ai-delivery-workflow 0.2.2 → 0.4.0

package/lib/delivery-state.mjs

@@ -1,9 +1,24 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import zlib from "node:zlib";
+import {
+  historyAnchorId,
+  readVerifiedHistoryAnchor,
+  structuredDocumentChecksum,
+} from "./history-anchor.mjs";
+import { assertPathInside, atomicWrite } from "./fs-utils.mjs";
 
-const NODE_IDS = new Set([
+const SEVEN_NODE_DEVELOPMENT_IDS = [
   "00-bootstrap",
+  "01-product-shaping",
+  "02-solution-design",
+  "03-delivery-readiness",
+  "04-implementation",
+  "05-candidate-assurance",
+  "06-version-closeout",
+];
+const LEGACY_DEVELOPMENT_IDS = [
   "01-product-discovery",
   "02-product-definition",
   "03-architecture-initial",
@@ -16,11 +31,15 @@ const NODE_IDS = new Set([
   "10-change-review",
   "11-candidate-verification",
   "12-version-closeout",
+];
+const LEGACY_PRODUCTION_IDS = [
   "12-release-preparation",
   "13-production-approval",
   "14-production-deployment",
   "15-production-verification",
   "16-version-archive",
+];
+const RELEASE_NODE_IDS = [
   "R00-release-request",
   "R01-version-selection",
   "R02-release-eligibility",
@@ -32,10 +51,21 @@ const NODE_IDS = new Set([
   "R08-production-deployment",
   "R09-production-verification",
   "R10-release-archive",
+];
+const NODE_IDS = new Set([
+  ...SEVEN_NODE_DEVELOPMENT_IDS,
+  ...LEGACY_DEVELOPMENT_IDS,
+  ...LEGACY_PRODUCTION_IDS,
+  ...RELEASE_NODE_IDS,
 ]);
+const SEVEN_NODE_DEVELOPMENT_ID_SET = new Set(SEVEN_NODE_DEVELOPMENT_IDS);
+const LEGACY_DEVELOPMENT_ID_SET = new Set(LEGACY_DEVELOPMENT_IDS);
+const RELEASE_NODE_ID_SET = new Set(RELEASE_NODE_IDS);
 const ARTIFACT_STATUSES = new Set([
   "draft",
   "review-draft",
+  "submitted",
+  "rejected",
   "pending-approval",
   "approved",
   "valid",
@@ -54,14 +84,24 @@ const ARTIFACT_STATUSES = new Set([
   "rolled-back",
   "archived",
 ]);
+const WORKING_DRAFT_STATUSES = new Set(["draft", "review-draft"]);
 const GATE_DECISIONS = new Set(["approved", "rejected", "blocked", "not-required"]);
 const UX_GATE_IDS = new Set(["UX-LF", "UX-VS", "UX-UI"]);
+const RETIRED_GATE_IDS = new Set(["UX-LF"]);
+const UX_GATE_NODES = new Set(["02-solution-design", "04-experience-design"]);
+const PRODUCT_TERMINAL_NODES = new Set(["01-product-shaping", "02-product-definition"]);
 const SUCCESSFUL_ARTIFACT_STATUSES = new Set([
   "approved", "valid", "frozen", "immutable", "passed", "deployed", "released",
   "release-ready", "included-in-release", "archived",
 ]);
 const NODE_RULES = new Map([
   ["00-bootstrap", { scope: "development", prerequisites: [], gates: [] }],
+  ["01-product-shaping", { scope: "development", prerequisites: ["00-bootstrap"], gates: ["GATE-A", "GATE-B"] }],
+  ["02-solution-design", { scope: "development", prerequisites: ["01-product-shaping"], gates: ["UX-VS", "UX-UI"] }],
+  ["03-delivery-readiness", { scope: "development", prerequisites: ["02-solution-design"], gates: [] }],
+  ["04-implementation", { scope: "development", prerequisites: ["03-delivery-readiness"], gates: [] }],
+  ["05-candidate-assurance", { scope: "development", prerequisites: ["04-implementation"], gates: [] }],
+  ["06-version-closeout", { scope: "development", prerequisites: ["05-candidate-assurance"], gates: [] }],
   ["01-product-discovery", { scope: "development", prerequisites: ["00-bootstrap"], gates: ["GATE-A"] }],
   ["02-product-definition", { scope: "development", prerequisites: ["01-product-discovery"], gates: ["GATE-B"] }],
   ["03-architecture-initial", { scope: "development", prerequisites: ["02-product-definition"], gates: [] }],
@@ -86,7 +126,27 @@ const NODE_RULES = new Map([
   ["R09-production-verification", { scope: "release", prerequisites: ["R08-production-deployment"], gates: [] }],
   ["R10-release-archive", { scope: "release", prerequisites: ["R09-production-verification"], gates: [] }],
 ]);
-const WRITABLE_NODE_IDS = new Set(NODE_RULES.keys());
+const WRITABLE_NODE_IDS = new Set([...SEVEN_NODE_DEVELOPMENT_IDS, ...RELEASE_NODE_IDS]);
+const SCOPED_COMPLETION_NODES = new Set([
+  "03-delivery-readiness", "04-implementation", "05-candidate-assurance", "06-version-closeout",
+  "07-iteration-planning", "08-test-design", "09-development",
+  "10-change-review", "11-candidate-verification", "12-version-closeout",
+]);
+const CANDIDATE_REQUIRED_NODES = new Set([
+  "04-implementation", "05-candidate-assurance", "06-version-closeout",
+  "11-candidate-verification", "12-version-closeout",
+]);
+const CANDIDATE_BOUND_NODES = new Set(["05-candidate-assurance", "06-version-closeout"]);
+const SCOPE_FREEZE_NODES = new Set(["03-delivery-readiness", "07-iteration-planning"]);
+const SLICE_BUDGET_LIMITS = new Map([
+  ["logical-tasks", 8],
+  ["active-hours", 8],
+  ["wall-clock-hours", 24],
+  ["blocking-repair-rounds", 2],
+]);
+const LOCK_WAIT_CELL = new Int32Array(new SharedArrayBuffer(4));
+const ACTIVE_LOCK_WAIT_TIMEOUT_MS = 30_000;
+const LOCK_METADATA_INITIALIZATION_TIMEOUT_MS = 1_000;
 
 function parseArgs(argv) {
   const positional = [];
@@ -120,6 +180,13 @@ function lifecycleDescriptor(command, positional, flags) {
   if (command === "gate" && new Set(["request", "decide"]).has(positional[1])) {
     return { kind: "gate", action: `gate-${positional[1]}`, subject_id: optionalFlag(flags, "--gate-id") };
   }
+  if (command === "scope" && new Set(["freeze", "amend", "warn"]).has(positional[1])) {
+    return {
+      kind: "scope",
+      action: `scope-${positional[1]}`,
+      subject_id: optionalFlag(flags, "--manifest-id") || optionalFlag(flags, "--iteration-id"),
+    };
+  }
   if (command !== "transition") return null;
   const transition = optionalFlag(flags, "--event") || "transition";
   if (transition.startsWith("node-")) {
@@ -135,9 +202,62 @@ function lifecycleDescriptor(command, positional, flags) {
   };
 }
 
+function assertNotLegacyDevelopmentNode(node) {
+  if (LEGACY_DEVELOPMENT_ID_SET.has(node)) {
+    throw new Error(`Legacy workflow node is read-only: ${node}`);
+  }
+  return node;
+}
+
+function assertGateContractWritable(gateId) {
+  if (RETIRED_GATE_IDS.has(gateId)) {
+    throw new Error(`${gateId} Gate contract is retired; historical records remain read-only.`);
+  }
+}
+
+function assertRetiredGateContract(gateId) {
+  if (!RETIRED_GATE_IDS.has(gateId)) {
+    throw new Error(`Gate contract is not retired: ${gateId}.`);
+  }
+}
+
+function assertNoLegacyDevelopmentWrite(files, command, positional, flags, options) {
+  let node = null;
+  if ((command === "artifact" && positional[1] === "register")
+    || (command === "gate" && positional[1] === "request")) {
+    node = optionalFlag(flags, "--node");
+  } else if (command === "gate" && positional[1] === "decide") {
+    const gateId = optionalFlag(flags, "--gate-id");
+    if (gateId) {
+      const state = normalizeWorkflowState(readYaml(files.workflowState, options.yaml, "workflow-state.yaml"));
+      const pending = [state.development_state, state.release_state]
+        .flatMap((scope) => scope.pending_gates)
+        .map((gate) => typeof gate === "string" ? { gate_id: gate, node: null } : gate)
+        .find((gate) => gate?.gate_id === gateId);
+      node = pending?.node || null;
+    }
+  } else if (command === "transition") {
+    node = optionalFlag(flags, "--node");
+    const event = optionalFlag(flags, "--event");
+    if (!node && new Set(["candidate-selected", "version-closed"]).has(event)) {
+      const artifactId = optionalFlag(flags, "--artifact-id");
+      if (artifactId) {
+        const registry = normalizeArtifactRegistry(
+          readYaml(files.artifactRegistry, options.yaml, "artifact-registry.yaml"),
+        );
+        node = registry.artifacts.find((artifact) =>
+          (artifact.artifact_id || artifact.id) === artifactId)?.node || null;
+      }
+    }
+  }
+  assertNotLegacyDevelopmentNode(node);
+}
+
 function dispatchLifecycle(options, files, descriptor, phase, flags, result = null, error = null) {
   if (!descriptor || typeof options.onLifecycleEvent !== "function") return { decision: "pass" };
-  const revision = optionalFlag(flags, "--expected-revision") || "none";
+  const revision = optionalFlag(flags, "--expected-scope-revision")
+    || optionalFlag(flags, "--expected-revision")
+    || "none";
   const identity = descriptor.subject_id || "unspecified";
   const idempotencyKey = `formal-state-${descriptor.kind}-${phase}-${descriptor.action}-${identity}-r${revision}`;
   const event = {
@@ -179,13 +299,6 @@ function readYaml(file, yaml, label) {
   return value;
 }
 
-function atomicWrite(file, content) {
-  fs.mkdirSync(path.dirname(file), { recursive: true });
-  const temporary = `${file}.${process.pid}.${Date.now()}.tmp`;
-  fs.writeFileSync(temporary, content, "utf8");
-  fs.renameSync(temporary, file);
-}
-
 function isInside(candidate, root) {
   const relative = path.relative(path.resolve(root), path.resolve(candidate));
   return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
@@ -195,6 +308,12 @@ function sha256(value) {
   return crypto.createHash("sha256").update(value).digest("hex");
 }
 
+export function stableValue(value) {
+  if (Array.isArray(value)) return value.map(stableValue);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stableValue(value[key])]));
+}
+
 function requiredFlag(flags, name) {
   const raw = flags.get(name);
   const value = Array.isArray(raw) ? raw.at(-1) : raw;
@@ -222,30 +341,84 @@ function artifactStatus(flags) {
   return status;
 }
 
-function expectedRevision(flags) {
-  const raw = requiredFlag(flags, "--expected-revision");
+function nonNegativeRevisionFlag(flags, name) {
+  const raw = requiredFlag(flags, name);
   const value = Number(raw);
   if (!Number.isInteger(value) || value < 0) {
-    throw new Error("--expected-revision must be a non-negative integer.");
+    throw new Error(`${name} must be a non-negative integer.`);
   }
   return value;
 }
 
-function withLock(files, stream, action) {
+function expectedRevision(flags) {
+  return nonNegativeRevisionFlag(flags, "--expected-revision");
+}
+
+function expectedScopeRevision(flags) {
+  if (!flags.has("--expected-scope-revision")) return null;
+  return nonNegativeRevisionFlag(flags, "--expected-scope-revision");
+}
+
+function assertWorkflowRevision(flags, state, scopeName = null) {
+  const scopedExpected = expectedScopeRevision(flags);
+  if (scopedExpected !== null) {
+    if (flags.has("--expected-revision")) {
+      throw new Error("Use either --expected-scope-revision or --expected-revision, not both.");
+    }
+    if (!scopeName) throw new Error("A workflow scope is required for --expected-scope-revision.");
+    const actual = scopeState(state, scopeName).revision;
+    if (actual !== scopedExpected) {
+      throw new Error(`${scopeName} scope revision conflict: expected ${scopedExpected}, actual ${actual}.`);
+    }
+    return;
+  }
+  const expected = expectedRevision(flags);
+  if (state.revision !== expected) {
+    throw new Error(`Workflow state revision conflict: expected ${expected}, actual ${state.revision}.`);
+  }
+}
+
+function pauseForLockRetry() {
+  Atomics.wait(LOCK_WAIT_CELL, 0, 0, 10);
+}
+
+function withLock(files, stream, action, lockOptions = {}) {
+  const recover = lockOptions.recover !== false;
+  const waitForActive = lockOptions.waitForActive === true;
+  const maximumAttempts = waitForActive ? Number.POSITIVE_INFINITY : 3;
+  const waitDeadline = waitForActive
+    ? Date.now() + (lockOptions.waitTimeoutMs ?? ACTIVE_LOCK_WAIT_TIMEOUT_MS)
+    : null;
+  // Read-only callers check both sides of lock acquisition so a stale journal is actionable
+  // and a writer that wins the race cannot expose a partial transaction.
+  if (!recover) assertNoPendingTransaction(files);
   fs.mkdirSync(files.lockRoot, { recursive: true });
   const lockFile = path.join(files.lockRoot, "formal-state.lock");
   let descriptor;
-  try {
-    descriptor = fs.openSync(lockFile, "wx");
-    fs.writeFileSync(descriptor, `${JSON.stringify({
-      pid: process.pid,
-      created_at: new Date().toISOString(),
-    })}\n`);
-  } catch (error) {
-    if (error.code === "EEXIST") throw new Error(`Formal state is locked while updating: ${stream}`);
-    throw error;
+  for (let attempt = 0; attempt < maximumAttempts && descriptor === undefined; attempt += 1) {
+    try {
+      descriptor = fs.openSync(lockFile, "wx");
+      fs.writeFileSync(descriptor, `${JSON.stringify({
+        pid: process.pid,
+        stream,
+        created_at: new Date().toISOString(),
+      })}\n`);
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (recover && removeAbandonedLock(lockFile)) continue;
+      if (waitForActive && isWaitableFormalLock(lockFile) && Date.now() < waitDeadline) {
+        pauseForLockRetry();
+        continue;
+      }
+      throw new Error(`Formal state is locked while updating: ${stream}`);
+    }
+  }
+  if (descriptor === undefined) {
+    throw new Error(`Formal state lock could not be acquired: ${stream}`);
   }
   try {
+    if (recover) recoverPendingTransaction(files);
+    else assertNoPendingTransaction(files);
     return action();
   } finally {
     if (descriptor !== undefined) fs.closeSync(descriptor);
@@ -253,6 +426,50 @@ function withLock(files, stream, action) {
   }
 }
 
+function isWaitableFormalLock(lockFile) {
+  try {
+    const content = fs.readFileSync(lockFile, "utf8");
+    try {
+      const owner = JSON.parse(content);
+      return typeof owner.stream === "string" && owner.stream.length > 0;
+    } catch {
+      const ageMs = Date.now() - fs.statSync(lockFile).mtimeMs;
+      return ageMs >= 0 && ageMs < LOCK_METADATA_INITIALIZATION_TIMEOUT_MS;
+    }
+  } catch (error) {
+    // The owner may release the lock between our failed open and metadata read.
+    return error.code === "ENOENT";
+  }
+}
+
+function isAbandonedLock(lockFile) {
+  try {
+    const owner = JSON.parse(fs.readFileSync(lockFile, "utf8"));
+    if (!Number.isInteger(owner.pid) || owner.pid <= 0) return false;
+    try {
+      process.kill(owner.pid, 0);
+      return false;
+    } catch (error) {
+      return error.code === "ESRCH";
+    }
+  } catch {
+    return false;
+  }
+}
+
+function removeAbandonedLock(lockFile) {
+  if (!isAbandonedLock(lockFile)) return false;
+  const abandoned = `${lockFile}.${process.pid}.${crypto.randomUUID()}.stale`;
+  try {
+    fs.renameSync(lockFile, abandoned);
+  } catch (error) {
+    if (error.code === "ENOENT") return true;
+    throw error;
+  }
+  fs.rmSync(abandoned, { force: true });
+  return true;
+}
+
 function statePaths(projectRoot) {
   const root = path.resolve(projectRoot);
   const workflow = path.join(root, ".workflow");
@@ -266,7 +483,13 @@ function statePaths(projectRoot) {
     artifactRegistry: path.join(delivery, "artifact-registry.yaml"),
     events: path.join(delivery, "state-events.jsonl"),
     eventShards: path.join(workflow, "control", "events"),
+    historySnapshots: path.join(workflow, "control", "snapshots", "formal-state"),
+    artifactHistoryArchives: path.join(workflow, "control", "archives", "history", "artifact-registry"),
+    artifactRetention: path.join(workflow, "control", "retention", "artifact-registry"),
+    compactRuntime: path.join(delivery, "runtime", "formal-state-compact"),
+    pruneRuntime: path.join(delivery, "runtime", "formal-state-prune"),
     lockRoot: path.join(delivery, "runtime", "formal-state-locks"),
+    transactionJournal: path.join(delivery, "runtime", "formal-state-locks", "formal-state-transaction.json"),
   };
 }
 
@@ -282,6 +505,21 @@ function normalizeScope(value, scopeId = null) {
     node_attempts: value?.node_attempts && typeof value.node_attempts === "object"
       ? value.node_attempts
       : {},
+    node_candidate_bindings: value?.node_candidate_bindings
+      && typeof value.node_candidate_bindings === "object"
+      && !Array.isArray(value.node_candidate_bindings)
+      ? value.node_candidate_bindings
+      : {},
+    scope_manifests: Array.isArray(value?.scope_manifests) ? value.scope_manifests : [],
+    current_scope_manifest_id: value?.current_scope_manifest_id ?? null,
+    scope_contract_version: value?.scope_contract_version ?? null,
+    scope_warnings: Array.isArray(value?.scope_warnings) ? value.scope_warnings : [],
+    node_completion_receipts: Array.isArray(value?.node_completion_receipts)
+      ? value.node_completion_receipts
+      : [],
+    contract_retirement_receipts: Array.isArray(value?.contract_retirement_receipts)
+      ? value.contract_retirement_receipts
+      : [],
     latest_candidate_id: value?.latest_candidate_id ?? null,
     latest_release_id: value?.latest_release_id ?? null,
     updated_at: value?.updated_at ?? "",
@@ -289,6 +527,24 @@ function normalizeScope(value, scopeId = null) {
   };
 }
 
+export function findIncompatibleNodeStates(scope) {
+  const memberships = new Map();
+  for (const [stateName, nodes] of [
+    ["active_nodes", scope?.active_nodes],
+    ["blocked_nodes", scope?.blocked_nodes],
+    ["completed_nodes", scope?.completed_nodes],
+  ]) {
+    for (const node of Array.isArray(nodes) ? nodes : []) {
+      const states = memberships.get(node) || new Set();
+      states.add(stateName);
+      memberships.set(node, states);
+    }
+  }
+  return [...memberships]
+    .filter(([, states]) => states.size > 1)
+    .map(([node, states]) => ({ node, states: [...states] }));
+}
+
 function exposeLegacyScopeAliases(state) {
   const preferred = state.last_transition?.scope === "release"
     ? state.release_state
@@ -369,14 +625,597 @@ function normalizeArtifactRegistry(value) {
   };
 }
 
