@tacuchi/agent-workflow-cli 25.7.0 → 25.9.0

package/dist/application/flow/submit.js

@@ -25,32 +25,88 @@ import { authorizeEffects, touchesTheWorld, } from "../../domain/capability/effe
 import { AttemptLedger } from "../../domain/capability/protocol.js";
 import { DEFAULT_CORE_DOCS_CANON, coreDocumentKindForPath } from "../../domain/docs-canon.js";
 import { claimedSeal, parseFlowAnswer, spendsAttempt, } from "../../domain/flow/answer.js";
-import { FIX_PREVIEW_TRANSITION, SETTLEMENT_READINGS, actionOf, alternativesOf, approvalGrantOf, effectsOf, internalActionOf, isRouteEvaluation, proposalContractOf, publishApprovalOf, routeControlOf, scopesSources, } from "../../domain/flow/authority.js";
+import { FIX_PREVIEW_TRANSITION, SETTLEMENT_READINGS, actionOf, alternativesOf, approvalGrantOf, effectsOf, internalActionOf, isRouteEvaluation, occurrenceAt, proposalContractOf, publishApprovalOf, reentryOf, routeControlOf, scopesSources, } from "../../domain/flow/authority.js";
 import { effectApprovalDigest } from "../../domain/flow/authorization.js";
+import { isBatchReview } from "../../domain/flow/batch-review.js";
+import { routeShape, settlementList, sourceList } from "../../domain/flow/decision-schema.js";
 import { PAUSE_LABEL, STOP_LABEL, stepOf, } from "../../domain/flow/directive.js";
-import { executionVerdict } from "../../domain/flow/execution-result.js";
+import { batchCreditVerdict, executionVerdict, } from "../../domain/flow/execution-result.js";
 import { ROUTE_ACCEPT_LABEL, ROUTE_ADJUST_LABEL, isRouteDisposition, } from "../../domain/flow/route.js";
-import { applyTransition, checkAgainstJourney, currentBatchIteration, restatesLastEvent, settlementAmbiguous, withApproval, withAttempt, withBoundary, withContinuation, withDecisionPreparation, withEvent, withFixPreview, withHandoff, withObservation, withPlanExecBatchStageForTransition, withProposal, withRouteDecisions, withRouteProposal, withScope, withSelectedChoice, withSettlementDeclarations, } from "../../domain/flow/run-state.js";
+import { applyTransition, checkAgainstJourney, iterationOf, planRefineHandoff, restartInvocation, restatesLastEvent, sameIteration, settlementAmbiguous, withApproval, withAttempt, withBoundary, withContinuation, withDecisionDate, withDecisionPreparation, withEvent, withFixPreview, withHandoff, withObservation, withPlanExecBatchCredit, withPlanExecBatchReview, withPlanExecBatchStageForTransition, withPlanExecBatchUpdate, withPlanExecEntry, withProposal, withQuickCheckouts, withReentry, withRouteDecisions, withRouteProposal, withScope, withSelectedChoice, withSettlementDeclarations, } from "../../domain/flow/run-state.js";
+import { APPROVE_UNCHANGED_PHASE, UNCHANGED_PHASE_CONSENT, approvedValidationOnly, } from "../../domain/flow/unchanged-phase.js";
 import { withSpecBaseline } from "../../domain/lineage.js";
 import { destinationsOf, observedEffects, sealProposal } from "../../domain/proposal.js";
 import { baseDigest } from "../../domain/proposal.js";
 import { reservationMarker } from "../../domain/reservation.js";
 import { checkSafeRelativePath } from "../../domain/safe-path.js";
 import { resolveCoreDocsCanon } from "../docs-canon-service.js";
+import { parseMdSectionBilingual } from "../markdown.js";
+import { parsePhases } from "../parsers/phases.js";
 import { readWorkspaceBlock } from "../parsers/project-block.js";
 import { parseDerivedFromPath, parseSpecRelation } from "../parsers/spec-relation.js";
+import { parseTasks } from "../parsers/tasks.js";
 import { resolveWorkspaceRootFrom } from "../paths-service.js";
 import { commitStoredPlanExecDecision, preparePlanExecDecision, } from "../plan-exec-decision-service.js";
 import { planBoundaryAction, planGrammarAtEntry, planGrammarAtPublication, } from "../plan-lint-service.js";
 import { semanticDigest } from "../semantic-operation/protocol.js";
 import { resolveSessionTarget } from "../session-resolver.js";
 import { sourceAliasesOfPlan, } from "../source-boundary-policy.js";
+import { readSourcePipelines, resolveFinalValidation } from "../source-pipeline.js";
+import { runWorkspaceCommit } from "../workspace-commit-service.js";
 import { actionDigest, advanceFlowRun, awaitingCliRerun, directiveFor, effectsOfTransition, resolveBoundary, } from "./advance.js";
-import { observeCheckout, withObservedCheckouts } from "./checkout-observation.js";
+import { observeCheckout, observeScopedFingerprints, withObservedCheckouts, } from "./checkout-observation.js";
 import { resolveCheckoutCandidates } from "./checkout-observation.js";
+import { closeAtBoundaryState } from "./close-at-boundary.js";
 import { driveInternalActions } from "./internal-drive.js";
+import { observePlanEntry } from "./plan-entry.js";
+import { observeQuickCheckouts } from "./quick-checkouts.js";
 import { journeyForRun } from "./run-journey.js";
-import { applyUnderLock, locateRun } from "./run-state-service.js";
+import { applyUnderLock, locateRun, readRun } from "./run-state-service.js";
+/** The same decision against the current boundary, without a run lock or writes. */
+export async function checkFlow(fs, paths, input) {
+    const canon = await resolveCoreDocsCanon(fs, paths);
+    if (!canon.ok)
+        return {
+            ok: false,
+            failure: { code: "DOCS_CANON_INVALID", message: canon.error, action: "corregí [docs]" },
+        };
+    const resolution = await resolveSessionTarget(fs, paths, {
+        intent: "read",
+        ...(input.code !== undefined ? { code: input.code } : {}),
+        ...(input.contextId !== undefined ? { contextId: input.contextId } : {}),
+        allowClosed: false,
+        bind: false,
+    });
+    if (resolution.outcome !== "resolved")
+        return { ok: false, session: resolution };
+    const session = resolution.session.folder;
+    const read = await readRun(fs, locateRun(paths, session));
+    if (!read.ok)
+        return { ok: false, failure: read.failure };
+    const snapshot = await observe(fs, paths, input.raw, session, input.git);
+    const decision = await decide(fs, paths, read.state, input, snapshot, true);
+    if (!decision.ok)
+        return { ok: false, failure: decision.failure };
+    const error = decision.value.directive.error;
+    return {
+        ok: true,
+        receipt: {
+            check: true,
+            valid: error === null,
+            error,
+            violations: error?.violations ??
+                (error === null
+                    ? []
+                    : [
+                        {
+                            code: error.code,
+                            field: "answer",
+                            message: error.message,
+                        },
+                    ]),
+        },
+    };
+}
 export async function submitFlow(fs, paths, input) {
     const canon = await resolveCoreDocsCanon(fs, paths);
     if (!canon.ok) {
@@ -112,7 +168,7 @@ export async function submitFlow(fs, paths, input) {
         ok: true,
         state: applied.state,
         value: applied.value.directive,
-    });
+    }, paths);
     if (!driven.ok)
         return { ok: false, failure: driven.failure };
     return { ok: true, directive: withObservedCheckouts(driven.value, observed) };
@@ -120,15 +176,78 @@ export async function submitFlow(fs, paths, input) {
 async function observe(fs, paths, raw, session, git) {
     const root = await resolveWorkspaceRootFrom(fs, paths);
     const plans = await observePlanArtifacts(fs, paths, raw);
+    const checkouts = await observeCheckouts(fs, paths, session, git);
     return {
         root,
+        quickCheckouts: await observeQuickCheckouts(fs, paths, session, git),
         destinations: await observeDestinations(fs, paths, raw),
         scope: await observeScope(fs, paths, raw),
         plans: plans.evidence,
-        checkouts: await observeCheckouts(fs, paths, session, git),
+        checkouts: checkouts.states,
+        checkoutFailure: checkouts.failure,
+        scoped: await observeBatchSources(fs, paths, session, git),
+        preexisting: await observePreexistingFailures(fs, paths, session, root),
+        validation_only_current: await observeValidationOnly(fs, paths, session, root),
         baselines: plans.baselines,
     };
 }
+/**
+ * The scoped fingerprints a phase validation is judged against, read before the
+ * lock like every other observation. The run read here only decides WHETHER to
+ * measure: the decision under the lock re-reads it, and a run that moved in
+ * between answers a different seal and is refused as stale anyway.
