@vostride/agent-qa-agent-local 0.2.3 → 0.2.4

package/dist/index.js

@@ -85,7 +85,6 @@ function createFrozenKnowledgeReader(reader) {
 }
 function constructKnowledgeReader(input) {
   return createFrozenKnowledgeReader(openKnowledgeReader({
-    ...input.resolveTrustPriors === void 0 ? {} : { priors: input.resolveTrustPriors() },
     knowledgeRoot: input.knowledgeRoot,
     ...input.product === void 0 ? {} : { product: input.product },
     scopeDefaults: {
@@ -116,7 +115,6 @@ function openRunKnowledgeComposition(input) {
     recordCap: scaledRecordCap(input.capabilities)
   };
   const reader = constructKnowledgeReader({
-    ...input.resolveTrustPriors === void 0 ? {} : { resolveTrustPriors: input.resolveTrustPriors },
     knowledgeRoot: input.knowledgeRoot,
     ...input.product === void 0 ? {} : { product: input.product },
     ...input.parentScopes === void 0 ? {} : { parentScopes: input.parentScopes },
@@ -367,8 +365,7 @@ function buildMemberRunConfig(input) {
     cache: input.cache,
     workingMemory: input.workingMemory,
     storageState: input.storageState,
-    // CTXB-06: model's canonical compaction (compactLogs for log bursts, guardBlob
-    // otherwise) replaces the runner-local ceiling fallback on every tool-output value.
+    // The model's canonical compaction applies to every tool-output value.
     guardBlob: guardToolOutput,
     compressor: input.compressor,
     knowledgeReader: input.knowledgeReader,
@@ -423,28 +420,6 @@ function buildMemberRunConfig(input) {
 import { existsSync } from "node:fs";
 import { dirname as dirname2 } from "node:path";
 import { startRun } from "@vostride/agent-qa-runner";
-
-// src/composition/run-risk.ts
-import {
-  ALLOW_PRODUCTION_OPT_IN,
-  buildProductionRefusal,
-  distinctInFirstOccurrenceOrder
-} from "@vostride/agent-qa-schema";
-
-// src/composition/run-invocation-core.ts
-var REFUSED_RUN_REQUEST_FIELDS = [
-  "scope",
-  "executionContext"
-];
-var RunRequestFieldRefusedError = class extends Error {
-  constructor(refusedFields) {
-    super(
-      `agent-qa cannot start a run with: ${refusedFields.join(", ")}. scope resolves from the config the run is started against, and executionContext is supplied by the composition that owns the door \u2014 a caller-named execution context would be a caller relabelling where its run came from.`
-    );
-    this.refusedFields = refusedFields;
-    this.name = "RunRequestFieldRefusedError";
-  }
-};
 var RunIdNotMintedError = class extends Error {
   constructor(runId) {
     super(
@@ -463,22 +438,6 @@ var RunIdAlreadyInUseError = class extends Error {
     this.name = "RunIdAlreadyInUseError";
   }
 };
-var RunDeniedError = class extends Error {
-  constructor(runId, reason) {
-    super(reason);
-    this.runId = runId;
-    this.reason = reason;
-    this.name = "RunDeniedError";
-    this.neutralReason = reason;
-  }
-  neutralReason;
-};
-function refuseProductionWithoutOptIn(runId, declaration) {
-  const production = declaration.productionTargetNames.length > 0 || declaration.targetClass === "production";
-  if (!production || declaration.allowProduction === true) return;
-  const reason = buildProductionRefusal(declaration.productionTargetNames);
-  throw new RunDeniedError(runId, reason);
-}
 function refuseUnavailableRunId(input) {
   if (!input.isMintedRunId(input.runId)) throw new RunIdNotMintedError(input.runId);
   if (existsSync(runDirFor({ configDir: input.configDir, runId: input.runId }))) {
@@ -489,8 +448,6 @@ function createRunInvocationCore(options) {
   const configDir = dirname2(options.agentQaRoot);
   return {
     async execute(request) {
-      const refused = REFUSED_RUN_REQUEST_FIELDS.filter((field) => request[field] !== void 0);
-      if (refused.length > 0) throw new RunRequestFieldRefusedError(refused);
       if (request.runId !== void 0) {
         refuseUnavailableRunId({
           configDir,
@@ -499,9 +456,6 @@ function createRunInvocationCore(options) {
         });
       }
       const runId = request.runId ?? options.mintRunId();
-      const declaration = await options.resolveTargetDeclaration(request);
-      const targetClass = declaration.targetClass;
-      refuseProductionWithoutOptIn(runId, declaration);
       await options.afterRefusal?.();
       const ports = buildRunPorts({ configDir, runId });
       const postVerdict = options.postVerdict?.({ runId, configDir });
@@ -514,8 +468,7 @@ function createRunInvocationCore(options) {
           ...postVerdict === void 0 ? {} : { postVerdict }
         },
         configDir,
-        configPath: request.configPath ?? options.configPath,
-        targetClass
+        configPath: request.configPath ?? options.configPath
       });
       const session = startRun({
         ...assembled,
@@ -638,9 +591,7 @@ import {
   deterministicOverrideStrategy,
   foldFunctionResult,
   invokeFunction,
-  parseProposeGate1Allowance,
   projectPlannerTools,
-  PROPOSE_GATE1_ALLOWANCE_CHECKPOINT,
   RUNS_START_FUNCTION_ID,
   splitClauses
 } from "@vostride/agent-qa-agent";
@@ -690,10 +641,6 @@ import {
   probeEmbedderWorkerSocket,
   purgeRecord,
   readCanonicalBundleAnchors,
-  readCanonicalBundleStateDigests,
-  canaryPostureFactsFor,
-  standingReceiptDigestsFor,
-  lowerTrustSharesFor,
   readEmbedderWorkerRegistration,
   readWriterLease,
   rebuildIndex,
@@ -756,7 +703,6 @@ import {
 // src/composition/knowledge-review-reader.ts
 import {
   canaryAttributionsFor,
-  candidateInjectionFor,
   gateReceiptsFor,
   diffSince,
   inspectRecords,
@@ -773,31 +719,20 @@ function createKnowledgeReaderPort(input) {
     }
   }
   return {
-    // 2026-09-07, 417 D-01: forward the candidate DATA verbatim. Since 441-41 (D-06) nothing here
-    // scans it; the chat and MCP doors mask declared values in every op result.
-    async candidateInjection({ candidateId }) {
-      return candidateInjectionFor({
-        ...input.resolveTrustPriors === void 0 ? {} : { priors: input.resolveTrustPriors() },
-        knowledgeRoot: await input.resolveKnowledgeRoot(),
-        candidateId
-      });
-    },
-    // 416 D-17: the caller supplied the identity; forward the reader's answer verbatim.
+    // The caller supplied the identity; forward the reader's answer verbatim.
     async gateReceipts({ candidateId }) {
       return gateReceiptsFor({
         knowledgeRoot: await input.resolveKnowledgeRoot(),
-        candidateId,
-        resolvePromotionPosture: await input.resolvePromotionPosture?.()
+        candidateId
       });
     },
     async listBundles() {
-      const rows = listBundles(await input.resolveKnowledgeRoot(), input.resolveTrustPriors?.());
+      const rows = listBundles(await input.resolveKnowledgeRoot());
       await sight(rows.map((row) => row.bundleId));
       return rows;
     },
     async inspectRecords({ filter }) {
       const records = inspectRecords({
-        ...input.resolveTrustPriors === void 0 ? {} : { priors: input.resolveTrustPriors() },
         knowledgeRoot: await input.resolveKnowledgeRoot(),
         filter
       });
@@ -814,7 +749,6 @@ function createKnowledgeReaderPort(input) {
     },
     async showRecord({ recordId }) {
       const result = showRecord({
-        ...input.resolveTrustPriors === void 0 ? {} : { priors: input.resolveTrustPriors() },
         knowledgeRoot: await input.resolveKnowledgeRoot(),
         recordId
       });
@@ -826,19 +760,7 @@ function createKnowledgeReaderPort(input) {
     async showRecords({ recordIds }) {
       return showRecords({ knowledgeRoot: await input.resolveKnowledgeRoot(), recordIds });
     },
-    /**
-     * 407 D-08: what became of the canary lines one run served.
-     *
-     * Resolved per call like its four siblings, and NOT sighted. The caller already holds every
-     * candidate id in the tuples it passes — it read them off its own run's evidence — so a
-     * sighting here would record that the reader was handed ids rather than that an entity was
-     * surfaced to anyone, which is the distinction the ledger exists to keep.
-     *
-     * The reader entry's answer is forwarded VERBATIM, `skippedBundles` included (407-19, REVIEW
-     * WR-03). This binding neither counts nor interprets: how much of the store went unread is a
-     * fact only the walk knows, and a composition that dropped it here would hand the op a
-     * clean-looking answer over a half-read store.
-     */
+    // Not sighted; `skippedBundles` is forwarded verbatim so a half-read store never looks clean.
     async canaryAttributions({ runId, tuples }) {
       return canaryAttributionsFor({
         knowledgeRoot: await input.resolveKnowledgeRoot(),
@@ -1356,11 +1278,7 @@ function createJsonlSessionLogOn(fs, options) {
         createdAt,
         model: options.model(),
         toolsetHash: options.toolsetHash(),
-        // CONDITIONALLY SPREAD, on the composition's own idiom (400-01) and for its reason: an
-        // unconditional `surface: options.surface` would put `"surface":undefined` through
-        // `JSON.stringify` — which drops it — but would also make an explicit `undefined` and an
-        // unsupplied option two spellings of one state at every call site above. Absent here means
-        // the option was never given, and that is exactly the pre-400 population's meaning.
+        // Spread conditionally, so absent means the option is not given.
         ...options.surface === void 0 ? {} : { surface: options.surface }
       };
       const created = fs.openSync(pathFor(id), "wx");
@@ -1501,22 +1419,14 @@ var SCHEMA_STATEMENTS = [
      -- Nullable because most rows never fail; written only by recordFailure.
      last_failure_kind   TEXT,
      last_failure_reason TEXT,
-     -- When somebody asked this job to stop (D-19). A column rather than a status, for the
-     -- same reason the claim is one: the job status vocabulary describes lifecycle stages,
-     -- and "still queued, but asked to stop" is a fact about a request, not a stage.
-     -- Appended LAST deliberately - a column inserted in the middle would move every
-     -- positional read of this table for no gain.
