arkgate 4.8.5 → 4.8.7

package/bin/lib/ark-order-invariants.mjs

@@ -9,9 +9,17 @@
  */
 
 import { ArkOrderError } from './ark-order-error.mjs';
-import { DEFAULT_MAX_XI_KEYS } from './ark-order-types.mjs';
+import { CAPACITY_OPS, DEFAULT_MAX_XI_KEYS } from './ark-order-types.mjs';
 import { deterministicHash, stableSerialize } from './stableHash';
 export { DEFAULT_MAX_XI_KEYS };
+/** D7: consumer still owns handlers — this only names the travel verb. */
+export function ingestTravelAction(residual) {
+    if (residual.kind === 'absorb')
+        return 'send';
+    if (residual.kind === 'escalate_up' && residual.target === 'human')
+        return 'raises';
+    return 'none';
+}
 const FORBIDDEN_PLANE_METHODS = ['update', 'patch', 'set', 'mutate'];
 export function isForbiddenPlaneMethod(name) {
     return FORBIDDEN_PLANE_METHODS.includes(name);
@@ -70,9 +78,39 @@ export function assertXiSchema(xi, schema) {
         }
     }
 }
-export function hashReleasePayload(xi, sigma) {
+function catalogDigestFor(xi, catalogDigest) {
+    if (typeof catalogDigest !== 'string')
+        return undefined;
+    if (!Object.prototype.hasOwnProperty.call(xi, 'catalogReleaseId'))
+        return undefined;
+    return catalogDigest;
+}
+export function hashReleasePayload(xi, sigma, catalogDigest) {
+    const digest = catalogDigestFor(xi, catalogDigest);
+    if (digest !== undefined)
+        return deterministicHash(stableSerialize({ xi, sigma, catalogDigest: digest }));
     return deterministicHash(stableSerialize({ xi, sigma }));
 }
+export function hashXiIdentity(xi, catalogDigest) {
+    const digest = catalogDigestFor(xi, catalogDigest);
+    if (digest !== undefined)
+        return deterministicHash(stableSerialize({ xi, catalogDigest: digest }));
+    return deterministicHash(stableSerialize({ xi }));
+}
+export function hashSigmaIdentity(sigma) {
+    return deterministicHash(stableSerialize({ sigma }));
+}
+export function xiRecordsEqual(left, right) {
+    return stableSerialize(left) === stableSerialize(right);
+}
+/** D1: after the first freeze, a later release() may not change ξ. */
+export function assertUnvalvedRelease(current, nextXi) {
+    if (!current)
+        return;
+    if (xiRecordsEqual(current.xi, nextXi))
+        return;
+    throw new ArkOrderError('ARKORDER_UNVALVED_RELEASE', 'ξ is frozen; change the pattern with proposeRelease then apply(ProposeResult)');
+}
 export function createFrozenRelease(input) {
     assertXiKeyCap(input.xi, input.maxXiKeys);
     const xi = freezeRecord(input.xi, 'ξ');
@@ -81,13 +119,28 @@ export function createFrozenRelease(input) {
     const sigma = freezeRecord(input.sigma ?? {}, 'σ');
     const release = Object.freeze({
         version: input.version,
-        hash: hashReleasePayload(xi, sigma),
+        hash: hashReleasePayload(xi, sigma, input.catalogDigest),
+        xiHash: hashXiIdentity(xi, input.catalogDigest),
+        sigmaHash: hashSigmaIdentity(sigma),
         xi,
         sigma,
         releasedAt: input.now,
     });
     return release;
 }
+/** D2: refresh σ without minting a pattern. xiHash must not change. */
+export function refreshSigmaRecord(input) {
+    const sigma = freezeRecord(input.sigma, 'σ');
+    return Object.freeze({
+        version: input.current.version,
+        hash: hashReleasePayload(input.current.xi, sigma, input.catalogDigest),
+        xiHash: input.current.xiHash,
+        sigmaHash: hashSigmaIdentity(sigma),
+        xi: input.current.xi,
+        sigma,
+        releasedAt: input.now,
+    });
+}
 const XI_TTL_KEY_RE = /^(ttl|freshUntil|fresh_until|maxAge|max_age)$/i;
 export function assertXiHasNoTtl(xi) {
     for (const key of Object.keys(xi)) {
@@ -121,28 +174,101 @@ export function assertSigmaFresh(input) {
         throw new ArkOrderError('ARKORDER_STALE_SIGMA', 'σ is older than sigmaMaxAgeMs; ξ does not TTL');
     }
 }
-export function classifyIngest(projection, event, packs = []) {
+export function fieldEventIdentity(event) {
+    return deterministicHash(stableSerialize({ kind: event.kind, payload: event.payload ?? null }));
+}
+function bindResidual(event, xiHash) {
+    return { event, xiHash, eventId: fieldEventIdentity(event) };
+}
+const CAPACITY_OP_SET = new Set(CAPACITY_OPS);
+function isCapacityOp(value) {
+    return typeof value === 'string' && CAPACITY_OP_SET.has(value);
+}
+function numericLeaf(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+function compareCapacity(left, op, right) {
+    if (op === 'lte')
+        return left <= right;
+    if (op === 'lt')
+        return left < right;
+    if (op === 'gte')
+        return left >= right;
+    return left > right;
+}
+function packHasFunction(value) {