+ */
+async function observeBatchSources(fs, paths, session, git) {
+    if (git === undefined)
+        return null;
+    // With a reader present, "not measured" is an empty map and never `null`: the
+    // judgment then finds every source unobservable and refuses, instead of
+    // skipping the one comparison the phase validation exists for.
+    const read = await readRun(fs, locateRun(paths, session));
+    if (!read.ok || read.state.boundary !== PHASE_VALIDATION || read.state.scope === null) {
+        return {};
+    }
+    const observed = await observeScopedFingerprints(fs, git, paths, session, read.state.scope.sources);
+    return observed.ok ? observed.base : {};
+}
+const PHASE_VALIDATION = "plan-exec.validation-execution";
+async function observeValidationOnly(fs, paths, session, root) {
+    const read = await readRun(fs, locateRun(paths, session));
+    if (!read.ok || read.state.boundary !== PHASE_VALIDATION || read.state.scope === null)
+        return false;
+    const batch = read.state.batches?.find((item) => item.iteration === read.state.batch_loop?.iteration);
+    if (batch === undefined || !approvedValidationOnly(read.state, batch))
+        return false;
+    try {
+        const text = await fs.readText(join(root, read.state.scope.plan));
+        return !parseTasks(text).items.some((task) => task.status === "open" && batch.phases.includes(task.phase ?? -1));
+    }
+    catch {
+        return false;
+    }
+}
+async function observePreexistingFailures(fs, paths, session, root) {
+    const read = await readRun(fs, locateRun(paths, session));
+    if (!read.ok || read.state.boundary !== PHASE_VALIDATION)
+        return [];
+    const state = read.state;
+    if (state.scope === null)
+        return null;
+    const batch = state.batches?.find((entry) => entry.iteration === state.batch_loop?.iteration);
+    if (batch === undefined)
+        return [];
+    try {
+        const phases = parsePhases(await fs.readText(join(root, state.scope.plan))).items;
+        const selected = phases.filter((phase) => batch.phases.includes(phase.n));
+        if (selected.length !== batch.phases.length ||
+            selected.some((phase) => phase.preexisting_failures === null))
+            return null;
+        return selected.flatMap((phase) => phase.preexisting_failures ?? []);
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Judge the plan bytes a proposal is carrying, and derive the seal each one gets.
  *
@@ -209,8 +328,10 @@ async function observeScope(fs, paths, raw) {
         declared: null,
         plan: null,
         sources: null,
+        final_validation: null,
         boundary_failures: null,
         plan_error: null,
+        isolation: "unit",
     };
     let parsed;
     try {
@@ -231,7 +352,7 @@ async function observeScope(fs, paths, raw) {
     const named = decisions.plan;
     const plan = typeof named === "string" ? named.trim() : null;
     if (plan === null || plan.length === 0 || !checkSafeRelativePath(plan).ok) {
-        return { ...empty, declared, plan };
+        return { ...empty, declared, plan, isolation: block?.edit_mode ?? "unit" };
     }
     const canon = await resolveCoreDocsCanon(fs, paths);
     if (!canon.ok)
@@ -255,8 +376,12 @@ async function observeScope(fs, paths, raw) {
         declared,
         plan,
         sources: sourceAliasesOfPlan(text),
+        final_validation: resolveFinalValidation(text, sourceAliasesOfPlan(text), await readSourcePipelines(fs, paths)),
         boundary_failures: planGrammarAtEntry(text, declared),
         plan_error: null,
+        isolation: /^> Aislamiento: unidad\s*$/m.test(text.split(/^## /m, 1)[0] ?? "")
+            ? "unit"
+            : (block?.edit_mode ?? "unit"),
     };
 }
 /**
@@ -268,7 +393,7 @@ async function observeScope(fs, paths, raw) {
  */
 async function observeCheckouts(fs, paths, session, git) {
     if (git === undefined)
-        return null;
+        return { states: null, failure: null };
     // The SAME resolution the directive published, from the same function: two
     // callers computing this apart is what made a rejection claim the tree moved
     // when all that differed was the directory each side measured.
@@ -277,11 +402,24 @@ async function observeCheckouts(fs, paths, session, git) {
     for (const candidate of candidates) {
         // An unreadable checkout is deliberately absent from the eligible set: a proof
         // against it fails closed instead of being treated as a clean tree.
-        const state = await observeCheckout(fs, git, candidate);
+        let state;
+        try {
+            state = await observeCheckout(fs, git, candidate);
+        }
+        catch (error) {
+            return {
+                states,
+                failure: {
+                    code: "WORKLINE_CHECKOUT_UNOBSERVABLE",
+                    message: error instanceof Error ? error.message : String(error),
+                    action: "corregí el fallo de git en ese checkout y recapturá la prueba",
+                },
+            };
+        }
         if (state !== null)
             states.push(state);
     }
-    return states;
+    return { states, failure: null };
 }
 /**
  * The alias→root pairs worth publishing: the ones actually OBSERVED.
@@ -348,11 +486,25 @@ async function observeDestinations(fs, paths, raw) {
     return snapshot;
 }
 // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: resend, drift, admission, scope, sealing, preview, grant and handoff checks are one intentional precedence contract.
-async function decide(fs, paths, state, input, snapshot) {
+async function decide(fs, paths, state, input, snapshot, checkOnly = false) {
     const journey = journeyForRun(state);
+    // Human controls are exits from the run, not answers to the current kind of
+    // boundary. They remain usable with an exhausted or incoherent attempt ledger.
+    const control = controlFromRaw(input.raw);
+    if (control === STOP_LABEL)
+        return closeFromAnswer(state);
+    if (control === PAUSE_LABEL) {
+        const standing = resolveBoundary(state, journey);
+        return reject(state, standing, `'${PAUSE_LABEL}': la frontera queda en pie`, {
+            code: "FLOW_BOUNDARY_PAUSED",
+            action: `escribí el CHECKPOINT con 'aw checkpoint-write --code ${state.session}' y retomá con 'aw flow advance --code ${state.session}'`,
+            outcome: "needs_input",
+        });
+    }
     const incoherent = checkAgainstJourney(state, journey);
-    if (incoherent !== null)
-        return { ok: false, failure: incoherent };
+    if (incoherent !== null) {
+        return reject(state, resolveBoundary(state, journey), incoherent.message, incoherent);
+    }
     const resolved = resolveBoundary(state, journey);
     if (resolved.stopped === null) {
         return reject(state, resolved, "el recorrido ya terminó: no hay frontera que responder", {
@@ -385,6 +537,16 @@ async function decide(fs, paths, state, input, snapshot) {
             action: "corré 'aw flow advance': el CLI corre una vez más la operación interna y, si reconoce su efecto, avanza sin cobrar",
         });
     }
+    // An internal action is credited only by the driver that ran it: that is what
+    // leaves its `executed` event in the trace. A result from outside, however well
+    // formed, is a claim nobody verified — and applying it used to publish nothing
+    // while marking the step done.
+    if (resolved.kind === "execution" && internalActionOf(resolved.stopped) !== null) {
+        return reject(state, resolved, `'${resolved.stopped.id}' la ejecuta el CLI: un resultado externo no la acredita`, {
+            code: "FLOW_INTERNAL_ACTION_EXTERNAL_RESULT",
+            action: `corré 'aw flow advance --session ${state.session}': el CLI corre la operación y la acredita; si la corrida no sale de esta frontera, '${restartInvocation(state.session)}' la destraba`,
+        }, cost);
+    }
     // The action the run is waiting on is the one that was EMITTED, and the seal
     // would already refuse a result about any other. What the persisted digest adds
     // is the diagnosis: when the two differ, the invocation changed underneath a run
@@ -393,8 +555,11 @@ async function decide(fs, paths, state, input, snapshot) {
     const drifted = actionDrift(state, resolved, cost);
     if (drifted !== null)
         return drifted;
+    if (resolved.kind === "execution" && snapshot.checkoutFailure !== null) {
+        return reject(state, resolved, snapshot.checkoutFailure.message, snapshot.checkoutFailure, cost);
+    }
     // 2 · The boundary in force decides what is admissible.
-    const admissible = admit(state, resolved, resolved.stopped, input, cost, snapshot.checkouts);
+    const admissible = admit(state, resolved, resolved.stopped, input, cost, snapshot.checkouts, snapshot.scoped, snapshot.preexisting, snapshot.validation_only_current);
     if ("decision" in admissible)
         return admissible.decision;
     const parsed = admissible;
@@ -408,19 +573,73 @@ async function decide(fs, paths, state, input, snapshot) {
     if (route.kind === "adjust") {
         return adjustRouteProposal(state, journey);
     }
-    const routed = route.kind === "accept" ? withRouteDecisions(state, route.decisions) : state;
+    if (checkOnly && resolved.kind === "execution")
+        return checked(state, resolved);
+    const accepted = route.kind === "accept" ? withRouteDecisions(state, route.decisions) : state;
+    // Sealed with the transition it earned, in the same state publication: a batch
+    // is never seen validated without the proofs that validated it.