-function appendEvent(files, event) {
+function uniqueSortedValues(values, label) {
+  const normalized = [...new Set(values.map((value) => String(value).trim()).filter(Boolean))].sort();
+  if (!normalized.length) throw new Error(`${label} requires at least one value.`);
+  return normalized;
+}
+
+function scopedReferences(flags, flag, idField) {
+  return uniqueSortedValues(repeatedFlag(flags, flag), flag).map((value) => {
+    const separator = value.indexOf(":");
+    if (separator <= 0 || separator === value.length - 1) {
+      throw new Error(`${flag} must use <node-id>:<id>.`);
+    }
+    const node = value.slice(0, separator);
+    const id = value.slice(separator + 1);
+    if (!WRITABLE_NODE_IDS.has(node) || scopeNameForNode(node) !== "development") {
+      throw new Error(`${flag} references an invalid development node: ${node}.`);
+    }
+    return { node, [idField]: id };
+  }).sort((left, right) => `${left.node}:${left[idField]}`.localeCompare(`${right.node}:${right[idField]}`));
+}
+
+function checksumWithoutField(record, field) {
+  const unsigned = { ...record };
+  delete unsigned[field];
+  return sha256(JSON.stringify(stableValue(unsigned)));
+}
+
+function scopeManifestChecksum(manifest) {
+  return checksumWithoutField(manifest, "manifest_checksum");
+}
+
+function completionReceiptChecksum(receipt) {
+  return checksumWithoutField(receipt, "receipt_checksum");
+}
+
+function contractRetirementReceiptChecksum(receipt) {
+  return checksumWithoutField(receipt, "receipt_checksum");
+}
+
+function currentScopeManifest(scope) {
+  if (!scope.current_scope_manifest_id) return null;
+  return scope.scope_manifests.find((manifest) => manifest?.manifest_id === scope.current_scope_manifest_id) || null;
+}
+
+function currentTaskFindings(task) {
+  const current = new Map();
+  for (const attempt of Array.isArray(task?.attempts) ? task.attempts : []) {
+    for (const phase of Array.isArray(attempt?.phases) ? attempt.phases : []) {
+      for (const finding of Array.isArray(phase?.findings) ? phase.findings : []) {
+        if (finding?.finding_id) current.set(finding.finding_id, finding);
+      }
+    }
+  }
+  return [...current.values()];
+}
+
+function readScopeTasks(files, scopeId, options) {
+  const taskRoot = path.join(files.workflow, "control", "tasks");
+  if (!fs.existsSync(taskRoot)) return new Map();
+  if (!fs.statSync(taskRoot).isDirectory()) throw new Error(`Task fact root must be a directory: ${taskRoot}`);
+  const tasks = new Map();
+  for (const name of fs.readdirSync(taskRoot).filter((item) => /\.ya?ml$|\.json$/i.test(item)).sort()) {
+    const task = readYaml(path.join(taskRoot, name), options.yaml, `task fact ${name}`);
+    if (task.iteration_id !== scopeId) continue;
+    if (!task.task_id) throw new Error(`Task fact is missing task_id: ${name}`);
+    if (tasks.has(task.task_id)) throw new Error(`Duplicate task fact ID: ${task.task_id}.`);
+    tasks.set(task.task_id, task);
+  }
+  return tasks;
+}
+
+function artifactFileIntegrity(files, artifact) {
+  const artifactPath = typeof artifact?.path === "string" ? artifact.path.replaceAll("\\", "/") : "";
+  if (!artifactPath.startsWith(".workflow/")) {
+    return { valid: false, code: "invalid-path", artifact_path: artifactPath, actual_checksum: null };
+  }
+  const absolute = path.resolve(files.root, artifactPath);
+  try {
+    if (!isInside(absolute, files.workflow) || !fs.existsSync(absolute) || !fs.statSync(absolute).isFile()) {
+      return { valid: false, code: "missing-or-outside", artifact_path: artifactPath, actual_checksum: null };
+    }
+    if (!isInside(fs.realpathSync(absolute), fs.realpathSync(files.workflow))) {
+      return { valid: false, code: "resolved-outside", artifact_path: artifactPath, actual_checksum: null };
+    }
+    const actualChecksum = sha256(fs.readFileSync(absolute));
+    if (artifact.checksum_algorithm !== "sha256" || artifact.checksum !== actualChecksum) {
+      return { valid: false, code: "checksum-mismatch", artifact_path: artifactPath, actual_checksum: actualChecksum };
+    }
+    return { valid: true, code: null, artifact_path: artifactPath, actual_checksum: actualChecksum };
+  } catch {
+    return { valid: false, code: "unreadable", artifact_path: artifactPath, actual_checksum: null };
+  }
+}
+
+function latestGateDecisions(scope, node) {
+  const attempt = Number(scope.node_attempts[node] || 1);
+  const decisions = new Map();
+  for (const decision of scope.gate_decisions) {
+    if (decision?.node === node
+      && (!decision.iteration_id || decision.iteration_id === scope.scope_id)
+      && Number(decision.node_attempt || attempt) === attempt
+      && decision.gate_id) decisions.set(decision.gate_id, decision);
+  }
+  return decisions;
+}
+
+function artifactSuperseder(registry, artifact) {
+  const artifactId = artifact?.artifact_id || artifact?.id;
+  if (!artifactId) return null;
+  return registry.artifacts.find((candidate) => candidate?.supersedes === artifactId) || null;
+}
+
+function projectedArtifactStatus(registry, artifact) {
+  return artifactSuperseder(registry, artifact) ? "superseded" : artifact?.status;
+}
+
+function deriveNodeStates(files, state, registry, options) {
+  const projections = {};
+  const artifacts = new Map(registry.artifacts.map((artifact) => [artifact.artifact_id || artifact.id, artifact]));
+  for (const [node, rule] of NODE_RULES) {
+    const scope = scopeState(state, rule.scope);
+    const attempt = Number(scope.node_attempts[node] || 1);
+    const active = scope.active_nodes.includes(node);
+    const blocked = scope.blocked_nodes.includes(node);
+    const completed = scope.completed_nodes.includes(node);
+    const manifest = rule.scope === "development" ? currentScopeManifest(scope) : null;
+    const tasks = rule.scope === "development" && scope.scope_id
+      ? readScopeTasks(files, scope.scope_id, options)
+      : new Map();
+    const missing = [];
+    const blockingReasons = [];
+    const blockingDefectIds = [];
+    const taskFacts = [];
+    const artifactFacts = [];
+    const scopedNode = rule.scope === "development" && SCOPED_COMPLETION_NODES.has(node);
+    const taskReferences = manifest?.required_tasks?.filter((reference) => reference.node === node) || [];
+    const allDefectReferences = CANDIDATE_REQUIRED_NODES.has(node)
+      ? manifest?.required_tasks || []
+      : taskReferences;
+
+    const governedScope = scope.scope_contract_version === 1 || Boolean(manifest);
+    if (scopedNode && governedScope && !manifest) missing.push("scope-manifest:frozen");
+    for (const reference of taskReferences) {
+      const task = tasks.get(reference.task_id);
+      taskFacts.push({ task_id: reference.task_id, status: task?.status || "missing" });
+      if (!task) {
+        missing.push(`task:${reference.task_id}:missing`);
+      } else if (task.status !== "completed") {
+        missing.push(`task:${reference.task_id}:${task.status || "unknown"}`);
+        if (new Set(["failed", "abandoned"]).has(task.status)) {
+          blockingReasons.push(`task:${reference.task_id}:${task.status}`);
+        }
+      }
+    }
+    for (const reference of allDefectReferences) {
+      const task = tasks.get(reference.task_id);
+      for (const finding of currentTaskFindings(task)) {
+        if (finding.severity === "blocking" && finding.status === "open") {
+          blockingDefectIds.push(finding.finding_id);
+          blockingReasons.push(`defect:${finding.finding_id}:open`);
+        }
+      }
+    }
+    for (const reference of manifest?.required_artifacts?.filter((item) => item.node === node) || []) {
+      const artifact = artifacts.get(reference.artifact_id);
+      const integrity = artifact ? artifactFileIntegrity(files, artifact) : null;
+      const artifactStatus = artifact ? projectedArtifactStatus(registry, artifact) : "missing";
+      artifactFacts.push({
+        artifact_id: reference.artifact_id,
+        status: artifactStatus,
+        checksum: artifact?.checksum || null,
+        checksum_valid: integrity?.valid || false,
+      });
+      if (!artifact) {
+        missing.push(`artifact:${reference.artifact_id}:missing`);
+      } else if (!integrity.valid) {
+        missing.push(`artifact:${reference.artifact_id}:${integrity.code}`);
+        blockingReasons.push(`artifact:${reference.artifact_id}:${integrity.code}`);
+      } else if (!allowedCompletionStatuses(node).has(artifactStatus)) {
+        missing.push(`artifact:${reference.artifact_id}:${artifactStatus || "unknown"}`);
+        if (new Set(["rejected", "failed", "invalid", "blocked", "stale", "superseded"]).has(artifactStatus)) {
+          blockingReasons.push(`artifact:${reference.artifact_id}:${artifactStatus}`);
+        }
+      }
+    }
+
+    const decisions = latestGateDecisions(scope, node);
+    const gateFacts = [];
+    for (const gateId of rule.gates || []) {
+      const decision = decisions.get(gateId);
+      gateFacts.push({ gate_id: gateId, decision: decision?.decision || "missing", actor: decision?.actor || null });
+      if (!satisfiesMandatoryGate(node, decision)) missing.push(`gate:${gateId}:approved`);
+      if (decision && !new Set(["approved", "not-required"]).has(decision.decision)) {
+        blockingReasons.push(`gate:${gateId}:${decision.decision}`);
+      }
+    }
+    const pendingForNode = scope.pending_gates.filter((gate) =>
+      typeof gate === "string" || gate?.node === node);
+    for (const pending of pendingForNode) {
+      const gateId = typeof pending === "string" ? pending : pending.gate_id;
+      if (gateId && !missing.includes(`gate:${gateId}:pending`)) missing.push(`gate:${gateId}:pending`);
+    }
+
+    let candidateId = null;
+    if (rule.scope === "development" && CANDIDATE_REQUIRED_NODES.has(node)) {
+      const binding = scope.node_candidate_bindings[node];
+      const requiresAttemptBinding = CANDIDATE_BOUND_NODES.has(node) && (active || blocked || completed);
+      candidateId = requiresAttemptBinding
+        ? (Number(binding?.node_attempt) === attempt ? binding.candidate_id : null)
+        : scope.latest_candidate_id;
+      const candidate = candidateId ? artifacts.get(candidateId) : null;
+      if (!candidate || projectedArtifactStatus(registry, candidate) !== "immutable") {
+        missing.push(requiresAttemptBinding ? "candidate:attempt-binding" : "candidate:selected");
+      } else {
+        const integrity = artifactFileIntegrity(files, candidate);
+        if (!integrity.valid) {
+          missing.push(`candidate:${candidateId}:${integrity.code}`);
+          blockingReasons.push(`candidate:${candidateId}:${integrity.code}`);
+        }
+      }
+    }
+
+    const receipt = [...scope.node_completion_receipts].reverse().find((item) =>
+      item?.node === node
+      && Number(item.node_attempt || attempt) === attempt
+      && (!manifest || (item.scope_manifest_id === manifest.manifest_id
+        && item.scope_manifest_checksum === manifest.manifest_checksum)));
+    if (completed && scopedNode && manifest && !receipt) missing.push("completion-receipt:current-scope");
+
+    const missingConditions = [...new Set(missing)].sort();
+    const blockConditions = [...new Set(blockingReasons)].sort();
+    const defects = [...new Set(blockingDefectIds)].sort();
+    let derivedState = "pending";
+    if (blocked || blockConditions.length) derivedState = "blocked";
+    else if (completed) derivedState = missingConditions.length ? "blocked" : "completed";
+    else if (active && missingConditions.length) derivedState = "waiting";
+    else if (active && scopedNode) derivedState = "ready-to-complete";
+    else if (active) derivedState = "active";
+
+    projections[node] = stableValue({
+      node,
+      state: derivedState,
+      completion_ready: derivedState === "ready-to-complete",
+      scope_manifest_id: manifest?.manifest_id || null,
+      scope_manifest_checksum: manifest?.manifest_checksum || null,
+      node_attempt: attempt,
+      required_task_ids: taskReferences.map((reference) => reference.task_id).sort(),
+      required_artifact_ids: (manifest?.required_artifacts || [])
+        .filter((reference) => reference.node === node)
+        .map((reference) => reference.artifact_id)
+        .sort(),
+      task_facts: taskFacts,
+      artifact_facts: artifactFacts,
+      gate_facts: gateFacts,
+      candidate_id: candidateId,
+      blocking_defect_ids: defects,
+      blocking_conditions: blockConditions,
+      missing_conditions: missingConditions,
+      completion_receipt_id: receipt?.receipt_id || null,
+    });
+  }
+  return projections;
+}
+
+const FORMAL_STREAMS = new Map([
+  ["workflow-state", {
+    snapshotFile: "workflow-state.yaml",
+    viewFile: (files) => files.workflowState,
+    normalize: normalizeWorkflowState,
+    applyOperations: applyWorkflowStateOperations,
+    allowedSchemas: new Set([1, 2]),
+  }],
+  ["artifact-registry", {
+    snapshotFile: "artifact-registry.yaml",
+    viewFile: (files) => files.artifactRegistry,
+    normalize: normalizeArtifactRegistry,
+    applyOperations: applyArtifactRegistryOperations,
+    allowedSchemas: new Set([1]),
+  }],
+]);
+
+function formalStreamViews(files, rawValues) {
+  return new Map([...FORMAL_STREAMS].map(([stream, descriptor]) => [stream, {
+    ...descriptor,
+    file: descriptor.viewFile(files),
+    raw: rawValues[stream],
+    value: descriptor.normalize(rawValues[stream]),
+  }]));
+}
+
+function durableWrite(file, content) {
+  const descriptor = fs.openSync(file, "w");
+  try {
+    fs.writeFileSync(descriptor, content, "utf8");
+    fs.fsyncSync(descriptor);
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+
+function writeTransactionJournal(files, journal) {
+  atomicWrite(files.transactionJournal, `${JSON.stringify(journal, null, 2)}\n`);
+  const descriptor = fs.openSync(files.transactionJournal, "r+");
+  try {
+    fs.fsyncSync(descriptor);
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+
+function fileChecksum(file) {
+  return sha256(fs.readFileSync(file));
+}
+
+function validateTransactionJournal(files, journal) {
+  if (journal?.schema_version !== 1 || !journal.transaction_id
+    || !new Set(["prepared", "committed"]).has(journal.phase)
+    || !Array.isArray(journal.entries) || !journal.entries.length) {
+    throw new Error("Formal state transaction journal is invalid.");
+  }
+  const managerEvents = path.join(
+    files.root, ".workflow", "control", "events", "workflow-manager-events.jsonl",
+  );
+  const managerReceipts = path.join(files.root, ".workflow", "control", "receipts");
+  const allowedFiles = new Set(
+    [files.project, files.workflowState, files.artifactRegistry, files.events, managerEvents]
+      .map((file) => path.resolve(file)),
+  );
+  for (const [index, entry] of journal.entries.entries()) {
+    const target = path.resolve(String(entry.file || ""));
+    const expectedTemporary = `${target}.${journal.transaction_id}.${index}.tmp`;
+    const expectedBackup = `${target}.${journal.transaction_id}.${index}.bak`;
+    if ((!allowedFiles.has(target)
+      && !isInside(target, files.eventShards)
+      && !isInside(target, files.historySnapshots)
+      && !isInside(target, path.join(files.delivery, "reviews", "prototype-pages"))
+      && !isInside(target, managerReceipts))
+      || path.resolve(String(entry.temporary || "")) !== path.resolve(expectedTemporary)
+      || path.resolve(String(entry.backup || "")) !== path.resolve(expectedBackup)
+      || typeof entry.had_original !== "boolean"
+      || !/^[a-f0-9]{64}$/.test(entry.new_checksum || "")
+      || (entry.had_original && !/^[a-f0-9]{64}$/.test(entry.original_checksum || ""))) {
+      throw new Error("Formal state transaction journal contains an invalid file entry.");
+    }
+  }
+  return journal;
+}
+
+function removeFileWithChecksum(file, expectedChecksum, label) {
+  if (!fs.existsSync(file)) return;
+  if (!fs.statSync(file).isFile() || fileChecksum(file) !== expectedChecksum) {
+    throw new Error(`Formal state transaction ${label} checksum mismatch: ${file}`);
+  }
+  fs.rmSync(file, { force: true });
+}
+
+function rollbackPreparedTransaction(files, journal) {
+  for (const entry of [...journal.entries].reverse()) {
+    if (fs.existsSync(entry.backup)) {
+      if (!fs.statSync(entry.backup).isFile() || fileChecksum(entry.backup) !== entry.original_checksum) {
+        throw new Error(`Formal state transaction backup checksum mismatch: ${entry.backup}`);
+      }
+      if (fs.existsSync(entry.file)) {
+        removeFileWithChecksum(entry.file, entry.new_checksum, "new target");
+      }
+      fs.renameSync(entry.backup, entry.file);
+    } else if (entry.had_original) {
+      if (!fs.existsSync(entry.file) || !fs.statSync(entry.file).isFile()
+        || fileChecksum(entry.file) !== entry.original_checksum) {
+        throw new Error(`Formal state transaction original target is unavailable: ${entry.file}`);
+      }
+    } else {
+      removeFileWithChecksum(entry.file, entry.new_checksum, "new target");
+    }
+    removeFileWithChecksum(entry.temporary, entry.new_checksum, "temporary file");
+  }
+  fs.rmSync(files.transactionJournal, { force: true });
+}
+
+function finalizeCommittedTransaction(files, journal) {
+  for (const entry of journal.entries) {
+    if (!fs.existsSync(entry.file) || !fs.statSync(entry.file).isFile()
+      || fileChecksum(entry.file) !== entry.new_checksum) {
+      throw new Error(`Committed formal state transaction target is invalid: ${entry.file}`);
+    }
+    removeFileWithChecksum(entry.temporary, entry.new_checksum, "temporary file");
+    if (entry.had_original) {
+      removeFileWithChecksum(entry.backup, entry.original_checksum, "backup file");
+    } else if (fs.existsSync(entry.backup)) {
+      throw new Error(`Unexpected formal state transaction backup: ${entry.backup}`);
+    }
+  }
+  fs.rmSync(files.transactionJournal, { force: true });
+}
+
+function recoverPendingTransaction(files) {
+  if (!fs.existsSync(files.transactionJournal)) return;
+  const journal = validateTransactionJournal(
+    files,
+    JSON.parse(fs.readFileSync(files.transactionJournal, "utf8")),
+  );
+  if (journal.phase === "committed") finalizeCommittedTransaction(files, journal);
+  else rollbackPreparedTransaction(files, journal);
+}
+
+function assertNoPendingTransaction(files) {
+  if (fs.existsSync(files.transactionJournal)) {
+    throw new Error("Formal state transaction is incomplete; run rebuild or retry the mutation to recover it.");
+  }
+}
+
+function withReadableFormalState(files, action) {
+  return withLock(files, "formal-state-read", action, { recover: false });
+}
+
+function withZeroWriteFormalState(files, action) {
+  const assertStable = () => {
+    assertNoPendingTransaction(files);
+    const lockFile = path.join(files.lockRoot, "formal-state.lock");
+    if (fs.existsSync(lockFile)) {
+      throw new Error("Formal state is locked; zero-write inspection cannot continue.");
+    }
+  };
+  assertStable();
+  try {
+    return action();
+  } finally {
+    assertStable();
+  }
+}
+
+export function withFormalStateReadLock(projectRoot, action) {
+  if (typeof action !== "function") throw new Error("Formal state read lock requires an action.");
+  return withReadableFormalState(statePaths(projectRoot), action);
+}
+
+function atomicWriteSet(files, entries, options = {}, transactionId = null) {
+  transactionId = transactionId || `${process.pid}.${Date.now()}.${crypto.randomUUID()}`;
+  const targets = entries.map(({ file }) => path.resolve(file));
+  if (new Set(targets).size !== targets.length) {
+    throw new Error("Formal state transaction cannot write the same target more than once.");
+  }
+  const staged = entries.map(({ file, content }, index) => ({
+    file: path.resolve(file),
+    content,
+    temporary: `${path.resolve(file)}.${transactionId}.${index}.tmp`,
+    backup: `${path.resolve(file)}.${transactionId}.${index}.bak`,
+    had_original: false,
+    original_checksum: null,
+    new_checksum: sha256(content),
+  }));
+  for (const entry of staged) {
+    fs.mkdirSync(path.dirname(entry.file), { recursive: true });
+    if (fs.existsSync(entry.file) && !fs.statSync(entry.file).isFile()) {
+      throw new Error(`Transactional write target must be a file: ${entry.file}`);
+    }
+    entry.had_original = fs.existsSync(entry.file);
+    entry.original_checksum = entry.had_original ? fileChecksum(entry.file) : null;
+  }
+  const journal = {
+    schema_version: 1,
+    transaction_id: transactionId,
+    phase: "prepared",
+    entries: staged.map(({ content: ignored, ...entry }) => entry),
+  };
+  try {
+    for (const entry of staged) durableWrite(entry.temporary, entry.content);
+    writeTransactionJournal(files, journal);
+    for (const [index, entry] of staged.entries()) {
+      if (entry.had_original) fs.renameSync(entry.file, entry.backup);
+      fs.renameSync(entry.temporary, entry.file);
+      if (typeof options.onTransactionCommit === "function") {
+        options.onTransactionCommit({ index, file: entry.file, transaction_id: transactionId });
+      }
+    }
+    journal.phase = "committed";
+    writeTransactionJournal(files, journal);
+  } catch (error) {
+    if (fs.existsSync(files.transactionJournal)) {
+      try {
+        recoverPendingTransaction(files);
+      } catch (recoveryError) {
+        throw new AggregateError([error, recoveryError], "Formal state transaction failed and requires recovery.");
+      }
+    } else {
+      for (const entry of staged) fs.rmSync(entry.temporary, { force: true });
+    }
+    throw error;
+  }
+  finalizeCommittedTransaction(files, journal);
+}
+
+function eventLogContent(files, events) {
+  if (fs.existsSync(files.events) && !fs.statSync(files.events).isFile()) {
+    throw new Error(`Transactional write target must be a file: ${files.events}`);
+  }
   const existing = fs.existsSync(files.events) ? fs.readFileSync(files.events, "utf8") : "";
   const prefix = existing && !existing.endsWith("\n") ? `${existing}\n` : existing;
-  atomicWrite(files.events, `${prefix}${JSON.stringify(event)}\n`);
+  return `${prefix}${events.map((event) => JSON.stringify(event)).join("\n")}\n`;
+}
+
+function unsignedRecordChecksum(record, yaml) {
+  const { record_checksum: ignored, ...unsigned } = record;
+  return sha256(yaml.stringify(unsigned));
+}
+
+function previousStreamChecksum(files, stream, beforeRevision, options) {
+  const directory = path.join(files.eventShards, stream);
+  const checksumFromAnchor = () => {
+    if (beforeRevision === 0) return null;
+    const trusted = readLatestHistoryAnchor(files, options);
+    const metadata = trusted?.anchor.streams?.[stream];
+    if (!metadata || metadata.revision !== beforeRevision) {
+      throw new Error(
+        `Formal event chain head is unavailable for ${stream} revision ${beforeRevision}.`,
+      );
+    }
+    return metadata.record_checksum;
+  };
+  if (!fs.existsSync(directory)) return checksumFromAnchor();
+  if (!fs.statSync(directory).isDirectory()) {
+    throw new Error(`Formal event stream must be a directory: ${stream}`);
+  }
+  const names = fs.readdirSync(directory).filter((name) => /\.ya?ml$/i.test(name)).sort();
+  if (!names.length) return checksumFromAnchor();
+  const previous = readYaml(path.join(directory, names.at(-1)), options.yaml, `formal event shard ${stream}/${names.at(-1)}`);
+  if (previous.revision !== beforeRevision) {
+    throw new Error(`Formal event chain revision mismatch for ${stream}: expected ${beforeRevision}, actual ${previous.revision}.`);
+  }
+  return previous.record_checksum || unsignedRecordChecksum(previous, options.yaml);
+}
+
+function artifactRegistryOperations(registry, artifacts, handoffs = []) {
+  const {
+    artifacts: ignoredArtifacts,
+    handoffs: ignoredHandoffs,
+    ...metadata
+  } = stableValue(registry);
+  return [
+    { action: "set-registry-metadata", fields: metadata },
+    ...artifacts.map((artifact) => ({
+      action: "upsert-artifact",
+      artifact_id: artifact.artifact_id || artifact.id,
+      artifact: stableValue(artifact),
+    })),
+    ...handoffs.map((handoff) => ({
+      action: "append-artifact-handoff",
+      handoff: stableValue(handoff),
+    })),
+  ];
+}
+
+function artifactRegistryTransaction(event, registry, beforeRevision, artifacts, handoffs = []) {
+  const subject = event.artifact_id || (event.artifact_ids || []).join(",") || event.type;
+  return {
+    schema_version: 2,
+    before_revision: beforeRevision,
+    after_revision: registry.revision,
+    idempotency_key: `artifact-registry:${event.type}:${subject}:r${beforeRevision}-${registry.revision}`,
+    operations: artifactRegistryOperations(registry, artifacts, handoffs),
+  };
+}
+
+function workflowStateOperations(state, scopeName, beforeRevision) {
+  const { development_state: ignoredDevelopment, release_state: ignoredRelease, ...metadata } = stableValue(state);
+  const scopes = beforeRevision === 0 ? ["development", "release"] : [scopeName];
+  return [
+    { action: "set-workflow-metadata", fields: metadata },
+    ...scopes.map((name) => ({
+      action: "replace-scope",
+      scope: name,
+      value: stableValue(scopeState(state, name)),
+    })),
+  ];
+}
+
+function workflowStateTransaction(event, state, scopeName, beforeRevision) {
+  const subject = event.gate_id || event.node || event.artifact_id || event.manifest_id
+    || event.warning_id || event.iteration_id || event.type;
+  return {
+    schema_version: 2,
+    before_revision: beforeRevision,
+    after_revision: state.revision,
+    idempotency_key: `workflow-state:${event.type}:${scopeName}:${subject}:r${beforeRevision}-${state.revision}`,
+    operations: workflowStateOperations(state, scopeName, beforeRevision),
+  };
 }
 