+    if (typeof value === 'function')
+        return true;
+    if (value === null || typeof value !== 'object')
+        return false;
+    if (Array.isArray(value))
+        return value.some(packHasFunction);
+    return Object.values(value).some(packHasFunction);
+}
+function evaluateCapacity(event, sigma, pack) {
+    const rows = pack.capacity ?? [];
+    for (const row of rows) {
+        if (packHasFunction(row) || !isCapacityOp(row.op))
+            return 'pack';
+        if (row.kind !== event.kind)
+            continue;
+        const payload = event.payload && typeof event.payload === 'object' && !Array.isArray(event.payload)
+            ? numericLeaf(event.payload[row.payloadKey])
+            : undefined;
+        const limit = numericLeaf(sigma[row.sigmaKey]);
+        if (payload === undefined || limit === undefined)
+            return 'pack';
+        if (!compareCapacity(payload, row.op, limit))
+            return 'capacity';
+    }
+    return 'ok';
+}
+export function classifyIngest(projection, event, packs = [], xiHash = '', sigma = Object.freeze({})) {
     const kind = event.kind;
+    const bound = bindResidual(event, xiHash);
     for (const pack of packs) {
+        if (packHasFunction(pack.capacity) || packHasFunction(pack.escalateKinds)) {
+            return {
+                ...bound,
+                kind: 'hold',
+                reasonCode: 'pack',
+                reason: `pack ${pack.id} is not data-only; user predicates are forbidden`,
+            };
+        }
         if (pack.escalateKinds?.includes(kind)) {
             const target = pack.escalateTarget ?? 'human';
             return {
-                kind: 'escalate',
-                event,
+                ...bound,
+                kind: 'escalate_up',
+                reasonCode: 'pack',
                 reason: `pack ${pack.id} slaves kind ${JSON.stringify(kind)} to a pattern change`,
                 target,
             };
         }
     }
-    if (projection.allowedKinds.includes(kind)) {
-        return { kind: 'absorb', event };
+    if (!projection.allowedKinds.includes(kind)) {
+        return {
+            ...bound,
+            kind: 'escalate_up',
+            reasonCode: 'not-in-pattern',
+            reason: `kind ${JSON.stringify(kind)} is not allowed by h(ξ); field cannot rewrite the pattern`,
+            target: 'human',
+        };
     }
-    return {
-        kind: 'escalate',
-        event,
-        reason: `kind ${JSON.stringify(kind)} is not allowed by h(ξ); field cannot rewrite the pattern`,
-        target: 'human',
-    };
+    for (const pack of packs) {
+        const cap = evaluateCapacity(event, sigma, pack);
+        if (cap === 'ok')
+            continue;
+        return {
+            ...bound,
+            kind: 'hold',
+            reasonCode: cap,
+            reason: cap === 'capacity'
+                ? `pack ${pack.id} capacity ${JSON.stringify(event.kind)} does not hold`
+                : `pack ${pack.id} capacity is not numeric data`,
+        };
+    }
+    return { ...bound, kind: 'absorb' };
 }
 export function blastRadiusOf(previous, next) {
     const prev = new Set(previous.allowedKinds);
@@ -179,6 +305,7 @@ export function proposePatternChange(input) {
         now: input.now,
         maxXiKeys: input.maxXiKeys,
         xiSchema: input.xiSchema,
+        catalogDigest: input.catalogDigest,
     });
     if (candidate.hash === input.current.hash) {
         throw new ArkOrderError('ARKORDER_EMPTY_BLAST', 'delta does not change ξ; that is not a pattern change');
@@ -195,3 +322,25 @@ export function proposePatternChange(input) {
         invalidations,
     };
 }
+/** D1 valve: freeze ProposeResult.nextXi. Empty blast still fails. */
+export function applyProposedRelease(input) {
+    const candidate = createFrozenRelease({
+        xi: { ...input.proposal.nextXi },
+        sigma: { ...input.current.sigma },
+        version: input.current.version + 1,
+        now: input.now,
+        maxXiKeys: input.maxXiKeys,
+        xiSchema: input.xiSchema,
+        catalogDigest: input.catalogDigest,
+    });
+    if (xiRecordsEqual(candidate.xi, input.current.xi)) {
+        throw new ArkOrderError('ARKORDER_EMPTY_BLAST', 'delta does not change ξ; that is not a pattern change');
+    }
+    const previous = input.projector(input.current, input.current.sigma);
+    const next = input.projector(candidate, candidate.sigma);
+    const { blastRadius } = blastRadiusOf(previous, next);
+    if (blastRadius.length === 0) {
+        throw new ArkOrderError('ARKORDER_EMPTY_BLAST', 'pattern change has empty blast radius; that key is not an order parameter');
+    }
+    return candidate;
+}

