audit-tools 0.50.4 → 0.50.7

package/dist/audit/cli/nextStepHelpers.js

@@ -6,26 +6,28 @@
  * concern.
  */
 import { randomUUID } from "node:crypto";
-import { mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { mkdir, readFile, unlink } from "node:fs/promises";
 import { join } from "node:path";
-import { advance, describeStoppedFold, compareCodeUnits, isFileMissingError, isJsonParseError, isRecord, readJsonFile, persistAnalyzerConsent, persistAnalyzerSettings, writeJsonFile, } from "audit-tools/shared";
-import { loadArtifactBundle, promoteFinalAuditReport, writeCoreArtifacts, } from "../io/artifacts.js";
-import { artifactTreeLockPath, auditReportPath, groundDesignFindings, laneAssetsDir, promotedAuditReportPath, withFileLock, } from "audit-tools/shared";
+import { advance, describeStoppedFold, RunLogger, compareCodeUnits, isFileMissingError, isJsonParseError, isRecord, readJsonFile, persistAnalyzerConsent, persistAnalyzerSettings, writeJsonFile, } from "audit-tools/shared";
+import { loadArtifactBundle, promoteFinalAuditReport, } from "../io/artifacts.js";
+import { auditReportPath, groundDesignFindings, laneAssetsDir, promotedAuditReportPath, } from "audit-tools/shared";
 import { charterExtractionKindsForCeiling } from "./charterExtractionPrompt.js";
 import { LANE_SUBMISSION_SCHEMAS, charterLaneSchema, describeSubmissionShapeMismatch, unwrapSubmissionArray, } from "./laneValidators.js";
-import { advanceAudit, findExecutorFailure, } from "../orchestrator/advance.js";
-import { captureDesignReviewSnapshot, isDesignReviewStale, } from "../orchestrator/designReviewSnapshot.js";
+import { advanceAudit, engineMaxTransitions, findExecutorFailure, runSingleAdvanceStep, MAX_DRAIN_STEPS, } from "../orchestrator/advance.js";
+import { buildDesignReviewSnapshot, isDesignReviewStale, } from "../orchestrator/designReviewSnapshot.js";
+import { computeStaleArtifacts, emitStalenessRecord, isMetadataMigrationStaleness, resetStalenessDedup, } from "../orchestrator/staleness.js";
+import { commitFold, createFoldTransaction, markSubmissionApplied, quarantineSubmissionFile, recoverStagedSubmissions, stageLaneSubmission, } from "./foldTransaction.js";
+import { charterClarificationOmits, charterExtractionOmits, intentEquivalenceOmits, synthesisNarrativeOmits, systemicChallengeOmits, } from "../orchestrator/obligationPolicy.js";
 import { computeArtifactStateSignature } from "../orchestrator/artifactMetadata.js";
 import { decideNextStep, PRIORITY, AUDIT_FRICTION_RUN_ID, decideAuditFrictionCloseout, } from "../orchestrator/nextStep.js";
 import { isHostDelegationExecutor } from "../orchestrator/executors.js";
-import { resolveCharterCeiling, ceilingRequestsCharters, } from "../orchestrator/charterExtractionExecutor.js";
-import { resolveClarificationAttention } from "../orchestrator/charterClarificationExecutor.js";
+import { resolveCharterCeiling } from "../orchestrator/charterExtractionExecutor.js";
 import { deriveAuditState } from "../orchestrator/state.js";
-import { deriveIntentEquivalenceStatus } from "../orchestrator/intentEquivalenceExecutor.js";
 import { checkFileIntegrity } from "../orchestrator/fileIntegrity.js";
 import { graphEnrichmentUnresolvedAnalyzers, graphEnrichmentLowConfidenceEdges, pendingAnalyzerConsent, } from "../orchestrator/hostInputPause.js";
-import { runAuditStep } from "./auditStep.js";
-import { writeHandoffOnly, ensureSemanticReviewRun, loadCurrentActiveReviewRun, } from "./reviewRun.js";
+import { runAuditStepUnlocked, withArtifactTreeHold } from "./auditStep.js";
+import { writeHandoffOnly, ensureSemanticReviewRunUnlocked, loadCurrentActiveReviewRun, } from "./reviewRun.js";
+import { sizeIndexFromManifest } from "../orchestrator/reviewPackets.js";
 import { buildPendingAuditTasks } from "./dispatch.js";
 import { buildLineIndex } from "./lineIndex.js";
 import { ingestAuditHostResults, } from "./dispatch/hostHandoff.js";
@@ -36,8 +38,31 @@ import { CHARTER_EXTRACTION_MERGED_FILENAME, GATE_LANES, charterExtractionLane,
  * `absent` on ENOENT-family errors; `malformed` when the file exists but is not
  * JSON — submitted content is the CALLER's to quarantine, never an
  * infrastructure failure. All other IO errors re-throw unchanged.
+ *
+ * With a fold transaction the submission is STAGED first — renamed into
+ * `submission-staging/` before anything parses it (CX-02 landing 3), so a
+ * crash mid-consumption is recoverable and `path` names the STAGED file: the
+ * quarantine helpers move it from there, and `markSubmissionApplied` (never a
+ * direct unlink) schedules its commit-time deletion. Without a transaction the
+ * read is a pure probe of the bound path — nothing moves.
  */
-export async function tryConsumeSubmission(artifactsDir, lane) {
+export async function tryConsumeSubmission(artifactsDir, lane, tx) {
+    if (tx) {
+        const stagedResult = await stageLaneSubmission(tx, artifactsDir, lane);
+        if (stagedResult.status === "absent")
+            return { status: "absent" };
+        const { stagingPath, contentHash } = stagedResult.staged;
+        try {
+            const value = await readJsonFile(stagingPath);
+            return { status: "ok", value, path: stagingPath, contentHash };
+        }
+        catch (error) {
+            if (isJsonParseError(error)) {
+                return { status: "malformed", path: stagingPath, reason: error.message };
+            }
+            throw error;
+        }
+    }
     const filePath = laneSubmissionPath(artifactsDir, lane);
     try {
         const value = await readJsonFile(filePath);
@@ -194,7 +219,7 @@ export async function buildTerminalStep(params, bundle, state, blockedReason) {
  *     (`return`), so applicable consent-gated candidates are never silently
  *     skipped (the silent-fail-closed defect this program exists to fix).
  */
-export async function handleAnalyzerConsentBranch(params, bundle, state, analyzersRef) {
+export async function handleAnalyzerConsentBranch(params, bundle, state, analyzersRef, tx) {
     const pending = pendingAnalyzerConsent({
         root: params.root,
         analyzers: analyzersRef.value,
@@ -207,7 +232,7 @@ export async function handleAnalyzerConsentBranch(params, bundle, state, analyze
     });
     if (pending.length === 0)
         return { action: "fallthrough" };
-    const incoming = await consumeEnumMapSubmission(params.artifactsDir, GATE_LANES.analyzer_consent, ANALYZER_CONSENT_VALUES);
+    const incoming = await consumeEnumMapSubmission(params.artifactsDir, GATE_LANES.analyzer_consent, ANALYZER_CONSENT_VALUES, tx);
     if (incoming.status === "quarantined") {
         return { action: "continue" };
     }
@@ -244,13 +269,12 @@ export async function handleAnalyzerConsentBranch(params, bundle, state, analyze
                 };
             }
         }
-        await unlink(incoming.path).catch(() => { });
-        await recordLaneOutcome(params.artifactsDir, GATE_LANES.analyzer_consent, {
-            kind: "accepted",
-            ...(incoming.ignored.length > 0
-                ? { message: describeIgnoredKeys(incoming.ignored, ANALYZER_CONSENT_VALUES) }
-                : {}),
-        });
+        // Deletion + the accepted ledger event are COMMIT-phase (the consent
+        // persist above is durable-by-design and idempotent, so a crash-replay
+        // re-applies it harmlessly while the staged file is restored).
+        markSubmissionApplied(tx, incoming.path, incoming.ignored.length > 0
+            ? describeIgnoredKeys(incoming.ignored, ANALYZER_CONSENT_VALUES)
+            : undefined);
         return { action: "continue" };
     }
     return { action: "return", result: { kind: "analyzer_consent", state, bundle, pending } };
@@ -263,11 +287,11 @@ export async function handleAnalyzerConsentBranch(params, bundle, state, analyze
  *   - `return`      → caller should emit the embedded result to cmdNextStep.
  *   - `fallthrough` → nothing submitted; run the deterministic executor.
  */
-export async function handleGraphEnrichmentBranch(params, bundle, state, analyzersRef, deps = {}) {
-    const runStep = deps.runStep ?? runAuditStep;
-    // Fold-level pause detection is single-sourced in `hostInputPause` so the drain
-    // stop predicate (`nextStepPausesForHostInput`) and this fold agree EXACTLY on
-    // when the analyzer-install consent / edge-reasoning turns are owed.
+export async function handleGraphEnrichmentBranch(params, bundle, state, analyzersRef, tx, deps = {}) {
+    const runStep = deps.runStep ?? runAuditStepUnlocked;
+    // Fold-level pause detection is single-sourced in `hostInputPause` so the
+    // plan draw's classifier (`obligationPolicy.ts`) and this fold agree EXACTLY
+    // on when the analyzer-install consent / edge-reasoning turns are owed.
     const pauseInputs = {
         root: params.root,
         analyzers: analyzersRef.value,
@@ -275,24 +299,20 @@ export async function handleGraphEnrichmentBranch(params, bundle, state, analyze
     };
     const unresolved = (deps.unresolvedAnalyzers ?? graphEnrichmentUnresolvedAnalyzers)(bundle, pauseInputs);
     if (unresolved.length > 0) {
-        const incoming = await consumeEnumMapSubmission(params.artifactsDir, GATE_LANES.analyzer_decisions, ANALYZER_SETTING_VALUES);
+        const incoming = await consumeEnumMapSubmission(params.artifactsDir, GATE_LANES.analyzer_decisions, ANALYZER_SETTING_VALUES, tx);
         if (incoming.status === "quarantined") {
             // A non-object top-level value used to be neither merged, deleted, nor
             // diagnosed — the file lingered at its bound path and the analyzer_install
             // step re-emitted silently forever. Quarantined + diagnosed instead.
