@smartmemory/compose 0.3.6-beta → 0.3.8

package/lib/judgment-writer.js

@@ -37,14 +37,23 @@
  */
 import {
   readFileSync, writeFileSync, renameSync, unlinkSync,
-  mkdirSync, rmSync, statSync, existsSync, utimesSync,
+  mkdirSync, rmSync, statSync, existsSync, utimesSync, readdirSync,
 } from 'node:fs';
 import { join, dirname } from 'node:path';
 
 import { checkOrInsert } from './idempotency.js';
 import { appendEvent } from './feature-events.js';
-import { createJudgmentStore } from './judgment/store/index.js';
+import {
+  createJudgmentStore,
+  effectiveStore,
+  goalCutoverComplete,
+} from './judgment/store/index.js';
+import { buildSupersessionIndex, tracePosition } from './judgment/trace.js';
+import { syncManifest } from './judgment-attest.js';
 import { regenerateProjections } from './judgment-gen.js';
+import { getJudgmentValidator } from './judgment/schema.js';
+import { ledgerEntryToDecision } from './judgment-decisions.js';
+import { writeJudgmentDecision } from './judgment-decision-write.js';
 import {
   assertValidRecord,
   assertGrounding,
@@ -97,7 +106,15 @@ async function acquireJudgmentLock(cwd) {
   while (true) {
     try {
       mkdirSync(path);
-      writeFileSync(ownerFile, token);
+      try {
+        writeFileSync(ownerFile, token);
+      } catch (err) {
+        // The lock dir exists but carries no owner token: every later release
+        // would decline to remove it (not provably ours), stranding the lock
+        // until the stale window expires. Undo our own partial acquisition.
+        rmSync(path, { recursive: true, force: true });
+        throw err;
+      }
       const heartbeat = setInterval(() => {
         try { utimesSync(path, new Date(), new Date()); } catch { /* lock stolen/gone — release will no-op */ }
       }, LOCK_HEARTBEAT_MS);
@@ -125,6 +142,15 @@ async function acquireJudgmentLock(cwd) {
   }
 }
 