+     -- A stop request, not a lifecycle stage. New columns go last, or positional reads would move.
      cancel_requested_at TEXT,
-     -- The instant this row was FIRST claimed, kept after the lease is released (425). The
-     -- claim column answers who holds the row now; no column answered how long the work took.
-     -- Written once by the claim, cleared only by the operator requeue. Appended last, as above.
+     -- When the row was first claimed; survives lease release, cleared only by operator requeue.
      started_at TEXT,
-     -- 444.1 D-23: a retrying row is not claimable before this instant. Appended last, as above.
+     -- A retrying row is not claimable before this instant.
      not_before TEXT
    )`,
-  // D-08's dedupe is THIS line. Making it a store-level constraint rather than a check the
-  // caller performs is what turns "two enqueues of the same work produce one job" from a
-  // convention into something no caller, in any process, can get wrong.
+  // The dedupe is this unique index, so no caller in any process can enqueue the same work twice.
   `CREATE UNIQUE INDEX IF NOT EXISTS jobs_kind_idempotency_key
      ON jobs (kind, idempotency_key)`,
   `CREATE TABLE IF NOT EXISTS job_store_fence (
@@ -1536,18 +1446,13 @@ var SCHEMA_STATEMENTS = [
      epoch          INTEGER NOT NULL,
      PRIMARY KEY (job_id, attempt, checkpoint_id)
    )`,
-  // 388 D-09: the chain-terminal record, beside the jobs it summarizes rather than in a
-  // second durable medium. `created_at` is written from the injected clock like every other
-  // timestamp in this file — a SQL-side default would leak host time into the D-03 dump and
-  // make two identical histories compare unequal.
+  // `created_at` comes from the injected clock; a SQL default would leak host time into the dump.
   `CREATE TABLE IF NOT EXISTS notifications (
      run_id     TEXT NOT NULL,
      payload    TEXT NOT NULL,
      created_at TEXT NOT NULL
    )`,
-  // D-10's dedupe is THIS line, and it is the same idiom as the jobs index above for the same
-  // reason: a crash-replayed chain terminal re-attempts the insert, and "one notification per
-  // run, ever" has to be something no caller — in this process or the next — can get wrong.
+  // One notification per run, ever: a crash-replayed terminal hits this unique index.
   `CREATE UNIQUE INDEX IF NOT EXISTS notifications_run_id
      ON notifications (run_id)`
 ];
@@ -1796,8 +1701,7 @@ function createSqliteJobStore(options) {
       attempts: toNumber(row.attempts),
       claimed: row.claimed_at !== null,
       cancelRequested: row.cancel_requested_at !== null,
-      // 422 D-16: OMITTED rather than `undefined` when there is nothing to say, so a reader that
-      // serializes this row does not publish an empty conclusion key for every ordinary job.
+      // Omitted rather than `undefined`, so a serialized row publishes no empty conclusion key.
       ...conclusionKind === void 0 ? {} : { conclusionKind },
       createdAt: String(row.created_at),
       updatedAt: String(row.updated_at)
@@ -1919,15 +1823,7 @@ function createSqliteJobStore(options) {
         markCancelHonoured.run(now, String(jobId));
       });
     },
-    // The 413-13 gap closure, and the checkpoint forget is its load-bearing half.
-    //
-    // Phase 413's pump composed with no post-run capabilities, so the kind registry selected
-    // the STAND-IN analyze-run handler: nineteen rows recorded a `verdicts-authored`
-    // checkpoint and reached `done` with nothing authored. Resetting the status alone would
-    // not undo that, it would REPEAT it — `selectLatestCheckpoint` reads
-    // `ORDER BY attempt DESC`, so the real handler's next attempt would resume on the
-    // stand-in's recorded value, author nothing again, and report completion again. So the
-    // rows go with the status, inside the same transaction, and the files follow the rows.
+    // Checkpoint rows go with the status, or the real handler resumes on the stand-in's value.
     async requeueTerminal(jobId, fence) {
       const now = clock.now();
       const decided = inTransaction(() => {
@@ -2116,15 +2012,11 @@ function createPostProcessingReader(options) {
         const curateMemory = toRow(
           selectJob.get(String(ids.curateMemory))
         );
-        const proposeImprovements = toRow(
-          selectJob.get(String(ids.proposeImprovements))
-        );
         const notification = notificationRow === void 0 ? void 0 : guardRunNotification2(JSON.parse(String(notificationRow.payload)));
         const curationSnapshot = readCurationSnapshot(db, options.agentQaRoot, ids, runId);
         return {
           ...analyzeRun === void 0 ? {} : { analyzeRun },
           ...curateMemory === void 0 ? {} : { curateMemory },
-          ...proposeImprovements === void 0 ? {} : { proposeImprovements },
           ...notification === void 0 ? {} : { notification },
           ...curationSnapshot === void 0 ? {} : { curationSnapshot }
         };
@@ -2183,8 +2075,6 @@ function receiptWriter(input) {
     executionContext: input.executionContext,
     writerLeaseId: input.lease.leaseId,
     epoch: input.lease.epoch,
-    ...input.resolveTrustPriors === void 0 ? {} : { resolveTrustPriors: input.resolveTrustPriors },
-    ...input.resolvePromotionPosture === void 0 ? {} : { resolvePromotionPosture: input.resolvePromotionPosture },
     ...input.sourceBuildOrdinal === void 0 ? {} : { sourceBuildOrdinal: input.sourceBuildOrdinal },
     ...input.sourceRunId === void 0 ? {} : { sourceRunId: input.sourceRunId }
   });
@@ -2233,10 +2123,6 @@ var LOCAL_CURATION_CAPABILITIES = Object.freeze({
   reconcileRunOutcomesProjection,
   enqueueCurationCandidateProjection,
   readCanonicalBundleAnchors,
-  readCanonicalBundleStateDigests,
-  readCanaryPostureFacts: canaryPostureFactsFor,
-  readStandingGateReceipts: standingReceiptDigestsFor,
-  readLowerTrustShares: lowerTrustSharesFor,
   runOutcomesProjectionVersion: RUN_OUTCOMES_PROJECTION_VERSION,
   canaryOutcomeObservationId,
   maintenance: Object.freeze({
@@ -2260,21 +2146,11 @@ function isTargetName(value) {
   return typeof value === "string" && value.trim().length > 0;
 }
 function recordedTargetsOf(artifact) {
-  const source = isRecord(artifact) ? artifact.source : void 0;
-  if (!isRecord(source)) return { status: "unknown" };
-  if (source.kind === "test") {
-    const target = isRecord(source.resolvedDefinition) ? source.resolvedDefinition.target : void 0;
-    return isTargetName(target) ? { status: "recorded", names: [target] } : { status: "unknown" };
-  }
-  if (source.kind !== "suite" || !Array.isArray(source.members)) return { status: "unknown" };
-  const names = /* @__PURE__ */ new Set();
-  for (const member of source.members) {
-    if (!isRecord(member)) return { status: "unknown" };
-    if (member.target === void 0 || member.target === null) continue;
-    if (!isTargetName(member.target)) return { status: "unknown" };
-    names.add(member.target);
-  }
-  return names.size === 0 ? { status: "unknown" } : { status: "recorded", names: [...names].sort() };
+  const targets = isRecord(artifact) ? artifact.targets : void 0;
+  if (!Array.isArray(targets) || targets.length === 0 || !targets.every(isTargetName)) {
+    return { status: "unknown" };
+  }
+  return { status: "recorded", names: [...new Set(targets)].sort() };
 }
 function createRunsReader(agentQaRoot) {
   function enumerate() {
@@ -2297,25 +2173,11 @@ function createRunsReader(agentQaRoot) {
     list() {
       return Promise.resolve(enumerate());
     },
-    /**
-     * Resolution runs over the ENUMERATED run documents and matches on the recorded `runId`,
-     * never by joining the caller's string onto a path (T-384-08): a `runId` of `../../etc` can
-     * therefore address nothing outside the runs directory, because it is never used to build a
-     * path at all.
-     */
+    // Matches the recorded `runId` over enumerated documents, so `../../etc` addresses nothing.
     get(runId) {
       return Promise.resolve(enumerate().find((document) => document.runId === runId));
     },
-    /**
-     * Deep replay of one run's `events.jsonl` through the SAME concrete store the v49 bus appends
-     * with, so a replayed stream is byte-for-byte what the run emitted.
-     *
-     * Two cases are deliberately distinct. An absent or empty log is an ordinary empty replay —
-     * nothing was recorded, so nothing was lost. A log whose earliest surviving seq is ABOVE the
-     * requested resume point means events the caller asked for existed and are gone; that is
-     * reported with the bus's own `ReplayIncompleteError` carrying the floor, never papered over
-     * by returning the surviving suffix (D-07/D-08).
-     */
+    // A resume point below the earliest surviving seq throws `ReplayIncompleteError`.
     readEvents(runId, fromSeq) {
       const recorded = [...new FsEventLog2({ root: agentQaRoot, runId }).read(0)].sort((left, right) => left.seq - right.seq);
       if (recorded.length === 0) return Promise.resolve([]);
@@ -2325,22 +2187,7 @@ function createRunsReader(agentQaRoot) {
       }
       return Promise.resolve(recorded.filter((event) => event.seq >= fromSeq));
     },
-    /**
-     * One step's persisted evidence, read back out of the run's own handoff document
-     * (387 KREV-02 / D-15).
-     *
-     * Through `loadCompletedRunHandoff` — the version guard — and NOT through a raw JSON read,
-     * which is the load-bearing half. 387-02 gave the guard a present-implies-valid clause for
-     * the retrieval trace, so a document whose trace is present but malformed is refused here
-     * rather than reaching the why-verb looking well-formed.
-     *
-     * The ambiguity check is the never-guess law at this seam. `stepIndex` numbers steps per
-     * MEMBER TEST, so a run with two tests has two step 0s; when the address does not name a
-     * test and more than one candidate answers to it, this reports the candidates rather than
-     * picking whichever test the document happened to list first. Picking would have produced a
-     * confident, wrong answer to a question that was never asked — and a why-verb that does
-     * that is worse than one that refuses, because its answer looks exactly like a right one.
