audit-tools 0.51.7 → 0.51.9

package/dist/remediate/steps/nextStep.js

@@ -1,21 +1,25 @@
+// sites-pinned: tests/remediate/friction-capture-closeout.test.ts, tests/remediate/next-step-lifecycle.test.ts, tests/remediate/next-step-pipeline-dispatch.test.ts, tests/remediate/next-step-outcomes-contract.test.ts, tests/remediate/integration-pipeline.test.ts, tests/remediate/outcomes-roundtrip.test.ts, tests/remediate/phase-close.test.ts, tests/remediate/grounding.test.ts
+// (the free-form branch's write
+// scope is normalized — a backslash-spelled citation no longer wedges prepare)
+import { AUDIT_TOOLS_DIRNAME } from "../../shared/io/auditToolsPaths.js";
 import { loadRemediateSessionConfig } from "./sessionConfigLoad.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { StateStore } from "../state/store.js";
 // IO / validation / rendering helpers
-import { discardOnSchemaVersionMismatch, readOptionalJsonFile, stagedAndUntracked, writeJsonFile, writeTextFile, buildAuditDeliverablePair, formatValidationIssues, isRecord, withFsRetry, RunLogger, coerceJsonObjectArg, renderPromptCommand, headCommit, projectAuditFindingsReportSubset, 
+import { discardOnSchemaVersionMismatch, readOptionalJsonFile, stagedAndUntracked, writeJsonFile, writeTextFile, buildAuditDeliverablePair, formatValidationIssues, isMissingObservation, isRecord, withFsRetry, RunLogger, coerceJsonObjectArg, renderPromptCommand, headCommit, projectAuditFindingsReportSubset, 
 // obligation engine + intent
 interpretFreeFormIntent, interpretIntent, unresolvedFromClauses, advance, describeStoppedFold, decideFrictionTriage, buildFrictionTriageBlock, linkFrictionRunIds, 
 // domain constants
-LENSES, SEVERITIES, CLOSING_ACTIONS, detectProjectFacts, isClosingAction, neutralProjectFacts, } from "audit-tools/shared";
+LENSES, SEVERITIES, CLOSING_ACTIONS, SKIP_WRITE, invalidateStepContracts, detectProjectFacts, isClosingAction, neutralProjectFacts, repoRelativePath, } from "audit-tools/shared";
 import { applyPlanPipeline, buildCoverageLedger } from "../phases/plan.js";
 import { groundExtractedFindings, } from "../phases/grounding.js";
 import { runTriagePhase } from "../phases/triage.js";
 import { runClosePhase } from "../phases/close.js";
 import { validateRemediationPlan } from "../validation/remediationState.js";
 import { readExtractedPlanIfPresent, } from "./dispatch/marshal.js";
-import { ingestRemediationHostResults, hostDependencyLevels, permanentlyDeadPendingBlocks, precomputeRecoveryTestVerdicts, prepareRemediationHostHandoff, } from "./dispatch/hostHandoff.js";
+import { ingestRemediationHostResults, hostDependencyLevels, permanentlyDeadPendingBlocks, precomputeRecoveryTestVerdicts, prepareRemediationHostHandoff, workloadBindingIdentity, } from "./dispatch/hostHandoff.js";
 import { FileLockTimeoutError, withFileLock, } from "../../shared/io/fileLock.js";
 import { AUDIT_FINDINGS_FILENAME, AUDIT_REPORT_FILENAME, auditArtifactsDir, auditFindingsPath, auditReportPath, promotedAuditFindingsPath, promotedAuditReportPath, remediationArtifactsDir, } from "../../shared/io/auditToolsPaths.js";
 import { callerWorkingDirectory, discoverRepoRoot, resolveRepoRoot, } from "../../shared/io/repoRoot.js";
@@ -25,7 +29,9 @@ import { deduplicateCrossLensFindings, fixupBlocksAfterDedup, } from "../dedup/c
 import { checkAffectedFileIntegrity } from "../utils/fileIntegrity.js";
 import { applyIntentOrdering } from "../intent/intentOrdering.js";
 import { resolveIntakeStep } from "./intakeResolver.js";
-import { runToolOwnedFinalGate, writeFinalGateRedRecord, writeFinalGateOutcomeRecord, } from "./finalGate.js";