+export async function withJudgmentLock(cwd, fn) {
+  const release = await acquireJudgmentLock(cwd);
+  try {
+    return await fn();
+  } finally {
+    release();
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Provenance + config
 // ---------------------------------------------------------------------------
@@ -141,222 +167,2672 @@ function stampProvenance(internal = {}) {
     session: process.env.CLAUDE_SESSION_ID || null,
     written_at: internal.writtenAt ?? new Date().toISOString(),
   };
-  if (internal.via) provenance.via = internal.via;
-  return provenance;
+  if (internal.via) provenance.via = internal.via;
+  if (internal.intentId) provenance.intent_id = internal.intentId;
+  return provenance;
+}
+
+function guardEnabled(cwd) {
+  try {
+    const config = JSON.parse(readFileSync(join(cwd, '.compose', 'compose.json'), 'utf8'));
+    return config?.capabilities?.guard === true;
+  } catch {
+    return false;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Compensating rollback
+// ---------------------------------------------------------------------------
+
+function atomicWrite(path, content) {
+  const tmp = `${path}.tmp.${process.pid}`;
+  try {
+    writeFileSync(tmp, content);
+    renameSync(tmp, path);
+  } catch (err) {
+    try { unlinkSync(tmp); } catch { /* tmp may not exist */ }
+    throw err;
+  }
+}
+
+class UndoLog {
+  constructor() {
+    this._entries = [];
+    this._paths = new Set();
+  }
+
+  /** Capture a mutable file's exact preimage before its first overwrite. */
+  capture(path) {
+    if (this._paths.has(path)) return;
+    this._paths.add(path);
+    this._entries.push({ path, prior: existsSync(path) ? readFileSync(path, 'utf8') : null });
+  }
+
+  /** Mark a newly created file so compensation removes it. */
+  created(path) {
+    if (this._paths.has(path)) return;
+    this._paths.add(path);
+    this._entries.push({ path, prior: null });
+  }
+
+  touchedPaths() {
+    return [...this._paths];
+  }
+
+  restore() {
+    for (const { path, prior } of [...this._entries].reverse()) {
+      try {
+        if (prior === null) { try { unlinkSync(path); } catch { /* gone */ } } else atomicWrite(path, prior);
+      } catch { /* best-effort compensation */ }
+    }
+  }
+}
+
+/**
+ * Run record mutations + projection regen with compensating rollback: on any
+ * failure the touched records are restored, projections re-regenerated from
+ * the restored records, and JUDGMENT_PARTIAL_WRITE surfaces the cause.
+ */
+function commitWithProjections(cwd, undo, mutate) {
+  try {
+    mutate();
+    regenerateProjections(cwd);
+    syncManifest(cwd, undo.touchedPaths());
+  } catch (err) {
+    undo.restore();
+    try { regenerateProjections(cwd); } catch { /* projections follow restored records on next regen */ }
+    try { syncManifest(cwd, undo.touchedPaths()); } catch { /* manifest follows restored records on next write */ }
+    throw typedError('JUDGMENT_PARTIAL_WRITE', `judgment write rolled back: ${err.message}`, err);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Intent replay (the reconciler)
+// ---------------------------------------------------------------------------
+
+let _intentCounter = 0;
+function newIntentId() {
+  _intentCounter += 1;
+  return `intent-${Date.now()}-${process.pid}-${_intentCounter}`;
+}
+
+async function callGuard(cwd, { slug, from, to }) {
+  // Lazy import: keeps this module leaf-light and cycle-free; the adapter is
+  // only loaded where capabilities.guard is on.
+  const { guardedTransition } = await import('../server/lifecycle-guard.js');
+  return guardedTransition({ featureCode: slug, from, to, workspaceRoot: cwd, mode: 'judgment' });
+}
+
+/** Apply an intent payload idempotently (joint write, deduped events, predictions). */
+function applyPayload(store, payload) {
+  if (payload.joint) store.writeJoint(payload.joint);
+  if (Array.isArray(payload.events) && payload.events.length > 0) {
+    const existing = new Set(store.readLedgerEvents().map((e) => JSON.stringify(e)));
+    for (const event of payload.events) {
+      const serialized = JSON.stringify(event);
+      if (!existing.has(serialized)) {
+        store.appendLedgerEvent(event);
+        existing.add(serialized);
+      }
+    }
+  }
+  for (const prediction of payload.predictions ?? []) {
+    const existing = store.readPrediction(prediction.id);
+    if (existing && JSON.stringify(existing) !== JSON.stringify(prediction)) {
+      throw typedError(
+        'JUDGMENT_CONFLICT',
+        `intent prediction ${prediction.id} conflicts with an existing record`,
+      );
+    }
+    if (!existing) store.writePrediction(prediction);
+  }
+}
+
+/**
+ * Drop an intent DURABLY: the ledger note lands (idempotent on its title,
+ * which embeds the intent id) BEFORE the intent is cleared. If the append
+ * fails the intent survives and the error propagates — a dropped divergence
+ * must never silently vanish.
+ */
+function dropIntentDurably(cwd, store, intent, reason, detail) {
+  const payload = intent.payload ?? {};
+  const title = `intent dropped (${intent.id}): ${payload.slug} ${payload.from} → ${payload.to} — ${reason}`;
+  const already = store.readLedgerEvents().some((e) => e.kind === 'note' && e.title === title);
+  try {
+    if (!already) {
+      store.appendLedgerEvent({
+        kind: 'note',
+        title,
+        body: JSON.stringify(detail),
+        anchor: `joint:${payload.slug}`,
+        provenance: stampProvenance(),
+      });
+    }
+    store.clearIntent(intent.id);
+  } catch (err) {
+    try { syncManifest(cwd, [store._ledgerPath()]); } catch { /* preserve the refusal error */ }
+    throw err;
+  }
+  syncManifest(cwd, [store._ledgerPath(), store._intentPath(intent.id)]);
+}
+
+const RESERVED_INTENT_KINDS = new Set(['package_transition']);
+
+function intentAttributedRecord(record, intentId) {
+  return {
+    ...record,
+    provenance: {
+      ...(record?.provenance ?? stampProvenance()),
+      intent_id: intentId,
+    },
+  };
+}
+
+function attributedTransitionPayload(intent) {
+  const payload = intent.payload ?? {};
+  return {
+    ...payload,
+    events: (payload.events ?? []).map(
+      (event) => intentAttributedRecord(event, intent.id),
+    ),
+    predictions: (payload.predictions ?? []).map(
+      (prediction) => intentAttributedRecord(prediction, intent.id),
+    ),
+  };
+}
+
+/**
+ * The only registered S4 intent applier. Payload shape never selects this
+ * handler; the dispatcher selects it exclusively from `intent.kind`.
+ */
+async function applyTransitionIntent(cwd, store, intent, { undo, unpublishedUndo }) {
+  const payload = attributedTransitionPayload(intent);
+
+  // Population invariant FIRST — before any guard call, so recovery can
+  // never advance the authoritative guard for an intent it is about to drop.
+  if (payload.to === 'under_test') {
+    const occupant = store.listJoints().find(
+      (joint) => joint.slug !== payload.slug && joint.state === 'under_test',
+    );
+    if (occupant) {
+      return {
+        status: 'refused',
+        reason: `ONE-UNDER-TEST refused on replay (${occupant.slug} already under test)`,
+        detail: { occupant: occupant.slug },
+        divergence: {
+          intent: intent.id,
+          slug: payload.slug,
+          refused: true,
+          oneUnderTest: occupant.slug,
+        },
+      };
+    }
+  }
+
+  let guardInfo = null;
+  if (guardEnabled(cwd) && payload.to && payload.from !== payload.to) {
+    const guard = await callGuard(cwd, {
+      slug: payload.slug,
+      from: payload.from,
+      to: payload.to,
+    });
+    if (!guard.applied) {
+      if (guard.error) {
+        return {
+          status: 'blocked',
+          reason: 'guard_unavailable',
+          error: guard.error,
+        };
+      }
+      const alreadyAdvanced = guard.currentState === payload.to;
+      if (!alreadyAdvanced) {
+        if (!guard.refused) {
+          return {
+            status: 'blocked',
+            reason: 'ambiguous_guard_verdict',
+          };
+        }
+        return {
+          status: 'refused',
+          reason: 'refused by guard',
+          detail: {
+            verdict: guard.verdict ?? null,
+            currentState: guard.currentState ?? null,
+          },
+          divergence: {
+            intent: intent.id,
+            slug: payload.slug,
+            refused: true,
+            verdict: guard.verdict ?? null,
+          },
+          guard: {
+            verdict: guard.verdict ?? null,
+            ledgerRef: guard.ledgerRef ?? null,
+            currentState: guard.currentState ?? null,
+          },
+        };
+      }
+    }
+    guardInfo = {
+      verdict: guard.verdict ?? null,
+      ledgerRef: guard.ledgerRef ?? null,
+      currentState: guard.currentState ?? null,
+    };
+  }
+
+  if (payload.joint) {
+    const path = store._jointPath(payload.joint.slug);
+    undo.capture(path);
+    unpublishedUndo.capture(path);
+  }
+  if ((payload.events?.length ?? 0) > 0) undo.capture(store._ledgerPath());
+  for (const prediction of payload.predictions ?? []) {
+    const path = store._predictionPath(prediction.id);
+    if (existsSync(path)) undo.capture(path);
+    else undo.created(path);
+  }
+  applyPayload(store, payload);
+  return { status: 'applied', guard: guardInfo };
+}
+
+// ---------------------------------------------------------------------------
+// COMP-JUDGMENT-GOAL-MIGRATE S1 — objective → goal migration intent
+// ---------------------------------------------------------------------------
+
+// The objective's canonical joints, enumerated in fixed order (design r4 /
+// blueprint C12). NOT parsed from projection markers. `self-report-reliable`
+// is deliberately absent — it has no canonical joint record and is named in
+// the migration note as unmigrated.
+const MIGRATION_JOINT_SLUGS = Object.freeze(['horizon', 'success-criteria', 'commercial-intent']);
+
+const MIGRATION_NOTE_TITLE = 'Legacy objective migrated to goal:v1';
+const MIGRATION_NOTE_ANCHOR = 'position:objective';
+
+function migrationConflict(intent, detail) {
+  return typedError('JUDGMENT_MIGRATION_CONFLICT', `goal migration ${intent.id}: ${detail}`);
+}
+
+/**
+ * Order-insensitive canonical serialization (plain JSON only). Built by direct
+ * string assembly — NEVER by writing keys into an accumulator object, which
+ * would route an own `__proto__` key through the prototype setter and silently
+ * drop it (making two records that differ only in `__proto__` compare equal).
+ */
+function stableStringify(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map(stableStringify).join(',')}]`;
+  }
+  if (value && typeof value === 'object') {
+    const keys = Object.keys(value).sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(',')}}`;
+  }
+  return JSON.stringify(value);
+}
+
+// Parsed records compare by STRUCTURE (blueprint: full parsed equality, not
+// byte identity — only goal/state.json is byte-level). Field reordering of an
+// otherwise-identical record must not read as a conflict; every own key,
+// including `__proto__`, participates.
+function artifactsEqual(a, b) {
+  return stableStringify(a) === stableStringify(b);
+}
+
+/** Exact bytes the store would write for a state record (skip-detection oracle). */
+function serializeStoreRecord(record) {
+  return JSON.stringify(record, null, 2) + '\n';
+}
+
+/**
+ * Highest chain revision present ON DISK by FILENAME (`<prefix><N>.json`),
+ * independent of whether the file parses. Occupancy must not depend on a
+ * forgiving parsed read: a malformed `v1.json` still occupies the slot, and
+ * appending past it would corrupt the chain.
+ */
+function highestChainNumberOnDisk(dir, prefix) {
+  if (!existsSync(dir)) return 0;
+  const fileRe = new RegExp(`^${escapeRegExp(prefix)}([1-9][0-9]*)\\.json$`);
+  return readdirSync(dir)
+    .map((file) => fileRe.exec(file))
+    .filter(Boolean)
+    .reduce((max, match) => Math.max(max, Number(match[1])), 0);
+}
+
+function migrationNoteBody(legacyProjection) {
+  return [
+    'Migrated to `goal:v1`. The legacy `objective` position is retired (tombstoned); goal meaning now lives in the goal store.',
+    '`self-report-reliable` was not migrated because no canonical joint record exists.',
+    'Legacy OBJECTIVE.md follows verbatim:',
+    legacyProjection,
+  ].join('\n\n');
+}
+
+/**
+ * Capture the current goal-state sidecar as a byte+record preimage (C4). The
+ * caller holds the writer lock. Returns null for absence; otherwise
+ * `{ bytes, record }`. The parsed record is schema-validated so a malformed
+ * sidecar surfaces as a migration conflict, not a downstream collapse.
+ */
+function captureGoalStatePreimage(rawStore) {
+  const path = rawStore._goalStatePath();
+  if (!existsSync(path)) return null;
+  const bytes = readFileSync(path, 'utf8');
+  let record;
+  try {
+    record = JSON.parse(bytes);
+  } catch (err) {
+    throw typedError('JUDGMENT_MIGRATION_CONFLICT', `goal migration: goal/state.json is not valid JSON: ${err.message}`);
+  }
+  try {
+    assertValidRecord('goal_state', record);
+    // C4: ambiguous/malformed sidecar IDs (duplicate or non-`gj`/`gl` entries
+    // the schema's array shape would otherwise accept) must fail as a
+    // migration conflict before the intent is persisted — never carried into a
+    // published state where a later removal could address only the first match.
+    allocateStableEntryId(record, 'joints', 'gj');
+    allocateStableEntryId(record, 'load_links', 'gl');
+  } catch (err) {
+    throw typedError('JUDGMENT_MIGRATION_CONFLICT', `goal migration: goal/state.json is not a valid goal_state record: ${err.message}`);
+  }
+  return { bytes, record };
+}
+
+/**
+ * Deterministic merged goal state (blueprint "Exact content mapping"):
+ * preimage active entries preserved (IDs/content/order) but re-stamped with
+ * migration provenance, followed by the fixed joints missing from the active
+ * set, deduped by `link.joint`. New `gj<N>` IDs are allocated above the
+ * high-water mark of ALL preimage joints (including removed ones), then the
+ * removed preimage entries are dropped from the output.
+ */
+function buildMigrationState(preimageRecord, provenance) {
+  const preimageJoints = preimageRecord?.joints ?? [];
+  const preimageLoadLinks = preimageRecord?.load_links ?? [];
+
+  // High-water over ALL preimage joints (incl. removed) so dropped entries
+  // never free an id for reuse.
+  let highWater = 0;
+  for (const link of preimageJoints) {
+    const match = /^gj([1-9][0-9]*)$/.exec(link?.id ?? '');
+    if (match) highWater = Math.max(highWater, Number(match[1]));
+  }
+
+  const activeJoints = preimageJoints
+    .filter((link) => link.removed == null)
+    .map((link) => ({ id: link.id, joint: link.joint, provenance, removed: null }));
+  const presentSlugs = new Set(activeJoints.map((link) => link.joint));
+
+  for (const slug of MIGRATION_JOINT_SLUGS) {
+    if (presentSlugs.has(slug)) continue; // dedupe by joint, not association id
+    highWater += 1;
+    activeJoints.push({ id: `gj${highWater}`, joint: slug, provenance, removed: null });
+    presentSlugs.add(slug);
+  }
+
+  const activeLoadLinks = preimageLoadLinks
+    .filter((link) => link.removed == null)
+    .map((link) => ({
+      id: link.id, clause: link.clause, carries: link.carries, provenance, removed: null,
+    }));
+
+  return { joints: activeJoints, load_links: activeLoadLinks, provenance };
+}
+
+/**
+ * Build the complete `goal_migration` intent from the effective pre-migration
+ * view. Every artifact (goal v1, tombstone, merged state, note) is a FINAL
+ * record carrying migration provenance — not a recipe re-read on replay. The
+ * three canonical joints must resolve before the intent is persisted (C12).
+ */
+function buildGoalMigrationIntent(cwd, rawStore, effective, { intentId, provenance }) {
+  const objective = effective.latestPositionRevision('objective');
+  if (!objective) {
+    throw typedError('JUDGMENT_REF', 'judgment_goal_write migrate: no live objective position to migrate');
+  }
+  const claim = objective.claims?.[0];
+  if (!claim) {
+    throw typedError('JUDGMENT_REF', 'judgment_goal_write migrate: objective r1 has no claim to migrate');
+  }
+
+  for (const slug of MIGRATION_JOINT_SLUGS) {
+    if (!effective.readJoint(slug)) {
+      throw typedError('JUDGMENT_REF', `judgment_goal_write migrate: required joint ${slug} does not resolve`);
+    }
+  }
+
+  // Goal v1 — one clause from the objective's claim; inferred channel (the
+  // live claim is a back-inferred draft, never owner speech); null provocation
+  // and no ratification are legal under via:migration.
+  const goalVersion = {
+    version: 1,
+    clauses: [{
+      id: 'c1',
+      text: claim.text,
+      channel: 'inferred',
+      elicitation: cloneRecord(claim.elicitation),
+      provenance,
+      trace: [],
+    }],
+    provocation: null,
+    diff_note: 'Migrated from legacy objective objective#r1.',
+    provenance,
+  };
+  assertValidRecord('goal_version', goalVersion);
+
+  // Tombstone — the next exact objective revision, empty claims, retracted,
+  // carrying the objective's own conviction.
+  const tombstoneRev = effective.readPositionChain('objective').length + 1;
+  const tombstone = {
+    slug: 'objective',
+    claims: [],
+    conviction: cloneRecord(objective.conviction),
+    retracted: true,
+    provenance,
+    rev: tombstoneRev,
+  };
+  assertValidRecord('position_revision', tombstone);
+
+  // Sidecar preimage + deterministic merged state.
+  const preimage = captureGoalStatePreimage(rawStore);
+  const goalState = buildMigrationState(preimage?.record ?? null, provenance);
+  assertValidRecord('goal_state', goalState);
+  // Re-validate the MERGED ids, not just the preimage: a pathological huge
+  // preimage id (beyond exact float range) can collide with a freshly
+  // allocated fixed-joint id. allocateStableEntryId's string-duplicate check
+  // catches the collision the schema's array shape would otherwise publish.
+  try {
+    allocateStableEntryId(goalState, 'joints', 'gj');
+    allocateStableEntryId(goalState, 'load_links', 'gl');
+  } catch (err) {
+    throw typedError('JUDGMENT_MIGRATION_CONFLICT', `goal migration: merged goal state has ambiguous association ids: ${err.message}`);
+  }
+
+  // Anchored note — carries the legacy projection verbatim.
+  const objectivePath = join(cwd, 'docs', 'judgment', 'OBJECTIVE.md');
+  const legacyProjection = existsSync(objectivePath) ? readFileSync(objectivePath, 'utf8') : '';
+  const note = {
+    kind: 'note',
+    title: MIGRATION_NOTE_TITLE,
+    body: migrationNoteBody(legacyProjection),
+    anchor: MIGRATION_NOTE_ANCHOR,
+    refs: ['objective#r1', 'goal:v1'],
+    provenance,
+  };
+  assertValidRecord('ledger_event', note);
+
+  const intent = {
+    id: intentId,
+    kind: 'goal_migration',
+    tool: 'judgment_goal_write',
+    op: 'migrate',
+    payload: {
+      source: {
+        objective_ref: 'objective#r1',
+        objective: cloneRecord(objective),
+        legacy_projection: legacyProjection,
+      },
+      goal_version: goalVersion,
+      objective_tombstone: tombstone,
+      goal_state_preimage: preimage,
+      goal_state: goalState,
+      note,
+    },
+    created_at: provenance.written_at,
+  };
+  assertValidRecord('pending_intent', intent);
+  return intent;
+}
+
+/**
+ * Apply the migration idempotently. Every occupied target is skipped only on
+ * full equality; any mismatch throws JUDGMENT_MIGRATION_CONFLICT BEFORE the
+ * first mutation, so replay after a mid-migration crash either completes the
+ * remaining artifacts or refuses cleanly. The real applier never returns
+ * `blocked` — that path exists only for the C13 injection seam.
+ */
+async function applyGoalMigrationIntent(cwd, store, intent, { undo, unpublishedUndo }) {
+  const { payload } = intent;
+  const goalPath = join(store._goalDir(), 'v1.json');
+  const tombstoneRev = payload.objective_tombstone.rev;
+  const tombstonePath = join(store._positionDir('objective'), `r${tombstoneRev}.json`);
+  const statePath = store._goalStatePath();
+  const ledgerPath = store._ledgerPath();
+
+  // ── Preflight (no mutation) ──────────────────────────────────────────────
+  // Occupancy is FILENAME-based (a malformed slot still occupies the chain);
+  // an occupied slot skips only when it parses AND structurally equals the
+  // payload AND no later revision exists — anything else conflicts.
+  const goalOnDisk = highestChainNumberOnDisk(store._goalDir(), 'v');
+  let writeGoal = true;
+  if (goalOnDisk > 1) {
+    throw migrationConflict(intent, 'goal/v1.json differs from the persisted payload');
+  }
+  if (goalOnDisk === 1) {
+    const existingGoal = store.readGoalVersion(1);
+    if (!existingGoal || !artifactsEqual(existingGoal, payload.goal_version)) {
+      throw migrationConflict(intent, 'goal/v1.json differs from the persisted payload');
+    }
+    writeGoal = false;
+  }
+
+  const objectiveOnDisk = highestChainNumberOnDisk(store._positionDir('objective'), 'r');
+  let writeTombstone = true;
+  if (objectiveOnDisk > tombstoneRev) {
+    throw migrationConflict(intent, 'objective tombstone differs from the persisted payload');
+  }
+  if (objectiveOnDisk === tombstoneRev) {
+    const existingTombstone = store.readPositionRevision('objective', tombstoneRev);
+    if (!existingTombstone || !artifactsEqual(existingTombstone, payload.objective_tombstone)) {
+      throw migrationConflict(intent, 'objective tombstone differs from the persisted payload');
+    }
+    writeTombstone = false;
+  }
+
+  const expectedStateBytes = serializeStoreRecord(payload.goal_state);
+  const preimageBytes = payload.goal_state_preimage ? payload.goal_state_preimage.bytes : null;
+  const currentStateBytes = existsSync(statePath) ? readFileSync(statePath, 'utf8') : null;
+  let writeState = true;
+  if (currentStateBytes === expectedStateBytes) {
+    writeState = false; // this migration already wrote the merged state
+  } else if (currentStateBytes !== preimageBytes) {
+    throw migrationConflict(intent, 'goal/state.json no longer matches the persisted preimage');
+  }
+
+  // Identify the migration note by (kind:note + this intent_id) ALONE. The
+  // migration writes exactly one such note, so any same-intent note whose body
+  // (incl. title/anchor) differs from the payload is a corrupted artifact and
+  // must conflict — matching on title/anchor too would let a tampered title
+  // masquerade as absence and append a second note.
+  const noteMatches = store.readLedgerEvents().filter((event) => (
+    event.kind === 'note' && event.provenance?.intent_id === intent.id
+  ));
+  let writeNote = true;
+  if (noteMatches.length > 1) {
+    throw migrationConflict(intent, 'anchored migration note differs from the persisted payload');
+  }
+  if (noteMatches.length === 1) {
+    if (!artifactsEqual(noteMatches[0], payload.note)) {
+      throw migrationConflict(intent, 'anchored migration note differs from the persisted payload');
+    }
+    writeNote = false;
+  }
+
+  const badAttestation = store.readLedgerEvents().find((event) => (
+    event.kind === 'attest'
+    && event.intent_id === intent.id
+    && (event.tool !== 'judgment_goal_write' || event.op !== 'migrate')
+  ));
+  if (badAttestation) {
+    throw migrationConflict(intent, 'durable attestation attribution conflicts');
+  }
+
+  // ── Apply (undo-logged) ──────────────────────────────────────────────────
+  if (writeGoal) {
+    undo.created(goalPath);
+    store.writeGoalVersion(payload.goal_version);
+  }
+  if (writeTombstone) {
+    undo.created(tombstonePath);
+    store.writePositionRevision(payload.objective_tombstone);
+  }
+  if (writeState) {
+    if (preimageBytes === null) {
+      undo.created(statePath);
+      unpublishedUndo.created(statePath);
+    } else {
+      undo.capture(statePath);
+      unpublishedUndo.capture(statePath);
+    }
+    store.writeGoalState(payload.goal_state);
+  }
+  if (writeNote) {
+    undo.capture(ledgerPath);
+    store.appendLedgerEvent(payload.note);
+  }
+  return { status: 'applied' };
+}
+
+/**
+ * Typed replay dispatch. Future payloads cannot impersonate a transition:
+ * only the registered kinds reach their handlers.
+ */
+export const INTENT_APPLIERS = Object.freeze({
+  transition: applyTransitionIntent,
+  goal_migration: applyGoalMigrationIntent,
+});
+
+function appendIntentAttestation(store, intent) {
+  const matches = store.readLedgerEvents().filter(
+    (event) => event.kind === 'attest' && event.intent_id === intent.id,
+  );
+  const mismatch = matches.find(
+    (event) => event.tool !== intent.tool || event.op !== intent.op,
+  );
+  if (mismatch) {
+    throw typedError(
+      'JUDGMENT_CONFLICT',
+      `intent ${intent.id} attestation attribution conflicts: expected ${intent.tool}/${intent.op}, found ${mismatch.tool}/${mismatch.op}`,
+    );
+  }
+  if (matches.length > 0) return { appended: false };
+
+  const event = {
+    kind: 'attest',
+    title: `intent published: ${intent.id}`,
+    intent_id: intent.id,
+    tool: intent.tool,
+    op: intent.op,
+    provenance: stampProvenance({ intentId: intent.id }),
+  };
+  assertValidRecord('ledger_event', event);
+  store.appendLedgerEvent(event);
+  return { appended: true };
+}
+
+function intentPartialError(intent, stage, err) {
+  if (err?.code?.startsWith?.('JUDGMENT_')) return err;
+  return typedError(
+    'JUDGMENT_PARTIAL_WRITE',
+    `intent ${intent.id} ${stage} failed before publication; intent retained: ${err.message}`,
+    err,
+  );
+}
+
+/**
+ * Single inline + replay success path.
+ *
+ * Publication order is binding: idempotent apply → durable attestation →
+ * durable clear (the publication point) → projection regeneration.
+ *
+ * The `appliers` map is a NON-EXPORTED dependency: the C13 unit-injection seam
+ * threads a substitute map through the internal replay/runOp path only. The
+ * exported `publishIntentLocked` below always uses the real INTENT_APPLIERS, so
+ * no public mutation surface can inject a no-op applier and clear an intent
+ * without producing its artifacts.
+ */
+async function publishIntentWith(cwd, store, intent, appliers) {
+  const applier = appliers[intent.kind];
+  if (!applier) {
+    if (RESERVED_INTENT_KINDS.has(intent.kind)) {
+      return {
+        status: 'blocked',
+        reason: 'reserved_intent_kind',
+        kind: intent.kind,
+      };
+    }
+    throw typedError(
+      'JUDGMENT_INTENT_KIND',
+      `intent ${intent.id} kind "${intent.kind}" is unregistered and was retained`,
+    );
+  }
+
+  const undo = new UndoLog();
+  const unpublishedUndo = new UndoLog();
+  let applied;
+  try {
+    applied = await applier(cwd, store, intent, { undo, unpublishedUndo });
+  } catch (err) {
+    undo.restore();
+    try { syncManifest(cwd, undo.touchedPaths()); } catch { /* preserve the publication error */ }
+    throw intentPartialError(intent, 'apply', err);
+  }
+
+  if (applied.status === 'blocked') {
+    syncManifest(cwd, undo.touchedPaths());
+    return applied;
+  }
+  if (applied.status === 'refused') {
+    dropIntentDurably(cwd, store, intent, applied.reason, applied.detail);
+    syncManifest(cwd, undo.touchedPaths());
+    regenerateProjections(cwd);
+    return applied;
+  }
+
+  // Capture the ledger preimage even when the payload carried no events:
+  // attestation append is part of the pre-publication undo window.
+  undo.capture(store._ledgerPath());
+  try {
+    appendIntentAttestation(store, intent);
+  } catch (err) {
+    undo.restore();
+    try { syncManifest(cwd, undo.touchedPaths()); } catch { /* preserve the publication error */ }
+    throw intentPartialError(intent, 'attestation append', err);
+  }
+
+  try {
+    store.clearIntent(intent.id);
+  } catch (err) {
+    // New intent-attributed ledger lines/predictions stay hidden and are
+    // deduped on retry. Existing in-place records have no effective preimage,
+    // so restore those until durable clear succeeds.
+    unpublishedUndo.restore();
+    try { syncManifest(cwd, undo.touchedPaths()); } catch { /* preserve the publication error */ }
+    throw typedError(
+      'JUDGMENT_PARTIAL_WRITE',
+      `intent ${intent.id} publication point clear failed; intent retained: ${err.message}`,
+      err,
+    );
+  }
+
+  syncManifest(cwd, [...undo.touchedPaths(), store._intentPath(intent.id)]);
+  try {
+    regenerateProjections(cwd);
+  } catch (err) {
+    throw typedError(
+      'JUDGMENT_PROJECTION_STALE',
+      `intent ${intent.id} canonical effects are committed but projections are stale: ${err.message}`,
+      err,
+    );
+  }
+  return { status: 'published', guard: applied.guard ?? null };
+}
+
+/**
+ * Exported publication entry — always the real applier table. External callers
+ * (e.g. the inline transition publish) cannot substitute the dispatch map.
+ */
+export async function publishIntentLocked(cwd, store, intent) {
+  return publishIntentWith(cwd, store, intent, INTENT_APPLIERS);
+}
+
+/**
+ * Replay every pending intent. MUST be called with the judgment lock held.
+ * Guard state is authoritative for transition edges; intent kind is
+ * authoritative for dispatch, and the intent payload is authoritative for
+ * the complete mutation. `appliers` is the internal C13 seam (default real).
+ */
+async function replayIntentsLocked(cwd, appliers = INTENT_APPLIERS) {
+  const store = createJudgmentStore(cwd);
+  const intents = store.readIntents();
+  let replayed = 0;
+  const divergences = [];
+  const blocked = [];
+  for (const intent of intents) {
+    const outcome = await publishIntentWith(cwd, store, intent, appliers);
+    if (outcome.status === 'published') replayed += 1;
+    else if (outcome.status === 'refused') divergences.push(outcome.divergence);
+    else if (outcome.status === 'blocked') {
+      blocked.push({
+        intent: intent.id,
+        kind: intent.kind,
+        reason: outcome.reason,
+      });
+    }
+  }
+  return { replayed, divergences, blocked };
+}
+
+/**
+ * Public reconciler: replay pending intents under the lock. Also runs
+ * automatically at the head of every write op and getJudgmentState. Always
+ * uses the real applier table — the injection seam is internal-only (C13).
+ */
+export async function replayPendingIntents(cwd) {
+  const release = await acquireJudgmentLock(cwd);
+  try {
+    return await replayIntentsLocked(cwd, INTENT_APPLIERS);
+  } finally {
+    release();
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Op wrapper: validate → (idempotency) → lock → replay → execute → audit
+// ---------------------------------------------------------------------------
+
+async function runOp(cwd, args, { tool, validate, execute }, appliers = INTENT_APPLIERS) {
+  if (args?.provenance !== undefined) {
+    throw typedError('JUDGMENT_INPUT', `${tool}: provenance is writer-stamped and cannot be set by the caller`);
+  }
+  const prepared = validate ? validate() : undefined; // sync, BEFORE idempotency (A1/A4)
+
+  const doWrite = async () => {
+    const release = await acquireJudgmentLock(cwd);
+    try {
+      await replayIntentsLocked(cwd, appliers);
+      return await execute(prepared);
+    } finally {
+      release();
+    }
+  };
+
+  let result;
+  let cached = false;
+  if (args?.idempotency_key) {
+    ({ result, cached } = await checkOrInsert(cwd, `${tool}:${args.idempotency_key}`, doWrite));
+  } else {
+    result = await doWrite();
+  }
+
+  if (!cached) {
+    // Best-effort audit AFTER commit (A5) — never let audit failure surface.
+    try { appendEvent(cwd, { tool, result }); } catch { /* best-effort */ }
+  }
+  return result;
+}
+
+// ---------------------------------------------------------------------------
+// COMP-JUDGMENT-STORES S3 — shared person/situation writer primitives
+// ---------------------------------------------------------------------------
+
+const FACT_CHANNELS = new Set(['said', 'observed', 'secondhand', 'inferred']);
+const PERSON_SECTIONS = new Set(['role', 'life', 'stated', 'revealed']);
+const LOAD_CHANNELS = new Set(['said', 'observed']);
+
+function hasOwn(value, key) {
+  return Object.prototype.hasOwnProperty.call(value ?? {}, key);
+}
+
+function requireString(args, key, tool, op) {
+  const value = args?.[key];
+  if (typeof value !== 'string' || value.trim().length === 0) {
+    throw typedError('JUDGMENT_INPUT', `${tool} ${op}: ${key} must be a non-empty string`);
+  }
+  return value;
+}
+
+function optionalString(args, key, tool, op) {
+  if (!hasOwn(args, key)) return undefined;
+  return requireString(args, key, tool, op);
+}
+
+function requireSlug(args, tool, op) {
+  const slug = requireString(args, 'slug', tool, op);
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) {
+    throw typedError('JUDGMENT_INPUT', `${tool} ${op}: slug must match ^[a-z0-9][a-z0-9-]*$`);
+  }
+  return slug;
+}
+
+function requireDate(args, key, tool, op) {
+  const value = requireString(args, key, tool, op);
+  const parsed = new Date(`${value}T00:00:00.000Z`);
+  if (
+    !/^\d{4}-\d{2}-\d{2}$/.test(value)
+    || Number.isNaN(parsed.getTime())
+    || parsed.toISOString().slice(0, 10) !== value
+  ) {
+    throw typedError('JUDGMENT_INPUT', `${tool} ${op}: ${key} must be an ISO date (YYYY-MM-DD)`);
+  }
+  return value;
+}
+
+function validateChannelAndVia(args, tool, op, { requireChannel = true } = {}) {
+  const channel = requireChannel
+    ? requireString(args, 'channel', tool, op)
+    : optionalString(args, 'channel', tool, op);
+  const via = optionalString(args, 'via', tool, op);
+  if (channel !== undefined && !FACT_CHANNELS.has(channel)) {
+    throw typedError('JUDGMENT_INPUT', `${tool} ${op}: unknown channel "${channel}"`);
+  }
+  if (channel === 'secondhand' && via === undefined) {
+    throw typedError('JUDGMENT_INPUT', `${tool} ${op}: secondhand channel requires a non-empty via`);
+  }
+  if (channel !== undefined && channel !== 'secondhand' && via !== undefined) {
+    throw typedError('JUDGMENT_INPUT', `${tool} ${op}: via is only valid for secondhand channel`);
+  }
+  const prepared = {};
+  if (channel !== undefined) prepared.channel = channel;
+  if (via !== undefined) prepared.via = via;
+  return prepared;
+}
+
+function validateCreateArgs(args, tool) {
+  return {
+    slug: requireSlug(args, tool, 'create'),
+    displayName: requireString(args, 'display_name', tool, 'create'),
+  };
+}
+
+function validatePersonAddFactArgs(args) {
+  const tool = 'judgment_person_write';
+  const section = requireString(args, 'section', tool, 'add_fact');
+  if (!PERSON_SECTIONS.has(section)) {
+    throw typedError('JUDGMENT_INPUT', `${tool} add_fact: unknown section "${section}"`);
+  }
+  return {
+    slug: requireSlug(args, tool, 'add_fact'),
+    section,
+    text: requireString(args, 'text', tool, 'add_fact'),
+    ...validateChannelAndVia(args, tool, 'add_fact'),
+    at: requireDate(args, 'at', tool, 'add_fact'),
+  };
+}
+
+function validateSituationAddFactArgs(args) {
+  const tool = 'judgment_situation_write';
+  return {
+    slug: requireSlug(args, tool, 'add_fact'),
+    text: requireString(args, 'text', tool, 'add_fact'),
+    ...validateChannelAndVia(args, tool, 'add_fact'),
+    at: requireDate(args, 'at', tool, 'add_fact'),
+  };
+}
+
+function validateCorrectArgs(args, tool, { person = false } = {}) {
+  const prepared = {
+    slug: requireSlug(args, tool, 'correct'),
+    factId: requireString(args, 'fact_id', tool, 'correct'),
+  };
+  if (hasOwn(args, 'text')) prepared.text = requireString(args, 'text', tool, 'correct');
+  if (hasOwn(args, 'at')) prepared.at = requireDate(args, 'at', tool, 'correct');
+  if (hasOwn(args, 'channel') || hasOwn(args, 'via')) {
+    Object.assign(prepared, validateChannelAndVia(
+      args,
+      tool,
+      'correct',
+      { requireChannel: hasOwn(args, 'channel') },
+    ));
+  }
+  if (person && hasOwn(args, 'section')) {
+    const section = requireString(args, 'section', tool, 'correct');
+    if (!PERSON_SECTIONS.has(section)) {
+      throw typedError('JUDGMENT_INPUT', `${tool} correct: unknown section "${section}"`);
+    }
+    prepared.section = section;
+  }
+  if (person && hasOwn(args, 'pair_with')) {
+    prepared.pairWith = requireString(args, 'pair_with', tool, 'correct');
+  }
+  if (person && hasOwn(args, 'clear')) {
+    if (
+      !Array.isArray(args.clear)
+      || args.clear.length !== 1
+      || args.clear[0] !== 'diverges_with'
+    ) {
+      throw typedError('JUDGMENT_INPUT', `${tool} correct: clear must be exactly ["diverges_with"]`);
+    }
+    prepared.clearDivergence = true;
+  }
+  if (prepared.pairWith && prepared.clearDivergence) {
+    throw typedError('JUDGMENT_INPUT', `${tool} correct: pair_with and clear are mutually exclusive`);
+  }
+
+  const mutableKeys = person