package/bin/lib/ark-order-types.mjs

@@ -9,3 +9,6 @@
  */
 
 export const DEFAULT_MAX_XI_KEYS = 7;
+export const INGEST_RESIDUAL_KINDS = ['absorb', 'escalate_up', 'hold'];
+export const INGEST_REASON_CODES = ['not-in-pattern', 'stale-sigma', 'pack', 'capacity'];
+export const CAPACITY_OPS = ['lte', 'lt', 'gte', 'gt'];

package/bin/lib/diagnostic-catalog.mjs

@@ -67,13 +67,14 @@ export const DIAGNOSTIC_CATALOG = Object.freeze([
     entry('ARKRUN_TRANSPORT_BYPASS', 'arkrun', 'Homemade broker or emitter import', 'A managed layer imports a closed broker/queue/emitter specifier (EventEmitter, queue clients, …) instead of the ArkRun kernel transport.', 'Send through the ArkRun kernel transport instead of importing that broker or emitter, then preflight again. Never mechanical-safe — homemade buses stay judgment.'),
     entry('ARKORDER_MISSING_PLANE', 'arkorder', 'No createOrderPlane in plane roots', 'The ArkOrder extra is on but no createOrderPlane factory was found in arkOrder.planeRoots, so agents can skip the pattern plane while the write gate stays green.', 'Import createOrderPlane from arkgate/order and call it in a plane root listed in arkOrder.planeRoots, then preflight again. Never mechanical-safe — factory placement is a design decision.'),
     entry('ARKORDER_KERNEL_IN_DOMAIN', 'arkorder', 'Domain-role layer imports the order plane', 'A Domain-role layer imports arkgate/order. Domain stays plane-free; planeRoots own the factory.', 'Move the arkgate/order import out of the Domain-role layer into a plane root or adapter, then preflight again. Never mechanical-safe.'),
-    entry('ARKORDER_GENERIC_UPDATE', 'arkorder', 'Generic update of ξ', 'A call to update/patch/set on the order plane rewrites the slow pattern. Haken slaving forbids generic ξ mutation.', 'Use release() to freeze ξ or proposeRelease() for a pattern change with blast radius, then preflight again. Never mechanical-safe.'),
+    entry('ARKORDER_GENERIC_UPDATE', 'arkorder', 'Generic update of ξ', 'A call to update/patch/set on the order plane rewrites the slow pattern. Haken slaving forbids generic ξ mutation.', 'Use release() for the first freeze of ξ. Later pattern change is proposeRelease then apply(ProposeResult). Never update/patch/set. Never mechanical-safe.'),
     entry('ARKORDER_TOO_MANY_PARAMS', 'arkorder', 'Too many slow keys', 'ξ has more keys than arkOrder.maxXiKeys. Haken requires a few slow modes, not a dump of microstate.', 'Cut ξ to the slow keys that actually slave the rest, then preflight again. Never mechanical-safe.'),
-    entry('ARKORDER_INGEST_WRITES_XI', 'arkorder', 'ingest assigned into ξ', 'An ingest() result is written into a Release or ξ store. ingest may absorb or escalate; it never mints a pattern.', 'Keep ingest results as absorb/escalate only. Change ξ with proposeRelease + release. Never mechanical-safe.'),
-    entry('ARKORDER_XI_FIELD_WRITE', 'arkorder', 'Slow key written around the order plane', 'A managed-layer file imports a persistence driver and writes a declared arkOrder.xiKeys name. Field events absorb or escalate; they do not PATCH the slow pattern.', 'Keep invoices, seats, hours, and logs on ingest. Change the slow key with proposeRelease + release, then preflight again. Never mechanical-safe.'),