+import { carriesGateVerdict } from "../../shared/types/remediationOutcome.js";
+import { RUNTIME_RESIDUAL_DECLARATION, readFinalGateVerdict, runToolOwnedFinalGate, writeFinalGateRedRecord, writeFinalGateOutcomeRecord, writeFinalGateVerdict, } from "./finalGate.js";
+import { renderGateAttribution, worktreeContentId, } from "./gateCommands.js";
 import { buildNextContractPipelineStep, shouldEnterContractPipeline, writePathASeedFromFindings, normalizeBlockTouchedFiles, checkWriteScopePathsAgainstTrackedTree, } from "./contractPipeline.js";
 import { compareCodeUnits } from "../../shared/compareCodeUnits.js";
 import { contractArtifactExists, contractPipelineDir, } from "../contractPipeline/artifactStore.js";
@@ -35,6 +41,7 @@ import { runFindingFilterPass } from "../findingFilter.js";
 import { droppedFindingsRecordPath, renderDroppedFindingsRecord, } from "../droppedFindingsRecord.js";
 import { intakePaths, isIntakeReady, manifestIsInputBound, readIntakeArtifacts, readProjectFacts, writeProjectFacts, resolveManifestSources, } from "../intake.js";
 import { ensureIntakeRiskSignal, readIntakeRiskSignal, writeIntakeRiskSignal, escalateRiskSignal, findingRiskEvidence, distinctAffectedFiles, } from "../riskSignal.js";
+import { readIntentCheckpoint, readIntentCheckpointLenient, } from "audit-tools/shared";
 import { ambiguityReviewPrompt, clarificationPrompt, collectIntakeClarificationsPrompt, collectStartingPointPrompt, extractedPlanDiscardedPrompt, loaderCommand, reviewApprovalPrompt, synthesizeIntakePrompt, triagePrompt, } from "./prompts.js";
 // Single-sourced prose renders of the canonical lens / severity vocabularies
 // (`audit-tools/shared` `LENSES` / `SEVERITIES`) for the intent-checkpoint
@@ -74,11 +81,36 @@ function resolveArtifactsDir(root, artifactsDir) {
     // honored verbatim.
     return artifactsDir ? resolve(artifactsDir) : remediationArtifactsDir(root);
 }
+/**
+ * The run's friction-record key: the plan id, or `null` when there is no plan.
+ *
+ * There is DELIBERATELY no fallback key. A fallback ("run") is a path every
+ * planless state shares, and `decideFrictionTriage` MATERIALIZES the record it
+ * is handed — so a planless caller could MINT a fresh empty record under it,
+ * which the close gate then blocks on. That is the 2026-08-24 defect exactly.
+ *
+ * The key is therefore the plan id or nothing, and a caller handed `null` has
+ * no walk to key: the walk ran before the close archived the plan-keyed record,
+ * and the plan is where its identity came from.
+ */
 function stateRunId(state) {
-    // When the plan is absent (fully-green close deleted the state, or complete
-    // was persisted without a plan), use the stable fallback "run" so the friction
-    // record path is deterministic across multiple next-step calls on the same run.
-    return state?.plan?.plan_id ?? "run";
+    return state?.plan?.plan_id ?? null;
+}
+/**
+ * The run key for a caller holding a LOADED state that must carry a plan id —
+ * the host-handoff/ingest paths, whose contracts declare `run_id: string`.
+ *
+ * It throws rather than inventing a key: an absent plan id there is a
+ * reachable-but-unexpected state, and silently falling back would mint a
+ * shared path exactly as the fallback key did. Callers that can legitimately
+ * hold a planless state use {@link stateRunId} and handle the `null`.
+ */
+function requireStateRunId(state) {
+    const runId = stateRunId(state);
+    if (!runId) {
+        throw new Error("remediate: a loaded state with no plan id cannot name a run");
+    }
+    return runId;
 }
 /**
  * Where an autonomous run's LEFTOVER deliverable pair lands.
