audit-tools 0.40.1 → 0.41.0

package/dist/audit/cli/nextStepHelpers.js

@@ -9,9 +9,9 @@ import { mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { advance, DEFAULT_MAX_TRANSITIONS, isFileMissingError, isJsonParseError, readJsonFile, persistAnalyzerConsent, persistAnalyzerSettings, writeJsonFile, } from "audit-tools/shared";
 import { loadArtifactBundle, promoteFinalAuditReport, writeCoreArtifacts, } from "../io/artifacts.js";
-import { artifactTreeLockPath, auditReportPath, groundDesignFindings, promotedAuditReportPath, withFileLock, } from "audit-tools/shared";
-import { CharterSubmissionSchema, CharterDeltaSubmissionSchema, ClarificationAnswersSubmissionSchema, CriticalFlowFallbackResultSchema, SynthesisNarrativeSchema, SystemicChallengeSubmissionSchema, } from "audit-tools/shared";
+import { artifactTreeLockPath, auditReportPath, groundDesignFindings, laneAssetsDir, promotedAuditReportPath, withFileLock, } from "audit-tools/shared";
 import { charterExtractionKindsForCeiling } from "./charterExtractionPrompt.js";
+import { LANE_SUBMISSION_SCHEMAS, charterLaneSchema, describeSubmissionShapeMismatch, isSubmissionObjectMap, unwrapSubmissionArray, } from "./laneValidators.js";
 import { advanceAudit } from "../orchestrator/advance.js";
 import { captureDesignReviewSnapshot, isDesignReviewStale, } from "../orchestrator/designReviewSnapshot.js";
 import { computeArtifactStateSignature } from "../orchestrator/artifactMetadata.js";
@@ -20,22 +20,23 @@ import { isHostDelegationExecutor } from "../orchestrator/executors.js";
 import { resolveCharterCeiling, ceilingRequestsCharters, } from "../orchestrator/charterExtractionExecutor.js";
 import { resolveClarificationAttention } from "../orchestrator/charterClarificationExecutor.js";
 import { deriveAuditState } from "../orchestrator/state.js";
-import { deriveIntentEquivalenceStatus, IntentEquivalenceVerdictSchema, } from "../orchestrator/intentEquivalenceExecutor.js";
+import { deriveIntentEquivalenceStatus } from "../orchestrator/intentEquivalenceExecutor.js";
 import { checkFileIntegrity } from "../orchestrator/fileIntegrity.js";
 import { graphEnrichmentUnresolvedAnalyzers, graphEnrichmentLowConfidenceEdges, pendingAnalyzerConsent, } from "../orchestrator/hostInputPause.js";
 import { runAuditStep } from "./auditStep.js";
 import { writeHandoffOnly, ensureSemanticReviewRun, loadCurrentActiveReviewRun, } from "./reviewRun.js";
 import { buildPendingAuditTasks } from "./dispatch.js";
 import { ingestAuditHostResults } from "./dispatch/hostHandoff.js";
+import { CHARTER_EXTRACTION_MERGED_FILENAME, GATE_LANES, charterExtractionLane, charterExtractionPacketFilename, laneSubmissionPath, recordHostResultOutcomes, recordLaneOutcome, } from "./laneSubmissions.js";
 /**
- * Read a JSON file from the `incoming/` subdirectory of `artifactsDir`.
- * `ok` when the file exists and parses; `absent` on ENOENT-family errors;
- * `malformed` when the file exists but is not JSON — submitted content is the
- * CALLER's to quarantine, never an infrastructure failure. All other IO errors
- * re-throw unchanged.
+ * Read a lane's submission from the TOOL-COMPUTED path its emission bound —
+ * never a name a host could type. `ok` when the file exists and parses;
+ * `absent` on ENOENT-family errors; `malformed` when the file exists but is not
+ * JSON — submitted content is the CALLER's to quarantine, never an
+ * infrastructure failure. All other IO errors re-throw unchanged.
  */
-export async function tryConsumeIncoming(artifactsDir, filename) {
-    const filePath = join(artifactsDir, "incoming", filename);
+export async function tryConsumeSubmission(artifactsDir, lane) {
+    const filePath = laneSubmissionPath(artifactsDir, lane);
     try {
         const value = await readJsonFile(filePath);
         return { status: "ok", value, path: filePath };
@@ -149,8 +150,8 @@ export async function buildTerminalStep(params, bundle, state, blockedReason) {
  * mirroring the analyzer-install consent fold exactly:
  *   - nothing pending (acquisition off / token present / all decided) → run the
  *     deterministic acquisition executor (`fallthrough`);
- *   - a decisions file arrived (`incoming/analyzer-consent-decisions.json`,
- *     `{ "<id>": "granted" | "declined" }`) → persist the decisions into
+ *   - a decisions submission arrived on the `analyzer_consent` lane
+ *     (`{ "<id>": "granted" | "declined" }`) → persist the decisions into
  *     session config (decisions durable, tokens never), fold them into the
  *     in-flight acquisition options, and re-scan (`continue`);
  *   - otherwise → emit the ONE batched operator-interactive offer step
@@ -167,43 +168,36 @@ export async function handleAnalyzerConsentBranch(params, bundle, state, analyze
     });
     if (pending.length === 0)
         return { action: "fallthrough" };
-    const incoming = await consumeObjectIncoming(params.artifactsDir, "analyzer-consent-decisions.json");
+    const incoming = await consumeEnumMapSubmission(params.artifactsDir, GATE_LANES.analyzer_consent, ANALYZER_CONSENT_VALUES);
     if (incoming.status === "quarantined") {
         return { action: "continue" };
     }
     if (incoming.status === "ok") {
-        const decisions = {};
-        for (const [id, value] of Object.entries(incoming.value)) {
-            if (value === "granted" || value === "declined") {
-                decisions[id] = value;
-            }
-        }
-        if (Object.keys(decisions).length > 0) {
-            await persistAnalyzerConsent(params.root, decisions);
-            if (params.externalAcquisition) {
-                params.externalAcquisition.analyzerConsent = {
-                    ...(params.externalAcquisition.analyzerConsent ?? {}),
-                    ...decisions,
-                };
-            }
-        }
-        else {
-            const invalidEntries = Object.keys(incoming.value).join(", ") || "(none)";
-            process.stderr.write(`[audit-code] analyzer-consent-decisions.json ignored: no recognized values (got: ${invalidEntries}). ` +
-                `Valid values are: granted, declined.\n`);
+        await persistAnalyzerConsent(params.root, incoming.values);
+        if (params.externalAcquisition) {
+            params.externalAcquisition.analyzerConsent = {
+                ...(params.externalAcquisition.analyzerConsent ?? {}),
+                ...incoming.values,
+            };
         }
         await unlink(incoming.path).catch(() => { });
+        await recordLaneOutcome(params.artifactsDir, GATE_LANES.analyzer_consent, {
+            kind: "accepted",
+            ...(incoming.ignored.length > 0
+                ? { message: describeIgnoredKeys(incoming.ignored, ANALYZER_CONSENT_VALUES) }
+                : {}),
+        });
         return { action: "continue" };
     }
     return { action: "return", result: { kind: "analyzer_consent", state, bundle, pending } };
 }
 /**
- * Handle the `graph_enrichment_executor` incoming-artifact polling block.
+ * Handle the `graph_enrichment_executor` submission-polling block.
  * Checks for pending analyzer install decisions and edge-reasoning results.
  * Returns an action object:
- *   - `continue`    → caller should keep folding (already consumed an artifact).
+ *   - `continue`    → caller should keep folding (already consumed a submission).
  *   - `return`      → caller should emit the embedded result to cmdNextStep.
- *   - `fallthrough` → no incoming artifacts; run the deterministic executor.
+ *   - `fallthrough` → nothing submitted; run the deterministic executor.