+    entry('ARKORDER_INGEST_WRITES_XI', 'arkorder', 'ingest assigned into ξ', 'An ingest() result is written into a Release or ξ store. ingest may absorb, escalate_up, or hold; it never mints a pattern.', 'Keep ingest results as absorb/escalate_up/hold only. Change ξ with proposeRelease then apply(ProposeResult). Never mechanical-safe.'),
+    entry('ARKORDER_XI_FIELD_WRITE', 'arkorder', 'Slow key written around the order plane', 'A managed-layer file imports a persistence driver and writes a declared arkOrder.xiKeys name. Field events absorb or escalate; they do not PATCH the slow pattern.', 'Keep invoices, seats, hours, and logs on ingest. Change the slow key with proposeRelease then apply(ProposeResult), then preflight again. Never mechanical-safe.'),
     entry('ARKORDER_INFORMATION_BUDGET', 'arkorder', 'Projection observes a forbidden kind', 'h(ξ) allowedKinds includes a kind listed in informationBudget.cannotObserve. A scale may not look at what it was told not to see.', 'Cut that kind from the projector or from cannotObserve, then preflight again. Never mechanical-safe.'),
     entry('ARKORDER_XI_TTL', 'arkorder', 'Slow key carries a freshness field', 'ξ named ttl/freshUntil/maxAge. Freshness belongs on σ. A slow parameter that expires per transaction is not slow.', 'Move freshness onto σ (freshUntil) and keep ξ stable, then preflight again. Never mechanical-safe.'),
-    entry('ARKORDER_STALE_SIGMA', 'arkorder', 'σ is stale', 'ingest ran after σ.freshUntil (or sigmaMaxAgeMs). ξ does not TTL.', 'Refresh σ and ingest again, or freeze a new release if the pattern changed. Never mechanical-safe.'),
+    entry('ARKORDER_STALE_SIGMA', 'arkorder', 'σ is stale', 'ingest ran after σ.freshUntil (or sigmaMaxAgeMs). ξ does not TTL.', 'Call refreshSigma and ingest again, or proposeRelease then apply(ProposeResult) if the pattern changed. Never mechanical-safe.'),
+    entry('ARKORDER_UNVALVED_RELEASE', 'arkorder', 'Unvalved second freeze of ξ', 'release() ran after a pattern was already frozen and the new ξ differs. First freeze is release(); later pattern change is proposeRelease then apply.', 'Change ξ with proposeRelease then apply(ProposeResult). release() is only the first freeze. Never mechanical-safe.'),
     // ── atomic preflight / change set ────────────────────────────────────────
     entry('INVALID_CHANGE_PATH', 'preflight', 'Unsafe change path', 'A change set entry is not a safe, non-empty project-relative path (absolute, escape, empty, or NUL).', 'Use canonical project-relative paths only in the atomic change set, then preflight again.'),
     entry('DUPLICATE_CHANGE_PATH', 'preflight', 'Duplicate path in change set', 'The atomic change set lists more than one operation for the same path.', 'Collapse to one create/update/delete per path, then preflight again.'),

package/bin/lib/doctor-human.mjs

@@ -118,6 +118,9 @@ export function printDoctorCompactHuman(view) {
         ? ok
         : warn;
   line(govMark, `Governed: ${cov.governed.percent}% (${cov.governed.classifiedFiles}/${cov.governed.totalFiles} files)`);
+  for (const row of cov.layers ?? []) {
+    if (row.description) line(' ', `${row.name} — ${row.description}`);
+  }
 