-function writeStream(files, stream, file, value, event, options) {
-  const serialized = options.yaml.stringify(value);
+function prepareStreamMutation(files, mutation, options, transactionId) {
+  const { stream, file, value, event, transaction = null } = mutation;
+  const serialized = options.yaml.stringify(transaction ? stableValue(value) : value);
   const eventId = crypto.randomUUID();
   const eventRecord = {
     event_id: eventId,
@@ -386,51 +1225,565 @@ function writeStream(files, stream, file, value, event, options) {
     ...event,
     after_checksum: sha256(serialized),
   };
+  const shardRecord = transaction
+    ? {
+      ...eventRecord,
+      transaction_id: transactionId,
+      ...transaction,
+      previous_checksum: previousStreamChecksum(files, stream, transaction.before_revision, options),
+    }
+    : { ...eventRecord, after_value: value };
+  const record = {
+    ...shardRecord,
+    record_checksum: unsignedRecordChecksum(shardRecord, options.yaml),
+  };
   const shardFile = path.join(files.eventShards, stream, `${String(value.revision).padStart(6, "0")}-${eventId}.yaml`);
-  atomicWrite(shardFile, options.yaml.stringify({ ...eventRecord, after_value: value }));
-  atomicWrite(file, serialized);
-  appendEvent(files, eventRecord);
+  const indexedEvent = transaction ? record : eventRecord;
+  return {
+    indexedEvent,
+    writes: [
+      { file: shardFile, content: options.yaml.stringify(record) },
+      { file, content: serialized },
+    ],
+  };
+}
+
+function commitFormalTransaction(files, mutations, extraWrites, options) {
+  if (!Array.isArray(mutations) || !mutations.length) {
+    throw new Error("Formal state transaction requires at least one stream mutation.");
+  }
+  const transactionId = `TXN-${crypto.randomUUID()}`;
+  const prepared = mutations.map((mutation) =>
+    prepareStreamMutation(files, mutation, options, transactionId));
+  const managerWrites = typeof options.managerTransactionWriteFactory === "function"
+    ? options.managerTransactionWriteFactory({
+      transaction_id: transactionId,
+      mutations: mutations.map((mutation) => ({
+        stream: mutation.stream,
+        event: mutation.event,
+        value: mutation.value,
+      })),
+    })
+    : [];
+  if (!Array.isArray(managerWrites)) {
+    throw new Error("Manager transaction write factory must return an array.");
+  }
+  const managerEventsFile = path.resolve(
+    files.root, ".workflow", "control", "events", "workflow-manager-events.jsonl",
+  );
+  const managerReceiptsRoot = path.resolve(files.root, ".workflow", "control", "receipts");
+  for (const write of managerWrites) {
+    const target = path.resolve(String(write?.file || ""));
+    const receiptRelative = path.relative(managerReceiptsRoot, target);
+    const isReceipt = Boolean(receiptRelative)
+      && !receiptRelative.startsWith("..")
+      && !path.isAbsolute(receiptRelative)
+      && path.extname(target) === ".json";
+    if (target !== managerEventsFile && !isReceipt) {
+      throw new Error("Manager transaction writes are limited to its Receipt and Event stores.");
+    }
+    if (typeof write.content !== "string" && !Buffer.isBuffer(write.content)) {
+      throw new Error("Manager transaction write content is invalid.");
+    }
+  }
+  atomicWriteSet(files, [
+    ...prepared.flatMap(({ writes }) => writes.slice(0, 1)),
+    { file: files.events, content: eventLogContent(files, prepared.map(({ indexedEvent }) => indexedEvent)) },
+    ...prepared.flatMap(({ writes }) => writes.slice(1)),
+    ...extraWrites,
+    ...managerWrites,
+  ], options, transactionId);
+}
+
+function applyArtifactRegistryOperations(value, record) {
+  const registry = normalizeArtifactRegistry(structuredClone(value || { artifacts: [] }));
+  for (const operation of record.operations || []) {
+    if (operation.action === "set-registry-metadata") {
+      if (!operation.fields || typeof operation.fields !== "object" || Array.isArray(operation.fields)) {
+        throw new Error(`Artifact registry metadata operation is invalid at revision ${record.revision}.`);
+      }
+      Object.assign(registry, operation.fields);
+      continue;
+    }
+    if (operation.action === "upsert-artifact") {
+      if (!operation.artifact_id || !operation.artifact || typeof operation.artifact !== "object") {
+        throw new Error(`Artifact registry upsert operation is invalid at revision ${record.revision}.`);
+      }
+      const index = registry.artifacts.findIndex((item) => (item.artifact_id || item.id) === operation.artifact_id);
+      if (index === -1) registry.artifacts.push(operation.artifact);
+      else registry.artifacts[index] = operation.artifact;
+      continue;
+    }
+    if (operation.action === "append-artifact-handoff") {
+      if (!operation.handoff || typeof operation.handoff !== "object"
+        || !Array.isArray(operation.handoff.artifact_ids)
+        || !operation.handoff.artifact_ids.length) {
+        throw new Error(`Artifact handoff operation is invalid at revision ${record.revision}.`);
+      }
+      registry.handoffs = [
+        ...(Array.isArray(registry.handoffs) ? registry.handoffs : []),
+        stableValue(operation.handoff),
+      ];
+      continue;
+    }
+    throw new Error(`Unsupported artifact registry operation at revision ${record.revision}: ${operation.action || "missing"}.`);
+  }
+  registry.revision = record.after_revision;
+  return stableValue(registry);
+}
+
+function applyWorkflowStateOperations(value, record) {
+  const state = structuredClone(value || {});
+  for (const operation of record.operations || []) {
+    if (operation.action === "set-workflow-metadata") {
+      if (!operation.fields || typeof operation.fields !== "object" || Array.isArray(operation.fields)) {
+        throw new Error(`Workflow state metadata operation is invalid at revision ${record.revision}.`);
+      }
+      Object.assign(state, operation.fields);
+      continue;
+    }
+    if (operation.action === "replace-scope") {
+      if (!new Set(["development", "release"]).has(operation.scope)
+        || !operation.value || typeof operation.value !== "object" || Array.isArray(operation.value)) {
+        throw new Error(`Workflow state scope operation is invalid at revision ${record.revision}.`);
+      }
+      state[operation.scope === "release" ? "release_state" : "development_state"] = stableValue(operation.value);
+      continue;
+    }
+    throw new Error(`Unsupported workflow state operation at revision ${record.revision}: ${operation.action || "missing"}.`);
+  }
+  state.revision = record.after_revision;
+  return stableValue(state);
+}
+
+function replayStreamRecords(stream, records, options, base = {}) {
+  const ordered = [...records].sort((left, right) => left.revision - right.revision);
+  let value = base.value ? structuredClone(base.value) : null;
+  let previousChecksum = base.recordChecksum ?? null;
+  let previousRevision = base.revision ?? 0;
+  for (const record of ordered) {
+    if (record.revision !== previousRevision + 1) {
+      throw new Error(`Formal event shard revision gap: ${stream}/${record.revision}; expected ${previousRevision + 1}.`);
+    }
+    if (record.after_value) {
+      value = record.after_value;
+    } else if (record.schema_version === 2 && Array.isArray(record.operations)) {
+      if (record.before_revision !== record.revision - 1 || record.after_revision !== record.revision) {
+        throw new Error(`Formal event shard revision metadata mismatch: ${stream}/${record.revision}.`);
+      }
+      if (record.previous_checksum !== previousChecksum) {
+        throw new Error(`Formal event shard checksum chain mismatch: ${stream}/${record.revision}.`);
+      }
+      const applyOperations = FORMAL_STREAMS.get(stream)?.applyOperations;
+      if (!applyOperations) throw new Error(`Unsupported formal event stream: ${stream}.`);
+      value = applyOperations(value, record);
+    } else {
+      throw new Error(`Formal event shard has no replayable value: ${stream}/${record.revision}.`);
+    }
+    const replayedChecksum = sha256(options.yaml.stringify(value));
+    if (replayedChecksum !== record.after_checksum) {
+      throw new Error(
+        `Formal event shard checksum mismatch: ${stream}/${record.revision}; expected ${record.after_checksum}, replayed ${replayedChecksum}.`,
+      );
+    }
+    if (record.record_checksum && unsignedRecordChecksum(record, options.yaml) !== record.record_checksum) {
+      throw new Error(`Formal event shard record checksum mismatch: ${stream}/${record.revision}.`);
+    }
+    previousChecksum = record.record_checksum || unsignedRecordChecksum(record, options.yaml);
+    previousRevision = record.revision;
+  }
+  return value;
+}
+
+function validateEventShardRecord(record, stream, name) {
+  const expectedName = `${String(record.revision).padStart(6, "0")}-${record.event_id}.yaml`;
+  if (record.stream !== stream || !Number.isInteger(record.revision) || !record.event_id
+    || name !== expectedName || (!record.after_value && !Array.isArray(record.operations))) {
+    throw new Error(`Formal event shard is invalid: ${stream}/${name}`);
+  }
+  return record;
 }
 
-function readEventShards(files, options) {
+function readEventShardRecord(files, options, stream, name) {
+  return validateEventShardRecord(readYaml(
+    path.join(files.eventShards, stream, name),
+    options.yaml,
+    `formal event shard ${stream}/${name}`,
+  ), stream, name);
+}
+
+function readEventShards(files, options, afterRevisions = null, indexedEvents = []) {
   if (!fs.existsSync(files.eventShards)) return [];
   const records = [];
-  for (const stream of fs.readdirSync(files.eventShards).sort()) {
-    const directory = path.join(files.eventShards, stream);
-    if (!fs.statSync(directory).isDirectory()) continue;
-    for (const name of fs.readdirSync(directory).filter((item) => /\.ya?ml$/i.test(item)).sort()) {
-      const record = readYaml(path.join(directory, name), options.yaml, `formal event shard ${stream}/${name}`);
-      if (record.stream !== stream || !Number.isInteger(record.revision) || !record.after_value) {
-        throw new Error(`Formal event shard is invalid: ${stream}/${name}`);
+  if (afterRevisions !== null) {
+    for (const event of indexedEvents) {
+      if (!Object.hasOwn(afterRevisions, event.stream)
+        || !Number.isInteger(event.revision)
+        || event.revision <= Number(afterRevisions[event.stream] || 0)) {
+        continue;
+      }
+      const eventId = String(event.event_id || "");
+      if (!eventId || eventId.includes("/") || eventId.includes("\\")) {
+        throw new Error(`Formal audit event ID is invalid: ${event.stream}/${event.revision}.`);
+      }
+      const name = `${String(event.revision).padStart(6, "0")}-${eventId}.yaml`;
+      records.push(readEventShardRecord(files, options, event.stream, name));
+    }
+  } else {
+    for (const stream of fs.readdirSync(files.eventShards).sort()) {
+      const directory = path.join(files.eventShards, stream);
+      if (!fs.statSync(directory).isDirectory()) continue;
+      for (const name of fs.readdirSync(directory).filter((item) => /\.ya?ml$/i.test(item)).sort()) {
+        records.push(readEventShardRecord(files, options, stream, name));
       }
-      const checksum = sha256(options.yaml.stringify(record.after_value));
-      if (checksum !== record.after_checksum) throw new Error(`Formal event shard checksum mismatch: ${stream}/${name}`);
-      records.push(record);
     }
   }
-  return records.sort((left, right) =>
+  const sorted = records.sort((left, right) =>
     String(left.occurred_at).localeCompare(String(right.occurred_at))
     || left.stream.localeCompare(right.stream)
     || left.revision - right.revision);
+  for (const stream of new Set(sorted.map((record) => record.stream))) {
+    if (afterRevisions === null) {
+      replayStreamRecords(stream, sorted.filter((record) => record.stream === stream), options);
+    }
+  }
+  return sorted;
+}
+
+function readLatestHistoryAnchor(files, options) {
+  const verified = readVerifiedHistoryAnchor({
+    historySnapshots: files.historySnapshots,
+    events: files.events,
+    streams: FORMAL_STREAMS,
+    readStructured: (file, label) => readYaml(file, options.yaml, label),
+    stringify: options.yaml.stringify,
+  });
+  return verified ? { anchor: verified.anchor, snapshots: verified.snapshots } : null;
+}
+
+function portableReference(files, target) {
+  const relative = path.relative(files.root, target);
+  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
+    throw new Error(`Version archive reference is outside the project: ${target}.`);
+  }
+  return relative.replaceAll("\\", "/");
+}
+
+function versionArchiveReferences(files, flags, options) {
+  const iterationId = requiredFlag(flags, "--iteration-id");
+  const requestedCandidateId = optionalFlag(flags, "--candidate-id");
+  return withReadableFormalState(files, () => {
+    const trusted = readLatestHistoryAnchor(files, options);
+    if (!trusted) throw new Error(`Version archive requires a trusted history anchor for ${iterationId}.`);
+    const scope = trusted.snapshots["workflow-state"]?.development_state;
+    if (scope?.scope_id !== iterationId) {
+      throw new Error(`Latest trusted history anchor does not contain version ${iterationId}.`);
+    }
+
+    const manifests = Array.isArray(scope.scope_manifests) ? scope.scope_manifests : [];
+    const manifestIndex = manifests.findIndex((item) => item?.manifest_id === scope.current_scope_manifest_id);
+    if (manifestIndex < 0) {
+      throw new Error(`Version archive requires the anchored scope manifest for ${iterationId}.`);
+    }
+    const manifest = manifests[manifestIndex];
+    const anchoredRegistry = trusted.snapshots["artifact-registry"] || { artifacts: [] };
+    const artifacts = anchoredRegistry.artifacts || [];
+    const candidateId = scope.latest_candidate_id || null;
+    if (!candidateId) {
+      throw new Error(`Version archive requires an anchored candidate for ${iterationId}.`);
+    }
+    if (requestedCandidateId && requestedCandidateId !== candidateId) {
+      throw new Error(
+        `Requested candidate ${requestedCandidateId} does not match anchored selected candidate ${candidateId}.`,
+      );
+    }
+    const candidateIndex = artifacts.findIndex((item) =>
+      (item.artifact_id || item.id) === candidateId);
+    if (candidateIndex < 0) {
+      throw new Error(`Version archive candidate is not present in the trusted anchor: ${candidateId}.`);
+    }
+    const candidate = artifacts[candidateIndex];
+    if (projectedArtifactStatus(anchoredRegistry, candidate) !== "immutable") {
+      throw new Error(`Anchored selected candidate is not immutable: ${candidateId}.`);
+    }
+    const anchorDirectory = path.join(files.historySnapshots, trusted.anchor.anchor_id);
+    const workflowSnapshotFile = path.join(anchorDirectory, FORMAL_STREAMS.get("workflow-state").snapshotFile);
+    const registrySnapshotFile = path.join(anchorDirectory, FORMAL_STREAMS.get("artifact-registry").snapshotFile);
+    const workflowRef = portableReference(files, workflowSnapshotFile);
+    const registryRef = portableReference(files, registrySnapshotFile);
+    const gateDecisions = Array.isArray(scope.gate_decisions) ? scope.gate_decisions : [];
+    return {
+      command: "snapshot references",
+      references: {
+        history_anchor: {
+          anchor_id: trusted.anchor.anchor_id,
+          anchor_checksum: trusted.anchor.anchor_checksum,
+          ref: portableReference(files, path.join(anchorDirectory, "anchor.yaml")),
+          workflow_state_checksum: trusted.anchor.streams["workflow-state"].view_checksum,
+          artifact_registry_checksum: trusted.anchor.streams["artifact-registry"].view_checksum,
+        },
+        scope: {
+          manifest_id: manifest.manifest_id,
+          manifest_checksum: manifest.manifest_checksum,
+          ref: `${workflowRef}#/development_state/scope_manifests/${manifestIndex}`,
+        },
+        candidate: {
+          artifact_id: candidate.artifact_id || candidate.id,
+          checksum_algorithm: candidate.checksum_algorithm || "sha256",
+          checksum: candidate.checksum,
+          ref: `${registryRef}#/artifacts/${candidateIndex}`,
+        },
+        gates: gateDecisions.map((decision, index) => ({
+          gate_id: decision.gate_id,
+          decision: decision.decision,
+          actor: decision.actor,
+          decided_at: decision.decided_at,
+          checksum_algorithm: "sha256",
+          checksum: sha256(JSON.stringify(stableValue(decision))),
+          ref: `${workflowRef}#/development_state/gate_decisions/${index}`,
+        })),
+      },
+    };
+  });
+}
+
+function readArtifactRetentionReceipts(files, options) {
+  if (!fs.existsSync(files.artifactRetention)) return [];
+  return fs.readdirSync(files.artifactRetention)
+    .filter((name) => /\.ya?ml$/i.test(name))
+    .sort()
+    .map((name) => {
+      const receipt = readYaml(
+        path.join(files.artifactRetention, name),
+        options.yaml,
+        `artifact retention receipt ${name}`,
+      );
+      const expectedName = `${historyAnchorId(receipt.anchor_id)}.yaml`;
+      if (name !== expectedName
+        || receipt.schema_version !== 1
+        || receipt.stream !== "artifact-registry"
+        || !/^[a-f0-9]{64}$/.test(receipt.anchor_checksum || "")
+        || !Number.isInteger(receipt.pruned_through_revision)
+        || receipt.pruned_through_revision < 0
+        || receipt.retained_from_revision !== receipt.pruned_through_revision + 1
+        || !Number.isInteger(receipt.deleted_shard_count)
+        || receipt.deleted_shard_count < 1
+        || !/^[a-f0-9]{64}$/.test(receipt.deleted_shards_checksum || "")
+        || structuredDocumentChecksum(receipt, "receipt_checksum", options.yaml.stringify)
+          !== receipt.receipt_checksum) {
+        throw new Error(`Artifact retention receipt is invalid: ${name}.`);
+      }
+      const anchorFile = path.join(files.historySnapshots, receipt.anchor_id, "anchor.yaml");
+      const anchor = readYaml(anchorFile, options.yaml, `retention anchor ${receipt.anchor_id}`);
+      if (anchor.anchor_checksum !== receipt.anchor_checksum
+        || structuredDocumentChecksum(anchor, "anchor_checksum", options.yaml.stringify)
+          !== anchor.anchor_checksum
+        || anchor.streams?.["artifact-registry"]?.revision !== receipt.pruned_through_revision) {
+        throw new Error(`Artifact retention receipt does not match its trusted anchor: ${name}.`);
+      }
+      return receipt;
+    });
+}
+
+function createFormalSnapshot(files, flags, options) {
+  return withLock(files, "formal-state-snapshot", () => {
+    const project = readYaml(files.project, options.yaml, "project.yaml");
+    const rawState = readYaml(files.workflowState, options.yaml, "workflow-state.yaml");
+    const rawRegistry = readYaml(files.artifactRegistry, options.yaml, "artifact-registry.yaml");
+    const views = formalStreamViews(files, {
+      "workflow-state": rawState,
+      "artifact-registry": rawRegistry,
+    });
+    const state = views.get("workflow-state").value;
+    const registry = views.get("artifact-registry").value;
+    const streamRevisions = stableValue(Object.fromEntries(
+      [...views].map(([stream, view]) => [stream, view.value.revision]),
+    ));
+    const reason = requiredFlag(flags, "--reason");
+    if (!new Set(["version-boundary", "configured-interval"]).has(reason)) {
+      throw new Error(`Unsupported history snapshot reason: ${reason}.`);
+    }
+    const eventCount = Object.values(streamRevisions).reduce((total, revision) => total + revision, 0);
+    const latest = readLatestHistoryAnchor(files, options);
+    if (reason === "configured-interval") {
+      const interval = Number(project.formal_state_snapshot_interval);
+      if (!Number.isInteger(interval) || interval <= 0) {
+        verifyFormalState(files, options);
+        return {
+          command: "snapshot create",
+          created: false,
+          reason: "snapshot interval is not configured",
+          event_count: eventCount,
+        };
+      }
+      const anchoredEventCount = latest?.anchor.event_index.event_count || 0;
+      if (eventCount - anchoredEventCount < interval) {
+        verifyFormalState(files, options);
+        return {
+          command: "snapshot create",
+          created: false,
+          reason: "snapshot interval has not been reached",
+          event_count: eventCount,
+          events_until_snapshot: interval - (eventCount - anchoredEventCount),
+          anchor_id: latest?.anchor.anchor_id || null,
+        };
+      }
+    }
+    const anchorId = historyAnchorId(
+      optionalFlag(flags, "--id")
+        || (reason === "configured-interval" ? `ANCHOR-W${state.revision}-A${registry.revision}` : ""),
+    );
+    const directory = path.join(files.historySnapshots, anchorId);
+    if (fs.existsSync(directory)
+      && latest?.anchor.anchor_id !== anchorId
+      && fs.lstatSync(directory).isDirectory()
+      && !fs.lstatSync(directory).isSymbolicLink()
+      && fs.readdirSync(directory).length === 0) {
+      fs.rmdirSync(directory);
+    }
+    if (fs.existsSync(directory)) {
+      const existing = latest?.anchor;
+      const unchanged = existing?.anchor_id === anchorId
+        && existing.reason === reason
+        && [...views].every(([stream, view]) =>
+          existing.streams[stream].revision === view.value.revision
+          && existing.streams[stream].view_checksum === fileChecksum(view.file));
+      if (!unchanged) throw new Error(`History anchor already exists: ${anchorId}.`);
+      verifyFormalState(files, options, { history: true, sinceAnchor: true });
+      return {
+        command: "snapshot create",
+        created: false,
+        deduplicated: true,
+        anchor_id: anchorId,
+        reason,
+        anchor_checksum: existing.anchor_checksum,
+        stream_revisions: streamRevisions,
+        event_count: eventCount,
+      };
+    }
+    verifyFormalState(files, options, {
+      history: true,
+      sinceAnchor: Boolean(latest),
+    });
+    const snapshotWrites = [...views].map(([, view]) => ({
+      file: path.join(directory, view.snapshotFile),
+      content: fs.readFileSync(view.file, "utf8"),
+    }));
+    const timestamp = (options.now || (() => new Date().toISOString()))();
+    const anchorBase = stableValue({
+      schema_version: 1,
+      anchor_id: anchorId,
+      project_id: project.project_id || state.project_id || null,
+      reason,
+      created_at: timestamp,
+      event_index: {
+        offset_bytes: fs.existsSync(files.events) ? fs.statSync(files.events).size : 0,
+        event_count: eventCount,
+      },
+      streams: Object.fromEntries([...views].map(([stream, view]) => [stream, {
+        revision: view.value.revision,
+        record_checksum: previousStreamChecksum(files, stream, view.value.revision, options),
+        view_checksum: fileChecksum(view.file),
+      }])),
+    });
+    const anchor = {
+      ...anchorBase,
+      anchor_checksum: sha256(options.yaml.stringify(anchorBase)),
+    };
+    const pointerBase = stableValue({
+      schema_version: 1,
+      anchor_id: anchorId,
+      anchor_checksum: anchor.anchor_checksum,
+      updated_at: timestamp,
+    });
+    const pointer = {
+      ...pointerBase,
+      pointer_checksum: sha256(options.yaml.stringify(pointerBase)),
+    };
+    atomicWriteSet(files, [
+      ...snapshotWrites,
+      { file: path.join(directory, "anchor.yaml"), content: options.yaml.stringify(stableValue(anchor)) },
+      { file: path.join(files.historySnapshots, "latest.yaml"), content: options.yaml.stringify(stableValue(pointer)) },
+    ], options);
+    return {
+      command: "snapshot create",
+      created: true,
+      anchor_id: anchorId,
+      reason,
+      anchor_checksum: anchor.anchor_checksum,
+      stream_revisions: streamRevisions,
+      event_count: eventCount,
+    };
+  }, { waitForActive: true });
 }
 