  */
 export async function handleGraphEnrichmentBranch(params, bundle, state, analyzersRef, deps = {}) {
     const runStep = deps.runStep ?? runAuditStep;
@@ -217,37 +211,23 @@ export async function handleGraphEnrichmentBranch(params, bundle, state, analyze
     };
     const unresolved = graphEnrichmentUnresolvedAnalyzers(bundle, pauseInputs);
     if (unresolved.length > 0) {
-        const incoming = await consumeObjectIncoming(params.artifactsDir, "analyzer-decisions.json");
+        const incoming = await consumeEnumMapSubmission(params.artifactsDir, GATE_LANES.analyzer_decisions, ANALYZER_SETTING_VALUES);
         if (incoming.status === "quarantined") {
             // A non-object top-level value used to be neither merged, deleted, nor
-            // diagnosed — the file lingered in incoming/ and the analyzer_install
+            // diagnosed — the file lingered at its bound path and the analyzer_install
             // step re-emitted silently forever. Quarantined + diagnosed instead.
             return { action: "continue" };
         }
         if (incoming.status === "ok") {
-            const settings = {};
-            for (const [id, value] of Object.entries(incoming.value)) {
-                if (value === "ephemeral" ||
-                    value === "permanent" ||
-                    value === "skip" ||
-                    value === "repo" ||
-                    value === "auto") {
-                    settings[id] = value;
-                }
-            }
-            if (Object.keys(settings).length > 0) {
-                const merged = await persistAnalyzerSettings(params.root, settings);
-                analyzersRef.value = merged.analyzers;
-            }
-            else {
-                // All entries in analyzer-decisions.json failed the recognized-value
-                // check (ephemeral|permanent|skip|repo|auto). Emit a diagnostic so the
-                // operator knows why no settings were applied (COR-03418a9f fix).
-                const invalidEntries = Object.keys(incoming.value).join(", ") || "(none)";
-                process.stderr.write(`[audit-code] analyzer-decisions.json ignored: no recognized values (got: ${invalidEntries}). ` +
-                    `Valid values are: ephemeral, permanent, skip, repo, auto.\n`);
-            }
+            const merged = await persistAnalyzerSettings(params.root, incoming.values);
+            analyzersRef.value = merged.analyzers;
             await unlink(incoming.path).catch(() => { });
+            await recordLaneOutcome(params.artifactsDir, GATE_LANES.analyzer_decisions, {
+                kind: "accepted",
+                ...(incoming.ignored.length > 0
+                    ? { message: describeIgnoredKeys(incoming.ignored, ANALYZER_SETTING_VALUES) }
+                    : {}),
+            });
             return { action: "continue" };
         }
         return { action: "return", result: { kind: "analyzer_install", state, bundle, unresolved } };
@@ -263,15 +243,20 @@ export async function handleGraphEnrichmentBranch(params, bundle, state, analyze
     {
         const candidates = graphEnrichmentLowConfidenceEdges(bundle, pauseInputs);
         if (candidates.length > 0) {
-            const edgeReasoningIncoming = await tryConsumeIncoming(params.artifactsDir, "edge-reasoning.json");
+            const edgeReasoningIncoming = await tryConsumeSubmission(params.artifactsDir, GATE_LANES.edge_reasoning);
             if (edgeReasoningIncoming.status === "malformed") {
-                const quarantinePath = await quarantineIncomingFile(params.artifactsDir, edgeReasoningIncoming.path, "edge-reasoning.json");
+                const quarantinePath = await quarantineSubmissionFile(params.artifactsDir, edgeReasoningIncoming.path, GATE_LANES.edge_reasoning);
                 await recordEdgeReasoningRejection(params.artifactsDir, {
-                    filename: "edge-reasoning.json",
+                    lane: GATE_LANES.edge_reasoning,
                     quarantine_path: quarantinePath,
                     reason: edgeReasoningIncoming.reason,
                     rejected_at: new Date().toISOString(),
                 });
+                await recordLaneOutcome(params.artifactsDir, GATE_LANES.edge_reasoning, {
+                    kind: "rejected",
+                    issueCode: "submission_malformed",
+                    message: edgeReasoningIncoming.reason,
+                });
                 return { action: "continue" };
             }
             if (edgeReasoningIncoming.status === "ok") {
@@ -283,18 +268,23 @@ export async function handleGraphEnrichmentBranch(params, bundle, state, analyze
                 // so the same "exactly one array-valued top-level property" rule
                 // applies, and a bare rewrites array is accepted too); anything else is
                 // quarantined and named in the re-emitted step's prompt.
-                const unwrapped = unwrapIncomingArray(edgeReasoningIncoming.value);
+                const unwrapped = unwrapSubmissionArray(edgeReasoningIncoming.value);
                 if (!unwrapped.ok) {
-                    const quarantinePath = await quarantineIncomingFile(params.artifactsDir, edgeReasoningIncoming.path, "edge-reasoning.json");
+                    const quarantinePath = await quarantineSubmissionFile(params.artifactsDir, edgeReasoningIncoming.path, GATE_LANES.edge_reasoning);
                     await recordEdgeReasoningRejection(params.artifactsDir, {
-                        filename: "edge-reasoning.json",
+                        lane: GATE_LANES.edge_reasoning,
                         quarantine_path: quarantinePath,
                         reason: unwrapped.reason,
                         rejected_at: new Date().toISOString(),
                     });
+                    await recordLaneOutcome(params.artifactsDir, GATE_LANES.edge_reasoning, {
+                        kind: "rejected",
+                        issueCode: "submission_contract_invalid",
+                        message: unwrapped.reason,
+                    });
                     return { action: "continue" };
                 }
-                // Apply BEFORE deleting the incoming file: if runStep throws (locks,
+                // Apply BEFORE deleting the submission: if runStep throws (locks,
                 // crash), the submission survives for the retry instead of being lost.
                 await runStep({
                     root: params.root,
@@ -306,6 +296,9 @@ export async function handleGraphEnrichmentBranch(params, bundle, state, analyze
                 });
                 await unlink(edgeReasoningIncoming.path).catch(() => { });
                 await clearEdgeReasoningRejection(params.artifactsDir);
+                await recordLaneOutcome(params.artifactsDir, GATE_LANES.edge_reasoning, {
+                    kind: "accepted",
+                });
                 return { action: "continue" };
             }
             return { action: "return", result: { kind: "edge_reasoning", state, bundle, candidates } };
@@ -317,11 +310,11 @@ export async function handleGraphEnrichmentBranch(params, bundle, state, analyze
     return { action: "fallthrough" };
 }
 /**
- * Handle the `design_review_contract` or `design_review_conceptual` incoming-artifact
- * polling blocks. Checks for contract and/or conceptual findings files independently.
+ * Handle the `design_review_contract` or `design_review_conceptual` submission
+ * polling blocks. Checks the contract and conceptual lanes independently.
  *
  * Returns:
- *   - `continue`               → one or both incoming files were consumed; keep folding.
+ *   - `continue`               → one or both lane submissions were consumed; keep folding.
  *   - `design_review_parallel` → both passes still needed; dispatch two subagents.
  *   - `design_review_contract` → only contract pass still needed.
  *   - `design_review_conceptual` → only conceptual pass still needed.
@@ -333,37 +326,17 @@ function passIsStale(bundle, pass) {
     const snapshot = bundle.design_review_snapshots?.[pass];
     return snapshot ? isDesignReviewStale(snapshot, bundle) : false;
 }
-/** Human-readable description of why an incoming value is neither an array nor a single-array-wrapped object. */
-function describeIncomingShapeMismatch(value) {
-    if (value === null)
-        return "null";
-    if (Array.isArray(value))
-        return "an array"; // reachable from consumeObjectIncoming (an array is not a key→value map)
-    const t = typeof value;
-    if (t !== "object")
-        return `a bare ${t}`;
-    const entries = Object.entries(value);
-    if (entries.length === 0)
-        return "an empty object";
-    const arrayKeys = entries.filter(([, v]) => Array.isArray(v)).map(([k]) => k);
-    const allKeys = entries.map(([k]) => k).join(", ");
-    if (arrayKeys.length === 0) {
-        return `an object with no array-valued properties (keys: ${allKeys})`;
-    }
-    return (`an object with ${arrayKeys.length} array-valued propert${arrayKeys.length === 1 ? "y" : "ies"} ` +
-        `out of ${entries.length} total key(s) (${allKeys}) — exactly one top-level array property is ` +
-        `required for the tolerant unwrap`);
-}
 /**
- * Move a malformed incoming submission to `<artifactsDir>/quarantine/` rather
- * than deleting it. Falls back to copy+unlink if `rename` fails (e.g. a
- * cross-device incoming/ mount) so the content is never lost.