-     */
+    // Read through the version guard; an ambiguous step reports its candidates instead of guessing.
     readStepEvidence(runId, address) {
       const document = enumerate().find((candidate) => candidate.runId === runId);
       if (document === void 0) return Promise.resolve({ kind: "run-not-recorded" });
@@ -2358,12 +2205,7 @@ function createRunsReader(agentQaRoot) {
         evidence === void 0 ? { kind: "step-not-found" } : { kind: "found", evidence }
       );
     },
-    /**
-     * Resolved over the ENUMERATED run directories (T-384-08, T-431-01): the caller's id is only
-     * ever compared, never joined onto a path, and the directory must hold a completed handoff
-     * recording that same id, so one run's snapshot can never answer for another. A snapshot that
-     * is absent, unreadable or gone since `list()` answered is `unknown`, never an error.
-     */
+    // The caller's id is compared, never joined onto a path; an absent snapshot is `unknown`.
     getRecordedTargets(runId) {
       const runsDir = join7(agentQaRoot, RUNS_SUBDIR3);
       if (!existsSync4(runsDir)) return Promise.resolve({ status: "unknown" });
@@ -2383,11 +2225,9 @@ function createRunsReader(agentQaRoot) {
     }
   };
 }
-function createKnowledgeReader(resolveKnowledgeRoot, sightMemoryEntities, resolvePromotionPosture, resolveTrustPriors) {
+function createKnowledgeReader(resolveKnowledgeRoot, sightMemoryEntities) {
   return createKnowledgeReaderPort({
     resolveKnowledgeRoot,
-    ...resolveTrustPriors === void 0 ? {} : { resolveTrustPriors },
-    ...resolvePromotionPosture === void 0 ? {} : { resolvePromotionPosture },
     ...sightMemoryEntities === void 0 ? {} : { sightMemoryEntities }
   });
 }
@@ -2421,10 +2261,7 @@ function createKnowledgeReview(input) {
     return next;
   }
   return {
-    // 432-12 (D-04/D-05/D-09): one explicit change, applied in the call through the direct writer
-    // (432-06). Nothing is filed: the change is committed under the lease, handed to a live
-    // holder, or refused by type. A missing identity is minted here, once per call, and returned on
-    // the receipt so the caller can retry the same change.
+    // A missing identity is minted once per call and returned, so a retry is the same change.
     change: (request) => serialized(async () => {
       const { knowledgeRoot } = await roots();
       const operationId = request.operationId ?? randomUUID3();
@@ -2438,18 +2275,14 @@ function createKnowledgeReview(input) {
         // `knowledge.reject` or `knowledge.forget`, which is the verb's own op id.
         opId: `knowledge.${request.verb}`,
         executionContext: (input.resolveExecutionContext ?? getActiveExecutionContext)(),
-        ...input.resolveTrustPriors === void 0 ? {} : { resolveTrustPriors: input.resolveTrustPriors },
-        ...input.resolvePromotionPosture === void 0 ? {} : { resolvePromotionPosture: input.resolvePromotionPosture },
         ...input.knowledgeChangeDelegate === void 0 ? {} : { delegate: input.knowledgeChangeDelegate },
         ...authority === void 0 ? {} : { writerAuthority: authority }
       });
       return knowledgeChangeOutput(request.verb, operationId, result);
     })
-    // 2026-10-01 (432-17, D-05/D-22): `propose` and `apply` are deleted with the proposal inbox.
   };
 }
 async function applyKnowledgeChange(input) {
-  const posture = await input.resolvePromotionPosture?.();
   const ledger = openAddressingLedgerForReview({
     path: join7(input.agentQaRoot, ADDRESSING_LEDGER_DB_FILE)
   });
@@ -2462,8 +2295,6 @@ async function applyKnowledgeChange(input) {
       opId: input.opId,
       executionContext: input.executionContext,
       resolveBundleShortId: (shortId) => ledger.lookupByShortId(shortId)?.machineId,
-      ...input.resolveTrustPriors === void 0 ? {} : { resolveTrustPriors: input.resolveTrustPriors },
-      ...posture === void 0 ? {} : { resolvePromotionPosture: posture },
       ...input.delegate === void 0 ? {} : { delegate: input.delegate },
       ...input.writerAuthority === void 0 ? {} : { writerAuthority: input.writerAuthority }
     });
@@ -2496,9 +2327,6 @@ async function withEntityResolutionDeps(input, body) {
     return await body({
       ledger,
       entityIndex,
-      // One kind is wired by the tracer. 387-03 registers the remaining sources here and
-      // neither the resolver nor the ops change — which is the property the tracer exists
-      // to establish before anything expands.
       sources: [createMemorySightingSource(() => knowledgeRoot)]
     });
   } finally {
@@ -2631,16 +2459,9 @@ function createDraftEvaluation(input) {
           elementsForTest: (filePath, testName) => fingerprints().elements.get(draftIdentityKey({ filePath, testName })) ?? []
         },
         textCorpus,
-        // D-19: the gitignored per-draft receipt store, bound over `agentQaRoot` beside the
-        // proposals inbox and for its reason — a receipt is machine-local working state under the
-        // runtime root, not a committed artifact a pull request has any business showing.
+        // Receipts are machine-local working state under the runtime root, not committed artifacts.
         receipts: createDraftReceiptsStore({ resolveAgentQaRoot: () => input.agentQaRoot }),
-        // D-14's live arm (394-17, step c). `product` is the SAME `observedProduct` gate 3's index
-        // is opened against — read off the first gate-run acknowledgment, never derived from
-        // configuration — so the stability read and the suite index can never be asking about two
-        // different applications. Before any run is acknowledged it is `undefined` and the
-        // consultation is skipped; D-04 forbids short-circuiting, so a flip cannot be observed
-        // until at least one run has been.
+        // `product` is gate 3's observed product: stability and the index ask about one app.
         suiteStability: {
           port: input.authoringFunnel,
           product: () => observedProduct
@@ -2674,10 +2495,7 @@ var LocalAgentClosedError = class extends Error {
   name = "LocalAgentClosedError";
 };
 var UNCLAIMABLE_BY_PROSE_POSTURE = Object.freeze({
-  // Frozen to the same depth it is read at (WR-11). The shallow freeze every sibling table
-  // here uses is not enough for this one: the VALUES are the arrays the queue claims
-  // against, so an unfrozen inner array is a writable disclosure guard reachable from any
-  // module that can import the table.
+  // Frozen deep, because the inner arrays are what the queue claims against.
   "masker-active": Object.freeze([]),
   "no-masker": Object.freeze(["curate-memory"])
 });
@@ -2803,63 +2621,24 @@ function createAnalysisArtifactReader(agentQaRoot) {
     }
   };
 }
-function postRunCapabilities(input, knowledgeRoot, analysisTokenBudget, jobStore, proposeGate1MaxPerJob) {
+function postRunCapabilities(input, knowledgeRoot, analysisTokenBudget) {
   const postRun = input.postRun;
   if (postRun === void 0) return void 0;
   return {
-    // 422 D-14: ONE narrow read — this job's own durable Gate-1 charge, addressed by its own id,
-    // through the authoritative `readCheckpoint` the store already publishes. The handler is
-    // handed no store, no checkpoint reader and no path; the shape check is `agent`'s, beside
-    // the shape it checks, so two hosts cannot disagree about what a readable charge is.
-    ...jobStore === void 0 ? {} : {
-      readProposeGate1Allowance: async (jobId) => parseProposeGate1Allowance(
-        await jobStore.readCheckpoint(asJobId2(jobId), PROPOSE_GATE1_ALLOWANCE_CHECKPOINT)
-      )
-    },
     loadCompletedRunHandoff: (runId) => loadCompletedRunHandoff(
       join7(input.agentQaRoot, RUNS_SUBDIR3, slugBranch4(runId), HANDOFF_FILE)
     ),
     curateRun: postRun.curateRun,
-    // 422 D-13: spread on the conditional idiom this file uses throughout, so an unbound port
-    // is an ABSENT member rather than a present `undefined` — the handler decides on presence,
-    // in one place, and a host that declined to bind cannot be mistaken for one that bound a
-    // hole.
-    ...postRun.stageAdversarialProposal === void 0 ? {} : { stageAdversarialProposal: postRun.stageAdversarialProposal },
-    // 422-09 (D-14): the Gate-1 leg's four ports and its bound, forwarded on the same
-    // presence-spread idiom one line up. The handler's own `screenGate1` requires ALL FOUR before
-    // it screens anything, so a host that binds three of them is a host that screens nothing —
-    // which is why they are forwarded one by one rather than as a bundle a caller could
-    // half-populate without noticing.
-    ...postRun.runReplayGate === void 0 ? {} : { runReplayGate: postRun.runReplayGate },
-    ...postRun.listBundles === void 0 ? {} : { listBundles: postRun.listBundles },
-    ...postRun.gateReceiptsFor === void 0 ? {} : { gateReceiptsFor: postRun.gateReceiptsFor },
-    ...postRun.readProposeCorpusPosture === void 0 ? {} : { readProposeCorpusPosture: postRun.readProposeCorpusPosture },
-    ...postRun.readMisdirectionRootPosture === void 0 ? {} : { readMisdirectionRootPosture: postRun.readMisdirectionRootPosture },
-    ...proposeGate1MaxPerJob === void 0 ? {} : { proposeGate1MaxPerJob },
-    // 389 D-09: the artifact's path is DERIVED from the artifact's own runId through the
-    // same `runs/<slug>/` law as the handoff read above — `slugBranch` is the traversal
-    // guard (T-389-01), and a job payload never carries a path.
+    // Derived from the artifact's own `runId` through `slugBranch`; a payload carries no path.
     persistAnalysis: (artifact) => writeAnalysisArtifact(
       join7(input.agentQaRoot, RUNS_SUBDIR3, slugBranch4(artifact.runId), ANALYSIS_FILE),
       artifact
     ),
-    // Plan 02's read side over the derived projection, keyed the projection's way —
-    // (product, filePath, testName), the stable identity, NEVER a per-run explicit id.
-    // The query arrives already keyed by the author callback; this binding only reads.
+    // Keyed by the stable identity (product, filePath, testName), never a per-run id; read-only.
     readTestHistory: (query) => readProjectedTestHistory(knowledgeRoot, query),
-    // D-02's sha-addressed screenshot bytes: the SAME CASS-02 store the runner writes.
-    // `FsEvidenceArtifactStore.getBlob` validates the lowercase 64-hex shape BEFORE any
-    // path use (T-389-14) and answers ENOENT as honest absence; the runId becomes a path
-    // segment only through `slugBranch` inside the store's own constructor.
