@planu/cli 5.1.1 → 5.3.0

package/dist/engine/planu-core.win32-arm64-msvc.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.1.1",
-  "engineVersion": "5.1.1",
-  "buildId": "1-5.1.1-aarch64-pc-windows-msvc",
+  "cliVersion": "5.3.0",
+  "engineVersion": "5.3.0",
+  "buildId": "1-5.3.0-aarch64-pc-windows-msvc",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "win32",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "44db6066ed29aedfdc6e4f2a940ec75a5bb38b47963cd83024f465293bfedc98",
+  "artifactSha256": "01422e8f53405b0cfffac1b978d4a07c7972c4cfa0071e3f7cf38d7f8b2513c3",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.win32-arm64-msvc.node.sbom.json",
-    "sha256": "5e6b815fce1aa7af3eb8ece295e1f0e6a0bac84615811c461cd54bf12e5a30f7"
+    "sha256": "23055aaffab71649b3fc5882ee65539d8f3db05b0e35d008cd43f807c3c55d93"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "5046eff43d23641fe60bd1c01e8c34277172db16",
+    "sourceCommit": "0bfc16bd342cfaa8ee48da5d9a1484df65bca782",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "YneMkC+5A2C6ux44tKvBSk9t48xGIc383BY62DpJ6SIdBMwdFZlScMLFAOIXI4vd77ZrHFVI90QCeIHgbspJBQ=="
+    "value": "Cwm9qVClAtTaV/h0ZVGCGk7QXtV1GStNz+b82ZZdsJjCKFVGv+RJybsHCZkcVakUQjSGmN4ssaJ1bvZq1paMBA=="
   }
 }

package/dist/engine/planu-core.win32-arm64-msvc.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.1.1",
+      "bom-ref": "pkg:cargo/planu-core@5.3.0",
       "type": "library",
       "name": "planu-core",
-      "version": "5.1.1",
+      "version": "5.3.0",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "44db6066ed29aedfdc6e4f2a940ec75a5bb38b47963cd83024f465293bfedc98"
+          "content": "01422e8f53405b0cfffac1b978d4a07c7972c4cfa0071e3f7cf38d7f8b2513c3"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.1.1",
+      "ref": "pkg:cargo/planu-core@5.3.0",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.win32-x64-msvc.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.1.1",
-  "engineVersion": "5.1.1",
-  "buildId": "1-5.1.1-x86_64-pc-windows-msvc",
+  "cliVersion": "5.3.0",
+  "engineVersion": "5.3.0",
+  "buildId": "1-5.3.0-x86_64-pc-windows-msvc",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "win32",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "301863177ab4858bbbcd6f1d5ac86af8f98c424512a54c28b5343c01c1bd377b",
+  "artifactSha256": "742b98dcbef119cd3f8b7f52c7e7508882312e40ffe6900558f054718054cb4e",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.win32-x64-msvc.node.sbom.json",
-    "sha256": "e8005e98ac68f02b8c8617c6dff112dd868f7cc6b5b8d9b9b67513bf58d1d201"
+    "sha256": "172c6101641c982c1bfc77907de80a963e550dea73dbd0db6e2abe332a87a88a"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "5046eff43d23641fe60bd1c01e8c34277172db16",
+    "sourceCommit": "0bfc16bd342cfaa8ee48da5d9a1484df65bca782",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "6tB0t8ghclHvFBbyGKGHG4QZ8TQ+xmAVm01BBbzC9MzVT/Cmy2Cf/KArHCK6Dsmur08z//zSNCLakiXShjRsDQ=="
+    "value": "rKiBtPEqL5BY1WRzouHSNnhfASCK+jUqnpGRpS2e7N/dpGootewvevQRZVJJixuQL0rlmoDZtiFmXwbfJ8yYAA=="
   }
 }

package/dist/engine/planu-core.win32-x64-msvc.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.1.1",
+      "bom-ref": "pkg:cargo/planu-core@5.3.0",
       "type": "library",
       "name": "planu-core",
-      "version": "5.1.1",
+      "version": "5.3.0",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "301863177ab4858bbbcd6f1d5ac86af8f98c424512a54c28b5343c01c1bd377b"
+          "content": "742b98dcbef119cd3f8b7f52c7e7508882312e40ffe6900558f054718054cb4e"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.1.1",
+      "ref": "pkg:cargo/planu-core@5.3.0",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/spec-language/english-only.d.ts

