@kungfu-tech/buildchain 4.0.0 → 4.0.1-alpha.2

package/dist/site/public-surface-audit.json

@@ -6,7 +6,7 @@
     "cliCommandCount": 114,
     "workflowCount": 71,
     "actionCount": 7,
-    "sitePageCount": 75,
+    "sitePageCount": 76,
     "docCommandRefCount": 919,
     "failureCount": 0
   },
@@ -680,6 +680,7 @@
           "buildchain-expected-major",
           "buildchain-ref",
           "buildchain-repository",
+          "buildchain-visible-workflow",
           "cache-dependency-lock-root",
           "cache-policy-root",
           "cache-toolchain-root",
@@ -744,7 +745,7 @@
           "verify-substage-evidence-path",
           "working-directory"
         ],
-        "inputCount": 90,
+        "inputCount": 91,
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -800,9 +801,11 @@
           "release-manifest-json",
           "runner-preset",
           "runner-routing-json",
-          "trusted-event"
+          "trusted-event",
+          "v4-consumer-policy-receipt-json",
+          "v4-consumer-policy-receipt-root"
         ],
-        "outputCount": 43
+        "outputCount": 45
       },
       {
         "id": ".bump-minor-version",
@@ -977,6 +980,7 @@
           "branch-protection-bypass-apps",
           "branch-protection-bypass-teams",
           "branch-protection-bypass-users",
+          "buildchain-alpha-contract-lock-path",
           "buildchain-contract-compatibility-policy",
           "buildchain-contract-drift-issue-mode",
           "buildchain-contract-lock-path",
@@ -984,6 +988,7 @@
           "buildchain-expected-major",
           "buildchain-ref",
           "buildchain-repository",
+          "buildchain-stable-contract-lock-path",
           "channel",
           "declarative-release-tail",
           "dry-run",
@@ -1002,6 +1007,8 @@
           "promotion-publication-channel",
           "promotion-router-ref",
           "promotion-router-sha",
+          "promotion-runtime-authorization-json",
+          "promotion-runtime-authorization-root",
           "promotion-runtime-ref",
           "promotion-runtime-sha",
           "promotion-shell-ref",
@@ -1067,6 +1074,7 @@
           "release-passport-output-dir",
           "release-passport-platform-manifest-paths",
           "release-passport-product-name",
+          "release-passport-v4-runtime-resume-evidence-json",
           "release-propagation-config-path",
           "required-artifact-count",
           "required-status-check",
@@ -1085,7 +1093,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 113,
+        "inputCount": 118,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1583,6 +1591,7 @@
           "buildchain-ref",
           "buildchain-repository",
           "buildchain-stable-contract-lock-path",
+          "buildchain-visible-workflow",
           "cache-dependency-lock-root",
           "cache-policy-root",
           "cache-toolchain-root",
@@ -1647,7 +1656,7 @@
           "verify-substage-evidence-path",
           "working-directory"
         ],
-        "inputCount": 93,
+        "inputCount": 94,
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1706,9 +1715,11 @@
           "release-manifest-json",
           "runner-preset",
           "runner-routing-json",
-          "trusted-event"
+          "trusted-event",
+          "v4-consumer-policy-receipt-json",
+          "v4-consumer-policy-receipt-root"
         ],
-        "outputCount": 46
+        "outputCount": 48
       },
       {
         "id": "buildchain-alpha-self-dogfood",
@@ -1866,10 +1877,15 @@
           "mode",
           "node-version",
           "require-version-state",
+          "source-proof-closure-paths-json",
+          "source-proof-dependency-paths-json",
+          "source-proof-policy-paths-json",
+          "source-proof-required-contexts-json",
+          "source-proof-reuse",
           "upload-artifacts",
           "working-directory"
         ],
-        "inputCount": 7,
+        "inputCount": 12,
         "secrets": [],
         "secretCount": 0,
         "outputs": [
@@ -1879,9 +1895,14 @@
           "controller-receipt-artifact",
           "controller-receipt-digest",
