@rightkit/release 0.6.13 → 0.6.15

package/bin/rightkit-gate.mjs

@@ -28,6 +28,10 @@
 //   rightkit-gate [--base <ref>] [--plan] [--no-cache]
 //                                             run the gate (default base origin/main); --plan prints the scans and runs none;
 //                                             --no-cache (or RK_GATE_CACHE=0) reruns every scan
+//   rightkit-gate --to check|compile|package|qualify|dev|test --route [--platform p] [--commit <rev>]
+//                                             prints one JSON line (schema rightkit-gate.route/1) naming the route this host takes for the
+//                                             stage and the refusal it would meet, and runs nothing: no ownership, snapshot, check, run record
+//                                             or receipt (rightkit#1297; the release canary probes it for every app). Exit 0 answered, 2 not
 //   rightkit-gate check [--repo <dir>] [--commit <rev> | --worktree] [--rule-tier compile|release] [--only <rule,...>] [--list] [--print-baseline] [--baseline <file>]
 //                                             the deterministic stage: the app check (../app-check.mjs), then every class A scan
 //                                             (lockfiles, cargo-deny/audit, secrets, licences, manifests, workflow lint, syntax) over the
@@ -64,20 +68,28 @@
 // SIGINT/SIGTERM stop scheduling, kill every running scan's process tree and exit non-zero listing the scans not run.
 import fs from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
-import { resolveManagedRoots } from "../managed-roots.mjs";
+import { envNamed, gateRunsRoot, resolveManagedRoots } from "../managed-roots.mjs";
+import { resolveBrokerClient, spawnBrokerClient } from "../broker-client.mjs";
 import os from "node:os";
 import path from "node:path";
 import { FOREIGN_PRE_COMMIT, retireHooksIn } from "../hook-retirement.mjs";
 import { fileURLToPath } from "node:url";
-import { BIOME_CONFIG_FILES, ESLINT_CONFIG_FILES, WORKSPACE_RUST_FILE, ancestorConfigChanged, ancestorDirsOf, canonicalJson, defaultSpawn, defaultSpawnAsync, digestScanSet, fileScanCache, findRustfmt, metadataArgs, planScans, runScans, scanDeferrals, scanFailures } from "../deterministic-scans.mjs";
+import { BIOME_CONFIG_FILES, ESLINT_CONFIG_FILES, WORKSPACE_RUST_FILE, ancestorConfigChanged, ancestorDirsOf, canonicalJson, defaultSpawn, defaultSpawnAsync, digestScanSet, fileScanCache, findRustfmt, metadataArgs, planScans, runScans, scanToolPolicyFromPipeline, scanDeferrals, scanFailures } from "../deterministic-scans.mjs";
 import { changedLockNames, parseLock, reach } from "../lock-graph.mjs";
 import { resolveExecutor } from "../gate-executor.mjs";
-import { directPlatform } from "../managed-cargo.mjs";
-import { bindingOf, endRun, readReceipt, RECEIPT_SCHEMA, receiptKey, sameBinding, sameSource, sealedFor, stagesTo, startRun, STAGES, STAGE_SOURCES, writeReceipt } from "../gate-stages.mjs";
+import { ALL_UNITS_ERRORS, ALL_UNITS_EXCEPTIONS_FILE, BROKER_EXCEPTIONS_FILE, BROKER_EXCEPTION_ERRORS, CARGO_WORKSPACE_LIST_FILE, CARGO_WORKSPACE_LIST_KEY, RIGHTKIT_IDENTITY_FILE, authorizeAllUnits, authorizeNoBroker, checkCargoWorkspaceList, describeAllUnitsException, describeBrokerException, isRightKitIdentity, unitsOfSelector } from "../broker-exception.mjs";
+import { SIGNING_REFUSAL_CODES, suiteSigningRefusals } from "../suite-signing-policy.mjs";
+import { gitListRustFiles } from "../signing-files.mjs";
+import { LINUX_BROKER_ROUTE, NO_BROKER_ENV, directPlatform, linuxBrokerDeclared } from "../managed-cargo.mjs";
+import { bindingOf, compileOutputsRecord, compileReuseProblem, endRun, readReceipt, RECEIPT_SCHEMA, receiptKey, sameBinding, sameSource, sealedFor, stagesTo, startRun, STAGES, STAGE_SOURCES, writeReceipt } from "../gate-stages.mjs";
 import { spawnSync as spawnInherit } from "../background-process.mjs";
 import { readDiskPolicy, scratchRoots } from "../disk-policy.mjs";
 import { buildDirectReceipt, directVerdict, resolveTargetDirectory, verifyDirectReceipt, writeDirectDiagnostics } from "../direct-receipt.mjs";
 import { createFreshnessCensus } from "../freshness-census.mjs";
+import { platformDirOf } from "../platform-dir.mjs";
+import { nativeToolRefusal, nativeToolUses } from "../native-tool-planning.mjs";
+import { BUILD_CONTROL_PROTOCOL, HANDSHAKE_PROBE_ID, RUNTIME_MANIFEST_FILE, mergeCapabilityViews, parseRuntimeIdentity, queryBrokerHandshake } from "../broker-handshake.mjs";
+import net from "node:net";
 
 const ZERO = /^0+$/;
 const SAFE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
@@ -91,7 +103,9 @@ export const PARTIAL_EXIT = 3;
 /** The platforms a door run can package: desktop (signed, sealed, installed QA, publisher upload) and mobile (signed, sealed, store test track). */
 export const PLATFORMS = Object.freeze(["mac", "win", "ios", "android"]);
 export const MOBILE_PLATFORMS = Object.freeze(new Set(["ios", "android"]));
-const USAGE = `usage: rightkit-gate --to check|compile|package|qualify|release [--platform mac|win|ios|android] [--tier patch|update] [--receipt-in <file>] [--receipt-out <file>] | rightkit-gate --to check|compile|package|qualify|release --unit npm:@rightkit/<name>|cargo:rightkit-<name> [--receipt-out <file>] | rightkit-gate --to dev|test [--commit <rev>] [-- <right-release args>] | rightkit-gate stage --platform mac|win [--tier patch|update] | rightkit-gate [--base <ref>] [--plan] [--no-cache] | rightkit-gate install-hook | rightkit-gate env-digest | rightkit-gate snapshot [--commit <rev>] [--verify [--env <sha256>]] [--json] | rightkit-gate live-scans --repo <root> | rightkit-gate clippy [<cargo clippy args>] | rightkit-gate env-digest [--snapshot <dir> --commit <sha>] | rightkit-gate check [--repo <dir>] [--commit <rev> | --worktree] [--rule-tier compile|release] [--only <rule,...>] [--list] [--print-baseline] [--baseline <file>] | rightkit-gate check --commit <sha> --full-a --snapshot <dir> | --version`;
+const USAGE = `usage: rightkit-gate --to check|compile|package|qualify|release [--platform mac|win|ios|android] [--tier patch|update] [--receipt-in <file>] [--receipt-out <file>] | rightkit-gate --to check|compile|package|qualify|release --unit npm:@rightkit/<name>|cargo:rightkit-<name> [--receipt-out <file>] | rightkit-gate --to check|compile|package|qualify --units-file <json {"units":[<selector>,...]} written for this run> | rightkit-gate --to check|compile|package|qualify --all-units-exception <id> (RightKit only: its unit is named on every run, or every unit by Adrian's entry in ci/all-units-exceptions.json of the commit) | rightkit-gate --to check|compile|package|qualify [--unit <selector>] --no-broker <exception-id> (Mac and Dell only; Adrian's recorded exception in .rightkit/broker-exceptions.json of the commit) | rightkit-gate --to dev|test [--commit <rev>] [-- <right-release args>] | rightkit-gate --to check|compile|package|qualify|dev|test --route [--platform mac|win|ios|android] [--commit <rev>] | rightkit-gate stage --platform mac|win [--tier patch|update] | rightkit-gate [--base <ref>] [--plan] [--no-cache] | rightkit-gate install-hook | rightkit-gate env-digest | rightkit-gate snapshot [--commit <rev>] [--verify [--env <sha256>]] [--json] | rightkit-gate live-scans --repo <root> | rightkit-gate clippy [<cargo clippy args>] | rightkit-gate env-digest [--snapshot <dir> --commit <sha>] | rightkit-gate check [--repo <dir>] [--commit <rev> | --worktree] [--rule-tier compile|release] [--only <rule,...>] [--list] [--print-baseline] [--baseline <file>] | rightkit-gate check --commit <sha> --full-a --snapshot <dir> | --version`;
+/** The host platform (process.platform) that constructs each platform's artifact; a platform missing here (android) builds on any host. */
+const STAGE_NATIVE_HOST = Object.freeze({ mac: "darwin", ios: "darwin", win: "win32" });
 
 // ---- pure helpers (exported for tests) ----------------------------------------------------------------------
 
@@ -232,13 +246,13 @@ function workspaceMetadata({ root, spawn, cargoCommand, dir, realpath }) {
  * { present, units: [{ name, dir, publish }], cargoDir, uncovered }.
  */
 /**
- * Where the snapshot export lives. The RustRight broker refuses a job whose workspace is on the system volume
- * (RK_INTERNAL_DRIVE_REFUSED: agents never write to the internal drive), and os.tmpdir() is on it on every Mac and Dell, so on a
- * host with a disk-policy scratch root (/Volumes/D/scratch, D:\scratch) the export goes there. RK_GATE_TMPDIR overrides; os.tmpdir()
- * is the fallback where no scratch root exists (CI runners, cloud containers), where plain cargo runs and nothing refuses the system
- * volume. (rightkit#1215)
+ * Where the gate's own temporary files live (cargo-deny's metadata file and config overlay, read by the broker by absolute path). The
+ * RustRight broker refuses paths on the system volume (RK_INTERNAL_DRIVE_REFUSED: agents never write to the internal drive), and
+ * os.tmpdir() is on it on every Mac and Dell, so on a host with a disk-policy scratch root (/Volumes/D/scratch, D:\scratch) they go
+ * there. RK_GATE_TMPDIR overrides; os.tmpdir() is the fallback where no scratch root exists (CI runners, cloud containers). The gate
+ * exports nothing and copies no source: this is not a source location (docs/GATE-CONTRACT.md, 2026-10-29: no export or copy).
  */
-export function exportTmpRoot({ env = process.env, platform = process.platform, exists = fs.existsSync, policy = null } = {}) {
+export function gateTmpRoot({ env = process.env, platform = process.platform, exists = fs.existsSync, policy = null } = {}) {
   if (env.RK_GATE_TMPDIR) return env.RK_GATE_TMPDIR;
   try {
     const roots = scratchRoots(policy ?? readDiskPolicy(), { platform, env });
@@ -248,64 +262,6 @@ export function exportTmpRoot({ env = process.env, platform = process.platform,
   return os.tmpdir();
 }
 
-/** The files cargo metadata, deny and audit read, in the repository root and in every workspace that has a manifest. */
-export const CARGO_INPUT_NAMES = Object.freeze(["Cargo.toml", "Cargo.lock", "deny.toml", "rust-toolchain.toml", "rust-toolchain", ".cargo"]);
-
-/**
- * The Cargo inputs of the live checkout `root` that are not blob-identical to `snapshot`'s (a commit or tree): a changed or deleted
- * tracked input, or any untracked file (ignored ones included, cargo reads them) under those paths. Empty means the broker may scan
- * the primary checkout for exactly the snapshot's result. `manifests` are the snapshot's tracked Cargo.toml paths (posix).
- */
-export function cargoInputsDiffer({ root, snapshot, manifests, spawn = defaultSpawn }) {
-  const git = (...a) => spawn("git", a, { cwd: root });
-  // Every manifest directory and every ancestor up to the root: cargo reads a .cargo/config.toml or a rust-toolchain file from any of them.
-  const dirs = new Set([""]);
-  for (const m of manifests) { const parts = path.posix.dirname(m).split("/").filter((x) => x && x !== "."); for (let i = 1; i <= parts.length; i++) dirs.add(parts.slice(0, i).join("/")); }
-  const dirList = [...dirs];
-  const paths = dirList.flatMap((d) => CARGO_INPUT_NAMES.map((n) => (d ? `${d}/${n}` : n)));
-  // Pathspecs go to git in bounded batches: a repository with many crates (RightKit: ~1000 input paths) overflows Windows' 32767-
-  // character command line in one argv (ENAMETOOLONG on the Dell, 2026-10-27; G4 was the same for rustfmt). Each batch's results
-  // are merged; a failed batch fails the whole listing closed.
-  const batches = pathspecBatches(paths);
-  const listedAll = batches.map((b) => git("ls-tree", "-r", "-z", snapshot, "--", ...b));
-  const badList = listedAll.find((r) => failed(r));
-  if (badList) return [`(cannot list ${snapshot}: ${why(badList)})`];
-  const snap = new Map();
-  for (const listed of listedAll) for (const entry of text(listed).split("\0").filter(Boolean)) { const tab = entry.indexOf("\t"); const [, , id] = entry.slice(0, tab).split(" "); snap.set(entry.slice(tab + 1), id); }
-  const differ = new Set();
-  for (const [p, id] of snap) {
-    const live = path.join(root, ...p.split("/"));
-    let liveId = null;
-    // Cargo reads the live bytes, so the live bytes are hashed raw (`--no-filters`: no clean filter, eol or text attribute can make
-    // two different byte strings look the same). The one accepted difference is an exact CRLF checkout of an LF blob (D13, Dell
-    // 2026-10-27: core.autocrlf), which every TOML/toolchain reader treats as the same newline; anything else differs.
-    try { if (fs.statSync(live).isFile()) { const h = git("hash-object", "--no-filters", "--", live); liveId = failed(h) ? null : text(h).trim(); } } catch { liveId = null; }
-    if (liveId !== id && !isCrlfCheckoutOf({ git, id, live })) differ.add(p);
-  }
-  // Untracked under the input paths, ignored files included: cargo reads a .cargo/config.toml or a deny.toml whether or not git tracks it.
-  for (const batch of batches) {
-    const others = git("ls-files", "-z", "--others", "--", ...batch);
-    if (failed(others)) differ.add(`(cannot list untracked Cargo inputs: ${why(others)})`); // fail closed: an unlisted input is an unknown input
-    else for (const p of text(others).split("\0").filter(Boolean)) if (!snap.has(p)) differ.add(p);
-    // A tracked input the snapshot lacks (added in HEAD after the snapshot, say) is live-only too.
-    const tracked = git("ls-files", "-z", "--", ...batch);
-    if (failed(tracked)) differ.add(`(cannot list tracked Cargo inputs: ${why(tracked)})`);
-    else for (const p of text(tracked).split("\0").filter(Boolean)) if (!snap.has(p)) differ.add(p);
-  }
-  return [...differ].sort();
-}
-
-/** True only when the live file's bytes are exactly blob `id` with every LF written as CRLF (an autocrlf checkout); fails closed. */
-export function isCrlfCheckoutOf({ git, id, live, readFile = fs.readFileSync }) {
-  try {
-    const blob = git("cat-file", "blob", id);
-    if (failed(blob)) return false;
-    const committed = text(blob);
-    if (committed.includes("\r")) return false;
-    return readFile(live, "utf8") === committed.replace(/\n/g, "\r\n");
-  } catch { return false; }
-}
-
 /**
  * Tool caches inside node_modules that nothing installs: test-result caches (vitest), the vite optimizer and bundled-config temp
  * files, transpile and other tool caches (.cache). Some hold code a later step executes, so the environment a verdict carries binds
@@ -1111,21 +1067,32 @@ export const QUIET_LEASE_WAIT_DRAIN_MS = 2 * 60 * 1000;
  * Without `rustright` on PATH, or when the broker refuses, the lane runs without a lease and the gate says so: the tests still run,
  * their verdict is simply taken on a possibly busy host. `o.spawn` is the gate's synchronous spawner.
  */
-export function quietLeaseLane(o, { tag = "rightkit-gate:", reason = "rightkit-gate-quiet-tests", ttlMs: baseTtlMs = QUIET_LEASE_TTL_MS, waitDrainMs = QUIET_LEASE_WAIT_DRAIN_MS, pid = process.pid } = {}) {
+export function quietLeaseLane(o, { tag = "rightkit-gate:", reason = "rightkit-gate-quiet-tests", ttlMs: baseTtlMs = QUIET_LEASE_TTL_MS, waitDrainMs = QUIET_LEASE_WAIT_DRAIN_MS, pid = process.pid, executor = null } = {}) {
+  // The declared Linux broker route (managed-cargo.mjs): its validated client and endpoint, never a PATH lookup.
+  const linuxRoute = executor?.route === LINUX_BROKER_ROUTE && executor.kind === "broker" ? executor : null;
   const which = (cmd) => {
     const r = o.spawn(o.platform === "win32" ? "where" : "which", [cmd]);
     return failed(r) ? null : (text(r).split(/\r?\n/).map((l) => l.trim()).find(Boolean) ?? null);
   };
+  // The client is started the one way every gate child starts it (broker-client.mjs): on Windows `rustright` is rustright.cmd, which node cannot
+  // spawn, so its target .exe is read from the shim and started directly, without a shell.
+  const clientCall = (client, args) => {
+    const platform = o.platform ?? process.platform;
+    if (linuxRoute) return spawnBrokerClient(o.spawn, linuxRoute.client, args, { env: { ...o.env, ...linuxRoute.env } }, { platform, readFile: o.readFile });
+    return spawnBrokerClient(o.spawn, platform === "win32" ? client : "rustright", args, {}, { platform, readFile: o.readFile });
+  };
   return {
     // `want.ttlMs` (from the scan runner): the lane's own bound, every quiet scan's timeout plus a margin, so the lease cannot
     // expire while a quiet suite still runs (each scan is killed at its timeout first).
     acquire: async (want = {}) => {
       const ttlMs = Number.isFinite(want.ttlMs) && want.ttlMs > baseTtlMs ? want.ttlMs : baseTtlMs;
-      // A direct (Linux) host never takes a broker lease, whatever is on PATH (managed-cargo directPlatform).
-      if (directPlatform(o.platform ?? process.platform)) { o.out(`${tag} note: direct host (no broker on ${o.platform ?? process.platform}); quiet test scans run without a broker lease`); return null; }
-      if (!which("rustright")) { o.out(`${tag} note: no rustright on PATH; quiet test scans run without a broker lease`); return null; }
+      if (o.brokerException) { o.out(`${tag} note: ${o.brokerException.note} (${o.brokerException.exceptionId}); quiet test scans run without a broker lease`); return null; }
+      // A direct (Linux) host never takes a broker lease, whatever is on PATH (managed-cargo directPlatform); a declared Linux broker route does.
+      if (directPlatform(o.platform ?? process.platform) && !linuxRoute) { o.out(`${tag} note: direct host (no broker on ${o.platform ?? process.platform}); quiet test scans run without a broker lease`); return null; }
+      const client = linuxRoute ? linuxRoute.client : which("rustright");
+      if (!client) { o.out(`${tag} note: no rustright on PATH; quiet test scans run without a broker lease`); return null; }
       const started = Date.now();
-      const r = o.spawn("rustright", ["quiet", "acquire", "--ttl-ms", String(ttlMs), "--reason", reason, "--wait-drain-ms", String(waitDrainMs), "--holder-pid", String(pid), "--json"]);
+      const r = clientCall(client, ["quiet", "acquire", "--ttl-ms", String(ttlMs), "--reason", reason, "--wait-drain-ms", String(waitDrainMs), "--holder-pid", String(pid), "--json"]);
       if (failed(r)) { o.out(`${tag} note: broker quiet lease refused (${(why(r) || `exit ${r?.status}`).slice(0, 200)}); quiet test scans run without a lease`); return null; }
       let id = null;
       // The CLI prints the broker's QUIET_LEASE event: { type, granted, state, id } when held; a refusal exits non-zero above.
@@ -1135,7 +1102,7 @@ export function quietLeaseLane(o, { tag = "rightkit-gate:", reason = "rightkit-g
       return { id, env: { RUSTRIGHT_QUIET_LEASE: id }, at: Date.now() };
     },
     release: async (id) => {
-      const r = o.spawn("rustright", ["quiet", "release", String(id)]);
+      const r = clientCall(linuxRoute ? linuxRoute.client : (which("rustright") ?? "rustright"), ["quiet", "release", String(id)]);
       if (failed(r)) o.out(`${tag} note: broker quiet lease ${id} release failed (${(why(r) || `exit ${r?.status}`).slice(0, 200)}); it expires on its own`);
       else o.out(`${tag} broker quiet lease ${id} released`);
     },
@@ -1239,19 +1206,106 @@ async function installHook(o, root) {
  * apps/coderight-tauri), else the repository root. Every right-release stage runs there, the sealed set is read from there, and the
  * receipt is keyed to it (receiptKey). Returns { appRoot, appDir } with appDir relative to the repository root, "." at the root.
  */
-export function appRootOf({ root, cwd, exists = fs.existsSync }) {
+export function appRootOf({ root, cwd, exists = fs.existsSync, configDirs = null }) {
   const inside = cwd && (cwd === root || cwd.startsWith(root + path.sep));
-  const hasConfig = (d) => ["right-release.config.json", "right-release.config.mjs"].some((f) => exists(path.join(d, f)));
+  // With `configDirs` (the directories whose committed tree holds a release config: `committedConfigDirs`) the scope is the SELECTED COMMIT's, read from
+  // its tree alone; the checkout's files are never asked, so a newer, dirty or edited checkout cannot move an older commit's app. Without it (callers that
+  // hold no commit) the live checkout answers, as before. Either way the directory the gate was run from is the explicit identity.
+  const hasConfig = configDirs
+    ? (d) => configDirs.has(path.relative(root, d).split(path.sep).join("/") || ".")
+    : (d) => ["right-release.config.json", "right-release.config.mjs"].some((f) => exists(path.join(d, f)));
   // The nearest directory at or above cwd (below the root) that carries a release config is the app; a deeper cwd (apps/foo/src) is apps/foo.
   let appRoot = root;
-  for (let d = path.resolve(cwd); d.startsWith(root) && d !== root; d = path.dirname(d)) { if (hasConfig(d)) { appRoot = d; break; } }
+  if (inside) for (let d = path.resolve(cwd); d.startsWith(root) && d !== root; d = path.dirname(d)) { if (hasConfig(d)) { appRoot = d; break; } }
   return { appRoot, appDir: path.relative(root, appRoot).split(path.sep).join("/") || "." };
 }
 