@@ -1,4 +1,5 @@
 import type { EnglishOnlyArtifactKind, EnglishOnlyValidationResult } from '../../types/spec-language.js';
+import type { EnglishOnlyGateResolution } from '../../types/spec-language-translation.js';
 /**
  * Validate that a Planu-owned persisted artifact is authored in English.
  *
@@ -12,5 +13,18 @@ export declare function validateEnglishOnlyArtifactText(text: string, kind?: Eng
  * Backward-compatible spec-specific entrypoint used by create_spec/update_status gates.
  */
 export declare function validateEnglishOnlySpecText(text: string): EnglishOnlyValidationResult;
+/** clarificationAnswers key carrying the LLM-provided English translation of the spec title. */
+export declare const TRANSLATED_TITLE_ANSWER_KEY = "Title-EN";
+/** clarificationAnswers key carrying the LLM-provided English translation of the description. */
+export declare const TRANSLATED_DESCRIPTION_ANSWER_KEY = "Desc-EN";
+/**
+ * SPEC-1342: Resolve the English-only gate for create_spec's title/description.
+ *
+ * Instead of hard-rejecting non-English input, this offers one clarification round:
+ * the calling LLM is asked (via the existing clarificationAnswers mechanism) to supply
+ * the English translation inline. Only rejects if that translation is missing or itself
+ * still non-English after the round.
+ */
+export declare function resolveEnglishOnlySpecGate(title: string, description: string, clarificationAnswers?: Record<string, string>): EnglishOnlyGateResolution;
 export declare function assertEnglishOnlyArtifactText(text: string, kind: EnglishOnlyArtifactKind): void;
 //# sourceMappingURL=english-only.d.ts.map

package/dist/engine/spec-language/english-only.js

@@ -119,6 +119,64 @@ export function validateEnglishOnlyArtifactText(text, kind = 'spec') {
 export function validateEnglishOnlySpecText(text) {
     return validateEnglishOnlyArtifactText(text, 'spec');
 }
+/** clarificationAnswers key carrying the LLM-provided English translation of the spec title. */
+export const TRANSLATED_TITLE_ANSWER_KEY = 'Title-EN';
+/** clarificationAnswers key carrying the LLM-provided English translation of the description. */
+export const TRANSLATED_DESCRIPTION_ANSWER_KEY = 'Desc-EN';
+/**
+ * SPEC-1342: Resolve the English-only gate for create_spec's title/description.
+ *
+ * Instead of hard-rejecting non-English input, this offers one clarification round:
+ * the calling LLM is asked (via the existing clarificationAnswers mechanism) to supply
+ * the English translation inline. Only rejects if that translation is missing or itself
+ * still non-English after the round.
+ */
+export function resolveEnglishOnlySpecGate(title, description, clarificationAnswers) {
+    const validation = validateEnglishOnlySpecText(`${title}\n\n${description}`);
+    if (validation.ok) {
+        return { action: 'ok' };
+    }
+    const originalLanguage = validation.detectedLanguage === 'pt' ? 'pt' : 'es';
+    const titleAnswer = clarificationAnswers?.[TRANSLATED_TITLE_ANSWER_KEY]?.trim();
+    const descriptionAnswer = clarificationAnswers?.[TRANSLATED_DESCRIPTION_ANSWER_KEY]?.trim();
+    if (!titleAnswer || !descriptionAnswer) {
+        return {
+            action: 'ask',
+            originalLanguage,
+            questions: buildTranslationRequestQuestions(title),
+        };
+    }
+    const translatedValidation = validateEnglishOnlySpecText(`${titleAnswer}\n\n${descriptionAnswer}`);
+    if (!translatedValidation.ok) {
+        return { action: 'reject', originalLanguage, reason: validation.reason };
+    }
+    return {
+        action: 'translated',
+        originalLanguage,
+        englishTitle: titleAnswer,
+        englishDescription: descriptionAnswer,
+    };
+}
+function buildTranslationRequestQuestions(title) {
+    return [
+        {
+            question: `The spec title "${title}" is not in English. What is the English translation of the title?`,
+            header: TRANSLATED_TITLE_ANSWER_KEY,
+            options: [
+                { label: 'Provide translation', description: 'Type the English translation as free text.' },
+            ],
+            multiSelect: false,
+        },
+        {
+            question: 'What is the English translation of the spec description?',
+            header: TRANSLATED_DESCRIPTION_ANSWER_KEY,
+            options: [
+                { label: 'Provide translation', description: 'Type the English translation as free text.' },
+            ],
+            multiSelect: false,
+        },
+    ];
+}
 export function assertEnglishOnlyArtifactText(text, kind) {
     const validation = validateEnglishOnlyArtifactText(text, kind);
     if (!validation.ok) {