+    let routed = parsed.credit === undefined
+        ? accepted
+        : withPlanExecBatchCredit(accepted, parsed.credit.batch, parsed.credit.proofs);
+    if (state.flow === "plan-exec" &&
+        [
+            "plan-exec.entry-gate",
+            "plan-exec.entry-gap-recognition",
+            "plan-exec.normalization-consent",
+        ].includes(resolved.stopped.id)) {
+        routed = withPlanExecEntry(routed, await observePlanEntry(fs, paths, state));
+    }
+    if (resolved.stopped.id === UNCHANGED_PHASE_CONSENT &&
+        parsed.answer.choice === APPROVE_UNCHANGED_PHASE) {
+        const entry = state.plan_exec_entry;
+        if (entry?.plan && entry.phases_without_open_tasks) {
+            routed = withPlanExecEntry(routed, {
+                ...entry,
+                approved_without_changes: [...entry.phases_without_open_tasks],
+            });
+        }
+    }
     // The registry, not the Spanish consequence text, owns what a selected
     // alternative does. A handoff must stop before any later plan-exec row can
     // mark work, validate or commit; a decision selection is durably recorded
     // even while its registration is handled by the decision bridge below.
     const selected = choiceOutcomeOf(resolved.stopped, parsed.answer.choice);
+    const withEvidence = parsed.answer.choice === "Copiar evidencia y aprobar commit del workspace";
+    let approvedWorkspaceCommit = null;
+    if (resolved.stopped.id === "chassis.commit-choice" &&
+        (parsed.answer.choice === "Aprobar commit del workspace" || withEvidence)) {
+        if (!input.git || !input.process)
+            return reject(state, resolved, "no se puede observar Git para aprobar el commit", {
+                code: "WORKSPACE_COMMIT_UNAVAILABLE",
+                action: "cerrá sin commit o reintentá con un repositorio Git legible",
+            }, cost);
+        const prepared = await runWorkspaceCommit(fs, input.git, input.process, paths, {
+            code: state.session,
+            withEvidence,
+        });
+        if ("error" in prepared)
+            return reject(state, resolved, prepared.error, {
+                code: "WORKSPACE_COMMIT_UNAVAILABLE",
+                action: "cerrá sin commit o repará la propuesta y volvé a prepararla",
+            }, cost);
+        if (parsed.answer.decisions.commit_approval !== prepared.proposal.approval) {
+            const command = `aw workspace-commit prepare --code ${state.session}${withEvidence ? " --with-evidence" : ""}`;
+            return reject(state, resolved, "la aprobación no coincide con la lista de rutas y el mensaje", {
+                code: "WORKSPACE_COMMIT_APPROVAL_INVALID",
+                action: `revisá ${command} y contestá con decisions.commit_approval: ${prepared.proposal.approval}`,
+            }, cost);
+        }
+        approvedWorkspaceCommit = prepared.proposal;
+    }
     if (selected?.kind === "handoff") {
         // Only `spec-refine` needs a document the run never declared: the plan's
         // scope names the plan, and the spec is one hop away through its lineage.
         const specPath = selected.destination === "spec-refine"
             ? await specPathOfScopedPlan(fs, paths, snapshot.root, state.scope?.plan ?? null)
             : null;
-        return applyAndHandoff(state, journey, resolved.stopped, identity, parsed.answer, selected, specPath);
+        return applyAndHandoff(routed, journey, resolved.stopped, identity, parsed.answer, selected, specPath, state.flow === "quick"
+            ? (parseMdSectionBilingual(await fs.readText(join(paths.cwdSessionsDir(), state.session, "SESSION.md")), "Objective")?.trim() ?? "")
+            : null);
     }
     // The fix preview is checked HERE and nowhere else: it is a declaration, so no
     // seal, no destination and no evidence would ever notice its absence, and the
@@ -438,27 +657,63 @@ async function decide(fs, paths, state, input, snapshot) {
     // preview showed. Neither ever applies the step by itself.
     const scoped = scopeFrom(routed, resolved.stopped, parsed.answer, snapshot.scope);
     if ("failure" in scoped) {
-        return reject(state, resolved, scoped.failure.message, { code: scoped.failure.code, action: scoped.failure.action }, cost);
+        // A run without an input plan only learns the plan's identity at source-scope.
+        // Once its grammar is read, asking for another scope cannot repair the plan:
+        // retain that observation and show a blocked boundary with the refine action.
+        const grammar = snapshot.scope.boundary_failures?.[0];
+        if (grammar !== undefined && scoped.failure.code === grammar.code && snapshot.scope.plan) {
+            const blocked = withPlanExecEntry(state, {
+                plan: snapshot.scope.plan,
+                phases_without_open_tasks: state.plan_exec_entry?.phases_without_open_tasks ?? null,
+                grammar_failure: {
+                    ...scoped.failure,
+                    action: `${scoped.failure.action}; corregí el plan con /w:plan-refine antes de reanudar ejecución`,
+                },
+            });
+            const refusal = reject(blocked, resolveBoundary(blocked, journey), scoped.failure.message, scoped.failure, cost);
+            return refusal.ok ? { ...refusal, persist: true } : refusal;
+        }
+        return reject(state, resolved, scoped.failure.message, scoped.failure, cost);
+    }
+    const batchProposal = await commitProposalFrom(scoped.state, resolved.stopped, parsed.answer, input.git, fs, paths);
+    if ("failure" in batchProposal) {
+        return reject(state, resolved, batchProposal.failure.message, batchProposal.failure, cost);
     }
     // The closure-evidence gate runs over the proposed bytes BEFORE the seal: a
     // plan whose validation names no observable check of the checkout is refused
     // while it is being written, not when somebody tries to execute it.
     const evidence = planEvidenceFrom(resolved.stopped, parsed.answer, snapshot.plans);
     if (evidence !== null) {
-        return reject(state, resolved, evidence.failure.message, { code: evidence.failure.code, action: evidence.failure.action }, cost);
+        return reject(state, resolved, evidence.failure.message, evidence.failure, cost);
     }
-    const sealed = sealFrom(scoped.state, resolved.stopped, parsed.answer, snapshot.destinations, snapshot.baselines);
+    const sealed = sealFrom(batchProposal.state, resolved.stopped, parsed.answer, snapshot.destinations, snapshot.baselines);
     if ("failure" in sealed) {
-        return reject(state, resolved, sealed.failure.message, { code: sealed.failure.code, action: sealed.failure.action }, cost);
+        return reject(state, resolved, sealed.failure.message, sealed.failure, cost);
     }
     const preparedForGate = await prepareDecisionForGate(fs, sealed.state, snapshot, parsed.answer, resolved, cost);
     if (!preparedForGate.ok)
         return preparedForGate.decision;
+    if (checkOnly)
+        return checked(state, resolved);
     const settlement = recordSettlement(preparedForGate.state, parsed.answer, resolved, cost);
     if (!settlement.ok)
         return settlement.decision;
     const granted = resolved.kind === "authorization" ? (resolved.authorization?.planned ?? []) : [];
-    const approved = grantOf(settlement.state, resolved, parsed.answer, granted, journey);
+    let approved = grantOf(settlement.state, resolved, parsed.answer, granted, journey);
+    if (resolved.stopped.id === "plan-exec.batch-commit-authorization" &&
+        parsed.answer.choice === "Aprobar los commits del lote") {
+        const batch = (approved.batches ?? []).find((entry) => entry.iteration === approved.batch_loop?.iteration);
+        if (batch?.commit_proposal !== undefined) {
+            const proposal = batch.commit_proposal;
+            approved = withPlanExecBatchUpdate(approved, batch.id, (entry) => ({
+                ...entry,
+                commit_proposal: {
+                    ...proposal,
+                    approved_digest: proposal.digest,
+                },
+            }));
+        }
+    }
     // All pure scope/proposal checks have now passed. A durable decision is a
     // material write, so it must never land when a later validation of the same
     // answer would refuse the boundary and leave its cursor standing.