+/**
+ * The directories (posix, relative to the repository root, "." for the root) that hold a release config in `commit`'s tree: `{ dirs }`, or `{ refusal }` when the
+ * tree cannot be listed. Read with `git ls-tree` of the selected commit, so the answer is the commit's, whatever the checkout holds.
+ */
+export function committedConfigDirs({ git, commit }) {
+  const listed = git("ls-tree", "-r", "--name-only", "-z", commit);
+  if (failed(listed)) return { refusal: `cannot list the files of ${String(commit).slice(0, 12)}: ${why(listed)}` };
+  const dirs = new Set(text(listed).split("\0").filter((f) => /(^|\/)right-release\.config\.(json|mjs)$/.test(f)).map((f) => path.posix.dirname(f)));
+  return { dirs };
+}
+
+/** True when `commit` is RightKit's own repository: its tree holds packages/release/package.json named @rightkit/release (the identity `check` uses for RightKit's own rules). Read from the commit, never the checkout. */
+export function rightkitIdentityAt(git, commit) {
+  const shown = git("show", `${commit}:${RIGHTKIT_IDENTITY_FILE}`);
+  return !failed(shown) && isRightKitIdentity(text(shown));
+}
+
+const UNIT_SELECTOR = /^(?:npm:@rightkit\/[a-z0-9-]+|cargo:rightkit-[a-z0-9-]+)$/;
+
+/**
+ * The unit list of `--units-file <file>`: JSON `{ "units": [ "cargo:rightkit-x", "npm:@rightkit/y", ... ] }` written for this run (not a
+ * committed file: Adrian, 2026-10-31: "a JSON file that is created at that time"). Every entry is a `--unit` selector, once. Throws a usage error.
+ */
+export function readUnitList(readFile, file) {
+  const usage = (what) => Object.assign(new Error(`RK_UNITS_FILE: ${file} ${what}`), { code: "RK_UNITS_FILE" });
+  let parsed;
+  try { parsed = JSON.parse(readFile(file)); } catch (e) { throw usage(`cannot be read as JSON (${e.message})`); }
+  const units = parsed?.units;
+  if (!Array.isArray(units) || !units.length || !units.every((u) => typeof u === "string" && UNIT_SELECTOR.test(u))) throw usage('must be { "units": [ "cargo:rightkit-<name>" | "npm:@rightkit/<name>", ... ] } with at least one unit');
+  const duplicate = units.find((u, i) => units.indexOf(u) !== i);
+  if (duplicate !== undefined) throw usage(`names ${duplicate} more than once`);
+  return units;
+}
+
+/**
+ * RightKit names its unit on every run (#1325, Adrian 2026-10-31: "the unit has to be mentioned. Okay, so either it is one specific unit, or it is
+ * a JSON file that is created at that time, or all with my exception"). A door run with no `--unit` is accepted in RightKit only with
+ * `--units-file` (each listed unit runs as its own unit run, in order, on the one selected commit, stopping at the first that fails) or
+ * `--all-units-exception <id>` (the whole-repository run, by Adrian's entry in the commit's ci/all-units-exceptions.json). Both flags name RightKit
+ * units, so a repository that is not RightKit refuses them. Returns `{ exit }` when the run ends here, or `{}` to go on as a whole door run (the
+ * all-units flag and its id are removed from `args`). An unresolvable commit is runStages' own refusal, so it goes on.
+ */
+export async function rightkitDoorRule(o, args, root, git, io, { unitsFileFlag, allUnitsFlag, unitList }) {
+  const tag = "rightkit-gate:";
+  const option = (name) => { const i = args.indexOf(name); return i < 0 ? undefined : args[i + 1]; };
+  let pinned;
+  try { pinned = (await import("../snapshot.mjs")).resolveCommit(root, option("--commit") ?? "HEAD"); } catch { return {}; }
+  const inRightKit = rightkitIdentityAt(git, pinned.commit);
+  if (!inRightKit) {
+    if (!unitsFileFlag && !allUnitsFlag) return {};
+    o.err(`${tag} BLOCKED: ${unitsFileFlag ? "--units-file" : "--all-units-exception"} names RightKit units and ${pinned.commit.slice(0, 12)} is not RightKit; every other repository is built whole from the ${CARGO_WORKSPACE_LIST_KEY} list committed in ${CARGO_WORKSPACE_LIST_FILE}, with no unit named; nothing ran`);
+    return { exit: 1 };
+  }
+  if (unitsFileFlag) {
+    const stage = option("--to");
+    const given = args.filter((a, i) => a.startsWith("--") && args[i - 1] !== "--units-file" && a !== "--units-file");
+    if (given.some((a) => a !== "--to" && a !== "--commit")) { o.err(`${tag} a unit list run takes only --to, --units-file and optional --commit (a receipt is written per unit run: run the unit alone with --receipt-out)`); return { exit: 2 }; }
+    for (const [i, selector] of unitList.entries()) {
+      o.out(`${tag} unit list ${i + 1}/${unitList.length}: ${selector} on commit ${pinned.commit.slice(0, 12)}`);
+      const code = await main(["--to", stage, "--unit", selector, "--commit", pinned.commit], io);
+      if (code !== 0) { o.err(`${tag} BLOCKED: unit ${selector} ended with exit ${code}; ${unitList.length - i - 1} unit(s) of the list did not run`); return { exit: code }; }
+    }
+    return { exit: 0 };
+  }
+  if (allUnitsFlag) {
+    const id = option("--all-units-exception");
+    let granted;
+    try {
+      const shown = git("show", `${pinned.commit}:${ALL_UNITS_EXCEPTIONS_FILE}`);
+      granted = authorizeAllUnits({ id, record: failed(shown) ? null : text(shown), now: o.now ? o.now() : Date.now() });
+    } catch (e) {
+      if (!e.code?.startsWith("RK_ALL_UNITS_")) throw e;
+      o.err(`${tag} BLOCKED: ${e.message}; nothing ran`);
+      return { exit: e.code === ALL_UNITS_ERRORS.usage ? 2 : 1 };
+    }
+    args.splice(args.indexOf("--all-units-exception"), 2);
+    o.out(`${tag} ALL UNITS EXCEPTION ${describeAllUnitsException(granted)}`);
+    return {};
+  }
+  o.err(`${tag} BLOCKED: RK_UNIT_NOT_NAMED: RightKit names its unit on every run: --unit <cargo:rightkit-name|npm:@rightkit/name>, --units-file <json written for this run>, or --all-units-exception <id> (Adrian's entry in ${ALL_UNITS_EXCEPTIONS_FILE}); a whole-repository run is never the default; nothing ran`);
+  return { exit: 1 };
+}
+
 async function runStages(o, args, root, git, io) {
   const option = (name) => { const i = args.indexOf(name); return i < 0 ? undefined : args[i + 1]; };
   const tag = "rightkit-gate:";
-  const { appRoot, appDir } = appRootOf({ root, cwd: o.cwd, exists: o.exists });
   const to = option("--to");
   // dev and test are door stages like the rest: the same commit-only route (select a commit, sync its snapshot under ownership, class A
   // of the snapshot), then right-release dev|test with the snapshot's app root as its cwd. They have no stage list of their own.
@@ -1272,25 +1326,51 @@ async function runStages(o, args, root, git, io) {
   if (mobile && to === "qualify") { o.err(`${tag} --to qualify has no stage for ${platform}: there is no installed-QA lane for a mobile build; qualification is the store's test track after --to release. Run --to package or --to release.`); return 2; }
   if (mobile) stages = stages.filter((s) => s !== "qualify");
   if (stages.includes("release") && !mobile && !["patch", "update"].includes(tier)) { o.err(`${tag} --to release needs --tier patch|update (chosen explicitly, never defaulted)`); return 2; }
+  // The commit this run is for is selected FIRST (--commit <rev>, default HEAD; the door snapshot's commit inside a door run; HEAD on hosted CI, whose runner
+  // checkout is the commit), and the app scope is read from THAT commit's tree (committedConfigDirs): the checkout's present files never decide it.
+  const hosted = o.env.GITHUB_ACTIONS === "true";
+  let selected = null;
+  if (!o.doorSnapshot && !hosted) {
+    const snapModule = await import("../snapshot.mjs");
+    try { selected = snapModule.resolveCommit(root, option("--commit") ?? "HEAD"); }
+    catch (e) {
+      if (o.routeProbe) return await runRouteProbe(o, args, root, git, { to, platform, stages: devTest ? [] : stages, devTest, appDir: "." }); // the probe names the same refusal in its own words
+      o.err(`${tag} cannot resolve ${option("--commit") ?? "HEAD"} to a commit: ${e.message}`); return 2;
+    }
+  }
+  const scopeCommit = o.doorSnapshot ? o.doorSnapshot.commit : selected ? selected.commit : text(git("rev-parse", "HEAD")).trim();
+  const inventory = committedConfigDirs({ git, commit: scopeCommit });
+  if (inventory.refusal) { o.err(`${tag} cannot read the app configuration of the selected commit: ${inventory.refusal}`); return 2; }
+  const { appRoot, appDir } = appRootOf({ root, cwd: o.cwd, configDirs: inventory.dirs });
+  // `--route`: which route this stage takes here and whether it refuses, answered without running anything (rightkit#1297).
+  if (o.routeProbe) return await runRouteProbe(o, args, root, git, { to, platform, stages: devTest ? [] : stages, devTest, appDir });
   // Commit-only build (GATE-CONTRACT §1): on every host (not hosted CI, whose runner checkout is the commit) the door selects a commit
   // (--commit <rev>, default HEAD), takes the host's build ownership, syncs the commit's gate-owned snapshot once, and every stage
-  // below reads that snapshot; the checkout may hold anything and is never a build source. Mac and Dell compile it through the
-  // RustRight snapshot carrier (`deps.snapshotBroker`, item 7 rows 7.20 to 7.24). Interim, until the one cutover commit (decision 2,
-  // "Interim"): Mac and Dell keep the checkout route exactly as it was (clean HEAD, today's package, qualify and `runWorktreeCompile`),
-  // and take the snapshot route ONLY when the carrier is wired (`deps.snapshotBroker`, today only in tests); no flag or environment
-  // variable selects it. Once it is selected any failure refuses; there is no retry on the checkout.
-  if (!o.doorSnapshot && o.env.GITHUB_ACTIONS !== "true" && snapshotRouteSelected(o)) {
-    // The door never sets TAURI_CONFIG or any externalBin override, and refuses to inherit one: Tauri merges it over the commit's own
-    // configuration (tauri-build lib.rs), which would build from a configuration that is not the commit's.
-    if (o.env.TAURI_CONFIG !== undefined) { o.err(`${tag} BLOCKED: RK_TAURI_CONFIG_OVERRIDE: TAURI_CONFIG is set in the environment; it would replace the commit's Tauri configuration (externalBin included) for every build below, so a commit-only build refuses it; nothing ran`); return 1; }
-    // `--to check` compiles nothing (class A of the snapshot: its Cargo scans go through the broker on their own), so it needs no carrier.
-    const refused = to === "check" ? null : snapshotRouteRefusal(o, { rightRelease: devTest });
-    if (refused) { o.err(`${tag} BLOCKED: ${refused.code}: ${refused.message}; nothing ran and the checkout is never built`); return 1; }
+  // below reads that snapshot; the checkout may hold anything and is never a build source. Every non-hosted host takes this route: Mac
+  // and Dell compile it through the RustRight snapshot carrier (`deps.snapshotBroker`, wired by `productionEntryDeps`; item 7 rows 7.20
+  // to 7.24, rightkit#1301), right-release's own children included. Once it is selected any failure refuses; there is no retry on the
+  // checkout, and no flag or environment variable selects another route.
+  // The route and every refusal the door can meet before it takes ownership are `routePlan`'s, the one function the `--route` probe
+  // also answers from (rightkit#1297 L1): the probe and the real run cannot drift, and the door-route parity test compares the two.
+  if (!o.doorSnapshot) {
+    const whichRoute = (cmd) => { const r = o.spawn(o.platform === "win32" ? "where" : "which", [cmd]); return failed(r) ? [] : text(r).split(/\r?\n/).map((l) => l.trim()).filter(Boolean); };
+    const routeExecutor = (o.resolveExecutor ?? resolveExecutor)({ env: o.env, platform: o.platform, exists: o.exists, which: whichRoute, readFile: o.readFile });
+    let decided;
+    try { decided = routePlan(o, { to, stages: devTest ? [] : stages, devTest, executor: routeExecutor, stagePlatform: platform, capabilities: await brokerCapabilityStateWithHandshake(o, { to, executor: routeExecutor }), appConfig: selected && to !== "check" ? routeAppConfig({ git, commit: selected.commit, appDir, platform: devTestPlatform(args) }) : null }); }
+    catch (e) { o.err(`${tag} ${e.message}`); return 2; }
+    if (decided.refusal) { o.err(`${tag} BLOCKED: ${decided.refusal.code}: ${decided.refusal.message}; nothing ran${decided.route === "snapshot" ? " and the checkout is never built" : ""}`); return 1; }
+    const notPublisher = decided.route === "snapshot" ? releaseRouteRefusal(o, { stages, platform }) : null;
+    if (notPublisher) { o.err(`${tag} BLOCKED: ${notPublisher.code}: ${notPublisher.message}; nothing ran and the checkout is never built`); return 1; }
+    // The declared Linux broker admits snapshots only under its own data root: refused before any ownership or sync when the gate's root is elsewhere.
+    if (decided.route === "snapshot" && !hosted) {
+      const snapSync = await import("../snapshot.mjs");
+      const mismatch = await declaredSnapshotRootRefusal(o, routeExecutor, o.snapshotRoot ?? snapSync.snapshotRoot({ platform: o.platform, env: o.env }));
+      if (mismatch) { o.err(`${tag} BLOCKED: ${mismatch.code}: ${mismatch.message}; nothing ran`); return 1; }
+    }
+  }
+  if (!o.doorSnapshot && !hosted) {
     const snap = await import("../snapshot.mjs");
     const { acquireBuildOwnership, ownershipFile } = await import("../build-ownership.mjs");
-    let selected;
-    try { selected = snap.resolveCommit(root, option("--commit") ?? "HEAD"); }
-    catch (e) { o.err(`${tag} cannot resolve ${option("--commit") ?? "HEAD"} to a commit: ${e.message}`); return 2; }
     const snapshotsAt = o.snapshotRoot ?? snap.snapshotRoot({ platform: o.platform, env: o.env });
     let own;
     try { own = (o.acquireOwnership ?? acquireBuildOwnership)({ file: ownershipFile({ platform: o.platform, beside: o.snapshotRoot }), stage: `door:${to}`, snapshot: path.join(snapshotsAt, snap.repositoryOf(root).key), commit: selected.commit, platform: o.platform, env: o.env }); }
@@ -1308,12 +1388,7 @@ async function runStages(o, args, root, git, io) {
       if (r?.released === false && !own.joined) o.err(`${tag} build ownership ${own.handle} kept: ${r.why}`);
     }
   }
-  if (devTest) {
-    // Mac and Dell, until the cutover: the checkout route as it was (class A of the working tree, then right-release on it). Hosted CI's
-    // runner checkout is the commit, so it takes the commit route below without a snapshot.
-    if (!o.doorSnapshot && o.env.GITHUB_ACTIONS !== "true") return await runWorktreeCompile(o, args, root, git, io, to, appRoot);
-    return await runDevTest(o, args, root, git, io, to, appRoot, appDir);
-  }
+  if (devTest) return await runDevTest(o, args, root, git, io, to, appRoot, appDir);
   const ds = o.doorSnapshot ?? null;
   const commit = ds ? ds.commit : text(git("rev-parse", "HEAD")).trim();
   const tree = ds ? ds.tree : text(git("rev-parse", "HEAD^{tree}")).trim();
@@ -1334,8 +1409,8 @@ async function runStages(o, args, root, git, io) {
     const shown = git("show", `${commit}:${f}`); if (!failed(shown)) lockFiles[f] = text(shown);
   }
   const binding = bindingOf({
-    tree, lockFiles, gateFile: fileURLToPath(import.meta.url), executor: executor.kind,
-    toolchain: { classA: { "cargo-deny": version("cargo-deny", ["--version"]), "cargo-audit": version("cargo-audit", ["--version"]), actionlint: version("actionlint", ["-version"]), shellcheck: version("shellcheck", ["--version"]) }, node: process.version, rustc: version(executor.kind === "broker" && executor.cargo[0] === "rustright" ? "rustright" : "rustc", executor.kind === "broker" && executor.cargo[0] === "rustright" ? ["rustc", "-V"] : ["-V"]), pnpm: version("pnpm", ["--version"]) },
+    tree, lockFiles, gateFile: fileURLToPath(import.meta.url), executor: o.brokerException ? `${executor.kind}:exception:${o.brokerException.exceptionId}` : executor.kind,
+    toolchain: { classA: { "cargo-deny": version("cargo-deny", ["--version"]), "cargo-audit": version("cargo-audit", ["--version"]), actionlint: version("actionlint", ["-version"]), shellcheck: version("shellcheck", ["--version"]) }, node: process.version, rustc: version(executor.kind === "broker" && executor.cargo.length > 1 ? executor.cargo[0] : "rustc", executor.kind === "broker" && executor.cargo.length > 1 ? ["rustc", "-V"] : ["-V"]), pnpm: version("pnpm", ["--version"]) },
   });
   // Release writes to R2. The write credential lives only in the trusted publisher: a GitHub Actions job in the protected
   // publication environment, which sets RIGHTKIT_PUBLISHER=github-environment. Hosts and agents never hold it, so the door refuses the
@@ -1351,6 +1426,7 @@ async function runStages(o, args, root, git, io) {
   if (receiptIn !== undefined) {
     let imported = null;
     try { imported = JSON.parse(o.readFile(path.resolve(o.cwd, receiptIn))); } catch { /* refused below */ }
+    if (imported?.brokerException) { o.err(`${tag} BLOCKED: --receipt-in ${receiptIn} was built outside the broker by exception ${imported.brokerException.exceptionId}; it is never taken as a broker-built receipt`); return 1; }
     if (!imported || imported.schema !== RECEIPT_SCHEMA || imported.commit !== commit || !sameSource(imported.binding, binding)) {
       o.err(`${tag} BLOCKED: --receipt-in ${receiptIn} is not a ${RECEIPT_SCHEMA} receipt for ${commit.slice(0, 12)} with this tree, these lockfiles and this gate`);
       return 1;
@@ -1363,6 +1439,8 @@ async function runStages(o, args, root, git, io) {
   const receipt = previous && sameBinding(previous.binding, binding) ? previous
     : previous && sameSource(previous.binding, binding) ? { ...previous, binding, stages: Object.fromEntries(Object.entries(previous.stages ?? {}).filter(([k]) => k !== "check" && k !== "compile")) }
       : { schema: RECEIPT_SCHEMA, commit, app: appDir, binding, stages: {} };
+  // Every run under a broker exception records it in the receipt (broker-exception.mjs): id, Adrian's quote, issue, units and host.
+  if (o.brokerException) receipt.brokerException = o.brokerException;
   const receiptOut = option("--receipt-out");
   const save = () => {
     (o.writeReceipt ?? writeReceipt)({ commonDir, receipt });
@@ -1374,25 +1452,35 @@ async function runStages(o, args, root, git, io) {
   // the door run records the split, so the child can prove which snapshot it may read and which checkout holds its outputs
   // (source-split.mjs). Anywhere else it runs in the app root of the checkout, which hosted CI's runner holds at the commit.
   const sourceOf = ds ? sourceSplitOf({ root, ds, appDir }) : null;
-  const rightRelease = (stage, cliArgs, extraEnv = {}) => {
+  const rightRelease = async (stage, cliArgs, extraEnv = {}) => {
+    // A broker host's child reaches the broker only through this stage's carrier (carried-cargo.mjs): its Cargo calls, and its pnpm, node and QA
+    // steps as adapter jobs with the third-party children's compiles nested under them. Every call is in the gate-owned ledger and is verified
+    // again after the child ends.
+    const carrier = await carrierForChildren({ o, ds, root, git, executor, stage, tag });
+    if (carrier.refusal) { o.err(`${tag} BLOCKED: ${carrier.refusal}; nothing ran`); return false; }
     const run = startRun({ commonDir, commit, tree, stage, ...(sourceOf ? { source: sourceOf } : {}) });
+    let childOk = false;
     try {
       o.out(`${tag} [${stage}] right-release ${cliArgs.join(" ")}${sourceOf ? ` (from the snapshot ${ds.path})` : ""}`);
-      const r = (o.spawnInherit ?? ((cmd, a, opts) => spawnInherit(cmd, a, { ...opts, stdio: "inherit" })))(process.execPath, [cli, ...cliArgs], { cwd: sourceOf ? snapshotAppRootOf(ds.path, appDir) : appRoot, env: { ...o.env, ...run.env, ...extraEnv } });
-      return r.status === 0;
+      const r = (o.spawnInherit ?? ((cmd, a, opts) => spawnInherit(cmd, a, { ...opts, stdio: "inherit" })))(process.execPath, [cli, ...cliArgs], { cwd: sourceOf ? snapshotAppRootOf(ds.path, appDir) : appRoot, env: carriedEnv(carrier, { ...o.env, ...run.env }, extraEnv) });
+      childOk = r.status === 0;
     } finally { endRun(run); }
+    const carriedOk = await carrier.finish({ stage });
+    return childOk && carriedOk;
   };
 