package/dist/engine/spec-migrator/criteria-scanner.js

@@ -2,7 +2,7 @@
 import { readFile, readdir, stat } from 'node:fs/promises';
 import { join } from 'node:path';
 import { checkCriteriaQuality } from '../criteria-quality-checker.js';
-import { isNativeActive, fastScanSpecs } from '../core-bridge.js';
+import { fastScanSpecsAsync } from '../core-bridge.js';
 const SPEC_DIR_RE = /^SPEC-\d+/;
 /** Extract YAML frontmatter content (between first and second ---). */
 function extractFrontmatterAndBody(content) {
@@ -43,18 +43,16 @@ function extractField(frontmatter, field) {
  * Returns an array of ambiguous criteria with context for LLM rewriting.
  */
 export async function scanForAmbiguousCriteria(projectPath) {
-    if (isNativeActive()) {
-        const briefs = fastScanSpecs(projectPath);
-        if (briefs) {
-            return briefs.flatMap((b) => b.ambiguousCriteria.map((a) => ({
-                specId: a.specId,
-                specTitle: a.specTitle,
-                specContext: '', // Native scanner doesn't return full body context yet
-                criterionText: a.criterionText,
-                score: a.score,
-                reason: a.reason,
-            })));
-        }
+    const { value: briefs } = await fastScanSpecsAsync(projectPath);
+    if (briefs) {
+        return briefs.flatMap((b) => b.ambiguousCriteria.map((a) => ({
+            specId: a.specId,
+            specTitle: a.specTitle,
+            specContext: '', // Native scanner doesn't return full body context yet
+            criterionText: a.criterionText,
+            score: a.score,
+            reason: a.reason,
+        })));
     }
     const ambiguous = [];
     const specsDir = join(projectPath, 'planu/specs');

package/dist/engine/spec-migrator/drift-detector.js

@@ -2,7 +2,7 @@
 import { readdir, stat, access, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { isOldFormat } from './lean-migration.js';
-import { isNativeActive, fastScanSpecs } from '../core-bridge.js';
+import { fastScanSpecsAsync } from '../core-bridge.js';
 import { isCanonicalPlanuRootDir, isCanonicalPlanuRootFile, isCanonicalSpecFile, } from './planu-canonical-policy.js';
 async function scanPlanuRoot(projectPath) {
     const rootFiles = [];
@@ -82,22 +82,20 @@ export async function detectDrift(projectPath) {
     const specsDir = join(projectPath, 'planu', 'specs');
     const unifiedSpecs = [];
     const leanSpecs = [];
-    if (isNativeActive()) {
-        const briefs = fastScanSpecs(projectPath);
-        if (briefs) {
-            for (const b of briefs) {
-                if (b.needsUnified) {
-                    unifiedSpecs.push(b.id);
-                }
-                if (b.needsLean) {
-                    leanSpecs.push(b.id);
-                }
+    const { value: briefs } = await fastScanSpecsAsync(projectPath);
+    if (briefs) {
+        for (const b of briefs) {
+            if (b.needsUnified) {
+                unifiedSpecs.push(b.id);
+            }
+            if (b.needsLean) {
+                leanSpecs.push(b.id);
             }
         }
     }
     const rootFiles = await scanPlanuRoot(projectPath);
     const specDirEntries = await readdir(specsDir).catch(() => []);
-    if (isNativeActive()) {
+    if (briefs) {
         for (const entry of specDirEntries) {
             const specPath = join(specsDir, entry);
             try {

