ai-foreman 1.7.29 → 2.0.1

package/dist/qaReview.js

@@ -1,21 +1,27 @@
+import { BoundedTurnEvents, boundedUtf8, receiptFingerprint } from "./boundedTurnEvidence.js";
+import { describeNativeQaResponse, qaStructuredResponse, qaStructuredStatus } from "./qaStructuredResponse.js";
+import { journalStructuredDispatch, operationInstruction, operationPayload, operationResponse, nativePolicy } from "./structuredOperation.js";
+import { durableOwnerDispatch } from "./structuredDispatchAuthority.js";
+import { providerWireContract, qaVerdictOutput, qaRecoveryOutput, initializationOutput, remediationOutput } from "rafi-spec";
 import { withGraphDerivedAccess } from "./graph/derived.js";
 import { dispatchWithGraphAccess } from "./graph/session.js";
 import { finalQaRoleInstructions, QA_COMMAND_DISCIPLINE, resolveEffectiveQaConfiguration } from "./qaEffectiveConfig.js";
-import { COVERAGE_INSTRUCTIONS, bindCoverageHostFields, parseContractCoverage, validateContractCoverage } from "./qaContractCoverage.js";
+import { COVERAGE_INSTRUCTIONS, bindCoverageHostFields, validateContractCoverage } from "./qaContractCoverage.js";
 import { contractDigest, renderVerificationContract } from "./qaVerificationContract.js";
 import { finalReviewContractContext } from "./qaContractDelivery.js";
 import { qaCommandOutputExcerptsAllowed, retainedQaCommandObservations } from "./qaReviewEvidence.js";
+import { retainedHostBuilderObservations } from "./qaBuilderEvidence.js";
 import { qaHostGraphFact } from "./qaHostFacts.js";
-import { graphContext, parseGraphRequest, prepareGraphInstruction, sendGraphTurn } from "./graph/turn.js";
+import { graphContext, prepareGraphInstruction, sendGraphTurn } from "./graph/turn.js";
 import { BuildControlBoundary } from "./buildInterventions.js";
 import { formatRecoveryCommand } from "./recoveryGuidance.js";
 import { assertBuildAssignmentReconciled, BuildAssignmentRejected, captureBuildSource } from "./buildAssignment.js";
 import { checkQaPrerequisites } from "./qaPrerequisites.js";
 import { boundedQaHistory } from "./qaHandbackHistory.js";
-import { QA_FAILURE_REPORT_END, QA_FAILURE_REPORT_START, parseQaResponseContract, qaFailureReportV1Schema, } from "rafi-spec";
+import { qaFailureReportV1Schema, } from "rafi-spec";
 import { SessionUnavailableError } from "./adapters/sessionFailure.js";
 import { currentActivity, withActivityPhase } from "./activity.js";
-import { buildQaInstruction, parseStepStatus } from "./foreman.js";
+import { buildQaInstruction } from "./foreman.js";
 import { captureFrozenQaSourceAsync, captureProspectiveGitTree, createDisposableQaSnapshotAsync, prospectiveGitTreeMatches, QaSourceInstabilityError } from "./qaSnapshot.js";
 import { loadTicketSetupConfigWithDefaults } from "./tickets/setupConfig.js";
 import { randomUUID } from "node:crypto";
@@ -24,11 +30,11 @@ import { resolve } from "node:path";
 import { WorkflowDb } from "./workflowDb.js";
 import { canonicalSessionPath } from "./sessionIdentity.js";
 import { loadProjectAutonomyConfig, resolveAutonomyPolicy } from "./recoveryPolicy.js";
-import { appendQaRecoveryAttempt, appendQaRecoveryResource, appendQaRecoveryReviewedState, compareQaRecoveryReviewedState, createQaRecoveryPacket, ensureQaRecoveryExcluded, loadQaRecoveryPacket, materializeQaRecoveryContext, qaRecoveryInventory, qaReportDigest, renderQaRecoveryAcknowledgementInstruction, updateQaRecoveryPosition, updateQaRecoveryReviewIdentity, validateManualQaReport, validateQaRecoveryAcknowledgement, } from "./qaRecovery.js";
+import { appendQaRecoveryAttempt, appendQaRecoveryResource, appendQaRecoveryReviewedState, compareQaRecoveryReviewedState, createQaRecoveryPacket, ensureQaRecoveryExcluded, loadQaRecoveryPacket, materializeQaRecoveryContext, qaRecoveryInventory, qaReportDigest, renderQaRecoveryAcknowledgementInstruction, updateQaRecoveryPosition, updateQaRecoveryReviewIdentity, validateManualQaReport, } from "./qaRecovery.js";
 import { canonicalJson, createQaFindingRefs, qaDigest } from "./qaProtocolV2.js";
-import { createHostQaComparison, findHostQaCheck } from "./hostQaComparison.js";
+import { createHostQaComparison, findHostQaCheck, inspectHostQaComparison } from "./hostQaComparison.js";
 import { createHostGraphApplicability, findGraphQaChecks } from "./hostGraphApplicability.js";
-import { applyHostQaAugmentations } from "./hostQaAugmentation.js";
+import { assembleFinalQaCoverage } from "./qaCoverageAssembly.js";
 import { qaUnresolvedToolDecision, recordQaUnresolvedTools } from "./qaToolRecovery.js";
 function ensureProtocolPausePacket(opts, head, stage, detail, frozenState) {
     const db = new WorkflowDb(opts.recovery.projectDir);
@@ -77,6 +83,9 @@ function pauseQaReview(opts, stage, detail, frozenState) {
  * The allowance is shared by all protocol failures for this ticket and survives restart.
  * oneReview's finally closes the predecessor before the loop allocates a new snapshot.
  */
+/** Frozen source of the review an automatic fresh retry replaces, so a retry
+ * that cannot be dispatched safely still pauses at that exact boundary. */
+const freshRetryState = new WeakMap();
 function retryFreshQaReview(opts, stage, detail, frozenState) {
     const db = new WorkflowDb(opts.recovery.projectDir);
     let retry = false;
@@ -95,6 +104,7 @@ function retryFreshQaReview(opts, stage, detail, frozenState) {
     }
     if (!retry)
         return pauseQaReview(opts, stage, `${detail}; automatic fresh QA review allowance exhausted`, frozenState);
+    freshRetryState.set(opts, frozenState);
     opts.resumedRecovery = undefined;
     currentActivity()?.update("qa-recovery", `${opts.ticket.id}: ${detail}. Running a complete fresh QA review.`);
     opts.evidence?.({ cycle: 0, outcome: "qa_fresh_review_retry", detail });
@@ -266,7 +276,7 @@ async function runIsolatedQaOwned(opts) {
             if (!opts.deliverBuilderFollowup)
                 return { outcome: "needs-human", detail: "Builder guidance is waiting; resume through the build owner with a validated Builder session" };
             const latest = durableReviews.at(-1);
-            const instruction = `Builder guidance follow-up after explicit resume.\nTicket scope: ${opts.ticket.id}. Do not substitute another ticket.\nPreserve the previously completed work and all mandatory requirements. Apply only the authorized waiting guidance within the approved ticket scope. If broader permission is needed, stop and explain it.\nApproved ticket requirements:\n${JSON.stringify(opts.ticket)}\nReport the instruction IDs you applied with evidence, then finish with STEP_STATUS: done | ticket="${opts.ticket.id}" summary="...".`;
+            const instruction = `Builder guidance follow-up after explicit resume.\nTicket scope: ${opts.ticket.id}. Do not substitute another ticket.\nPreserve the previously completed work and all mandatory requirements. Apply only the authorized waiting guidance within the approved ticket scope. If broader permission is needed, stop and explain it.\nApproved ticket requirements:\n${JSON.stringify(opts.ticket)}\nReport the instruction IDs you applied with evidence in the native work-report payload.`;
             const fix = await opts.deliverBuilderFollowup(instruction, { reviewAttemptId: latest.attemptId, requirementsDigest: qaDigest("admitted-requirements", opts.ticket), maximum: maxBuilderFixes, authorizationId: opts.qaRemediationAuthorization });
             opts.qaRemediationAuthorization = undefined;
             if (!fix.ok) {
@@ -359,7 +369,18 @@ async function runIsolatedQaOwned(opts) {
         opts.qaHistory = [...history];
         reviewAttempt += 1;
         const attemptId = randomUUID();
-        const review = await withActivityPhase(`running QA review ${cycle} (${automaticFixes}/${maxBuilderFixes} fixes used)`, () => observedQaReview(opts, { cycle, reviewAttempt, remediationGeneration, attemptId }));
+        let review;
+        try {
+            review = await withActivityPhase(`running QA review ${cycle} (${automaticFixes}/${maxBuilderFixes} fixes used)`, () => observedQaReview(opts, { cycle, reviewAttempt, remediationGeneration, attemptId }));
+        }
+        catch (error) {
+            // An automatic fresh review that graph-access revocation blocks before
+            // dispatch pauses safely instead of failing the build.