-            return { action: "continue" };
+            return { action: "continue", bundle };
         }
         if (incoming.status === "ok") {
             const merged = await persistAnalyzerSettings(params.root, incoming.values);
             analyzersRef.value = merged.analyzers;
-            await unlink(incoming.path).catch(() => { });
-            await recordLaneOutcome(params.artifactsDir, GATE_LANES.analyzer_decisions, {
-                kind: "accepted",
-                ...(incoming.ignored.length > 0
-                    ? { message: describeIgnoredKeys(incoming.ignored, ANALYZER_SETTING_VALUES) }
-                    : {}),
-            });
-            return { action: "continue" };
+            markSubmissionApplied(tx, incoming.path, incoming.ignored.length > 0
+                ? describeIgnoredKeys(incoming.ignored, ANALYZER_SETTING_VALUES)
+                : undefined);
+            return { action: "continue", bundle };
         }
         return { action: "return", result: { kind: "analyzer_install", state, bundle, unresolved } };
     }
@@ -307,7 +327,7 @@ export async function handleGraphEnrichmentBranch(params, bundle, state, analyze
     {
         const candidates = graphEnrichmentLowConfidenceEdges(bundle, pauseInputs);
         if (candidates.length > 0) {
-            const edgeReasoningIncoming = await tryConsumeSubmission(params.artifactsDir, GATE_LANES.edge_reasoning);
+            const edgeReasoningIncoming = await tryConsumeSubmission(params.artifactsDir, GATE_LANES.edge_reasoning, tx);
             if (edgeReasoningIncoming.status === "malformed") {
                 const quarantinePath = await quarantineSubmissionFile(params.artifactsDir, edgeReasoningIncoming.path, GATE_LANES.edge_reasoning);
                 await recordEdgeReasoningRejection(params.artifactsDir, {
@@ -321,7 +341,7 @@ export async function handleGraphEnrichmentBranch(params, bundle, state, analyze
                     issueCode: "submission_malformed",
                     message: edgeReasoningIncoming.reason,
                 });
-                return { action: "continue" };
+                return { action: "continue", bundle };
             }
             if (edgeReasoningIncoming.status === "ok") {
                 // Same hazard class as the design-review quarantine fix: a malformed
@@ -346,24 +366,25 @@ export async function handleGraphEnrichmentBranch(params, bundle, state, analyze
                         issueCode: "submission_contract_invalid",
                         message: unwrapped.reason,
                     });
-                    return { action: "continue" };
+                    return { action: "continue", bundle };
                 }
-                // Apply BEFORE deleting the submission: if runStep throws (locks,
-                // crash), the submission survives for the retry instead of being lost.
-                await runStep({
+                // Apply BEFORE the deletion commits: if runStep throws, the staged
+                // submission is RESTORED for the retry instead of being lost. The
+                // executor is forced explicitly — the fold's engine selected this
+                // obligation, so the selection is graph enrichment by construction,
+                // and an unforced call would re-enter a drain.
+                const applied = await runStep({
                     root: params.root,
                     artifactsDir: params.artifactsDir,
                     analyzers: analyzersRef.value,
                     graphLlmEdgeReasoning: true,
+                    preferredExecutor: "graph_enrichment_executor",
                     edgeReasoningResults: { rewrites: unwrapped.array },
                     since: params.since,
-                });
-                await unlink(edgeReasoningIncoming.path).catch(() => { });
+                }, bundle);
+                markSubmissionApplied(tx, edgeReasoningIncoming.path);
                 await clearEdgeReasoningRejection(params.artifactsDir);
-                await recordLaneOutcome(params.artifactsDir, GATE_LANES.edge_reasoning, {
-                    kind: "accepted",
-                });
-                return { action: "continue" };
+                return { action: "continue", bundle: applied.updated_bundle };
             }
             return { action: "return", result: { kind: "edge_reasoning", state, bundle, candidates } };
         }
@@ -390,32 +411,8 @@ function passIsStale(bundle, pass) {
     const snapshot = bundle.design_review_snapshots?.[pass];
     return snapshot ? isDesignReviewStale(snapshot, bundle) : false;
 }
-/**
- * Move a refused submission to `<artifactsDir>/quarantine/` rather than
- * deleting it. Falls back to copy+unlink if `rename` fails (e.g. a cross-device
- * artifacts mount) so the content is never lost. The quarantined file is named
- * for its LANE — the bound path is a digest, which tells an operator nothing.
- */
-async function quarantineSubmissionFile(artifactsDir, filePath, lane) {
-    const quarantineDir = join(artifactsDir, "quarantine");
-    await mkdir(quarantineDir, { recursive: true });
-    const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
-    const quarantinePath = join(quarantineDir, `${lane}.${timestamp}.json`);
-    try {
-        await rename(filePath, quarantinePath);
-    }
-    catch {
-        try {
-            const content = await readFile(filePath, "utf8");
-            await writeFile(quarantinePath, content, "utf8");
-        }
-        catch {
-            // Best-effort: nothing left to quarantine if even the read failed.
-        }
-        await unlink(filePath).catch(() => { });
-    }
-    return quarantinePath;
-}
+// `quarantineSubmissionFile` moved to `foldTransaction.ts` (the staging/commit
+// module owns submission-file lifecycle mechanics); imported above.
 /**
  * Quarantine a submission that failed zod validation — or failed to parse as
  * JSON at all (a plain string reason): move it off its bound path (never
@@ -452,8 +449,8 @@ async function quarantineMisshapedSubmission(artifactsDir, filePath, lane, error
  * it has applied the value, so a submission is never destroyed before its
  * content has landed somewhere else.
  */
-export async function consumeArraySubmission(artifactsDir, lane) {
-    const incoming = await tryConsumeSubmission(artifactsDir, lane);
+export async function consumeArraySubmission(artifactsDir, lane, tx) {
+    const incoming = await tryConsumeSubmission(artifactsDir, lane, tx);
     if (incoming.status === "absent")
         return { status: "absent" };
     if (incoming.status === "malformed") {
@@ -487,8 +484,8 @@ export async function consumeArraySubmission(artifactsDir, lane) {
  * caller unlinks after applying, so a crash mid-apply retains the submission
  * for the retry.
  */
-export async function consumeObjectSubmission(artifactsDir, lane) {
-    const incoming = await tryConsumeSubmission(artifactsDir, lane);
+export async function consumeObjectSubmission(artifactsDir, lane, tx) {
+    const incoming = await tryConsumeSubmission(artifactsDir, lane, tx);
     if (incoming.status === "absent")
         return { status: "absent" };
     if (incoming.status === "malformed") {
@@ -546,8 +543,8 @@ function describeIgnoredKeys(ignored, allowed) {
  * on the accepting event so the omission is on the record rather than in a
  * stderr line nobody kept.
  */
-async function consumeEnumMapSubmission(artifactsDir, lane, allowed) {
-    const incoming = await consumeObjectSubmission(artifactsDir, lane);
+async function consumeEnumMapSubmission(artifactsDir, lane, allowed, tx) {
+    const incoming = await consumeObjectSubmission(artifactsDir, lane, tx);
     if (incoming.status === "absent")
         return { status: "absent" };
     if (incoming.status === "quarantined")
@@ -636,9 +633,9 @@ export async function renderEdgeReasoningRejectionNotice(artifactsDir) {
  * here. Two appends per refusal made a single rejection read as two on a record
  * whose whole value is counting them.
  */
-async function recordRejectedDesignReviewSubmission(artifactsDir, existing, pass, quarantined) {
+function withRejectedDesignReviewSubmission(existing, pass, quarantined) {
     if (!existing)
-        return;
+        return undefined;
     const entry = {
         pass,
         lane: quarantined.lane,
@@ -646,11 +643,17 @@ async function recordRejectedDesignReviewSubmission(artifactsDir, existing, pass
         reason: quarantined.reason,
         rejected_at: new Date().toISOString(),
     };
-    existing.rejected_submissions = [
-        ...(existing.rejected_submissions ?? []).filter((r) => r.pass !== pass),
-        entry,
-    ];
-    await writeJsonFile(join(artifactsDir, "design_assessment.json"), existing);
+    // PURE rebuild — never a mutation of the carried assessment. Both derive
+    // memos key on bundle identity, so an in-place edit would let an earlier
+    // carry observe a later change (the aliasing hazard CX-02's record pins);
+    // the persisted write is the fold's single core commit, not this site.
+    return {
+        ...existing,
+        rejected_submissions: [
+            ...(existing.rejected_submissions ?? []).filter((r) => r.pass !== pass),
+            entry,
+        ],
+    };
 }
 /**
  * Render a host-facing notice for any pending quarantined design-review
@@ -677,8 +680,22 @@ export function renderDesignReviewRejectionNotice(bundle, passes) {
         'one array-valued property (e.g. `{"findings": [...]}`).');
     return lines.join("\n");
 }
-export async function handleDesignReviewBranch(params, bundle, state) {
-    const existing = bundle.design_assessment;
+export async function handleDesignReviewBranch(params, bundle, state, tx) {
+    // Working copies, replaced IMMUTABLY on every change — never a mutation of
+    // the carried bundle's nested objects (the aliasing hazard the CX-02 record
+    // pins: both derive memos key on bundle identity, and an in-place edit lets
+    // an earlier carry observe a later change). `carried()` assembles the fresh
+    // bundle every path hands back.
+    let assessment = bundle.design_assessment;
+    let snapshots = bundle.design_review_snapshots;
+    const carried = () => {
+        const next = { ...bundle };
+        if (assessment !== undefined)
+            next.design_assessment = assessment;
+        if (snapshots !== undefined)
+            next.design_review_snapshots = snapshots;
+        return next;
+    };
     /**
      * P25-f: a valid submission with nowhere to merge it is HELD and RECORDED,
      * never consumed-and-dropped. `design_assessment` is normally present by the
@@ -705,107 +722,121 @@ export async function handleDesignReviewBranch(params, bundle, state) {
             issueCode: "submission_rejected",
             message: `${pass} pass: ${reason}`,
         });
-        await recordRejectedDesignReviewSubmission(params.artifactsDir, existing, pass, {
-            status: "quarantined",
-            quarantinePath,
-            lane,
-            reason,
-        });
+        assessment =
+            withRejectedDesignReviewSubmission(assessment, pass, {
+                status: "quarantined",
+                quarantinePath,
+                lane,
+                reason,
+            }) ?? assessment;
     };
     // Legacy: consume the old combined findings submission. Tolerant-unwrap or
     // quarantine (never a bare unconditional delete) — see the block comment above.
-    const legacyResult = await consumeArraySubmission(params.artifactsDir, GATE_LANES.design_review_legacy);
+    const legacyResult = await consumeArraySubmission(params.artifactsDir, GATE_LANES.design_review_legacy, tx);
     if (legacyResult.status === "quarantined") {
-        await recordRejectedDesignReviewSubmission(params.artifactsDir, existing, "legacy", legacyResult);
-        return { action: "continue" };
+        assessment =
+            withRejectedDesignReviewSubmission(assessment, "legacy", legacyResult) ??
+                assessment;
+        return { action: "continue", bundle: carried() };
     }
     if (legacyResult.status === "ok") {
-        if (existing) {
-            existing.review_findings = groundDesignFindings(legacyResult.value, bundle.repo_manifest);
-            existing.reviewed = true;
-            existing.rejected_submissions = (existing.rejected_submissions ?? []).filter((r) => r.pass !== "legacy");
-            await writeJsonFile(join(params.artifactsDir, "design_assessment.json"), existing);
-            await unlink(legacyResult.path).catch(() => { });
-            await recordLaneOutcome(params.artifactsDir, GATE_LANES.design_review_legacy, {
-                kind: "accepted",
-            });
-            return { action: "continue" };
+        if (assessment) {
+            assessment = {
+                ...assessment,
+                review_findings: groundDesignFindings(legacyResult.value, bundle.repo_manifest),
+                reviewed: true,
+                rejected_submissions: (assessment.rejected_submissions ?? []).filter((r) => r.pass !== "legacy"),
+            };
+            markSubmissionApplied(tx, legacyResult.path);
+            return { action: "continue", bundle: carried() };
         }
         await holdWithoutTarget("legacy", GATE_LANES.design_review_legacy, legacyResult.path);
-        return { action: "continue" };
+        return { action: "continue", bundle: carried() };
     }
     // absent: fall through to the contract/conceptual check.
     // New: consume contract-findings and/or conceptual-findings independently.
