@rightkit/release 0.6.7 → 0.6.10

package/bin/rightkit-gate.mjs

@@ -27,7 +27,7 @@
 //   rightkit-gate [--base <ref>] [--plan] [--no-cache]
 //                                             run the gate (default base origin/main); --plan prints the scans and runs none;
 //                                             --no-cache (or RK_GATE_CACHE=0) reruns every scan
-//   rightkit-gate check [--repo <dir>] [--commit <rev> | --worktree] [--only <rule,...>] [--list] [--print-baseline] [--baseline <file>]
+//   rightkit-gate check [--repo <dir>] [--commit <rev> | --worktree] [--rule-tier compile|release] [--only <rule,...>] [--list] [--print-baseline] [--baseline <file>]
 //                                             the deterministic stage: the app check (../app-check.mjs), then every class A scan
 //                                             (lockfiles, cargo-deny/audit, secrets, licences, manifests, workflow lint, syntax) over the
 //                                             whole tree of the commit, not a diff. Nothing compiles; without a broker class A uses
@@ -59,19 +59,23 @@
 // rust.<crate>.testInputs lists the paths they read, for npm, node and docs scans, and whenever a reference cannot be resolved
 // statically) are all identical. Stored in <git common dir>/rightkit-gate-cache; a hit prints
 // `cached` and is listed in the result's cacheHits. Failures, deferrals and class A scans are never cached.
-// RK_GATE_JOBS (default 4) sets how many compile scans run side by side; RK_GATE_TEST_JOBS (default RK_GATE_JOBS) how many test
-// scans, after the compile lanes drain. A crate whose ci/gate.config.json entry says `quietTests: true` has its test scans run last,
+// RK_GATE_JOBS (default 4) sets class A scan concurrency; class B runs one scan at a time per checkout.
+// A crate whose ci/gate.config.json entry says `quietTests: true` has its test scans run last,
 // one at a time, under the RustRight quiet lease (`rustright quiet acquire`, RUSTRIGHT_QUIET_LEASE in their environment).
 // SIGINT/SIGTERM stop scheduling, kill every running scan's process tree and exit non-zero listing the scans not run.
 import fs from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import { resolveManagedRoots } from "../managed-roots.mjs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { BIOME_CONFIG_FILES, ESLINT_CONFIG_FILES, WORKSPACE_RUST_FILE, ancestorConfigChanged, ancestorDirsOf, canonicalJson, defaultSpawn, digestScanSet, fileScanCache, findRustfmt, metadataArgs, planScans, runScans, scanDeferrals, scanFailures } from "../deterministic-scans.mjs";
 import { changedLockNames, parseLock, reach } from "../lock-graph.mjs";
 import { resolveExecutor } from "../gate-executor.mjs";
-import { bindingOf, endRun, readReceipt, RECEIPT_SCHEMA, sameBinding, sameSource, sealedFor, stagesTo, startRun, STAGES, writeReceipt } from "../gate-stages.mjs";
+import { directPlatform } from "../managed-cargo.mjs";
+import { bindingOf, endRun, readReceipt, RECEIPT_SCHEMA, receiptKey, sameBinding, sameSource, sealedFor, stagesTo, startRun, STAGES, writeReceipt } from "../gate-stages.mjs";
 import { spawnSync as spawnInherit } from "../background-process.mjs";
+import { readDiskPolicy, scratchRoots } from "../disk-policy.mjs";
 
 const ZERO = /^0+$/;
 const SAFE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
@@ -82,7 +86,10 @@ const why = (r) => String(r?.error?.message ?? r?.stderr ?? "").trim().split(/\r
 
 // A green `check --only` view: app rules passed but no class A scan ran. Distinct from 0 so no caller can admit it as a full check.
 export const PARTIAL_EXIT = 3;
-const USAGE = `usage: rightkit-gate --to check|compile|package|qualify|release [--platform mac|win] [--tier patch|update] [--receipt-in <file>] [--receipt-out <file>] | rightkit-gate --to dev|test [-- <right-release args>] | rightkit-gate stage --platform mac|win [--tier patch|update] | rightkit-gate [--base <ref>] [--plan] [--no-cache] [--pre-push] | rightkit-gate install-hook [--force] | rightkit-gate check [--repo <dir>] [--commit <rev> | --worktree] [--only <rule,...>] [--list] [--print-baseline] [--baseline <file>] | --version`;
+/** The platforms a door run can package: desktop (signed, sealed, installed QA, publisher upload) and mobile (signed, sealed, store test track). */
+export const PLATFORMS = Object.freeze(["mac", "win", "ios", "android"]);
+export const MOBILE_PLATFORMS = Object.freeze(new Set(["ios", "android"]));
+const USAGE = `usage: rightkit-gate --to check|compile|package|qualify|release [--platform mac|win|ios|android] [--tier patch|update] [--receipt-in <file>] [--receipt-out <file>] | rightkit-gate --to check|compile|package|qualify|release --unit npm:@rightkit/<name>|cargo:rightkit-<name> [--receipt-out <file>] | rightkit-gate --to dev|test [-- <right-release args>] | rightkit-gate stage --platform mac|win [--tier patch|update] | rightkit-gate [--base <ref>] [--plan] [--no-cache] [--pre-push] | rightkit-gate install-hook [--force] | rightkit-gate env-digest | rightkit-gate snapshot [--commit <rev>] [--verify] [--json] | rightkit-gate live-scans --repo <root> | rightkit-gate env-digest [--snapshot <dir> --commit <sha>] | rightkit-gate check [--repo <dir>] [--commit <rev> | --worktree] [--rule-tier compile|release] [--only <rule,...>] [--list] [--print-baseline] [--baseline <file>] | rightkit-gate check --commit <sha> --full-a --snapshot <dir> | --version`;
 
 // ---- pure helpers (exported for tests) ----------------------------------------------------------------------
 
