC_RELEVANCE_UNIT_SCHEMA_VERSION = "contextguard.static-relevance-unit.v1"
+STATIC_RELEVANCE_DETAILED_UNIT_CAP = 64
+STATIC_RELEVANCE_UNIT_JSON_BYTE_CAP = 8192
+STATIC_RELEVANCE_JSON_MAX_DEPTH = 100
+STATIC_RELEVANCE_PROCESS_EXIT_CONTRACT = (
+    "exit code 0 means ready_for_plan_review; exit code 2 means a blocked plan was emitted"
+)
+JSON_SAFE_INTEGER_MAX = 9_007_199_254_740_991
+PROOF_SOURCE_LABEL_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:/+-]{0,119}$")
+PROOF_RECEIPT_ID_RE = re.compile(r"^[a-f0-9]{16,64}$")
+PROOF_CONTENT_SHA256_RE = re.compile(r"^[a-f0-9]{64}$")
+PROOF_CAPTURED_AT_RE = re.compile(r"^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$")
+PROOF_UNIT_ALLOWED_FIELDS = frozenset({
+    "source_label",
+    "receipt_id",
+    "content_sha256",
+    "safe_range",
+    "captured_at",
+    "transform_policy",
+    "rehydrate_command",
+})
+PROOF_READINESS_BLOCKER_ORDER = (
+    "missing_proof_unit",
+    "too_many_proof_units",
+    "proof_unit_json_too_large",
+    "invalid_proof_unit_unicode",
+    "invalid_proof_unit_json",
+    "duplicate_proof_unit_keys",
+    "proof_unit_json_nesting_too_deep",
+    "nonfinite_proof_unit_number",
+    "proof_unit_not_object",
+    "unknown_proof_unit_fields",
+    "missing_source_label",
+    "invalid_source_label",
+    "missing_receipt",
+    "invalid_receipt",
+    "missing_content_sha256",
+    "invalid_content_sha256",
+    "missing_timestamp",
+    "invalid_timestamp",
+    "missing_transform_policy",
+    "invalid_transform_policy",
+    "invalid_safe_range",
+    "missing_safe_range_for_transform_policy",
+    "missing_rehydrate_command",
+    "invalid_rehydrate_command",
+    "rehydrate_receipt_mismatch",
+    "receipt_hash_conflict",
+    "protected_zone_denial_required",
+    "missing_provider_measurement_boundary",
+)
+PROOF_WARNING_ORDER = (
+    "protected_zone_compliance_not_checked",
+    "safe_range_bounds_not_checked",
+    "receipt_storage_not_checked",
+    "content_hash_not_verified",
+    "rehydrate_command_not_executed",
+    "timestamp_freshness_not_checked",
+    "safe_range_omitted",
+    "duplicate_proof_unit",
+)
+PROOF_VERIFICATION_BLOCKER_ORDER = (
+    "missing_proof_unit",
+    "too_many_proof_units",
+    "proof_unit_json_too_large",
+    "invalid_proof_unit_unicode",
+    "invalid_proof_unit_json",
+    "duplicate_proof_unit_keys",
+    "proof_unit_json_nesting_too_deep",
+    "nonfinite_proof_unit_number",
+    "proof_unit_not_object",
+    "unknown_proof_unit_fields",
+    "missing_source_label",
+    "invalid_source_label",
+    "missing_receipt",
+    "invalid_receipt",
+    "missing_content_sha256",
+    "invalid_content_sha256",
+    "missing_timestamp",
+    "invalid_timestamp",
+    "missing_transform_policy",
+    "invalid_transform_policy",
+    "invalid_safe_range",
+    "missing_safe_range_for_transform_policy",
+    "missing_rehydrate_command",
+    "invalid_rehydrate_command",
+    "rehydrate_receipt_mismatch",
+    "receipt_hash_conflict",
+    "invalid_artifact_directory",
+    "artifact_io_capability_unavailable",
+    "artifact_directory_not_found",
+    "artifact_directory_symlink_rejected",
+    "artifact_directory_not_regular",
+    "artifact_directory_owner_mismatch",
+    "artifact_directory_mode_not_private",
+    "artifact_directory_access_failed",
+    "request_preflight_aborted",
+    "receipt_pair_incomplete",
+    "receipt_metadata_symlink_rejected",
+    "receipt_metadata_not_regular",
+    "receipt_metadata_owner_mismatch",
+    "receipt_metadata_mode_not_private",
+    "receipt_metadata_multiple_links",
+    "receipt_metadata_too_large",
+    "receipt_metadata_invalid_unicode",
+    "receipt_metadata_invalid_json",
+    "receipt_metadata_duplicate_keys",
+    "receipt_metadata_nesting_too_deep",
+    "receipt_metadata_nonfinite_number",
+    "receipt_metadata_not_object",
+    "receipt_metadata_id_mismatch",
+    "receipt_metadata_stored_output_invalid",
+    "receipt_metadata_file_binding_mismatch",
+    "receipt_content_symlink_rejected",
+    "receipt_content_not_regular",
+    "receipt_content_owner_mismatch",
+    "receipt_content_mode_not_private",
+    "receipt_content_multiple_links",
+    "receipt_content_too_large",
+    "receipt_content_size_mismatch",
+    "receipt_content_hash_mismatch",
+    "receipt_line_count_mismatch",
+    "proof_content_hash_mismatch",
+    "safe_range_out_of_bounds",
+    "artifact_changed_during_read",
+    "artifact_read_failed",
+)
+PROOF_VERIFICATION_WARNING_ORDER = (
+    "timestamp_freshness_not_checked",
+    "protected_zone_compliance_not_checked",
+    "rehydrate_command_not_executed",
+    "safe_range_not_supplied",
+    "duplicate_proof_unit",
+)
+PROOF_VERIFICATION_CLAIM_BOUNDARY = (
+    "Local receipt/hash/range/command binding only; no semantic-safety, protected-zone, freshness, replacement, "
+    "omission, or hosted-savings authority."
+)
+PROOF_VERIFICATION_PROCESS_EXIT_CONTRACT = (
+    "exit code 0 means all supplied proof units passed bounded local verification only; exit code 2 means "
+    "verification_failed"
+)
+SEMANTIC_GC_UNIT_ID_RE = re.compile(r"^[A-Za-z0-9._:/-]{1,128}$")
+SEMANTIC_GC_SOURCE_LABEL_RE = re.compile(r"^[A-Za-z0-9._:/ -]{1,128}$")
+SEMANTIC_GC_RECEIPT_ID_RE = re.compile(r"^[a-f0-9]{16,64}$")
+SEMANTIC_GC_CONTENT_SHA256_RE = re.compile(r"^[a-f0-9]{64}$")
+SEMANTIC_GC_ALLOWED_FIELDS = frozenset({
+    "schema", "unit_id", "references", "is_root", "protected_zone",
+    "content_sha256", "provenance", "missed_context_note", "exact_fallback_command",
+})
+SEMANTIC_GC_BLOCKER_ORDER = (
+    "no_context_units", "unit_limit_exceeded", "invalid_context_unit_json",
+    "duplicate_json_key", "context_unit_depth_exceeded", "nonfinite_json_number",
+    "invalid_unicode_scalar", "decoder_recursion_limit", "invalid_context_unit_schema",
+    "unknown_context_unit_field", "missing_unit_id", "invalid_unit_id",
+    "duplicate_unit_id", "invalid_references", "duplicate_reference", "unknown_reference",
+    "ambiguous_reference",
+    "invalid_root_flag", "invalid_protected_zone_flag", "no_declared_root",
+    "graph_evaluation_suppressed", "protected_zone_policy_required",
+    "invalid_content_sha256", "missing_provenance", "invalid_provenance",
+    "invalid_source_label", "invalid_receipt_id", "missing_missed_context_note",
+    "invalid_missed_context_note", "missing_exact_fallback", "invalid_exact_fallback",
+    "fallback_receipt_mismatch", "provider_boundary_ack_required", "human_review_ack_required",
+)
+SEMANTIC_GC_WARNING_ORDER = (
+    "plan_only_no_omission", "caller_declared_graph_unverified",
+    "semantic_relevance_not_evaluated", "provider_boundary_not_verified",
+    "provenance_not_verified_externally", "fallback_not_executed",
+    "human_review_still_required", "accepted_notes_are_untrusted",
+    "duplicate_content_sha256", "duplicate_receipt_id",
+    "protected_unreachable_excluded", "no_sweep_candidates",
+)
+STATIC_RELEVANCE_ID_RE = re.compile(r"^[A-Za-z0-9._:/-]{1,128}$")
+STATIC_RELEVANCE_PATH_TOKEN_SPLIT_RE = re.compile(r"[._-]+")
+STATIC_RELEVANCE_ALLOWED_FIELDS = frozenset({
+    "schema", "unit_id", "path", "task_anchor", "protection_reasons", "symbol",
+    "symbol_references", "dataflow_predecessors", "dataflow_successors", "git",
+})
+STATIC_RELEVANCE_SYMBOL_KINDS = frozenset({
+    "module", "class", "function", "method", "variable", "constant", "test", "config", "data", "unknown",
+})
+STATIC_RELEVANCE_PROTECTION_REASON_ORDER = (
+    "authentication", "authorization", "secrets", "security_sensitive", "migration",
+    "acceptance_test", "unresolved_error_evidence", "caller_protected",
+    "builtin_auth_path", "builtin_security_path", "builtin_secret_path",
+    "builtin_migration_path", "builtin_acceptance_path", "builtin_secret_material_path",
+)
+STATIC_RELEVANCE_EXPLICIT_PROTECTION_REASONS = frozenset(STATIC_RELEVANCE_PROTECTION_REASON_ORDER[:8])
+STATIC_RELEVANCE_BLOCKER_ORDER = (
+    "no_relevance_units", "relevance_unit_limit_exceeded", "relevance_unit_json_too_large",
+    "invalid_unicode_scalar", "decoder_recursion_limit", "malformed_relevance_unit_json",
+    "duplicate_relevance_unit_json_key", "non_finite_relevance_unit_json_value",
+    "relevance_unit_json_depth_exceeded", "relevance_unit_must_be_object",
+    "relevance_unit_schema_mismatch", "relevance_unit_unexpected_field",
+    "invalid_relevance_unit_id", "invalid_relevance_unit_path", "invalid_task_anchor",
+    "missing_protection_reasons", "invalid_protection_reasons", "duplicate_relevance_unit_id",
+    "no_task_anchor", "missing_symbol_signal", "invalid_symbol_signal",
+    "missing_symbol_references_signal", "invalid_symbol_references_signal",
+    "missing_dataflow_predecessors_signal", "invalid_dataflow_predecessors_signal",
+    "missing_dataflow_successors_signal", "invalid_dataflow_successors_signal",
+    "missing_git_signal", "invalid_git_signal", "missing_blame_age_signal",
+    "invalid_blame_age_signal", "missing_blame_contributor_signal",
+    "invalid_blame_contributor_signal", "missing_path_change_count_signal",
+    "invalid_path_change_count_signal", "duplicate_relation_target", "unknown_relation_target",
+    "ambiguous_relation_target", "inconsistent_dataflow_relation",
+    "protected_path_policy_required", "provider_boundary_ack_required",
+)
+STATIC_RELEVANCE_WARNING_ORDER = (
+    "caller_declared_static_evidence_unverified", "symbol_and_dataflow_semantics_not_verified",
+    "git_history_metrics_not_verified", "protected_path_detection_non_exhaustive",
+    "accepted_labels_are_untrusted_caller_data", "static_relevance_is_not_semantic_safety",
+    "review_order_does_not_authorize_omission", "hosted_provider_behavior_and_savings_unverified",
+)
+IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY = "provider-measured-matched-tasks-required"
 LOCAL_PROXY_DEFAULT_BIND_HOST = "127.0.0.1"
 LOCAL_PROXY_DEFAULT_BIND_PORT = 0
 LOCAL_PROXY_DEFAULT_TARGET_HOST = "127.0.0.1"
@@ -259,6 +496,225 @@ EXPERIMENTS: tuple[Experiment, ...] = (
             "OCR confidence/error notes when OCR is present, and missed-context guardrails before human review."
         ),
     ),
+    Experiment(
+        id="image-context-pack",
+        name="Pxpipe-inspired image context pack planning gate",
+        summary=(
+            "Plan-only evaluation gate for pxpipe-inspired image/context packing without rendering images, "
+            "emitting visual artifacts, or changing runtime behavior."
+        ),
+        stability="experimental",
+        default_enabled=False,
+        risk_level="high",
+        claim_boundary=(
+            "Image/request byte reductions are proxy evidence only; hosted token/cost savings require "
+            "provider-measured matched successful tasks."
+        ),
+        gate_requirements=(
+            "explicit opt-in",
+            "verified exact text artifact fallback before omitted text is used",
+            "protected-zone denial",
+            "provider/model measurement boundary",
+            "missed-context guardrails",
+            "relation to visual-crop-ocr",
+        ),
+        runtime_status="available-plan-only",
+        commands=("context-guard experiments plan image-context-pack",),
+        opt_in_flags=(
+            "plan image-context-pack",
+            "--exact-text-fallback-receipt",
+            "--reexpand-command",
+            "--provider-boundary-ack",
+            "--protected-zone-policy deny",
+            "--missed-context-note",
+            "--image-size",
+            "--packed-image-size",
+        ),
+        config_effect=(
+            "Registry enablement records project-local intent only; image-context-pack exposes only a deterministic "
+            "plan command. It does not add an emit/record/serve runtime, render images, run OCR, call models, proxy "
+            "traffic, write binary artifacts, or duplicate the caller-supplied visual-crop-ocr evidence-pack emitter."
+        ),
+        evidence_contract=(
+            "The planner requires acknowledgements for explicit evaluation intent, verified exact text artifact fallback, "
+            "protected-zone denial, provider/model measured matched-task boundaries, missed-context review, and the fact that "
+            "visual-crop-ocr is the existing caller-supplied visual evidence-pack surface, not a verified "
+            "exact binary/image fallback."
+        ),
+    ),
+
+    Experiment(
+        id="semantic-checkpoint",
+        name="Semantic checkpoint planning gate",
+        summary=(
+            "Plan-only evaluation gate for semantic checkpoint metadata and provenance readiness without "
+            "emitting replacement context or changing runtime behavior."
+        ),
+        stability="experimental",
+        default_enabled=False,
+        risk_level="high",
+        claim_boundary=(
+            "Semantic checkpoint metadata is dry-run planning evidence only; it cannot replace raw context or "
+            "claim hosted token/cost savings without future provider-measured matched successful tasks."
+        ),
+        gate_requirements=(
+            "explicit planning goal",
+            "verified exact context fallback before checkpoint metadata is used",
+            "provider/model measurement boundary",
+            "protected-zone denial",
+            "missed-context guardrails",
+            "provenance review acknowledgement",
+        ),
+        runtime_status="available-plan-only",
+        commands=("context-guard experiments plan semantic-checkpoint",),
+        opt_in_flags=(
+            "plan semantic-checkpoint",
+            "--goal",
+            "--constraint",
+            "--decision",
+            "--open-task",
+            "--evidence-handle",
+            "--missing-provenance-note",
+            "--unresolved-question",
+            "--exact-context-fallback-receipt",
+            "--reexpand-command",
+            "--provider-boundary-ack",
+            "--protected-zone-policy deny",
+            "--missed-context-note",
+        ),
+        config_effect=(
+            "Registry enablement records project-local intent only; semantic-checkpoint exposes only a deterministic "
+            "plan command. It does not add an emit/record/serve runtime, call models/providers, proxy traffic, write "
+            "files, edit prompts/transcripts, replace context, or emit checkpoint candidates."
+        ),
+        evidence_contract=(
+            "The planner requires a goal, exact context artifact fallback, protected-zone denial, provider/model "
+            "measured matched-task boundary, missed-context notes, and provenance review notes before checkpoint metadata "
+            "is ready for plan review; raw context remains authoritative."
+        ),
+    ),
+    Experiment(
+        id="proof-carrying-context",
+        name="Proof-carrying context metadata planning and local verification gate",
+        summary=(
+            "Plan proof-envelope metadata readiness or read-only verify explicit private local receipts without "
+            "executing rehydration or emitting compact context."
+        ),
+        stability="experimental",
+        default_enabled=False,
+        risk_level="high",
+        claim_boundary=(
+            "Local verification covers receipt/content/hash/range bounds and command binding only; it grants no "
+            "semantic-safety, freshness, protected-zone, replacement, omission, or hosted-savings authority."
+        ),
+        gate_requirements=(
+            "at least one bounded inline proof-unit JSON object",
+            "caller-declared protected-zone denial",
+            "provider/model measurement boundary acknowledgement",
+            "syntax-only proof metadata and exact rehydration binding",
+            "one explicit private no-follow artifact directory for read-only verification",
+        ),
+        runtime_status="available-plan-and-read-only-verify",
+        commands=(
+            "context-guard experiments plan proof-carrying-context",
+            "context-guard experiments verify proof-carrying-context",
+        ),
+        opt_in_flags=(
+            "plan proof-carrying-context",
+            "verify proof-carrying-context",
+            "--artifact-dir",
+            "--proof-unit-json",
+            "--provider-boundary-ack",
+            "--protected-zone-policy deny",
+        ),
+        config_effect=(
+            "Registry enablement records project-local intent only; proof-carrying-context exposes deterministic plan "
+            "and read-only local verify commands. Verify reads only explicit receipt leaves; neither command adds an "
+            "emit/record/serve runtime, executes rehydration, writes, generates compact context, or replaces context."
+        ),
+        evidence_contract=(
+            "The planner validates bounded inline proof metadata only. Verify additionally checks explicit private "
+            "receipt storage, full-content bindings, range bounds, and command syntax without executing it; timestamp "
+            "freshness, protected-zone semantics, replacement safety, and hosted savings remain unchecked."
+        ),
+    ),
+    Experiment(
+        id="semantic-gc",
+        name="Semantic graph garbage-collection planning gate",
+        summary=(
+            "Plan-only caller-declared mark-and-sweep classification with strict graph-integrity suppression "
+            "and recovery-evidence gates for human review."
+        ),
+        stability="experimental",
+        default_enabled=False,
+        risk_level="high",
+        claim_boundary=(
+            "Unreachable graph nodes are plan-review candidates, not proof of irrelevance or authorization to omit; "
+            "the planner does not read content, verify provenance, execute fallback, or call providers."
+        ),
+        gate_requirements=(
+            "complete unambiguous caller-declared graph",
+            "deny-only protected-zone declaration",
+            "candidate recovery evidence and missed-context note",
+            "provider-boundary acknowledgement for every complete graph; "
+            "human-review acknowledgement when unprotected sweep candidates exist",
+        ),
+        runtime_status="available-plan-only",
+        commands=("context-guard experiments plan semantic-gc",),
+        opt_in_flags=(
+            "plan semantic-gc", "--context-unit-json", "--provider-boundary-ack",
+            "--human-review-ack", "--protected-zone-policy deny",
+        ),
+        config_effect=(
+            "Registry enablement records project-local intent only; semantic-gc exposes one deterministic plan command. "
+            "It does not add an emit/record/serve/apply/delete/omit runtime, read context or artifacts, write files, "
+            "call models/providers/network, execute fallback, replace context, or authorize omission."
+        ),
+        evidence_contract=(
+            "The complete caller-declared graph must pass strict structural validation before iterative reachability. "
+            "Unprotected unreachable candidates require sanitized provenance, content hash, exact fallback, and an "
+            "untrusted missed-context note plus human-review acknowledgement before the plan is ready for review. "
+            "A complete graph with no unprotected sweep candidates does not require that acknowledgement. "
+            "Ready plans exit 0; blocked plans still emit their envelope and exit 2."