-    const contractResult = await consumeArraySubmission(params.artifactsDir, GATE_LANES.design_review_contract);
-    const conceptualResult = await consumeArraySubmission(params.artifactsDir, GATE_LANES.design_review_conceptual);
+    const contractResult = await consumeArraySubmission(params.artifactsDir, GATE_LANES.design_review_contract, tx);
+    const conceptualResult = await consumeArraySubmission(params.artifactsDir, GATE_LANES.design_review_conceptual, tx);
     let consumed = false;
     if (contractResult.status === "quarantined") {
-        await recordRejectedDesignReviewSubmission(params.artifactsDir, existing, "contract", contractResult);
+        assessment =
+            withRejectedDesignReviewSubmission(assessment, "contract", contractResult) ??
+                assessment;
     }
-    else if (contractResult.status === "ok" && existing) {
-        existing.contract_findings = groundDesignFindings(contractResult.value, bundle.repo_manifest);
-        existing.contract_reviewed = true;
-        existing.rejected_submissions = (existing.rejected_submissions ?? []).filter((r) => r.pass !== "contract");
+    else if (contractResult.status === "ok" && assessment) {
+        assessment = {
+            ...assessment,
+            contract_findings: groundDesignFindings(contractResult.value, bundle.repo_manifest),
+            contract_reviewed: true,
+            rejected_submissions: (assessment.rejected_submissions ?? []).filter((r) => r.pass !== "contract"),
+        };
         consumed = true;
     }
     else if (contractResult.status === "ok") {
         await holdWithoutTarget("contract", GATE_LANES.design_review_contract, contractResult.path);
     }
     if (conceptualResult.status === "quarantined") {
-        await recordRejectedDesignReviewSubmission(params.artifactsDir, existing, "conceptual", conceptualResult);
+        assessment =
+            withRejectedDesignReviewSubmission(assessment, "conceptual", conceptualResult) ??
+                assessment;
     }
-    else if (conceptualResult.status === "ok" && existing) {
-        existing.conceptual_findings = groundDesignFindings(conceptualResult.value, bundle.repo_manifest);
-        existing.conceptual_reviewed = true;
-        existing.rejected_submissions = (existing.rejected_submissions ?? []).filter((r) => r.pass !== "conceptual");
+    else if (conceptualResult.status === "ok" && assessment) {
+        assessment = {
+            ...assessment,
+            conceptual_findings: groundDesignFindings(conceptualResult.value, bundle.repo_manifest),
+            conceptual_reviewed: true,
+            rejected_submissions: (assessment.rejected_submissions ?? []).filter((r) => r.pass !== "conceptual"),
+        };
         consumed = true;
     }
     else if (conceptualResult.status === "ok") {
         await holdWithoutTarget("conceptual", GATE_LANES.design_review_conceptual, conceptualResult.path);
     }
-    if (consumed && existing) {
-        await writeJsonFile(join(params.artifactsDir, "design_assessment.json"), existing);
+    if (consumed && assessment) {
         // Snapshot each just-completed pass (B2 parity port): record the verdict +
         // the semantic projection of the structural inputs it reviewed, so a later
         // upstream change re-stales the pass and the re-emit can be diff-scoped
-        // rather than a blind full re-run. Capture after the design_assessment write
-        // so the projection reflects the persisted findings.
+        // rather than a blind full re-run. The snapshot VALUE rides the carried
+        // bundle (so this fold's own staleness derivation sees the pass fresh) and
+        // its WRITE is staged on the transaction, committing WITH the core — a
+        // snapshot lost between fold and commit would silently mark a completed
+        // pass satisfied (CX-02 landing 2).
         const reviewedAt = new Date().toISOString();
         if (contractResult.status === "ok") {
-            await captureDesignReviewSnapshot(params.artifactsDir, "contract", existing.contract_findings ?? [], bundle, reviewedAt);
-            // Unlink only now: the findings are persisted and snapshotted, so the
-            // submission's content survives its own deletion.
-            await unlink(contractResult.path).catch(() => { });
-            await recordLaneOutcome(params.artifactsDir, GATE_LANES.design_review_contract, {
-                kind: "accepted",
-            });
+            const snapshot = buildDesignReviewSnapshot("contract", assessment.contract_findings ?? [], carried(), reviewedAt);
+            tx.pendingSnapshots.push(snapshot);
+            snapshots = { ...(snapshots ?? {}), contract: snapshot };
+            markSubmissionApplied(tx, contractResult.path);
         }
         if (conceptualResult.status === "ok") {
-            await captureDesignReviewSnapshot(params.artifactsDir, "conceptual", existing.conceptual_findings ?? [], bundle, reviewedAt);
-            await unlink(conceptualResult.path).catch(() => { });
-            await recordLaneOutcome(params.artifactsDir, GATE_LANES.design_review_conceptual, {
-                kind: "accepted",
-            });
+            const snapshot = buildDesignReviewSnapshot("conceptual", assessment.conceptual_findings ?? [], carried(), reviewedAt);
+            tx.pendingSnapshots.push(snapshot);
+            snapshots = { ...(snapshots ?? {}), conceptual: snapshot };
+            markSubmissionApplied(tx, conceptualResult.path);
         }
-        return { action: "continue" };
+        return { action: "continue", bundle: carried() };
     }
     // Determine which passes still need to run. A completed pass whose snapshot has
     // gone stale (a structural input changed in projection) is NOT done — it must
     // re-run as a diff-based re-review. This mirrors the obligation staleness in
-    // `designReviewPassState`.
-    const contractDone = existing?.contract_reviewed === true && !passIsStale(bundle, "contract");
-    const conceptualDone = existing?.conceptual_reviewed === true && !passIsStale(bundle, "conceptual");
+    // `designReviewPassState`. Checked against the CARRIED bundle so a rejection
+    // note recorded above reaches the re-emitted step's renderer.
+    const current = carried();
+    const contractDone = current.design_assessment?.contract_reviewed === true &&
+        !passIsStale(current, "contract");
+    const conceptualDone = current.design_assessment?.conceptual_reviewed === true &&
+        !passIsStale(current, "conceptual");
     if (!contractDone && !conceptualDone) {
-        return { action: "return", result: { kind: "design_review_parallel", state, bundle } };
+        return { action: "return", result: { kind: "design_review_parallel", state, bundle: current } };
     }
     if (!contractDone) {
-        return { action: "return", result: { kind: "design_review_contract", state, bundle } };
+        return { action: "return", result: { kind: "design_review_contract", state, bundle: current } };
     }
     if (!conceptualDone) {
-        return { action: "return", result: { kind: "design_review_conceptual", state, bundle } };
+        return { action: "return", result: { kind: "design_review_conceptual", state, bundle: current } };
     }
     // Both done — should not normally reach here (obligations would be satisfied).
-    return { action: "continue" };
+    return { action: "continue", bundle: current };
 }
 /**
  * Drive one "poll the lane → apply+continue, else omit-or-return" gate — the
@@ -813,8 +844,8 @@ export async function handleDesignReviewBranch(params, bundle, state) {
  * charter_clarification, and systemic_challenge. See the section comment
  * above for the two gates that deviate and are not run through this engine.
  */
-async function runOmittableGate(descriptor, params, bundle, state) {
-    const incoming = await tryConsumeSubmission(params.artifactsDir, descriptor.lane);
+async function runOmittableGate(descriptor, params, bundle, state, tx) {
+    const incoming = await tryConsumeSubmission(params.artifactsDir, descriptor.lane, tx);
     if (incoming.status === "malformed") {
         // Not-JSON submission: same quarantine-loudly lifecycle as a mis-shaped one.
         await quarantineMisshapedSubmission(params.artifactsDir, incoming.path, descriptor.lane, incoming.reason);
@@ -822,10 +853,11 @@ async function runOmittableGate(descriptor, params, bundle, state) {
     else if (incoming.status === "ok") {
         const parsed = descriptor.schema.safeParse(incoming.value);
         if (parsed.success) {
-            await descriptor.apply(parsed.data, incoming.path, params);
-            await unlink(incoming.path).catch(() => { });
-            await recordLaneOutcome(params.artifactsDir, descriptor.lane, { kind: "accepted" });
-            return { action: "continue" };
+            const applied = await descriptor.apply(parsed.data, incoming.path, params, bundle, { contentHash: incoming.contentHash });
+            // Deletion + the accepted event commit WITH the core write; a throw
+            // between here and the commit restores the staged submission instead.
+            markSubmissionApplied(tx, incoming.path);
+            return { action: "continue", bundle: applied.updated_bundle };
         }
         // Mis-shaped submission: quarantine loudly and fall through to
         // shouldOmit/return — never hand it to the executor to crash on or silently
@@ -849,22 +881,21 @@ async function runOmittableGate(descriptor, params, bundle, state) {
  *     This MUST make progress, never a no-op reload — otherwise the obligation
  *     stays actionable and the fold spins (the guards do not cover this branch).
  */
-export async function handleSynthesisNarrativeBranch(params, bundle, state) {
+export async function handleSynthesisNarrativeBranch(params, bundle, state, tx) {
     return runOmittableGate({
         kind: "synthesis_narrative",
         lane: GATE_LANES.synthesis_narrative,
         schema: LANE_SUBMISSION_SCHEMAS[GATE_LANES.synthesis_narrative],
-        apply: async (_value, path, p) => {
-            await runAuditStep({
-                root: p.root,
-                artifactsDir: p.artifactsDir,
-                preferredExecutor: "synthesis_narrative_executor",
-                narrativeResultsPath: path,
-            });
-        },
+        apply: (_value, path, p, foldBundle) => runAuditStepUnlocked({
+            root: p.root,
+            artifactsDir: p.artifactsDir,
+            preferredExecutor: "synthesis_narrative_executor",
+            narrativeResultsPath: path,
+        }, foldBundle),
         // Narrative disabled: omit (run the deterministic omit executor below).
-        shouldOmit: () => !params.narrativeEnabled,
-    }, params, bundle, state);
+        // Single-sourced with the plan draw's classifier (obligationPolicy.ts).
+        shouldOmit: () => synthesisNarrativeOmits({ narrativeEnabled: params.narrativeEnabled }),
+    }, params, bundle, state, tx);
 }
 /**
  * Handle the `intent_equivalence_executor` polling block (DD-9). Deviates from
@@ -877,9 +908,9 @@ export async function handleSynthesisNarrativeBranch(params, bundle, state) {
  *     gate-version-stale / structured delta) — run the executor, stay drainable.
  *   - `return`    → a prose-only delta awaits the host judge; emit the step.
  */
-export async function handleIntentEquivalenceBranch(params, bundle, state) {
+export async function handleIntentEquivalenceBranch(params, bundle, state, tx) {
     const lane = GATE_LANES.intent_equivalence;
-    const incoming = await tryConsumeSubmission(params.artifactsDir, lane);
+    const incoming = await tryConsumeSubmission(params.artifactsDir, lane, tx);
     if (incoming.status === "malformed") {
         await quarantineMisshapedSubmission(params.artifactsDir, incoming.path, lane, incoming.reason);
         // Fall through: no valid submission — re-emit or deterministically resolve.