           "controller-receipt-json",
-          "controller-receipt-status"
+          "controller-receipt-status",
+          "source-proof-decision-root",
+          "source-proof-producer-run-id",
+          "source-proof-reuse-reason",
+          "source-proof-reused",
+          "source-proof-root"
         ],
-        "outputCount": 7
+        "outputCount": 12
       },
       {
         "id": "dev-alpha-candidate-patrol",
@@ -2007,6 +2028,7 @@
         "path": ".github/workflows/dev-pr-auto-merge.yml",
         "reusable": true,
         "inputs": [
+          "active-lease-context",
           "affected-paths-json",
           "allowed-head-prefixes",
           "assignment-root",
@@ -2040,7 +2062,7 @@
           "toolchain-root",
           "warrant-lease-seconds"
         ],
-        "inputCount": 32,
+        "inputCount": 33,
         "secrets": [
           "github-token"
         ],
@@ -2451,11 +2473,13 @@
           "artifact-paths",
           "artifact-retention-days",
           "build-command",
+          "buildchain-alpha-contract-lock-path",
           "buildchain-contract-compatibility-policy",
           "buildchain-contract-drift-issue-mode",
           "buildchain-contract-lock-path",
           "buildchain-ref",
           "buildchain-repository",
+          "buildchain-stable-contract-lock-path",
           "node-version",
           "package-name",
           "prepare-paper-package",
@@ -2469,7 +2493,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 21,
+        "inputCount": 23,
         "secrets": [],
         "secretCount": 0,
         "outputs": [
@@ -2582,6 +2606,7 @@
           "release-passport-output-dir",
           "release-passport-platform-manifest-paths",
           "release-passport-product-name",
+          "release-passport-v4-runtime-resume-evidence-json",
           "release-propagation-config-path",
           "required-artifact-count",
           "required-status-check",
@@ -2600,7 +2625,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 102,
+        "inputCount": 103,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -3002,6 +3027,9 @@
           "release-passport-platform-manifest-paths",
           "release-passport-product-name",
           "release-passport-promotion-routing-json",
+          "release-passport-v4-consumer-policy-certification-json",
+          "release-passport-v4-consumer-policy-certification-root",
+          "release-passport-v4-runtime-resume-evidence-json",
           "release-tail-state-path",
           "require-governance",
           "require-publication-qualification",
@@ -3015,7 +3043,7 @@
           "transaction-state-path",
           "verification-command"
         ],
-        "inputCount": 80
+        "inputCount": 83
       },
       {
         "id": "release-tail",
@@ -3405,6 +3433,10 @@
         "id": "manual:v4-production-release",
         "category": "manual"
       },
+      {
+        "id": "manual:v4-runtime-ref-resume-authority",
+        "category": "manual"
+      },
       {
         "id": "manual:v4-stage-capsule",
         "category": "manual"
@@ -8025,8 +8057,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "031027fdd7688220deb52bfae928be562fa5509bf4a4f5e692ab2a949971d15a",
-    "workflowRegistryDigest": "5b58098f76e192debf3845c49f104c0546c4eff4ce5ad4c052770349386b2d92",
-    "pageRegistryDigest": "b916ca61d67cbb86708d4d314c4811bde37878644326ac073cd3b372d3708730"
+    "workflowRegistryDigest": "b56e58e414eb2eebeb9a7331e8a1ea1ed890b778b6dacea1d71a77fbf7e014e1",
+    "pageRegistryDigest": "d56b274a2aae61918cb1afbc6d59569a4022801a9f0169c4393128b18e74b9a1"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-13T09:05:27.306Z",
-  "publishedAt": "2026-08-13T09:05:27.306Z",
+  "generatedAt": "2026-08-15T11:38:16.137Z",
+  "publishedAt": "2026-08-15T11:38:16.137Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "45a49dcaa0fcef59bc66481a85c39514d08972cc",
+  "sourceRevision": "8c8a952f024c32f8961c05dd59238a29ed361e72",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.0",
+    "version": "4.0.1-alpha.2",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-provenance.json