+        ),
+    ),
+    Experiment(
+        id="static-relevance",
+        name="Static relevance evidence compiler",
+        summary=(
+            "Compile bounded caller-declared symbol, dataflow, and git-history signals into deterministic "
+            "human-review diagnostics with protected-retention vetoes."
+        ),
+        stability="experimental",
+        default_enabled=False,
+        risk_level="high",
+        claim_boundary=(
+            "Static evidence and review order are unverified plan-review diagnostics only; they do not authorize "
+            "deprioritization, omission, deletion, replacement, or runtime action."
+        ),
+        gate_requirements=(
+            "complete bounded inline caller-declared static evidence",
+            "unambiguous reciprocal dataflow relations and at least one task anchor",
+            "deny-only protected-path policy",
+            "provider-boundary acknowledgement",
+        ),
+        runtime_status="available-plan-only",
+        commands=("context-guard experiments plan static-relevance",),
+        opt_in_flags=(
+            "plan static-relevance", "--relevance-unit-json", "--provider-boundary-ack",
+            "--protected-path-policy deny",
+        ),
+        config_effect=(
+            "Registry enablement records project-local intent only; static-relevance exposes one deterministic plan "
+            "command and never scans repositories, reads source, invokes git/parsers/providers/subprocesses, writes "
+            "files, or authorizes runtime selection or omission."
+        ),
+        evidence_contract=(
+            "Every caller-supplied symbol, relation, dataflow, and git signal must be syntactically complete and "
+            "internally consistent before slices or review ordering are compiled. Protected paths and explicit "
+            "protected evidence are retention vetoes. All evidence remains unverified."
+        ),
+    ),
     Experiment(
         id="learned-compression",
         name="Learned/synthetic compression candidate gate",
@@ -395,6 +851,15 @@ class RegistryError(RuntimeError):
     pass
 
 
+class StoreOnceAction(argparse.Action):
+    """Store a sensitive option once without echoing either supplied value."""
+
+    def __call__(self, parser, namespace, values, option_string=None):
+        if getattr(namespace, self.dest, None) is not None:
+            raise argparse.ArgumentError(self, "--artifact-dir may be specified only once")
+        setattr(namespace, self.dest, values)
+
+
 def fail(message: str, code: int = 2) -> NoReturn:
     print(f"{TOOL_NAME}: {message}", file=sys.stderr)
     raise SystemExit(code)
@@ -1564,175 +2029,2958 @@ def read_visual_ocr_text(args: argparse.Namespace) -> dict[str, Any]:
         text = raw.decode("utf-8", errors="replace")
         valid_encoding = False
     return {
-        "source_type": source_type,
-        "source_label": source_label,
-        "bytes": len(raw),
-        "lines": len(text.splitlines()),
-        "sha256": hashlib.sha256(raw).hexdigest() if raw else None,
-        "truncated": truncated,
-        "max_bytes": MAX_VISUAL_OCR_TEXT_BYTES,
-        "valid_utf8": valid_encoding,
-        "text": text,
-        "text_preview": text,
-        "has_text": bool(text.strip()),
+        "source_type": source_type,
+        "source_label": source_label,
+        "bytes": len(raw),
+        "lines": len(text.splitlines()),
+        "sha256": hashlib.sha256(raw).hexdigest() if raw else None,
+        "truncated": truncated,
+        "max_bytes": MAX_VISUAL_OCR_TEXT_BYTES,
+        "valid_utf8": valid_encoding,
+        "text": text,
+        "text_preview": text,
+        "has_text": bool(text.strip()),
+    }
+
+
+def visual_crop_ocr_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
+    full_receipt = args.full_evidence_receipt.strip() if args.full_evidence_receipt else None
+    full_label = args.full_evidence_label.strip() if args.full_evidence_label else None
+    missed_context_notes = clean_values(args.missed_context_note)
+    ocr_error_notes = clean_values(args.ocr_error_note)
+    crop_label = args.crop_label.strip() if args.crop_label else None
+
+    bounds = parse_int_tuple(args.crop_bounds, count=4)
+    image_size = parse_int_tuple(args.image_size, count=2)
+    bounds_payload, image_payload = crop_payload(bounds, image_size)
+    crop_fields_present = any(value is not None and str(value).strip() for value in (args.crop_label, args.crop_bounds, args.image_size))
+    crop_geometry_valid, crop_exceeds = valid_crop_geometry(bounds, image_size)
+    crop_complete = bool(crop_label and crop_geometry_valid and not crop_exceeds)
+
+    ocr_text = read_visual_ocr_text(args)
+    confidence, confidence_error = parse_confidence(args.ocr_confidence)
+    ocr_fields_present = any(
+        [
+            args.ocr_text is not None,
+            args.ocr_text_file is not None,
+            args.ocr_confidence is not None,
+            bool(ocr_error_notes),
+        ]
+    )
+    ocr_complete = bool(
+        ocr_text["has_text"]
+        and ocr_text["valid_utf8"]
+        and not ocr_text["truncated"]
+        and confidence_error is None
+        and ocr_error_notes
+    )
+
+    blockers: list[str] = []
+    if not full_receipt:
+        blockers.append("missing_full_evidence_receipt")
+    if not missed_context_notes:
+        blockers.append("missing_missed_context_note")
+    if not crop_complete and not ocr_complete:
+        blockers.append("missing_derived_evidence")
+
+    if crop_fields_present and (not crop_label or not crop_geometry_valid):
+        blockers.append("invalid_crop_bounds")
+    elif crop_fields_present and crop_exceeds:
+        blockers.append("crop_exceeds_image_bounds")
+
+    if ocr_fields_present:
+        if confidence_error == "missing":
+            blockers.append("missing_ocr_confidence")
+        elif confidence_error == "invalid":
+            blockers.append("invalid_ocr_confidence")
+        if not ocr_error_notes:
+            blockers.append("missing_ocr_error_note")
+        if not ocr_text["has_text"]:
+            blockers.append("missing_ocr_text")
+        if not ocr_text["valid_utf8"]:
+            blockers.append("invalid_ocr_text_encoding")
+        if ocr_text["truncated"]:
+            blockers.append("ocr_text_truncated")
+
+    # Preserve stable ordering while avoiding duplicates when incomplete derived
+    # evidence also contributed path-specific blockers.
+    blockers = list(dict.fromkeys(blockers))
+    status = "ready_for_human_review" if not blockers else "blocked_until_visual_evidence"
+
+    return {
+        "tool": TOOL_NAME,
+        "schema_version": CONFIG_SCHEMA_VERSION,
+        "experiment_id": "visual-crop-ocr",
+        "mode": "dry_run",
+        "status": status,
+        "external_services": {
+            "called": False,
+            "ocr_service": None,
+            "image_service": None,
+            "network": False,
+        },
+        "full_visual_evidence": {
+            "required": True,
+            "available": bool(full_receipt),
+            "receipt_id": full_receipt,
+            "label": full_label,
+            "verified": False,
+            "note": "G004 records user-supplied full visual evidence handles only; it does not verify receipt storage.",
+        },
+        "derived_evidence": {
+            "crop": {
+                "available": crop_complete,
+                "label": crop_label,
+                "bounds": bounds_payload,
+                "image_size": image_payload,
+                "source": "user_supplied_metadata" if crop_fields_present else None,
+            },
+            "ocr": {
+                "available": ocr_complete,
+                "source_type": ocr_text["source_type"],
+                "source_label": ocr_text["source_label"],
+                "text_preview": ocr_text["text_preview"] if ocr_text["has_text"] else None,
+                "metadata": {
+                    "bytes": ocr_text["bytes"],
+                    "lines": ocr_text["lines"],
+                    "sha256": ocr_text["sha256"],
+                    "truncated": ocr_text["truncated"],
+                    "max_bytes": ocr_text["max_bytes"],
+                    "valid_utf8": ocr_text["valid_utf8"],
+                },
+                "confidence": confidence,
+                "error_notes": ocr_error_notes,
+            },
+        },
+        "guardrails": {
+            "original_evidence_required": True,
+            "full_visual_evidence_must_remain_available": True,
+            "external_ocr_service_allowed": False,
+            "external_image_service_allowed": False,
+            "human_review_required": True,
+            "missed_context_review_required": True,
+            "confidence_error_notes_required_for_ocr": True,
+            "stable_runtime_behavior_changed": False,
+            "candidate_replacement_allowed": False,
+        },
+        "review_plan": {
+            "readiness_blockers": blockers,
+            "missed_context_notes": missed_context_notes,
+            "next_steps": [
+                "Keep full visual evidence retrievable before relying on cropped or OCR-derived evidence.",
+                "Review crop bounds and OCR text against the original evidence for missed context.",
+                "Do not claim hosted image/text token or cost savings from this dry-run plan.",
+            ],
+        },
+        "claim_boundary": (
+            "Dry-run visual/OCR fixture planning only; no hosted visual/text token or cost savings claim without "
+            "provider-measured matched successful tasks."
+        ),
+        "candidate_replacement": None,
+    }
+
+
+def command_plan_visual_crop_ocr(args: argparse.Namespace) -> int:
+    payload = visual_crop_ocr_plan_payload(args)
+    if args.json:
+        emit_json(payload)
+    else:
+        print("ContextGuard visual crop/OCR plan (dry-run only)")
+        print("No external OCR/image service was called and no replacement evidence was emitted.")
+        print(f"Status: {payload['status']}")
+        print(f"Full evidence available: {payload['full_visual_evidence']['available']} verified=false")
+        print(
+            "Derived evidence: "
+            f"crop={payload['derived_evidence']['crop']['available']} "
+            f"ocr={payload['derived_evidence']['ocr']['available']}"
+        )
+        if payload["review_plan"]["readiness_blockers"]:
+            print(f"Readiness blockers: {', '.join(payload['review_plan']['readiness_blockers'])}")
+        print(payload["claim_boundary"])
+    return 0
+
+
+def image_context_pack_size_payload(raw: str | None) -> tuple[dict[str, Any] | None, bool]:
+    size = parse_int_tuple(raw, count=2)
+    if raw is None or not str(raw).strip():
+        return None, True
+    if size is None:
+        return None, False
+    width, height = size
+    if width <= 0 or height <= 0:
+        return {"width": width, "height": height}, False
+    return {"width": width, "height": height}, True
+
+
+def image_context_pack_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
+    receipt_id = args.exact_text_fallback_receipt.strip() if args.exact_text_fallback_receipt else None
+    reexpand_command = args.reexpand_command.strip() if args.reexpand_command else None
+    reexpand_valid, fallback_blocker = valid_learned_reexpand_command(receipt_id, reexpand_command)
+    fallback_blocker_map = {
+        "missing_exact_fallback": "missing_exact_text_fallback",
+        "invalid_reexpand_command": "invalid_exact_text_reexpand_command",
+    }
+    source_size, source_size_valid = image_context_pack_size_payload(args.image_size)
+    packed_size, packed_size_valid = image_context_pack_size_payload(args.packed_image_size)
+    missed_context_notes = clean_values(args.missed_context_note)
+    protected_policy = (args.protected_zone_policy or "deny").strip().lower()
+
+    blockers: list[str] = []
+    if fallback_blocker:
+        blockers.append(fallback_blocker_map.get(fallback_blocker, fallback_blocker))
+    if not args.provider_boundary_ack:
+        blockers.append("missing_provider_measurement_boundary")
+    if not missed_context_notes:
+        blockers.append("missing_missed_context_note")
+    if protected_policy != "deny":
+        blockers.append("protected_zone_denial_required")
+    if not source_size_valid:
+        blockers.append("invalid_image_size")
+    if not packed_size_valid:
+        blockers.append("invalid_packed_image_size")
+    blockers = list(dict.fromkeys(blockers))
+
+    source_area = source_size["width"] * source_size["height"] if source_size and source_size_valid else None
+    packed_area = packed_size["width"] * packed_size["height"] if packed_size and packed_size_valid else None
+    area_delta = source_area - packed_area if source_area is not None and packed_area is not None else None
+    ready = not blockers
+
+    return {
+        "tool": TOOL_NAME,
+        "schema_version": CONFIG_SCHEMA_VERSION,
+        "plan_schema_version": IMAGE_CONTEXT_PACK_PLAN_SCHEMA_VERSION,
+        "experiment_id": "image-context-pack",
+        "mode": "dry_run",
+        "status": "ready_for_plan_review" if ready else "blocked_until_image_context_pack_gate_ready",
+        "plan_only": {
+            "command_advertised": True,
+            "emit_command_available": False,
+            "record_command_available": False,
+            "serve_command_available": False,
+            "runtime_behavior_changed": False,
+            "replacement_or_visual_evidence_emitted": False,
+        },
+        "external_services": {
+            "called": False,
+            "network": False,
+            "model_calls": False,
+            "ocr_service": None,
+            "image_service": None,
+            "proxy_forwarding": False,
+        },
+        "runtime_side_effects": {
+            "files_written": False,
+            "image_rendering": False,
+            "ocr_execution": False,
+            "image_parsing": False,
+            "binary_artifacts_written": False,
+            "proxy_forwarding": False,
+            "stable_runtime_behavior_changed": False,
+        },
+        "text_fallback": {
+            "required": True,
+            "available": bool(reexpand_valid),
+            "receipt_id": receipt_id,
+            "reexpand_command": reexpand_command,
+            "verified": False,
+            "must_be_verified_before_omitted_text_is_used": True,
+            "note": (
+                "This dry-run validates only local receipt/re-expand shape. A future runtime must verify exact "
+                "text artifact content before relying on omitted exact text."
+            ),
+        },
+        "protected_zones": {
+            "policy": protected_policy,
+            "override_allowed": False,
+            "denied_classes": [
+                "code",
+                "diffs",
+                "identifiers",
+                "hashes",
+                "paths",
+                "numeric_constants",
+                "json_keys",
+                "stack_frames",
+                "secrets",
+                "prompt_like_instructions",
+            ],
+        },
+        "image_pack_plan": {
+            "source_label": sanitize_self_hosted_text(args.source_label) if args.source_label else "manual-plan",
+            "source_image_size": source_size,
+            "packed_image_size": packed_size,
+            "source_area": source_area,
+            "packed_area": packed_area,
+            "area_delta": area_delta,
+            "area_reduction_is_proxy_only": area_delta is not None,
+            "image_or_request_byte_reductions_are_proxy_evidence_only": True,
+        },
+        "measurement_boundary": {
+            "provider_boundary_acknowledged": bool(args.provider_boundary_ack),
+            "provider_boundary_policy": IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY,
+            "provider_measured_matched_tasks_required_for_hosted_claims": True,
+            "provider_model_specific": True,
+            "hosted_api_token_savings_claim_allowed": False,
+            "hosted_api_cost_savings_claim_allowed": False,
+        },
+        "relation_to_visual_crop_ocr": {
+            "visual_crop_ocr_is_existing_surface": True,
+            "visual_crop_ocr_remains_caller_supplied_visual_evidence_pack": True,
+            "image_context_pack_is_planning_gate_not_duplicate_emitter": True,
+            "verified_exact_binary_or_image_fallback_claimed": False,
+        },
+        "review_plan": {
+            "readiness_blockers": blockers,
+            "missed_context_notes": missed_context_notes,
+            "next_steps": [
+                "Keep exact text artifact fallback verified before any future image/context packing omits source text.",
+                "Deny protected evidence zones before any future lossy visual packing is considered.",
+                "Measure provider/model token and cost fields on matched successful tasks before any hosted savings claim.",
+                "Use visual-crop-ocr only for caller-supplied visual evidence packs; this gate emits no images or evidence.",
+            ],
+        },
+        "claim_boundary": (
+            "Dry-run image-context-pack planning only; image/request byte reductions are proxy evidence and no hosted "
+            "token/cost savings claim is allowed without provider-measured matched successful tasks."
+        ),
+        "candidate_replacement": None,
+    }
+
+
+def command_plan_image_context_pack(args: argparse.Namespace) -> int:
+    payload = image_context_pack_plan_payload(args)
+    if args.json:
+        emit_json(payload)
+    else:
+        print("ContextGuard image-context-pack plan (dry-run only)")
+        print("No image rendering, OCR/image service, model call, proxy forwarding, binary artifact, or replacement was emitted.")
+        print(f"Status: {payload['status']}")
+        if payload["review_plan"]["readiness_blockers"]:
+            print(f"Readiness blockers: {', '.join(payload['review_plan']['readiness_blockers'])}")
+        print(payload["claim_boundary"])
+    return 0
+
+
+def semantic_checkpoint_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
+    goal = args.goal.strip() if args.goal else None
+    receipt_id = args.exact_context_fallback_receipt.strip() if args.exact_context_fallback_receipt else None
+    reexpand_command = args.reexpand_command.strip() if args.reexpand_command else None
+    reexpand_valid, fallback_blocker = valid_learned_reexpand_command(receipt_id, reexpand_command)
+    fallback_blocker_map = {
+        "missing_exact_fallback": "missing_exact_context_fallback",
+        "invalid_reexpand_command": "invalid_exact_context_reexpand_command",
+    }
+    protected_policy = (args.protected_zone_policy or "deny").strip().lower()
+    missed_context_notes = clean_values(args.missed_context_note)
+    missing_provenance_notes = clean_values(args.missing_provenance_note)
+
+    blockers: list[str] = []
+    if not goal:
+        blockers.append("missing_goal")
+    if fallback_blocker:
+        blockers.append(fallback_blocker_map.get(fallback_blocker, fallback_blocker))
+    if not args.provider_boundary_ack:
+        blockers.append("missing_provider_measurement_boundary")
+    if protected_policy != "deny":
+        blockers.append("protected_zone_denial_required")
+    if not missed_context_notes:
+        blockers.append("missing_missed_context_note")
+    if not missing_provenance_notes:
+        blockers.append("missing_provenance_review")
+    blockers = list(dict.fromkeys(blockers))
+    ready = not blockers
+
+    return {
+        "tool": TOOL_NAME,
+        "schema_version": CONFIG_SCHEMA_VERSION,
+        "plan_schema_version": SEMANTIC_CHECKPOINT_PLAN_SCHEMA_VERSION,
+        "experiment_id": "semantic-checkpoint",
+        "mode": "dry_run",
+        "status": "ready_for_plan_review" if ready else "blocked_until_semantic_checkpoint_gate_ready",
+        "plan_only": {
+            "command_advertised": True,
+            "emit_command_available": False,
+            "record_command_available": False,
+            "serve_command_available": False,
+            "runtime_behavior_changed": False,
+            "replacement_context_emitted": False,
+        },
+        "external_services": {
+            "called": False,
+            "network": False,
+            "model_calls": False,
+            "provider_calls": False,
+            "proxy_forwarding": False,
+        },
+        "runtime_side_effects": {
+            "files_written": False,
+            "transcript_edited": False,
+            "prompt_edited": False,
+            "context_replaced": False,
+            "stable_runtime_behavior_changed": False,
+        },
+        "checkpoint_metadata": {
+            "goal": goal,
+            "constraints": clean_values(args.constraint),
+            "decisions": clean_values(args.decision),
+            "open_tasks": clean_values(args.open_task),
+            "evidence_provenance_handles": clean_values(args.evidence_handle),
+            "unresolved_questions": clean_values(args.unresolved_question),
+        },
+        "exact_context_fallback": {
+            "required": True,
+            "available": bool(reexpand_valid),
+            "receipt_id": receipt_id,
+            "reexpand_command": reexpand_command,
+            "verified": False,
+            "must_be_verified_before_checkpoint_metadata_is_used": True,
+            "allowed_reexpand_shapes": [
+                "context-guard-artifact get RECEIPT --full",
+                "context-guard artifact get RECEIPT --full",
+            ],
+        },
+        "protected_zones": {
+            "policy": protected_policy,
+            "override_allowed": False,
+            "denied_classes": [
+                "code",
+                "diffs",
+                "identifiers",
+                "hashes",
+                "paths",
+                "numeric_constants",
+                "json_keys",
+                "stack_frames",
+                "secrets",
+                "prompt_like_instructions",
+            ],
+        },
+        "measurement_boundary": {
+            "provider_boundary_acknowledged": bool(args.provider_boundary_ack),
+            "provider_boundary_policy": IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY,
+            "provider_measured_matched_tasks_required_for_hosted_claims": True,
+            "provider_model_specific": True,
+            "hosted_api_token_savings_claim_allowed": False,
+            "hosted_api_cost_savings_claim_allowed": False,
+        },
+        "provenance_review": {
+            "required": True,
+            "reviewed": bool(missing_provenance_notes),
+            "missing_provenance_notes": missing_provenance_notes,
+            "missing_provenance_warnings": [] if missing_provenance_notes else ["missing_provenance_review"],
+            "checkpoint_cannot_replace_raw_context_without_complete_provenance": True,
+        },
+        "review_plan": {
+            "readiness_blockers": blockers,
+            "missed_context_notes": missed_context_notes,
+            "next_steps": [
+                "Keep exact raw context fallback verified before checkpoint metadata is used.",
+                "Deny protected evidence zones before any semantic checkpoint summary is considered.",
+                "Keep provenance handles and missing-provenance review notes attached to checkpoint metadata.",
+                "Measure provider/model token and cost fields on matched successful tasks before any hosted savings claim.",
+            ],
+        },
+        "claim_boundary": (
+            "Dry-run semantic-checkpoint planning only; checkpoint metadata is not replacement context and no hosted "
+            "token/cost savings claim is allowed without provider-measured matched successful tasks."