   o.out(`${tag} --to ${to} for ${commit.slice(0, 12)}${appDir === "." ? "" : ` (app ${appDir})`}: ${stages.join(" -> ")}; executor ${executor.kind}`);
   // A later stage on the sealed bytes: check, compile and package already passed for them (in this receipt) and the bytes on disk are
   // the ones they sealed, so they are not run again.
   // The release configs of the commit (under this app) that declare `sidecars`: the commit's config decides on the snapshot route, never the checkout's.
-  const sidecarConfigsOf = () => {
-    const listedConfigs = git("ls-tree", "-r", "--name-only", "-z", commit);
-    return (failed(listedConfigs) ? [] : text(listedConfigs).split("\0").filter((f) => /(^|\/)right-release\.config\.(json|mjs)$/.test(f)).filter((f) => appDir === "." || f.startsWith(`${appDir}/`)))
-      .filter((f) => { try { return /\bsidecars\b/.test(o.readFile(path.join(ds ? ds.path : root, f))); } catch { return false; } });
-  };
+  const sidecarConfigsOf = () => committedSidecarConfigs({ o, git, commit, appDir, base: ds ? ds.path : root });
   const sealedNow = receipt.stages.package?.ok ? (o.sealedFor ?? sealedFor)({ root: appRoot, commit, platform }) : null;
+  // The protected-receipt verifier pulls in the ownership policy modules (and their dependencies): loaded only for a run that qualifies or releases,
+  // so an installed copy that only checks or compiles never needs them (GB-14).
+  const qualifyReuse = stages.includes("qualify") || stages.includes("release") ? await import("../qualify-reuse.mjs") : null;
+  const installedQaReceiptDigest = (...a) => qualifyReuse.installedQaReceiptDigest(...a);
+  const qualifyReuseProblem = (...a) => qualifyReuse.qualifyReuseProblem(...a);
+  const qualifyRecordProblem = (recorded) => (o.qualifyReuseProblem ?? qualifyReuseProblem)({ recorded, sealedNow, repoRoot: appRoot, platform, ...(o.verifyQa !== undefined ? { verify: o.verifyQa } : (o.env.GITHUB_ACTIONS === "true" && o.env.RIGHTKIT_PUBLISHER === "github-environment" ? { verify: null } : {})) });
   const sealedIntact = Boolean(sealedNow && sealedNow.id === receipt.stages.package.sealed && sealedNow.digest === receipt.stages.package.manifestSha256);
   // Every deterministic scan (full class A) runs before any compile, for every door stage. The app rules run at the tier the stage
   // owes: dev, test and package take the compile-tier rules; qualify and release add the release-only rules (approvals, ratified
@@ -1400,16 +1488,36 @@ async function runStages(o, args, root, git, io) {
   // 2026-10-28 change to release tier everywhere was never his decision and blocked HeardRight's dev and test builds).
   const earlyTier = ["qualify", "release"].includes(to) ? "release" : "compile";
   const tierAtLeast = (have, need) => have === "release" || need === "compile";
+  // GB-12 (GATE 36/44/86, E18): Class A admission runs at every stage boundary a door run crosses; an outer receipt boolean or an intact
+  // sealed set never stands in for it. The deterministic scans reuse through their own complete result-cache key (never this receipt's
+  // coarse binding, which names the entry file only), and the live scans (cargo-deny, cargo-audit, pnpm-audit, pnpm-lockfile,
+  // advisory-exceptions) are never cached, so the day's advisories are re-asked on every reuse. The one exception is the trusted
+  // publisher's upload (`--to release` on a desktop platform): it runs no build environment, only uploads bytes whose earlier stages
+  // (Class A included) another job of the same pipeline recorded in the receipt it imported (--receipt-in).
+  const publisherUploadOnly = to === "release" && !mobile;
+  // GB-15: a nested app's Class A runs its executing scans for that app's dependency closure; an app at the repository root is the repository.
+  const appScope = appDir === "." ? [] : ["--scope", appDir];
   for (const stage of stages) {
-    if (stage === "check" && receipt.stages.check?.ok && tierAtLeast(receipt.stages.check.ruleTier ?? "compile", earlyTier)) { o.out(`${tag} [check] already passed (${receipt.stages.check.ruleTier ?? "compile"} tier) for this exact input (commit, tree, lockfiles, gate, toolchain)`); continue; }
-    if (stage === "compile" && receipt.stages.compile?.ok) { o.out(`${tag} [${stage}] already passed for this exact input (commit, tree, lockfiles, gate, toolchain)`); continue; }
-    if ((stage === "check" || stage === "compile" || stage === "package") && sealedIntact) {
+    if (stage === "check" && publisherUploadOnly && receipt.stages.check?.ok && tierAtLeast(receipt.stages.check.ruleTier ?? "compile", earlyTier)) { o.out(`${tag} [check] already passed (${receipt.stages.check.ruleTier ?? "compile"} tier) for this exact input (commit, tree, lockfiles, gate, toolchain)`); continue; }
+    if (stage === "compile" && receipt.stages.compile?.ok) {
+      // GB-13 (GATE E6/E7/E16): a recorded compile stands only while the outputs it recorded are still on disk and the compile environment is
+      // the one it ran in; otherwise the compile runs again, warm (never a cleared target), unless the sealed bytes below carry it.
+      const outputsProblem = (o.compileReuseProblem ?? compileReuseProblem)(receipt.stages.compile, { env: o.env });
+      if (!outputsProblem) { o.out(`${tag} [${stage}] already passed for this exact input (commit, tree, lockfiles, gate, toolchain) and its outputs are intact`); continue; }
+      if (!sealedIntact) o.out(`${tag} [${stage}] the recorded compile no longer stands: ${outputsProblem}; running it again (warm)`);
+    }
+    if (((stage === "check" && publisherUploadOnly) || stage === "compile" || stage === "package") && sealedIntact) {
       o.out(`${tag} [${stage}] already passed for the sealed set ${sealedNow.id} (manifest ${sealedNow.digest.slice(0, 12)})`); continue;
     }
     // The publisher (another runner, often another OS) cannot repeat installed QA; it takes the qualify result recorded for exactly
     // these sealed bytes. --to qualify itself always runs it.
+    // GB-14: the record is reused only while the protected installed-QA receipt it names still verifies over the current state (the existing
+    // verifier: policy bundle, floor, required checks, source, artifact hashes); the publisher, which holds no receipt key, is held to the
+    // recorded receipt digest and the manifest digest, and the upload admission verifies the receipt itself.
     if (stage === "qualify" && to !== "qualify" && sealedIntact && receipt.stages.qualify?.ok && receipt.stages.qualify.manifestSha256 === sealedNow.digest) {
-      o.out(`${tag} [qualify] already passed for the sealed set ${sealedNow.id} (manifest ${sealedNow.digest.slice(0, 12)})`); continue;
+      const problem = qualifyRecordProblem(receipt.stages.qualify);
+      if (!problem) { o.out(`${tag} [qualify] already passed for the sealed set ${sealedNow.id} (manifest ${sealedNow.digest.slice(0, 12)}; protected QA receipt ${receipt.stages.qualify.qaReceiptDigest.slice(0, 12)} verified)`); continue; }
+      o.out(`${tag} [qualify] the recorded result no longer stands: ${problem}; it runs again`);
     }
     // The publisher only uploads. It never checks out a build environment, signs or runs installed QA, so every earlier stage must
     // already stand in its receipt for exactly the sealed bytes on disk; anything else is refused, never rebuilt or requalified here.
@@ -1421,7 +1529,7 @@ async function runStages(o, args, root, git, io) {
     if (ds && !(await openSnapshotStage({ o, ds, root, stage, tag }))) { receipt.stages[stage] = { ok: false, at: new Date().toISOString(), snapshot: { path: ds.path, tree: ds.tree, intactAfter: false }, ownership: ds.own.handle }; save(); o.err(`${tag} --to ${to} stopped before ${stage}: the snapshot is not the commit's bytes plus the ledger; nothing ran`); return 2; }
     let ok = false; const at = new Date().toISOString(); let extra = {}; let directReceipt = null;
     if (stage === "check") {
-      ok = (await (o.runCheck ?? (() => main(["check", "--commit", ds ? commit : "HEAD", "--full-a", ...(ds ? ["--snapshot", ds.path] : []), "--rule-tier", earlyTier], { ...io, cwd: root, ...(ds ? { buildOwnership: ds.own } : {}) })))(earlyTier)) === 0;
+      ok = (await (o.runCheck ?? (() => main(["check", "--commit", ds ? commit : "HEAD", "--full-a", ...(ds ? ["--snapshot", ds.path] : []), ...appScope, "--rule-tier", earlyTier], { ...io, cwd: root, ...(ds ? { buildOwnership: ds.own } : {}) })))(earlyTier)) === 0;
       extra = { ruleTier: earlyTier };
     }
     else if (stage === "compile") {
@@ -1431,15 +1539,17 @@ async function runStages(o, args, root, git, io) {
       ok = true;
       // On the snapshot route the sidecars are staged from the snapshot's own config and sources through right-release's source split
       // (the staged files and receipt land beside the sources the compile reads; the caches and build trees stay the checkout's), before
-      // `main --all` compiles. A broker host reaches Cargo here only through the snapshot carrier, which right-release's children do not
-      // have yet (item 7 row 7.24): it is refused with a code, never staged from the checkout.
-      if (ds && sidecarConfigs.length && executor.kind === "broker") { o.err(`${tag} BLOCKED: RK_SNAPSHOT_CARRIER_NOT_WIRED: [compile] ${sidecarConfigs.join(", ")} stage sidecars through right-release, whose Cargo calls reach the RustRight broker only through the snapshot carrier (item 7 row 7.24), which is not wired; nothing compiled`); ok = false; }
+      // `main --all` compiles. A broker host's stage-sidecar child reaches Cargo through the stage's carrier (carried-cargo.mjs).
       // right-release runs in appRoot (nested apps), so the repository-relative config is handed over absolute (Astra, second pass).
       // On the snapshot route sidecars are staged ONCE per door run by the ledger bookkeeping (attribution diff, immutable staged entries).
-      if (ok && ds) ok = await stageSidecarsOnce({ o, ds, root, configs: sidecarConfigs, appDir, cli, commonDir, commit, tree, stage });
-      else for (const config of ok ? sidecarConfigs : []) if (!rightRelease(stage, ["stage-sidecar", "--config", path.join(root, config)])) { ok = false; break; }
-      if (ok) ok = (await (o.runCompile ?? (() => main(ds ? ["--all", "--commit", commit, "--snapshot", ds.path] : ["--all"], { ...io, cwd: root, readStdin: () => "", ...(ds ? { buildOwnership: ds.own, snapshotLedger: ds.ledger?.entries ?? [], onCompileLedger: (entries) => { ds.compileAdmitted = entries; }, onDirectReceipt: (r) => { directReceipt = r; } } : {}) })))()) === 0;
+      if (ok && ds) ok = await stageSidecarsOnce({ o, ds, root, git, configs: sidecarConfigs, appDir, cli, commonDir, commit, tree, stage, executor });
+      else for (const config of ok ? sidecarConfigs : []) if (!await rightRelease(stage, ["stage-sidecar", "--config", path.join(root, config)])) { ok = false; break; }
+      let compiledDirs = [];
+      const reportOutputs = (dirs) => { compiledDirs = [...dirs]; };
+      if (ok) ok = (await (o.runCompile ?? (() => main(ds ? ["--all", "--commit", commit, "--snapshot", ds.path] : ["--all"], { ...io, cwd: root, readStdin: () => "", ...(ds ? { buildOwnership: ds.own, snapshotLedger: ds.ledger?.entries ?? [], onCompileLedger: (entries) => { ds.compileAdmitted = entries; }, onDirectReceipt: (r) => { directReceipt = r; }, onCompileOutputs: reportOutputs } : {}) })))({ reportOutputs })) === 0;
       if (directReceipt) extra = { ...extra, direct: directReceipt };
+      // What this compile produced, recorded with its result so a later run can prove the outputs are still there (GB-13).
+      if (ok) extra = { ...extra, outputs: compileOutputsRecord({ dirs: compiledDirs, env: o.env }) };
       // The cross-check with `.rightkit/compile-inputs.json`: a declared input that covers ledger entries must carry the digest of those
       // very bytes in the compile receipt (the broker digests declared inputs in place in the snapshot, BC:39).
       if (ok && ds && directReceipt?.declaredInputDigests) {
@@ -1454,29 +1564,61 @@ async function runStages(o, args, root, git, io) {
       // compile was already passed (a separately invoked `--to package` re-stages after the sync, so it never meets a missing externalBin).
       // right-release then takes its identity from the selected commit and the verified snapshot (release-source-identity.mjs, row 7.04),
       // never the checkout's HEAD, status or branch; its outputs, state and the sealed directory stay in the checkout's `.right-release`.
-      ok = ds ? await stageSidecarsOnce({ o, ds, root, configs: sidecarConfigsOf(), appDir, cli, commonDir, commit, tree, stage, executor }) : true;
+      ok = ds ? await stageSidecarsOnce({ o, ds, root, git, configs: sidecarConfigsOf(), appDir, cli, commonDir, commit, tree, stage, executor }) : true;
       // Source QA (right-release qa --stage source) exists for mac and win only; a mobile package is the signed build alone.
       // Row 7.04c (R-T1, 7.09): the snapshot holds no Cargo target. On a direct host the checkout's output directory is resolved here, in the primary
       // checkout, and handed to right-release absolute: it binds every manifest's target for this stage, and the sealed manifest must record it back
       // (the door never trusts the child's value alone). One workspace is pinned as a whole; several are refused, naming them. A broker host's target
-      // is the carrier's (rows 7.20 to 7.24), which this gate does not call yet.
+      // is the carrier's (rows 7.20 to 7.24): the carried calls' signed receipts name it (carried-cargo.mjs), and no CARGO_TARGET_DIR is passed.
       let packagePin = { dir: null };
       if (ok && ds && executor.kind !== "broker") {
-        packagePin = cargoOutputPin({ o, git, root, commit, executor });
+        packagePin = await cargoOutputPinForScope({ o, git, root, commit, executor, snapshot: ds.path, ...(appDir === "." ? {} : { scopeDirs: [appDir] }) });
         if (packagePin.refusal) { o.err(`${tag} BLOCKED: RK_SNAPSHOT_OUTPUT_UNPINNED: [package] ${packagePin.refusal}; nothing was built`); ok = false; }
         else if (packagePin.dir) o.out(`${tag} [package] output directory for the Cargo workspace: ${packagePin.dir} (the checkout's)`);
       }
-      const packageEnv = packagePin.dir ? { CARGO_TARGET_DIR: packagePin.dir } : {};
-      ok = ok && (mobile || rightRelease(stage, ["qa", "--stage", "source", "--platform", platform], packageEnv)) && rightRelease(stage, ["build", "--platform", platform], packageEnv);
+      // GB-17: several Cargo workspaces: each of right-release's and its children's Cargo calls is bound to ITS workspace's target through the per-call wrapper.
+      let packageMulti = null;
+      if (ok && packagePin.dirs?.length > 1) {
+        packageMulti = await bindUnitCargo({ o, git, root, ds, executor, which: whichIn(o), ...(appDir === "." ? {} : { scopeDirs: [appDir] }) });
+        if (packageMulti.refusal) { o.err(`${tag} BLOCKED: RK_SNAPSHOT_OUTPUT_UNPINNED: [package] ${packageMulti.refusal}; nothing was built`); ok = false; }
+        else if (packageMulti.note) o.out(`${tag} [package] ${packageMulti.note}`);
+      }
+      const packageEnv = packagePin.dir ? { CARGO_TARGET_DIR: packagePin.dir } : (packageMulti?.env ?? {});
+      ok = ok && (mobile || await rightRelease(stage, ["qa", "--stage", "source", "--platform", platform], packageEnv)) && await rightRelease(stage, ["build", "--platform", platform], packageEnv);
       const sealed = ok ? (o.sealedFor ?? sealedFor)({ root: appRoot, commit, platform }) : null;
       if (ok && !sealed) { o.err(`${tag} [package] the build reported success but sealed nothing for ${commit.slice(0, 8)} on ${platform}`); ok = false; }
       if (sealed) extra = { platform, sealed: sealed.id, manifestSha256: sealed.digest };
       // The cross-check: the Cargo targets the sealed manifest records are the directory this door resolved itself. A different one voids the stage.
-      if (ok && sealed && ds && packagePin.dir) {
+      try { packageMulti?.cleanup?.(); } catch { /* the wrapper's map is the gate's own temp directory */ }
+      if (ok && sealed && ds && (packagePin.dir || packagePin.dirs?.length > 1)) {
+        let recorded = null;
+        try { recorded = JSON.parse(String(o.readFile(sealed.manifest))).boundTargets ?? null; } catch { recorded = null; }
+        const { crossCheckBoundTargets, SPLIT_TARGET_DRIFT_CODE } = await import("../release-artifact-path.mjs");
+        const drift = crossCheckBoundTargets({ recorded, expected: packagePin.dirs });
+        if (drift.length) {
+          for (const problem of drift.slice(0, 10)) o.err(`${tag} ${SPLIT_TARGET_DRIFT_CODE}: [package] ${problem}`);
+          const closedDrift = await closeSnapshotStage({ o, ds, root, stage, step: stage, tag });
+          receipt.stages[stage] = { ok: false, at, voided: SPLIT_TARGET_DRIFT_CODE, ...extra, snapshot: { path: ds.path, tree: ds.tree, intactAfter: closedDrift.ok }, ownership: ds.own.handle };
+          save();
+          o.err(`${tag} --to ${to} stopped at ${stage}: ${SPLIT_TARGET_DRIFT_CODE}; the sealed set is void and nothing after it ran`);
+          return 2;
+        }
+      }
+      // A broker host's Cargo target is the carrier's: every target the sealed manifest records is a directory a verified, signed receipt of this
+      // stage named (`outputDir`), never one the child alone reported.
+      if (ok && sealed && ds && executor.kind === "broker") {
         let recorded = null;
         try { recorded = JSON.parse(String(o.readFile(sealed.manifest))).boundTargets ?? null; } catch { recorded = null; }
         const { crossCheckBoundTargets, SPLIT_TARGET_DRIFT_CODE } = await import("../release-artifact-path.mjs");
-        const drift = crossCheckBoundTargets({ recorded, expected: [packagePin.dir] });
+        // The commit's workspaces decide whether a bound target is owed; the receipts compared are THIS package stage's own (rightkit#1301 L1).
+        const owed = Object.keys(await snapshotCargoWorkspaces({ git, ds, root })).length > 0;
+        const want = [...(ds.carriedByStage?.[stage] ?? [])];
+        let drift = [];
+        if (owed) {
+          if (!Array.isArray(recorded) || !recorded.length) drift = ["the sealed manifest records no bound Cargo target; a broker host's package stage binds the output directory its carried build's receipt named"];
+          else if (!want.length) drift = ["no verified receipt of this package stage names an output directory, so the recorded target cannot be checked"];
+          else drift = crossCheckBoundTargets({ recorded, expected: want });
+        }
         if (drift.length) {
           for (const problem of drift.slice(0, 10)) o.err(`${tag} ${SPLIT_TARGET_DRIFT_CODE}: [package] ${problem}`);
           const closedDrift = await closeSnapshotStage({ o, ds, root, stage, step: stage, tag });
@@ -1497,21 +1639,23 @@ async function runStages(o, args, root, git, io) {
         // store); the release tier is owed first, as for desktop qualification.
         const releaseTier = receipt.stages.check?.ok && receipt.stages.check.ruleTier === "release"
           ? (o.out(`${tag} [release] the release tier already passed at check for this exact input; not run again`), 0)
-          : await (o.runReleaseCheck ?? (() => main(["check", "--commit", ds ? commit : "HEAD", "--full-a", ...(ds ? ["--snapshot", ds.path] : []), "--rule-tier", "release"], { ...io, cwd: root, ...(ds ? { buildOwnership: ds.own } : {}) })))();
+          : await (o.runReleaseCheck ?? (() => main(["check", "--commit", ds ? commit : "HEAD", "--full-a", ...(ds ? ["--snapshot", ds.path] : []), ...appScope, "--rule-tier", "release"], { ...io, cwd: root, ...(ds ? { buildOwnership: ds.own } : {}) })))();
         if (releaseTier !== 0) { o.err(`${tag} [release] the release tier (every rule and scan) is red for ${commit.slice(0, 12)}; nothing was uploaded`); ok = false; }
-        else ok = rightRelease(stage, ["upload", "--platform", platform, "--release", sealed.sealed, "--apply"]);
+        else ok = await rightRelease(stage, ["upload", "--platform", platform, "--release", sealed.sealed, "--apply"]);
         extra = { sealed: sealed.sealed, manifestSha256: sealed.manifestSha256, track: platform === "ios" ? "testflight" : "play-internal", ruleTier: "release" };
       } else if (stage === "qualify") {
         // Qualification owes the release tier: every rule and scan, the ones held out of compile admission included (app-check.mjs TIERS).
         const releaseTier = receipt.stages.check?.ok && receipt.stages.check.ruleTier === "release"
           ? (o.out(`${tag} [qualify] the release tier already passed at check for this exact input; not run again`), 0)
-          : await (o.runReleaseCheck ?? (() => main(["check", "--commit", ds ? commit : "HEAD", "--full-a", ...(ds ? ["--snapshot", ds.path] : []), "--rule-tier", "release"], { ...io, cwd: root, ...(ds ? { buildOwnership: ds.own } : {}) })))();
+          : await (o.runReleaseCheck ?? (() => main(["check", "--commit", ds ? commit : "HEAD", "--full-a", ...(ds ? ["--snapshot", ds.path] : []), ...appScope, "--rule-tier", "release"], { ...io, cwd: root, ...(ds ? { buildOwnership: ds.own } : {}) })))();
         if (releaseTier !== 0) { o.err(`${tag} [qualify] the release tier (every rule and scan) is red for ${commit.slice(0, 12)}; nothing was qualified`); ok = false; }
-        else ok = rightRelease(stage, ["qa", "--stage", "installed", "--platform", platform, "--release", sealed.sealed]);
-        extra = { sealed: sealed.sealed, manifestSha256: sealed.manifestSha256, ruleTier: "release" };
+        else ok = await rightRelease(stage, ["qa", "--stage", "installed", "--platform", platform, "--release", sealed.sealed]);
+        // The protected installed-QA receipt this run produced is journaled by digest (GB-14), so the record can be re-verified before any reuse.
+        extra = { sealed: sealed.sealed, manifestSha256: sealed.manifestSha256, ruleTier: "release", ...(ok ? { qaReceiptDigest: (o.installedQaReceiptDigest ?? installedQaReceiptDigest)({ repoRoot: appRoot, releaseId: sealed.sealed, platform }) } : {}) };
       } else {
         if (!receipt.stages.qualify?.ok || receipt.stages.qualify.manifestSha256 !== sealed.manifestSha256) { o.err(`${tag} BLOCKED: [release] the sealed set was not qualified (installed QA) in this door run's receipt`); ok = false; }
-        else { ok = rightRelease(stage, ["upload", "--release", sealed.sealed, "--platform", platform, "--tier", tier]); extra = { sealed: sealed.sealed, manifestSha256: sealed.manifestSha256, tier }; }
+        else if (qualifyRecordProblem(receipt.stages.qualify)) { o.err(`${tag} BLOCKED: [release] the recorded qualification no longer stands: ${qualifyRecordProblem(receipt.stages.qualify)}; nothing was uploaded`); ok = false; }
+        else { ok = await rightRelease(stage, ["upload", "--release", sealed.sealed, "--platform", platform, "--tier", tier]); extra = { sealed: sealed.sealed, manifestSha256: sealed.manifestSha256, tier }; }
       }
     }
     if (ds) {
@@ -1550,7 +1694,9 @@ function stageForPublisher(o, args, root, git) {
   const common = text(git("rev-parse", "--git-common-dir")).trim();
   if (!/^[0-9a-f]{40}$/.test(commit) || !common) { o.err(`${tag} cannot read HEAD and the git directory`); return 2; }
   const commonDir = path.resolve(root, common);
-  const { appRoot, appDir } = appRootOf({ root, cwd: o.cwd, exists: o.exists });
+  const inventory = committedConfigDirs({ git, commit });
+  if (inventory.refusal) { o.err(`${tag} cannot read the app configuration of ${commit.slice(0, 12)}: ${inventory.refusal}`); return 2; }
+  const { appRoot, appDir } = appRootOf({ root, cwd: o.cwd, configDirs: inventory.dirs });
   const receipt = (o.readReceipt ?? readReceipt)({ commonDir, commit, app: appDir });
   const pack = receipt?.stages?.package; const qual = receipt?.stages?.qualify;
   const sealed = pack?.ok ? (o.sealedFor ?? sealedFor)({ root: appRoot, commit, platform }) : null;
@@ -1565,7 +1711,7 @@ function stageForPublisher(o, args, root, git) {
     const receiptFile = path.join(work, `receipt-${platform}.json`);
     fs.writeFileSync(receiptFile, `${JSON.stringify(receipt, null, 2)}\n`);
     const archive = path.join(work, `sealed-${platform}.tar.gz`);
-    const tar = o.spawn("tar", ["-czf", archive, "-C", appRoot, path.join(".right-release", "sealed", sealed.id, platform)]);
+    const tar = o.spawn("tar", ["-czf", archive, "-C", appRoot, path.join(".right-release", "sealed", sealed.id, platformDirOf(platform))]);
     if (failed(tar)) { o.err(`${tag} could not pack ${sealed.id}/${platform}`); return 1; }
     const gh = (...a) => o.spawn("gh", a, { cwd: root });
     if (failed(gh("release", "view", releaseTag))) {
@@ -1663,30 +1809,41 @@ export async function closeSnapshotStage({ o, ds, root, stage, step = "stage", t
   return { ok: true, entries };
 }
 
+/** The release configs of `commit` (under `appDir`) that declare `sidecars`, read from `base` (the snapshot on the snapshot route): the commit's config decides, never the checkout's. */
+export function committedSidecarConfigs({ o, git, commit, appDir = ".", base }) {
+  const listedConfigs = git("ls-tree", "-r", "--name-only", "-z", commit);
+  return (failed(listedConfigs) ? [] : text(listedConfigs).split("\0").filter((f) => /(^|\/)right-release\.config\.(json|mjs)$/.test(f)).filter((f) => appDir === "." || f.startsWith(`${appDir}/`)))
+    .filter((f) => { try { return /\bsidecars\b/.test(o.readFile(path.join(base, f))); } catch { return false; } });
+}
+
 /**
  * Sidecars are staged ONCE per door run, after the sync and before the first stage that builds the Tauri crate. The step is
  * right-release's own `stage-sidecar --json` run inside the snapshot (the split); this gate then walks the snapshot itself and the
  * step's additions must equal the files it reported plus its receipt (anything else is an unattributed write, RK_CHECK_ERROR). The
  * staged files become immutable `staged` ledger entries. Returns true when nothing is owed or staging passed.
  */
-export async function stageSidecarsOnce({ o, ds, root, configs, appDir, cli, commonDir, commit, tree, stage, executor = null, tag = "rightkit-gate:" }) {
+export async function stageSidecarsOnce({ o, ds, root, git = null, configs, appDir, cli, commonDir, commit, tree, stage, executor = null, tag = "rightkit-gate:" }) {
   if (ds.sidecarsStaged) return true;
   ds.sidecarsStaged = true;
   if (!configs.length) return true;
-  if (executor?.kind === "broker") { o.err(`${tag} BLOCKED: RK_SNAPSHOT_CARRIER_NOT_WIRED: [${stage}] ${configs.join(", ")} stage sidecars through right-release, whose Cargo calls reach the RustRight broker only through the snapshot carrier (item 7 row 7.24); nothing was staged`); return false; }
   const { attributionProblems, reportedPaths } = await import("../stage-ledger.mjs");
   const source = sourceSplitOf({ root, ds, appDir });
   const { TAURI_CONFIG: inherited, ...cleanEnv } = o.env; void inherited; // never set or pass one (refused at the door's start)
   for (const config of configs) {
     const before = ds.ledger?.entries ?? [];
+    // The stage-sidecar child's Cargo calls (its builds and metadata queries) are carried on a broker host (carried-cargo.mjs).
+    const carrier = await carrierForChildren({ o, ds, root, git, executor, stage, tag });
+    if (carrier.refusal) { o.err(`${tag} BLOCKED: ${carrier.refusal}; nothing was staged`); return false; }
     const run = startRun({ commonDir, commit, tree, stage, source });
     let r;
     try {
       o.out(`${tag} [${stage}] right-release stage-sidecar --config ${path.join(ds.path, config)} (from the snapshot ${ds.path})`);
-      r = (o.spawnCapture ?? ((cmd, a, opts) => spawnInherit(cmd, a, { ...opts, encoding: "utf8", maxBuffer: 1 << 26 })))(process.execPath, [cli, "stage-sidecar", "--config", path.join(ds.path, config), "--json"], { cwd: snapshotAppRootOf(ds.path, appDir), env: { ...cleanEnv, ...run.env } });
+      r = (o.spawnCapture ?? ((cmd, a, opts) => spawnInherit(cmd, a, { ...opts, encoding: "utf8", maxBuffer: 1 << 26 })))(process.execPath, [cli, "stage-sidecar", "--config", path.join(ds.path, config), "--json"], { cwd: snapshotAppRootOf(ds.path, appDir), env: carriedEnv(carrier, { ...cleanEnv, ...run.env }) });
     } finally { endRun(run); }
+    const carriedOk = await carrier.finish({ stage });
     if (r?.stderr) o.err(String(r.stderr).trimEnd());
     if (!r || r.status !== 0) { o.err(`${tag} [${stage}] stage-sidecar for ${config} failed${r?.error ? ` (${r.error.message})` : ""}`); return false; }
+    if (!carriedOk) return false;
     let result;
     try { result = JSON.parse(String(r.stdout ?? "").trim()); } catch { o.err(`${tag} RK_CHECK_ERROR: [${stage}] stage-sidecar --json for ${config} did not print its result; its writes cannot be attributed`); return false; }
     let walked;
@@ -1702,44 +1859,116 @@ export async function stageSidecarsOnce({ o, ds, root, configs, appDir, cli, com
   return true;
 }
 
