@kontourai/flow-agents 2.3.0 → 3.0.0

package/evals/integration/test_workflow_sidecar_writer.sh

@@ -34,7 +34,7 @@ run_bounded() {
 
 WRITER="workflow-sidecar"
 VALIDATOR="validate-workflow-artifacts"
-ARTIFACT_DIR="$TMPDIR_EVAL/repo/.flow-agents/auto-sidecars"
+ARTIFACT_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/auto-sidecars"
 mkdir -p "$ARTIFACT_DIR"
 
 DEFAULT_ROOT_REPO="$TMPDIR_EVAL/default-root-repo"
@@ -56,22 +56,57 @@ else
   _fail "sidecar writer default-root ensure-session failed: $(cat "$TMPDIR_EVAL/default-root.out" "$TMPDIR_EVAL/default-root.err")"
 fi
 
-OLD_ROOT_REPO="$TMPDIR_EVAL/old-root-repo"
-mkdir -p "$OLD_ROOT_REPO/.flow-agents/old-session"
-cat > "$OLD_ROOT_REPO/.flow-agents/current.json" <<'JSON'
-{"schema_version":"1.0","active_slug":"old-session","artifact_dir":"old-session"}
+PREVIOUS_ROOT_REPO="$TMPDIR_EVAL/previous-root-repo"
+mkdir -p "$PREVIOUS_ROOT_REPO/.flow-agents/previous-session"
+cat > "$PREVIOUS_ROOT_REPO/.flow-agents/current.json" <<'JSON'
+{"schema_version":"1.0","active_slug":"previous-session","artifact_dir":"previous-session"}
 JSON
-cat > "$OLD_ROOT_REPO/.flow-agents/old-session/state.json" <<'JSON'
-{"schema_version":"1.0","task_slug":"old-session","status":"planned","phase":"planning","next_action":{"status":"continue","summary":"continue"}}
+cat > "$PREVIOUS_ROOT_REPO/.flow-agents/previous-session/state.json" <<'JSON'
+{"schema_version":"1.0","task_slug":"previous-session","status":"planned","phase":"planning","next_action":{"status":"continue","summary":"continue"}}
 JSON
-if (cd "$OLD_ROOT_REPO" && flow_agents_node "$WRITER" current --format slug >"$TMPDIR_EVAL/old-current.out" 2>"$TMPDIR_EVAL/old-current.err") \
-  && [[ "$(cat "$TMPDIR_EVAL/old-current.out")" == "old-session" ]]; then
-  _pass "sidecar writer reads legacy .flow-agents current session when no new root exists"
+if (cd "$PREVIOUS_ROOT_REPO" && flow_agents_node "$WRITER" current --format slug >"$TMPDIR_EVAL/previous-current.out" 2>"$TMPDIR_EVAL/previous-current.err"); then
+  _fail "sidecar writer default current unexpectedly read previous .flow-agents runtime root: $(cat "$TMPDIR_EVAL/previous-current.out")"
 else
-  _fail "sidecar writer did not read legacy current session: $(cat "$TMPDIR_EVAL/old-current.out" "$TMPDIR_EVAL/old-current.err")"
+  _pass "sidecar writer does not fall back to previous .flow-agents runtime root"
 fi
 
-SESSION_ROOT="$TMPDIR_EVAL/repo/.flow-agents"
+if (cd "$PREVIOUS_ROOT_REPO" && flow_agents_node "$WRITER" current --artifact-root "$PREVIOUS_ROOT_REPO/.flow-agents" --format slug >"$TMPDIR_EVAL/previous-current-explicit.out" 2>"$TMPDIR_EVAL/previous-current-explicit.err") \
+  && [[ "$(cat "$TMPDIR_EVAL/previous-current-explicit.out")" == "previous-session" ]]; then
+  _pass "sidecar writer reads explicitly supplied artifact root"
+else
+  _fail "sidecar writer did not read explicit artifact root: $(cat "$TMPDIR_EVAL/previous-current-explicit.out" "$TMPDIR_EVAL/previous-current-explicit.err")"
+fi
+
+TRAVERSAL_ROOT="$TMPDIR_EVAL/traversal-repo/.kontourai/flow-agents"
+TRAVERSAL_OUTSIDE="$TMPDIR_EVAL/traversal-outside-existing"
+mkdir -p "$TRAVERSAL_ROOT" "$TRAVERSAL_OUTSIDE"
+node - "$TRAVERSAL_ROOT" "$TRAVERSAL_OUTSIDE" <<'NODE'
+const fs = require("node:fs");
+const path = require("node:path");
+const root = process.argv[2];
+const outside = process.argv[3];
+fs.writeFileSync(path.join(root, "current.json"), JSON.stringify({
+  schema_version: "1.0",
+  active_slug: "escape",
+  artifact_dir: path.relative(root, outside),
+  updated_at: "2026-05-09T00:00:00Z",
+}) + "\n");
+NODE
+if run_bounded 20 flow_agents_node "$WRITER" record-agent-event \
+  --artifact-root "$TRAVERSAL_ROOT" \
+  --agent-id tool-worker \
+  --kind note \
+  --status active \
+  --summary "must not write outside" \
+  >"$TMPDIR_EVAL/current-traversal.out" 2>"$TMPDIR_EVAL/current-traversal.err"; then
+  _fail "sidecar writer accepted current.json artifact_dir outside artifact root"
+elif [[ ! -e "$TRAVERSAL_OUTSIDE/agents" ]]; then
+  _pass "sidecar writer rejects current.json artifact_dir outside artifact root"
+else
+  _fail "sidecar writer wrote agent events outside artifact root"
+fi
+
+SESSION_ROOT="$TMPDIR_EVAL/repo/.kontourai/flow-agents"
 if flow_agents_node "$WRITER" ensure-session \
   --artifact-root "$SESSION_ROOT" \
   --task-slug ensured-session \
@@ -118,12 +153,12 @@ if (cd "$UNSAFE_REPO_ROOT" \
   && git init -q \
   && git remote add origin "file:///Users/alice/customer-secret.git" \
   && FLOW_AGENTS_REPO="/Users/alice/customer-secret" flow_agents_node "$WRITER" ensure-session \
-    --artifact-root ".flow-agents" \
+    --artifact-root ".kontourai/flow-agents" \
     --task-slug unsafe-repo \
     --title "Unsafe repo" \
     --summary "Unsafe repo fallback." \
     --timestamp "2026-05-09T00:00:00Z" >/dev/null 2>"$TMPDIR_EVAL/unsafe-repo.err" \
-  && node - ".flow-agents/unsafe-repo/state.json" <<'NODE'
+  && node - ".kontourai/flow-agents/unsafe-repo/state.json" <<'NODE'
 const fs = require("node:fs");
 const repo = JSON.parse(fs.readFileSync(process.argv[2], "utf8")).repo;
 if (repo !== "unsafe-repo") throw new Error(`unsafe repo fallback was ${JSON.stringify(repo)}`);
@@ -162,8 +197,8 @@ else
 fi
 
 cp "$SESSION_ROOT/current.json" "$TMPDIR_EVAL/current-before-traversal-agent.json"
-TRAVERSAL_AGENT_OUTSIDE="$TMPDIR_EVAL/repo/.flow-agents/evil-agent-outside.jsonl"
-if run_bounded 5 flow_agents_node "$WRITER" record-agent-event \
+TRAVERSAL_AGENT_OUTSIDE="$TMPDIR_EVAL/repo/.kontourai/flow-agents/evil-agent-outside.jsonl"
+if run_bounded 20 flow_agents_node "$WRITER" record-agent-event \
   --artifact-root "$SESSION_ROOT" \
   --agent-id ../evil-agent-outside \
   --kind evidence \
@@ -219,7 +254,7 @@ if flow_agents_node "$WRITER" ensure-session \
   --timestamp "2026-05-09T00:00:50Z" >"$TMPDIR_EVAL/ensure-traversal.out" 2>&1; then
   _fail "sidecar writer should reject traversal task slugs"
 elif rg -q -- '--task-slug must not contain' "$TMPDIR_EVAL/ensure-traversal.out" \
-  && [[ ! -d "$TMPDIR_EVAL/repo/.flow-agents/outside" ]]; then
+  && [[ ! -d "$TMPDIR_EVAL/repo/.kontourai/flow-agents/outside" ]]; then
   _pass "sidecar writer rejects traversal task slugs without creating outside dirs"
 else
   _fail "sidecar writer traversal rejection was not fail-closed: $(cat "$TMPDIR_EVAL/ensure-traversal.out")"
@@ -249,7 +284,7 @@ mkdir -p "$COPIED_ROOT"
 cp -R "$ENSURED_DIR" "$COPIED_DIR"
 cp "$SESSION_ROOT/current.json" "$TMPDIR_EVAL/current-before-copied-agent.json"
 COPIED_AGENT_EVENT_PATH="$COPIED_DIR/ag""ents/copied-worker/events.jsonl"
-if run_bounded 5 flow_agents_node "$WRITER" record-agent-event \
+if run_bounded 20 flow_agents_node "$WRITER" record-agent-event \
   --artifact-dir "$COPIED_DIR" \
   --agent-id copied-worker \
   --kind evidence \
@@ -269,7 +304,7 @@ fi
 
 cp "$SESSION_ROOT/current.json" "$TMPDIR_EVAL/current-before-mismatch-agent.json"
 MISMATCH_AGENT_EVENT_PATH="$COPIED_DIR/ag""ents/mismatch-worker/events.jsonl"
-if run_bounded 5 flow_agents_node "$WRITER" record-agent-event \
+if run_bounded 20 flow_agents_node "$WRITER" record-agent-event \
   --artifact-root "$SESSION_ROOT" \
   --artifact-dir "$COPIED_DIR" \
   --agent-id mismatch-worker \
@@ -293,7 +328,7 @@ SYMLINK_DIR="$SESSION_ROOT/symlink-session"
 mkdir -p "$SYMLINK_TARGET"
 if ln -s "$SYMLINK_TARGET" "$SYMLINK_DIR" 2>"$TMPDIR_EVAL/symlink-create.err"; then
   cp "$SESSION_ROOT/current.json" "$TMPDIR_EVAL/current-before-symlink-agent.json"
-  if run_bounded 5 flow_agents_node "$WRITER" record-agent-event \
+  if run_bounded 20 flow_agents_node "$WRITER" record-agent-event \
     --artifact-root "$SESSION_ROOT" \
     --artifact-dir "$SYMLINK_DIR" \
     --agent-id symlink-worker \
@@ -422,12 +457,405 @@ if flow_agents_node "$WRITER" ensure-session \
   --criterion "Different CLI criterion" \
   --timestamp "2026-05-09T00:02:00Z" >"$TMPDIR_EVAL/ensure-existing.out" 2>"$TMPDIR_EVAL/ensure-existing.err" \
   && rg -q '"description": "Existing artifact criterion"' "$EXISTING_ONLY_DIR/acceptance.json" \
-  && ! rg -q 'Different CLI criterion' "$EXISTING_ONLY_DIR/acceptance.json"; then
-  _pass "sidecar writer derives missing sidecars from existing session Markdown"
+  && ! rg -q 'Different CLI criterion' "$EXISTING_ONLY_DIR/acceptance.json" \
+  && rg -q '"branch": "main"' "$EXISTING_ONLY_DIR/state.json"; then
+  _pass "sidecar writer derives missing sidecars from existing session Markdown and preserves its own pre-#289 branch: main line (legacy, not re-derived)"
 else
   _fail "sidecar writer drifted sidecars from existing session Markdown: $(cat "$TMPDIR_EVAL/ensure-existing.out" "$TMPDIR_EVAL/ensure-existing.err")"
 fi
 