@@ -349,14 +381,51 @@ function allItemsTerminal(state) {
  * return the plan untouched.
  */
 async function applyCheckpointIntentOrdering(artifactsDir, plan) {
-    const checkpoint = await readOptionalJsonFile(join(artifactsDir, "intent_checkpoint.json")).catch(() => undefined);
+    // Ordering is an ADVISORY pass: it reorders the plan and nothing depends on
+    // it, so an unreadable checkpoint degrades to "no intent" here rather than
+    // failing the planning step. (Every other read site is a GATE and lets the
+    // throw out — see `readIntentCheckpoint`.)
+    const checkpoint = await readIntentCheckpoint(join(artifactsDir, "intent_checkpoint.json")).catch(() => undefined);
     const freeForm = checkpoint?.free_form_intent;
     if (typeof freeForm !== "string" || freeForm.trim().length === 0)
         return plan;
     const ordered = applyIntentOrdering(plan.findings, plan.blocks, interpretFreeFormIntent(freeForm));
     return { ...plan, findings: ordered.findings, blocks: ordered.blocks };
 }
-function normalizeExtractedPlan(value, facts) {
+/**
+ * The write scope a free-form finding's `affected_files` implies, in the ONE
+ * form the block contract accepts.
+ *
+ * The paths arriving here have been GROUNDED but never normalized: grounding
+ * asks whether a path resolves to a real file (`existsSync`), and on Windows
+ * `src\a.ts` does — so a Windows-spelled citation survives grounding and, copied
+ * verbatim, becomes a `touched_files` entry `assertBlockContract` refuses. The
+ * run then wedges at handoff preparation and every retry reproduces the refusal.
+ *
+ * It normalizes through the SAME shared `repoRelativePath` the handoff boundary
+ * resolves declared entries with, so this producer's output is in the form its
+ * consumer demands by construction rather than by a second, drifting rule. A
+ * path that cannot be contained (`../outside.ts`) is DROPPED rather than
+ * resolved: the block contract refuses it later anyway, and dropping it here
+ * leaves the finding itself intact — grounding already decided which paths are
+ * real, and this decides only how they are SPELLED.
+ */
+function normalizedWriteScope(root, finding) {
+    const normalized = [];
+    for (const affected of finding.affected_files) {
+        let path;
+        try {
+            path = repoRelativePath(root, affected.path, "affected_files[].path");
+        }
+        catch {
+            continue;
+        }
+        if (path.length > 0 && !normalized.includes(path))
+            normalized.push(path);
+    }
+    return normalized;
+}
+function normalizeExtractedPlan(root, value, facts) {
     if (!isRecord(value)) {
         throw new Error("extracted-plan.json must be an object.");
     }
@@ -390,7 +459,9 @@ function normalizeExtractedPlan(value, facts) {
             block_id: `B-${String(index + 1).padStart(3, "0")}`,
             items: [finding.id],
             parallel_safe: true,
-            touched_files: finding.affected_files.map((af) => af.path),
+            // Normalized, not copied: see normalizedWriteScope — a Windows-spelled
+            // citation would otherwise become a write scope the handoff refuses.
+            touched_files: normalizedWriteScope(root, finding),
         }));
     const dedup = deduplicateCrossLensFindings(findings);
     const dedupBlocks = fixupBlocksAfterDedup(blocks, dedup.mergeMap);
@@ -447,7 +518,16 @@ function normalizeExtractedPlan(value, facts) {
  * so membership is the whole check.
  */
 async function confirmedClosingPlan(artifactsDir) {
-    const checkpoint = await readOptionalJsonFile(join(artifactsDir, "intent_checkpoint.json"));
+    // LENIENT, for the same reason the gate is: this runs on the state the gate
+    // just handled, and its own contract below says an out-of-vocabulary action
+    // "cannot reach here". A strict read would turn a case this function already
+    // handles by falling back to `none` into a thrown load error instead.