-/**
- * The Cargo binding of a unit stage built from a snapshot (row 7.06a; decision 2 Q3, as for any npm unit): a unit's test or pack that
- * reaches Cargo must never write `target/` into the snapshot. Every tracked Cargo.toml of the commit is asked, in the CHECKOUT, for its
- * workspace and `target_directory`. Linux and any POSIX host with a direct executor put the runtime wrapper (cargo-target-shim.mjs)
- * first on PATH and name it in CARGO, so each cargo call binds its own workspace's checkout target or is refused. A broker host
- * (`o.snapshotBroker`) uses the same wrapper in broker mode, one carried request per call with its own receipt. A direct Windows host has
- * no wrapper: one workspace is pinned by CARGO_TARGET_DIR, several are refused. Returns `{ env, note, cleanup }` or `{ refusal }`.
- */
-async function bindUnitCargo({ o, git, root, ds, executor, which }) {
-  const listed = git("ls-tree", "-r", "--name-only", "-z", ds.commit);
-  if (failed(listed)) return { refusal: `cannot list the files of ${ds.commit.slice(0, 12)}: ${why(listed)}` };
-  const manifests = text(listed).split("\0").filter((f) => f === "Cargo.toml" || f.endsWith("/Cargo.toml"));
-  if (!manifests.length) return { env: {}, note: null, cleanup() {} };
+/** Hosted CI scans its committed runner checkout. Raw-tree verification defeats filters or a stale index hiding edits. */
+async function verifyCommittedCheckout({ git, root, commit, tree, when }) {
+  const head = git("rev-parse", "--verify", "HEAD^{commit}");
+  const dirty = git("status", "--porcelain", "--untracked-files=all");
+  if (failed(head) || text(head).trim() !== commit || failed(dirty) || text(dirty).trim()) throw new Error(`hosted CI checkout is not clean commit ${commit} ${when}`);
+  const { commitOf } = await import("../snapshot-check.mjs");
+  const identity = commitOf(root, commit);
+  if (identity.commit !== commit || identity.tree !== tree) throw new Error(`hosted CI commit identity changed ${when}`);
+  const { snapshotTree } = await import("../snapshot.mjs");
+  const actual = snapshotTree({ checkout: root, dir: root, baseTree: identity.tree });
+  if (actual !== tree) throw new Error(`hosted CI checkout is raw tree ${actual}, not tree ${tree} of commit ${commit} ${when}`);
+}
+
+/** Select output-binding workspaces from committed source before any Cargo metadata process runs. */
+async function committedCargoManifests({ o, git, root, commit, scopeDirs }) {
+  const listed = git("ls-tree", "-r", "--name-only", "-z", commit);
+  if (failed(listed)) throw new Error(`cannot list the files of ${commit.slice(0, 12)}: ${why(listed)}`);
+  const files = text(listed).split("\0").filter(Boolean).map(posix);
+  const tracked = (name) => files.filter((f) => f === name || f.endsWith(`/${name}`));
+  const allManifests = tracked("Cargo.toml");
+  if (!scopeDirs?.length) return { manifests: allManifests, hasCargo: allManifests.length > 0 };
+  const fileSet = new Set(files);
+  const readCommitted = (file) => {
+    if (!fileSet.has(file)) throw new Error(`RK_SCOPE_CLOSURE: ${file} is absent from commit ${commit}`);
+    const r = git("show", `${commit}:${file}`);
+    if (failed(r)) throw new Error(`RK_SCOPE_CLOSURE: cannot read ${file} of commit ${commit}: ${why(r)}`);
+    return text(r);
+  };
+  const relative = (file) => posix(path.relative(root, file));
+  const readFile = (file) => readCommitted(relative(file));
+  const exists = (file) => { const rel = relative(file); return fileSet.has(rel) || files.some((f) => f.startsWith(`${rel}/`)); };
+  let fixtures = [];
+  if (fileSet.has(GATE_CONFIG)) {
+    const config = JSON.parse(readCommitted(GATE_CONFIG));
+    if (Array.isArray(config.fixtures)) fixtures = config.fixtures.filter((d) => typeof d === "string");
+  }
+  const tools = await import("../app-closure.mjs");
+  const sourceMetadata = tools.cargoMetadataFromManifests({ manifests: tracked("Cargo.toml").filter((m) => !fixtures.some((d) => m.startsWith(`${d.replace(/\/$/, "")}/`))), readFile: readCommitted });
+  const inventory = discoverRustWorkspaces({ root, tracked, fixtures, readFile, metadata: sourceMetadata });
+  const npm = discoverNpmUnits({ root, tracked, readFile, exists });
+  const closure = tools.closureOf({ scopeDirs, npmUnits: npm, rustUnits: inventory.units, readFile: readCommitted });
+  const workspaces = [...new Set(inventory.units.filter((u) => closure.rust.has(u.name)).map((u) => u.cargoDir))].sort();
+  o.out(`rightkit-gate: Cargo output scope ${scopeDirs.join(", ")}: ${workspaces.length} workspace(s) (${workspaces.join(", ") || "none"}); dependency directories ${closure.dependencyDirs.join(", ")}`);
+  return { manifests: workspaces.map((dir) => path.posix.join(dir, "Cargo.toml")), hasCargo: allManifests.length > 0 };
+}
+
+async function cargoOutputPinForScope(options) {
+  try { return cargoOutputPin({ ...options, manifests: (await committedCargoManifests(options)).manifests }); }
+  catch (error) { return { refusal: error.message }; }
+}
+
+/** Bind only committed closure workspaces to checkout outputs; runtime Cargo outside that map refuses. */
+async function bindUnitCargo({ o, git, root, ds, executor, which, scopeDirs }) {
+  let selection;
+  try { selection = await committedCargoManifests({ o, git, root, commit: ds.commit, scopeDirs }); }
+  catch (error) { return { refusal: error.message }; }
+  const { manifests, hasCargo } = selection;
+  if (!hasCargo) return { env: {}, note: null, cleanup() {} };
+  // A scoped npm stage with no declared Rust dependency still gets an empty runtime map: reaching undeclared Cargo refuses.
   let checkoutReal = root; try { checkoutReal = fs.realpathSync.native(root); } catch { /* as given */ }
-  const cargo = executor.cargo ?? ["cargo"];
   const targetDirs = {};
-  for (const m of manifests) {
-    const file = path.join(root, ...m.split("/"));
-    if (!o.exists(file)) return { refusal: `the checkout has no ${m}, so its Cargo output directory cannot be resolved` };
-    const r = o.spawn(cargo[0], [...cargo.slice(1), "metadata", "--offline", "--format-version", "1", "--no-deps", "--manifest-path", file], { cwd: path.dirname(file), env: o.env });
-    let doc = null;
-    try { doc = failed(r) ? null : JSON.parse(text(r)); } catch { doc = null; }
-    if (!doc || typeof doc.target_directory !== "string" || !path.isAbsolute(doc.target_directory) || typeof doc.workspace_root !== "string") return { refusal: `cargo metadata in the checkout reported no absolute target_directory for ${m}${failed(r) ? ` (${why(r)})` : ""}` };
-    const cargoDir = posix(path.relative(checkoutReal, (() => { try { return fs.realpathSync.native(doc.workspace_root); } catch { return doc.workspace_root; } })())) || ".";
-    targetDirs[cargoDir] = path.resolve(doc.target_directory);
+  if (executor.kind === "broker") {
+    // A broker host never asks Cargo anything about the checkout: the broker pins every output directory (the receipt's `outputDir`), so
+    // all this binding needs is which directories of the commit are Cargo workspaces, and the commit's own manifests say so (read with the
+    // object database, never the editable checkout: GATE-CONTRACT "Commit-only build"). The same rule the carried seam applies to a call
+    // (cargo-target-shim.mjs locateWorkspaceByWalk): the nearest enclosing manifest that declares `[workspace]`, else the nearest manifest.
+    const tracked = new Set(manifests);
+    const bodies = new Map();
+    const declaresWorkspace = (m) => {
+      if (!bodies.has(m)) { const r = git("show", `${ds.commit}:${m}`); bodies.set(m, failed(r) ? null : text(r)); }
+      return bodies.get(m);
+    };
+    for (const m of manifests) {
+      let dir = path.posix.dirname(m); let nearest = null; let found = null;
+      for (;;) {
+        const candidate = dir === "." ? "Cargo.toml" : `${dir}/Cargo.toml`;
+        if (tracked.has(candidate)) {
+          nearest ??= dir;
+          const body = declaresWorkspace(candidate);
+          if (body === null) return { refusal: `cannot read ${candidate} of ${ds.commit.slice(0, 12)}` };
+          if (/^\s*\[workspace(?:\.[^\]]*)?\]/m.test(body)) { found = dir; break; }
+        }
+        if (dir === ".") break;
+        dir = path.posix.dirname(dir);
+      }
+      targetDirs[found ?? nearest ?? path.posix.dirname(m)] = null;
+    }
+  }
+  // GB-16/GB-17: a direct host's workspaces and target directories are resolved from the SELECTED COMMIT's snapshot (its committed manifests and `.cargo/config.toml`) and mapped
+  // lexically to the checkout's counterpart, exactly as cargoOutputPin does: the live checkout's manifests are never read, so a directory the newer checkout deleted or moved, or a dirty or
+  // untracked manifest there, changes nothing.
+  if (executor.kind !== "broker") {
+    const resolved = cargoOutputPin({ o, git, root, commit: ds.commit, executor, snapshot: ds.path, manifests });
+    if (resolved.refusal) return { refusal: resolved.refusal };
+    const relOf = (w) => { for (const base of [root, checkoutReal]) { const r = path.relative(base, w); if (!r.startsWith("..") && !path.isAbsolute(r)) return posix(r) || "."; } return posix(w); };
+    for (const [workspaceRoot, target] of resolved.workspaces ?? []) targetDirs[relOf(workspaceRoot)] = target;
   }
   const workspaces = Object.keys(targetDirs);
   if (o.platform === "win32" && executor.kind !== "broker") {
+    if (workspaces.length === 0) return { refusal: "the selected closure has no Cargo workspace; a direct Windows host cannot wrap undeclared Cargo calls" };
     if (workspaces.length > 1) return { refusal: `the commit holds ${workspaces.length} Cargo workspaces (${workspaces.join(", ")}) and a direct Windows host has no per-call wrapper to bind each to its own target directory` };
     return { env: { CARGO_TARGET_DIR: Object.values(targetDirs)[0] }, note: `output directory for the Cargo workspace: ${Object.values(targetDirs)[0]} (the checkout's)`, cleanup() {} };
   }
   const shimModule = await import("../cargo-target-shim.mjs");
   let broker = null; let realCargo = null;
   if (executor.kind === "broker") {
-    if (!o.snapshotBroker) return { refusal: "a broker host reaches Cargo from a unit stage only through the snapshot carrier (deps.snapshotBroker), which is not wired" };
-    const sb = o.snapshotBroker;
-    const marked = sb.markBrokerSubmit?.();
-    if (marked?.broker?.submitted !== true || marked.handle !== sb.handle) return { refusal: `the build ownership did not record the broker submit${sb.handle ? ` under ${sb.handle}` : ""}` };
+    if (!o.snapshotBroker) return { refusal: "a broker host reaches Cargo from a unit stage only through the snapshot carrier (deps.snapshotBroker), which this gate was started without" };
+    let sb;
+    try { sb = await carrierBroker({ o, root, ds, executor, which }); } catch (error) { return { refusal: `the snapshot carrier cannot be built (${error.code ?? "error"}: ${error.message})` }; }
+    // Installing the carrier map sends nothing: the ownership records each carried request's sub-handle just before it is sent (snapshot-broker.mjs).
     const { brokerSection } = await import("../snapshot-broker.mjs");
     broker = { checkoutDirs: Object.fromEntries(workspaces.map((w) => [w, path.join(checkoutReal, ...(w === "." ? [] : w.split("/")))])), section: (o.brokerSection ?? brokerSection)(sb) };
   } else {
@@ -1751,8 +1980,9 @@ async function bindUnitCargo({ o, git, root, ds, executor, which }) {
   catch (error) { if (dir) fs.rmSync(dir, { recursive: true, force: true }); return { refusal: `the runtime cargo wrapper cannot be installed (${error.message})` }; }
   const scan = shimModule.shimScanEnv(o.env, installed);
   const delta = Object.fromEntries(Object.entries(scan).filter(([k, v]) => o.env[k] !== v));
+  const { CARRIED_CARGO_MAP_ENV } = await import("../carried-cargo.mjs");
   return {
-    env: delta, note: `runtime cargo wrapper ${installed.shim} (${installed.mode}): each cargo call a unit stage reaches binds its workspace's checkout target directory or is refused`,
+    env: { ...delta, ...(installed.mode === "broker" ? { [CARRIED_CARGO_MAP_ENV]: installed.mapFile } : {}) }, note: `runtime cargo wrapper ${installed.shim} (${installed.mode}): each cargo call a unit stage reaches binds its workspace's checkout target directory or is refused`,
     // Every call the wrapper decided is in the gate-owned ledger: a refused or unverified call fails the stage even when the test ignored cargo's exit (7.10, decision C).
     check: async () => { const { readLedger, UNSCOPED } = await import("../cargo-ledger.mjs"); return readLedger(installed.ledgerDir, UNSCOPED).problems ?? []; },
     cleanup: () => { fs.rmSync(installed.dir ?? dir, { recursive: true, force: true }); },
@@ -1785,10 +2015,13 @@ async function runUnitSnapshot(o, args, root, git, io, option) {
   const which = (cmd) => { const r = o.spawn(o.platform === "win32" ? "where" : "which", [cmd]); return failed(r) ? [] : text(r).split(/\r?\n/).map((l) => l.trim()).filter(Boolean); };
   const executor = (o.resolveExecutor ?? resolveExecutor)({ env: o.env, platform: o.platform, exists: o.exists, which, readFile: o.readFile }); applyExecutorEnv(o, executor);
   if (executor.kind === "refuse") { o.err(`${tag} BLOCKED: ${executor.problem}`); return 1; }
+  { const decided = routePlan(o, { to: option("--to"), stages: [], devTest: true, executor, capabilities: await brokerCapabilityStateWithHandshake(o, { to: option("--to"), executor }) });
+    if (decided.refusal?.code === "RK_BROKER_CAPABILITY_MISSING") { o.err(`${tag} BLOCKED: ${decided.refusal.code}: ${decided.refusal.message}; nothing ran`); return 1; } }
   if (executor.kind === "broker" && !o.snapshotBroker) { o.err(`${tag} BLOCKED: RK_SNAPSHOT_CARRIER_NOT_WIRED: a broker host builds a unit snapshot only through the snapshot carrier; nothing ran`); return 1; }
   const common = git("rev-parse", "--git-common-dir");
   if (failed(common) || !text(common).trim()) { o.err(`${tag} cannot read the git directory`); return 2; }
   const snapshotsAt = o.snapshotRoot ?? snap.snapshotRoot({ platform: o.platform, env: o.env });
+  { const mismatch = await declaredSnapshotRootRefusal(o, executor, snapshotsAt); if (mismatch) { o.err(`${tag} BLOCKED: ${mismatch.code}: ${mismatch.message}; nothing ran`); return 1; } }
   let own;
   try { own = (o.acquireOwnership ?? acquireBuildOwnership)({ file: ownershipFile({ platform: o.platform, beside: o.snapshotRoot }), stage: `door:unit:${option("--to")}`, snapshot: path.join(snapshotsAt, snap.repositoryOf(root).key), commit, platform: o.platform, env: o.env }); }
   catch (e) { if (e.code !== "busy" && e.code !== "refused") throw e; o.err(`${tag} BLOCKED: ${e.message}; nothing ran${e.code === "refused" ? ", nothing created" : ""}`); return 1; }
@@ -1800,7 +2033,9 @@ async function runUnitSnapshot(o, args, root, git, io, option) {
     o.out(`${tag} snapshot ${synced.path} is commit ${synced.commit} tree ${synced.tree} (written=${synced.written} removed=${synced.removed} unchanged=${synced.unchanged})`);
     const ds = { own, path: synced.path, commit: synced.commit, tree: synced.tree, root: snapshotsAt, ledger: { entries: [] } };
     // A unit's test or pack that reaches Cargo must never write `target/` into the snapshot (npm units included): see bindUnitCargo.
-    const bound = await bindUnitCargo({ o, git, root, ds, executor, which });
+    // A check starts no unit command: its own Class A path binds read-only Cargo calls. Resolving every unit's compile output
+    // here would run unrelated metadata before the scoped check even begins.
+    const bound = option("--to") === "check" ? { env: {}, cleanup() {} } : await bindUnitCargo({ o, git, root, ds, executor, which, scopeDirs: [path.posix.dirname(manifest)] });
     if (bound.refusal) { o.err(`${tag} BLOCKED: RK_SNAPSHOT_OUTPUT_UNPINNED: ${bound.refusal}; nothing ran`); return 1; }
     if (bound.note) o.out(`${tag} ${bound.note}`);
     const envExtra = bound.env;
@@ -1813,14 +2048,15 @@ async function runUnitSnapshot(o, args, root, git, io, option) {
     return await runUnitGate({ selector, to: option("--to"), root: ds.path, commonDir: path.resolve(root, text(common).trim()), commit: ds.commit, tree: ds.tree, executor, env: o.env, platform: o.platform, source, envExtra,
       resolve: (sel, r) => resolveUnit(sel, r, { granted: () => localBuildGrantedAt(source) }),
       ...(o.loadUnitOwner ? { loadOwner: o.loadUnitOwner } : {}),
+      ...(o.unitGateDeps ?? {}), // test seam: fetchReceipt, stageCommands, verifyReceipts, selfGit
       stageGuard: { start: (stage) => openSnapshotStage({ o, ds, root, stage: `unit:${stage}`, tag }), end: async (stage) => {
         if (!(await closeSnapshotStage({ o, ds, root, stage: `unit:${stage}`, step: `unit:${stage}`, tag })).ok) return false;
         const calls = bound.check ? await bound.check() : [];
         for (const p of calls.slice(0, 10)) o.err(`${tag} RK_CHECK_ERROR: [unit:${stage}] a cargo call the unit stage made did not complete: ${typeof p === "string" ? p : JSON.stringify(p)}`);
         return calls.length === 0;
       } },
-      check: (tier) => (o.runCheck ?? (() => main(["check", "--commit", ds.commit, "--full-a", "--snapshot", ds.path, "--rule-tier", tier], { ...io, cwd: root, buildOwnership: own })))(tier), out: o.out, err: o.err,
-      ...(reportOut ? { writeReport: (report) => o.writeFile(path.resolve(o.cwd, reportOut), `${JSON.stringify(report, null, 2)}\n`) } : {}),
+      check: (tier) => (o.runCheck ?? (() => main(["check", "--commit", ds.commit, "--full-a", "--snapshot", ds.path, "--rule-tier", tier, "--scope", path.posix.dirname(manifest)], { ...io, cwd: root, buildOwnership: own })))(tier), out: o.out, err: o.err,
+      ...(reportOut ? { writeReport: (report) => o.writeFile(path.resolve(o.cwd, reportOut), `${JSON.stringify(o.brokerException ? { ...report, brokerException: o.brokerException } : report, null, 2)}\n`) } : {}),
     });
     } finally { bound.cleanup(); }
   } finally {
@@ -1830,52 +2066,12 @@ async function runUnitSnapshot(o, args, root, git, io, option) {
 }
 
 /**
- * Whether the door takes the snapshot route on this host. Linux always does (direct, no broker); a broker host (Mac, Dell) does only
- * when the snapshot carrier is wired (`deps.snapshotBroker`). Until the cutover commit wires it in production, that is tests only;
- * every other Mac or Dell run keeps the checkout route (decision 2 "Interim"). No flag or environment variable selects it.
+ * Whether the door takes the snapshot route on this host: every host but hosted CI, whose runner checkout is the commit. Linux
+ * compiles it directly; Mac and Dell compile it through the RustRight snapshot carrier. There is no other route and no flag or
+ * environment variable that selects one (rightkit#1301: the checkout route is deleted).
  */
 export function snapshotRouteSelected(o) {
-  return directPlatform(o.platform) || Boolean(o.snapshotBroker);
-}
-
-/**
- * rightkit-gate --to dev|test [-- <right-release dev|test arguments>] on the CHECKOUT route (Mac and Dell until the cutover commit):
- * class A over the working tree first (nothing compiles while it is red), then `right-release dev|test` runs under a live door run,
- * the only way it runs at all. The executor is the same as every other stage: the broker where there is one (its own admission
- * checks again), plain cargo on an unmanaged host, never around a managed host's broker. The cutover commit deletes this function.
- */
-async function runWorktreeCompile(o, args, root, git, io, to, appRoot = root) {
-  const tag = "rightkit-gate:";
-  const separator = args.indexOf("--");
-  const passthrough = separator >= 0 ? args.slice(separator + 1) : [];
-  // `--to dev --platform mac` (the documented form) hands the platform to right-release as `--platform mac`; a platform given after
-  // `--` wins (Pulse, 2026-10-27: the flag before `--` was dropped and right-release refused "requires --platform").
-  const gateArgs = separator >= 0 ? args.slice(0, separator) : args;
-  const platformAt = gateArgs.indexOf("--platform");
-  if (platformAt >= 0 && gateArgs[platformAt + 1] && !passthrough.includes("--platform")) passthrough.unshift("--platform", gateArgs[platformAt + 1]);
-  const commit = text(git("rev-parse", "HEAD")).trim();
-  const tree = text(git("rev-parse", "HEAD^{tree}")).trim();
-  const common = text(git("rev-parse", "--git-common-dir")).trim();
-  if (!/^[0-9a-f]{40}$/.test(commit) || !common) { o.err(`${tag} cannot read HEAD and the git directory`); return 2; }
-  const which = (cmd) => { const r = o.spawn(o.platform === "win32" ? "where" : "which", [cmd]); return failed(r) ? [] : text(r).split(/\r?\n/).map((l) => l.trim()).filter(Boolean); };
-  const executor = (o.resolveExecutor ?? resolveExecutor)({ env: o.env, platform: o.platform, exists: o.exists, which, readFile: o.readFile }); applyExecutorEnv(o, executor);
-  if (executor.kind === "refuse") { o.err(`${tag} BLOCKED: ${executor.problem}`); return 1; }
-  o.out(`${tag} --to ${to} on the working tree of ${commit.slice(0, 12)}: check (class A) -> right-release ${to}; executor ${executor.kind}`);
-  // Full class A on the working tree, the checks that execute repository code included, before right-release compiles anything.
-  const checked = await (o.runCheck ?? (() => main(["check", "--worktree", "--full-a"], { ...io, cwd: root })))();
-  if (checked !== 0) { o.err(`${tag} --to ${to} stopped at check: nothing compiled`); return 1; }
-  const commonDir = path.resolve(root, common);
-  const run = startRun({ commonDir, commit, tree, stage: to });
-  try {
-    const cli = fileURLToPath(new URL("../cli/right-release.mjs", import.meta.url));
-    // right-release reads its config from its cwd: the resolved app root (appRootOf), not the directory the command was typed in
-    // (apps/foo/src is apps/foo; Astra, third pass).
-    // The door's own RightKit runs every sub-step: a dev target's `right-release web-build|stage-sidecar` steps resolve `right-release`
-    // on PATH, which found the app's node_modules copy (HeardRight on the Dell, 2026-10-27: the app's 0.6.8 guard refused what the
-    // door's 0.6.9 admitted). An installed gate (node_modules/@rightkit/release/bin) has its package's bin shims two levels up.
-    const r = (o.spawnInherit ?? ((cmd, a, opts) => spawnInherit(cmd, a, { ...opts, stdio: "inherit" })))(process.execPath, [cli, to, ...passthrough], { cwd: appRoot, env: { ...o.env, ...run.env, ...doorPath(o) } });
-    return r.status === 0 ? 0 : 1;
-  } finally { endRun(run); }
+  return o.env?.GITHUB_ACTIONS !== "true";
 }
 
 /** The app's root inside the snapshot: `<snapshot>/<appDir>`, the snapshot itself for an app at the repository root. */
@@ -1893,43 +2089,430 @@ function sourceSplitOf({ root, ds, appDir }) {
 /**
  * Why the snapshot route cannot start on this host, or null. The route is the executor's: `direct` hosts (Linux always, any host
  * with no broker) take it as they are. A broker host compiles the snapshot only through the RustRight snapshot carrier, which the
- * gate reaches through `deps.snapshotBroker` (item 7 rows 7.20 to 7.24, wired in production by the carrier lane); without it the
- * host is refused (RK_SNAPSHOT_CARRIER_NOT_WIRED), and a broker that cannot be reached is refused too (RK_SNAPSHOT_BROKER_UNAVAILABLE).
- * Neither ever falls back to compiling the checkout.
+ * gate reaches through `deps.snapshotBroker` (production wires it on Mac and Dell: `productionEntryDeps`); a gate started without
+ * it is refused (RK_SNAPSHOT_CARRIER_NOT_WIRED: tests only, never production), and a broker that cannot be reached is refused too
+ * (RK_SNAPSHOT_BROKER_UNAVAILABLE). Neither ever falls back to compiling the checkout.
  */
-export function snapshotRouteRefusal(o, { rightRelease = false } = {}) {
+export function snapshotRouteRefusal(o) {
   const which = (cmd) => { const r = o.spawn(o.platform === "win32" ? "where" : "which", [cmd]); return failed(r) ? [] : text(r).split(/\r?\n/).map((l) => l.trim()).filter(Boolean); };
   const executor = (o.resolveExecutor ?? resolveExecutor)({ env: o.env, platform: o.platform, exists: o.exists, which, readFile: o.readFile });
   if (executor.kind === "refuse") return { code: "RK_SNAPSHOT_BROKER_UNAVAILABLE", message: executor.problem };
-  // right-release's own children (dev, test) reach Cargo with no carrier of their own on a broker host (row 7.24): refused even when the gate has one.
-  if (executor.kind === "broker" && rightRelease) return { code: "RK_SNAPSHOT_CARRIER_NOT_WIRED", message: `right-release dev and test reach Cargo on a ${o.platform} broker host only through the snapshot carrier's per-call wrapper (item 7 row 7.24), which is not wired` };
-  if (executor.kind === "broker" && !o.snapshotBroker) return { code: "RK_SNAPSHOT_CARRIER_NOT_WIRED", message: `a ${o.platform} host compiles a commit snapshot only through the RustRight snapshot carrier (item 7 rows 7.20 to 7.24), which this gate does not carry yet` };
+  if (executor.kind === "broker" && !o.snapshotBroker) return { code: "RK_SNAPSHOT_CARRIER_NOT_WIRED", message: `a ${o.platform} host compiles a commit snapshot only through the RustRight snapshot carrier (item 7 rows 7.20 to 7.24), and this gate was started without it` };
   return null;
 }
 