+# ─── #289: branch as first-class routing state (agent/<actor>/<slug>) ─────────
+# AC2/AC7 (derivation + current.json mirror): a freshly created session with no explicit
+# --actor derives its branch from the ambient runtime session id. CLAUDE_CODE_SESSION_ID is
+# injected here to exercise the real Claude Code runtime-session-id path in
+# actor-identity.js's resolveActor (rather than the --actor override seam) — state.json, the
+# freshly seeded session Markdown, and current.json must all carry the same derived
+# agent/<actor>/<slug> value.
+BRANCH_ENV_DIR="$SESSION_ROOT/branch-session-env"
+if CLAUDE_CODE_SESSION_ID="claude-session-alpha-001" flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SESSION_ROOT" \
+  --task-slug branch-session-env \
+  --source-request "Derive a routing branch from an injected runtime session id." \
+  --summary "A fresh session with no explicit --actor should derive its branch from the injected runtime session id." \
+  --timestamp "2026-05-09T00:03:00Z" >"$TMPDIR_EVAL/branch-session-env.out" 2>"$TMPDIR_EVAL/branch-session-env.err" \
+  && rg -q '"branch": "agent/claude-code-claude-session-alpha-001-[A-Za-z0-9_.-]+/branch-session-env"' "$BRANCH_ENV_DIR/state.json" \
+  && grep -Eq '^branch: agent/claude-code-claude-session-alpha-001-[A-Za-z0-9_.-]+/branch-session-env$' "$BRANCH_ENV_DIR/branch-session-env--deliver.md" \
+  && rg -q '"branch": "agent/claude-code-claude-session-alpha-001-[A-Za-z0-9_.-]+/branch-session-env"' "$SESSION_ROOT/current.json"; then
+  _pass "sidecar writer derives agent/<actor>/<slug> branch from an injected runtime session id into state.json, markdown, and current.json (AC2, AC7)"
+else
+  _fail "sidecar writer did not derive a consistent injected-session-id branch across state.json/markdown/current.json: $(cat "$TMPDIR_EVAL/branch-session-env.out" "$TMPDIR_EVAL/branch-session-env.err")"
+fi
+
+# AC3 (explicit override): --branch on a brand-new session records the value verbatim,
+# not a derived agent/<actor>/<slug> name.
+BRANCH_OVERRIDE_DIR="$SESSION_ROOT/branch-override-a"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SESSION_ROOT" \
+  --task-slug branch-override-a \
+  --branch "custom/my-branch" \
+  --source-request "An explicit --branch overrides derivation." \
+  --summary "A brand-new session with --branch should record the value verbatim." \
+  --timestamp "2026-05-09T00:03:05Z" >"$TMPDIR_EVAL/branch-override.out" 2>"$TMPDIR_EVAL/branch-override.err" \
+  && rg -q '"branch": "custom/my-branch"' "$BRANCH_OVERRIDE_DIR/state.json" \
+  && grep -Eq '^branch: custom/my-branch$' "$BRANCH_OVERRIDE_DIR/branch-override-a--deliver.md"; then
+  _pass "sidecar writer records an explicit --branch value verbatim, not a derived name (AC3)"
+else
+  _fail "sidecar writer did not honor an explicit --branch override: $(cat "$TMPDIR_EVAL/branch-override.out" "$TMPDIR_EVAL/branch-override.err")"
+fi
+
+# AC4 (distinct actors): two fresh sessions with distinct explicit --actor values produce
+# distinct branch values, differing only in the actor segment.
+BRANCH_DERIVE_A_DIR="$SESSION_ROOT/branch-derive-a"
+BRANCH_DERIVE_B_DIR="$SESSION_ROOT/branch-derive-b"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SESSION_ROOT" \
+  --task-slug branch-derive-a \
+  --actor test-actor-alpha \
+  --source-request "Derive a branch for actor alpha." \
+  --summary "Distinct actor alpha." \
+  --timestamp "2026-05-09T00:03:10Z" >"$TMPDIR_EVAL/branch-derive-a.out" 2>"$TMPDIR_EVAL/branch-derive-a.err" \
+  && flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SESSION_ROOT" \
+  --task-slug branch-derive-b \
+  --actor test-actor-beta \
+  --source-request "Derive a branch for actor beta." \
+  --summary "Distinct actor beta." \
+  --timestamp "2026-05-09T00:03:11Z" >"$TMPDIR_EVAL/branch-derive-b.out" 2>"$TMPDIR_EVAL/branch-derive-b.err" \
+  && rg -q '"branch": "agent/test-actor-alpha/branch-derive-a"' "$BRANCH_DERIVE_A_DIR/state.json" \
+  && rg -q '"branch": "agent/test-actor-beta/branch-derive-b"' "$BRANCH_DERIVE_B_DIR/state.json"; then
+  _pass "sidecar writer derives distinct branch values for distinct actors (AC4)"
+else
+  _fail "sidecar writer did not derive distinct branches for distinct actors: $(cat "$TMPDIR_EVAL/branch-derive-a.out" "$TMPDIR_EVAL/branch-derive-a.err" "$TMPDIR_EVAL/branch-derive-b.out" "$TMPDIR_EVAL/branch-derive-b.err")"
+fi
+
+# AC5 (existing-session continuity): re-running ensure-session against the SAME slug from a
+# DIFFERENT actor never re-derives or overwrites the already-recorded branch (ADR 0021 §5
+# takeover continuity — resume the incumbent's branch, never a parallel one).
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SESSION_ROOT" \
+  --task-slug branch-derive-a \
+  --actor test-actor-gamma \
+  --source-request "A takeover by a different actor must not refork the branch." \
+  --summary "Resuming actor gamma should inherit alpha's already-recorded branch." \
+  --timestamp "2026-05-09T00:03:12Z" >"$TMPDIR_EVAL/branch-no-rederive.out" 2>"$TMPDIR_EVAL/branch-no-rederive.err" \
+  && rg -q '"branch": "agent/test-actor-alpha/branch-derive-a"' "$BRANCH_DERIVE_A_DIR/state.json" \
+  && ! rg -q 'test-actor-gamma' "$BRANCH_DERIVE_A_DIR/state.json"; then
+  _pass "sidecar writer never re-derives an existing session's branch for a later actor (AC5, ADR 0021 §5)"
+else
+  _fail "sidecar writer re-derived or overwrote an existing session's branch on takeover: $(cat "$TMPDIR_EVAL/branch-no-rederive.out" "$TMPDIR_EVAL/branch-no-rederive.err")"
+fi
+
+# ─── #309: init-plan (and advance-state) must never drop an already-recorded branch ────
+# Regression cover for the full ensure-session -> init-plan -> advance-state lifecycle every
+# real session goes through. init-plan is invoked (per plan-work/SKILL.md) against the
+# PLAN artifact the tool-planner writes (e.g. "<slug>--plan-work.md"), a DIFFERENT file than
+# the session "<slug>--deliver.md" that carries the "branch:" line ensure-session seeded — that
+# plan artifact below deliberately carries NO "branch:" field, reproducing the exact shape of
+# the live kontourai-flow-agents-166 regression. state.json (and current.json's mirror) must
+# still carry the derived branch after init-plan, and again after a subsequent advance-state.
+BRANCH_SEQ_DIR="$SESSION_ROOT/branch-full-sequence"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SESSION_ROOT" \
+  --task-slug branch-full-sequence \
+  --actor seq-actor \
+  --source-request "Establish a session whose branch must survive init-plan and advance-state." \
+  --summary "Fresh session for the full ensure-session -> init-plan -> advance-state sequence." \
+  --timestamp "2026-07-01T00:04:20Z" >"$TMPDIR_EVAL/branch-seq-ensure.out" 2>"$TMPDIR_EVAL/branch-seq-ensure.err" \
+  && rg -q '"branch": "agent/seq-actor/branch-full-sequence"' "$BRANCH_SEQ_DIR/state.json"; then
+  _pass "sidecar writer (#309 setup) seeds branch-full-sequence with a derived branch via ensure-session"
+else
+  _fail "sidecar writer (#309 setup) failed to seed branch-full-sequence: $(cat "$TMPDIR_EVAL/branch-seq-ensure.out" "$TMPDIR_EVAL/branch-seq-ensure.err")"
+fi
+
+BRANCH_SEQ_PLAN_ARTIFACT="$BRANCH_SEQ_DIR/branch-full-sequence--plan-work.md"
+cat > "$BRANCH_SEQ_PLAN_ARTIFACT" <<'MARKDOWN'
+---
+role: plan
+parent: branch-full-sequence--deliver
+created: 2026-07-01
+---
+
+# Plan: #309 branch survival fixture
+
+## Plan
+
+A plan artifact deliberately carrying no `branch:` line (mirrors the real tool-planner output).
+
+## Definition Of Done
+
+- **Acceptance criteria:**
+  - [ ] init-plan preserves the already-recorded branch - Evidence: pending.
+MARKDOWN
+
+if flow_agents_node "$WRITER" init-plan "$BRANCH_SEQ_PLAN_ARTIFACT" \
+  --source-request "Plan artifact carries no branch: line." \
+  --summary "Planning sidecars initialized from a branch-less plan artifact." \
+  --next-action "Advance to execution." \
+  --timestamp "2026-07-01T00:04:21Z" >"$TMPDIR_EVAL/branch-seq-initplan.out" 2>"$TMPDIR_EVAL/branch-seq-initplan.err" \
+  && rg -q '"branch": "agent/seq-actor/branch-full-sequence"' "$BRANCH_SEQ_DIR/state.json"; then
+  _pass "sidecar writer (#309) preserves the already-recorded branch across init-plan even when the plan artifact carries no branch: line"
+else
+  _fail "sidecar writer (#309) DROPPED the branch on init-plan: $(cat "$TMPDIR_EVAL/branch-seq-initplan.out" "$TMPDIR_EVAL/branch-seq-initplan.err"); state.json=$(cat "$BRANCH_SEQ_DIR/state.json" 2>/dev/null)"
+fi
+
+if flow_agents_node "$WRITER" advance-state "$BRANCH_SEQ_DIR" \
+  --status in_progress \
+  --phase execution \
+  --summary "Execution started." \
+  --next-action "Run checks." \
+  --timestamp "2026-07-01T00:04:22Z" >"$TMPDIR_EVAL/branch-seq-advance.out" 2>"$TMPDIR_EVAL/branch-seq-advance.err" \
+  && rg -q '"branch": "agent/seq-actor/branch-full-sequence"' "$BRANCH_SEQ_DIR/state.json" \
+  && rg -q '"branch": "agent/seq-actor/branch-full-sequence"' "$SESSION_ROOT/current.json"; then
+  _pass "sidecar writer (#309) still carries the branch in state.json and its current.json mirror after advance-state"
+else
+  _fail "sidecar writer (#309) lost the branch by advance-state, or current.json mirror drifted: $(cat "$TMPDIR_EVAL/branch-seq-advance.out" "$TMPDIR_EVAL/branch-seq-advance.err"); state.json=$(cat "$BRANCH_SEQ_DIR/state.json" 2>/dev/null)"
+fi
+
+# #309 backfill repro: an ALREADY-BROKEN pre-fix session (state.json has no branch key at all,
+# matching kontourai-flow-agents-166/-290) can be repaired by re-running init-plan against the
+# SAME branch-less plan artifact that dropped the branch in the first place -- WITHOUT any direct
+# file edit -- because initSidecars falls back to reading the session's own canonical
+# "<slug>--deliver.md" from disk when neither the existing state.json nor the passed-in markdown
+# carries a branch.
+BRANCH_BACKFILL_DIR="$SESSION_ROOT/branch-backfill-repro"
+mkdir -p "$BRANCH_BACKFILL_DIR"
+cat > "$BRANCH_BACKFILL_DIR/branch-backfill-repro--deliver.md" <<'MARKDOWN'
+# branch-backfill-repro
+
+branch: agent/seq-actor/branch-backfill-repro
+worktree: main
+created: 2026-07-01T00:04:23Z
+status: planning
+type: deliver
+iteration: 1
+
+## Plan
+
+Pre-fix victim fixture: state.json below was written WITHOUT a branch key (simulating #309).
+MARKDOWN
+cat > "$BRANCH_BACKFILL_DIR/state.json" <<'JSON'
+{
+  "schema_version": "1.0",
+  "task_slug": "branch-backfill-repro",
+  "repo": "kontourai/flow-agents",
+  "status": "planned",
+  "phase": "planning",
+  "created_at": "2026-07-01T00:04:23Z",
+  "updated_at": "2026-07-01T00:04:23Z",
+  "artifact_paths": ["state.json"],
+  "next_action": { "status": "continue", "summary": "pre-fix victim fixture" }
+}
+JSON
+BRANCH_BACKFILL_PLAN_ARTIFACT="$BRANCH_BACKFILL_DIR/branch-backfill-repro--plan-work.md"
+cat > "$BRANCH_BACKFILL_PLAN_ARTIFACT" <<'MARKDOWN'
+---
+role: plan
+parent: branch-backfill-repro--deliver
+created: 2026-07-01
+---
+
+# Plan: #309 backfill repro fixture
+
+## Definition Of Done
+
+- **Acceptance criteria:**
+  - [ ] backfill repairs the dropped branch - Evidence: pending.
+MARKDOWN
+
+if flow_agents_node "$WRITER" init-plan "$BRANCH_BACKFILL_PLAN_ARTIFACT" \
+  --source-request "Re-run init-plan against the same branch-less plan artifact to backfill." \
+  --summary "Backfill re-run." \
+  --next-action "n/a" \
+  --timestamp "2026-07-01T00:04:23Z" >"$TMPDIR_EVAL/branch-backfill.out" 2>"$TMPDIR_EVAL/branch-backfill.err" \
+  && rg -q '"branch": "agent/seq-actor/branch-backfill-repro"' "$BRANCH_BACKFILL_DIR/state.json"; then
+  _pass "sidecar writer (#309) backfills a pre-fix-broken session's branch via a sanctioned init-plan re-run (no direct file edit)"
+else
+  _fail "sidecar writer (#309) failed to backfill an already-broken session's branch: $(cat "$TMPDIR_EVAL/branch-backfill.out" "$TMPDIR_EVAL/branch-backfill.err"); state.json=$(cat "$BRANCH_BACKFILL_DIR/state.json" 2>/dev/null)"
+fi
+
+# Actor charset guard: an explicit --actor value that strips to empty under the allowed
+# charset dies before any session artifact is written (mirrors the liveness write path's
+# existing F7 test coverage).
+BRANCH_BAD_ACTOR_DIR="$SESSION_ROOT/branch-bad-actor"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SESSION_ROOT" \
+  --task-slug branch-bad-actor \
+  --actor ":::" \
+  --source-request "Garbage --actor should die." \
+  --summary "Should not create a session." \
+  --timestamp "2026-05-09T00:03:13Z" >"$TMPDIR_EVAL/branch-bad-actor.out" 2>"$TMPDIR_EVAL/branch-bad-actor.err"; then
+  _fail "sidecar writer should reject a --actor value that strips to empty under the allowed charset"
+elif rg -q -- '--actor value strips to empty' "$TMPDIR_EVAL/branch-bad-actor.out" "$TMPDIR_EVAL/branch-bad-actor.err" \
+  && [[ ! -f "$BRANCH_BAD_ACTOR_DIR/state.json" ]]; then
+  _pass "sidecar writer dies on a garbage --actor value before writing any session artifact"
+else
+  _fail "garbage --actor rejection was not fail-closed or lacked diagnostics: $(cat "$TMPDIR_EVAL/branch-bad-actor.out" "$TMPDIR_EVAL/branch-bad-actor.err")"
+fi
+
+# ─── #289 fix-plan iteration 1 (F1/F2/F4) ──────────────────────────────────────
+# F1: a trailing-dot slug (git-check-ref-format forbids a ref component ending in ".") derives a
+# branch that is a REAL, valid git ref — asserted against the actual `git check-ref-format`
+# binary, not a hand-rolled regex re-implementation of its rules.
+BRANCH_TRAILING_DOT_DIR="$SESSION_ROOT/branch-trailing-dot"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SESSION_ROOT" \
+  --task-slug branch-trailing-dot \
+  --actor "my-fix." \
+  --source-request "A trailing-dot actor segment must not leave an illegal git ref." \
+  --summary "Trailing dot should be stripped, not left dangling." \
+  --timestamp "2026-07-01T00:04:00Z" >"$TMPDIR_EVAL/branch-trailing-dot.out" 2>"$TMPDIR_EVAL/branch-trailing-dot.err"; then
+  TRAILING_DOT_BRANCH="$(jq -r '.branch // empty' "$BRANCH_TRAILING_DOT_DIR/state.json" 2>/dev/null)"
+  if [[ -n "$TRAILING_DOT_BRANCH" ]] && [[ "$TRAILING_DOT_BRANCH" != *"." ]] && git check-ref-format --branch "$TRAILING_DOT_BRANCH" >/dev/null 2>&1; then
+    _pass "sidecar writer strips a trailing dot from a derived branch segment and the result passes the real git check-ref-format binary (F1)"
+  else
+    _fail "sidecar writer derived a branch that git check-ref-format rejects (F1): branch=$TRAILING_DOT_BRANCH"
+  fi
+else
+  _fail "sidecar writer ensure-session failed for trailing-dot actor fixture: $(cat "$TMPDIR_EVAL/branch-trailing-dot.out" "$TMPDIR_EVAL/branch-trailing-dot.err")"
+fi
+
+# F2: an explicit --branch is strictly validated, not trusted verbatim. Each hostile value below
+# must die BEFORE any session artifact is written (no state.json / no session Markdown), with a
+# diagnostic naming the actual problem.
+assert_hostile_branch_dies() {
+  local label="$1" branch_value="$2" slug="$3" expect_pattern="$4"
+  local dir="$SESSION_ROOT/$slug"
+  local out="$TMPDIR_EVAL/hostile-branch-$slug.out"
+  if flow_agents_node "$WRITER" ensure-session \
+    --artifact-root "$SESSION_ROOT" \
+    --task-slug "$slug" \
+    --branch "$branch_value" \
+    --source-request "Hostile --branch should die before mutation." \
+    --summary "Should not create a session." \
+    --timestamp "2026-07-01T00:04:10Z" >"$out" 2>&1; then
+    _fail "sidecar writer should reject a hostile --branch value ($label)"
+  elif rg -q -- "$expect_pattern" "$out" && [[ ! -f "$dir/state.json" ]]; then
+    _pass "sidecar writer dies on a hostile --branch value before writing any session artifact ($label, F2)"
+  else
+    _fail "hostile --branch rejection ($label) was not fail-closed or lacked diagnostics: $(cat "$out")"
+  fi
+}
+assert_hostile_branch_dies "embedded newline" "$(printf 'main\nbad')" "branch-hostile-newline" "control character or newline"
+assert_hostile_branch_dies '".." sequence' "foo..bar" "branch-hostile-dotdot" 'must not contain a "\.\." sequence'
+assert_hostile_branch_dies "trailing .lock" "foo.lock" "branch-hostile-lock" '"\.lock"'
+assert_hostile_branch_dies "embedded space" "foo bar" "branch-hostile-space" "contains a space"
+
+# F4: two distinct all-garbage --task-slug values (each collapsing sanitizeBranchSegment's
+# charset filter to empty) must derive DISTINCT branches, not silently collide on the bare
+# literal "unknown". Actor is held fixed and valid so the slug segment is the only variable.
+BRANCH_GARBAGE_A_DIR="$SESSION_ROOT/???"
+BRANCH_GARBAGE_B_DIR="$SESSION_ROOT/!!!"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SESSION_ROOT" \
+  --task-slug '???' \
+  --actor test-actor-fix4 \
+  --source-request "All-garbage slug A." \
+  --summary "Garbage slug A." \
+  --timestamp "2026-07-01T00:04:20Z" >"$TMPDIR_EVAL/branch-garbage-a.out" 2>"$TMPDIR_EVAL/branch-garbage-a.err" \
+  && flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SESSION_ROOT" \
+  --task-slug '!!!' \
+  --actor test-actor-fix4 \
+  --source-request "All-garbage slug B." \
+  --summary "Garbage slug B." \
+  --timestamp "2026-07-01T00:04:21Z" >"$TMPDIR_EVAL/branch-garbage-b.out" 2>"$TMPDIR_EVAL/branch-garbage-b.err"; then
+  GARBAGE_A_BRANCH="$(jq -r '.branch // empty' "$BRANCH_GARBAGE_A_DIR/state.json" 2>/dev/null)"
+  GARBAGE_B_BRANCH="$(jq -r '.branch // empty' "$BRANCH_GARBAGE_B_DIR/state.json" 2>/dev/null)"
+  if [[ -n "$GARBAGE_A_BRANCH" ]] && [[ -n "$GARBAGE_B_BRANCH" ]] \
+    && [[ "$GARBAGE_A_BRANCH" != "$GARBAGE_B_BRANCH" ]] \
+    && [[ "$GARBAGE_A_BRANCH" == agent/test-actor-fix4/unknown-* ]] \
+    && [[ "$GARBAGE_B_BRANCH" == agent/test-actor-fix4/unknown-* ]] \
+    && git check-ref-format --branch "$GARBAGE_A_BRANCH" >/dev/null 2>&1 \
+    && git check-ref-format --branch "$GARBAGE_B_BRANCH" >/dev/null 2>&1; then
+    _pass "sidecar writer derives distinct disambiguated branches for two all-garbage task slugs (F4): $GARBAGE_A_BRANCH vs $GARBAGE_B_BRANCH"
+  else
+    _fail "sidecar writer did not disambiguate two all-garbage task slugs (F4): a=$GARBAGE_A_BRANCH b=$GARBAGE_B_BRANCH"
+  fi
+else
+  _fail "sidecar writer ensure-session failed for all-garbage slug fixtures: $(cat "$TMPDIR_EVAL/branch-garbage-a.out" "$TMPDIR_EVAL/branch-garbage-a.err" "$TMPDIR_EVAL/branch-garbage-b.out" "$TMPDIR_EVAL/branch-garbage-b.err")"
+fi
+
+# ─── #289 fix-plan iteration 2 (F2'/F4' residuals from code-review-289-iteration-1) ─────────────
+# F2': the whole-string checks above (iteration 1) only look at the START/END of the full
+# --branch value, so a fuzz of charset-valid values found hostile /-delimited PATH COMPONENTS
+# that slip past them. Each of these four escape classes must still die pre-mutation.
+assert_hostile_branch_dies "leading '-' (path component)" "-lead" "branch-hostile-lead" 'starting with "-"'
+assert_hostile_branch_dies "non-first component starting with '.'" "a/.b" "branch-hostile-dotcomp" 'starting with "\."'
+assert_hostile_branch_dies "non-last component ending in .lock" "foo.lock/bar" "branch-hostile-lockcomp" '"\.lock"'
+assert_hostile_branch_dies "component that is exactly '.'" "a/./b" "branch-hostile-dotonly" '"\."'
+
+# F2' belt-and-braces: every --branch value validateExplicitBranch ACCEPTS must also pass the
+# real `git check-ref-format --branch` binary — not just this repo's earlier fixtures
+# ("custom/my-branch", AC3 above), but a representative additional accepted value with a nested
+# path and mixed charset.
+BRANCH_ACCEPTED_GIT_DIR="$SESSION_ROOT/branch-accepted-git-valid"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SESSION_ROOT" \
+  --task-slug branch-accepted-git-valid \
+  --branch "release/2026.07_hotfix-1" \
+  --source-request "An accepted --branch value must also be a real, git-valid ref." \
+  --summary "Accepted --branch values are double-checked against the real git binary." \
+  --timestamp "2026-07-02T00:04:30Z" >"$TMPDIR_EVAL/branch-accepted-git.out" 2>"$TMPDIR_EVAL/branch-accepted-git.err"; then
+  ACCEPTED_GIT_BRANCH="$(jq -r '.branch // empty' "$BRANCH_ACCEPTED_GIT_DIR/state.json" 2>/dev/null)"
+  if [[ "$ACCEPTED_GIT_BRANCH" == "release/2026.07_hotfix-1" ]] && git check-ref-format --branch "$ACCEPTED_GIT_BRANCH" >/dev/null 2>&1; then
+    _pass "sidecar writer's accepted --branch value passes the real git check-ref-format binary (F2')"
+  else
+    _fail "sidecar writer accepted a --branch value that the real git binary rejects (F2'): branch=$ACCEPTED_GIT_BRANCH"
+  fi
+else
+  _fail "sidecar writer ensure-session failed for the accepted git-valid --branch fixture: $(cat "$TMPDIR_EVAL/branch-accepted-git.out" "$TMPDIR_EVAL/branch-accepted-git.err")"
+fi
+
+# F4': the FINAL sanitized segment equaling the literal fallback token "unknown" must ALWAYS be
+# disambiguated with the 6-hex sha256 suffix - including a literal --actor "unknown" (no
+# literal-input carve-out), and including near-miss inputs ("unknown.", ".unknown") that only
+# collapse to the literal "unknown" via this function's OWN leading/trailing-dot stripping.
+# All three must derive DISTINCT branches (distinct raw input -> distinct hash) despite sharing
+# the same effective actor "meaning".
+BRANCH_UNKNOWN_LITERAL_DIR="$SESSION_ROOT/branch-unknown-literal"
+BRANCH_UNKNOWN_TRAILING_DIR="$SESSION_ROOT/branch-unknown-trailing-dot"
+BRANCH_UNKNOWN_LEADING_DIR="$SESSION_ROOT/branch-unknown-leading-dot"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SESSION_ROOT" \
+  --task-slug branch-unknown-literal \
+  --actor "unknown" \
+  --source-request "Literal --actor unknown must still be disambiguated." \
+  --summary "No literal-input carve-out." \
+  --timestamp "2026-07-02T00:04:40Z" >"$TMPDIR_EVAL/branch-unknown-literal.out" 2>"$TMPDIR_EVAL/branch-unknown-literal.err" \
+  && flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SESSION_ROOT" \
+  --task-slug branch-unknown-trailing-dot \
+  --actor "unknown." \
+  --source-request "Trailing-dot actor collapsing to literal unknown must still be disambiguated." \
+  --summary "Near-miss trailing dot." \
+  --timestamp "2026-07-02T00:04:41Z" >"$TMPDIR_EVAL/branch-unknown-trailing-dot.out" 2>"$TMPDIR_EVAL/branch-unknown-trailing-dot.err" \
+  && flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SESSION_ROOT" \
+  --task-slug branch-unknown-leading-dot \
+  --actor ".unknown" \
+  --source-request "Leading-dot actor collapsing to literal unknown must still be disambiguated." \
+  --summary "Near-miss leading dot." \
+  --timestamp "2026-07-02T00:04:42Z" >"$TMPDIR_EVAL/branch-unknown-leading-dot.out" 2>"$TMPDIR_EVAL/branch-unknown-leading-dot.err"; then
+  UNKNOWN_LITERAL_BRANCH="$(jq -r '.branch // empty' "$BRANCH_UNKNOWN_LITERAL_DIR/state.json" 2>/dev/null)"
+  UNKNOWN_TRAILING_BRANCH="$(jq -r '.branch // empty' "$BRANCH_UNKNOWN_TRAILING_DIR/state.json" 2>/dev/null)"
+  UNKNOWN_LEADING_BRANCH="$(jq -r '.branch // empty' "$BRANCH_UNKNOWN_LEADING_DIR/state.json" 2>/dev/null)"
+  if [[ "$UNKNOWN_LITERAL_BRANCH" == agent/unknown-*/branch-unknown-literal ]] \
+    && [[ "$UNKNOWN_TRAILING_BRANCH" == agent/unknown-*/branch-unknown-trailing-dot ]] \
+    && [[ "$UNKNOWN_LEADING_BRANCH" == agent/unknown-*/branch-unknown-leading-dot ]] \
+    && [[ "${UNKNOWN_LITERAL_BRANCH#agent/}" != "${UNKNOWN_TRAILING_BRANCH#agent/}" ]] \
+    && [[ "${UNKNOWN_LITERAL_BRANCH#agent/}" != "${UNKNOWN_LEADING_BRANCH#agent/}" ]] \
+    && [[ "${UNKNOWN_TRAILING_BRANCH#agent/}" != "${UNKNOWN_LEADING_BRANCH#agent/}" ]] \
+    && git check-ref-format --branch "$UNKNOWN_LITERAL_BRANCH" >/dev/null 2>&1 \
+    && git check-ref-format --branch "$UNKNOWN_TRAILING_BRANCH" >/dev/null 2>&1 \
+    && git check-ref-format --branch "$UNKNOWN_LEADING_BRANCH" >/dev/null 2>&1; then
+    _pass "sidecar writer derives three DISTINCT disambiguated branches for actors 'unknown', 'unknown.', '.unknown' (F4'): $UNKNOWN_LITERAL_BRANCH vs $UNKNOWN_TRAILING_BRANCH vs $UNKNOWN_LEADING_BRANCH"
+  else
+    _fail "sidecar writer did not disambiguate all three unknown-collapsing actor variants distinctly (F4'): literal=$UNKNOWN_LITERAL_BRANCH trailing=$UNKNOWN_TRAILING_BRANCH leading=$UNKNOWN_LEADING_BRANCH"
+  fi
+else
+  _fail "sidecar writer ensure-session failed for one of the unknown-collapsing actor fixtures: $(cat "$TMPDIR_EVAL/branch-unknown-literal.out" "$TMPDIR_EVAL/branch-unknown-literal.err" "$TMPDIR_EVAL/branch-unknown-trailing-dot.out" "$TMPDIR_EVAL/branch-unknown-trailing-dot.err" "$TMPDIR_EVAL/branch-unknown-leading-dot.out" "$TMPDIR_EVAL/branch-unknown-leading-dot.err")"
+fi
+
 printf 'DO NOT OVERWRITE\n' >> "$ENSURED_DIR/ensured-session--deliver.md"
 if flow_agents_node "$WRITER" ensure-session \
   --artifact-root "$SESSION_ROOT" \
@@ -522,7 +950,46 @@ else
   _fail "sidecar writer did not update state or bundle from evidence"
 fi
 