+            const frozen = freshRetryState.get(opts);
+            if (frozen && /Graph access changed/.test(String(error)))
+                return pauseQaReview(opts, "graph-access-changed", String(error).replace(/^Error: /, ""), frozen);
+            throw error;
+        }
         if (review.outcome === "retry-modification") {
             const durableFixes = persistedQaFixCount(opts);
             cycle += Math.max(0, durableFixes - automaticFixes);
@@ -517,13 +538,13 @@ async function observedQaFix(opts, phase, request, causingAttemptId, remediation
                 markQaRecoveryAction(opts, "builder-remediation-in-flight");
             }
             const result = await withActivityPhase(phase, () => deliverQaFailureOrLegacyFix(opts, request, causingAttemptId));
-            const responseStatus = typeof result.response === "string" ? parseStepStatus(result.response) : undefined;
+            const responseStatus = result.outcome === "remediation-reported" ? { kind: "done" } : undefined;
             const accepted = result.ok
                 && typeof result.response === "string" && result.response.length > 0
                 && typeof result.summary === "string" && result.summary.length > 0
                 && typeof result.providerTurnId === "string" && result.providerTurnId.length > 0
                 && responseStatus?.kind === "done";
-            const normalized = accepted ? result : result.ok ? { ...result, ok: false, detail: result.detail ?? "Builder remediation success requires an actual response, bounded summary, provider turn identity, and STEP_STATUS: done" } : result;
+            const normalized = accepted ? result : result.ok ? { ...result, ok: false, detail: result.detail ?? "Builder remediation success requires an actual response, bounded summary, provider turn identity, and a validated completed remediation outcome" } : result;
             finishQaFixAttempt(opts, durable, normalized.ok ? "succeeded" : "failed", normalized.detail, normalized.response, normalized.summary, normalized.providerTurnId);
             if (normalized.ok)
                 markQaRecoveryAction(opts, "qa-full-review");
@@ -644,16 +665,20 @@ function finishQaFixAttempt(opts, attempt, outcome, detail, response, summary, p
         return;
     const db = new WorkflowDb(opts.recovery.projectDir);
     try {
-        const responseDigest = typeof response === "string" ? db.putEvidence("qa", Buffer.from(response)) : undefined;
-        const summaryDigest = typeof summary === "string" ? db.putEvidence("qa", Buffer.from(boundedBuilderSummary(summary))) : undefined;
+        let responseDigest = typeof response === "string" ? db.putEvidence("qa", Buffer.from(response)) : undefined;
+        let summaryDigest = typeof summary === "string" ? db.putEvidence("qa", Buffer.from(boundedBuilderSummary(summary))) : undefined;
         const head = db.qaTicketHead(opts.recovery.runId, opts.ticket.id);
         let receipt;
         if (outcome === "succeeded") {
-            if (!responseDigest || !summaryDigest)
-                throw new Error("successful Builder remediation is missing response evidence");
-            if (!providerTurnId)
-                throw new Error("successful Builder remediation is missing its provider turn identity");
-            receipt = { version: 2, operationId: attempt.operationId, runId: opts.recovery.runId, ticketId: opts.ticket.id, reportDigest: attempt.reportDigest, sourceStateDigest: attempt.sourceStateDigest, requestDigest: attempt.requestDigest, responseDigest, summaryDigest, providerTurnId, completedAt: new Date().toISOString() };
+            const turn = db.qaDeliveryTurns(attempt.operationId).at(-1);
+            if (!turn || turn.status !== "completed" || !turn.sealedDispatch || !turn.rawResponseDigest || turn.providerTurnId !== providerTurnId)
+                throw new Error("successful Builder remediation requires its persisted native delivery receipt");
+            const native = db.replayStructuredDispatch(turn.turnRecordId, remediationOutput);
+            if (native.result.kind !== "completed" || native.result.payload.status !== "done")
+                throw new Error("Builder remediation has no completed native result");
+            responseDigest = turn.rawResponseDigest;
+            summaryDigest = db.putEvidence("qa", native.result.payload.report.summary);
+            receipt = { version: 3, operationId: attempt.operationId, runId: opts.recovery.runId, ticketId: opts.ticket.id, reportDigest: attempt.reportDigest, reportOccurrenceId: turn.reportOccurrenceId, turnRecordId: turn.turnRecordId, sourceStateDigest: attempt.sourceStateDigest, requestDigest: attempt.requestDigest, responseDigest, summaryDigest, providerTurnId: turn.providerTurnId, completedAt: new Date().toISOString() };
         }
         db.commitQaRemediationOutcome({ recoveryAttemptId: attempt.recoveryId, remediationAttemptId: attempt.remediationId, outcome, detail, responseDigest, summaryDigest, receipt, expectedRevision: head.revision });
     }
@@ -702,7 +727,6 @@ async function oneReview(opts, identity) {
         return { outcome: "needs-human", detail: `${error.message}. No QA session or report was created. Resume with: ${formatRecoveryCommand(opts.recovery.projectDir)}` };
     }
     let qa;
-    let recoverySnapshot;
     let recoveryContext;
     let resumedPacket = opts.resumedRecovery;
     let resumedFullReviewNeedsBinding = false;
@@ -744,7 +768,7 @@ async function oneReview(opts, identity) {
             return { outcome: "needs-human", detail };
         }
         let graphReviewContext = graphContext(opts.recovery.projectDir, snapshot.path, "final-qa", handoff, { accessWorkspace: opts.builderWorktree, operationId: `graph-review:${attemptId}`, logicalTaskId: attemptId, sourceRef: snapshot.frozenState.digest, runId: opts.recovery.runId, workId: opts.ticket.id });
-        let graphPrepared = opts.resumedRecovery ? { instruction: handoff, bytes: 0 } : await prepareGraphInstruction(handoff, graphReviewContext, await qa.contextUsage?.());
+        let graphPrepared = opts.resumedRecovery ? { instruction: handoff, bytes: 0 } : await prepareGraphInstruction(handoff, graphReviewContext, await qa.contextUsage?.(), qaVerdictOutput);
         handoff = graphPrepared.instruction;
         const v2Binding = beginV2Review(opts, snapshot.frozenState, snapshot.path, handoff, qaHandle, { attemptId, cycle, remediationGeneration });
         handoff = v2Binding.reviewInstruction;
@@ -754,8 +778,6 @@ async function oneReview(opts, identity) {
         durableReviewStarted = true;
         if (resumedPacket)
             resumedPacket = v2Binding.recoveryPacket;
-        let preparedTurn;
-        let preparedContract;
         if (opts.resumedRecovery) {
             if (opts.resumedRecovery.manifest.ticketId !== opts.ticket.id)
                 return { outcome: "needs-human", detail: `QA recovery packet ticket ${opts.resumedRecovery.manifest.ticketId} does not match current ticket ${opts.ticket.id}` };
@@ -774,24 +796,8 @@ async function oneReview(opts, identity) {
             catch (error) {
                 const detail = error instanceof Error ? error.message : String(error);
                 const synthetic = { text: "", rawResponse: "", cleanedResponse: "", isError: true, numTurns: 0, costUsd: 0 };
-                const recovery = await repairResumedFailureReport(opts, identity, resumedPacket, snapshot, qaHandle, synthetic, [detail], qaEvents, undefined, true);
-                if (recovery.outcome === "failed")
-                    return recovery.result;
-                if (recovery.outcome === "retry")
-                    return { outcome: "retry-modification" };
-                if (recovery.outcome === "passed")
-                    return recovery.result;
-                qa = recovery.qa;
-                recoverySnapshot = recovery.snapshot;
-                if (recovery.outcome === "manual") {
-                    const text = `${QA_FAILURE_REPORT_START}\n${JSON.stringify(recovery.report)}\n${QA_FAILURE_REPORT_END}\nSTEP_STATUS: qa_fail | issues="operator repaired report"`;
-                    preparedTurn = { text, rawResponse: text, cleanedResponse: text, isError: false, numTurns: 0, costUsd: 0 };
-                    preparedContract = { valid: true, errors: [], status: "qa_fail", fields: { issues: "operator repaired report" }, report: recovery.report, rawReportJson: JSON.stringify(recovery.report) };
-                }
-                else {
-                    preparedTurn = recovery.turn;
-                    preparedContract = recovery.contract;
-                }
+                const recovery = await retainInvalidResumedResponse(opts, identity, resumedPacket, snapshot, synthetic, [detail], qaEvents);
+                return recovery.result;
             }
             let comparison;
             try {
@@ -800,103 +806,50 @@ async function oneReview(opts, identity) {
             catch (error) {
                 const reason = `QA recovery error: current reviewed state cannot be reconstructed: ${error instanceof Error ? error.message : String(error)}`;
                 const synthetic = { text: "", rawResponse: "", cleanedResponse: "", isError: true, numTurns: 0, costUsd: 0 };
-                const recovery = await repairResumedFailureReport(opts, identity, resumedPacket, snapshot, qaHandle, synthetic, [reason], qaEvents, undefined, true, reason);
-                if (recovery.outcome === "failed")
-                    return recovery.result;
-                if (recovery.outcome === "retry")
-                    return { outcome: "retry-modification" };
-                if (recovery.outcome === "passed")
-                    return recovery.result;
-                if (recovery.outcome === "manual")
-                    return { outcome: "needs-human", detail: `${reason}; a manual reconstruction cannot replace missing reviewed-state evidence` };
-                qa = recovery.qa;
-                recoverySnapshot = recovery.snapshot;
-                preparedTurn = recovery.turn;
-                preparedContract = recovery.contract;
-                const recoveredState = (recovery.snapshot ?? snapshot).frozenState;
-                comparison = { matches: true, originalDigest: recoveredState.digest, currentDigest: recoveredState.digest, drift: [], frozenState: recoveredState };
+                const recovery = await retainInvalidResumedResponse(opts, identity, resumedPacket, snapshot, synthetic, [reason], qaEvents);
+                return recovery.result;
             }
-            if (!preparedTurn) {
-                if (!comparison.matches) {
-                    resumedPacket = appendQaRecoveryResource(resumedPacket, `recovery-history/drift-${identity.attemptId}.json`, { originalDigest: comparison.originalDigest, currentDigest: comparison.currentDigest, drift: comparison.drift, priorReports: "historical" }, { purpose: "Deterministic current-source drift summary; every earlier report is historical" });
-                    if (resumedPacket.manifest.reviewedStateDigest !== snapshot.frozenState.digest) {
-                        resumedPacket = appendQaRecoveryReviewedState(resumedPacket, snapshot.frozenState, `reviewed-state/current-r${resumedPacket.manifest.revision + 1}`);
-                    }
-                }
-                try {
-                    recoveryContext = materializeQaRecoveryContext(resumedPacket, snapshot.path);
-                    bindQaRecoveryContext(qa, recoveryContext);
-                }
-                catch (error) {
-                    const detail = `QA recovery context could not be materialized: ${error instanceof Error ? error.message : String(error)}`;
-                    const synthetic = { text: "", rawResponse: "", cleanedResponse: "", isError: true, numTurns: 0, costUsd: 0 };
-                    const recovery = await repairResumedFailureReport(opts, identity, resumedPacket, snapshot, qaHandle, synthetic, [detail], qaEvents, undefined, true);
-                    if (recovery.outcome === "failed")
-                        return recovery.result;
-                    if (recovery.outcome === "retry")
-                        return { outcome: "retry-modification" };
-                    if (recovery.outcome === "passed")
-                        return recovery.result;
-                    qa = recovery.qa;
-                    recoverySnapshot = recovery.snapshot;
-                    if (recovery.outcome === "manual") {
-                        const text = `${QA_FAILURE_REPORT_START}\n${JSON.stringify(recovery.report)}\n${QA_FAILURE_REPORT_END}\nSTEP_STATUS: qa_fail | issues="operator repaired report"`;
-                        preparedTurn = { text, rawResponse: text, cleanedResponse: text, isError: false, numTurns: 0, costUsd: 0 };
-                        preparedContract = { valid: true, errors: [], status: "qa_fail", fields: { issues: "operator repaired report" }, report: recovery.report, rawReportJson: JSON.stringify(recovery.report) };
-                    }
-                    else {
-                        preparedTurn = recovery.turn;
-                        preparedContract = recovery.contract;
-                    }
-                }
-                if (!preparedTurn) {