@@ -887,20 +918,20 @@ export async function handleIntentEquivalenceBranch(params, bundle, state) {
     else if (incoming.status === "ok") {
         const parsed = LANE_SUBMISSION_SCHEMAS[lane].safeParse(incoming.value);
         if (parsed.success) {
-            await runAuditStep({
+            const applied = await runAuditStepUnlocked({
                 root: params.root,
                 artifactsDir: params.artifactsDir,
                 preferredExecutor: "intent_equivalence_executor",
                 intentEquivalenceVerdictPath: incoming.path,
-            });
-            await unlink(incoming.path).catch(() => { });
-            await recordLaneOutcome(params.artifactsDir, lane, { kind: "accepted" });
-            return { action: "continue" };
+            }, bundle);
+            markSubmissionApplied(tx, incoming.path);
+            return { action: "continue", bundle: applied.updated_bundle };
         }
         await quarantineMisshapedSubmission(params.artifactsDir, incoming.path, lane, parsed.error);
         // Fall through: no valid submission — re-emit or deterministically resolve.
     }
-    if (deriveIntentEquivalenceStatus(bundle).kind !== "prose_judgment_pending") {
+    // Single-sourced with the plan draw's classifier (obligationPolicy.ts).
+    if (intentEquivalenceOmits(bundle)) {
         return { action: "run_omit" };
     }
     return { action: "return", result: { kind: "intent_equivalence", state, bundle } };
@@ -917,23 +948,21 @@ export async function handleIntentEquivalenceBranch(params, bundle, state) {
  *   - `return`    → no submission yet; emit the critical_flow_fallback host step.
  * `run_omit` is never returned (shouldOmit is constant-false).
  */
-export async function handleCriticalFlowFallbackBranch(params, bundle, state) {
+export async function handleCriticalFlowFallbackBranch(params, bundle, state, tx) {
     return runOmittableGate({
         kind: "critical_flow_fallback",
         lane: GATE_LANES.critical_flow_fallback,
         schema: LANE_SUBMISSION_SCHEMAS[GATE_LANES.critical_flow_fallback],
-        apply: async (_value, path, p) => {
-            await runAuditStep({
-                root: p.root,
-                artifactsDir: p.artifactsDir,
-                preferredExecutor: "critical_flow_fallback_executor",
-                criticalFlowFallbackResultsPath: path,
-            });
-        },
+        apply: (_value, path, p, foldBundle) => runAuditStepUnlocked({
+            root: p.root,
+            artifactsDir: p.artifactsDir,
+            preferredExecutor: "critical_flow_fallback_executor",
+            criticalFlowFallbackResultsPath: path,
+        }, foldBundle),
         // Never omit: the obligation is only reached when the deterministic bar
         // failed, and the host is always available to author the enrichment.
         shouldOmit: () => false,
-    }, params, bundle, state);
+    }, params, bundle, state, tx);
 }
 /**
  * Handle the `charter_extraction_executor` submission-polling block
@@ -946,10 +975,11 @@ export async function handleCriticalFlowFallbackBranch(params, bundle, state) {
  *   - a `deep`/`deepest` ceiling with no submission yet → `return` the host step
  *     that renders the charter-extraction prompt.
  */
-export async function handleCharterExtractionBranch(params, bundle, state) {
+export async function handleCharterExtractionBranch(params, bundle, state, tx) {
     const ceiling = resolveCharterCeiling(bundle.intent_checkpoint);
     // Shallow ceiling (default): omit deterministically, no host turn, no lanes.
-    if (!ceilingRequestsCharters(ceiling)) {
+    // Single-sourced with the plan draw's classifier (obligationPolicy.ts).
+    if (charterExtractionOmits(bundle)) {
         return { action: "run_omit" };
     }
     // Per-kind blind lanes (design resolution 2): one submission file per kind,
@@ -968,7 +998,10 @@ export async function handleCharterExtractionBranch(params, bundle, state) {
     let quarantinedAny = false;
     for (const kind of kinds) {
         const lane = charterExtractionLane(kind);
-        const incoming = await tryConsumeSubmission(params.artifactsDir, lane);
+        // Staged per lane; an INCOMPLETE set is restored to its bound paths at
+        // commit (un-applied), which is exactly the K-of-N resume the design
+        // wants — pending lanes survive on disk until every lane is present.
+        const incoming = await tryConsumeSubmission(params.artifactsDir, lane, tx);
         if (incoming.status === "absent")
             continue;
         if (incoming.status === "malformed") {
@@ -1001,25 +1034,24 @@ export async function handleCharterExtractionBranch(params, bundle, state) {
         // wrote). It is handed to the executor by path and deleted after ingest.
         const mergedPath = join(laneAssetsDir(params.artifactsDir), CHARTER_EXTRACTION_MERGED_FILENAME);
         await writeJsonFile(mergedPath, merged);
-        await runAuditStep({
+        const applied = await runAuditStepUnlocked({
             root: params.root,
             artifactsDir: params.artifactsDir,
             preferredExecutor: "charter_extraction_executor",
             charterSubmissionPath: mergedPath,
-        });
+        }, bundle);
         await unlink(mergedPath).catch(() => { });
-        for (const [kind, lane] of laneValues.entries()) {
-            await unlink(lane.path).catch(() => { });
-            await recordLaneOutcome(params.artifactsDir, charterExtractionLane(kind), {
-                kind: "accepted",
-            });
+        for (const lane of laneValues.values()) {
+            // Deletion + accepted events commit WITH the core write (lane.path is
+            // the STAGED file — a throw before the commit restores every lane).
+            markSubmissionApplied(tx, lane.path);
         }
         // Evidence packets are consumed inputs like the lane submissions — a stale
         // packet left behind would feed a later re-extraction yesterday's evidence.
         for (const kind of kinds) {
             await unlink(join(laneAssetsDir(params.artifactsDir), charterExtractionPacketFilename(kind))).catch(() => { });
         }
-        return { action: "continue" };
+        return { action: "continue", bundle: applied.updated_bundle };
     }
     // Missing or quarantined lane(s): a host turn is still owed — the emitter
     // re-materializes only the missing lanes (completed lane results stay).
@@ -1036,23 +1068,21 @@ export async function handleCharterExtractionBranch(params, bundle, state) {
  *   - a `deltas_pending` register with no submission yet → `return` the host step
  *     that renders the charter-delta prompt for the independent miner.
  */
-export async function handleCharterDeltaBranch(params, bundle, state) {
+export async function handleCharterDeltaBranch(params, bundle, state, tx) {
     return runOmittableGate({
         kind: "charter_delta",
         lane: GATE_LANES.charter_delta,
         schema: LANE_SUBMISSION_SCHEMAS[GATE_LANES.charter_delta],
-        apply: async (_value, path, p) => {
-            await runAuditStep({
-                root: p.root,
-                artifactsDir: p.artifactsDir,
-                preferredExecutor: "charter_delta_executor",
-                charterDeltaSubmissionPath: path,
-            });
-        },
+        apply: (_value, path, p, foldBundle) => runAuditStepUnlocked({
+            root: p.root,
+            artifactsDir: p.artifactsDir,
+            preferredExecutor: "charter_delta_executor",
+            charterDeltaSubmissionPath: path,
+        }, foldBundle),
         // Nothing to mine (extraction omitted or no subsystems): settle
         // deterministically, no host turn.
         shouldOmit: (b) => !(b.charter_register?.deltas_pending === true),
-    }, params, bundle, state);
+    }, params, bundle, state, tx);
 }
 /**
  * Handle the `charter_clarification_executor` obligation (Phase D triangulation
@@ -1068,39 +1098,21 @@ export async function handleCharterDeltaBranch(params, bundle, state) {
  *   - once the register exists with ≥1 interactive `asked` question and no answers
  *     yet → `return` the host step that relays the VOI queue.
  */
-export async function handleCharterClarificationBranch(params, bundle, state) {
+export async function handleCharterClarificationBranch(params, bundle, state, tx) {
     return runOmittableGate({
         kind: "charter_clarification",
         lane: GATE_LANES.charter_clarification,
         schema: LANE_SUBMISSION_SCHEMAS[GATE_LANES.charter_clarification],
-        apply: async (_value, path, p) => {
-            await runAuditStep({
-                root: p.root,
-                artifactsDir: p.artifactsDir,
-                preferredExecutor: "charter_clarification_executor",
-                clarificationAnswersPath: path,
-            });
-        },
-        shouldOmit: (b) => {
-            const ceiling = resolveCharterCeiling(b.intent_checkpoint);
-            const attention = resolveClarificationAttention(b.intent_checkpoint);
-            // Shallow ceiling or autonomous (zero-attention) mode: assemble the
-            // register deterministically, no host turn (every question banks as
-            // a finding).
-            if (!ceilingRequestsCharters(ceiling) || attention === 0)
-                return true;
-            // The loop must be COMPUTED before we can relay a queue: if no register
-            // exists yet, run the deterministic assembler this turn (it partitions/
-            // ranks/gates/splits from the charter_register), then re-scan.
-            if (!b.charter_clarification)
-                return true;
-            // Register exists: relay the interactive queue only when there is one
-            // to ask.
-            if ((b.charter_clarification.asked?.length ?? 0) === 0)
-                return true;
-            return false;
-        },
-    }, params, bundle, state);
+        apply: (_value, path, p, foldBundle) => runAuditStepUnlocked({
+            root: p.root,
+            artifactsDir: p.artifactsDir,
+            preferredExecutor: "charter_clarification_executor",
+            clarificationAnswersPath: path,
+        }, foldBundle),
+        // The omit predicate is single-sourced with the plan draw's classifier
+        // (obligationPolicy.ts) — the two draws must agree on the boundary.
+        shouldOmit: charterClarificationOmits,
+    }, params, bundle, state, tx);
 }
 /**
  * Handle the `systemic_challenge_executor` obligation (Phase E — the second-order
@@ -1116,45 +1128,43 @@ export async function handleCharterClarificationBranch(params, bundle, state) {
  * A converged register satisfies the obligation, so this branch is never reached for
  * it (the priority scan skips a satisfied obligation).
  */
-export async function handleSystemicChallengeBranch(params, bundle, state) {
+export async function handleSystemicChallengeBranch(params, bundle, state, tx) {
     return runOmittableGate({
         kind: "systemic_challenge",
         lane: GATE_LANES.systemic_challenge,
         schema: LANE_SUBMISSION_SCHEMAS[GATE_LANES.systemic_challenge],
-        apply: async (_value, path, p) => {
-            await runAuditStep({
-                root: p.root,
-                artifactsDir: p.artifactsDir,
-                preferredExecutor: "systemic_challenge_executor",
-                systemicChallengePath: path,
-            });
-        },
-        shouldOmit: (b) => {
-            // Shallow ceiling (default): omit deterministically, no host turn.
-            if (!ceilingRequestsCharters(resolveCharterCeiling(b.intent_checkpoint)))
-                return true;
-            // The loop must be OPENED before we can dispatch the adversary: if no
-            // register exists yet, run the deterministic executor this turn (it
-            // computes the metrics digest + writes an open register), then re-scan.
-            if (!b.systemic_challenge)
-                return true;
-            // A converged register is already satisfied (never reaches this branch
-            // in practice). An open register → dispatch the next
-            // second-order-adversary round.