   const hostRed =
     gatesMissing.length > 0 ||
@@ -230,6 +233,12 @@ export function printDoctorDetailsHuman(view) {
     );
   }
   if (cov.suggestions.length === 0 && cov.emptyLayers.length === 0) line(ok, 'Every layer classifies files; no empty layers');
+  const captioned = (cov.layers ?? []).filter((row) => row.description);
+  if (captioned.length > 0) {
+    console.log('');
+    console.log(color.bold('Layers'));
+    for (const row of captioned) line(' ', `${row.name} — ${row.description}`);
+  }
 
   if (packageVersionTruth?.dualTruth) {
     console.log('');

package/bin/lib/doctor-plan.mjs

@@ -15,6 +15,7 @@ import { describePackageVersionDualTruth } from './field-install.mjs';
 import { detectAgentHomeGaps } from './agent-homes.mjs';
 import { collectDoctorNextActions } from './doctor-next-actions.mjs';
 import { printDoctorCompactHuman, printDoctorDetailsHuman } from './doctor-human.mjs';
+import { placementDescriptionFields } from './layer-description.mjs';
 export { printDoctorCompactHuman, printDoctorDetailsHuman };
 export { summarizeRulesUnderContract };
 
@@ -117,6 +118,7 @@ export function computeCoverage(root, config, files, rules) {
     name: layer.name,
     patterns: layer.patterns ?? [],
     files: counts.get(layer.name) ?? 0,
+    ...placementDescriptionFields(layer),
   }));
   // A layer whose patterns match zero files is dead config — it enforces nothing, usually a
   // wrong glob (the #1 monorepo mistake). A layer with no rule edge can import anything.
@@ -171,7 +173,8 @@ export function runCoverage(root, config, files, rules, asJson) {
   console.log(`  ${pad('Layer')}  Files`);
   for (const row of layerRows) {
     const flag = row.files === 0 ? '   (pattern matches nothing)' : '';
-    console.log(`  ${pad(row.name)}  ${String(row.files).padStart(5)}${flag}`);
+    const caption = row.description ? `  ${row.description}` : '';
+    console.log(`  ${pad(row.name)}  ${String(row.files).padStart(5)}${flag}${caption}`);
   }
   console.log(`  ${pad('(unclassified)')}  ${String(unclassified.length).padStart(5)}`);
   console.log('');
@@ -758,6 +761,7 @@ export function runDoctor(root, config, files, rules, violations, asJson, option
             productHonesty,
             governed: cov.governed,
             coverageHonesty,
+            layers: cov.layers,
             emptyLayers: cov.emptyLayers,
             layersWithoutRules: cov.layersWithoutRules,
             ungovernedDirs: cov.suggestions.length,

package/bin/lib/html-report.mjs

@@ -25,6 +25,7 @@ import { capabilityBadgesFor, renderAdvisorySections } from './html-report-advis
 import { renderEvolutionSection } from './html-report-evolution.mjs';
 import { arkGitignoreAppendDecision } from './ark-gitignore.mjs';
 import { captureGitSnapshot } from './report-snapshot-context.mjs';
+import { layerDescriptionCaption } from './layer-description.mjs';
 
 export { arkGitignoreAppendDecision, gitignoreCoversArkState, gitignoreHasArkNegationException } from './ark-gitignore.mjs';
 
@@ -405,7 +406,7 @@ export function renderBeginnerHtmlReport({ root, config, violations, ok, version
 
   const placementRows = layers
     .map((layer) => {
-      const purpose = layer.description || 'See ark.config.json';
+      const purpose = layerDescriptionCaption(layer) || 'See ark.config.json';
       const folders = (layer.patterns || []).join(', ') || '—';
       return `<tr><td><strong>${esc(layer.name)}</strong></td><td>${esc(purpose)}</td><td><code>${esc(folders)}</code></td></tr>`;
     })
@@ -762,9 +763,10 @@ export function renderHtmlReport({
       ].join(' ');
       const example = exampleByLayer?.get?.(layer.name);
       const files = counts.get(layer.name) || 0;
+      const caption = layerDescriptionCaption(layer);
       return `<tr>
         <td class="ln">${esc(layer.name)}<div class="tags">${tags}</div></td>
-        <td>${layer.description ? esc(layer.description) : '<span class="dim">—</span>'}</td>
+        <td>${caption ? esc(caption) : '<span class="dim">—</span>'}</td>
         <td class="num">${files}</td>
         <td><code class="pat">${(layer.patterns || []).map(esc).join('<br>') || '—'}</code></td>
         <td>${example ? `<code>${esc(example)}</code>` : '<span class="dim">no files yet</span>'}</td>