@@ -481,6 +736,29 @@ async function decide(fs, paths, state, input, snapshot) {
             outcome: selected,
         })
         : approved;
+    if (approvedWorkspaceCommit !== null) {
+        selectedState = withEvent(selectedState, {
+            kind: "executed",
+            transition: "chassis.commit-choice",
+            operation: "workspace.commit-approved",
+            summary: JSON.stringify(approvedWorkspaceCommit),
+            output_digest: semanticDigest(approvedWorkspaceCommit),
+            effects: [],
+            evidence: ["workspace.commit-paths-approved"],
+        });
+    }
+    if (resolved.stopped.id === "chassis.commit-choice" &&
+        (parsed.answer.choice === "Copiar evidencia y cerrar" || withEvidence)) {
+        selectedState = withEvent(selectedState, {
+            kind: "executed",
+            transition: "chassis.commit-choice",
+            operation: "workspace.evidence-approved",
+            summary: "copia explícita de evidencia efímera",
+            output_digest: semanticDigest("workspace.evidence-approved"),
+            effects: [],
+            evidence: ["workspace.evidence-copy-approved"],
+        });
+    }
     if (registered?.ok && registered.reconciliation !== null) {
         selectedState = withContinuation(selectedState, registered.reconciliation);
     }
@@ -500,12 +778,160 @@ async function decide(fs, paths, state, input, snapshot) {
     // cuya respuesta se tiraba —así que `Compactar` ahí volvía a una pregunta que
     // ya nadie podía mostrar.
     if (preview.preview !== null) {
-        selectedState = withFixPreview(selectedState, preview.preview);
+        selectedState = withFixPreview(selectedState, {
+            ...preview.preview,
+            ...(snapshot.quickCheckouts === null ? {} : { checkouts: snapshot.quickCheckouts }),
+        });
     }
+    selectedState = withQuickCheckouts(selectedState, snapshot.quickCheckouts);
+    // A redraft recorded by `grantOf` inserted rows after this boundary, so the
+    // transition is applied against the journey as it now reads.
+    const walked = journeyForRun(selectedState);
     const outcome = holds
-        ? holdAfterApproval(selectedState, journey, identity)
-        : applyAndAdvance(selectedState, journey, resolved.stopped, identity, parsed.answer);
-    return standalone === null ? outcome : withStandaloneGuidance(outcome, standalone);
+        ? holdAfterApproval(selectedState, walked, identity)
+        : applyAndAdvance(selectedState, walked, resolved.stopped, identity, parsed.answer);
+    const directed = standalone === null ? outcome : withStandaloneGuidance(outcome, standalone);
+    if (!directed.ok || !preparedForGate.warnings?.length)
+        return directed;
+    return {
+        ...directed,
+        value: {
+            ...directed.value,
+            directive: {
+                ...directed.value.directive,
+                next_action: `${preparedForGate.warnings.join("; ")}; ${directed.value.directive.next_action}`,
+            },
+        },
+    };
+}
+function controlFromRaw(raw) {
+    try {
+        const body = JSON.parse(raw);
+        if (!isRecord(body))
+            return null;
+        return body.choice === PAUSE_LABEL || body.choice === STOP_LABEL ? body.choice : null;
+    }
+    catch {
+        return null;
+    }
+}
+function checked(state, resolved) {
+    const built = directiveFor(state, resolved, []);
+    if (!built.ok)
+        return { ok: false, failure: built.failure };
+    return { ok: true, state, value: { directive: built.directive, advanced: false } };
+}
+async function commitProposalFrom(state, stopped, answer, git, fs, paths) {
+    if (stopped.id !== "plan-exec.batch-commit-proposal")
+        return { state };
+    const batch = (state.batches ?? []).find((entry) => entry.iteration === state.batch_loop?.iteration);
+    if (batch === undefined || batch.snapshot === undefined || git === undefined) {
+        return {
+            failure: {
+                code: "PLAN_EXEC_BATCH_COMMIT_UNOBSERVABLE",
+                message: "falta la instantánea git o el lector de las fuentes",
+                action: "volvé a adquirir la unidad del lote",
+            },
+        };
+    }
+    const messages = answer.decisions.messages;
+    const declaredPaths = answer.decisions.paths;
+    const pathMap = typeof declaredPaths === "object" && declaredPaths !== null && !Array.isArray(declaredPaths)
+        ? declaredPaths
+        : {};
+    const inPlace = state.scope?.isolation === "in-place";
+    const given = typeof messages === "object" && messages !== null && !Array.isArray(messages)
+        ? messages
+        : {};
+    const candidates = await resolveCheckoutCandidates(fs, paths, state.session);
+    const sources = [];
+    for (const [alias, base] of Object.entries(batch.snapshot).sort(([a], [b]) => a.localeCompare(b))) {
+        const root = candidates.find((candidate) => candidate.source === alias)?.root;
+        if (root === undefined)
+            return {
+                failure: {
+                    code: "PLAN_EXEC_BATCH_COMMIT_UNOBSERVABLE",
+                    message: `no se puede ubicar la unidad ${alias}`,
+                    action: "restaurá la unidad de esta sesión",
+                },
+            };
+        const dirty = await git.dirtyPaths(root);
+        const changed = dirty
+            .filter((entry) => !base.dirty.some((previous) => previous.path === entry.path && previous.digest === entry.digest))
+            .map((entry) => entry.path);
+        const askedPaths = pathMap[alias];
+        if (inPlace &&
+            (!Array.isArray(askedPaths) ||
+                !askedPaths.length ||
+                askedPaths.some((path) => typeof path !== "string" || !path.trim()) ||
+                new Set(askedPaths).size !== askedPaths.length))
+            return {
+                failure: {
+                    code: "PLAN_EXEC_BATCH_PATHS_REQUIRED",
+                    message: `${alias}: declarás decisions.paths[${alias}] como lista exacta de rutas de la corrida`,
+                    action: "indicá sólo rutas de la corrida en este checkout",
+                },
+            };
+        const paths = inPlace ? askedPaths : changed;
+        if (inPlace) {
+            for (const path of paths) {
+                const before = base.dirty.find((entry) => entry.path === path);
+                const after = dirty.find((entry) => entry.path === path);
+                if (before && after?.digest !== before.digest)
+                    return {
+                        failure: {
+                            code: "PLAN_EXEC_BATCH_SHARED_PATH",
+                            message: `${alias}: ${path} fue tocada por el usuario y por la corrida`,
+                            action: "detené el lote sin commitear y acordá la separación de cambios",
+                        },
+                    };
+                if (before || !after)
+                    return {
+                        failure: {
+                            code: "PLAN_EXEC_BATCH_PATH_NOT_OWNED",
+                            message: `${alias}: ${path} ya era del usuario o no está sucia`,
+                            action: "declarás únicamente rutas nuevas de la corrida",
+                        },
+                    };
+            }
+        }
+        if (paths.length === 0)
+            continue;
+        const message = given[alias];
+        if (typeof message !== "string" ||
+            message.trim() !== message ||
+            message.length === 0 ||
+            /[\r\n]/.test(message) ||
+            /\b(?:Co-authored-by|Signed-off-by|Reviewed-by):/i.test(message)) {
+            return {
+                failure: {
+                    code: "PLAN_EXEC_BATCH_COMMIT_MESSAGE_INVALID",
+                    message: `${alias}: el mensaje debe ser una sola línea sin trailers`,
+                    action: "devolvé decisions.messages por alias con un mensaje de una línea",
+                },
+            };
+        }
+        sources.push({
+            alias,
+            paths: paths.sort(),
+            dirty: dirty.filter((entry) => paths.includes(entry.path)),
+            message,
+            ...(inPlace
+                ? {
+                    foreign_paths: dirty
+                        .filter((entry) => !paths.includes(entry.path))
+                        .map((entry) => entry.path),
+                }
+                : {}),
+        });
+    }
+    const digest = semanticDigest({ batch: batch.id, snapshot: batch.snapshot, sources });
+    return {
+        state: withPlanExecBatchUpdate(state, batch.id, (item) => ({
+            ...item,
+            commit_proposal: { sources, digest },
+        })),
+    };
 }
 /**
  * The declared fix preview, checked for the three things it has to say.