+    ? ['text', 'at', 'channel', 'via', 'section', 'pairWith', 'clearDivergence']
+    : ['text', 'at', 'channel', 'via'];
+  if (!mutableKeys.some((key) => hasOwn(prepared, key))) {
+    throw typedError('JUDGMENT_INPUT', `${tool} correct: provide at least one correctable field`);
+  }
+  return prepared;
+}
+
+function validateOpenFieldArgs(args) {
+  const tool = 'judgment_person_write';
+  const slug = requireSlug(args, tool, 'open_field');
+  const create = hasOwn(args, 'name');
+  const fill = hasOwn(args, 'open_field_id') && hasOwn(args, 'filled_by') && !hasOwn(args, 'reopen');
+  const reopen = hasOwn(args, 'open_field_id') && args.reopen === true;
+  if (Number(create) + Number(fill) + Number(reopen) !== 1) {
+    throw typedError(
+      'JUDGMENT_INPUT',
+      `${tool} open_field: select exactly one create, fill, or reopen branch`,
+    );
+  }
+  if (create) {
+    if (hasOwn(args, 'open_field_id') || hasOwn(args, 'filled_by') || hasOwn(args, 'reopen')) {
+      throw typedError('JUDGMENT_INPUT', `${tool} open_field: select exactly one create, fill, or reopen branch`);
+    }
+    return { branch: 'create', slug, name: requireString(args, 'name', tool, 'open_field') };
+  }
+  const openFieldId = requireString(args, 'open_field_id', tool, 'open_field');
+  if (fill) {
+    return {
+      branch: 'fill',
+      slug,
+      openFieldId,
+      filledBy: requireString(args, 'filled_by', tool, 'open_field'),
+    };
+  }
+  if (hasOwn(args, 'filled_by') || hasOwn(args, 'name')) {
+    throw typedError('JUDGMENT_INPUT', `${tool} open_field: select exactly one create, fill, or reopen branch`);
+  }
+  return {
+    branch: 'reopen',
+    slug,
+    openFieldId,
+    reason: requireString(args, 'reason', tool, 'open_field'),
+  };
+}
+
+function validateOwedArgs(args) {
+  const tool = 'judgment_situation_write';
+  const slug = requireSlug(args, tool, 'owed');
+  const create = hasOwn(args, 'name') || hasOwn(args, 'why_load_bearing');
+  const give = hasOwn(args, 'owed_id') && hasOwn(args, 'filled_by') && !hasOwn(args, 'reopen');
+  const reopen = hasOwn(args, 'owed_id') && args.reopen === true;
+  if (Number(create) + Number(give) + Number(reopen) !== 1) {
+    throw typedError('JUDGMENT_INPUT', `${tool} owed: select exactly one create, give, or reopen branch`);
+  }
+  if (create) {
+    if (hasOwn(args, 'owed_id') || hasOwn(args, 'filled_by') || hasOwn(args, 'reopen')) {
+      throw typedError('JUDGMENT_INPUT', `${tool} owed: select exactly one create, give, or reopen branch`);
+    }
+    return {
+      branch: 'create',
+      slug,
+      name: requireString(args, 'name', tool, 'owed'),
+      whyLoadBearing: requireString(args, 'why_load_bearing', tool, 'owed'),
+    };
+  }
+  const owedId = requireString(args, 'owed_id', tool, 'owed');
+  if (give) {
+    return {
+      branch: 'give',
+      slug,
+      owedId,
+      filledBy: requireString(args, 'filled_by', tool, 'owed'),
+    };
+  }
+  if (hasOwn(args, 'filled_by') || hasOwn(args, 'name') || hasOwn(args, 'why_load_bearing')) {
+    throw typedError('JUDGMENT_INPUT', `${tool} owed: select exactly one create, give, or reopen branch`);
+  }
+  return {
+    branch: 'reopen',
+    slug,
+    owedId,
+    reason: requireString(args, 'reason', tool, 'owed'),
+  };
+}
+
+function validateRetirableArgs(args, tool, op, { createKeys, idKey }) {
+  const slug = requireSlug(args, tool, op);
+  const create = createKeys.every((key) => hasOwn(args, key));
+  const remove = hasOwn(args, idKey) && args.remove === true;
+  if (Number(create) + Number(remove) !== 1) {
+    throw typedError('JUDGMENT_INPUT', `${tool} ${op}: select exactly one create or remove branch`);
+  }
+  if (create) {
+    if (hasOwn(args, idKey) || hasOwn(args, 'remove') || hasOwn(args, 'reason')) {
+      throw typedError('JUDGMENT_INPUT', `${tool} ${op}: select exactly one create or remove branch`);
+    }
+    const prepared = { branch: 'create', slug };
+    for (const key of createKeys) {
+      prepared[key] = requireString(args, key, tool, op);
+    }
+    return prepared;
+  }
+  if (createKeys.some((key) => hasOwn(args, key))) {
+    throw typedError('JUDGMENT_INPUT', `${tool} ${op}: select exactly one create or remove branch`);
+  }
+  return {
+    branch: 'remove',
+    slug,
+    entryId: requireString(args, idKey, tool, op),
+    reason: requireString(args, 'reason', tool, op),
+  };
+}
+
+function validateFamilyDispatch(args, tool, validators) {
+  const op = args?.op;
+  if (typeof op !== 'string' || !hasOwn(validators, op)) {
+    throw typedError('JUDGMENT_INPUT', `${tool}: unknown op "${String(op)}"`);
+  }
+  return { op, input: validators[op](args) };
+}
+
+function cloneRecord(record) {
+  return JSON.parse(JSON.stringify(record));
+}
+
+function correctionTrace(prior, provenance) {
+  return {
+    prior,
+    corrected_at: provenance.written_at,
+    provenance,
+  };
+}
+
+function removedBlock(reason, provenance) {
+  return {
+    at: provenance.written_at,
+    reason,
+    provenance,
+  };
+}
+
+function persistAggregate(cwd, path, { created = false, write }) {
+  const undo = new UndoLog();
+  commitWithProjections(cwd, undo, () => {
+    if (created) undo.created(path);
+    else undo.capture(path);
+    write();
+  });
+}
+
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * Allocate the next permanent sub-entry ID from the collection high-water
+ * mark. The caller holds the writer lock. Retired entries remain in the
+ * collection and therefore participate automatically.
+ */
+export function allocateStableEntryId(record, collection, prefix) {
+  const entries = Array.isArray(collection) ? collection : record?.[collection];
+  const collectionName = Array.isArray(collection) ? 'collection' : collection;
+  if (!Array.isArray(entries)) {
+    throw typedError(
+      'JUDGMENT_CONFLICT',
+      `${record?.slug ?? 'record'} ${String(collectionName)} is not an on-disk entry collection`,
+    );
+  }
+  const pattern = new RegExp(`^${escapeRegExp(prefix)}([1-9][0-9]*)$`);
+  const seen = new Set();
+  let highWater = 0;
+  for (const entry of entries) {
+    const id = entry?.id;
+    const match = typeof id === 'string' ? pattern.exec(id) : null;
+    if (!match) {
+      throw typedError(
+        'JUDGMENT_CONFLICT',
+        `${record?.slug ?? 'record'} ${String(collectionName)} has malformed id ${String(id)}; expected ${prefix}<positive-integer>`,
+      );
+    }
+    if (seen.has(id)) {
+      throw typedError(
+        'JUDGMENT_CONFLICT',
+        `${record?.slug ?? 'record'} ${String(collectionName)} has duplicate id ${id}`,
+      );
+    }
+    seen.add(id);
+    highWater = Math.max(highWater, Number(match[1]));
+  }
+  return `${prefix}${highWater + 1}`;
+}
+
+function assertFactVia(fact, ownerLabel) {
+  if (fact.channel === 'secondhand') {
+    if (typeof fact.via !== 'string' || fact.via.trim().length === 0) {
+      throw typedError(
+        'JUDGMENT_INPUT',
+        `${ownerLabel} fact ${fact.id}: secondhand channel requires a non-empty via`,
+      );
+    }
+  } else if (fact.via !== undefined) {
+    throw typedError(
+      'JUDGMENT_INPUT',
+      `${ownerLabel} fact ${fact.id}: via is only valid for secondhand channel`,
+    );
+  }
+}
+
+function activeEntries(entries) {
+  return entries.filter((entry) => entry.removed == null);
+}
+
+function assertPersonSemantics(store, record) {
+  allocateStableEntryId(record, 'facts', 'f');
+  allocateStableEntryId(record, 'edges', 'e');
+  allocateStableEntryId(record, 'open_fields', 'of');
+  allocateStableEntryId(record, 'load_links', 'l');
+
+  const facts = new Map(record.facts.map((fact) => [fact.id, fact]));
+  for (const fact of record.facts) assertFactVia(fact, `person ${record.slug}`);
+
+  for (const fact of record.facts) {
+    if (fact.diverges_with === undefined) continue;
+    const paired = facts.get(fact.diverges_with);
+    if (!paired) {
+      throw typedError(
+        'JUDGMENT_REF',
+        `person ${record.slug} fact ${fact.id}: diverges_with ${fact.diverges_with} does not resolve`,
+      );
+    }
+    if (paired.diverges_with !== fact.id) {
+      throw typedError(
+        'JUDGMENT_REF',
+        `person ${record.slug} divergence ${fact.id}↔${paired.id} is not reciprocal`,
+      );
+    }
+    if (new Set([fact.section, paired.section]).size !== 2
+      || ![fact.section, paired.section].every((section) => ['stated', 'revealed'].includes(section))) {
+      throw typedError(
+        'JUDGMENT_REF',
+        `person ${record.slug} divergence ${fact.id}↔${paired.id} must join stated↔revealed`,
+      );
+    }
+  }
+
+  for (const field of record.open_fields) {
+    if (!['open', 'filled'].includes(field.status)) {
+      throw typedError(
+        'JUDGMENT_CONFLICT',
+        `person ${record.slug} open field ${field.id} has invalid lifecycle state ${String(field.status)}`,
+      );
+    }
+    if (field.status === 'filled') {
+      const fact = facts.get(field.filled_by);
+      if (!fact) {
+        throw typedError(
+          'JUDGMENT_REF',
+          `person ${record.slug} open field ${field.id}: filled_by ${field.filled_by} does not resolve`,
+        );
+      }
+      if (fact.channel !== 'said') {
+        throw typedError(
+          'JUDGMENT_REF',
+          `person ${record.slug} open field ${field.id}: filled_by ${field.filled_by} must name a said fact`,
+        );
+      }
+    } else if (field.status === 'open' && field.filled_by !== undefined) {
+      throw typedError(
+        'JUDGMENT_CONFLICT',
+        `person ${record.slug} open field ${field.id} is open but retains filled_by ${field.filled_by}`,
+      );
+    }
+  }
+
+  for (const edge of activeEntries(record.edges)) {
+    if (!store.readPerson(edge.to)) {
+      throw typedError(
+        'JUDGMENT_REF',
+        `person ${record.slug} edge ${edge.id}: target person ${edge.to} does not exist`,
+      );
+    }
+  }
+
+  const links = activeEntries(record.load_links);
+  for (const link of links) {
+    const fact = facts.get(link.fact);
+    if (!fact) {
+      throw typedError(
+        'JUDGMENT_REF',
+        `person ${record.slug} load link ${link.id}: fact ${link.fact} does not resolve`,
+      );
+    }
+  }
+  if (links.length > 0 && !record.facts.some((fact) => fact.channel === 'said')) {
+    throw typedError(
+      'JUDGMENT_LOAD_CHANNEL',
+      `person ${record.slug} is a stub and cannot carry load (active: ${links.map((link) => link.id).join(', ')})`,
+    );
+  }
+  for (const link of links) {
+    const fact = facts.get(link.fact);
+    if (!LOAD_CHANNELS.has(fact.channel)) {
+      throw typedError(
+        'JUDGMENT_LOAD_CHANNEL',
+        `person ${record.slug} load link ${link.id}: fact ${fact.id} channel ${fact.channel} cannot carry load`,
+      );
+    }
+  }
+}
+
+function assertSituationSemantics(record) {
+  allocateStableEntryId(record, 'facts', 'f');
+  allocateStableEntryId(record, 'owed', 'o');
+  allocateStableEntryId(record, 'load_links', 'l');
+
+  const facts = new Map(record.facts.map((fact) => [fact.id, fact]));
+  for (const fact of record.facts) assertFactVia(fact, `situation ${record.slug}`);
+
+  for (const owed of record.owed) {
+    if (!['open', 'given'].includes(owed.status)) {
+      throw typedError(
+        'JUDGMENT_CONFLICT',
+        `situation ${record.slug} owed ${owed.id} has invalid lifecycle state ${String(owed.status)}`,
+      );
+    }
+    if (owed.status === 'given') {
+      if (!facts.has(owed.filled_by)) {
+        throw typedError(
+          'JUDGMENT_REF',
+          `situation ${record.slug} owed ${owed.id}: filled_by ${owed.filled_by} does not resolve`,
+        );
+      }
+    } else if (owed.status === 'open' && owed.filled_by !== undefined) {
+      throw typedError(
+        'JUDGMENT_CONFLICT',
+        `situation ${record.slug} owed ${owed.id} is open but retains filled_by ${owed.filled_by}`,
+      );
+    }
+  }
+
+  for (const link of activeEntries(record.load_links)) {
+    const fact = facts.get(link.fact);
+    if (!fact) {
+      throw typedError(
+        'JUDGMENT_REF',
+        `situation ${record.slug} load link ${link.id}: fact ${link.fact} does not resolve`,
+      );
+    }
+    if (!LOAD_CHANNELS.has(fact.channel)) {
+      throw typedError(
+        'JUDGMENT_LOAD_CHANNEL',
+        `situation ${record.slug} load link ${link.id}: fact ${fact.id} channel ${fact.channel} cannot carry load`,
+      );
+    }
+  }
+}
+
+function personCorrectionBlockers(record, factId) {
+  const fact = record.facts.find((entry) => entry.id === factId);
+  const refBlockers = [];
+  const loadBlockers = [];
+
+  if (fact.diverges_with !== undefined) {
+    const paired = record.facts.find((entry) => entry.id === fact.diverges_with);
+    if (
+      !paired
+      || paired.diverges_with !== fact.id
+      || new Set([fact.section, paired.section]).size !== 2
+      || ![fact.section, paired.section].every((section) => ['stated', 'revealed'].includes(section))
+    ) {
+      refBlockers.push(fact.diverges_with);
+    }
+  }
+  if (fact.channel !== 'said') {
+    refBlockers.push(
+      ...record.open_fields
+        .filter((field) => field.status === 'filled' && field.filled_by === fact.id)
+        .map((field) => field.id),
+    );
+  }
+
+  const activeLinks = activeEntries(record.load_links);
+  if (!LOAD_CHANNELS.has(fact.channel)) {
+    loadBlockers.push(
+      ...activeLinks.filter((link) => link.fact === fact.id).map((link) => link.id),
+    );
+  }
+  if (!record.facts.some((entry) => entry.channel === 'said')) {
+    loadBlockers.push(...activeLinks.map((link) => link.id));
+  }
+
+  return {
+    ref: [...new Set(refBlockers)].filter(Boolean),
+    load: [...new Set(loadBlockers)].filter(Boolean),
+  };
+}
+
+function situationCorrectionBlockers(record, factId) {
+  const fact = record.facts.find((entry) => entry.id === factId);
+  if (LOAD_CHANNELS.has(fact.channel)) return [];
+  return activeEntries(record.load_links)
+    .filter((link) => link.fact === factId)
+    .map((link) => link.id);
+}
+
+function appendCorrectionTraces(priorByFact, provenance) {
+  for (const [fact, prior] of priorByFact) {
+    if (Object.keys(prior).length > 0) {
+      fact.trace.push(correctionTrace(prior, provenance));
+    }
+  }
+}
+
+function recordPrior(priorByFact, fact, key) {
+  let prior = priorByFact.get(fact);
+  if (!prior) {
+    prior = {};
+    priorByFact.set(fact, prior);
+  }
+  if (!hasOwn(prior, key)) prior[key] = fact[key] ?? null;
+}
+
+function applyFactScalarCorrections(fact, input, priorByFact) {
+  for (const key of ['text', 'at']) {
+    if (hasOwn(input, key) && input[key] !== fact[key]) {
+      recordPrior(priorByFact, fact, key);
+      fact[key] = input[key];
+    }
+  }
+
+  if (hasOwn(input, 'channel') && input.channel !== fact.channel) {
+    recordPrior(priorByFact, fact, 'channel');
+    fact.channel = input.channel;
+    if (input.channel === 'secondhand') {
+      recordPrior(priorByFact, fact, 'via');
+      fact.via = input.via;
+    } else if (fact.via !== undefined) {
+      recordPrior(priorByFact, fact, 'via');
+      delete fact.via;
+    }
+  } else if (hasOwn(input, 'via')) {
+    if (fact.channel !== 'secondhand') {
+      throw typedError(
+        'JUDGMENT_INPUT',
+        `fact ${fact.id}: via is only valid while channel is secondhand`,
+      );
+    }
+    if (input.via !== fact.via) {
+      recordPrior(priorByFact, fact, 'via');
+      fact.via = input.via;
+    }
+  }
+}
+
+const PERSON_VALIDATORS = Object.freeze({
+  create: (args) => validateCreateArgs(args, 'judgment_person_write'),
+  add_fact: validatePersonAddFactArgs,
+  correct: (args) => validateCorrectArgs(args, 'judgment_person_write', { person: true }),
+  open_field: validateOpenFieldArgs,
+  edge: (args) => validateRetirableArgs(
+    args,
+    'judgment_person_write',
+    'edge',
+    { createKeys: ['to', 'kind'], idKey: 'edge_id' },
+  ),
+  load_link: (args) => validateRetirableArgs(
+    args,
+    'judgment_person_write',
+    'load_link',
+    { createKeys: ['fact', 'carries'], idKey: 'load_link_id' },
+  ),
+});
+
+function personRecord(store, slug) {
+  const record = store.readPerson(slug);
+  if (!record) throw typedError('JUDGMENT_NOT_FOUND', `person ${slug} does not exist`);
+  return cloneRecord(record);
+}
+
+function writePersonAggregate(cwd, store, record, { created = false } = {}) {
+  assertPersonSemantics(store, record);
+  assertValidRecord('person', record);
+  persistAggregate(cwd, store._personPath(record.slug), {
+    created,
+    write: () => store.writePerson(record),
+  });
+}
+
+const PERSON_EXECUTORS = Object.freeze({
+  create(cwd, input, internal) {
+    const store = createJudgmentStore(cwd);
+    if (store.readPerson(input.slug)) {
+      throw typedError('JUDGMENT_CONFLICT', `person ${input.slug} already exists`);
+    }
+    const provenance = stampProvenance(internal);
+    const record = {
+      slug: input.slug,
+      display_name: input.displayName,
+      facts: [],
+      edges: [],
+      open_fields: [],
+      load_links: [],
+      provenance,
+    };
+    writePersonAggregate(cwd, store, record, { created: true });
+    return { op: 'create', slug: record.slug };
+  },
+
+  add_fact(cwd, input, internal) {
+    const store = createJudgmentStore(cwd);
+    const record = personRecord(store, input.slug);
+    const provenance = stampProvenance(internal);
+    const fact = {
+      id: allocateStableEntryId(record, 'facts', 'f'),
+      section: input.section,
+      text: input.text,
+      channel: input.channel,
+      at: input.at,
+      provenance,
+      trace: [],
+    };
+    if (input.via !== undefined) fact.via = input.via;
+    record.facts.push(fact);
+    record.provenance = provenance;
+    writePersonAggregate(cwd, store, record);
+    return { op: 'add_fact', slug: record.slug, id: fact.id };
+  },
+
+  correct(cwd, input, internal) {
+    const store = createJudgmentStore(cwd);
+    const record = personRecord(store, input.slug);
+    const fact = record.facts.find((entry) => entry.id === input.factId);
+    if (!fact) {
+      throw typedError('JUDGMENT_NOT_FOUND', `person ${record.slug} fact ${input.factId} not found`);
+    }
+
+    const provenance = stampProvenance(internal);
+    const priorByFact = new Map();
+    applyFactScalarCorrections(fact, input, priorByFact);
+
+    if (hasOwn(input, 'section') && input.section !== fact.section) {
+      recordPrior(priorByFact, fact, 'section');
+      fact.section = input.section;
+    }
+
+    if (input.pairWith) {
+      const paired = record.facts.find((entry) => entry.id === input.pairWith);
+      if (!paired) {
+        throw typedError(
+          'JUDGMENT_REF',
+          `person ${record.slug} pair endpoint ${input.pairWith} does not resolve`,
+        );
+      }
+      if (fact.diverges_with !== undefined) {
+        throw typedError(
+          'JUDGMENT_CONFLICT',
+          `person ${record.slug} fact ${fact.id} is already paired with ${fact.diverges_with}`,
+        );
+      }
+      if (paired.diverges_with !== undefined) {
+        throw typedError(
+          'JUDGMENT_CONFLICT',
+          `person ${record.slug} fact ${paired.id} is already paired with ${paired.diverges_with}`,
+        );
+      }
+      if (
+        new Set([fact.section, paired.section]).size !== 2
+        || ![fact.section, paired.section].every((section) => ['stated', 'revealed'].includes(section))
+      ) {
+        throw typedError(
+          'JUDGMENT_REF',
+          `person ${record.slug} pair ${fact.id}↔${paired.id} must join stated↔revealed`,
+        );
+      }
+      recordPrior(priorByFact, fact, 'diverges_with');
+      recordPrior(priorByFact, paired, 'diverges_with');
+      fact.diverges_with = paired.id;
+      paired.diverges_with = fact.id;
+    }
+
+    if (input.clearDivergence) {
+      const pairedId = fact.diverges_with;
+      if (pairedId === undefined) {
+        throw typedError(
+          'JUDGMENT_CONFLICT',
+          `person ${record.slug} fact ${fact.id} has no divergence pair to clear`,
+        );
+      }
+      const paired = record.facts.find((entry) => entry.id === pairedId);
+      recordPrior(priorByFact, fact, 'diverges_with');
+      delete fact.diverges_with;
+      if (paired?.diverges_with === fact.id) {
+        recordPrior(priorByFact, paired, 'diverges_with');
+        delete paired.diverges_with;
+      }
+    }
+
+    if ([...priorByFact.values()].every((prior) => Object.keys(prior).length === 0)) {
+      throw typedError('JUDGMENT_INPUT', `judgment_person_write correct: fact ${fact.id} has no changed value`);
+    }
+
+    const blockers = personCorrectionBlockers(record, fact.id);
+    const allBlockers = [...new Set([...blockers.ref, ...blockers.load])];
+    if (blockers.ref.length > 0) {
+      throw typedError(
+        'JUDGMENT_REF',
+        `person ${record.slug} correction of fact ${fact.id} is blocked by dependent entries: ${allBlockers.join(', ')}`,
+      );
+    }
+    if (blockers.load.length > 0) {
+      throw typedError(
+        'JUDGMENT_LOAD_CHANNEL',
+        `person ${record.slug} correction of fact ${fact.id} is blocked by active load links: ${blockers.load.join(', ')}`,
+      );
+    }
+
+    appendCorrectionTraces(priorByFact, provenance);
+    record.provenance = provenance;
+    writePersonAggregate(cwd, store, record);
+    return { op: 'correct', slug: record.slug, fact_id: fact.id };
+  },
+
+  open_field(cwd, input, internal) {
+    const store = createJudgmentStore(cwd);
+    const record = personRecord(store, input.slug);
+    const provenance = stampProvenance(internal);
+
+    let field;
+    if (input.branch === 'create') {
+      field = {
+        id: allocateStableEntryId(record, 'open_fields', 'of'),
+        name: input.name,
+        status: 'open',
+        provenance,
+        trace: [],
+      };
+      record.open_fields.push(field);
+    } else {
+      field = record.open_fields.find((entry) => entry.id === input.openFieldId);
+      if (!field) {
+        throw typedError(
+          'JUDGMENT_NOT_FOUND',
+          `person ${record.slug} open field ${input.openFieldId} not found`,
+        );
+      }
+      if (input.branch === 'fill') {
+        if (field.status !== 'open') {
+          throw typedError(
+            'JUDGMENT_CONFLICT',
+            `person ${record.slug} open field ${field.id} is already ${field.status}`,
+          );
+        }
+        const fact = record.facts.find((entry) => entry.id === input.filledBy);
+        if (!fact) {
+          throw typedError(
+            'JUDGMENT_REF',
+            `person ${record.slug} open field ${field.id}: filled_by ${input.filledBy} does not resolve`,
+          );
+        }
+        if (fact.channel !== 'said') {
+          throw typedError(
+            'JUDGMENT_REF',
+            `person ${record.slug} open field ${field.id}: filled_by ${input.filledBy} must name a said fact`,
+          );
+        }
+        field.trace.push(correctionTrace({ status: 'open', filled_by: null }, provenance));
+        field.status = 'filled';
+        field.filled_by = fact.id;
+      } else {
+        if (field.status !== 'filled') {
+          throw typedError(
+            'JUDGMENT_CONFLICT',
+            `person ${record.slug} open field ${field.id} is already open`,
+          );
+        }
+        field.trace.push(correctionTrace({
+          status: 'filled',
+          filled_by: field.filled_by,
+        }, provenance));
+        field.status = 'open';
+        delete field.filled_by;
+      }
+    }
+
+    record.provenance = provenance;
+    writePersonAggregate(cwd, store, record);
+    return {
+      op: 'open_field',
+      slug: record.slug,
+      id: field.id,
+      status: field.status,
+    };
+  },
+
+  edge(cwd, input, internal) {
+    const store = createJudgmentStore(cwd);
+    const record = personRecord(store, input.slug);
+    const provenance = stampProvenance(internal);
+    let edge;
+
+    if (input.branch === 'create') {
+      if (!store.readPerson(input.to)) {
+        throw typedError(
+          'JUDGMENT_REF',
+          `person ${record.slug} edge target person ${input.to} does not exist`,
+        );
+      }
+      edge = {
+        id: allocateStableEntryId(record, 'edges', 'e'),
+        to: input.to,
+        kind: input.kind,
+        provenance,
+        removed: null,
+      };
+      record.edges.push(edge);
+    } else {
+      edge = record.edges.find((entry) => entry.id === input.entryId);
+      if (!edge) {
+        throw typedError('JUDGMENT_NOT_FOUND', `person ${record.slug} edge ${input.entryId} not found`);
+      }
+      if (edge.removed !== null) {
+        throw typedError('JUDGMENT_CONFLICT', `person ${record.slug} edge ${edge.id} is already removed`);
+      }
+      edge.removed = removedBlock(input.reason, provenance);
+    }
+
+    record.provenance = provenance;
+    writePersonAggregate(cwd, store, record);
+    return {
+      op: 'edge',
+      slug: record.slug,
+      id: edge.id,
+      removed: edge.removed !== null,
+    };
+  },
+
+  load_link(cwd, input, internal) {
+    const store = createJudgmentStore(cwd);
+    const record = personRecord(store, input.slug);
+    const provenance = stampProvenance(internal);
+    let link;
+
+    if (input.branch === 'create') {
+      const fact = record.facts.find((entry) => entry.id === input.fact);
+      if (!fact) {
+        throw typedError(
+          'JUDGMENT_REF',
+          `person ${record.slug} load link fact ${input.fact} does not resolve`,
+        );
+      }
+      if (!record.facts.some((entry) => entry.channel === 'said')) {
+        throw typedError('JUDGMENT_LOAD_CHANNEL', `person ${record.slug} is a stub and cannot carry load`);
+      }
+      if (!LOAD_CHANNELS.has(fact.channel)) {
+        throw typedError(
+          'JUDGMENT_LOAD_CHANNEL',
+          `person ${record.slug} fact ${fact.id} channel ${fact.channel} cannot carry load`,
+        );
+      }
+      link = {
+        id: allocateStableEntryId(record, 'load_links', 'l'),
+        fact: input.fact,
+        carries: input.carries,
+        provenance,
+        removed: null,
+      };
+      record.load_links.push(link);
+    } else {
+      link = record.load_links.find((entry) => entry.id === input.entryId);
+      if (!link) {
+        throw typedError(
+          'JUDGMENT_NOT_FOUND',
+          `person ${record.slug} load link ${input.entryId} not found`,
+        );
+      }
+      if (link.removed !== null) {
+        throw typedError(
+          'JUDGMENT_CONFLICT',
+          `person ${record.slug} load link ${link.id} is already removed`,
+        );
+      }
+      link.removed = removedBlock(input.reason, provenance);
+    }
+
+    record.provenance = provenance;
+    writePersonAggregate(cwd, store, record);
+    return {
+      op: 'load_link',
+      slug: record.slug,
+      id: link.id,
+      removed: link.removed !== null,
+    };
+  },
+});
+
+/**
+ * One op-discriminated writer for the entire person family.
+ */
+export async function judgmentPersonWrite(cwd, args, internal = {}) {
+  return runOp(cwd, args, {
+    tool: 'judgment_person_write',
+    validate: () => validateFamilyDispatch(args, 'judgment_person_write', PERSON_VALIDATORS),
+    execute: ({ op, input }) => PERSON_EXECUTORS[op](cwd, input, internal),
+  });
+}
+
+const SITUATION_VALIDATORS = Object.freeze({
+  create: (args) => validateCreateArgs(args, 'judgment_situation_write'),
+  add_fact: validateSituationAddFactArgs,
+  correct: (args) => validateCorrectArgs(args, 'judgment_situation_write'),
+  owed: validateOwedArgs,
+  load_link: (args) => validateRetirableArgs(
+    args,
+    'judgment_situation_write',
+    'load_link',
+    { createKeys: ['fact', 'carries'], idKey: 'load_link_id' },
+  ),
+});
+
+function situationRecord(store, slug) {
+  const record = store.readSituationEntity(slug);
+  if (!record) {
+    throw typedError('JUDGMENT_NOT_FOUND', `situation entity ${slug} does not exist`);
+  }
+  return cloneRecord(record);
+}
+
+function writeSituationAggregate(cwd, store, record, { created = false } = {}) {
+  assertSituationSemantics(record);
+  assertValidRecord('situation_entity', record);
+  persistAggregate(cwd, store._situationEntityPath(record.slug), {
+    created,
+    write: () => store.writeSituationEntity(record),
+  });
+}
+
+const SITUATION_EXECUTORS = Object.freeze({
+  create(cwd, input, internal) {
+    const store = createJudgmentStore(cwd);
+    if (store.readSituationEntity(input.slug)) {
+      throw typedError('JUDGMENT_CONFLICT', `situation entity ${input.slug} already exists`);
+    }
+    const provenance = stampProvenance(internal);
+    const record = {
+      slug: input.slug,
+      display_name: input.displayName,
+      facts: [],
+      owed: [],
+      load_links: [],
+      provenance,
+    };
+    writeSituationAggregate(cwd, store, record, { created: true });
+    return { op: 'create', slug: record.slug };
+  },
+
+  add_fact(cwd, input, internal) {
+    const store = createJudgmentStore(cwd);
+    const record = situationRecord(store, input.slug);
+    const provenance = stampProvenance(internal);
+    const fact = {
+      id: allocateStableEntryId(record, 'facts', 'f'),
+      text: input.text,
+      channel: input.channel,
+      at: input.at,
+      provenance,
+      trace: [],
+    };
+    if (input.via !== undefined) fact.via = input.via;
+    record.facts.push(fact);
+    record.provenance = provenance;
+    writeSituationAggregate(cwd, store, record);
+    return { op: 'add_fact', slug: record.slug, id: fact.id };
+  },
+
+  correct(cwd, input, internal) {
+    const store = createJudgmentStore(cwd);
+    const record = situationRecord(store, input.slug);
+    const fact = record.facts.find((entry) => entry.id === input.factId);
+    if (!fact) {
+      throw typedError('JUDGMENT_NOT_FOUND', `situation ${record.slug} fact ${input.factId} not found`);
+    }
+    const provenance = stampProvenance(internal);
+    const priorByFact = new Map();
+    applyFactScalarCorrections(fact, input, priorByFact);
+    if ([...priorByFact.values()].every((prior) => Object.keys(prior).length === 0)) {
+      throw typedError('JUDGMENT_INPUT', `judgment_situation_write correct: fact ${fact.id} has no changed value`);
+    }
+    const blockers = situationCorrectionBlockers(record, fact.id);
+    if (blockers.length > 0) {
+      throw typedError(
+        'JUDGMENT_LOAD_CHANNEL',
+        `situation ${record.slug} correction of fact ${fact.id} is blocked by active load links: ${blockers.join(', ')}`,
+      );
+    }
+    appendCorrectionTraces(priorByFact, provenance);
+    record.provenance = provenance;
+    writeSituationAggregate(cwd, store, record);
+    return { op: 'correct', slug: record.slug, fact_id: fact.id };
+  },
+
+  owed(cwd, input, internal) {
+    const store = createJudgmentStore(cwd);
+    const record = situationRecord(store, input.slug);
+    const provenance = stampProvenance(internal);
+    let owed;
+
+    if (input.branch === 'create') {
+      owed = {
+        id: allocateStableEntryId(record, 'owed', 'o'),
+        name: input.name,
+        why_load_bearing: input.whyLoadBearing,
+        status: 'open',
+        provenance,
+        trace: [],
+      };
+      record.owed.push(owed);
+    } else {
+      owed = record.owed.find((entry) => entry.id === input.owedId);
+      if (!owed) {
+        throw typedError('JUDGMENT_NOT_FOUND', `situation ${record.slug} owed ${input.owedId} not found`);
+      }
+      if (input.branch === 'give') {
+        if (owed.status !== 'open') {
+          throw typedError(
+            'JUDGMENT_CONFLICT',
+            `situation ${record.slug} owed ${owed.id} is already ${owed.status}`,
+          );
+        }
+        if (!record.facts.some((fact) => fact.id === input.filledBy)) {
+          throw typedError(
+            'JUDGMENT_REF',
+            `situation ${record.slug} owed ${owed.id}: filled_by ${input.filledBy} does not resolve`,
+          );
+        }
+        owed.trace.push(correctionTrace({ status: 'open', filled_by: null }, provenance));
+        owed.status = 'given';
+        owed.filled_by = input.filledBy;
+      } else {
+        if (owed.status !== 'given') {
+          throw typedError(
+            'JUDGMENT_CONFLICT',
+            `situation ${record.slug} owed ${owed.id} is already open`,
+          );
+        }
+        owed.trace.push(correctionTrace({
+          status: 'given',
+          filled_by: owed.filled_by,
+        }, provenance));
+        owed.status = 'open';
+        delete owed.filled_by;
+      }
+    }
+
+    record.provenance = provenance;
+    writeSituationAggregate(cwd, store, record);
+    return {
+      op: 'owed',
+      slug: record.slug,
+      id: owed.id,
+      status: owed.status,
+    };
+  },
+
+  load_link(cwd, input, internal) {
+    const store = createJudgmentStore(cwd);
+    const record = situationRecord(store, input.slug);
+    const provenance = stampProvenance(internal);
+    let link;
+
+    if (input.branch === 'create') {
+      const fact = record.facts.find((entry) => entry.id === input.fact);
+      if (!fact) {
+        throw typedError(
+          'JUDGMENT_REF',
+          `situation ${record.slug} load link fact ${input.fact} does not resolve`,
+        );
+      }
+      if (!LOAD_CHANNELS.has(fact.channel)) {
+        throw typedError(
+          'JUDGMENT_LOAD_CHANNEL',
+          `situation ${record.slug} fact ${fact.id} channel ${fact.channel} cannot carry load`,
+        );
+      }
+      link = {
+        id: allocateStableEntryId(record, 'load_links', 'l'),
+        fact: input.fact,
+        carries: input.carries,
+        provenance,
+        removed: null,
+      };
+      record.load_links.push(link);
+    } else {
+      link = record.load_links.find((entry) => entry.id === input.entryId);
+      if (!link) {
+        throw typedError(
+          'JUDGMENT_NOT_FOUND',
+          `situation ${record.slug} load link ${input.entryId} not found`,
+        );
+      }
+      if (link.removed !== null) {
+        throw typedError(
+          'JUDGMENT_CONFLICT',
+          `situation ${record.slug} load link ${link.id} is already removed`,
+        );
+      }
+      link.removed = removedBlock(input.reason, provenance);
+    }
+
+    record.provenance = provenance;
+    writeSituationAggregate(cwd, store, record);
+    return {
+      op: 'load_link',
+      slug: record.slug,
+      id: link.id,
+      removed: link.removed !== null,
+    };
+  },
+});
+
+/**
+ * One op-discriminated writer for the entire situation family.
+ */
+export async function judgmentSituationWrite(cwd, args, internal = {}) {
+  return runOp(cwd, args, {
+    tool: 'judgment_situation_write',
+    validate: () => validateFamilyDispatch(args, 'judgment_situation_write', SITUATION_VALIDATORS),
+    execute: ({ op, input }) => SITUATION_EXECUTORS[op](cwd, input, internal),
+  });
+}
+
+// ---------------------------------------------------------------------------
+// COMP-JUDGMENT-STORES S4 — judgment_goal_write
+// ---------------------------------------------------------------------------
+
+const GOAL_TOOL = 'judgment_goal_write';
+
+// The precheck must be exactly as strict as the contract's
+// `format: "date-time"` (a laxer precheck would let malformed input reach
+// the idempotency cache before validation), so it delegates to the same
+// ajv instance that performs final schema validation.
+let _dateTimeValidate = null;
+
+function isContractDateTime(value) {
+  if (!_dateTimeValidate) {
+    _dateTimeValidate = getJudgmentValidator().ajv
+      .compile({ type: 'string', format: 'date-time' });
+  }
+  return _dateTimeValidate(value);
+}
+
+function requireDateTimeValue(value, label, code = 'JUDGMENT_INPUT') {
+  if (typeof value !== 'string' || !isContractDateTime(value)) {
+    throw typedError(code, `${label} must be a valid date-time string`);
+  }
+  return value;
+}
+
+function requireNestedString(value, key, label, code = 'JUDGMENT_INPUT') {
+  const field = value?.[key];
+  if (typeof field !== 'string' || field.trim().length === 0) {
+    throw typedError(code, `${label}.${key} must be a non-empty string`);
+  }
+  return field;
+}
+
+function sanitizeElicitation(value, label, code = 'JUDGMENT_INPUT') {
+  return {
+    asked: requireNestedString(value, 'asked', label, code),
+    answered_at: requireDateTimeValue(value?.answered_at, `${label}.answered_at`, code),
+    answer_ref: requireNestedString(value, 'answer_ref', label, code),
+  };
+}
+
+function sanitizeRatification(value, code = 'JUDGMENT_INPUT') {
+  return {
+    ...sanitizeElicitation(value, `${GOAL_TOOL} cut: ratification`, code),
+    quote: requireNestedString(value, 'quote', `${GOAL_TOOL} cut: ratification`, code),
+  };
 }
 