+ * Move a refused submission to `<artifactsDir>/quarantine/` rather than
+ * deleting it. Falls back to copy+unlink if `rename` fails (e.g. a cross-device
+ * artifacts mount) so the content is never lost. The quarantined file is named
+ * for its LANE — the bound path is a digest, which tells an operator nothing.
  */
-async function quarantineIncomingFile(artifactsDir, filePath, originalFilename) {
+async function quarantineSubmissionFile(artifactsDir, filePath, lane) {
     const quarantineDir = join(artifactsDir, "quarantine");
     await mkdir(quarantineDir, { recursive: true });
     const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
-    const quarantinePath = join(quarantineDir, `${originalFilename}.${timestamp}.json`);
+    const quarantinePath = join(quarantineDir, `${lane}.${timestamp}.json`);
     try {
         await rename(filePath, quarantinePath);
     }
@@ -381,94 +354,165 @@ async function quarantineIncomingFile(artifactsDir, filePath, originalFilename)
 }
 /**
  * Quarantine a submission that failed zod validation — or failed to parse as
- * JSON at all (a plain string reason): move it out of `incoming/` (never
- * unlink-and-discard) and write a stderr diagnostic naming the quarantined
- * file + the error. The single loud-quarantine path shared by every
- * schema-validated incoming gate (`runOmittableGate` + `handleIntentEquivalenceBranch`
- * + the charter lane loop) so the "quarantine loudly" property cannot drift
- * between them. Returns the quarantine path.
+ * JSON at all (a plain string reason): move it off its bound path (never
+ * unlink-and-discard), write a stderr diagnostic naming the quarantined file +
+ * the error, and record the refusal on the submission ledger so a repaired run
+ * stays distinguishable from a clean one. The single loud-quarantine path
+ * shared by every schema-validated gate (`runOmittableGate` +
+ * `handleIntentEquivalenceBranch` + the charter lane loop) so the "quarantine
+ * loudly" property cannot drift between them. Returns the quarantine path.
  */
-async function quarantineMisshapedIncoming(artifactsDir, filePath, filename, error) {
+async function quarantineMisshapedSubmission(artifactsDir, filePath, lane, error) {
     const reason = typeof error === "string"
         ? error
         : error.issues
             .map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`)
             .join("; ");
-    const quarantinePath = await quarantineIncomingFile(artifactsDir, filePath, filename);
-    process.stderr.write(`[audit-code] ${filename} quarantined to ${quarantinePath}: ${reason}. ` +
+    const quarantinePath = await quarantineSubmissionFile(artifactsDir, filePath, lane);
+    process.stderr.write(`[audit-code] ${lane} submission quarantined to ${quarantinePath}: ${reason}. ` +
         `Fix the shape and resubmit.\n`);
+    await recordLaneOutcome(artifactsDir, lane, {
+        kind: "rejected",
+        issueCode: typeof error === "string" ? "submission_malformed" : "submission_contract_invalid",
+        message: reason,
+    });
     return quarantinePath;
 }
 /**
- * The single tolerant-unwrap rule: a bare array is accepted as-is; a top-level
- * object wrapping exactly one array-valued property is unambiguous and is
- * accepted as that array. Anything else fails with a shape description.
- * Single-sourced so `consumeArrayIncoming` and the edge-reasoning gate cannot
- * drift on what shapes are accepted.
- */
-function unwrapIncomingArray(value) {
-    if (Array.isArray(value))
-        return { ok: true, array: value };
-    if (value !== null && typeof value === "object") {
-        const entries = Object.entries(value);
-        if (entries.length === 1 && Array.isArray(entries[0][1])) {
-            return { ok: true, array: entries[0][1] };
-        }
-    }
-    return { ok: false, reason: describeIncomingShapeMismatch(value) };
-}
-/**
- * Read a JSON `incoming/` file expected to be an array (or a top-level object
+ * Read a lane submission expected to be an array (or a top-level object
  * wrapping exactly one array-valued property, the tolerant unwrap). Accepts
- * either shape and deletes the source file; any other shape is quarantined
- * (never unlinked-and-discarded) and reported with a reason.
+ * either shape; any other shape is quarantined (never unlinked-and-discarded)
+ * and reported with a reason.
+ *
+ * An accepted submission is NOT deleted here (P25-f) — the caller unlinks after
+ * it has applied the value, so a submission is never destroyed before its
+ * content has landed somewhere else.
  */
-export async function consumeArrayIncoming(artifactsDir, filename) {
-    const incoming = await tryConsumeIncoming(artifactsDir, filename);
+export async function consumeArraySubmission(artifactsDir, lane) {
+    const incoming = await tryConsumeSubmission(artifactsDir, lane);
     if (incoming.status === "absent")
         return { status: "absent" };
     if (incoming.status === "malformed") {
-        const quarantinePath = await quarantineIncomingFile(artifactsDir, incoming.path, filename);
-        return { status: "quarantined", quarantinePath, originalFilename: filename, reason: incoming.reason };
+        const quarantinePath = await quarantineSubmissionFile(artifactsDir, incoming.path, lane);
+        await recordLaneOutcome(artifactsDir, lane, {
+            kind: "rejected",
+            issueCode: "submission_malformed",
+            message: incoming.reason,
+        });
+        return { status: "quarantined", quarantinePath, lane, reason: incoming.reason };
     }
     const { value, path } = incoming;
-    const unwrapped = unwrapIncomingArray(value);
+    const unwrapped = unwrapSubmissionArray(value);
     if (unwrapped.ok) {
-        await unlink(path).catch(() => { });
         return { status: "ok", value: unwrapped.array, path };
     }
-    const quarantinePath = await quarantineIncomingFile(artifactsDir, path, filename);
-    return { status: "quarantined", quarantinePath, originalFilename: filename, reason: unwrapped.reason };
+    const quarantinePath = await quarantineSubmissionFile(artifactsDir, path, lane);
+    await recordLaneOutcome(artifactsDir, lane, {
+        kind: "rejected",
+        issueCode: "submission_contract_invalid",
+        message: unwrapped.reason,
+    });
+    return { status: "quarantined", quarantinePath, lane, reason: unwrapped.reason };
 }
 /**
- * Read a JSON `incoming/` file expected to be a plain top-level object (a
- * key → value map, e.g. analyzer-decisions.json). A non-object value — null,
+ * Read a lane submission expected to be a plain top-level object (a
+ * key → value map, e.g. the analyzer decisions). A non-object value — null,
  * an array, a bare primitive — is quarantined with a stderr diagnostic rather
- * than left lingering in `incoming/` (where it used to make the emitting step
- * re-ask silently forever). Unlike `consumeArrayIncoming`, an accepted file is
- * NOT deleted here — the caller unlinks after applying, so a crash mid-apply
- * retains the submission for the retry.
+ * than left lingering at the bound path (where it used to make the emitting
+ * step re-ask silently forever). An accepted file is NOT deleted here — the
+ * caller unlinks after applying, so a crash mid-apply retains the submission
+ * for the retry.