+/** The refusal codes a route probe can answer with: the codes the stages themselves print (`BLOCKED: <code>: ...`). */
+export const ROUTE_REFUSAL_CODES = Object.freeze(["RK_TAURI_CONFIG_OVERRIDE", "RK_STAGE_HOST_MISMATCH", "RK_SNAPSHOT_BROKER_UNAVAILABLE", "RK_SNAPSHOT_CARRIER_NOT_WIRED", "RK_BROKER_CAPABILITY_MISSING", "RK_BROKER_UNAVAILABLE",
+  // One signing identity per product (rightkit#1303): the Mac and the Dell refuse an unsigned, ad hoc or re-identified test or dev build.
+  ...SIGNING_REFUSAL_CODES]);
+/** The stages `--route` can answer for (`release` writes to the publisher and has no route of its own on a host). */
+export const ROUTE_PROBE_STAGES = Object.freeze(["check", "compile", "package", "qualify", "dev", "test"]);
+export const ROUTE_SCHEMA = "rightkit-gate.route/1";
+
+/**
+ * The capabilities a broker must advertise for the carried stages (rightkit#1301 B2). RustRight reports them in `rustright doctor --json`
+ * as `.broker.capabilities` (the HANDSHAKE's `capabilities`: `journal-v1`, `snapshot-readonly-v1`, `snapshot-adapter-v1`, ...; constants
+ * in rustright-protocol response.rs). The two required strings ship with RustRight's upcoming change: today's broker (78eda7e) reports no
+ * `.broker.capabilities`, so this release refuses every stage that builds until that broker is installed. `snapshot-adapter-v1`
+ * (rustright#190, rightkit#1301 B10) is the broker's acceptance of a snapshot-bound adapter job (pnpm, node, QA) inside a gate snapshot,
+ * under which a Tauri CLI's compiles run nested: without it every pnpm step of a snapshot stage (an app's dev and package steps, an npm
+ * unit's compile and package) is refused by the broker, so the gate refuses first. `stage-grant-v1` is no longer required: the gate mints
+ * no stage grant (one model: every compile of a snapshot stage is a carried request or nested under one).
+ */
+export const REQUIRED_BROKER_CAPABILITIES = Object.freeze(["snapshot-readonly-v1", "snapshot-adapter-v1"]);
+
+/**
+ * The broker's capabilities, asked without a build through `rustright doctor --json`: `{ ok: true, capabilities }` or `{ ok: false, problem }`.
+ * A missing client, a client that cannot run, a hung (20 s), unparsable or field-less answer is `ok: false`, which the route refuses (fail
+ * closed). A doctor that reports an unhealthy host still prints its JSON: the field decides, not the exit status.
+ */
+export function queryBrokerCapabilities(o, { executor = null } = {}) {
+  const client = brokerClientOf(o, executor);
+  if (!client) return { ok: false, problem: "the RustRight client is not on PATH" };
+  const r = spawnBrokerClient(o.spawn, client, ["doctor", "--json"], { env: brokerEnvOf(o, executor), encoding: "utf8", timeout: 20_000, windowsHide: true }, { platform: o.platform ?? process.platform, readFile: o.readFile });
+  if (r?.error || r?.status === null || r?.status === undefined) return { ok: false, problem: `\`rustright doctor --json\` did not finish: ${why(r)}` };
+  let doc;
+  try { doc = JSON.parse(text(r)); } catch { return { ok: false, problem: `\`rustright doctor --json\` printed no JSON${r.status ? ` (exit ${r.status})` : ""}` }; }
+  const caps = doc?.broker?.capabilities;
+  if (!Array.isArray(caps) || !caps.every((c) => typeof c === "string")) return { ok: false, problem: "`rustright doctor --json` reports no `.broker.capabilities` (a broker that predates snapshot-readonly-v1 and snapshot-adapter-v1)" };
+  // The list is the broker's HANDSHAKE.capabilities only when the client received that handshake: an unreachable broker (doctor reports an empty list for it) advertises nothing, which is a
+  // different statement from a broker that advertises few capabilities, so it is a problem naming why, never a list. Each name is advertised once.
+  if (doc.broker.reachable !== true) return { ok: false, problem: `the broker is not reachable, so its HANDSHAKE.capabilities were not received (\`rustright doctor --json\` .broker.reachable is ${JSON.stringify(doc.broker.reachable ?? null)}${typeof doc.broker.error === "string" && doc.broker.error ? `: ${doc.broker.error}` : ""})` };
+  if (new Set(caps).size !== caps.length) return { ok: false, problem: "`rustright doctor --json` lists a capability twice: the broker's HANDSHAKE.capabilities are not read from an answer that repeats itself" };
+  return { ok: true, capabilities: caps };
+}
+
+/**
+ * What a route decision needs of the broker: `null` when nothing is asked (not a broker executor, hosted CI, `--to check`, or a gate
+ * whose broker is an injected fixture without a declared capability query), else the answer. The production carrier asks the real
+ * client; a test's injected broker declares its own through `o.brokerCapabilities`.
+ */
+export function brokerCapabilityState(o, { to, executor }) {
+  if (executor?.kind !== "broker" || to === "check" || o.env.GITHUB_ACTIONS === "true") return null;
+  if (typeof o.brokerCapabilities === "function") return o.brokerCapabilities(o);
+  return typeof o.snapshotBroker?.create === "function" ? queryBrokerCapabilities(o, { executor }) : null;
+}
+
+/**
+ * GB-51 / GB-62: the capability state a route plans from, with the broker's HANDSHAKE received by the gate itself (broker-handshake.mjs) beside `rustright doctor --json`: both are asked, they must agree,
+ * and a plan sees only names advertised by what answered. Not asked (null) exactly when `brokerCapabilityState` asks nothing; an injected fixture broker that declares its own capabilities
+ * (`o.brokerCapabilities`) keeps them unless it also declares a handshake (`o.brokerHandshake`, a function returning a parsed handshake or `{ ok: false, problem }`).
+ */
+export async function brokerCapabilityStateWithHandshake(o, { to, executor }) {
+  const doctor = brokerCapabilityState(o, { to, executor });
+  if (doctor === null) return null;
+  const injected = typeof o.brokerHandshake === "function";
+  if (!injected && typeof o.brokerCapabilities === "function") return doctor;
+  let handshake;
+  try {
+    handshake = injected ? await o.brokerHandshake(o) : await queryBrokerHandshake({ ...o, env: brokerEnvOf(o, executor) }, { client: brokerClientOf(o, executor) });
+  } catch (error) { handshake = { ok: false, problem: `the broker's HANDSHAKE could not be read (${error?.message ?? error})` }; }
+  return mergeCapabilityViews({ doctor, handshake });
+}
+
+/**
+ * The refusal of `--to release` on a host that is not the trusted publisher, or null: a release uploads sealed bytes and runs only in the release workflow's
+ * protected publication job (GITHUB_ACTIONS with RIGHTKIT_PUBLISHER=github-environment); a mobile platform's store upload has its own tier-less route. Asked by a real
+ * run before it takes ownership or syncs the snapshot (E2E L3-03); the probe has no release route, so this is not a probe code.
+ */
+export function releaseRouteRefusal(o, { stages, platform }) {
+  if (!stages.includes("release") || MOBILE_PLATFORMS.has(platform)) return null;
+  if (o.env.GITHUB_ACTIONS === "true" && o.env.RIGHTKIT_PUBLISHER === "github-environment") return null;
+  return { code: "RK_RELEASE_PUBLISHER_ONLY", message: "--to release runs only in the trusted publisher (the release workflow's protected publication job). Run --to qualify on the native host, then dispatch the release workflow for the commit" };
+}
+
+/**
+ * Which route this host's door takes for `--to <stage>` and whether it refuses, WITHOUT running anything: the decisions of `runStages`
+ * in the order it makes them. `runStages` takes its own pre-ownership route and refusal from this very function (rightkit#1297 L1), so
+ * the probe and a real run cannot drift (the door-route parity test compares them over the carrier, executor, platform and Tauri
+ * combinations):
+ *   1. hosted CI (GITHUB_ACTIONS) builds the runner's checkout, which is the commit: no snapshot route;
+ *   2. every other host takes the snapshot route (Linux direct; Mac and Dell through the carrier; there is no checkout route);
+ *   3. the snapshot route refuses an inherited TAURI_CONFIG;
+ *   4. then `snapshotRouteRefusal` (skipped for `--to check`, which compiles nothing): an unreachable broker, a gate without its carrier;
+ *   5. then an executor that cannot start (a broker-managed host whose broker is unreachable), on any route.
+ * `executor` is a resolved executor. Returns { route, refusal } with
+ * refusal null or { code, stage, message }. Reads no checkout, takes no ownership, syncs no snapshot and spawns nothing itself.
+ */
+export function routePlan(o, { to, stages, devTest, executor, capabilities = null, appConfig = null, stagePlatform = null }) {
+  const refuse = (code, stage, message) => ({ code, stage, message });
+  const hosted = o.env.GITHUB_ACTIONS === "true";
+  const snapshot = !hosted && snapshotRouteSelected(o);
+  const route = hosted ? "hosted" : "snapshot";
+  if (snapshot) {
+    if (o.env.TAURI_CONFIG !== undefined) return { route, refusal: refuse("RK_TAURI_CONFIG_OVERRIDE", to, "TAURI_CONFIG is set in the environment; it would replace the commit's Tauri configuration (externalBin included) for every build below, so a commit-only build refuses it") };
+    // A stage that packages or qualifies a platform's artifact runs on that platform's own host: Mac and Windows artifacts are constructed on their
+    // native platform and never cross-built (GATE-CONTRACT s1 "Native build target"; PLATFORM-MATRIX: packages only on the matching native host).
+    // Refused here, before ownership, a snapshot or any process, so `--route` and a real run say the same thing (E2E L3-03).
+    const hostNeeded = STAGE_NATIVE_HOST[stagePlatform];
+    if (stagePlatform && (stages.includes("package") || stages.includes("qualify")) && hostNeeded && o.platform !== hostNeeded) {
+      return { route, refusal: refuse("RK_STAGE_HOST_MISMATCH", to, `--to ${to} --platform ${stagePlatform} builds the ${stagePlatform} artifact, which is constructed only on a ${hostNeeded === "darwin" ? "Mac" : "Windows"} host (this host is ${o.platform}); a Mac or Windows artifact is never cross-built from another platform, so nothing was started`) };
+    }
+    const refused = to === "check" ? null : snapshotRouteRefusal(o);
+    if (refused) return { route, refusal: refuse(refused.code, to, refused.message) };
+    // The broker must accept what the carried stages ask of it (rightkit#1301 B2): a missing or failing capability query refuses.
+    if (capabilities && executor?.kind === "broker" && to !== "check") {
+      const missing = capabilities.ok ? REQUIRED_BROKER_CAPABILITIES.filter((c) => !capabilities.capabilities.includes(c)) : REQUIRED_BROKER_CAPABILITIES;
+      if (!capabilities.ok || missing.length) return { route, refusal: refuse("RK_BROKER_CAPABILITY_MISSING", to, `the broker ${capabilities.ok ? `does not advertise ${missing.join(", ")}` : `cannot be asked for its capabilities (${capabilities.problem})`} (\`rustright doctor --json\` \`.broker.capabilities\`); this release builds only against a broker that accepts snapshot-bound read-only Cargo and snapshot-bound adapter jobs (rightkit#1301, rustright#188, rustright#190)`) };
+    }
+  }
+  // GB-51: a declared native build tool with no carried adapter (xcodegen, xcodebuild, Gradle, CMake) refuses here, at planning, naming the missing
+  // capability, instead of after the earlier stages built (the door's launch-time refusal remains the backstop).
+  if (snapshot && executor?.kind === "broker" && appConfig?.config && to !== "check") {
+    const refusalText = nativeToolRefusal(nativeToolUses({ config: appConfig.config, to, devPlatform: appConfig.nativePlatform ?? appConfig.devPlatform ?? null, platform: appConfig.nativePlatform ?? null }), { capabilities, readFile: appConfig.readFile ?? null, listFiles: appConfig.listFiles ?? null });
+    if (refusalText) return { route, refusal: refuse("RK_BROKER_CAPABILITY_MISSING", to, refusalText) };
+  }
+  // One signing identity per product, every build (rightkit#1303): on the Mac and the Dell a test or dev build that would run unsigned, ad hoc or under
+  // another identifier is refused here, from the commit's own config, so `--route` and a real run decide alike. Linux and hosted CI are exempt.
+  if (snapshot && appConfig?.config && (devTest || to === "test" || to === "dev")) {
+    const [first] = suiteSigningRefusals({ config: appConfig.config, platform: o.platform, env: o.env, to, devPlatform: appConfig.devPlatform ?? null, readFile: appConfig.readFile, listFiles: appConfig.listFiles ?? null });
+    if (first) return { route, refusal: refuse(first.code, to, first.message) };
+  }
+  if (executor?.kind === "refuse") return { route, refusal: refuse("RK_BROKER_UNAVAILABLE", to, executor.problem) };
+  return { route, refusal: null };
+}
+
+/**
+ * The app config of the selected commit for the route's signing refusals, read from the object database (never the checkout): `{ config, readFile }`,
+ * `readFile(rel)` being an app-relative file of the commit (text or null). Null when the commit has no readable JSON config (class A judges that).
+ * The probe covers JSON configs only: a legacy right-release.config.mjs is not evaluated here (that would run app code in the probe), so `--route` is
+ * silent about it. The same policy (suiteSigningRefusals) is enforced at run time on whatever config loaded: test-command.mjs before any suite runs and
+ * development.mjs before a dev target builds, so a .mjs config's unsigned product build is refused there, on the Mac and the Dell.
+ */
+export function routeAppConfig({ git, commit, appDir = ".", platform = null }) {
+  if (!commit) return null;
+  const show = (rel) => { const r = git("show", `${commit}:${path.posix.normalize(appDir === "." ? rel : `${appDir}/${rel}`)}`); return failed(r) ? null : text(r); };
+  const raw = show("right-release.config.json");
+  if (raw === null) return null;
+  let config;
+  try { config = JSON.parse(raw); } catch { return null; }
+  const list = (c, rel) => { const r = git("ls-tree", "-r", "--name-only", c, "--", rel); return failed(r) ? null : text(r).split(/\r?\n/).filter(Boolean); };
+  return { config, readFile: show, listFiles: gitListRustFiles(list, commit, appDir), devPlatform: platform === "mac" || platform === "win" ? platform : null, nativePlatform: platform ?? null };
+}
+
+/** The `--platform` a dev or test run was given: before `--`, or in the arguments after it (a platform after `--` wins, as runDevTest hands it on). */
+export function devTestPlatform(args) {
+  const at = args.indexOf("--");
+  const find = (list) => { const i = list.lastIndexOf("--platform"); return i < 0 ? null : list[i + 1] ?? null; };
+  return (at >= 0 ? find(args.slice(at + 1)) : null) ?? find(at >= 0 ? args.slice(0, at) : args);
+}
+
+/**
+ * `rightkit-gate --to <stage> --route [--platform p] [--commit rev]`: prints one JSON line (`rightkit-gate.route/1`) naming the route
+ * the stage would take and the refusal it would meet, and runs nothing: no ownership, no snapshot sync, no check, no run record, no
+ * receipt, no right-release. Exit 0 when it answered (a refusal is an answer), 2 when it could not compute one.
+ */
+async function runRouteProbe(o, args, root, git, { to, platform, stages, devTest, appDir }) {
+  const tag = "rightkit-gate: --route:";
+  const option = (name) => { const i = args.indexOf(name); return i < 0 ? undefined : args[i + 1]; };
+  const snap = await import("../snapshot.mjs");
+  let selected;
+  try { selected = snap.resolveCommit(root, option("--commit") ?? "HEAD"); }
+  catch (e) { o.err(`${tag} cannot resolve ${option("--commit") ?? "HEAD"} to a commit: ${e.message}`); return 2; }
+  const which = (cmd) => { const r = o.spawn(o.platform === "win32" ? "where" : "which", [cmd]); return failed(r) ? [] : text(r).split(/\r?\n/).map((l) => l.trim()).filter(Boolean); };
+  const executor = (o.resolveExecutor ?? resolveExecutor)({ env: o.env, platform: o.platform, exists: o.exists, which, readFile: o.readFile });
+  let plan;
+  const capabilities = await brokerCapabilityStateWithHandshake(o, { to, executor });
+  try { plan = routePlan(o, { to, stages, devTest, executor, stagePlatform: platform, capabilities, appConfig: to !== "check" ? routeAppConfig({ git, commit: selected.commit, appDir, platform: devTestPlatform(args) }) : null }); }
+  catch (e) { o.err(`${tag} ${e.message}`); return 2; }
+  // The declared Linux broker's snapshot root: the probe reports the refusal a real run would meet (read-only: one status probe of the broker).
+  if (!plan.refusal && plan.route === "snapshot") {
+    let at = null; try { at = o.snapshotRoot ?? snap.snapshotRoot({ platform: o.platform, env: o.env }); } catch { at = null; }
+    const mismatch = at ? await declaredSnapshotRootRefusal(o, executor, at) : null;
+    if (mismatch) plan = { ...plan, refusal: { code: mismatch.code, stage: to, message: mismatch.message } };
+  }
+  // Read-only: GIT_OPTIONAL_LOCKS=0, so the probe's `git status` never refreshes the index or contends with a writer (rightkit#1297 L4).
+  const dirty = o.spawn("git", ["status", "--porcelain", "--untracked-files=no"], { cwd: root, env: { ...o.env, GIT_OPTIONAL_LOCKS: "0" } });
+  const version = JSON.parse(fs.readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+  o.out(JSON.stringify({
+    schema: ROUTE_SCHEMA, gate: version, to, platform: platform ?? null, host: o.platform, app: appDir, commit: selected.commit,
+    executor: executor.kind, carrier: o.snapshotBroker ? (o.snapshotBroker.kind ?? "injected") : null, route: plan.route,
+    brokerCapabilities: capabilities?.ok ? capabilities.capabilities : null, stages: devTest ? ["check", to] : stages, refusal: plan.refusal, checkoutClean: failed(dirty) ? null : !text(dirty).trim(),
+  }));
+  return 0;
+}
+
+// ---- the carrier of a snapshot stage's right-release children (carried-cargo.mjs; rightkit#1301) --------------------------------------
+
+/**
+ * The environment of a carried stage's child: the base, the stage's carrier and the caller's extras, without an output directory.
+ * The broker pins every Cargo output, so the Tauri CLI and every other child must not look for bundles in a directory the environment
+ * names (rightkit#1301 F5): CARGO_TARGET_DIR and CARGO_BUILD_TARGET_DIR are dropped, in any case.
+ */
+export function carriedEnv(carrier, base, extra = {}) {
+  if (!carrier.carried) return { ...base, ...carrier.env, ...extra };
+  const strip = (env) => {
+    const out = { ...env };
+    for (const key of Object.keys(out)) {
+      if (/^(CARGO_TARGET_DIR|CARGO_BUILD_TARGET_DIR)$/i.test(key)) delete out[key];
+    }
+    return out;
+  };
+  return { ...strip(base), ...carrier.env, ...strip(extra) };
+}
+
+// ---- the declared Linux broker's snapshot root --------------------------------------------------------------------------------------------------
+// The broker admits a snapshot only under `<its data root>/snapshots`. On Linux the gate's snapshot root is `~/.config/rightkit/gate.json` `snapshotRoot`, else
+// `~/.local/state/rightkit/snapshots` (snapshot.mjs snapshotRoot); a host whose broker keeps its data elsewhere would sync thousands of files, take build ownership and submit,
+// only to be refused at admission with the ownership left unknown. So the declared route compares the two BEFORE ownership or a sync, and refuses typed.
+export const LINUX_SNAPSHOT_ROOT_MISMATCH = "RK_LINUX_BROKER_SNAPSHOT_ROOT_MISMATCH";
+const ANSWERING_ROOTS_TIMEOUT_MS = 10_000;
+
+/**
+ * What the answering broker says its roots are: the health probe's `STATUS` carries `roots` (`rustright.answering-roots.v1`: dataRoot, controlRoot, ...), after the HANDSHAKE the first event
+ * is. Reads lines until a STATUS with roots (or any other end) and resolves `{ ok: true, dataRoot }` or `{ ok: false, problem }`; never rejects. `connect` is the transport (tests, `net.connect`).
+ */
+export function readAnsweringRoots({ endpoint, identity, connect = (target) => net.connect({ path: target }), timeoutMs = ANSWERING_ROOTS_TIMEOUT_MS }) {
+  return new Promise((resolve) => {
+    let settled = false; let conn = null; let timer = null; let buffer = "";
+    const finish = (result) => { if (settled) return; settled = true; clearTimeout(timer); try { conn?.destroy(); } catch { /* gone */ } resolve(result); };
+    const problem = (why) => finish({ ok: false, problem: why });
+    try { conn = connect(endpoint); } catch (e) { problem(`cannot connect to the broker at ${endpoint} (${e?.code ?? e?.message ?? e})`); return; }
+    timer = setTimeout(() => problem(`the broker at ${endpoint} reported no roots within ${timeoutMs} ms`), timeoutMs);
+    conn.on("connect", () => { try { conn.write(`${JSON.stringify({ type: "STATUS", protocol: BUILD_CONTROL_PROTOCOL, runtime: identity, id: HANDSHAKE_PROBE_ID })}\n`); } catch (e) { problem(`cannot send the probe to the broker at ${endpoint} (${e?.message ?? e})`); } });
+    conn.on("data", (chunk) => {
+      buffer += String(chunk);
+      if (buffer.length > (1 << 21)) { problem("the broker's reply is too large"); return; }
+      for (let at = buffer.indexOf("\n"); at >= 0; at = buffer.indexOf("\n")) {
+        const line = buffer.slice(0, at); buffer = buffer.slice(at + 1);
+        let event; try { event = JSON.parse(line); } catch { problem("the broker's reply is not JSON"); return; }
+        if (event?.type === "STATUS" && event.roots && typeof event.roots === "object") {
+          const root = event.roots.dataRoot;
+          if (event.roots.schema !== "rustright.answering-roots.v1" || typeof root !== "string" || !path.isAbsolute(root)) { problem("the broker's STATUS roots are not rustright.answering-roots.v1 with an absolute dataRoot"); return; }
+          finish({ ok: true, dataRoot: root }); return;
+        }
+        if (event?.type !== "HANDSHAKE" && event?.type !== "STATUS") { problem(`the broker answered ${event?.type ?? "something"} to the roots probe`); return; }
+      }
+    });
+    const closed = () => problem(`the broker at ${endpoint} closed without reporting its roots (a broker that predates the answering roots)`);
+    conn.on("error", (e) => problem(`the broker connection at ${endpoint} failed (${e?.code ?? e?.message ?? e})`));
+    conn.on("close", closed); conn.on("end", closed);
+  });
+}
+
+/** The declared Linux broker's data root: what it reports on the wire (the validated client, its runtime manifest, the declared endpoint), `{ ok, dataRoot }` or `{ ok: false, problem }`. */
+export async function queryBrokerDataRoot(o, executor) {
+  try {
+    const exe = resolveBrokerClient(executor.client, { platform: o.platform, readFile: o.readFile }).file;
+    let real = exe; try { real = fs.realpathSync.native(exe); } catch { real = exe; }
+    const identity = parseRuntimeIdentity(fs.readFileSync(path.join(path.dirname(real), RUNTIME_MANIFEST_FILE), "utf8"));
+    if (!identity.ok) return { ok: false, problem: identity.problem };
+    return await readAnsweringRoots({ endpoint: executor.socket, identity: identity.identity, ...(o.connectBroker ? { connect: o.connectBroker } : {}) });
+  } catch (e) { return { ok: false, problem: e.message }; }
+}
+
+/**
+ * null, or `{ code, message }` when the declared Linux broker would refuse this gate's snapshots. Only the declared route is asked (a Linux host with no declared broker stays direct and
+ * has no broker root). The broker's own report decides; when it reports none (a broker that predates it, or an unreadable answer) the DECLARED data root (RUSTRIGHT_DATA_ROOT, else
+ * RIGHTKIT_DATA_ROOT, MANAGED_ROOT or EXTERNAL_ROOT) is the comparison, and the message says it is only a declaration; with neither nothing is known and nothing is refused here.
+ * `snapshotsAt` is the gate's snapshot root.
+ */
+export async function declaredSnapshotRootRefusal(o, executor, snapshotsAt) {
+  if (executor?.kind !== "broker" || executor.route !== LINUX_BROKER_ROUTE) return null;
+  const answered = await (o.queryBrokerDataRoot ?? queryBrokerDataRoot)(o, executor);
+  let dataRoot; let basis;
+  if (answered?.ok) { dataRoot = answered.dataRoot; basis = "the broker reports its data root"; }
+  else {
+    dataRoot = envNamed(o.env, "DATA_ROOT") || envNamed(o.env, "MANAGED_ROOT") || envNamed(o.env, "EXTERNAL_ROOT");
+    basis = `the broker did not report its roots (${answered?.problem ?? "no answer"}), so the DECLARED data root from the environment is the comparison (a declaration, not the broker's word)`;
+  }
+  if (!dataRoot) return null;
+  const real = (p) => { try { return fs.realpathSync.native(p); } catch { return path.resolve(p); } };
+  const expected = path.join(dataRoot, "snapshots");
+  if (real(expected) === real(snapshotsAt)) return null;
+  return { code: LINUX_SNAPSHOT_ROOT_MISMATCH, message: `the gate's snapshot root is ${snapshotsAt}, but the declared Linux broker admits snapshots only under ${expected} (${basis}); set "snapshotRoot": ${JSON.stringify(expected)} in ~/.config/rightkit/gate.json (the gate host configuration), then run again. Nothing was synced and no build ownership was taken` };
+}
+
+/** The RustRight client this executor drives: the declared Linux route's validated client, else the absolute `rustright` on PATH (Mac, Dell). */
+const brokerClientOf = (o, executor) => (executor?.route === LINUX_BROKER_ROUTE && executor.kind === "broker" ? executor.client : whichIn(o)("rustright").find((c) => path.isAbsolute(c)));
+/** The environment the client runs in: the gate's, plus the endpoint the executor declared (the declared Linux route's socket). */
+const brokerEnvOf = (o, executor) => (executor?.route === LINUX_BROKER_ROUTE && executor.env ? { ...o.env, ...executor.env } : o.env);
+const whichIn = (o) => (cmd) => { const r = o.spawn(o.platform === "win32" ? "where" : "which", [cmd]); return failed(r) ? [] : text(r).split(/\r?\n/).map((l) => l.trim()).filter(Boolean); };
+
+/**
+ * The gate's snapshot broker for this door run: `o.snapshotBroker` is the production carrier statement (`{ kind, create }`, which
+ * builds the broker once: the host's enrolled pins, the declared inputs read from the snapshot, the build ownership and the RustRight
+ * client) or, in a test, a ready broker object. Built once per door run.
+ */
+async function carrierBroker({ o, root, ds, executor = null, which = whichIn(o) }) {
+  if (ds.carrierBroker) return ds.carrierBroker;
+  const carrier = o.snapshotBroker;
+  let sb = carrier;
+  if (typeof carrier?.create === "function") {
+    const client = executor?.route === LINUX_BROKER_ROUTE && executor.kind === "broker" ? executor.client : which("rustright").find((c) => path.isAbsolute(c));
+    const { brokerLeaseState } = await import("../build-ownership.mjs");
+    sb = carrier.create({ lease: brokerLeaseState, env: brokerEnvOf(o, executor), platform: o.platform, checkout: root, commit: { sha: ds.commit, tree: ds.tree }, snapshot: { path: ds.path, expectedTree: ds.tree }, ownership: ds.own, client, gateFile: callingGatePath(), spawn: o.spawn });
+  }
+  ds.carrierBroker = sb;
+  return sb;
+}
+
+/** The commit's Cargo workspaces in the snapshot, each with its counterpart in the primary checkout: `{ [cargoDir]: checkout path }`, from the files alone. */
+async function snapshotCargoWorkspaces({ git, ds, root }) {
+  const listed = git("ls-tree", "-r", "--name-only", "-z", ds.commit);
+  if (failed(listed)) throw new Error(`cannot list the files of ${ds.commit.slice(0, 12)}: ${why(listed)}`);
+  const manifests = text(listed).split("\0").filter((f) => f === "Cargo.toml" || f.endsWith("/Cargo.toml"));
+  const { locateWorkspaceByWalk } = await import("../cargo-target-shim.mjs");
+  let checkout = root; try { checkout = fs.realpathSync.native(root); } catch { /* as given */ }
+  const dirs = {};
+  for (const m of manifests) {
+    const file = path.join(ds.path, ...m.split("/"));
+    let rel;
+    try { rel = posix(path.relative(ds.path, path.dirname(locateWorkspaceByWalk(file, path.dirname(file))))) || "."; } catch { rel = posix(path.dirname(m)); }
+    if (rel === ".." || rel.startsWith("../")) rel = posix(path.dirname(m)) || ".";
+    dirs[rel] = path.join(checkout, ...(rel === "." ? [] : rel.split("/")));
+  }
+  return dirs;
+}
+
+/**
+ * The carrier of one snapshot stage's right-release child on a broker host: the stage's workspaces, the broker section, one map and
+ * ledger. Returns `{ env, refusal, finish({ stage }), cleanup }`: `env` is added to the
+ * child's environment; `finish` runs after the child ended, fails on any call that was refused, unverified or unfinished and on any
+ * receipt the gate cannot verify again itself, and removes the carrier. A direct executor, or no snapshot, has nothing to carry.
+ */
+async function carrierForChildren({ o, ds, root, git, executor, stage, tag = "rightkit-gate:" }) {
+  const none = { env: {}, carried: false, refusal: null, async finish() { return true; }, cleanup() {} };
+  if (!ds || executor?.kind !== "broker") return none;
+  let base = null;
+  try {
+    if (!git) throw new Error("the gate's git reader is missing");
+    const carried = await import("../carried-cargo.mjs");
+    const { brokerSection } = await import("../snapshot-broker.mjs");
+    const sb = await carrierBroker({ o, root, ds, executor });
+    // Installing the carrier map sends nothing, so it records nothing: the child's own uncarried probes (`rustc -vV`, `--version`) never
+    // reach the broker under a snapshot, and each carried request records its sub-handle just before it is sent (snapshot-broker.mjs).
+    const checkoutDirs = await snapshotCargoWorkspaces({ git, ds, root });
+    base = fs.mkdtempSync(path.join(os.tmpdir(), "rk-carrier-"));
+    // The carrier is the map and the ledger on every platform: no PATH wrapper and no stage grant. The child's pnpm, node and QA steps are carried
+    // adapter jobs and its Cargo calls carried requests; whatever the Tauri CLI compiles runs nested under the adapter job that started it, and the
+    // broker's signed list of those children is what the gate verifies and reads the bundle root from (carried-cargo.mjs).
+    const installed = (o.installCarrier ?? carried.installCarrier)({ base, snapshotRoot: ds.path, checkoutDirs, section: (o.brokerSection ?? brokerSection)(sb), known: Object.fromEntries(ds.carriedOutputs ?? []), platform: o.platform, env: o.env });
+    o.out(`${tag} [${stage}] carrier (${installed.mode}): ${Object.keys(checkoutDirs).length} workspace(s); each right-release cargo call and each pnpm, node or QA step is one carried request with its own signed receipt, and a compile a step's child makes is nested under it`);
+    let finished = false;
+    const cleanup = () => { try { installed.cleanup?.(); } catch { /* removed below */ } fs.rmSync(base, { recursive: true, force: true }); };
+    return {
+      env: installed.env, carried: true, refusal: null, cleanup,
+      async finish({ stage: at = stage } = {}) {
+        if (finished) return true;
+        finished = true;
+        let problems;
+        try {
+          problems = await installed.problems(sb);
+          // The output directories the stage's verified receipts name: the package stage's sealed manifest must record only these.
+          for (const dir of installed.outputDirs?.() ?? []) ((ds.carriedByStage ??= {})[at] ??= new Set()).add(dir);
+          // And by workspace, for the next stage's children: a receipt already names the output directory, so none asks Cargo for it.
+          for (const [root, dir] of installed.outputsByWorkspace?.() ?? []) (ds.carriedOutputs ??= new Map()).set(root, dir);
+        } catch (error) { problems = [`the cargo ledger cannot be read (${error.message})`]; } finally { cleanup(); }
+        for (const p of problems.slice(0, 10)) o.err(`${tag} RK_CHECK_ERROR: [${at}] a broker call the right-release child made did not complete: ${typeof p === "string" ? p : JSON.stringify(p)}`);
+        return problems.length === 0;
+      },
+    };
+  } catch (error) {
+    if (base) fs.rmSync(base, { recursive: true, force: true });
+    return { ...none, refusal: `${error.code ?? "RK_CARGO_CARRIER"}: the stage's cargo carrier cannot be installed (${error.message})` };
+  }
+}
+
 /**
  * The checkout's Cargo output directory for the snapshot of `commit`: `{ dir }` (null when the commit has no Cargo manifest) or
- * `{ refusal }`. Each tracked Cargo.toml of the commit is asked, in the CHECKOUT with the stage's environment, for its
- * `target_directory` (which honours CARGO_TARGET_DIR and `.cargo/config.toml` build.target-dir) and its workspace root; one workspace
- * yields its directory, several are refused rather than pointed at one shared directory (GATE-CONTRACT: mixed workspaces never share a target).
+ * `{ refusal }`. Each Cargo.toml the COMMIT tracks (git ls-tree of the selected commit, never the checkout's files) is asked, in the
+ * commit's SNAPSHOT with the stage's environment, for its `target_directory` (which honours CARGO_TARGET_DIR and the committed
+ * `.cargo/config.toml` build.target-dir) and its workspace root. A path the snapshot holds is mapped lexically to the same
+ * snapshot-relative path under the checkout (the output directory is the checkout's, GATE-CONTRACT "Output directory & cache"), so a
+ * directory the newer checkout deleted or moved, or a dirty or untracked manifest there, changes nothing: the checkout is not read. A
+ * path outside the snapshot (an absolute CARGO_TARGET_DIR) stands as reported. Optional manifests restrict discovery to a resolved
+ * committed closure. Several workspaces retain independent output directories for the runtime wrapper; they never share one target.
  */
-function cargoOutputPin({ o, git, root, commit, executor }) {
+export function cargoOutputPin({ o, git, root, commit, executor, snapshot, manifests: selectedManifests }) {
   const listed = git("ls-tree", "-r", "--name-only", "-z", commit);
   if (failed(listed)) return { refusal: `cannot list the files of ${commit.slice(0, 12)}: ${why(listed)}` };
-  const manifests = text(listed).split("\0").filter((f) => f === "Cargo.toml" || f.endsWith("/Cargo.toml"));
+  const trackedManifests = text(listed).split("\0").filter((f) => f === "Cargo.toml" || f.endsWith("/Cargo.toml"));
+  if (selectedManifests && selectedManifests.some((m) => !trackedManifests.includes(m))) return { refusal: "the scoped Cargo output map names a manifest outside the selected commit" };
+  const manifests = selectedManifests ?? trackedManifests;
+  if (manifests.length && (typeof snapshot !== "string" || !path.isAbsolute(snapshot))) return { refusal: "the output directory is resolved in the commit's snapshot and none was given" };
   const cargo = executor.cargo ?? ["cargo"];
+  // The snapshot as the tool reports it may be a realpath of the spelling the gate holds (a symlinked temp root): both spellings map.
+  const snapshots = [path.resolve(snapshot ?? "/")];
+  try { snapshots.push(fs.realpathSync.native(snapshot)); } catch { /* an absent snapshot fails at the metadata call */ }
+  const toCheckout = (p) => {
+    for (const base of snapshots) { const rel = path.relative(base, p); if (rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel))) return path.join(root, rel); }
+    return p;
+  };
   const workspaces = new Map();
   for (const m of manifests) {
-    const file = path.join(root, ...m.split("/"));
-    if (!o.exists(file)) return { refusal: `the checkout has no ${m}, so its Cargo output directory cannot be resolved` };
+    const file = path.join(snapshot, ...m.split("/"));
     const r = o.spawn(cargo[0], [...cargo.slice(1), "metadata", "--offline", "--format-version", "1", "--no-deps", "--manifest-path", file], { cwd: path.dirname(file), env: o.env });
     let doc = null;
     try { doc = failed(r) ? null : JSON.parse(text(r)); } catch { doc = null; }
-    if (!doc || typeof doc.target_directory !== "string" || !path.isAbsolute(doc.target_directory) || typeof doc.workspace_root !== "string") return { refusal: `cargo metadata in the checkout reported no absolute target_directory for ${m}${failed(r) ? ` (${why(r)})` : ""}` };
-    workspaces.set(path.resolve(doc.workspace_root), path.resolve(doc.target_directory));
+    if (!doc || typeof doc.target_directory !== "string" || !path.isAbsolute(doc.target_directory) || typeof doc.workspace_root !== "string") return { refusal: `cargo metadata in the snapshot reported no absolute target_directory for ${m}${failed(r) ? ` (${why(r)})` : ""}` };
+    workspaces.set(path.resolve(toCheckout(path.resolve(doc.workspace_root))), path.resolve(toCheckout(path.resolve(doc.target_directory))));
   }
-  if (workspaces.size > 1) return { refusal: `the commit holds ${workspaces.size} Cargo workspaces (${[...workspaces.keys()].map((w) => posix(path.relative(root, w)) || ".").join(", ")}); one directory cannot serve them all, and right-release's own Cargo calls carry no per-workspace wrapper` };
-  return { dir: workspaces.size ? [...workspaces.values()][0] : null };
+  // GB-17: several Cargo workspaces are independent components with their own target caches (GATE-CONTRACT, mixed workspaces never share a target): the per-workspace mapping
+  // (workspace root of the checkout -> its own target directory, all resolved from the commit's snapshot) is returned, never one shared directory and no refusal. The caller binds
+  // each of right-release's and its children's Cargo calls to its own workspace through the per-call wrapper (bindUnitCargo).
+  if (workspaces.size > 1) return { dir: null, workspaces, dirs: [...workspaces.values()] };
+  return { dir: workspaces.size ? [...workspaces.values()][0] : null, workspaces, dirs: [...workspaces.values()] };
 }
 