@@ -37,6 +37,8 @@
       "./release-line-bootstrap": "./packages/core/release-line-bootstrap.js",
       "./readme-badges": "./packages/core/readme-badges.js",
       "./public-surface-audit": "./packages/core/public-surface-audit.js",
+      "./v4-floating-consumer-policy": "./packages/core/v4-floating-consumer-policy.js",
+      "./v4-runtime-ref-resume-authority": "./packages/core/v4-runtime-ref-resume-authority.js",
       "./logging": "./packages/core/logging.js",
       "./portable-dev-cache": "./packages/core/portable-dev-cache.js",
       "./publication-artifact": "./packages/core/publication-artifact.js",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-13T09:05:27.306Z",
-  "publishedAt": "2026-08-13T09:05:27.306Z",
+  "generatedAt": "2026-08-15T11:38:16.137Z",
+  "publishedAt": "2026-08-15T11:38:16.137Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "45a49dcaa0fcef59bc66481a85c39514d08972cc",
+  "sourceRevision": "8c8a952f024c32f8961c05dd59238a29ed361e72",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.0",
+    "version": "4.0.1-alpha.2",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:94a4866f5a44f97ab10ad460c4d9ff39c58aa28e231311425af2fcb857aa8c72"
+      "digest": "sha256:c6be6076530f21d1a81f4f3d64f7aa2a9e5e8fb35a02f79a895814a85cad4838"
     },
     {
       "id": "getting-started",
@@ -245,7 +245,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:f8200ba1fbe5779408b4a1e82a0e28a5e8f696b05f97efd2d286d3008755fdbb"
+      "digest": "sha256:1771331eea141e17dc27d19ccd6ccdf2d3a7d2ecdb98fb9e0d0d563b1e61b438"
     },
     {
       "id": "build-facts",
@@ -277,7 +277,7 @@
       "path": "docs/lifecycle-protocol.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:4b7a8efe1d22751ded069f46a23490db70cda9e9e14641acab600ab781245b19"
+      "digest": "sha256:edff8787985801d060efe9c924d80ac1689f5f2305d853f645fe877bab34c207"
     },
     {
       "id": "reusable-build-surface",
@@ -285,7 +285,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:54cadd6e2f168ca40d9ed66d2f9848d5d56c9d05759bf0454f5027b1df274796"
+      "digest": "sha256:fc2649d0ae4dc6a08275bc1f2509efd3e9730227eaa8157ef64daf4b9c850264"
     },
     {
       "id": "publish-transaction",
@@ -333,7 +333,7 @@
       "path": "docs/runtime-train-validation.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:f0a1cdb7fe5f72fc2ed921f1aeadbd16184dda16be3727e4193fa2af250325db"
+      "digest": "sha256:7df1e85785a1bd8d87c22359d63bcd1caf3fc6c4924d04b6802584b189f75a08"
     },
     {
       "id": "versioning",
@@ -341,7 +341,7 @@
       "path": "docs/versioning.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:7f6e377abf976e9eb9c5f0fd2baec96922ca44d9ab7dd08178608657fa858978"
+      "digest": "sha256:fa094ca11fe51b2f23b2154523414676d6f8c8fa50493c5027a469da9115a414"
     },
     {
       "id": "web-surface-deployments",