+        ),
+        "candidate_replacement": None,
+    }
+
+
+def command_plan_semantic_checkpoint(args: argparse.Namespace) -> int:
+    payload = semantic_checkpoint_plan_payload(args)
+    if args.json:
+        emit_json(payload)
+    else:
+        print("ContextGuard semantic-checkpoint plan (dry-run only)")
+        print("No files, prompts, transcripts, model/provider calls, proxy forwarding, or replacement context were emitted.")
+        print(f"Status: {payload['status']}")
+        if payload["review_plan"]["readiness_blockers"]:
+            print(f"Readiness blockers: {', '.join(payload['review_plan']['readiness_blockers'])}")
+        print(payload["claim_boundary"])
+    return 0
+
+
+_PROOF_NONFINITE_SENTINEL = object()
+
+
+def ordered_proof_taxonomy(values: list[str] | set[str], order: tuple[str, ...]) -> list[str]:
+    selected = set(values)
+    return [value for value in order if value in selected]
+
+
+def empty_proof_unit_row(unit_index: int, issue: str) -> dict[str, Any]:
+    return {
+        "captured_at": None,
+        "content_hash": {
+            "algorithm": "sha256",
+            "content_verified": False,
+            "syntax_valid": False,
+            "value": None,
+        },
+        "receipt": {
+            "id": None,
+            "storage_checked": False,
+            "syntax_valid": False,
+        },
+        "rehydration": {
+            "command": None,
+            "executed": False,
+            "receipt_bound": False,
+            "syntax_valid": False,
+        },
+        "safe_range": None,
+        "source_label": None,
+        "syntax_and_consistency_valid": False,
+        "transform_policy": None,
+        "unit_index": unit_index,
+        "validation_issues": [issue],
+        "warnings": [],
+    }
+
+
+def decode_proof_unit_json(raw: Any, unit_index: int) -> tuple[dict[str, Any] | None, dict[str, Any] | None]:
+    if not isinstance(raw, str):
+        return None, empty_proof_unit_row(unit_index, "invalid_proof_unit_json")
+    try:
+        encoded = raw.encode("utf-8", errors="strict")
+    except UnicodeEncodeError:
+        return None, empty_proof_unit_row(unit_index, "invalid_proof_unit_unicode")
+    if len(encoded) > PROOF_CARRYING_CONTEXT_UNIT_JSON_BYTE_CAP:
+        return None, empty_proof_unit_row(unit_index, "proof_unit_json_too_large")
+
+    duplicate_keys = False
+
+    def proof_object_pairs_hook(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+        nonlocal duplicate_keys
+        result: dict[str, Any] = {}
+        for key, value in pairs:
+            if key in result:
+                duplicate_keys = True
+            result[key] = value
+        return result
+
+    try:
+        decoded = json.loads(
+            raw,
+            object_pairs_hook=proof_object_pairs_hook,
+            parse_constant=lambda _value: _PROOF_NONFINITE_SENTINEL,
+        )
+    except RecursionError:
+        return None, empty_proof_unit_row(unit_index, "proof_unit_json_nesting_too_deep")
+    except (json.JSONDecodeError, ValueError, TypeError):
+        return None, empty_proof_unit_row(unit_index, "invalid_proof_unit_json")
+
+    depth_exceeded = False
+    decoded_unicode_invalid = False
+    nonfinite_number = False
+    stack: list[tuple[Any, int]] = [(decoded, 0)]
+    while stack:
+        value, depth = stack.pop()
+        if depth > PROOF_UNIT_JSON_MAX_DEPTH:
+            depth_exceeded = True
+        if isinstance(value, str):
+            try:
+                value.encode("utf-8", errors="strict")
+            except UnicodeEncodeError:
+                decoded_unicode_invalid = True
+        elif value is _PROOF_NONFINITE_SENTINEL:
+            nonfinite_number = True
+        elif type(value) is float and not math.isfinite(value):
+            nonfinite_number = True
+
+        if depth > PROOF_UNIT_JSON_MAX_DEPTH:
+            continue
+        if isinstance(value, dict):
+            next_depth = depth + 1
+            for key, child in value.items():
+                stack.append((key, next_depth))
+                stack.append((child, next_depth))
+        elif isinstance(value, list):
+            next_depth = depth + 1
+            for child in value:
+                stack.append((child, next_depth))
+
+    if duplicate_keys:
+        return None, empty_proof_unit_row(unit_index, "duplicate_proof_unit_keys")
+    if depth_exceeded:
+        return None, empty_proof_unit_row(unit_index, "proof_unit_json_nesting_too_deep")
+    if nonfinite_number:
+        return None, empty_proof_unit_row(unit_index, "nonfinite_proof_unit_number")
+    if decoded_unicode_invalid:
+        return None, empty_proof_unit_row(unit_index, "invalid_proof_unit_unicode")
+    if not isinstance(decoded, dict):
+        return None, empty_proof_unit_row(unit_index, "proof_unit_not_object")
+    return decoded, None
+
+
+def normalize_required_proof_string(
+    obj: dict[str, Any],
+    field: str,
+    missing_issue: str,
+    invalid_issue: str,
+    validator: Any,
+    issues: list[str],
+) -> str | None:
+    raw = obj.get(field)
+    if raw is None or (isinstance(raw, str) and not raw.strip()):
+        issues.append(missing_issue)
+        return None
+    if not isinstance(raw, str):
+        issues.append(invalid_issue)
+        return None
+    value = raw.strip()
+    if not validator(value):
+        issues.append(invalid_issue)
+        return None
+    return value
+
+
+def valid_proof_timestamp(value: str) -> bool:
+    if PROOF_CAPTURED_AT_RE.fullmatch(value) is None:
+        return False
+    try:
+        datetime.strptime(value, "%Y-%m-%dT%H:%M:%SZ")
+    except ValueError:
+        return False
+    return True
+
+
+def normalize_proof_safe_range(
+    obj: dict[str, Any],
+    issues: list[str],
+) -> tuple[dict[str, Any] | None, bool, bool]:
+    if "safe_range" not in obj or obj.get("safe_range") is None:
+        return None, False, False
+    raw = obj.get("safe_range")
+    if not isinstance(raw, dict) or set(raw) != {"kind", "start", "end"}:
+        issues.append("invalid_safe_range")
+        return None, True, True
+    kind = raw.get("kind")
+    start = raw.get("start")
+    end = raw.get("end")
+    if type(start) is not int or type(end) is not int:
+        issues.append("invalid_safe_range")
+        return None, True, True
+    if kind == "lines":
+        valid = 1 <= start <= end <= JSON_SAFE_INTEGER_MAX
+        coordinate_system = "one_based_inclusive"
+    elif kind == "bytes":
+        valid = 0 <= start < end <= JSON_SAFE_INTEGER_MAX
+        coordinate_system = "zero_based_half_open"
+    else:
+        valid = False
+        coordinate_system = ""
+    if not valid:
+        issues.append("invalid_safe_range")
+        return None, True, True
+    return {
+        "coordinate_system": coordinate_system,
+        "end": end,
+        "kind": kind,
+        "start": start,
+    }, True, False
+
+
+def parse_proof_rehydrate_command(command: str) -> tuple[bool, str | None]:
+    if any(character in command for character in ";|&><`$\\\n\r"):
+        return False, None
+    try:
+        argv = shlex.split(command)
+    except ValueError:
+        return False, None
+    receipt: str | None = None
+    if len(argv) == 4 and argv[0:2] == ["context-guard-artifact", "get"] and argv[3] == "--full":
+        receipt = argv[2]
+    elif len(argv) == 5 and argv[0:3] == ["context-guard", "artifact", "get"] and argv[4] == "--full":
+        receipt = argv[3]
+    if receipt is None or PROOF_RECEIPT_ID_RE.fullmatch(receipt) is None:
+        return False, None
+    return True, receipt
+
+
+def normalize_proof_unit(obj: dict[str, Any], unit_index: int) -> tuple[dict[str, Any], str | None, str | None]:
+    issues: list[str] = []
+    if set(obj) - PROOF_UNIT_ALLOWED_FIELDS:
+        issues.append("unknown_proof_unit_fields")
+
+    source_label = normalize_required_proof_string(
+        obj,
+        "source_label",
+        "missing_source_label",
+        "invalid_source_label",
+        lambda value: PROOF_SOURCE_LABEL_RE.fullmatch(value) is not None,
+        issues,
+    )
+    receipt_id = normalize_required_proof_string(
+        obj,
+        "receipt_id",
+        "missing_receipt",
+        "invalid_receipt",
+        lambda value: PROOF_RECEIPT_ID_RE.fullmatch(value) is not None,
+        issues,
+    )
+    content_sha256 = normalize_required_proof_string(
+        obj,
+        "content_sha256",
+        "missing_content_sha256",
+        "invalid_content_sha256",
+        lambda value: PROOF_CONTENT_SHA256_RE.fullmatch(value) is not None,
+        issues,
+    )
+    captured_at = normalize_required_proof_string(
+        obj,
+        "captured_at",
+        "missing_timestamp",
+        "invalid_timestamp",
+        valid_proof_timestamp,
+        issues,
+    )
+    raw_transform_policy = obj.get("transform_policy")
+    transform_policy: str | None = None
+    if raw_transform_policy is None or (
+        isinstance(raw_transform_policy, str) and not raw_transform_policy.strip()
+    ):
+        issues.append("missing_transform_policy")
+    elif not isinstance(raw_transform_policy, str) or raw_transform_policy not in {
+        "identity",
+        "safe_range_extract",
+    }:
+        issues.append("invalid_transform_policy")
+    else:
+        transform_policy = raw_transform_policy
+    safe_range, safe_range_supplied, safe_range_invalid = normalize_proof_safe_range(obj, issues)
+    if transform_policy == "safe_range_extract" and not safe_range_supplied and not safe_range_invalid:
+        issues.append("missing_safe_range_for_transform_policy")
+
+    raw_command = obj.get("rehydrate_command")
+    command_value: str | None = None
+    command_syntax_valid = False
+    command_receipt: str | None = None
+    if raw_command is None or (isinstance(raw_command, str) and not raw_command.strip()):
+        issues.append("missing_rehydrate_command")
+    elif not isinstance(raw_command, str):
+        issues.append("invalid_rehydrate_command")
+    else:
+        command_syntax_valid, command_receipt = parse_proof_rehydrate_command(raw_command)
+        if not command_syntax_valid:
+            issues.append("invalid_rehydrate_command")
+
+    receipt_bound = bool(
+        command_syntax_valid
+        and receipt_id is not None
+        and command_receipt == receipt_id
+    )
+    if command_syntax_valid and receipt_id is not None and command_receipt != receipt_id:
+        issues.append("rehydrate_receipt_mismatch")
+    if receipt_bound and isinstance(raw_command, str):
+        command_value = raw_command.strip()
+
+    ordered_issues = ordered_proof_taxonomy(issues, PROOF_READINESS_BLOCKER_ORDER)
+    row = {
+        "captured_at": captured_at,
+        "content_hash": {
+            "algorithm": "sha256",
+            "content_verified": False,
+            "syntax_valid": content_sha256 is not None,
+            "value": content_sha256,
+        },
+        "receipt": {
+            "id": receipt_id,
+            "storage_checked": False,
+            "syntax_valid": receipt_id is not None,
+        },
+        "rehydration": {
+            "command": command_value,
+            "executed": False,
+            "receipt_bound": receipt_bound,
+            "syntax_valid": command_syntax_valid,
+        },
+        "safe_range": safe_range,
+        "source_label": source_label,
+        "syntax_and_consistency_valid": not ordered_issues,
+        "transform_policy": transform_policy,
+        "unit_index": unit_index,
+        "validation_issues": ordered_issues,
+        "warnings": [],
+    }
+    return row, receipt_id, content_sha256
+
+
+def proof_duplicate_key(row: dict[str, Any]) -> tuple[Any, ...]:
+    safe_range = row["safe_range"]
+    normalized_range = None if safe_range is None else (
+        safe_range["kind"],
+        safe_range["start"],
+        safe_range["end"],
+    )
+    return (
+        row["source_label"],
+        row["receipt"]["id"],
+        row["content_hash"]["value"],
+        normalized_range,
+        row["captured_at"],
+        row["transform_policy"],
+        row["rehydration"]["command"],
+    )
+
+
+def proof_verification_scope() -> dict[str, Any]:
+    return {
+        "content_hash_verified": False,
+        "cross_field_consistency_checked": True,
+        "cross_unit_receipt_hash_consistency_checked": True,
+        "decoded_number_finiteness_checked": True,
+        "decoded_unicode_checked": True,
+        "duplicate_json_keys_checked": True,
+        "field_syntax_checked": True,
+        "json_depth_checked": True,
+        "json_syntax_checked": True,
+        "protected_zone_compliance_checked": False,
+        "receipt_content_read": False,
+        "receipt_storage_checked": False,
+        "rehydration_executed": False,
+        "safe_range_bounds_checked": False,
+        "semantics": "validator_capability_invariant",
+        "source_content_read": False,
+    }
+
+
+def proof_carrying_context_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
+    raw_units = args.proof_unit_json or []
+    supplied_count = len(raw_units)
+    detailed_count = min(supplied_count, PROOF_CARRYING_CONTEXT_DETAILED_UNIT_CAP)
+    overflow_count = max(supplied_count - PROOF_CARRYING_CONTEXT_DETAILED_UNIT_CAP, 0)
+    detailed_raw_units = raw_units[:PROOF_CARRYING_CONTEXT_DETAILED_UNIT_CAP]
+
+    rows: list[dict[str, Any]] = []
+    conflict_inputs: list[tuple[str | None, str | None]] = []
+    for unit_index, raw in enumerate(detailed_raw_units):
+        decoded, terminal_row = decode_proof_unit_json(raw, unit_index)
+        if terminal_row is not None:
+            rows.append(terminal_row)
+            conflict_inputs.append((None, None))
+            continue
+        assert decoded is not None
+        row, receipt_id, content_sha256 = normalize_proof_unit(decoded, unit_index)
+        rows.append(row)
+        conflict_inputs.append((receipt_id, content_sha256))
+
+    hashes_by_receipt: dict[str, set[str]] = {}
+    for receipt_id, content_sha256 in conflict_inputs:
+        if receipt_id is not None and content_sha256 is not None:
+            hashes_by_receipt.setdefault(receipt_id, set()).add(content_sha256)
+    conflicted_receipts = {
+        receipt_id for receipt_id, hashes in hashes_by_receipt.items() if len(hashes) > 1
+    }
+    for row, (receipt_id, _content_sha256) in zip(rows, conflict_inputs):
+        if receipt_id in conflicted_receipts:
+            row["validation_issues"] = ordered_proof_taxonomy(
+                [*row["validation_issues"], "receipt_hash_conflict"],
+                PROOF_READINESS_BLOCKER_ORDER,
+            )
+
+    duplicate_groups: dict[tuple[Any, ...], list[int]] = {}
+    for row in rows:
+        if not row["validation_issues"]:
+            duplicate_groups.setdefault(proof_duplicate_key(row), []).append(row["unit_index"])
+    duplicate_indexes = {
+        unit_index
+        for indexes in duplicate_groups.values()
+        if len(indexes) > 1
+        for unit_index in indexes
+    }
+
+    valid_count = 0
+    for row in rows:
+        row_valid = not row["validation_issues"]
+        row["syntax_and_consistency_valid"] = row_valid
+        if not row_valid:
+            row["warnings"] = []
+            continue
+        valid_count += 1
+        warnings = list(PROOF_WARNING_ORDER[:6])
+        if row["safe_range"] is None:
+            warnings.append("safe_range_omitted")
+        if row["unit_index"] in duplicate_indexes:
+            warnings.append("duplicate_proof_unit")
+        row["warnings"] = ordered_proof_taxonomy(warnings, PROOF_WARNING_ORDER)
+
+    protected_policy = (args.protected_zone_policy or "deny").strip().lower()
+    blockers: list[str] = []
+    if supplied_count == 0:
+        blockers.append("missing_proof_unit")
+    if overflow_count:
+        blockers.append("too_many_proof_units")
+    for row in rows:
+        blockers.extend(row["validation_issues"])
+    if protected_policy != "deny":
+        blockers.append("protected_zone_denial_required")
+    if not args.provider_boundary_ack:
+        blockers.append("missing_provider_measurement_boundary")
+    blockers = ordered_proof_taxonomy(blockers, PROOF_READINESS_BLOCKER_ORDER)
+
+    top_warnings = list(PROOF_WARNING_ORDER[:2])
+    for row in rows:
+        top_warnings.extend(row["warnings"])
+    top_warnings = ordered_proof_taxonomy(top_warnings, PROOF_WARNING_ORDER)
+    ready = not blockers
+
+    return {
+        "candidate_replacement": None,
+        "claim_boundary": (
+            "Dry-run proof-carrying-context metadata validation only; protected-zone compliance, safe-range bounds, "
+            "receipt storage, source content, SHA-256, timestamp freshness, and rehydration were not checked, no "
+            "context was generated or replaced, and no hosted token/cost savings claim is allowed without "
+            "provider-measured matched successful tasks."