  */
-export async function consumeObjectIncoming(artifactsDir, filename) {
-    const incoming = await tryConsumeIncoming(artifactsDir, filename);
+export async function consumeObjectSubmission(artifactsDir, lane) {
+    const incoming = await tryConsumeSubmission(artifactsDir, lane);
     if (incoming.status === "absent")
         return { status: "absent" };
     if (incoming.status === "malformed") {
-        const quarantinePath = await quarantineIncomingFile(artifactsDir, incoming.path, filename);
-        process.stderr.write(`[audit-code] ${filename} quarantined to ${quarantinePath}: ${incoming.reason}. ` +
+        const quarantinePath = await quarantineSubmissionFile(artifactsDir, incoming.path, lane);
+        process.stderr.write(`[audit-code] ${lane} submission quarantined to ${quarantinePath}: ${incoming.reason}. ` +
             `Fix the JSON and resubmit.\n`);
+        await recordLaneOutcome(artifactsDir, lane, {
+            kind: "rejected",
+            issueCode: "submission_malformed",
+            message: incoming.reason,
+        });
         return { status: "quarantined", quarantinePath, reason: incoming.reason };
     }
     const { value, path } = incoming;
-    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
-        return { status: "ok", value: value, path };
+    if (isSubmissionObjectMap(value)) {
+        return { status: "ok", value, path };
     }
-    const reason = describeIncomingShapeMismatch(value);
-    const quarantinePath = await quarantineIncomingFile(artifactsDir, path, filename);
-    process.stderr.write(`[audit-code] ${filename} quarantined to ${quarantinePath}: expected a JSON object, got ${reason}. ` +
+    const reason = describeSubmissionShapeMismatch(value);
+    const quarantinePath = await quarantineSubmissionFile(artifactsDir, path, lane);
+    process.stderr.write(`[audit-code] ${lane} submission quarantined to ${quarantinePath}: expected a JSON object, got ${reason}. ` +
         `Fix the shape and resubmit.\n`);
+    await recordLaneOutcome(artifactsDir, lane, {
+        kind: "rejected",
+        issueCode: "submission_contract_invalid",
+        message: reason,
+    });
     return { status: "quarantined", quarantinePath, reason };
 }
+/** The two decision vocabularies the operator-facing analyzer gates accept. */
+const ANALYZER_CONSENT_VALUES = ["granted", "declined"];
+const ANALYZER_SETTING_VALUES = [
+    "ephemeral",
+    "permanent",
+    "skip",
+    "repo",
+    "auto",
+];
+/** Name the keys that carried no recognized value, for the ledger event. */
+function describeIgnoredKeys(ignored, allowed) {
+    return (`ignored ${ignored.length} unrecognized entr${ignored.length === 1 ? "y" : "ies"} ` +
+        `(${ignored.join(", ")}); recognized values are: ${allowed.join(", ")}`);
+}
+/**
+ * Read a decisions submission — a `{ "<id>": "<one of a fixed vocabulary>" }`
+ * map — for the two operator-facing analyzer gates.
+ *
+ * The value-enum filter used to be per-gate, and both copies treated a
+ * submission with ZERO recognized values as a SUCCESS: nothing was applied, the
+ * file was deleted, and an `accepted` event went on the ledger, so a host that
+ * answered in the wrong vocabulary had its answer destroyed, the run recorded
+ * as clean, and the identical step re-emitted. A submission that says nothing
+ * the gate understands is a refusal: it is quarantined (bytes kept), recorded
+ * `rejected`, and re-asked. PARTIAL recognition still applies — the operator's
+ * real decisions are not held hostage to one typo — with the ignored keys named
+ * on the accepting event so the omission is on the record rather than in a
+ * stderr line nobody kept.
+ */
+async function consumeEnumMapSubmission(artifactsDir, lane, allowed) {
+    const incoming = await consumeObjectSubmission(artifactsDir, lane);
+    if (incoming.status === "absent")
+        return { status: "absent" };
+    if (incoming.status === "quarantined")
+        return { status: "quarantined" };
+    const values = {};
+    const ignored = [];
+    for (const [id, value] of Object.entries(incoming.value)) {
+        if (allowed.includes(value)) {
+            values[id] = value;
+        }
+        else {
+            ignored.push(id);
+        }
+    }
+    if (Object.keys(values).length > 0) {
+        return { status: "ok", values, ignored, path: incoming.path };
+    }
+    const reason = `no recognized values (got: ${Object.keys(incoming.value).join(", ") || "(none)"}). ` +
+        `Valid values are: ${allowed.join(", ")}.`;
+    const quarantinePath = await quarantineSubmissionFile(artifactsDir, incoming.path, lane);
+    process.stderr.write(`[audit-code] ${lane} submission quarantined to ${quarantinePath}: ${reason} ` +
+        `Fix the values and resubmit.\n`);
+    await recordLaneOutcome(artifactsDir, lane, {
+        kind: "rejected",
+        issueCode: "submission_contract_invalid",
+        message: reason,
+    });
+    return { status: "quarantined" };
+}
 function edgeReasoningRejectionPath(artifactsDir) {
     return join(artifactsDir, "quarantine", "edge-reasoning.rejection.json");
 }
@@ -502,27 +546,38 @@ export async function renderEdgeReasoningRejectionNotice(artifactsDir) {
         "Your last edge-reasoning submission did not match the expected shape and was " +
             "quarantined (not applied, not silently discarded). Fix the shape and resubmit:",
         "",
-        `- \`${rejection.filename}\` quarantined to \`${rejection.quarantine_path}\` (${rejection.rejected_at}): ${rejection.reason}`,
+        `- lane \`${rejection.lane}\` quarantined to \`${rejection.quarantine_path}\` (${rejection.rejected_at}): ${rejection.reason}`,
         "",
         'Expected shape: {"rewrites":[{"from":"...","to":"...","kind":"...","reason":"..."}]} — ' +
             "a bare JSON array of rewrites is also accepted.",
     ].join("\n");
 }
 /**
- * Record a quarantined design-review submission on `design_assessment` (and
- * persist immediately) so the note survives the same-call `continue`
- * re-derivation. A no-op when `design_assessment` doesn't exist yet — in
- * practice unreachable, since `design_assessment_current` is a
- * higher-priority obligation than either design-review pass (PRIORITY in
- * nextStep.ts), so `design_assessment` always exists by the time this branch
- * runs.
+ * Record a quarantined design-review submission.
+ *
+ * TWO homes, because they answer different questions and one of them can be
+ * absent. `design_assessment.rejected_submissions` is what the re-emitted step
+ * reads back to tell the host WHY its last submission was refused — so it is
+ * written whenever there is an assessment to write it on. The submission ledger
+ * is the durable record that a refusal happened at all, and it is written
+ * unconditionally.
+ *
+ * This function used to open `if (!existing) return;`, which meant the one case
+ * where a submission had no merge target — exactly the case where the host most
+ * needs to be told something went wrong — recorded nothing anywhere. The
+ * ledger closes that hole without inventing a partial `design_assessment.json`
+ * for an assessment that does not exist yet: every quarantine reaches it, but
+ * through the ONE site that performs the quarantine (`consumeArraySubmission`,
+ * or `holdWithoutTarget` for the no-merge-target case), never a second append
+ * here. Two appends per refusal made a single rejection read as two on a record
+ * whose whole value is counting them.
  */
 async function recordRejectedDesignReviewSubmission(artifactsDir, existing, pass, quarantined) {
     if (!existing)
         return;
     const entry = {
         pass,
-        filename: quarantined.originalFilename,
+        lane: quarantined.lane,
         quarantine_path: quarantined.quarantinePath,
         reason: quarantined.reason,
         rejected_at: new Date().toISOString(),
@@ -552,7 +607,7 @@ export function renderDesignReviewRejectionNotice(bundle, passes) {
         "",
     ];
     for (const r of rejected) {
-        lines.push(`- **${r.pass}** — \`${r.filename}\` quarantined to \`${r.quarantine_path}\` (${r.rejected_at}): ${r.reason}`);
+        lines.push(`- **${r.pass}** — lane \`${r.lane}\` quarantined to \`${r.quarantine_path}\` (${r.rejected_at}): ${r.reason}`);
     }
     lines.push("", "Expected shape: a JSON array of findings, or a top-level object wrapping exactly " +
         'one array-valued property (e.g. `{"findings": [...]}`).');
@@ -560,9 +615,42 @@ export function renderDesignReviewRejectionNotice(bundle, passes) {
 }
 export async function handleDesignReviewBranch(params, bundle, state) {
     const existing = bundle.design_assessment;
-    // Legacy: consume old combined findings file. Tolerant-unwrap or quarantine
-    // (never a bare unconditional delete) — see the quarantine block comment above.