-                    if (!recoveryContext)
-                        throw new Error("QA recovery context invariant failed after successful materialization");
-                    const acknowledgement = renderQaRecoveryAcknowledgementInstruction(resumedPacket, recoveryContext.relativePath);
-                    const acknowledged = await performRecoveryAcknowledgement(resumedPacket, qa, acknowledgement, qaEvents, Boolean(opts.continuityManaged), "resume-entry", recoveryContext);
-                    resumedPacket = acknowledged.packet;
-                    const ackErrors = acknowledged.errors;
-                    if (ackErrors.length) {
-                        if (acknowledged.retryable)
-                            return retryFreshQaReview(opts, "invalid-recovery-acknowledgement", `QA recovery acknowledgement was invalid: ${ackErrors.join("; ")}`, snapshot.frozenState);
-                        const synthetic = { text: "", rawResponse: "", cleanedResponse: "", isError: true, numTurns: 0, costUsd: 0 };
-                        const recovery = await repairResumedFailureReport(opts, identity, resumedPacket, snapshot, qaHandle, synthetic, ackErrors, qaEvents, recoveryContext, true);
-                        if (recovery.outcome === "failed")
-                            return recovery.result;
-                        if (recovery.outcome === "retry")
-                            return { outcome: "retry-modification" };
-                        if (recovery.outcome === "passed")
-                            return recovery.result;
-                        qa = recovery.qa;
-                        recoverySnapshot = recovery.snapshot;
-                        if (recovery.outcome === "manual") {
-                            const text = `${QA_FAILURE_REPORT_START}\n${JSON.stringify(recovery.report)}\n${QA_FAILURE_REPORT_END}\nSTEP_STATUS: qa_fail | issues="recovered report"`;
-                            preparedTurn = { text, rawResponse: text, cleanedResponse: text, isError: false, numTurns: 0, costUsd: 0 };
-                            preparedContract = { valid: true, errors: [], status: "qa_fail", fields: { issues: "recovered report" }, report: recovery.report, rawReportJson: JSON.stringify(recovery.report) };
-                        }
-                        else {
-                            preparedTurn = recovery.turn;
-                            preparedContract = recovery.contract;
-                        }
-                    }
-                    if (!preparedTurn) {
-                        try {
-                            recoveryContext.verify();
-                        }
-                        catch (error) {
-                            return pauseQaReview(opts, "recovery-context-mutation", error instanceof Error ? error.message : String(error), (recoverySnapshot ?? snapshot).frozenState);
-                        }
-                        handoff = `${handoff}\n\nThis is a fresh QA session. Perform a complete review of the current immutable snapshot; use every prior report only as historical evidence.${comparison.matches ? "" : ` The source has drifted. Original reviewed-state digest: ${comparison.originalDigest}. Current reviewed-state digest: ${comparison.currentDigest}. Deterministic drift inventory: ${JSON.stringify(comparison.drift)}.`}`;
-                        resumedFullReviewNeedsBinding = true;
-                    }
+            if (!comparison.matches) {
+                resumedPacket = appendQaRecoveryResource(resumedPacket, `recovery-history/drift-${identity.attemptId}.json`, { originalDigest: comparison.originalDigest, currentDigest: comparison.currentDigest, drift: comparison.drift, priorReports: "historical" }, { purpose: "Deterministic current-source drift summary; every earlier report is historical" });
+                if (resumedPacket.manifest.reviewedStateDigest !== snapshot.frozenState.digest) {
+                    resumedPacket = appendQaRecoveryReviewedState(resumedPacket, snapshot.frozenState, `reviewed-state/current-r${resumedPacket.manifest.revision + 1}`);
                 }
             }
+            try {
+                recoveryContext = materializeQaRecoveryContext(resumedPacket, snapshot.path);
+                bindQaRecoveryContext(qa, recoveryContext);
+            }
+            catch (error) {
+                const detail = `QA recovery context could not be materialized: ${error instanceof Error ? error.message : String(error)}`;
+                const synthetic = { text: "", rawResponse: "", cleanedResponse: "", isError: true, numTurns: 0, costUsd: 0 };
+                const recovery = await retainInvalidResumedResponse(opts, identity, resumedPacket, snapshot, synthetic, [detail], qaEvents);
+                return recovery.result;
+            }
+            if (!recoveryContext)
+                throw new Error("QA recovery context invariant failed after successful materialization");
+            const acknowledgement = renderQaRecoveryAcknowledgementInstruction(resumedPacket, recoveryContext.relativePath);
+            const acknowledged = await performRecoveryAcknowledgement(resumedPacket, qa, acknowledgement, qaEvents, Boolean(opts.continuityManaged), "resume-entry", recoveryContext);
+            resumedPacket = acknowledged.packet;
+            const ackErrors = acknowledged.errors;
+            if (ackErrors.length) {
+                const synthetic = { text: "", rawResponse: "", cleanedResponse: "", isError: true, numTurns: 0, costUsd: 0 };
+                const recovery = await retainInvalidResumedResponse(opts, identity, resumedPacket, snapshot, synthetic, ackErrors, qaEvents);
+                return recovery.result;
+            }
+            try {
+                recoveryContext.verify();
+            }
+            catch (error) {
+                return pauseQaReview(opts, "recovery-context-mutation", error instanceof Error ? error.message : String(error), snapshot.frozenState);
+            }
+            handoff = `${handoff}\n\nThis is a fresh QA session. Perform a complete review of the current immutable snapshot; use every prior report only as historical evidence.${comparison.matches ? "" : ` The source has drifted. Original reviewed-state digest: ${comparison.originalDigest}. Current reviewed-state digest: ${comparison.currentDigest}. Deterministic drift inventory: ${JSON.stringify(comparison.drift)}.`}`;
+            resumedFullReviewNeedsBinding = true;
             opts.resumedRecovery = undefined;
         }
         if (resumedFullReviewNeedsBinding) {
             const resumedAttemptId = randomUUID();
             graphReviewContext = { ...graphReviewContext, operationId: `graph-review:${resumedAttemptId}`, logicalTaskId: resumedAttemptId };
-            graphPrepared = await prepareGraphInstruction(handoff, graphReviewContext, await qa.contextUsage?.());
+            graphPrepared = await prepareGraphInstruction(handoff, graphReviewContext, await qa.contextUsage?.(), qaVerdictOutput);
             handoff = graphPrepared.instruction;
             const resumedReviewBinding = beginV2Review(opts, snapshot.frozenState, snapshot.path, handoff, qaHandle, { attemptId: resumedAttemptId, cycle, remediationGeneration });
             bindQaTurnAdapter(qa, resumedReviewBinding);
@@ -905,61 +858,29 @@ async function oneReview(opts, identity) {
         }
         let graphSubturn = 0;
         const activeGraphBinding = qaTurnBindings.get(qa);
-        let turn = preparedTurn ?? await sendGraphTurn(qa, handoff, { ...graphReviewContext, reviewBasisRef: activeGraphBinding.reviewBasisDigest }, undefined, (prompt) => sendDurableQaTurn(qa, prompt, qaEvents, graphSubturn++ === 0 ? "initial" : `graph-evidence-${graphSubturn}`), { ...graphPrepared, instruction: activeGraphBinding.reviewInstruction });
-        let status = parseStepStatus(turn.text);
+        const turn = await sendGraphTurn(qa, handoff, { ...graphReviewContext, reviewBasisRef: activeGraphBinding.reviewBasisDigest }, nativePolicy(qaVerdictOutput), durableOwnerDispatch(activeGraphBinding.projectDir, qaVerdictOutput, { runId: activeGraphBinding.runId, actionId: activeGraphBinding.reviewAttemptId }, (prompt) => sendDurableQaTurn(qa, prompt, qaEvents, graphSubturn++ === 0 ? "initial" : `graph-evidence-${graphSubturn}`)), { ...graphPrepared, instruction: activeGraphBinding.reviewInstruction });
+        const status = qaStructuredStatus(turn);
         recoveryContext = qaTurnBindings.get(qa)?.recoveryContext;
         try {
-            if (!preparedTurn)
-                recoveryContext?.verify();
+            recoveryContext?.verify();
             await opts.observeNativeCompactions?.(qa);
             recoveryContext?.verify();
         }
         catch (error) {
-            return pauseQaReview(opts, "recovery-context-mutation", error instanceof Error ? error.message : String(error), (recoverySnapshot ?? snapshot).frozenState);
-        }
-        let responseContract = preparedContract ?? parseQaResponseContract(turn.text);
-        let responseProtocolError;
-        if (status.kind !== "qa_fail" && status.kind !== "unknown" && !responseContract.valid) {
-            responseProtocolError = `invalid QA response contract: ${responseContract.errors.join("; ")}`;
-        }
-        if (!turn.isError && status.kind === "blocked" && opts.resolveBlocked) {
-            const reason = status.reason ?? "QA reported an unspecified blocker";
-            turn = await sendDurableQaTurn(qa, [
-                `Your QA review reported a blocker: ${reason}`,
-                "Resolve the blocker if possible without changing project files. Otherwise return a precise STEP_STATUS: blocked marker.",
-                "If you can finish the review, return the complete QA response contract.",
-            ].join("\n\n"), qaEvents, "blocked-recovery");
-            try {
-                recoveryContext?.verify();
-            }
-            catch (error) {
-                return pauseQaReview(opts, "recovery-context-mutation", error instanceof Error ? error.message : String(error), (recoverySnapshot ?? snapshot).frozenState);
-            }
-            status = parseStepStatus(turn.text);
-            try {
-                await opts.observeNativeCompactions?.(qa);
-                recoveryContext?.verify();
-            }
-            catch (error) {
-                return pauseQaReview(opts, "recovery-context-mutation", error instanceof Error ? error.message : String(error), (recoverySnapshot ?? snapshot).frozenState);
-            }
-            responseContract = parseQaResponseContract(turn.text);
-            responseProtocolError = undefined;
-            if (status.kind !== "qa_fail" && status.kind !== "unknown" && !responseContract.valid) {
-                responseProtocolError = `invalid QA response contract after blocker recovery: ${responseContract.errors.join("; ")}`;
-            }
+            return pauseQaReview(opts, "recovery-context-mutation", error instanceof Error ? error.message : String(error), snapshot.frozenState);
         }
+        const responseContract = qaStructuredResponse(turn);
         const unresolvedDecision = qaUnresolvedToolDecision(opts.recovery.projectDir, opts.recovery.runId, opts.ticket.id, qaEvents);
         if (unresolvedDecision.action !== "none") {
             recordQaUnresolvedTools(opts.recovery.projectDir, opts.recovery.runId, opts.ticket.id, qaEvents);
             if (unresolvedDecision.action === "retry")
-                return retryFreshQaReview(opts, "unresolved-provider-tool", unresolvedDecision.detail, (recoverySnapshot ?? snapshot).frozenState);
-            return pauseQaReview(opts, "unresolved-provider-tool", unresolvedDecision.detail, (recoverySnapshot ?? snapshot).frozenState);
+                return retryFreshQaReview(opts, "unresolved-provider-tool", unresolvedDecision.detail, snapshot.frozenState);
+            return pauseQaReview(opts, "unresolved-provider-tool", unresolvedDecision.detail, snapshot.frozenState);
         }
         opts.state.reviews += 1;
         opts.state.sessionId = qa.sessionId();
         opts.state.sessionRef = qa.sessionRef?.();
-        const reviewedSnapshot = recoverySnapshot ?? snapshot;
+        const reviewedSnapshot = snapshot;
         const changes = await withActivityPhase("checking QA file changes", () => reviewedSnapshot.qaChanges());
         if (changes.length) {
             opts.state.modificationViolations += 1;
@@ -988,9 +909,13 @@ async function oneReview(opts, identity) {
             return { outcome: "retry-modification" };
         }
         if (turn.continuityErrors?.length && !turn.failure)
-            return retryFreshQaReview(opts, "invalid-continuity", `QA continuity record was invalid: ${turn.continuityErrors.join("; ")}`, reviewedSnapshot.frozenState);
-        if (responseProtocolError && !turn.isError && !turn.failure)
-            return retryFreshQaReview(opts, "invalid-response-contract", responseProtocolError, reviewedSnapshot.frozenState);
+            return pauseQaReview(opts, "invalid-continuity", `QA continuity record was invalid: ${turn.continuityErrors.join("; ")}`, reviewedSnapshot.frozenState);
+        if (!responseContract.valid && !turn.failure) {
+            const retained = resumedPacket