 /**
@@ -1963,10 +2546,9 @@ async function runDevTest(o, args, root, git, io, to, appRoot, appDir) {
   const which = (cmd) => { const r = o.spawn(o.platform === "win32" ? "where" : "which", [cmd]); return failed(r) ? [] : text(r).split(/\r?\n/).map((l) => l.trim()).filter(Boolean); };
   const executor = (o.resolveExecutor ?? resolveExecutor)({ env: o.env, platform: o.platform, exists: o.exists, which, readFile: o.readFile }); applyExecutorEnv(o, executor);
   if (executor.kind === "refuse") { o.err(`${tag} BLOCKED: ${executor.problem}`); return 1; }
-  if (ds && executor.kind === "broker") { o.err(`${tag} BLOCKED: RK_SNAPSHOT_CARRIER_NOT_WIRED: right-release ${to} reaches Cargo on a broker host only through the snapshot carrier (item 7 row 7.24), which is not wired; nothing ran and the checkout is never built`); return 1; }
   o.out(`${tag} --to ${to} for ${commit.slice(0, 12)}${appDir === "." ? "" : ` (app ${appDir})`}: check (class A) -> right-release ${to}; executor ${executor.kind}${ds ? `; snapshot ${ds.path}` : ""}`);
   // Full class A of the commit before right-release compiles anything: of the snapshot, the checks that execute repository code included.
-  const checked = await (o.runCheck ?? (() => main(["check", "--commit", ds ? commit : "HEAD", "--full-a", ...(ds ? ["--snapshot", ds.path] : [])], { ...io, cwd: root, ...(ds ? { buildOwnership: ds.own } : {}) })))();
+  const checked = await (o.runCheck ?? (() => main(["check", "--commit", ds ? commit : "HEAD", "--full-a", ...(ds ? ["--snapshot", ds.path] : []), ...(appDir === "." ? [] : ["--scope", appDir])], { ...io, cwd: root, ...(ds ? { buildOwnership: ds.own } : {}) })))();
   if (checked !== 0) { o.err(`${tag} --to ${to} stopped at check: nothing compiled`); return 1; }
   // The snapshot is exactly tree + dependencies + the ledger before right-release starts; what it wrote may remain only as ledger
   // entries (a generated `gen/schemas`, a dist), recorded by this gate's own walk (stage-ledger.mjs, decision 2 Q1).
@@ -1974,11 +2556,30 @@ async function runDevTest(o, args, root, git, io, to, appRoot, appDir) {
   // Cargo would resolve `target/` (or a relative build.target-dir) against the snapshot: its output directory is resolved in the checkout
   // and passed absolute, so the warm outputs stay the checkout's and the snapshot holds no target/ (docs/GATE-CONTRACT.md "Output
   // directory & cache"). One Cargo workspace is pinned as a whole; several would share one directory (refused, naming them).
-  const pin = ds ? cargoOutputPin({ o, git, root, commit, executor }) : { dir: null };
+  // A broker host's output is the broker's (the receipts' `outputDir`); only a direct host pins the checkout's target directory.
+  const pin = ds && executor.kind !== "broker" ? await cargoOutputPinForScope({ o, git, root, commit, executor, snapshot: ds.path, ...(appDir === "." ? {} : { scopeDirs: [appDir] }) }) : { dir: null };
   if (pin.refusal) { o.err(`${tag} BLOCKED: RK_SNAPSHOT_OUTPUT_UNPINNED: ${pin.refusal}; nothing compiled`); return 1; }
   if (pin.dir) o.out(`${tag} output directory for the Cargo workspace: ${pin.dir} (the checkout's)`);
+  // GB-17: several workspaces, each with its own target (never one shared directory): the per-call wrapper binds every Cargo call to its workspace's target, from the snapshot's mapping.
+  let pinMulti = null;
+  if (pin.dirs?.length > 1) {
+    pinMulti = await bindUnitCargo({ o, git, root, ds, executor, which: whichIn(o), ...(appDir === "." ? {} : { scopeDirs: [appDir] }) });
+    if (pinMulti.refusal) { o.err(`${tag} BLOCKED: RK_SNAPSHOT_OUTPUT_UNPINNED: ${pinMulti.refusal}; nothing compiled`); return 1; }
+    if (pinMulti.note) o.out(`${tag} ${pinMulti.note}`);
+  }
   const commonDir = path.resolve(root, common);
   const source = ds ? sourceSplitOf({ root, ds, appDir }) : null;
+  // GB-58 (GATE dev/test exact stage; E19): the selected app's declared sidecars are staged ONCE under this snapshot's ownership before the dependent
+  // build, through the same planner and ledger as the compile and package stages (a Tauri crate with externalBin refuses to build without them). The
+  // app's own prepare step may stage them too; the ledger's attribution check, not an environment marker, is what keeps that single and exact.
+  if (ds) {
+    const sidecarConfigs = committedSidecarConfigs({ o, git, commit, appDir, base: ds.path });
+    const staged = await stageSidecarsOnce({ o, ds, root, git, configs: sidecarConfigs, appDir, cli: fileURLToPath(new URL("../cli/right-release.mjs", import.meta.url)), commonDir, commit, tree, stage: to, executor, tag });
+    if (!staged) { o.err(`${tag} --to ${to} stopped: the declared sidecars could not be staged; nothing compiled`); return 1; }
+  }
+  // right-release dev and test, and the Tauri CLI and every other child they start, reach Cargo only through the stage's carrier on a broker host.
+  const carrier = await carrierForChildren({ o, ds, root, git, executor, stage: to, tag });
+  if (carrier.refusal) { o.err(`${tag} BLOCKED: ${carrier.refusal}; nothing compiled`); return 1; }
   const run = startRun({ commonDir, commit, tree, stage: to, ...(source ? { source } : {}) });
   try {
     const cli = fileURLToPath(new URL("../cli/right-release.mjs", import.meta.url));
@@ -1987,15 +2588,19 @@ async function runDevTest(o, args, root, git, io, to, appRoot, appDir) {
     // The door's own RightKit runs every sub-step: a dev target's `right-release web-build|stage-sidecar` steps resolve `right-release`
     // on PATH, which found the app's node_modules copy (HeardRight on the Dell, 2026-10-27: the app's 0.6.8 guard refused what the
     // door's 0.6.9 admitted). An installed gate (node_modules/@rightkit/release/bin) has its package's bin shims two levels up.
-    const r = (o.spawnInherit ?? ((cmd, a, opts) => spawnInherit(cmd, a, { ...opts, stdio: "inherit" })))(process.execPath, [cli, to, ...passthrough], { cwd: source ? snapshotAppRootOf(ds.path, appDir) : appRoot, env: { ...o.env, ...run.env, ...doorPath(o), ...(pin.dir ? { CARGO_TARGET_DIR: pin.dir } : {}) } });
+    const r = (o.spawnInherit ?? ((cmd, a, opts) => spawnInherit(cmd, a, { ...opts, stdio: "inherit" })))(process.execPath, [cli, to, ...passthrough], { cwd: source ? snapshotAppRootOf(ds.path, appDir) : appRoot, env: carriedEnv(carrier, { ...o.env, ...run.env }, { ...doorPath({ ...o, env: { ...o.env, ...carrier.env } }), ...(pin.dir ? { CARGO_TARGET_DIR: pin.dir } : (pinMulti?.env ?? {})) }) });
+    const carriedOk = await carrier.finish({ stage: to });
     if (ds && !(await closeSnapshotStage({ o, ds, root, stage: to, step: to, tag })).ok) { o.err(`${tag} --to ${to} stopped: the result covers no known bytes`); return 2; }
-    return r.status === 0 ? 0 : 1;
-  } finally { endRun(run); }
+    return r.status === 0 && carriedOk ? 0 : 1;
+  } finally { endRun(run); carrier.cleanup(); try { pinMulti?.cleanup?.(); } catch { /* the wrapper map is the gate's own temp directory */ } }
 }
 
 /** A direct (Linux) executor's environment (PATH without RustRight shim directories) for every child this run starts. */
 function applyExecutorEnv(o, executor) {
   if (executor?.env && o.env) Object.assign(o.env, executor.env);
+  // Outside the broker by Adrian's recorded exception: every child's `rustright cargo|rustc|rustdoc` runs direct, never through the installed
+  // client (managed-cargo.mjs NO_BROKER_ENV; it holds only inside this live door run). Without it a child on the Mac or the Dell still reaches the broker.
+  if (o.brokerException && o.env && executor?.kind === "direct") o.env[NO_BROKER_ENV] = o.brokerException.exceptionId;
   if (executor?.note && o.out) o.out(`rightkit-gate: ${executor.note}`);
 }
 
@@ -2016,6 +2621,32 @@ export function doorPath(o, gateFile = o.gateFile ?? fileURLToPath(import.meta.u
  * readStdin, out, err, cwd, env, platform, abort (an AbortController), runScans and findRustfmt (the scan runner and the
  * lookup of a usable rustfmt, which the deferred Rust gate needs).
  */
+/** The gate flags a `--to <stage>` invocation takes (before a `--` separator, after which the arguments belong to right-release), and whether each takes a value. */
+const STAGE_VALUE_FLAGS = Object.freeze(["--to", "--platform", "--tier", "--commit", "--receipt-in", "--receipt-out", "--unit", "--units-file", "--all-units-exception"]);
+const STAGE_BOOLEAN_FLAGS = Object.freeze(["--route"]);
+
+/**
+ * Why `args` (a `--to <stage>` invocation) is not a well-formed request, or null. Every value flag needs a value that is not another flag and may be
+ * given once; `--flag=value`, unknown flags and stray words are refused. The arguments after a `--` separator are right-release's and are not read.
+ */
+export function stageArgsProblem(args) {
+  const at = args.indexOf("--");
+  const gate = at < 0 ? args : args.slice(0, at);
+  const seen = new Set();
+  for (let i = 0; i < gate.length; i += 1) {
+    const a = gate[i];
+    if (STAGE_BOOLEAN_FLAGS.includes(a)) continue;
+    if (STAGE_VALUE_FLAGS.includes(a)) {
+      const value = gate[i + 1];
+      if (value === undefined || value.startsWith("--")) return a === "--to" ? `--to needs a stage (${[...STAGES, "dev", "test"].join("|")})` : `${a} needs a value`;
+      if (seen.has(a)) return `${a} was given twice`;
+      seen.add(a); i += 1; continue;
+    }
+    return a.startsWith("-") ? `unknown option ${JSON.stringify(a)} (a value follows its flag as the next word: \`--commit <rev>\`, not \`--commit=<rev>\`)` : `unexpected argument ${JSON.stringify(a)}`;
+  }
+  return null;
+}
+
 export async function main(argv, io = {}) {
   const o = {
     spawn: defaultSpawn, exists: fs.existsSync, readFile: (f) => fs.readFileSync(f, "utf8"), writeFile: fs.writeFileSync, mkdir: fs.mkdirSync, chmod: fs.chmodSync, readdir: fs.readdirSync,
@@ -2028,6 +2659,8 @@ export async function main(argv, io = {}) {
   const option = (name) => { const i = args.indexOf(name); return i < 0 ? undefined : args[i + 1]; };
   // `clippy`: the Clippy route (../clippy-route.mjs; docs/GATE-CONTRACT.md §1 "Clippy route & batching"). Dispatched before the global
   // flags below because everything after `clippy` is cargo's own argv, verbatim (`-v`, `-h` and `--version` are cargo's).
+  // `candidate-receipt` (GB-73): the candidate build receipt the RustRight installer takes in place of a clean primary checkout.
+  if (args[0] === "candidate-receipt") return (await import("../candidate-receipt-command.mjs")).candidateReceiptCommand(o, args.slice(1));
   if (args[0] === "clippy") return (await import("../clippy-route.mjs")).clippyCommand(o, args.slice(1), { main, io, absoluteEnv: SNAPSHOT_ABSOLUTE_ENV });
   if (args.includes("--version") || args.includes("-v")) {
     o.out(JSON.parse(fs.readFileSync(new URL("../package.json", import.meta.url), "utf8")).version);
@@ -2052,6 +2685,42 @@ export async function main(argv, io = {}) {
   // class A scan (lockfiles, cargo-deny, cargo-audit, secrets, licences, manifests, workflow lint, syntax...) over the whole tree of the
   // commit, never a diff. Nothing compiles. The RustRight broker runs exactly this before it admits any compile. `--list`,
   // `--print-baseline` and `--only` stay app-check-only views.
+  // `check --commit <sha>` without `--snapshot` reads the gate's one warm snapshot of that commit, selected the way
+  // every `--to` stage selects it: host-wide build ownership first, then one sync of the commit into the gate-owned source directory, then the
+  // check of that snapshot below. There is no export and no copy of the source (docs/GATE-CONTRACT.md, 2026-10-29); the checkout's own files are
+  // never read, so an uncommitted edit in it is ignored. Hosted CI has no warm snapshot: its runner checkout is the commit, scanned in place.
+  // `check --commit <sha> --full-a` takes the same route (GB-48, GATE 34/36/44, E17): the selected commit's snapshot, never a conversion to
+  // `--worktree` that reads the live checkout after a momentary cleanliness check. Only hosted CI keeps the in-place full check.
+  const commitCheck = sub === "check"
+    && !["--snapshot", "--worktree", "--plan", "--list", "--print-baseline", "--only"].some((f) => args.includes(f)) && o.classA !== false && snapshotRouteSelected(o);
+  if (commitCheck) {
+    const sc = await import("../snapshot-check.mjs");
+    const snap = await import("../snapshot.mjs");
+    const { acquireBuildOwnership, ownershipFile } = await import("../build-ownership.mjs");
+    const at = option("--repo") ? path.resolve(o.cwd, option("--repo")) : o.cwd;
+    const top0 = o.spawn("git", ["rev-parse", "--show-toplevel"], { cwd: at });
+    if (failed(top0) || !text(top0).trim()) { o.err("rightkit-gate: not inside a git repository"); return 2; }
+    let own = o.buildOwnership ?? null; let ownHere = false;
+    try {
+      const checkout = fs.realpathSync.native(path.resolve(text(top0).trim()));
+      const selected = sc.commitOf(checkout, option("--commit") ?? "HEAD", o.spawn);
+      const snapshotsAt = o.snapshotRoot ?? snap.snapshotRoot({ platform: o.platform, env: o.env });
+      if (!own) {
+        try { own = (o.acquireOwnership ?? acquireBuildOwnership)({ file: ownershipFile({ platform: o.platform, beside: o.snapshotRoot }), stage: "check", snapshot: path.join(snapshotsAt, snap.repositoryOf(checkout).key), commit: selected.commit, platform: o.platform, env: o.env }); ownHere = true; }
+        catch (e) { if (e.code !== "busy" && e.code !== "refused") throw e; o.err(`rightkit-gate: RK_CHECK_ERROR: ${e.message}; nothing ran${e.code === "refused" ? ", nothing created" : ""}`); return 2; }
+        o.out(`rightkit-gate: build ownership ${own.joined ? "joined" : "held"} ${own.handle}${own.reclaimed ? ` (reclaimed from ${own.reclaimed.from}: ${own.reclaimed.proofs.join("; ")})` : ""}`);
+      }
+      let synced;
+      try { synced = (o.syncSnapshot ?? snap.syncSnapshot)({ checkout, rev: selected.commit, root: snapshotsAt }); }
+      catch (e) { o.err(`rightkit-gate: ${e.code === "error" ? sc.CHECK_ERROR : "BLOCKED"}: snapshot ${e.message}; nothing ran`); return e.code === "error" ? 2 : 1; }
+      o.out(`rightkit-gate: snapshot ${synced.path} is commit ${synced.commit} tree ${synced.tree} (written=${synced.written} removed=${synced.removed} unchanged=${synced.unchanged})`);
+      const next = [...argv]; const ci = next.indexOf("--commit");
+      if (ci >= 0) next.splice(ci, 2, "--commit", synced.commit); else next.push("--commit", synced.commit);
+      next.push("--snapshot", synced.path);
+      return await main(next, { ...io, buildOwnership: own });
+    } catch (e) { if (e instanceof sc.CheckError) { o.err(`rightkit-gate: ${sc.CHECK_ERROR}: ${e.message}`); return 2; } throw e; }
+    finally { if (ownHere) { const r = own.release(); if (r?.released === false && !own.joined) o.err(`rightkit-gate: build ownership ${own.handle} kept: ${r.why}`); } }
+  }
   if ((sub === "check" || (!sub && args.includes("--all"))) && args.includes("--snapshot") && !o.buildOwnership) {
     // Host-wide build ownership (../build-ownership.mjs; GATE-CONTRACT §1): held from before the first snapshot read through the
     // end of the check, so no other request can sync the snapshot while class A runs in it. A nested gate whose
@@ -2091,9 +2760,11 @@ export async function main(argv, io = {}) {
     // and package compile on the compile-tier rules, qualify and release name the release tier (rightkit#1296).
     const fullAdmission = args.includes("--full-a") && !args.includes("--list") && !args.includes("--print-baseline") && !args.includes("--only");
     const stripSnapshot = (list) => { const i = list.indexOf("--snapshot"); return i < 0 ? list : [...list.slice(0, i), ...list.slice(i + 2)]; };
-    const appArgs = stripSnapshot(args.slice(1).filter((a) => a !== "--full-a"));
+    const scopeForward = args.flatMap((a, i) => a === "--scope" ? [a, args[i + 1]] : []);
+    const withoutScope = args.slice(1).filter((a, i, list) => a !== "--scope" && list[i - 1] !== "--scope");
+    const appArgs = stripSnapshot(withoutScope.filter((a) => a !== "--full-a"));
     if (fullAdmission && !appArgs.includes("--rule-tier")) appArgs.push("--rule-tier", requestedTier);
-    const appCheck = await (o.appCheck ?? (await import("../app-check.mjs")).main)(appArgs, { out: o.out, err: o.err, label: "check", cwd: o.cwd });
+    const appCheck = await (o.appCheck ?? (await import("../app-check.mjs")).main)(appArgs, { out: o.out, err: o.err, label: "check", cwd: o.cwd, ...(snapshotDir && !args.includes("--worktree") ? { snapshot: snapshotDir } : {}) });
     if (args.includes("--list") || args.includes("--print-baseline") || args.includes("--only") || o.classA === false) {
       // A view of the app rules, never a class A verdict: say so, so no caller can take its exit 0 for a full check.
       // A green partial view exits PARTIAL_EXIT (3), never 0, so a caller that admits only exit 0 rejects it by status alone.
@@ -2109,7 +2780,7 @@ export async function main(argv, io = {}) {
     const checkCwd = repoArg ? path.resolve(o.cwd, repoArg) : o.cwd;
     // The app rules' tier is the stage's (rightkit#1296); class A's deterministic scans are the same at either tier.
     const ruleTier = requestedTier;
-    const classA = await main(["--class-a", "--rule-tier", ruleTier, ...(args.includes("--full-a") ? ["--full-a"] : []), ...(args.includes("--worktree") ? ["--worktree"] : ["--commit", snapshotCommit?.commit ?? option("--commit") ?? "HEAD"]), ...(snapshotDir ? ["--snapshot", snapshotDir] : [])], { ...io, cwd: checkCwd });
+    const classA = await main(["--class-a", "--rule-tier", ruleTier, ...(args.includes("--full-a") ? ["--full-a"] : []), ...(args.includes("--worktree") ? ["--worktree"] : ["--commit", snapshotCommit?.commit ?? option("--commit") ?? "HEAD"]), ...(snapshotDir ? ["--snapshot", snapshotDir] : []), ...scopeForward], { ...io, cwd: checkCwd });
     // RightKit checking itself: its own rules (line endings, consumer recipes, npm surface, version copies and the version feed, dispatcher
     // pins, consumer locks, generated docs, temp paths: scripts/preflight.mjs) and its exports' import safety are class A for the RightKit repository.
     let selfRules = 0;
@@ -2123,7 +2794,7 @@ export async function main(argv, io = {}) {
     // In snapshot mode RightKit's own scripts are the snapshot's (the commit's code), never the live checkout's.
     const selfRoot = snapshotDir ?? root;
     const rightkitRepository = root && (() => {
-      try { return JSON.parse(o.readFile(path.join(selfRoot, "packages", "release", "package.json"))).name === "@rightkit/release"; }
+      try { return isRightKitIdentity(o.readFile(path.join(selfRoot, ...RIGHTKIT_IDENTITY_FILE.split("/")))); }
       catch { return false; }
     })();
     if (rightkitRepository && (!o.exists(path.join(selfRoot, "scripts", "preflight.mjs")) || !o.exists(path.join(selfRoot, "scripts", "ci", "exports-import-effects.mjs")))) {
@@ -2137,7 +2808,7 @@ export async function main(argv, io = {}) {
       const r = launch(process.execPath, [path.join(snapshotDir, "scripts", "preflight.mjs"), "--repo", root, "--commit", snapshotCommit.commit], { cwd: root, env: o.env });
       selfRules = r.status === 0 ? 0 : 1;
       const effects = path.join(snapshotDir, "scripts", "ci", "exports-import-effects.mjs");
-      if (selfRules === 0 && o.exists(effects)) {
+      if (selfRules === 0 && o.exists(effects) && scopeForward.length === 0) {
         const common = o.spawn("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd: root });
         const report = path.join(failed(common) ? path.join(root, ".git") : text(common).trim(), "rightkit-gate", "import-effects", `snapshot-${snapshotCommit.commit}.json`);
         const e = launch(process.execPath, [effects, "--root", snapshotDir, "--no-export", "--report", report], { cwd: snapshotDir, env: o.env });
@@ -2206,6 +2877,7 @@ export async function main(argv, io = {}) {
   // directory. A direct host only, until the broker's snapshot carrier lands (step 4d).
   const snapshotB = !classAOnly && args.includes("--all") ? (option("--snapshot") ?? null) : null;
   if (snapshotB && !option("--commit")) { o.err(`${tag} --all --snapshot <dir> needs --commit <sha>`); return 2; }
+  let hostedCommitA = null;
   if (fullA && !args.includes("--worktree") && !snapshotA) {
     // A commit is checked in full only where its bytes are the live checkout: it is HEAD and nothing tracked or untracked differs
     // (the unit and app stages already refuse a dirty tree). Then the working tree is that commit, and the checks run there.
@@ -2214,16 +2886,32 @@ export async function main(argv, io = {}) {
     const dirty = at("status", "--porcelain", "--untracked-files=all");
     if (failed(want) || failed(head) || text(want).trim() !== text(head).trim()) { o.err("rightkit-gate: --full-a checks a commit only when it is HEAD of this checkout: the repository's checks run on the live tree"); return 2; }
     if (failed(dirty) || text(dirty).trim()) { o.err("rightkit-gate: --full-a on a commit needs a clean checkout (the live tree must be exactly that commit); commit or remove the changes"); return 2; }
-    const i = args.indexOf("--commit"); if (i >= 0) args.splice(i, 2);
-    args.push("--worktree");
+    if (!snapshotRouteSelected(o)) {
+      const tree = at("rev-parse", "--verify", `${text(want).trim()}^{tree}`);
+      if (failed(tree) || !text(tree).trim()) { o.err("rightkit-gate: RK_CHECK_ERROR: cannot identify hosted CI commit tree"); return 2; }
+      hostedCommitA = { commit: text(want).trim(), tree: text(tree).trim() };
+      const i = args.indexOf("--commit"); if (i >= 0) args.splice(i, 2, "--commit", hostedCommitA.commit); else args.push("--commit", hostedCommitA.commit);
+    } else {
+      const i = args.indexOf("--commit"); if (i >= 0) args.splice(i, 2);
+      args.push("--worktree");
+    }
   }
   const classACommit = classAOnly && !args.includes("--worktree") ? (option("--commit") ?? "HEAD") : null;
+  const scopeDirs = args.flatMap((a, i) => a === "--scope" ? [args[i + 1]] : []);
+  if (scopeDirs.length) {
+    const bad = scopeDirs.find((d) => typeof d !== "string" || !d || d.startsWith("--") || path.isAbsolute(d) || /^[A-Za-z]:/.test(d) || /(^|[\\/])\.\.([\\/]|$)/.test(d));
+    if (!fullA || (!snapshotA && !hostedCommitA) || bad !== undefined || scopeDirs.some((d) => d === undefined)) { o.err("rightkit-gate: --scope needs full Class A of a snapshot or committed hosted CI checkout & repository-relative directories"); return 2; }
+  }
   if (args.includes("--base") && (!option("--base") || option("--base").startsWith("--"))) { o.err("rightkit-gate: --base needs a ref"); return 2; }
 