-    const legacyResult = await consumeArrayIncoming(params.artifactsDir, "design-review-findings.json");
+    /**
+     * P25-f: a valid submission with nowhere to merge it is HELD and RECORDED,
+     * never consumed-and-dropped. `design_assessment` is normally present by the
+     * time this branch runs (`design_assessment_current` outranks both review
+     * passes in PRIORITY) — but that is a reasoning argument, and the old code
+     * relied on it: it deleted the file at unwrap time and then skipped the merge
+     * on `&& existing`, destroying valid work and re-emitting the identical step
+     * with zero signal to the host. Quarantining keeps the bytes and puts the
+     * refusal on the record, so the next pass can still use them.
+     */
+    const holdWithoutTarget = async (pass, lane, path) => {
+        const reason = "no design assessment exists yet to merge this submission into";
+        const quarantinePath = await quarantineSubmissionFile(params.artifactsDir, path, lane);
+        process.stderr.write(`[audit-code] ${lane} submission quarantined to ${quarantinePath}: no design ` +
+            `assessment exists yet to merge it into. Re-run next-step; the assessment is ` +
+            `built by a higher-priority obligation.\n`);
+        // The ledger append belongs to the site that performs the quarantine — this
+        // is the one quarantine `consumeArraySubmission` does not do — so a refusal
+        // is recorded exactly once no matter which path refused it. With no
+        // assessment on disk there is no `rejected_submissions` note to write, and
+        // this event is the only durable record that the submission was received.
+        await recordLaneOutcome(params.artifactsDir, lane, {
+            kind: "rejected",
+            issueCode: "submission_rejected",
+            message: `${pass} pass: ${reason}`,
+        });
+        await recordRejectedDesignReviewSubmission(params.artifactsDir, existing, pass, {
+            status: "quarantined",
+            quarantinePath,
+            lane,
+            reason,
+        });
+    };
+    // Legacy: consume the old combined findings submission. Tolerant-unwrap or
+    // quarantine (never a bare unconditional delete) — see the block comment above.
+    const legacyResult = await consumeArraySubmission(params.artifactsDir, GATE_LANES.design_review_legacy);
     if (legacyResult.status === "quarantined") {
         await recordRejectedDesignReviewSubmission(params.artifactsDir, existing, "legacy", legacyResult);
         return { action: "continue" };
@@ -573,15 +661,19 @@ export async function handleDesignReviewBranch(params, bundle, state) {
             existing.reviewed = true;
             existing.rejected_submissions = (existing.rejected_submissions ?? []).filter((r) => r.pass !== "legacy");
             await writeJsonFile(join(params.artifactsDir, "design_assessment.json"), existing);
+            await unlink(legacyResult.path).catch(() => { });
+            await recordLaneOutcome(params.artifactsDir, GATE_LANES.design_review_legacy, {
+                kind: "accepted",
+            });
             return { action: "continue" };
         }
-        // File consumed but no target to merge into — keep folding.
+        await holdWithoutTarget("legacy", GATE_LANES.design_review_legacy, legacyResult.path);
         return { action: "continue" };
     }
     // absent: fall through to the contract/conceptual check.
     // New: consume contract-findings and/or conceptual-findings independently.
-    const contractResult = await consumeArrayIncoming(params.artifactsDir, "design-review-contract-findings.json");
-    const conceptualResult = await consumeArrayIncoming(params.artifactsDir, "design-review-conceptual-findings.json");
+    const contractResult = await consumeArraySubmission(params.artifactsDir, GATE_LANES.design_review_contract);
+    const conceptualResult = await consumeArraySubmission(params.artifactsDir, GATE_LANES.design_review_conceptual);
     let consumed = false;
     if (contractResult.status === "quarantined") {
         await recordRejectedDesignReviewSubmission(params.artifactsDir, existing, "contract", contractResult);
@@ -592,6 +684,9 @@ export async function handleDesignReviewBranch(params, bundle, state) {
         existing.rejected_submissions = (existing.rejected_submissions ?? []).filter((r) => r.pass !== "contract");
         consumed = true;
     }
+    else if (contractResult.status === "ok") {
+        await holdWithoutTarget("contract", GATE_LANES.design_review_contract, contractResult.path);
+    }
     if (conceptualResult.status === "quarantined") {
         await recordRejectedDesignReviewSubmission(params.artifactsDir, existing, "conceptual", conceptualResult);
     }
@@ -601,6 +696,9 @@ export async function handleDesignReviewBranch(params, bundle, state) {
         existing.rejected_submissions = (existing.rejected_submissions ?? []).filter((r) => r.pass !== "conceptual");
         consumed = true;
     }
+    else if (conceptualResult.status === "ok") {
+        await holdWithoutTarget("conceptual", GATE_LANES.design_review_conceptual, conceptualResult.path);
+    }
     if (consumed && existing) {
         await writeJsonFile(join(params.artifactsDir, "design_assessment.json"), existing);
         // Snapshot each just-completed pass (B2 parity port): record the verdict +
@@ -611,9 +709,19 @@ export async function handleDesignReviewBranch(params, bundle, state) {
         const reviewedAt = new Date().toISOString();
         if (contractResult.status === "ok") {
             await captureDesignReviewSnapshot(params.artifactsDir, "contract", existing.contract_findings ?? [], bundle, reviewedAt);
+            // Unlink only now: the findings are persisted and snapshotted, so the
+            // submission's content survives its own deletion.
+            await unlink(contractResult.path).catch(() => { });
+            await recordLaneOutcome(params.artifactsDir, GATE_LANES.design_review_contract, {
+                kind: "accepted",
+            });
         }
         if (conceptualResult.status === "ok") {
             await captureDesignReviewSnapshot(params.artifactsDir, "conceptual", existing.conceptual_findings ?? [], bundle, reviewedAt);
+            await unlink(conceptualResult.path).catch(() => { });
+            await recordLaneOutcome(params.artifactsDir, GATE_LANES.design_review_conceptual, {
+                kind: "accepted",
+            });
         }
         return { action: "continue" };
     }
@@ -636,28 +744,29 @@ export async function handleDesignReviewBranch(params, bundle, state) {
     return { action: "continue" };
 }
 /**
- * Drive one "poll incoming → apply+continue, else omit-or-return" gate — the
+ * Drive one "poll the lane → apply+continue, else omit-or-return" gate — the
  * shape common to synthesis_narrative, charter_extraction,
  * charter_clarification, and systemic_challenge. See the section comment
  * above for the two gates that deviate and are not run through this engine.
  */
 async function runOmittableGate(descriptor, params, bundle, state) {
-    const incoming = await tryConsumeIncoming(params.artifactsDir, descriptor.filename);
+    const incoming = await tryConsumeSubmission(params.artifactsDir, descriptor.lane);
     if (incoming.status === "malformed") {
         // Not-JSON submission: same quarantine-loudly lifecycle as a mis-shaped one.
-        await quarantineMisshapedIncoming(params.artifactsDir, incoming.path, descriptor.filename, incoming.reason);
+        await quarantineMisshapedSubmission(params.artifactsDir, incoming.path, descriptor.lane, incoming.reason);
     }
     else if (incoming.status === "ok") {
         const parsed = descriptor.schema.safeParse(incoming.value);
         if (parsed.success) {
             await descriptor.apply(parsed.data, incoming.path, params);
             await unlink(incoming.path).catch(() => { });
+            await recordLaneOutcome(params.artifactsDir, descriptor.lane, { kind: "accepted" });
             return { action: "continue" };
         }
         // Mis-shaped submission: quarantine loudly and fall through to
         // shouldOmit/return — never hand it to the executor to crash on or silently
         // treat as an empty "reviewed, found nothing" result.