+                ? await retainInvalidResumedResponse(opts, identity, resumedPacket, snapshot, turn, responseContract.errors, qaEvents, true)
+                : await retainInvalidQaResponse(opts, identity, snapshot, qa, qaHandle, handoff, turn, responseContract.errors, qaEvents, true);
+            return retained.result;
+        }
         if (turn.isError || turn.failure)
             return pauseQaReview(opts, "qa-turn-error", `QA turn failed: ${sanitizePreview(turn.text)}`, reviewedSnapshot.frozenState);
         if (status.kind === "blocked")
@@ -1017,64 +942,7 @@ async function oneReview(opts, identity) {
         if (status.kind === "qa_fail" || responseContract.status === "qa_fail") {
             let contract = responseContract;
             if (!contract.valid || !contract.report) {
-                const recovery = resumedPacket
-                    ? await repairResumedFailureReport(opts, identity, resumedPacket, snapshot, qaHandle, turn, contract.errors, qaEvents, recoveryContext)
-                    : await repairInvalidFailureReport(opts, identity, snapshot, qa, qaHandle, handoff, turn, contract.errors, qaEvents);
-                if (recovery.outcome === "failed")
-                    return recovery.result;
-                if (recovery.outcome === "retry")
-                    return { outcome: "retry-modification" };
-                if (recovery.outcome === "passed")
-                    return recovery.result;
-                if (recovery.outcome === "manual") {
-                    qa = recovery.qa;
-                    recoverySnapshot = recovery.snapshot;
-                    contract = { valid: true, errors: [], status: "qa_fail", fields: {}, report: recovery.report };
-                }
-                else {
-                    qa = recovery.qa;
-                    recoverySnapshot = recovery.snapshot;
-                    turn = recovery.turn;
-                    contract = recovery.contract;
-                }
-                const recoveryChanges = await (recoverySnapshot ?? snapshot).qaChanges();
-                if (recoveryChanges.length)
-                    return { outcome: "needs-human", detail: `QA modified files during report recovery: ${recoveryChanges.join(", ")}` };
-                activeBinding = qaTurnBindings.get(qa);
-                if (!activeBinding)
-                    throw new Error("Recovered QA verdict is missing its durable source/review-basis binding");
-                const recoveredLiveSource = await captureFrozenQaSourceAsync(opts.builderWorktree, progress);
-                const recoveredSnapshot = recoverySnapshot ?? snapshot;
-                if (recoveredLiveSource.digest !== activeBinding.sourceStateDigest || recoveredSnapshot.frozenState.digest !== activeBinding.sourceStateDigest) {
-                    const driftDb = new WorkflowDb(opts.recovery.projectDir);
-                    try {
-                        const head = driftDb.qaTicketHead(opts.recovery.runId, opts.ticket.id);
-                        if (head.state === "turn-intended")
-                            driftDb.transitionQa(opts.recovery.runId, opts.ticket.id, head.revision, { type: "source-drift" });
-                    }
-                    finally {
-                        driftDb.close();
-                    }
-                    finishDurableQaReview(opts, activeBinding.reviewAttemptId, { status: "interrupted", detail: `Builder source drifted before recovered verdict acceptance (${activeBinding.sourceStateDigest} -> ${recoveredLiveSource.digest})` });
-                    durableReviewFinished = true;
-                    return { outcome: "retry-modification" };
-                }
-                if (contract.valid && contract.status === "qa_pass") {
-                    if (missingPrerequisites.length)
-                        return pauseQaReview(opts, "verification-not-run", "Required verification remains not_run; prerequisite recovery and fresh QA required", reviewedSnapshot.frozenState);
-                    let certificate;
-                    try {
-                        certificate = finishV2Pass(opts, qa, contract.fields.summary ?? "qa_pass");
-                    }
-                    catch (error) {
-                        const detail = error instanceof Error ? error.message : String(error);
-                        return retryFreshQaReview(opts, "invalid-qa-coverage", `Recovered QA pass evidence was not parseable or complete: ${detail}`, reviewedSnapshot.frozenState);
-                    }
-                    markQaRecoveryResolved(opts);
-                    durableReviewFinished = true;
-                    opts.evidence?.({ cycle, reviewAttempt: activeBinding.reviewNumber, remediationGeneration, attemptId: activeBinding.reviewAttemptId, outcome: "passed", detail: contract.fields.summary ?? "qa_pass", durationMs: Math.max(0, performance.now() - started) });
-                    return { outcome: "passed", summary: contract.fields.summary, passCertificateId: certificate.certificateId, sourceStateDigest: certificate.sourceStateDigest, reviewBasisDigest: certificate.reviewBasisDigest };
-                }
+                return pauseQaReview(opts, "invalid-native-qa-response", "Failed QA verdict has no validated failure report", reviewedSnapshot.frozenState);
             }
             const acceptedBinding = activeBinding;
             const report = contract.report;
@@ -1100,7 +968,7 @@ async function oneReview(opts, identity) {
             markQaRecoveryPendingBuilder(opts);
             return { outcome: "failed", detail, report, reportDigest: digest, reviewAttempt: acceptedBinding.reviewNumber, reviewAttemptId: acceptedBinding.reviewAttemptId };
         }
-        return retryFreshQaReview(opts, "unrecognized-qa-outcome", status.error ?? `QA returned ${status.kind}`, reviewedSnapshot.frozenState);
+        return pauseQaReview(opts, "unrecognized-qa-outcome", status.error ?? `QA returned ${status.kind}`, reviewedSnapshot.frozenState);
     }
     finally {
         if (durableReviewStarted && !durableReviewFinished) {
@@ -1119,8 +987,6 @@ async function oneReview(opts, identity) {
         }
         if (qa)
             await withActivityPhase("closing QA session", () => qa.close().catch(() => { }));
-        if (recoverySnapshot)
-            await recoverySnapshot.remove().catch(() => { });
         await withActivityPhase("cleaning up disposable QA snapshot", () => opts.observer
             ? opts.observer.span("cleanup", "cleaning up disposable QA snapshot", () => snapshot.remove())
             : snapshot.remove());
@@ -1138,8 +1004,7 @@ function finishDurableQaReview(opts, attemptId, patch) {
 function qaFindingRefs(runId, ticketId, reviewAttemptId, reportDigest, rawFindingIds) {
     return createQaFindingRefs({ runId, ticketId, reviewAttemptId, reportDigest, rawFindingIds });
 }
-async function repairResumedFailureReport(opts, identity, initialPacket, snapshot, originalHandle, originalTurn, originalErrors, qaEvents, recoveryContext, startAtMenu = false, requireFreshReviewReason) {
-    const originalQa = originalHandle.adapter;
+async function retainInvalidResumedResponse(opts, identity, initialPacket, snapshot, originalTurn, originalErrors, qaEvents, retryFresh = false) {
     const originalResponse = effectiveTurnText(originalTurn);
     let packet = appendQaRecoveryResource(initialPacket, `qa-responses/resumed-${identity.attemptId}.txt`, originalResponse, {
         purpose: "Exact first cleaned QA report response after resumed packet acknowledgement", exact: true,
@@ -1147,15 +1012,10 @@ async function repairResumedFailureReport(opts, identity, initialPacket, snapsho
     await awaitQaTurnEvent(qaEvents, originalTurn);
     packet = await appendTurnObservation(packet, `resumed-original-${identity.attemptId}`, originalTurn, originalTurn.hostInstruction, originalErrors, "resumed-fail-closed", qaEvents);
     packet = appendQaRecoveryResource(packet, `validation/resumed-${identity.attemptId}.json`, {
-        status: parseStepStatus(originalResponse), errors: originalErrors, recoveryStage: "resumed-fail-closed",
+        status: describeNativeQaResponse(originalResponse).status, errors: originalErrors, recoveryStage: "resumed-fail-closed",
     }, { purpose: "Validation result for the first resumed QA report response" });
-    void packet;
-    void requireFreshReviewReason;
-    if (!originalTurn.isError && !originalTurn.failure) {
-        const result = retryFreshQaReview(opts, "resumed-invalid-report", "Resumed QA report was invalid; a complete fresh QA review is required", snapshot.frozenState);
-        return result.outcome === "retry-modification" ? { outcome: "retry" } : { outcome: "failed", result };
-    }
-    return { outcome: "failed", result: pauseQaReview(opts, "resumed-reconstruction-disabled", `Resumed QA recovery could not be validated: ${originalErrors.map(error => sanitizePreview(error)).join("; ")}; a complete fresh QA review is required`, snapshot.frozenState) };
+    const resumedDetail = `Resumed QA response failed validation. Evidence retained at ${packet.directory}. ${originalErrors.map(error => sanitizePreview(error)).join("; ")}`;
+    return { outcome: "failed", result: retryFresh ? retryFreshQaReview(opts, "resumed-invalid-contract", resumedDetail, snapshot.frozenState) : pauseQaReview(opts, "resumed-invalid-contract", resumedDetail, snapshot.frozenState) };
 }
 export function buildQaReviewHandoff(ticket, builderSummary, diffDigest, validationChecklist, changeSummary, history = []) {
     return [
@@ -1166,7 +1026,7 @@ export function buildQaReviewHandoff(ticket, builderSummary, diffDigest, validat
         `Prior authoritative QA/report and Builder-remediation history: ${history.length ? JSON.stringify(boundedQaHistory(history)) : "(none; perform a complete first review)"}`,
         `Failure report JSON Schema: ${JSON.stringify(qaFailureReportV1Schema)}`,
         QA_COMMAND_DISCIPLINE,
-        `A failing response must use exactly:\n${QA_FAILURE_REPORT_START}\n{...valid QaFailureReportV1 JSON...}\n${QA_FAILURE_REPORT_END}\nSTEP_STATUS: qa_fail | issues="short plain-text synopsis"`,
+        "Submit the native qa-verdict payload. Every verdict, passed or failed, includes coverage and verifiedInstructionIds. Coverage holds the required coverage claims when a verification contract exists; otherwise it is null. A failed verdict also includes the complete failure report.",
         "Be very thorough. Don't leave anything out. Make sure all required fields are added. Triple check your work to ensure nothing is left out and all required fields are added and populated correctly.",
         "Do not change source, configuration, documentation, tickets, or control files. Only ignored cache, coverage, and build output is allowed.",
     ].join("\n");
@@ -1187,16 +1047,7 @@ export async function compactWithRetry(adapter) {
 export const QA_REPORT_RECOVERY_MENU = [
     "Try a complete fresh QA review.", "Manually fix saved JSON for human inspection.", "Give QA specific instructions for a fresh review.", "Pause.",
 ];
-function correctionInstruction(errors, guidance) {
-    return [
-        "Report correction only. Reconstruct the already-completed QA review without rerunning tools, tests, or repository inspection.",
-        `The prior failure report was invalid: ${errors.join("; ")}`,
-        guidance ? `Operator guidance: ${guidance}` : "",
-        `Return exactly one valid envelope in this order:\n${QA_FAILURE_REPORT_START}\n{...valid JSON matching the supplied schema...}\n${QA_FAILURE_REPORT_END}\nSTEP_STATUS: qa_fail | issues="short plain-text synopsis"`,
-        "Do not omit any completed finding, check, evidence, or observation.",
-    ].filter(Boolean).join("\n\n");
-}
-async function repairInvalidFailureReport(opts, identity, snapshot, originalQa, qaHandle, reviewPrompt, originalTurn, originalErrors, qaEvents) {
+async function retainInvalidQaResponse(opts, identity, snapshot, originalQa, qaHandle, reviewPrompt, originalTurn, originalErrors, qaEvents, retryFresh = false) {
     const originalResponse = effectiveTurnText(originalTurn);
     const runId = opts.recovery?.runId ?? `volatile-${identity.attemptId}`;
     const continuity = qaContinuityRecoveryContext(opts);
@@ -1205,7 +1056,7 @@ async function repairInvalidFailureReport(opts, identity, snapshot, originalQa,
         projectDir: opts.recovery?.projectDir ?? opts.builderWorktree, frozenState: snapshot.frozenState,
         runId, ticketId: opts.ticket.id, cycle: identity.cycle, reviewAttempt: identity.reviewAttempt,
         reviewAttemptId: identity.attemptId,
-        recoveryStage: "same-session", correctionTurns: 0, reportJson: extractReportBody(originalResponse),
+        recoveryStage: "same-session", correctionTurns: 0, reportJson: describeNativeQaResponse(originalResponse).reportJson ?? "{}\n",
         resources: {
             ticket: { value: opts.ticket, purpose: "Complete authoritative ticket definition" },
             "qa-review-prompt": { value: reviewPrompt, purpose: "Exact original QA review instruction", exactText: true },
@@ -1214,11 +1065,11 @@ async function repairInvalidFailureReport(opts, identity, snapshot, originalQa,