@@ -234,6 +241,262 @@ function workspaceMetadata({ root, spawn, cargoCommand, dir, realpath }) {
  * here. The gate itself uses discoverRustWorkspaces, which handles every workspace of the repository. Returns
  * { present, units: [{ name, dir, publish }], cargoDir, uncovered }.
  */
+/**
+ * Where the snapshot export lives. The RustRight broker refuses a job whose workspace is on the system volume
+ * (RK_INTERNAL_DRIVE_REFUSED: agents never write to the internal drive), and os.tmpdir() is on it on every Mac and Dell, so on a
+ * host with a disk-policy scratch root (/Volumes/D/scratch, D:\scratch) the export goes there. RK_GATE_TMPDIR overrides; os.tmpdir()
+ * is the fallback where no scratch root exists (CI runners, cloud containers), where plain cargo runs and nothing refuses the system
+ * volume. (rightkit#1215)
+ */
+export function exportTmpRoot({ env = process.env, platform = process.platform, exists = fs.existsSync, policy = null } = {}) {
+  if (env.RK_GATE_TMPDIR) return env.RK_GATE_TMPDIR;
+  try {
+    const roots = scratchRoots(policy ?? readDiskPolicy(), { platform, env });
+    const found = roots.find((root) => exists(root));
+    if (found) return found;
+  } catch { /* no readable policy: the system temp dir */ }
+  return os.tmpdir();
+}
+
+/** The files cargo metadata, deny and audit read, in the repository root and in every workspace that has a manifest. */
+export const CARGO_INPUT_NAMES = Object.freeze(["Cargo.toml", "Cargo.lock", "deny.toml", "rust-toolchain.toml", "rust-toolchain", ".cargo"]);
+
+/**
+ * The Cargo inputs of the live checkout `root` that are not blob-identical to `snapshot`'s (a commit or tree): a changed or deleted
+ * tracked input, or any untracked file (ignored ones included, cargo reads them) under those paths. Empty means the broker may scan
+ * the primary checkout for exactly the snapshot's result. `manifests` are the snapshot's tracked Cargo.toml paths (posix).
+ */
+export function cargoInputsDiffer({ root, snapshot, manifests, spawn = defaultSpawn }) {
+  const git = (...a) => spawn("git", a, { cwd: root });
+  // Every manifest directory and every ancestor up to the root: cargo reads a .cargo/config.toml or a rust-toolchain file from any of them.
+  const dirs = new Set([""]);
+  for (const m of manifests) { const parts = path.posix.dirname(m).split("/").filter((x) => x && x !== "."); for (let i = 1; i <= parts.length; i++) dirs.add(parts.slice(0, i).join("/")); }
+  const dirList = [...dirs];
+  const paths = dirList.flatMap((d) => CARGO_INPUT_NAMES.map((n) => (d ? `${d}/${n}` : n)));
+  // Pathspecs go to git in bounded batches: a repository with many crates (RightKit: ~1000 input paths) overflows Windows' 32767-
+  // character command line in one argv (ENAMETOOLONG on the Dell, 2026-10-27; G4 was the same for rustfmt). Each batch's results
+  // are merged; a failed batch fails the whole listing closed.
+  const batches = pathspecBatches(paths);
+  const listedAll = batches.map((b) => git("ls-tree", "-r", "-z", snapshot, "--", ...b));
+  const badList = listedAll.find((r) => failed(r));
+  if (badList) return [`(cannot list ${snapshot}: ${why(badList)})`];
+  const snap = new Map();
+  for (const listed of listedAll) for (const entry of text(listed).split("\0").filter(Boolean)) { const tab = entry.indexOf("\t"); const [, , id] = entry.slice(0, tab).split(" "); snap.set(entry.slice(tab + 1), id); }
+  const differ = new Set();
+  for (const [p, id] of snap) {
+    const live = path.join(root, ...p.split("/"));
+    let liveId = null;
+    // Cargo reads the live bytes, so the live bytes are hashed raw (`--no-filters`: no clean filter, eol or text attribute can make
+    // two different byte strings look the same). The one accepted difference is an exact CRLF checkout of an LF blob (D13, Dell
+    // 2026-10-27: core.autocrlf), which every TOML/toolchain reader treats as the same newline; anything else differs.
+    try { if (fs.statSync(live).isFile()) { const h = git("hash-object", "--no-filters", "--", live); liveId = failed(h) ? null : text(h).trim(); } } catch { liveId = null; }
+    if (liveId !== id && !isCrlfCheckoutOf({ git, id, live })) differ.add(p);
+  }
+  // Untracked under the input paths, ignored files included: cargo reads a .cargo/config.toml or a deny.toml whether or not git tracks it.
+  for (const batch of batches) {
+    const others = git("ls-files", "-z", "--others", "--", ...batch);
+    if (failed(others)) differ.add(`(cannot list untracked Cargo inputs: ${why(others)})`); // fail closed: an unlisted input is an unknown input
+    else for (const p of text(others).split("\0").filter(Boolean)) if (!snap.has(p)) differ.add(p);
+    // A tracked input the snapshot lacks (added in HEAD after the snapshot, say) is live-only too.
+    const tracked = git("ls-files", "-z", "--", ...batch);
+    if (failed(tracked)) differ.add(`(cannot list tracked Cargo inputs: ${why(tracked)})`);
+    else for (const p of text(tracked).split("\0").filter(Boolean)) if (!snap.has(p)) differ.add(p);
+  }
+  return [...differ].sort();
+}
+
+/** True only when the live file's bytes are exactly blob `id` with every LF written as CRLF (an autocrlf checkout); fails closed. */
+export function isCrlfCheckoutOf({ git, id, live, readFile = fs.readFileSync }) {
+  try {
+    const blob = git("cat-file", "blob", id);
+    if (failed(blob)) return false;
+    const committed = text(blob);
+    if (committed.includes("\r")) return false;
+    return readFile(live, "utf8") === committed.replace(/\n/g, "\r\n");
+  } catch { return false; }
+}
+
+/**
+ * Tool caches inside node_modules that nothing installs: test-result caches (vitest), the vite optimizer and bundled-config temp
+ * files, transpile and other tool caches (.cache). Some hold code a later step executes, so the environment a verdict carries binds
+ * their bytes as they stand when class A ends, and the broker's START recomputes it: a cache edited, added or removed after the
+ * verdict (by a dev server, another tool, or by hand) voids the ticket and class A runs again. Nothing is deleted. Inside one run
+ * the start/end comparison leaves them out, because the run itself writes them. pnpm's task-run state holds only completion
+ * markers pnpm reads, never code, and is not bound.
+ */
+/** Longest the class A environment waits for `pnpm --version`. */
+export const PNPM_PROBE_TIMEOUT_MS = 60_000;
+export const TOOL_CACHE_DIRS = new Set([".vite", ".vite-temp", ".vitest-cache", ".cache"]);
+export const INSTALL_STATE_NOT_COVERED = new Set([".pnpm-task-run-state-v1"]);
+const nodeModulesDirs = (root, files) => [...new Set(files.filter((f) => /(^|\/)package\.json$/.test(f)).map((f) => path.join(path.dirname(path.join(root, f)), "node_modules")))].sort();
+function isLink(p) { try { return fs.lstatSync(p).isSymbolicLink(); } catch { return false; } }
+
+/**
+ * Members of the root pnpm workspace holding their own pnpm virtual store (node_modules/.pnpm) while the root has one, without
+ * being an install root (no pnpm-lock.yaml of their own): leftovers of a standalone install from before the package joined the workspace. Their dependencies resolve to
+ * the root store, but the leftover can still be read, and vitest hashes the nearest lockfile it finds (node_modules/.pnpm/
+ * lock.yaml) for a module cache it shares across the workspace, so one such package makes concurrent vitest runs clear the
+ * shared cache under each other (ENOTEMPTY, fullA-16).
+ */
+export function orphanedPnpmStores({ root, files }) {
+  // Only proven orphans: the repository root is a pnpm workspace with its own virtual store, and the package is a member of it by
+  // the root pnpm-workspace.yaml globs (negations honoured) and not an install root of its own. A standalone nested project is
+  // not judged.
+  const ws = path.join(root, "pnpm-workspace.yaml");
+  if (!fs.existsSync(ws) || !fs.existsSync(path.join(root, "node_modules", ".pnpm"))) return [];
+  const globs = parseWorkspaceGlobs(fs.readFileSync(ws, "utf8"));
+  const include = globs.filter((g) => !g.startsWith("!")).map(globToRegExp);
+  const exclude = globs.filter((g) => g.startsWith("!")).map((g) => globToRegExp(g.slice(1)));
+  return nodeModulesDirs(root, files).filter((nm) => {
+    const pkg = path.dirname(nm); const rel = path.relative(root, pkg).split(path.sep).join("/");
+    if (!rel || !include.some((re) => re.test(rel)) || exclude.some((re) => re.test(rel))) return false;
+    return fs.existsSync(path.join(nm, ".pnpm")) && !fs.existsSync(path.join(pkg, "pnpm-lock.yaml"));
+  }).map((nm) => path.relative(root, path.join(nm, ".pnpm")).split(path.sep).join("/"));
+}
+
+/**
+ * Cache files that hold only a tool's own bookkeeping, never code a check executes, at exact paths: vitest's result ordering,
+ * node_modules/.vite/vitest/results.json and node_modules/.vite/vitest/<40-hex project hash>/results.json, which vitest reads only
+ * with JSON.parse to order test files (vitest 5.0.5 dist/chunks/cli-api.*.js ResultsCache.readFromCache).
+ */
+export const CACHE_NON_CODE = [/(^|\/)node_modules\/\.vite\/vitest\/([0-9a-f]{40}\/)?results\.json$/];
+/** Every file in the workspace's tool caches (TOOL_CACHE_DIRS, not following links) with its content hash, keyed by path. */
+export function toolCacheManifest({ root, files }) {
+  const out = new Map();
+  const walk = (dir) => {
+    let entries; try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (error) { if (error?.code === "ENOENT") return; throw new Error(`cannot list the tool cache ${path.relative(root, dir)} (${error?.code ?? error?.message})`); }
+    for (const e of entries) {
+      const p = path.join(dir, e.name); const rel = path.relative(root, p).split(path.sep).join("/");
+      if (e.isDirectory()) walk(p);
+      else if (e.isSymbolicLink()) out.set(rel, `link:${fs.readlinkSync(p)}`);
+      else if (e.isFile()) { try { out.set(rel, createHash("sha256").update(fs.readFileSync(p)).digest("hex")); } catch (error) { if (error?.code !== "ENOENT") throw new Error(`cannot read the tool cache file ${rel} (${error?.code ?? error?.message})`); } }
+    }
+  };
+  for (const d of nodeModulesDirs(root, files)) for (const name of TOOL_CACHE_DIRS) walk(path.join(d, name));
+  return out;
+}
+/**
+ * What a run did to the tool caches: a pre-existing cache file that changed or vanished means the checks may have read bytes that
+ * are no longer there (a concurrent writer, an interrupted or partial write), so the verdict cannot name them. Files added while
+ * it ran are listed and bound in env, though another process may have written them. Limits: a file changed and restored between
+ * the two manifests is not observed, and a file added and read by a check is bound only as it stands at the end. CACHE_NON_CODE
+ * files may change.
+ */
+export function toolCacheDrift(before, after) {
+  const changed = []; const added = [];
+  for (const [p, h] of before) if (!CACHE_NON_CODE.some((re) => re.test(p)) && after.get(p) !== h) changed.push(p);
+  for (const p of after.keys()) if (!before.has(p)) added.push(p);
+  return { changed: changed.sort(), added: added.sort() };
+}
+
+/**
+ * The installed dependency bytes a class A verdict executes: every node_modules directory of the workspace (the root one holds
+ * pnpm's virtual store) walked without following links, plus everything a link there resolves to outside those directories (a
+ * workspace package's built and ignored files, a linked package elsewhere on disk), each resolved target hashed once. A real file
+ * is its path, exec bit and content hash; a link is its target (a dangling one is bound as dangling). A cycle is cut by the
+ * resolved-path set; a target that is the root, an ancestor of it or the filesystem root, any other entry type, an unreadable
+ * entry, or more than `maxFiles` files throws. Tool caches (TOOL_CACHE_DIRS) leave no trace. Bytes that change while it hashes are caught by comparing the digest at the start
+ * and end of the run and again at START.
+ */
+export function installedDependencyDigest({ root, files, maxFiles = 400000, includeCaches = true }) {
+  const h = createHash("sha256");
+  const realRoot = fs.realpathSync(root);
+  const walkedRoots = nodeModulesDirs(root, files);
+  const realWalked = walkedRoots.map((d) => { try { return fs.realpathSync(d); } catch (error) { if (error?.code === "ENOENT") return null; throw error; } }).filter(Boolean);
+  const inside = (p, dir) => p === dir || p.startsWith(dir + path.sep);
+  const rel = (p) => (inside(p, realRoot) ? path.relative(realRoot, p).split(path.sep).join("/") : p);
+  const seen = new Set(); const pending = []; let count = 0;
+  const fail = (what, error) => { throw new Error(`cannot read ${what} for the class A environment (${error?.code ?? error?.message ?? error})`); };
+  const entry = (p, name, parentIsNodeModules, fromLink) => {
+    const st = (() => { try { return fs.lstatSync(p); } catch (error) { return fail(rel(p), error); } })();
+    if (st.isSymbolicLink()) {
+      let target; let real;
+      try { target = fs.readlinkSync(p); } catch (error) { return fail(`the link ${rel(p)}`, error); }
+      // A dangling link (pnpm hoists optional packages for other platforms that were never installed) resolves nothing, so it
+      // supplies no bytes; it is bound as dangling, and a target that later appears changes the digest.
+      try { real = fs.realpathSync(p); } catch (error) { if (error?.code === "ENOENT") { h.update(`${rel(p)}\tdangling\t${target}\n`); return; } return fail(`the link ${rel(p)}`, error); }
+      h.update(`${rel(p)}\tlink\t${target}\n`);
+      if (!realWalked.some((d) => inside(real, d))) pending.push(real);
+      return;
+    }
+    // pnpm's task-run state holds only completion markers, never code, and leaves no trace. Tool caches are bound byte for byte
+    // unless `includeCaches` is false (only for the start/end comparison inside one run, which writes them itself).
+    if (parentIsNodeModules && !fromLink && INSTALL_STATE_NOT_COVERED.has(name)) return;
+    if (parentIsNodeModules && !fromLink && TOOL_CACHE_DIRS.has(name) && !includeCaches) return;
+    if (st.isDirectory()) return walk(p, fromLink);
+    if (st.isFile()) {
+      if (++count > maxFiles) throw new Error(`more than ${maxFiles} installed dependency files; refusing an unbounded class A environment`);
+      let bytes; try { bytes = fs.readFileSync(p); } catch (error) { return fail(rel(p), error); }
+      h.update(`${rel(p)}\tfile\t${st.mode & 0o111 ? "x" : "-"}\t${createHash("sha256").update(bytes).digest("hex")}\n`);
+      return;
+    }
+    throw new Error(`unsupported entry ${rel(p)} in the installed dependencies`);
+  };
+  const walk = (dir, fromLink) => {
+    let names; try { names = fs.readdirSync(dir).sort(); } catch (error) { return fail(rel(dir), error); }
+    const nm = path.basename(dir) === "node_modules";
+    for (const name of names) {
+      const p = path.join(dir, name);
+      if (fromLink && (name === ".git" || (name === "node_modules" && walkedRoots.includes(p)))) continue;
+      entry(p, name, nm, fromLink);
+    }
+  };
+  for (const d of walkedRoots) {
+    h.update(`root\t${rel(d)}\n`);
+    try { fs.lstatSync(d); } catch (error) { if (error?.code === "ENOENT" || error?.code === "ENOTDIR") { h.update("absent\n"); continue; } fail(rel(d), error); }
+    walk(d, false);
+  }
+  while (pending.length) {
+    const real = pending.shift();
+    if (seen.has(real)) continue;
+    seen.add(real);
+    if (real === path.parse(real).root || inside(realRoot, real)) throw new Error(`a dependency link resolves to ${real}, the repository or one of its ancestors; refusing to bind it`);
+    h.update(`target\t${rel(real)}\n`);
+    const st = fs.lstatSync(real);
+    // A linked package outside the walked node_modules trees (a workspace package, or one elsewhere on disk) is hashed whole:
+    // any of its files can be executed by a consumer (an ignored dist/, an implicit index.js, a file its entry imports).
+    if (st.isDirectory()) walk(real, true); else entry(real, path.basename(real), false, true);
+  }
+  return h.digest("hex");
+}
+
+/**
+ * What a class A verdict depends on outside the checked tree: every file of this gate package (code at any depth, the advisory
+ * database, contracts, assets), node and pnpm versions, platform/arch, and each package's installed state
+ * (node_modules/.modules.yaml) and the installed dependency bytes (installedDependencyDigest). The broker binds an admission ticket to it and recomputes it when the compile starts
+ * (`rightkit-gate env-digest`), so a dependency or tool change while a compile waits invalidates the ticket.
+ */
+export function classAEnvironmentDigest({ root, files, spawn = defaultSpawn, includeCaches = true }) {
+  // Only a file that does not exist is "absent"; any other read failure throws: an input whose bytes cannot be read is never
+  // identified by a placeholder that would match the same failure later.
+  // `optional`: only an install-state file may legitimately not exist; a gate file found by the walk must be readable.
+  const fileDigest = (f, { optional = false } = {}) => { try { return createHash("sha256").update(fs.readFileSync(f)).digest("hex"); } catch (error) { if (optional && (error?.code === "ENOENT" || error?.code === "ENOTDIR")) return "absent"; throw new Error(`cannot read ${f} for the class A environment (${error?.code ?? error?.message})`); } };
+  const gatePkg = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+  const walkGate = (dir) => fs.readdirSync(dir, { withFileTypes: true }).flatMap((e) => (e.name === "node_modules" || e.name.startsWith(".") ? [] : e.isDirectory() ? walkGate(path.join(dir, e.name)) : [path.join(dir, e.name)]));
+  const gateFiles = walkGate(gatePkg).sort().map((f) => `${path.relative(gatePkg, f)}:${fileDigest(f)}`);
+  // Bounded: a pnpm that switches itself to the repository's packageManager version on first use, or waits on the network,
+  // must fail the probe (and its process tree) within PNPM_PROBE_TIMEOUT_MS, never hang an admission.
+  const pnpmVersion = (() => {
+    const r = spawn("pnpm", ["--version"], { cwd: root, boundedMs: PNPM_PROBE_TIMEOUT_MS });
+    if (r?.timedOut) throw new Error(`cannot identify pnpm for the class A environment (pnpm --version timed out after ${PNPM_PROBE_TIMEOUT_MS} ms; run it once in ${root} so pnpm can switch to the packageManager version)`);
+    if (failed(r) || !text(r).trim()) throw new Error(`cannot identify pnpm for the class A environment (${r?.error ? `could not run pnpm: ${r.error.code ?? r.error.message}` : why(r)})`);
+    return text(r).trim();
+  })();
+  const installState = files.filter((f) => /(^|\/)package\.json$/.test(f)).map((f) => path.join(path.dirname(path.join(root, f)), "node_modules", ".modules.yaml")).map((m) => `${path.relative(root, m)}:${fileDigest(m, { optional: true })}`);
+  return createHash("sha256").update([`node ${process.version}`, `pnpm ${pnpmVersion}`, `platform ${process.platform}-${process.arch}`, ...gateFiles, ...installState, `installed ${installedDependencyDigest({ root, files, includeCaches })}`].join("\n")).digest("hex");
+}
+
+/** Split pathspecs into batches whose joined length stays under `limit` characters (well below Windows' 32767 command line). */
+export function pathspecBatches(paths, limit = 8000) {
+  const batches = []; let current = []; let size = 0;
+  for (const p of paths) {
+    if (current.length && size + p.length + 1 > limit) { batches.push(current); current = []; size = 0; }
+    current.push(p); size += p.length + 1;
+  }
+  if (current.length) batches.push(current);
+  return batches;
+}
+
 export function discoverRustUnits({ root, spawn, cargoCommand, tracked, readFile, realpath = fs.realpathSync }) {
   const manifests = tracked("Cargo.toml");
   if (!manifests.length) return { present: false, units: [], cargoDir: ".", uncovered: [] };
@@ -490,7 +753,7 @@ export function lockScope({ changed, cargoDir = ".", unitNames, showBase, readLo
  * or the committed hook of every app copied from the template stops being "already current"). `nodePath` and every package are written into
  * a shell script: installHook passes only plain relative paths (hookGatePlan).
  */
-export function hookText(nodePath, packages = []) {
+export function hookText(nodePath, packages = [], legacy = false) {
   const bins = packages.map((dir) => ` ${dir}/node_modules/.bin/rightkit-gate`).join("");
   const pnpmExec = packages.length ? `pnpm --dir ${packages[0]} exec rightkit-gate` : "pnpm exec rightkit-gate";
   return `#!/bin/sh
@@ -510,7 +773,13 @@ found=""
 for bin in node_modules/.bin/rightkit-gate${bins} */node_modules/.bin/rightkit-gate */*/node_modules/.bin/rightkit-gate */*/*/node_modules/.bin/rightkit-gate; do
   if [ -x "$bin" ]; then found="$bin"; break; fi
 done
-if [ -n "$found" ]; then
+${legacy ? "" : `if command -v rightkit-host-gate >/dev/null 2>&1; then
+  echo "rightkit-gate: using host trusted gate" >&2
+  rightkit_gate() { rightkit-host-gate "$@"; }
+elif [ -f "$HOME/Library/Application Support/RightKit/build-control/config.json" ] || [ -f /d/.rightkit-managed/config.json ]; then
+  echo "rightkit-gate: managed host is missing rightkit-host-gate" >&2
+  exit 1
+el`}if [ -n "$found" ]; then
   echo "rightkit-gate: using $found" >&2
   rightkit_gate() { "$found" "$@"; }
 elif command -v pnpm >/dev/null 2>&1; then
@@ -707,8 +976,8 @@ const plainRelative = (p) => typeof p === "string" && p !== "" && !path.posix.is
  *   when declared. Without a declaration, a closure source that navigates out of its crate at run time without a literal path
  *   (externalInputs `leavesCrate`: workspace root, current_dir, a bare "..", the manifest directory's parent) keys the scan on the
  *   whole HEAD tree, since its tests may read anything.
- * - An npm package scan (test:npm, tsc, eslint, biome) keys on the package's workspace closure (its `workspace:` dependencies,
- *   transitively, by package name) and the root npm inputs; test:scripts-ci on scripts/, ci/, .github/, packages/release and the
+ * - An npm package scan (test:npm, tsc, eslint, biome) keys on the package's workspace closure (every dependency that is a workspace
+ *   package, whatever its spec, transitively, by package name) and the root npm inputs; test:scripts-ci on scripts/, ci/, .github/, packages/release and the
  *   root install graph. Every other class B scan (generated-docs, swift-build) uses the whole tree.
  * - Class A: cargo-deny, cargo-audit, pnpm-audit, pnpm-lockfile and advisory-exceptions are never cached (live answers); rustfmt,
  *   node-check, actionlint and the parse scans key on their files' blob ids; cargo-package-list on the crate, the manifest projection
@@ -746,9 +1015,10 @@ export function buildCacheDigest({ objectId, headTree, rustUnits = [], npmUnits
       if (!m) { unresolved = true; continue; }
       for (const section of ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"]) {
         for (const [name, spec] of Object.entries(m[section] ?? {})) {
-          if (!/^(workspace:|link:|file:)/.test(String(spec))) continue;
+          // A workspace package is a member whatever the spec: pnpm links it for a version range too (linkWorkspacePackages), and the
+          // tsc row checks it from its committed source (deterministic-scans.mjs TSC_PROJECT). Only an explicit local spec must resolve.
           const dep = npmByPkgName.get(`${u.root ?? "."}\0${name}`);
-          if (!dep) { unresolved = true; continue; }
+          if (!dep) { if (/^(workspace:|link:|file:)/.test(String(spec))) unresolved = true; continue; }
           if (!seen.has(dep.name)) { seen.set(dep.name, dep); stack.push(dep); }
         }
       }
@@ -893,13 +1163,18 @@ export const QUIET_LEASE_WAIT_DRAIN_MS = 2 * 60 * 1000;
  * Without `rustright` on PATH, or when the broker refuses, the lane runs without a lease and the gate says so: the tests still run,
  * their verdict is simply taken on a possibly busy host. `o.spawn` is the gate's synchronous spawner.
  */
-export function quietLeaseLane(o, { tag = "rightkit-gate:", reason = "rightkit-gate-quiet-tests", ttlMs = QUIET_LEASE_TTL_MS, waitDrainMs = QUIET_LEASE_WAIT_DRAIN_MS, pid = process.pid } = {}) {
+export function quietLeaseLane(o, { tag = "rightkit-gate:", reason = "rightkit-gate-quiet-tests", ttlMs: baseTtlMs = QUIET_LEASE_TTL_MS, waitDrainMs = QUIET_LEASE_WAIT_DRAIN_MS, pid = process.pid } = {}) {
   const which = (cmd) => {
     const r = o.spawn(o.platform === "win32" ? "where" : "which", [cmd]);
     return failed(r) ? null : (text(r).split(/\r?\n/).map((l) => l.trim()).find(Boolean) ?? null);
   };
   return {
-    acquire: async () => {
+    // `want.ttlMs` (from the scan runner): the lane's own bound, every quiet scan's timeout plus a margin, so the lease cannot
+    // expire while a quiet suite still runs (each scan is killed at its timeout first).
+    acquire: async (want = {}) => {
+      const ttlMs = Number.isFinite(want.ttlMs) && want.ttlMs > baseTtlMs ? want.ttlMs : baseTtlMs;
+      // A direct (Linux) host never takes a broker lease, whatever is on PATH (managed-cargo directPlatform).
+      if (directPlatform(o.platform ?? process.platform)) { o.out(`${tag} note: direct host (no broker on ${o.platform ?? process.platform}); quiet test scans run without a broker lease`); return null; }
       if (!which("rustright")) { o.out(`${tag} note: no rustright on PATH; quiet test scans run without a broker lease`); return null; }
       const started = Date.now();
       const r = o.spawn("rustright", ["quiet", "acquire", "--ttl-ms", String(ttlMs), "--reason", reason, "--wait-drain-ms", String(waitDrainMs), "--holder-pid", String(pid), "--json"]);
@@ -997,7 +1272,7 @@ async function installHook(o, root, force) {
   const wanted = hookText(nodePath, packages);
   const hasHook = o.exists(hookPath);
   const current = hasHook ? o.readFile(hookPath).replace(/\r\n/g, "\n") : null;
-  if (hasHook && current !== wanted && !force) {
+  if (hasHook && current !== wanted && current !== hookText(nodePath, packages, true) && !force) {
     o.err(`rightkit-gate: ${path.join(".githooks", "pre-push")} already exists and differs; nothing changed. Review it, or run \`rightkit-gate install-hook --force\` to replace it.`);
     return 1;
   }
@@ -1094,33 +1369,84 @@ async function installHook(o, root, force) {
  * the receipt only when every bound input is unchanged; the right-release stages run under a live door run, so they refuse any other
  * caller (gate-stages.mjs requireDoorRun).
  */
+/**
+ * The app a door run is for: the directory the gate was run from when it holds a release config (a nested app such as
+ * apps/coderight-tauri), else the repository root. Every right-release stage runs there, the sealed set is read from there, and the
+ * receipt is keyed to it (receiptKey). Returns { appRoot, appDir } with appDir relative to the repository root, "." at the root.
+ */
+export function appRootOf({ root, cwd, exists = fs.existsSync }) {
+  const inside = cwd && (cwd === root || cwd.startsWith(root + path.sep));
+  const hasConfig = (d) => ["right-release.config.json", "right-release.config.mjs"].some((f) => exists(path.join(d, f)));
+  // The nearest directory at or above cwd (below the root) that carries a release config is the app; a deeper cwd (apps/foo/src) is apps/foo.
+  let appRoot = root;
+  for (let d = path.resolve(cwd); d.startsWith(root) && d !== root; d = path.dirname(d)) { if (hasConfig(d)) { appRoot = d; break; } }
+  return { appRoot, appDir: path.relative(root, appRoot).split(path.sep).join("/") || "." };
+}
+
 async function runStages(o, args, root, git, io) {
   const option = (name) => { const i = args.indexOf(name); return i < 0 ? undefined : args[i + 1]; };
   const tag = "rightkit-gate:";
+  const { appRoot, appDir } = appRootOf({ root, cwd: o.cwd, exists: o.exists });
   const to = option("--to");
-  if (to === "dev" || to === "test") return await runWorktreeCompile(o, args, root, git, io, to);
-  const stages = stagesTo(to);
+  if (to === "dev" || to === "test") return await runWorktreeCompile(o, args, root, git, io, to, appRoot);
+  let stages = stagesTo(to);
   if (!stages) { o.err(`${tag} --to must be one of ${STAGES.join(", ")}`); return 2; }
   const platform = option("--platform");
   const tier = option("--tier");
-  if (stages.includes("package") && !["mac", "win"].includes(platform)) { o.err(`${tag} --to ${to} needs --platform mac|win`); return 2; }
-  if (stages.includes("release") && !["patch", "update"].includes(tier)) { o.err(`${tag} --to release needs --tier patch|update (chosen explicitly, never defaulted)`); return 2; }
-  const commit = text(git("rev-parse", "HEAD")).trim();
-  const tree = text(git("rev-parse", "HEAD^{tree}")).trim();
+  if (stages.includes("package") && !PLATFORMS.includes(platform)) { o.err(`${tag} --to ${to} needs --platform ${PLATFORMS.join("|")}`); return 2; }
+  // iOS and Android (Adrian, 2026-10-26: every app build goes through the door, class A first): check, compile and package run here as
+  // for desktop; there is no installed-QA lane for them, so the qualify stage does not exist for a mobile platform and is never
+  // recorded as passed. Qualification is the store's test track, after the release stage uploads the sealed build from this host
+  // (TestFlight, Play internal track; right-release upload --apply, no patch/update tier).
+  const mobile = MOBILE_PLATFORMS.has(platform);
+  if (mobile && to === "qualify") { o.err(`${tag} --to qualify has no stage for ${platform}: there is no installed-QA lane for a mobile build; qualification is the store's test track after --to release. Run --to package or --to release.`); return 2; }
+  if (mobile) stages = stages.filter((s) => s !== "qualify");
+  if (stages.includes("release") && !mobile && !["patch", "update"].includes(tier)) { o.err(`${tag} --to release needs --tier patch|update (chosen explicitly, never defaulted)`); return 2; }
+  // Commit-only build (GATE-CONTRACT §1, joint plan step 4c): on a direct host (Linux; not hosted CI, whose runner checkout is the
+  // commit) the door selects a commit (--commit <rev>, default HEAD), takes the host's build ownership, syncs the commit's
+  // gate-owned snapshot once, and every stage below reads that snapshot; the checkout may hold anything. Broker hosts keep the
+  // checkout route until the RustRight snapshot carrier lands (step 4d).
+  if (!o.doorSnapshot && directPlatform(o.platform) && o.env.GITHUB_ACTIONS !== "true") {
+    const snap = await import("../snapshot.mjs");
+    const { acquireBuildOwnership, ownershipFile } = await import("../build-ownership.mjs");
+    let selected;
+    try { selected = snap.resolveCommit(root, option("--commit") ?? "HEAD"); }
+    catch (e) { o.err(`${tag} cannot resolve ${option("--commit") ?? "HEAD"} to a commit: ${e.message}`); return 2; }
+    const snapshotsAt = o.snapshotRoot ?? snap.snapshotRoot({ platform: o.platform, env: o.env });
+    let own;
+    try { own = (o.acquireOwnership ?? acquireBuildOwnership)({ file: ownershipFile({ platform: o.platform, beside: o.snapshotRoot }), stage: `door:${to}`, snapshot: path.join(snapshotsAt, snap.repositoryOf(root).key), commit: selected.commit, platform: o.platform, env: o.env }); }
+    catch (e) { if (e.code !== "busy" && e.code !== "refused") throw e; o.err(`${tag} BLOCKED: ${e.message}; nothing ran${e.code === "refused" ? ", nothing created" : ""}`); return 1; }
+    o.out(`${tag} build ownership ${own.joined ? "joined" : "held"} ${own.handle}${own.reclaimed ? ` (reclaimed from ${own.reclaimed.from}: ${own.reclaimed.proofs.join("; ")})` : ""}`);
+    try {
+      // One sync per door run: a second one would prune what class A installed into the snapshot.
+      let synced;
+      try { synced = (o.syncSnapshot ?? snap.syncSnapshot)({ checkout: root, rev: selected.commit, root: snapshotsAt }); }
+      catch (e) { o.err(`${tag} ${e.code === "error" ? "RK_CHECK_ERROR" : "BLOCKED"}: snapshot ${e.message}; nothing ran`); return e.code === "error" ? 2 : 1; }
+      o.out(`${tag} snapshot ${synced.path} is commit ${synced.commit} tree ${synced.tree} (written=${synced.written} removed=${synced.removed} unchanged=${synced.unchanged})`);
+      return await runStages({ ...o, buildOwnership: own, doorSnapshot: { own, path: synced.path, commit: synced.commit, tree: synced.tree, root: snapshotsAt } }, args, root, git, { ...io, buildOwnership: own });
+    } finally {
+      const r = own.release();
+      if (r?.released === false && !own.joined) o.err(`${tag} build ownership ${own.handle} kept: ${r.why}`);
+    }
+  }
+  const ds = o.doorSnapshot ?? null;
+  const commit = ds ? ds.commit : text(git("rev-parse", "HEAD")).trim();
+  const tree = ds ? ds.tree : text(git("rev-parse", "HEAD^{tree}")).trim();
   const common = text(git("rev-parse", "--git-common-dir")).trim();
   if (!/^[0-9a-f]{40}$/.test(commit) || !tree || !common) { o.err(`${tag} cannot read HEAD and the git directory`); return 2; }
   const commonDir = path.resolve(root, common);
-  const dirty = git("status", "--porcelain", "--untracked-files=no");
-  if (failed(dirty) || text(dirty).trim()) { o.err(`${tag} BLOCKED: the checkout differs from HEAD; every stage works on the commit, so commit or stash first`); return 1; }
+  // The snapshot route reads only the commit; the checkout may hold anything (GATE-CONTRACT §1: no dirty-tree condition).
+  const dirty = ds ? null : git("status", "--porcelain", "--untracked-files=no");
+  if (!ds && (failed(dirty) || text(dirty).trim())) { o.err(`${tag} BLOCKED: the checkout differs from HEAD; every stage works on the commit, so commit or stash first`); return 1; }
 