-        await quarantineMisshapedIncoming(params.artifactsDir, incoming.path, descriptor.filename, parsed.error);
+        await quarantineMisshapedSubmission(params.artifactsDir, incoming.path, descriptor.lane, parsed.error);
     }
     if (descriptor.shouldOmit(bundle)) {
         return { action: "run_omit" };
@@ -665,9 +774,9 @@ async function runOmittableGate(descriptor, params, bundle, state) {
     return { action: "return", result: { kind: descriptor.kind, state, bundle } };
 }
 /**
- * Handle the `synthesis_narrative_executor` incoming-artifact polling block.
+ * Handle the `synthesis_narrative_executor` submission-polling block.
  * Returns:
- *   - `continue`  → an incoming narrative file was consumed + applied (progress
+ *   - `continue`  → a narrative submission was consumed + applied (progress
  *     made); re-scan on the reloaded bundle.
  *   - `return`    → a host turn is still needed (narrative enabled, none supplied
  *     yet); emit the synthesis_narrative step.
@@ -679,8 +788,8 @@ async function runOmittableGate(descriptor, params, bundle, state) {
 export async function handleSynthesisNarrativeBranch(params, bundle, state) {
     return runOmittableGate({
         kind: "synthesis_narrative",
-        filename: "synthesis-narrative.json",
-        schema: SynthesisNarrativeSchema,
+        lane: GATE_LANES.synthesis_narrative,
+        schema: LANE_SUBMISSION_SCHEMAS[GATE_LANES.synthesis_narrative],
         apply: async (_value, path, p) => {
             await runAuditStep({
                 root: p.root,
@@ -705,14 +814,14 @@ export async function handleSynthesisNarrativeBranch(params, bundle, state) {
  *   - `return`    → a prose-only delta awaits the host judge; emit the step.
  */
 export async function handleIntentEquivalenceBranch(params, bundle, state) {
-    const filename = "intent-equivalence-verdict.json";
-    const incoming = await tryConsumeIncoming(params.artifactsDir, filename);
+    const lane = GATE_LANES.intent_equivalence;
+    const incoming = await tryConsumeSubmission(params.artifactsDir, lane);
     if (incoming.status === "malformed") {
-        await quarantineMisshapedIncoming(params.artifactsDir, incoming.path, filename, incoming.reason);
+        await quarantineMisshapedSubmission(params.artifactsDir, incoming.path, lane, incoming.reason);
         // Fall through: no valid submission — re-emit or deterministically resolve.
     }
     else if (incoming.status === "ok") {
-        const parsed = IntentEquivalenceVerdictSchema.safeParse(incoming.value);
+        const parsed = LANE_SUBMISSION_SCHEMAS[lane].safeParse(incoming.value);
         if (parsed.success) {
             await runAuditStep({
                 root: params.root,
@@ -721,9 +830,10 @@ export async function handleIntentEquivalenceBranch(params, bundle, state) {
                 intentEquivalenceVerdictPath: incoming.path,
             });
             await unlink(incoming.path).catch(() => { });
+            await recordLaneOutcome(params.artifactsDir, lane, { kind: "accepted" });
             return { action: "continue" };
         }
-        await quarantineMisshapedIncoming(params.artifactsDir, incoming.path, filename, parsed.error);
+        await quarantineMisshapedSubmission(params.artifactsDir, incoming.path, lane, parsed.error);
         // Fall through: no valid submission — re-emit or deterministically resolve.
     }
     if (deriveIntentEquivalenceStatus(bundle).kind !== "prose_judgment_pending") {
@@ -732,7 +842,7 @@ export async function handleIntentEquivalenceBranch(params, bundle, state) {
     return { action: "return", result: { kind: "intent_equivalence", state, bundle } };
 }
 /**
- * Handle the `critical_flow_fallback_executor` incoming-artifact polling block.
+ * Handle the `critical_flow_fallback_executor` submission-polling block.
  * The obligation is only ever selected when the deterministic flow inference
  * marked itself below the confidence bar (`critical_flows.fallback_required`),
  * so — unlike the synthesis-narrative / charter gates — there is NO autonomous
@@ -746,8 +856,8 @@ export async function handleIntentEquivalenceBranch(params, bundle, state) {
 export async function handleCriticalFlowFallbackBranch(params, bundle, state) {
     return runOmittableGate({
         kind: "critical_flow_fallback",
-        filename: "critical-flow-fallback.json",
-        schema: CriticalFlowFallbackResultSchema,
+        lane: GATE_LANES.critical_flow_fallback,
+        schema: LANE_SUBMISSION_SCHEMAS[GATE_LANES.critical_flow_fallback],
         apply: async (_value, path, p) => {
             await runAuditStep({
                 root: p.root,
@@ -762,9 +872,9 @@ export async function handleCriticalFlowFallbackBranch(params, bundle, state) {
     }, params, bundle, state);
 }
 /**
- * Handle the `charter_extraction_executor` incoming-artifact polling block
+ * Handle the `charter_extraction_executor` submission-polling block
  * (Phase C). Mirrors the synthesis-narrative branch:
- *   - a pending `incoming/charter-extraction.json` → assemble+gate it via the
+ *   - every per-kind lane present and valid → assemble+gate the merge via the
  *     preferred executor (ingest), then `continue`;
  *   - otherwise a `shallow` ceiling → `run_omit` (the deterministic executor
  *     writes an empty `status:omitted` register — the conversation-first default,
@@ -793,42 +903,22 @@ export async function handleCharterExtractionBranch(params, bundle, state) {
     const laneValues = new Map();
     let quarantinedAny = false;
     for (const kind of kinds) {
-        const filename = `charter-extraction-${kind}.json`;
-        const incoming = await tryConsumeIncoming(params.artifactsDir, filename);
+        const lane = charterExtractionLane(kind);
+        const incoming = await tryConsumeSubmission(params.artifactsDir, lane);
         if (incoming.status === "absent")
             continue;
         if (incoming.status === "malformed") {
             quarantinedAny = true;
-            await quarantineMisshapedIncoming(params.artifactsDir, incoming.path, filename, incoming.reason);
+            await quarantineMisshapedSubmission(params.artifactsDir, incoming.path, lane, incoming.reason);
             continue;
         }
-        const laneSchema = CharterSubmissionSchema.superRefine((submission, ctx) => {
-            submission.nodes.forEach((node, ni) => {
-                if (node.kind !== kind) {
-                    ctx.addIssue({
-                        code: "custom",
-                        path: ["nodes", ni, "kind"],
-                        message: `lane '${kind}' may only carry kind '${kind}', got '${node.kind}'`,
-                    });
-                }
-                const unknown = node.files.filter((f) => !universe.has(f));
-                if (unknown.length > 0) {
-                    ctx.addIssue({
-                        code: "custom",
-                        path: ["nodes", ni, "files"],
-                        message: `teleology node cites file(s) outside the repo: ${unknown.sort().join(", ")} — ` +
-                            "scopes must be repo-relative paths exactly as the evidence packet names them",
-                    });
-                }
-            });
-        });
-        const parsed = laneSchema.safeParse(incoming.value);
+        const parsed = charterLaneSchema(kind, universe).safeParse(incoming.value);
         if (parsed.success) {
             laneValues.set(kind, { value: parsed.data, path: incoming.path });
         }
         else {
             quarantinedAny = true;
-            await quarantineMisshapedIncoming(params.artifactsDir, incoming.path, filename, parsed.error);
+            await quarantineMisshapedSubmission(params.artifactsDir, incoming.path, lane, parsed.error);
         }
     }
     if (!quarantinedAny && laneValues.size === kinds.length) {
@@ -842,7 +932,10 @@ export async function handleCharterExtractionBranch(params, bundle, state) {
         const merged = {
             nodes: kinds.flatMap((kind) => laneValues.get(kind).value.nodes),
         };
-        const mergedPath = join(params.artifactsDir, "incoming", "charter-extraction.json");
+        // The merged submission is TOOL-written, so it lives with the other lane
+        // assets rather than under `submissions/` (which holds only what a host
+        // wrote). It is handed to the executor by path and deleted after ingest.