-    //
-    // 405-05: THROUGH THE SHARED RULE, not a lambda of its own. `runs.artifact` binds a port over
-    // the same `lookupEvidenceBlob` below, and two lambdas over one store would be two answers to
-    // where a run's blobs live — agreeing on the day the second is written and diverging the first
-    // time either side changes a root. This job wants only the found bytes, so the three-arm
-    // lookup collapses here; the SPLIT is what the op needs and what this caller does not.
+    // Through the shared `lookupEvidenceBlob`, so `runs.artifact` and this job agree on blobs.
     readEvidenceBlob: (runId, sha) => readEvidenceBlobBytes({ agentQaRoot: input.agentQaRoot }, runId, sha),
-    // Host-resolved and passed through untouched (386 D-15): the budget derives from the
-    // same profile resolution as the job model, and this composition adds no knob of its own.
+    // Host-resolved from the job model's profile; this composition adds no knob.
     ...analysisTokenBudget === void 0 ? {} : { analysisTokenBudget }
   };
 }
@@ -2973,7 +2752,6 @@ function composeLocalAgent(input) {
       // which is also what its header will say. A container seeded from another session's override
       // would make one conversation's verb the next conversation's opening posture.
       state: createChatState({ activeModel: composedChatModelName })
-      // 432-13 (D-14): no pin holder. `/pin` left chat resolution with the op gate it tightened.
     };
     chatScopes.set(sessionId, scope);
     return scope;
@@ -2984,11 +2762,7 @@ function composeLocalAgent(input) {
   const chatSessionLog = createJsonlSessionLog({
     root: input.agentQaRoot,
     now: () => clock.now(),
-    // THE COMPOSED MODEL, not a session's override, and the difference is a leak this keying closes.
-    // This thunk is read when a header is WRITTEN, which happens exactly once per session and only
-    // for a session that has not existed until now — so no `/model` can have run in it. Answering
-    // with a live override would stamp one conversation's switch onto the opening header of every
-    // conversation opened after it. 441 GAP3-D4: written and listed through the declared mask.
+    // The composed model, masked: a live override would stamp one session's switch on later ones.
     model: () => input.mask(composedChatModelName),
     toolsetHash: () => chatToolsetHash(composedRegistry)
   });
@@ -3039,14 +2813,7 @@ function composeLocalAgent(input) {
         stage = createPlannerStage({
           model: chatModelsByName.get(activeName) ?? input.chatModel,
           tools: projectPlannerTools(composedRegistry, CHAT_PLANNER_CALLER),
-          // Read PER REQUEST — not per turn and not per stage (392 plan 13, CR-02). A stage
-          // is shared by every session planning under the same model name, so a context
-          // thunk taking no argument had exactly one conversation to answer with, and on
-          // two interleaved turns it answered with whichever one published last. Taking the
-          // requesting session's id makes "the conversation this request replays" a fact
-          // about the call. The read is still LIVE, so a `/model` override still moves what
-          // the prompt states without the stage being rebuilt, and the conversation block
-          // still carries what compaction left rather than a second replay of the log.
+          // Read per request: a stage is shared by every session planning under one model.
           context: (contextRequest) => {
             const scope = chatScopeFor(contextRequest.sessionId).state.read();
             return { activeModel: scope.activeModel, conversation: scope.conversation };
@@ -3060,41 +2827,22 @@ function composeLocalAgent(input) {
   const chatCompaction = input.chatAccounting === void 0 ? void 0 : createChatCompactionHook({
     accounting: input.chatAccounting,
     now: () => clock.now(),
-    // 392-06's flagged consumer, wired: what compaction leaves IS the conversation the
-    // prompt renders, and it lands in the live state on EVERY turn rather than only on a
-    // triggered pass — a sink that fired only when a pass ran would leave the prompt holding
-    // a stale conversation on every quiet turn. Into the SESSION'S OWN container (plan 13):
-    // the id is the compacted turn's, so a pruned history cannot land in another
-    // conversation however many turns are in flight.
+    // What compaction leaves is the conversation the prompt renders, kept per session.
     onConversation: (messages, sessionId) => {
       chatScopeFor(sessionId).state.setConversation(messages);
     }
   });
   const chatTurn = createTurnEngine({
     table: CHAT_RESOLVER_TABLE,
-    // 392 plan 02, D-09: the real conjunction grammar, quote-aware. The tracer's
-    // whole-utterance placeholder is gone; this is the seam filled, not widened.
+    // The real conjunction grammar, quote-aware.
     split: splitClauses,
     reconcile: input.chatReconcile ?? deterministicOverrideStrategy,
     sessionLog: trackedChatSessionLog,
-    // RESEARCH Pitfall 1: per-STAGE minting, because origin is a per-call fact. A deterministic
-    // table hit is a person typing and mints `human`; a planner-planned call mints `agent`, and the
-    // turn's receipts record which.
-    // 2026-10-01 (432-21, D-12): NOT STAMPED WITH THE SESSION ANY MORE. The session id rode the
-    // caller for the gate's deny overlay (plan 13, W-03) and the overlay is deleted (432-13/18/19);
-    // nothing reads `FunctionCaller.sessionId`. The session still reaches the ops that record it
-    // through the turn's own session facts, not through the caller.
+    // Minted per stage: a table hit is a person typing (`human`); a planned call is `agent`.
     mint: {
       forStage: (stage) => stage === "resolver" ? CHAT_RESOLVER_CALLER : CHAT_PLANNER_CALLER
     },
-    // 399.1 D-01/D-03/D-05: the classified envelope, built HERE because this closure is the one
-    // place in the system holding both the registry and the invoke call. The chat subtree cannot
-    // reach a spec by construction (384 FUNC-03), so the verdict and the render fold have to arrive
-    // as data on this return — which is what `ChatInvokeAnswer` is. `foldFunctionResult` owns the
-    // fail-closed rule so both composition roots get the same one rather than a copy each.
-    //
-    // invokeFunction validates canonical output; it does not promise masking. Classify those
-    // original bytes before projecting the answer into results[] and the durable clause_result.
+    // Classify the original bytes before projecting: `invokeFunction` does not mask.
     invoke: async (functionId, invokeInput, caller) => {
       if (composedRegistry === void 0) {
         throw new TypeError("a chat turn ran before its registry finished composing");
@@ -3105,24 +2853,9 @@ function composeLocalAgent(input) {
     },
     ...chatPlanner === void 0 ? {} : { planner: chatPlanner },
     ...chatCompaction === void 0 ? {} : { compaction: chatCompaction },
-    // 392 plan 08: the directive handlers, which is what turns the engine's
-    // `directive recognised but no handler` refusal from the shipped behaviour into an
-    // unreachable arm on this host. `/help` and `/quit` are REPL chrome and answer in prose;
-    // `/model` changes what the session is and returns the EFFECT it had. (432-13: `/pin` is gone.)
-    //
-    // RESOLVED PER SESSION (plan 13, CR-02 / W-03). Each one acts on a conversation rather than the
-    // project, so the handler set is built over the scope of the session running the turn:
-    // `/model` moves that conversation's model and `/quit` asks that loop to end.
+    // Resolved per session: `/model` and `/quit` act on the conversation running the turn.
     directives: (sessionId) => ({
-      // THE BATCH PRE-FLIGHT (392-14, E3/E3b). The engine asks this of EVERY directive of a turn
-      // before it applies the first one, so a refused later directive leaves an earlier one
-      // unapplied.
-      //
-      // IT APPLIES NOTHING. `/model` RESOLVES the model and caches it under its name — a cache is
-      // not the session's state, and the session's own `activeModel` is left exactly where it was.
-      // The resolution is also the only part of `/model` that can fail, so caching it here is what
-      // makes the later apply unable to throw after an earlier directive has already been carried
-      // out.
+      // Applies nothing: `/model` resolves and caches by name, so the apply cannot throw midway.
       validate: async (directive, argument) => {
         if (directive === "model" && argument !== void 0 && input.chatModelFor !== void 0) {
           chatModelsByName.set(argument, await input.chatModelFor(argument));
@@ -3144,17 +2877,7 @@ function composeLocalAgent(input) {
       }
     }),
     state: (sessionId) => chatScopeFor(sessionId).state,
-    // D-04: the configuration RE-READ, per turn and PER SESSION. A thunk rather than a captured
-    // value, because the drift worth detecting is precisely the one that happens underneath a
-    // running session — a model resolved differently by the host, or a build whose registry
-    // reaches further than the one this session opened against. The engine folds the log for what
-    // was last recorded and emits `model_change` / `active_tools_change` on the difference.
-    //
-    // THE MODEL IT REPORTS IS THE ASKING SESSION'S (plan 13). A composition-wide read would answer
-    // one conversation's `/model` override for every conversation, and the per-turn diff would
-    // then write a `model_change` into sessions nobody had switched.
-    //
-    // 441 GAP3-D4: masked, because the log it is compared with is masked on append.
+    // Re-read per turn and per session, and masked like the log it is compared with.
     config: (sessionId) => {
       const ids = chatToolsetIds(composedRegistry);
       return {
@@ -3162,20 +2885,9 @@ function composeLocalAgent(input) {
         toolset: { hash: chatToolsetHash(composedRegistry), ids }
       };
     },
-    // 395-08 D-14/D-15 · CFGM-05: the target vocabulary the PRE-DISPATCH write_test route reads.
-    // Bound off the SAME host verb `authoringRead.configuredTargetNames` uses, so the seam that
-    // decides whether to offer a scaffold and the loop that later checks what a model emitted are
-    // reading one answer rather than two. A host that cannot name its targets binds nothing and the
-    // route never runs, which leaves the shipped dispatch and the loop's own backstop exactly as
-    // they were.
-    // BOUND ONLY WHERE THE LOOP IS. A host that cannot author has nothing for this route to route,
-    // and binding it anyway would answer an empty vocabulary — which the route reads as the
-    // from-zero case and refuses, reporting the wrong cause for a host whose real problem is that
-    // `authoring.draft.write` is unbound. Absent leaves the shipped dispatch untouched.
+    // Bound only where the loop is; elsewhere an empty vocabulary refuses with the wrong cause.
     ...input.draftAuthoring !== void 0 && input.runExecution !== void 0 ? { configuredTargets: () => input.draftAuthoring.configuredTargetNames() } : {},
-    // 395-13 D-14: where the scaffold proposal is rendered before the in-turn apply is invoked.