package/dist/site/workflow-registry.json

@@ -119,6 +119,7 @@
         "buildchain-expected-major",
         "buildchain-ref",
         "buildchain-repository",
+        "buildchain-visible-workflow",
         "cache-dependency-lock-root",
         "cache-policy-root",
         "cache-toolchain-root",
@@ -183,7 +184,7 @@
         "verify-substage-evidence-path",
         "working-directory"
       ],
-      "inputCount": 90,
+      "inputCount": 91,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -239,9 +240,11 @@
         "release-manifest-json",
         "runner-preset",
         "runner-routing-json",
-        "trusted-event"
+        "trusted-event",
+        "v4-consumer-policy-receipt-json",
+        "v4-consumer-policy-receipt-root"
       ],
-      "outputCount": 43,
+      "outputCount": 45,
       "surface": "reusable-build",
       "capabilityGroup": "api-cli-reference",
       "status": "active",
@@ -466,6 +469,7 @@
         "branch-protection-bypass-apps",
         "branch-protection-bypass-teams",
         "branch-protection-bypass-users",
+        "buildchain-alpha-contract-lock-path",
         "buildchain-contract-compatibility-policy",
         "buildchain-contract-drift-issue-mode",
         "buildchain-contract-lock-path",
@@ -473,6 +477,7 @@
         "buildchain-expected-major",
         "buildchain-ref",
         "buildchain-repository",
+        "buildchain-stable-contract-lock-path",
         "channel",
         "declarative-release-tail",
         "dry-run",
@@ -491,6 +496,8 @@
         "promotion-publication-channel",
         "promotion-router-ref",
         "promotion-router-sha",
+        "promotion-runtime-authorization-json",
+        "promotion-runtime-authorization-root",
         "promotion-runtime-ref",
         "promotion-runtime-sha",
         "promotion-shell-ref",
@@ -556,6 +563,7 @@
         "release-passport-output-dir",
         "release-passport-platform-manifest-paths",
         "release-passport-product-name",
+        "release-passport-v4-runtime-resume-evidence-json",
         "release-propagation-config-path",
         "required-artifact-count",
         "required-status-check",
@@ -574,7 +582,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 113,
+      "inputCount": 118,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1252,6 +1260,7 @@
         "buildchain-ref",
         "buildchain-repository",
         "buildchain-stable-contract-lock-path",
+        "buildchain-visible-workflow",
         "cache-dependency-lock-root",
         "cache-policy-root",
         "cache-toolchain-root",
@@ -1316,7 +1325,7 @@
         "verify-substage-evidence-path",
         "working-directory"
       ],
-      "inputCount": 93,
+      "inputCount": 94,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1375,9 +1384,11 @@
         "release-manifest-json",
         "runner-preset",
         "runner-routing-json",
-        "trusted-event"
+        "trusted-event",
+        "v4-consumer-policy-receipt-json",
+        "v4-consumer-policy-receipt-root"
       ],
-      "outputCount": 46,
+      "outputCount": 48,
       "surface": "channel-build-router",
       "capabilityGroup": "reusable-build",
       "status": "active",
@@ -1655,10 +1666,15 @@
         "mode",
         "node-version",
         "require-version-state",
+        "source-proof-closure-paths-json",
+        "source-proof-dependency-paths-json",
+        "source-proof-policy-paths-json",
+        "source-proof-required-contexts-json",
+        "source-proof-reuse",
         "upload-artifacts",
         "working-directory"
       ],
-      "inputCount": 7,
+      "inputCount": 12,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
@@ -1668,9 +1684,14 @@
         "controller-receipt-artifact",
         "controller-receipt-digest",
         "controller-receipt-json",
-        "controller-receipt-status"
+        "controller-receipt-status",
+        "source-proof-decision-root",
+        "source-proof-producer-run-id",
+        "source-proof-reuse-reason",
+        "source-proof-reused",
+        "source-proof-root"
       ],
-      "outputCount": 7,
+      "outputCount": 12,
       "surface": "repository-workflow",
       "capabilityGroup": "api-cli-reference",
       "status": "active",
@@ -1846,6 +1867,7 @@
       "path": ".github/workflows/dev-pr-auto-merge.yml",
       "reusable": true,
       "inputs": [
+        "active-lease-context",
         "affected-paths-json",
         "allowed-head-prefixes",
         "assignment-root",
@@ -1879,7 +1901,7 @@
         "toolchain-root",
         "warrant-lease-seconds"
       ],
-      "inputCount": 32,
+      "inputCount": 33,
       "secrets": [
         "github-token"
       ],
@@ -1968,7 +1990,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.0",
+      "introducedVersion": "4.0.1-alpha.2",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -1989,7 +2011,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.0",
+      "introducedVersion": "4.0.1-alpha.2",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2010,7 +2032,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.0",
+      "introducedVersion": "4.0.1-alpha.2",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2060,7 +2082,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.0",
+      "introducedVersion": "4.0.1-alpha.2",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2440,11 +2462,13 @@
         "artifact-paths",
         "artifact-retention-days",
         "build-command",
+        "buildchain-alpha-contract-lock-path",
         "buildchain-contract-compatibility-policy",
         "buildchain-contract-drift-issue-mode",
         "buildchain-contract-lock-path",
         "buildchain-ref",
         "buildchain-repository",
+        "buildchain-stable-contract-lock-path",
         "node-version",
         "package-name",
         "prepare-paper-package",
@@ -2458,7 +2482,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 21,
+      "inputCount": 23,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
@@ -2581,6 +2605,7 @@
         "release-passport-output-dir",
         "release-passport-platform-manifest-paths",
         "release-passport-product-name",
+        "release-passport-v4-runtime-resume-evidence-json",
         "release-propagation-config-path",
         "required-artifact-count",
         "required-status-check",
@@ -2599,7 +2624,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 102,
+      "inputCount": 103,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -3150,6 +3175,9 @@
         "release-passport-platform-manifest-paths",
         "release-passport-product-name",
         "release-passport-promotion-routing-json",
+        "release-passport-v4-consumer-policy-certification-json",
+        "release-passport-v4-consumer-policy-certification-root",
+        "release-passport-v4-runtime-resume-evidence-json",
         "release-tail-state-path",
         "require-governance",
         "require-publication-qualification",
@@ -3163,7 +3191,7 @@
         "transaction-state-path",
         "verification-command"
       ],
-      "inputCount": 80,
+      "inputCount": 83,
       "capabilityGroup": "release-passport-trust",
       "status": "active",
       "owner": "buildchain-actions",