+        ),
+        "experiment_id": "proof-carrying-context",
+        "external_services": {
+            "called": False,
+            "dns_lookup": False,
+            "model_calls": False,
+            "network": False,
+            "provider_calls": False,
+            "proxy_forwarding": False,
+        },
+        "measurement_boundary": {
+            "hosted_api_cost_savings_claim_allowed": False,
+            "hosted_api_token_savings_claim_allowed": False,
+            "local_metadata_readiness_is_not_hosted_savings_evidence": True,
+            "provider_boundary_acknowledged": bool(args.provider_boundary_ack),
+            "provider_boundary_policy": IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY,
+            "provider_measured_matched_successful_tasks_required_for_hosted_claims": True,
+            "provider_model_specific": True,
+        },
+        "mode": "dry_run",
+        "plan_only": {
+            "command_advertised": True,
+            "compact_context_generated": False,
+            "emit_command_available": False,
+            "evaluation_only": True,
+            "record_command_available": False,
+            "replacement_context_emitted": False,
+            "runtime_behavior_changed": False,
+            "serve_command_available": False,
+        },
+        "plan_schema_version": PROOF_CARRYING_CONTEXT_PLAN_SCHEMA_VERSION,
+        "proof_contract": {
+            "detailed_unit_cap": PROOF_CARRYING_CONTEXT_DETAILED_UNIT_CAP,
+            "hash_policy": {
+                "algorithm": "sha256",
+                "content_read": False,
+                "content_verified": False,
+                "input_format": "64_lowercase_hex",
+            },
+            "optional_input_fields": ["safe_range"],
+            "overflow_policy": {
+                "detailed_rows_emitted": False,
+                "overflow_values_echoed": False,
+                "overflow_values_encoded": False,
+                "overflow_values_parsed": False,
+            },
+            "proof_unit_input_flag": "--proof-unit-json",
+            "proof_unit_input_repeatable": True,
+            "rehydration_policy": {
+                "allowed_command_shapes": [
+                    "context-guard-artifact get RECEIPT --full",
+                    "context-guard artifact get RECEIPT --full",
+                ],
+                "command_executed": False,
+                "receipt_bound_command_required": True,
+                "receipt_storage_checked": False,
+            },
+            "required_input_fields": [
+                "source_label",
+                "receipt_id",
+                "content_sha256",
+                "captured_at",
+                "transform_policy",
+                "rehydrate_command",
+            ],
+            "safe_range_policy": {
+                "bounds_checked": False,
+                "byte_coordinate_system": "zero_based_half_open",
+                "json_safe_integer_max": JSON_SAFE_INTEGER_MAX,
+                "kinds": ["lines", "bytes"],
+                "line_coordinate_system": "one_based_inclusive",
+                "required_by_default": False,
+                "semantic_safety_checked": False,
+            },
+            "source_label_policy": {
+                "max_characters": 120,
+                "profile": "ascii-identifier-v1",
+                "raw_content_allowed": False,
+                "regex": "^[A-Za-z0-9][A-Za-z0-9._:/+-]{0,119}$",
+                "safety_checked": False,
+                "secrecy_checked": False,
+            },
+            "strict_json_policy": {
+                "decoded_unicode_must_encode_utf8": True,
+                "depth_root": 0,
+                "duplicate_keys_allowed": False,
+                "float_finiteness_check": "math.isfinite",
+                "max_depth": PROOF_UNIT_JSON_MAX_DEPTH,
+                "non_finite_numbers_allowed": False,
+                "post_decode_walk": "iterative_container_keys_and_values",
+                "raw_unicode_must_encode_utf8": True,
+                "root_must_be_object": True,
+            },
+            "timestamp_policy": {
+                "caller_supplied_only": True,
+                "current_time_generated": False,
+                "freshness_checked": False,
+                "input_format": "YYYY-MM-DDTHH:MM:SSZ",
+                "required": True,
+            },
+            "transform_policy": {
+                "allowed": ["identity", "safe_range_extract"],
+                "automatic_deletion_allowed": False,
+                "lossy_transform_allowed": False,
+                "semantic_rewrite_allowed": False,
+            },
+            "unit_json_byte_cap": PROOF_CARRYING_CONTEXT_UNIT_JSON_BYTE_CAP,
+            "verification_scope": proof_verification_scope(),
+        },
+        "proof_unit_schema_version": PROOF_CARRYING_CONTEXT_UNIT_SCHEMA_VERSION,
+        "proof_units": rows,
+        "protected_zones": {
+            "compliance_checked": False,
+            "content_inspected": False,
+            "declared_policy": protected_policy,
+            "declared_policy_only": True,
+            "denied_classes": [
+                "code",
+                "diffs",
+                "identifiers",
+                "hashes",
+                "paths",
+                "numeric_constants",
+                "json_keys",
+                "stack_frames",
+                "secrets",
+                "prompt_like_instructions",
+            ],
+            "override_allowed": False,
+            "prompt_like_instruction_compliance_checked": False,
+            "semantic_transform_permitted_by_gate": False,
+        },
+        "review_plan": {
+            "detailed_proof_unit_count": detailed_count,
+            "invalid_detailed_proof_unit_count": detailed_count - valid_count,
+            "next_steps": [
+                "Treat this result as proof-envelope metadata syntax and consistency review only.",
+                "Verify protected-zone compliance, range bounds, receipt storage, source content, SHA-256, and rehydration only in a separately approved future consumer/runtime.",
+                "Keep protected evidence and prompt-like instructions out of transformation paths.",
+                "Measure provider/model token and cost fields on matched successful tasks before any hosted savings claim.",
+            ],
+            "overflow_proof_unit_count": overflow_count,
+            "readiness_blocker_order": list(PROOF_READINESS_BLOCKER_ORDER),
+            "readiness_blockers": blockers,
+            "supplied_proof_unit_count": supplied_count,
+            "valid_detailed_proof_unit_count": valid_count,
+            "warning_order": list(PROOF_WARNING_ORDER),
+            "warnings": top_warnings,
+        },
+        "runtime_side_effects": {
+            "artifact_files_read": False,
+            "config_files_read": False,
+            "current_time_generated": False,
+            "files_written": False,
+            "prompt_edited": False,
+            "rehydrate_command_executed": False,
+            "source_files_read": False,
+            "stable_runtime_behavior_changed": False,
+            "stdin_content_read": False,
+            "subprocesses_executed": False,
+            "transcript_edited": False,
+        },
+        "schema_version": CONFIG_SCHEMA_VERSION,
+        "status": (
+            "ready_for_plan_review"
+            if ready
+            else "blocked_until_proof_carrying_context_gate_ready"
+        ),
+        "tool": TOOL_NAME,
+    }
+
+
+def command_plan_proof_carrying_context(args: argparse.Namespace) -> int:
+    payload = proof_carrying_context_plan_payload(args)
+    if args.json:
+        emit_json(payload)
+    else:
+        print("ContextGuard proof-carrying-context plan (dry-run metadata readiness only)")
+        print("No source/artifact/config/stdin content was read; no verification, context generation, replacement, network, subprocess, or file write occurred.")
+        print(f"Status: {payload['status']}")
+        if payload["review_plan"]["readiness_blockers"]:
+            print(f"Readiness blockers: {', '.join(payload['review_plan']['readiness_blockers'])}")
+        print(f"Warnings: {', '.join(payload['review_plan']['warnings'])}")
+        print(payload["claim_boundary"])
+    return 0
+
+
+def proof_verification_row(unit_index: int, blockers: list[str] | None = None) -> dict[str, Any]:
+    return {
+        "blockers": list(blockers or []),
+        "content_hash": {
+            "algorithm": "sha256",
+            "declared_value": None,
+            "matches_proof_unit": False,
+            "matches_receipt_metadata": False,
+            "verified": False,
+        },
+        "preflight_valid": False,
+        "protected_zone": {"compliance_checked": False, "status": "unchecked"},
+        "receipt": {
+            "content_file_verified": False,
+            "id": None,
+            "metadata_file_verified": False,
+            "metadata_verified": False,
+            "stored_bytes": None,
+            "stored_lines": None,
+            "verified": False,
+        },
+        "rehydration": {
+            "executed": False,
+            "receipt_bound": False,
+            "syntax_valid": False,
+            "verified": False,
+        },
+        "safe_range": None,
+        "source_label": None,
+        "status": "verification_failed",
+        "timestamp": {
+            "format_valid": False,
+            "freshness_checked": False,
+            "status": "invalid_or_unavailable",
+        },
+        "transform_policy": None,
+        "unit_index": unit_index,
+        "warnings": [],
+    }
+
+
+def normalized_proof_verification_row(plan_row: dict[str, Any]) -> dict[str, Any]:
+    row = proof_verification_row(plan_row["unit_index"])
+    safe_range = plan_row["safe_range"]
+    row.update({
+        "preflight_valid": True,
+        "source_label": plan_row["source_label"],
+        "transform_policy": plan_row["transform_policy"],
+        "timestamp": {
+            "format_valid": True,
+            "freshness_checked": False,
+            "status": "format_valid_semantics_unchecked",
+        },
+    })
+    row["receipt"]["id"] = plan_row["receipt"]["id"]
+    row["content_hash"]["declared_value"] = plan_row["content_hash"]["value"]
+    row["rehydration"] = {
+        "executed": False,
+        "receipt_bound": True,
+        "syntax_valid": True,
+        "verified": True,
+    }
+    if safe_range is not None:
+        row["safe_range"] = {
+            "bounds_checked": False,
+            "coordinate_system": safe_range["coordinate_system"],
+            "end": safe_range["end"],
+            "kind": safe_range["kind"],
+            "range_content_retrieved": False,
+            "start": safe_range["start"],
+            "status": "not_checked",
+        }
+    return row
+
+
+def proof_artifact_io_capabilities_available() -> bool:
+    return bool(
+        NO_FOLLOW_SUPPORTED
+        and hasattr(os, "O_NOFOLLOW")
+        and DIR_FD_OPEN_SUPPORTED
+        and DIR_FD_STAT_NOFOLLOW_SUPPORTED
+        and callable(getattr(os, "open", None))
+        and callable(getattr(os, "stat", None))
+        and callable(getattr(os, "fstat", None))
+        and callable(getattr(os, "geteuid", None))
+        and callable(getattr(os, "read", None))
+        and callable(getattr(os, "close", None))
+    )
+
+
+def validate_proof_artifact_dir_arg(raw: Any) -> tuple[str | None, str | None]:
+    if not isinstance(raw, str) or not raw or "\x00" in raw:
+        return None, "invalid_artifact_directory"
+    components = raw.split("/")
+    if ".." in components:
+        return None, "invalid_artifact_directory"
+    if not raw.startswith("/"):
+        first = next((component for component in components if component), "")
+        if first == "~" or first.startswith("~"):
+            return None, "invalid_artifact_directory"
+    normalized = os.path.normpath(raw)
+    if normalized.startswith("//"):
+        normalized = "/" + normalized.lstrip("/")
+    if not os.path.isabs(normalized):
+        normalized = os.path.normpath(os.path.join(os.getcwd(), normalized))
+    return normalized, None
+
+
+def normalize_proof_allowed_macos_alias(path: str) -> str:
+    parts = Path(path).parts
+    if len(parts) < 2 or parts[1] not in {"tmp", "var"}:
+        return path
+    alias = "/" + parts[1]
+    expected = "/private/" + parts[1]
+    try:
+        info = os.stat(alias, follow_symlinks=False)
+        if (
+            stat.S_ISLNK(info.st_mode)
+            and str(_normalized_link_target(Path("/"), os.readlink(alias))) == expected
+        ):
+            return os.path.join(expected, *parts[2:])
+    except OSError:
+        pass
+    return path
+
+
+def map_proof_directory_error(exc: OSError, parent_fd: int | None, component: str | None) -> str:
+    if exc.errno == errno.ENOENT:
+        return "artifact_directory_not_found"
+    if exc.errno == errno.ELOOP:
+        return "artifact_directory_symlink_rejected"
+    if exc.errno == errno.ENOTDIR:
+        if parent_fd is not None and component is not None:
+            try:
+                info = os.stat(component, dir_fd=parent_fd, follow_symlinks=False)
+                if stat.S_ISLNK(info.st_mode):
+                    return "artifact_directory_symlink_rejected"
+            except OSError:
+                pass
+        return "artifact_directory_not_regular"
+    if exc.errno in {errno.EACCES, errno.EPERM}:
+        return "artifact_directory_access_failed"
+    return "artifact_directory_access_failed"
+
+
+def open_proof_artifact_directory(path: str) -> tuple[int | None, str | None]:
+    path = normalize_proof_allowed_macos_alias(path)
+    flags = os.O_RDONLY | os.O_NOFOLLOW
+    if hasattr(os, "O_CLOEXEC"):
+        flags |= os.O_CLOEXEC
+    if hasattr(os, "O_DIRECTORY"):
+        flags |= os.O_DIRECTORY
+    current_fd: int | None = None
+    try:
+        current_fd = os.open("/", flags)
+        for component in (part for part in Path(path).parts[1:] if part not in {"", "."}):
+            try:
+                next_fd = os.open(component, flags, dir_fd=current_fd)
+            except OSError as exc:
+                return None, map_proof_directory_error(exc, current_fd, component)
+            os.close(current_fd)
+            current_fd = next_fd
+        try:
+            info = os.fstat(current_fd)
+        except OSError:
+            return None, "artifact_directory_access_failed"
+        if not stat.S_ISDIR(info.st_mode):
+            return None, "artifact_directory_not_regular"
+        if info.st_uid != os.geteuid():
+            return None, "artifact_directory_owner_mismatch"
+        if stat.S_IMODE(info.st_mode) != 0o700:
+            return None, "artifact_directory_mode_not_private"
+        result = current_fd
+        current_fd = None
+        return result, None
+    except OSError as exc:
+        return None, map_proof_directory_error(exc, None, None)
+    finally:
+        if current_fd is not None:
+            try:
+                os.close(current_fd)
+            except OSError:
+                pass
+
+
+def proof_leaf_stat_blockers(info: Any, leaf_kind: str) -> list[str]:
+    prefix = f"receipt_{leaf_kind}"
+    if stat.S_ISLNK(info.st_mode):
+        return [f"{prefix}_symlink_rejected"]
+    if not stat.S_ISREG(info.st_mode):
+        return [f"{prefix}_not_regular"]
+    blockers: list[str] = []
+    if info.st_uid != os.geteuid():
+        blockers.append(f"{prefix}_owner_mismatch")
+    if stat.S_IMODE(info.st_mode) != 0o600:
+        blockers.append(f"{prefix}_mode_not_private")
+    if info.st_nlink != 1:
+        blockers.append(f"{prefix}_multiple_links")
+    return blockers
+
+
+def proof_leaf_precheck(
+    artifact_fd: int,
+    name: str,
+    leaf_kind: str,
+) -> tuple[Any | None, bool, list[str]]:
+    try:
+        info = os.stat(name, dir_fd=artifact_fd, follow_symlinks=False)
+    except OSError as exc:
+        if exc.errno == errno.ENOENT:
+            return None, True, []
+        if exc.errno == errno.ELOOP:
+            return None, False, [f"receipt_{leaf_kind}_symlink_rejected"]
+        return None, False, ["artifact_read_failed"]
+    return info, False, proof_leaf_stat_blockers(info, leaf_kind)
+
+
+def proof_stat_stability(info: Any) -> tuple[int, ...]:
+    """Return every identity, mutation, and leaf-policy field used by verification."""