             "builder-response-history": { value: (opts.state.builderResponseHistory ?? []).filter((entry) => entry.ticketId === opts.ticket.id), purpose: "Every exact host-observed Builder completion/remediation response and its bounded prompt summary" },
             "original-host-prompt": { value: originalTurn.hostInstruction ?? reviewPrompt, purpose: "Exact host-requested original QA instruction", exactText: true },
             "original-provider-prompt": { value: originalTurn.providerInstruction ?? { unavailable: "adapter did not expose provider-dispatched instruction" }, purpose: "Exact provider-dispatched original QA instruction or explicit unavailable marker", exactText: typeof originalTurn.providerInstruction === "string" },
-            "original-raw-response": { value: originalTurn.rawResponse ?? originalResponse, purpose: "Exact raw provider response before cleanup", exactText: true },
-            "original-cleaned-response": { value: originalResponse, purpose: "Exact cleaned original response used for contract validation", exactText: true },
-            "original-validation": { value: { errors: originalErrors, parsedStatus: parseStepStatus(originalResponse), responseBytes: Buffer.byteLength(originalResponse), turn: turnMetadata(originalTurn) }, purpose: "Parsed status, validator result, and complete host-observable turn metadata" },
+            "original-raw-response": { value: originalTurn.transportEvidence ?? { unavailable: true }, purpose: "Retained bounded transport references" },
+            "original-cleaned-response": { value: originalTurn.transportEvidence ?? { unavailable: true }, purpose: "Retained bounded cleaned evidence references" },
+            "original-validation": { value: { errors: originalErrors, parsedStatus: describeNativeQaResponse(originalResponse).status, responseBytes: Buffer.byteLength(originalResponse), turn: turnMetadata(originalTurn) }, purpose: "Parsed status, validator result, and complete host-observable turn metadata" },
             "qa-history": { value: opts.qaHistory ?? [], purpose: "Earlier valid reports, observations, fixes, and unresolved history" },
-            "tool-events": { value: qaEvents.length ? qaEvents : { unavailable: true }, purpose: "All QA tool/activity events available through BuilderEvent, or an explicit unavailable marker" },
+            "tool-events": { value: qaEvents instanceof BoundedTurnEvents ? qaEvents.metadata() : { unavailable: true }, purpose: "All QA tool/activity events available through BuilderEvent, or an explicit unavailable marker" },
             continuity: { value: continuity, purpose: "Cumulative continuity checkpoints, later host facts, handoff lineage, and recovery history" },
             settings: { value: { runtime: originalQa.agent, session: qaHandle.sessionIdentity(), runtimeSettings: qaHandle.runtimeContext, effectiveRoleInstructions: qaHandle.effectiveRoleInstructions, roleInstructionDigest: sha(qaHandle.effectiveRoleInstructions), loadedSkills: qaHandle.skills, handoffReceipt: qaHandle.handoffReceipt }, purpose: "Effective QA role instructions, actual loaded skills, runtime settings, and handoff receipt captured at session creation" },
             "context-usage": { value: await originalQa.contextUsage?.().catch(() => undefined) ?? { unavailable: true }, purpose: "Provider context usage sample or explicit unavailable marker" },
@@ -1235,69 +1086,12 @@ async function repairInvalidFailureReport(opts, identity, snapshot, originalQa,
         packetDb.close();
     }
     let packet = existingPacket ? appendQaRecoveryAttempt(existingPacket, packetInput) : createQaRecoveryPacket(packetInput);
-    let qa = originalQa;
-    let activeQaHandle = qaHandle;
-    let errors = originalErrors;
-    let turns = 0;
-    let recoveryContextSeal;
-    let protocolViolation;
-    let correctionExecutionFailed = false;
-    const attemptCorrections = async (count, stage, guidance) => {
-        for (let index = 0; index < count; index++) {
-            turns++;
-            packet = updateQaRecoveryPosition(packet, stage, turns, "qa-correction");
-            const prompt = correctionInstruction(errors, guidance);
-            packet = appendQaRecoveryResource(packet, `prompts/${String(turns).padStart(2, "0")}.txt`, prompt, { purpose: `Exact QA report-correction prompt ${turns} (${stage})`, exact: true });
-            try {
-                recoveryContextSeal?.verify();
-            }
-            catch (error) {
-                protocolViolation = error instanceof Error ? error.message : String(error);
-                return undefined;
-            }
-            const result = await sendDurableQaTurn(qa, prompt, qaEvents, `${stage}:correction-${index + 1}`);
-            try {
-                recoveryContextSeal?.verify();
-            }
-            catch (error) {
-                protocolViolation = error instanceof Error ? error.message : String(error);
-                return undefined;
-            }
-            const contract = parseQaResponseContract(result.text);
-            packet = await appendTurnObservation(packet, `correction-${String(turns).padStart(2, "0")}`, result, prompt, contract.errors, stage, qaEvents);
-            packet = appendQaRecoveryResource(packet, `qa-responses/${String(turns).padStart(2, "0")}.txt`, result.text, { purpose: `Exact QA correction response ${turns} (${stage})`, exact: true });
-            packet = appendQaRecoveryResource(packet, `validation/${String(turns).padStart(2, "0")}.json`, {
-                status: contract.status, fields: contract.fields, errors: contract.errors,
-                turn: { isError: result.isError, numTurns: result.numTurns, costUsd: result.costUsd, inputTokens: result.inputTokens ?? "unavailable", outputTokens: result.outputTokens ?? "unavailable" }, stage,
-            }, { purpose: `Parsed status, validator result, turn metadata, and recovery stage for correction ${turns}` });
-            packet = appendQaRecoveryResource(packet, "context/tool-events.json", qaEvents.length ? qaEvents : { unavailable: true }, { purpose: "Latest complete set of QA BuilderEvent records available to the host" });
-            try {
-                recoveryContextSeal?.verify();
-            }
-            catch (error) {
-                protocolViolation = error instanceof Error ? error.message : String(error);
-                return undefined;
-            }
-            if (!result.isError && !result.failure && contract.valid && contract.report)
-                return { result, contract };
-            correctionExecutionFailed = Boolean(result.failure || (result.isError && !result.continuityErrors?.length));
-            errors = result.isError ? [`QA correction turn errored: ${sanitizePreview(result.text)}`] : contract.errors;
-        }
-        return undefined;
-    };
-    let fixed = await attemptCorrections(1, "same-session");
-    if (fixed && !protocolViolation)
-        return { outcome: "recovered", qa, turn: fixed.result, contract: fixed.contract };
-    if (protocolViolation)
-        packet = appendQaRecoveryResource(packet, `recovery-history/context-mutation-${packet.manifest.revision + 1}.txt`, protocolViolation, { purpose: "Recovery-context mutation protocol violation", exact: true });
-    void packet;
-    if (protocolViolation || correctionExecutionFailed)
-        return { outcome: "failed", result: pauseQaReview(opts, "report-correction-exhausted", protocolViolation ?? errors.join("; "), snapshot.frozenState) };
-    const result = retryFreshQaReview(opts, "report-correction-exhausted", "QA report correction exhausted after one same-session turn; a complete fresh QA review is required", snapshot.frozenState);
-    return result.outcome === "retry-modification" ? { outcome: "retry" } : { outcome: "failed", result };
+    packet = appendQaRecoveryResource(packet, "qa-responses/native-receipt.json", originalTurn.structured ?? { unavailable: true }, { purpose: "Original native provider receipt retained without changing or repeating completed QA work" });
+    const invalidDetail = `QA response failed validation. Evidence retained at ${packet.directory}. ${originalErrors.join("; ")}`;
+    return { outcome: "failed", result: retryFresh ? retryFreshQaReview(opts, "invalid-native-qa-response", invalidDetail, snapshot.frozenState) : pauseQaReview(opts, "invalid-native-qa-response", invalidDetail, snapshot.frozenState) };
 }
-async function exhausted(packet, originalResponse, opts, prefix = "QA report correction exhausted after nine turns", qa, snapshot, liveSession = Boolean(qa), unavailableOperatorReason, requireFreshReviewReason) {
-    const synopsis = parseQaResponseContract(originalResponse).fields.issues?.trim();
+async function exhausted(packet, originalResponse, opts, prefix = "QA review requires an explicit recovery decision", qa, snapshot, liveSession = Boolean(qa), unavailableOperatorReason, requireFreshReviewReason) {
+    const synopsis = describeNativeQaResponse(originalResponse).issues?.trim();
     let currentPrefix = prefix;
     if (packet.manifest.pendingAction !== "operator-menu") {
         packet = updateQaRecoveryPosition(packet, "operator-menu", packet.manifest.correctionTurns, "operator-menu");
@@ -1360,12 +1154,6 @@ function normalizeUnsupportedOperator(result, reason) {
         ? { outcome: "failed", result: { outcome: "needs-human", detail: `Requested QA recovery route is unavailable because ${reason}` } }
         : result;
 }
-function extractReportBody(text) {
-    const start = text.split(/\r?\n/).findIndex((line) => line.trim() === QA_FAILURE_REPORT_START);
-    const lines = text.split(/\r?\n/);
-    const end = lines.findIndex((line, index) => index > start && line.trim() === QA_FAILURE_REPORT_END);
-    return start >= 0 && end > start ? lines.slice(start + 1, end).join("\n") : "{}\n";
-}
 function boundedBuilderSummary(text) { return Buffer.from(text).subarray(0, 16 * 1024).toString(); }
 function latestBuilderResponse(opts) {
     return opts.state.builderResponseHistory?.filter((entry) => entry.ticketId === opts.ticket.id).at(-1)?.response ?? opts.builderSummary;
@@ -1444,7 +1232,7 @@ function markQaRecoveryAction(opts, action) {
 }
 const qaEventRecorders = new WeakMap();
 function startQaEventRecorder(adapter) {
-    const events = [];
+    const events = new BoundedTurnEvents(providerWireContract(qaVerdictOutput, adapter.agent).maximumResponseBytes);
     qaEventRecorders.set(events, { waits: new Map(), activePumps: 0 });
     attachQaEventRecorder(events, adapter);
     return events;
@@ -1507,14 +1295,14 @@ async function appendTurnObservation(packet, label, turn, requestedPrompt, error
     let next = appendQaRecoveryResource(packet, `turns/${label}/host-prompt.${hostPrompt === undefined ? "json" : "txt"}`, hostPrompt ?? { unavailable: "adapter did not expose the host-requested instruction" }, { purpose: `Host-requested QA instruction for ${label}`, exact: hostPrompt !== undefined });
     const providerPrompt = turn.providerInstruction;
     next = appendQaRecoveryResource(next, `turns/${label}/provider-prompt.${providerPrompt === undefined ? "json" : "txt"}`, providerPrompt ?? { unavailable: "adapter did not expose the provider-dispatched instruction" }, { purpose: `Provider-dispatched QA instruction for ${label}`, exact: providerPrompt !== undefined });
-    next = appendQaRecoveryResource(next, `turns/${label}/raw-response.txt`, turn.rawResponse ?? turn.text, { purpose: `Raw provider QA response for ${label}`, exact: true });
-    next = appendQaRecoveryResource(next, `turns/${label}/cleaned-response.txt`, effectiveTurnText(turn), { purpose: `Cleaned QA response used for contract validation for ${label}`, exact: true });
+    next = appendQaRecoveryResource(next, `turns/${label}/raw-response.json`, turn.transportEvidence ?? { unavailable: true }, { purpose: `Retained bounded transport references for ${label}` });
+    next = appendQaRecoveryResource(next, `turns/${label}/cleaned-response.json`, turn.transportEvidence ?? { unavailable: true }, { purpose: `Retained bounded QA evidence for ${label}` });
     next = appendQaRecoveryResource(next, `turns/${label}/metadata.json`, { stage, validationErrors: errors, turn: turnMetadata(turn), eventCompletion: turn.turnId ? events.some((event) => event.kind === "turn-complete" && (event.turnId ?? event.result.turnId) === turn.turnId) ? "complete" : "incomplete" : "unavailable" }, { purpose: `Turn metadata, validation result, and event completeness for ${label}` });
-    return appendQaRecoveryResource(next, `turns/${label}/events.json`, events.length ? events : { unavailable: true }, { purpose: `Complete host-observed event set through ${label}` });
+    return appendQaRecoveryResource(next, `turns/${label}/events.json`, events instanceof BoundedTurnEvents ? events.metadata() : { unavailable: true }, { purpose: `Complete host-observed event set through ${label}` });
 }
 async function performRecoveryAcknowledgement(packet, qa, prompt, events, continuityAlreadyValidated, label, seal) {
-    // Both turns acknowledge the same already-materialized revision. Observing
-    // either response advances the owner-only packet afterward, so validation
+    // Acknowledge the already-materialized revision. Observing the response
+    // advances the owner-only packet afterward, so validation
     // must continue to use this immutable target rather than the new revision.