+    //
+    // This function only USES validated fields, so it takes the plain lenient read
+    // and never touches `readIntentCheckpointLenient`'s raw rejections: the value
+    // returned is one the schema accepts, and `isClosingAction` / `customCommandOf`
+    // are the point-of-use checks on top of it.
+    const checkpoint = await readIntentCheckpoint(join(artifactsDir, "intent_checkpoint.json"), { lenient: true });
     if (!checkpoint || checkpoint.confirmed_by !== "host")
         return { action: "none" };
     const chosen = checkpoint.closing_action;
@@ -555,8 +635,8 @@ function carryForwardMatchingItems(previous, replanned) {
         // A still-pending item carries no work to preserve, so it is re-minted from
         // the fresh plan rather than carried forward. (This test used to also admit
         // a pending item that held an `item_spec`; the document phase that produced
-        // one was dissolved by N-R13 and the field is gone, so the second condition
-        // could never be true and is not restated here.)
+        // one was dissolved and the field is gone, so the second condition could
+        // never be true and is not restated here.)
         if (!previousFinding || !previousItem) {
             continue;
         }
@@ -619,6 +699,29 @@ async function forceReplanFromExistingIntake(root, artifactsDir, previous, store
     await store.saveState(carried);
     return carried;
 }
+/**
+ * The BLOCKING friction close-out step for a run whose walk is still owed.
+ *
+ * Emitted from `handleClosing` BEFORE the close touches disk, so the record the
+ * host is told to write (`triage.recordPath`) is the plan-keyed one this very
+ * decision just materialized — and so the run's identity in that path is the
+ * plan id, not a fallback. The step is a `closing`-phase gate: `next-step`
+ * re-decides the same walk on the next call, and only a disposed walk lets the
+ * close proceed.
+ */
+async function buildFrictionWalkStep(root, artifactsDir, state, triage) {
+    return writeCurrentStep({
+        stepKind: "close_run",
+        status: "ready",
+        runId: requireStateRunId(state),
+        repoRoot: root,
+        artifactsDir,
+        prompt: `# Remediation Run Friction Triage\n\nComplete the friction close-out walk before the run may close.\n${buildFrictionTriageBlock(triage)}`,
+        allowedCommands: [],
+        stopCondition: "Complete friction triage (write dispositions and open_observations), then call next-step again.",
+        artifactPaths: { friction_record: triage.recordPath },
+    });
+}
 async function presentReportStep(root, artifactsDir, state) {
     const reportPath = join(dirname(artifactsDir), "remediation-report.md");
     // Terminal friction-TRIAGE close-out, folded into present_report (single-sourced in
@@ -626,13 +729,39 @@ async function presentReportStep(root, artifactsDir, state) {
     // event + reflection is disposed AND ≥1 open observation written. Never trivially
     // satisfied by an empty event set — the host must actively confirm the friction state.
     //
-    // When `artifactsDir` was deleted by a fully-green close (close.ts rm -rf on a
-    // green run), there is nowhere to persist the friction record and no mechanical
-    // events to triage — skip the triage entirely and go straight to complete.
-    const artifactsDirExists = existsSync(artifactsDir);
-    const triage = artifactsDirExists
-        ? await decideRemediateFrictionCloseout(artifactsDir, state)
-        : null;
+    // NO FRICTION RECORD IS EVER MINTED HERE. The decision was made — and the
+    // record, under the run's plan-keyed path, was walked — before the close
+    // archived it: `handleClosing` consults `decideRemediateFrictionCloseout`
+    // against the LIVE state and short-circuits the close until the walk is
+    // disposed. So ON THE GREEN PATH — the close ran to `complete`, archived the
+    // run and removed the artifacts dir — the walk was already completed when the
+    // close started, the plan-keyed record left with the other deliverables, and
+    // all that is left is to RENDER the already-recorded walk for the host.
+    //
+    // NOT-GREEN IS THE OTHER HALF, and it is not "mint nothing": a close that
+    // returned a non-`complete` state PRESERVES the artifacts dir, so the record
+    // this step decides remains where the run wrote it — the caller reaches here
+    // with the saved state still carrying its plan id, `decideFrictionTriage`
+    // materializes (or re-reads) that same plan-keyed file, and the walk is
+    // rendered from the record that is still in place.