 function rebuildFormalViews(files, options) {
   return withLock(files, "formal-state-rebuild", () => {
+    const retentionReceipts = readArtifactRetentionReceipts(files, options);
+    const historyArchives = readArtifactHistoryArchives(files, options);
+    if (retentionReceipts.length || historyArchives.length) {
+      const trusted = readLatestHistoryAnchor(files, options);
+      if (!trusted) throw new Error("Retained history rebuild requires a trusted history anchor.");
+      const errors = [];
+      const events = readEvents(files, errors, {
+        offsetBytes: trusted.anchor.event_index.offset_bytes,
+        lineOffset: trusted.anchor.event_index.event_count,
+      });
+      if (errors.length) {
+        throw new Error(`Retained history rebuild failed:\n- ${errors.join("\n- ")}`);
+      }
+      const baseRevisions = Object.fromEntries(
+        Object.entries(trusted.anchor.streams).map(([stream, metadata]) => [stream, metadata.revision]),
+      );
+      const records = readEventShards(files, options, baseRevisions, events);
+      const rebuilt = Object.fromEntries([...FORMAL_STREAMS].map(([stream]) => [stream, replayStreamRecords(
+        stream,
+        records.filter((record) => record.stream === stream),
+        options,
+        {
+          value: trusted.snapshots[stream],
+          recordChecksum: trusted.anchor.streams[stream].record_checksum,
+          revision: trusted.anchor.streams[stream].revision,
+        },
+      )]));
+      atomicWriteSet(files, [...FORMAL_STREAMS].map(([stream, descriptor]) => {
+        const streamRecords = records.filter((record) => record.stream === stream);
+        return {
+          file: descriptor.viewFile(files),
+          content: streamRecords.length
+            ? options.yaml.stringify(rebuilt[stream])
+            : fs.readFileSync(
+              path.join(files.historySnapshots, trusted.anchor.anchor_id, descriptor.snapshotFile),
+              "utf8",
+            ),
+        };
+      }), options);
+      return {
+        command: "rebuild",
+        rebuilt: true,
+        history_base_anchor_id: trusted.anchor.anchor_id,
+        event_shard_count: records.length,
+        workflow_revision: rebuilt["workflow-state"]?.revision ?? 0,
+        artifact_registry_revision: rebuilt["artifact-registry"]?.revision ?? 0,
+      };
+    }
     const records = readEventShards(files, options);
     if (!records.length) {
       return { command: "rebuild", rebuilt: false, event_shard_count: 0, message: "No formal event shards exist; legacy views were left unchanged." };
     }
-    const latest = new Map();
-    for (const record of records) {
-      const current = latest.get(record.stream);
-      if (!current || record.revision > current.revision) latest.set(record.stream, record);
-    }
-    const workflow = latest.get("workflow-state");
-    const registry = latest.get("artifact-registry");
-    if (workflow) atomicWrite(files.workflowState, options.yaml.stringify(workflow.after_value));
-    if (registry) atomicWrite(files.artifactRegistry, options.yaml.stringify(registry.after_value));
-    const index = records.map(({ after_value: ignored, ...record }) => JSON.stringify(record)).join("\n");
-    atomicWrite(files.events, `${index}\n`);
+    const workflowRecords = records.filter((record) => record.stream === "workflow-state");
+    const registryRecords = records.filter((record) => record.stream === "artifact-registry");
+    const workflow = workflowRecords.length ? replayStreamRecords("workflow-state", workflowRecords, options) : null;
+    const registry = registryRecords.length ? replayStreamRecords("artifact-registry", registryRecords, options) : null;
+    const index = records.map((record) => {
+      const { after_value: ignored, ...indexed } = record;
+      if (record.after_value) delete indexed.record_checksum;
+      return JSON.stringify(indexed);
+    }).join("\n");
+    const writes = [{ file: files.events, content: `${index}\n` }];
+    if (workflow) writes.unshift({ file: files.workflowState, content: options.yaml.stringify(workflow) });
+    if (registry) writes.unshift({ file: files.artifactRegistry, content: options.yaml.stringify(registry) });
+    atomicWriteSet(files, writes, options);
     return {
       command: "rebuild",
       rebuilt: true,
@@ -460,6 +1813,10 @@ function registerArtifact(files, flags, options) {
       throw new Error(`Artifact ID is already registered: ${artifactId}`);
     }
     const artifactPath = requiredFlag(flags, "--path").replaceAll("\\", "/");
+    const status = artifactStatus(flags);
+    if (WORKING_DRAFT_STATUSES.has(status)) {
+      throw new Error("Working drafts are mutable and must not be registered in the formal artifact registry.");
+    }
     if (!artifactPath.startsWith(".workflow/")) {
       throw new Error("Artifact path must be project-relative and start with .workflow/.");
     }
@@ -482,14 +1839,37 @@ function registerArtifact(files, flags, options) {
     if (supersedes) {
       predecessor = registry.artifacts.find((item) => (item.artifact_id || item.id) === supersedes);
       if (!predecessor) throw new Error(`Superseded artifact is not registered: ${supersedes}`);
-      if (predecessor.status === "superseded") {
-        throw new Error(`Artifact is already superseded: ${supersedes}`);
+      const successor = artifactSuperseder(registry, predecessor);
+      if (predecessor.status === "superseded" || successor) {
+        const successorId = successor?.artifact_id || successor?.id;
+        throw new Error(
+          `Artifact is already superseded: ${supersedes}${successorId ? ` by ${successorId}` : ""}`,
+        );
       }
     }
     const node = requiredFlag(flags, "--node");
+    assertNotLegacyDevelopmentNode(node);
     if (!NODE_IDS.has(node)) throw new Error(`Unknown workflow node: ${node}`);
     const artifactScope = scopeNameForNode(node);
     const artifactScopeState = scopeState(workflowState, artifactScope);
+    const candidateId = optionalFlag(flags, "--candidate-id");
+    if (node === "05-candidate-assurance") {
+      if (!candidateId) {
+        throw new Error("05-candidate-assurance artifacts require --candidate-id.");
+      }
+      const attempt = Number(artifactScopeState.node_attempts[node] || 0);
+      const binding = artifactScopeState.node_candidate_bindings[node];
+      if (!artifactScopeState.active_nodes.includes(node)
+        || Number(binding?.node_attempt) !== attempt
+        || binding?.candidate_id !== candidateId) {
+        throw new Error(`Assurance artifact candidate ${candidateId} does not match the active node attempt.`);
+      }
+      const candidate = registry.artifacts.find((item) =>
+        (item.artifact_id || item.id) === candidateId);
+      if (!candidate || projectedArtifactStatus(registry, candidate) !== "immutable") {
+        throw new Error(`Assurance artifact candidate is not selected and immutable: ${candidateId}.`);
+      }
+    }
     const artifact = {
       artifact_id: artifactId,
       artifact_type: optionalFlag(flags, "--artifact-type"),
@@ -497,40 +1877,39 @@ function registerArtifact(files, flags, options) {
       node,
       scope: artifactScope,
       iteration_id: artifactScopeState.scope_id || null,
-      status: artifactStatus(flags),
+      status,
       version: optionalFlag(flags, "--version"),
       producer_skill: optionalFlag(flags, "--producer-skill"),
+      candidate_id: candidateId,
       supersedes,
       checksum_algorithm: "sha256",
       checksum: sha256(content),
       registered_at: timestamp,
     };
-    if (predecessor) {
-      const previous = predecessor.status || "unknown";
-      predecessor.status = "superseded";
-      predecessor.superseded_by = artifactId;
-      predecessor.status_history = [
-        ...(Array.isArray(predecessor.status_history) ? predecessor.status_history : []),
-        {
-          from: previous,
-          to: "superseded",
-          evidence: [artifactId],
-          changed_at: timestamp,
-        },
-      ];
-    }
     registry.schema_version = 1;
     registry.project_id = registry.project_id || project.project_id || workflowState.project_id || null;
     registry.iteration_id = workflowState.development_state.scope_id || registry.iteration_id || null;
     registry.revision += 1;
     registry.updated_at = timestamp;
     registry.artifacts = [...registry.artifacts, artifact];
-    writeStream(files, "artifact-registry", files.artifactRegistry, registry, {
+    const event = {
       type: "artifact-registered",
       occurred_at: timestamp,
       artifact_id: artifactId,
       path: artifactPath,
-    }, options);
+    };
+    commitFormalTransaction(files, [{
+      stream: "artifact-registry",
+      file: files.artifactRegistry,
+      value: registry,
+      event,
+      transaction: artifactRegistryTransaction(
+        event,
+        registry,
+        expected,
+        [artifact],
+      ),
+    }], [], options);
     return {
       command: "artifact register",
       project_id: registry.project_id,
@@ -539,7 +1918,7 @@ function registerArtifact(files, flags, options) {
       artifact,
       artifact_registry: registry,
     };
-  });
+  }, { waitForActive: true });
 }
 
 function changeArtifactStatus(files, flags, options) {
@@ -558,8 +1937,11 @@ function changeArtifactStatus(files, flags, options) {
     const evidence = repeatedFlag(flags, "--evidence");
     if (!evidence.length) throw new Error("artifact status requires at least one --evidence reference.");
     if (artifact.status === status) throw new Error(`Artifact already has status ${status}: ${artifactId}`);
-    if (artifact.status === "superseded" || artifact.status === "archived") {
-      throw new Error(`Terminal artifact status cannot change: ${artifact.status}`);
+    if (!WORKING_DRAFT_STATUSES.has(artifact.status)) {
+      throw new Error(`Immutable artifact revision cannot change status: ${artifact.status}`);
+    }
+    if (WORKING_DRAFT_STATUSES.has(status)) {
+      throw new Error("Legacy draft migration must target an immutable semantic status.");
     }
 