   const which = (cmd) => { const r = o.spawn(o.platform === "win32" ? "where" : "which", [cmd]); return failed(r) ? [] : text(r).split(/\r?\n/).map((l) => l.trim()).filter(Boolean); };
-  const executor = (o.resolveExecutor ?? resolveExecutor)({ env: o.env, platform: o.platform, exists: o.exists, which, readFile: o.readFile });
+  const executor = (o.resolveExecutor ?? resolveExecutor)({ env: o.env, platform: o.platform, exists: o.exists, which, readFile: o.readFile }); applyExecutorEnv(o, executor);
   if (executor.kind === "refuse") { o.err(`${tag} BLOCKED: ${executor.problem}`); return 1; }
   const version = (cmd, a) => { const r = o.spawn(cmd, a, { cwd: root }); return failed(r) ? null : text(r).trim().split(/\r?\n/)[0]; };
-  const listed = git("ls-tree", "-r", "--name-only", "-z", "HEAD");
+  const listed = git("ls-tree", "-r", "--name-only", "-z", commit);
   const lockFiles = {};
   for (const f of failed(listed) ? [] : text(listed).split("\0").filter((x) => /(^|\/)(Cargo\.lock|pnpm-lock\.yaml)$/.test(x))) {
-    const shown = git("show", `HEAD:${f}`); if (!failed(shown)) lockFiles[f] = text(shown);
+    const shown = git("show", `${commit}:${f}`); if (!failed(shown)) lockFiles[f] = text(shown);
   }
   const binding = bindingOf({
     tree, lockFiles, gateFile: fileURLToPath(import.meta.url), executor: executor.kind,
@@ -1129,7 +1455,7 @@ async function runStages(o, args, root, git, io) {
   // Release writes to R2. The write credential lives only in the trusted publisher: a GitHub Actions job in the protected
   // publication environment, which sets RIGHTKIT_PUBLISHER=github-environment. Hosts and agents never hold it, so the door refuses the
   // stage anywhere else rather than fail half way through an upload.
-  if (stages.includes("release") && !(o.env.GITHUB_ACTIONS === "true" && o.env.RIGHTKIT_PUBLISHER === "github-environment")) {
+  if (stages.includes("release") && !mobile && !(o.env.GITHUB_ACTIONS === "true" && o.env.RIGHTKIT_PUBLISHER === "github-environment")) {
     o.err(`${tag} BLOCKED: --to release runs only in the trusted publisher (the release workflow's protected publication job). Run --to qualify here, then dispatch the release workflow for ${commit.slice(0, 12)}`);
     return 1;
   }
@@ -1146,12 +1472,12 @@ async function runStages(o, args, root, git, io) {
     }
     (o.writeReceipt ?? writeReceipt)({ commonDir, receipt: imported });
   }
-  const previous = (o.readReceipt ?? readReceipt)({ commonDir, commit });
+  const previous = (o.readReceipt ?? readReceipt)({ commonDir, commit, app: appDir });
   // Same host and inputs: every recorded stage counts. Same source on another host: only the stages bound to sealed bytes (package and
   // later) carry over; check and compile run again here.
   const receipt = previous && sameBinding(previous.binding, binding) ? previous
     : previous && sameSource(previous.binding, binding) ? { ...previous, binding, stages: Object.fromEntries(Object.entries(previous.stages ?? {}).filter(([k]) => k !== "check" && k !== "compile")) }
-      : { schema: RECEIPT_SCHEMA, commit, binding, stages: {} };
+      : { schema: RECEIPT_SCHEMA, commit, app: appDir, binding, stages: {} };
   const receiptOut = option("--receipt-out");
   const save = () => {
     (o.writeReceipt ?? writeReceipt)({ commonDir, receipt });
@@ -1163,18 +1489,22 @@ async function runStages(o, args, root, git, io) {
     const run = startRun({ commonDir, commit, tree, stage });
     try {
       o.out(`${tag} [${stage}] right-release ${cliArgs.join(" ")}`);
-      const r = (o.spawnInherit ?? ((cmd, a, opts) => spawnInherit(cmd, a, { ...opts, stdio: "inherit" })))(process.execPath, [cli, ...cliArgs], { cwd: root, env: { ...o.env, ...run.env } });
+      const r = (o.spawnInherit ?? ((cmd, a, opts) => spawnInherit(cmd, a, { ...opts, stdio: "inherit" })))(process.execPath, [cli, ...cliArgs], { cwd: appRoot, env: { ...o.env, ...run.env } });
       return r.status === 0;
     } finally { endRun(run); }
   };
 