     const target = packet;
     try {
@@ -1523,8 +1311,16 @@ async function performRecoveryAcknowledgement(packet, qa, prompt, events, contin
     catch (error) {
         return { packet, errors: [`recovery context mutated before acknowledgement: ${error instanceof Error ? error.message : String(error)}`] };
     }
-    const first = await sendDurableQaTurn(qa, prompt, events, `${label}:acknowledgement`);
-    let errors = validateQaRecoveryAcknowledgement(effectiveTurnText(first), target, { continuityAlreadyValidated });
+    const first = await sendDurableQaTurn(qa, prompt, events, `${label}:acknowledgement`, qaRecoveryOutput);
+    let errors = [];
+    try {
+        const ack = operationPayload(first, qaRecoveryOutput);
+        if (ack.packet !== target.manifest.packetDigest || ack.reviewed_state !== target.manifest.reviewedStateDigest || ack.required_resources_read !== "all")
+            errors.push("Recovery acceptance binding mismatch");
+    }
+    catch (error) {
+        errors.push(String(error));
+    }
     try {
         seal?.verify();
     }
@@ -1533,41 +1329,14 @@ async function performRecoveryAcknowledgement(packet, qa, prompt, events, contin
     }
     packet = await appendTurnObservation(packet, `${label}-acknowledgement`, first, prompt, errors, "packet-acknowledgement", events);
     if (first.isError || first.failure)
-        return { packet, errors: [...errors, first.continuityErrors?.length && !first.failure ? "QA acknowledgement continuity metadata was invalid" : "QA acknowledgement provider turn failed"],
-            retryable: Boolean(first.continuityErrors?.length && !first.failure && !errors.some(error => /mutated/i.test(error))) };
+        return { packet, errors: [...errors, first.continuityErrors?.length && !first.failure ? "QA acknowledgement continuity metadata was invalid" : "QA acknowledgement provider turn failed"] };
     try {
         seal?.verify();
     }
     catch (error) {
         errors.push(`recovery context mutated after acknowledgement: ${error instanceof Error ? error.message : String(error)}`);
     }
-    if (errors.length) {
-        const correction = `${prompt}\n\nAcknowledgement correction only. Do not produce the report yet. Errors: ${errors.join("; ")}`;
-        try {
-            seal?.verify();
-        }
-        catch (error) {
-            return { packet, errors: [`recovery context mutated before acknowledgement repair: ${error instanceof Error ? error.message : String(error)}`] };
-        }
-        const repaired = await sendDurableQaTurn(qa, correction, events, `${label}:acknowledgement-repair`);
-        errors = validateQaRecoveryAcknowledgement(effectiveTurnText(repaired), target, { continuityAlreadyValidated });
-        try {
-            seal?.verify();
-        }
-        catch (error) {
-            errors.push(`recovery context mutated during acknowledgement repair: ${error instanceof Error ? error.message : String(error)}`);
-        }
-        packet = await appendTurnObservation(packet, `${label}-acknowledgement-repair`, repaired, correction, errors, "packet-acknowledgement-repair", events);
-        if (repaired.isError || repaired.failure)
-            errors.push(repaired.continuityErrors?.length && !repaired.failure ? "QA acknowledgement repair continuity metadata was invalid" : "QA acknowledgement repair provider turn failed");
-        try {
-            seal?.verify();
-        }
-        catch (error) {
-            errors.push(`recovery context mutated after acknowledgement repair: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-    return { packet, errors, retryable: !errors.some(error => /mutated|provider turn failed/i.test(error)) };
+    return { packet, errors };
 }
 function validateBoundaryReceipt(receipt, packet, successorHandle) {
     const observedSuccessor = successorHandle.sessionIdentity();
@@ -1630,6 +1399,24 @@ export function assertQaRecoveryHandoffInventory(resources) {
 }
 function effectiveTurnText(turn) { return turn.cleanedResponse ?? turn.text; }
 const qaTurnBindings = new WeakMap();
+/** A readable evidence view, never a new native receipt or acceptance decision. */
+function retainedBuilderReport(db, digest) {
+    const bytes = db.getEvidence(digest);
+    if (!bytes)
+        return { digest, availability: "unavailable" };
+    try {
+        const retained = JSON.parse(bytes.toString());
+        const receipt = retained?.structured;
+        if (receipt?.state === "candidate") {
+            const value = typeof receipt.value === "string" ? JSON.parse(receipt.value) : receipt.value;
+            return { digest, availability: "available", operation: receipt.operation, schemaDigest: receipt.schemaDigest, report: value?.result };
+        }
+        return { digest, availability: "historical", report: retained };
+    }
+    catch {
+        return { digest, availability: "unreadable", reason: "Retained receipt JSON cannot be decoded; do not infer missing evidence from a summary." };
+    }
+}
 function beginV2Review(opts, source, reviewedSnapshotPath, instruction, handle, attempt) {
     const db = new WorkflowDb(opts.recovery.projectDir);
     try {
@@ -1665,35 +1452,46 @@ function beginV2Review(opts, source, reviewedSnapshotPath, instruction, handle,
             const expected = contract.inputs.find(input => input.kind === "checklist");
             if (expected?.digest !== contractDigest("input-checklist", checklist))
                 throw new Error("Final QA checklist differs from delivered contract");
-            const needsHistoricalEvidence = contract.checks.some(check => /red|test.?first|ordering|historical/i.test(JSON.stringify(check)));
             const builderClaims = db.operations(opts.recovery.runId).flatMap(operation => {
                 const intent = operation.intent;
                 const result = operation.result;
-                return operation.kind === "builder-coverage" && operation.status === "confirmed" && intent.workId === opts.ticket.id && intent.contractDigest === contract.contentDigest && result?.binding?.sourceDigest === source.digest && result.coverageDigest
+                return operation.kind === "builder-coverage" && operation.status === "confirmed" && intent.workId === opts.ticket.id && intent.contractDigest === contract.contentDigest && result?.binding?.sourceDigest && result.coverageDigest && (result.binding.sourceDigest === source.digest || result.implementationDigest)
                     ? [{
                             operationId: operation.idempotencyKey,
                             digest: result.coverageDigest,
-                            coverage: preparationStore.artifact(result.coverageDigest, "builder-coverage"),
-                            ...(needsHistoricalEvidence && result.implementationDigest ? {
+                            sourceDigest: result.binding.sourceDigest,
+                            currentSource: result.binding.sourceDigest === source.digest,
+                            ...(result.binding.sourceDigest === source.digest ? { coverage: preparationStore.artifact(result.coverageDigest, "builder-coverage") } : {}),
+                            ...(result.implementationDigest ? {
                                 // The response is already host-retained by finishBuildAssignment.
-                                // Expose only this bounded, contract-relevant excerpt to the
-                                // independent reviewer; do not retain or disclose all Builder
-                                // output globally.
-                                implementationResponse: {
-                                    digest: result.implementationDigest,
-                                    response: db.getEvidence(result.implementationDigest)?.toString() ?? "unavailable",
-                                },
+                                // Supply this scoped original report through the bounded context
+                                // and its complete read-only resource. Historical reports never
+                                // substitute for current-source coverage.