     const timestamp = (options.now || (() => new Date().toISOString()))();
@@ -572,43 +1954,763 @@ function changeArtifactStatus(files, flags, options) {
     registry.schema_version = 1;
     registry.revision += 1;
     registry.updated_at = timestamp;
-    writeStream(files, "artifact-registry", files.artifactRegistry, registry, {
+    const event = {
       type: "artifact-status-changed",
       occurred_at: timestamp,
       artifact_id: artifactId,
       from: previous,
       to: status,
       evidence,
-    }, options);
+    };
+    commitFormalTransaction(files, [{
+      stream: "artifact-registry",
+      file: files.artifactRegistry,
+      value: registry,
+      event,
+      transaction: artifactRegistryTransaction(event, registry, expected, [artifact]),
+    }], [], options);
+    return {
+      command: "artifact status",
+      revision: registry.revision,
+      artifact,
+      artifact_registry: registry,
+    };
+  }, { waitForActive: true });
+}
+
+function recoverArtifactPrune(files, apply, options) {
+  if (!fs.existsSync(files.pruneRuntime)) return 0;
+  const pending = fs.readdirSync(files.pruneRuntime, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => path.join(files.pruneRuntime, entry.name));
+  if (pending.length && !apply) {
+    throw new Error("An interrupted artifact prune requires explicit --apply recovery.");
+  }
+  let recovered = 0;
+  for (const directory of pending) {
+    const planFile = path.join(directory, "plan.json");
+    if (!fs.existsSync(planFile)) throw new Error(`Artifact prune recovery plan is missing: ${directory}.`);
+    let plan;
+    try {
+      plan = JSON.parse(fs.readFileSync(planFile, "utf8"));
+    } catch {
+      throw new Error(`Artifact prune recovery plan is invalid: ${directory}.`);
+    }
+    if (plan?.schema_version !== 1 || !plan.anchor_id || !Array.isArray(plan.shards)
+      || plan.shards.some((item) => !/^[^/\\]+\.ya?ml$/i.test(item?.name || "")
+        || !/^[a-f0-9]{64}$/.test(item?.checksum || ""))) {
+      throw new Error(`Artifact prune recovery plan is invalid: ${directory}.`);
+    }
+    const receiptFile = path.join(files.artifactRetention, `${historyAnchorId(plan.anchor_id)}.yaml`);
+    if (fs.existsSync(receiptFile)) {
+      const receipt = readArtifactRetentionReceipts(files, options)
+        .find((item) => item.anchor_id === plan.anchor_id);
+      const plannedShardsChecksum = sha256(JSON.stringify(stableValue(plan.shards)));
+      if (!receipt
+        || receipt.deleted_shard_count !== plan.shards.length
+        || receipt.deleted_shards_checksum !== plannedShardsChecksum) {
+        throw new Error(`Artifact prune receipt does not match its recovery plan: ${plan.anchor_id}.`);
+      }
+      fs.rmSync(directory, { recursive: true, force: true });
+      recovered += 1;
+      continue;
+    }
+    const shardDirectory = path.join(files.eventShards, "artifact-registry");
+    fs.mkdirSync(shardDirectory, { recursive: true });
+    for (const { name, checksum } of plan.shards) {
+      const staged = path.join(directory, name);
+      if (!fs.existsSync(staged)) continue;
+      if (fileChecksum(staged) !== checksum) {
+        throw new Error(`Artifact prune staged shard checksum mismatch: ${name}.`);
+      }
+      const destination = path.join(shardDirectory, name);
+      if (fs.existsSync(destination)) {
+        if (fileChecksum(destination) !== checksum) {
+          throw new Error(`Artifact prune recovery destination conflicts: ${name}.`);
+        }
+        fs.rmSync(staged, { force: true });
+      } else {
+        fs.renameSync(staged, destination);
+      }
+    }
+    fs.rmSync(directory, { recursive: true, force: true });
+    recovered += 1;
+  }
+  return recovered;
+}
+
+function legacyArtifactHistoryArchive(files, trusted, options) {
+  verifyFormalState(files, options, { history: true });
+  const anchoredRevision = trusted.anchor.streams["artifact-registry"].revision;
+  const shardDirectory = path.join(files.eventShards, "artifact-registry");
+  const legacyShards = fs.existsSync(shardDirectory)
+    ? fs.readdirSync(shardDirectory)
+      .filter((name) => /\.ya?ml$/i.test(name))
+      .map((name) => ({
+        name,
+        file: path.join(shardDirectory, name),
+        record: readEventShardRecord(files, options, "artifact-registry", name),
+      }))
+      .filter(({ record }) => record.after_value && record.revision <= anchoredRevision)
+      .sort((left, right) => left.record.revision - right.record.revision)
+    : [];
+  if (!legacyShards.length) {
+    throw new Error("Legacy artifact history compact requires anchored full-snapshot shards.");
+  }
+  const replayed = replayStreamRecords(
+    "artifact-registry",
+    legacyShards.map(({ record }) => record),
+    options,
+  );
+  const anchoredRegistry = trusted.snapshots["artifact-registry"];
+  if (JSON.stringify(stableValue(normalizeArtifactRegistry(replayed)))
+    !== JSON.stringify(stableValue(normalizeArtifactRegistry(anchoredRegistry)))) {
+    throw new Error("Legacy artifact history replay does not reproduce the anchored registry.");
+  }
+  const finalRecord = legacyShards.at(-1).record;
+  const anchoredChecksum = trusted.anchor.streams["artifact-registry"].view_checksum;
+  if (finalRecord.revision !== anchoredRevision || finalRecord.after_checksum !== anchoredChecksum) {
+    throw new Error("Legacy artifact history replay does not reproduce the anchored registry checksum.");
+  }
+
+  const digest = crypto.createHash("sha256");
+  const entries = legacyShards.map(({ name, file, record }) => {
+    const content = fs.readFileSync(file);
+    digest.update(name);
+    digest.update("\0");
+    digest.update(content);
+    digest.update("\0");
+    return {
+      path: name,
+      revision: record.revision,
+      size_bytes: content.length,
+      sha256: sha256(content),
+      content_base64: content.toString("base64"),
+    };
+  });
+  const sourceHistoryRootDigest = digest.digest("hex");
+  const coverage = {
+    first_revision: legacyShards[0].record.revision,
+    last_revision: finalRecord.revision,
+    event_count: legacyShards.length,
+  };
+  const archiveId = trusted.anchor.anchor_id;
+  const bundle = stableValue({
+    schema_version: 1,
+    archive_id: archiveId,
+    stream: "artifact-registry",
+    source_root: portableReference(files, shardDirectory),
+    source_history_root_digest: sourceHistoryRootDigest,
+    source_history_root_digest_algorithm: "sha256-path-null-bytes-null-v1",
+    coverage,
+    anchor: {
+      anchor_id: trusted.anchor.anchor_id,
+      anchor_checksum: trusted.anchor.anchor_checksum,
+      registry_revision: anchoredRevision,
+      registry_checksum: anchoredChecksum,
+    },
+    entries,
+  });
+  const archiveBytes = zlib.gzipSync(Buffer.from(`${JSON.stringify(bundle, null, 2)}\n`), {
+    level: 9,
+    mtime: 0,
+  });
+  const archiveFile = path.join(files.artifactHistoryArchives, `${archiveId}.json.gz`);
+  const manifestFile = path.join(files.artifactHistoryArchives, `${archiveId}.yaml`);
+  const looseBytes = entries.reduce((total, entry) => total + entry.size_bytes, 0);
+  const compactedAt = (options.now || (() => new Date().toISOString()))();
+  const manifestBase = stableValue({
+    schema_version: 1,
+    archive_id: archiveId,
+    stream: "artifact-registry",
+    anchor_id: trusted.anchor.anchor_id,
+    anchor_checksum: trusted.anchor.anchor_checksum,
+    registry_revision: anchoredRevision,
+    registry_checksum: anchoredChecksum,
+    source_root: bundle.source_root,
+    source_history_root_digest: sourceHistoryRootDigest,
+    source_history_root_digest_algorithm: bundle.source_history_root_digest_algorithm,
+    coverage,
+    loose_file_count: entries.length,
+    loose_bytes: looseBytes,
+    archive_format: "gzip-json-v1",
+    archive_path: portableReference(files, archiveFile),
+    archive_checksum: sha256(archiveBytes),
+    compressed_bundle_bytes: archiveBytes.length,
+    compacted_at: compactedAt,
+  });
+  const manifest = {
+    ...manifestBase,
+    manifest_checksum: sha256(options.yaml.stringify(manifestBase)),
+  };
+  const manifestContent = options.yaml.stringify(stableValue(manifest));
+  const archiveStorageBytes = archiveBytes.length + Buffer.byteLength(manifestContent);
+  return {
+    bundle,
+    archiveBytes,
+    archiveFile,
+    entries,
+    manifest,
+    manifestContent,
+    manifestFile,
+    report: {
+      command: "compact",
+      anchor_id: trusted.anchor.anchor_id,
+      anchor_checksum: trusted.anchor.anchor_checksum,
+      source_history_root_digest: sourceHistoryRootDigest,
+      coverage,
+      loose_file_count: entries.length,
+      loose_bytes: looseBytes,
+      compressed_bundle_bytes: archiveBytes.length,
+      manifest_bytes: Buffer.byteLength(manifestContent),
+      archive_bytes: archiveStorageBytes,
+      expected_freed_bytes: looseBytes - archiveStorageBytes,
+      archive_path: portableReference(files, archiveFile),
+      manifest_path: portableReference(files, manifestFile),
+    },
+  };
+}
+
+function readArtifactHistoryArchives(files, options) {
+  assertPathInside(files.root, files.artifactHistoryArchives);
+  if (!fs.existsSync(files.artifactHistoryArchives)) return [];
+  return fs.readdirSync(files.artifactHistoryArchives)
+    .filter((name) => /\.ya?ml$/i.test(name))
+    .sort()
+    .map((name) => {
+      const manifestFile = path.join(files.artifactHistoryArchives, name);
+      const manifest = readYaml(manifestFile, options.yaml, `artifact history archive manifest ${name}`);
+      const archiveId = historyAnchorId(manifest.archive_id);
+      const expectedManifestName = `${archiveId}.yaml`;
+      const archiveFile = path.join(files.artifactHistoryArchives, `${archiveId}.json.gz`);
+      const coverage = manifest.coverage;
+      if (name !== expectedManifestName
+        || manifest.schema_version !== 1
+        || manifest.stream !== "artifact-registry"
+        || manifest.anchor_id !== archiveId
+        || manifest.archive_format !== "gzip-json-v1"
+        || manifest.archive_path !== portableReference(files, archiveFile)
+        || !/^[a-f0-9]{64}$/.test(manifest.anchor_checksum || "")
+        || !/^[a-f0-9]{64}$/.test(manifest.registry_checksum || "")
+        || !/^[a-f0-9]{64}$/.test(manifest.source_history_root_digest || "")
+        || manifest.source_history_root_digest_algorithm !== "sha256-path-null-bytes-null-v1"
+        || !/^[a-f0-9]{64}$/.test(manifest.archive_checksum || "")
+        || !Number.isSafeInteger(manifest.registry_revision)
+        || manifest.registry_revision < 1
+        || !Number.isSafeInteger(coverage?.first_revision)
+        || !Number.isSafeInteger(coverage?.last_revision)
+        || !Number.isSafeInteger(coverage?.event_count)
+        || coverage.first_revision < 1
+        || coverage.last_revision < coverage.first_revision
+        || coverage.event_count !== coverage.last_revision - coverage.first_revision + 1
+        || coverage.last_revision !== manifest.registry_revision
+        || !Number.isSafeInteger(manifest.loose_file_count)
+        || manifest.loose_file_count !== coverage.event_count
+        || !Number.isSafeInteger(manifest.loose_bytes)
+        || manifest.loose_bytes < 0
+        || !Number.isSafeInteger(manifest.compressed_bundle_bytes)
+        || manifest.compressed_bundle_bytes < 1
+        || structuredDocumentChecksum(manifest, "manifest_checksum", options.yaml.stringify)
+          !== manifest.manifest_checksum
+        || !fs.existsSync(archiveFile)
+        || fs.statSync(archiveFile).size !== manifest.compressed_bundle_bytes
+        || sha256(fs.readFileSync(archiveFile)) !== manifest.archive_checksum) {
+        throw new Error(`Artifact history archive manifest is invalid: ${name}.`);
+      }
+      let bundle;
+      try {
+        bundle = JSON.parse(zlib.gunzipSync(fs.readFileSync(archiveFile)).toString("utf8"));
+      } catch {
+        throw new Error(`Artifact history archive bundle is invalid: ${archiveId}.`);
+      }
+      if (bundle?.schema_version !== 1
+        || bundle.archive_id !== archiveId
+        || bundle.stream !== "artifact-registry"
+        || bundle.source_root !== manifest.source_root
+        || bundle.source_history_root_digest !== manifest.source_history_root_digest
+        || bundle.source_history_root_digest_algorithm !== manifest.source_history_root_digest_algorithm
+        || JSON.stringify(bundle.coverage) !== JSON.stringify(manifest.coverage)
+        || bundle.anchor?.anchor_id !== manifest.anchor_id
+        || bundle.anchor?.anchor_checksum !== manifest.anchor_checksum
+        || bundle.anchor?.registry_revision !== manifest.registry_revision
+        || bundle.anchor?.registry_checksum !== manifest.registry_checksum
+        || !Array.isArray(bundle.entries)
+        || bundle.entries.length !== manifest.loose_file_count) {
+        throw new Error(`Artifact history archive bundle metadata is invalid: ${archiveId}.`);
+      }
+      const digest = crypto.createHash("sha256");
+      const names = new Set();
+      let entryBytes = 0;
+      const records = bundle.entries.map((entry, index) => {
+        if (!/^[^/\\]+\.ya?ml$/i.test(entry?.path || "") || names.has(entry.path)) {
+          throw new Error(`Artifact history archive entry path is invalid: ${archiveId}.`);
+        }
+        names.add(entry.path);
+        if (!Number.isSafeInteger(entry.size_bytes) || entry.size_bytes < 0
+          || !Number.isSafeInteger(entry.revision)
+          || entry.revision !== coverage.first_revision + index) {
+          throw new Error(`Artifact history archive entry metadata is invalid: ${archiveId}/${entry.path}.`);
+        }
+        const content = Buffer.from(String(entry.content_base64 || ""), "base64");
+        if (content.length !== entry.size_bytes || sha256(content) !== entry.sha256) {
+          throw new Error(`Artifact history archive entry checksum is invalid: ${archiveId}/${entry.path}.`);
+        }
+        entryBytes += entry.size_bytes;
+        digest.update(entry.path);
+        digest.update("\0");
+        digest.update(content);
+        digest.update("\0");
+        let record;
+        try {
+          record = options.yaml.parse(content.toString("utf8"));
+        } catch {
+          throw new Error(`Artifact history archive entry is unreadable: ${archiveId}/${entry.path}.`);
+        }
+        const validated = validateEventShardRecord(record, "artifact-registry", entry.path);
+        if (validated.revision !== entry.revision) {
+          throw new Error(`Artifact history archive entry revision is invalid: ${archiveId}/${entry.path}.`);
+        }
+        return validated;
+      });
+      if (digest.digest("hex") !== manifest.source_history_root_digest
+        || entryBytes !== manifest.loose_bytes
+        || records.length !== manifest.coverage?.event_count
+        || records[0]?.revision !== manifest.coverage?.first_revision
+        || records.at(-1)?.revision !== manifest.coverage?.last_revision
+        || records.some((record, index) => record.revision !== coverage.first_revision + index)) {
+        throw new Error(`Artifact history archive coverage is invalid: ${archiveId}.`);
+      }
+      const replayed = replayStreamRecords("artifact-registry", records, options);
+      const anchorFile = path.join(files.historySnapshots, archiveId, "anchor.yaml");
+      const snapshotFile = path.join(files.historySnapshots, archiveId, "artifact-registry.yaml");
+      const anchor = readYaml(anchorFile, options.yaml, `artifact history archive anchor ${archiveId}`);
+      const snapshot = normalizeArtifactRegistry(readYaml(
+        snapshotFile,
+        options.yaml,
+        `artifact history archive snapshot ${archiveId}`,
+      ));
+      if (anchor.anchor_checksum !== manifest.anchor_checksum
+        || structuredDocumentChecksum(anchor, "anchor_checksum", options.yaml.stringify)
+          !== anchor.anchor_checksum
+        || anchor.streams?.["artifact-registry"]?.revision !== manifest.registry_revision
+        || anchor.streams?.["artifact-registry"]?.view_checksum !== manifest.registry_checksum
+        || sha256(fs.readFileSync(snapshotFile)) !== manifest.registry_checksum
+        || JSON.stringify(stableValue(normalizeArtifactRegistry(replayed)))
+          !== JSON.stringify(stableValue(snapshot))) {
+        throw new Error(`Artifact history archive replay does not match its anchor: ${archiveId}.`);
+      }
+      return { manifest, manifestFile, archiveFile, bundle };
+    });
+}
+
+function restoreCompactionStaging(files, directory, plan) {
+  const shardDirectory = path.join(files.eventShards, "artifact-registry");
+  fs.mkdirSync(shardDirectory, { recursive: true });
+  for (const entry of plan.entries) {
+    const staged = path.join(directory, entry.path);
+    if (!fs.existsSync(staged)) continue;
+    if (sha256(fs.readFileSync(staged)) !== entry.sha256) {
+      throw new Error(`Artifact history compact staged shard checksum mismatch: ${entry.path}.`);
+    }
+    const destination = path.join(shardDirectory, entry.path);
+    if (fs.existsSync(destination)) {
+      if (sha256(fs.readFileSync(destination)) !== entry.sha256) {
+        throw new Error(`Artifact history compact recovery destination conflicts: ${entry.path}.`);
+      }
+      fs.rmSync(staged, { force: true });
+    } else {
+      fs.renameSync(staged, destination);
+    }
+  }
+}
+
+function recoverArtifactHistoryCompaction(files, apply, options) {
+  if (!fs.existsSync(files.compactRuntime)) return 0;
+  const pending = fs.readdirSync(files.compactRuntime, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => path.join(files.compactRuntime, entry.name));
+  if (pending.length && !apply) {
+    throw new Error("An interrupted artifact history compact requires explicit apply recovery.");
+  }
+  let recovered = 0;
+  for (const directory of pending) {
+    const planFile = path.join(directory, "plan.json");
+    if (!fs.existsSync(planFile)) {
+      const interruptedPlanWrites = fs.readdirSync(directory, { withFileTypes: true });
+      if (interruptedPlanWrites.every((entry) =>
+        entry.isFile() && /^plan\.json\.\d+\.\d+\.tmp$/.test(entry.name))) {
+        fs.rmSync(directory, { recursive: true, force: true });
+        recovered += 1;
+        continue;
+      }
+      throw new Error(`Artifact history compact recovery plan is invalid: ${directory}.`);
+    }
+    let plan;
+    try {
+      plan = JSON.parse(fs.readFileSync(planFile, "utf8"));
+    } catch {
+      throw new Error(`Artifact history compact recovery plan is invalid: ${directory}.`);
+    }
+    if (plan?.schema_version !== 1 || !plan.archive_id
+      || !/^[a-f0-9]{64}$/.test(plan.archive_checksum || "")
+      || !Array.isArray(plan.entries) || !plan.entries.length
+      || plan.entries.some((entry) => !/^[^/\\]+\.ya?ml$/i.test(entry?.path || "")
+        || !/^[a-f0-9]{64}$/.test(entry?.sha256 || ""))) {
+      throw new Error(`Artifact history compact recovery plan is invalid: ${directory}.`);
+    }
+    const plannedEntries = new Map(plan.entries.map((entry) => [entry.path, entry.sha256]));
+    const stagedEntries = fs.readdirSync(directory, { withFileTypes: true })
+      .filter((entry) => entry.name !== "plan.json");
+    if (plannedEntries.size !== plan.entries.length
+      || stagedEntries.some((entry) => !entry.isFile() || !plannedEntries.has(entry.name))) {
+      throw new Error(`Artifact history compact recovery plan is invalid: ${directory}.`);
+    }
+    const changedStagedEntry = stagedEntries.find((entry) =>
+      sha256(fs.readFileSync(path.join(directory, entry.name))) !== plannedEntries.get(entry.name));
+    if (changedStagedEntry) {
+      throw new Error(`Artifact history compact staged shard checksum mismatch: ${changedStagedEntry.name}.`);
+    }
+    let archive = null;
+    try {
+      archive = readArtifactHistoryArchives(files, options)
+        .find(({ manifest }) => manifest.archive_id === plan.archive_id) || null;
+    } catch {
+      archive = null;
+    }
+    const archivedEntries = new Map(
+      (archive?.bundle.entries || []).map((entry) => [entry.path, entry.sha256]),
+    );
+    const archiveMatches = archive?.manifest.archive_checksum === plan.archive_checksum
+      && plan.entries.every((entry) => archivedEntries.get(entry.path) === entry.sha256);
+    if (!archiveMatches) {
+      restoreCompactionStaging(files, directory, plan);
+      fs.rmSync(directory, { recursive: true, force: true });
+      throw new Error(`Artifact history compact recovery plan does not match its verified archive: ${plan.archive_id}.`);
+    }
+    fs.rmSync(directory, { recursive: true, force: true });
+    recovered += 1;
+  }
+  return recovered;
+}
+
+function removeCompactedLooseEntries(files, archiveId, archiveChecksum, entries) {
+  if (!entries.length) return;
+  const stagingDirectory = path.join(files.compactRuntime, crypto.randomUUID());
+  fs.mkdirSync(stagingDirectory, { recursive: true });
+  atomicWrite(path.join(stagingDirectory, "plan.json"), `${JSON.stringify({
+    schema_version: 1,
+    archive_id: archiveId,
+    archive_checksum: archiveChecksum,
+    entries: entries.map((entry) => ({ path: entry.path, sha256: entry.sha256 })),
+  }, null, 2)}\n`);
+  const shardDirectory = path.join(files.eventShards, "artifact-registry");
+  try {
+    for (const entry of entries) {
+      const source = path.join(shardDirectory, entry.path);
+      if (sha256(fs.readFileSync(source)) !== entry.sha256) {
+        throw new Error(`Artifact history shard changed during compact: ${entry.path}.`);
+      }
+      fs.renameSync(source, path.join(stagingDirectory, entry.path));
+    }
+    fs.rmSync(stagingDirectory, { recursive: true, force: true });
+  } catch (error) {
+    restoreCompactionStaging(files, stagingDirectory, { entries });
+    fs.rmSync(stagingDirectory, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+function compactArtifactHistory(files, flags, options) {
+  const apply = flags.has("--apply");
+  const action = () => {
+    assertPathInside(files.root, files.artifactHistoryArchives);
+    assertPathInside(files.root, files.compactRuntime);
+    assertPathInside(files.root, path.join(files.eventShards, "artifact-registry"));
+    const recoveredCompactionCount = recoverArtifactHistoryCompaction(files, apply, options);
+    const trusted = readLatestHistoryAnchor(files, options);
+    if (!trusted) throw new Error("Legacy artifact history compact requires a trusted history anchor.");
+    const existingArchive = readArtifactHistoryArchives(files, options)
+      .find(({ manifest }) => manifest.archive_id === trusted.anchor.anchor_id);
+    if (existingArchive) {
+      verifyFormalState(files, options, { history: true });
+      const shardDirectory = path.join(files.eventShards, "artifact-registry");
+      const looseEntries = existingArchive.bundle.entries.filter((entry) => {
+        const looseFile = path.join(shardDirectory, entry.path);
+        if (!fs.existsSync(looseFile)) return false;
+        if (sha256(fs.readFileSync(looseFile)) !== entry.sha256) {
+          throw new Error(`Artifact history loose shard conflicts with verified archive: ${entry.path}.`);
+        }
+        return true;
+      });
+      const looseBytes = looseEntries.reduce((total, entry) => total + entry.size_bytes, 0);
+      const manifestBytes = fs.statSync(existingArchive.manifestFile).size;
+      const result = {
+        command: "compact",
+        anchor_id: existingArchive.manifest.anchor_id,
+        anchor_checksum: existingArchive.manifest.anchor_checksum,
+        source_history_root_digest: existingArchive.manifest.source_history_root_digest,
+        coverage: existingArchive.manifest.coverage,
+        loose_file_count: looseEntries.length,
+        loose_bytes: looseBytes,
+        compressed_bundle_bytes: existingArchive.manifest.compressed_bundle_bytes,
+        manifest_bytes: manifestBytes,
+        archive_bytes: existingArchive.manifest.compressed_bundle_bytes + manifestBytes,
+        expected_freed_bytes: looseBytes,
+        archive_path: existingArchive.manifest.archive_path,
+        manifest_path: portableReference(files, existingArchive.manifestFile),
+        mode: apply ? "apply" : "dry-run",
+        applied: false,
+        deduplicated: true,
+        recovered_compaction_count: recoveredCompactionCount,
+      };
+      if (!apply || !looseEntries.length) return result;
+      removeCompactedLooseEntries(
+        files,
+        trusted.anchor.anchor_id,
+        existingArchive.manifest.archive_checksum,
+        looseEntries,
+      );
+      return { ...result, applied: true };
+    }
+    const plan = legacyArtifactHistoryArchive(files, trusted, options);
+    const result = {
+      ...plan.report,
+      mode: apply ? "apply" : "dry-run",
+      applied: false,
+      deduplicated: false,
+      recovered_compaction_count: recoveredCompactionCount,
+    };
+    if (!apply) return result;
+    if (fs.existsSync(plan.manifestFile)) {
+      throw new Error(`Artifact history archive already exists: ${trusted.anchor.anchor_id}.`);
+    }
+    fs.mkdirSync(files.artifactHistoryArchives, { recursive: true });
+    const orphanArchiveExists = fs.existsSync(plan.archiveFile);
+    if (orphanArchiveExists
+      && (fs.statSync(plan.archiveFile).size !== plan.archiveBytes.length
+        || sha256(fs.readFileSync(plan.archiveFile)) !== plan.manifest.archive_checksum)) {
+      throw new Error(`Artifact history archive conflicts with the compact plan: ${trusted.anchor.anchor_id}.`);
+    }
+    let archiveWritten = false;
+    let manifestWritten = false;
+    try {
+      if (!orphanArchiveExists) {
+        atomicWrite(plan.archiveFile, plan.archiveBytes);
+        archiveWritten = true;
+      }
+      atomicWrite(plan.manifestFile, plan.manifestContent);
+      manifestWritten = true;
+      const verified = readArtifactHistoryArchives(files, options);
+      if (!verified.some(({ manifest }) => manifest.archive_id === trusted.anchor.anchor_id)) {
+        throw new Error(`Artifact history archive verification failed: ${trusted.anchor.anchor_id}.`);
+      }
+    } catch (error) {
+      if (manifestWritten) fs.rmSync(plan.manifestFile, { force: true });
+      if (archiveWritten) fs.rmSync(plan.archiveFile, { force: true });
+      throw error;
+    }
+
+    removeCompactedLooseEntries(
+      files,
+      trusted.anchor.anchor_id,
+      plan.manifest.archive_checksum,
+      plan.entries,
+    );
+    return { ...result, applied: true };
+  };
+  return apply
+    ? withLock(files, "artifact-history-compact", action)
+    : withZeroWriteFormalState(files, action);
+}
+
+function pruneArtifactHistory(files, flags, options) {
+  const apply = flags.has("--apply");
+  const action = () => {
+    const recovered_prune_count = recoverArtifactPrune(files, apply, options);
+    const trusted = readLatestHistoryAnchor(files, options);
+    if (!trusted) throw new Error("Artifact prune requires a trusted history anchor.");
+    verifyFormalState(files, options, { history: true });
+    const anchoredRevision = trusted.anchor.streams["artifact-registry"].revision;
+    const shardDirectory = path.join(files.eventShards, "artifact-registry");
+    const eligibleShards = fs.existsSync(shardDirectory)
+      ? fs.readdirSync(shardDirectory)
+        .filter((name) => /\.ya?ml$/i.test(name))
+        .map((name) => ({ name, record: readEventShardRecord(files, options, "artifact-registry", name) }))
+        .filter(({ record }) => record.revision <= anchoredRevision)
+        .sort((left, right) => left.record.revision - right.record.revision)
+      : [];
+    const result = {
+      command: "artifact prune",
+      mode: apply ? "apply" : "dry-run",
+      applied: false,
+      recovered_prune_count,
+      anchor_id: trusted.anchor.anchor_id,
+      anchor_checksum: trusted.anchor.anchor_checksum,
+      pruned_through_revision: anchoredRevision,
+      retained_from_revision: anchoredRevision + 1,
+      eligible_shard_count: eligibleShards.length,
+      eligible_shards: eligibleShards.map(({ name }) =>
+        path.relative(files.root, path.join(shardDirectory, name)).replaceAll("\\", "/")),
+    };
+    if (!apply || !eligibleShards.length) return result;
+
+    const deletedShards = eligibleShards.map(({ name }) => ({
+      name,
+      checksum: fileChecksum(path.join(shardDirectory, name)),
+    }));
+    const timestamp = (options.now || (() => new Date().toISOString()))();
+    const receiptBase = stableValue({
+      schema_version: 1,
+      stream: "artifact-registry",
+      anchor_id: trusted.anchor.anchor_id,
+      anchor_checksum: trusted.anchor.anchor_checksum,
+      pruned_through_revision: anchoredRevision,
+      retained_from_revision: anchoredRevision + 1,
+      deleted_shard_count: deletedShards.length,
+      deleted_shards_checksum: sha256(JSON.stringify(stableValue(deletedShards))),
+      applied_at: timestamp,
+    });
+    const receipt = {
+      ...receiptBase,
+      receipt_checksum: sha256(options.yaml.stringify(receiptBase)),
+    };
+    const receiptFile = path.join(files.artifactRetention, `${trusted.anchor.anchor_id}.yaml`);
+    if (fs.existsSync(receiptFile)) {
+      throw new Error(`Artifact prune receipt already exists: ${trusted.anchor.anchor_id}.`);
+    }
+
+    const stagingDirectory = path.join(files.pruneRuntime, crypto.randomUUID());
+    fs.mkdirSync(stagingDirectory, { recursive: true });
+    atomicWrite(path.join(stagingDirectory, "plan.json"), `${JSON.stringify({
+      schema_version: 1,
+      anchor_id: trusted.anchor.anchor_id,
+      shards: deletedShards,
+    }, null, 2)}\n`);
+    let receiptWritten = false;
+    try {
+      for (const { name, checksum } of deletedShards) {
+        const source = path.join(shardDirectory, name);
+        if (fileChecksum(source) !== checksum) throw new Error(`Artifact shard changed during prune: ${name}.`);
+        fs.renameSync(source, path.join(stagingDirectory, name));
+      }
+      atomicWrite(receiptFile, options.yaml.stringify(stableValue(receipt)));
+      receiptWritten = true;
+      fs.rmSync(stagingDirectory, { recursive: true, force: true });
+    } catch (error) {
+      if (!receiptWritten) {
+        for (const { name } of deletedShards) {
+          const staged = path.join(stagingDirectory, name);
+          if (fs.existsSync(staged)) fs.renameSync(staged, path.join(shardDirectory, name));
+        }
+        fs.rmSync(stagingDirectory, { recursive: true, force: true });
+      }
+      throw error;
+    }
+    verifyFormalState(files, options, { history: true, sinceAnchor: true });
     return {
-      command: "artifact status",
-      revision: registry.revision,
-      artifact,
-      artifact_registry: registry,
+      ...result,
+      applied: true,
+      deleted_shard_count: deletedShards.length,
+      receipt_path: path.relative(files.root, receiptFile).replaceAll("\\", "/"),
+      receipt_checksum: receipt.receipt_checksum,
     };
-  });
+  };
+  return apply
+    ? withLock(files, "artifact-prune", action)
+    : withZeroWriteFormalState(files, action);
 }
 
 function allowedCompletionStatuses(node) {
-  if (node === "12-version-closeout") return new Set(["release-ready"]);
+  if (node === "06-version-closeout" || node === "12-version-closeout") {
+    return new Set(["release-ready"]);
+  }
   if (node === "R08-production-deployment") return new Set(["deployed"]);
   if (node === "R09-production-verification") return new Set(["passed"]);
   if (node === "R10-release-archive") return new Set(["released", "archived"]);
   return SUCCESSFUL_ARTIFACT_STATUSES;
 }
 