-  o.out(`${tag} --to ${to} for ${commit.slice(0, 12)}: ${stages.join(" -> ")}; executor ${executor.kind}`);
+  o.out(`${tag} --to ${to} for ${commit.slice(0, 12)}${appDir === "." ? "" : ` (app ${appDir})`}: ${stages.join(" -> ")}; executor ${executor.kind}`);
   // A later stage on the sealed bytes: check, compile and package already passed for them (in this receipt) and the bytes on disk are
   // the ones they sealed, so they are not run again.
-  const sealedNow = receipt.stages.package?.ok ? (o.sealedFor ?? sealedFor)({ root, commit, platform }) : null;
+  const sealedNow = receipt.stages.package?.ok ? (o.sealedFor ?? sealedFor)({ root: appRoot, commit, platform }) : null;
   const sealedIntact = Boolean(sealedNow && sealedNow.id === receipt.stages.package.sealed && sealedNow.digest === receipt.stages.package.manifestSha256);
+  // Every deterministic rule and scan must run before compilation, for every door stage.
+  const earlyTier = "release";
+  const tierAtLeast = (have, need) => have === "release" || need === "compile";
   for (const stage of stages) {
-    if ((stage === "check" || stage === "compile") && receipt.stages[stage]?.ok) { o.out(`${tag} [${stage}] already passed for this exact input (commit, tree, lockfiles, gate, toolchain)`); continue; }
+    if (stage === "check" && receipt.stages.check?.ok && tierAtLeast(receipt.stages.check.ruleTier ?? "compile", earlyTier)) { o.out(`${tag} [check] already passed (${receipt.stages.check.ruleTier ?? "compile"} tier) for this exact input (commit, tree, lockfiles, gate, toolchain)`); continue; }
+    if (stage === "compile" && receipt.stages.compile?.ok) { o.out(`${tag} [${stage}] already passed for this exact input (commit, tree, lockfiles, gate, toolchain)`); continue; }
     if ((stage === "check" || stage === "compile" || stage === "package") && sealedIntact) {
       o.out(`${tag} [${stage}] already passed for the sealed set ${sealedNow.id} (manifest ${sealedNow.digest.slice(0, 12)})`); continue;
     }
@@ -1185,41 +1515,77 @@ async function runStages(o, args, root, git, io) {
     }
     // The publisher only uploads. It never checks out a build environment, signs or runs installed QA, so every earlier stage must
     // already stand in its receipt for exactly the sealed bytes on disk; anything else is refused, never rebuilt or requalified here.
-    if (to === "release" && stage !== "release") {
+    if (to === "release" && !mobile && stage !== "release") {
       o.err(`${tag} BLOCKED: [${stage}] --to release only uploads: the receipt must already record ${stage} for the sealed bytes on disk (${sealedNow ? `manifest ${sealedNow.digest.slice(0, 12)}` : "none found"}); run --to qualify on the host and stage again`);
       return 1;
     }
-    let ok = false; const at = new Date().toISOString(); let extra = {};
-    if (stage === "check") ok = (await (o.runCheck ?? (() => main(["check", "--commit", "HEAD"], { ...io, cwd: root })))()) === 0;
+    let ok = false; const at = new Date().toISOString(); let extra = {}; let directReceipt = null;
+    if (stage === "check") {
+      ok = (await (o.runCheck ?? (() => main(["check", "--commit", ds ? commit : "HEAD", "--full-a", ...(ds ? ["--snapshot", ds.path] : []), "--rule-tier", earlyTier], { ...io, cwd: root, ...(ds ? { buildOwnership: ds.own } : {}) })))(earlyTier)) === 0;
+      extra = { ruleTier: earlyTier };
+    }
     else if (stage === "compile") {
       // A Tauri crate with externalBin needs its sidecars in src-tauri/binaries before it compiles (its build script refuses
       // otherwise), so every release config that declares `sidecars` is staged first, through right-release under this door run.
-      const listedConfigs = git("ls-tree", "-r", "--name-only", "-z", "HEAD");
-      const sidecarConfigs = (failed(listedConfigs) ? [] : text(listedConfigs).split("\0").filter((f) => /(^|\/)right-release\.config\.(json|mjs)$/.test(f)))
-        .filter((f) => { try { return /\bsidecars\b/.test(o.readFile(path.join(root, f))); } catch { return false; } });
+      const listedConfigs = git("ls-tree", "-r", "--name-only", "-z", commit);
+      const sidecarConfigs = (failed(listedConfigs) ? [] : text(listedConfigs).split("\0").filter((f) => /(^|\/)right-release\.config\.(json|mjs)$/.test(f)).filter((f) => appDir === "." || f.startsWith(`${appDir}/`)))
+        // On the snapshot route the commit's config decides, never the checkout's (which may add, edit or hide one).
+        .filter((f) => { try { return /\bsidecars\b/.test(o.readFile(path.join(ds ? ds.path : root, f))); } catch { return false; } });
       ok = true;
-      for (const config of sidecarConfigs) if (!rightRelease(stage, ["stage-sidecar", "--config", config])) { ok = false; break; }
-      if (ok) ok = (await (o.runCompile ?? (() => main(["--all"], { ...io, cwd: root, readStdin: () => "" })))()) === 0;
+      // Sidecar staging is right-release's, which still reads the checkout: from a snapshot it waits for the right-release source
+      // split (joint plan step 4c, second part), so a commit with sidecars is refused here rather than built from the checkout.
+      if (ds && sidecarConfigs.length) { o.err(`${tag} BLOCKED: [compile] ${sidecarConfigs.join(", ")} stage sidecars through right-release, which does not build from a commit snapshot yet; nothing compiled`); ok = false; }
+      // right-release runs in appRoot (nested apps), so the repository-relative config is handed over absolute (Astra, second pass).
+      for (const config of ok && !ds ? sidecarConfigs : []) if (!rightRelease(stage, ["stage-sidecar", "--config", path.join(root, config)])) { ok = false; break; }
+      if (ok) ok = (await (o.runCompile ?? (() => main(ds ? ["--all", "--commit", commit, "--snapshot", ds.path] : ["--all"], { ...io, cwd: root, readStdin: () => "", ...(ds ? { buildOwnership: ds.own, onDirectReceipt: (r) => { directReceipt = r; } } : {}) })))()) === 0;
+      if (directReceipt) extra = { ...extra, direct: directReceipt };
+    }
+    else if (stage === "package" && ds) {
+      o.err(`${tag} BLOCKED: [package] right-release builds and seals from the checkout; building from a commit snapshot waits for the right-release source split (joint plan step 4c, second part); nothing was built`);
+      ok = false;
     }
     else if (stage === "package") {
-      ok = rightRelease(stage, ["qa", "--stage", "source", "--platform", platform]) && rightRelease(stage, ["build", "--platform", platform]);
-      const sealed = ok ? (o.sealedFor ?? sealedFor)({ root, commit, platform }) : null;
+      // Source QA (right-release qa --stage source) exists for mac and win only; a mobile package is the signed build alone.
+      ok = (mobile || rightRelease(stage, ["qa", "--stage", "source", "--platform", platform])) && rightRelease(stage, ["build", "--platform", platform]);
+      const sealed = ok ? (o.sealedFor ?? sealedFor)({ root: appRoot, commit, platform }) : null;
       if (ok && !sealed) { o.err(`${tag} [package] the build reported success but sealed nothing for ${commit.slice(0, 8)} on ${platform}`); ok = false; }
       if (sealed) extra = { platform, sealed: sealed.id, manifestSha256: sealed.digest };
     } else {
       const sealed = receipt.stages.package?.ok ? receipt.stages.package : null;
-      const current = sealed ? (o.sealedFor ?? sealedFor)({ root, commit, platform }) : null;
+      const current = sealed ? (o.sealedFor ?? sealedFor)({ root: appRoot, commit, platform }) : null;
       if (!sealed || !current || current.id !== sealed.sealed || current.digest !== sealed.manifestSha256) {
         o.err(`${tag} BLOCKED: [${stage}] needs the sealed set the package stage produced for this commit, unchanged (sealed manifest digest)`);
         ok = false;
+      } else if (stage === "release" && mobile) {
+        // The host uploads the sealed mobile build to the store's test track itself (the credentials live in the host's credential
+        // store); the release tier is owed first, as for desktop qualification.
+        const releaseTier = receipt.stages.check?.ok && receipt.stages.check.ruleTier === "release"
+          ? (o.out(`${tag} [release] the release tier already passed at check for this exact input; not run again`), 0)
+          : await (o.runReleaseCheck ?? (() => main(["check", "--commit", ds ? commit : "HEAD", "--full-a", ...(ds ? ["--snapshot", ds.path] : []), "--rule-tier", "release"], { ...io, cwd: root, ...(ds ? { buildOwnership: ds.own } : {}) })))();
+        if (releaseTier !== 0) { o.err(`${tag} [release] the release tier (every rule and scan) is red for ${commit.slice(0, 12)}; nothing was uploaded`); ok = false; }
+        else ok = rightRelease(stage, ["upload", "--platform", platform, "--release", sealed.sealed, "--apply"]);
+        extra = { sealed: sealed.sealed, manifestSha256: sealed.manifestSha256, track: platform === "ios" ? "testflight" : "play-internal", ruleTier: "release" };
       } else if (stage === "qualify") {
-        ok = rightRelease(stage, ["qa", "--stage", "installed", "--platform", platform, "--release", sealed.sealed]);
-        extra = { sealed: sealed.sealed, manifestSha256: sealed.manifestSha256 };
+        // Qualification owes the release tier: every rule and scan, the ones held out of compile admission included (app-check.mjs TIERS).
+        const releaseTier = receipt.stages.check?.ok && receipt.stages.check.ruleTier === "release"
+          ? (o.out(`${tag} [qualify] the release tier already passed at check for this exact input; not run again`), 0)
+          : await (o.runReleaseCheck ?? (() => main(["check", "--commit", ds ? commit : "HEAD", "--full-a", ...(ds ? ["--snapshot", ds.path] : []), "--rule-tier", "release"], { ...io, cwd: root, ...(ds ? { buildOwnership: ds.own } : {}) })))();
+        if (releaseTier !== 0) { o.err(`${tag} [qualify] the release tier (every rule and scan) is red for ${commit.slice(0, 12)}; nothing was qualified`); ok = false; }
+        else ok = rightRelease(stage, ["qa", "--stage", "installed", "--platform", platform, "--release", sealed.sealed]);
+        extra = { sealed: sealed.sealed, manifestSha256: sealed.manifestSha256, ruleTier: "release" };
       } else {
         if (!receipt.stages.qualify?.ok || receipt.stages.qualify.manifestSha256 !== sealed.manifestSha256) { o.err(`${tag} BLOCKED: [release] the sealed set was not qualified (installed QA) in this door run's receipt`); ok = false; }
         else { ok = rightRelease(stage, ["upload", "--release", sealed.sealed, "--platform", platform, "--tier", tier]); extra = { sealed: sealed.sealed, manifestSha256: sealed.manifestSha256, tier }; }
       }
     }
+    if (ds) {
+      // The stage covers the commit only if the snapshot is still its tree and the host is still this door's (E6).
+      let intact = ds.own.held();
+      if (intact) { try { (o.verifySnapshot ?? (await import("../snapshot.mjs")).verifySnapshot)({ checkout: root, rev: commit, root: ds.root, dir: ds.path }); } catch (e) { intact = false; o.err(`${tag} RK_CHECK_ERROR: [${stage}] ${e.message}`); } }
+      else o.err(`${tag} RK_CHECK_ERROR: [${stage}] the build ownership ${ds.own.handle} is no longer held`);
+      extra = { ...extra, snapshot: { path: ds.path, tree: ds.tree, intactAfter: intact }, ownership: ds.own.handle };
+      if (!intact) { receipt.stages[stage] = { ok: false, at, ...extra }; save(); o.err(`${tag} --to ${to} stopped at ${stage}: the result covers no known bytes`); return 2; }
+    }
     receipt.stages[stage] = { ok, at, ...extra };
     save();
     if (!ok) { o.err(`${tag} --to ${to} stopped at ${stage}: nothing after it ran`); return 1; }
@@ -1247,20 +1613,22 @@ function stageForPublisher(o, args, root, git) {
   const common = text(git("rev-parse", "--git-common-dir")).trim();
   if (!/^[0-9a-f]{40}$/.test(commit) || !common) { o.err(`${tag} cannot read HEAD and the git directory`); return 2; }
   const commonDir = path.resolve(root, common);
-  const receipt = (o.readReceipt ?? readReceipt)({ commonDir, commit });
+  const { appRoot, appDir } = appRootOf({ root, cwd: o.cwd, exists: o.exists });
+  const receipt = (o.readReceipt ?? readReceipt)({ commonDir, commit, app: appDir });
   const pack = receipt?.stages?.package; const qual = receipt?.stages?.qualify;
-  const sealed = pack?.ok ? (o.sealedFor ?? sealedFor)({ root, commit, platform }) : null;
+  const sealed = pack?.ok ? (o.sealedFor ?? sealedFor)({ root: appRoot, commit, platform }) : null;
   if (!pack?.ok || !qual?.ok || pack.platform !== platform || qual.manifestSha256 !== pack.manifestSha256 || !sealed || sealed.id !== pack.sealed || sealed.digest !== pack.manifestSha256) {
     o.err(`${tag} BLOCKED: stage needs this host's receipt for ${commit.slice(0, 12)} with package and qualify passed on ${platform} and the sealed set unchanged; run rightkit-gate --to qualify --platform ${platform} first`);
     return 1;
   }
-  const releaseTag = `rightkit-staging-${commit}`;
+  // One draft per commit and app (receiptKey): two apps of one repository staged at one commit never clobber each other's assets.
+  const releaseTag = `rightkit-staging-${receiptKey(commit, appDir)}`;
   const work = fs.mkdtempSync(path.join(os.tmpdir(), "rightkit-stage-"));
   try {
     const receiptFile = path.join(work, `receipt-${platform}.json`);
     fs.writeFileSync(receiptFile, `${JSON.stringify(receipt, null, 2)}\n`);
     const archive = path.join(work, `sealed-${platform}.tar.gz`);
-    const tar = o.spawn("tar", ["-czf", archive, "-C", root, path.join(".right-release", "sealed", sealed.id, platform)]);
+    const tar = o.spawn("tar", ["-czf", archive, "-C", appRoot, path.join(".right-release", "sealed", sealed.id, platform)]);
     if (failed(tar)) { o.err(`${tag} could not pack ${sealed.id}/${platform}`); return 1; }
     const gh = (...a) => o.spawn("gh", a, { cwd: root });
     if (failed(gh("release", "view", releaseTag))) {
@@ -1273,7 +1641,6 @@ function stageForPublisher(o, args, root, git) {
     if (tier) {
       // The trusted publisher is RightKit's publish-app workflow: app repositories are private and run no Actions.
       const slug = text(gh("repo", "view", "--json", "nameWithOwner", "-q", ".nameWithOwner")).trim();
-      const appDir = path.relative(root, o.cwd).replaceAll("\\", "/") || ".";
       const run = gh("workflow", "run", "publish-app.yml", "-R", PUBLISHER_REPO, "-f", `app=${slug}`, "-f", `app_dir=${appDir}`, "-f", `source_revision=${commit}`, "-f", `tier=${tier}`, "-f", `platforms=${platform}`);
       if (!slug || failed(run)) { o.err(`${tag} staged, but could not dispatch ${PUBLISHER_REPO} publish-app.yml: ${text(run).trim()}`); return 1; }
       o.out(`${tag} dispatched ${PUBLISHER_REPO} publish-app.yml for ${slug}@${commit.slice(0, 12)} (${platform}, ${tier}); the publisher re-runs class A, verifies the receipt and the bytes, then uploads`);
@@ -1288,28 +1655,55 @@ function stageForPublisher(o, args, root, git) {
  * run, the only way it runs at all. The executor is the same as every other stage: the broker where there is one (its own admission
  * checks again), plain cargo on an unmanaged host, never around a managed host's broker.
  */
-async function runWorktreeCompile(o, args, root, git, io, to) {
+async function runWorktreeCompile(o, args, root, git, io, to, appRoot = root) {
   const tag = "rightkit-gate:";
-  const passthrough = args.includes("--") ? args.slice(args.indexOf("--") + 1) : [];
+  const separator = args.indexOf("--");
+  const passthrough = separator >= 0 ? args.slice(separator + 1) : [];
+  // `--to dev --platform mac` (the documented form) hands the platform to right-release as `--platform mac`; a platform given after
+  // `--` wins (Pulse, 2026-10-27: the flag before `--` was dropped and right-release refused "requires --platform").
+  const gateArgs = separator >= 0 ? args.slice(0, separator) : args;
+  const platformAt = gateArgs.indexOf("--platform");
+  if (platformAt >= 0 && gateArgs[platformAt + 1] && !passthrough.includes("--platform")) passthrough.unshift("--platform", gateArgs[platformAt + 1]);
   const commit = text(git("rev-parse", "HEAD")).trim();
   const tree = text(git("rev-parse", "HEAD^{tree}")).trim();
   const common = text(git("rev-parse", "--git-common-dir")).trim();
   if (!/^[0-9a-f]{40}$/.test(commit) || !common) { o.err(`${tag} cannot read HEAD and the git directory`); return 2; }
   const which = (cmd) => { const r = o.spawn(o.platform === "win32" ? "where" : "which", [cmd]); return failed(r) ? [] : text(r).split(/\r?\n/).map((l) => l.trim()).filter(Boolean); };
-  const executor = (o.resolveExecutor ?? resolveExecutor)({ env: o.env, platform: o.platform, exists: o.exists, which, readFile: o.readFile });
+  const executor = (o.resolveExecutor ?? resolveExecutor)({ env: o.env, platform: o.platform, exists: o.exists, which, readFile: o.readFile }); applyExecutorEnv(o, executor);
   if (executor.kind === "refuse") { o.err(`${tag} BLOCKED: ${executor.problem}`); return 1; }
   o.out(`${tag} --to ${to} on the working tree of ${commit.slice(0, 12)}: check (class A) -> right-release ${to}; executor ${executor.kind}`);
-  const checked = await (o.runCheck ?? (() => main(["check", "--worktree"], { ...io, cwd: root })))();
+  // Full class A on the working tree, the checks that execute repository code included, before right-release compiles anything.
+  const checked = await (o.runCheck ?? (() => main(["check", "--worktree", "--full-a"], { ...io, cwd: root })))();
   if (checked !== 0) { o.err(`${tag} --to ${to} stopped at check: nothing compiled`); return 1; }
   const commonDir = path.resolve(root, common);
   const run = startRun({ commonDir, commit, tree, stage: to });
   try {
     const cli = fileURLToPath(new URL("../cli/right-release.mjs", import.meta.url));
-    const r = (o.spawnInherit ?? ((cmd, a, opts) => spawnInherit(cmd, a, { ...opts, stdio: "inherit" })))(process.execPath, [cli, to, ...passthrough], { cwd: o.cwd, env: { ...o.env, ...run.env } });
+    // right-release reads its config from its cwd: the resolved app root (appRootOf), not the directory the command was typed in
+    // (apps/foo/src is apps/foo; Astra, third pass).
+    // The door's own RightKit runs every sub-step: a dev target's `right-release web-build|stage-sidecar` steps resolve `right-release`
+    // on PATH, which found the app's node_modules copy (HeardRight on the Dell, 2026-10-27: the app's 0.6.8 guard refused what the
+    // door's 0.6.9 admitted). An installed gate (node_modules/@rightkit/release/bin) has its package's bin shims two levels up.
+    const r = (o.spawnInherit ?? ((cmd, a, opts) => spawnInherit(cmd, a, { ...opts, stdio: "inherit" })))(process.execPath, [cli, to, ...passthrough], { cwd: appRoot, env: { ...o.env, ...run.env, ...doorPath(o) } });
     return r.status === 0 ? 0 : 1;
   } finally { endRun(run); }
 }
 
+/** A direct (Linux) executor's environment (PATH without RustRight shim directories) for every child this run starts. */
+function applyExecutorEnv(o, executor) {
+  if (executor?.env && o.env) Object.assign(o.env, executor.env);
+  if (executor?.note && o.out) o.out(`rightkit-gate: ${executor.note}`);
+}
+
+/** PATH with the door's own `right-release` shims first (`<node_modules>/.bin` beside an installed gate), or nothing for a checkout. */
+export function doorPath(o, gateFile = o.gateFile ?? fileURLToPath(import.meta.url), platform = o.platform ?? process.platform) {
+  const bin = path.resolve(path.dirname(gateFile), "..", "..", "..", ".bin");
+  const shim = path.join(bin, platform === "win32" ? "right-release.cmd" : "right-release");
+  if (!(o.exists ?? fs.existsSync)(shim)) return {};
+  const key = platform === "win32" ? Object.keys(o.env ?? {}).find((k) => k.toUpperCase() === "PATH") ?? "Path" : "PATH";
+  return { [key]: `${bin}${path.delimiter}${(o.env ?? {})[key] ?? ""}` };
+}
+
 // ---- main ---------------------------------------------------------------------------------------------------
 