package/dist/engine/validation/validation-freshness.d.ts

@@ -1,4 +1,4 @@
-import type { ValidationFreshnessLease, ValidationReceiptBindings } from '../../types/validation-receipt.js';
+import type { ValidationFreshnessLease, ValidationReceiptBindings, ValidationWatchEventClassification } from '../../types/validation-receipt.js';
 export type { ValidationFreshnessLease } from '../../types/validation-receipt.js';
 /**
  * Invalidate the active validation lease for a spec.
@@ -10,6 +10,25 @@ export declare function invalidateValidationFreshness(input: {
     projectId: string;
     specId: string;
 }): boolean;
+/**
+ * Classify one raw watcher event as a direct relevant/ignored child path, a
+ * synthetic root event (macOS emits these for the watched directory itself),
+ * or an ambiguous filename-less event that needs authoritative verification
+ * before it can be trusted to mean real byte drift.
+ */
+export declare function classifyValidationWatchEventForTests(input: {
+    filename: string | null;
+    watchedRoot: string;
+    relevant: (filename: string) => boolean;
+}): ValidationWatchEventClassification;
+/** Inject one classified watcher event without relying on host-specific fs.watch timing. */
+export declare function injectValidationWatchEventForTests(input: {
+    lease: Pick<ValidationFreshnessLease, 'projectId' | 'specId' | 'epoch'>;
+    scope: 'project' | 'handoff';
+    filename: string | null;
+}): ValidationWatchEventClassification | undefined;
+/** Pause or observe authoritative verification turns without changing watcher topology. */
+export declare function setValidationFreshnessVerificationHookForTests(hook: (() => Promise<void>) | undefined): void;
 /** Start both watchers before snapshotting and invalidate any older receipt immediately. */
 export declare function beginValidationFreshnessBarrier(input: {
     projectId: string;