+    return (
+        info.st_dev,
+        info.st_ino,
+        info.st_size,
+        info.st_mtime_ns,
+        info.st_ctime_ns,
+        info.st_uid,
+        info.st_gid,
+        stat.S_IFMT(info.st_mode),
+        stat.S_IMODE(info.st_mode),
+        info.st_nlink,
+    )
+
+
+_PROOF_METADATA_NONFINITE_SENTINEL = object()
+
+
+def decode_proof_receipt_metadata(raw: bytes, receipt: str) -> tuple[dict[str, Any] | None, list[str]]:
+    try:
+        text = raw.decode("utf-8", errors="strict")
+    except UnicodeDecodeError:
+        return None, ["receipt_metadata_invalid_unicode"]
+    duplicate_keys = False
+
+    def pairs_hook(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+        nonlocal duplicate_keys
+        obj: dict[str, Any] = {}
+        for key, value in pairs:
+            if key in obj:
+                duplicate_keys = True
+            obj[key] = value
+        return obj
+
+    try:
+        decoded = json.loads(
+            text,
+            object_pairs_hook=pairs_hook,
+            parse_constant=lambda _value: _PROOF_METADATA_NONFINITE_SENTINEL,
+        )
+    except RecursionError:
+        return None, ["receipt_metadata_nesting_too_deep"]
+    except (json.JSONDecodeError, ValueError, TypeError):
+        return None, ["receipt_metadata_invalid_json"]
+
+    depth_exceeded = False
+    decoded_unicode_invalid = False
+    nonfinite = False
+    stack: list[tuple[Any, int]] = [(decoded, 0)]
+    while stack:
+        value, depth = stack.pop()
+        if depth > PROOF_UNIT_JSON_MAX_DEPTH:
+            depth_exceeded = True
+            continue
+        if isinstance(value, str):
+            try:
+                value.encode("utf-8", errors="strict")
+            except UnicodeEncodeError:
+                decoded_unicode_invalid = True
+        if value is _PROOF_METADATA_NONFINITE_SENTINEL or (
+            type(value) is float and not math.isfinite(value)
+        ):
+            nonfinite = True
+        if isinstance(value, dict):
+            for key, child in value.items():
+                stack.append((key, depth + 1))
+                stack.append((child, depth + 1))
+        elif isinstance(value, list):
+            for child in value:
+                stack.append((child, depth + 1))
+    if duplicate_keys:
+        return None, ["receipt_metadata_duplicate_keys"]
+    if depth_exceeded:
+        return None, ["receipt_metadata_nesting_too_deep"]
+    if nonfinite:
+        return None, ["receipt_metadata_nonfinite_number"]
+    if decoded_unicode_invalid:
+        return None, ["receipt_metadata_invalid_unicode"]
+    if not isinstance(decoded, dict):
+        return None, ["receipt_metadata_not_object"]
+    if decoded.get("artifact_id") != receipt:
+        return None, ["receipt_metadata_id_mismatch"]
+    stored = decoded.get("stored_output")
+    if not isinstance(stored, dict):
+        return None, ["receipt_metadata_stored_output_invalid"]
+    sha256 = stored.get("sha256")
+    byte_count = stored.get("bytes")
+    line_count = stored.get("lines")
+    stored_valid = bool(
+        isinstance(sha256, str)
+        and PROOF_CONTENT_SHA256_RE.fullmatch(sha256)
+        and type(byte_count) is int
+        and 0 <= byte_count <= PROOF_RECEIPT_CONTENT_BYTE_CAP
+        and type(line_count) is int
+        and (
+            (byte_count == 0 and line_count == 0)
+            or (byte_count > 0 and 1 <= line_count <= byte_count)
+        )
+    )
+    if not stored_valid:
+        return None, ["receipt_metadata_stored_output_invalid"]
+    if (
+        stored.get("content_file") != f"{receipt}.txt"
+        or stored.get("metadata_file") != f"{receipt}.json"
+    ):
+        return None, ["receipt_metadata_file_binding_mismatch"]
+    return decoded, []
+
+
+def open_proof_leaf(
+    artifact_fd: int,
+    name: str,
+    precheck: Any,
+    leaf_kind: str,
+) -> tuple[int | None, Any | None, list[str]]:
+    try:
+        fd = os.open(
+            name,
+            _file_open_flags(label=f"proof receipt {leaf_kind}"),
+            dir_fd=artifact_fd,
+        )
+    except OSError as exc:
+        if exc.errno == errno.ELOOP:
+            return None, None, [f"receipt_{leaf_kind}_symlink_rejected"]
+        return None, None, ["artifact_read_failed"]
+    try:
+        opened = os.fstat(fd)
+        blockers = proof_leaf_stat_blockers(opened, leaf_kind)
+        if proof_stat_stability(opened) != proof_stat_stability(precheck):
+            blockers.append("artifact_changed_during_read")
+        cap = (
+            PROOF_RECEIPT_METADATA_BYTE_CAP
+            if leaf_kind == "metadata"
+            else PROOF_RECEIPT_CONTENT_BYTE_CAP
+        )
+        if opened.st_size > cap:
+            blockers.append(f"receipt_{leaf_kind}_too_large")
+        blockers = ordered_proof_taxonomy(blockers, PROOF_VERIFICATION_BLOCKER_ORDER)
+        if blockers:
+            os.close(fd)
+            return None, None, blockers
+        return fd, opened, []
+    except OSError:
+        try:
+            os.close(fd)
+        except OSError:
+            pass
+        return None, None, ["artifact_read_failed"]
+
+
+def read_proof_metadata_leaf(fd: int, opened: Any) -> tuple[bytes | None, list[str]]:
+    if opened.st_size > PROOF_RECEIPT_METADATA_BYTE_CAP:
+        return None, ["receipt_metadata_too_large"]
+    expected_size = opened.st_size
+    accumulated = bytearray()
+    first_read = True
+    eof = False
+    try:
+        while first_read or len(accumulated) != expected_size:
+            first_read = False
+            if len(accumulated) >= PROOF_RECEIPT_METADATA_BYTE_CAP + 1:
+                break
+            chunk = os.read(
+                fd,
+                PROOF_RECEIPT_METADATA_BYTE_CAP + 1 - len(accumulated),
+            )
+            if not chunk:
+                eof = True
+                break
+            accumulated.extend(chunk)
+            if len(accumulated) == expected_size:
+                break
+    except OSError:
+        return None, ["artifact_read_failed"]
+    blockers = []
+    if len(accumulated) > PROOF_RECEIPT_METADATA_BYTE_CAP:
+        blockers.append("receipt_metadata_too_large")
+    if len(accumulated) != expected_size or (eof and len(accumulated) < expected_size):
+        blockers.append("artifact_changed_during_read")
+    blockers = ordered_proof_taxonomy(blockers, PROOF_VERIFICATION_BLOCKER_ORDER)
+    return (None, blockers) if blockers else (bytes(accumulated), [])
+
+
+def read_proof_content_leaf(
+    fd: int,
+    opened: Any,
+    declared_bytes: int,
+    runtime_boundaries: dict[str, Any],
+) -> tuple[bytes | None, list[str]]:
+    blockers = []
+    if opened.st_size > PROOF_RECEIPT_CONTENT_BYTE_CAP:
+        blockers.append("receipt_content_too_large")
+    if opened.st_size != declared_bytes:
+        blockers.append("receipt_content_size_mismatch")
+    blockers = ordered_proof_taxonomy(blockers, PROOF_VERIFICATION_BLOCKER_ORDER)
+    if blockers:
+        return None, blockers
+    accumulated = bytearray()
+    early_eof = False
+    extra_data = False
+    try:
+        while len(accumulated) < declared_bytes:
+            runtime_boundaries["artifact_content_read_for_whole_file_verification"] = True
+            chunk = os.read(
+                fd,
+                min(PROOF_RECEIPT_CONTENT_READ_CHUNK, declared_bytes - len(accumulated)),
+            )
+            if not chunk:
+                early_eof = True
+                break
+            accumulated.extend(chunk)
+        if not early_eof:
+            runtime_boundaries["artifact_content_read_for_whole_file_verification"] = True
+            extra_data = bool(os.read(fd, 1))
+    except OSError:
+        return None, ["artifact_read_failed"]
+    blockers = []
+    if early_eof or extra_data or len(accumulated) != declared_bytes:
+        blockers.extend(["receipt_content_size_mismatch", "artifact_changed_during_read"])
+    blockers = ordered_proof_taxonomy(blockers, PROOF_VERIFICATION_BLOCKER_ORDER)
+    return (None, blockers) if blockers else (bytes(accumulated), [])
+
+
+def verify_proof_receipt(
+    artifact_fd: int,
+    receipt: str,
+    runtime_boundaries: dict[str, Any],
+) -> dict[str, Any]:
+    metadata_name = f"{receipt}.json"
+    content_name = f"{receipt}.txt"
+    metadata_precheck, metadata_missing, metadata_blockers = proof_leaf_precheck(
+        artifact_fd, metadata_name, "metadata"
+    )
+    content_precheck, content_missing, content_blockers = proof_leaf_precheck(
+        artifact_fd, content_name, "content"
+    )
+    blockers = [*metadata_blockers, *content_blockers]
+    if metadata_missing or content_missing:
+        blockers.append("receipt_pair_incomplete")
+    blockers = ordered_proof_taxonomy(blockers, PROOF_VERIFICATION_BLOCKER_ORDER)
+    result: dict[str, Any] = {
+        "actual_lines": None,
+        "actual_sha256": None,
+        "blockers": blockers,
+        "content_file_verified": False,
+        "matches_receipt_metadata": False,
+        "metadata_file_verified": False,
+        "metadata_verified": False,
+        "stored_bytes": None,
+        "stored_lines": None,
+    }
+    if blockers or metadata_precheck is None or content_precheck is None:
+        return result
+
+    metadata_fd: int | None = None
+    content_fd: int | None = None
+    metadata_opened: Any | None = None
+    content_opened: Any | None = None
+    try:
+        metadata_fd, metadata_opened, blockers = open_proof_leaf(
+            artifact_fd, metadata_name, metadata_precheck, "metadata"
+        )
+        if blockers or metadata_fd is None or metadata_opened is None:
+            result["blockers"] = blockers
+            return result
+        content_fd, content_opened, blockers = open_proof_leaf(
+            artifact_fd, content_name, content_precheck, "content"
+        )
+        if blockers or content_fd is None or content_opened is None:
+            result["blockers"] = blockers
+            return result
+
+        metadata_raw, blockers = read_proof_metadata_leaf(metadata_fd, metadata_opened)
+        if blockers or metadata_raw is None:
+            result["blockers"] = blockers
+            return result
+        metadata, blockers = decode_proof_receipt_metadata(metadata_raw, receipt)
+        if blockers or metadata is None:
+            result["blockers"] = blockers
+            return result
+        stored = metadata["stored_output"]
+        result.update({
+            "metadata_file_verified": True,
+            "metadata_verified": True,
+            "stored_bytes": stored["bytes"],
+            "stored_lines": stored["lines"],
+        })
+
+        content_raw, blockers = read_proof_content_leaf(
+            content_fd,
+            content_opened,
+            stored["bytes"],
+            runtime_boundaries,
+        )
+        if blockers or content_raw is None:
+            result["blockers"] = blockers
+            return result
+        actual_sha256 = hashlib.sha256(content_raw).hexdigest()
+        actual_lines = content_raw.count(b"\n") + int(
+            bool(content_raw and not content_raw.endswith(b"\n"))
+        )
+        result["actual_sha256"] = actual_sha256
+        result["actual_lines"] = actual_lines
+        result["matches_receipt_metadata"] = actual_sha256 == stored["sha256"]
+        if not result["matches_receipt_metadata"]:
+            blockers.append("receipt_content_hash_mismatch")
+        if actual_lines != stored["lines"]:
+            blockers.append("receipt_line_count_mismatch")
+        result["content_file_verified"] = not blockers
+        result["blockers"] = ordered_proof_taxonomy(
+            blockers, PROOF_VERIFICATION_BLOCKER_ORDER
+        )
+        return result
+    finally:
+        stability_blockers: list[str] = []
+        for fd, opened in (
+            (metadata_fd, metadata_opened),
+            (content_fd, content_opened),
+        ):
+            if fd is None:
+                continue
+            try:
+                after = os.fstat(fd)
+                if opened is None or proof_stat_stability(after) != proof_stat_stability(opened):
+                    stability_blockers.append("artifact_changed_during_read")
+            except OSError:
+                stability_blockers.append("artifact_read_failed")
+            try:
+                os.close(fd)
+            except OSError:
+                pass
+        if stability_blockers:
+            result["blockers"] = ordered_proof_taxonomy(
+                [*result["blockers"], *stability_blockers],
+                PROOF_VERIFICATION_BLOCKER_ORDER,
+            )
+            result["content_file_verified"] = False
+            result["matches_receipt_metadata"] = False
+            result["metadata_file_verified"] = False
+            result["metadata_verified"] = False
+
+
+def verify_proof_range_bounds(row: dict[str, Any], stored_bytes: int, stored_lines: int) -> bool:
+    safe_range = row["safe_range"]
+    if safe_range is None:
+        return True
+    if safe_range["kind"] == "lines":
+        passed = 1 <= safe_range["start"] <= safe_range["end"] <= stored_lines
+    else:
+        passed = 0 <= safe_range["start"] < safe_range["end"] <= stored_bytes
+    safe_range["bounds_checked"] = True
+    safe_range["status"] = "verified" if passed else "verification_failed"
+    return passed
+
+
+def proof_verification_runtime_boundaries() -> dict[str, Any]:
+    return {
+        "artifact_content_read_for_whole_file_verification": False,
+        "command_executed": False,
+        "config_read": False,
+        "content_echoed": False,
+        "current_time_generated": False,
+        "files_written": False,
+        "hosted_savings_claim_allowed": False,
+        "network_or_provider_called": False,
+        "range_content_retrieved": False,
+        "replacement_authorized": False,
+        "source_or_stdin_read": False,
+        "subprocess_started": False,
+    }
+
+
+def proof_carrying_context_verify_payload(args: argparse.Namespace) -> dict[str, Any]:
+    raw_units = args.proof_unit_json or []
+    supplied_count = len(raw_units)
+    detailed_count = min(supplied_count, PROOF_CARRYING_CONTEXT_DETAILED_UNIT_CAP)
+    overflow_count = max(supplied_count - PROOF_CARRYING_CONTEXT_DETAILED_UNIT_CAP, 0)
+    rows: list[dict[str, Any]] = []
+    plan_rows: list[dict[str, Any] | None] = []
+    conflict_inputs: list[tuple[str | None, str | None]] = []
+    preflight_issues: list[list[str]] = []
+    for unit_index, raw in enumerate(raw_units[:PROOF_CARRYING_CONTEXT_DETAILED_UNIT_CAP]):
+        decoded, terminal_row = decode_proof_unit_json(raw, unit_index)
+        if terminal_row is not None:
+            issues = list(terminal_row["validation_issues"])
+            rows.append(proof_verification_row(unit_index, issues))
+            plan_rows.append(None)
+            conflict_inputs.append((None, None))
+            preflight_issues.append(issues)
+            continue
+        assert decoded is not None
+        plan_row, receipt, declared_hash = normalize_proof_unit(decoded, unit_index)
+        issues = list(plan_row["validation_issues"])
+        rows.append(
+            proof_verification_row(unit_index, issues)
+            if issues
+            else normalized_proof_verification_row(plan_row)
+        )
+        plan_rows.append(plan_row)
+        conflict_inputs.append((receipt, declared_hash))
+        preflight_issues.append(issues)
+
+    hashes_by_receipt: dict[str, set[str]] = {}
+    for receipt, declared_hash in conflict_inputs:
+        if receipt is not None and declared_hash is not None:
+            hashes_by_receipt.setdefault(receipt, set()).add(declared_hash)
+    conflicted_receipts = {
+        receipt for receipt, hashes in hashes_by_receipt.items() if len(hashes) > 1
+    }
+    for index, (receipt, _declared_hash) in enumerate(conflict_inputs):
+        if receipt in conflicted_receipts:
+            issues = ordered_proof_taxonomy(
+                [*preflight_issues[index], "receipt_hash_conflict"],
+                PROOF_VERIFICATION_BLOCKER_ORDER,
+            )
+            preflight_issues[index] = issues
+            rows[index] = proof_verification_row(index, issues)
+
+    duplicate_groups: dict[tuple[Any, ...], list[int]] = {}
+    for index, plan_row in enumerate(plan_rows):
+        if plan_row is not None and not preflight_issues[index]:
+            duplicate_groups.setdefault(proof_duplicate_key(plan_row), []).append(index)
+    duplicate_indexes = {
+        index
+        for indexes in duplicate_groups.values()
+        if len(indexes) > 1
+        for index in indexes
+    }
+    for index, row in enumerate(rows):
+        if preflight_issues[index]:
+            continue
+        warnings = list(PROOF_VERIFICATION_WARNING_ORDER[:3])
+        if row["safe_range"] is None:
+            warnings.append("safe_range_not_supplied")
+        if index in duplicate_indexes:
+            warnings.append("duplicate_proof_unit")
+        row["warnings"] = ordered_proof_taxonomy(
+            warnings, PROOF_VERIFICATION_WARNING_ORDER
+        )
+
+    request_blockers: list[str] = []
+    if supplied_count == 0:
+        request_blockers.append("missing_proof_unit")
+    if overflow_count:
+        request_blockers.append("too_many_proof_units")
+    for issues in preflight_issues:
+        request_blockers.extend(issues)
+
+    normalized_dir, directory_issue = validate_proof_artifact_dir_arg(
+        getattr(args, "artifact_dir", None)
+    )
+    if directory_issue:
+        request_blockers.append(directory_issue)
+    if not proof_artifact_io_capabilities_available():
+        request_blockers.append("artifact_io_capability_unavailable")
+    preflight_aborted = bool(request_blockers)
+    if preflight_aborted:
+        for index, row in enumerate(rows):
+            if not preflight_issues[index]:
+                row["blockers"] = ["request_preflight_aborted"]
+        if rows and any(not issues for issues in preflight_issues):
+            request_blockers.append("request_preflight_aborted")
+
+    runtime_boundaries = proof_verification_runtime_boundaries()
+    artifact_fd: int | None = None
+    directory_stage_issue: str | None = None
+    if not preflight_aborted:
+        assert normalized_dir is not None
+        artifact_fd, directory_stage_issue = open_proof_artifact_directory(normalized_dir)
+        if directory_stage_issue:
+            for row in rows:
+                row["blockers"] = [directory_stage_issue]
+            request_blockers.append(directory_stage_issue)
+    try:
+        if artifact_fd is not None:
+            receipt_cache: dict[str, dict[str, Any]] = {}
+            for row in rows:
+                receipt = row["receipt"]["id"]
+                assert isinstance(receipt, str)
+                if receipt not in receipt_cache:
+                    receipt_cache[receipt] = verify_proof_receipt(
+                        artifact_fd, receipt, runtime_boundaries
+                    )
+                result = receipt_cache[receipt]
+                row["blockers"] = list(result["blockers"])
+                row["receipt"].update({
+                    "content_file_verified": result["content_file_verified"],
+                    "metadata_file_verified": result["metadata_file_verified"],
+                    "metadata_verified": result["metadata_verified"],
+                    "stored_bytes": result["stored_bytes"],
+                    "stored_lines": result["stored_lines"],
+                    "verified": bool(
+                        result["metadata_verified"] and result["content_file_verified"]
+                    ),
+                })
+                if result["actual_sha256"] is not None:
+                    matches_proof = (
+                        result["actual_sha256"] == row["content_hash"]["declared_value"]
+                    )
+                    row["content_hash"].update({
+                        "matches_proof_unit": matches_proof,
+                        "matches_receipt_metadata": result["matches_receipt_metadata"],
+                        "verified": bool(matches_proof and result["matches_receipt_metadata"]),
+                    })
+                    if not matches_proof:
+                        row["blockers"].append("proof_content_hash_mismatch")
+                    if (
+                        row["receipt"]["verified"]
+                        and row["content_hash"]["verified"]
+                        and not verify_proof_range_bounds(
+                            row, result["stored_bytes"], result["stored_lines"]
+                        )
+                    ):
+                        row["blockers"].append("safe_range_out_of_bounds")
+                row["blockers"] = ordered_proof_taxonomy(