-function guardEnabled(cwd) {
-  try {
-    const config = JSON.parse(readFileSync(join(cwd, '.compose', 'compose.json'), 'utf8'));
-    return config?.capabilities?.guard === true;
-  } catch {
-    return false;
+function sanitizeProvocation(value, code = 'JUDGMENT_INPUT') {
+  return {
+    quote: requireNestedString(value, 'quote', `${GOAL_TOOL} cut: provocation`, code),
+    at: requireDateTimeValue(value?.at, `${GOAL_TOOL} cut: provocation.at`, code),
+  };
+}
+
+function validateGoalClauseInput(value, index, { ordinary }) {
+  const label = `${GOAL_TOOL} cut: clause ${index + 1}`;
+  if (value == null || typeof value !== 'object' || Array.isArray(value)) {
+    throw typedError('JUDGMENT_INPUT', `${label} must be an object`);
+  }
+  if (ordinary && (value.elicitation == null || typeof value.elicitation !== 'object')) {
+    throw typedError(
+      'JUDGMENT_UNRATIFIED_CUT',
+      `${label} requires an elicitation citation before an ordinary goal cut`,
+    );
+  }
+  const text = requireNestedString(value, 'text', label);
+  const channel = requireNestedString(value, 'channel', label);
+  if (!FACT_CHANNELS.has(channel)) {
+    throw typedError('JUDGMENT_INPUT', `${label} has unknown channel "${channel}"`);
+  }
+  const via = hasOwn(value, 'via')
+    ? requireNestedString(value, 'via', label)
+    : undefined;
+  if (channel === 'secondhand' && via === undefined) {
+    throw typedError(
+      'JUDGMENT_INPUT',
+      `${label}: secondhand channel requires a non-empty via`,
+    );
   }
+  if (channel !== 'secondhand' && via !== undefined) {
+    throw typedError(
+      'JUDGMENT_INPUT',
+      `${label}: via is only valid for secondhand channel`,
+    );
+  }
+  const clause = {
+    text,
+    channel,
+    elicitation: sanitizeElicitation(
+      value.elicitation,
+      `${label}.elicitation`,
+      ordinary ? 'JUDGMENT_UNRATIFIED_CUT' : 'JUDGMENT_INPUT',
+    ),
+  };
+  if (via !== undefined) clause.via = via;
+  return clause;
 }
 