@@ -601,10 +1027,7 @@ function routeAnswer(state, stopped, journey, answer) {
         };
     }
     const candidate = answer.decisions.route;
-    if (!isRecord(candidate) ||
-        !isRecord(candidate.summary) ||
-        !isRecord(candidate.basis) ||
-        !Array.isArray(candidate.controls)) {
+    if (!routeShape(candidate)) {
         return {
             kind: "failure",
             failure: {
@@ -629,17 +1052,25 @@ function routeAnswer(state, stopped, journey, answer) {
     const declaredSummary = summary;
     const basis = candidate.basis;
     const basisFields = ["intention", "checkout", "conventions", "adopted_decisions"];
-    if (basisFields.some((field) => !nonBlank(basis[field]))) {
+    const asText = (value) => {
+        if (nonBlank(value))
+            return value.trim();
+        if (Array.isArray(value) && value.length > 0 && value.every(nonBlank))
+            return value.map((entry) => entry.trim()).join("\n");
+        return null;
+    };
+    const invalidBasis = basisFields.find((field) => asText(basis[field]) === null);
+    if (invalidBasis !== undefined) {
         return {
             kind: "failure",
             failure: {
                 code: "FLOW_ROUTE_PROPOSAL_INVALID",
-                message: "la ruta no explica intención, checkout, convenciones y decisiones adoptadas",
+                message: `decisions.route.basis.${invalidBasis} espera texto o lista de textos no vacíos; recibió ${Array.isArray(basis[invalidBasis]) ? "lista inválida" : typeof basis[invalidBasis]}`,
                 action: "completá cada campo de decisions.route.basis con una observación concreta",
             },
         };
     }
-    const declaredBasis = basis;
+    const declaredBasis = Object.fromEntries(basisFields.map((field) => [field, asText(basis[field])]));
     const configured = new Map(journey.flatMap((decision) => {
         const control = routeControlOf(decision);
         return control === null ? [] : [[decision.id, { decision, control }]];
@@ -679,17 +1110,28 @@ function routeAnswer(state, stopped, journey, answer) {
                 },
             };
         }
+        const { decision, control } = configuredControl;
+        const consequence = control.consequences[raw.disposition];
+        if (consequence === undefined) {
+            return {
+                kind: "failure",
+                failure: {
+                    code: "FLOW_ROUTE_HARD_GATE",
+                    message: `'${raw.transition}' no admite '${raw.disposition}': el registro no deja que una ruta la saltee`,
+                    action: "declará apply o substitute para ese control; la evidencia que acredita el paso no se omite",
+                },
+            };
+        }
         const substitution = routeSubstitution(raw.disposition, raw.substitution);
         if ("failure" in substitution)
             return { kind: "failure", failure: substitution.failure };
-        const { decision, control } = configuredControl;
         controls.push({
             transition: decision.id,
             title: decision.title,
             disposition: raw.disposition,
             recommendation: control.recommendation,
             alternatives: control.consequences,
-            consequence: control.consequences[raw.disposition],
+            consequence,
             risk: control.risk,
             reason: raw.reason.trim(),
             substitution: substitution.value,
@@ -774,15 +1216,26 @@ function scopeFrom(state, stopped, answer, snapshot) {
     if (!scopesSources(stopped))
         return { state };
     const asked = answer.decisions.sources;
-    const sources = Array.isArray(asked)
-        ? asked.filter((alias) => typeof alias === "string").map((a) => a.trim())
+    const sources = sourceList(asked)
+        ? asked.map((entry) => typeof entry === "string"
+            ? entry.trim()
+            : isRecord(entry) && typeof entry.alias === "string" && Object.keys(entry).length === 1
+                ? entry.alias.trim()
+                : null)
         : null;
-    if (sources === null || sources.length === 0 || sources.some((alias) => alias.length === 0)) {
+    if (sources?.some((alias) => alias === null)) {
+        const at = sources.findIndex((alias) => alias === null);
         return {
-            failure: invalidScope("esta frontera fija qué fuentes edita la corrida y la respuesta no trae ninguna", "devolvé en 'decisions.sources' los alias exactos que el plan afecta, y en 'decisions.plan' su documento"),
+            failure: invalidScope(`decisions.sources[${at}] espera un alias de texto o {alias: string}; recibió ${Array.isArray(asked) && asked[at] === null ? "null" : typeof asked[at]}`, "cada fuente es un alias de texto o un objeto {alias} sin otras claves"),
         };
     }
-    if (new Set(sources).size !== sources.length) {
+    if (sources === null || sources.length === 0 || sources.some((alias) => alias?.length === 0)) {
+        return {
+            failure: invalidScope(`decisions.sources espera una lista no vacía de alias de texto o {alias: string}; recibió ${Array.isArray(asked) ? "lista vacía" : typeof asked}`, "devolvé en 'decisions.sources' los alias exactos que el plan afecta, y en 'decisions.plan' su documento"),
+        };
+    }
+    const aliases = sources;
+    if (new Set(aliases).size !== aliases.length) {
         return {
             failure: invalidScope("el scope declara la misma fuente dos veces", "una unidad por alias: declarás cada fuente una sola vez"),
         };
@@ -790,7 +1243,7 @@ function scopeFrom(state, stopped, answer, snapshot) {
     const plan = snapshot.plan;
     if (plan === null || plan.length === 0) {
         return {
-            failure: invalidScope("el scope no dice qué plan ejecuta esta corrida", `devolvé en 'decisions.plan' la ruta del plan dentro del workspace (${DEFAULT_CORE_DOCS_CANON.plan}/PPP-plan-<slug>.md)`),
+            failure: invalidScope(`decisions.plan espera una ruta de texto no vacía; recibió ${typeof answer.decisions.plan}`, `devolvé en 'decisions.plan' la ruta del plan dentro del workspace (${DEFAULT_CORE_DOCS_CANON.plan}/PPP-plan-<slug>.md)`),
         };
     }
     if (snapshot.plan_error !== null) {
@@ -803,7 +1256,7 @@ function scopeFrom(state, stopped, answer, snapshot) {
         };
     }
     const declared = snapshot.declared;
-    if (declared === null && sources.some((alias) => alias !== "workspace")) {
+    if (declared === null && aliases.some((alias) => alias !== "workspace")) {
         return {
             failure: {
                 code: "FLOW_SCOPE_UNKNOWN_SOURCE",
@@ -813,7 +1266,7 @@ function scopeFrom(state, stopped, answer, snapshot) {
         };
     }
     const declaredAliases = declared ?? [];
-    const unknown = sources.filter((alias) => alias !== "workspace" && !declaredAliases.includes(alias));
+    const unknown = aliases.filter((alias) => alias !== "workspace" && !declaredAliases.includes(alias));
     if (unknown.length > 0) {
         return {
             failure: {
@@ -839,12 +1292,19 @@ function scopeFrom(state, stopped, answer, snapshot) {
                 code: structural.code,
                 message: structural.message,
                 action: planBoundaryAction(structural.code, "execution-entry"),
+                violations: snapshot.boundary_failures.map((failure) => ({
+                    code: failure.code,
+                    field: failure.line ? `plan:${failure.line}` : "plan",
+                    expected: "gramática de fuentes y prueba local del plan",
+                    received: failure.message,
+                    message: failure.message,
+                })),
             },
         };
     }
     const declaredByPlan = snapshot.sources;
-    const missing = declaredByPlan.filter((alias) => !sources.includes(alias));
-    const extra = sources.filter((alias) => !declaredByPlan.includes(alias));
+    const missing = declaredByPlan.filter((alias) => !aliases.includes(alias));
+    const extra = aliases.filter((alias) => !declaredByPlan.includes(alias));
     if (missing.length > 0 || extra.length > 0) {
         const difference = [
             ...(missing.length > 0 ? [`faltan ${missing.join(", ")}`] : []),
@@ -858,7 +1318,16 @@ function scopeFrom(state, stopped, answer, snapshot) {
             },
         };
     }
-    return { state: withScope(state, { plan, sources }) };
+    return {
+        state: withScope(state, {
+            plan,
+            sources: aliases,
+            isolation: snapshot.isolation,
+            ...(snapshot.final_validation === null
+                ? {}
+                : { final_validation: snapshot.final_validation }),
+        }),
+    };
 }
 const SETTLEMENT_OUTCOMES = SETTLEMENT_READINGS.map((reading) => reading.outcome);
 /** The reading each label of the question stands for — from the row's own table. */
@@ -998,7 +1467,7 @@ function ratified(declaration, outcome) {
         : { note: declaration.note, index: declaration.index, outcome };
 }
 function readDeclarations(value) {
-    if (!Array.isArray(value))
+    if (!settlementList(value))
         return null;
     const out = [];
     for (const entry of value) {
@@ -1063,6 +1532,7 @@ async function prepareDecisionForGate(fs, state, snapshot, answer, resolved, cos
             }, cost),
         };
     }
+    const dated = withDecisionDate(state, state.decision_date ?? new Date().toISOString().slice(0, 10));
     // The plan of the scope decides WHICH preparation this is. A standalone plan has
     // no spec to compose against, so calling `preparePlanExecDecision` for it would
     // refuse with `FLOW_DECISION_LINEAGE_INVALID` and leave the run with handoffs as
@@ -1070,7 +1540,7 @@ async function prepareDecisionForGate(fs, state, snapshot, answer, resolved, cos
     const standalone = await standaloneDecisionFor(fs, snapshot.root, plan, candidate);
     if (standalone !== null) {
         return standalone.ok
-            ? { ok: true, state: withDecisionPreparation(state, standalone.preparation) }
+            ? { ok: true, state: withDecisionPreparation(dated, standalone.preparation) }
             : {
                 ok: false,
                 decision: reject(state, resolved, standalone.failure.message, standalone.failure, cost),
@@ -1081,23 +1551,27 @@ async function prepareDecisionForGate(fs, state, snapshot, answer, resolved, cos
         session: state.session,
         plan,
         value: candidate,
+        date: dated.decision_date ?? new Date().toISOString().slice(0, 10),
     });
     if (!prepared.ok) {
+        const refused = reject(dated, resolveBoundary(dated, journeyForRun(dated)), prepared.failure.message, prepared.failure, cost);
         return {
             ok: false,
-            decision: reject(state, resolved, prepared.failure.message, prepared.failure, cost),
+            decision: refused.ok ? { ...refused, persist: true } : refused,
         };
     }
     switch (prepared.kind) {
         case "settled":
             return {
                 ok: true,
-                state: withDecisionPreparation(state, { kind: "settled", decision: prepared.decision }),
+                ...(prepared.warnings === undefined ? {} : { warnings: prepared.warnings }),
+                state: withDecisionPreparation(dated, { kind: "settled", decision: prepared.decision }),
             };
         case "reused":
             return {
                 ok: true,
-                state: withDecisionPreparation(state, {
+                ...(prepared.warnings === undefined ? {} : { warnings: prepared.warnings }),
+                state: withDecisionPreparation(dated, {
                     kind: "reused",
                     note: prepared.note,
                     decision: prepared.decision,
@@ -1107,7 +1581,8 @@ async function prepareDecisionForGate(fs, state, snapshot, answer, resolved, cos
         case "prepared":
             return {
                 ok: true,
-                state: withDecisionPreparation(state, {
+                ...(prepared.warnings === undefined ? {} : { warnings: prepared.warnings }),
+                state: withDecisionPreparation(dated, {
                     kind: "prepared",
                     note: prepared.prepared.note,
                     preview: prepared.prepared.preview,
@@ -1216,11 +1691,11 @@ async function registerSelectedDecision(fs, paths, state, snapshot, resolved, co
  * run that merely advanced would be indistinguishable from one that never decided.