+                    row["blockers"], PROOF_VERIFICATION_BLOCKER_ORDER
+                )
+                if not row["blockers"]:
+                    row["status"] = "verified"
+    finally:
+        if artifact_fd is not None:
+            try:
+                os.close(artifact_fd)
+            except OSError:
+                pass
+
+    top_blockers = list(request_blockers)
+    for row in rows:
+        top_blockers.extend(row["blockers"])
+    top_blockers = ordered_proof_taxonomy(
+        top_blockers, PROOF_VERIFICATION_BLOCKER_ORDER
+    )
+    verified_count = sum(row["status"] == "verified" for row in rows)
+    failed_count = supplied_count - verified_count
+    unique_receipt_count = len({receipt for receipt, _hash in conflict_inputs if receipt})
+    status = (
+        "verified"
+        if supplied_count > 0
+        and overflow_count == 0
+        and verified_count == detailed_count
+        and not top_blockers
+        else "verification_failed"
+    )
+    return {
+        "artifact_scope": {
+            "content_byte_cap": PROOF_RECEIPT_CONTENT_BYTE_CAP,
+            "directory_echoed": False,
+            "exact_receipt_files_only": True,
+            "explicit_directory": True,
+            "fallback_directories_searched": False,
+            "metadata_byte_cap": PROOF_RECEIPT_METADATA_BYTE_CAP,
+            "posix_private_mode_required": True,
+            "same_effective_owner_required": True,
+            "symlinks_followed": False,
+        },
+        "blocker_order": list(PROOF_VERIFICATION_BLOCKER_ORDER),
+        "blockers": top_blockers,
+        "candidate_replacement": None,
+        "claim_boundary": PROOF_VERIFICATION_CLAIM_BOUNDARY,
+        "experiment_id": "proof-carrying-context",
+        "mode": "verify",
+        "process_exit_contract": PROOF_VERIFICATION_PROCESS_EXIT_CONTRACT,
+        "proof_unit_schema_version": PROOF_CARRYING_CONTEXT_UNIT_SCHEMA_VERSION,
+        "proof_units": rows,
+        "runtime_boundaries": runtime_boundaries,
+        "schema": PROOF_CARRYING_CONTEXT_VERIFY_SCHEMA_VERSION,
+        "status": status,
+        "summary": {
+            "detailed_unit_count": detailed_count,
+            "failed_unit_count": failed_count,
+            "overflow_unit_count": overflow_count,
+            "supplied_unit_count": supplied_count,
+            "unique_receipt_count": unique_receipt_count,
+            "verified_unit_count": verified_count,
+        },
+        "warning_order": list(PROOF_VERIFICATION_WARNING_ORDER),
+    }
+
+
+def command_verify_proof_carrying_context(args: argparse.Namespace) -> int:
+    payload = proof_carrying_context_verify_payload(args)
+    if args.json:
+        sys.stdout.write(json.dumps(payload, ensure_ascii=False, indent=2, sort_keys=True) + "\n")
+    else:
+        print("ContextGuard proof-carrying-context verification")
+        print(f"Status: {payload['status']}")
+        for key in (
+            "supplied_unit_count",
+            "detailed_unit_count",
+            "overflow_unit_count",
+            "unique_receipt_count",
+            "verified_unit_count",
+            "failed_unit_count",
+        ):
+            print(f"{key}: {payload['summary'][key]}")
+        print(f"Blockers: {', '.join(payload['blockers'])}")
+        print(payload["claim_boundary"])
+    return 0 if payload["status"] == "verified" else 2
+
+
+_SEMANTIC_GC_NONFINITE_SENTINEL = object()
+
+
+def ordered_semantic_gc_taxonomy(values: list[str] | set[str], order: tuple[str, ...]) -> list[str]:
+    selected = set(values)
+    return [value for value in order if value in selected]
+
+
+def semantic_gc_validation_row(index: int, issue: str | None = None) -> dict[str, Any]:
+    return {
+        "candidate_safety_applicable": None,
+        "candidate_safety_issues": [],
+        "input_index": index,
+        "structural_issues": [issue] if issue else [],
+        "unit_id": None,
+    }
+
+
+def decode_semantic_gc_unit(raw: Any, index: int) -> tuple[dict[str, Any] | None, dict[str, Any]]:
+    row = semantic_gc_validation_row(index)
+    if not isinstance(raw, str):
+        row["structural_issues"] = ["invalid_context_unit_json"]
+        return None, row
+    try:
+        encoded = raw.encode("utf-8", errors="strict")
+    except UnicodeEncodeError:
+        row["structural_issues"] = ["invalid_unicode_scalar"]
+        return None, row
+    if len(encoded) > SEMANTIC_GC_UNIT_JSON_BYTE_CAP:
+        row["structural_issues"] = ["invalid_context_unit_json"]
+        return None, row
+
+    duplicate_key = False
+
+    def pairs_hook(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+        nonlocal duplicate_key
+        result: dict[str, Any] = {}
+        for key, value in pairs:
+            if key in result:
+                duplicate_key = True
+            result[key] = value
+        return result
+
+    try:
+        decoded = json.loads(
+            raw,
+            object_pairs_hook=pairs_hook,
+            parse_constant=lambda _value: _SEMANTIC_GC_NONFINITE_SENTINEL,
+        )
+    except RecursionError:
+        row["structural_issues"] = ["decoder_recursion_limit"]
+        return None, row
+    except (json.JSONDecodeError, UnicodeDecodeError, ValueError, TypeError):
+        row["structural_issues"] = ["invalid_context_unit_json"]
+        return None, row
+
+    depth_exceeded = False
+    nonfinite = False
+    invalid_unicode = False
+    stack: list[tuple[Any, int]] = [(decoded, 0)]
+    while stack:
+        value, depth = stack.pop()
+        if depth > SEMANTIC_GC_JSON_MAX_DEPTH:
+            depth_exceeded = True
+            continue
+        if isinstance(value, str):
+            try:
+                value.encode("utf-8", errors="strict")
+            except UnicodeEncodeError:
+                invalid_unicode = True
+        elif value is _SEMANTIC_GC_NONFINITE_SENTINEL or (type(value) is float and not math.isfinite(value)):
+            nonfinite = True
+        if isinstance(value, dict):
+            for key, child in value.items():
+                stack.append((key, depth + 1))
+                stack.append((child, depth + 1))
+        elif isinstance(value, list):
+            for child in value:
+                stack.append((child, depth + 1))
+
+    issue = None
+    if duplicate_key:
+        issue = "duplicate_json_key"
+    elif depth_exceeded:
+        issue = "context_unit_depth_exceeded"
+    elif nonfinite:
+        issue = "nonfinite_json_number"
+    elif invalid_unicode:
+        issue = "invalid_unicode_scalar"
+    elif not isinstance(decoded, dict):
+        issue = "invalid_context_unit_json"
+    if issue:
+        row["structural_issues"] = [issue]
+        return None, row
+    return decoded, row
+
+
+def normalize_semantic_gc_structure(obj: dict[str, Any], row: dict[str, Any]) -> dict[str, Any]:
+    issues: list[str] = []
+    if obj.get("schema") != SEMANTIC_GC_UNIT_SCHEMA_VERSION:
+        issues.append("invalid_context_unit_schema")
+    if set(obj) - SEMANTIC_GC_ALLOWED_FIELDS:
+        issues.append("unknown_context_unit_field")
+
+    raw_id = obj.get("unit_id")
+    unit_id = raw_id if isinstance(raw_id, str) and SEMANTIC_GC_UNIT_ID_RE.fullmatch(raw_id) else None
+    if raw_id is None or raw_id == "":
+        issues.append("missing_unit_id")
+    elif unit_id is None:
+        issues.append("invalid_unit_id")
+    row["unit_id"] = unit_id
+
+    raw_references = obj.get("references")
+    references: list[str] = []
+    reference_targets: list[str] = []
+    if not isinstance(raw_references, list) or len(raw_references) > 64:
+        issues.append("invalid_references")
+    else:
+        seen: set[str] = set()
+        reference_issue = False
+        for reference in raw_references:
+            if not isinstance(reference, str) or SEMANTIC_GC_UNIT_ID_RE.fullmatch(reference) is None:
+                issues.append("invalid_references")
+                reference_issue = True
+                continue
+            if reference in seen:
+                issues.append("duplicate_reference")
+                reference_issue = True
+                continue
+            references.append(reference)
+            reference_targets.append(reference)
+            seen.add(reference)
+        if reference_issue:
+            references = []
+
+    is_root = obj.get("is_root")
+    if type(is_root) is not bool:
+        issues.append("invalid_root_flag")
+        is_root = None
+    protected = obj.get("protected_zone")
+    if type(protected) is not bool:
+        issues.append("invalid_protected_zone_flag")
+        protected = None
+    row["structural_issues"] = ordered_semantic_gc_taxonomy(issues, SEMANTIC_GC_BLOCKER_ORDER)
+    return {
+        "object": obj,
+        "row": row,
+        "unit_id": unit_id,
+        "references": references,
+        "reference_targets": reference_targets,
+        "is_root": is_root,
+        "protected_zone": protected,
+    }
+
+
+def valid_semantic_gc_note(value: Any) -> bool:
+    if not isinstance(value, str) or not (1 <= len(value) <= 512) or value != value.strip():
+        return False
+    return not any(unicodedata.category(char) in {"Cc", "Cf", "Zl", "Zp"} for char in value)
+
+
+def normalize_semantic_gc_candidate(unit: dict[str, Any]) -> tuple[dict[str, Any], list[str], str | None, str | None]:
+    obj = unit["object"]
+    issues: list[str] = []
+    raw_hash = obj.get("content_sha256")
+    content_hash = raw_hash if isinstance(raw_hash, str) and SEMANTIC_GC_CONTENT_SHA256_RE.fullmatch(raw_hash) else None
+    if content_hash is None:
+        issues.append("invalid_content_sha256")
+
+    raw_provenance = obj.get("provenance")
+    source_label = None
+    receipt_id = None
+    if raw_provenance is None:
+        issues.append("missing_provenance")
+    elif not isinstance(raw_provenance, dict) or set(raw_provenance) != {"source_label", "receipt_id"}:
+        issues.append("invalid_provenance")
+    else:
+        raw_label = raw_provenance.get("source_label")
+        if (
+            isinstance(raw_label, str)
+            and raw_label == raw_label.strip()
+            and SEMANTIC_GC_SOURCE_LABEL_RE.fullmatch(raw_label) is not None
+        ):
+            source_label = raw_label
+        else:
+            issues.append("invalid_source_label")
+        raw_receipt = raw_provenance.get("receipt_id")
+        if isinstance(raw_receipt, str) and SEMANTIC_GC_RECEIPT_ID_RE.fullmatch(raw_receipt):
+            receipt_id = raw_receipt
+        else:
+            issues.append("invalid_receipt_id")
+
+    raw_note = obj.get("missed_context_note")
+    note = raw_note if valid_semantic_gc_note(raw_note) else None
+    if raw_note is None or raw_note == "":
+        issues.append("missing_missed_context_note")
+    elif note is None:
+        issues.append("invalid_missed_context_note")
+
+    raw_fallback = obj.get("exact_fallback_command")
+    fallback = None
+    if raw_fallback is None or raw_fallback == "":
+        issues.append("missing_exact_fallback")
+    elif not isinstance(raw_fallback, str):
+        issues.append("invalid_exact_fallback")
+    else:
+        forbidden = (';', '|', '&', '>', '<', '`', '$', '\\', '\n', '\r', '"', "'")
+        if any(token in raw_fallback for token in forbidden) or raw_fallback != raw_fallback.strip():
+            issues.append("invalid_exact_fallback")
+        else:
+            parts = raw_fallback.split(" ")
+            if len(parts) != 4 or parts[0] != "context-guard-artifact" or parts[1] != "get" or parts[3] != "--full":
+                issues.append("invalid_exact_fallback")
+            elif SEMANTIC_GC_RECEIPT_ID_RE.fullmatch(parts[2]) is None:
+                issues.append("invalid_exact_fallback")
+            elif receipt_id is not None and parts[2] != receipt_id:
+                issues.append("fallback_receipt_mismatch")
+            elif receipt_id is None:
+                issues.append("invalid_exact_fallback")
+            else:
+                fallback = raw_fallback
+
+    issues = ordered_semantic_gc_taxonomy(issues, SEMANTIC_GC_BLOCKER_ORDER)
+    return ({
+        "candidate_replacement": None,
+        "candidate_safety_issues": issues,
+        "content_sha256": content_hash,
+        "exact_fallback_command": fallback,
+        "human_review_required": True,
+        "missed_context_note": note,
+        "protected_zone": False,
+        "provenance": {"receipt_id": receipt_id, "source_label": source_label},
+        "reason": "unreachable_from_declared_roots",
+        "unit_id": unit["unit_id"],
+    }, issues, content_hash, receipt_id)
+
+
+def semantic_gc_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
+    raw_units = args.context_unit_json or []
+    total_count = len(raw_units)
+    detailed_count = min(total_count, SEMANTIC_GC_DETAILED_UNIT_CAP)
+    overflow_count = max(total_count - SEMANTIC_GC_DETAILED_UNIT_CAP, 0)
+    units: list[dict[str, Any]] = []
+    rows: list[dict[str, Any]] = []
+    decoded_count = 0
+    for index, raw in enumerate(raw_units[:SEMANTIC_GC_DETAILED_UNIT_CAP]):
+        decoded, row = decode_semantic_gc_unit(raw, index)
+        rows.append(row)
+        if decoded is None:
+            continue
+        decoded_count += 1
+        units.append(normalize_semantic_gc_structure(decoded, row))
+
+    by_id: dict[str, list[dict[str, Any]]] = {}
+    for unit in units:
+        if unit["unit_id"] is not None:
+            by_id.setdefault(unit["unit_id"], []).append(unit)
+    duplicate_ids = {unit_id for unit_id, matches in by_id.items() if len(matches) > 1}
+    for unit in units:
+        structural = list(unit["row"]["structural_issues"])
+        if unit["unit_id"] in duplicate_ids:
+            structural.append("duplicate_unit_id")
+        if any(reference not in by_id for reference in unit["reference_targets"]):
+            structural.append("unknown_reference")
+        if any(reference in duplicate_ids for reference in unit["reference_targets"]):
+            structural.append("ambiguous_reference")
+        unit["row"]["structural_issues"] = ordered_semantic_gc_taxonomy(structural, SEMANTIC_GC_BLOCKER_ORDER)
+
+    declared_roots = sorted(
+        unit_id for unit_id, matches in by_id.items()
+        if unit_id not in duplicate_ids and len(matches) == 1 and matches[0]["is_root"] is True
+    )
+    structural_blockers: list[str] = []
+    if total_count == 0:
+        structural_blockers.append("no_context_units")
+    if overflow_count:
+        structural_blockers.append("unit_limit_exceeded")
+    for row in rows:
+        structural_blockers.extend(row["structural_issues"])
+    if not declared_roots:
+        structural_blockers.append("no_declared_root")
+    graph_complete = not structural_blockers
+
+    marked_ids: list[str] = []
+    candidates: list[dict[str, Any]] = []
+    unreachable_count = 0
+    protected_unreachable_count = 0
+    safety_valid_count = 0
+    safety_invalid_count = 0
+    safety_blockers: list[str] = []
+    candidate_hashes: list[str] = []
+    candidate_receipts: list[str] = []
+    if graph_complete:
+        marked: set[str] = set()
+        pending = list(declared_roots)
+        while pending:
+            unit_id = pending.pop()
+            if unit_id in marked:
+                continue
+            marked.add(unit_id)
+            pending.extend(by_id[unit_id][0]["references"])
+        marked_ids = sorted(marked)
+        for unit in units:
+            unit_id = unit["unit_id"]
+            assert unit_id is not None
+            row = unit["row"]
+            if unit_id in marked:
+                row["candidate_safety_applicable"] = False
+                continue
+            unreachable_count += 1
+            if unit["protected_zone"] is True:
+                protected_unreachable_count += 1
+                row["candidate_safety_applicable"] = False
+                continue
+            row["candidate_safety_applicable"] = True
+            candidate, issues, content_hash, receipt_id = normalize_semantic_gc_candidate(unit)
+            row["candidate_safety_issues"] = issues
+            candidates.append(candidate)
+            safety_blockers.extend(issues)
+            if issues:
+                safety_invalid_count += 1
+            else:
+                safety_valid_count += 1
+            if content_hash is not None:
+                candidate_hashes.append(content_hash)
+            if receipt_id is not None:
+                candidate_receipts.append(receipt_id)
+        candidates.sort(key=lambda item: item["unit_id"])
+
+    blockers = list(structural_blockers)
+    if not graph_complete:
+        blockers.append("graph_evaluation_suppressed")
+    protected_policy = "deny" if getattr(args, "protected_zone_policy", None) == "deny" else None
+    if protected_policy is None:
+        blockers.append("protected_zone_policy_required")
+    blockers.extend(safety_blockers)
+    if graph_complete and not args.provider_boundary_ack:
+        blockers.append("provider_boundary_ack_required")
+    if graph_complete and candidates and not args.human_review_ack:
+        blockers.append("human_review_ack_required")
+    blockers = ordered_semantic_gc_taxonomy(blockers, SEMANTIC_GC_BLOCKER_ORDER)
+
+    warnings = list(SEMANTIC_GC_WARNING_ORDER[:6])
+    if candidates:
+        warnings.extend(("human_review_still_required", "accepted_notes_are_untrusted"))
+    if len(candidate_hashes) != len(set(candidate_hashes)):
+        warnings.append("duplicate_content_sha256")
+    if len(candidate_receipts) != len(set(candidate_receipts)):
+        warnings.append("duplicate_receipt_id")
+    if protected_unreachable_count:
+        warnings.append("protected_unreachable_excluded")
+    if graph_complete and not candidates:
+        warnings.append("no_sweep_candidates")
+    warnings = ordered_semantic_gc_taxonomy(warnings, SEMANTIC_GC_WARNING_ORDER)
+
+    verification_scope = {
+        "artifact_content_read": False,
+        "context_content_read": False,
+        "deletion_or_omission_performed": False,
+        "exact_fallback_executed": False,
+        "files_written": False,
+        "model_or_provider_called": False,
+        "network_called": False,
+        "provenance_verified_externally": False,
+        "subprocess_started": False,
+    }
+    return {
+        "blockers": blockers,
+        "candidate_count": len(candidates),
+        "candidate_replacement": None,
+        "candidate_safety_invalid_count": safety_invalid_count,
+        "candidate_safety_valid_count": safety_valid_count,
+        "candidates": candidates,
+        "declared_root_count": len(declared_roots),
+        "declared_root_ids": declared_roots,
+        "decoded_unit_count": decoded_count,
+        "detailed_unit_count": detailed_count,
+        "effective_protected_zone_policy": "deny",
+        "experiment": "semantic-gc",
+        "graph_evaluation_performed": graph_complete,
+        "graph_integrity_complete": graph_complete,
+        "human_review_acknowledged": bool(args.human_review_ack),
+        "human_review_performed": False,
+        "marked_unit_count": len(marked_ids),
+        "marked_unit_ids": marked_ids,
+        "omission_authorized": False,
+        "overflow_unit_count": overflow_count,
+        "plan_only": True,
+        "process_exit_contract": SEMANTIC_GC_PROCESS_EXIT_CONTRACT,
+        "protected_unreachable_count": protected_unreachable_count,
+        "protected_zone_policy": protected_policy,
+        "provider_boundary_acknowledged": bool(args.provider_boundary_ack),
+        "runtime_action_allowed": False,
+        "schema": SEMANTIC_GC_PLAN_SCHEMA_VERSION,
+        "status": "ready_for_plan_review" if not blockers else "blocked",
+        "structurally_valid_unit_count": sum(not row["structural_issues"] for row in rows),
+        "total_unit_count": total_count,
+        "unit_validation": rows,
+        "unreachable_unit_count": unreachable_count,
+        "verification_scope": verification_scope,
+        "warnings": warnings,
+    }
+
+
+def command_plan_semantic_gc(args: argparse.Namespace) -> int:
+    payload = semantic_gc_plan_payload(args)
+    if args.json:
+        print(json.dumps(payload, ensure_ascii=False, sort_keys=True, separators=(",", ":")))
+    else:
+        print("ContextGuard semantic-gc plan")
+        print(f"Status: {payload['status']}")
+        print(f"Graph complete: {payload['graph_integrity_complete']}; candidates: {payload['candidate_count']}")
+        if payload["blockers"]:
+            print(f"Blockers: {', '.join(payload['blockers'])}")
+        print(f"Exit contract: {payload['process_exit_contract']}.")
+        print("semantic-gc is plan-only; no context was deleted, omitted, read, replaced, or authorized for runtime action.")