-    // Conditionally spread on the exact idiom above, so a host that binds no surface leaves the
-    // field ABSENT and the engine's own "renders nothing" posture is what answers — in one place.
+    // Spread conditionally, so a host binding no surface leaves `present` absent.
     ...input.chatPresent === void 0 ? {} : { present: input.chatPresent },
     now: () => clock.now(),
     mintTurnId: () => `turn-${randomUUID3()}`
@@ -3191,19 +2903,7 @@ function composeLocalAgent(input) {
         ...input.resolveWriterAuthority === void 0 ? {} : { resolveWriterAuthority: input.resolveWriterAuthority }
       }).list()
     },
-    // D-14's history half, over the run-outcome projection's own read side (394-17, step b).
-    //
-    // ONE CONNECTION PER VERB, opened read-only and closed in `finally`, on the shape
-    // `readProjectedTestHistory` above already takes. An absent database, a store predating the
-    // projection tables and an identity nothing has counted all answer EMPTY — which
-    // `assessSuiteStability` turns into the honest `no-history` posture rather than into a clean
-    // bill of health. Any other read failure propagates: a corrupt store is not "no history".
-    //
-    // THE OUTCOME WORDS. The durable window keeps one boolean per build (`last_outcomes_json`),
-    // which is what the fold reduced each member's outcome to, so this spells it back with the two
-    // words it was reduced FROM. Nothing downstream compares those strings against a member list —
-    // `assessSuiteStability` counts DISTINCT values — so a flip in the window is a flip here, and
-    // no vocabulary is invented beyond what the projection actually kept.
+    // One read-only connection per verb; absent data answers empty, other failures propagate.
     outcomes: {
       testsIn: async (product, filePath) => {
         const knowledgeRoot = await input.knowledgeRoot();
@@ -3237,145 +2937,47 @@ function composeLocalAgent(input) {
           return runsReader.get(runId);
         }
       },
-      // 387 D-01: this host's list verbs are live sighting sites. Every entity a listing,
-      // an inspect, a diff or a show surfaces gets its permanent address the first time it
-      // is surfaced — which is what "pre-existing entities get IDs the day they are first
-      // referenced" means in practice, and it costs the creation paths nothing.
+      // List verbs are live sighting sites: an entity gets its address when first surfaced.
       knowledge: createKnowledgeReader(
         input.knowledgeRoot,
-        createMemorySightingHook(entityResolutionInput),
-        input.resolvePromotionPosture,
-        input.resolveTrustPriors
+        createMemorySightingHook(entityResolutionInput)
       ),
       config: input.config,
       entities: createEntityDirectory(entityResolutionInput),
-      // 387-08 KREV-01: the WRITE half, and it is present in every local composition because a
-      // local host owns the knowledge root it serves from. It stays an OPTIONAL dep so a host
-      // that is genuinely read-only — a listing, a remote surface — reports the four mutating
-      // verbs as `unbound` BY NAME rather than as a hole in the catalogue.
+      // Optional, so a read-only host reports the mutating verbs as `unbound` by name.
       knowledgeReview: createKnowledgeReview({
-        ...input.resolveTrustPriors === void 0 ? {} : { resolveTrustPriors: input.resolveTrustPriors },
-        ...input.resolvePromotionPosture === void 0 ? {} : { resolvePromotionPosture: input.resolvePromotionPosture },
         agentQaRoot: input.agentQaRoot,
         resolveKnowledgeRoot: input.knowledgeRoot,
         ...input.knowledgeChangeDelegate === void 0 ? {} : { knowledgeChangeDelegate: input.knowledgeChangeDelegate },
         ...input.resolveWriterAuthority === void 0 ? {} : { resolveWriterAuthority: input.resolveWriterAuthority },
-        // 432-12: the host's own context, so a direct change is recorded under the context it was
-        // actually made in. (432-39: the registry no longer receives it; this is its one reader.)
+        // The host's own context, so a direct change records the context it is made in.
         ...input.resolveExecutionContext === void 0 ? {} : { resolveExecutionContext: input.resolveExecutionContext }
       }),
-      // 388 D-14: chip truth, on EVERY local host and not gated on `postRun`. The two are
-      // different questions and conflating them would be the bug: `postRun` says whether this
-      // host can DO the chain's work, while this says whether it can SEE what the chain did —
-      // and a host that never drains anything (a status query, a listing, the CLI after a
-      // handed-off tail) is exactly the caller that most needs to read durable state.
-      //
-      // Given the SAME id source the queue below is built with, so the rows projected are the
-      // rows enqueued. It opens nothing here: the reader constructs no handle until it is asked
-      // a question, and never one that could create the database (Pitfall 4).
+      // On every host, unlike `postRun`: a host that never drains still reads what the chain did.
       postProcessing: createPostProcessingReader({
         agentQaRoot: input.agentQaRoot,
         idSource: input.idSource ?? DIGEST_JOB_ID_SOURCE
       }),
-      // 405 D-03: the run-detail projection read, conditionally spread on the house rule — an
-      // absent port must be an ABSENT field and not a present `undefined` one, because the
-      // registry reads exactly this record to decide what the capability LISTS as. Unlike
-      // `postProcessing` above it is NOT present on every local host: chip truth is readable from
-      // `agentQaRoot` alone, but a run's projected step tree lives in a dashboard database that
-      // only the dashboard process holds.
-      // 423 D-04: runs.evidence shares this reader with runs.detail and the blob reader
-      // below. The registry requires both for evidence without narrowing detail availability.
+      // An absent port must be an absent field: the registry lists capabilities off this record.
       ...input.runDetail === void 0 ? {} : { runDetail: input.runDetail },
-      // 405-05 D-12/D-13: the run-scoped evidence-blob read, on EVERY local host and NOT
-      // conditionally spread — unlike `runDetail` one line up, which needs a dashboard database
-      // this host may not hold, every local composition has a runtime root and therefore has the
-      // run directories these blobs live in. It is the SAME reader the analysis job's
-      // `readEvidenceBlob` is built over, so "resolve this ref" and "diet this evidence" cannot
-      // disagree about where a blob is.
+      // On every host, and the same reader the analysis job uses, so both agree where a blob is.
       evidenceBlobs: createEvidenceBlobReader({ agentQaRoot: input.agentQaRoot }),
-      // Present iff this host can execute a run. The registry reads the SAME record to
-      // decide what `runs.start` lists as, so the declaration and the dispatch cannot
-      // disagree about whether this composition can run it (D-16).
+      // Present only if this host can run; the registry lists `runs.start` from the same record.
       ...input.runExecution === void 0 ? {} : {
         runInvocation: createLocalRunInvocation({
           agentQaRoot: input.agentQaRoot,
           execution: input.runExecution
         })
       },
-      // 389 D-10/D-11: the artifact read `analysis.get` binds through, and the D-08
-      // recurrence join the one renderer consults. Both are bindable from `agentQaRoot`
-      // and the knowledge root alone, so every local composition carries them — a host
-      // with no artifact on disk serves the floor, and a host with no recorded history
-      // renders the explicit no-history clause; neither is a refusal (plan 05's law).
+      // Bindable from the roots alone, so every host serves the floor or the no-history clause.
       analysis: createAnalysisArtifactReader(input.agentQaRoot),
       recurrence: recurrence.provider,
-      // 398 D-09 (dated 2026-08-17): the catalog port `agent.explain` binds through, handed
-      // straight through from the host. Conditionally spread rather than assigned, on the
-      // `runInvocation` precedent: an absent port must be an ABSENT field and not a present
-      // `undefined` one, because the registry reads exactly this record to decide what the
-      // capability LISTS as — so the declaration and the dispatch cannot disagree about whether
-      // this composition can explain itself (D-16).
+      // Spread conditionally so `agent.explain` lists `unbound` where no catalog is handed in.
       ...input.capabilityCatalog === void 0 ? {} : { capabilityCatalog: input.capabilityCatalog },
-      // 403 D-03: the live-view mint seam, conditionally spread on the same rule — an absent port
-      // must be an ABSENT field, so `runs.liveurl` declares `unbound` where no origin is served.
+      // Spread conditionally, so `runs.liveurl` declares `unbound` where no origin is served.
       ...input.liveView === void 0 ? {} : { liveView: input.liveView },
-      // 390 D-12/D-13: the three quarantine verbs, bound HERE and therefore on BOTH hosts —
-      // the CLI tail and 386's daemon compose the same root, which is the whole point of
-      // 385 D-15 (a second binding site is a second answer to "what is quarantined").
-      //
-      // Present in every local composition for the same reason the knowledge WRITE half is: a
-      // local host owns the committed knowledge root the ledger lives at. It stays an OPTIONAL
-      // dep so a genuinely read-only or remote composition reports all three `unbound` BY NAME
-      // rather than answering an empty list about a ledger it has never been able to open.
-      //
-      // The port takes the root as a FACTORY (the CLI resolves it asynchronously) and the clock
-      // as an argument, so this composition supplies both and the implementation reads neither
-      // of its own accord. Nothing opens here: the first byte is read when a verb is invoked.
-      //
-      // 390-09 / CR-03: the SAME `resolveWriterAuthority` the apply path consumes three bindings
-      // above, and it is what lands each host on the correct lease arm with zero daemon changes.
-      // The daemon supplies it (`cli/src/daemon/host.ts:1839`) because it acquired the lease at
-      // startup and holds it for its lifetime, so the verbs ride that authority instead of asking
-      // for a lease the process cannot be granted twice; the CLI in-process host supplies nothing,
-      // so the verbs acquire and release per call. Conditionally spread like its neighbour rather
-      // than assigned through: an absent authority must be an ABSENT field, not a present
-      // `undefined` one, so the implementation's `?.()` arm distinguishes the two hosts.
-      //
-      // 390-12 / D-01: the identity mint is handed straight through, REQUIRED and unspread. The
-      // verbs key the committed ledger on `filePath` and every reader compares those bytes with
-      // `===`, so a host that supplied nothing would be back to storing whatever a human typed —
-      // the round-2 regression. Unlike the authority above there is no host without a checkout
-      // root, so the absent case is a compile error rather than a second posture.