  */
 function standaloneDecisionEvent(state, transition, record) {
-    const batchIteration = currentBatchIteration(state, transition);
+    const rowIteration = iterationOf(state, transition);
     return {
         kind: "executed",
         transition,
-        ...(batchIteration === null ? {} : { batch_iteration: batchIteration }),
+        ...rowIteration,
         operation: "plan-exec.standalone-decision",
         summary: record.decision,
         output_digest: record.digest,
@@ -1261,7 +1736,7 @@ function withStandaloneGuidance(decision, record) {
  * cannot tell them apart, and neither could the table that decides the charge.
  */
 function invalidScope(message, action) {
-    return { code: "FLOW_SCOPE_INVALID", message, action };
+    return { code: "FLOW_SCOPE_SHAPE_INVALID", message, action };
 }
 /**
  * The closure-evidence gate, run BEFORE the preview is sealed.
@@ -1275,6 +1750,8 @@ function planEvidenceFrom(stopped, answer, observed) {
     if (proposalContractOf(stopped) === null || answer.artifacts.length === 0)
         return null;
     const proposed = new Set(answer.artifacts.map((artifact) => artifact.path.trim()));
+    const violations = [];
+    let first = null;
     for (const plan of observed) {
         if (!proposed.has(plan.path))
             continue;
@@ -1285,15 +1762,20 @@ function planEvidenceFrom(stopped, answer, observed) {
         // should not learn of the header on the next attempt.
         const lineage = plan.failures.find((candidate) => candidate !== failure && candidate.code === "PLAN_LINEAGE_UNSEALED");
         const also = lineage === undefined ? "" : ` · además: ${lineage.message}`;
-        return {
-            failure: {
-                code: failure.code,
-                message: `'${plan.path}': ${failure.message}${also}`,
-                action: planBoundaryAction(failure.code, "proposal"),
-            },
+        first ??= {
+            code: failure.code,
+            message: `'${plan.path}': ${failure.message}${also}`,
+            action: planBoundaryAction(failure.code, "proposal"),
         };
-    }
-    return null;
+        violations.push(...plan.failures.map((entry) => ({
+            code: entry.code,
+            field: entry.line ? `${plan.path}:${entry.line}` : plan.path,
+            expected: "plan con prueba local y linaje sellado",
+            received: entry.message,
+            message: entry.message,
+        })));
+    }
+    return first === null ? null : { failure: { ...first, violations } };
 }
 /**
  * Seat the proposal an authoring answer just handed over — sealed, not believed.
@@ -1396,6 +1878,26 @@ function sealFrom(state, stopped, answer, snapshot, baselines) {
         })),
     };
 }
+/**
+ * The redraft a confirmation row's alternative asked for, or `null`.
+ *
+ * It unseats any standing proposal and records a reentry from the flow's
+ * authoring row, so the run walks the redraft and its gate again instead of
+ * carrying on to a publication with nothing to publish and a finalize that
+ * closes the session. Independent of whether a proposal is seated: a proposal
+ * the run gave up on is exactly when redrafting matters most.
+ */
+function redraftOf(state, stopped, answer, journey) {
+    const redraft = reentryOf(stopped);
+    if (redraft === null || answer.choice !== redraft.label)
+        return null;
+    return withReentry(withProposal(state, null), {
+        kind: "refine",
+        transition: stopped.id,
+        occurrence: occurrenceAt(journey, state.applied.length),
+        from: redraft.from,
+    });
+}
 /**
  * The grant this answer produced, scoped to what it was given over.
  *
@@ -1410,8 +1912,13 @@ function sealFrom(state, stopped, answer, snapshot, baselines) {
  */
 function grantOf(state, resolved, answer, granted, journey) {
     const stopped = resolved.stopped;
+    if (stopped === null)
+        return state;
+    const redrafted = redraftOf(state, stopped, answer, journey);
+    if (redrafted !== null)
+        return redrafted;
     const proposal = state.proposal;
-    const approve = stopped === null ? null : publishApprovalOf(stopped);
+    const approve = publishApprovalOf(stopped);
     if (approve !== null && proposal !== null) {
         if (answer.choice === approve) {
             return withApproval(state, {
@@ -1420,13 +1927,11 @@ function grantOf(state, resolved, answer, granted, journey) {
                 classes: [...proposal.requires_approval],
             });
         }
-        // Declining unseats the proposal, and that is what makes `Refinar` cost
-        // nothing: the publication downstream finds nothing to publish and is skipped
-        // saying so, instead of stopping to ask for an authorization over bytes the
+        // Declining unseats the proposal: no authorization is asked over bytes the
         // person just turned down.
         return withProposal(state, null);
     }
-    const link = stopped === null ? null : approvalGrantOf(stopped);
+    const link = approvalGrantOf(stopped);
     if (link !== null && answer.choice === link.approve) {
         const target = journey.find((row) => row.id === link.transition);
         // A link to a transition this journey does not walk grants nothing: the
@@ -1457,7 +1962,7 @@ function grantOf(state, resolved, answer, granted, journey) {
  * a payload the boundary's own contract rejects, a decline (a real answer that
  * applies nothing), and an execution result that did not earn its transition.
  */
-function admit(state, resolved, stopped, input, cost, checkouts) {
+function admit(state, resolved, stopped, input, cost, checkouts, scoped, preexisting, validationOnlyCurrent) {
     const expectedApproval = resolved.kind === "authorization"
         ? effectApprovalDigest(stopped.id, resolved.authorization?.planned ?? [])
         : null;
@@ -1491,14 +1996,11 @@ function admit(state, resolved, stopped, input, cost, checkouts) {
         // consults. A resend, a decline and a pause are not failed tries either, and
         // they are classified there rather than being exempted here.
         return {
-            decision: reject(state, resolved, parsed.failure.message, { code: parsed.failure.code, action: parsed.failure.action }, cost),
+            decision: reject(state, resolved, parsed.failure.message, parsed.failure, cost),
         };
     }
-    // The flow control is a real answer, and neither half applies anything. They
-    // are kept apart because the outcomes differ and the difference is the point:
-    // stopping ends the run here (`cancelled`), pausing keeps the very same
-    // boundary standing so the run picks it up after compacting (`needs_input`).
-    // Collapsing them would report a paused run as a cancelled one.
+    // Pause leaves the boundary standing; stop places the shared close intention.
+    // The driver runs finalize after this transaction releases the run lock.
     if (parsed.answer.choice === PAUSE_LABEL) {
         return {
             decision: reject(state, resolved, `'${PAUSE_LABEL}': la frontera queda en pie y la corrida retoma acá`, {
@@ -1509,33 +2011,80 @@ function admit(state, resolved, stopped, input, cost, checkouts) {
         };
     }
     if (parsed.answer.choice === STOP_LABEL) {
-        return {
-            decision: reject(state, resolved, `'${STOP_LABEL}': el recorrido queda detenido en esta frontera`, {
-                code: "FLOW_BOUNDARY_DECLINED",
-                action: "reanudá con 'aw flow advance' cuando quieras retomar esta frontera",
-                outcome: "cancelled",
-            }, cost),
-        };
+        return { decision: closeFromAnswer(state) };
     }
     // An execution result has to EARN the transition. Anything short of a completed
     // run with its evidence and its whole effect keeps the boundary standing: the
     // work stays pending, with the recovery the action declared.