-// ---------------------------------------------------------------------------
-// Compensating rollback
-// ---------------------------------------------------------------------------
+function validateGoalCutArgs(args, internal) {
+  const internalDraft = internal.via === 'import' || internal.via === 'migration';
+  if (internal.via !== undefined && !internalDraft) {
+    throw typedError(
+      'JUDGMENT_INPUT',
+      `${GOAL_TOOL} cut: internal via must be import or migration`,
+    );
+  }
+  if (!Array.isArray(args.clauses) || args.clauses.length === 0) {
+    throw typedError(
+      internalDraft ? 'JUDGMENT_INPUT' : 'JUDGMENT_UNRATIFIED_CUT',
+      `${GOAL_TOOL} cut: ordinary cuts require non-empty clauses`,
+    );
+  }
+  if (!internalDraft && (args.provocation == null || typeof args.provocation !== 'object')) {
+    throw typedError(
+      'JUDGMENT_UNRATIFIED_CUT',
+      `${GOAL_TOOL} cut: ordinary cuts require a provocation citation`,
+    );
+  }
+  if (!internalDraft && (args.ratification == null || typeof args.ratification !== 'object')) {
+    throw typedError(
+      'JUDGMENT_UNRATIFIED_CUT',
+      `${GOAL_TOOL} cut: ordinary cuts require an owner ratification citation`,
+    );
+  }
 