package/docs/MAP.md

@@ -159,6 +159,8 @@ replace them.
 | How do self-hosted runners reuse local Git checkout caches without weakening source locks? | [`reusable-build-surface.md`](reusable-build-surface.md#locked-source-checkout-cache) | use | stable |
 | How do ephemeral GitHub-hosted runners share exact dependency or compiler caches without fixed-runner affinity? | [`cli.md`](cli.md#commands) | use/verify | preview |
 | How do I validate an unreleased Buildchain runtime train while keeping `@v3`? | [`runtime-train-validation.md`](runtime-train-validation.md) | use | stable |
+| How do v4 consumers keep floating selectors while proving exact runtime and lock identity? | [`reusable-build-surface.md`](reusable-build-surface.md#v4-floating-consumer-admission) | verify/use | preview |
+| How can a trusted v4 run use a transient exact runtime and resume sealed Stage Capsules after a floating ref moves? | [`v4-runtime-ref-resume-authority.md`](v4-runtime-ref-resume-authority.md) | use/verify | preview |
 | How do I automatically qualify alpha candidates and publish the newest non-revoked qualified candidate at a fixed window? | [`stable-candidate-patrol.md`](stable-candidate-patrol.md) | use | preview |
 | How do I deploy a site/app preview, staging, or production surface? | [`web-surface-deployments.md`](web-surface-deployments.md) | use | stable |
 | How do I publish observed infrastructure contracts for downstream consumers? | [`infra-contract.md`](infra-contract.md) | use | preview |

package/docs/dev-delivery-warrant.md

@@ -150,7 +150,25 @@ The reusable `dev-pr-auto-merge.yml` supports three explicit rollout modes:
 - `shadow` qualifies the source and emits a read-only queue submission plan;
 - `required` persists the submission, selects the Warrant, and refuses GitHub
   enqueue unless the immutable queue commit, state root, active Warrant, and
-  selected candidate all pass exact readback validation.
+  selected candidate all pass exact readback validation. Immediately before
+  enqueue, the controller writes and reads back both the exact-head queue
+  admission status and the active lease status. Only after both are visible at
+  their required states does it reread the pull request head, protected base,
+  native merge queue, and current protected Warrant. The final rooted
+  admission transaction binds the frozen base, source head, Warrant fence and
+  generation, Project Cut proof, and both status contexts. Status propagation
+  is retried before enqueue; base, head, predecessor, lease, or Warrant drift
+  revokes both statuses without attempting enqueue.
+
+  Required-mode admission also performs a latest-base Project Cut immediately
+  before enqueue. If the protected base advanced, the controller reclassifies
+  the exact attributed delta against the Warrant-bound source proof. Only a disjoint,
+  fully attributed move may reuse that proof; overlap, unknown attribution,
+  missing composition, or merge conflict fails with a stable pre-enqueue reason.
+  The rooted Project Cut receipt binds the frozen and admitted base SHAs,
+  GitHub's exact synthetic merge commit and replay tree, and the unchanged PR
+  head. A final base/head/queue/Warrant compare-and-swap readback must still
+  match that receipt before the enqueue mutation is attempted.
 
 Consumers should deploy `shadow` first, inspect receipts, then change their
 protected caller to `required`. Rollback is a reviewed caller change back to