-    if (resolved.kind === "execution") {
-        // The row's `effects` are the ceiling and the sealed proposal is what really
-        // happens: demanding an overwrite from a publication that only creates files
-        // would leave the transition pending for an effect nobody could produce.
-        const verdict = executionVerdict(parsed.answer.result, resolved.action, effectsOfTransition(state, stopped), checkouts);
-        if (verdict !== null) {
-            const trace = declaredTrace(state, stopped, resolved, parsed.answer, verdict);
-            return {
-                decision: reject(state, resolved, verdict.message, verdict.detail, {
-                    ...cost,
-                    ...(trace === null ? {} : { trace }),
-                }),
-            };
-        }
+    if (resolved.kind !== "execution")
+        return parsed;
+    return earned(state, resolved, stopped, parsed, cost, checkouts, scoped, preexisting, validationOnlyCurrent);
+}
+function closeFromAnswer(state) {
+    const closing = closeAtBoundaryState(state);
+    if (!closing.ok)
+        return closing;
+    const advanced = advanceFlowRun({
+        state: closing.state,
+        journey: journeyForRun(closing.state),
+    });
+    if (!advanced.ok)
+        return advanced;
+    return {
+        ok: true,
+        state: advanced.state,
+        value: { directive: advanced.directive, advanced: true },
+    };
+}
+/** The execution verdict, then — at the phase validation — the batch's own credit. */
+function earned(state, resolved, stopped, parsed, cost, checkouts, scoped, preexisting, validationOnlyCurrent) {
+    // The row's `effects` are the ceiling and the sealed proposal is what really
+    // happens: demanding an overwrite from a publication that only creates files
+    // would leave the transition pending for an effect nobody could produce.
+    const verdict = executionVerdict(parsed.answer.result, resolved.action, effectsOfTransition(state, stopped), checkouts, preexisting);
+    if (verdict !== null) {
+        const trace = declaredTrace(state, stopped, resolved, parsed.answer, verdict);
+        return {
+            decision: reject(state, resolved, verdict.message, verdict.detail, {
+                ...cost,
+                ...(trace === null ? {} : { trace }),
+            }),
+        };
+    }
+    const credited = batchCredit(state, stopped, parsed.answer, resolved, scoped, validationOnlyCurrent);
+    if (credited === null)
+        return parsed;
+    if (!credited.ok) {
+        return {
+            decision: reject(state, resolved, credited.refusal.message, credited.refusal.detail, cost),
+        };
     }
-    return parsed;
+    return { ...parsed, credit: credited.credit };
+}
+/**
+ * The phase validation's own judgment: the batch it closes must bring a proof of
+ * each of its sources, of its own checkout. `null` on every other boundary, and
+ * on a run with no batch standing, where there is nothing to credit.
+ */
+function batchCredit(state, stopped, answer, resolved, scoped, validationOnlyCurrent) {
+    if (stopped.id !== PHASE_VALIDATION || answer.result === null || state.scope === null) {
+        return null;
+    }
+    const iteration = state.batch_loop?.iteration ?? null;
+    const batches = state.batches ?? [];
+    const batch = batches.find((entry) => entry.iteration === iteration);
+    if (batch === undefined)
+        return null;
+    const verdict = batchCreditVerdict(answer.result, {
+        batch,
+        batches,
+        sources: state.scope.sources,
+        scoped,
+        validation_only_approved: validationOnlyCurrent && approvedValidationOnly(state, batch),
+    }, resolved.action?.recovery ?? "");
+    if (!verdict.ok)
+        return verdict;
+    return { ok: true, credit: { batch: batch.id, proofs: verdict.credit } };
 }
 /**
  * The material fact a REFUSED external result still leaves behind — or `null`.
@@ -1557,11 +2106,11 @@ function declaredTrace(state, stopped, resolved, answer, verdict) {
     if (!touchesTheWorld(applied) && verdict.detail.code !== "FLOW_EFFECT_PARTIAL")
         return null;
     const invocation = resolved.action?.invocation;
-    const batchIteration = currentBatchIteration(state, stopped.id);
+    const rowIteration = iterationOf(state, stopped.id);
     return {
         kind: "failed",
         transition: stopped.id,
-        ...(batchIteration === null ? {} : { batch_iteration: batchIteration }),
+        ...rowIteration,
         // What was really run, named the way whoever ran it would recognize it: an
         // external execution has no internal operation id to quote.
         operation: invocation === undefined ? stopped.id : [invocation.program, ...invocation.args].join(" "),
@@ -1604,7 +2153,11 @@ function actionDrift(state, resolved, cost) {
  * was written" are different facts, and only the second one advances a run.
  */
 function holdAfterApproval(approved, journey, identity) {
-    const held = advanceFlowRun({ state: withAttempt(approved, identity), journey, applied: [] });
+    const held = advanceFlowRun({
+        state: withAttempt(approved, { ...identity, approval: true }),
+        journey,
+        applied: [],
+    });
     if (!held.ok)
         return { ok: false, failure: held.failure };
     return { ok: true, state: held.state, value: { directive: held.directive, advanced: true } };
@@ -1617,14 +2170,10 @@ function applyAndAdvance(approved, journey, stopped, identity, answer) {
     let next = answer.signals.length > 0
         ? withObservation(approved, observationFor(approved, stopped.id, answer.signals))
         : approved;
-    next = withPlanExecBatchStageForTransition(applyTransition(next, stopped.id, effectsOfTransition(next, stopped)), stopped.id);
-    // A published proposal is spent, whoever published it. This is the degraded
-    // path — no internal executor, so the caller ran the write and returned its
-    // result — and leaving the proposal seated would keep a preview of bytes that
-    // are already on disk standing in front of the next boundary.
-    if (internalActionOf(stopped)?.operation === "proposal.publish") {
-        next = withProposal(next, null);
+    if (stopped.answer_contract === "batch-review" && isBatchReview(answer.decisions.review)) {
+        next = withPlanExecBatchReview(next, answer.decisions.review);
     }
+    next = withPlanExecBatchStageForTransition(applyTransition(next, stopped.id, effectsOfTransition(next, stopped)), stopped.id);
     next = withAttempt(next, identity);
     // The boundary follows the position, always: handing the engine a state whose
     // boundary still names the transition just applied is exactly the incoherence
@@ -1677,15 +2226,8 @@ function choiceOutcomeOf(stopped, label) {
  * the state. A retry is recognized by the attempt ledger, so it cannot create a
  * second package or walk the batch toward a commit.
  */
-function applyAndHandoff(state, journey, stopped, identity, answer, outcome, specPath) {
-    const plan = state.scope?.plan ?? null;
-    if (outcome.destination === "plan-refine" && plan === null) {
-        const resolved = resolveBoundary(state, journey);
-        return reject(state, resolved, "la entrega a plan-refine no tiene el plan que debe reabrir", {
-            code: "FLOW_HANDOFF_PLAN_MISSING",
-            action: "fijá el scope de plan-exec antes de elegir una escalación a plan-refine",
-        }, { journey, identity });
-    }
+function applyAndHandoff(state, journey, stopped, identity, answer, outcome, specPath, request) {
+    const plan = state.scope?.plan ?? state.plan_exec_entry?.plan ?? null;
     const fixPreview = state.fix_preview ?? null;
     const packageBody = {
         plan,
@@ -1695,7 +2237,11 @@ function applyAndHandoff(state, journey, stopped, identity, answer, outcome, spe
         // declared preview travels with it — the destination is the one place that
         // rewrites it, and rediscovering it there is exactly what the package exists
         // to avoid.
-        decisions: fixPreview === null ? answer.decisions : { ...answer.decisions, preview: fixPreview },
+        decisions: {
+            ...answer.decisions,
+            ...(fixPreview === null ? {} : { preview: fixPreview }),
+            ...(request === null ? {} : { request }),
+        },
         selection: answer.choice ?? "",
     };
     // The handoff to `spec-refine` used to be the bare command while the one to
@@ -1703,13 +2249,7 @@ function applyAndHandoff(state, journey, stopped, identity, answer, outcome, spe
     // spec again — the escalation package exists precisely so nothing is
     // re-derived at the destination. An unreadable plan degrades to the bare
     // command: an escalation is never blocked over the convenience of an argument.