-INVALID_REF_DIR="$TMPDIR_EVAL/repo/.flow-agents/invalid-evidence-ref"
+# ─── WS8 (ADR 0020) AC1: producer evidence classification ─────────────────────
+# buildTrustBundle derives evidence.evidenceType/method from check.kind instead of
+# hardcoding test_output, and always stamps execution.label on command-backed checks.
+CLASSIFY_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/evidence-classification"
+mkdir -p "$CLASSIFY_DIR"
+cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$CLASSIFY_DIR/evidence-classification--deliver.md"
+flow_agents_node "$WRITER" init-plan "$CLASSIFY_DIR/evidence-classification--deliver.md" \
+  --source-request "Classify evidence by kind." \
+  --summary "Evidence classification fixture." \
+  --next-action "Record mixed-kind evidence." \
+  --timestamp "2026-05-09T00:01:00Z" >"$TMPDIR_EVAL/classify-init.out" 2>"$TMPDIR_EVAL/classify-init.err"
+
+if flow_agents_node "$WRITER" record-evidence "$CLASSIFY_DIR" \
+  --verdict pass \
+  --check-json '{"id":"unit-tests","kind":"test","status":"pass","summary":"Unit tests passed.","command":"npm test"}' \
+  --check-json '{"id":"dashboard-ui","kind":"browser","status":"pass","summary":"Visual check of dashboard."}' \
+  --timestamp "2026-05-09T00:01:05Z" >"$TMPDIR_EVAL/classify.out" 2>"$TMPDIR_EVAL/classify.err"; then
+  if node - "$CLASSIFY_DIR/trust.bundle" << 'NODE' 2>/dev/null
+const fs = require("fs");
+const b = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+const ev = b.evidence || [];
+const testEv = ev.find((e) => /unit-tests/.test(String(e.claimId)) || /Unit tests/.test(String(e.excerptOrSummary)));
+const browserEv = ev.find((e) => /dashboard-ui/.test(String(e.claimId)) || /dashboard/.test(String(e.excerptOrSummary)));
+if (!testEv) throw new Error("no test-kind evidence item");
+if (!browserEv) throw new Error("no browser-kind evidence item");
+if (testEv.evidenceType !== "test_output") throw new Error("test-kind evidenceType expected test_output, got " + testEv.evidenceType);
+if (!testEv.execution || testEv.execution.label !== "npm test") throw new Error("test-kind must stamp execution.label 'npm test', got " + JSON.stringify(testEv.execution));
+if (browserEv.evidenceType === "test_output") throw new Error("browser-kind evidenceType must NOT be test_output (got test_output)");
+if (browserEv.evidenceType !== "crawl_observation") throw new Error("browser-kind evidenceType expected crawl_observation, got " + browserEv.evidenceType);
+NODE
+  then
+    _pass "AC1: producer classifies test-kind as test_output+label and browser-kind as crawl_observation"
+  else
+    _fail "AC1: evidence classification incorrect: $(cat "$TMPDIR_EVAL/classify.out" "$TMPDIR_EVAL/classify.err")"
+  fi
+else
+  _fail "AC1: record-evidence for classification fixture failed: $(cat "$TMPDIR_EVAL/classify.out" "$TMPDIR_EVAL/classify.err")"
+fi
+
+INVALID_REF_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/invalid-evidence-ref"
 mkdir -p "$INVALID_REF_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$INVALID_REF_DIR/invalid-evidence-ref--deliver.md"
 flow_agents_node "$WRITER" init-plan "$INVALID_REF_DIR/invalid-evidence-ref--deliver.md" \
@@ -557,7 +1024,7 @@ else
   _fail "incomplete structured artifact_refs rejection was not fail-closed: $(cat "$TMPDIR_EVAL/incomplete-ref.out" "$TMPDIR_EVAL/incomplete-ref.err")"
 fi
 