package/bin/lib/layer-description.mjs

@@ -0,0 +1,27 @@
+/**
+ * App-context caption from `layers[].description`.
+ * Metadata only — callers project it; policyHash strips it elsewhere.
+ * Present non-empty string is returned; absence/empty/non-string is undefined.
+ *
+ * @param {{ description?: unknown } | null | undefined} layerOrPlacement
+ * @returns {string | undefined}
+ */
+export function layerDescriptionCaption(layerOrPlacement) {
+  const caption =
+    layerOrPlacement && typeof layerOrPlacement === 'object'
+      ? layerOrPlacement.description
+      : undefined;
+  return typeof caption === 'string' && caption.length > 0 ? caption : undefined;
+}
+
+/**
+ * Project the caption onto place / prepare-write / coverage / doctor JSON.
+ * Absence omits the field (never empty string).
+ *
+ * @param {{ description?: unknown } | null | undefined} layerOrPlacement
+ * @returns {{ description: string } | {}}
+ */
+export function placementDescriptionFields(layerOrPlacement) {
+  const caption = layerDescriptionCaption(layerOrPlacement);
+  return caption ? { description: caption } : {};
+}

package/bin/lib/prepare-write.mjs

@@ -7,6 +7,12 @@
 import crypto from 'node:crypto';
 import { validateWithAutoPatch } from './auto-patch.mjs';
 import { classifyRemediation, enrichViolationWithFixClass } from './remediation.mjs';
+import {
+  layerDescriptionCaption,
+  placementDescriptionFields,
+} from './layer-description.mjs';
+
+export { layerDescriptionCaption, placementDescriptionFields };
 
 /**
  * Stable content identity for host commit / cache keys.
@@ -114,7 +120,7 @@ export function composePrepareWrite(opts) {
     ...(placement?.suggestedLayers ? { suggestedLayers: placement.suggestedLayers } : {}),
     ...(placement?.message ? { placementMessage: placement.message } : {}),
     ...(placement?.note ? { placementNote: placement.note } : {}),
-    ...(placement?.description ? { description: placement.description } : {}),
+    ...placementDescriptionFields(placement),
     // Q03: pass through golden pattern from ark_place (advisory; absent is normal).
     ...(placement?.goldenPattern ? { goldenPattern: placement.goldenPattern } : {}),
     mode: gate.mode,