package/dist/engine/validation/validation-freshness.js

@@ -67,6 +67,7 @@ const FINGERPRINT_CHUNK_BYTES = 64 * 1024;
 const EVIDENCE_FILE = /^(?:discovery|task-plan|traceability-matrix|contract-validation-(?:api|graphql|event|ui|mcp))\.json$/u;
 const active = new Map();
 const beginQueues = new Map();
+let verificationHookForTests;
 function key(projectId, specId) {
     return `${projectId}:${specId}`;
 }
@@ -149,18 +150,57 @@ export function invalidateValidationFreshness(input) {
     runInvalidationTurn(input.projectId, input.specId, state);
     return true;
 }
-function startWatch(path, relevant, onRelevantChange, onError) {
+/**
+ * Invalidate only if `expected` is still the exact live state for this
+ * identity. `invalidateValidationFreshness` mutates whatever is currently
+ * active for a projectId/specId regardless of epoch — callers holding a
+ * lease captured before an `await` must use this guard so a stale lease can
+ * never invalidate the epoch that replaced it.
+ */
+function invalidateExactEpoch(lease, expected) {
+    if (active.get(key(lease.projectId, lease.specId)) !== expected) {
+        return false;
+    }
+    return invalidateValidationFreshness(lease);
+}
+/**
+ * Classify one raw watcher event as a direct relevant/ignored child path, a
+ * synthetic root event (macOS emits these for the watched directory itself),
+ * or an ambiguous filename-less event that needs authoritative verification
+ * before it can be trusted to mean real byte drift.
+ */
+export function classifyValidationWatchEventForTests(input) {
+    if (!input.filename) {
+        return 'ambiguous';
+    }
+    const normalized = input.filename.replaceAll('\\', '/');
+    if (normalized === input.watchedRoot ||
+        normalized === `${input.watchedRoot}/` ||
+        normalized === '.' ||
+        normalized === './') {
+        return 'synthetic';
+    }
+    const rootPrefix = `${input.watchedRoot}/`;
+    const relative = normalized.startsWith(rootPrefix)
+        ? normalized.slice(rootPrefix.length)
+        : normalized;
+    return input.relevant(relative) ? 'direct-relevant' : 'ignored';
+}
+function startWatch(path, relevant, onRelevantChange, onAmbiguousChange, onError) {
     try {
         const watchedRoot = basename(path);
-        const watcher = watch(path, { recursive: true }, (event, filename) => {
-            // macOS emits a synthetic `change` for the watched directory itself in
-            // addition to the actionable relative child event.
-            if (event === 'change' && filename === watchedRoot) {
-                return;
-            }
-            if (!filename || relevant(filename.replaceAll('\\', '/'))) {
+        const watcher = watch(path, { recursive: true }, (_event, filename) => {
+            const classification = classifyValidationWatchEventForTests({
+                filename,
+                watchedRoot,
+                relevant,
+            });
+            if (classification === 'direct-relevant') {
                 onRelevantChange();
             }
+            else if (classification === 'synthetic' || classification === 'ambiguous') {
+                onAmbiguousChange();
+            }
         });
         watcher.on('error', onError);
         watcher.unref();
@@ -172,6 +212,111 @@ function startWatch(path, relevant, onRelevantChange, onError) {
         return undefined;
     }
 }
+/** Inject one classified watcher event without relying on host-specific fs.watch timing. */
+export function injectValidationWatchEventForTests(input) {
+    const state = active.get(key(input.lease.projectId, input.lease.specId));
+    if (state?.epoch !== input.lease.epoch || !state.accepting) {
+        return undefined;
+    }
+    const projectScope = input.scope === 'project';
+    const classification = classifyValidationWatchEventForTests({
+        filename: input.filename,
+        watchedRoot: basename(projectScope ? state.projectPath : state.handoffPath),
+        relevant: projectScope ? isValidationSourcePath : (filename) => EVIDENCE_FILE.test(filename),
+    });
+    if (classification === 'direct-relevant') {
+        invalidateValidationFreshness(input.lease);
+    }
+    else if (classification === 'synthetic' || classification === 'ambiguous') {
+        noteAmbiguousEvent(state);
+    }
+    return classification;
+}
+/** Pause or observe authoritative verification turns without changing watcher topology. */
+export function setValidationFreshnessVerificationHookForTests(hook) {
+    verificationHookForTests = hook;
+}
+function noteAmbiguousEvent(state) {
+    // Every synthetic or filename-less event counts, even while a cycle is
+    // already in flight: the in-flight cycle's target snapshot was captured