-INVALID_ACCEPTANCE_REF_DIR="$TMPDIR_EVAL/repo/.flow-agents/invalid-acceptance-ref"
+INVALID_ACCEPTANCE_REF_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/invalid-acceptance-ref"
 mkdir -p "$INVALID_ACCEPTANCE_REF_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$INVALID_ACCEPTANCE_REF_DIR/invalid-acceptance-ref--deliver.md"
 flow_agents_node "$WRITER" init-plan "$INVALID_ACCEPTANCE_REF_DIR/invalid-acceptance-ref--deliver.md" \
@@ -630,7 +1097,7 @@ check_surface_fixture() {
   local verdict="$3"
   local expected_status="$4"
   local expected_text="$5"
-  local dir="$TMPDIR_EVAL/repo/.flow-agents/surface-$name"
+  local dir="$TMPDIR_EVAL/repo/.kontourai/flow-agents/surface-$name"
   mkdir -p "$dir"
   # Phase 4c: evidence.json no longer written; verify surface trust check status in trust.bundle.
   if flow_agents_node "$WRITER" record-evidence "$dir" \
@@ -657,7 +1124,7 @@ check_surface_fixture "integrity-mismatch" "integrity-mismatch-trust-report.json
 check_surface_fixture "provider-absent" "provider-absent.json" "not_verified" "not_verified" "No trust provider is configured"
 check_surface_fixture "artifact-absent" "artifact-absent.json" "not_verified" "not_verified" "not readable"
 
-PURE_SURFACE_DIR="$TMPDIR_EVAL/repo/.flow-agents/surface-trust-only"
+PURE_SURFACE_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/surface-trust-only"
 mkdir -p "$PURE_SURFACE_DIR"
 # Phase 4c: evidence.json no longer written; verify in trust.bundle.
 if flow_agents_node "$WRITER" record-evidence "$PURE_SURFACE_DIR" \
@@ -737,7 +1204,7 @@ else
   _fail "terminal jump rejection lacked diagnostics or mutated authoritative sidecars"
 fi
 
-BUILDER_TRANSITION_DIR="$TMPDIR_EVAL/repo/.flow-agents/builder-transition-guard"
+BUILDER_TRANSITION_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/builder-transition-guard"
 mkdir -p "$BUILDER_TRANSITION_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$BUILDER_TRANSITION_DIR/builder-transition-guard--deliver.md"
 flow_agents_node "$WRITER" init-plan "$BUILDER_TRANSITION_DIR/builder-transition-guard--deliver.md" \
@@ -835,7 +1302,7 @@ else
   _fail "Builder Kit max-attempt route-back behavior was not deterministic"
 fi
 
-LEGACY_TRANSITION_DIR="$TMPDIR_EVAL/repo/.flow-agents/legacy-transition-guard"
+LEGACY_TRANSITION_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/legacy-transition-guard"
 mkdir -p "$LEGACY_TRANSITION_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$LEGACY_TRANSITION_DIR/legacy-transition-guard--deliver.md"
 flow_agents_node "$WRITER" init-plan "$LEGACY_TRANSITION_DIR/legacy-transition-guard--deliver.md" \
@@ -864,7 +1331,7 @@ else
   _fail "legacy-compatible direct primitive route-back failed: $(cat "$TMPDIR_EVAL/legacy-route-back.out" "$TMPDIR_EVAL/legacy-route-back.err")"
 fi
 
-NV_DIR="$TMPDIR_EVAL/repo/.flow-agents/not-verified-sidecars"
+NV_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/not-verified-sidecars"
 mkdir -p "$NV_DIR"
 cat > "$NV_DIR/not-verified-sidecars--deliver.md" <<'MARKDOWN'
 # Route not verified evidence
@@ -937,7 +1404,7 @@ else
   _fail "sidecar writer did not preserve not-verified state"
 fi
 
-NEW_INVALID_DIR="$TMPDIR_EVAL/repo/.flow-agents/new-invalid-artifact"
+NEW_INVALID_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/new-invalid-artifact"
 if flow_agents_node "$WRITER" record-evidence "$NEW_INVALID_DIR" \
   --verdict banana \
   --check-json '{"id":"invalid-new","kind":"test","status":"pass","summary":"Should fail."}' >"$TMPDIR_EVAL/new-invalid.out" 2>&1; then
@@ -948,10 +1415,10 @@ else
   _fail "sidecar writer left lock file for invalid new artifact command"
 fi
 
-LOCK_DENIED_DIR="$TMPDIR_EVAL/repo/.flow-agents/lock-denied"
+LOCK_DENIED_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/lock-denied"
 mkdir -p "$LOCK_DENIED_DIR"
 if chmod 500 "$LOCK_DENIED_DIR" 2>"$TMPDIR_EVAL/lock-denied-chmod.err"; then
-  if run_bounded 5 flow_agents_node "$WRITER" record-critique "$LOCK_DENIED_DIR" \
+  if run_bounded 20 flow_agents_node "$WRITER" record-critique "$LOCK_DENIED_DIR" \
     --id lock-denied-review \
     --reviewer tool-code-reviewer \
     --verdict pass \
@@ -992,7 +1459,7 @@ else
   _fail "sidecar writer critique failed: $(cat "$TMPDIR_EVAL/critique.out" "$TMPDIR_EVAL/critique.err")"
 fi
 
-CONCURRENT_DIR="$TMPDIR_EVAL/repo/.flow-agents/concurrent-critiques"
+CONCURRENT_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/concurrent-critiques"
 mkdir -p "$CONCURRENT_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$CONCURRENT_DIR/concurrent-critiques--deliver.md"
 flow_agents_node "$WRITER" init-plan "$CONCURRENT_DIR/concurrent-critiques--deliver.md" \
@@ -1056,7 +1523,7 @@ else
   _fail "sidecar writer did not update release state"
 fi
 
-NO_SUMMARY_RELEASE_DIR="$TMPDIR_EVAL/repo/.flow-agents/no-summary-release"
+NO_SUMMARY_RELEASE_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/no-summary-release"
 mkdir -p "$NO_SUMMARY_RELEASE_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$NO_SUMMARY_RELEASE_DIR/no-summary-release--deliver.md"
 flow_agents_node "$WRITER" init-plan "$NO_SUMMARY_RELEASE_DIR/no-summary-release--deliver.md" \
@@ -1110,7 +1577,7 @@ else
   _fail "no-correction learning closeout failed validation: $(cat "$TMPDIR_EVAL/learning-valid.out" "$TMPDIR_EVAL/learning-valid.err")"
 fi
 