   const top = o.spawn("git", ["rev-parse", "--show-toplevel"], { cwd: o.cwd });
   if (failed(top) || !text(top).trim()) { o.err("rightkit-gate: not inside a git repository"); return 2; }
   const root = path.resolve(text(top).trim());
   const git = (...a) => o.spawn("git", a, { cwd: root });
+  if (hostedCommitA) {
+    try { await verifyCommittedCheckout({ git, root, ...hostedCommitA, when: "before class A discovery" }); }
+    catch (error) { o.err(`rightkit-gate: RK_CHECK_ERROR: ${error.message}; nothing scanned`); return 2; }
+  }
   if (sub === "install-hook") return await installHook(o, root);
   // `env-digest`: only the environment identity a full class A verdict depends on (classAEnvironmentDigest), no scans. The broker
   // recomputes it when a queued compile starts and re-runs the check if it changed since the verdict.
@@ -2253,16 +2941,81 @@ export async function main(argv, io = {}) {
   // `--unit` is a gate flag only before a `--` separator: after it the arguments belong to right-release (an app's `--to dev -- …`).
   const separator = args.indexOf("--");
   const unitFlag = args.includes("--unit") && (separator < 0 || args.indexOf("--unit") < separator);
+  // RightKit names its unit on every run (rightkitDoorRule): `--unit <selector>`, `--units-file <json written for this run>` or
+  // `--all-units-exception <id>`; exactly one. The unit list is read here, before anything runs, so a bad file is a usage error (exit 2).
+  const gateFlag = (name) => args.includes(name) && (separator < 0 || args.indexOf(name) < separator);
+  const unitsFileFlag = gateFlag("--units-file"); const allUnitsFlag = gateFlag("--all-units-exception");
+  let unitList = null;
+  if (unitsFileFlag || allUnitsFlag) {
+    const flag = unitsFileFlag ? "--units-file" : "--all-units-exception";
+    if (option("--to") === undefined) { o.err(`rightkit-gate: ${flag} applies to a --to stage\n${USAGE}`); return 2; }
+    if ([unitFlag, unitsFileFlag, allUnitsFlag].filter(Boolean).length > 1) { o.err("rightkit-gate: name the unit once: --unit, --units-file or --all-units-exception, not several"); return 2; }
+    if (!option(flag) || option(flag).startsWith("--")) { o.err(`rightkit-gate: ${flag} needs a value\n${USAGE}`); return 2; }
+    if (unitsFileFlag) {
+      try { unitList = readUnitList((f) => o.readFile(path.resolve(o.cwd, f)), option("--units-file")); }
+      catch (e) { o.err(`rightkit-gate: ${e.message}`); return 2; }
+    }
+  }
+  // `--no-broker <exception-id>`: the one documented exception to the mandatory broker on Mac and Dell (broker-exception.mjs). The record is
+  // read from the selected commit, never the working tree; every refusal is typed and nothing runs. The run then takes the same stages
+  // with the direct executor, and prints and records the exception.
+  const noBrokerAt = args.indexOf("--no-broker");
+  if (noBrokerAt >= 0 && (separator < 0 || noBrokerAt < separator)) {
+    const brokerId = args[noBrokerAt + 1];
+    if (option("--to") === undefined) { o.err(`rightkit-gate: ${BROKER_EXCEPTION_ERRORS.usage}: --no-broker <exception-id> applies to a --to stage\n${USAGE}`); return 2; }
+    args.splice(noBrokerAt, typeof brokerId === "string" && !brokerId.startsWith("--") ? 2 : 1);
+    let granted;
+    try {
+      let record = null; let inRightKit = true;
+      if (typeof brokerId === "string" && !brokerId.startsWith("--")) {
+        const pinned = (await import("../snapshot.mjs")).resolveCommit(root, option("--commit") ?? "HEAD");
+        const shown = git("show", `${pinned.commit}:${BROKER_EXCEPTIONS_FILE}`);
+        record = failed(shown) ? null : text(shown);
+        // The repository identity of the commit decides what an exception must name: RightKit's units, or (every other repository, built whole) nothing.
+        inRightKit = rightkitIdentityAt(git, pinned.commit);
+      }
+      // A unit list run covers every listed unit; a run that names no unit (the whole repository) selects every unit.
+      const selected = unitFlag ? unitsOfSelector(option("--unit")) : unitList ? unitList.flatMap((u) => unitsOfSelector(u)) : unitsOfSelector(undefined);
+      granted = authorizeNoBroker({ id: brokerId, record, platform: o.platform, units: selected, now: o.now ? o.now() : Date.now(), inRightKit });
+    } catch (e) {
+      if (!e.code?.startsWith("RK_BROKER_EXCEPTION_")) { o.err(`rightkit-gate: cannot resolve ${option("--commit") ?? "HEAD"} to a commit: ${e.message}`); return 2; }
+      o.err(`rightkit-gate: BLOCKED: ${e.message}; nothing ran`); return e.code === BROKER_EXCEPTION_ERRORS.usage ? 2 : 1;
+    }
+    const brokerResolver = o.resolveExecutor ?? resolveExecutor;
+    o.resolveExecutor = (a) => brokerResolver({ ...a, forceDirect: true });
+    o.brokerException = granted;
+    io = { ...io, resolveExecutor: o.resolveExecutor, brokerException: granted };
+    o.out(`rightkit-gate: BROKER EXCEPTION ${describeBrokerException(granted)}`);
+  }
+  // The door's stage arguments are read strictly (E2E L3-02): a flag with no value, `--flag=value`, an unknown flag, a repeated value flag or a stray
+  // word is refused before git, ownership or any process, never ignored (`--commit=<old sha>` used to build HEAD, a trailing `--to` ran the default gate).
+  // A unit run (`--unit`) validates its own, narrower vocabulary below ("unit stages take only ...").
+  if (!sub && !unitFlag && args.some((a) => a === "--to" || a.startsWith("--to="))) {
+    const problem = stageArgsProblem(args);
+    if (problem) { o.err(`rightkit-gate: ${problem}\n${USAGE}`); return 2; }
+  }
+  // `--route` is a gate flag only before a `--` separator (after it the arguments belong to right-release). It answers which route a
+  // stage takes and runs nothing, so it takes no unit, receipt or release stage (rightkit#1297).
+  const gateArgs = separator < 0 ? args : args.slice(0, separator);
+  if (gateArgs.includes("--route")) {
+    const routeTo = option("--to");
+    const clash = ["--unit", "--units-file", "--all-units-exception", "--receipt-in", "--receipt-out"].filter((f) => gateArgs.includes(f));
+    if (routeTo === undefined) { o.err(`rightkit-gate: --route needs --to ${ROUTE_PROBE_STAGES.join("|")}\n${USAGE}`); return 2; }
+    if (routeTo === "release") { o.err("rightkit-gate: --route answers for --to check|compile|package|qualify|dev|test; release uploads and has no route of its own"); return 2; }
+    if (clash.length) { o.err(`rightkit-gate: --route runs nothing and takes no ${clash.join(" or ")}`); return 2; }
+    o.routeProbe = true;
+  }
   if (option("--to") !== undefined && unitFlag) {
     const selector = option("--unit");
     const validArgs = args.length % 2 === 0 && args.every((a, i) => i % 2 ? !a.startsWith("--") : ["--to", "--unit", "--receipt-out", "--commit"].includes(a)) && ["--to", "--unit", "--receipt-out", "--commit"].every((flag) => args.filter((a) => a === flag).length <= 1);
     if (!validArgs || !selector) {
       o.err("rightkit-gate: unit stages take only --to, --unit and optional --receipt-out and --commit"); return 2;
     }
-    // Row 7.06a: on the snapshot route (Linux now; Mac and Dell at the cutover) a unit stage builds the selected commit's snapshot.
-    if (!o.doorSnapshot && o.env.GITHUB_ACTIONS !== "true" && snapshotRouteSelected(o)) return await runUnitSnapshot(o, args, root, git, io, option);
-    if (option("--commit") !== undefined) { o.err("rightkit-gate: BLOCKED: --commit selects a commit for the snapshot route; on this host a unit stage takes HEAD of a clean checkout until the cutover"); return 2; }
-    const head = git("rev-parse", "HEAD"), treeResult = git("rev-parse", "HEAD^{tree}"), common = git("rev-parse", "--git-common-dir"), dirty = git("status", "--porcelain", "--untracked-files=no");
+    // Row 7.06a: on every host but hosted CI a unit stage builds the selected commit's snapshot (Linux direct, Mac and Dell through the carrier).
+    if (!o.doorSnapshot && snapshotRouteSelected(o)) return await runUnitSnapshot(o, args, root, git, io, option);
+    // Hosted CI only: the runner's checkout is the commit.
+    if (option("--commit") !== undefined) { o.err("rightkit-gate: BLOCKED: --commit selects a commit for the snapshot route; hosted CI builds the runner's checkout, which is the commit"); return 2; }
+    const head = git("rev-parse", "HEAD"), treeResult = git("rev-parse", "HEAD^{tree}"), common = git("rev-parse", "--git-common-dir"), dirty = git("status", "--porcelain", "--untracked-files=all");
     const commit = text(head).trim(), tree = text(treeResult).trim();
     if (failed(head) || failed(treeResult) || failed(common) || !text(common).trim() || !/^[0-9a-f]{40}$/.test(commit) || !/^[0-9a-f]{40}$/.test(tree) || failed(dirty) || text(dirty).trim()) { o.err("rightkit-gate: BLOCKED: unit stages need clean committed HEAD and tree"); return 1; }
     const match = /^(?:npm:@rightkit\/([a-z0-9-]+)|cargo:(rightkit-[a-z0-9-]+))$/.exec(selector);
@@ -2276,12 +3029,22 @@ export async function main(argv, io = {}) {
     // node_modules does not carry; the app paths of this gate must keep loading there (app-check.test: the installed copy).
     const { runUnitGate } = await import("../unit-gate.mjs");
     return await runUnitGate({ selector, to: option("--to"), root, commonDir: path.resolve(root, text(common).trim()), commit, tree, executor, env: o.env, platform: o.platform,
-      check: (tier) => main(["check", "--commit", "HEAD", "--full-a", "--rule-tier", tier], { ...io, cwd: root }), out: o.out, err: o.err,
+      check: async (tier) => {
+        await verifyCommittedCheckout({ git, root, commit, tree, when: "before unit:check" });
+        const result = await main(["check", "--commit", commit, "--full-a", "--rule-tier", tier, "--scope", path.posix.dirname(manifest)], { ...io, cwd: root });
+        await verifyCommittedCheckout({ git, root, commit, tree, when: "after unit:check" });
+        return result;
+      }, out: o.out, err: o.err,
       ...(reportOut ? { writeReport: (report) => o.writeFile(path.resolve(o.cwd, reportOut), `${JSON.stringify(report, null, 2)}\n`) } : {}),
     });
   }
   if (unitFlag) { o.err("rightkit-gate: --unit requires --to"); return 2; }
-  if (option("--to") !== undefined) return await runStages(o, args, root, git, io);
+  if (option("--to") !== undefined) {
+    // A door run that names no unit: RightKit refuses it unless Adrian's exception or a unit list names what runs (rightkitDoorRule).
+    const door = await rightkitDoorRule(o, args, root, git, io, { unitsFileFlag, allUnitsFlag, unitList });
+    if (door.exit !== undefined) return door.exit;
+    return await runStages(o, args, root, git, io);
+  }
   if (sub === "stage") return stageForPublisher(o, args, root, git);
 
   const planOnly = args.includes("--plan");
@@ -2323,6 +3086,16 @@ export async function main(argv, io = {}) {
   // A broker-managed host whose broker is unreachable refuses the moment a Cargo manifest is in the snapshot (below): a repository
   // with no Rust owes nothing to the broker (a git hook's minimal PATH, a JS-only app), and the class A scans never compile.
   const cargoCommand = executor.cargo ?? ["cargo"];
+  // The declared Linux broker route's cargo is `[<absolute validated client>, "cargo"]`, which the scan planner (planScans: `["rustright","cargo"]` or
+  // `["cargo"]`) refuses, and a PATH `rustright` is never the client. So the scans are PLANNED with the logical `["rustright","cargo"]` and every spawn the
+  // gate hands the scans, the discovery of the snapshot's workspaces and the tool probes resolves that one name to the executor's validated client,
+  // with the endpoint the executor declared (`withDeclaredClient`); nothing starts a `rustright` found on PATH. The carried requests
+  // (snapshotCargoSpawn's carrySpawn, the snapshot carrier) name the client by absolute path already. Every other route plans `cargoCommand` itself.
+  const declaredClient = executor.kind === "broker" && executor.route === LINUX_BROKER_ROUTE && typeof executor.client === "string" ? executor.client : null;
+  const planCargoCommand = declaredClient ? ["rustright", ...cargoCommand.slice(1)] : cargoCommand;
+  const withDeclaredClient = (spawn) => (declaredClient
+    ? (command, args, opts = {}) => (command === "rustright" ? spawn(declaredClient, args, { ...opts, env: { ...(opts.env ?? o.env), ...(executor.env ?? {}) } }) : spawn(command, args, opts))
+    : spawn);
   // A broker host (Mac, Dell) compiles a commit snapshot through the RustRight snapshot carrier: `deps.snapshotBroker`, built in the
   // snapshot-compile region below (item 7 rows 7.20 to 7.24). A broker-managed host whose broker cannot be reached is refused with
   // the executor's own problem, never compiled around.
@@ -2339,11 +3112,9 @@ export async function main(argv, io = {}) {
   }
 
   const ac = o.abort ?? new AbortController();
-  let exportRoot = null;
   let snapshotGitConfig = null;
   let cargoShimDir = null;
   const cleanup = () => {
-    if (exportRoot) fs.rmSync(exportRoot, { recursive: true, force: true });
     if (cargoShimDir) fs.rmSync(cargoShimDir, { recursive: true, force: true });
     if (snapshotGitConfig) { fs.rmSync(snapshotGitConfig, { force: true }); try { fs.rmdirSync(path.dirname(snapshotGitConfig)); } catch { /* not empty: leave it, the next exact sync prunes it */ } }
   };
@@ -2351,6 +3122,14 @@ export async function main(argv, io = {}) {
   try {
     let repo = root;
     let snapshotBCommit = null;
+    // On a broker host the gate's snapshot is the broker's managed one, where RustRight refuses a root request ("a root request cannot run inside a
+    // managed snapshot", rightkit#1311): the gate's own Cargo reads there (unit discovery, workspace members) are carried read-only requests,
+    // with the broker's signed receipt verified (snapshot-metadata.mjs). The checkout, git and a direct host keep the plain spawn.
+    let snapshotSpawn = withDeclaredClient((c, a, opts) => o.spawn(c, a, opts));
+    let discoveryBroker = null;
+    // On a broker host, the spawn every Class A Cargo scan of the snapshot runs through: a Cargo call inside the snapshot is a carried read-only
+    // request of one of the exact admitted shapes (snapshot-metadata.mjs), anything else passes through (node, git, the client's probe).
+    let scanSpawn = null;
     if (snapshot && snapshotB) {
       // Direct host: no broker grant to satisfy, so no config-only .git; the snapshot is scanned and compiled in place.
       repo = snapshotB;
@@ -2368,27 +3147,14 @@ export async function main(argv, io = {}) {
         o.writeFile(snapshotGitConfig, `[remote "origin"]\n\turl = ${originUrl}\n`);
       }
     } else if (snapshot) {
-      exportRoot = fs.mkdtempSync(path.join(exportTmpRoot({ env: o.env, platform: o.platform, exists: o.exists }), "rk-gate-"));
-      repo = path.join(exportRoot, "repo");
-      // Every file of the commit or tree: read-tree into a private index, then checkout-index. `git archive` would leave out files
-      // marked export-ignore in .gitattributes, so they would never be scanned; this export has no such exclusion.
-      const indexEnv = { ...o.env, GIT_INDEX_FILE: path.join(exportRoot, "index") };
-      const made = o.spawn("git", ["read-tree", snapshot], { cwd: root, env: indexEnv });
-      // git builds each path as <prefix><index path> with "/" separators and creates only the directories below the prefix, so the
-      // export root must exist and the prefix use "/": a "C:\\...\\repo\\" prefix made checkout-index fail on Windows
-      // (publish run 40282215043: "cannot create directory at ...\\repo\\.github").
-      fs.mkdirSync(repo, { recursive: true });
-      const x = failed(made) ? made : o.spawn("git", ["checkout-index", "--all", "--force", `--prefix=${repo.split(path.sep).join("/")}/`], { cwd: root, env: indexEnv });
-      if (failed(made) || failed(x)) { o.err(`${tag} cannot export ${snapshot}: ${why(made) || why(x)}`); return 2; }
-      // rustright binds the tracked .rightkit-local-build.json grant to the origin URL in .git/config (rustright-policy local_build.rs),
-      // and the export has no .git, so cargo metadata in it was refused on every broker host and no push passed the hook (rightkit#1215).
-      // A config-only .git carries exactly the source checkout's origin and is not a repository to git (no HEAD, no objects), so nothing
-      // can run git against the export. No origin (a checkout without a remote): nothing is written and rustright decides as before.
-      const origin = o.spawn("git", ["config", "--get", "remote.origin.url"], { cwd: root });
-      const originUrl = failed(origin) ? "" : text(origin).trim();
-      if (originUrl) {
-        o.mkdir(path.join(repo, ".git"), { recursive: true });
-        o.writeFile(path.join(repo, ".git", "config"), `[remote "origin"]\n\turl = ${originUrl}\n`);
+      // No export, no copy of the source (docs/GATE-CONTRACT.md, 2026-10-29): a host that has the gate's warm snapshot reads the commit
+      // through it (`check --commit` selects it above, `--to` stages hand it over). What reaches here is a run whose checkout IS the
+      // commit: hosted CI's runner checkout, or HEAD for the legacy gate run. It is scanned in place, only after proving it is that commit.
+      if (classAOnly && snapshotRouteSelected(o)) { o.err(`${tag} BLOCKED: class A of a commit reads the gate's warm snapshot of it, never the checkout; run \`rightkit-gate check --commit <sha>\` (it selects the snapshot) or pass \`--snapshot <dir>\``); return 2; }
+      const want = git("rev-parse", "--verify", `${snapshot}^{commit}`); const head = git("rev-parse", "--verify", "HEAD^{commit}");
+      if (snapshot !== "HEAD" && (failed(want) || failed(head) || text(want).trim() !== text(head).trim())) {
+        o.err(`${tag} BLOCKED: ${snapshot} is not HEAD of this checkout, and this run has no gate-owned snapshot of it: only the commit the checkout already is can be scanned in place (hosted CI's runner checkout); check another commit with \`check --commit <sha>\` on a host with the gate's warm snapshot`);
+        return 2;
       }
     }
     // Every file of the snapshot, once: units, manifests, lockfiles and the changed set are all read from what is scanned, never from
@@ -2399,7 +3165,7 @@ export async function main(argv, io = {}) {
     const tracked = (name) => files.filter((f) => f === name || f.endsWith(`/${name}`));
     const readSnap = (f) => o.readFile(f);
 
-    let rust; let npm; let npmRoots = []; let manifests = [];
+    let rust; let npm; let npmRoots = []; let installRoots = []; let manifests = []; let closure = null; let closureTools = null;
     try {
       manifests = tracked("Cargo.toml");
       if (executor.kind === "refuse" && manifests.length) { o.err(`${tag} BLOCKED: ${executor.problem}`); return 1; }
@@ -2413,11 +3179,63 @@ export async function main(argv, io = {}) {
         const r = git("ls-files", "-z", "--others", "--exclude-standard", "--", ":(glob)**/Cargo.toml");
         return failed(r) ? [] : text(r).split("\0").filter(Boolean).map(posix);
       };
-      rust = discoverRustWorkspaces({ root: repo, spawn: (c, a, opts) => o.spawn(c, a, opts), cargoCommand, tracked, untracked, fixtures, readFile: readSnap });
+      if (executor.kind === "broker" && snapshot && (snapshotA || snapshotB) && manifests.length) {
+        const { snapshotCargoSpawn } = await import("../snapshot-metadata.mjs");
+        const { createSnapshotBroker } = await import("../snapshot-broker.mjs");
+        const snapshotCheck = await import("../snapshot-check.mjs");
+        const snapshotCommitOf = () => snapshotCheck.commitOf(fs.realpathSync.native(root), String(snapshot), o.spawn);
+        // The broker is built before anything is read: a missing enrollment, ownership or client refuses here, naming its code (as the compile does).
+        try {
+          if (o.snapshotBroker && typeof o.snapshotBroker.create !== "function") discoveryBroker = o.snapshotBroker; // a fixture broker (tests)
+          else {
+            const sc = snapshotCommitOf();
+            discoveryBroker = createSnapshotBroker({ env: o.env, platform: o.platform, checkout: root, commit: { sha: sc.commit, tree: sc.tree }, snapshot: { path: repo, expectedTree: sc.tree }, ownership: o.buildOwnership, client: executor.route === LINUX_BROKER_ROUTE ? executor.client : which("rustright").find((c) => path.isAbsolute(c)), gateFile: callingGatePath(), spawn: o.spawn });
+          }
+        } catch (error) { o.err(`${tag} BLOCKED: ${error.code ?? "RK_SNAPSHOT_BROKER"}: ${error.message}; nothing compiled`); return 1; }
+        snapshotSpawn = snapshotCargoSpawn({ spawn: withDeclaredClient((c, a, opts) => o.spawn(c, a, opts)), cargoCommand: planCargoCommand, snapshotRoot: repo, env: o.env, err: o.err, broker: () => discoveryBroker });
+        scanSpawn = snapshotCargoSpawn({ spawn: withDeclaredClient(defaultSpawnAsync), carrySpawn: (c, a, opts) => o.spawn(c, a, opts), cargoCommand: planCargoCommand, snapshotRoot: repo, env: o.env, err: o.err, broker: () => discoveryBroker });
+      }
       npm = discoverNpmUnits({ root: repo, tracked, readFile: readSnap, exists: o.exists });
       npmRoots = discoverPnpmRoots({ root: repo, tracked, exists: o.exists });
+      let metadata = null;
+      if (scopeDirs.length) {
+        closureTools = await import("../app-closure.mjs");
+        const readCommitted = (file) => {
+          if (!files.includes(file)) throw new Error(`${file} is absent from the committed tree`);
+          return readSnap(path.join(repo, file));
+        };
+        const sourceMetadata = closureTools.cargoMetadataFromManifests({ manifests: manifests.filter((m) => !fixtures.some((d) => m.startsWith(`${d.replace(/\/$/, "")}/`))), readFile: readCommitted });
+        const inventory = discoverRustWorkspaces({ root: repo, tracked, fixtures, readFile: readSnap, metadata: sourceMetadata });
+        closure = closureTools.closureOf({ scopeDirs, npmUnits: npm, rustUnits: inventory.units, readFile: readCommitted });
+        const selectedWorkspaces = new Set(inventory.units.filter((u) => closure.rust.has(u.name)).map((u) => u.cargoDir));
+        metadata = (dir) => {
+          const source = sourceMetadata(dir);
+          return selectedWorkspaces.has(source.cargoDir) ? workspaceMetadata({ root: repo, spawn: snapshotSpawn, cargoCommand: planCargoCommand, dir, realpath: fs.realpathSync }) : source;
+        };
+      }
+      rust = discoverRustWorkspaces({ root: repo, spawn: snapshotSpawn, cargoCommand: planCargoCommand, tracked, untracked, fixtures, readFile: readSnap, ...(metadata ? { metadata } : {}) });
+      if (closure) {
+        // Confirm membership discovered by Cargo; its closure must resolve without unrelated execution.
+        closure = closureTools.closureOf({ scopeDirs, npmUnits: npm, rustUnits: rust.units, readFile: (file) => { if (!files.includes(file)) throw new Error(`${file} is absent from the committed tree`); return readSnap(path.join(repo, file)); } });
+        installRoots = [...new Set(npm.filter((u) => closure.npm.has(u.name)).map((u) => u.root ?? "."))].sort();
+      } else installRoots = npmRoots;
     } catch (e) { o.err(`${tag} BLOCKED: cannot discover the repository's units: ${e.message}`); return 1; }
     for (const k of rust.skipped) o.out(`${tag} note: ${k.manifest} is skipped, not scanned: ${k.why}`);
+    // Every repository but RightKit commits one fixed build definition that lists every Cargo workspace; a run builds all of them and nothing is
+    // chosen per run (#1325, Adrian 2026-10-31). The workspaces this commit holds and the committed list must be the same set, missing or extra,
+    // or nothing runs. RightKit is judged per unit instead (rightkitDoorRule). `--plan` builds nothing, so it only says what a run would meet.
+    {
+      let rightkitHere = false;
+      if (files.includes(RIGHTKIT_IDENTITY_FILE)) { try { rightkitHere = isRightKitIdentity(readSnap(path.join(repo, ...RIGHTKIT_IDENTITY_FILE.split("/")))); } catch { rightkitHere = false; } }
+      if (!rightkitHere) {
+        try { checkCargoWorkspaceList({ discovered: rust.workspaces.map((w) => w.cargoDir), record: files.includes(CARGO_WORKSPACE_LIST_FILE) ? readSnap(path.join(repo, CARGO_WORKSPACE_LIST_FILE)) : null }); }
+        catch (e) {
+          if (!e.code?.startsWith("RK_CARGO_WORKSPACE_LIST_")) throw e;
+          if (args.includes("--plan")) o.out(`${tag} note: a run would be refused: ${e.message}`);
+          else { o.err(`${tag} BLOCKED: ${e.message}; nothing ran`); return 1; }
+        }
+      }
+    }
 
     // The snapshot compile: verified as the commit's tree before anything runs, dependencies installed into it offline from the
     // checkout's store, and every Cargo workspace's output pinned to the target directory cargo resolves for it IN THE CHECKOUT
@@ -2449,7 +3267,7 @@ export async function main(argv, io = {}) {
           directDeclaredNotes = judged.findings.map((f) => `declared compile input: ${f}`);
         }
         o.out(`${tag} snapshot ${snapshotB} is commit ${snapshotBCommit.commit} tree ${snapshotBCommit.tree} (verified before the compile)`);
-        for (const r of sc.installSnapshotDependencies({ checkout, snapshot: snapshotB, roots: npmRoots, env: o.env, spawn: o.spawn })) o.out(`${tag} ${sc.describeInstall(r)}`);
+        for (const r of sc.installSnapshotDependencies({ checkout, snapshot: snapshotB, ...snapshotBCommit, ...(o.snapshotLedger !== undefined ? { ledger: o.snapshotLedger } : {}), roots: installRoots, ...(closure ? { packageDirs: npm.filter((u) => closure.npm.has(u.name)).map((u) => u.dir) } : {}), env: o.env, spawn: o.spawn })) o.out(`${tag} ${sc.describeInstall(r)}`);
       } catch (error) { o.err(`${tag} ${error.code === "RK_CHECK_ERROR" ? "RK_CHECK_ERROR" : "BLOCKED"}: ${error.message}`); return error.code === "RK_CHECK_ERROR" ? 2 : 1; }
       // A broker host (item 7 rows 7.20 to 7.24): the compile goes through the RustRight snapshot carrier. The broker pins the output
       // directory (its managed generation target), so no checkout target is resolved here; the gate's broker is built once, with the
@@ -2458,8 +3276,8 @@ export async function main(argv, io = {}) {
       if (executor.kind === "broker" && manifests.length) {
         try {
           const { createSnapshotBroker } = await import("../snapshot-broker.mjs");
-          const client = which("rustright").find((c) => path.isAbsolute(c));
-          snapshotBroker = createSnapshotBroker({ env: o.env, platform: o.platform, checkout: root, commit: { sha: snapshotBCommit.commit, tree: snapshotBCommit.tree }, snapshot: { path: snapshotB, expectedTree: snapshotBCommit.tree }, ownership: o.buildOwnership, client, gateFile: callingGatePath(), spawn: o.spawn });
+          const client = executor.route === LINUX_BROKER_ROUTE ? executor.client : which("rustright").find((c) => path.isAbsolute(c));
+          snapshotBroker = discoveryBroker ?? createSnapshotBroker({ env: o.env, platform: o.platform, checkout: root, commit: { sha: snapshotBCommit.commit, tree: snapshotBCommit.tree }, snapshot: { path: snapshotB, expectedTree: snapshotBCommit.tree }, ownership: o.buildOwnership, client, gateFile: callingGatePath(), spawn: o.spawn });
         } catch (error) { o.err(`${tag} BLOCKED: ${error.code ?? "RK_SNAPSHOT_BROKER"}: ${error.message}; nothing compiled`); return 1; }
         o.out(`${tag} broker snapshot compile: pins ${snapshotBroker.pins.keyId.slice(0, 12)} from ${snapshotBroker.pinsSource}, ${snapshotBroker.declaredInputs.length} declared input(s) read from the snapshot, ownership ${snapshotBroker.handle}`);
       }
@@ -2491,11 +3309,9 @@ export async function main(argv, io = {}) {
           let broker = null;
           if (snapshotBroker) {
             // Broker mode (the Mac, decision C): every cargo a test reaches is its own carried request. The gate's own snapshot-to-checkout
-            // map is the only source of a request's primaryCwd, and broker work may exist from here on: the ownership records it first.
+            // map is the only source of a request's primaryCwd; each carried request records its sub-handle in the ownership just before it is sent.
             const checkoutRoot = fs.realpathSync.native(root);
             const checkoutDirs = Object.fromEntries(rust.workspaces.map((ws) => [ws.cargoDir, path.join(checkoutRoot, ...(ws.cargoDir === "." ? [] : ws.cargoDir.split("/")))]));
-            const marked = snapshotBroker.markBrokerSubmit();
-            if (marked?.broker?.submitted !== true || marked.handle !== snapshotBroker.handle) throw new Error(`the build ownership did not record the broker submit under ${snapshotBroker.handle}`);
             const { brokerSection } = await import("../snapshot-broker.mjs");
             broker = { checkoutDirs, section: brokerSection(snapshotBroker) };
           }
@@ -2515,7 +3331,7 @@ export async function main(argv, io = {}) {
         // (its directory is an input above, which holds its Cargo.toml, Cargo.lock, deny.toml, .cargo and .rightkit).
         ...(rust.workspaces.some((w) => w.cargoDir === ".") ? ["Cargo.toml", "Cargo.lock", "deny.toml"] : []),
         ".cargo", "rust-toolchain.toml", "rust-toolchain", "clippy.toml", "rustfmt.toml", ...npmRootFiles, ...npmRoots.filter((r) => r !== ".").flatMap((r) => npmRootFiles.map((f) => `${r}/${f}`))])];
-      // Batched like cargoInputsDiffer: one argv with every input path overflows Windows' command line in a large repository.
+      // Batched (pathspecBatches): one argv with every input path overflows Windows' command line in a large repository.
       const dirtyRuns = pathspecBatches(inputs).map((batch) => git("status", "--porcelain", "--untracked-files=all", "--", ...batch));
       const dirtyFailed = dirtyRuns.find((r) => failed(r));
       const dirtyFiles = dirtyFailed ? [`git status failed: ${why(dirtyFailed)}`] : dirtyRuns.flatMap((r) => text(r).split(/\r?\n/)).filter(Boolean).filter((l) => !l.includes("node_modules"));
@@ -2552,38 +3368,12 @@ export async function main(argv, io = {}) {
     }
     const rustScope = restricted ? scopeNames : null;
 