+    // before this event arrived, so skipping it here would let a mutation
+    // signaled only by this event slip past with no follow-up verification
+    // turn. The drain loop still bounds the total work to one leading and one
+    // trailing turn regardless of how many events land during a cycle.
+    state.ambiguousEvents += 1;
+}
+/**
+ * Run one authoritative verification turn confirming the exact epoch, source
+ * digest, and evidence fingerprint are unchanged as of `targetEvent`.
+ */
+async function runAmbiguousVerificationTurn(lease, state, bindings, targetEvent) {
+    const generationBefore = state.generation;
+    try {
+        await verificationHookForTests?.();
+        const fingerprintBefore = await evidenceFingerprint(state.handoffPath);
+        const sourceDigest = await gitSourceTreeDigest(state.projectPath);
+        const fingerprintAfter = await evidenceFingerprint(state.handoffPath);
+        const confirmed = active.get(key(lease.projectId, lease.specId));
+        if (confirmed !== state ||
+            confirmed.epoch !== lease.epoch ||
+            !confirmed.healthy ||
+            confirmed.generation !== generationBefore ||
+            sourceDigest !== bindings.sourceDigest ||
+            fingerprintBefore !== state.evidenceFingerprint ||
+            fingerprintAfter !== fingerprintBefore) {
+            invalidateExactEpoch(lease, state);
+            return false;
+        }
+        state.verifiedAmbiguousEvents = Math.max(state.verifiedAmbiguousEvents, targetEvent);
+        return true;
+    }
+    catch (error) {
+        reportClassifiedDegradation('VALIDATION_FRESHNESS_CHECK_FAILED', error);
+        invalidateExactEpoch(lease, state);
+        return false;
+    }
+}
+/**
+ * Run the bounded leading-plus-trailing verification cycle for every
+ * ambiguous event noted so far. Every concurrent caller shares the SAME
+ * cycle promise for its full duration — joining mid-cycle can never start an
+ * independent third turn, which keeps AC4's "at most one leading and one
+ * trailing turn" bound even when callers interleave with new events.
+ */
+function runAmbiguousDrainCycle(lease, state, bindings) {
+    const cycle = (async () => {
+        for (let turnIndex = 0; turnIndex < 2; turnIndex += 1) {
+            if (state.ambiguousEvents === state.verifiedAmbiguousEvents) {
+                return true;
+            }
+            if (!bindings) {
+                invalidateExactEpoch(lease, state);
+                return false;
+            }
+            const targetEvent = state.ambiguousEvents;
+            if (!(await runAmbiguousVerificationTurn(lease, state, bindings, targetEvent))) {
+                return false;
+            }
+        }
+        if (state.ambiguousEvents === state.verifiedAmbiguousEvents) {
+            return true;
+        }
+        invalidateExactEpoch(lease, state);
+        return false;
+    })().finally(() => {
+        if (state.ambiguousDrainCycle === cycle) {
+            state.ambiguousDrainCycle = undefined;
+        }
+    });
+    return cycle;
+}
+async function drainAmbiguousEvents(lease, state, bindings) {
+    if (state.ambiguousEvents === state.verifiedAmbiguousEvents) {
+        return true;
+    }
+    state.ambiguousDrainCycle ??= runAmbiguousDrainCycle(lease, state, bindings);
+    return state.ambiguousDrainCycle;
+}
 async function evidenceFingerprint(path) {
     const names = (await readdir(path, { withFileTypes: true }))
         .filter((entry) => EVIDENCE_FILE.test(entry.name))
@@ -263,6 +408,8 @@ export async function beginValidationFreshnessBarrier(input) {
             epoch: randomUUID(),
             expiresAt: Date.now() + policy.freshnessLeaseTtlMs,
             generation: 0,
+            ambiguousEvents: 0,
+            verifiedAmbiguousEvents: 0,
             healthy: true,
             accepting: true,
             projectPath: input.projectPath,
@@ -279,14 +426,19 @@ export async function beginValidationFreshnessBarrier(input) {
                 invalidateValidationFreshness(input);
             }
         };
+        const ambiguous = () => {
+            if (active.get(identity)?.epoch === watchedEpoch && state.accepting) {
+                noteAmbiguousEvent(state);
+            }
+        };
         const failed = () => {
             if (active.get(identity)?.epoch === watchedEpoch && state.accepting) {
                 state.healthy = false;
                 changed();
             }
         };
-        const projectWatcher = startWatch(input.projectPath, isValidationSourcePath, changed, failed);
-        const handoffWatcher = startWatch(input.handoffPath, (filename) => EVIDENCE_FILE.test(filename), changed, failed);
+        const projectWatcher = startWatch(input.projectPath, isValidationSourcePath, changed, ambiguous, failed);