-            if (b.systemic_challenge.converged)
-                return true;
-            return false;
-        },
-    }, params, bundle, state);
+        apply: (_value, path, p, foldBundle, staged) => runAuditStepUnlocked({
+            root: p.root,
+            artifactsDir: p.artifactsDir,
+            preferredExecutor: "systemic_challenge_executor",
+            systemicChallengePath: path,
+            // The iterative-fold duplicate guard: the executor's register
+            // records every folded submission's content hash and IGNORES a
+            // duplicate, so a crash-restored already-folded round can never
+            // read as a quiet round and converge the adversary loop falsely.
+            systemicChallengeSubmissionHash: staged.contentHash,
+        }, foldBundle),
+        // Single-sourced with the plan draw's classifier (obligationPolicy.ts).
+        shouldOmit: systemicChallengeOmits,
+    }, params, bundle, state, tx);
 }
 /**
  * Execute one deterministic audit step and record its progress. Throws (with
- * cause) if the executor fails, preserving the existing throw-with-cause pattern.
- * `index` is the 0-based fold position (the transition counter), surfaced as the
- * 1-based `iteration` in the `deterministic-progress.json` marker a
- * filesystem-watching host reads.
+ * cause) if the executor fails, preserving the existing throw-with-cause
+ * pattern. `index` is the 0-based deterministic-dispatch ordinal of this fold
+ * call, surfaced as the 1-based `iteration` in the
+ * `deterministic-progress.json` marker a filesystem-watching host reads
+ * (semantics stated in the marker-protocol note on the fold driver: under one
+ * drain it counts DISPATCHES of this call, no longer outer transitions).
+ *
+ * The dispatch is `runSingleAdvanceStep` on the fold's CARRIED bundle — one
+ * step, no lock (the fold holds the one lock), no persist (the fold commits
+ * once), no reload (disk holds the fold's pre-state). Failure attribution is
+ * dispatch-local: a single step's failing identity IS its selection, recorded
+ * on `failureRef` so the fold's commit-on-throw persists it without a second
+ * lock acquisition (the deleted O2 RMW).
  */
-export async function executeAndRecord(params, analyzers, decision, index, lastSummary) {
+export async function executeAndRecord(params, analyzers, decision, index, lastSummary, bundle, ctx) {
     try {
         // Write a "started" marker before execution so a host watching the filesystem
         // can tell which executor is active during a long-running step (OBS-0d4c2311).
@@ -1166,13 +1176,16 @@ export async function executeAndRecord(params, analyzers, decision, index, lastS
             status: "running",
             started_at: startedAt,
         });
-        const result = await runAuditStep({
+        const indexes = await manifestIndexes(params.root, bundle, ctx.manifestIndexCache);
+        const result = await runSingleAdvanceStep(bundle, {
             root: params.root,
             artifactsDir: params.artifactsDir,
             analyzers,
             graphLlmEdgeReasoning: params.graphLlmEdgeReasoning,
             externalAcquisition: params.externalAcquisition,
             since: params.since,
+            lineIndex: indexes.lineIndex,
+            sizeIndex: indexes.sizeIndex,
         });
         await writeJsonFile(join(params.artifactsDir, "steps", "deterministic-progress.json"), {
             iteration: index + 1,
@@ -1187,32 +1200,23 @@ export async function executeAndRecord(params, analyzers, decision, index, lastS
         return result;
     }
     catch (error) {
-        // `runAuditStep` → `advanceAudit` DRAINS: this one call folds through
-        // successive obligations, so `decision` names only the FIRST one. Reporting
-        // it would attribute a failure in any later fold step to an executor that
-        // already SUCCEEDED (observed: a synthesis_executor blowup recorded against
-        // runtime_validation_executor). The failing identity is read off the error
-        // that carries it; `decision` is only the fallback for a throw raised before
-        // any executor was dispatched.
+        // Dispatch-local attribution: this call ran ONE step, so its selection is
+        // the failing identity; `findExecutorFailure` still reads a wrapped
+        // `ExecutorFailure` when the runner threw one (a forced nested dispatch's
+        // structured error contract survives).
         const failure = findExecutorFailure(error);
         const failedExecutor = failure?.executor ?? decision.selected_executor;
         const failedObligation = failure?.obligation ?? decision.selected_obligation;
-        // O2: error-recovery is itself a load→modify→persist artifact-tree mutation
-        // (runAuditStep has already released its lock by the time we reach this
-        // catch), so hold the artifact-tree lock across the whole RMW.
-        await withFileLock(artifactTreeLockPath(params.artifactsDir), async () => {
-            const current = await loadArtifactBundle(params.artifactsDir);
-            const currentState = deriveAuditState(current);
-            currentState.last_executor = failedExecutor ?? undefined;
-            currentState.last_obligation = failedObligation ?? undefined;
-            await writeCoreArtifacts(params.artifactsDir, { ...current, audit_state: currentState });
-        });
+        // The fold's commit-on-throw persists this attribution in the SINGLE core
+        // commit — the old second lock acquisition here would deadlock against the
+        // fold's own hold (`withFileLock` is non-reentrant).
+        ctx.failureRef.value = { executor: failedExecutor, obligation: failedObligation };
         await writeJsonFile(join(params.artifactsDir, "steps", "deterministic-progress.json"), {
             iteration: index + 1,
             last_executor: failedExecutor,
             last_obligation: failedObligation,
-            // The obligation the drain STARTED from, kept alongside the failing one so
-            // the fold position stays reconstructable from the marker alone.
+            // The obligation the fold selected for this dispatch, kept alongside the
+            // failing one so the fold position stays reconstructable from the marker.
             selected_executor: decision.selected_executor,
             selected_obligation: decision.selected_obligation,
             prior_summary: lastSummary || null,
@@ -1223,6 +1227,27 @@ export async function executeAndRecord(params, analyzers, decision, index, lastS
         throw new Error(`Deterministic executor ${failedExecutor} failed on obligation ${failedObligation} (iteration ${index + 1}, prior progress: ${lastSummary || "none"}): ${detail}`, { cause: error instanceof Error ? error : undefined });
     }
 }
+/**
+ * Line/size indexes for a dispatch, memoized on `repo_manifest` IDENTITY: the
+ * fold dispatches many steps per call and `buildLineIndex` walks real files,
+ * so recomputing per dispatch would regress the drain's cost profile; the
+ * manifest object is replaced whenever intake re-derives it, which is exactly
+ * when the indexes must be rebuilt.
+ */
+async function manifestIndexes(root, bundle, cache) {
+    const manifest = bundle.repo_manifest;
+    if (!manifest)
+        return {};
+    const cached = cache.get(manifest);
+    if (cached)
+        return cached;
+    const built = {
+        lineIndex: await buildLineIndex(root, manifest),
+        sizeIndex: sizeIndexFromManifest(manifest),
+    };
+    cache.set(manifest, built);
+    return built;
+}
 // ── Cycle guards (kept in audit's Ctx; NOT routed through advance) ─────────────
 //
 // HANDOFF approach-B: the shared `advance` engine is inherently 0-tolerance (it
@@ -1282,11 +1307,19 @@ export async function checkNoProgressBeforeDispatch(ctx) {
                 "dispatched this run without net progress; stopping instead of looping.",
             timestamp: new Date().toISOString(),
         });
-        return buildTerminalStep(ctx.params, ctx.bundle, ctx.state, "No-progress guard: a deterministic executor was about to re-run on an " +
-            "artifact state it already processed this run without changing it " +
-            `(obligation ${ctx.selectedObligation ?? "unknown"}, executor ` +
-            `${ctx.selectedExecutor ?? "unknown"}). Stopping to avoid an infinite ` +
-            "no-progress loop.");
+        // A terminal INTENT, not the built terminal: `buildTerminalStep` can
+        // PROMOTE (which deletes artifactsDir), so it must run after the fold's
+        // commit and outside its hold. The marker above is the in-fold record.
+        return {
+            kind: "terminal_intent",
+            bundle: ctx.bundle,
+            state: ctx.state,
+            reason: "No-progress guard: a deterministic executor was about to re-run on an " +
+                "artifact state it already processed this run without changing it " +
+                `(obligation ${ctx.selectedObligation ?? "unknown"}, executor ` +
+                `${ctx.selectedExecutor ?? "unknown"}). Stopping to avoid an infinite ` +
+                "no-progress loop.",
+        };
     }
     ctx.dispatchedSignatures.add(dispatchKey);
     return undefined;
@@ -1312,9 +1345,15 @@ export async function checkFinalizationCycle(ctx) {
             `progress; stopping. Cycling obligations: ${cycle.join(" -> ")}.`,
         timestamp: new Date().toISOString(),
     });
-    return buildTerminalStep(ctx.params, ctx.result.updated_bundle, ctx.result.audit_state, "Finalization is not converging: deterministic executors kept revisiting " +
-        `prior artifact states (${cycle.join(" -> ")}). Review whether these ` +
-        "obligations are erroneously invalidating each other.");
+    // Intent, not the built terminal — see checkNoProgressBeforeDispatch.
+    return {
+        kind: "terminal_intent",
+        bundle: ctx.result.updated_bundle,
+        state: ctx.result.audit_state,
+        reason: "Finalization is not converging: deterministic executors kept revisiting " +
+            `prior artifact states (${cycle.join(" -> ")}). Review whether these ` +
+            "obligations are erroneously invalidating each other.",
+    };
 }
 const EMPTY_FOLD_ADVISORIES = {
     ingestIssues: [],
@@ -1373,6 +1412,9 @@ function blockedFromResult(result) {
             bundle: result.updated_bundle,
             reason: result.progress_summary,
         },
+        // The emit carries the advanced bundle so the fold's single commit
+        // persists what this dispatch produced (audit_state included).
+        state: result.updated_bundle,
     };
 }
 /**
@@ -1388,9 +1430,11 @@ function blockedFromResult(result) {
  * see the cycle-guard section comment.
  */
 async function runDeterministicExecutor(bundle, ctx) {
-    const decision = decideNextStep(bundle);
+    // Emit-off: the fold's driver emits ONE consolidated staleness record at its
+    // boundary (the preserve-list contract), so no in-fold derivation may emit.
+    const decision = decideNextStep(bundle, { emitStaleness: false });
     const noProgress = await checkNoProgressBeforeDispatch({
-        index: ctx.iterationRef.value,
+        index: ctx.dispatchOrdinalRef.value,
         dispatchedSignatures: ctx.dispatchedSignatures,
         params: ctx.params,
         bundle,
@@ -1398,15 +1442,16 @@ async function runDeterministicExecutor(bundle, ctx) {
         selectedObligation: decision.selected_obligation,
         selectedExecutor: decision.selected_executor,
     });
-    if (noProgress !== undefined)
-        return { kind: "emit", step: noProgress };
-    const result = await executeAndRecord(ctx.params, ctx.analyzersRef.value, decision, ctx.iterationRef.value, ctx.lastSummaryRef.value);
+    if (noProgress !== undefined) {
+        return { kind: "emit", step: noProgress, state: bundle };
+    }
+    const result = await executeAndRecord(ctx.params, ctx.analyzersRef.value, decision, ctx.dispatchOrdinalRef.value, ctx.lastSummaryRef.value, bundle, ctx);
     ctx.lastSummaryRef.value = result.progress_summary;
     if (!result.progress_made) {
         return blockedFromResult(result);
     }
     const cycle = await checkFinalizationCycle({
-        index: ctx.iterationRef.value,
+        index: ctx.dispatchOrdinalRef.value,
         obligationTrail: ctx.obligationTrail,
         seenStateSignatures: ctx.seenStateSignatures,
         tolerance: FINALIZATION_CYCLE_TOLERANCE,
@@ -1416,9 +1461,15 @@ async function runDeterministicExecutor(bundle, ctx) {
         result,
         selectedObligation: decision.selected_obligation,
     });
-    if (cycle !== undefined)
-        return { kind: "emit", step: cycle };
-    return { kind: "transition", state: await loadArtifactBundle(ctx.params.artifactsDir) };
+    if (cycle !== undefined) {
+        return { kind: "emit", step: cycle, state: result.updated_bundle };
+    }
+    // One counted, signed dispatch — the guards' unit (CX-02 constraint 1).