+                                implementationResponse: retainedBuilderReport(db, result.implementationDigest),
                             } : {}),
                         }] : [];
             });
-            const commandObservations = retainedQaCommandObservations(opts.recovery.projectDir, opts.recovery.runId, opts.ticket.id, qaCommandOutputExcerptsAllowed(opts.ticket.id));
+            const commandObservations = [
+                ...retainedQaCommandObservations(opts.recovery.projectDir, opts.recovery.runId, opts.ticket.id, qaCommandOutputExcerptsAllowed(opts.ticket.id)),
+                ...retainedHostBuilderObservations(db, opts.recovery.runId, opts.ticket.id),
+            ];
             instruction += `\n${qaHostGraphFact(opts.recovery.projectDir)}\n`;
             instruction += finalReviewContractContext(contract, preparationStore, reviewedSnapshotPath, builderClaims, commandObservations);
+            if (findHostQaCheck(contract)) {
+                const comparison = inspectHostQaComparison({ db, projectDir: opts.recovery.projectDir, worktree: opts.builderWorktree, runId: opts.recovery.runId, ticket: opts.ticket, contract });
+                if (comparison.finalSourceDigest !== source.digest)
+                    throw new Error("Host comparison source differs from the frozen QA source");
+                const digest = preparationStore.putArtifact("host-qa-comparison-observation", comparison);
+                const boundedPaths = (paths) => ({ paths: paths.slice(0, 20), omitted: Math.max(0, paths.length - 20) });
+                instruction += `\nHost source comparison observed before this review: ${JSON.stringify({ evidenceRef: `host-qa-comparison-observation:${digest}`, contractDigest: comparison.contractDigest, baselineSourceDigest: comparison.baselineSourceDigest, finalSourceDigest: comparison.finalSourceDigest, status: comparison.status, reason: comparison.reason, changedPaths: boundedPaths(comparison.changedPaths), unauthorizedPaths: boundedPaths(comparison.unauthorizedPaths), deletedPaths: boundedPaths(comparison.deletedPaths), protectedPaths: boundedPaths(comparison.protectedPaths), filePreservation: comparison.filePreservation, preservationOmitted: comparison.preservationOmitted })}\nThis retained observation compares complete captured product-path identities against the admitted preimplementation baseline. When omitted is zero the changed-path list is complete; captured paths absent from it are unchanged. A filePreservation row with status compared and baselineIsExactPrefix true proves every baseline byte remains in its original position; if baselineEndsWithNewline is true, every original complete line is preserved. Cite this retained observation for an applicable exact-preservation check. False or unavailable does not prove preservation and is not automatically a failure for requirements that permit other edits. These facts do not prove product behavior or a historical test sequence. Independently verify those applicable requirements with source and tests. Do not wait for a future host comparison or reconstruct the private baseline. Rafi recomputes the comparison against current source before certificate issuance; this observation alone cannot approve work.\n`;
+            }
             instruction += `\n${renderVerificationContract(contract)}\n${COVERAGE_INSTRUCTIONS}\nCoverage binding: ${JSON.stringify({ phase: "qa", runId: opts.recovery.runId, workId: opts.ticket.id, contractDigest: contract.contentDigest, revision: contract.revision, sourceDigest: source.digest, attemptId: attempt.attemptId, sessionId: handle.sessionIdentity().sessionId })}`;
         }
+        instruction += `\n\n${operationInstruction(qaVerdictOutput)}`;
         const originalInstruction = instruction;
         const guidance = db.reserveGuidance(opts.recovery.runId, opts.ticket.id, "qa", attempt.attemptId, source.digest, instruction, false);
-        instruction = guidance.text;
+        const managerVerificationInstruction = `\nManager instruction verification: verifiedInstructionIds may contain only independently verified IDs from this exact allowed list: ${JSON.stringify([...guidance.ids, ...verification.ids])}. These are separate Manager instructions, not contract check IDs or test names. If the list is empty, return verifiedInstructionIds: []. Rafi binds the immutable input-basis digest after validating your coverage claims; do not add host bindings to the payload.`;
+        instruction = guidance.text + managerVerificationInstruction;
         const basisWithoutDigest = {
             version: 2,
             ...(contract ? { contractBinding: { version: 1, transportVersion: 1, revision: contract.revision, digest: contract.contentDigest, admissionDigest: admission.requirementsDigest, commonConfigDigest: contract.inputs.find(input => input.kind === "rules").digest } } : {}),
@@ -1738,7 +1536,7 @@ function beginV2Review(opts, source, reviewedSnapshotPath, instruction, handle,
         head = db.commitQaReviewReady(sourceV2, basis, identity, handle.confinement, attempt, head.revision);
         if (recoveryPacket)
             recoveryPacket = updateQaRecoveryReviewIdentity(recoveryPacket, head.reviewNumber, attempt.attemptId, attempt.cycle);
-        return { projectDir: opts.recovery.projectDir, runId: opts.recovery.runId, ticketId: opts.ticket.id, reviewNumber: head.reviewNumber, reviewAttemptId: attempt.attemptId, sourceStateDigest: source.digest, reviewBasisDigest: basis.digest, sessionGeneration: identity.generation, sessionRef: identity, reviewedSnapshotPath: identity.cwd, frozenSource: source, recoveryPacket, nextTurn: 0, originalInstruction, inputBasisEnvelope, reviewInstruction: instruction, guidanceIds: guidance.ids, verificationIds: verification.ids };
+        return { projectDir: opts.recovery.projectDir, runId: opts.recovery.runId, ticketId: opts.ticket.id, reviewNumber: head.reviewNumber, reviewAttemptId: attempt.attemptId, sourceStateDigest: source.digest, reviewBasisDigest: basis.digest, sessionGeneration: identity.generation, sessionRef: identity, reviewedSnapshotPath: identity.cwd, frozenSource: source, recoveryPacket, nextTurn: 0, originalInstruction, inputBasisEnvelope, managerVerificationInstruction, reviewInstruction: instruction, guidanceIds: guidance.ids, verificationIds: verification.ids };
     }
     finally {
         db.close();
@@ -1785,18 +1583,20 @@ function bindQaRecoveryContext(adapter, context) {
         throw new Error("QA recovery context requires a durable review binding");
     binding.recoveryContext = context;
 }
-async function sendDurableQaTurn(adapter, instruction, events, slot) {
+async function sendDurableQaTurn(adapter, instruction, events, slot, output = qaVerdictOutput) {
     const binding = qaTurnBindings.get(adapter);
     if (!binding)
         throw new Error("QA provider dispatch requires a durable source/review-basis binding");
     // Repairs and recovery acknowledgements bypass graph navigation, but their
     // provider history and journal artifacts retain the original access grants.
-    return dispatchWithGraphAccess(binding.projectDir, adapter, instruction, undefined, () => sendDurableQaTurnOwned(adapter, instruction, events, slot));
+    return dispatchWithGraphAccess(binding.projectDir, adapter, instruction, undefined, () => sendDurableQaTurnOwned(adapter, instruction, events, slot, output));
 }
-async function sendDurableQaTurnOwned(adapter, instruction, events, slot) {
+async function sendDurableQaTurnOwned(adapter, instruction, events, slot, output = qaVerdictOutput) {
     const binding = qaTurnBindings.get(adapter);
     if (!binding)
         throw new Error("QA provider dispatch requires a durable source/review-basis binding");
+    if (slot !== "initial")
+        instruction += `\n\n${operationInstruction(output)}`;
     if (slot !== "session-initialization") {
         try {
             await adapter.prepareAutoCompaction?.();
@@ -1812,7 +1612,7 @@ async function sendDurableQaTurnOwned(adapter, instruction, events, slot) {
             "Rafi QA session initialization only.",
             "Do not inspect source, call tools, make findings, or modify files.",
             "Reply briefly that the context is ready, followed by the required continuity record.",
-        ].join("\n"), events, "session-initialization");
+        ].join("\n"), events, "session-initialization", initializationOutput);
         const setupCalledTools = events.slice(eventOffset).some((event) => event.kind === "tool");
         if (initialized.isError || setupCalledTools || adapter.requiresAutoCompactionSetupTurn?.()) {
             return { ...initialized, isError: true,
@@ -1832,13 +1632,13 @@ async function sendDurableQaTurnOwned(adapter, instruction, events, slot) {
         db.atomic(() => {
             if (slot === "initial") {
                 const guidance = db.reserveGuidance(binding.runId, binding.ticketId, "qa", operationId, binding.sourceStateDigest, binding.originalInstruction);
-                if (guidance.text + (binding.inputBasisEnvelope ?? "") !== binding.reviewInstruction)
+                if (guidance.text + (binding.managerVerificationInstruction ?? "") + (binding.inputBasisEnvelope ?? "") !== binding.reviewInstruction)
                     throw new BuildControlBoundary("Manager guidance changed during QA preparation; restart a full review with the current instruction basis");
                 binding.guidanceIds = guidance.ids;
                 instruction = binding.reviewInstruction;
             }
             const instructionDigest = db.putEvidence("qa", Buffer.from(instruction));
-            const intent = { version: 2, operationId, runId: binding.runId, ticketId: binding.ticketId, reviewNumber: binding.reviewNumber, sessionGeneration: binding.sessionGeneration, slot: retrySlot, sourceStateDigest: binding.sourceStateDigest, reviewBasisDigest: binding.reviewBasisDigest, providerSession, instructionDigest, intendedAt };
+            const intent = { version: 2, operationId, runId: binding.runId, ticketId: binding.ticketId, reviewNumber: binding.reviewNumber, sessionGeneration: binding.sessionGeneration, slot: retrySlot, sourceStateDigest: binding.sourceStateDigest, reviewBasisDigest: binding.reviewBasisDigest, providerSession, instructionDigest, intendedAt, outputContract: { protocolVersion: output.protocolVersion, operation: output.operation, schemaVersion: output.schemaVersion, schemaDigest: output.schemaDigest } };
             const head = db.qaTicketHead(binding.runId, binding.ticketId);
             db.commitQaTurnIntent(intent, head.revision);
         });
@@ -1851,18 +1651,18 @@ async function sendDurableQaTurnOwned(adapter, instruction, events, slot) {
     // Reading the sealed QA packet is ordinary confined read-only QA work.
     // Only formatting repair and ownership acceptance are response-only; the
     // first resource-inspection turn cannot truthfully read with tools disabled.
-    const responseRepair = slot?.includes("correction") || (slot?.includes("acknowledgement") && slot.includes("repair"));
     try {
-        result = await adapter.sendTurn(instruction, slot === "session-initialization" ? { purpose: "initialization", responseOnly: true } : responseRepair ? { purpose: "response-repair", responseOnly: true } : undefined);
+        result = await journalStructuredDispatch(binding.projectDir, adapter, instruction, nativePolicy(output, { dispatchId: operationId, logicalActionId: binding.reviewAttemptId, journalRunId: binding.runId, ...(slot === "session-initialization" ? { purpose: "initialization", responseOnly: true } : {}) }), (text, policy) => adapter.sendTurn(text, policy));
     }
     catch (error) {
         const failedDb = new WorkflowDb(binding.projectDir);
         try {
             const receipt = {
                 version: 2, operationId, dispatch: "uncertain", terminalEventObserved: false,
-                eventStreamDigest: failedDb.putEvidence("qa", Buffer.from(canonicalJson(events))),
+                eventStreamDigest: failedDb.putEvidence("qa", Buffer.from(canonicalJson(events instanceof BoundedTurnEvents ? events.metadata() : []))),
                 sourceStateDigest: binding.sourceStateDigest, reviewBasisDigest: binding.reviewBasisDigest, completedAt: new Date().toISOString(),
             };
+            failedDb.recordCommunicationEvidenceRefs(operationId, [receipt.rawResponseDigest, receipt.cleanedResponseDigest, receipt.eventStreamDigest].filter((digest) => Boolean(digest)));
             failedDb.finishQaTurn(receipt);
             const head = failedDb.qaTicketHead(binding.runId, binding.ticketId);
             if (head.state === "turn-intended")
@@ -1871,13 +1671,15 @@ async function sendDurableQaTurnOwned(adapter, instruction, events, slot) {
         finally {
             failedDb.close();
         }
-        ensureUncertainQaTurnPacket(binding, instruction, error instanceof Error ? error.message : String(error));
+        ensureUncertainQaTurnPacket(binding, instruction, boundedUtf8(error instanceof Error ? error.message : String(error), 4096).toString());
         throw error;
     }
     await awaitQaTurnEvent(events, result);
     const activeSession = adapter.sessionRef?.();
     const reportedSession = result.providerMetadata?.sessionRef;
-    const identityMismatch = adapter.agent !== session.provider
+    const expectedWire = providerWireContract(output, session.provider);