-CORRECTION_DIR="$TMPDIR_EVAL/repo/.flow-agents/correction-needed-learning"
+CORRECTION_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/correction-needed-learning"
 mkdir -p "$CORRECTION_DIR"
 if flow_agents_node "$WRITER" record-learning "$CORRECTION_DIR" \
   --task-slug correction-needed-learning \
@@ -1124,7 +1591,7 @@ else
   _fail "correction-needed learning closeout failed: $(cat "$TMPDIR_EVAL/correction-needed-learning.out" "$TMPDIR_EVAL/correction-needed-learning.err" "$TMPDIR_EVAL/correction-needed-valid.out" "$TMPDIR_EVAL/correction-needed-valid.err")"
 fi
 
-DOGFOOD_DIR="$TMPDIR_EVAL/repo/.flow-agents/dogfood-pass"
+DOGFOOD_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/dogfood-pass"
 mkdir -p "$DOGFOOD_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$DOGFOOD_DIR/dogfood-pass--deliver.md"
 flow_agents_node "$WRITER" init-plan "$DOGFOOD_DIR/dogfood-pass--deliver.md" \
@@ -1145,7 +1612,7 @@ else
   _fail "dogfood-pass missing actionable no-evidence error"
 fi
 
-DIRTY_EVIDENCE_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.flow-agents/dogfood-dirty-evidence"
+DIRTY_EVIDENCE_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/dogfood-dirty-evidence"
 mkdir -p "$DIRTY_EVIDENCE_DOGFOOD_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$DIRTY_EVIDENCE_DOGFOOD_DIR/dogfood-dirty-evidence--deliver.md"
 flow_agents_node "$WRITER" init-plan "$DIRTY_EVIDENCE_DOGFOOD_DIR/dogfood-dirty-evidence--deliver.md" \
@@ -1191,7 +1658,7 @@ else
   _fail "dogfood-pass existing dirty evidence was not fail-closed"
 fi
 
-INVALID_EXISTING_EVIDENCE_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.flow-agents/dogfood-existing-invalid-evidence"
+INVALID_EXISTING_EVIDENCE_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/dogfood-existing-invalid-evidence"
 mkdir -p "$INVALID_EXISTING_EVIDENCE_DOGFOOD_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$INVALID_EXISTING_EVIDENCE_DOGFOOD_DIR/dogfood-existing-invalid-evidence--deliver.md"
 flow_agents_node "$WRITER" init-plan "$INVALID_EXISTING_EVIDENCE_DOGFOOD_DIR/dogfood-existing-invalid-evidence--deliver.md" \
@@ -1265,7 +1732,7 @@ else
   _fail "dogfood-pass not_verified clean-pass check was not fail-closed"
 fi
 
-INVALID_EVIDENCE_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.flow-agents/dogfood-invalid-evidence"
+INVALID_EVIDENCE_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/dogfood-invalid-evidence"
 mkdir -p "$INVALID_EVIDENCE_DOGFOOD_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$INVALID_EVIDENCE_DOGFOOD_DIR/dogfood-invalid-evidence--deliver.md"
 flow_agents_node "$WRITER" init-plan "$INVALID_EVIDENCE_DOGFOOD_DIR/dogfood-invalid-evidence--deliver.md" \
@@ -1292,7 +1759,7 @@ else
   _fail "dogfood-pass invalid evidence metadata was not fail-closed"
 fi
 
-INVALID_LEARNING_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.flow-agents/dogfood-invalid-learning"
+INVALID_LEARNING_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/dogfood-invalid-learning"
 mkdir -p "$INVALID_LEARNING_DOGFOOD_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$INVALID_LEARNING_DOGFOOD_DIR/dogfood-invalid-learning--deliver.md"
 flow_agents_node "$WRITER" init-plan "$INVALID_LEARNING_DOGFOOD_DIR/dogfood-invalid-learning--deliver.md" \
@@ -1318,7 +1785,7 @@ else
   _fail "dogfood-pass invalid learning was not fail-closed"
 fi
 
-INVALID_LEARNING_SHAPE_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.flow-agents/dogfood-invalid-learning-shape"
+INVALID_LEARNING_SHAPE_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/dogfood-invalid-learning-shape"
 mkdir -p "$INVALID_LEARNING_SHAPE_DOGFOOD_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$INVALID_LEARNING_SHAPE_DOGFOOD_DIR/dogfood-invalid-learning-shape--deliver.md"
 flow_agents_node "$WRITER" init-plan "$INVALID_LEARNING_SHAPE_DOGFOOD_DIR/dogfood-invalid-learning-shape--deliver.md" \
@@ -1344,7 +1811,7 @@ else
   _fail "dogfood-pass invalid learning shape was not fail-closed"
 fi
 
-EXISTING_INVALID_LEARNING_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.flow-agents/dogfood-existing-invalid-learning"
+EXISTING_INVALID_LEARNING_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/dogfood-existing-invalid-learning"
 mkdir -p "$EXISTING_INVALID_LEARNING_DOGFOOD_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$EXISTING_INVALID_LEARNING_DOGFOOD_DIR/dogfood-existing-invalid-learning--deliver.md"
 flow_agents_node "$WRITER" init-plan "$EXISTING_INVALID_LEARNING_DOGFOOD_DIR/dogfood-existing-invalid-learning--deliver.md" \
@@ -1397,7 +1864,7 @@ else
   _fail "dogfood-pass existing invalid learning was not fail-closed"
 fi
 
-EXISTING_LEARNED_NO_CORRECTION_DIR="$TMPDIR_EVAL/repo/.flow-agents/dogfood-learned-no-correction"
+EXISTING_LEARNED_NO_CORRECTION_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/dogfood-learned-no-correction"
 mkdir -p "$EXISTING_LEARNED_NO_CORRECTION_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$EXISTING_LEARNED_NO_CORRECTION_DIR/dogfood-learned-no-correction--deliver.md"
 flow_agents_node "$WRITER" init-plan "$EXISTING_LEARNED_NO_CORRECTION_DIR/dogfood-learned-no-correction--deliver.md" \
@@ -1452,7 +1919,7 @@ else
   _fail "dogfood-pass existing learned learning missing correction was not fail-closed"
 fi
 
-INVALID_CRITIQUE_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.flow-agents/dogfood-invalid-critique"
+INVALID_CRITIQUE_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/dogfood-invalid-critique"
 mkdir -p "$INVALID_CRITIQUE_DOGFOOD_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$INVALID_CRITIQUE_DOGFOOD_DIR/dogfood-invalid-critique--deliver.md"
 flow_agents_node "$WRITER" init-plan "$INVALID_CRITIQUE_DOGFOOD_DIR/dogfood-invalid-critique--deliver.md" \
@@ -1484,7 +1951,7 @@ else
   _fail "dogfood-pass invalid critique metadata was not fail-closed"
 fi
 
-EXISTING_INVALID_CRITIQUE_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.flow-agents/dogfood-existing-invalid-critique"
+EXISTING_INVALID_CRITIQUE_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/dogfood-existing-invalid-critique"
 mkdir -p "$EXISTING_INVALID_CRITIQUE_DOGFOOD_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$EXISTING_INVALID_CRITIQUE_DOGFOOD_DIR/dogfood-existing-invalid-critique--deliver.md"
 flow_agents_node "$WRITER" init-plan "$EXISTING_INVALID_CRITIQUE_DOGFOOD_DIR/dogfood-existing-invalid-critique--deliver.md" \
@@ -1650,7 +2117,7 @@ else
   _fail "dogfood-pass failing critique was not fail-closed"
 fi
 
-DIRTY_CRITIQUE_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.flow-agents/dogfood-dirty-critique"
+DIRTY_CRITIQUE_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/dogfood-dirty-critique"
 mkdir -p "$DIRTY_CRITIQUE_DOGFOOD_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$DIRTY_CRITIQUE_DOGFOOD_DIR/dogfood-dirty-critique--deliver.md"
 flow_agents_node "$WRITER" init-plan "$DIRTY_CRITIQUE_DOGFOOD_DIR/dogfood-dirty-critique--deliver.md" \
@@ -1701,7 +2168,7 @@ else
   _fail "dogfood-pass existing dirty critique was not fail-closed"
 fi
 
-FAILED_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.flow-agents/dogfood-failed-pass"
+FAILED_DOGFOOD_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/dogfood-failed-pass"
 mkdir -p "$FAILED_DOGFOOD_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$FAILED_DOGFOOD_DIR/dogfood-failed-pass--deliver.md"
 flow_agents_node "$WRITER" init-plan "$FAILED_DOGFOOD_DIR/dogfood-failed-pass--deliver.md" \
@@ -1834,7 +2301,7 @@ else
   _fail "dogfood-pass release readiness did not update expected sidecars"
 fi
 
-DOGFOOD_NV_DIR="$TMPDIR_EVAL/repo/.flow-agents/dogfood-not-verified"
+DOGFOOD_NV_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/dogfood-not-verified"
 mkdir -p "$DOGFOOD_NV_DIR"
 cat > "$DOGFOOD_NV_DIR/dogfood-not-verified--deliver.md" <<'MARKDOWN'
 # Dogfood not verified fixture
@@ -1914,7 +2381,7 @@ else
   _fail "invalid release decision failure was not actionable"
 fi
 
-SEMANTIC_RELEASE_DIR="$TMPDIR_EVAL/repo/.flow-agents/semantic-release"
+SEMANTIC_RELEASE_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/semantic-release"
 mkdir -p "$SEMANTIC_RELEASE_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$SEMANTIC_RELEASE_DIR/semantic-release--deliver.md"
 flow_agents_node "$WRITER" init-plan "$SEMANTIC_RELEASE_DIR/semantic-release--deliver.md" \
@@ -1989,7 +2456,7 @@ else
   _fail "incomplete correction prevention failure was not actionable: $(cat "$TMPDIR_EVAL/correction-incomplete-prevention.out")"
 fi
 
-SEMANTIC_LEARNING_DIR="$TMPDIR_EVAL/repo/.flow-agents/semantic-learning"
+SEMANTIC_LEARNING_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/semantic-learning"
 mkdir -p "$SEMANTIC_LEARNING_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$SEMANTIC_LEARNING_DIR/semantic-learning--deliver.md"
 flow_agents_node "$WRITER" init-plan "$SEMANTIC_LEARNING_DIR/semantic-learning--deliver.md" \
@@ -2023,7 +2490,7 @@ else
   _fail "semantic learning failure advanced state or lacked actionable output"
 fi
 
-REVIEW_DIR="$TMPDIR_EVAL/repo/.flow-agents/imported-critique"
+REVIEW_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/imported-critique"
 mkdir -p "$REVIEW_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$REVIEW_DIR/imported-critique--deliver.md"
 flow_agents_node "$WRITER" init-plan "$REVIEW_DIR/imported-critique--deliver.md" \
@@ -2090,7 +2557,7 @@ else
   _fail "writer output failed validation: $(cat "$TMPDIR_EVAL/valid.out" "$TMPDIR_EVAL/valid.err")"
 fi
 
-BAD_DIR="$TMPDIR_EVAL/repo/.flow-agents/bad-critique"
+BAD_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/bad-critique"
 mkdir -p "$BAD_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$BAD_DIR/bad-critique--deliver.md"
 
@@ -2118,7 +2585,7 @@ else
   _fail "open critique failure did not mention open findings"
 fi
 
-IMPORT_BAD="$TMPDIR_EVAL/repo/.flow-agents/imported-bad-critique"
+IMPORT_BAD="$TMPDIR_EVAL/repo/.kontourai/flow-agents/imported-bad-critique"
 mkdir -p "$IMPORT_BAD"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$IMPORT_BAD/imported-bad-critique--deliver.md"
 flow_agents_node "$WRITER" init-plan "$IMPORT_BAD/imported-bad-critique--deliver.md" \
@@ -2162,7 +2629,7 @@ fi
 
 
 # ─── AC1: trust.bundle dual-write file existence and schema validity ──────────
-TB_SCHEMA_DIR="$TMPDIR_EVAL/repo/.flow-agents/trust-bundle-schema"
+TB_SCHEMA_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/trust-bundle-schema"
 mkdir -p "$TB_SCHEMA_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$TB_SCHEMA_DIR/trust-bundle-schema--deliver.md"
 flow_agents_node "$WRITER" init-plan "$TB_SCHEMA_DIR/trust-bundle-schema--deliver.md" \
@@ -2199,7 +2666,7 @@ NODEOF
 fi
 
 # ─── AC2: claim status fidelity — pass→verified, fail→disputed ───────────────
-TB_FIDELITY_DIR="$TMPDIR_EVAL/repo/.flow-agents/trust-bundle-fidelity"
+TB_FIDELITY_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/trust-bundle-fidelity"
 mkdir -p "$TB_FIDELITY_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$TB_FIDELITY_DIR/trust-bundle-fidelity--deliver.md"
 flow_agents_node "$WRITER" init-plan "$TB_FIDELITY_DIR/trust-bundle-fidelity--deliver.md" \
@@ -2239,7 +2706,7 @@ else
 fi
 