+    ctx.dispatchOrdinalRef.value += 1;
+    // The IN-MEMORY carry: the dispatch's own updated bundle, fresh identity by
+    // construction. A disk reload here would read the fold's pre-state and
+    // silently roll back everything the fold has done (persist-once).
+    return { kind: "transition", state: result.updated_bundle };
 }
 /**
  * `derive` for an audit obligation: look up its precomputed satisfaction state
@@ -1434,25 +1485,23 @@ function deriveObligationState(id, cache) {
             return "satisfied";
         let state = cache.get(bundle);
         if (!state) {
-            // MEMOIZED per bundle IDENTITY, exactly as the inner drain's namesake in
+            // MEMOIZED per bundle IDENTITY, exactly as the plan draw's namesake in
             // `orchestrator/advance.ts` is — and for the same reason. `advance` scans
             // by calling EVERY registered def's `derive`, so without this the fold
             // ran the holistic `deriveAuditState` once PER OBLIGATION per scan: 25
-            // full staleness passes to answer one question. That is the same
-            // regression `6145a1a3` measured and memoized away on the inner side; it
-            // was simply never applied here.
+            // full staleness passes to answer one question (the regression
+            // `6145a1a3` measured and memoized away).
             //
             // The key is safe for the same reason it is safe there: identity changes
-            // at every transition (each one loads or builds a fresh bundle), and the
+            // at every transition (each one carries a fresh bundle), and the
             // `complete` gate above can only flip via a transition. So an entry can
             // never outlive the state it was derived under.
             //
-            // Emission stays at the DEFAULT here, unlike the inner drain's
-            // `emitStaleness: false`. This layer IS the boundary the inner one defers
-            // its record to, so it must still emit — and now it emits once per scan
-            // rather than relying on `emitStalenessRecord`'s last-key latch to
-            // swallow 24 duplicates.
-            state = deriveAuditState(bundle);
+            // EMIT-OFF, like every in-fold derivation (CX-02): the fold's DRIVER
+            // emits the ONE consolidated staleness record at its boundary — the
+            // preserve-list contract — so a derive that emitted per scan miss would
+            // turn one call's cascade back into a record per carried bundle.
+            state = deriveAuditState(bundle, { emitStaleness: false });
             cache.set(bundle, state);
         }
         const found = state.obligations.find((o) => o.id === id);
@@ -1473,250 +1522,194 @@ function deriveObligationState(id, cache) {
  * priority scan it mirrors.
  */
 export function buildAuditObligations() {
-    // One memo per registry construction, shared by every def in it — the same
-    // shape `buildDrainObligations` uses. Scoped to the call so it dies with the
-    // fold it was built for, and keyed on bundle identity so it cannot outlive a
-    // transition.
+    // One memo per registry construction, shared by every def in it. Scoped to
+    // the call so it dies with the fold it was built for, and keyed on bundle
+    // identity so it cannot outlive a transition.
     const cache = new WeakMap();
-    const deterministic = (id) => ({
-        id,
-        derive: deriveObligationState(id, cache),
-        execute: (bundle, ctx) => runDeterministicExecutor(bundle, ctx),
-    });
-    return [
-        deterministic("repo_manifest"),
-        deterministic("file_disposition"),
-        deterministic("auto_fixes_applied"),
-        deterministic("syntax_resolved"),
-        {
-            // External analyzers: the Item B consent fold runs FIRST — applicable
-            // consent-gated candidates with no recorded decision surface ONE batched
-            // operator offer (or consume the arrived decisions file), and only then
-            // does the deterministic acquisition executor run.
-            id: "external_analyzers_current",
-            derive: deriveObligationState("external_analyzers_current", cache),
-            execute: async (bundle, ctx) => {
-                const state = deriveAuditState(bundle);
-                const branch = await handleAnalyzerConsentBranch(ctx.params, bundle, state, ctx.analyzersRef);
-                if (branch.action === "return") {
-                    return { kind: "emit", step: branch.result };
-                }
-                if (branch.action === "continue") {
-                    return { kind: "transition", state: await loadArtifactBundle(ctx.params.artifactsDir) };
-                }
-                return runDeterministicExecutor(bundle, ctx);
-            },
-        },
-        deterministic("structure_artifacts"),
-        {
-            // Critical-flow fallback: when deterministic flow inference fell below the
-            // confidence bar, poll the host submission (persist it → structure re-merges
-            // on the next fold) or emit the host step. No autonomous omit — the host is
-            // always available to author the enrichment. Non-drainable (host_delegation),
-            // so the drain stops here when a submission is still owed.
-            id: "critical_flow_fallback_current",
-            derive: deriveObligationState("critical_flow_fallback_current", cache),
-            execute: async (bundle, ctx) => {
-                const state = deriveAuditState(bundle);
-                const branch = await handleCriticalFlowFallbackBranch(ctx.params, bundle, state);
-                if (branch.action === "return") {
-                    return { kind: "emit", step: branch.result };
-                }
-                // continue: a submission was consumed + persisted — re-scan (structure
-                // then re-stales + rebuilds critical_flows off the merged flows).
-                return { kind: "transition", state: await loadArtifactBundle(ctx.params.artifactsDir) };
-            },
+    // The 13 BESPOKE per-obligation host-boundary policy bodies — the content
+    // the one registry carries beyond its PRIORITY-derived skeleton. Their
+    // branch predicates are single-sourced with the plan draw's classifier
+    // (`obligationPolicy.ts`), so the two draws agree on WHERE the boundary is;
+    // what only this draw may do is CONSUME (stage/apply/quarantine) and EMIT.
+    //
+    // Every `emit` carries `state:` — the engine persists the outcome's state at
+    // the fold's single commit, so an emit that advanced the bundle and omitted
+    // it would silently roll its own work back. Every `transition` carries the
+    // handler's returned bundle (an in-memory carry, never a disk reload).
+    const bespoke = {
+        // External analyzers: the Item B consent fold runs FIRST — applicable
+        // consent-gated candidates with no recorded decision surface ONE batched
+        // operator offer (or consume the arrived decisions file), and only then
+        // does the deterministic acquisition executor run.
+        external_analyzers_current: async (bundle, ctx) => {
+            const state = deriveAuditState(bundle, { emitStaleness: false });
+            const branch = await handleAnalyzerConsentBranch(ctx.params, bundle, state, ctx.analyzersRef, ctx.tx);
+            if (branch.action === "return") {
+                return { kind: "emit", step: branch.result, state: bundle };
+            }
+            if (branch.action === "continue") {
+                return { kind: "transition", state: bundle };
+            }
+            return runDeterministicExecutor(bundle, ctx);
         },
-        {
-            // Graph enrichment: poll the analyzer-decision / edge-reasoning lane
-            // artifacts first (emit a host step when one is needed), otherwise run the
-            // deterministic enrichment executor.
-            id: "graph_enrichment_current",
-            derive: deriveObligationState("graph_enrichment_current", cache),
-            execute: async (bundle, ctx) => {
-                const state = deriveAuditState(bundle);
-                const branch = await handleGraphEnrichmentBranch(ctx.params, bundle, state, ctx.analyzersRef);
-                if (branch.action === "return") {
-                    return { kind: "emit", step: branch.result };
-                }
-                if (branch.action === "continue") {
-                    // A decisions/edge file was consumed (and possibly applied): re-scan on
-                    // the reloaded bundle without running the executor this turn.
-                    return { kind: "transition", state: await loadArtifactBundle(ctx.params.artifactsDir) };
-                }
-                // fallthrough: run the deterministic enrichment executor.
+        // Critical-flow fallback: when deterministic flow inference fell below the
+        // confidence bar, apply the host submission against the carried bundle or
+        // emit the host step. No autonomous omit — the host is always available to
+        // author the enrichment.
+        critical_flow_fallback_current: async (bundle, ctx) => {
+            const state = deriveAuditState(bundle, { emitStaleness: false });
+            const branch = await handleCriticalFlowFallbackBranch(ctx.params, bundle, state, ctx.tx);
+            if (branch.action === "return") {
+                return { kind: "emit", step: branch.result, state: bundle };
+            }
+            if (branch.action === "run_omit") {
                 return runDeterministicExecutor(bundle, ctx);
-            },
-        },
-        deterministic("design_assessment_current"),
-        deterministic("structure_decomposition_current"),
-        deterministic("docs_digest_current"),
-        {
-            // Confirm-intent host step: the host writes intent_checkpoint.json (read by
-            // deriveAuditState on re-invocation), so there is no submission to
-            // consume — emit the step directly.
-            id: "intent_checkpoint_current",
-            derive: deriveObligationState("intent_checkpoint_current", cache),
-            execute: async (bundle) => ({
-                kind: "emit",
-                step: { kind: "confirm_intent", state: deriveAuditState(bundle), bundle },
-            }),
-        },
-        {
-            // DD-9 intent-equivalence gate: consume a judge verdict (validated +
-            // quarantined-loudly), resolve the deterministic arms in-fold (baseline
-            // stamp / gate-version-stale / structured delta), or emit the bounded
-            // prose-equivalence judge step. Sits between the intent checkpoint and
-            // every consumer of it, so a pending judgment pauses the cascade instead
-            // of racing it.
-            id: "intent_equivalence_current",
-            derive: deriveObligationState("intent_equivalence_current", cache),
-            execute: async (bundle, ctx) => {
-                const state = deriveAuditState(bundle);
-                const branch = await handleIntentEquivalenceBranch(ctx.params, bundle, state);
-                if (branch.action === "return") {
-                    return { kind: "emit", step: branch.result };
-                }
-                if (branch.action === "run_omit") {
-                    return runDeterministicExecutor(bundle, ctx);
-                }
-                return { kind: "transition", state: await loadArtifactBundle(ctx.params.artifactsDir) };
-            },
+            }
+            return { kind: "transition", state: branch.bundle };
         },
-        {
-            // Charter extraction (Phase C): poll the lane submissions (ingest+gate),
-            // omit at a shallow ceiling, or emit the host charter-extraction step at a
-            // deep+ ceiling. Mirrors the synthesis-narrative branch.
-            id: "charter_extraction_current",
-            derive: deriveObligationState("charter_extraction_current", cache),
-            execute: async (bundle, ctx) => {
-                const state = deriveAuditState(bundle);
-                const branch = await handleCharterExtractionBranch(ctx.params, bundle, state);
-                if (branch.action === "return") {
-                    return { kind: "emit", step: branch.result };
-                }
-                if (branch.action === "run_omit") {
-                    return runDeterministicExecutor(bundle, ctx);
-                }
-                return { kind: "transition", state: await loadArtifactBundle(ctx.params.artifactsDir) };
-            },
+        // Graph enrichment: poll the analyzer-decision / edge-reasoning lane
+        // artifacts first (emit a host step when one is needed), otherwise run the
+        // deterministic enrichment executor.