+    const identityMismatch = (result.structured?.state === "candidate" && (result.structured.dispatchId !== operationId || result.structured.sessionId !== session.sessionId || result.structured.profile !== expectedWire.profile || result.structured.wireContractDigest !== expectedWire.descriptorDigest || result.structured.wireSchemaDigest !== expectedWire.wireSchemaDigest || result.structured.wireVariant !== expectedWire.variant))
+        || adapter.agent !== session.provider
         || adapter.sessionId() !== session.sessionId
         || !activeSession
         || stableProviderSessionIdentity(activeSession) !== stableProviderSessionIdentity(session)
@@ -1892,12 +1694,17 @@ async function sendDurableQaTurnOwned(adapter, instruction, events, slot) {
             const receipt = {
                 version: 2, operationId, dispatch: "uncertain", terminalEventObserved: false,
                 providerTurnId: result.turnId,
-                rawResponseDigest: failedDb.putEvidence("qa", Buffer.from(result.rawResponse ?? result.text)),
-                cleanedResponseDigest: failedDb.putEvidence("qa", Buffer.from(result.cleanedResponse ?? result.text)),
+                rawResponseDigest: failedDb.operation(operationId)?.result?.rawDigest,
+                sealedDispatch: failedDb.structuredOwnerDispatch(operationId),
+                structuredResponseDigest: failedDb.operation(operationId)?.result?.responseDigest,
+                cleanedResponseDigest: failedDb.putEvidence("qa", boundedUtf8(result.cleanedResponse ?? result.text, expectedWire.maximumResponseBytes)),
+                retainedEvidence: { rawOriginalBytes: result.transportEvidence?.rawBytes, rawRetainedBytes: result.transportEvidence?.retainedRawBytes,
+                    cleanedOriginalBytes: Buffer.byteLength(result.cleanedResponse ?? result.text), cleanedRetainedBytes: boundedUtf8(result.cleanedResponse ?? result.text, expectedWire.maximumResponseBytes).length },
                 providerInstructionDigest: failedDb.putEvidence("qa", Buffer.from(result.providerInstruction ?? result.hostInstruction ?? instruction)),
-                eventStreamDigest: failedDb.putEvidence("qa", Buffer.from(canonicalJson({ events, rejectedProviderMetadata: result.providerMetadata, activeSession }))),
+                eventStreamDigest: failedDb.putEvidence("qa", Buffer.from(canonicalJson({ observation: events instanceof BoundedTurnEvents ? events.metadata() : [], rejectedSessionId: boundedUtf8(result.providerMetadata?.sessionId ?? "unavailable", 256).toString(), activeSessionId: boundedUtf8(activeSession?.sessionId ?? "unavailable", 256).toString() }))),
                 sourceStateDigest: binding.sourceStateDigest, reviewBasisDigest: binding.reviewBasisDigest, completedAt: new Date().toISOString(),
             };
+            failedDb.recordCommunicationEvidenceRefs(operationId, [receipt.rawResponseDigest, receipt.cleanedResponseDigest, receipt.eventStreamDigest].filter((digest) => Boolean(digest)));
             failedDb.finishQaTurn(receipt);
             const head = failedDb.qaTicketHead(binding.runId, binding.ticketId);
             if (head.state === "turn-intended")
@@ -1910,21 +1717,28 @@ async function sendDurableQaTurnOwned(adapter, instruction, events, slot) {
         throw new Error(detail);
     }
     const completedAt = new Date().toISOString();
-    const terminalEventObserved = Boolean(result.turnId && result.failure?.dispatchState !== "unknown"
-        && events.some((event) => event.kind === "turn-complete" && (event.turnId ?? event.result.turnId) === result.turnId));
+    const terminalEventObserved = Boolean(!(events instanceof BoundedTurnEvents && events.terminalOverflow) && result.turnId && result.failure?.dispatchState !== "unknown"
+        && events.filter(event => event.kind === "turn-complete" && (event.turnId ?? event.result.turnId) === result.turnId).length === 1
+        && events.some(event => event.kind === "turn-complete" && (event.turnId ?? event.result.turnId) === result.turnId &&
+            receiptFingerprint(event.result) === receiptFingerprint(result)));
     const receiptDb = new WorkflowDb(binding.projectDir);
     try {
-        const rawResponseDigest = receiptDb.putEvidence("qa", Buffer.from(result.rawResponse ?? result.text));
+        const rawResponseDigest = (receiptDb.operation(operationId)?.result).rawDigest;
+        const structuredResponseDigest = receiptDb.operation(operationId)?.result?.responseDigest;
         const providerInstruction = result.providerInstruction ?? result.hostInstruction ?? instruction;
         const providerInstructionDigest = receiptDb.putEvidence("qa", Buffer.from(providerInstruction));
-        const cleanedResponseDigest = receiptDb.putEvidence("qa", Buffer.from(result.cleanedResponse ?? result.text));
-        const eventStreamDigest = receiptDb.putEvidence("qa", Buffer.from(canonicalJson(events)));
+        const cleanedResponseDigest = receiptDb.putEvidence("qa", boundedUtf8(result.cleanedResponse ?? result.text, expectedWire.maximumResponseBytes));
+        const eventStreamDigest = receiptDb.putEvidence("qa", Buffer.from(canonicalJson(events instanceof BoundedTurnEvents ? events.metadata() : [])));
         const receipt = {
-            version: 2, operationId, dispatch: terminalEventObserved ? "completed" : "uncertain", providerTurnId: result.turnId,
-            providerInstructionDigest, rawResponseDigest, cleanedResponseDigest, eventStreamDigest,
+            version: 2, operationId, dispatch: terminalEventObserved && !result.isError && !result.failure ? "completed" : "uncertain", providerTurnId: result.turnId,
+            sealedDispatch: receiptDb.structuredOwnerDispatch(operationId),
+            providerInstructionDigest, rawResponseDigest, cleanedResponseDigest, eventStreamDigest, structuredResponseDigest,
+            retainedEvidence: { rawOriginalBytes: result.transportEvidence?.rawBytes, rawRetainedBytes: result.transportEvidence?.retainedRawBytes,
+                cleanedOriginalBytes: Buffer.byteLength(result.cleanedResponse ?? result.text), cleanedRetainedBytes: boundedUtf8(result.cleanedResponse ?? result.text, expectedWire.maximumResponseBytes).length },
             terminalEventObserved, sourceStateDigest: binding.sourceStateDigest, reviewBasisDigest: binding.reviewBasisDigest, completedAt,
         };
         receiptDb.atomic(() => {
+            receiptDb.recordCommunicationEvidenceRefs(operationId, [rawResponseDigest, cleanedResponseDigest, eventStreamDigest]);
             receiptDb.finishQaTurn(receipt);
             const metricAdmission = receiptDb.admittedWork(binding.runId, binding.ticketId);
             if (metricAdmission)
@@ -1935,7 +1749,7 @@ async function sendDurableQaTurnOwned(adapter, instruction, events, slot) {
         binding.lastReceiptDigest = qaDigest("turn-receipt", receipt);
         let graphRequest = false;
         try {
-            graphRequest = Boolean(parseGraphRequest(result.cleanedResponse ?? result.text));
+            graphRequest = operationResponse(result, output).result.kind === "graph-request";
         }
         catch {
             graphRequest = true;
@@ -1943,6 +1757,7 @@ async function sendDurableQaTurnOwned(adapter, instruction, events, slot) {
         if (!slot?.startsWith("session-") && !graphRequest)
             binding.lastBusinessReceiptDigest = binding.lastReceiptDigest;
         binding.lastResponse = result.text;
+        binding.lastTurn = result;
         if (!terminalEventObserved) {
             const head = receiptDb.qaTicketHead(binding.runId, binding.ticketId);
             receiptDb.transitionQa(binding.runId, binding.ticketId, head.revision, { type: "turn-uncertain" });
@@ -2017,15 +1832,23 @@ function finishV2Pass(opts, adapter, detail) {
                     throw new Error("Final coverage requires the current ready contract");
                 const contract = db.qaPreparationStore().contract(contractHead.digest);
                 const coverageBinding = { phase: "qa", sourceDigest: binding.sourceStateDigest, inputBasisDigest: binding.reviewBasisDigest, attemptId: binding.reviewAttemptId, sessionId: binding.sessionRef.sessionId };
-                const providerCoverage = bindCoverageHostFields(parseContractCoverage(binding.lastResponse ?? ""), contract, coverageBinding);
+                if (!binding.lastTurn)
+                    throw new Error("QA coverage requires the retained structured verdict");
+                const claims = operationPayload(binding.lastTurn, qaVerdictOutput).coverage;
+                if (!claims)
+                    throw new Error("QA verdict omitted required coverage");
+                const providerCoverage = bindCoverageHostFields(claims, contract, coverageBinding);
                 const hostComparison = findHostQaCheck(contract)
                     ? createHostQaComparison({ db, projectDir: binding.projectDir, worktree: opts.builderWorktree, runId: binding.runId, ticket: opts.ticket, contract, reviewAttemptId: binding.reviewAttemptId, reviewBasisDigest: binding.reviewBasisDigest })
                     : undefined;
                 const hostGraph = findGraphQaChecks(contract).length
                     ? createHostGraphApplicability({ projectDir: binding.projectDir, runId: binding.runId, ticketId: binding.ticketId, contract, reviewAttemptId: binding.reviewAttemptId, reviewBasisDigest: binding.reviewBasisDigest, sourceDigest: binding.sourceStateDigest, store: db.qaPreparationStore() })
                     : undefined;
-                const commandObservations = retainedQaCommandObservations(opts.recovery.projectDir, opts.recovery.runId, opts.ticket.id, false);
-                const coverage = applyHostQaAugmentations({ coverage: providerCoverage, contract, projectDir: binding.projectDir, hostComparison, hostGraph, commandObservations });
+                const commandObservations = [
+                    ...retainedQaCommandObservations(opts.recovery.projectDir, opts.recovery.runId, opts.ticket.id, false),
+                    ...retainedHostBuilderObservations(db, opts.recovery.runId, opts.ticket.id),
+                ];
+                const coverage = assembleFinalQaCoverage({ providerCoverage, contract, projectDir: binding.projectDir, hostComparison, hostGraph, commandObservations });
                 const errors = validateContractCoverage(contract, coverage, coverageBinding);
                 if (errors.length)
                     throw new Error(`Final QA coverage incomplete: ${errors.join("; ")}`);
@@ -2033,8 +1856,14 @@ function finishV2Pass(opts, adapter, detail) {
                 contractCoverage = { version: 1, contractDigest: contract.contentDigest, revision: contract.revision, coverageDigest, attemptId: binding.reviewAttemptId, sessionId: binding.sessionRef.sessionId };
             }
             const certificate = db.commitQaPassAttempt(binding.reviewAttemptId, { runId: binding.runId, ticketId: binding.ticketId, qaRevision: head.revision + 1, sourceStateDigest: binding.sourceStateDigest, reviewBasisDigest: binding.reviewBasisDigest, turnReceiptDigest: binding.lastBusinessReceiptDigest, ...(contractCoverage ? { contractCoverage } : {}) }, detail, head.revision);
-            db.verifyGuidance(binding.guidanceIds, certificate, binding.lastResponse ?? "");
-            db.verifyBuilderGuidance(binding.verificationIds, certificate, binding.lastResponse ?? "", binding.lastBusinessReceiptDigest);
+            if (!binding.lastTurn)
+                throw new Error("QA guidance verification requires the native turn receipt");
+            const verifiedInstructionIds = operationPayload(binding.lastTurn, qaVerdictOutput).verifiedInstructionIds;
+            const allowedInstructionIds = new Set([...binding.guidanceIds, ...binding.verificationIds]);
+            if (verifiedInstructionIds.some(id => !allowedInstructionIds.has(id)))
+                throw new Error("QA claimed verification of a foreign instruction");
+            db.verifyGuidance(binding.guidanceIds, certificate, verifiedInstructionIds);
+            db.verifyBuilderGuidance(binding.verificationIds, certificate, verifiedInstructionIds, binding.lastBusinessReceiptDigest);
             return { certificateId: certificate.certificateId, sourceStateDigest: binding.sourceStateDigest, reviewBasisDigest: binding.reviewBasisDigest };
         });
     }
@@ -2106,6 +1935,7 @@ export async function verifyPendingQaFinalizationSource(projectDir, sourceWorktr
     const controlDb = new WorkflowDb(projectDir);
     try {
         controlDb.assertFinalizationControls(runId, ticketId);
+        controlDb.assertQaFinalizationAuthority(runId, ticketId);
     }
     finally {
         controlDb.close();
@@ -2169,7 +1999,7 @@ function turnMetadata(turn) {
         inputTokens: turn.inputTokens ?? "unavailable",
         outputTokens: turn.outputTokens ?? "unavailable",
         usage: turn.usage ?? { unavailable: true },
-        failure: turn.failure ?? null,
+        failure: turn.failure ? { ...turn.failure, diagnostics: boundedUtf8(turn.failure.diagnostics, 4096).toString() } : null,
         provider: turn.providerMetadata ?? { unavailable: true },
     };
 }
@@ -2185,6 +2015,11 @@ function qaContinuityRecoveryContext(opts) {
             recoveryAttempts: db.recoveryAttempts(opts.recovery.runId).filter((attempt) => attempt.ticket === opts.ticket.id),
         };
     }
+    catch (error) {
+        if (/revoked graph-derived evidence|Graph access changed/.test(String(error)))
+            return { unavailable: "graph-access-revoked", detail: "Historical graph-derived continuity is withheld; explicit source-based recovery is required" };
+        throw error;
+    }
     finally {
         db.close();
     }