 # ─── AC2: claim status fidelity — critique fail→disputed, pass→verified ──────
-TB_CRITIQUE_DIR="$TMPDIR_EVAL/repo/.flow-agents/trust-bundle-critique"
+TB_CRITIQUE_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/trust-bundle-critique"
 mkdir -p "$TB_CRITIQUE_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$TB_CRITIQUE_DIR/trust-bundle-critique--deliver.md"
 flow_agents_node "$WRITER" init-plan "$TB_CRITIQUE_DIR/trust-bundle-critique--deliver.md" \
@@ -2290,7 +2757,7 @@ else
 fi
 
 # ─── AC3: capture authoritative over claimed status + policies present (ADR 0010 maximal) ──
-TB_CAPTURE_DIR="$TMPDIR_EVAL/repo/.flow-agents/trust-bundle-capture"
+TB_CAPTURE_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/trust-bundle-capture"
 mkdir -p "$TB_CAPTURE_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$TB_CAPTURE_DIR/trust-bundle-capture--deliver.md"
 flow_agents_node "$WRITER" init-plan "$TB_CAPTURE_DIR/trust-bundle-capture--deliver.md" \
@@ -2324,6 +2791,85 @@ else
   _fail "trust.bundle capture-authoritative setup failed: $(cat "$TMPDIR_EVAL/tb-capture-evidence.out" "$TMPDIR_EVAL/tb-capture-evidence.err")"
 fi
 
+# ---- #347: hard cutover -- an unstamped (pre-#344) claim in a session trust bundle is a loud,
+# typed error; checksFromBundle/critiquesFromBundle carry NO claimType-derivation fallback (that
+# fallback WAS the #268 defect kept reachable). ----------------------------------------------
+TB_UNSTAMPED_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/trust-bundle-unstamped"
+mkdir -p "$TB_UNSTAMPED_DIR"
+cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$TB_UNSTAMPED_DIR/trust-bundle-unstamped--deliver.md"
+flow_agents_node "$WRITER" init-plan "$TB_UNSTAMPED_DIR/trust-bundle-unstamped--deliver.md" \
+  --source-request "Unstamped bundle regression fixture." \
+  --summary "Unstamped bundle regression fixture." \
+  --next-action "Seed a stamped check, then strip its origin stamp to simulate a pre-#344 bundle." \
+  --timestamp "2026-05-09T00:00:00Z" >"$TMPDIR_EVAL/tb-unstamped-init.out" 2>"$TMPDIR_EVAL/tb-unstamped-init.err"
+flow_agents_node "$WRITER" record-evidence "$TB_UNSTAMPED_DIR" \
+  --verdict pass \
+  --check-json '{"id":"tb-unstamped-check","kind":"test","status":"pass","summary":"Stamped check, about to be corrupted."}' \
+  --timestamp "2026-05-09T00:01:00Z" >"$TMPDIR_EVAL/tb-unstamped-evidence.out" 2>"$TMPDIR_EVAL/tb-unstamped-evidence.err"
+
+# Simulate a pre-#344 bundle by stripping the origin/check_kind stamp from every claim -- never
+# done by hand-editing production sessions, only here to recreate the on-disk shape of a bundle
+# recorded before #344 shipped stamping.
+export UNSTAMPED_TARGET="$TB_UNSTAMPED_DIR/trust.bundle"
+node --input-type=module <<NODEOF
+import { readFileSync, writeFileSync } from 'node:fs';
+const target = process.env.UNSTAMPED_TARGET;
+const data = JSON.parse(readFileSync(target, 'utf8'));
+data.claims = (data.claims || []).map((c) => {
+  if (c && c.metadata && typeof c.metadata === 'object') {
+    const rest = { ...c.metadata };
+    delete rest.origin;
+    delete rest.check_kind;
+    return { ...c, metadata: rest };
+  }
+  return c;
+});
+writeFileSync(target, JSON.stringify(data, null, 2) + '\n');
+NODEOF
+
+if flow_agents_node "$WRITER" record-critique "$TB_UNSTAMPED_DIR" \
+  --id tb-unstamped-review \
+  --reviewer tool-code-reviewer \
+  --verdict pass \
+  --summary "Should never be recorded -- the bundle is unstamped." \
+  --timestamp "2026-05-09T00:02:00Z" >"$TMPDIR_EVAL/tb-unstamped-critique.out" 2>"$TMPDIR_EVAL/tb-unstamped-critique.err"; then
+  _fail "record-critique should refuse to read an unstamped (pre-#344) trust.bundle, not silently reclassify it by claimType"
+elif rg -q 'pre-supersession trust\.bundle' "$TMPDIR_EVAL/tb-unstamped-critique.out" "$TMPDIR_EVAL/tb-unstamped-critique.err" \
+  && rg -qF "$TB_UNSTAMPED_DIR" "$TMPDIR_EVAL/tb-unstamped-critique.out" "$TMPDIR_EVAL/tb-unstamped-critique.err" \
+  && rg -q 're-record evidence to regenerate' "$TMPDIR_EVAL/tb-unstamped-critique.out" "$TMPDIR_EVAL/tb-unstamped-critique.err" \
+  && rg -q 'record-evidence' "$TMPDIR_EVAL/tb-unstamped-critique.out" "$TMPDIR_EVAL/tb-unstamped-critique.err"; then
+  _pass "record-critique refuses an unstamped (pre-#344) trust.bundle: typed error names the session dir and the record-evidence remedy (no claimType-derivation fallback, #347)"
+else
+  _fail "record-critique on an unstamped bundle failed for the wrong reason: $(cat "$TMPDIR_EVAL/tb-unstamped-critique.out" "$TMPDIR_EVAL/tb-unstamped-critique.err")"
+fi
+
+# The same unstamped bundle also refuses promote (checksFromBundle) -- not just
+# record-critique/critiquesFromBundle.
+if flow_agents_node "$WRITER" promote "$TB_UNSTAMPED_DIR" --none --reason "regression probe" \
+  --timestamp "2026-05-09T00:03:00Z" >"$TMPDIR_EVAL/tb-unstamped-promote.out" 2>"$TMPDIR_EVAL/tb-unstamped-promote.err"; then
+  _fail "promote should refuse to read an unstamped (pre-#344) trust.bundle via checksFromBundle"
+elif rg -q 'pre-supersession trust\.bundle' "$TMPDIR_EVAL/tb-unstamped-promote.out" "$TMPDIR_EVAL/tb-unstamped-promote.err"; then
+  _pass "promote (checksFromBundle) also refuses an unstamped (pre-#344) trust.bundle with the same typed error"
+else
+  _fail "promote on an unstamped bundle failed for the wrong reason: $(cat "$TMPDIR_EVAL/tb-unstamped-promote.out" "$TMPDIR_EVAL/tb-unstamped-promote.err")"
+fi
+
+# (b) STAMPED bundles are unaffected: the earlier, still-stamped trust-bundle-critique fixture
+# carries the origin stamp on every claim -- the normal write path was never touched by this cutover.
+export STAMPED_TARGET="$TB_CRITIQUE_DIR/trust.bundle"
+if [[ -f "$STAMPED_TARGET" ]] && node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/tb-stamped-unaffected.err"
+import { readFileSync } from 'node:fs';
+const target = process.env.STAMPED_TARGET;
+const bundle = JSON.parse(readFileSync(target, 'utf8'));
+const unstamped = bundle.claims.filter((c) => !(c.metadata && typeof c.metadata === 'object' && typeof c.metadata.origin === 'string' && c.metadata.origin.length > 0));
+if (unstamped.length > 0) { process.stderr.write('found ' + unstamped.length + ' claim(s) with no origin stamp in a normally-written bundle\n'); process.exit(1); }
+NODEOF
+then
+  _pass "stamped bundles are unaffected: every claim in a normally-written trust bundle carries the origin stamp (#347)"
+else
+  _fail "stamped-bundle regression: $(cat "$TMPDIR_EVAL/tb-stamped-unaffected.err")"
+fi
+
 # ─── AC4: render-trust-panel projects the bundle to a standalone Surface Trust Panel (ADR 0010 Phase 3) ──
 if [[ -f "$TB_CAPTURE_DIR/trust.bundle" ]] && flow_agents_node "$WRITER" render-trust-panel "$TB_CAPTURE_DIR" --out "$TB_CAPTURE_DIR/trust-panel.html" >"$TMPDIR_EVAL/tb-panel.out" 2>"$TMPDIR_EVAL/tb-panel.err"; then
   PANEL="$TB_CAPTURE_DIR/trust-panel.html"
@@ -2382,7 +2928,7 @@ else
 fi
 
 # ─── AC6: agent liveness (ADR 0012) — held / free-on-lapse / free-on-release ──
-TB_LIVENESS_ROOT="$TMPDIR_EVAL/liveness/.flow-agents"
+TB_LIVENESS_ROOT="$TMPDIR_EVAL/liveness/.kontourai/flow-agents"
 flow_agents_node "$WRITER" liveness claim     held-subj  --actor agent-A --at "2026-06-25T11:50:00Z" --ttl 1800 --artifact-root "$TB_LIVENESS_ROOT" >/dev/null 2>&1
 flow_agents_node "$WRITER" liveness heartbeat held-subj  --actor agent-A --at "2026-06-25T11:58:00Z" --artifact-root "$TB_LIVENESS_ROOT" >/dev/null 2>&1
 flow_agents_node "$WRITER" liveness claim     stale-subj --actor agent-B --at "2026-06-25T11:00:00Z" --ttl 1800 --artifact-root "$TB_LIVENESS_ROOT" >/dev/null 2>&1
@@ -2397,25 +2943,207 @@ else
   _fail "liveness status mismatch (expected held/free/free): $LIVENESS_OUT"
 fi
 