-      // 394-07 D-12 / WTST-05: the honesty funnel's reads, bound HERE and therefore on BOTH hosts,
-      // which is the whole point of 385 D-15 — a second binding site would be a second answer to
-      // "how many drafts did this session keep", and that number is the one WTST-05 exists to keep
-      // honest.
-      //
-      // UNCONDITIONAL, unlike the loop's two halves above it, and the asymmetry is the point: the
-      // funnel is a READ over records this host owns by owning `agentQaRoot`, so every local
-      // composition can answer it whether or not it can author anything. An empty receipts
-      // directory and an absent one are the same answer, and nothing opens here — the first byte
-      // is read when the verb is invoked.
-      //
-      // THE RECEIPTS PORT IS THE READ HALF ONLY. The evaluator one binding below is handed the
-      // same store's `put`; this bundle names `list` and nothing else, so the projection is
-      // structurally unable to write the records it reports on. Two narrow mirrors over one store
-      // rather than one wide port.
-      //
-      // 2026-10-01 (432-17, D-06): the bundle no longer reads the proposals inbox. 2026-10-02
-      // (quick 261002-ctr): the terminal stage is `writeEligible`, read off the receipts this
-      // bundle lists (see `projectAuthoringFunnel`).
-      //
-      // `outcomes` IS BOUND (394-17, step b): the port's two verbs now LEAD with `product`, so the
-      // binding reads the run-outcome projection on its own primary key instead of guessing a
-      // partition or serving every product's history under one file path.
-      //
-      // ASSEMBLED ABOVE rather than inline, because the gate-2 flip path is handed the SAME
-      // bundle: one composition-level answer to "what does this project know about this suite",
-      // reached by the funnel read op and by the evaluator's consultation alike.
+      // The funnel reads records this host owns, so it is unconditional; its receipts port lists.
       authoringFunnel,
-      // 2026-10-01 (432-17, D-05/D-22): the proposals inbox (391 PROP-03) is not bound — it is deleted
-      // with its ops. Old files under `<agentQaRoot>/proposals/` are never opened again.
       ...input.feedback === void 0 ? {} : { feedback: input.feedback },
       ...input.feedbackReads === void 0 ? {} : { feedbackReads: input.feedbackReads },
       quarantine: createQuarantineOperations({
@@ -3384,24 +2986,13 @@ function composeLocalAgent(input) {
         mintIdentityPath: input.mintQuarantineIdentityPath,
         ...input.resolveWriterAuthority === void 0 ? {} : { resolveWriterAuthority: input.resolveWriterAuthority }
       }),
-      // 392 D-24: the turn engine assembled above. Bound HERE and therefore on BOTH hosts, so
-      // `agent.ask` is a real capability wherever the composition root runs — and unbound nowhere,
-      // which is what lets 397's parity suite read it off the registry with no chat-specific case.
+      // Bound here, so `agent.ask` is a real capability on every host.
       chatTurn: {
         // The engine also echoes authored clause text on receipts and refusal answers. Mask
         // the complete outward projection after execution, never the message it dispatches.
         runTurn: async (turnInput) => projectChatMembers(await chatTurn.runTurn(turnInput), CHAT_TURN_RESULT_RULES, input.mask)
       },
-      // 393 D-01 / D-15: the keep-gate evaluator's two host halves, bound HERE and therefore on
-      // BOTH hosts — the CLI and 386's daemon compose this same root, which is the whole point of
-      // 385 D-15 (a second binding site would be a second answer to "is this draft worth keeping",
-      // and the two would disagree about a decision that gets written into a durable receipt).
-      //
-      // Conditionally spread on BOTH halves, because a capability that can parse but cannot run is
-      // not a degraded evaluator — it is a host that must say `unbound` by name. `runs.start` is
-      // dispatched through the registry this very call is about to produce, which is the same
-      // deferred reference the chat engine takes and is safe for the same reason: no op can run
-      // before the registry it is registered in has been built.
+      // Both halves spread conditionally: a host that can parse but not run says `unbound`.
       ...input.draftAuthoring === void 0 || input.runExecution === void 0 ? {} : {
         draftEvaluation: createDraftEvaluation({
           authoring: input.draftAuthoring,
@@ -3422,50 +3013,7 @@ function composeLocalAgent(input) {
           }
         })
       },
-      // 394 D-01 / WTST-01: the authoring LOOP's two halves, bound HERE and therefore on BOTH
-      // hosts, under the SAME condition the evaluator above is bound under — the loop's stage 4
-      // dispatches `authoring.draft.verify`, so a host that cannot verify a draft cannot author
-      // one either, and a third answer to "can this host author" would be a third thing to keep
-      // in step.
-      //
-      // THE READ HALF IS `getAuthoringBrief`'S FIRST PRODUCTION CALLER. The port has been
-      // implemented and unbound since v51 (`knowledge-local/src/serving/authoring-reader.ts`),
-      // which means every field of its contract is crossing a real seam for the first time here;
-      // a mismatch surfaces at this binding rather than in a surface. The reader is built PER
-      // CALL over a freshly resolved knowledge root, on the standing-approval reader's stated
-      // reasoning — the CLI resolves its root asynchronously and per call, and a root captured
-      // once would serve a brief out of a knowledge tree the invocation is not serving from. No
-      // `product` is bound: the composition does not own one, and the SCOPE arrives on the op's
-      // input, which is the honest half of the pair the reader filters on.
-      //
-      // `suiteTextCorpus` is the SAME host walk gate 3's degraded lane already consumes, reached
-      // here for stage 2's pre-authoring screen. One walk, one notion of what a suite test's text
-      // is; a second enumeration would let the screen and the gate disagree about the same pair.
-      //
-      // THE WRITE HALF bundles the model, the shelf and the verify dispatch, because none of the
-      // three is independently bindable: a host with a model and no shelf cannot author, one with
-      // a shelf and no model has nothing to author with, and one that can do both but cannot
-      // verify would produce a test and have nothing to say about whether it is worth keeping.
-      // The model is a FACTORY, resolved at most once and only when a draft is actually compiled,
-      // the same idiom `openJobs` uses — binding this capability must not construct a client for a
-      // host that never authors.
-      //
-      // WHY THE ROUTER (plan 05) WILL READ `DraftRunPortLike.get`'s `CompletedRunHandoff` AND NOT
-      // `runs.get`'s PROJECTION. D-08 routes on run EVIDENCE — step terminations, planning
-      // failure, cycle flags, the per-step sub-action record — and `runs.get` projects a
-      // `RunDetail` in which none of that survives (`stepCount` is its only step-shaped field).
-      // This is `createDraftEvaluation`'s own posture, stated one layer out: the op is reached for
-      // what an op owns, and the reader is read for evidence no projection carries. A router built
-      // on the projection would have to infer a mechanics failure from a member verdict, and
-      // inferring an app defect out of a bare member verdict is precisely the cardinal error D-08
-      // exists to make unreachable.
-      //
-      // A NOTE FOR WHOEVER EDITS THIS PARAGRAPH. The arch dependency scan reads import specifiers
-      // out of this file's RAW BYTES, comments included, so any prose shaped like an import's
-      // trailing clause — the keyword, then a quoted phrase — is reported as an undeclared
-      // external dependency of this package. Two drafts of this comment tripped it, once on a
-      // sentence about verdicts and once on the sentence explaining the first. Keep quoted phrases
-      // away from that keyword here.
+      // The arch import scan reads comments too: never put a quote after the word `from`.
       ...authoringLoopHost === void 0 ? {} : {
         authoringRead: {
           async getAuthoringBrief(intent, scope) {
@@ -3473,35 +3021,21 @@ function composeLocalAgent(input) {
             return createAuthoringReader({ knowledgeRoot }).getAuthoringBrief(intent, scope);
           },
           suiteTextCorpus: () => authoringLoopHost.suiteTextCorpus(),
-          // 394-33 · WR-07: the `target` vocabulary stage 3's compile prompt serves. Bound off the
-          // SAME port the brief and the corpus come from, so a host that can run the loop's read
-          // stages can name its own targets by construction — see the port's own doc.
+          // Off the same port as the brief and corpus, so a loop host names its own targets.
           configuredTargetNames: () => authoringLoopHost.configuredTargetNames()
         },
-        // 394-26 · WINDOWS 110: the scope an intent-only call is authored at, bound HERE and so on
-        // BOTH hosts, off the same port the read and compile halves come from. Its own deps key
-        // rather than a third verb on `authoringRead`, because deriving a scope needs the resolved
-        // config and the workspace while the brief needs a knowledge index — a host can have one
-        // without the other, and the op refuses on THIS key by name when a scope-less call arrives
-        // at a composition that never bound it.
+        // Its own key: a scope needs config and workspace, the brief needs an index.
         authoringScope: {
           deriveDefault: () => authoringLoopHost.deriveDefaultScope()
         },
         draftShelf: {
           model: async () => await input.model(),
           write: (contents) => authoringLoopHost.stageDraft(contents),
-          // 394-06 D-09/D-20: the ONE RFC-6902 applier, reached at the host because it needs the
-          // yaml CST and neither `agent` nor this package may depend on `core`. Same seam,
-          // same reason and same shape as `stageDraft` right above it.
+          // The one RFC 6902 applier, at the host because it needs `core`'s yaml CST.
           applyPatches: (draft, patchSet) => authoringLoopHost.applyPatchesToDraft(draft, patchSet),
-          // 432 D-06/D-07: the direct writer the loop's final write and the edit op reach. Same seam
-          // and same reason as the two verbs above: the boundary check needs `core`.
+          // Same seam as the verbs above: the boundary check needs `core`.
           publish: (request) => authoringLoopHost.publishDraft(request),
-          // 394-06: stage 5's evidence reader and the repair arm's probe runner. The reader is
-          // the same `runsReader` the gate evaluator is bound to — a second reader would be a
-          // second answer to what one run recorded — and the starter dispatches the REGISTERED
-          // `runs.start` on the gate-run caller, so a probe is marker-stamped exactly as a gate
-          // run is and is excluded from outcomes for the same reason.
+          // The evaluator's reader; probes use the gate-run caller, so outcomes exclude them.
           runs: {
             start: async (request) => {
               if (composedRegistry === void 0) {
@@ -3516,8 +3050,6 @@ function composeLocalAgent(input) {
             },
             get: (runId) => runsReader.get(runId)
           },
-          // 2026-10-01 (432-18/432-19, D-15): no dispatch-scoped grant exists. The authoring loop
-          // runs its dispatch directly, and no gate run it starts consults any approval.
           verifyDraft: async (verifyInput) => {
             if (composedRegistry === void 0) {
               throw new TypeError("a draft was verified before its registry finished composing");
@@ -3530,28 +3062,13 @@ function composeLocalAgent(input) {
             );
           }
         }
-        // 2026-10-01 (432-17, D-06): no authoring proposal writer is bound; an authored test is
-        // written in its own call through the shelf's direct writer.