+    //
+    // It is decided — and so materialized — ONLY when the state names a run. The
+    // guard is the plan id, not the artifacts dir: the dir is not evidence of
+    // anything here, since `decideNextStepLoop` mkdirs it unconditionally on entry,
+    // `RunLogger.event` mkdirs it again for `run.log.jsonl`, and `writeJsonFile`
+    // mkdirs any parent it is handed. So a dir-existence test is true on every
+    // path, including a run whose state the close deleted. Guarding on the dir was
+    // the 2026-08-24 defect: the decider ran with a null state, took a fallback
+    // key, and because `decideFrictionTriage` MATERIALIZES the record it is given,
+    // minted a fresh EMPTY record inside the directory the close had just deleted —
+    // re-blocking the run on the record it had created. `stateRunId` now answers
+    // `null` for a planless state and this call therefore decides nothing.
+    //
+    // A `complete` state reaching here is a run that never ran the close walk (a
+    // re-delivery of an already-complete run, whose plan the state still carries),
+    // so the walk is genuinely still owed and deciding it here is correct — it
+    // renders as the blocking step. Only a planless state renders nothing.
+    const triage = await decideRemediateFrictionCloseout(artifactsDir, state);
     const frictionBlock = triage ? buildFrictionTriageBlock(triage) : "";
     const isBlocked = triage?.action === "dispose";
     return writeCurrentStep({
@@ -683,32 +812,32 @@ function currentHostBoundaryState(state) {
  *
  * So:
  *
- * - **Phase 1, UNLOCKED.** Snapshot the state, capture HEAD, and run every
- *   distinct required-test command exactly once
- *   (`precomputeRecoveryTestVerdicts`). HEAD is captured BEFORE the spawns, not
- *   after, because a host-authored command that MOVES HEAD would otherwise
- *   produce verdicts of mixed provenance and go undetected. (The guard compares
- *   commit shas: it sees HEAD movement, not worktree dirt — a command that only
- *   dirties files is invisible to it, which is acceptable because phase 2's
- *   corroboration is commit-based.)
- * - **Phase 2, LOCKED.** Re-read HEAD and abort the whole recovery if it moved
- *   (`tree_moved_between_phases`) — the phase-1 verdicts would describe a tree
- *   that no longer exists, and nothing is accepted or appended. Otherwise ingest
- *   with the pre-computed verdicts, which the ingest only READS: in recovery
- *   mode it never spawns, and a command missing from the table fails closed.
+ * - **Phase 1, UNLOCKED.** Snapshot the state, capture HEAD and the workload
+ *   binding, and run every distinct required-test command exactly once
+ *   (`precomputeRecoveryTestVerdicts`). Both identities are captured BEFORE the
+ *   spawns, not after, because a host-authored command that MOVES HEAD would
+ *   otherwise produce verdicts of mixed provenance and go undetected. (The HEAD
+ *   guard compares commit shas: it sees HEAD movement, not worktree dirt — a
+ *   command that only dirties files is invisible to it, which is acceptable
+ *   because phase 2's corroboration is commit-based.)
+ * - **Phase 2, LOCKED.** Re-read both identities and abort the whole recovery if
+ *   either moved — `tree_moved_between_phases` for HEAD,
+ *   `state_moved_between_phases` for the binding — because the phase-1 verdicts
+ *   would describe a tree or a frontier that no longer exists, and nothing is
+ *   accepted or appended. Otherwise ingest with the pre-computed verdicts, which
+ *   the ingest only READS: in recovery mode it never spawns, and a command
+ *   missing from the table fails closed.
  *
  * What remains inside the lock is git plumbing (ancestry, ref scan, diff-tree),
  * the ledger append, and the state write — sub-second work, comfortably inside
- * heartbeat coverage. The HEAD-unchanged guard closes the gap the phase split
- * opens; the operational protocol is still one writer at a time, now enforced by
- * a lock that cannot be stolen mid-hold instead of by convention.