-    const command = outcome.destination === "plan-refine"
-        ? `/w:plan-refine ${plan}`
-        : outcome.destination === "spec-refine"
-            ? specPath === null
-                ? "/w:spec-refine"
-                : `/w:spec-refine ${specPath}`
-            : "/w:spec-new";
+    const command = handoffCommand(outcome.destination, plan, specPath);
     let next = withSelectedChoice(state, {
         transition: stopped.id,
         label: answer.choice ?? "",
@@ -1717,14 +2257,26 @@ function applyAndHandoff(state, journey, stopped, identity, answer, outcome, spe
     });
     next = withPlanExecBatchStageForTransition(applyTransition(next, stopped.id, effectsOfTransition(next, stopped)), stopped.id);
     next = withAttempt(next, identity);
-    next = withHandoff(next, {
-        destination: outcome.destination,
-        command,
-        package: packageBody,
-        package_digest: semanticDigest(packageBody),
-    });
+    next = withHandoff(next, outcome.destination === "plan-refine"
+        ? planRefineHandoff(state, answer.decisions, answer.choice ?? "")
+        : {
+            destination: outcome.destination,
+            command,
+            package: packageBody,
+            package_digest: semanticDigest(packageBody),
+        });
     next = withBoundary(next, journey[next.applied.length]?.id ?? null);
-    const advanced = advanceFlowRun({ state: next, journey, applied: [stepOf(stopped)] });
+    if (state.flow === "quick" && outcome.destination === "spec-new") {
+        const closing = closeAtBoundaryState(next);
+        if (!closing.ok)
+            return closing;
+        next = closing.state;
+    }
+    const advanced = advanceFlowRun({
+        state: next,
+        journey: journeyForRun(next),
+        applied: [stepOf(stopped)],
+    });
     if (!advanced.ok)
         return { ok: false, failure: advanced.failure };
     return {
@@ -1733,6 +2285,13 @@ function applyAndHandoff(state, journey, stopped, identity, answer, outcome, spe
         value: { directive: advanced.directive, advanced: true },
     };
 }
+function handoffCommand(destination, plan, spec) {
+    if (destination === "plan-refine")
+        return `/w:plan-refine ${plan}`;
+    if (destination === "spec-refine")
+        return spec === null ? "/w:spec-refine" : `/w:spec-refine ${spec}`;
+    return "/w:spec-new";
+}
 /**
  * Whether this submission is a resend, judged by the ledger that already knows
  * how.
@@ -1764,11 +2323,11 @@ function resendCheck(state, resolved, cost) {
     for (const past of state.attempts) {
         const replay = ledger.record(past);
         if (!replay.ok)
-            return { ok: false, failure: replay.failure };
+            return reject(state, resolved, replay.failure.message, replay.failure);
     }
     const verdict = ledger.record(identity);
     if (!verdict.ok)
-        return { ok: false, failure: verdict.failure };
+        return reject(state, resolved, verdict.failure.message, verdict.failure);
     if (verdict.kind === "new")
         return null;
     // The TWIN's transition, not this submission's: the identity is built over the
@@ -1776,10 +2335,9 @@ function resendCheck(state, resolved, cost) {
     // What is being asked is whether the step the twin answered ever moved.
     const twin = state.attempts.find((past) => past.invocation_id === identity.invocation_id &&
         past.request_digest === identity.request_digest);
-    // The twin was refused: this is a retry of the same wrong answer, so it gets
-    // the same real diagnosis again and counts toward the cap, which is what
-    // eventually degrades the boundary instead of leaving the caller looping.
-    if (twin !== undefined && !state.applied.includes(twin.transition))
+    // A refused twin gets its real diagnosis again, but the same request cannot
+    // create another row. Only a different insufficient answer spends again.
+    if (twin !== undefined && twinWasRefused(state, twin))
         return null;
     return reject(state, resolved, "esta respuesta ya se había aplicado: el recorrido no avanza dos veces", {
         code: "FLOW_ANSWER_RESENT",
@@ -1787,6 +2345,19 @@ function resendCheck(state, resolved, cost) {
         outcome: "completed",
     }, cost);
 }
+/**
+ * Whether the attempt a resend matches never advanced anything.
+ *
+ * Its transition missing from `applied` says so. So does its transition being
+ * the boundary still standing at the same iteration: a repeated row (a batch or
+ * a redraft copy) has its id in `applied` from an earlier walk, and that earlier
+ * walk is not this one.
+ */
+function twinWasRefused(state, twin) {
+    if (!state.applied.includes(twin.transition))
+        return true;
+    return (twin.transition === state.boundary && sameIteration(twin, iterationOf(state, twin.transition)));
+}
 /**
  * A rejection, expressed as the recalculated directive.
  *
@@ -1797,8 +2368,8 @@ function resendCheck(state, resolved, cost) {
  * recoverable — an unbounded loop inside the very mechanism that exists to bound
  * one. One place decides, one table says which codes count.
  *
- * `cost` is absent only where there is no boundary to charge: a run that already
- * finished, or one that never stopped at anything.
+ * `cost` is also absent for mechanical controls and replay failures, which never
+ * charge a boundary even when it is still open.
  */
 function reject(state, resolved, message, detail, cost) {
     // A refused answer is the one rejection that CHANGES the run: the attempt is
@@ -1809,14 +2380,20 @@ function reject(state, resolved, message, detail, cost) {
     const traced = cost?.trace === undefined || restatesLastEvent(state, cost.trace)
         ? state
         : withEvent(state, cost.trace);
-    const after = cost !== undefined && spendsAttempt(detail.code) ? withAttempt(traced, cost.identity) : traced;
+    const after = cost !== undefined &&
+        spendsAttempt(detail.code) &&
+        !state.attempts.some((past) => past.invocation_id === cost.identity.invocation_id &&
+            past.attempt === cost.identity.attempt &&
+            past.request_digest === cost.identity.request_digest)
+        ? withAttempt(traced, cost.identity)
+        : traced;
     const now = cost === undefined || after === state ? resolved : resolveBoundary(after, cost.journey);
     const built = directiveFor(after, now, [], {
         // No outcome named ⇒ the boundary decides it: a finished journey reports
         // `completed`, an open one `needs_input`. Hardcoding one here would let a
         // rejection at the end of a run claim work is still pending.
         ...(detail.outcome === undefined ? {} : { outcome: detail.outcome }),
-        nextAction: `${message} — ${now.error?.action ?? detail.action}`,
+        nextAction: `${message} — ${detail.code === "FLOW_BOUNDARY_PAUSED" ? detail.action : (now.error?.action ?? detail.action)}`,
     });
     if (!built.ok)
         return { ok: false, failure: built.failure };
@@ -1826,7 +2403,12 @@ function reject(state, resolved, message, detail, cost) {
     // longer a way forward, and reporting the payload's error would suggest it is.
     const directive = {
         ...built.directive,
-        error: now.error ?? { code: detail.code, message, action: detail.action },
+        error: (detail.code === "FLOW_BOUNDARY_PAUSED" ? null : now.error) ?? {
+            code: detail.code,
+            message,
+            action: detail.action,
+            ...(detail.violations ? { violations: detail.violations } : {}),
+        },
     };
     return {
         ok: true,
@@ -1848,17 +2430,12 @@ function reject(state, resolved, message, detail, cost) {
  */
 function attemptIdentity(state, input, seal, transition) {
     const digest = semanticDigest({ payload: input.raw, approval: input.approval });
-    const batchIteration = currentBatchIteration(state, transition);
+    const rowIteration = iterationOf(state, transition);
     const prior = state.attempts.filter((past) => past.invocation_id === seal);
     const twin = prior.find((past) => past.request_digest === digest);
-    // The next ordinal, asked with the SAME expression `AttemptLedger.record`
-    // validates it against. Counting rows instead is a second reading of one fact,
-    // and the two part the moment a resend is persisted: a recognized resend is
-    // re-evaluated and its row kept wearing the twin's ordinal — deliberately, so
-    // it still counts toward the cap — so the rows say two while the highest
-    // ordinal says one, and the next answer arrives as attempt 3 where the ledger
-    // accepts only 2. Nobody can answer that boundary, and `recover` reads the
-    // chain as coherent because replaying two identical rows never fails.
+    // A twin reuses its ordinal only for the ledger's resend verdict; reject does
+    // not persist it again. A new answer takes highest + 1, never the row count of
+    // a legacy ledger that may still contain identical twins.
     const highest = Math.max(0, ...prior.map((past) => past.attempt));
     const attempt = twin?.attempt ?? highest + 1;
     const parent = attempt === 1
@@ -1872,18 +2449,18 @@ function attemptIdentity(state, input, seal, transition) {
         // The seal moves with the state; the transition does not while the run
         // stands there. It is what the cap counts over.
         transition,
-        ...(batchIteration === null ? {} : { batch_iteration: batchIteration }),
+        ...rowIteration,
     };
 }
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function observationFor(state, transition, signals) {
-    const batchIteration = currentBatchIteration(state, transition);
+    const rowIteration = iterationOf(state, transition);
     return {
         transition,
         signals,
-        ...(batchIteration === null ? {} : { batch_iteration: batchIteration }),
+        ...rowIteration,
     };
 }
 //# sourceMappingURL=submit.js.map