 /**
@@ -1333,14 +1727,67 @@ export async function main(argv, io = {}) {
     return 0;
   }
   if (args.includes("--help") || args.includes("-h")) { o.out(USAGE); return 0; }
+  // `snapshot`: sync the selected commit into the gate-owned source directory and verify it is exactly the commit's tree
+  // (../snapshot.mjs; docs/GATE-CONTRACT.md §1). Reads the checkout's commits only, never its working files.
+  // `--verify --env <digest>` also requires the installed dependency environment to still be the digest `env-digest --snapshot` recorded.
+  if (args[0] === "snapshot") {
+    const sc = await import("../snapshot-check.mjs");
+    return (await import("../snapshot.mjs")).snapshotCommand(o, args.slice(1), { environmentDigest: ({ checkout, dir, commit }) => classAEnvironmentDigest({ root: dir, files: sc.commitFiles(checkout, commit, o.spawn).files, spawn: o.spawn }) });
+  }
+  // `live-scans`: re-run only the live remote scans (pnpm-audit) of a checked tree, answering the broker's verdict-reuse refresh
+  // (../snapshot-check.mjs; GATE-CONTRACT §1, E18; rightkit#1257).
+  if (args[0] === "live-scans") return (await import("../snapshot-check.mjs")).liveScansCommand(o, args.slice(1), { discoverPnpmRoots, discoverNpmUnits });
   const sub = args[0] && !args[0].startsWith("-") ? args[0] : null;
-  if (sub && sub !== "install-hook" && sub !== "check" && sub !== "stage") { o.err(`rightkit-gate: unknown command ${JSON.stringify(sub)}\n${USAGE}`); return 2; }
+  if (sub && sub !== "install-hook" && sub !== "check" && sub !== "stage" && sub !== "env-digest") { o.err(`rightkit-gate: unknown command ${JSON.stringify(sub)}\n${USAGE}`); return 2; }
   // `check` is the deterministic stage (Adrian, 2026-10-25: deterministic always first, one door): the app-check rules, then every
   // class A scan (lockfiles, cargo-deny, cargo-audit, secrets, licences, manifests, workflow lint, syntax...) over the whole tree of the
   // commit, never a diff. Nothing compiles. The RustRight broker runs exactly this before it admits any compile. `--list`,
   // `--print-baseline` and `--only` stay app-check-only views.
+  if ((sub === "check" || (!sub && args.includes("--all"))) && args.includes("--snapshot") && !o.buildOwnership) {
+    // Host-wide build ownership (../build-ownership.mjs; GATE-CONTRACT §1): held from before the first snapshot read through the
+    // end of the check, so no other request can sync the snapshot while class A runs in it. A nested gate whose
+    // RIGHTKIT_BUILD_OWNERSHIP names the current owner joins it. Busy (or liveness unknown) runs nothing.
+    const { acquireBuildOwnership, ownershipFile } = await import("../build-ownership.mjs");
+    let own;
+    try { own = (o.acquireOwnership ?? acquireBuildOwnership)({ file: ownershipFile({ platform: o.platform, beside: o.snapshotRoot }), stage: sub ?? "compile", snapshot: option("--snapshot") ?? null, commit: option("--commit") ?? null, platform: o.platform, env: o.env }); }
+    catch (e) { if (e.code !== "busy" && e.code !== "refused") throw e; o.err(`rightkit-gate: RK_CHECK_ERROR: ${e.message}; nothing ran${e.code === "refused" ? ", nothing created" : ""}`); return 2; }
+    o.out(`rightkit-gate: build ownership ${own.joined ? "joined" : "held"} ${own.handle}${own.reclaimed ? ` (reclaimed from ${own.reclaimed.from}: ${own.reclaimed.proofs.join("; ")})` : ""}`);
+    try { return await main(argv, { ...io, buildOwnership: own }); }
+    finally { const r = own.release(); if (r?.released === false && !own.joined) o.err(`rightkit-gate: build ownership ${own.handle} kept: ${r.why}`); }
+  }
   if (sub === "check") {
-    const appCheck = await (o.appCheck ?? (await import("../app-check.mjs")).main)(args.slice(1), { out: o.out, err: o.err, label: "check", cwd: o.cwd });
+    // `--snapshot <dir>`: full class A of the gate-owned snapshot of a selected commit (../snapshot-check.mjs). The checkout is only
+    // where the commit comes from: its HEAD and status are never read, and the snapshot must be exactly the commit's tree before and
+    // after the check, or the check is RK_CHECK_ERROR (exit 2).
+    let snapshotDir = null; let snapshotCommit = null; let snapshotCheckout = null; let sc = null;
+    if (args.includes("--snapshot")) {
+      sc = await import("../snapshot-check.mjs");
+      try {
+        const at = option("--repo") ? path.resolve(o.cwd, option("--repo")) : o.cwd;
+        const top0 = o.spawn("git", ["rev-parse", "--show-toplevel"], { cwd: at });
+        if (failed(top0) || !text(top0).trim()) throw new sc.CheckError(`${at} is not a git checkout`);
+        snapshotCheckout = fs.realpathSync.native(path.resolve(text(top0).trim()));
+        snapshotDir = sc.snapshotOption(args, { checkout: snapshotCheckout });
+        snapshotCommit = sc.commitOf(snapshotCheckout, option("--commit"), o.spawn);
+        sc.verifySnapshotDir({ checkout: snapshotCheckout, dir: snapshotDir, ...snapshotCommit, when: "before the check" });
+        o.out(`rightkit-gate: snapshot ${snapshotDir} is commit ${snapshotCommit.commit} tree ${snapshotCommit.tree} (verified before the check)`);
+      } catch (e) { o.err(`rightkit-gate: ${sc.CHECK_ERROR}: ${e.message}`); return 2; }
+    }
+    if (args.filter((arg) => arg === "--rule-tier").length > 1 || (args.includes("--rule-tier") && option("--rule-tier") === undefined)) {
+      o.err("rightkit-gate: check requires exactly one value for --rule-tier"); return 2;
+    }
+    const requestedTier = option("--rule-tier") ?? "compile";
+    if (!["compile", "release"].includes(requestedTier)) { o.err(`rightkit-gate: check --rule-tier must be compile or release, not ${JSON.stringify(requestedTier)}`); return 2; }
+    // Full admission cannot be downgraded by a caller's tier flag. Partial views retain their requested tier.
+    const fullAdmission = args.includes("--full-a") && !args.includes("--list") && !args.includes("--print-baseline") && !args.includes("--only");
+    const stripSnapshot = (list) => { const i = list.indexOf("--snapshot"); return i < 0 ? list : [...list.slice(0, i), ...list.slice(i + 2)]; };
+    const appArgs = stripSnapshot(args.slice(1).filter((a) => a !== "--full-a"));
+    if (fullAdmission) {
+      const tierIndex = appArgs.indexOf("--rule-tier");
+      if (tierIndex >= 0) appArgs.splice(tierIndex, 2);
+      appArgs.push("--rule-tier", "release");
+    }
+    const appCheck = await (o.appCheck ?? (await import("../app-check.mjs")).main)(appArgs, { out: o.out, err: o.err, label: "check", cwd: o.cwd });
     if (args.includes("--list") || args.includes("--print-baseline") || args.includes("--only") || o.classA === false) {
       // A view of the app rules, never a class A verdict: say so, so no caller can take its exit 0 for a full check.
       // A green partial view exits PARTIAL_EXIT (3), never 0, so a caller that admits only exit 0 rejects it by status alone.
@@ -1348,13 +1795,17 @@ export async function main(argv, io = {}) {
       o.err("rightkit-gate: PARTIAL: app rules only (--only); no class A scan ran, so this is not a class A result");
       return appCheck === 0 ? PARTIAL_EXIT : appCheck;
     }
+    if (appCheck !== 0) {
+      o.err("rightkit-gate: BLOCKED: app rules failed; no further scans ran");
+      return appCheck;
+    }
     const repoArg = option("--repo");
     const checkCwd = repoArg ? path.resolve(o.cwd, repoArg) : o.cwd;
-    const classA = await main(["--class-a", ...(args.includes("--worktree") ? ["--worktree"] : ["--commit", option("--commit") ?? "HEAD"])], { ...io, cwd: checkCwd });
+    // Admission uses the full tier; a partial diagnostic check may choose either tier.
+    const ruleTier = fullAdmission ? "release" : requestedTier;
+    const classA = await main(["--class-a", "--rule-tier", ruleTier, ...(args.includes("--full-a") ? ["--full-a"] : []), ...(args.includes("--worktree") ? ["--worktree"] : ["--commit", snapshotCommit?.commit ?? option("--commit") ?? "HEAD"]), ...(snapshotDir ? ["--snapshot", snapshotDir] : [])], { ...io, cwd: checkCwd });
     // RightKit checking itself: its own rules (line endings, consumer recipes, npm surface, version copies and the version feed, dispatcher
-    // pins, consumer locks, generated docs, temp paths: scripts/preflight.mjs) and its exports' import safety are class A for the RightKit repository. They run only when this gate is that
-    // repository's own in-tree copy, so a gate checking any other repository (the broker's pinned one included) never runs
-    // that repository's code.
+    // pins, consumer locks, generated docs, temp paths: scripts/preflight.mjs) and its exports' import safety are class A for the RightKit repository.
     let selfRules = 0;
     const top = o.spawn("git", ["rev-parse", "--show-toplevel"], { cwd: checkCwd });
     const root = failed(top) ? null : path.resolve(text(top).trim());
@@ -1363,7 +1814,30 @@ export async function main(argv, io = {}) {
     // never after a failure, so a red tree executes nothing of its own.
     // Compared as real, long paths (and case-blind on Windows): git prints the long form of an 8.3 short path such as RUNNER~1.
     const canon = (p) => { let c; try { c = fs.realpathSync.native(p); } catch { c = path.resolve(p); } return process.platform === "win32" ? c.toLowerCase() : c; };
-    if (root && canon(self).startsWith(canon(root) + path.sep) && o.exists(path.join(root, "scripts", "preflight.mjs")) && appCheck === 0 && classA === 0) {
+    // In snapshot mode RightKit's own scripts are the snapshot's (the commit's code), never the live checkout's.
+    const selfRoot = snapshotDir ?? root;
+    const rightkitRepository = root && (() => {
+      try { return JSON.parse(o.readFile(path.join(selfRoot, "packages", "release", "package.json"))).name === "@rightkit/release"; }
+      catch { return false; }
+    })();
+    if (rightkitRepository && (!o.exists(path.join(selfRoot, "scripts", "preflight.mjs")) || !o.exists(path.join(selfRoot, "scripts", "ci", "exports-import-effects.mjs")))) {
+      o.err("rightkit-gate: BLOCKED: RightKit's preflight or exports check is missing");
+      selfRules = 1;
+    }
+    if (root && selfRules === 0 && snapshotDir && rightkitRepository && appCheck === 0 && classA === 0) {
+      // The commit's own preflight reads the commit from the checkout's object database; its exports probe imports from the snapshot,
+      // whose dependencies class A installed, and reports beside (never over) the commit-bound report publication reads.
+      const launch = o.spawnInherit ?? ((cmd, a, opts) => spawnInherit(cmd, a, { ...opts, stdio: "inherit" }));
+      const r = launch(process.execPath, [path.join(snapshotDir, "scripts", "preflight.mjs"), "--repo", root, "--commit", snapshotCommit.commit], { cwd: root, env: o.env });
+      selfRules = r.status === 0 ? 0 : 1;
+      const effects = path.join(snapshotDir, "scripts", "ci", "exports-import-effects.mjs");
+      if (selfRules === 0 && o.exists(effects)) {
+        const common = o.spawn("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd: root });
+        const report = path.join(failed(common) ? path.join(root, ".git") : text(common).trim(), "rightkit-gate", "import-effects", `snapshot-${snapshotCommit.commit}.json`);
+        const e = launch(process.execPath, [effects, "--root", snapshotDir, "--no-export", "--report", report], { cwd: snapshotDir, env: o.env });
+        if (e.status !== 0) selfRules = 1;
+      }
+    } else if (root && selfRules === 0 && !snapshotDir && (rightkitRepository || canon(self).startsWith(canon(root) + path.sep)) && o.exists(path.join(root, "scripts", "preflight.mjs")) && appCheck === 0 && classA === 0) {
       const launch = o.spawnInherit ?? ((cmd, a, opts) => spawnInherit(cmd, a, { ...opts, stdio: "inherit" }));
       const selector = args.includes("--worktree") ? ["--worktree"] : ["--commit", option("--commit") ?? "HEAD"];
       const r = launch(process.execPath, [path.join(root, "scripts", "preflight.mjs"), "--repo", root, ...selector], { cwd: root, env: o.env });
@@ -1381,15 +1855,15 @@ export async function main(argv, io = {}) {
         if (requested !== null && at(requested) !== at("HEAD")) {
           o.err(`rightkit-gate: BLOCKED: the exports import check probes the checkout's HEAD (${String(at("HEAD")).slice(0, 12)}), not the requested ${requested}; check out that commit to check it`);
           selfRules = 1;
-        } else if (requested === null && dirty()) {
-          o.err("rightkit-gate: BLOCKED: the exports import check probes the checkout's HEAD, and the working tree differs from it; commit or stash the changes, or check --commit HEAD");
-          selfRules = 1;
         } else {
+          // A working-tree check of a dirty checkout probes the working tree's own bytes (--worktree: staged into a throwaway index
+          // and exported like a commit), never HEAD's, so local development is checked on what it actually is.
+          const worktreeProbe = requested === null && dirty();
           // Like CI's scans job: exports that resolve to build output are INCOMPLETE here and handed, through --report, to the
           // sealed-byte check that publication runs; without --report the probe exits 3 and a green tree could never pass.
           const common = o.spawn("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd: root });
           const report = path.join(failed(common) ? path.join(root, ".git") : text(common).trim(), "rightkit-gate", "import-effects", "report.json");
-          const e = launch(process.execPath, [effects, "--report", report], { cwd: root, env: o.env });
+          const e = launch(process.execPath, [effects, "--report", report, ...(worktreeProbe ? ["--worktree"] : [])], { cwd: root, env: o.env });
           if (e.status !== 0) selfRules = 1;
         }
       }
@@ -1406,9 +1880,37 @@ export async function main(argv, io = {}) {
       if (!judged.inputs.length && !judged.findings.length) o.out("rightkit-gate: no declared compile inputs in the captured tree");
       inputs = judged.findings.length ? 1 : 0;
     }
+    if (snapshotDir) {
+      try { sc.verifySnapshotDir({ checkout: snapshotCheckout, dir: snapshotDir, ...snapshotCommit, when: "after the check" }); }
+      catch (e) { o.err(`rightkit-gate: ${sc.CHECK_ERROR}: ${e.message}; the result covers no known bytes`); return 2; }
+      o.out(`rightkit-gate: snapshot ${snapshotDir} is still tree ${snapshotCommit.tree} after the check`);
+    }
     return Math.max(appCheck, classA, selfRules, inputs);
   }
   const classAOnly = args.includes("--class-a");
+  // --full-a: every class A check, the ones that execute the repository's code (tests, typecheck, lint, generated docs) included,
+  // on the live working tree, before anything compiles. The door's dev/compile stages require it: a content-only check never
+  // authorizes a build (Adrian: class A is everything mechanical and deterministic; reviewer audit 2026-10-28).
+  const fullA = classAOnly && args.includes("--full-a");
+  // Full class A of a gate-owned snapshot (`check --snapshot`, which verified it): the snapshot is the commit's bytes, so neither the
+  // checkout's HEAD nor its cleanliness matters, and the repository's code runs in the snapshot, never in the checkout.
+  const snapshotA = classAOnly ? (option("--snapshot") ?? null) : null;
+  // The door's compile of a selected commit (`--all --commit <sha> --snapshot <dir>`, joint plan step 4c): every scan, class B's
+  // compiles included, reads the verified gate-owned snapshot, never the checkout; outputs go to the checkout's own target
+  // directory. A direct host only, until the broker's snapshot carrier lands (step 4d).
+  const snapshotB = !classAOnly && args.includes("--all") ? (option("--snapshot") ?? null) : null;
+  if (snapshotB && !option("--commit")) { o.err(`${tag} --all --snapshot <dir> needs --commit <sha>`); return 2; }
+  if (fullA && !args.includes("--worktree") && !snapshotA) {
+    // A commit is checked in full only where its bytes are the live checkout: it is HEAD and nothing tracked or untracked differs
+    // (the unit and app stages already refuse a dirty tree). Then the working tree is that commit, and the checks run there.
+    const at = (...a) => o.spawn("git", a, { cwd: o.cwd });
+    const want = at("rev-parse", "--verify", `${option("--commit") ?? "HEAD"}^{commit}`), head = at("rev-parse", "--verify", "HEAD^{commit}");
+    const dirty = at("status", "--porcelain", "--untracked-files=all");
+    if (failed(want) || failed(head) || text(want).trim() !== text(head).trim()) { o.err("rightkit-gate: --full-a checks a commit only when it is HEAD of this checkout: the repository's checks run on the live tree"); return 2; }
+    if (failed(dirty) || text(dirty).trim()) { o.err("rightkit-gate: --full-a on a commit needs a clean checkout (the live tree must be exactly that commit); commit or remove the changes"); return 2; }
+    const i = args.indexOf("--commit"); if (i >= 0) args.splice(i, 2);
+    args.push("--worktree");
+  }
   const classACommit = classAOnly && !args.includes("--worktree") ? (option("--commit") ?? "HEAD") : null;
   if (args.includes("--base") && (!option("--base") || option("--base").startsWith("--"))) { o.err("rightkit-gate: --base needs a ref"); return 2; }
 