+ * heartbeat coverage. The two unchanged-identity guards close the gap the phase
+ * split opens; the operational protocol is still one writer at a time, now
+ * enforced by a lock that cannot be stolen mid-hold instead of by convention.
  *
- * One accepted cost: `StateStore.mutate` always writes, so a recovery run that
- * changes nothing rewrites `state.json` with identical content. Expressing a
- * true no-op means plumbing the locked store's `SKIP_WRITE` sentinel through
- * `StateStore.mutate`, which is a change to the store's API rather than to this
- * verb. The `state_changed` flag on the returned summary stays authoritative
- * for callers either way.
+ * A recovery that changes nothing writes nothing: phase 2 returns the locked
+ * store's `SKIP_WRITE` sentinel, which `StateStore.mutate` now honors, so the
+ * retry loop of a genuinely-empty recovery no longer replaces `state.json` with
+ * byte-identical content on every pass.
  */
 export async function recoverIngestHostResults(options) {
     const root = resolveRoot(options.root);
@@ -720,6 +849,7 @@ export async function recoverIngestHostResults(options) {
         throw new Error(`No remediation state at ${artifactsDir} — there is nothing to ingest.`);
     }
     const headBeforeTests = await headCommit(root);
+    const bindingBeforeTests = workloadBindingIdentity(currentHostBoundaryState(snapshot));
     const requiredTestVerdicts = await precomputeRecoveryTestVerdicts({
         root,
         artifactsDir,
@@ -740,23 +870,50 @@ export async function recoverIngestHostResults(options) {
             throw new Error(`No remediation state at ${artifactsDir} — there is nothing to ingest.`);
         }
         const headNow = await headCommit(root);
-        if (headNow !== headBeforeTests) {
+        const bindingNow = workloadBindingIdentity(currentHostBoundaryState(state));
+        // TWO identities, because they catch different writers. HEAD moves when the
+        // tree does; the workload binding moves when a concurrent state writer
+        // settles items or re-mints the workload without committing anything. The
+        // verdict table describes the frontier as it was at phase 1, so either
+        // change invalidates it — and a stale table is not merely imprecise: the
+        // commands it no longer covers read as `required_test_failed`, which
+        // attributes a bookkeeping race to the host's work.
+        const moved = headNow !== headBeforeTests
+            ? "tree"
+            : bindingNow !== bindingBeforeTests
+                ? "state"
+                : null;
+        if (moved !== null) {
             ingested = {
                 accepted_count: 0,
                 completed_work_item_ids: [],
                 pending_work_item_ids: state.host_handoff?.work_item_ids ?? [],
+                // This verdict aborts the whole recovery BEFORE any item is read, so
+                // there is no per-item observation to report — an empty map is the
+                // honest statement of that, not a missing field.
+                work_item_outcomes: new Map(),
                 issues: [
-                    {
-                        code: "tree_moved_between_phases",
-                        message: `HEAD moved from ${headBeforeTests ?? "(none)"} to ${headNow ?? "(none)"} ` +
-                            "while the required tests were running, so their verdicts no longer describe " +
-                            "this tree. Nothing was accepted; re-run recover-ingest on a settled tree.",
-                    },
+                    moved === "tree"
+                        ? {
+                            code: "tree_moved_between_phases",
+                            message: `HEAD moved from ${headBeforeTests ?? "(none)"} to ${headNow ?? "(none)"} ` +
+                                "while the required tests were running, so their verdicts no longer describe " +
+                                "this tree. Nothing was accepted; re-run recover-ingest on a settled tree.",
+                        }
+                        : {
+                            code: "state_moved_between_phases",
+                            message: "the run's workload binding changed while the required tests were running, " +
+                                "so their verdicts no longer describe the pending frontier. Nothing was " +
+                                "accepted; re-run recover-ingest once no other writer is advancing this run.",
+                        },
                 ],
                 state_changed: false,
                 state: currentHostBoundaryState(state),
             };
-            return state;
+            // The lock was taken to WRITE. Nothing changed, so write nothing: the
+            // no-op sentinel is what keeps a settled recovery from replacing
+            // state.json with byte-identical content on every retry.