+    return 0 if payload["status"] == "ready_for_plan_review" else 2
+
+
+_STATIC_RELEVANCE_NONFINITE_SENTINEL = object()
+
+
+def ordered_static_relevance_taxonomy(values: list[str] | set[str]) -> list[str]:
+    selected = set(values)
+    return [value for value in STATIC_RELEVANCE_BLOCKER_ORDER if value in selected]
+
+
+def static_relevance_validation_row(index: int, issue: str | None = None) -> dict[str, Any]:
+    return {
+        "input_index": index,
+        "unit_id": None,
+        "normalized_path": None,
+        "normalized_evidence_included": False,
+        "structural_issues": [issue] if issue else [],
+        "missing_signals": [],
+        "invalid_signals": [],
+        "protection_reasons": [],
     }
 
 
-def visual_crop_ocr_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
-    full_receipt = args.full_evidence_receipt.strip() if args.full_evidence_receipt else None
-    full_label = args.full_evidence_label.strip() if args.full_evidence_label else None
-    missed_context_notes = clean_values(args.missed_context_note)
-    ocr_error_notes = clean_values(args.ocr_error_note)
-    crop_label = args.crop_label.strip() if args.crop_label else None
+def decode_static_relevance_unit(raw: Any, index: int) -> tuple[dict[str, Any] | None, dict[str, Any]]:
+    row = static_relevance_validation_row(index)
+    if not isinstance(raw, str):
+        row["structural_issues"] = ["malformed_relevance_unit_json"]
+        return None, row
+    try:
+        encoded = raw.encode("utf-8", errors="strict")
+    except UnicodeEncodeError:
+        row["structural_issues"] = ["invalid_unicode_scalar"]
+        return None, row
+    if len(encoded) > STATIC_RELEVANCE_UNIT_JSON_BYTE_CAP:
+        row["structural_issues"] = ["relevance_unit_json_too_large"]
+        return None, row
+
+    duplicate_key = False
+
+    def pairs_hook(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+        nonlocal duplicate_key
+        result: dict[str, Any] = {}
+        for key, value in pairs:
+            if key in result:
+                duplicate_key = True
+            result[key] = value
+        return result
 
-    bounds = parse_int_tuple(args.crop_bounds, count=4)
-    image_size = parse_int_tuple(args.image_size, count=2)
-    bounds_payload, image_payload = crop_payload(bounds, image_size)
-    crop_fields_present = any(value is not None and str(value).strip() for value in (args.crop_label, args.crop_bounds, args.image_size))
-    crop_geometry_valid, crop_exceeds = valid_crop_geometry(bounds, image_size)
-    crop_complete = bool(crop_label and crop_geometry_valid and not crop_exceeds)
+    try:
+        decoded = json.loads(
+            raw,
+            object_pairs_hook=pairs_hook,
+            parse_constant=lambda _value: _STATIC_RELEVANCE_NONFINITE_SENTINEL,
+        )
+    except RecursionError:
+        row["structural_issues"] = ["decoder_recursion_limit"]
+        return None, row
+    except UnicodeDecodeError:
+        row["structural_issues"] = ["invalid_unicode_scalar"]
+        return None, row
+    except (json.JSONDecodeError, ValueError, TypeError):
+        row["structural_issues"] = ["malformed_relevance_unit_json"]
+        return None, row
+
+    depth_exceeded = False
+    nonfinite = False
+    invalid_unicode = False
+    try:
+        stack: list[tuple[Any, int]] = [(decoded, 0)]
+        while stack:
+            value, depth = stack.pop()
+            if depth > STATIC_RELEVANCE_JSON_MAX_DEPTH:
+                depth_exceeded = True
+                continue
+            if isinstance(value, str):
+                try:
+                    value.encode("utf-8", errors="strict")
+                except UnicodeEncodeError:
+                    invalid_unicode = True
+            elif value is _STATIC_RELEVANCE_NONFINITE_SENTINEL or (
+                type(value) is float and not math.isfinite(value)
+            ):
+                nonfinite = True
+            if isinstance(value, dict):
+                for key, child in value.items():
+                    stack.append((key, depth + 1))
+                    stack.append((child, depth + 1))
+            elif isinstance(value, list):
+                for child in value:
+                    stack.append((child, depth + 1))
+    except RecursionError:
+        row["structural_issues"] = ["decoder_recursion_limit"]
+        return None, row
+
+    issue = None
+    if duplicate_key:
+        issue = "duplicate_relevance_unit_json_key"
+    elif nonfinite:
+        issue = "non_finite_relevance_unit_json_value"
+    elif depth_exceeded:
+        issue = "relevance_unit_json_depth_exceeded"
+    elif invalid_unicode:
+        issue = "invalid_unicode_scalar"
+    elif not isinstance(decoded, dict):
+        issue = "relevance_unit_must_be_object"
+    if issue:
+        row["structural_issues"] = [issue]
+        return None, row
+    return decoded, row
+
+
+def valid_static_relevance_path(value: Any) -> bool:
+    if not isinstance(value, str):
+        return False
+    try:
+        encoded = value.encode("utf-8", errors="strict")
+    except UnicodeEncodeError:
+        return False
+    if not (1 <= len(encoded) <= 240) or value.startswith("/") or value.endswith("/") or "\\" in value:
+        return False
+    components = value.split("/")
+    if any(component in {"", ".", ".."} for component in components):
+        return False
+    return not any(unicodedata.category(char) in {"Cc", "Cs"} for char in value)
 
-    ocr_text = read_visual_ocr_text(args)
-    confidence, confidence_error = parse_confidence(args.ocr_confidence)
-    ocr_fields_present = any(
-        [
-            args.ocr_text is not None,
-            args.ocr_text_file is not None,
-            args.ocr_confidence is not None,
-            bool(ocr_error_notes),
-        ]
+
+def valid_static_relevance_symbol_name(value: Any) -> bool:
+    if not isinstance(value, str):
+        return False
+    try:
+        size = len(value.encode("utf-8", errors="strict"))
+    except UnicodeEncodeError:
+        return False
+    return 1 <= size <= 128 and all(
+        char.isprintable() and not unicodedata.category(char).startswith("C") for char in value
     )
-    ocr_complete = bool(
-        ocr_text["has_text"]
-        and ocr_text["valid_utf8"]
-        and not ocr_text["truncated"]
-        and confidence_error is None
-        and ocr_error_notes
+
+
+def static_relevance_builtin_protection_reasons(path: str) -> list[str]:
+    reasons: set[str] = set()
+    components = path.split("/")
+    lowered = [component.lower() for component in components]
+    for component in lowered:
+        tokens = {token for token in STATIC_RELEVANCE_PATH_TOKEN_SPLIT_RE.split(component) if token}
+        if tokens & {"auth", "authentication", "authorization"}:
+            reasons.add("builtin_auth_path")
+        if "security" in tokens:
+            reasons.add("builtin_security_path")
+        if tokens & {"secret", "secrets", "credential", "credentials"}:
+            reasons.add("builtin_secret_path")
+        if tokens & {"migration", "migrations"}:
+            reasons.add("builtin_migration_path")
+        if tokens & {"acceptance", "e2e"}:
+            reasons.add("builtin_acceptance_path")
+    basename = lowered[-1]
+    if (
+        basename == ".env"
+        or basename.startswith(".env.")
+        or basename.endswith((".pem", ".key", ".p12", ".pfx"))
+    ):
+        reasons.add("builtin_secret_material_path")
+    return [reason for reason in STATIC_RELEVANCE_PROTECTION_REASON_ORDER if reason in reasons]
+
+
+def normalize_static_relevance_unit(
+    obj: dict[str, Any], row: dict[str, Any]
+) -> dict[str, Any]:
+    structural: list[str] = []
+    missing: list[str] = []
+    invalid: list[str] = []
+    if obj.get("schema") != STATIC_RELEVANCE_UNIT_SCHEMA_VERSION:
+        structural.append("relevance_unit_schema_mismatch")
+    if set(obj) - STATIC_RELEVANCE_ALLOWED_FIELDS:
+        structural.append("relevance_unit_unexpected_field")
+
+    raw_id = obj.get("unit_id")
+    unit_id = raw_id if isinstance(raw_id, str) and STATIC_RELEVANCE_ID_RE.fullmatch(raw_id) else None
+    if unit_id is None:
+        structural.append("invalid_relevance_unit_id")
+    row["unit_id"] = unit_id
+
+    raw_path = obj.get("path")
+    normalized_path = raw_path if valid_static_relevance_path(raw_path) else None
+    if normalized_path is None:
+        structural.append("invalid_relevance_unit_path")
+    row["normalized_path"] = normalized_path
+
+    task_anchor = obj.get("task_anchor")
+    if type(task_anchor) is not bool:
+        structural.append("invalid_task_anchor")
+        task_anchor = None
+
+    explicit_reasons: list[str] = []
+    if "protection_reasons" not in obj:
+        structural.append("missing_protection_reasons")
+    else:
+        raw_reasons = obj.get("protection_reasons")
+        if (
+            not isinstance(raw_reasons, list)
+            or len(raw_reasons) > 8
+            or any(not isinstance(reason, str) or reason not in STATIC_RELEVANCE_EXPLICIT_PROTECTION_REASONS for reason in raw_reasons)
+            or len(raw_reasons) != len(set(raw_reasons))
+        ):
+            structural.append("invalid_protection_reasons")
+        else:
+            explicit_reasons = list(raw_reasons)
+    all_reasons = set(explicit_reasons)
+    if normalized_path is not None:
+        all_reasons.update(static_relevance_builtin_protection_reasons(normalized_path))
+    ordered_reasons = [reason for reason in STATIC_RELEVANCE_PROTECTION_REASON_ORDER if reason in all_reasons]
+    row["protection_reasons"] = ordered_reasons
+
+    symbol = None
+    if "symbol" not in obj:
+        missing.append("missing_symbol_signal")
+    else:
+        raw_symbol = obj.get("symbol")
+        if not isinstance(raw_symbol, dict) or set(raw_symbol) != {"name", "kind", "start_line", "end_line"}:
+            invalid.append("invalid_symbol_signal")
+        else:
+            name = raw_symbol.get("name")
+            kind = raw_symbol.get("kind")
+            start_line = raw_symbol.get("start_line")
+            end_line = raw_symbol.get("end_line")
+            if (
+                not valid_static_relevance_symbol_name(name)
+                or not isinstance(kind, str)
+                or kind not in STATIC_RELEVANCE_SYMBOL_KINDS
+                or type(start_line) is not int
+                or type(end_line) is not int
+                or not (1 <= start_line <= end_line <= 10_000_000)
+            ):
+                invalid.append("invalid_symbol_signal")
+            else:
+                symbol = {"name": name, "kind": kind, "start_line": start_line, "end_line": end_line}
+
+    relations: dict[str, list[str] | None] = {}
+    relation_specs = (
+        ("symbol_references", "missing_symbol_references_signal", "invalid_symbol_references_signal"),
+        ("dataflow_predecessors", "missing_dataflow_predecessors_signal", "invalid_dataflow_predecessors_signal"),
+        ("dataflow_successors", "missing_dataflow_successors_signal", "invalid_dataflow_successors_signal"),
     )
+    for field, missing_token, invalid_token in relation_specs:
+        if field not in obj:
+            missing.append(missing_token)
+            relations[field] = None
+            continue
+        raw_relations = obj.get(field)
+        valid_list = isinstance(raw_relations, list)
+        safe_targets = [
+            target for target in raw_relations
+            if isinstance(target, str) and STATIC_RELEVANCE_ID_RE.fullmatch(target) is not None
+        ] if valid_list else []
+        valid_targets = valid_list and len(safe_targets) == len(raw_relations)
+        duplicate_targets = len(safe_targets) != len(set(safe_targets))
+        if not valid_list or len(raw_relations) > 64 or not valid_targets or duplicate_targets:
+            invalid.append(invalid_token)
+            relations[field] = None
+            if duplicate_targets:
+                structural.append("duplicate_relation_target")
+            continue
+        relations[field] = sorted(raw_relations)
+
+    git = None
+    if "git" not in obj:
+        missing.append("missing_git_signal")
+    else:
+        raw_git = obj.get("git")
+        expected_git_fields = {"blame_age_days", "blame_contributor_count", "path_change_count_90d"}
+        if not isinstance(raw_git, dict) or set(raw_git) - expected_git_fields:
+            invalid.append("invalid_git_signal")
+        else:
+            values: dict[str, int] = {}
+            git_specs = (
+                ("blame_age_days", "missing_blame_age_signal", "invalid_blame_age_signal", 0, 365000),
+                ("blame_contributor_count", "missing_blame_contributor_signal", "invalid_blame_contributor_signal", 1, 10000),
+                ("path_change_count_90d", "missing_path_change_count_signal", "invalid_path_change_count_signal", 0, 100000),
+            )
+            for field, missing_token, invalid_token, minimum, maximum in git_specs:
+                if field not in raw_git:
+                    missing.append(missing_token)
+                else:
+                    value = raw_git[field]
+                    if type(value) is not int or not minimum <= value <= maximum:
+                        invalid.append(invalid_token)
+                    else:
+                        values[field] = value
+            if len(values) == 3 and not any(token == "invalid_git_signal" for token in invalid):
+                git = {
+                    "blame_age_days": values["blame_age_days"],
+                    "blame_contributor_count": values["blame_contributor_count"],
+                    "path_change_count_90d": values["path_change_count_90d"],
+                }
+
+    row["structural_issues"] = ordered_static_relevance_taxonomy(structural)
+    row["missing_signals"] = ordered_static_relevance_taxonomy(missing)
+    row["invalid_signals"] = ordered_static_relevance_taxonomy(invalid)
+    locally_valid = not structural and not missing and not invalid
+    normalized = None
+    if locally_valid:
+        assert unit_id is not None and normalized_path is not None and task_anchor is not None
+        assert symbol is not None and git is not None
+        assert all(relations[field] is not None for field, _, _ in relation_specs)
+        normalized = {
+            "unit_id": unit_id,
+            "normalized_path": normalized_path,
+            "task_anchor": task_anchor,
+            "protection_reasons": ordered_reasons,
+            "symbol": symbol,
+            "symbol_references": relations["symbol_references"],
+            "dataflow_predecessors": relations["dataflow_predecessors"],
+            "dataflow_successors": relations["dataflow_successors"],
+            "git": git,
+        }
+        row["normalized_evidence_included"] = True
+    return {
+        "row": row,
+        "unit_id": unit_id,
+        "normalized_path": normalized_path,
+        "task_anchor": task_anchor,
+        "relations": relations,
+        "normalized": normalized,
+    }
 
+
+def traverse_static_relevance(starts: list[str], adjacency: dict[str, set[str]]) -> set[str]:
+    visited: set[str] = set()
+    pending = list(starts)
+    while pending:
+        unit_id = pending.pop()
+        if unit_id in visited:
+            continue
+        visited.add(unit_id)
+        pending.extend(sorted(adjacency[unit_id] - visited, reverse=True))
+    return visited
+
+
+def static_relevance_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
+    raw_units = getattr(args, "relevance_unit_json", None) or []
+    input_count = len(raw_units)
+    detailed_count = min(input_count, STATIC_RELEVANCE_DETAILED_UNIT_CAP)
+    overflow_count = max(input_count - STATIC_RELEVANCE_DETAILED_UNIT_CAP, 0)
+    rows: list[dict[str, Any]] = []
+    units: list[dict[str, Any]] = []
     blockers: list[str] = []
-    if not full_receipt:
-        blockers.append("missing_full_evidence_receipt")
-    if not missed_context_notes:
-        blockers.append("missing_missed_context_note")
-    if not crop_complete and not ocr_complete:
-        blockers.append("missing_derived_evidence")
+    if input_count == 0:
+        blockers.append("no_relevance_units")
+    if overflow_count:
+        blockers.append("relevance_unit_limit_exceeded")
+    for index, raw in enumerate(raw_units[:STATIC_RELEVANCE_DETAILED_UNIT_CAP]):
+        decoded, row = decode_static_relevance_unit(raw, index)
+        rows.append(row)
+        if decoded is not None:
+            units.append(normalize_static_relevance_unit(decoded, row))
+
+    by_id: dict[str, list[dict[str, Any]]] = {}
+    for unit in units:
+        if unit["unit_id"] is not None:
+            by_id.setdefault(unit["unit_id"], []).append(unit)
+    duplicate_ids = {unit_id for unit_id, matches in by_id.items() if len(matches) > 1}
+    if duplicate_ids:
+        blockers.append("duplicate_relevance_unit_id")
+        for unit_id in duplicate_ids:
+            for unit in by_id[unit_id]:
+                unit["row"]["structural_issues"] = ordered_static_relevance_taxonomy(
+                    unit["row"]["structural_issues"] + ["duplicate_relevance_unit_id"]
+                )
 
-    if crop_fields_present and (not crop_label or not crop_geometry_valid):
-        blockers.append("invalid_crop_bounds")
-    elif crop_fields_present and crop_exceeds:
-        blockers.append("crop_exceeds_image_bounds")
+    relation_fields = ("symbol_references", "dataflow_predecessors", "dataflow_successors")
+    for unit in units:
+        relation_targets = [
+            target
+            for field in relation_fields
+            for target in (unit["relations"].get(field) or [])
+        ]
+        cross_issues: list[str] = []
+        if any(target not in by_id for target in relation_targets):
+            cross_issues.append("unknown_relation_target")
+        if any(target in duplicate_ids for target in relation_targets):
+            cross_issues.append("ambiguous_relation_target")
+        if cross_issues:
+            unit["row"]["structural_issues"] = ordered_static_relevance_taxonomy(
+                unit["row"]["structural_issues"] + cross_issues
+            )
 
-    if ocr_fields_present:
-        if confidence_error == "missing":
-            blockers.append("missing_ocr_confidence")
-        elif confidence_error == "invalid":
-            blockers.append("invalid_ocr_confidence")
-        if not ocr_error_notes:
-            blockers.append("missing_ocr_error_note")
-        if not ocr_text["has_text"]:
-            blockers.append("missing_ocr_text")
-        if not ocr_text["valid_utf8"]:
-            blockers.append("invalid_ocr_text_encoding")
-        if ocr_text["truncated"]:
-            blockers.append("ocr_text_truncated")
+    unique_normalized = {
+        unit_id: matches[0]["normalized"]
+        for unit_id, matches in by_id.items()
+        if len(matches) == 1 and matches[0]["normalized"] is not None
+    }
+    inconsistent_ids: set[str] = set()
+    for unit_id, unit in unique_normalized.items():
+        assert unit is not None
+        for successor in unit["dataflow_successors"]:
+            target = unique_normalized.get(successor)
+            if target is not None and unit_id not in target["dataflow_predecessors"]:
+                inconsistent_ids.add(unit_id)
+        for predecessor in unit["dataflow_predecessors"]:
+            target = unique_normalized.get(predecessor)
+            if target is not None and unit_id not in target["dataflow_successors"]:
+                inconsistent_ids.add(unit_id)
+    if inconsistent_ids:
+        blockers.append("inconsistent_dataflow_relation")
+        for unit_id in inconsistent_ids:
+            for unit in by_id[unit_id]:
+                unit["row"]["structural_issues"] = ordered_static_relevance_taxonomy(
+                    unit["row"]["structural_issues"] + ["inconsistent_dataflow_relation"]
+                )
 
-    # Preserve stable ordering while avoiding duplicates when incomplete derived
-    # evidence also contributed path-specific blockers.