@@ -1417,6 +1919,59 @@ export async function main(argv, io = {}) {
   const root = path.resolve(text(top).trim());
   const git = (...a) => o.spawn("git", a, { cwd: root });
   if (sub === "install-hook") return await installHook(o, root, args.includes("--force"));
+  // `env-digest`: only the environment identity a full class A verdict depends on (classAEnvironmentDigest), no scans. The broker
+  // recomputes it when a queued compile starts and re-runs the check if it changed since the verdict.
+  if (sub === "env-digest") {
+    // `env-digest --snapshot <dir> --commit <sha>`: the same identity over a verified snapshot (the broker's START recheck of a
+    // snapshot-aware verdict): the commit's files, the snapshot's installed dependencies.
+    if (args.includes("--snapshot")) {
+      const sc = await import("../snapshot-check.mjs");
+      try {
+        const dir = option("--snapshot"); const rev = option("--commit");
+        if (!dir || !path.isAbsolute(dir) || !rev || rev.startsWith("--")) throw new sc.CheckError("env-digest --snapshot needs an absolute directory and --commit <sha>");
+        const checkout = fs.realpathSync.native(root);
+        const { commit, tree } = sc.commitOf(checkout, rev, o.spawn);
+        const real = fs.realpathSync.native(dir);
+        sc.verifySnapshotDir({ checkout, dir: real, commit, tree, when: "for env-digest" });
+        o.out(`env=${classAEnvironmentDigest({ root: real, files: sc.commitFiles(checkout, commit, o.spawn).files, spawn: o.spawn })}`);
+        return 0;
+      } catch (e) { o.err(`rightkit-gate: ${e.code === sc.CHECK_ERROR ? `${sc.CHECK_ERROR}: ` : "env-digest: "}${e.message}`); return 2; }
+    }
+    const listed = git("ls-files", "-z", "--cached", "--others", "--exclude-standard");
+    if (failed(listed)) { o.err(`rightkit-gate: env-digest cannot list the working tree: ${why(listed)}`); return 2; }
+    try { const files = text(listed).split("\0").filter(Boolean).map(posix); o.out(`env=${classAEnvironmentDigest({ root, files, spawn: o.spawn })}`); }
+    catch (error) { o.err(`rightkit-gate: env-digest: ${error.message}`); return 2; }
+    return 0;
+  }
+  if (args.includes("--plan") && option("--to") !== undefined) { o.err("rightkit-gate: --plan plans the class A scans and runs nothing; it takes no --to stage (Astra, second pass)"); return 2; }
+  // `--unit` is a gate flag only before a `--` separator: after it the arguments belong to right-release (an app's `--to dev -- …`).
+  const separator = args.indexOf("--");
+  const unitFlag = args.includes("--unit") && (separator < 0 || args.indexOf("--unit") < separator);
+  if (option("--to") !== undefined && unitFlag) {
+    const selector = option("--unit");
+    const validArgs = args.length % 2 === 0 && args.every((a, i) => i % 2 ? !a.startsWith("--") : ["--to", "--unit", "--receipt-out"].includes(a)) && ["--to", "--unit", "--receipt-out"].every((flag) => args.filter((a) => a === flag).length <= 1);
+    if (!validArgs || !selector) {
+      o.err("rightkit-gate: unit stages take only --to, --unit and optional --receipt-out"); return 2;
+    }
+    const head = git("rev-parse", "HEAD"), treeResult = git("rev-parse", "HEAD^{tree}"), common = git("rev-parse", "--git-common-dir"), dirty = git("status", "--porcelain", "--untracked-files=no");
+    const commit = text(head).trim(), tree = text(treeResult).trim();
+    if (failed(head) || failed(treeResult) || failed(common) || !text(common).trim() || !/^[0-9a-f]{40}$/.test(commit) || !/^[0-9a-f]{40}$/.test(tree) || failed(dirty) || text(dirty).trim()) { o.err("rightkit-gate: BLOCKED: unit stages need clean committed HEAD and tree"); return 1; }
+    const match = /^(?:npm:@rightkit\/([a-z0-9-]+)|cargo:(rightkit-[a-z0-9-]+))$/.exec(selector);
+    const manifest = match && (match[1] ? `packages/${match[1]}/package.json` : `crates/${match[2]}/Cargo.toml`);
+    if (!manifest || failed(git("ls-files", "--error-unmatch", "--", ".rightkit-local-build.json", manifest))) { o.err("rightkit-gate: BLOCKED: unit and local grant must be tracked canonical files"); return 1; }
+    const which = (cmd) => { const r = o.spawn(o.platform === "win32" ? "where" : "which", [cmd]); return failed(r) ? [] : text(r).split(/\r?\n/).map((l) => l.trim()).filter(Boolean); };
+    const executor = (o.resolveExecutor ?? resolveExecutor)({ env: o.env, platform: o.platform, exists: o.exists, which, readFile: o.readFile }); applyExecutorEnv(o, executor);
+    if (executor.kind === "refuse") { o.err(`rightkit-gate: BLOCKED: ${executor.problem}`); return 1; }
+    const reportOut = option("--receipt-out");
+    // Loaded here, not at the top: the unit path reads Cargo manifests (smol-toml), which an installed copy of this package without
+    // node_modules does not carry; the app paths of this gate must keep loading there (app-check.test: the installed copy).
+    const { runUnitGate } = await import("../unit-gate.mjs");
+    return await runUnitGate({ selector, to: option("--to"), root, commonDir: path.resolve(root, text(common).trim()), commit, tree, executor, env: o.env, platform: o.platform,
+      check: (tier) => main(["check", "--commit", "HEAD", "--full-a", "--rule-tier", tier], { ...io, cwd: root }), out: o.out, err: o.err,
+      ...(reportOut ? { writeReport: (report) => o.writeFile(path.resolve(o.cwd, reportOut), `${JSON.stringify(report, null, 2)}\n`) } : {}),
+    });
+  }
+  if (unitFlag) { o.err("rightkit-gate: --unit requires --to"); return 2; }
   if (option("--to") !== undefined) return await runStages(o, args, root, git, io);
   if (sub === "stage") return stageForPublisher(o, args, root, git);
 
@@ -1429,13 +1984,18 @@ export async function main(argv, io = {}) {
   // (git hands the local field over verbatim, so a rev expression such as `HEAD@{1 minute ago}` or `HEAD^{/one thing}` holds spaces)
   // refuses the push on every host and in every repository, never a line that disappears: its pushed commit could not be compared with
   // HEAD and its remote ref could not be judged. `pushedRemoteShas` are the remote commits being replaced.
+  // A push of ref deletions alone carries no content: nothing to check, nothing to plan (the hook skips its check the same way).
+  let deletionsOnly = false;
   if (!planOnly && !classAOnly) {
     const head = text(git("rev-parse", "HEAD")).trim();
     const parsed = parsePushLines(o.readStdin());
+    // Every line is read before any shortcut: a malformed line hides what is pushed, so it blocks even beside deletions (Astra, third pass).
     if (parsed.malformed.length) {
       o.err(`${tag} BLOCKED: pre-push stdin line ${parsed.malformed[0].number} is not "<local ref> <local sha> <remote ref> <remote sha>" (four fields separated by single spaces), so the pushed refs cannot all be read and the pushed commit cannot be compared with HEAD; push a plain ref (git push <remote> HEAD:<branch>)`);
       return 1;
     }
+    deletionsOnly = parsed.lines.length > 0 && parsed.lines.every((l) => ZERO.test(l.localSha));
+    if (deletionsOnly) { o.out(`${tag} only deletions are pushed; nothing to check, nothing planned`); return 0; }
     for (const { localSha, remoteRef, remoteSha } of parsed.lines) {
       if (ZERO.test(localSha)) continue; // a delete pushes no content
       if (localSha !== head) {
@@ -1450,21 +2010,53 @@ export async function main(argv, io = {}) {
   // The executor is chosen here, never by the caller (Adrian, 2026-10-25): the RustRight broker where this machine has it, a refusal
   // on a broker-managed machine whose broker cannot be reached, direct cargo on any other host (a cloud container, a CI runner).
   const which = (cmd) => { const r = o.spawn(o.platform === "win32" ? "where" : "which", [cmd]); return failed(r) ? [] : text(r).split(/\r?\n/).map((l) => l.trim()).filter(Boolean); };
-  const executor = (o.resolveExecutor ?? resolveExecutor)({ env: o.env, platform: o.platform, exists: o.exists, which, readFile: o.readFile });
-  if (executor.kind === "refuse") { o.err(`${tag} BLOCKED: ${executor.problem}`); return 1; }
-  const cargoCommand = executor.cargo;
+  const executor = (o.resolveExecutor ?? resolveExecutor)({ env: o.env, platform: o.platform, exists: o.exists, which, readFile: o.readFile }); applyExecutorEnv(o, executor);
+  // A broker-managed host whose broker is unreachable refuses the moment a Cargo manifest is in the snapshot (below): a repository
+  // with no Rust owes nothing to the broker (a git hook's minimal PATH, a JS-only app), and the class A scans never compile.
+  const cargoCommand = executor.cargo ?? ["cargo"];
+  if (snapshotB && executor.kind !== "direct") { o.err(`${tag} BLOCKED: a ${executor.kind} host compiles a commit snapshot only through the RustRight snapshot carrier (joint plan step 4d), which is not wired yet; nothing ran`); return 1; }
   // The snapshot: the commit or tree being checked (check --commit), HEAD for the gate, or the working tree (check --worktree, --plan).
   const allFilesMode = classAOnly || args.includes("--all");
-  const snapshot = planOnly ? null : classAOnly ? classACommit : "HEAD";
+  const snapshot = planOnly ? null : classAOnly ? classACommit : snapshotB ? option("--commit") : "HEAD";
+  // Every effectful gate entry owes the app rules, not only `check` (Astra, 2026-10-26): a bare, --all or pre-push run on HEAD runs them
+  // first, in the tier asked for (compile by default), and plans nothing while they are red. --plan and --class-a (which runs them in
+  // `check`) are untouched.
+  if (snapshot && !classAOnly) {
+    const appRules = await (o.appCheck ?? (await import("../app-check.mjs")).main)(["--repo", root, "--commit", snapshot, "--rule-tier", option("--rule-tier") ?? "compile"], { out: o.out, err: o.err, label: "check", cwd: o.cwd });
+    if (appRules !== 0) { const id = git("rev-parse", String(snapshot)); o.err(`${tag} BLOCKED: the app rules are red for ${(failed(id) ? String(snapshot) : text(id).trim()).slice(0, 12)}; no scan was planned or run`); return appRules; }
+  }
 
   const ac = o.abort ?? new AbortController();
   let exportRoot = null;
-  const cleanup = () => { if (exportRoot) fs.rmSync(exportRoot, { recursive: true, force: true }); };
+  let snapshotGitConfig = null;
+  let cargoShimDir = null;
+  const cleanup = () => {
+    if (exportRoot) fs.rmSync(exportRoot, { recursive: true, force: true });
+    if (cargoShimDir) fs.rmSync(cargoShimDir, { recursive: true, force: true });
+    if (snapshotGitConfig) { fs.rmSync(snapshotGitConfig, { force: true }); try { fs.rmdirSync(path.dirname(snapshotGitConfig)); } catch { /* not empty: leave it, the next exact sync prunes it */ } }
+  };
   const signals = [];
   try {
     let repo = root;
-    if (snapshot) {
-      exportRoot = fs.mkdtempSync(path.join(o.env.RK_GATE_TMPDIR || os.tmpdir(), "rk-gate-"));
+    let snapshotBCommit = null;
+    if (snapshot && snapshotB) {
+      // Direct host: no broker grant to satisfy, so no config-only .git; the snapshot is scanned and compiled in place.
+      repo = snapshotB;
+    } else if (snapshot && snapshotA) {
+      // The verified gate-owned snapshot is the commit's bytes: it is scanned in place, no export.
+      repo = snapshotA;
+      // As for an export (rightkit#1215): rustright binds the tracked .rightkit-local-build.json grant to the origin URL in .git/config,
+      // so a locked cargo metadata in the snapshot needs a config-only .git naming exactly the checkout's origin. It is not a
+      // repository (no HEAD, no objects), the seeded identity never reads .git, and it is removed when the check ends.
+      const origin = o.spawn("git", ["config", "--get", "remote.origin.url"], { cwd: root });
+      const originUrl = failed(origin) ? "" : text(origin).trim();
+      if (originUrl && !o.exists(path.join(repo, ".git"))) {
+        o.mkdir(path.join(repo, ".git"), { recursive: true });
+        snapshotGitConfig = path.join(repo, ".git", "config");
+        o.writeFile(snapshotGitConfig, `[remote "origin"]\n\turl = ${originUrl}\n`);
+      }
+    } else if (snapshot) {
+      exportRoot = fs.mkdtempSync(path.join(exportTmpRoot({ env: o.env, platform: o.platform, exists: o.exists }), "rk-gate-"));
       repo = path.join(exportRoot, "repo");
       // Every file of the commit or tree: read-tree into a private index, then checkout-index. `git archive` would leave out files
       // marked export-ignore in .gitattributes, so they would never be scanned; this export has no such exclusion.
@@ -1476,6 +2068,16 @@ export async function main(argv, io = {}) {
       fs.mkdirSync(repo, { recursive: true });
       const x = failed(made) ? made : o.spawn("git", ["checkout-index", "--all", "--force", `--prefix=${repo.split(path.sep).join("/")}/`], { cwd: root, env: indexEnv });
       if (failed(made) || failed(x)) { o.err(`${tag} cannot export ${snapshot}: ${why(made) || why(x)}`); return 2; }
+      // rustright binds the tracked .rightkit-local-build.json grant to the origin URL in .git/config (rustright-policy local_build.rs),
+      // and the export has no .git, so cargo metadata in it was refused on every broker host and no push passed the hook (rightkit#1215).
+      // A config-only .git carries exactly the source checkout's origin and is not a repository to git (no HEAD, no objects), so nothing
+      // can run git against the export. No origin (a checkout without a remote): nothing is written and rustright decides as before.
+      const origin = o.spawn("git", ["config", "--get", "remote.origin.url"], { cwd: root });
+      const originUrl = failed(origin) ? "" : text(origin).trim();
+      if (originUrl) {
+        o.mkdir(path.join(repo, ".git"), { recursive: true });
+        o.writeFile(path.join(repo, ".git", "config"), `[remote "origin"]\n\turl = ${originUrl}\n`);
+      }
     }
     // Every file of the snapshot, once: units, manifests, lockfiles and the changed set are all read from what is scanned, never from
     // the live checkout (a live edit cannot change what gets planned).
@@ -1488,6 +2090,7 @@ export async function main(argv, io = {}) {
     let rust; let npm; let npmRoots = []; let manifests = [];
     try {
       manifests = tracked("Cargo.toml");
+      if (executor.kind === "refuse" && manifests.length) { o.err(`${tag} BLOCKED: ${executor.problem}`); return 1; }
       // ci/gate.config.json `fixtures` (optional): directories whose manifests are consumer or sample crates, gated through the
       // consumer rows of the crates they exercise (CI treats them the same), never as units.
       let fixtures = [];
@@ -1504,14 +2107,59 @@ export async function main(argv, io = {}) {
     } catch (e) { o.err(`${tag} BLOCKED: cannot discover the repository's units: ${e.message}`); return 1; }
     for (const k of rust.skipped) o.out(`${tag} note: ${k.manifest} is skipped, not scanned: ${k.why}`);
 