-# ─── AC7: lifecycle-driven liveness (ADR 0012) — init-plan claims, advance-state releases (opt-in) ──
-TB_LC_ROOT="$TMPDIR_EVAL/liveness-lifecycle/.flow-agents"
+# ─── F8(i) (#288 fix iteration 2, orphan-heartbeat invariant): direct CLI `liveness
+# heartbeat`/`release` must die with remediation when no prior claim event exists for the
+# (subjectId, actor) pair — the exact reproduction the reviewer flagged ("liveness heartbeat
+# <subj> --actor <a> with no prior claim writes an orphan heartbeat"). `claim` itself is
+# unaffected (it establishes the pair). ──
+TB_ORPHAN_ROOT="$TMPDIR_EVAL/liveness-orphan/.kontourai/flow-agents"
+if flow_agents_node "$WRITER" liveness heartbeat orphan-subj --actor agent-orphan --artifact-root "$TB_ORPHAN_ROOT" >"$TMPDIR_EVAL/orphan-heartbeat.out" 2>"$TMPDIR_EVAL/orphan-heartbeat.err"; then
+  _fail "liveness (F8(i)): heartbeat with no prior claim for the (subject, actor) pair should have exited nonzero"
+elif rg -qi 'prior claim' "$TMPDIR_EVAL/orphan-heartbeat.err" && rg -qi 'liveness claim' "$TMPDIR_EVAL/orphan-heartbeat.err"   && [[ ! -f "$TB_ORPHAN_ROOT/liveness/events.jsonl" ]]; then
+  _pass "liveness (F8(i)): heartbeat with no prior claim dies with remediation naming 'liveness claim' and writes no orphan event"
+else
+  _fail "liveness (F8(i)) orphan-heartbeat rejection lacked remediation or wrote an event: $(cat "$TMPDIR_EVAL/orphan-heartbeat.out" "$TMPDIR_EVAL/orphan-heartbeat.err")"
+fi
+
+if flow_agents_node "$WRITER" liveness release orphan-release-subj --actor agent-orphan-r --artifact-root "$TB_ORPHAN_ROOT" >"$TMPDIR_EVAL/orphan-release.out" 2>"$TMPDIR_EVAL/orphan-release.err"; then
+  _fail "liveness (F8(i)): release with no prior claim for the (subject, actor) pair should have exited nonzero"
+elif rg -qi 'prior claim' "$TMPDIR_EVAL/orphan-release.err" && rg -qi 'liveness claim' "$TMPDIR_EVAL/orphan-release.err"   && ! rg -q '"subjectId":"orphan-release-subj"' "$TB_ORPHAN_ROOT/liveness/events.jsonl" 2>/dev/null; then
+  _pass "liveness (F8(i)): release with no prior claim dies with remediation naming 'liveness claim' and writes no orphan event"
+else
+  _fail "liveness (F8(i)) orphan-release rejection lacked remediation or wrote an event: $(cat "$TMPDIR_EVAL/orphan-release.out" "$TMPDIR_EVAL/orphan-release.err")"
+fi
+
+# A prior claim for the SAME subjectId but a DIFFERENT actor must not satisfy the check — the
+# invariant is per-(subject, actor) pair, not merely per-subject.
+flow_agents_node "$WRITER" liveness claim orphan-crossactor-subj --actor agent-orphan-real --artifact-root "$TB_ORPHAN_ROOT" >/dev/null 2>&1
+if flow_agents_node "$WRITER" liveness heartbeat orphan-crossactor-subj --actor agent-orphan-impostor --artifact-root "$TB_ORPHAN_ROOT" >"$TMPDIR_EVAL/orphan-crossactor.out" 2>"$TMPDIR_EVAL/orphan-crossactor.err"; then
+  _fail "liveness (F8(i)): heartbeat for a different actor than the one who claimed should have exited nonzero"
+elif rg -qi 'prior claim' "$TMPDIR_EVAL/orphan-crossactor.err"   && ! rg -q '"subjectId":"orphan-crossactor-subj","actor":"agent-orphan-impostor","at":"[^"]*","type":"heartbeat"' "$TB_ORPHAN_ROOT/liveness/events.jsonl" 2>/dev/null   && ! rg -q '"type":"heartbeat".*"subjectId":"orphan-crossactor-subj".*"actor":"agent-orphan-impostor"' "$TB_ORPHAN_ROOT/liveness/events.jsonl" 2>/dev/null; then
+  _pass "liveness (F8(i)): the prior-claim check is scoped per (subject, actor) pair — another actor's claim on the same subject does not satisfy it"
+else
+  _fail "liveness (F8(i)) cross-actor orphan-heartbeat check failed: $(cat "$TMPDIR_EVAL/orphan-crossactor.out" "$TMPDIR_EVAL/orphan-crossactor.err")"
+fi
+
+# claim itself is unaffected: it must still succeed with no prior claim of any kind.
+if flow_agents_node "$WRITER" liveness claim orphan-claim-ok-subj --actor agent-orphan-ok --artifact-root "$TB_ORPHAN_ROOT" >"$TMPDIR_EVAL/orphan-claim-ok.out" 2>"$TMPDIR_EVAL/orphan-claim-ok.err"   && rg -q '"type":"claim","subjectId":"orphan-claim-ok-subj"' "$TB_ORPHAN_ROOT/liveness/events.jsonl"; then
+  _pass "liveness (F8(i)): claim is unaffected by the prior-claim requirement — it succeeds with no prior events at all"
+else
+  _fail "liveness (F8(i)) claim regressed: $(cat "$TMPDIR_EVAL/orphan-claim-ok.out" "$TMPDIR_EVAL/orphan-claim-ok.err")"
+fi
+
+# ─── AC7: lifecycle-driven liveness (ADR 0012) — init-plan claims, advance-state releases (default-on) ──
+TB_LC_ROOT="$TMPDIR_EVAL/liveness-lifecycle/.kontourai/flow-agents"
 TB_LC_DIR="$TB_LC_ROOT/lc-task"; mkdir -p "$TB_LC_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$TB_LC_DIR/lc-task--deliver.md"
-FLOW_AGENTS_LIVENESS=on FLOW_AGENTS_ACTOR=agent-LC flow_agents_node "$WRITER" init-plan "$TB_LC_DIR/lc-task--deliver.md" --task-slug lc-task --source-request x --summary y --next-action z --timestamp "2026-06-25T11:50:00Z" >/dev/null 2>&1
+FLOW_AGENTS_ACTOR=agent-LC flow_agents_node "$WRITER" init-plan "$TB_LC_DIR/lc-task--deliver.md" --task-slug lc-task --source-request x --summary y --next-action z --timestamp "2026-06-25T11:50:00Z" >/dev/null 2>&1
 LC_HELD=$(flow_agents_node "$WRITER" liveness status --now "2026-06-25T12:00:00Z" --artifact-root "$TB_LC_ROOT" 2>/dev/null | grep -viE "unknown format")
-FLOW_AGENTS_LIVENESS=on FLOW_AGENTS_ACTOR=agent-LC flow_agents_node "$WRITER" advance-state "$TB_LC_DIR" --status delivered --phase done --task-slug lc-task --timestamp "2026-06-25T11:55:00Z" >/dev/null 2>&1
+LC_CLAIM_EVENTS=$(cat "$TB_LC_ROOT/liveness/events.jsonl" 2>/dev/null)
+FLOW_AGENTS_ACTOR=agent-LC flow_agents_node "$WRITER" advance-state "$TB_LC_DIR" --status delivered --phase done --task-slug lc-task --timestamp "2026-06-25T11:55:00Z" >/dev/null 2>&1
 LC_FREE=$(flow_agents_node "$WRITER" liveness status --now "2026-06-25T12:00:00Z" --artifact-root "$TB_LC_ROOT" 2>/dev/null | grep -viE "unknown format")
-TB_OFF_ROOT="$TMPDIR_EVAL/liveness-off/.flow-agents"; mkdir -p "$TB_OFF_ROOT/off-task"
+TB_OFF_ROOT="$TMPDIR_EVAL/liveness-off/.kontourai/flow-agents"; mkdir -p "$TB_OFF_ROOT/off-task"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$TB_OFF_ROOT/off-task/off-task--deliver.md"
-flow_agents_node "$WRITER" init-plan "$TB_OFF_ROOT/off-task/off-task--deliver.md" --task-slug off-task --source-request x --summary y --next-action z >/dev/null 2>&1
-if echo "$LC_HELD" | grep -qE "lc-task.*agent-LC.*held" && echo "$LC_FREE" | grep -qE "lc-task.*agent-LC.*free" && [ ! -f "$TB_OFF_ROOT/liveness/events.jsonl" ]; then
-  _pass "liveness lifecycle: init-plan claims (held), advance→delivered releases (free); opt-in respected (no events when disabled)"
-else
-  _fail "liveness lifecycle mismatch: held=[$LC_HELD] free=[$LC_FREE] off=$([ -f "$TB_OFF_ROOT/liveness/events.jsonl" ] && echo wrote || echo none)"
+FLOW_AGENTS_LIVENESS=off flow_agents_node "$WRITER" init-plan "$TB_OFF_ROOT/off-task/off-task--deliver.md" --task-slug off-task --source-request x --summary y --next-action z >/dev/null 2>&1
+if echo "$LC_HELD" | grep -qE "lc-task.*agent-LC.*held" \
+  && echo "$LC_CLAIM_EVENTS" | grep -qE '"type":"claim","subjectId":"lc-task"' \
+  && echo "$LC_FREE" | grep -qE "lc-task.*agent-LC.*free" \
+  && [ ! -f "$TB_OFF_ROOT/liveness/events.jsonl" ]; then
+  _pass "liveness lifecycle: no env set → init-plan writes a claim event + shows held (default-on proof), advance→delivered releases (free); FLOW_AGENTS_LIVENESS=off respected (no events written)"
+else
+  _fail "liveness lifecycle mismatch: held=[$LC_HELD] claim-event=[$(echo "$LC_CLAIM_EVENTS" | head -c 200)] free=[$LC_FREE] off=$([ -f "$TB_OFF_ROOT/liveness/events.jsonl" ] && echo wrote || echo none)"
+fi
+
+# ─── F2 (#288 fix iteration 1, cr-HIGH coverage gap): FLOW_AGENTS_LIVENESS_TTL_SECONDS is
+# honored by the lifecycle auto-claim path — init-plan with the env var set to a custom value
+# must emit a claim event carrying that exact ttlSeconds, not the DEFAULT_TTL_SECONDS literal ──
+TB_TTL_ROOT="$TMPDIR_EVAL/liveness-ttl-env/.kontourai/flow-agents"
+TB_TTL_DIR="$TB_TTL_ROOT/ttl-task"; mkdir -p "$TB_TTL_DIR"
+cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$TB_TTL_DIR/ttl-task--deliver.md"
+FLOW_AGENTS_ACTOR=agent-TTL FLOW_AGENTS_LIVENESS_TTL_SECONDS=300 flow_agents_node "$WRITER" init-plan "$TB_TTL_DIR/ttl-task--deliver.md" --task-slug ttl-task --source-request x --summary y --next-action z --timestamp "2026-06-25T11:50:00Z" >/dev/null 2>&1
+TTL_CLAIM_EVENTS=$(cat "$TB_TTL_ROOT/liveness/events.jsonl" 2>/dev/null)
+if echo "$TTL_CLAIM_EVENTS" | grep -qE '"type":"claim","subjectId":"ttl-task".*"ttlSeconds":300'; then
+  _pass "liveness lifecycle: FLOW_AGENTS_LIVENESS_TTL_SECONDS=300 → emitted claim carries ttlSeconds:300 (F2, AC2)"
+else
+  _fail "liveness lifecycle did not honor FLOW_AGENTS_LIVENESS_TTL_SECONDS=300: events=[$(echo "$TTL_CLAIM_EVENTS" | head -c 200)]"
+fi
+
+# ─── F5 (#288 fix iteration 1, sec-LOW): hostile subjectId is stripped from the terminal print,
+# but preserved verbatim in the persisted event (display-only concern, not a write-shape change) ──
+TB_HOSTILE_ROOT="$TMPDIR_EVAL/liveness-hostile-subject/.kontourai/flow-agents"
+HOSTILE_SUBJECT=$'hostile\x1b[31msubj\x07tail'
+HOSTILE_OUT=$(flow_agents_node "$WRITER" liveness claim "$HOSTILE_SUBJECT" --actor agent-hostile --at "2026-06-25T11:50:00Z" --ttl 1800 --artifact-root "$TB_HOSTILE_ROOT" 2>&1)
+HOSTILE_EVENT=$(cat "$TB_HOSTILE_ROOT/liveness/events.jsonl" 2>/dev/null)
+if printf '%s' "$HOSTILE_OUT" | grep -qF $'\x1b[31m'; then
+  HOSTILE_ESCAPE_LEAKED=true
+else
+  HOSTILE_ESCAPE_LEAKED=false
+fi
+if [[ "$HOSTILE_ESCAPE_LEAKED" == "false" ]] \
+  && printf '%s' "$HOSTILE_OUT" | grep -qF "hostile" \
+  && printf '%s' "$HOSTILE_OUT" | grep -qF "tail" \
+  && echo "$HOSTILE_EVENT" | grep -qF 'hostile'; then
+  _pass "liveness claim: hostile subjectId (ANSI escape + control char) is stripped from the terminal confirmation print, but preserved verbatim in the persisted event (F5)"
+else
+  _fail "liveness claim hostile-subjectId print check failed: escape-leaked=$HOSTILE_ESCAPE_LEAKED out=$(printf '%s' "$HOSTILE_OUT" | cat -v) event=$(echo "$HOSTILE_EVENT" | head -c 200)"
+fi
+
+# ─── AC5 (#287): two auto-derived sessions (no --actor, no FLOW_AGENTS_ACTOR) → two distinct held holders ──
+# Simulates two concurrent sessions on one host via injected CLAUDE_CODE_SESSION_ID envs (the
+# runtime-native session-id signal actor-identity.js's resolveActor() reads at priority layer 2).
+# Neither invocation passes --actor; the actor is fully auto-derived.
+TB_TWOHOLDERS_ROOT="$TMPDIR_EVAL/liveness-two-holders/.kontourai/flow-agents"
+CLAUDE_CODE_SESSION_ID=sess-a flow_agents_node "$WRITER" liveness claim two-holder-subj --ttl 1800 --artifact-root "$TB_TWOHOLDERS_ROOT" >"$TMPDIR_EVAL/two-holders-a.out" 2>"$TMPDIR_EVAL/two-holders-a.err"
+TWO_HOLDERS_A_STATUS=$?
+CLAUDE_CODE_SESSION_ID=sess-b flow_agents_node "$WRITER" liveness claim two-holder-subj --ttl 1800 --artifact-root "$TB_TWOHOLDERS_ROOT" >"$TMPDIR_EVAL/two-holders-b.out" 2>"$TMPDIR_EVAL/two-holders-b.err"
+TWO_HOLDERS_B_STATUS=$?
+flow_agents_node "$WRITER" liveness status --json --subject two-holder-subj --artifact-root "$TB_TWOHOLDERS_ROOT" >"$TMPDIR_EVAL/two-holders-status.json" 2>"$TMPDIR_EVAL/two-holders-status.err"
+if [[ "$TWO_HOLDERS_A_STATUS" -eq 0 && "$TWO_HOLDERS_B_STATUS" -eq 0 ]] \
+  && node - "$TMPDIR_EVAL/two-holders-status.json" <<'NODE'
+const fs = require("node:fs");
+const rows = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+if (!Array.isArray(rows) || rows.length !== 2) throw new Error("expected 2 rows, got " + JSON.stringify(rows));
+const held = rows.filter((r) => r.label === "held");
+if (held.length !== 2) throw new Error("expected 2 held rows, got " + JSON.stringify(rows));
+const actors = new Set(held.map((r) => r.actor));
+if (actors.size !== 2) throw new Error("expected 2 distinct actors, got " + JSON.stringify([...actors]));
+if ([...actors].some((a) => String(a).toLowerCase() === "local")) throw new Error("actor collapsed to local: " + JSON.stringify([...actors]));
+NODE
+then
+  _pass "liveness (AC5): two auto-derived sessions (no --actor) produce two distinct held holders, not one collapsed 'local' holder"
+else
+  _fail "liveness (AC5) two-holder check failed: $(cat "$TMPDIR_EVAL/two-holders-a.out" "$TMPDIR_EVAL/two-holders-a.err" "$TMPDIR_EVAL/two-holders-b.out" "$TMPDIR_EVAL/two-holders-b.err" "$TMPDIR_EVAL/two-holders-status.err") json=$(cat "$TMPDIR_EVAL/two-holders-status.json" 2>/dev/null)"
+fi
+
+# ─── AC6 (#287): forced-unresolved actor → liveness write exits nonzero with remediation ──
+# FLOW_AGENTS_ACTOR_TEST_FORCE_UNRESOLVED=1 (together with NODE_ENV=test — F4, #287 fix iteration 1:
+# the hatch requires BOTH vars) is the test-only escape hatch in actor-identity.js's resolveActor():
+# it short-circuits to {actor: "", source: "test-forced-unresolved"} before any real runtime/ancestry
+# detection runs, deterministically proving the fail-loud path without needing to sabotage ps/proc.
+# No --actor flag, no (non-forced) FLOW_AGENTS_ACTOR set.
+TB_FORCEUNRES_ROOT="$TMPDIR_EVAL/liveness-forced-unresolved/.kontourai/flow-agents"
+if FLOW_AGENTS_ACTOR_TEST_FORCE_UNRESOLVED=1 NODE_ENV=test flow_agents_node "$WRITER" liveness claim forced-unresolved-subj --artifact-root "$TB_FORCEUNRES_ROOT" >"$TMPDIR_EVAL/forced-unresolved.out" 2>"$TMPDIR_EVAL/forced-unresolved.err"; then
+  _fail "liveness (AC6): claim with FLOW_AGENTS_ACTOR_TEST_FORCE_UNRESOLVED=1 should have exited nonzero"
+elif rg -q -- '--actor' "$TMPDIR_EVAL/forced-unresolved.err" && rg -q -- 'FLOW_AGENTS_ACTOR' "$TMPDIR_EVAL/forced-unresolved.err" \
+  && [[ ! -f "$TB_FORCEUNRES_ROOT/liveness/events.jsonl" ]]; then
+  _pass "liveness (AC6): forced-unresolved actor (no --actor, no runtime/ancestry signal) exits nonzero naming --actor and FLOW_AGENTS_ACTOR"
+else
+  _fail "liveness (AC6) forced-unresolved rejection lacked remediation or wrote an event: $(cat "$TMPDIR_EVAL/forced-unresolved.out" "$TMPDIR_EVAL/forced-unresolved.err")"
+fi
+
+# ─── AC3 (#287): literal "local" actor is rejected even when explicitly set, not just when absent ──
+# Deviation note (see worker report): `FLOW_AGENTS_ACTOR=local` alone (env override, no --actor) is
+# REJECTED by actor-identity.js's resolveActor() at the override layer (it can never round-trip back
+# in via that seam — see the module's own header comment) but the command then falls through to a
+# real runtime/ancestry-derived actor and SUCCEEDS with that distinct, non-"local" value whenever any
+# resolution layer is available (true in this sandbox via CLAUDE_CODE_SESSION_ID, and true in nearly
+# any environment via the process-ancestry fallback) — empirically confirmed exit 0 during this
+# task's investigation. The `--actor local` explicit-flag path bypasses resolveActor's override
+# rejection and hits the liveness() guard directly, so it is the deterministic, environment-independent
+# way to prove "explicitly set literal local is rejected, never silently written" at the CLI level.
+TB_LITERALLOCAL_ROOT="$TMPDIR_EVAL/liveness-literal-local/.kontourai/flow-agents"
+if flow_agents_node "$WRITER" liveness claim literal-local-subj --actor local --artifact-root "$TB_LITERALLOCAL_ROOT" >"$TMPDIR_EVAL/literal-local.out" 2>"$TMPDIR_EVAL/literal-local.err"; then
+  _fail "liveness (AC3): claim with --actor local should have exited nonzero"
+elif rg -q -- '--actor' "$TMPDIR_EVAL/literal-local.err" && rg -q -- 'FLOW_AGENTS_ACTOR' "$TMPDIR_EVAL/literal-local.err" \
+  && [[ ! -f "$TB_LITERALLOCAL_ROOT/liveness/events.jsonl" ]]; then
+  _pass "liveness (AC3): explicit --actor local (case-insensitive literal) exits nonzero naming --actor and FLOW_AGENTS_ACTOR"
+else
+  _fail "liveness (AC3) literal-local rejection lacked remediation or wrote an event: $(cat "$TMPDIR_EVAL/literal-local.out" "$TMPDIR_EVAL/literal-local.err")"
+fi
+if flow_agents_node "$WRITER" liveness claim literal-local-subj-upper --actor LOCAL --artifact-root "$TB_LITERALLOCAL_ROOT" >"$TMPDIR_EVAL/literal-local-upper.out" 2>"$TMPDIR_EVAL/literal-local-upper.err"; then
+  _fail "liveness (AC3): claim with --actor LOCAL (case-insensitive) should have exited nonzero"
+else
+  _pass "liveness (AC3): explicit --actor LOCAL is rejected case-insensitively"
+fi
+# Env-only override path: FLOW_AGENTS_ACTOR=local (no --actor) must never let "local" round-trip back
+# in as the persisted actor — it falls through to auto-derivation instead of dying when a resolution
+# layer is available (documented behavior of the override seam, see comment above).
+if FLOW_AGENTS_ACTOR=local flow_agents_node "$WRITER" liveness claim literal-local-env-subj --artifact-root "$TB_LITERALLOCAL_ROOT" >"$TMPDIR_EVAL/literal-local-env.out" 2>"$TMPDIR_EVAL/literal-local-env.err" \
+  && ! rg -q '"actor":"local"' "$TB_LITERALLOCAL_ROOT/liveness/events.jsonl" 2>/dev/null \
+  && ! rg -qi 'by local$' "$TMPDIR_EVAL/literal-local-env.out"; then
+  _pass "liveness (AC3): FLOW_AGENTS_ACTOR=local override is rejected and never round-trips into the persisted actor"
+else
+  _fail "liveness (AC3) FLOW_AGENTS_ACTOR=local override handling regressed: $(cat "$TMPDIR_EVAL/literal-local-env.out" "$TMPDIR_EVAL/literal-local-env.err")"
+fi
+
+# ─── T4 (#287 fix iteration 2, F7): explicit --actor value that strips to empty under the allowed
+# [A-Za-z0-9_.-] charset is a hard error on the write path (unlike the env-override seam, which
+# falls through to derivation) — claim exits nonzero with remediation and writes no event.
+TB_STRIPEMPTY_ROOT="$TMPDIR_EVAL/liveness-strip-empty/.kontourai/flow-agents"
+if flow_agents_node "$WRITER" liveness claim strip-empty-subj --actor ':::' --artifact-root "$TB_STRIPEMPTY_ROOT" >"$TMPDIR_EVAL/strip-empty.out" 2>"$TMPDIR_EVAL/strip-empty.err"; then
+  _fail "liveness (T4/F7): claim with --actor ':::' should have exited nonzero"
+elif rg -q -- '--actor' "$TMPDIR_EVAL/strip-empty.err"   && [[ ! -f "$TB_STRIPEMPTY_ROOT/liveness/events.jsonl" ]]; then
+  _pass "liveness (T4/F7): --actor ':::' (strips to empty) exits nonzero with --actor remediation and writes no event"
+else
+  _fail "liveness (T4/F7) strip-to-empty --actor rejection lacked remediation or wrote an event: $(cat "$TMPDIR_EVAL/strip-empty.out" "$TMPDIR_EVAL/strip-empty.err")"
+fi
+
+# ─── AC4 (#287): backward-compatible reads of legacy literal "local" events ──
+# Hand-seed liveness/events.jsonl directly (bypassing the CLI) to simulate a pre-#287 event whose
+# actor field is the literal string "local", then confirm `liveness status` still parses, groups, and
+# labels it correctly — reads must keep tolerating historical "local" events (unlike writes).
+TB_LEGACY_ROOT="$TMPDIR_EVAL/liveness-legacy/.kontourai/flow-agents"
+mkdir -p "$TB_LEGACY_ROOT/liveness"
+printf '%s\n' '{"type":"claim","subjectId":"legacy-subj","actor":"local","at":"2026-06-25T11:50:00Z","ttlSeconds":1800}' > "$TB_LEGACY_ROOT/liveness/events.jsonl"
+LEGACY_STATUS_OUT=$(flow_agents_node "$WRITER" liveness status --subject legacy-subj --now "2026-06-25T12:00:00Z" --artifact-root "$TB_LEGACY_ROOT" 2>/dev/null)
+if echo "$LEGACY_STATUS_OUT" | grep -qE "legacy-subj.*local.*held"; then
+  _pass "liveness (AC4): hand-seeded legacy actor:\"local\" event still parses as one held row"
+else
+  _fail "liveness (AC4) legacy 'local' event failed to parse: $LEGACY_STATUS_OUT"
 fi
 