-    // A broker host: rustright refuses every cargo command but a locked metadata outside the app's primary checkout
-    // (RK_NOT_PRIMARY_CHECKOUT), so class A's cargo scans cannot read the export there. They run in the primary checkout, allowed only
-    // when every Cargo input in it is blob-identical to the snapshot's; a live edit to a manifest, lock, deny.toml or .cargo/ refuses
-    // the check with the paths named. A direct host (cloud, CI) keeps reading the export. (rightkit#1215, third cause)
+    // A broker host: the class A Cargo scans of the snapshot (metadata, fetch, cargo-deny, cargo-audit) are carried read-only requests that run IN
+    // THE SNAPSHOT (scanSpawn above), so an uncommitted edit in the checkout is ignored, never refused (docs/GATE-CONTRACT.md: no dirty-tree
+    // condition; class A reads the snapshot). The checkout is only where the RustRight client starts (it refuses to start anywhere else) and
+    // where class B's carried compiles name their working directory; `cargoLiveRoot` is that directory, never a source.
     let cargoLiveRoot = null;
-    if (classAOnly && snapshot && executor.kind === "broker" && manifests.length) {
-      const differing = cargoInputsDiffer({ root, snapshot, manifests, spawn: (c, a, opts) => o.spawn(c, a, opts) });
-      if (differing.length) {
-        const resolved = git("rev-parse", "--verify", String(snapshot));
-        o.err(`${tag} BLOCKED: the broker scans Cargo inputs in the primary checkout, and these differ from ${(failed(resolved) ? String(snapshot) : text(resolved).trim()).slice(0, 12)}: ${differing.join(", ")}; commit or restore them, then run the check again`);
-        return 1;
-      }
-      // A snapshot check's cargo scans then read the checkout's WORKSPACE, which can hold more than its tracked inputs: an untracked
-      // member, or a stray directory a members glob (crates/*) matches. Cargo's own member list there must equal the commit's (from
-      // the snapshot), or the verdict would not be the commit's (Oracle review of 79c4427b). A checkout cargo cannot read refuses too.
-      if (snapshotA) {
-        const memberDiff = [];
-        const membersOf = (base, dir) => workspaceMetadata({ root: base, spawn: (c, a, opts) => o.spawn(c, a, opts), cargoCommand, dir, realpath: fs.realpathSync }).members.map((m) => m.manifest).sort();
-        for (const ws of rust.workspaces) {
-          let inCommit; let inCheckout;
-          try { inCommit = membersOf(repo, ws.cargoDir); } catch (e) { memberDiff.push(`${ws.cargoDir} (commit): ${e.message}`); continue; }
-          try { inCheckout = membersOf(root, ws.cargoDir); } catch (e) { memberDiff.push(`${ws.cargoDir} (checkout): ${e.message}`); continue; }
-          const extra = inCheckout.filter((m) => !inCommit.includes(m)); const missing = inCommit.filter((m) => !inCheckout.includes(m));
-          if (extra.length || missing.length) memberDiff.push(`${ws.cargoDir}: checkout-only ${extra.join(", ") || "none"}; commit-only ${missing.join(", ") || "none"}`);
-        }
-        if (memberDiff.length) {
-          o.err(`${tag} BLOCKED: the broker scans Cargo in the primary checkout, and cargo's workspace there is not the commit's: ${memberDiff.join("; ")}; remove or commit what differs, then run the check again`);
-          return 1;
-        }
-      }
-      cargoLiveRoot = root;
-    }
+    if (executor.kind === "broker" && manifests.length && snapshot && (snapshotA || snapshotB)) cargoLiveRoot = root;
     // One Cargo workspace and lock per crate (rightkit#1285): the reach between crates is the manifests' path dependencies, read from the
     // gated snapshot. A crate that is selected selects its transitive dependents (checked, not re-linted); a vendored source it patches
     // in selects the crate. Neither is derivable from a single lock, so a layout that cannot read them is refused, never planned narrower.
@@ -2600,14 +3390,11 @@ export async function main(argv, io = {}) {
         externalInputs = vendorOwners(crateUnits, (u) => o.readFile(path.join(repo, u.dir, "Cargo.toml")));
       } catch (e) { o.err(`${tag} BLOCKED: cannot read the path dependencies between the crate workspaces (${e.message}); their reverse dependents would go unchecked, so nothing is planned`); return 1; }
     }
-    // A broker snapshot compile: its cargo scans are carried requests that name the commit's snapshot and run from the primary checkout
-    // (rustright refuses cargo anywhere else); the checkout is the request's working directory, never its source.
-    if (snapshotBroker && manifests.length) cargoLiveRoot = root;
     let fullPlan;
     fullPlan = planScans({
-      // Class A of a commit or tree reads only that snapshot: every scan, cargo's included, runs in the export, never in the live
+      // Class A of a commit or tree reads only that snapshot: every scan, cargo's included, runs in the snapshot, never in the live
       // checkout (which may hold other bytes). Compiles (class B) use the live checkout, whose tree the dirty check pinned to HEAD.
-      changed, contentRoot: repo, liveRoot: (classAOnly && snapshot) || snapshotB ? repo : root, trustedRoot: snapshotA ?? snapshotB ?? root, includeTests: true, rustScope, cargoCommand, targetDirs, cargoShim: Boolean(cargoShim),
+      changed, contentRoot: repo, liveRoot: (classAOnly && snapshot) || snapshotB ? repo : root, trustedRoot: snapshotA ?? snapshotB ?? root, includeTests: true, rustScope, cargoCommand: planCargoCommand, targetDirs, cargoShim: Boolean(cargoShim),
       tier: fullA ? "release" : (option("--rule-tier") ?? "compile"), cargoLiveRoot,
       // The quiet tests (port, pipe, desktop and wall-clock bound) are proven by the CI shards, one crate per runner, unless
       // RK_GATE_QUIET_TESTS=local asks for the serial quiet lane here (no CI, or a CI outage).
@@ -2626,6 +3413,21 @@ export async function main(argv, io = {}) {
     // broker is unreachable runs neither; the gate stops rather than skip them.
     if (executor.kind === "refuse" && fullPlan.scans.some((x) => x.class === "B" || (x.kind === "test" && (!classAOnly || fullA)))) { o.err(`${tag} BLOCKED: ${executor.problem}`); return 1; }
     let plan = fullPlan;
+    if (closure) {
+      let kept;
+      try {
+        kept = closureTools.scopeScans(fullPlan.scans, closure, { rustUnits: rust.units });
+        plan = closureTools.scopedPlan(fullPlan, kept.scans, closure);
+      } catch (error) { o.err(`${tag} BLOCKED: ${error.message}`); return 1; }
+      plan.notes = plan.notes.filter((n) => !n.includes("every Rust unit is in scope"));
+      const classA = plan.scans.filter((s) => s.class === "A");
+      // What actually executes: tests, executing rows and every Cargo scan (metadata, package list, deny, audit run cargo, through the broker
+      // on a broker host), never only the rows that carry `executes`. The Cargo counts are named so a scoped run shows how much cargo it starts.
+      const executing = classA.filter((s) => closureTools.isExecutingScan(s)).length;
+      const cargoRun = classA.filter((s) => closureTools.isCargoScan(s)).length;
+      const cargoExcluded = kept.dropped.filter((s) => closureTools.isCargoScan(s)).length;
+      o.out(`${tag} scope ${closure.dirs.join(", ")}: dependency directories ${closure.dependencyDirs.join(", ")}; ${closure.npm.size} npm & ${closure.rust.size} Rust unit(s); Class A ${executing} executing scan(s) (${cargoRun} Cargo), ${classA.length - executing} repository file-only scan(s); ${kept.dropped.length} unrelated executing scan(s) excluded (${cargoExcluded} Cargo); ${plan.scans.length - classA.length} closure Class B scan(s) do not run in this check; install roots ${installRoots.join(", ") || "none"}; scope digest ${plan.scopeDigest}`);
+    }
     const jobs = Math.max(1, Number(o.env.RK_GATE_JOBS ?? 4) || 4);
     const testJobs = Math.max(1, Number(o.env.RK_GATE_TEST_JOBS ?? jobs) || jobs);
     const classBJobs = Math.max(1, Number(o.env.RK_GATE_CLASS_B_JOBS ?? 3) || 3);
@@ -2664,7 +3466,8 @@ export async function main(argv, io = {}) {
     // Full class A of a snapshot binds like the live tree does: its bytes are the commit's (blob ids from the object database), its
     // environment includes the dependencies installed into it below.
     const snapFullA = fullA && Boolean(snapshotA);
-    const boundFullA = liveFullA || snapFullA;
+    const hostedFullA = fullA && Boolean(hostedCommitA);
+    const boundFullA = liveFullA || snapFullA || hostedFullA;
     const liveBase = snapFullA ? snapshotA : root;
     // The live bytes full class A judges: every tracked and untracked (not ignored) file, hashed raw. Computed whether or not the
     // cache is used; a failure to compute it blocks (the verdict must name the bytes it covers).
@@ -2687,6 +3490,12 @@ export async function main(argv, io = {}) {
     if (liveFullA) {
       try { live = liveTree(); } catch (error) { o.err(`${tag} BLOCKED: cannot bind full class A to the working tree's bytes (${error.message})`); return 1; }
     }
+    if (hostedFullA) {
+      try {
+        await verifyCommittedCheckout({ git, root, ...hostedCommitA, when: "before class A" });
+        live = (await import("../snapshot-check.mjs")).commitFiles(root, hostedCommitA.commit, o.spawn);
+      } catch (error) { o.err(`${tag} RK_CHECK_ERROR: ${error.message}; nothing scanned`); return 2; }
+    }
     let snapshotCommitId = null;
     if (snapFullA) {
       const sc = await import("../snapshot-check.mjs");
@@ -2698,7 +3507,7 @@ export async function main(argv, io = {}) {
         live = sc.commitFiles(checkout, ct.commit, o.spawn);
         // Dependencies for the checks that execute repository code: installed into the snapshot from the commit's lockfile and the
         // primary checkout's existing store (coordinator decision A, rightkit#1257). A store miss stops here, naming the package.
-        const installed = sc.installSnapshotDependencies({ checkout, snapshot: snapshotA, roots: npmRoots, env: o.env, spawn: o.spawn });
+        const installed = sc.installSnapshotDependencies({ checkout, snapshot: snapshotA, ...ct, roots: installRoots, ...(closure ? { packageDirs: npm.filter((u) => closure.npm.has(u.name)).map((u) => u.dir) } : {}), env: o.env, spawn: o.spawn });
         for (const r of installed) o.out(`${tag} ${sc.describeInstall(r)}`);
       } catch (error) { o.err(`${tag} ${error.code === "RK_CHECK_ERROR" ? "RK_CHECK_ERROR" : "BLOCKED"}: ${error.message}`); return error.code === "RK_CHECK_ERROR" ? 2 : 1; }
     }
@@ -2727,7 +3536,8 @@ export async function main(argv, io = {}) {
         // The verdict also depends on what is not in the tree: the gate's own code and advisory data, the node and pnpm that run
         // the checks, the installed dependencies (pnpm's install state) and the platform. Any change there is a cache miss.
         const environment = classAEnvironmentDigest({ root: liveBase, gatePackage: o.gatePackage, files, spawn: o.spawn });
-        cache = { ...store, digest: `${buildCacheDigest({ objectId, headTree: digestOf(files), rustUnits: rust.units, npmUnits: npm, cargoDir: ".", rustLocks, crateFeatures, listFiles, readBlob })}:${environment}` };
+        const digest = buildCacheDigest({ objectId, headTree: digestOf(files), rustUnits: rust.units, npmUnits: npm, cargoDir: ".", rustLocks, crateFeatures, listFiles, readBlob });
+        cache = { ...store, digest: (scan) => { const key = digest(scan); return key === null ? null : `${key}:${environment}:${plan.scopeDigest ?? "repository"}:${plan.scanSetDigest}`; } };
       } catch { cache = null; }
     }
     if (!classAOnly && !args.includes("--no-cache") && o.env.RK_GATE_CACHE !== "0") {
@@ -2757,6 +3567,18 @@ export async function main(argv, io = {}) {
         }
       } catch { cache = null; }
     }
+    // The scan-tool policy (RA-18 / L9-03): the analyzers class A accepts (shellcheck, actionlint, cargo-deny, cargo-audit) run only from an enrolled
+    // executable. It comes from this host's enrolment record under the managed data root, else (RightKit's own checkout only) from the RUNNING
+    // gate's revision of ci/rk-pipeline.json `tools` (scan-tool-enrolment.mjs), never the checked repository, the snapshot or an environment variable.
+    // An unreadable or malformed record refuses the run: a scan tool is never judged against a policy that could not be read.
+    let scanTools;
+    try {
+      scanTools = await (o.loadScanToolPolicy ?? (async (q) => (await import("../scan-tool-enrolment.mjs")).loadScanToolPolicy(q)))({
+        dataRoot: resolveManagedRoots({ env: o.env, platform: o.platform }).dataRoot, platform: o.platform, gateFile: callingGatePath(), checkout: root, fromPipeline: scanToolPolicyFromPipeline, // reads the gate's own repository with real git, never the run's (possibly injected) spawn
+      });
+    } catch (error) { o.err(`${tag} BLOCKED: ${error.code ?? "RK_SCAN_TOOLS"}: ${error.message}; no scan ran`); return 1; }
+    const enrolledTools = Object.keys(scanTools?.policy ?? {});
+    if (enrolledTools.length) o.out(`${tag} scan-tool policy: ${enrolledTools.map((name) => `${name} (${scanTools.sources?.[name] ?? "enrolled"})`).join(", ")}`);
     // The direct compile's freshness census (row 7.19): the fingerprint units before the scans, and the fingerprint log of each cargo
     // process that compiles (CARGO_LOG on that process only, read from its own standard error). A broker host's census is the broker's.
     const census = snapshotB && !snapshotBroker ? createFreshnessCensus({ targetDirs }) : null;
@@ -2765,6 +3587,20 @@ export async function main(argv, io = {}) {
     const scanResult = await (o.runScans ?? runScans)(plan, {
       classes: classAOnly ? ["A"] : ["A", "B"], jobs, testJobs, classBJobs, signal: ac.signal, ...(cache ? { cache } : {}),
       ...(census ? { spawn: census.wrapSpawn(defaultSpawnAsync) } : {}),
+      // The declared Linux broker route: the scans are planned with the logical `rustright`, which this spawn (and scanSpawn's pass-through below) starts as the
+      // executor's validated client, never a PATH lookup (withDeclaredClient).
+      ...(declaredClient && !scanSpawn ? { spawn: withDeclaredClient(census ? census.wrapSpawn(defaultSpawnAsync) : defaultSpawnAsync) } : {}),
+      toolPolicy: scanTools?.policy ?? {},
+      // The class A cargo reads (deny, audit, metadata, fetch) are carried requests the broker executes (scanSpawn): cargo-deny and cargo-audit are then the
+      // broker's registered tools, in the check stage too (which has no snapshotBroker). Only when the reads really go to the broker.
+      ...(executor.kind === "broker" && scanSpawn ? { cargoReadsCarried: true } : {}),
+      // A broker host: every Cargo call a class A scan makes inside the snapshot is a carried read-only request; the gate's own temporary files
+      // (cargo-deny's metadata and config) live in a gate-owned directory the broker can read, outside the checkout.
+      ...(scanSpawn ? { spawn: scanSpawn, tmpRoot: gateTmpRoot({ env: o.env, platform: o.platform, exists: o.exists }) } : {}),
+      // A host with no broker runs its Class A Cargo scans itself, in the snapshot: cargo would write target/.rustc_info.json beside each manifest
+      // it reads and the snapshot would no longer be the commit's tree. Each such scan gets an output directory of its own under the gate's
+      // scratch root, removed when it ends (deterministic-scans.mjs cargoReadTargetDir). A broker host carries these reads and the broker owns the output.
+      ...(!scanSpawn ? { cargoReadTargetRoot: gateTmpRoot({ env: o.env, platform: o.platform, exists: o.exists }) } : {}),
       // The runtime cargo wrapper is first on PATH and named in CARGO for every scan of a snapshot compile; CARGO (a path named by the
       // wrapper's identity) is in every scan's cache key, so no result cached without the wrapper or with another map is reused.
       ...(cargoShim ? { env: cargoShim.scanEnv, ...(cargoShim.sentinel ? { cargoSentinel: cargoShim.sentinel } : {}), cargoLedger: { dir: cargoShim.ledgerDir } } : {}),
@@ -2775,14 +3611,14 @@ export async function main(argv, io = {}) {
       // `executes`) run in the full gate (--all, the push hook, the door's compile stage), after the content checks and before any compile.
       ...(classAOnly && !fullA ? { exclude: (s) => s.executes === true } : {}),
       // A snapshot check names its commit; it never reads the checkout's HEAD.
-      quietLane: quietLeaseLane(o, { tag, reason: `rightkit-gate-quiet-tests@${snapshotCommitId ? snapshotCommitId.commit.slice(0, 12) : snapshotBCommit ? snapshotBCommit.commit.slice(0, 12) : text(git("rev-parse", "--short", "HEAD")).trim()}` }),
+      quietLane: quietLeaseLane(o, { tag, executor, reason: `rightkit-gate-quiet-tests@${snapshotCommitId ? snapshotCommitId.commit.slice(0, 12) : snapshotBCommit ? snapshotBCommit.commit.slice(0, 12) : text(git("rev-parse", "--short", "HEAD")).trim()}` }),
       // On a broker-managed host the quiet suites need the lease or they are refused (never run unleashed).
       requireQuietLease: executor.kind === "broker",
       // Failing scans' complete output: never inside the repository, on the host's scratch root (RIGHTKIT_SCRATCH_ROOT, else the
       // managed data root's runs/), in a folder unique to this run so evidence is never overwritten.
       scanLogDir: (() => {
         try {
-          const base = o.env.RIGHTKIT_SCRATCH_ROOT || path.join(resolveManagedRoots({ env: o.env }).dataRoot, "runs");
+          const base = gateRunsRoot({ env: o.env, platform: o.platform });
           const stamp = new Date().toISOString().replace(/[:.]/g, "-");
           return path.join(base, "rightkit-gate-scan-logs", `${path.basename(root)}-${stamp}-${process.pid}`);
         } catch { return null; }
@@ -2807,6 +3643,10 @@ export async function main(argv, io = {}) {
     // in (gate, tools, installed dependencies, tool caches), unchanged too. A verdict whose binding moved covers nothing: a green one is
     // refused and a red one names no reusable deterministic cause (rightkit#1257). Returns { env, notes } or { prefix, problem, exit }.
     const judgedBinding = async () => {
+      if (hostedFullA) {
+        try { await verifyCommittedCheckout({ git, root, ...hostedCommitA, when: "after class A" }); }
+        catch (error) { return { prefix: "RK_CHECK_ERROR", exit: 2, problem: `${error.message}; the verdict covers no known bytes` }; }
+      }
       if (liveFullA) {
         let digestNow = null;
         try { digestNow = liveTree().digest; } catch { digestNow = null; }
@@ -2844,6 +3684,8 @@ export async function main(argv, io = {}) {
       o.out(`${tag} snapshot ${snapshotB} is still tree ${snapshotBCommit.tree} after the compile`);
       // A broker host's evidence is the broker's own signed receipts (each carried scan's row.snapshotEvidence, verified above); the
       // gate writes no receipt that says `executor: direct` for it.
+      // The output directories this compile's evidence names (GB-13): the broker's signed receipts' `outputDir`, or the direct host's resolved targets.
+      o.onCompileOutputs?.(snapshotBroker ? scanResult.scans.map((r) => r.snapshotEvidence?.outputDir).filter(Boolean) : Object.values(targetDirs ?? {}).filter(Boolean));
       if (snapshotBroker) o.out(`${tag} broker compile: ${scanResult.scans.filter((r) => r.snapshotEvidence).length} carried request(s) with verified signed receipts; no direct receipt on a broker host`);
       else {
         // The direct host's own receipt (GATE-CONTRACT "Broker interface", row 7.18): the contract's returned-evidence names minus the
@@ -2854,7 +3696,7 @@ export async function main(argv, io = {}) {
         const requestId = randomUUID();
         const exitCode = failures.length ? 1 : 0;
         const diagnosticsDir = (() => {
-          try { return path.join(o.env.RIGHTKIT_SCRATCH_ROOT || path.join(resolveManagedRoots({ env: o.env }).dataRoot, "runs"), "rightkit-gate-direct-diagnostics"); } catch { return path.join(os.tmpdir(), "rightkit-gate-direct-diagnostics"); }
+          try { return path.join(gateRunsRoot({ env: o.env, platform: o.platform }), "rightkit-gate-direct-diagnostics"); } catch { return path.join(os.tmpdir(), "rightkit-gate-direct-diagnostics"); }
         })();
         let directReceipt;
         try {
@@ -2888,7 +3730,7 @@ export async function main(argv, io = {}) {
           if (binding.exit === 2) return 2;
         } else {
           for (const n of binding.notes) o.out(`${tag} ${n}`);
-          const marker = (await import("../snapshot-check.mjs")).deterministicMarker(scanResult, binding.env);
+          const marker = (await import("../snapshot-check.mjs")).deterministicMarker(scanResult, plan.scopeDigest ? createHash("sha256").update(`${binding.env}:${plan.scopeDigest}:${plan.scanSetDigest}`).digest("hex") : binding.env);
           if (marker) o.out(marker);
         }
       }
@@ -2905,12 +3747,12 @@ export async function main(argv, io = {}) {
       // raw bytes>\n" lines (git hash-object --no-filters), so the broker can recompute it over its snapshot without this gate.
       if (live) {
         // A snapshot holds only the commit's files: every one is tracked.
-        const trackedList = snapFullA ? null : git("ls-files", "-z", "--cached");
+        const trackedList = snapFullA || hostedFullA ? null : git("ls-files", "-z", "--cached");
         if (trackedList && failed(trackedList)) { o.err(`${tag} BLOCKED: cannot list tracked files to name the checked bytes`); return 1; }
-        const tracked = new Set(snapFullA ? live.files : text(trackedList).split("\0").filter(Boolean).map(posix));
-        o.out(`${tag} class A bytes tracked=${live.digestOf(live.files.filter((f) => tracked.has(f)))} all=${live.digest}${envStartWithCaches ? ` env-at-start=${envStartWithCaches}` : ""} env=${binding.env}`);
+        const tracked = new Set(snapFullA || hostedFullA ? live.files : text(trackedList).split("\0").filter(Boolean).map(posix));
+        o.out(`${tag} class A bytes tracked=${live.digestOf(live.files.filter((f) => tracked.has(f)))} all=${live.digest}${envStartWithCaches ? ` env-at-start=${envStartWithCaches}` : ""} env=${plan.scopeDigest ? createHash("sha256").update(`${binding.env}:${plan.scopeDigest}:${plan.scanSetDigest}`).digest("hex") : binding.env}${plan.scopeDigest ? ` scope=${plan.scopeDigest} scans=${plan.scanSetDigest}` : ""}`);
       }
-      o.out(`${tag} class A full pass: ${scanResult.scans.length} deterministic check(s), the ones that execute repository code included, over ${changed.length} file(s) of ${base}`);
+      o.out(`${tag} class A ${plan.scopeDigest ? "scoped" : "full"} pass: ${scanResult.scans.length} deterministic check(s), the ones that execute repository code included, over ${changed.length} file(s) of ${base}`);
       return 0;
     }
     if (classAOnly) {
@@ -2932,18 +3774,32 @@ export async function main(argv, io = {}) {
 // The inherited locations a snapshot compile requires as absolute paths (GATE-CONTRACT "Output directory & cache").
 const SNAPSHOT_ABSOLUTE_ENV = ["CARGO_HOME", "RUSTUP_HOME", "SCCACHE_DIR", "TMPDIR", "TMP", "TEMP"];
 
+/**
+ * What the production entry (`node rightkit-gate.mjs ...`) hands `main` as its injected dependencies, and what `--route` reports: the
+ * snapshot carrier on Mac and Dell (rightkit#1301: right-release's own Cargo calls, the Tauri CLI's and cargo-about's are carried, so
+ * every stage compiles the commit's snapshot through the broker); nothing on Linux, which compiles direct with no broker. Tests inject
+ * their own carrier through `main`; the contract test (door-route.test.mjs) runs the real entry. `platform` is the host whose deps are
+ * asked for (the real entry passes none).
+ */
+export async function productionEntryDeps({ platform = process.platform, env = process.env } = {}) {
+  // A direct Linux host carries nothing. A Linux host that DECLARED the broker route (managed-cargo.mjs linuxBrokerDeclared) gets the same carrier as the
+  // Mac and the Dell, valid declaration or not: an invalid one is refused by the executor (kind "refuse"), never left to compile direct without a carrier.
+  if (directPlatform(platform) && !linuxBrokerDeclared(env, platform)) return {};
+  const { PRODUCTION_SNAPSHOT_CARRIER } = await import("../snapshot-broker.mjs");
+  return { snapshotBroker: PRODUCTION_SNAPSHOT_CARRIER };
+}
+
 const invokedDirectly = (() => {
   try { return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return false; }
 })();
 /** This gate's own resolved entry file: the broker admits a compile only when the request names the pinned trusted gate by this
- * path (rustright reads it from RIGHTKIT_CALLING_GATE; a missing or different path is refused). */
+ * path (rustright reads it from RUSTRIGHT_CALLING_GATE; a missing or different path is refused). */
 export const callingGatePath = () => fs.realpathSync(fileURLToPath(import.meta.url));
 if (invokedDirectly) {
   // Every child this run starts that can reach rustright (scans, unit stages, right-release dev/test, their builds) inherits it.
-  process.env.RIGHTKIT_CALLING_GATE = callingGatePath();
-  // Interim (decision 2): production carries no snapshot carrier until every child that reaches Cargo has one (item 7 row 7.24,
-  // right-release dev and test, is not wired). With it wired early, 0.6.12 refused every dev, test and sidecar package build on the
-  // Mac and the Dell (rightkit#1296, HeardRight 2026-10-30); without it they keep the checkout route, as in 0.6.10. Linux takes the
-  // snapshot route regardless (direct, no carrier). Tests inject a carrier. The cutover commit wires PRODUCTION_SNAPSHOT_CARRIER here.
-  Promise.resolve(main(process.argv.slice(2))).then((code) => process.exit(code), (e) => { console.error(`rightkit-gate: ${e?.stack ?? e}`); process.exit(2); });
+  process.env.RUSTRIGHT_CALLING_GATE = callingGatePath();
+  delete process.env.RIGHTKIT_CALLING_GATE; // one spelling, never both
+  // Production carries the snapshot carrier on Mac and Dell (rightkit#1301): every child that reaches Cargo is carried, so every stage
+  // compiles the commit's snapshot. Linux takes the snapshot route direct, with no carrier. Tests inject theirs.
+  productionEntryDeps().then((deps) => main(process.argv.slice(2), deps)).then((code) => process.exit(code), (e) => { console.error(`rightkit-gate: ${e?.stack ?? e}`); process.exit(2); });
 }