+    // The snapshot compile: verified as the commit's tree before anything runs, dependencies installed into it offline from the
+    // checkout's store, and every Cargo workspace's output pinned to the target directory cargo resolves for it IN THE CHECKOUT
+    // (CARGO_TARGET_DIR or build.target-dir honoured), so the warm outputs are the checkout's and the snapshot holds no target/.
+    let targetDirs = null; let cargoShim = null;
+    if (snapshotB) {
+      const sc = await import("../snapshot-check.mjs");
+      try {
+        const checkout = fs.realpathSync.native(root);
+        snapshotBCommit = sc.commitOf(checkout, String(snapshot), o.spawn);
+        sc.verifySnapshotDir({ checkout, dir: snapshotB, ...snapshotBCommit, when: "before the compile" });
+        o.out(`${tag} snapshot ${snapshotB} is commit ${snapshotBCommit.commit} tree ${snapshotBCommit.tree} (verified before the compile)`);
+        for (const r of sc.installSnapshotDependencies({ checkout, snapshot: snapshotB, roots: npmRoots, env: o.env, spawn: o.spawn })) o.out(`${tag} ${sc.describeInstall(r)}`);
+      } catch (error) { o.err(`${tag} ${error.code === "RK_CHECK_ERROR" ? "RK_CHECK_ERROR" : "BLOCKED"}: ${error.message}`); return error.code === "RK_CHECK_ERROR" ? 2 : 1; }
+      targetDirs = {};
+      for (const ws of rust.workspaces) {
+        const manifest = path.join(root, ws.cargoDir, "Cargo.toml");
+        if (!o.exists(manifest)) { o.err(`${tag} BLOCKED: the checkout has no ${posix(path.relative(root, manifest))}, so the output directory of workspace ${ws.cargoDir} cannot be resolved; nothing compiled`); return 1; }
+        const r = o.spawn(cargoCommand[0], [...cargoCommand.slice(1), "metadata", "--offline", "--format-version", "1", "--no-deps", "--manifest-path", manifest], { cwd: path.dirname(manifest), env: o.env });
+        let dir = null;
+        try { dir = failed(r) ? null : JSON.parse(text(r)).target_directory; } catch { dir = null; }
+        if (typeof dir !== "string" || !path.isAbsolute(dir)) { o.err(`${tag} BLOCKED: cargo metadata in the checkout reported no absolute target_directory for ${ws.cargoDir}${failed(r) ? ` (${why(r)})` : ""}; nothing compiled`); return 1; }
+        targetDirs[ws.cargoDir] = path.resolve(dir);
+        o.out(`${tag} output directory for workspace ${ws.cargoDir}: ${targetDirs[ws.cargoDir]} (the checkout's)`);
+      }
+      // CARGO_HOME, sccache & temp are inherited as absolute values, never snapshot-relative (GATE-CONTRACT "Output directory & cache"):
+      // a relative one would be resolved inside the snapshot, a second cache or output location. Refused before anything compiles.
+      const relativeEnv = SNAPSHOT_ABSOLUTE_ENV.filter((name) => typeof o.env[name] === "string" && o.env[name] !== "" && !path.isAbsolute(o.env[name]));
+      if (relativeEnv.length) { o.err(`${tag} BLOCKED: ${relativeEnv.map((n) => `${n}=${o.env[n]}`).join(", ")} ${relativeEnv.length > 1 ? "are" : "is"} relative; a snapshot compile inherits CARGO_HOME, sccache and temp only as absolute paths, never resolved inside the snapshot; nothing compiled`); return 1; }
+      // The runtime cargo wrapper (item 7): first on PATH and named in CARGO for every scan, it binds each real cargo invocation to its
+      // own workspace's checkout target directory or refuses it (RK_CARGO_*), whatever path reaches cargo. Direct POSIX hosts only (a
+      // broker host never reaches here; a direct Windows host keeps the fail-closed static walk). Removed when the gate ends (cleanup).
+      if (o.platform !== "win32" && rust.workspaces.length) {
+        const realCargo = which("cargo").find((c) => path.isAbsolute(c));
+        if (!realCargo) { o.err(`${tag} BLOCKED: no cargo on PATH to wrap for the snapshot compile; nothing compiled`); return 1; }
+        try {
+          const shimModule = await import("../cargo-target-shim.mjs");
+          cargoShim = shimModule.installCargoShim({ base: os.tmpdir(), snapshotRoot: snapshotB, targetDirs, realCargo, platform: o.platform, onDir: (dir) => { cargoShimDir = dir; } });
+          cargoShim.scanEnv = shimModule.shimScanEnv(o.env, cargoShim);
+        } catch (error) { o.err(`${tag} BLOCKED: the runtime cargo wrapper cannot be installed (${error.message}); nothing compiled`); return 1; }
+        o.out(`${tag} runtime cargo wrapper ${cargoShim.shim} (identity ${cargoShim.identity.slice(0, 16)}) -> ${realCargo}: each cargo invocation binds its workspace's checkout target directory or is refused`);
+      }
+    }
+
     // Class B scans (compile, lint, tests) run in the live checkout, so it must equal HEAD where they read it: an uncommitted fix could
     // otherwise hide a committed failure. Class A reads only the snapshot.
-    if (!planOnly && !classAOnly) {
+    if (!planOnly && !classAOnly && !snapshotB) {
       const npmRootFiles = ["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml", ".npmrc", ...ESLINT_CONFIG_FILES, ...BIOME_CONFIG_FILES];
       const inputs = [...new Set([...rust.units.map((u) => u.dir), ...npm.map((u) => u.dir), ...rust.workspaces.map((w) => w.cargoDir), "ci", "scripts", "vendor", "Cargo.toml", "Cargo.lock", ".cargo", "rust-toolchain.toml", "rust-toolchain",
         "deny.toml", "clippy.toml", "rustfmt.toml", ...npmRootFiles, ...npmRoots.filter((r) => r !== ".").flatMap((r) => npmRootFiles.map((f) => `${r}/${f}`))])];
-      const dirty = git("status", "--porcelain", "--untracked-files=all", "--", ...inputs);
-      const dirtyFiles = failed(dirty) ? [`git status failed: ${why(dirty)}`] : text(dirty).split(/\r?\n/).filter(Boolean).filter((l) => !l.includes("node_modules"));
+      // Batched like cargoInputsDiffer: one argv with every input path overflows Windows' command line in a large repository.
+      const dirtyRuns = pathspecBatches(inputs).map((batch) => git("status", "--porcelain", "--untracked-files=all", "--", ...batch));
+      const dirtyFailed = dirtyRuns.find((r) => failed(r));
+      const dirtyFiles = dirtyFailed ? [`git status failed: ${why(dirtyFailed)}`] : dirtyRuns.flatMap((r) => text(r).split(/\r?\n/)).filter(Boolean).filter((l) => !l.includes("node_modules"));
       if (dirtyFiles.length) {
         o.err(`${tag} BLOCKED: the checkout differs from HEAD where compile scans read it; commit or stash first:`);
         for (const l of dirtyFiles.slice(0, 20)) o.err(`  ${l}`);
@@ -1545,18 +2193,60 @@ export async function main(argv, io = {}) {
     }
     const rustScope = restricted ? scopeNames : null;
 