+        graph_enrichment_current: async (bundle, ctx) => {
+            const state = deriveAuditState(bundle, { emitStaleness: false });
+            const branch = await handleGraphEnrichmentBranch(ctx.params, bundle, state, ctx.analyzersRef, ctx.tx);
+            if (branch.action === "return") {
+                return { kind: "emit", step: branch.result, state: bundle };
+            }
+            if (branch.action === "continue") {
+                return { kind: "transition", state: branch.bundle };
+            }
+            return runDeterministicExecutor(bundle, ctx);
         },
-        {
-            // Charter delta-mining (Phase C.2): poll the delta lane submission
-            // (route+gate it), settle deterministically when the register is not
-            // deltas_pending (extraction omitted / no subsystems), or emit the host step
-            // for the INDEPENDENT delta-miner when a deltas_pending register has no
-            // submission yet. Mirrors the charter-extraction branch.
-            id: "charter_delta_current",
-            derive: deriveObligationState("charter_delta_current", cache),
-            execute: async (bundle, ctx) => {
-                const state = deriveAuditState(bundle);
-                const branch = await handleCharterDeltaBranch(ctx.params, bundle, state);
-                if (branch.action === "return") {
-                    return { kind: "emit", step: branch.result };
-                }
-                if (branch.action === "run_omit") {
-                    return runDeterministicExecutor(bundle, ctx);
-                }
-                return { kind: "transition", state: await loadArtifactBundle(ctx.params.artifactsDir) };
+        // Confirm-intent host step: the host writes intent_checkpoint.json (read by
+        // deriveAuditState on re-invocation), so there is no submission to
+        // consume — emit the step directly.
+        intent_checkpoint_current: async (bundle) => ({
+            kind: "emit",
+            step: {
+                kind: "confirm_intent",
+                state: deriveAuditState(bundle, { emitStaleness: false }),
+                bundle,
             },
+            state: bundle,
+        }),
+        // DD-9 intent-equivalence gate: consume a judge verdict (validated +
+        // quarantined-loudly), resolve the deterministic arms in-fold, or emit the
+        // bounded prose-equivalence judge step.
+        intent_equivalence_current: async (bundle, ctx) => {
+            const state = deriveAuditState(bundle, { emitStaleness: false });
+            const branch = await handleIntentEquivalenceBranch(ctx.params, bundle, state, ctx.tx);
+            if (branch.action === "return") {
+                return { kind: "emit", step: branch.result, state: bundle };
+            }
+            if (branch.action === "run_omit") {
+                return runDeterministicExecutor(bundle, ctx);
+            }
+            return { kind: "transition", state: branch.bundle };
         },
-        {
-            // Contract design-review pass: poll the contract/conceptual lanes;
-            // emit the dispatch step when a pass still needs to run.
-            id: "design_review_contract_completed",
-            derive: deriveObligationState("design_review_contract_completed", cache),
-            execute: (bundle, ctx) => runDesignReviewObligation(bundle, ctx),
-        },
-        {
-            // Conceptual design-review pass: same submission-poll handler (it resolves
-            // which pass remains).
-            id: "design_review_conceptual_completed",
-            derive: deriveObligationState("design_review_conceptual_completed", cache),
-            execute: (bundle, ctx) => runDesignReviewObligation(bundle, ctx),
+        // Charter extraction (Phase C): consume the lane submissions (ingest+gate),
+        // omit at a shallow ceiling, or emit the host charter-extraction step.
+        charter_extraction_current: async (bundle, ctx) => {
+            const state = deriveAuditState(bundle, { emitStaleness: false });
+            const branch = await handleCharterExtractionBranch(ctx.params, bundle, state, ctx.tx);
+            if (branch.action === "return") {
+                return { kind: "emit", step: branch.result, state: bundle };
+            }
+            if (branch.action === "run_omit") {
+                return runDeterministicExecutor(bundle, ctx);
+            }
+            return { kind: "transition", state: branch.bundle };
         },
-        {
-            // Charter clarification (Phase D triangulation loop): poll the answers lane
-            // (apply + re-split), assemble the loop deterministically at a shallow ceiling
-            // / zero attention (autonomous), or emit the host step relaying the VOI-ranked
-            // interactive queue at a deep+ ceiling with attention > 0. Non-drainable
-            // (host_delegation), so the drain stops here.
-            id: "charter_clarification_current",
-            derive: deriveObligationState("charter_clarification_current", cache),
-            execute: async (bundle, ctx) => {
-                const state = deriveAuditState(bundle);
-                const branch = await handleCharterClarificationBranch(ctx.params, bundle, state);
-                if (branch.action === "return") {
-                    return { kind: "emit", step: branch.result };
-                }
-                if (branch.action === "run_omit") {
-                    return runDeterministicExecutor(bundle, ctx);
-                }
-                return { kind: "transition", state: await loadArtifactBundle(ctx.params.artifactsDir) };
-            },
+        // Charter delta-mining (Phase C.2): consume the delta lane submission,
+        // settle deterministically when the register is not deltas_pending, or
+        // emit the independent delta-miner's host step.
+        charter_delta_current: async (bundle, ctx) => {
+            const state = deriveAuditState(bundle, { emitStaleness: false });
+            const branch = await handleCharterDeltaBranch(ctx.params, bundle, state, ctx.tx);
+            if (branch.action === "return") {
+                return { kind: "emit", step: branch.result, state: bundle };
+            }
+            if (branch.action === "run_omit") {
+                return runDeterministicExecutor(bundle, ctx);
+            }
+            return { kind: "transition", state: branch.bundle };
         },
-        {
-            // Systemic challenge (Phase E loop-until-dry): poll the adversary lane's
-            // round (fold it), omit at a shallow ceiling, or emit the second-order-adversary
-            // host step when the loop is open at a deep+ ceiling. Non-drainable
-            // (host_delegation), so the drain stops here.
-            id: "systemic_challenge_current",
-            derive: deriveObligationState("systemic_challenge_current", cache),
-            execute: async (bundle, ctx) => {
-                const state = deriveAuditState(bundle);
-                const branch = await handleSystemicChallengeBranch(ctx.params, bundle, state);
-                if (branch.action === "return") {
-                    return { kind: "emit", step: branch.result };
-                }
-                if (branch.action === "run_omit") {
-                    return runDeterministicExecutor(bundle, ctx);
-                }
-                return { kind: "transition", state: await loadArtifactBundle(ctx.params.artifactsDir) };
-            },
+        // The two design-review passes share one submission-poll handler (it
+        // resolves which pass remains).
+        design_review_contract_completed: (bundle, ctx) => runDesignReviewObligation(bundle, ctx),
+        design_review_conceptual_completed: (bundle, ctx) => runDesignReviewObligation(bundle, ctx),
+        // Charter clarification (Phase D triangulation loop).
+        charter_clarification_current: async (bundle, ctx) => {
+            const state = deriveAuditState(bundle, { emitStaleness: false });
+            const branch = await handleCharterClarificationBranch(ctx.params, bundle, state, ctx.tx);
+            if (branch.action === "return") {
+                return { kind: "emit", step: branch.result, state: bundle };
+            }
+            if (branch.action === "run_omit") {
+                return runDeterministicExecutor(bundle, ctx);
+            }
+            return { kind: "transition", state: branch.bundle };
         },
-        deterministic("planning_artifacts"),
-        {
-            // The audit-task dispatch obligation maps to the host-delegation
-            // semantic_review_executor (no deterministic runner) → host review.
-            id: "audit_tasks_completed",
-            derive: deriveObligationState("audit_tasks_completed", cache),
-            execute: (bundle, ctx) => runHostDelegationObligation(bundle, ctx),
+        // Systemic challenge (Phase E loop-until-dry).
+        systemic_challenge_current: async (bundle, ctx) => {
+            const state = deriveAuditState(bundle, { emitStaleness: false });
+            const branch = await handleSystemicChallengeBranch(ctx.params, bundle, state, ctx.tx);
+            if (branch.action === "return") {
+                return { kind: "emit", step: branch.result, state: bundle };
+            }
+            if (branch.action === "run_omit") {
+                return runDeterministicExecutor(bundle, ctx);
+            }
+            return { kind: "transition", state: branch.bundle };
         },
-        deterministic("audit_results_ingested"),
-        deterministic("runtime_validation_current"),
-        deterministic("synthesis_current"),
-        {
-            // Synthesis narrative: poll the narrative lane; emit the host step when
-            // narrative is enabled and not yet supplied, otherwise the deterministic
-            // omit runs (fold on).
-            id: "synthesis_narrative_current",
-            derive: deriveObligationState("synthesis_narrative_current", cache),
-            execute: async (bundle, ctx) => {
-                const state = deriveAuditState(bundle);
-                const branch = await handleSynthesisNarrativeBranch(ctx.params, bundle, state);
-                if (branch.action === "return") {
-                    return { kind: "emit", step: branch.result };
-                }
-                if (branch.action === "run_omit") {
-                    // Narrative disabled: run the deterministic omit executor so the
-                    // status:omitted marker is written and the obligation is satisfied.
-                    // (A bare reload here would leave it actionable and spin the fold.)
-                    return runDeterministicExecutor(bundle, ctx);
-                }
-                // continue: a narrative submission was consumed + applied — re-scan.
-                return { kind: "transition", state: await loadArtifactBundle(ctx.params.artifactsDir) };
-            },
+        // The audit-task dispatch obligation maps to the host-delegation
+        // semantic_review_executor (no deterministic runner) → host review.
+        audit_tasks_completed: (bundle, ctx) => runHostDelegationObligation(bundle, ctx),
+        // Synthesis narrative: consume the narrative lane; emit the host step when
+        // narrative is enabled and not yet supplied, otherwise the deterministic
+        // omit runs (fold on).
+        synthesis_narrative_current: async (bundle, ctx) => {
+            const state = deriveAuditState(bundle, { emitStaleness: false });
+            const branch = await handleSynthesisNarrativeBranch(ctx.params, bundle, state, ctx.tx);
+            if (branch.action === "return") {
+                return { kind: "emit", step: branch.result, state: bundle };
+            }
+            if (branch.action === "run_omit") {
+                // Narrative disabled: run the deterministic omit executor so the
+                // status:omitted marker is written and the obligation is satisfied.
+                return runDeterministicExecutor(bundle, ctx);
+            }
+            // continue: a narrative submission was consumed + applied — re-scan.
+            return { kind: "transition", state: branch.bundle };
         },
-    ];
+    };
+    // The registry's membership and order DERIVE from PRIORITY — never a second
+    // hand-enumerated list, so an id cannot be in the scan and absent from the
+    // registry (this derivation dissolved the fold-array⇄PRIORITY sync tests).
+    // `friction_capture_current` gets a plain def and stays inert by absence:
+    // `deriveAuditState` never emits it, so its derive is always satisfied.
+    for (const id of Object.keys(bespoke)) {
+        if (!PRIORITY.includes(id)) {
+            throw new Error(`buildAuditObligations: bespoke policy body for "${id}" names an id absent from PRIORITY — the registry derives from PRIORITY, so this body could never run`);
+        }
+    }
+    return PRIORITY.map((id) => ({
+        id,
+        derive: deriveObligationState(id, cache),
+        execute: bespoke[id] ??