+        const handoffWatcher = startWatch(input.handoffPath, (filename) => EVIDENCE_FILE.test(filename), changed, ambiguous, failed);
         if (!projectWatcher || !handoffWatcher) {
             projectWatcher?.close();
             handoffWatcher?.close();
@@ -346,10 +498,11 @@ export async function closeValidationFreshnessLease(lease) {
         return;
     }
     state.closing ??= (async () => {
-        state.accepting = false;
         state.watchers.splice(0).forEach((watcher) => {
             watcher.close();
         });
+        await drainAmbiguousEvents(lease, state, state.bindings);
+        state.accepting = false;
         if (state.ttlTimer) {
             clearTimeout(state.ttlTimer);
         }
@@ -386,27 +539,30 @@ export async function bindValidationFreshnessLease(lease, bindings) {
         Date.now() >= state.expiresAt) {
         return false;
     }
+    if (!(await drainAmbiguousEvents(lease, state, bindings))) {
+        return false;
+    }
     let fingerprintBefore;
     try {
         fingerprintBefore = await evidenceFingerprint(state.handoffPath);
         if ((await gitSourceTreeDigest(state.projectPath)) !== bindings.sourceDigest) {
-            invalidateValidationFreshness(lease);
+            invalidateExactEpoch(lease, state);
             return false;
         }
     }
     catch (error) {
         reportClassifiedDegradation('VALIDATION_FRESHNESS_CHECK_FAILED', error);
-        invalidateValidationFreshness(lease);
+        invalidateExactEpoch(lease, state);
         return false;
     }
     if (fingerprintBefore !== state.evidenceFingerprint) {
-        invalidateValidationFreshness(lease);
+        invalidateExactEpoch(lease, state);
         return false;
     }
     const confirmed = active.get(key(lease.projectId, lease.specId));
     if (!confirmed?.healthy ||
         confirmed.epoch !== state.epoch ||
-        confirmed.generation !== state.generation) {
+        confirmed.generation !== lease.generation) {
         return false;
     }
     confirmed.bindings = structuredClone(bindings);
@@ -443,29 +599,32 @@ export async function assertValidationFreshnessBarrier(lease, bindings) {
         candidate.generation !== lease.generation) {
         return false;
     }
+    if (!(await drainAmbiguousEvents(lease, candidate, candidate.bindings))) {
+        return false;
+    }
     let fingerprintBefore;
     try {
         fingerprintBefore = await evidenceFingerprint(candidate.handoffPath);
     }
     catch (error) {
         reportClassifiedDegradation('VALIDATION_FRESHNESS_CHECK_FAILED', error);
-        invalidateValidationFreshness(lease);
+        invalidateExactEpoch(lease, candidate);
         return false;
     }
     if (fingerprintBefore !== candidate.evidenceFingerprint) {
-        invalidateValidationFreshness(lease);
+        invalidateExactEpoch(lease, candidate);
         return false;
     }
     try {
         if (candidate.bindings &&
             (await gitSourceTreeDigest(candidate.projectPath)) !== candidate.bindings.sourceDigest) {
-            invalidateValidationFreshness(lease);
+            invalidateExactEpoch(lease, candidate);
             return false;
         }
     }
     catch (error) {
         reportClassifiedDegradation('VALIDATION_FRESHNESS_CHECK_FAILED', error);
-        invalidateValidationFreshness(lease);
+        invalidateExactEpoch(lease, candidate);
         return false;
     }
     // A generation change invalidates the lease synchronously. Do not wait for
@@ -481,7 +640,7 @@ export async function assertValidationFreshnessBarrier(lease, bindings) {
         fingerprintAfter = undefined;
     }
     if (!state || fingerprintAfter !== fingerprintBefore) {
-        invalidateValidationFreshness(lease);
+        invalidateExactEpoch(lease, candidate);
         return false;
     }
     if (state.generation !== lease.generation) {
@@ -518,7 +677,7 @@ export async function rebaselineValidationFreshnessLeaseAfterRecompute(input) {
         }
         catch (error) {
             reportClassifiedDegradation('VALIDATION_FRESHNESS_CHECK_FAILED', error);
-            invalidateValidationFreshness(input.lease);
+            invalidateExactEpoch(input.lease, before);
             return undefined;
         }
         const after = await readStableState(input.lease);
@@ -549,6 +708,7 @@ export async function resetValidationFreshnessForTests() {
     });
     await Promise.all(leases.map((lease) => closeValidationFreshnessLease(lease)));
     beginQueues.clear();
+    verificationHookForTests = undefined;
 }
 /** Count-only process diagnostic; intentionally absent from the package entrypoint. */
 export function getValidationFreshnessDiagnosticsForTests() {