-function atomicWrite(path, content) {
-  const tmp = `${path}.tmp.${process.pid}`;
-  try {
-    writeFileSync(tmp, content);
-    renameSync(tmp, path);
-  } catch (err) {
-    try { unlinkSync(tmp); } catch { /* tmp may not exist */ }
-    throw err;
+  const prepared = {
+    clauses: args.clauses.map(
+      (clause, index) => validateGoalClauseInput(clause, index, { ordinary: !internalDraft }),
+    ),
+    provocation: args.provocation == null
+      ? null
+      : sanitizeProvocation(
+        args.provocation,
+        internalDraft ? 'JUDGMENT_INPUT' : 'JUDGMENT_UNRATIFIED_CUT',
+      ),
+    diffNote: requireString(args, 'diff_note', GOAL_TOOL, 'cut'),
+    internalDraft,
+  };
+  if (args.ratification != null) {
+    prepared.ratification = sanitizeRatification(
+      args.ratification,
+      internalDraft ? 'JUDGMENT_INPUT' : 'JUDGMENT_UNRATIFIED_CUT',
+    );
   }
+  return prepared;
 }
 
-class UndoLog {
-  constructor() { this.entries = []; }
-
-  /** Record a file's prior bytes (null = did not exist) before it is touched. */
-  note(path) {
-    this.entries.push({ path, prior: existsSync(path) ? readFileSync(path, 'utf8') : null });
+function validateGoalCorrectArgs(args) {
+  const clauseId = requireString(args, 'clause_id', GOAL_TOOL, 'correct');
+  if (!/^c[1-9][0-9]*$/.test(clauseId)) {
+    throw typedError(
+      'JUDGMENT_INPUT',
+      `${GOAL_TOOL} correct: clause_id must match c<positive-integer>`,
+    );
   }
+  return {
+    clauseId,
+    text: requireString(args, 'text', GOAL_TOOL, 'correct'),
+  };
+}
 
-  restore() {
-    for (const { path, prior } of [...this.entries].reverse()) {
-      try {
-        if (prior === null) { try { unlinkSync(path); } catch { /* gone */ } } else atomicWrite(path, prior);
-      } catch { /* best-effort compensation */ }
+function validateGoalRetirableArgs(args, op, { createKey, idKey }) {
+  const create = hasOwn(args, createKey);
+  const remove = hasOwn(args, idKey) && args.remove === true;
+  if (Number(create) + Number(remove) !== 1) {
+    throw typedError(
+      'JUDGMENT_INPUT',
+      `${GOAL_TOOL} ${op}: select exactly one create or remove branch`,
+    );
+  }
+  if (create) {
+    if (hasOwn(args, idKey) || hasOwn(args, 'remove') || hasOwn(args, 'reason')) {
+      throw typedError(
+        'JUDGMENT_INPUT',
+        `${GOAL_TOOL} ${op}: select exactly one create or remove branch`,
+      );
     }
+    const input = {
+      branch: 'create',
+      value: requireString(args, createKey, GOAL_TOOL, op),
+    };
+    if (op === 'load_link') {
+      input.carries = requireString(args, 'carries', GOAL_TOOL, op);
+    }
+    return input;
+  }
+  if (hasOwn(args, createKey) || (op === 'load_link' && hasOwn(args, 'carries'))) {
+    throw typedError(
+      'JUDGMENT_INPUT',
+      `${GOAL_TOOL} ${op}: select exactly one create or remove branch`,
+    );
+  }
+  return {
+    branch: 'remove',
+    entryId: requireString(args, idKey, GOAL_TOOL, op),
+    reason: requireString(args, 'reason', GOAL_TOOL, op),
+  };
+}
+
+function validateGoalDispatch(args, internal) {
+  const op = args?.op;
+  let input;
+  switch (op) {
+    case 'cut':
+      input = validateGoalCutArgs(args, internal);
+      break;
+    case 'correct':
+      input = validateGoalCorrectArgs(args);
+      break;
+    case 'joint_link':
+      input = validateGoalRetirableArgs(
+        args,
+        op,
+        { createKey: 'joint', idKey: 'joint_link_id' },
+      );
+      break;
+    case 'load_link':
+      input = validateGoalRetirableArgs(
+        args,
+        op,
+        { createKey: 'clause', idKey: 'load_link_id' },
+      );
+      break;
+    case 'migrate':
+      input = validateGoalMigrateArgs(args);
+      break;
+    default:
+      throw typedError('JUDGMENT_INPUT', `${GOAL_TOOL}: unknown op "${String(op)}"`);
   }
+  return { op, input };
 }
 
 /**
- * Run record mutations + projection regen with compensating rollback: on any
- * failure the touched records are restored, projections re-regenerated from
- * the restored records, and JUDGMENT_PARTIAL_WRITE surfaces the cause.
+ * `op=migrate` takes no caller payload: goal v1, the tombstone, the merged
+ * state, the note, and all provenance are writer-constructed. Any extra key
+ * (records, provenance, intent ids, joint lists, note content) is rejected
+ * before idempotency so a malformed migrate can never be cached as a hit.
  */
-function commitWithProjections(cwd, undo, mutate) {
-  try {
-    mutate();
-    regenerateProjections(cwd);
-  } catch (err) {
-    undo.restore();
-    try { regenerateProjections(cwd); } catch { /* projections follow restored records on next regen */ }
-    throw typedError('JUDGMENT_PARTIAL_WRITE', `judgment write rolled back: ${err.message}`, err);
+function validateGoalMigrateArgs(args) {
+  const allowed = new Set(['op', 'idempotency_key']);
+  const extras = Object.keys(args).filter((key) => !allowed.has(key));
+  if (extras.length > 0) {
+    throw typedError(
+      'JUDGMENT_INPUT',
+      `${GOAL_TOOL} migrate: takes no payload; unexpected ${extras.sort().join(', ')}`,
+    );
+  }
+  return { branch: 'migrate' };
+}
+
+function goalWriteContext(cwd) {
+  const rawStore = createJudgmentStore(cwd);
+  const effective = effectiveStore(rawStore);
+  if (effective.hasPendingIntentKind('goal_migration')) {
+    throw typedError(
+      'JUDGMENT_INTENT_PENDING',
+      `${GOAL_TOOL}: goal_migration intent is still pending`,
+    );
   }
+  return { rawStore, effective };
 }
 
 // ---------------------------------------------------------------------------
-// Intent replay (the reconciler)
+// COMP-JUDGMENT-GOAL-MIGRATE S2 — completion predicate, wholesale fence
 // ---------------------------------------------------------------------------
 
-let _intentCounter = 0;
-function newIntentId() {
-  _intentCounter += 1;
-  return `intent-${Date.now()}-${process.pid}-${_intentCounter}`;
-}
+/**
+ * Durable state of the objective→goal cutover (design r4 / blueprint line 144).
+ * Completion is true ONLY when goal v1 carries `via:"migration"` with a
+ * non-empty intent id, the ledger holds the exact `judgment_goal_write/migrate`
+ * attestation for that id, no matching intent remains, and the objective
+ * position is retracted. Later ordinary goal versions do not invalidate it.
+ *
+ * @returns {{status: 'none'|'attribution_conflict'|'pending'|'revived'|'incomplete'|'complete',
+ *            attested: boolean, intent_id: string|null}}
+ *   `attested` is the weaker fence predicate: a migration-attested v1 exists,
+ *   regardless of whether the objective is currently retracted.
+ */
+function migrationCompletion(effective, raw) {
+  const v1 = effective.readGoalVersion(1);
+  const intentId = v1?.provenance?.intent_id;
+  if (
+    !v1
+    || v1.provenance?.via !== 'migration'
+    || typeof intentId !== 'string'
+    || intentId === ''
+  ) {
+    return { status: 'none', attested: false, intent_id: null };
+  }
 
-async function callGuard(cwd, { slug, from, to }) {
-  // Lazy import: keeps this module leaf-light and cycle-free; the adapter is
-  // only loaded where capabilities.guard is on.
-  const { guardedTransition } = await import('../server/lifecycle-guard.js');
-  return guardedTransition({ featureCode: slug, from, to, workspaceRoot: cwd, mode: 'judgment' });
-}
+  const attestations = effective.readLedgerEvents().filter(
+    (event) => event.kind === 'attest' && event.intent_id === intentId,
+  );
+  if (attestations.length === 0) {
+    return { status: 'none', attested: false, intent_id: intentId };
+  }
+  // C11: attribution-only matching is not enough — the attestation resolving a
+  // migration intent must be exactly this tool/op, or the cutover is forged.
+  const mismatch = attestations.find(
+    (event) => event.tool !== GOAL_TOOL || event.op !== 'migrate',
+  );
+  if (mismatch) {
+    return { status: 'attribution_conflict', attested: false, intent_id: intentId };
+  }
 
-/** Apply an intent payload idempotently (joint write, deduped events, predictions). */
-function applyPayload(store, payload) {
-  if (payload.joint) store.writeJoint(payload.joint);
-  if (Array.isArray(payload.events) && payload.events.length > 0) {
-    const existing = new Set(store.readLedgerEvents().map((e) => JSON.stringify(e)));
-    for (const event of payload.events) {
-      if (!existing.has(JSON.stringify(event))) store.appendLedgerEvent(event);
-    }
+  // "No matching intent remains" is a binding conjunct. The effective view
+  // already hides an artifact whose intent is pending, so this is normally
+  // unreachable; it stays as the fail-closed reading of the raw store.
+  if (raw.readIntents().some((intent) => intent.id === intentId)) {
+    return { status: 'pending', attested: true, intent_id: intentId };
+  }
+
+  const objectiveStatus = effective.derivePositionStatus('objective');
+  if (objectiveStatus === 'retracted') {
+    return { status: 'complete', attested: true, intent_id: intentId };
   }
-  for (const prediction of payload.predictions ?? []) store.writePrediction(prediction);
+  return {
+    status: objectiveStatus === 'live' ? 'revived' : 'incomplete',
+    attested: true,
+    intent_id: intentId,
+  };
 }
 
 /**
- * Replay every pending intent. MUST be called with the judgment lock held.
- * Guard state is authoritative for the edge (re-issuing the transition:
- * applied/replayed → apply payload; refused → drop intent, divergence
- * surfaced; unreachable → keep intent for the next replay); the intent is
- * authoritative for the payload — recovery restores the WHOLE mutation,
- * never a bare state flip.
- */
-/**
- * Drop an intent DURABLY: the ledger note lands (idempotent on its title,
- * which embeds the intent id) BEFORE the intent is cleared. If the append
- * fails the intent survives and the error propagates — a dropped divergence
- * must never silently vanish.
+ * The wholesale pre-cutover fence (C5). Applied ONCE, before the executor, to
+ * every non-`migrate` goal op — never copied into the ordinary executors.
+ * `goalWriteContext` runs first so a surviving migration intent keeps its
+ * `JUDGMENT_INTENT_PENDING` precedence after replay.
  */
-function dropIntentDurably(store, intent, reason, detail) {
-  const payload = intent.payload ?? {};
-  const title = `intent dropped (${intent.id}): ${payload.slug} ${payload.from} → ${payload.to} — ${reason}`;
-  const already = store.readLedgerEvents().some((e) => e.kind === 'note' && e.title === title);
-  if (!already) {
-    store.appendLedgerEvent({
-      kind: 'note',
-      title,
-      body: JSON.stringify(detail),
-      anchor: `joint:${payload.slug}`,
-      provenance: stampProvenance(),
-    });
+function assertGoalMigrationFence(cwd, op) {
+  const { rawStore, effective } = goalWriteContext(cwd);
+  const completion = migrationCompletion(effective, rawStore);
+  if (effective.derivePositionStatus('objective') === 'live' && !completion.attested) {
+    throw typedError(
+      'JUDGMENT_MIGRATION_REQUIRED',
+      `${GOAL_TOOL} ${op}: legacy objective is live; run ${GOAL_TOOL} op=migrate before any other goal operation`,
+    );
   }
-  store.clearIntent(intent.id);
 }
 