 # ─── AC8: bundle-writers fail LOUDLY when Surface unavailable — no silent data loss (#156) ──
-TB_FO_DIR="$TMPDIR_EVAL/repo/.flow-agents/failopen"
+TB_FO_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/failopen"
 mkdir -p "$TB_FO_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$TB_FO_DIR/failopen--deliver.md"
 flow_agents_node "$WRITER" init-plan "$TB_FO_DIR/failopen--deliver.md" --task-slug failopen --source-request x --summary y --next-action z --timestamp "2026-05-09T00:00:00Z" >/dev/null 2>&1
@@ -2435,7 +3163,7 @@ fi
 # field matches @kontourai/surface's exported statusFunctionVersion constant.
 # Also run hachure conformance vectors through Surface's deriveClaimStatus to
 # confirm our producer path produces canonical statuses.
-TB_CONF_DIR="$TMPDIR_EVAL/repo/.flow-agents/trust-bundle-conformance"
+TB_CONF_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/trust-bundle-conformance"
 mkdir -p "$TB_CONF_DIR"
 cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$TB_CONF_DIR/trust-bundle-conformance--deliver.md"
 flow_agents_node "$WRITER" init-plan "$TB_CONF_DIR/trust-bundle-conformance--deliver.md"   --source-request "Conformance fixture."   --summary "Conformance fixture."   --next-action "Record evidence and check statusFunctionVersion."   --timestamp "2026-05-09T00:00:00Z" >"$TMPDIR_EVAL/tb-conf-init.out" 2>"$TMPDIR_EVAL/tb-conf-init.err"
@@ -2505,7 +3233,7 @@ fi
 
 # ─── Deterministic session slug from work-item ref (#161) ───────────────────
 
-WORK_ITEM_ROOT="$TMPDIR_EVAL/work-item-repo/.flow-agents"
+WORK_ITEM_ROOT="$TMPDIR_EVAL/work-item-repo/.kontourai/flow-agents"
 
 # (a) --work-item derives deterministic slug kontourai-flow-agents-161
 if flow_agents_node "$WRITER" ensure-session \
@@ -2539,7 +3267,7 @@ else
 fi
 
 # (c) --task-slug wins over --work-item (back-compat: explicit overrides derived)
-TASK_SLUG_ROOT="$TMPDIR_EVAL/task-slug-repo/.flow-agents"
+TASK_SLUG_ROOT="$TMPDIR_EVAL/task-slug-repo/.kontourai/flow-agents"
 if flow_agents_node "$WRITER" ensure-session \
   --artifact-root "$TASK_SLUG_ROOT" \
   --task-slug "manual-slug" \
@@ -2555,7 +3283,7 @@ else
 fi
 
 # (c2) --task-slug only (no --work-item) still works
-TASK_SLUG_ONLY_ROOT="$TMPDIR_EVAL/task-slug-only-repo/.flow-agents"
+TASK_SLUG_ONLY_ROOT="$TMPDIR_EVAL/task-slug-only-repo/.kontourai/flow-agents"
 if flow_agents_node "$WRITER" ensure-session \
   --artifact-root "$TASK_SLUG_ONLY_ROOT" \
   --task-slug "explicit-only" \
@@ -2572,7 +3300,7 @@ fi
 # ensure-session establishes the slug; liveness events (emitted by init-plan/advance-state) key
 # on that same slug as subjectId. We verify this by emitting two liveness claim events directly
 # via `liveness claim` using the slug derived from the ref, then asserting both share subjectId.
-LIVENESS_WORK_ROOT="$TMPDIR_EVAL/liveness-wi-repo/.flow-agents"
+LIVENESS_WORK_ROOT="$TMPDIR_EVAL/liveness-wi-repo/.kontourai/flow-agents"
 # First: ensure-session --work-item produces the expected slug (directory name proof)
 if flow_agents_node "$WRITER" ensure-session \
   --artifact-root "$LIVENESS_WORK_ROOT" \