+        const mergedPath = join(laneAssetsDir(params.artifactsDir), CHARTER_EXTRACTION_MERGED_FILENAME);
         await writeJsonFile(mergedPath, merged);
         await runAuditStep({
             root: params.root,
@@ -851,13 +944,16 @@ export async function handleCharterExtractionBranch(params, bundle, state) {
             charterSubmissionPath: mergedPath,
         });
         await unlink(mergedPath).catch(() => { });
-        for (const lane of laneValues.values()) {
+        for (const [kind, lane] of laneValues.entries()) {
             await unlink(lane.path).catch(() => { });
+            await recordLaneOutcome(params.artifactsDir, charterExtractionLane(kind), {
+                kind: "accepted",
+            });
         }
         // Evidence packets are consumed inputs like the lane submissions — a stale
         // packet left behind would feed a later re-extraction yesterday's evidence.
         for (const kind of kinds) {
-            await unlink(join(params.artifactsDir, "incoming", `charter-extraction-${kind}-packet.md`)).catch(() => { });
+            await unlink(join(laneAssetsDir(params.artifactsDir), charterExtractionPacketFilename(kind))).catch(() => { });
         }
         return { action: "continue" };
     }
@@ -866,9 +962,9 @@ export async function handleCharterExtractionBranch(params, bundle, state) {
     return { action: "return", result: { kind: "charter_extraction", state, bundle } };
 }
 /**
- * Handle the `charter_delta_executor` incoming-artifact polling block (Phase C.2 —
+ * Handle the `charter_delta_executor` submission-polling block (Phase C.2 —
  * the INDEPENDENT delta-miner). Mirrors the charter-extraction branch:
- *   - a pending `incoming/charter-delta.json` → route+gate it via the preferred
+ *   - a pending `charter_delta` lane submission → route+gate it via the preferred
  *     executor (ingest), then `continue`;
  *   - otherwise, when the register is NOT `deltas_pending` (extraction omitted, or
  *     found no subsystems to mine) → `run_omit` (the deterministic executor settles
@@ -879,8 +975,8 @@ export async function handleCharterExtractionBranch(params, bundle, state) {
 export async function handleCharterDeltaBranch(params, bundle, state) {
     return runOmittableGate({
         kind: "charter_delta",
-        filename: "charter-delta.json",
-        schema: CharterDeltaSubmissionSchema,
+        lane: GATE_LANES.charter_delta,
+        schema: LANE_SUBMISSION_SCHEMAS[GATE_LANES.charter_delta],
         apply: async (_value, path, p) => {
             await runAuditStep({
                 root: p.root,
@@ -899,7 +995,7 @@ export async function handleCharterDeltaBranch(params, bundle, state) {
  * loop). Mirrors the charter-extraction branch, but the loop is DETERMINISTIC — the
  * executor assembles asked/banked from the Phase-C `charter_register` deltas, so the
  * host turn only surfaces the VOI-ranked interactive queue for relay:
- *   - a pending `incoming/charter-clarification.json` (host answers) → assemble via
+ *   - a pending `charter_clarification` lane submission (host answers) → assemble via
  *     the deterministic runner, then `continue`;
  *   - a `shallow` ceiling OR zero attention → `run_omit` (the runner writes the
  *     register autonomously — every question banks as a finding, no host turn);
@@ -911,8 +1007,8 @@ export async function handleCharterDeltaBranch(params, bundle, state) {
 export async function handleCharterClarificationBranch(params, bundle, state) {
     return runOmittableGate({
         kind: "charter_clarification",
-        filename: "charter-clarification.json",
-        schema: ClarificationAnswersSubmissionSchema,
+        lane: GATE_LANES.charter_clarification,
+        schema: LANE_SUBMISSION_SCHEMAS[GATE_LANES.charter_clarification],
         apply: async (_value, path, p) => {
             await runAuditStep({
                 root: p.root,
@@ -945,7 +1041,7 @@ export async function handleCharterClarificationBranch(params, bundle, state) {
 /**
  * Handle the `systemic_challenge_executor` obligation (Phase E — the second-order
  * adversary loop-until-dry pass). Mirrors the charter-clarification branch:
- *   - a pending `incoming/systemic-challenge.json` (an adversary round's findings) →
+ *   - a pending `systemic_challenge` lane submission (an adversary round's findings) →
  *     fold it via the deterministic runner, then `continue`;
  *   - a `shallow` ceiling → `run_omit` (the runner writes an omitted register
  *     autonomously, no host turn);
@@ -959,8 +1055,8 @@ export async function handleCharterClarificationBranch(params, bundle, state) {
 export async function handleSystemicChallengeBranch(params, bundle, state) {
     return runOmittableGate({
         kind: "systemic_challenge",
-        filename: "systemic-challenge.json",
-        schema: SystemicChallengeSubmissionSchema,
+        lane: GATE_LANES.systemic_challenge,
+        schema: LANE_SUBMISSION_SCHEMAS[GATE_LANES.systemic_challenge],
         apply: async (_value, path, p) => {
             await runAuditStep({
                 root: p.root,
@@ -987,49 +1083,72 @@ export async function handleSystemicChallengeBranch(params, bundle, state) {
         },
     }, params, bundle, state);
 }
+/**
+ * The single enumeration of every gate that can be owed a host submission, and
+ * of every lane within it.
+ *
+ * It under-counted before P25 in three ways, each of which meant the "complete"
+ * registry could not be used to derive what a run expects: the analyzer-consent
+ * gate had no entry at all, the conceptual perspective lanes were minted
+ * privately by `conceptualDispatch`, and the charter lane set was hard-coded
+ * three deep instead of derived from `charterExtractionKindsForCeiling`. All
+ * three are fixed here; tool-WRITTEN inputs (lane prompts, evidence packets,
+ * the merged charter submission) are deliberately absent — they are not
+ * submissions, so nothing is ever owed on them.
+ */
 export const HOST_GATE_DESCRIPTORS = {
+    analyzer_consent: {
+        driven: "custom",
+        lanes: [GATE_LANES.analyzer_consent],
+    },
     graph_enrichment: {
         driven: "custom",
-        incomingFiles: ["analyzer-decisions.json", "edge-reasoning.json"],
+        lanes: [GATE_LANES.analyzer_decisions, GATE_LANES.edge_reasoning],
     },
     design_review: {
         driven: "custom",
-        incomingFiles: [
-            "design-review-findings.json",
-            "design-review-contract-findings.json",
-            "design-review-conceptual-findings.json",
+        // The deep conceptual pass's independent JUDGE produces the conceptual
+        // submission, so it is the `design_review_conceptual` lane rather than one
+        // of its own. The pass's N perspective lanes are deliberately ABSENT: the
+        // tool never reads a perspective's findings (the judge does), so it is owed
+        // nothing on them — listing them here would state an expectation the run
+        // could never satisfy and could never drop.
+        lanes: [
+            GATE_LANES.design_review_legacy,
+            GATE_LANES.design_review_contract,
+            GATE_LANES.design_review_conceptual,
         ],
     },
     critical_flow_fallback: {
         driven: "generic",
-        incomingFiles: ["critical-flow-fallback.json"],
+        lanes: [GATE_LANES.critical_flow_fallback],
     },
     // Custom: runOmittableGate minus the plain-consume — the verdict is
     // schema-validated + quarantined-loudly in the handler itself.
     intent_equivalence: {
         driven: "custom",
-        incomingFiles: ["intent-equivalence-verdict.json"],
+        lanes: [GATE_LANES.intent_equivalence],
     },
-    synthesis_narrative: { driven: "generic", incomingFiles: ["synthesis-narrative.json"] },
+    synthesis_narrative: { driven: "generic", lanes: [GATE_LANES.synthesis_narrative] },
     // Custom: the per-kind blind-lane gate (design resolution 2) — one submission
-    // file per charter kind, each validated (shape + kind purity + scope
-    // grounding) and quarantined loudly per lane, tool-side merge only when every
-    // lane is present + valid. The three estimator channels are the lane set at
-    // every charter-authorizing ceiling; `true` is nominated by the delta miner
-    // at deepest, never a lane (design resolution 4).