package/bin/lib/remediation.mjs

@@ -107,6 +107,7 @@ const ARKORDER_JUDGMENT_RULE_IDS = new Set([
     'ARKORDER_TOO_MANY_PARAMS',
     'ARKORDER_INGEST_WRITES_XI',
     'ARKORDER_XI_FIELD_WRITE',
+    'ARKORDER_UNVALVED_RELEASE',
 ]);
 function arkRunCallSiteName(violation) {
     return typeof violation.target === 'string' && violation.target.trim().length > 0
@@ -238,15 +239,17 @@ export function deterministicNextAction(violation) {
         case 'ARKORDER_KERNEL_IN_DOMAIN':
             return 'Move the arkgate/order import out of the Domain-role layer into a plane root or adapter, then preflight again. Never mechanical-safe.';
         case 'ARKORDER_GENERIC_UPDATE':
-            return 'Use release() to freeze ξ or proposeRelease() for a pattern change with blast radius, then preflight again. Never mechanical-safe.';
+            return 'Use release() for the first freeze of ξ. Later pattern change is proposeRelease then apply(ProposeResult). Never update/patch/set. Never mechanical-safe.';
         case 'ARKORDER_TOO_MANY_PARAMS':
             return 'Cut ξ to the slow keys that actually slave the rest, then preflight again. Never mechanical-safe.';
         case 'ARKORDER_INGEST_WRITES_XI':
-            return 'Keep ingest results as absorb/escalate only. Change ξ with proposeRelease + release. Never mechanical-safe.';
+            return 'Keep ingest results as absorb/escalate_up/hold only. Change ξ with proposeRelease then apply(ProposeResult). Never mechanical-safe.';
         case 'ARKORDER_XI_FIELD_WRITE':
             return typeof violation.target === 'string' && violation.target.length > 0
-                ? `Do not persist slow key ${violation.target} from a use-case. Absorb the field with ingest() or change the pattern with proposeRelease(), then preflight again.`
-                : 'Do not persist a declared slow key from a use-case. Absorb the field with ingest() or change the pattern with proposeRelease(), then preflight again. Never mechanical-safe.';
+                ? `Do not persist slow key ${violation.target} from a use-case. Absorb the field with ingest() or change the pattern with proposeRelease then apply, then preflight again.`
+                : 'Do not persist a declared slow key from a use-case. Absorb the field with ingest() or change the pattern with proposeRelease then apply, then preflight again. Never mechanical-safe.';
+        case 'ARKORDER_UNVALVED_RELEASE':
+            return 'Change ξ with proposeRelease then apply(ProposeResult). release() is only the first freeze. Never mechanical-safe.';
         default:
             if (typeof violation.ruleId === 'string' && violation.ruleId.startsWith('ARKRULE_')) {
                 return `Fix the ArkRule ${typeof violation.arkruleId === 'string' ? violation.arkruleId : violation.ruleId}, then preflight again.`;
@@ -520,6 +523,7 @@ export function enrichViolationWithFixClass(violation) {
         case 'ARKORDER_INFORMATION_BUDGET':
         case 'ARKORDER_XI_TTL':
         case 'ARKORDER_STALE_SIGMA':
+        case 'ARKORDER_UNVALVED_RELEASE':
             enriched.fixClass = 'arkorder-usage';
             enriched.effort = 'medium';
             enriched.enthusiastHint =
@@ -539,7 +543,9 @@ export function enrichViolationWithFixClass(violation) {
                                             ? 'TTL is σ, never ξ. A slow key that expires is not an order parameter.'
                                             : violation.ruleId === 'ARKORDER_STALE_SIGMA'
                                                 ? 'Refresh σ. ξ does not expire.'
-                                                : 'Call createOrderPlane from arkgate/order in a listed plane root so the app actually freezes a pattern.';
+                                                : violation.ruleId === 'ARKORDER_UNVALVED_RELEASE'
+                                                    ? 'The pattern is frozen. proposeRelease then apply — do not call release() again with a different ξ.'
+                                                    : 'Call createOrderPlane from arkgate/order in a listed plane root so the app actually freezes a pattern.';
             break;
         default:
             enriched.fixClass = 'review-contract';

package/dist/{configTypes-dy5PfTqS.d.ts → configTypes-0eHpocR3.d.ts}

@@ -16,6 +16,10 @@ type ArkConfigLayer = {
     patterns: string[];
     exclude?: string[];
     intentPrefixes?: string[];
+    /**
+     * App-context caption for this layer.
+     * Metadata — excluded from policy hash. Absence is silent.
+     */
     description?: string;
     forbiddenGlobals?: string[];
     /** ADR 0009 D2 — opt-in effect-capability walls; absence changes no verdict. */

package/dist/{diagnosticCatalog-DMO30svh.d.ts → diagnosticCatalog-wDAH08gH.d.ts}

@@ -1,5 +1,5 @@
-import { e as CreateArchitectureProfileOptions, b as ArchitectureProfile, d as ArkCheckConfig, C as CreateArchitectureProfileFromArkConfigOptions, f as CreateElevenLayerArkConfigOptions, i as Policy, j as IntentCreator, I as IntentName } from './types-BuM8WNqe.js';
-import { A as ArkConfig, c as ArkConfigLoadResult } from './configTypes-dy5PfTqS.js';
+import { e as CreateArchitectureProfileOptions, b as ArchitectureProfile, d as ArkCheckConfig, C as CreateArchitectureProfileFromArkConfigOptions, f as CreateElevenLayerArkConfigOptions, i as Policy, j as IntentCreator, I as IntentName } from './types-BK47clMl.js';
+import { A as ArkConfig, c as ArkConfigLoadResult } from './configTypes-0eHpocR3.js';
 
 /** Versioned public result contract shared by every ArkGate enforcement adapter. */
 /**
@@ -409,7 +409,7 @@ declare const ARK_ANALYSIS_RESULT_SCHEMA: {
 };
 
 /** ArkGate library version — single source of truth. */
-declare const version = "4.8.5";
+declare const version = "4.8.7";
 
 /**
  * AI Code Gate (basic).