-    blockers = list(dict.fromkeys(blockers))
-    status = "ready_for_human_review" if not blockers else "blocked_until_visual_evidence"
+    safe_anchor_ids = sorted({
+        unit["unit_id"] for unit in units
+        if unit["unit_id"] is not None and unit["task_anchor"] is True
+    })
+    if not safe_anchor_ids:
+        blockers.append("no_task_anchor")
+    for row in rows:
+        blockers.extend(row["structural_issues"])
+        blockers.extend(row["missing_signals"])
+        blockers.extend(row["invalid_signals"])
+
+    protected_policy = "deny" if getattr(args, "protected_path_policy", None) == "deny" else None
+    if protected_policy is None:
+        blockers.append("protected_path_policy_required")
+    provider_ack = bool(getattr(args, "provider_boundary_ack", False))
+    if not provider_ack:
+        blockers.append("provider_boundary_ack_required")
+    blockers = ordered_static_relevance_taxonomy(blockers)
+
+    structural_tokens = set(STATIC_RELEVANCE_BLOCKER_ORDER[:19]) | set(STATIC_RELEVANCE_BLOCKER_ORDER[35:39])
+    structural_integrity_complete = not any(token in structural_tokens for token in blockers)
+    unassessable_tokens = set(STATIC_RELEVANCE_BLOCKER_ORDER[2:12])
+    signal_tokens = set(STATIC_RELEVANCE_BLOCKER_ORDER[19:35])
+    declared_signal_fields_complete = (
+        1 <= input_count <= STATIC_RELEVANCE_DETAILED_UNIT_CAP
+        and not any(token in unassessable_tokens or token in signal_tokens for token in blockers)
+    )
+    compilation_performed = (
+        structural_integrity_complete
+        and declared_signal_fields_complete
+        and protected_policy == "deny"
+        and provider_ack
+    )
 
+    normalized_units = [unit["normalized"] for unit in units if unit["normalized"] is not None]
+    normalized_units.sort(key=lambda unit: (
+        unit["unit_id"], unit["normalized_path"],
+        json.dumps(unit, ensure_ascii=False, sort_keys=True, separators=(",", ":")),
+    ))
+    protected_vetoes = [
+        {
+            "unit_id": unit["unit_id"],
+            "normalized_path": unit["normalized_path"],
+            "protection_reasons": unit["row"]["protection_reasons"],
+            "protected_retention_veto": True,
+            "review_priority_tier": 0,
+        }
+        for unit in units
+        if unit["unit_id"] is not None
+        and unit["normalized_path"] is not None
+        and unit["row"]["protection_reasons"]
+    ]
+    protected_vetoes.sort(key=lambda row: (
+        row["unit_id"], row["normalized_path"],
+        json.dumps(row["protection_reasons"], ensure_ascii=False, separators=(",", ":")),
+    ))
+
+    backward_ids: list[str] = []
+    forward_ids: list[str] = []
+    symbol_ids: list[str] = []
+    review_order: list[dict[str, Any]] = []
+    if compilation_performed:
+        compiled_by_id = {unit["unit_id"]: unit for unit in normalized_units}
+        identifiers = set(compiled_by_id)
+        successors = {unit_id: set(unit["dataflow_successors"]) for unit_id, unit in compiled_by_id.items()}
+        predecessors = {unit_id: set(unit["dataflow_predecessors"]) for unit_id, unit in compiled_by_id.items()}
+        symbol_out = {unit_id: set(unit["symbol_references"]) for unit_id, unit in compiled_by_id.items()}
+        symbol_in = {unit_id: set() for unit_id in identifiers}
+        symbol_graph = {unit_id: set() for unit_id in identifiers}
+        union_graph = {unit_id: set() for unit_id in identifiers}
+        for unit_id in identifiers:
+            for target in symbol_out[unit_id]:
+                symbol_in[target].add(unit_id)
+                symbol_graph[unit_id].add(target)
+                symbol_graph[target].add(unit_id)
+                union_graph[unit_id].add(target)
+                union_graph[target].add(unit_id)
+            for target in successors[unit_id] | predecessors[unit_id]:
+                union_graph[unit_id].add(target)
+                union_graph[target].add(unit_id)
+        anchors = sorted(unit_id for unit_id, unit in compiled_by_id.items() if unit["task_anchor"])
+        forward = traverse_static_relevance(anchors, successors)
+        backward = traverse_static_relevance(anchors, predecessors)
+        symbol_slice = traverse_static_relevance(anchors, symbol_graph)
+        forward_ids = sorted(forward)
+        backward_ids = sorted(backward)
+        symbol_ids = sorted(symbol_slice)
+        distances = {unit_id: 65 for unit_id in identifiers}
+        pending = [(anchor, 0) for anchor in anchors]
+        cursor = 0
+        while cursor < len(pending):
+            unit_id, distance = pending[cursor]
+            cursor += 1
+            if distance >= distances[unit_id]:
+                continue
+            distances[unit_id] = distance
+            for target in sorted(union_graph[unit_id]):
+                if distance + 1 < distances[target]:
+                    pending.append((target, distance + 1))
+        rows_for_sort: list[tuple[tuple[Any, ...], dict[str, Any]]] = []
+        for unit_id, unit in compiled_by_id.items():
+            symbol_in_degree = len(symbol_in[unit_id] - {unit_id})
+            symbol_out_degree = len(symbol_out[unit_id] - {unit_id})
+            dataflow_in_degree = len(predecessors[unit_id] - {unit_id})
+            dataflow_out_degree = len(successors[unit_id] - {unit_id})
+            centrality_total = symbol_in_degree + symbol_out_degree + dataflow_in_degree + dataflow_out_degree
+            protected = bool(unit["protection_reasons"])
+            if protected:
+                tier = 0
+            elif unit["task_anchor"]:
+                tier = 1
+            elif unit_id in forward or unit_id in backward:
+                tier = 2
+            elif unit_id in symbol_slice:
+                tier = 3
+            elif distances[unit_id] != 65:
+                tier = 4
+            else:
+                tier = 5
+            rank_key = (
+                tier, distances[unit_id], -centrality_total,
+                -unit["git"]["path_change_count_90d"], unit["git"]["blame_age_days"],
+                unit["normalized_path"], unit_id,
+            )
+            review = {
+                "rank": 0,
+                "unit_id": unit_id,
+                "normalized_path": unit["normalized_path"],
+                "symbol": unit["symbol"],
+                "task_anchor": unit["task_anchor"],
+                "protection_reasons": unit["protection_reasons"],
+                "protected_retention_veto": protected,
+                "review_priority_tier": tier,
+                "task_distance": distances[unit_id],
+                "centrality": {
+                    "symbol_in_degree": symbol_in_degree,
+                    "symbol_out_degree": symbol_out_degree,
+                    "dataflow_in_degree": dataflow_in_degree,
+                    "dataflow_out_degree": dataflow_out_degree,
+                    "centrality_total": centrality_total,
+                },
+                "git": unit["git"],
+                "rank_key": list(rank_key),
+            }
+            rows_for_sort.append((rank_key, review))
+        rows_for_sort.sort(key=lambda item: item[0])
+        review_order = [row for _, row in rows_for_sort]
+        for rank, row in enumerate(review_order, 1):
+            row["rank"] = rank
+
+    rows.sort(key=lambda row: (
+        row["unit_id"] is None, row["unit_id"] or "",
+        row["normalized_path"] is None, row["normalized_path"] or "", row["input_index"],
+    ))
     return {
-        "tool": TOOL_NAME,
-        "schema_version": CONFIG_SCHEMA_VERSION,
-        "experiment_id": "visual-crop-ocr",
-        "mode": "dry_run",
-        "status": status,
-        "external_services": {
-            "called": False,
-            "ocr_service": None,
-            "image_service": None,
-            "network": False,
-        },
-        "full_visual_evidence": {
-            "required": True,
-            "available": bool(full_receipt),
-            "receipt_id": full_receipt,
-            "label": full_label,
-            "verified": False,
-            "note": "G004 records user-supplied full visual evidence handles only; it does not verify receipt storage.",
+        "schema": STATIC_RELEVANCE_PLAN_SCHEMA_VERSION,
+        "experiment_id": "static-relevance",
+        "mode": "plan",
+        "status": "ready_for_plan_review" if compilation_performed else "blocked",
+        "process_exit_contract": STATIC_RELEVANCE_PROCESS_EXIT_CONTRACT,
+        "protected_path_policy": protected_policy,
+        "effective_protected_path_policy": "deny",
+        "provider_boundary_acknowledged": provider_ack,
+        "input_summary": {
+            "input_count": input_count, "detailed_count": detailed_count, "overflow_count": overflow_count,
         },
-        "derived_evidence": {
-            "crop": {
-                "available": crop_complete,
-                "label": crop_label,
-                "bounds": bounds_payload,
-                "image_size": image_payload,
-                "source": "user_supplied_metadata" if crop_fields_present else None,
-            },
-            "ocr": {
-                "available": ocr_complete,
-                "source_type": ocr_text["source_type"],
-                "source_label": ocr_text["source_label"],
-                "text_preview": ocr_text["text_preview"] if ocr_text["has_text"] else None,
-                "metadata": {
-                    "bytes": ocr_text["bytes"],
-                    "lines": ocr_text["lines"],
-                    "sha256": ocr_text["sha256"],
-                    "truncated": ocr_text["truncated"],
-                    "max_bytes": ocr_text["max_bytes"],
-                    "valid_utf8": ocr_text["valid_utf8"],
-                },
-                "confidence": confidence,
-                "error_notes": ocr_error_notes,
-            },
+        "structural_integrity_complete": structural_integrity_complete,
+        "declared_signal_fields_complete": declared_signal_fields_complete,
+        "compilation_performed": compilation_performed,
+        "normalized_evidence": {"unit_count": len(normalized_units), "units": normalized_units},
+        "unit_validation": rows,
+        "compilation": {
+            "task_anchor_ids": safe_anchor_ids,
+            "backward_dataflow_slice_ids": backward_ids,
+            "forward_dataflow_slice_ids": forward_ids,
+            "symbol_slice_ids": symbol_ids,
+            "protected_vetoes": protected_vetoes,
+            "review_order": review_order,
         },
-        "guardrails": {
-            "original_evidence_required": True,
-            "full_visual_evidence_must_remain_available": True,
-            "external_ocr_service_allowed": False,
-            "external_image_service_allowed": False,
-            "human_review_required": True,
-            "missed_context_review_required": True,
-            "confidence_error_notes_required_for_ocr": True,
-            "stable_runtime_behavior_changed": False,
-            "candidate_replacement_allowed": False,
+        "readiness_blockers": blockers,
+        "warnings": list(STATIC_RELEVANCE_WARNING_ORDER),
+        "verification_scope": {
+            "evidence_collection_verified": False,
+            "repository_coverage_verified": False,
+            "symbol_resolution_verified": False,
+            "dataflow_semantics_verified": False,
+            "git_metrics_verified": False,
         },
-        "review_plan": {
-            "readiness_blockers": blockers,
-            "missed_context_notes": missed_context_notes,
-            "next_steps": [
-                "Keep full visual evidence retrievable before relying on cropped or OCR-derived evidence.",
-                "Review crop bounds and OCR text against the original evidence for missed context.",
-                "Do not claim hosted image/text token or cost savings from this dry-run plan.",
-            ],
+        "runtime_boundaries": {
+            "repository_scanned": False,
+            "source_content_read": False,
+            "git_invoked": False,
+            "parser_invoked": False,
+            "provider_called": False,
+            "files_written": False,
         },
-        "claim_boundary": (
-            "Dry-run visual/OCR fixture planning only; no hosted visual/text token or cost savings claim without "
-            "provider-measured matched successful tasks."
-        ),
         "candidate_replacement": None,
+        "human_review_performed": False,
+        "deprioritization_authorized": False,
+        "omission_authorized": False,
+        "runtime_action_allowed": False,
     }
 
 
-def command_plan_visual_crop_ocr(args: argparse.Namespace) -> int:
-    payload = visual_crop_ocr_plan_payload(args)
+def command_plan_static_relevance(args: argparse.Namespace) -> int:
+    payload = static_relevance_plan_payload(args)
     if args.json:
-        emit_json(payload)
+        print(json.dumps(payload, ensure_ascii=False, sort_keys=True, separators=(",", ":")))
     else:
-        print("ContextGuard visual crop/OCR plan (dry-run only)")
-        print("No external OCR/image service was called and no replacement evidence was emitted.")
+        summary = payload["input_summary"]
+        print("ContextGuard static-relevance plan")
         print(f"Status: {payload['status']}")
-        print(f"Full evidence available: {payload['full_visual_evidence']['available']} verified=false")
-        print(
-            "Derived evidence: "
-            f"crop={payload['derived_evidence']['crop']['available']} "
-            f"ocr={payload['derived_evidence']['ocr']['available']}"
-        )
-        if payload["review_plan"]["readiness_blockers"]:
-            print(f"Readiness blockers: {', '.join(payload['review_plan']['readiness_blockers'])}")
-        print(payload["claim_boundary"])
-    return 0
+        print(f"Inputs: {summary['input_count']}; blockers: {len(payload['readiness_blockers'])}")
+        print(f"Protected retention vetoes: {len(payload['compilation']['protected_vetoes'])}")
+        print("Static relevance is plan-review-only and authorizes no deprioritization, omission, deletion, or runtime action.")
+    return 0 if payload["status"] == "ready_for_plan_review" else 2
 
 
 def visual_crop_ocr_evidence_pack_payload(args: argparse.Namespace) -> dict[str, Any]:
@@ -4435,7 +7683,9 @@ def build_parser() -> argparse.ArgumentParser:
     add_common_args(disable_parser)
     disable_parser.set_defaults(func=command_disable)
 
-    plan_parser = sub.add_parser("plan", help="Run read-only dry-run planners for experimental lanes.")
+    plan_parser = sub.add_parser(
+        "plan", allow_abbrev=False, help="Run read-only dry-run planners for experimental lanes."
+    )
     plan_sub = plan_parser.add_subparsers(dest="plan_command", required=True)
 
     context_diff = plan_sub.add_parser(
@@ -4467,6 +7717,158 @@ def build_parser() -> argparse.ArgumentParser:
     visual_ocr.add_argument("--json", action="store_true", help="Emit JSON output.")
     visual_ocr.set_defaults(func=command_plan_visual_crop_ocr)
 
+    image_context_pack = plan_sub.add_parser(
+        "image-context-pack",
+        help="Dry-run a plan-only pxpipe-inspired image/context packing gate without rendering images.",
+    )
+    image_context_pack.add_argument("--source-label", help="Safe label for this image/context packing plan.")
+    image_context_pack.add_argument("--image-size", help="Optional source image/context canvas size as width,height integers.")
+    image_context_pack.add_argument("--packed-image-size", help="Optional planned packed image size as width,height integers.")
+    image_context_pack.add_argument("--exact-text-fallback-receipt", help="Local exact text artifact receipt id for omitted source text.")
+    image_context_pack.add_argument("--reexpand-command", help="Local exact text re-expand command bound to the receipt id.")
+    image_context_pack.add_argument(
+        "--provider-boundary-ack",
+        action="store_true",
+        help="Acknowledge hosted claims require provider-measured matched successful tasks for the target model.",
+    )
+    image_context_pack.add_argument(
+        "--protected-zone-policy",
+        default="deny",
+        choices=("deny", "allow"),
+        help="Protected evidence handling; only deny can pass the plan gate.",
+    )
+    image_context_pack.add_argument("--missed-context-note", action="append", help="Potential context omitted by a future pack. Repeatable.")
+    image_context_pack.add_argument("--json", action="store_true", help="Emit JSON output.")
+    image_context_pack.set_defaults(func=command_plan_image_context_pack)
+
+    semantic_checkpoint = plan_sub.add_parser(
+        "semantic-checkpoint",
+        help="Dry-run a plan-only semantic checkpoint metadata gate without replacing raw context.",
+    )
+    semantic_checkpoint.add_argument("--goal", help="Planning goal for the semantic checkpoint metadata.")
+    semantic_checkpoint.add_argument("--constraint", action="append", help="Constraint the checkpoint metadata must preserve. Repeatable.")
+    semantic_checkpoint.add_argument("--decision", action="append", help="Decision captured by the checkpoint metadata. Repeatable.")
+    semantic_checkpoint.add_argument("--open-task", action="append", help="Open task captured by the checkpoint metadata. Repeatable.")
+    semantic_checkpoint.add_argument("--evidence-handle", action="append", help="Evidence/provenance handle supporting the checkpoint. Repeatable.")
+    semantic_checkpoint.add_argument("--missing-provenance-note", action="append", help="Missing provenance review note or 'none known after review'. Repeatable.")
+    semantic_checkpoint.add_argument("--unresolved-question", action="append", help="Unresolved question for checkpoint review. Repeatable.")
+    semantic_checkpoint.add_argument("--exact-context-fallback-receipt", help="Local exact raw context artifact receipt id.")
+    semantic_checkpoint.add_argument("--reexpand-command", help="Local exact context re-expand command bound to the receipt id.")
+    semantic_checkpoint.add_argument(
+        "--provider-boundary-ack",
+        action="store_true",
+        help="Acknowledge hosted claims require provider-measured matched successful tasks for the target model.",
+    )
+    semantic_checkpoint.add_argument(
+        "--protected-zone-policy",
+        default="deny",
+        choices=("deny", "allow"),
+        help="Protected evidence handling; only deny can pass the plan gate.",
+    )
+    semantic_checkpoint.add_argument("--missed-context-note", action="append", help="Potential context missed by checkpoint metadata. Repeatable.")
+    semantic_checkpoint.add_argument("--json", action="store_true", help="Emit JSON output.")
+    semantic_checkpoint.set_defaults(func=command_plan_semantic_checkpoint)
+
+    proof_carrying_context = plan_sub.add_parser(
+        "proof-carrying-context",
+        help="Dry-run bounded proof-envelope metadata readiness without reading or verifying content.",
+    )
+    proof_carrying_context.add_argument(
+        "--proof-unit-json",
+        action="append",
+        help="Inline literal proof-unit JSON object. Repeatable; never treated as a path.",
+    )
+    proof_carrying_context.add_argument(
+        "--provider-boundary-ack",
+        action="store_true",
+        help="Acknowledge hosted claims require provider-measured matched successful tasks for the target model.",
+    )
+    proof_carrying_context.add_argument(
+        "--protected-zone-policy",
+        default="deny",
+        choices=("deny", "allow"),
+        help="Caller-declared protected evidence policy; only deny can pass and compliance remains unchecked.",
+    )
+    proof_carrying_context.add_argument("--json", action="store_true", help="Emit JSON output.")
+    proof_carrying_context.set_defaults(func=command_plan_proof_carrying_context)
+
+    verify_parser = sub.add_parser(
+        "verify",
+        allow_abbrev=False,
+        help="Run bounded read-only local verifiers for experimental lanes.",
+    )
+    verify_sub = verify_parser.add_subparsers(dest="verify_command", required=True)
+    verify_proof = verify_sub.add_parser(
+        "proof-carrying-context",
+        allow_abbrev=False,
+        help="Verify explicit private receipt leaves without retrieval or execution.",
+    )
+    verify_proof.add_argument(
+        "--artifact-dir",
+        action=StoreOnceAction,
+        help="One explicit private local artifact directory; no fallback is searched.",
+    )
+    verify_proof.add_argument(
+        "--proof-unit-json",
+        action="append",
+        help="Inline literal proof-unit JSON object. Repeatable; never treated as a path.",
+    )
+    verify_proof.add_argument("--json", action="store_true", help="Emit JSON output.")
+    verify_proof.set_defaults(func=command_verify_proof_carrying_context)
+
+    semantic_gc = plan_sub.add_parser(
+        "semantic-gc",
+        allow_abbrev=False,
+        help="Plan caller-declared graph reachability candidates without reading or omitting context.",
+    )
+    semantic_gc.add_argument(
+        "--context-unit-json",
+        action="append",
+        help="Inline literal semantic-GC unit JSON object. Repeatable; never treated as a path.",
+    )
+    semantic_gc.add_argument(
+        "--provider-boundary-ack",
+        action="store_true",
+        help="Acknowledge that provider behavior and hosted savings remain unverified.",
+    )
+    semantic_gc.add_argument(
+        "--human-review-ack",
+        action="store_true",
+        help="Acknowledge that candidate review remains required; this does not perform review.",
+    )
+    semantic_gc.add_argument(
+        "--protected-zone-policy",
+        choices=("deny",),
+        default=None,
+        help="Explicit deny-only protected-zone declaration; omitted remains effective deny but blocks readiness.",
+    )
+    semantic_gc.add_argument("--json", action="store_true", help="Emit JSON output.")
+    semantic_gc.set_defaults(func=command_plan_semantic_gc)
+
+    static_relevance = plan_sub.add_parser(
+        "static-relevance",
+        allow_abbrev=False,
+        help="Compile bounded caller-declared static evidence into plan-review diagnostics.",
+    )
+    static_relevance.add_argument(
+        "--relevance-unit-json",
+        action="append",
+        help="Inline literal static-relevance unit JSON object. Repeatable; never treated as a path.",
+    )
+    static_relevance.add_argument(
+        "--provider-boundary-ack",
+        action="store_true",
+        help="Acknowledge that provider behavior and hosted savings remain unverified.",
+    )
+    static_relevance.add_argument(
+        "--protected-path-policy",
+        choices=("deny",),
+        default=None,
+        help="Explicit deny-only protected-path declaration; omitted remains effective deny but blocks readiness.",
+    )
+    static_relevance.add_argument("--json", action="store_true", help="Emit JSON output.")
+    static_relevance.set_defaults(func=command_plan_static_relevance)
+
     self_hosted = plan_sub.add_parser(
         "self-hosted-metrics-ledger",
         help="Dry-run self-hosted/local metrics ledger sidecar evidence without writing a ledger.",
@@ -4757,7 +8159,7 @@ def normalize_negative_csv_option_values(argv: list[str] | None) -> list[str] |
         argv = sys.argv[1:]
     normalized: list[str] = []
     pending_csv_option: str | None = None
-    csv_options = {"--crop-bounds"}
+    csv_options = {"--crop-bounds", "--image-size", "--packed-image-size"}
     for token in argv:
         if pending_csv_option is not None:
             normalized.append(f"{pending_csv_option}={token}")