-async function replayIntentsLocked(cwd) {
-  const store = createJudgmentStore(cwd);
-  const intents = store.readIntents();
-  let replayed = 0;
-  let mutated = false;
-  const divergences = [];
-  for (const intent of intents) {
-    const payload = intent.payload ?? {};
-    // Population invariant FIRST — before any guard call, so recovery can
-    // never advance the authoritative guard for an intent it is about to
-    // drop (stacked intents must not split guard state from records).
-    if (payload.to === 'under_test') {
-      const occupant = store.listJoints().find((j) => j.slug !== payload.slug && j.state === 'under_test');
-      if (occupant) {
-        dropIntentDurably(store, intent, `ONE-UNDER-TEST refused on replay (${occupant.slug} already under test)`, { occupant: occupant.slug });
-        divergences.push({ intent: intent.id, slug: payload.slug, refused: true, oneUnderTest: occupant.slug });
-        mutated = true;
-        continue;
-      }
-    }
-    if (guardEnabled(cwd) && payload.to && payload.from !== payload.to) {
-      const guard = await callGuard(cwd, { slug: payload.slug, from: payload.from, to: payload.to });
-      if (!guard.applied) {
-        // guard unreachable → keep the intent; the next replay retries
-        if (guard.error) continue;
-        // The crash window: the guard ALREADY advanced this edge in the
-        // interrupted attempt, so re-issuing is refused with currentState at
-        // the target. Guard state is authoritative for the edge — the intent
-        // is authoritative for the payload: roll the whole mutation forward.
-        const alreadyAdvanced = guard.currentState === payload.to;
-        if (!alreadyAdvanced) {
-          if (!guard.refused) continue; // ambiguous non-verdict → retry later
-          dropIntentDurably(store, intent, 'refused by guard', {
-            verdict: guard.verdict ?? null, currentState: guard.currentState ?? null,
-          });
-          divergences.push({ intent: intent.id, slug: payload.slug, refused: true, verdict: guard.verdict ?? null });
-          mutated = true;
-          continue;
-        }
-      }
-    }
-    applyPayload(store, payload);
-    store.clearIntent(intent.id);
-    replayed += 1;
-    mutated = true;
+function resolveEffectiveGoalClause(effective, reference, { ledger = false } = {}) {
+  const pattern = ledger
+    ? /^goal:v([1-9][0-9]*)#(c[1-9][0-9]*)$/
+    : /^v([1-9][0-9]*)#(c[1-9][0-9]*)$/;
+  const match = pattern.exec(reference);
+  if (!match) {
+    throw typedError('JUDGMENT_REF', `goal clause reference ${reference} is invalid`);
+  }
+  const version = Number(match[1]);
+  const clauseId = match[2];
+  const goal = effective.readGoalVersion(version);
+  const clause = goal?.clauses?.find((entry) => entry.id === clauseId);
+  if (!goal || !clause) {
+    throw typedError('JUDGMENT_REF', `goal clause reference ${reference} does not resolve`);
   }
-  if (mutated) regenerateProjections(cwd);
-  return { replayed, divergences };
+  return { goal, clause };
 }
 
-/**
- * Public reconciler: replay pending intents under the lock. Also runs
- * automatically at the head of every write op and getJudgmentState.
- */
-export async function replayPendingIntents(cwd) {
-  const release = await acquireJudgmentLock(cwd);
-  try {
-    return await replayIntentsLocked(cwd);
-  } finally {
-    release();
+function assertGoalStateSemantics(effective, state) {
+  // Calling the high-water allocator validates every extant ID, including
+  // retired entries, without consuming the returned candidate.
+  allocateStableEntryId(state, 'joints', 'gj');
+  allocateStableEntryId(state, 'load_links', 'gl');
+  for (const link of activeEntries(state.joints)) {
+    if (!effective.readJoint(link.joint)) {
+      throw typedError(
+        'JUDGMENT_REF',
+        `goal joint link ${link.id}: joint ${link.joint} does not resolve`,
+      );
+    }
+  }
+  for (const link of activeEntries(state.load_links)) {
+    resolveEffectiveGoalClause(effective, link.clause);
   }
+  assertValidRecord('goal_state', state);
 }
 
-// ---------------------------------------------------------------------------
-// Op wrapper: validate → (idempotency) → lock → replay → execute → audit
-// ---------------------------------------------------------------------------
+function writeGoalState(cwd, rawStore, effective, state) {
+  assertGoalStateSemantics(effective, state);
+  persistAggregate(cwd, rawStore._goalStatePath(), {
+    created: !existsSync(rawStore._goalStatePath()),
+    write: () => rawStore.writeGoalState(state),
+  });
+}
 
-async function runOp(cwd, args, { tool, validate, execute }) {
-  if (args?.provenance !== undefined) {
-    throw typedError('JUDGMENT_INPUT', `${tool}: provenance is writer-stamped and cannot be set by the caller`);
-  }
-  const prepared = validate ? validate() : undefined; // sync, BEFORE idempotency (A1/A4)
+const GOAL_EXECUTORS = Object.freeze({
+  cut(cwd, input, internal) {
+    const { rawStore, effective } = goalWriteContext(cwd);
+    const rawChain = rawStore.readGoalChain();
+    const version = (rawChain.at(-1)?.version ?? 0) + 1;
+    const provenance = stampProvenance(internal);
+    const record = {
+      version,
+      clauses: [],
+      provocation: input.provocation,
+      diff_note: input.diffNote,
+      provenance,
+    };
+    if (input.ratification !== undefined) record.ratification = input.ratification;
+    for (const inputClause of input.clauses) {
+      const clause = {
+        id: allocateStableEntryId(record, 'clauses', 'c'),
+        text: inputClause.text,
+        channel: inputClause.channel,
+        elicitation: inputClause.elicitation,
+        provenance,
+        trace: [],
+      };
+      if (inputClause.via !== undefined) clause.via = inputClause.via;
+      record.clauses.push(clause);
+    }
+    assertValidRecord('goal_version', record);
 
-  const doWrite = async () => {
-    const release = await acquireJudgmentLock(cwd);
-    try {
-      await replayIntentsLocked(cwd);
-      return await execute(prepared);
-    } finally {
-      release();
+    const undo = new UndoLog();
+    const path = join(rawStore._goalDir(), `v${version}.json`);
+    commitWithProjections(cwd, undo, () => {
+      undo.created(path);
+      rawStore.writeGoalVersion(record);
+    });
+    return {
+      op: 'cut',
+      version,
+      ref: `goal:v${version}`,
+      ratified: record.ratification != null,
+    };
+  },
+
+  correct(cwd, input, internal) {
+    const { rawStore, effective } = goalWriteContext(cwd);
+    const current = effective.latestGoalVersion();
+    if (!current) {
+      throw typedError('JUDGMENT_REF', `${GOAL_TOOL} correct: no effective current goal version`);
+    }
+    const record = cloneRecord(current);
+    const clause = record.clauses.find((entry) => entry.id === input.clauseId);
+    if (!clause) {
+      throw typedError(
+        'JUDGMENT_REF',
+        `${GOAL_TOOL} correct: current goal v${record.version} has no clause ${input.clauseId}`,
+      );
+    }
+    if (clause.text === input.text) {
+      throw typedError(
+        'JUDGMENT_INPUT',
+        `${GOAL_TOOL} correct: clause ${input.clauseId} wording is unchanged`,
+      );
+    }
+    const provenance = stampProvenance(internal);
+    clause.trace.push(correctionTrace({ text: clause.text }, provenance));
+    clause.text = input.text;
+    assertValidRecord('goal_version', record);
+
+    const undo = new UndoLog();
+    const path = join(rawStore._goalDir(), `v${record.version}.json`);
+    commitWithProjections(cwd, undo, () => {
+      undo.capture(path);
+      rawStore.replaceGoalVersion(record.version, record);
+    });
+    return {
+      op: 'correct',
+      version: record.version,
+      clause_id: clause.id,
+    };
+  },
+
+  joint_link(cwd, input, internal) {
+    const { rawStore, effective } = goalWriteContext(cwd);
+    const provenance = stampProvenance(internal);
+    const state = cloneRecord(effective.readGoalState() ?? {
+      joints: [],
+      load_links: [],
+      provenance,
+    });
+    let link;
+    if (input.branch === 'create') {
+      if (!effective.readJoint(input.value)) {
+        throw typedError(
+          'JUDGMENT_REF',
+          `${GOAL_TOOL} joint_link: joint ${input.value} does not resolve`,
+        );
+      }
+      link = {
+        id: allocateStableEntryId(state, 'joints', 'gj'),
+        joint: input.value,
+        provenance,
+        removed: null,
+      };
+      state.joints.push(link);
+    } else {
+      link = state.joints.find((entry) => entry.id === input.entryId);
+      if (!link) {
+        throw typedError(
+          'JUDGMENT_NOT_FOUND',
+          `${GOAL_TOOL} joint_link: association ${input.entryId} not found`,
+        );
+      }
+      if (link.removed !== null) {
+        throw typedError(
+          'JUDGMENT_CONFLICT',
+          `${GOAL_TOOL} joint_link: association ${link.id} is already removed`,
+        );
+      }
+      link.removed = removedBlock(input.reason, provenance);
+    }
+    state.provenance = provenance;
+    writeGoalState(cwd, rawStore, effective, state);
+    return {
+      op: 'joint_link',
+      id: link.id,
+      removed: link.removed !== null,
+    };
+  },
+
+  load_link(cwd, input, internal) {
+    const { rawStore, effective } = goalWriteContext(cwd);
+    const provenance = stampProvenance(internal);
+    const state = cloneRecord(effective.readGoalState() ?? {
+      joints: [],
+      load_links: [],
+      provenance,
+    });
+    let link;
+    if (input.branch === 'create') {
+      resolveEffectiveGoalClause(effective, input.value);
+      link = {
+        id: allocateStableEntryId(state, 'load_links', 'gl'),
+        clause: input.value,
+        carries: input.carries,
+        provenance,
+        removed: null,
+      };
+      state.load_links.push(link);
+    } else {
+      link = state.load_links.find((entry) => entry.id === input.entryId);
+      if (!link) {
+        throw typedError(
+          'JUDGMENT_NOT_FOUND',
+          `${GOAL_TOOL} load_link: association ${input.entryId} not found`,
+        );
+      }
+      if (link.removed !== null) {
+        throw typedError(
+          'JUDGMENT_CONFLICT',
+          `${GOAL_TOOL} load_link: association ${link.id} is already removed`,
+        );
+      }
+      link.removed = removedBlock(input.reason, provenance);
+    }
+    state.provenance = provenance;
+    writeGoalState(cwd, rawStore, effective, state);
+    return {
+      op: 'load_link',
+      id: link.id,
+      removed: link.removed !== null,
+    };
+  },
+
+  /**
+   * One-shot, fail-closed cutover. `migrate` is exempt from the wholesale
+   * fence (it is the op that lifts it) but not from intent precedence: a
+   * migration intent that survived replay is reported, never duplicated.
+   * Completion and its repair diagnostics are checked before the legality
+   * window so a rerun is a no-op and a revived objective names its repair.
+   * Every refusal below performs no canonical write.
+   */
+  async migrate(cwd, input, internal) {
+    const { rawStore, effective } = goalWriteContext(cwd);
+    const completion = migrationCompletion(effective, rawStore);
+
+    if (completion.status === 'attribution_conflict') {
+      throw migrationConflict({ id: completion.intent_id }, 'durable attestation attribution conflicts');
+    }
+    if (completion.status === 'complete') {
+      // No new record: republish projections so a stale generated surface
+      // converges, and report the original publication's intent id. There is
+      // nothing to roll back — the migration is already published — so a
+      // regeneration failure keeps the published-migration semantics: report
+      // stale and repair on the next regeneration/read.
+      try {
+        regenerateProjections(cwd);
+      } catch (err) {
+        throw typedError(
+          'JUDGMENT_PROJECTION_STALE',
+          `intent ${completion.intent_id} canonical effects are committed but projections are stale: ${err.message}`,
+          err,
+        );
+      }
+      return {
+        op: 'migrate',
+        status: 'already migrated',
+        version: 1,
+        ref: 'goal:v1',
+        intent_id: completion.intent_id,
+      };
+    }
+    if (completion.status === 'revived') {
+      throw typedError(
+        'JUDGMENT_MIGRATION_CONFLICT',
+        `${GOAL_TOOL} migrate: migration-attested goal v1 exists but objective is live; append retracted:true through judgment_position_create, then retry`,
+      );
     }
-  };
 
-  let result;
-  let cached = false;
-  if (args?.idempotency_key) {
-    ({ result, cached } = await checkOrInsert(cwd, `${tool}:${args.idempotency_key}`, doWrite));
-  } else {
-    result = await doWrite();
-  }
+    // Legality window: a live effective objective plus an empty goal chain in
+    // BOTH views. A sidecar does not close the window; a hidden or ordinary
+    // goal version does.
+    if (effective.readGoalChain().length > 0 || rawStore.readGoalChain().length > 0) {
+      throw typedError(
+        'JUDGMENT_MIGRATION_CONFLICT',
+        `${GOAL_TOOL} migrate: goal chain is non-empty without a durable migration-attested v1`,
+      );
+    }
+    if (effective.derivePositionStatus('objective') !== 'live') {
+      throw typedError(
+        'JUDGMENT_MIGRATION_CONFLICT',
+        `${GOAL_TOOL} migrate: legacy objective is not live and no durable migration is complete`,
+      );
+    }
 
-  if (!cached) {
-    // Best-effort audit AFTER commit (A5) — never let audit failure surface.
-    try { appendEvent(cwd, { tool, result }); } catch { /* best-effort */ }
-  }
-  return result;
+    const intentId = newIntentId();
+    const provenance = stampProvenance({ ...internal, via: 'migration', intentId });
+    const intent = buildGoalMigrationIntent(cwd, rawStore, effective, { intentId, provenance });
+    rawStore.persistIntent(intent);
+    syncManifest(cwd, [rawStore._intentPath(intent.id)]);
+    await publishIntentWith(cwd, rawStore, intent, internal.appliers ?? INTENT_APPLIERS);
+    return {
+      op: 'migrate',
+      status: 'migrated',
+      version: 1,
+      ref: 'goal:v1',
+      intent_id: intentId,
+    };
+  },
+});
+
+/**
+ * One op-discriminated writer for goal versions and their mutable sidecar.
+ * `internal.appliers` is the C13 unit-injection seam (never MCP-reachable):
+ * it threads a substitute intent-applier map through replay for failure tests.
+ */
+export async function judgmentGoalWrite(cwd, args, internal = {}) {
+  return runOp(cwd, args, {
+    tool: GOAL_TOOL,
+    validate: () => validateGoalDispatch(args, internal),
+    execute: ({ op, input }) => {
+      // One central fence for the whole goal store (C5), after replay and
+      // under the held lock. `migrate` is the op that lifts it.
+      if (op !== 'migrate') assertGoalMigrationFence(cwd, op);
+      return GOAL_EXECUTORS[op](cwd, input, internal);
+    },
+  }, internal.appliers);
 }
 