+    // per charter kind, each validated (shape + kind purity + scope grounding) and
+    // quarantined loudly per lane, tool-side merge only when every lane is present
+    // + valid. The lane set is DERIVED from the same function the gate loop walks,
+    // so the registry and the loop cannot disagree at any ceiling; `true` is
+    // nominated by the delta miner at deepest, never a lane (design resolution 4).
     charter_extraction: {
         driven: "custom",
-        incomingFiles: [
-            "charter-extraction-stated.json",
-            "charter-extraction-structural.json",
-            "charter-extraction-revealed.json",
-        ],
+        lanes: charterExtractionKindsForCeiling({
+            rung: "deepest",
+            explicit_opt_in: true,
+        }).map(charterExtractionLane),
     },
-    charter_delta: { driven: "generic", incomingFiles: ["charter-delta.json"] },
-    charter_clarification: { driven: "generic", incomingFiles: ["charter-clarification.json"] },
-    systemic_challenge: { driven: "generic", incomingFiles: ["systemic-challenge.json"] },
+    charter_delta: { driven: "generic", lanes: [GATE_LANES.charter_delta] },
+    charter_clarification: { driven: "generic", lanes: [GATE_LANES.charter_clarification] },
+    systemic_challenge: { driven: "generic", lanes: [GATE_LANES.systemic_challenge] },
 };
 export const HOST_GATE_KINDS = [
+    "analyzer_consent",
     "graph_enrichment",
     "critical_flow_fallback",
     "intent_equivalence",
@@ -1336,7 +1455,7 @@ export function buildAuditObligations() {
             },
         },
         {
-            // Graph enrichment: poll the analyzer-decision / edge-reasoning incoming
+            // Graph enrichment: poll the analyzer-decision / edge-reasoning lane
             // artifacts first (emit a host step when one is needed), otherwise run the
             // deterministic enrichment executor.
             id: "graph_enrichment_current",
@@ -1361,7 +1480,7 @@ export function buildAuditObligations() {
         deterministic("docs_digest_current"),
         {
             // Confirm-intent host step: the host writes intent_checkpoint.json (read by
-            // deriveAuditState on re-invocation), so there is no incoming artifact to
+            // deriveAuditState on re-invocation), so there is no submission to
             // consume — emit the step directly.
             id: "intent_checkpoint_current",
             derive: deriveObligationState("intent_checkpoint_current"),
@@ -1392,7 +1511,7 @@ export function buildAuditObligations() {
             },
         },
         {
-            // Charter extraction (Phase C): poll the incoming submission (ingest+gate),
+            // Charter extraction (Phase C): poll the lane submissions (ingest+gate),
             // omit at a shallow ceiling, or emit the host charter-extraction step at a
             // deep+ ceiling. Mirrors the synthesis-narrative branch.
             id: "charter_extraction_current",
@@ -1410,7 +1529,7 @@ export function buildAuditObligations() {
             },
         },
         {
-            // Charter delta-mining (Phase C.2): poll the incoming delta submission
+            // Charter delta-mining (Phase C.2): poll the delta lane submission
             // (route+gate it), settle deterministically when the register is not
             // deltas_pending (extraction omitted / no subsystems), or emit the host step
             // for the INDEPENDENT delta-miner when a deltas_pending register has no
@@ -1430,21 +1549,21 @@ export function buildAuditObligations() {
             },
         },
         {
-            // Contract design-review pass: poll incoming contract/conceptual findings;
+            // Contract design-review pass: poll the contract/conceptual lanes;
             // emit the dispatch step when a pass still needs to run.
             id: "design_review_contract_completed",
             derive: deriveObligationState("design_review_contract_completed"),
             execute: (bundle, ctx) => runDesignReviewObligation(bundle, ctx),
         },
         {
-            // Conceptual design-review pass: same incoming-poll handler (it resolves
+            // Conceptual design-review pass: same submission-poll handler (it resolves
             // which pass remains).
             id: "design_review_conceptual_completed",
             derive: deriveObligationState("design_review_conceptual_completed"),
             execute: (bundle, ctx) => runDesignReviewObligation(bundle, ctx),
         },
         {
-            // Charter clarification (Phase D triangulation loop): poll incoming answers
+            // Charter clarification (Phase D triangulation loop): poll the answers lane
             // (apply + re-split), assemble the loop deterministically at a shallow ceiling
             // / zero attention (autonomous), or emit the host step relaying the VOI-ranked
             // interactive queue at a deep+ ceiling with attention > 0. Non-drainable
@@ -1464,7 +1583,7 @@ export function buildAuditObligations() {
             },
         },
         {
-            // Systemic challenge (Phase E loop-until-dry): poll the incoming adversary
+            // Systemic challenge (Phase E loop-until-dry): poll the adversary lane's
             // round (fold it), omit at a shallow ceiling, or emit the second-order-adversary
             // host step when the loop is open at a deep+ ceiling. Non-drainable
             // (host_delegation), so the drain stops here.
@@ -1494,7 +1613,7 @@ export function buildAuditObligations() {
         deterministic("runtime_validation_current"),
         deterministic("synthesis_current"),
         {
-            // Synthesis narrative: poll the incoming narrative; emit the host step when
+            // Synthesis narrative: poll the narrative lane; emit the host step when
             // narrative is enabled and not yet supplied, otherwise the deterministic
             // omit runs (fold on).
             id: "synthesis_narrative_current",
@@ -1511,7 +1630,7 @@ export function buildAuditObligations() {
                     // (A bare reload here would leave it actionable and spin the fold.)
                     return runDeterministicExecutor(bundle, ctx);
                 }
-                // continue: an incoming narrative was consumed + applied — re-scan.
+                // continue: a narrative submission was consumed + applied — re-scan.
                 return { kind: "transition", state: await loadArtifactBundle(ctx.params.artifactsDir) };
             },
         },
@@ -1547,14 +1666,19 @@ async function runHostDelegationObligation(bundle, ctx) {
     // accepted ledger written before core ingestion is retried, while results
     // already reflected in coverage are not replayed.
     const currentRun = await loadCurrentActiveReviewRun(ctx.params.artifactsDir);
+    let ingestIssues = [];
     if (currentRun) {
         let acceptedResults = [];
+        let completedIds = [];
         try {
-            acceptedResults = (await ingestAuditHostResults({
+            const ingested = await ingestAuditHostResults({
                 root: ctx.params.root,
                 artifactsDir: ctx.params.artifactsDir,
                 runId: currentRun.run_id,
-            })).accepted_results;
+            });
+            acceptedResults = ingested.accepted_results;
+            ingestIssues = ingested.issues;
+            completedIds = ingested.completed_work_item_ids;
         }
         catch (error) {
             // No handoff exists on the first visit, or prepare was interrupted before
@@ -1562,6 +1686,17 @@ async function runHostDelegationObligation(bundle, ctx) {
             if (!isFileMissingError(error))
                 throw error;
         }
+        // The ingest CLASSIFIES every failed read — a submission that never
+        // arrived, unreadable bytes (an EACCES or a directory at the bound path
+        // reads as malformed WITH the OS detail in its message), a body that fails
+        // the contract, a replayed result id. Those classifications used to die in
+        // the caller that computed them; they now land on the ledger and, below,
+        // in the re-emitted step the host actually reads. The completed set rides
+        // along so a repaired item closes its own record.
+        await recordHostResultOutcomes(ctx.params.artifactsDir, currentRun.run_id, {
+            issues: ingestIssues,
+            acceptedIds: completedIds,
+        });
         const pendingIds = new Set(buildPendingAuditTasks(bundle).map((task) => task.task_id));
         const pendingAccepted = acceptedResults.filter((result) => pendingIds.has(result.task_id));
         if (pendingAccepted.length > 0) {
@@ -1589,6 +1724,7 @@ async function runHostDelegationObligation(bundle, ctx) {
             kind: "semantic_review",
             selectedExecutor: decision.selected_executor,
             ...review,
+            ...(ingestIssues.length > 0 ? { ingestIssues } : {}),
         },
     };
 }