       },
-      // 432-16 (D-07): no test-draft or config commit port and no undo source is bound — agent-qa
-      // makes no git commits. The final authored test is written through `draftShelf.publish`.
-      //
-      // 395-01 D-01/D-03/D-17 · CFGM-01/03/04: the config editor's host half, each spread on its
-      // OWN condition rather than as one bundle, so a host missing one reports that one `unbound`.
+      // Each config-editor half spreads on its own condition, so a missing one reads `unbound`.
       ...input.configFiles === void 0 ? {} : { configFiles: input.configFiles },
       ...input.configValidate === void 0 ? {} : { configValidate: input.configValidate },
       ...input.scaffoldContent === void 0 ? {} : { scaffoldContent: input.scaffoldContent },
       ...input.configWrite === void 0 ? {} : { configWrite: input.configWrite }
-      // 2026-10-14 (441-39, D-15): a config change is not scanned for secrets, so no scan is bound.
-      // 2026-10-01 (432-17, D-05): no config proposal filer is bound; the six config ops write in
-      // the call through `configWrite`.
     }
-    // 2026-10-15 (441-28, D-15): no audit sink; the guardrail audit went with the guardrails.
-    // 432-13 (D-14/D-15): no standing-approval reader, confirm port or session deny overlay reaches
-    // the registry — `invokeFunction` asks nobody. 432-18 deleted the grant reader with the ledger.
-    // 2026-10-02 (432-39, D-12): the host's execution-context answer is no longer forwarded here.
-    // The registry's option was retired and unread since 432-13 and is deleted; the same answer
-    // still reaches the knowledge review above, which records a direct change under it.
   });
   composedRegistry = registry;
   let opened;
@@ -3563,7 +3080,6 @@ function composeLocalAgent(input) {
     const model = await input.model();
     const knowledgeRoot = await input.knowledgeRoot();
     const analysisTokenBudget = input.analysisTokenBudget === void 0 ? void 0 : await input.analysisTokenBudget();
-    const proposeGate1MaxPerJob = input.postRun?.proposeGate1MaxPerJob === void 0 ? void 0 : await input.postRun.proposeGate1MaxPerJob();
     const store = createSqliteJobStore({
       path: join7(input.agentQaRoot, AGENT_JOB_STORE_DB_FILE),
       clock,
@@ -3572,7 +3088,7 @@ function composeLocalAgent(input) {
     let jobs;
     try {
       const kinds = input.jobKinds ?? createRealJobKindRegistry(
-        postRunCapabilities(input, knowledgeRoot, analysisTokenBudget, store, proposeGate1MaxPerJob)
+        postRunCapabilities(input, knowledgeRoot, analysisTokenBudget)
       );
       const idSource = input.idSource ?? DIGEST_JOB_ID_SOURCE;
       const unclaimableKinds = UNCLAIMABLE_BY_PROSE_POSTURE[input.postRun?.candidateProse ?? "no-masker"];
@@ -3659,13 +3175,330 @@ import {
 } from "@vostride/agent-qa-runner-local";
 import { resolveBuildTag } from "@vostride/agent-qa-runner-local";
 
+// src/store/mark-ledger.ts
+import { closeSync as closeSync5, existsSync as existsSync5, fsyncSync as fsyncSync5, openSync as openSync5, readFileSync as readFileSync6, renameSync as renameSync4, unlinkSync, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join9 } from "node:path";
+import {
+  canonicalJson as canonicalJson6,
+  ImprovementPlanSchema,
+  MarkReceiptSchema,
+  markAddressKey,
+  slugBranch as slugBranch5
+} from "@vostride/agent-qa-schema";
+import { z as z2 } from "zod";
+
+// src/composition/run-layout.ts
+import { HANDOFF_FILE as HANDOFF_FILE2, RUNS_SUBDIR as RUNS_SUBDIR4, loadCompletedRunHandoff as loadCompletedRunHandoff2 } from "@vostride/agent-qa-runner-local";
+
+// src/store/mark-lock.ts
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { closeSync as closeSync4, fsyncSync as fsyncSync4, lstatSync, mkdirSync as mkdirSync4, openSync as openSync4, readFileSync as readFileSync5, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname7, join as join8 } from "node:path";
+import { z } from "zod";
+var ownerSchema = z.object({
+  schemaVersion: z.literal(2),
+  kind: z.literal("mark-ledger-lock"),
+  pid: z.number().int().positive(),
+  token: z.uuid(),
+  runId: z.string().min(1)
+}).strict();
+function syncDirectory(path) {
+  const fd = openSync4(path, "r");
+  try {
+    fsyncSync4(fd);
+  } finally {
+    closeSync4(fd);
+  }
+}
+function readOwner(path, runId) {
+  try {
+    const directory = lstatSync(path);
+    if (!directory.isDirectory() || directory.isSymbolicLink()) return void 0;
+    const ownerFile = join8(path, "owner.json");
+    const file = lstatSync(ownerFile);
+    if (!file.isFile() || file.isSymbolicLink()) return void 0;
+    const parsed = ownerSchema.safeParse(JSON.parse(readFileSync5(ownerFile, "utf8")));
+    return parsed.success && parsed.data.runId === runId ? parsed.data : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function positivelyDead(pid) {
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch (error) {
+    return error.code === "ESRCH";
+  }
+}
+async function acquireMarkLock(lock, runId, busy) {
+  const owner = { schemaVersion: 2, kind: "mark-ledger-lock", pid: process.pid, token: randomUUID4(), runId };
+  const candidate = `${lock}.candidate-${owner.token}`;
+  mkdirSync4(candidate);
+  const fd = openSync4(join8(candidate, "owner.json"), "wx", 384);
+  try {
+    writeFileSync4(fd, JSON.stringify(owner));
+    fsyncSync4(fd);
+  } finally {
+    closeSync4(fd);
+  }
+  syncDirectory(candidate);
+  const started = Date.now();
+  let acquired = false;
+  try {
+    while (!acquired) {
+      try {
+        mkdirSync4(lock);
+        renameSync3(join8(candidate, "owner.json"), join8(lock, "owner.json"));
+        syncDirectory(lock);
+        syncDirectory(dirname7(lock));
+        rmSync3(candidate, { recursive: true });
+        acquired = true;
+      } catch (error) {
+        if (!["EEXIST", "ENOTEMPTY", "ENOTDIR", "EISDIR", "EPERM", "EACCES"].includes(error.code ?? "")) throw error;
+        const current = readOwner(lock, runId);
+        if (current !== void 0 && positivelyDead(current.pid)) {
+          try {
+            renameSync3(lock, `${lock}.dead-${current.token}`);
+            syncDirectory(dirname7(lock));
+            continue;
+          } catch (recoveryError) {
+            if (recoveryError.code === "ENOENT") continue;
+            if (!["EEXIST", "ENOTEMPTY", "ENOTDIR", "EISDIR", "EPERM", "EACCES"].includes(recoveryError.code ?? "")) throw recoveryError;
+          }
+        }
+        const remaining = 1e4 - (Date.now() - started);
+        if (remaining <= 0) throw busy();
+        await new Promise((resolve2) => setTimeout(resolve2, Math.min(50, remaining)));
+      }
+    }
+  } finally {
+    if (!acquired) rmSync3(candidate, { recursive: true, force: true });
+  }
+  return () => {
+    if (readOwner(lock, runId)?.token !== owner.token) return;
+    const released = `${lock}.released-${owner.token}`;
+    renameSync3(lock, released);
+    syncDirectory(dirname7(lock));
+    rmSync3(released, { recursive: true });
+    syncDirectory(dirname7(lock));
+  };
+}
+
+// src/store/mark-ledger.ts
+var MARKS_LEDGER_FILE = "marks.jsonl";
+var MARKS_LEDGER_LOCK_FILE = "marks.jsonl.lock";
+var MARK_INTENT_FILE = "mark-intent.json";
+var MARK_INTENT_STAGES = ["prepared", "evidence", "applied"];
+var intentSchema = z2.object({
+  schemaVersion: z2.literal(2),
+  mark: MarkReceiptSchema,
+  stage: z2.enum(MARK_INTENT_STAGES),
+  operationId: z2.uuid(),
+  plan: ImprovementPlanSchema.optional()
+}).strict().superRefine((intent, ctx) => {
+  if (intent.stage === "applied" && intent.mark.disposition.kind === "drafted") {
+    ctx.addIssue({ code: "custom", path: ["mark", "disposition"], message: "a mark applies its fix; it never files a draft" });
+  }
+});
+function atomicPublish(path, text) {
+  const staged = `${path}.pending`;
+  const fd = openSync5(staged, "w", 384);
+  try {
+    writeFileSync5(fd, text);
+    fsyncSync5(fd);
+  } finally {
+    closeSync5(fd);
+  }
+  renameSync4(staged, path);
+}
+var MarkLedgerBusyError = class extends Error {
+  constructor() {
+    super("Mark ledger is busy; retry the mark after the current transaction finishes");
+    this.name = "MarkLedgerBusyError";
+  }
+};
+var MarkLedgerCorruptError = class extends Error {
+  constructor(line) {
+    super(`Mark ledger is corrupt at line ${line}`);
+    this.line = line;
+    this.name = "MarkLedgerCorruptError";
+  }
+};
+var MarkIntentUnusableError = class extends Error {
+  constructor(intentPath, reason) {
+    const what = reason === "earlier-version" ? "was written by an earlier agent-qa version, which this version does not read" : reason === "unreadable" ? "is unreadable" : "does not match this run's mark ledger";
+    super(`The unfinished-mark record ${intentPath} ${what}; nothing was marked. Remove that file, then mark again.`);
+    this.intentPath = intentPath;
+    this.reason = reason;
+    this.name = "MarkIntentUnusableError";