+function nodeModel(node) {
+  if (SEVEN_NODE_DEVELOPMENT_ID_SET.has(node)) return "development-seven-node";
+  if (LEGACY_DEVELOPMENT_ID_SET.has(node)) return "development-legacy-13";
+  if (RELEASE_NODE_ID_SET.has(node)) return "release-r00-r10";
+  return "legacy-production-read-only";
+}
+
+function nodeContractCatalog() {
+  return Object.fromEntries([...NODE_RULES].map(([node, rule]) => [node, {
+    node,
+    model: nodeModel(node),
+    scope: rule.scope,
+    prerequisites: [...rule.prerequisites],
+    internal_gates: [...rule.gates],
+    completion: {
+      requires_scope_manifest: rule.scope === "development" && SCOPED_COMPLETION_NODES.has(node),
+      requires_candidate: rule.scope === "development" && CANDIDATE_REQUIRED_NODES.has(node),
+      binds_candidate_on_start: CANDIDATE_BOUND_NODES.has(node),
+      requires_candidate_assurance: node === "06-version-closeout",
+      allowed_evidence_statuses: [...allowedCompletionStatuses(node)].sort(),
+    },
+  }]));
+}
+
 function satisfiesMandatoryGate(node, decision) {
   return decision?.decision === "approved"
-    || (node === "04-experience-design" && decision?.decision === "not-required");
+    || (UX_GATE_NODES.has(node) && decision?.decision === "not-required");
 }
 
 function isProductTerminalEvidence(artifact) {
-  return artifact?.node === "02-product-definition"
+  return PRODUCT_TERMINAL_NODES.has(artifact?.node)
     && /terminal/i.test(artifact.artifact_type || "")
     && SUCCESSFUL_ARTIFACT_STATUSES.has(artifact.status);
 }
 
-function persistScopeMutation(files, state, scope, timestamp, transition, eventRecord, options) {
+function artifactHandoffMutation(files, transition, timestamp, options) {
+  const artifactIds = [...new Set(transition.evidence || [])];
+  if (!artifactIds.length) return null;
+  const registry = normalizeArtifactRegistry(
+    readYaml(files.artifactRegistry, options.yaml, "artifact-registry.yaml"),
+  );
+  for (const artifactId of artifactIds) {
+    const artifact = registry.artifacts.find((item) => (item.artifact_id || item.id) === artifactId);
+    if (!artifact) throw new Error(`Handoff artifact is not registered: ${artifactId}`);
+  }
+  const handoff = stableValue({
+    workflow_event: transition.event,
+    scope: transition.scope,
+    iteration_id: transition.iteration_id,
+    artifact_ids: artifactIds,
+    ...(transition.node ? { node: transition.node } : {}),
+    ...(transition.gate_id ? { gate_id: transition.gate_id } : {}),
+    occurred_at: timestamp,
+  });
+  registry.handoffs = [
+    ...(Array.isArray(registry.handoffs) ? registry.handoffs : []),
+    handoff,
+  ];
+  const beforeRevision = registry.revision;
+  registry.revision += 1;
+  registry.updated_at = timestamp;
+  const event = {
+    type: "artifact-handoff-recorded",
+    occurred_at: timestamp,
+    workflow_event: transition.event,
+    scope: transition.scope,
+    iteration_id: transition.iteration_id,
+    artifact_ids: artifactIds,
+  };
+  return {
+    stream: "artifact-registry",
+    file: files.artifactRegistry,
+    value: registry,
+    event,
+    transaction: artifactRegistryTransaction(event, registry, beforeRevision, [], [handoff]),
+  };
+}
+
+function persistScopeMutation(files, context, options) {
+  const { state, scope, timestamp, transition, extraWrites = [] } = context;
+  const beforeRevision = state.revision;
   state.schema_version = 2;
   state.revision += 1;
   scope.revision += 1;
@@ -616,23 +2718,199 @@ function persistScopeMutation(files, state, scope, timestamp, transition, eventR
   state.updated_at = timestamp;
   scope.last_transition = transition;
   state.last_transition = transition;
-  writeStream(files, "workflow-state", files.workflowState, state, eventRecord, options);
+  const { event: type, ...eventDetails } = transition;
+  const eventRecord = { type, ...eventDetails };
+  const mutations = [{
+    stream: "workflow-state",
+    file: files.workflowState,
+    value: state,
+    event: eventRecord,
+    transaction: workflowStateTransaction(eventRecord, state, transition.scope, beforeRevision),
+  }];
+  const handoffMutation = artifactHandoffMutation(files, transition, timestamp, options);
+  if (handoffMutation) mutations.push(handoffMutation);
+  commitFormalTransaction(files, mutations, extraWrites, options);
   exposeLegacyScopeAliases(state);
 }
 
-function transitionWorkflow(files, flags, options) {
-  const expected = expectedRevision(flags);
+function scopeManifestFromFlags(flags, scope, timestamp, amendment) {
+  const manifestId = requiredFlag(flags, "--manifest-id");
+  if (scope.scope_manifests.some((manifest) => manifest?.manifest_id === manifestId)) {
+    throw new Error(`Scope manifest ID already exists: ${manifestId}.`);
+  }
+  const current = currentScopeManifest(scope);
+  if (amendment) {
+    if (!current) throw new Error("scope amend requires an existing frozen scope manifest.");
+    const supersedes = requiredFlag(flags, "--supersedes");
+    if (supersedes !== current.manifest_id) {
+      throw new Error(`scope amend must supersede current manifest ${current.manifest_id}.`);
+    }
+  } else if (current) {
+    throw new Error(`Scope is already frozen by ${current.manifest_id}; use scope amend.`);
+  }
+  const approvedBy = requiredFlag(flags, "--approved-by");
+  const reason = requiredFlag(flags, "--reason");
+  const manifest = {
+    manifest_id: manifestId,
+    iteration_id: scope.scope_id,
+    revision: Number(current?.revision || 0) + 1,
+    status: "frozen",
+    supersedes: amendment ? current.manifest_id : null,
+    slices: uniqueSortedValues(repeatedFlag(flags, "--slice"), "--slice"),
+    requirements: uniqueSortedValues(repeatedFlag(flags, "--requirement"), "--requirement"),
+    acceptance: uniqueSortedValues(repeatedFlag(flags, "--acceptance"), "--acceptance"),
+    required_tasks: scopedReferences(flags, "--required-task", "task_id"),
+    required_artifacts: scopedReferences(flags, "--required-artifact", "artifact_id"),
+    approved_by: approvedBy,
+    approval_reason: reason,
+    frozen_at: timestamp,
+  };
+  manifest.manifest_checksum = scopeManifestChecksum(manifest);
+  return manifest;
+}
+
+function mutateScopeManifest(files, flags, options, amendment = false) {
+  return withLock(files, "workflow-state", () => {
+    const state = normalizeWorkflowState(readYaml(files.workflowState, options.yaml, "workflow-state.yaml"));
+    assertWorkflowRevision(flags, state, "development");
+    const scope = state.development_state;
+    const iterationId = requiredFlag(flags, "--iteration-id");
+    if (scope.scope_id !== iterationId) {
+      throw new Error(`Iteration mismatch for development scope: state is ${scope.scope_id}, command is ${iterationId}.`);
+    }
+    if (!amendment
+      && ![...SCOPE_FREEZE_NODES].some((node) =>
+        scope.active_nodes.includes(node) || scope.completed_nodes.includes(node))) {
+      throw new Error(
+        "scope freeze requires Delivery Readiness (03-delivery-readiness or legacy 07-iteration-planning) to be active or completed.",
+      );
+    }
+    const timestamp = (options.now || (() => new Date().toISOString()))();
+    const manifest = scopeManifestFromFlags(flags, scope, timestamp, amendment);
+    scope.scope_contract_version = 1;
+    scope.scope_manifests = [...scope.scope_manifests, manifest];
+    scope.current_scope_manifest_id = manifest.manifest_id;
+    const transition = {
+      event: amendment ? "scope-amended" : "scope-frozen",
+      scope: "development",
+      iteration_id: iterationId,
+      manifest_id: manifest.manifest_id,
+      supersedes: manifest.supersedes,
+      approved_by: manifest.approved_by,
+      reason: manifest.approval_reason,
+      occurred_at: timestamp,
+    };
+    persistScopeMutation(files, { state, scope, timestamp, transition }, options);
+    return {
+      command: amendment ? "scope amend" : "scope freeze",
+      revision: state.revision,
+      scope_revision: scope.revision,
+      scope_manifest: manifest,
+      workflow_state: state,
+    };
+  }, { waitForActive: flags.has("--expected-scope-revision") });
+}
+
+function recordScopeWarning(files, flags, options) {
   return withLock(files, "workflow-state", () => {
     const state = normalizeWorkflowState(readYaml(files.workflowState, options.yaml, "workflow-state.yaml"));
-    if (state.revision !== expected) {
-      throw new Error(`Workflow state revision conflict: expected ${expected}, actual ${state.revision}.`);
+    assertWorkflowRevision(flags, state, "development");
+    const scope = state.development_state;
+    const iterationId = requiredFlag(flags, "--iteration-id");
+    if (scope.scope_id !== iterationId) {
+      throw new Error(`Iteration mismatch for development scope: state is ${scope.scope_id}, command is ${iterationId}.`);
+    }
+    const manifest = currentScopeManifest(scope);
+    if (!manifest) throw new Error("scope warn requires a frozen scope manifest.");
+    const metric = requiredFlag(flags, "--metric").toLowerCase();
+    if (!SLICE_BUDGET_LIMITS.has(metric)) {
+      throw new Error(`Unsupported Slice budget metric: ${metric}.`);
     }
+    const observed = Number(requiredFlag(flags, "--observed"));
+    const requestedLimit = optionalFlag(flags, "--limit");
+    const limit = requestedLimit === null ? SLICE_BUDGET_LIMITS.get(metric) : Number(requestedLimit);
+    if (!Number.isFinite(observed) || observed < 0 || !Number.isFinite(limit) || limit < 0) {
+      throw new Error("Slice budget observed and limit values must be non-negative numbers.");
+    }
+    if (observed <= limit) throw new Error(`Slice budget is not exceeded for ${metric}: ${observed} <= ${limit}.`);
+    const reason = requiredFlag(flags, "--reason");
+    const timestamp = (options.now || (() => new Date().toISOString()))();
+    const warning = stableValue({
+      warning_id: optionalFlag(flags, "--warning-id")
+        || `WARN-${sha256(`${iterationId}:${metric}:${observed}:${limit}:${scope.scope_warnings.length + 1}`).slice(0, 20)}`,
+      iteration_id: iterationId,
+      scope_manifest_id: manifest.manifest_id,
+      scope_manifest_checksum: manifest.manifest_checksum,
+      metric,
+      observed,
+      limit,
+      exceeded: true,
+      action: "warn-only",
+      reslice_performed: false,
+      reason,
+      recorded_at: timestamp,
+    });
+    if (scope.scope_warnings.some((item) => item?.warning_id === warning.warning_id)) {
+      throw new Error(`Scope warning ID already exists: ${warning.warning_id}.`);
+    }
+    scope.scope_warnings = [...scope.scope_warnings, warning];
+    const transition = {
+      event: "scope-budget-warning",
+      scope: "development",
+      iteration_id: iterationId,
+      manifest_id: manifest.manifest_id,
+      warning_id: warning.warning_id,
+      metric,
+      observed,
+      limit,
+      action: warning.action,
+      occurred_at: timestamp,
+    };
+    persistScopeMutation(files, { state, scope, timestamp, transition }, options);
+    return {
+      command: "scope warn",
+      revision: state.revision,
+      scope_revision: scope.revision,
+      warning,
+      scope_manifest: manifest,
+      workflow_state: state,
+    };
+  }, { waitForActive: flags.has("--expected-scope-revision") });
+}
+
+function completionReceiptFromProjection(scope, node, projection, evidence, timestamp) {
+  const manifest = currentScopeManifest(scope);
+  const receipt = stableValue({
+    receipt_id: `RECEIPT-${sha256(`${scope.scope_id}:${node}:${projection.node_attempt}:${manifest?.manifest_id || "legacy"}`).slice(0, 24)}`,
+    iteration_id: scope.scope_id,
+    node,
+    node_attempt: projection.node_attempt,
+    scope_manifest_id: manifest?.manifest_id || null,
+    scope_manifest_revision: manifest?.revision || null,
+    scope_manifest_checksum: manifest?.manifest_checksum || null,
+    required_task_ids: projection.required_task_ids,
+    required_artifact_ids: projection.required_artifact_ids,
+    task_facts: projection.task_facts,
+    artifact_facts: projection.artifact_facts,
+    gate_facts: projection.gate_facts,
+    candidate_id: projection.candidate_id,
+    blocking_defect_ids: projection.blocking_defect_ids,
+    completion_evidence: [...new Set(evidence)].sort(),
+    completed_at: timestamp,
+  });
+  receipt.receipt_checksum = completionReceiptChecksum(receipt);
+  return receipt;
+}
+
+function transitionWorkflow(files, flags, options) {
+  return withLock(files, "workflow-state", () => {
+    const state = normalizeWorkflowState(readYaml(files.workflowState, options.yaml, "workflow-state.yaml"));
     const event = requiredFlag(flags, "--event");
     const iterationId = requiredFlag(flags, "--iteration-id");
     const evidence = repeatedFlag(flags, "--evidence");
     const timestamp = (options.now || (() => new Date().toISOString()))();
 
-    const persist = (scopeName, details = {}) => {
+    const persist = (scopeName, details = {}, extraWrites = []) => {
       const scope = scopeState(state, scopeName);
       const transition = {
         event,
@@ -642,19 +2920,19 @@ function transitionWorkflow(files, flags, options) {
         ...details,
         occurred_at: timestamp,
       };
-      persistScopeMutation(files, state, scope, timestamp, transition, {
-        type: event,
-        occurred_at: timestamp,
-        scope: scopeName,
-        iteration_id: iterationId,
-        evidence,
-        ...details,
+      persistScopeMutation(files, {
+        state,
+        scope,
+        timestamp,
+        transition,
+        extraWrites,
       }, options);
       return { command: "transition", event, revision: state.revision, scope_revision: scope.revision, workflow_state: state };
     };
 
     if (event === "iteration-started" || event === "release-started") {
       const scopeName = event === "release-started" ? "release" : "development";
+      assertWorkflowRevision(flags, state, scopeName);
       const current = scopeState(state, scopeName);
       if (current.scope_id === iterationId) throw new Error(`${scopeName} scope is already current: ${iterationId}`);
       if (current.active_nodes.length || current.blocked_nodes.length || current.pending_gates.length) {
@@ -665,12 +2943,14 @@ function transitionWorkflow(files, flags, options) {
       state[scopeName === "release" ? "release_state" : "development_state"] = normalizeScope({
         scope_id: iterationId,
         revision: nextRevision,
+        ...(scopeName === "development" ? { scope_contract_version: 1 } : {}),
       });
       const project = readYaml(files.project, options.yaml, "project.yaml");
       if (scopeName === "development") project.current_iteration_id = iterationId;
       else project.current_release_id = iterationId;
-      atomicWrite(files.project, options.yaml.stringify(project));
-      return persist(scopeName);
+      return persist(scopeName, {}, [
+        { file: files.project, content: options.yaml.stringify(project) },
+      ]);
     }
 
     if (event === "candidate-selected" || event === "release-selected") {
@@ -678,13 +2958,18 @@ function transitionWorkflow(files, flags, options) {
       const registry = normalizeArtifactRegistry(readYaml(files.artifactRegistry, options.yaml, "artifact-registry.yaml"));
       const artifact = registry.artifacts.find((item) => (item.artifact_id || item.id) === artifactId);
       if (!artifact) throw new Error(`Selected artifact is not registered: ${artifactId}`);
+      assertNotLegacyDevelopmentNode(artifact.node);
+      if (artifactSuperseder(registry, artifact)) {
+        throw new Error(`Selected artifact is superseded: ${artifactId}`);
+      }
       const expectedNodes = event === "candidate-selected"
-        ? new Set(["09-development", "R04-release-candidate"])
+        ? new Set(["04-implementation", "09-development", "R04-release-candidate"])
         : new Set(["12-release-preparation", "R06-release-preparation"]);
       if (!expectedNodes.has(artifact.node)) {
         throw new Error(`Selected artifact ${artifactId} belongs to ${artifact.node}, not ${[...expectedNodes].join(" or ")}.`);
       }
       const scopeName = event === "release-selected" ? "release" : scopeNameForNode(artifact.node);
+      assertWorkflowRevision(flags, state, scopeName);
       const scope = scopeState(state, scopeName);
       if (!scope.scope_id) throw new Error(`${scopeName} scope must be started before ${event}.`);
       if (scope.scope_id !== iterationId) {
@@ -703,6 +2988,7 @@ function transitionWorkflow(files, flags, options) {
 
     if (event === "version-closed" || event === "release-archived") {
       const scopeName = event === "release-archived" ? "release" : "development";
+      assertWorkflowRevision(flags, state, scopeName);
       const scope = scopeState(state, scopeName);
       if (scope.scope_id !== iterationId) {
         throw new Error(`Iteration mismatch for ${scopeName} scope: state is ${scope.scope_id}, command is ${iterationId}.`);
@@ -711,10 +2997,20 @@ function transitionWorkflow(files, flags, options) {
       const registry = normalizeArtifactRegistry(readYaml(files.artifactRegistry, options.yaml, "artifact-registry.yaml"));
       const artifact = registry.artifacts.find((item) => (item.artifact_id || item.id) === artifactId);
       if (!artifact) throw new Error(`Milestone artifact is not registered: ${artifactId}`);
-      const expectedNode = event === "version-closed" ? "12-version-closeout" : "R10-release-archive";
+      assertNotLegacyDevelopmentNode(artifact.node);
+      const expectedNodes = event === "version-closed"
+        ? ["06-version-closeout"]
+        : ["R10-release-archive"];
       const expectedStatus = event === "version-closed" ? "release-ready" : "released";
-      if (!scope.completed_nodes.includes(expectedNode)) throw new Error(`${event} requires ${expectedNode} to be completed.`);
-      if (artifact.node !== expectedNode) throw new Error(`Milestone artifact ${artifactId} belongs to ${artifact.node}, not ${expectedNode}.`);
+      if (!expectedNodes.some((node) => scope.completed_nodes.includes(node))) {
+        throw new Error(`${event} requires ${expectedNodes.join(" or ")} to be completed.`);
+      }
+      if (!expectedNodes.includes(artifact.node)) {
+        throw new Error(`Milestone artifact ${artifactId} belongs to ${artifact.node}, not ${expectedNodes.join(" or ")}.`);
+      }
+      if (!scope.completed_nodes.includes(artifact.node)) {
+        throw new Error(`${event} requires its artifact node ${artifact.node} to be completed.`);
+      }
       if (artifact.status !== expectedStatus) {
         throw new Error(`Milestone artifact ${artifactId} must have status ${expectedStatus}, not ${artifact.status || "missing"}.`);
       }
@@ -742,12 +3038,15 @@ function transitionWorkflow(files, flags, options) {
       throw new Error(`Unknown workflow node: ${node}`);
     }
     const scopeName = scopeNameForNode(node);
+    assertWorkflowRevision(flags, state, scopeName);
     const scope = scopeState(state, scopeName);
     if (!scope.scope_id) throw new Error(`${scopeName} scope must be started before node ${node}.`);
     if (scope.scope_id !== iterationId) {
       throw new Error(`Iteration mismatch for ${scopeName} scope: state is ${scope.scope_id}, command is ${iterationId}.`);
     }
     let reason = null;
+    let completionReceipt = null;
+    let boundCandidateId = null;
 