+            ((bundle, ctx) => runDeterministicExecutor(bundle, ctx)),
+    }));
 }
 /** Shared design-review-pass executor (both pass obligations route here). */
 async function runDesignReviewObligation(bundle, ctx) {
-    const state = deriveAuditState(bundle);
-    const branch = await handleDesignReviewBranch(ctx.params, bundle, state);
+    const state = deriveAuditState(bundle, { emitStaleness: false });
+    const branch = await handleDesignReviewBranch(ctx.params, bundle, state, ctx.tx);
     if (branch.action === "return") {
-        return { kind: "emit", step: branch.result };
+        // The handler's carried bundle rides BOTH the step (the renderer reads the
+        // rejection notes off it) and the emit's state (the commit persists them).
+        return { kind: "emit", step: branch.result, state: branch.result.bundle };
     }
-    return { kind: "transition", state: await loadArtifactBundle(ctx.params.artifactsDir) };
+    return { kind: "transition", state: branch.bundle };
 }
 /**
  * Host-delegation dispatch obligation (`audit_tasks_completed` →
@@ -1726,7 +1719,7 @@ async function runDesignReviewObligation(bundle, ctx) {
  * delegation executor emits the same blocked step the no-executor branch did.
  */
 async function runHostDelegationObligation(bundle, ctx) {
-    const decision = decideNextStep(bundle);
+    const decision = decideNextStep(bundle, { emitStaleness: false });
     const state = decision.state;
     if (!decision.selected_executor) {
         return emitNoExecutorBlocked(bundle, ctx, decision);
@@ -1783,12 +1776,14 @@ async function runHostDelegationObligation(bundle, ctx) {
         const pendingIds = new Set(buildPendingAuditTasks(bundle).map((task) => task.task_id));
         const pendingAccepted = acceptedResults.filter((result) => pendingIds.has(result.task_id));
         if (pendingAccepted.length > 0) {
-            const ingested = await runAuditStep({
+            // Forced, lock-free, against the CARRIED bundle: the fold owns the one
+            // hold and the one persist.
+            const ingested = await runAuditStepUnlocked({
                 root: ctx.params.root,
                 artifactsDir: ctx.params.artifactsDir,
                 preferredExecutor: "result_ingestion_executor",
                 auditResultsData: [...pendingAccepted],
-            });
+            }, bundle);
             // The transition returns before any emission, and the NEXT ingest skips
             // already-accepted bindings — so this fold's advisories would be a
             // one-shot loss. Carry them in the ctx ref; the semantic-review emit
@@ -1801,7 +1796,13 @@ async function runHostDelegationObligation(bundle, ctx) {
             return { kind: "transition", state: ingested.updated_bundle };
         }
     }
-    const review = await ensureSemanticReviewRun({
+    // The UNLOCKED variant: the fold already holds the artifact-tree lock, and
+    // `withFileLock` is non-reentrant — the locking `ensureSemanticReviewRun`
+    // here would be a deterministic FileLockTimeoutError on the audit loop's
+    // most common exit path. Its blocked core state rides the emit's `state`
+    // below, so the fold's single commit persists it (the pause's own persist
+    // was the split's other half).
+    const review = await ensureSemanticReviewRunUnlocked({
         root: ctx.params.root,
         artifactsDir: ctx.params.artifactsDir,
         bundle,
@@ -1836,6 +1837,9 @@ async function runHostDelegationObligation(bundle, ctx) {
                 ],
             }
             : emitted,
+        // The pause's blocked core state — the fold's single commit persists it
+        // (the locking variant's own write was the other half of the split).
+        state: review.bundle,
     };
 }
 /** Emit the no-executor blocked step (the hand loop's `!selected_executor` arm). */
@@ -1849,23 +1853,27 @@ async function emitNoExecutorBlocked(bundle, ctx, decision) {
         audit_state: state,
         progress_summary: reason,
     });
-    return { kind: "emit", step: { kind: "blocked", state, bundle, reason } };
+    return { kind: "emit", step: { kind: "blocked", state, bundle, reason }, state: bundle };
 }
 /**
- * Wrap each obligation so the transition counter advances exactly once per fold
- * iteration — the analog of the hand loop's `index++`. Incrementing AFTER a
- * `transition` (and never on an `emit`, which exits the fold) means during any
- * `execute` the counter holds the current iteration's 0-based index, which the
- * two cycle guards read as `index`. Single point of truth so a new obligation
- * cannot forget to count.
+ * Wrap each obligation so the fold's CURRENT carried bundle is always
+ * observable on the ctx — the commit-on-throw path persists it, and a throw
+ * unwinds the engine before it can return its state. Single point of truth so
+ * a new obligation cannot forget to track. (The dispatch ordinal the guards
+ * read is counted at the dispatch site, `runDeterministicExecutor` — a policy
+ * transition mints no new artifact state, so it does not count.)
  */
-function countTransitions(obligations) {
+function trackFoldBundle(obligations) {
     return obligations.map((obligation) => ({
         ...obligation,
         execute: async (bundle, ctx) => {
             const outcome = await obligation.execute(bundle, ctx);
-            if (outcome.kind === "transition")
-                ctx.iterationRef.value += 1;
+            if (outcome.kind === "transition") {
+                ctx.currentBundleRef.value = outcome.state;
+            }
+            else if (outcome.state !== undefined) {
+                ctx.currentBundleRef.value = outcome.state;
+            }
             return outcome;
         },
     }));
@@ -1936,21 +1944,114 @@ export async function runDeterministicForNextStep(params) {
                 validationWarnings: [...EMPTY_FOLD_ADVISORIES.validationWarnings],
             },
         },
-        iterationRef: { value: 0 },
+        dispatchOrdinalRef: { value: 0 },
         dispatchedSignatures: new Set(),
         seenStateSignatures: new Set(),
         obligationTrail: [],
+        tx: createFoldTransaction(),
+        currentBundleRef: { value: {} },
+        failureRef: { value: null },
+        manifestIndexCache: new WeakMap(),
     };
-    const startBundle = await loadArtifactBundle(params.artifactsDir);
-    const outcome = await advance({
-        priority: PRIORITY,
-        obligations: countTransitions(buildAuditObligations()),
-    }, startBundle, ctx);
-    if (outcome.step)
+    // ONE hold, ONE core commit (CX-02 constraint 3): the whole drain runs under
+    // a single artifact-tree lock, carries its bundle in memory, and lands ONE
+    // authoritative core write at the boundary — on EVERY exit, the throw path
+    // included (a persist only on success would drop the failure attribution the
+    // recovery path reads). Non-core writes (markers, handoff, quarantine, the
+    // durable analyzer stores) stay mid-fold by design: the delivered property
+    // is one CORE write boundary, not one persist boundary.
+    resetStalenessDedup();
+    const foldLogger = new RunLogger(join(params.artifactsDir, "run.log.jsonl"), {
+        enabled: true,
+    });
+    const outcome = await withArtifactTreeHold(params.artifactsDir, foldLogger, async () => {
+        // CX-02 hold measurement: time the IN-HOLD span (acquire→release, this
+        // callback), and record the engine's own charged-execution count. The
+        // `finally` below runs on the throw path too, still under the hold.
+        const holdStartMs = Date.now();
+        let chargedExecutions;
+        await recoverStagedSubmissions(params.artifactsDir);
+        const startBundle = await loadArtifactBundle(params.artifactsDir);
+        ctx.currentBundleRef.value = startBundle;
+        try {
+            const engineOutcome = await advance({
+                priority: PRIORITY,
+                obligations: trackFoldBundle(buildAuditObligations()),
+            }, startBundle, ctx, {
+                maxTransitions: engineMaxTransitions(),
+                maxExecutions: MAX_DRAIN_STEPS,
+            });
+            chargedExecutions = engineOutcome.executions;
+            await commitFold(params.artifactsDir, engineOutcome.state, ctx.tx);
+            return engineOutcome;
+        }
+        catch (error) {
+            // Commit-on-throw: persist the carried bundle WITH dispatch-local
+            // failure attribution, then rethrow. This replaces the old catch's
+            // second lock acquisition (a deterministic timeout under one hold).
+            const bundle = ctx.currentBundleRef.value;
+            const failure = ctx.failureRef.value ??
+                (() => {
+                    const found = findExecutorFailure(error);
+                    return found
+                        ? { executor: found.executor, obligation: found.obligation }
+                        : null;
+                })();
+            const failedState = deriveAuditState(bundle, { emitStaleness: false });
+            failedState.last_executor = failure?.executor ?? undefined;
+            failedState.last_obligation = failure?.obligation ?? undefined;
+            await commitFold(params.artifactsDir, { ...bundle, audit_state: failedState }, ctx.tx);
+            throw error;
+        }
+        finally {
+            foldLogger.event({
+                kind: "outcome",
+                note: "fold_hold",
+                duration_ms: Date.now() - holdStartMs,
+                ...(chargedExecutions === undefined
+                    ? {}
+                    : { executions: chargedExecutions }),
+            });
+        }
+    });
+    // The ONE consolidated staleness record for the whole fold (preserve list):
+    // every in-fold derivation ran emit-off, so this is the only scan-level
+    // record this call emits (forced applies keep their own per-apply records,
+    // exactly as each per-transition runAuditStep call did before the collapse).
+    const finalStale = computeStaleArtifacts(outcome.state, { emit: false });
+    emitStalenessRecord(finalStale, isMetadataMigrationStaleness(outcome.state)
+        ? "metadata_schema_version_migration"
+        : undefined);
+    if (outcome.step) {
+        if (outcome.step.kind === "terminal_intent") {
+            // Guard terminals convert POST-commit, POST-hold: buildTerminalStep can
+            // promote, and promotion deletes artifactsDir.
+            return await buildTerminalStep(params, outcome.step.bundle, outcome.step.state, outcome.step.reason);
+        }
         return outcome.step;
-    // This call supplies no `maxTransitions`, so the bound in force IS the engine
-    // default — `describeStoppedFold` reads it from the same place rather than
-    // this site restating the constant.
+    }
+    if (outcome.stopped === "budget") {
+        // The pacing cap (MAX_DRAIN_STEPS charged executions), spent gracefully:
+        // the run is paused resumably — the committed state resumes on the next
+        // call. Never non-convergence; never routed through the stalled branch.
+        const bundle = outcome.state;
+        const state = bundle.audit_state ?? deriveAuditState(bundle, { emitStaleness: false });
+        const reason = `Pacing cap: this call spent its ${MAX_DRAIN_STEPS}-execution budget and paused. ` +
+            "Nothing is wrong — the fold's work is committed; re-run next-step to resume.";
+        await writeHandoffOnly({
+            root: params.root,
+            artifactsDir: params.artifactsDir,
+            bundle,
+            audit_state: state,
+            progress_summary: reason,
+        });
+        return { kind: "blocked", state, bundle, reason };
+    }
+    // The engine stamps the limit that fired on the result (`stoppedBound`), so
+    // `describeStoppedFold` reports the number in force with nothing restated
+    // here. Budget stops were handled above; what reaches this branch is genuine
+    // non-convergence (the derived transition backstop, which the execution
+    // budget makes unreachable in practice — a backstop firing IS the anomaly).
     const stalled = describeStoppedFold(outcome);
     if (stalled) {
         // The engine's bound is its runaway backstop, and audit deliberately