+  }
+};
+function isEarlierVersionIntent(value) {
+  if (value === null || typeof value !== "object") return false;
+  const intent = value;
+  return "proposalUuid" in intent || "testDraft" in intent || intent["stage"] === "drafted";
+}
+function latestMarkReceiptsPerAddress(receipts) {
+  const latest = /* @__PURE__ */ new Map();
+  for (const receipt of receipts) {
+    const key = markAddressKey(receipt);
+    if ((latest.get(key)?.ordinal ?? 0) < receipt.ordinal) latest.set(key, receipt);
+  }
+  return [...latest.values()].sort(
+    (a, b) => a.testIndex - b.testIndex || (a.stepIndex ?? -1) - (b.stepIndex ?? -1)
+  );
+}
+function latestMarkReceiptFor(receipts, runId, address) {
+  if (address.runId !== runId) return void 0;
+  return latestMarkReceiptsPerAddress(receipts).find((receipt) => markAddressKey(receipt) === markAddressKey(address) && (address.testId === void 0 || receipt.testId === address.testId));
+}
+var MarkLedgerNoRunError = class extends Error {
+  constructor() {
+    super("run-not-found: mark ledger requires a completed run handoff");
+    this.name = "MarkLedgerNoRunError";
+  }
+};
+var FsMarkLedger = class {
+  dir;
+  file;
+  lock;
+  runId;
+  runSlug;
+  inTransaction = false;
+  intentValue;
+  constructor(config) {
+    this.runId = config.runId;
+    this.runSlug = slugBranch5(config.runId);
+    this.dir = join9(config.root, RUNS_SUBDIR4, this.runSlug);
+    this.file = join9(this.dir, MARKS_LEDGER_FILE);
+    this.lock = join9(this.dir, MARKS_LEDGER_LOCK_FILE);
+  }
+  read() {
+    let text;
+    try {
+      text = readFileSync6(this.file, "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT") return [];
+      throw error;
+    }
+    if (text === "") return [];
+    const lines = text.split("\n");
+    if (lines.pop() !== "") throw new MarkLedgerCorruptError(lines.length + 1);
+    return lines.map((line, index) => {
+      try {
+        const receipt = MarkReceiptSchema.parse(JSON.parse(line));
+        if (receipt.ordinal !== index + 1 || receipt.runId !== this.runId || receipt.runSlug !== this.runSlug) {
+          throw new Error("ledger identity or ordinal mismatch");
+        }
+        return receipt;
+      } catch {
+        throw new MarkLedgerCorruptError(index + 1);
+      }
+    });
+  }
+  latestPerAddress() {
+    return latestMarkReceiptsPerAddress(this.read());
+  }
+  latestFor(address) {
+    if (address.runId !== this.runId) return void 0;
+    return latestMarkReceiptFor(this.read(), this.runId, address);
+  }
+  /** Private resumable state is admitted only while this run's existing lock is held. */
+  prepareIntent(mark, operationId) {
+    if (!this.inTransaction) throw new Error("mark intent requires the run transaction");
+    const prior = this.intentValue;
+    if (prior !== void 0) {
+      const request = (value) => ({
+        runId: value.runId,
+        testIndex: value.testIndex,
+        testId: value.testId,
+        stepIndex: value.stepIndex,
+        kind: value.kind,
+        note: value.note
+      });
+      if (canonicalJson6(request(prior.mark)) !== canonicalJson6(request(mark))) {
+        throw new Error("An unfinished mark must be retried with its original address, kind and note");
+      }
+      return prior;
+    }
+    return this.checkpointIntent({ schemaVersion: 2, mark, operationId, stage: "prepared" });
+  }
+  checkpointIntent(value) {
+    if (!this.inTransaction) throw new Error("mark intent requires the run transaction");
+    const intent = intentSchema.parse(value);
+    if (intent.mark.runId !== this.runId || intent.mark.runSlug !== this.runSlug || intent.mark.ordinal !== this.read().length + 1) throw new MarkLedgerCorruptError(intent.mark.ordinal);
+    atomicPublish(join9(this.dir, MARK_INTENT_FILE), `${canonicalJson6(intent)}
+`);
+    this.intentValue = intent;
+    return intent;
+  }
+  async transact(fn) {
+    if (!existsSync5(join9(this.dir, HANDOFF_FILE2))) throw new MarkLedgerNoRunError();
+    const release = await acquireMarkLock(this.lock, this.runId, () => new MarkLedgerBusyError());
+    try {
+      const receipts = this.read();
+      const nextOrdinal = receipts.length + 1;
+      const intentPath = join9(this.dir, MARK_INTENT_FILE);
+      this.intentValue = void 0;
+      if (existsSync5(intentPath)) {
+        let raw;
+        try {
+          raw = JSON.parse(readFileSync6(intentPath, "utf8"));
+        } catch {
+          throw new MarkIntentUnusableError(intentPath, "unreadable");
+        }
+        const parsed = intentSchema.safeParse(raw);
+        if (!parsed.success) {
+          throw new MarkIntentUnusableError(
+            intentPath,
+            isEarlierVersionIntent(raw) ? "earlier-version" : "unreadable"
+          );
+        }
+        const intent = parsed.data;
+        if (intent.mark.runId !== this.runId || intent.mark.runSlug !== this.runSlug) {
+          throw new MarkIntentUnusableError(intentPath, "mismatched");
+        }
+        if (intent.mark.ordinal === nextOrdinal) this.intentValue = intent;
+        else if (canonicalJson6(receipts[intent.mark.ordinal - 1]) === canonicalJson6(intent.mark)) unlinkSync(intentPath);
+        else throw new MarkIntentUnusableError(intentPath, "mismatched");
+      }
+      this.inTransaction = true;
+      const record = await fn(nextOrdinal);
+      if (record === void 0) return void 0;
+      const receipt = MarkReceiptSchema.parse({ ...record, ordinal: nextOrdinal });
+      if (receipt.runId !== this.runId || receipt.runSlug !== this.runSlug) {
+        throw new Error("mark receipt does not belong to this run ledger");
+      }
+      if (this.intentValue !== void 0 && (this.intentValue.stage !== "applied" || canonicalJson6(this.intentValue.mark) !== canonicalJson6(receipt))) {
+        throw new MarkLedgerCorruptError(nextOrdinal);
+      }
+      const before = existsSync5(this.file) ? readFileSync6(this.file, "utf8") : "";
+      atomicPublish(this.file, `${before}${canonicalJson6(receipt)}
+`);
+      if (this.intentValue !== void 0) unlinkSync(intentPath);
+      return receipt;
+    } finally {
+      this.inTransaction = false;
+      this.intentValue = void 0;
+      release();
+    }
+  }
+  append(record) {
+    return this.transact(async () => record);
+  }
+};
+
+// src/composition/action-cache.ts
+import { purgeActionCache } from "@vostride/agent-qa-runner-local";
+
 // src/composition/compose-job-recovery.ts
-import { join as join8 } from "node:path";
+import { join as join10 } from "node:path";
 import { createAgentJobQueue as createAgentJobQueue2, createRealJobKindRegistry as createRealJobKindRegistry2 } from "@vostride/agent-qa-agent";
 var JOB_RECOVERY_MAX_RESUMED_JOBS = 64;
 function composeJobRecovery(input) {
   const store = createSqliteJobStore({
-    path: join8(input.agentQaRoot, AGENT_JOB_STORE_DB_FILE),
+    path: join10(input.agentQaRoot, AGENT_JOB_STORE_DB_FILE),
     clock: input.clock,
     checkpoints: createJobCheckpointStore({ root: input.agentQaRoot })
   });
@@ -3785,7 +3618,6 @@ function createMemorySessionLog(options) {
   };
 }
 export {
-  ALLOW_PRODUCTION_OPT_IN,
   BRIEF_CEILING,
   BRIEF_FRACTION,
   BuildOrdinalReservationError,
@@ -3802,25 +3634,32 @@ export {
   EMBEDDER_WORKER_TERM_GRACE_MS,
   ENTITY_INDEX_SWEEP_INTERVAL_MS,
   EmbedderWorkerTimeoutError,
+  FsMarkLedger,
   GLOBAL_RECORD_CAP,
+  HANDOFF_FILE2 as HANDOFF_FILE,
   InvalidChatSessionIdError,
   JOB_RECOVERY_MAX_RESUMED_JOBS,
   LOCAL_CURATION_CAPABILITIES,
   LOCAL_DAEMON_CAPABILITIES,
   LOCAL_KNOWLEDGE_PROBES,
   LocalAgentClosedError,
+  MARKS_LEDGER_FILE,
+  MARKS_LEDGER_LOCK_FILE,
+  MARK_INTENT_FILE,
   MIN_BRIEF,
   MIN_CAUTION,
   MIN_MEMORY_TOOL_CONTEXT_WINDOW,
+  MarkIntentUnusableError,
+  MarkLedgerBusyError,
+  MarkLedgerCorruptError,
+  MarkLedgerNoRunError,
   QUARANTINE_CLASS_DISPOSITIONS,
   QUARANTINE_FLOOR_ELIGIBILITY,
   READ_BODY_FRACTION,
-  REFUSED_RUN_REQUEST_FIELDS,
-  RunDeniedError,
+  RUNS_SUBDIR4 as RUNS_SUBDIR,
   RunIdAlreadyInUseError,
   RunIdNotMintedError,
   RunProducedNoEventsError,
-  RunRequestFieldRefusedError,
   SUITE_LIFECYCLE_LANE,
   SYSTEM_CLOCK,
   SuiteBoundaryWhileLiveError,
@@ -3829,7 +3668,6 @@ export {
   WEAK_MODEL_CAP_SCALE,
   applyKnowledgeChange,
   buildMemberRunConfig,
-  buildProductionRefusal,
   buildRunPorts,
   buildScreenshotCompressor,
   buildSuiteMemberExecutor,
@@ -3849,15 +3687,17 @@ export {
   createRunsReader,
   createSuiteLifecycle,
   latestBuildOrdinal,
+  latestMarkReceiptFor,
+  latestMarkReceiptsPerAddress,
   listSessions,
+  loadCompletedRunHandoff2 as loadCompletedRunHandoff,
   lookupEvidenceBlob,
   mapVerdictToExitCode,
   memoryToolGate,
   mintChatSessionId,
   openRunKnowledgeComposition,
+  purgeActionCache,
   readEvidenceBlobBytes,
-  refuseProductionWithoutOptIn,
-  refuseUnavailableRunId,
   registerAdapterLiveStream,
   reserveBuildOrdinalForProducts,
   resolveBuildTag,