 // ---------------------------------------------------------------------------
@@ -388,6 +2864,20 @@ export async function judgmentPositionCreate(cwd, args, internal = {}) {
     },
     execute: (record) => {
       const store = createJudgmentStore(cwd);
+      // C6 — terminal objective retirement. Store-backed, so it lives here
+      // (after replay, under the lock), never in synchronous validation. A
+      // `retracted:true` tombstone stays legal: it is the repair path for a
+      // revived objective.
+      if (
+        record.slug === 'objective'
+        && record.retracted !== true
+        && goalCutoverComplete(effectiveStore(store))
+      ) {
+        throw typedError(
+          'JUDGMENT_OBJECTIVE_RETIRED',
+          'judgment_position_create: objective is retired after goal cutover; use judgment_goal_write for goal changes (retracted:true remains legal)',
+        );
+      }
       if (record.supersedes) {
         const [targetSlug, revPart] = record.supersedes.split('#r');
         if (!store.readPositionRevision(targetSlug, Number(revPart))) {
@@ -398,9 +2888,7 @@ export async function judgmentPositionCreate(cwd, args, internal = {}) {
       let written;
       commitWithProjections(cwd, undo, () => {
         written = store.writePositionRevision(record);
-        undo.note(written.path); // written before noted? note AFTER write would store new bytes —
-        // the file is brand new, so restore() must delete it: record prior=null explicitly.
-        undo.entries[undo.entries.length - 1].prior = null;
+        undo.created(written.path);
       });
       return { slug: record.slug, rev: written.rev, ref: written.ref, status: store.derivePositionStatus(record.slug) };
     },
@@ -469,7 +2957,7 @@ export async function judgmentPositionAmend(cwd, args, internal = {}) {
       let written;
       commitWithProjections(cwd, undo, () => {
         written = store.writePositionRevision(record);
-        undo.entries.push({ path: written.path, prior: null });
+        undo.created(written.path);
       });
       return { slug: args.slug, rev: written.rev, ref: written.ref };
     },
@@ -522,7 +3010,7 @@ export async function judgmentJointAdd(cwd, args, internal = {}) {
       }
       const undo = new UndoLog();
       commitWithProjections(cwd, undo, () => {
-        undo.entries.push({ path: store._jointPath(record.slug), prior: null });
+        undo.created(store._jointPath(record.slug));
         store.writeJoint(record);
       });
       return { slug: record.slug, state: record.state, rank: record.rank };
@@ -584,7 +3072,8 @@ export async function judgmentTransition(cwd, args, internal = {}) {
       const joint = store.readJoint(args.slug);
       if (!joint) throw typedError('JUDGMENT_NOT_FOUND', `joint ${args.slug} does not exist`);
       const from = joint.state;
-      const provenance = stampProvenance(internal);
+      const intentId = newIntentId();
+      const provenance = stampProvenance({ ...internal, intentId });
       const events = [];
       const mutated = { ...joint };
 
@@ -628,7 +3117,13 @@ export async function judgmentTransition(cwd, args, internal = {}) {
           if (other) {
             throw typedError('JUDGMENT_CONFLICT', `ONE-UNDER-TEST: joint ${other.slug} is already under test`);
           }
-          const pending = store.readIntents().find((i) => i.payload?.to === 'under_test' && i.payload?.slug !== args.slug);
+          const pending = store.readIntents().find(
+            (intent) => (
+              intent.kind === 'transition'
+              && intent.payload?.to === 'under_test'
+              && intent.payload?.slug !== args.slug
+            ),
+          );
           if (pending) {
             throw typedError('JUDGMENT_CONFLICT', `ONE-UNDER-TEST: pending intent ${pending.id} already targets under_test for ${pending.payload.slug}`);
           }
@@ -690,58 +3185,43 @@ export async function judgmentTransition(cwd, args, internal = {}) {
 
       // Intent-first: persist the COMPLETE mutation before the guard call.
       const intent = {
-        id: newIntentId(),
-        op: 'judgment_transition',
+        id: intentId,
+        kind: 'transition',
+        tool: 'judgment_transition',
+        op: 'transition',
         payload: { slug: args.slug, from, to: mutated.state, joint: mutated, events, predictions: [] },
         created_at: provenance.written_at,
       };
       assertValidRecord('pending_intent', intent);
       store.persistIntent(intent);
+      syncManifest(cwd, [store._intentPath(intent.id)]);
 
-      let guardInfo = null;
-      if (isEdge && guardEnabled(cwd)) {
-        const guard = await callGuard(cwd, { slug: args.slug, from, to: args.to });
-        if (!guard.applied) {
-          if (guard.refused) {
-            // Local graph said legal, guard said no — surfaced, never hidden,
-            // and DURABLY: the drop lands as a ledger note before the intent
-            // clears, so the refusal survives even if the caller drops the
-            // transient result.
-            dropIntentDurably(store, intent, 'refused by guard', {
-              verdict: guard.verdict ?? null, currentState: guard.currentState ?? null,
-            });
-            regenerateProjections(cwd);
-            return {
-              applied: false,
-              refused: true,
-              slug: args.slug,
-              from,
-              to: args.to,
-              guard: { verdict: guard.verdict ?? null, ledgerRef: guard.ledgerRef ?? null, currentState: guard.currentState ?? null },
-              divergence: true,
-            };
-          }
-          // Guard ERROR (unreachable/timeout) is ambiguous — the guard may
-          // have advanced before the response was lost. KEEP the intent: the
-          // reconciler resolves it on the next write/read (fresh verdict →
-          // roll forward; currentState at target → roll forward; genuine
-          // refusal → durable drop).
-          throw typedError('JUDGMENT_GUARD_UNAVAILABLE', `guard transition failed closed (intent ${intent.id} kept for replay): ${guard.error?.message ?? JSON.stringify(guard.error)}`, guard.error);
-        }
-        guardInfo = { verdict: guard.verdict ?? null, ledgerRef: guard.ledgerRef ?? null, currentState: guard.currentState ?? null };
+      const publication = await publishIntentLocked(cwd, store, intent);
+      if (publication.status === 'blocked') {
+        throw typedError(
+          'JUDGMENT_GUARD_UNAVAILABLE',
+          `guard transition failed closed (intent ${intent.id} kept for replay): ${publication.error?.message ?? publication.reason}`,
+          publication.error,
+        );
+      }
+      if (publication.status === 'refused') {
+        return {
+          applied: false,
+          refused: true,
+          slug: args.slug,
+          from,
+          to: args.to,
+          guard: publication.guard ?? {
+            verdict: null,
+            ledgerRef: null,
+            currentState: null,
+          },
+          divergence: true,
+        };
       }
-
-      const undo = new UndoLog();
-      commitWithProjections(cwd, undo, () => {
-        undo.note(store._jointPath(args.slug));
-        undo.note(store._ledgerPath());
-        for (const p of intent.payload.predictions) undo.note(store._predictionPath(p.id));
-        applyPayload(store, intent.payload);
-      });
-      store.clearIntent(intent.id);
 
       const result = { applied: true, slug: args.slug, from, to: mutated.state, state: mutated.state, rank: mutated.rank };
-      if (guardInfo) result.guard = guardInfo;
+      if (publication.guard) result.guard = publication.guard;
       return result;
     },
   });
@@ -755,7 +3235,7 @@ const LEDGER_PASSTHROUGH_KEYS = [
   'kind', 'title', 'body', 'refs', 'rejected', 'conviction', 'trigger',
   'open_joints', 'prediction', 'disposition', 'recall_verdict', 'attribution',
   'prediction_ref', 'prediction_grade', 'reason', 'anchor', 'rank_change',
-  'elicitation',
+  'elicitation', 'rests_on',
 ];
 
 function nextPredictionId(store) {
@@ -773,6 +3253,12 @@ export async function judgmentLedgerAppend(cwd, args, internal = {}) {
   return runOp(cwd, args, {
     tool: 'judgment_ledger_append',
     validate: () => {
+      if (args.kind === 'attest') {
+        throw typedError(
+          'JUDGMENT_INPUT',
+          'judgment_ledger_append: attest is a writer-reserved intent publication event',
+        );
+      }
       const event = { provenance: stampProvenance(internal) };
       for (const key of LEDGER_PASSTHROUGH_KEYS) {
         if (args[key] !== undefined) event[key] = args[key];
@@ -780,11 +3266,33 @@ export async function judgmentLedgerAppend(cwd, args, internal = {}) {
       assertValidRecord('ledger_event', event);
       return event;
     },
-    execute: (event) => {
+    execute: async (event) => {
       const store = createJudgmentStore(cwd);
 
       let spawned = null;
       const isCommitDecide = event.kind === 'decide' && event.trigger !== undefined;
+      if (isCommitDecide && (event.rests_on?.length ?? 0) > 0) {
+        const effective = effectiveStore(store);
+        if (effective.hasPendingIntentKind('goal_migration')) {
+          throw typedError(
+            'JUDGMENT_INTENT_PENDING',
+            'judgment_ledger_append: goal_migration intent is still pending',
+          );
+        }
+        for (const reference of event.rests_on) {
+          const { clause } = resolveEffectiveGoalClause(
+            effective,
+            reference,
+            { ledger: true },
+          );
+          if (clause.channel === 'inferred') {
+            throw typedError(
+              'JUDGMENT_INFERRED_COMMIT',
+              `judgment_ledger_append: ${reference} is inferred and may not carry a commit`,
+            );
+          }
+        }
+      }
       const isConstructDisposition = event.disposition === 'CONSTRUCT';
       if ((isCommitDecide || isConstructDisposition) && event.prediction) {
         spawned = {
@@ -808,12 +3316,42 @@ export async function judgmentLedgerAppend(cwd, args, internal = {}) {
         assertValidRecord('prediction', graded);
       }
 
+      // GOV-COMPOSE-SEAM-1 `canon-on-decisions` P2 — the SmartMemory write.
+      //
+      // BEFORE the local commit, deliberately. Under D1 the SmartMemory
+      // decision is the canon and the markdown is a projection, so the canon
+      // is written first and the projection follows. It is also the only
+      // ordering that fails safely: a remote failure throws and nothing local
+      // is written, whereas committing locally first would leave a decision
+      // that exists in the projection and nowhere else.
+      //
+      // The seq is computed here rather than taken from `appendLedgerEvent`
+      // because the key needs it before the append. Safe: we hold the advisory
+      // lock, so the length cannot move underneath us. If the local commit
+      // below then fails, a retry recomputes the SAME seq, hits the sidecar,
+      // skips the remote write and completes the local one.
+      //
+      // `writeJudgmentDecision` is FAIL-CLOSED and returns null only when the
+      // coupling is disabled. A live entry carrying an inferred conviction is
+      // written on the inferred confidence scale and flagged
+      // `conviction_review_required` for a later ruling — the P2.5 gate blocks
+      // the BACKFILL, not new entries, which would otherwise be unrecordable.
+      const nextSeq = store.readLedgerEvents().length + 1;
+      const mapped = ledgerEntryToDecision(event, nextSeq);
+      if (mapped) {
+        await writeJudgmentDecision(cwd, mapped);
+      }
+
       const undo = new UndoLog();
       let seq;
       commitWithProjections(cwd, undo, () => {
-        undo.note(store._ledgerPath());
-        if (spawned) undo.entries.push({ path: store._predictionPath(spawned.id), prior: null });
-        if (graded) undo.note(store._predictionPath(graded.id));
+        undo.capture(store._ledgerPath());
+        if (spawned) {
+          const path = store._predictionPath(spawned.id);
+          if (existsSync(path)) undo.capture(path);
+          else undo.created(path);
+        }
+        if (graded) undo.capture(store._predictionPath(graded.id));
         ({ seq } = store.appendLedgerEvent(event));
         if (spawned) store.writePrediction(spawned);
         if (graded) store.writePrediction(graded);
@@ -824,7 +3362,7 @@ export async function judgmentLedgerAppend(cwd, args, internal = {}) {
       if (graded) result.graded = graded.id;
       return result;
     },
-  });
+  }, internal.appliers);
 }
 
 // ---------------------------------------------------------------------------
@@ -836,42 +3374,84 @@ export async function judgmentLedgerAppend(cwd, args, internal = {}) {
  * recent ledger. Small result (AUDIT-19) — titles and refs, never full
  * document text. Replays pending intents first (reconciler-on-read).
  */
-export async function getJudgmentState(cwd) {
+/**
+ * Causal ancestry for one position (COMP-JUDGMENT-PRECEDENT slice A).
+ *
+ * Read-only counterpart to getJudgmentState, which returns latest-only and so
+ * cannot answer "what did this replace, and what did we believe then". Takes the
+ * same lock + intent replay so the trace reflects committed state, not a
+ * half-applied intent queue.
+ */
+export async function getJudgmentTrace(cwd, slug) {
+  if (typeof slug !== 'string' || slug.trim() === '') {
+    throw typedError('JUDGMENT_INPUT', 'get_judgment_trace: slug is required');
+  }
   const release = await acquireJudgmentLock(cwd);
-  let replay;
   try {
-    replay = await replayIntentsLocked(cwd);
+    await replayIntentsLocked(cwd);
+    const store = effectiveStore(createJudgmentStore(cwd));
+    return tracePosition(store, slug.trim());
   } finally {
     release();
   }
-  const store = createJudgmentStore(cwd);
-  const positions = store.listPositionSlugs().map((slug) => {
-    const latest = store.latestPositionRevision(slug);
+}
+
+export async function getJudgmentState(cwd) {
+  const release = await acquireJudgmentLock(cwd);
+  try {
+    const replay = await replayIntentsLocked(cwd);
+    regenerateProjections(cwd);
+    const store = effectiveStore(createJudgmentStore(cwd));
+    // Prebuilt index — see COMP-JUDGMENT-PRECEDENT: without it this loop is
+    // O(n^2) over the store.
+    const supersession = buildSupersessionIndex(store);
+    const positions = store.listPositionSlugs().map((slug) => {
+      const latest = store.latestPositionRevision(slug);
+      return {
+        slug,
+        ref: `${slug}#r${latest.rev}`,
+        status: store.derivePositionStatus(slug, supersession),
+        conviction: latest.conviction?.level ?? null,
+      };
+    });
+    const joints = store.listJoints().map((j) => ({
+      slug: j.slug,
+      state: j.state,
+      resolve_by: j.resolve_by,
+      cost: j.cost,
+      rank: j.rank,
+    }));
+    const openPredictions = store.listPredictions({ status: 'open' })
+      .map((p) => ({ id: p.id, text: p.text, context: p.context }));
+    const recentLedger = store.readLedgerEvents().slice(-10)
+      .map((e) => ({ kind: e.kind, title: e.title }));
+    const people = store.listPeople();
+    const latestGoal = store.latestGoalVersion();
     return {
-      slug,
-      ref: `${slug}#r${latest.rev}`,
-      status: store.derivePositionStatus(slug),
-      conviction: latest.conviction?.level ?? null,
+      positions,
+      joints,
+      under_test: joints.filter((j) => j.state === 'under_test').map((j) => j.slug),
+      open_predictions: openPredictions,
+      recent_ledger: recentLedger,
+      intents_replayed: replay.replayed,
+      divergences: replay.divergences,
+      counts: {
+        people: {
+          spoken: people.filter(
+            (person) => person.facts.some((fact) => fact.channel === 'said'),
+          ).length,
+          stub: people.filter(
+            (person) => !person.facts.some((fact) => fact.channel === 'said'),
+          ).length,
+        },
+        entities: store.listSituationEntities().length,
+        goal: {
+          version: latestGoal?.version ?? null,
+          ratified: Boolean(latestGoal?.ratification),
+        },
+      },
     };
-  });
-  const joints = store.listJoints().map((j) => ({
-    slug: j.slug,
-    state: j.state,
-    resolve_by: j.resolve_by,
-    cost: j.cost,
-    rank: j.rank,
-  }));
-  const openPredictions = store.listPredictions({ status: 'open' })
-    .map((p) => ({ id: p.id, text: p.text, context: p.context }));
-  const recentLedger = store.readLedgerEvents().slice(-10)
-    .map((e) => ({ kind: e.kind, title: e.title }));
-  return {
-    positions,
-    joints,
-    under_test: joints.filter((j) => j.state === 'under_test').map((j) => j.slug),
-    open_predictions: openPredictions,
-    recent_ledger: recentLedger,
-    intents_replayed: replay.replayed,
-    divergences: replay.divergences,
-  };
+  } finally {
+    release();
+  }
 }