-    const fullPlan = planScans({
+    // A broker host: rustright refuses every cargo command but a locked metadata outside the app's primary checkout
+    // (RK_NOT_PRIMARY_CHECKOUT), so class A's cargo scans cannot read the export there. They run in the primary checkout, allowed only
+    // when every Cargo input in it is blob-identical to the snapshot's; a live edit to a manifest, lock, deny.toml or .cargo/ refuses
+    // the check with the paths named. A direct host (cloud, CI) keeps reading the export. (rightkit#1215, third cause)
+    let cargoLiveRoot = null;
+    if (classAOnly && snapshot && executor.kind === "broker" && manifests.length) {
+      const differing = cargoInputsDiffer({ root, snapshot, manifests, spawn: (c, a, opts) => o.spawn(c, a, opts) });
+      if (differing.length) {
+        const resolved = git("rev-parse", "--verify", String(snapshot));
+        o.err(`${tag} BLOCKED: the broker scans Cargo inputs in the primary checkout, and these differ from ${(failed(resolved) ? String(snapshot) : text(resolved).trim()).slice(0, 12)}: ${differing.join(", ")}; commit or restore them, then run the check again`);
+        return 1;
+      }
+      // A snapshot check's cargo scans then read the checkout's WORKSPACE, which can hold more than its tracked inputs: an untracked
+      // member, or a stray directory a members glob (crates/*) matches. Cargo's own member list there must equal the commit's (from
+      // the snapshot), or the verdict would not be the commit's (Oracle review of 79c4427b). A checkout cargo cannot read refuses too.
+      if (snapshotA) {
+        const memberDiff = [];
+        const membersOf = (base, dir) => workspaceMetadata({ root: base, spawn: (c, a, opts) => o.spawn(c, a, opts), cargoCommand, dir, realpath: fs.realpathSync }).members.map((m) => m.manifest).sort();
+        for (const ws of rust.workspaces) {
+          let inCommit; let inCheckout;
+          try { inCommit = membersOf(repo, ws.cargoDir); } catch (e) { memberDiff.push(`${ws.cargoDir} (commit): ${e.message}`); continue; }
+          try { inCheckout = membersOf(root, ws.cargoDir); } catch (e) { memberDiff.push(`${ws.cargoDir} (checkout): ${e.message}`); continue; }
+          const extra = inCheckout.filter((m) => !inCommit.includes(m)); const missing = inCommit.filter((m) => !inCheckout.includes(m));
+          if (extra.length || missing.length) memberDiff.push(`${ws.cargoDir}: checkout-only ${extra.join(", ") || "none"}; commit-only ${missing.join(", ") || "none"}`);
+        }
+        if (memberDiff.length) {
+          o.err(`${tag} BLOCKED: the broker scans Cargo in the primary checkout, and cargo's workspace there is not the commit's: ${memberDiff.join("; ")}; remove or commit what differs, then run the check again`);
+          return 1;
+        }
+      }
+      cargoLiveRoot = root;
+    }
+    let fullPlan;
+    fullPlan = planScans({
       // Class A of a commit or tree reads only that snapshot: every scan, cargo's included, runs in the export, never in the live
       // checkout (which may hold other bytes). Compiles (class B) use the live checkout, whose tree the dirty check pinned to HEAD.
-      changed, contentRoot: repo, liveRoot: classAOnly && snapshot ? repo : root, includeTests: true, rustScope, cargoCommand,
+      changed, contentRoot: repo, liveRoot: (classAOnly && snapshot) || snapshotB ? repo : root, trustedRoot: snapshotA ?? snapshotB ?? root, includeTests: true, rustScope, cargoCommand, targetDirs, cargoShim: Boolean(cargoShim),
+      tier: fullA ? "release" : (option("--rule-tier") ?? "compile"), cargoLiveRoot,
       // The quiet tests (port, pipe, desktop and wall-clock bound) are proven by the CI shards, one crate per runner, unless
       // RK_GATE_QUIET_TESTS=local asks for the serial quiet lane here (no CI, or a CI outage).
-      quietTests: o.env.RK_GATE_QUIET_TESTS === "local" ? "local" : "ci", packageFeatures,
+      // Full class A runs every test before a compile: the quiet suites run here in the quiet lane, never left to CI.
+      // The door's snapshot compile already executes the repository's own code (its tests) in the verified snapshot, guarded like
+      // full class A, so the docs generator runs there too instead of being deferred (step 4c review).
+      quietTests: fullA || o.env.RK_GATE_QUIET_TESTS === "local" ? "local" : "ci", packageFeatures, liveExecution: (fullA && (args.includes("--worktree") || Boolean(snapshotA))) || Boolean(snapshotB),
       rustUnits: rust.units, npmUnits: npm, npmRoots, cargoDir: ".", rustLocks, crateFeatures,
       // The broker (or, on a direct host, the gate itself) admits compiles; no separate grant file decides it here.
       localCompile: true,
       exists: o.exists, readFile: o.readFile, platform: o.platform,
     });
+    // A broker-managed host whose broker is unreachable runs no class B scan: npm tests and scripts can compile native code the
+    // snapshot lists no manifest for (Astra, second pass); the class A scans never compile and still run.
+    // Class A tests run code too (Astra, second pass: a test script can compile native code its text does not show), so a host whose
+    // broker is unreachable runs neither; the gate stops rather than skip them.
+    if (executor.kind === "refuse" && fullPlan.scans.some((x) => x.class === "B" || (x.kind === "test" && (!classAOnly || fullA)))) { o.err(`${tag} BLOCKED: ${executor.problem}`); return 1; }
     let plan = args.includes("--pre-push") ? prePushPlan(fullPlan) : fullPlan;
     const jobs = Math.max(1, Number(o.env.RK_GATE_JOBS ?? 4) || 4);
     const testJobs = Math.max(1, Number(o.env.RK_GATE_TEST_JOBS ?? jobs) || jobs);
@@ -1574,7 +2264,7 @@ export async function main(argv, io = {}) {
     for (const n of plan.notes) o.out(`${tag} note: ${n}`);
     o.out(`${tag} executor: ${executor.kind}${executor.kind === "broker" ? ` (${cargoCommand.join(" ")})` : " (no broker on this host: cargo runs directly, through the same gates)"}`);
     const quietCount = plan.scans.filter((s) => s.quiet === true).length;
-    o.out(`${tag} ${plan.scans.length} scan(s) for ${changed.length} changed file(s) vs ${base.slice(0, 12)}; compile scans ${jobs} at a time, tests ${testJobs} at a time${quietCount ? `, ${quietCount} quiet test scan(s) last under the broker's quiet lease` : ""}`);
+    o.out(`${tag} ${plan.scans.length} scan(s) for ${changed.length} changed file(s) vs ${base.slice(0, 12)}; class A scans ${jobs} at a time, class B scans 1 at a time${quietCount ? `, ${quietCount} quiet test scan(s) last under the broker's quiet lease` : ""}`);
     let signalCode = 0;
     for (const sig of ["SIGINT", "SIGTERM"]) {
       const handler = () => {
@@ -1587,9 +2277,82 @@ export async function main(argv, io = {}) {
     }
     // The result cache keys on the gated commit's object ids; the pre-push check above made HEAD the pushed commit.
     let cache = null;
+    // Full class A on the working tree (the door, and broker admission of the live checkout) caches on the LIVE bytes: every
+    // tracked and untracked (not ignored) file is hashed raw, so the door's run and a repeat admission of the same bytes hit the
+    // cache, and any edit misses it.
+    const liveFullA = fullA && args.includes("--worktree");
+    // Full class A of a snapshot binds like the live tree does: its bytes are the commit's (blob ids from the object database), its
+    // environment includes the dependencies installed into it below.
+    const snapFullA = fullA && Boolean(snapshotA);
+    const boundFullA = liveFullA || snapFullA;
+    const liveBase = snapFullA ? snapshotA : root;
+    // The live bytes full class A judges: every tracked and untracked (not ignored) file, hashed raw. Computed whether or not the
+    // cache is used; a failure to compute it blocks (the verdict must name the bytes it covers).
+    const liveTree = () => {
+      const listed = git("ls-files", "-z", "--cached", "--others", "--exclude-standard");
+      if (failed(listed)) throw new Error(`cannot list the working tree: ${why(listed)}`);
+      const files = [...new Set(text(listed).split("\0").filter(Boolean).map(posix))].filter((f) => { try { return fs.statSync(path.join(root, f)).isFile(); } catch { return false; } }).sort();
+      const ids = new Map();
+      for (const batch of pathspecBatches(files, 60000)) {
+        const r = o.spawn("git", ["hash-object", "--no-filters", "--stdin-paths"], { cwd: root, input: `${batch.join("\n")}\n` });
+        if (failed(r)) throw new Error(`git hash-object failed: ${why(r)}`);
+        const out = text(r).split(/\r?\n/).filter(Boolean);
+        if (out.length !== batch.length) throw new Error("git hash-object returned a short list");
+        batch.forEach((f, i) => ids.set(f, out[i]));
+      }
+      const digestOf = (list) => createHash("sha256").update(list.map((f) => `${f}\t${ids.get(f)}\n`).join("")).digest("hex");
+      return { files, ids, digestOf, digest: digestOf(files) };
+    };
+    let live = null;
+    if (liveFullA) {
+      try { live = liveTree(); } catch (error) { o.err(`${tag} BLOCKED: cannot bind full class A to the working tree's bytes (${error.message})`); return 1; }
+    }
+    let snapshotCommitId = null;
+    if (snapFullA) {
+      const sc = await import("../snapshot-check.mjs");
+      try {
+        const checkout = fs.realpathSync.native(root);
+        const ct = sc.commitOf(checkout, String(snapshot), o.spawn);
+        snapshotCommitId = ct;
+        sc.verifySnapshotDir({ checkout, dir: snapshotA, ...ct, when: "before class A" });
+        live = sc.commitFiles(checkout, ct.commit, o.spawn);
+        // Dependencies for the checks that execute repository code: installed into the snapshot from the commit's lockfile and the
+        // primary checkout's existing store (coordinator decision A, rightkit#1257). A store miss stops here, naming the package.
+        const installed = sc.installSnapshotDependencies({ checkout, snapshot: snapshotA, roots: npmRoots, env: o.env, spawn: o.spawn });
+        for (const r of installed) o.out(`${tag} ${sc.describeInstall(r)}`);
+      } catch (error) { o.err(`${tag} ${error.code === "RK_CHECK_ERROR" ? "RK_CHECK_ERROR" : "BLOCKED"}: ${error.message}`); return error.code === "RK_CHECK_ERROR" ? 2 : 1; }
+    }
+    const liveSnapshot = live?.digest ?? null;
+    // The environment, installed dependencies included, is bound at the start and compared at the end, so a dependency that
+    // changes while class A runs voids the verdict.
+    // envStartWithCaches records, for audit, the tool caches as the run found them (what its checks could read); the pass line
+    // carries it next to the env the verdict binds.
+    let envAtStart = null; let envStartWithCaches = null; let cachesAtStart = null;
+    if (boundFullA) {
+      const orphans = orphanedPnpmStores({ root: liveBase, files: live.files });
+      if (orphans.length) { o.err(`${tag} BLOCKED: orphaned nested pnpm store(s) ${orphans.join(", ")}: left by a standalone install in a workspace member; they can hold stale dependencies and make concurrent vitest runs clear their shared module cache under each other. Move them aside (or reinstall) and run again.`); return 1; }
+      try { envAtStart = classAEnvironmentDigest({ root: liveBase, files: live.files, spawn: o.spawn, includeCaches: false }); envStartWithCaches = classAEnvironmentDigest({ root: liveBase, files: live.files, spawn: o.spawn }); cachesAtStart = toolCacheManifest({ root: liveBase, files: live.files }); }
+      catch (error) { o.err(`${tag} BLOCKED: ${error.message}`); return 1; }
+    }
+    if (boundFullA && !args.includes("--no-cache") && o.env.RK_GATE_CACHE !== "0") {
+      try {
+        const common = git("rev-parse", "--git-common-dir");
+        if (failed(common)) throw new Error("no git directory");
+        const { files, ids, digestOf } = live;
+        const under = (dir) => (dir === "." || dir === "" ? files : files.filter((f) => f === dir || f.startsWith(`${dir}/`)));
+        const objectId = (p) => (ids.has(p) ? ids.get(p) : under(p).length ? digestOf(under(p)) : null);
+        const store = fileScanCache(path.join(path.resolve(root, text(common).trim()), "rightkit-gate-cache"));
+        const listFiles = (dir) => under(dir);
+        const readBlob = (p) => fs.readFileSync(path.join(liveBase, p), "utf8");
+        // The verdict also depends on what is not in the tree: the gate's own code and advisory data, the node and pnpm that run
+        // the checks, the installed dependencies (pnpm's install state) and the platform. Any change there is a cache miss.
+        const environment = classAEnvironmentDigest({ root: liveBase, files, spawn: o.spawn });
+        cache = { ...store, digest: `${buildCacheDigest({ objectId, headTree: digestOf(files), rustUnits: rust.units, npmUnits: npm, cargoDir: ".", rustLocks, crateFeatures, listFiles, readBlob })}:${environment}` };
+      } catch { cache = null; }
+    }
     if (!classAOnly && !args.includes("--no-cache") && o.env.RK_GATE_CACHE !== "0") {
       try {
-        const headSha = text(git("rev-parse", "HEAD")).trim();
+        const headSha = snapshotBCommit?.commit ?? text(git("rev-parse", "HEAD")).trim();
         const treeId = text(git("rev-parse", `${headSha}^{tree}`)).trim();
         const common = git("rev-parse", "--git-common-dir");
         if (headSha && treeId && !failed(common) && text(common).trim()) {
@@ -1616,7 +2379,26 @@ export async function main(argv, io = {}) {
     }
     const scanResult = await (o.runScans ?? runScans)(plan, {
       classes: classAOnly ? ["A"] : ["A", "B"], jobs, testJobs, signal: ac.signal, ...(cache ? { cache } : {}),
-      quietLane: quietLeaseLane(o, { tag, reason: `rightkit-gate-quiet-tests@${text(git("rev-parse", "--short", "HEAD")).trim()}` }),
+      // The runtime cargo wrapper is first on PATH and named in CARGO for every scan of a snapshot compile; CARGO (a path named by the
+      // wrapper's identity) is in every scan's cache key, so no result cached without the wrapper or with another map is reused.
+      ...(cargoShim ? { env: cargoShim.scanEnv, ...(cargoShim.sentinel ? { cargoSentinel: cargoShim.sentinel } : {}) } : {}),
+      // `check` (and the broker's compile admission, which runs it on a captured copy of the tree without node_modules) judges the
+      // content: it never executes the repository's own code. The class A checks that do (tests, typecheck, lint, generated docs:
+      // `executes`) run in the full gate (--all, the push hook, the door's compile stage), after the content checks and before any compile.
+      ...(classAOnly && !fullA ? { exclude: (s) => s.executes === true } : {}),
+      // A snapshot check names its commit; it never reads the checkout's HEAD.
+      quietLane: quietLeaseLane(o, { tag, reason: `rightkit-gate-quiet-tests@${snapshotCommitId ? snapshotCommitId.commit.slice(0, 12) : snapshotBCommit ? snapshotBCommit.commit.slice(0, 12) : text(git("rev-parse", "--short", "HEAD")).trim()}` }),
+      // On a broker-managed host the quiet suites need the lease or they are refused (never run unleashed).
+      requireQuietLease: executor.kind === "broker",
+      // Failing scans' complete output: never inside the repository, on the host's scratch root (RIGHTKIT_SCRATCH_ROOT, else the
+      // managed data root's runs/), in a folder unique to this run so evidence is never overwritten.
+      scanLogDir: (() => {
+        try {
+          const base = o.env.RIGHTKIT_SCRATCH_ROOT || path.join(resolveManagedRoots({ env: o.env }).dataRoot, "runs");
+          const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+          return path.join(base, "rightkit-gate-scan-logs", `${path.basename(root)}-${stamp}-${process.pid}`);
+        } catch { return null; }
+      })(),
       onResult: (row, p) => o.out(`${tag} [${p.done}/${p.total}] ${(row.cached ? "cached" : row.status).padEnd(7)} ${row.id} (${p.seconds}s)${row.status === "fail" ? ` :: ${String(row.detail ?? "").slice(0, 300)}` : ""}`),
     });
     if (ac.signal.aborted) {
@@ -1630,14 +2412,98 @@ export async function main(argv, io = {}) {
     const deferrals = scanDeferrals(scanResult);
     for (const line of deferrals) failures.push(`DEFERRED ${line}`);
     for (const note of scanResult.notes) o.out(`${tag} ${note}`);
+    // What a full class A verdict binds, green or red: the bytes it judged, unchanged from start to end, and the environment it judged
+    // in (gate, tools, installed dependencies, tool caches), unchanged too. A verdict whose binding moved covers nothing: a green one is
+    // refused and a red one names no reusable deterministic cause (rightkit#1257). Returns { env, notes } or { prefix, problem, exit }.
+    const judgedBinding = async () => {
+      if (liveFullA) {
+        let digestNow = null;
+        try { digestNow = liveTree().digest; } catch { digestNow = null; }
+        if (digestNow !== liveSnapshot) return { prefix: "BLOCKED", exit: 1, problem: "the working tree changed while class A ran; the verdict does not cover the current bytes. Run again." };
+      }
+      if (snapFullA) {
+        try { (await import("../snapshot-check.mjs")).verifySnapshotDir({ checkout: fs.realpathSync.native(root), dir: snapshotA, ...snapshotCommitId, when: "after class A" }); }
+        catch (error) { return { prefix: "RK_CHECK_ERROR", exit: 2, problem: `${error.message}; the verdict covers no known bytes` }; }
+      }
+      if (!live) return { env: null, notes: [] };
+      let envDigest; let envNoCaches;
+      try { envDigest = classAEnvironmentDigest({ root: liveBase, files: live.files, spawn: o.spawn }); envNoCaches = classAEnvironmentDigest({ root: liveBase, files: live.files, spawn: o.spawn, includeCaches: false }); }
+      catch (error) { return { prefix: "BLOCKED", exit: 1, problem: error.message }; }
+      const notes = [];
+      if (cachesAtStart !== null) {
+        let drift;
+        try { drift = toolCacheDrift(cachesAtStart, toolCacheManifest({ root: liveBase, files: live.files })); } catch (error) { return { prefix: "BLOCKED", exit: 1, problem: error.message }; }
+        if (drift.changed.length) return { prefix: "BLOCKED", exit: 1, problem: `${drift.changed.length} tool cache file(s) that existed when class A started changed or vanished while it ran, so the checks may have read bytes the verdict cannot name: ${drift.changed.slice(0, 5).join(", ")}${drift.changed.length > 5 ? ", …" : ""}. Run again.` };
+        if (drift.added.length) notes.push(`note: ${drift.added.length} tool cache file(s) appeared while class A ran (by it or another process), bound in env as they stand: ${drift.added.slice(0, 5).join(", ")}${drift.added.length > 5 ? ", …" : ""}`);
+      }
+      if (envAtStart !== null && envNoCaches !== envAtStart) return { prefix: "BLOCKED", exit: 1, problem: "the class A environment (gate, tools or installed dependencies) changed while class A ran; the verdict does not cover it. Run again." };
+      return { env: envDigest, notes };
+    };
+    if (snapshotB) {
+      // The compile covers the commit only if the snapshot still is its tree after every scan ran (E6).
+      try { (await import("../snapshot-check.mjs")).verifySnapshotDir({ checkout: fs.realpathSync.native(root), dir: snapshotB, ...snapshotBCommit, when: "after the compile" }); }
+      catch (error) { o.err(`${tag} RK_CHECK_ERROR: ${error.message}; the compile covers no known bytes`); return 2; }
+      o.out(`${tag} snapshot ${snapshotB} is still tree ${snapshotBCommit.tree} after the compile`);
+      // The direct host's own receipt (GATE-CONTRACT "Broker interface": the same field names as the broker's evidence, without the
+      // broker-only ones): this run, the commit, the snapshot's tree at start and exit, the ownership, where the outputs went, the
+      // result and when it was issued. Rebuilt units are the freshness census of joint plan step 6, not measured here.
+      const workspaces = Object.keys(targetDirs ?? {});
+      const directReceipt = {
+        schema: "rightkit.gate-direct-receipt/1", requestId: randomUUID(), executor: "direct", issuedAt: new Date().toISOString(),
+        commit: { sha: snapshotBCommit.commit, tree: snapshotBCommit.tree },
+        snapshot: { path: snapshotB, treeAtStart: snapshotBCommit.tree, treeAtExit: snapshotBCommit.tree },
+        ownership: { handle: o.buildOwnership?.handle ?? null },
+        outputDir: workspaces.length === 1 ? targetDirs[workspaces[0]] : null, outputDirs: { ...(targetDirs ?? {}) },
+        cargoWrapper: cargoShim ? { identity: cargoShim.identity, workspaces: cargoShim.workspaces } : null,
+        exitStatus: failures.length ? 1 : 0, rebuilt: null,
+      };
+      o.onDirectReceipt?.(directReceipt);
+      o.out(`${tag} direct receipt ${JSON.stringify(directReceipt)}`);
+    }
     if (failures.length) {
       o.err(`${tag} BLOCKED (${failures.length})`);
       for (const f of failures) o.err(`  - ${f}`);
+      // A red full class A names its cause when every failure is one a re-run of the same inputs reproduces AND the bytes and
+      // environment it was judged in held from start to end, so the broker may reuse it (rightkit#1257); a live scan, a timeout, a
+      // missing tool, anything undecided, or a binding that moved names none.
+      if (boundFullA) {
+        const binding = await judgedBinding();
+        if (binding.problem) {
+          o.err(`${tag} ${binding.prefix}: ${binding.problem} No deterministic verdict is named.`);
+          if (binding.exit === 2) return 2;
+        } else {
+          for (const n of binding.notes) o.out(`${tag} ${n}`);
+          const marker = (await import("../snapshot-check.mjs")).deterministicMarker(scanResult, binding.env);
+          if (marker) o.out(marker);
+        }
+      }
       o.err(classAOnly ? "Class A is red: nothing compiles until it is green." : "Fix and push again. Never bypass with --no-verify.");
       return 1;
     }
+    if (fullA) {
+      // The verdict is for the bytes that were checked, in the environment that was checked: either moving makes it a verdict for nothing.
+      const binding = await judgedBinding();
+      if (binding.problem) { o.err(`${tag} ${binding.prefix}: ${binding.problem}`); return binding.exit; }
+      for (const n of binding.notes) o.out(`${tag} ${n}`);
+      // The bytes this verdict covers, for the broker to compare with the snapshot it compiles: the tracked files only (what a
+      // captured snapshot holds), and every file including untracked ones. Each is sha256 over sorted "<path>\t<git blob id of the
+      // raw bytes>\n" lines (git hash-object --no-filters), so the broker can recompute it over its snapshot without this gate.
+      if (live) {
+        // A snapshot holds only the commit's files: every one is tracked.
+        const trackedList = snapFullA ? null : git("ls-files", "-z", "--cached");
+        if (trackedList && failed(trackedList)) { o.err(`${tag} BLOCKED: cannot list tracked files to name the checked bytes`); return 1; }
+        const tracked = new Set(snapFullA ? live.files : text(trackedList).split("\0").filter(Boolean).map(posix));
+        o.out(`${tag} class A bytes tracked=${live.digestOf(live.files.filter((f) => tracked.has(f)))} all=${live.digest}${envStartWithCaches ? ` env-at-start=${envStartWithCaches}` : ""} env=${binding.env}`);
+      }
+      o.out(`${tag} class A full pass: ${scanResult.scans.length} deterministic check(s), the ones that execute repository code included, over ${changed.length} file(s) of ${base}`);
+      return 0;
+    }
     if (classAOnly) {
-      o.out(`${tag} class A pass: ${scanResult.scans.length} deterministic scan(s) over ${changed.length} file(s) of ${base}`);
+      // `check` judged the content only: the class A checks that execute the repository's code did not run here, so this is not a
+      // full class A pass, and it says so (reviewer, 2026-10-27). The full gate runs them before any compile.
+      const notRun = plan.scans.filter((s) => s.class === "A" && s.executes === true).map((s) => s.id);
+      if (notRun.length) o.out(`${tag} class A partial: ${notRun.length} check(s) that execute repository code (tests, typecheck, lint, generated docs) run in the full gate, not in check: ${notRun.slice(0, 8).join(", ")}${notRun.length > 8 ? ", …" : ""}`);
+      o.out(`${tag} class A content pass: ${scanResult.scans.length} deterministic scan(s) over ${changed.length} file(s) of ${base}`);
       return 0;
     }
     o.out(`${tag} pass (${changed.length} changed file(s) vs ${base}); ${deferrals.length} scan(s) deferred, not passed${scanResult.cacheHits.length ? `; ${scanResult.cacheHits.length} reused from the result cache` : ""}`);
@@ -1648,9 +2514,17 @@ export async function main(argv, io = {}) {
   }
 }
 
+// The inherited locations a snapshot compile requires as absolute paths (GATE-CONTRACT "Output directory & cache").
+const SNAPSHOT_ABSOLUTE_ENV = ["CARGO_HOME", "RUSTUP_HOME", "SCCACHE_DIR", "TMPDIR", "TMP", "TEMP"];
+
 const invokedDirectly = (() => {
   try { return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return false; }
 })();
+/** This gate's own resolved entry file: the broker admits a compile only when the request names the pinned trusted gate by this
+ * path (rustright reads it from RIGHTKIT_CALLING_GATE; a missing or different path is refused). */
+export const callingGatePath = () => fs.realpathSync(fileURLToPath(import.meta.url));
 if (invokedDirectly) {
+  // Every child this run starts that can reach rustright (scans, unit stages, right-release dev/test, their builds) inherits it.
+  process.env.RIGHTKIT_CALLING_GATE = callingGatePath();
   main(process.argv.slice(2)).then((code) => process.exit(code), (e) => { console.error(`rightkit-gate: ${e?.stack ?? e}`); process.exit(2); });
 }