     if (event === "node-started") {
       if (scope.blocked_nodes.includes(node)) throw new Error(`Blocked node must be unblocked before start: ${node}`);
@@ -772,8 +3071,40 @@ function transitionWorkflow(files, flags, options) {
         && !evidenceArtifacts.some((artifact) => artifact.node === prerequisite
           && SUCCESSFUL_ARTIFACT_STATUSES.has(artifact.status)));
       if (missing.length) throw new Error(`Node prerequisite is not satisfied: ${missing.join(", ")}.`);
+      const nextAttempt = Number(scope.node_attempts[node] || 0) + 1;
+      if (CANDIDATE_BOUND_NODES.has(node)) {
+        const registry = normalizeArtifactRegistry(
+          readYaml(files.artifactRegistry, options.yaml, "artifact-registry.yaml"),
+        );
+        const candidate = registry.artifacts.find((artifact) =>
+          (artifact.artifact_id || artifact.id) === scope.latest_candidate_id);
+        if (!candidate || projectedArtifactStatus(registry, candidate) !== "immutable") {
+          throw new Error(`Node ${node} requires a selected immutable candidate before start.`);
+        }
+        const integrity = artifactFileIntegrity(files, candidate);
+        if (!integrity.valid) {
+          throw new Error(`Selected candidate ${scope.latest_candidate_id} failed integrity: ${integrity.code}.`);
+        }
+        boundCandidateId = scope.latest_candidate_id;
+        if (node === "06-version-closeout") {
+          const manifest = currentScopeManifest(scope);
+          const assuranceReceipt = [...scope.node_completion_receipts].reverse().find((receipt) =>
+            receipt?.node === "05-candidate-assurance"
+            && receipt.candidate_id === boundCandidateId
+            && (!manifest || (receipt.scope_manifest_id === manifest.manifest_id
+              && receipt.scope_manifest_checksum === manifest.manifest_checksum)));
+          if (!assuranceReceipt) {
+            throw new Error(`Candidate Assurance has not completed for selected candidate ${boundCandidateId}.`);
+          }
+        }
+        scope.node_candidate_bindings[node] = {
+          node_attempt: nextAttempt,
+          candidate_id: boundCandidateId,
+          bound_at: timestamp,
+        };
+      }
       scope.active_nodes = [...scope.active_nodes, node];
-      scope.node_attempts[node] = Number(scope.node_attempts[node] || 0) + 1;
+      scope.node_attempts[node] = nextAttempt;
     } else if (event === "node-completed") {
       if (!scope.active_nodes.includes(node)) throw new Error(`Node is not active: ${node}`);
       if (!evidence.length) throw new Error("node-completed requires at least one --evidence artifact ID.");
@@ -783,27 +3114,54 @@ function transitionWorkflow(files, flags, options) {
       if (unsuccessful) {
         throw new Error(`Completion evidence ${unsuccessful.artifact_id || unsuccessful.id} has unsuccessful status ${unsuccessful.status}.`);
       }
+      if (node === "04-implementation") {
+        const selectedCandidate = artifacts.find((artifact) =>
+          (artifact.artifact_id || artifact.id) === scope.latest_candidate_id
+          && artifact.status === "immutable");
+        if (!selectedCandidate) {
+          throw new Error("Node completion conditions are not satisfied for 04-implementation: candidate:selected.");
+        }
+      }
+      if (node === "05-candidate-assurance") {
+        const attempt = Number(scope.node_attempts[node] || 1);
+        const binding = scope.node_candidate_bindings[node];
+        const mismatched = artifacts.find((artifact) =>
+          Number(binding?.node_attempt) !== attempt
+          || artifact.candidate_id !== binding?.candidate_id);
+        if (mismatched) {
+          throw new Error(
+            `Assurance evidence ${mismatched.artifact_id || mismatched.id} does not bind candidate ${binding?.candidate_id || "missing"}.`,
+          );
+        }
+      }
       const attempt = Number(scope.node_attempts[node] || 1);
       const pendingForNode = scope.pending_gates.filter((gate) =>
         typeof gate === "string" || (gate?.node === node && Number(gate.node_attempt || attempt) === attempt));
       if (pendingForNode.length) throw new Error(`Node has pending gates: ${node}`);
-      const latestGateDecisions = new Map();
-      for (const decision of scope.gate_decisions) {
-        if (decision?.node === node
-          && (!decision.iteration_id || decision.iteration_id === iterationId)
-          && Number(decision.node_attempt || attempt) === attempt
-          && decision.gate_id) latestGateDecisions.set(decision.gate_id, decision);
-      }
-      const nonApproving = [...latestGateDecisions.values()].find((decision) =>
+      const gateDecisions = latestGateDecisions(scope, node);
+      const nonApproving = [...gateDecisions.values()].find((decision) =>
         !new Set(["approved", "not-required"]).has(decision.decision));
       if (nonApproving) {
         throw new Error(`Node has a non-approving Gate decision ${nonApproving.gate_id}: ${nonApproving.decision}.`);
       }
       const missingGates = (NODE_RULES.get(node)?.gates || []).filter((gateId) => {
-        const decision = latestGateDecisions.get(gateId);
+        const decision = gateDecisions.get(gateId);
         return !satisfiesMandatoryGate(node, decision);
       });
       if (missingGates.length) throw new Error(`Node is missing mandatory Gate decisions: ${missingGates.join(", ")}.`);
+      if (scopeName === "development" && scope.scope_contract_version === 1
+        && SCOPED_COMPLETION_NODES.has(node)) {
+        const registry = normalizeArtifactRegistry(
+          readYaml(files.artifactRegistry, options.yaml, "artifact-registry.yaml"),
+        );
+        const projection = deriveNodeStates(files, state, registry, options)[node];
+        if (projection.state !== "ready-to-complete") {
+          const conditions = [...projection.missing_conditions, ...projection.blocking_conditions];
+          throw new Error(`Node completion conditions are not satisfied for ${node}: ${conditions.join(", ") || projection.state}.`);
+        }
+        completionReceipt = completionReceiptFromProjection(scope, node, projection, evidence, timestamp);
+        scope.node_completion_receipts = [...scope.node_completion_receipts, completionReceipt];
+      }
       scope.active_nodes = scope.active_nodes.filter((item) => item !== node);
       scope.completed_nodes = [...new Set([...scope.completed_nodes, node])];
     } else if (event === "node-blocked") {
@@ -822,8 +3180,14 @@ function transitionWorkflow(files, flags, options) {
         + "node-blocked, node-unblocked, candidate-selected, release-selected, version-closed, or release-archived.",
       );
     }
-    return persist(scopeName, { node, ...(reason ? { reason } : {}) });
-  });
+    const result = persist(scopeName, {
+      node,
+      ...(boundCandidateId ? { candidate_id: boundCandidateId } : {}),
+      ...(reason ? { reason } : {}),
+    });
+    if (completionReceipt) result.completion_receipt = completionReceipt;
+    return result;
+  }, { waitForActive: flags.has("--expected-scope-revision") });
 }
 
 function registeredEvidence(files, evidence, options, node = null) {
@@ -834,6 +3198,9 @@ function registeredEvidence(files, evidence, options, node = null) {
   return evidence.map((artifactId) => {
     const artifact = registry.artifacts.find((item) => (item.artifact_id || item.id) === artifactId);
     if (!artifact) throw new Error(`Evidence artifact is not registered: ${artifactId}`);
+    if (artifactSuperseder(registry, artifact)) {
+      throw new Error(`Evidence artifact is superseded: ${artifactId}`);
+    }
     if (node && artifact.node && artifact.node !== node) {
       throw new Error(`Evidence ${artifactId} belongs to ${artifact.node}, not ${node}.`);
     }
@@ -841,16 +3208,160 @@ function registeredEvidence(files, evidence, options, node = null) {
   });
 }
 
-function requestGate(files, flags, options) {
-  const expected = expectedRevision(flags);
+function retiredGateContractPlan(state, gateId) {
+  assertRetiredGateContract(gateId);
+  const affectedIterations = [];
+  const expectedScopeRevisions = {};
+  for (const [scopeName, scope] of [
+    ["development", state.development_state],
+    ["release", state.release_state],
+  ]) {
+    const requests = scope.pending_gates
+      .map((gate) => typeof gate === "string" ? { gate_id: gate, node: null } : gate)
+      .filter((gate) => gate?.gate_id === gateId);
+    if (!requests.length) continue;
+    expectedScopeRevisions[scopeName] = scope.revision;
+    for (const request of requests) {
+      affectedIterations.push({
+        iteration_id: request.iteration_id || scope.scope_id,
+        scope: scopeName,
+        node: request.node || null,
+        node_attempt: Number(request.node_attempt || scope.node_attempts[request.node] || 1),
+        scope_revision: scope.revision,
+      });
+    }
+  }
+  return {
+    command: "contract retire",
+    dry_run: true,
+    applied: false,
+    gate_id: gateId,
+    replacement_gate_id: gateId === "UX-LF" ? "UX-UI" : null,
+    fresh_approval_required: gateId === "UX-LF",
+    affected_iterations: affectedIterations,
+    expected_scope_revisions: expectedScopeRevisions,
+  };
+}
+
+function retireGateContract(files, flags, options) {
+  const gateId = requiredFlag(flags, "--gate-id");
+  if (flags.has("--dry-run")) return withReadableFormalState(files, () => {
+    const state = normalizeWorkflowState(
+      readYaml(files.workflowState, options.yaml, "workflow-state.yaml"),
+    );
+    return retiredGateContractPlan(state, gateId);
+  });
   return withLock(files, "workflow-state", () => {
     const state = normalizeWorkflowState(
       readYaml(files.workflowState, options.yaml, "workflow-state.yaml"),
     );
-    if (state.revision !== expected) {
-      throw new Error(`Workflow state revision conflict: expected ${expected}, actual ${state.revision}.`);
+    const plan = retiredGateContractPlan(state, gateId);
+    if (!plan.affected_iterations.length) {
+      return { ...plan, dry_run: false, applied: false, receipts: [], workflow_state: state };
+    }
+    const affectedScopes = Object.keys(plan.expected_scope_revisions);
+    if (affectedScopes.length !== 1) {
+      throw new Error(`${gateId} retirement must affect exactly one formal scope per transaction.`);
+    }
+    const scopeName = affectedScopes[0];
+    assertWorkflowRevision(flags, state, scopeName);
+    const actor = requiredFlag(flags, "--actor");
+    if (actor !== "system:package-upgrade") {
+      throw new Error("Contract retirement must be executed by system:package-upgrade.");
     }
+    const reason = requiredFlag(flags, "--reason");
+    const contractVersion = requiredFlag(flags, "--contract-version");
+    const scope = scopeState(state, scopeName);
+    const pending = scope.pending_gates
+      .map((gate) => typeof gate === "string" ? { gate_id: gate, node: null } : gate);
+    const retiredRequests = pending.filter((gate) => gate?.gate_id === gateId);
+    const timestamp = (options.now || (() => new Date().toISOString()))();
+    const receipts = retiredRequests.map((request) => {
+      const requestChecksum = sha256(JSON.stringify(stableValue(request)));
+      const receipt = stableValue({
+        receipt_id: `RETIRE-${gateId}-${requestChecksum.slice(0, 20).toUpperCase()}`,
+        gate_id: gateId,
+        iteration_id: request.iteration_id || scope.scope_id,
+        scope: scopeName,
+        node: request.node || null,
+        node_attempt: Number(request.node_attempt || scope.node_attempts[request.node] || 1),
+        request_checksum: requestChecksum,
+        request_evidence: [...new Set(request.evidence || [])].sort(),
+        contract_version: contractVersion,
+        disposition: "contract-retired",
+        human_approval_created: false,
+        renewed_gate_id: gateId === "UX-LF" ? "UX-UI" : null,
+        retired_by: actor,
+        reason,
+        retired_at: timestamp,
+      });
+      receipt.receipt_checksum = contractRetirementReceiptChecksum(receipt);
+      return receipt;
+    });
+    const remaining = pending.filter((gate) => gate?.gate_id !== gateId);
+    const existingUxUiRequests = remaining.filter((gate) => gate?.gate_id === "UX-UI");
+    const renewalSources = existingUxUiRequests.length ? existingUxUiRequests : retiredRequests;
+    const renewedRequests = gateId === "UX-LF"
+      ? renewalSources.map((request, index) => {
+        const retiredIndex = Math.max(0, retiredRequests.findIndex((candidate) =>
+          (candidate.iteration_id || scope.scope_id) === (request.iteration_id || scope.scope_id)));
+        const retiredRequest = retiredRequests[retiredIndex] || retiredRequests[index] || request;
+        const receipt = receipts[retiredIndex] || receipts[index];
+        return {
+          ...request,
+          gate_id: "UX-UI",
+          renewed_from_gate_id: gateId,
+          iteration_id: request.iteration_id || scope.scope_id,
+          scope: scopeName,
+          node: "02-solution-design",
+          node_attempt: Number(retiredRequest.node_attempt || request.node_attempt
+            || scope.node_attempts[retiredRequest.node] || 1),
+          evidence: [],
+          prototype_revision_required: true,
+          required_evidence_type: "prototype-revision",
+          retirement_receipt_checksum: receipt.receipt_checksum,
+          requested_at: request.requested_at || timestamp,
+        };
+      })
+      : [];
+    scope.pending_gates = [
+      ...remaining.filter((gate) => gate?.gate_id !== "UX-UI"),
+      ...renewedRequests,
+    ];
+    scope.contract_retirement_receipts = [
+      ...scope.contract_retirement_receipts,
+      ...receipts,
+    ];
+    const transition = {
+      event: "gate-contract-retired",
+      scope: scopeName,
+      gate_id: gateId,
+      iteration_id: scope.scope_id,
+      retirement_receipt_ids: receipts.map((receipt) => receipt.receipt_id),
+      renewed_gate_ids: renewedRequests.map((request) => request.gate_id),
+      occurred_at: timestamp,
+    };
+    persistScopeMutation(files, { state, scope, timestamp, transition }, options);
+    return {
+      ...plan,
+      dry_run: false,
+      applied: true,
+      receipts,
+      renewed_requests: renewedRequests,
+      revision: state.revision,
+      scope_revision: scope.revision,
+      workflow_state: state,
+    };
+  }, { waitForActive: flags.has("--expected-scope-revision") });
+}
+
+function requestGate(files, flags, options) {
+  return withLock(files, "workflow-state", () => {
+    const state = normalizeWorkflowState(
+      readYaml(files.workflowState, options.yaml, "workflow-state.yaml"),
+    );
     const gateId = requiredFlag(flags, "--gate-id");
+    assertGateContractWritable(gateId);
     const iterationId = requiredFlag(flags, "--iteration-id");
     const node = requiredFlag(flags, "--node");
     if (!WRITABLE_NODE_IDS.has(node)) {
@@ -858,6 +3369,7 @@ function requestGate(files, flags, options) {
       throw new Error(`Unknown workflow node: ${node}`);
     }
     const scopeName = scopeNameForNode(node);
+    assertWorkflowRevision(flags, state, scopeName);
     const scope = scopeState(state, scopeName);
     if (scope.scope_id !== iterationId) {
       throw new Error(`Iteration mismatch for ${scopeName} scope: state is ${scope.scope_id}, command is ${iterationId}.`);
@@ -889,34 +3401,24 @@ function requestGate(files, flags, options) {
       evidence,
       occurred_at: timestamp,
     };
-    persistScopeMutation(files, state, scope, timestamp, transition, {
-      type: "gate-requested",
-      occurred_at: timestamp,
-      scope: scopeName,
-      gate_id: gateId,
-      node,
-      iteration_id: iterationId,
-      evidence,
-    }, options);
+    persistScopeMutation(files, { state, scope, timestamp, transition }, options);
     return {
       command: "gate request",
       revision: state.revision,
+      scope_revision: scope.revision,
       gate: request,
       workflow_state: state,
     };
-  });
+  }, { waitForActive: flags.has("--expected-scope-revision") });
 }
 
 function decideGate(files, flags, options) {
-  const expected = expectedRevision(flags);
   return withLock(files, "workflow-state", () => {
     const state = normalizeWorkflowState(
       readYaml(files.workflowState, options.yaml, "workflow-state.yaml"),
     );
-    if (state.revision !== expected) {
-      throw new Error(`Workflow state revision conflict: expected ${expected}, actual ${state.revision}.`);
-    }
     const gateId = requiredFlag(flags, "--gate-id");
+    assertGateContractWritable(gateId);
     const scopes = [state.development_state, state.release_state];
     let owningScope = null;
     let pending = [];
@@ -933,7 +3435,9 @@ function decideGate(files, flags, options) {
       }
     }
     if (!request) throw new Error(`Gate is not pending: ${gateId}`);
+    assertNotLegacyDevelopmentNode(request.node);
     const scopeName = request.scope || scopeNameForNode(request.node);
+    assertWorkflowRevision(flags, state, scopeName);
     const decision = requiredFlag(flags, "--decision").toLowerCase().replaceAll("_", "-");
     if (!GATE_DECISIONS.has(decision)) throw new Error(`Unsupported gate decision: ${decision}`);
     const actor = requiredFlag(flags, "--actor");
@@ -941,8 +3445,15 @@ function decideGate(files, flags, options) {
     const evidence = repeatedFlag(flags, "--evidence");
     const evidenceArtifacts = registeredEvidence(files, evidence, options);
     const crossNodeEvidence = evidenceArtifacts.filter((artifact) => artifact.node !== request.node);
+    const freshPrototypeRevisionRequired = request.prototype_revision_required === true;
+    if (freshPrototypeRevisionRequired && decision === "approved" && !options.pageReviewReceiptWrite) {
+      throw new Error("Renewed UX-UI approval requires a fresh Prototype revision through Workflow Manager prototype review.");
+    }
+    if (freshPrototypeRevisionRequired && decision === "not-required") {
+      throw new Error("Renewed UX-UI cannot be not-required; a fresh Prototype revision and Workflow Manager approval are required.");
+    }
     if (decision === "not-required") {
-      if (request.node !== "04-experience-design" || !UX_GATE_IDS.has(gateId)) {
+      if (!UX_GATE_NODES.has(request.node) || !UX_GATE_IDS.has(gateId)) {
         throw new Error(`Gate ${gateId} cannot use not-required.`);
       }
       if (!evidenceArtifacts.some(isProductTerminalEvidence)) {
@@ -973,6 +3484,68 @@ function decideGate(files, flags, options) {
       evidence,
       decided_at: timestamp,
     };
+    const extraWrites = [];
+    if (options.pageReviewReceiptWrite) {
+      if (gateId !== "UX-UI" || decision !== "approved") {
+        throw new Error("A Prototype Page review receipt can only complete an approved UX-UI decision.");
+      }
+      const receiptWrite = options.pageReviewReceiptWrite;
+      const receiptRoot = path.resolve(files.delivery, "reviews", "prototype-pages");
+      const receiptFile = path.resolve(String(receiptWrite.file || ""));
+      const relativeReceipt = path.relative(receiptRoot, receiptFile);
+      if (!relativeReceipt || relativeReceipt.startsWith("..") || path.isAbsolute(relativeReceipt)) {
+        throw new Error("Prototype Page review receipt must stay within the formal review receipt directory.");
+      }
+      if (fs.existsSync(receiptFile)) throw new Error("Prototype Page review receipt is immutable and already exists.");
+      const receipt = options.yaml.parse(String(receiptWrite.content || ""));
+      if (!receipt || receipt.artifact_type !== "prototype-page-review-receipt"
+          || receipt.decision !== "approved" || receipt.actor !== actor
+          || receipt.iteration_id !== record.iteration_id) {
+        throw new Error("Prototype Page review receipt does not match the UX-UI decision.");
+      }
+      const { receipt_checksum: ignored, ...unsignedReceipt } = receipt;
+      if (receipt.receipt_checksum !== sha256(JSON.stringify(stableValue(unsignedReceipt)))) {
+        throw new Error("Prototype Page review receipt checksum is invalid.");
+      }
+      const expectedReceiptFile = path.resolve(
+        receiptRoot,
+        String(receipt.prototype_revision_id || ""),
+        `${String(receipt.receipt_id || "")}.yaml`,
+      );
+      if (receiptFile !== expectedReceiptFile) {
+        throw new Error("Prototype Page review receipt path does not match its identities.");
+      }
+      const requestedEvidenceIds = new Set(request.evidence || []);
+      const revisionEvidence = evidenceArtifacts.find((artifact) =>
+        (freshPrototypeRevisionRequired || requestedEvidenceIds.has(artifact.artifact_id || artifact.id))
+        && artifact.artifact_type === "prototype-revision"
+        && artifact.iteration_id === receipt.iteration_id
+        && artifact.checksum_algorithm === "sha256"
+        && artifact.checksum === receipt.prototype_revision_checksum);
+      if (!revisionEvidence || !artifactFileIntegrity(files, revisionEvidence).valid) {
+        throw new Error("UX-UI Gate does not bind the exact Prototype revision evidence in the Page receipt.");
+      }
+      const revision = readYaml(
+        path.resolve(files.root, revisionEvidence.path),
+        options.yaml,
+        "Prototype revision Gate evidence",
+      );
+      if (revision.artifact_type !== "prototype-revision"
+          || revision.artifact_id !== receipt.prototype_revision_id
+          || revision.prototype_id !== receipt.prototype_id
+          || revision.iteration_id !== receipt.iteration_id) {
+        throw new Error("UX-UI Gate does not bind the exact Prototype revision evidence in the Page receipt.");
+      }
+      record.prototype_revision_id = receipt.prototype_revision_id;
+      record.prototype_revision_checksum = receipt.prototype_revision_checksum;
+      record.page_review_receipt = {
+        receipt_id: receipt.receipt_id,
+        page_id: receipt.page_id,
+        ref: path.relative(files.root, receiptFile).replaceAll("\\", "/"),
+        checksum: receipt.receipt_checksum,
+      };
+      extraWrites.push({ file: receiptFile, content: receiptWrite.content });
+    }
     owningScope.pending_gates = pending.filter((gate) => gate?.gate_id !== gateId);
     owningScope.gate_decisions = [...owningScope.gate_decisions, record];
     const transition = {
@@ -981,42 +3554,82 @@ function decideGate(files, flags, options) {
       ...record,
       occurred_at: timestamp,
     };
-    persistScopeMutation(files, state, owningScope, timestamp, transition, {
-      type: "gate-decided",
-      occurred_at: timestamp,
-      scope: scopeName,
-      ...record,
+    persistScopeMutation(files, {
+      state,
+      scope: owningScope,
+      timestamp,
+      transition,
+      extraWrites,
     }, options);
     return {
       command: "gate decide",
       revision: state.revision,
+      scope_revision: owningScope.revision,
       gate: record,
       workflow_state: state,
     };
-  });
+  }, { waitForActive: flags.has("--expected-scope-revision") });
 }
 
-function readEvents(files, errors) {
+function readEvents(files, errors, readOptions = {}) {
   if (!fs.existsSync(files.events)) return [];
   const events = [];
-  const lines = fs.readFileSync(files.events, "utf8").split(/\r?\n/);
+  const offsetBytes = Number(readOptions.offsetBytes || 0);
+  const lineOffset = Number(readOptions.lineOffset || 0);
+  const descriptor = fs.openSync(files.events, "r");
+  let content;
+  try {
+    const size = fs.fstatSync(descriptor).size;
+    if (!Number.isInteger(offsetBytes) || offsetBytes < 0 || offsetBytes > size) {
+      errors.push(`Audit event byte offset is invalid: ${offsetBytes}.`);
+      return events;
+    }
+    content = Buffer.alloc(size - offsetBytes);
+    let bytesRead = 0;
+    while (bytesRead < content.length) {
+      const count = fs.readSync(
+        descriptor,
+        content,
+        bytesRead,
+        content.length - bytesRead,
+        offsetBytes + bytesRead,
+      );
+      if (count === 0) break;
+      bytesRead += count;
+    }
+    if (bytesRead !== content.length) {
+      errors.push(`Audit event suffix could not be read completely from byte offset ${offsetBytes}.`);
+      return events;
+    }
+  } finally {
+    fs.closeSync(descriptor);
+  }
+  const lines = content.toString("utf8").split(/\r?\n/);
   for (let index = 0; index < lines.length; index += 1) {
     if (!lines[index].trim()) continue;
     try {
       const event = JSON.parse(lines[index]);
       if (!event || typeof event !== "object" || Array.isArray(event)) {
-        errors.push(`Audit event at line ${index + 1} must be a JSON object.`);
+        errors.push(`Audit event at line ${lineOffset + index + 1} must be a JSON object.`);
       } else {
         events.push(event);
       }
     } catch {
-      errors.push(`Audit event at line ${index + 1} is not valid JSON.`);
+      errors.push(`Audit event at line ${lineOffset + index + 1} is not valid JSON.`);
     }
   }
   return events;
 }
 
-function verifyStream(file, value, stream, events, errors, allowedSchemas = new Set([1])) {
+function verifyStream(
+  file,
+  value,
+  stream,
+  events,
+  errors,
+  allowedSchemas = new Set([1]),
+  base = {},
+) {
   if (!allowedSchemas.has(value.schema_version)) {
     errors.push(`${stream} schema_version must be one of ${[...allowedSchemas].join(", ")}.`);
   }
@@ -1024,18 +3637,27 @@ function verifyStream(file, value, stream, events, errors, allowedSchemas = new
     errors.push(`${stream} revision must be a non-negative integer.`);
     return;
   }
+  const baseRevision = Number(base.revision || 0);
+  if (!Number.isInteger(baseRevision) || baseRevision < 0 || value.revision < baseRevision) {
+    errors.push(`${stream} revision predates the trusted history anchor.`);
+    return;
+  }
   const streamEvents = events.filter((event) => event.stream === stream);
-  if (value.revision === 0) {
-    if (streamEvents.length) errors.push(`${stream} revision is 0 but audit events exist.`);
+  const expectedEventCount = value.revision - baseRevision;
+  if (expectedEventCount === 0) {
+    if (streamEvents.length) errors.push(`${stream} has audit events after its current revision.`);
+    if (base.viewChecksum && fileChecksum(file) !== base.viewChecksum) {
+      errors.push(`Audit checksum mismatch for ${stream}.`);
+    }
     return;
   }
-  if (streamEvents.length !== value.revision) {
+  if (streamEvents.length !== expectedEventCount) {
     errors.push(
-      `Audit event count mismatch for ${stream}: expected ${value.revision}, actual ${streamEvents.length}.`,
+      `Audit event count mismatch for ${stream}: expected ${expectedEventCount}, actual ${streamEvents.length}.`,
     );
   }
   const revisions = streamEvents.map((event) => event.revision);
-  for (let revision = 1; revision <= value.revision; revision += 1) {
+  for (let revision = baseRevision + 1; revision <= value.revision; revision += 1) {
     if (revisions.filter((item) => item === revision).length !== 1) {
       errors.push(`${stream} audit revision ${revision} must occur exactly once.`);
     }
@@ -1048,30 +3670,254 @@ function verifyStream(file, value, stream, events, errors, allowedSchemas = new
   }
 }
 
-function verifyFormalState(files, options) {
+function verifyScopeContracts(scope, scopeName, errors) {
+  if (scope.scope_contract_version !== null && scope.scope_contract_version !== 1) {
+    errors.push(`Workflow ${scopeName} scope_contract_version must be 1 when present.`);
+  }
+  const manifests = Array.isArray(scope.scope_manifests) ? scope.scope_manifests : [];
+  const manifestIds = new Set();
+  for (const [index, manifest] of manifests.entries()) {
+    if (!manifest?.manifest_id || manifestIds.has(manifest.manifest_id)) {
+      errors.push(`Workflow ${scopeName} scope manifest ID is missing or duplicated.`);
+      continue;
+    }
+    manifestIds.add(manifest.manifest_id);
+    if (manifest.iteration_id !== scope.scope_id) {
+      errors.push(`Scope manifest ${manifest.manifest_id} belongs to ${manifest.iteration_id}, not ${scope.scope_id}.`);
+    }
+    if (manifest.revision !== index + 1) {
+      errors.push(`Scope manifest ${manifest.manifest_id} revision must be ${index + 1}.`);
+    }
+    const expectedSupersedes = index === 0 ? null : manifests[index - 1]?.manifest_id;
+    if ((manifest.supersedes || null) !== expectedSupersedes) {
+      errors.push(`Scope manifest ${manifest.manifest_id} must supersede ${expectedSupersedes || "nothing"}.`);
+    }
+    if (!manifest.approved_by || !manifest.approval_reason || manifest.status !== "frozen") {
+      errors.push(`Scope manifest ${manifest.manifest_id} is not explicitly approved and frozen.`);
+    }
+    if (manifest.manifest_checksum !== scopeManifestChecksum(manifest)) {
+      errors.push(`Scope manifest checksum mismatch: ${manifest.manifest_id}.`);
+    }
+  }
+  if (scope.scope_contract_version === 1) {
+    const requiresManifest = scopeName === "development"
+      && (scope.completed_nodes.some((node) => SCOPED_COMPLETION_NODES.has(node))
+        || [...scope.active_nodes, ...scope.blocked_nodes]
+          .some((node) => SCOPED_COMPLETION_NODES.has(node) && !SCOPE_FREEZE_NODES.has(node)));
+    if ((scope.current_scope_manifest_id && !manifestIds.has(scope.current_scope_manifest_id))
+      || (!scope.current_scope_manifest_id && requiresManifest)) {
+      errors.push(`Workflow ${scopeName} scope requires a valid current scope manifest.`);
+    }
+  } else if (scope.current_scope_manifest_id && !manifestIds.has(scope.current_scope_manifest_id)) {
+    errors.push(`Workflow ${scopeName} current scope manifest is missing: ${scope.current_scope_manifest_id}.`);
+  }
+
+  const manifestsById = new Map(manifests.map((manifest) => [manifest.manifest_id, manifest]));
+  const warningIds = new Set();
+  for (const warning of scope.scope_warnings) {
+    const manifest = manifestsById.get(warning?.scope_manifest_id);
+    if (!warning?.warning_id || warningIds.has(warning.warning_id)) {
+      errors.push(`Workflow ${scopeName} scope warning ID is missing or duplicated.`);
+      continue;
+    }
+    warningIds.add(warning.warning_id);
+    if (!manifest || warning.scope_manifest_checksum !== manifest.manifest_checksum) {
+      errors.push(`Scope warning ${warning.warning_id} does not bind a valid manifest.`);
+    }
+    if (warning.action !== "warn-only" || warning.reslice_performed !== false) {
+      errors.push(`Scope warning ${warning.warning_id} must not reslice or change scope.`);
+    }
+  }
+
+  const receiptIds = new Set();
+  for (const receipt of scope.node_completion_receipts) {
+    if (!receipt?.receipt_id || receiptIds.has(receipt.receipt_id)) {
+      errors.push(`Workflow ${scopeName} completion receipt ID is missing or duplicated.`);
+      continue;
+    }
+    receiptIds.add(receipt.receipt_id);
+    if (receipt.receipt_checksum !== completionReceiptChecksum(receipt)) {
+      errors.push(`Node completion receipt checksum mismatch: ${receipt.receipt_id}.`);
+    }
+    if (receipt.scope_manifest_id) {
+      const manifest = manifestsById.get(receipt.scope_manifest_id);
+      if (!manifest || receipt.scope_manifest_checksum !== manifest.manifest_checksum) {
+        errors.push(`Node completion receipt ${receipt.receipt_id} does not bind a valid scope manifest.`);
+      }
+    }
+    if (Array.isArray(receipt.blocking_defect_ids) && receipt.blocking_defect_ids.length) {
+      errors.push(`Node completion receipt ${receipt.receipt_id} retains blocking defects.`);
+    }
+  }
+  const retirementReceiptIds = new Set();
+  for (const receipt of scope.contract_retirement_receipts) {
+    if (!receipt?.receipt_id || retirementReceiptIds.has(receipt.receipt_id)) {
+      errors.push(`Workflow ${scopeName} contract retirement receipt ID is missing or duplicated.`);
+      continue;
+    }
+    retirementReceiptIds.add(receipt.receipt_id);
+    if (receipt.receipt_checksum !== contractRetirementReceiptChecksum(receipt)) {
+      errors.push(`Contract retirement receipt checksum mismatch: ${receipt.receipt_id}.`);
+    }
+    if (!RETIRED_GATE_IDS.has(receipt.gate_id)
+      || receipt.iteration_id !== scope.scope_id
+      || receipt.scope !== scopeName
+      || receipt.disposition !== "contract-retired"
+      || receipt.human_approval_created !== false
+      || receipt.retired_by !== "system:package-upgrade"
+      || !receipt.contract_version
+      || !/^[a-f0-9]{64}$/.test(receipt.request_checksum || "")) {
+      errors.push(`Contract retirement receipt is invalid: ${receipt.receipt_id}.`);
+    }
+  }
+  if (scope.scope_contract_version === 1 && scope.current_scope_manifest_id) {
+    const current = manifestsById.get(scope.current_scope_manifest_id);
+    for (const node of scope.completed_nodes.filter((item) => SCOPED_COMPLETION_NODES.has(item))) {
+      const attempt = Number(scope.node_attempts[node] || 1);
+      const receipt = scope.node_completion_receipts.find((item) =>
+        item?.node === node
+        && Number(item.node_attempt || attempt) === attempt
+        && item.scope_manifest_id === current?.manifest_id
+        && item.scope_manifest_checksum === current?.manifest_checksum);
+      if (!receipt) errors.push(`Completed node ${node} lacks a receipt for the current scope manifest.`);
+    }
+  }
+}
+
+function verifyFormalState(files, options, verification = {}) {
+  const verifyHistory = verification.history === true;
+  const sinceAnchor = verification.sinceAnchor === true;
+  if (sinceAnchor && !verifyHistory) {
+    throw new Error("--since-anchor requires --history.");
+  }
   const project = readYaml(files.project, options.yaml, "project.yaml");
   const rawState = readYaml(files.workflowState, options.yaml, "workflow-state.yaml");
   const rawRegistry = readYaml(files.artifactRegistry, options.yaml, "artifact-registry.yaml");
-  const state = normalizeWorkflowState(rawState);
-  const registry = normalizeArtifactRegistry(rawRegistry);
+  const views = formalStreamViews(files, {
+    "workflow-state": rawState,
+    "artifact-registry": rawRegistry,
+  });
+  const state = views.get("workflow-state").value;
+  const registry = views.get("artifact-registry").value;
   const errors = [];
-  const events = readEvents(files, errors);
-  let shards = [];
+  let retentionReceipts = [];
+  let historyArchives = [];
   try {
-    shards = readEventShards(files, options);
+    retentionReceipts = readArtifactRetentionReceipts(files, options);
   } catch (error) {
     errors.push(error.message);
   }
+  if (verifyHistory) {
+    try {
+      historyArchives = readArtifactHistoryArchives(files, options);
+    } catch (error) {
+      errors.push(error.message);
+    }
+  }
+  const compactedHistory = verifyHistory && !sinceAnchor
+    && historyArchives.length > 0 && retentionReceipts.length === 0;
+  const retainedHistory = verifyHistory && !sinceAnchor
+    && (retentionReceipts.length > 0 || compactedHistory);
+  const verificationMode = verifyHistory
+    ? (sinceAnchor
+      ? "incremental-history"
+      : compactedHistory
+        ? "compacted-history"
+        : retainedHistory
+          ? "retained-history"
+          : "full-history")
+    : "routine";
+  let trustedAnchor = null;
+  if (sinceAnchor || !verifyHistory || retainedHistory) {
+    try {
+      trustedAnchor = readLatestHistoryAnchor(files, options);
+      if (sinceAnchor && !trustedAnchor) {
+        errors.push("Incremental history verification requires a trusted history anchor.");
+      } else if (retainedHistory && !trustedAnchor) {
+        errors.push("Retained history verification requires a trusted history anchor.");
+      }
+    } catch (error) {
+      errors.push(error.message);
+    }
+  }
+  const anchor = trustedAnchor?.anchor || null;
+  const baseRevisions = anchor
+    ? Object.fromEntries(Object.entries(anchor.streams).map(([stream, metadata]) => [stream, metadata.revision]))
+    : {};
+  const events = readEvents(files, errors, anchor ? {
+    offsetBytes: anchor.event_index.offset_bytes,
+    lineOffset: anchor.event_index.event_count,
+  } : {});
+  let shards = [];
+  if (verifyHistory && (!sinceAnchor || trustedAnchor)) {
+    try {
+      shards = readEventShards(
+        files,
+        options,
+        anchor ? baseRevisions : null,
+        anchor ? events : [],
+      );
+    } catch (error) {
+      errors.push(error.message);
+    }
+  }
 
-  verifyStream(files.workflowState, rawState, "workflow-state", events, errors, new Set([1, 2]));
-  verifyStream(files.artifactRegistry, rawRegistry, "artifact-registry", events, errors);
-  if (shards.length) {
-    for (const [stream, value] of [["workflow-state", rawState], ["artifact-registry", rawRegistry]]) {
-      const latest = shards.filter((record) => record.stream === stream)
-        .sort((left, right) => right.revision - left.revision)[0];
-      if (latest && (latest.revision !== value.revision
-        || latest.after_checksum !== sha256(options.yaml.stringify(value)))) {
-        errors.push(`Derived view does not match latest authoritative shard for ${stream}.`);
+  for (const [stream, view] of views) {
+    verifyStream(
+      view.file,
+      view.raw,
+      stream,
+      events,
+      errors,
+      view.allowedSchemas,
+      anchor ? {
+        revision: anchor.streams[stream].revision,
+        viewChecksum: anchor.streams[stream].view_checksum,
+      } : {},
+    );
+  }
+  if (verifyHistory) {
+    for (const [stream, view] of views) {
+      const value = view.value;
+      const streamShards = shards.filter((record) => record.stream === stream);
+      const streamEvents = events.filter((event) => event.stream === stream);
+      const baseRevision = Number(baseRevisions[stream] || 0);
+      const expectedShardCount = value.revision - baseRevision;
+      if (expectedShardCount < 0) {
+        errors.push(`${stream} revision predates the trusted history anchor.`);
+        continue;
+      }
+      if (streamShards.length !== expectedShardCount) {
+        errors.push(`Event shard count mismatch for ${stream}: expected ${expectedShardCount}, actual ${streamShards.length}.`);
+      }
+      for (let revision = baseRevision + 1; revision <= value.revision; revision += 1) {
+        const revisionShards = streamShards.filter((record) => record.revision === revision);
+        if (revisionShards.length !== 1) {
+          errors.push(`${stream} event shard revision ${revision} must occur exactly once.`);
+          continue;
+        }
+        const indexedEvent = streamEvents.find((event) => event.revision === revision);
+        const { after_value: ignored, ...shardEvent } = revisionShards[0];
+        if (!indexedEvent?.record_checksum) delete shardEvent.record_checksum;
+        if (!indexedEvent
+          || JSON.stringify(stableValue(shardEvent)) !== JSON.stringify(stableValue(indexedEvent))) {
+          errors.push(`Event shard metadata mismatch for ${stream} revision ${revision}.`);
+        }
+      }
+      try {
+        const replayed = replayStreamRecords(stream, streamShards, options, trustedAnchor ? {
+          value: trustedAnchor.snapshots[stream],
+          recordChecksum: anchor.streams[stream].record_checksum,
+          revision: baseRevision,
+        } : {});
+        if (value.revision > 0) {
+          const normalizedReplayed = FORMAL_STREAMS.get(stream).normalize(replayed);
+          if (JSON.stringify(stableValue(normalizedReplayed)) !== JSON.stringify(stableValue(value))) {
+            errors.push(`Derived view does not match latest authoritative shard for ${stream}.`);
+          }
+        }
+      } catch (error) {
+        errors.push(error.message);
       }
     }
   }
@@ -1101,13 +3947,8 @@ function verifyFormalState(files, options) {
     if (hasScopedState && !scope.scope_id) {
       errors.push(`Workflow ${scopeName} scope has state but no scope_id.`);
     }
-    for (const node of active) {
-      if (blocked.has(node) || completed.has(node)) {
-        errors.push(`Workflow node appears in incompatible states in ${scopeName}: ${node}.`);
-      }
-    }
-    for (const node of blocked) {
-      if (completed.has(node)) errors.push(`Workflow node appears in incompatible states in ${scopeName}: ${node}.`);
+    for (const conflict of findIncompatibleNodeStates(scope)) {
+      errors.push(`Workflow node appears in incompatible states in ${scopeName}: ${conflict.node}.`);
     }
     for (const node of [...active, ...blocked, ...completed]) {
       if (!NODE_IDS.has(node)) errors.push(`Unknown workflow node in formal state: ${node}.`);
@@ -1115,6 +3956,7 @@ function verifyFormalState(files, options) {
         errors.push(`Workflow node is stored in the wrong ${scopeName} scope: ${node}.`);
       }
     }
+    verifyScopeContracts(scope, scopeName, errors);
   }
 
   const artifactIds = new Set();
@@ -1128,25 +3970,24 @@ function verifyFormalState(files, options) {
     if (artifactIds.has(artifactId)) errors.push(`Duplicate artifact ID: ${artifactId}.`);
     artifactIds.add(artifactId);
 
-    const artifactPath = typeof artifact.path === "string" ? artifact.path.replaceAll("\\", "/") : "";
-    if (!artifactPath.startsWith(".workflow/")) {
+    const integrity = artifactFileIntegrity(files, artifact);
+    const artifactPath = integrity.artifact_path;
+    if (integrity.code === "invalid-path") {
       errors.push(`Artifact path must start with .workflow/: ${artifactId}.`);
       continue;
     }
     if (artifactPaths.has(artifactPath)) errors.push(`Duplicate artifact path: ${artifactPath}.`);
     artifactPaths.add(artifactPath);
 
-    const absolute = path.resolve(files.root, artifactPath);
-    if (!isInside(absolute, files.workflow) || !fs.existsSync(absolute) || !fs.statSync(absolute).isFile()) {
+    if (integrity.code === "missing-or-outside" || integrity.code === "unreadable") {
       errors.push(`Artifact file is missing or outside .workflow/: ${artifactId}.`);
       continue;
     }
-    if (!isInside(fs.realpathSync(absolute), fs.realpathSync(files.workflow))) {
+    if (integrity.code === "resolved-outside") {
       errors.push(`Artifact path resolves outside .workflow/: ${artifactId}.`);
       continue;
     }
-    const checksum = sha256(fs.readFileSync(absolute));
-    if (artifact.checksum_algorithm !== "sha256" || artifact.checksum !== checksum) {
+    if (integrity.code === "checksum-mismatch") {
       errors.push(`Checksum mismatch for artifact ${artifactId}.`);
     }
   }
@@ -1156,11 +3997,17 @@ function verifyFormalState(files, options) {
     command: "verify",
     valid: true,
     errors: [],
+    verification_mode: verificationMode,
+    anchor_id: anchor?.anchor_id || null,
+    post_anchor_event_count: anchor ? events.length : null,
     workflow_revision: state.revision,
     artifact_registry_revision: registry.revision,
     artifact_count: registry.artifacts.length,
-    audit_event_count: events.length,
+    audit_event_count: (anchor?.event_index.event_count || 0) + events.length,
     event_shard_count: shards.length,
+    history_verified: verifyHistory,
+    retention_receipt_count: retentionReceipts.length,
+    history_archive_count: historyArchives.length,
   };
 }
 
@@ -1170,6 +4017,10 @@ export function executeDeliveryStateCommand(argv, options = {}) {
   const command = positional[0];
   const projectRoot = path.resolve(String(flags.get("--project") || options.projectRoot || process.cwd()));
   const files = statePaths(projectRoot);
+  assertNoLegacyDevelopmentWrite(files, command, positional, flags, options);
+  if (command === "gate" && ["request", "decide"].includes(positional[1])) {
+    assertGateContractWritable(requiredFlag(flags, "--gate-id"));
+  }
   const descriptor = lifecycleDescriptor(command, positional, flags);
   const before = dispatchLifecycle(options, files, descriptor, "before", flags);
   if (before.decision === "block") {
@@ -1183,33 +4034,63 @@ export function executeDeliveryStateCommand(argv, options = {}) {
       result = registerArtifact(files, flags, options);
     } else if (command === "artifact" && positional[1] === "status") {
       result = changeArtifactStatus(files, flags, options);
+    } else if (command === "artifact" && positional[1] === "prune") {
+      result = pruneArtifactHistory(files, flags, options);
+    } else if (command === "artifact" && positional[1] === "compact") {
+      result = compactArtifactHistory(files, flags, options);
     } else if (command === "gate" && positional[1] === "request") {
       result = requestGate(files, flags, options);
     } else if (command === "gate" && positional[1] === "decide") {
       result = decideGate(files, flags, options);
+    } else if (command === "contract" && positional[1] === "retire") {
+      result = retireGateContract(files, flags, options);
+    } else if (command === "scope" && positional[1] === "freeze") {
+      result = mutateScopeManifest(files, flags, options, false);
+    } else if (command === "scope" && positional[1] === "amend") {
+      result = mutateScopeManifest(files, flags, options, true);
+    } else if (command === "scope" && positional[1] === "warn") {
+      result = recordScopeWarning(files, flags, options);
     } else if (command === "transition") {
       result = transitionWorkflow(files, flags, options);
     } else if (command === "verify") {
-      result = verifyFormalState(files, options);
+      result = withReadableFormalState(
+        files,
+        () => verifyFormalState(files, options, {
+          history: flags.has("--history"),
+          sinceAnchor: flags.has("--since-anchor"),
+        }),
+      );
+    } else if (command === "snapshot" && positional[1] === "create") {
+      result = createFormalSnapshot(files, flags, options);
+    } else if (command === "snapshot" && positional[1] === "references") {
+      result = versionArchiveReferences(files, flags, options);
     } else if (command === "rebuild") {
       result = rebuildFormalViews(files, options);
     } else if (command === "inspect") {
-      const project = readYaml(files.project, options.yaml, "project.yaml");
-      const workflowState = normalizeWorkflowState(
-        readYaml(files.workflowState, options.yaml, "workflow-state.yaml"),
-      );
-      const artifactRegistry = normalizeArtifactRegistry(
-        readYaml(files.artifactRegistry, options.yaml, "artifact-registry.yaml"),
-      );
-      result = {
-        command,
-        project_id: project.project_id || workflowState.project_id || path.basename(projectRoot),
-        project,
-        workflow_state: workflowState,
-        artifact_registry: artifactRegistry,
-      };
+      result = withReadableFormalState(files, () => {
+        const project = readYaml(files.project, options.yaml, "project.yaml");
+        const workflowState = normalizeWorkflowState(
+          readYaml(files.workflowState, options.yaml, "workflow-state.yaml"),
+        );
+        const artifactRegistry = normalizeArtifactRegistry(
+          readYaml(files.artifactRegistry, options.yaml, "artifact-registry.yaml"),
+        );
+        return {
+          command,
+          project_id: project.project_id || workflowState.project_id || path.basename(projectRoot),
+          project,
+          workflow_state: workflowState,
+          artifact_registry: artifactRegistry,
+          node_contracts: nodeContractCatalog(),
+          scope_manifest: currentScopeManifest(workflowState.development_state),
+          derived_node_states: deriveNodeStates(files, workflowState, artifactRegistry, options),
+        };
+      });
     } else {
-      throw new Error("Use inspect, verify, rebuild, artifact register/status, transition, or gate request/decide.");
+      throw new Error(
+        "Use inspect, verify, rebuild, snapshot create, artifact register/status/prune/compact, scope freeze/amend/warn, "
+        + "transition, gate request/decide, or contract retire.",
+      );
     }
     dispatchLifecycle(options, files, descriptor, "after", flags, result);
     return result;