+            return SKIP_WRITE;
         }
         const outcome = await ingestRemediationHostResults({
             root,
@@ -769,16 +926,62 @@ export async function recoverIngestHostResults(options) {
             throw new Error("Remediation state uses a retired dispatch shape and cannot cross the host handoff boundary.");
         }
         ingested = outcome;
+        // A nothing-to-recover pass returns the sentinel, not the state it read: the
+        // mutation is a no-op and must not rewrite the file (see StateStore.mutate).
         if (!outcome.state_changed)
-            return state;
-        const { contract_version: _contractVersion, ...persistableState } = outcome.state;
-        return persistableState;
+            return SKIP_WRITE;
+        // No `contract_version` strip. The boundary helper below stamps the version
+        // onto the state it hands the host handoff, and this used to peel it back
+        // off on the way to disk so `state.json` matched what was written before.
+        // The STORE now owns that field end to end — it stamps it on read and the
+        // write hook validates it — so peeling it here would persist a state
+        // without the identity the store just established, and the next read would
+        // have to re-invent it.
+        return outcome.state;
     });
+    // The run moved, so the persisted step contract no longer describes it: it
+    // names work this ingest just resolved, against a workload binding this ingest
+    // may have cleared. Invalidate it — but only when something actually changed,
+    // because a no-op recovery must leave the tree byte-identical (which is the
+    // same reason the mutation above writes nothing).
+    if (ingested.state_changed) {
+        await invalidateStepContracts(artifactsDir);
+    }
     return ingested;
 }
+/**
+ * Render the host-facing result status for an ingest, split by outcome.
+ *
+ * Takes the whole summary rather than just its issues, because the split needs
+ * BOTH halves: which items were refused (from the issues) and which landed
+ * without a result (from `work_item_outcomes`, where the run's corroborated
+ * commit for the item is what separates that case from plain unfinished work).
+ */
+function remediationResultDiagnostics(ingested) {
+    const describe = (issue) => `- ${issue.work_item_id ? `\`${issue.work_item_id}\`: ` : ""}${issue.message}${issue.result_path ? ` (\`${issue.result_path}\`)` : ""}`;
+    const section = (heading, lines) => lines.length === 0 ? "" : `\n${heading}\n\n${lines.join("\n")}\n`;
+    const rejected = ingested.issues.filter((issue) => !isMissingObservation(issue));
+    const landedWithoutResult = [...ingested.work_item_outcomes]
+        .filter(([, outcome]) => outcome === "missing_result_with_commit")
+        .map(([id]) => id)
+        .sort(compareCodeUnits);
+    const notYetWritten = ingested.issues.filter((issue) => isMissingObservation(issue));
+    const body = section("## Results already landed, whose result file is missing", landedWithoutResult.map((id) => `- \`${id}\`: this item's edits are IN this repository — a corroborated commit landed ` +
+        `for it and its changed files are recorded — but no result file exists at its bound ` +
+        `\`result_path\`. This is PARTIAL PROGRESS, not absent work: write the result for the ` +
+        `commit that is already there rather than redoing the edit.`)) +
+        section("## Result status requiring attention", rejected.map(describe)) +
+        section("## Results not yet written", notYetWritten.map(describe));
+    if (body === "")
+        return "";
+    return (body +
+        "\nThe workload was restored from its tool-owned digest when necessary. Repair or\n" +
+        "complete only the named result files; do not rewrite the workload or its\n" +
+        "baseline.\n");
+}
 async function buildImplementDispatchStep(ctx) {
     const { root, artifactsDir, state, store, runLogger } = ctx;
-    const runId = stateRunId(state);
+    const runId = requireStateRunId(state);
     const boundaryState = currentHostBoundaryState(state);
     const ingested = await ingestRemediationHostResults({
         root,
@@ -815,9 +1018,10 @@ async function buildImplementDispatchStep(ctx) {
         });
     }
     if (ingested.state_changed) {
-        const { contract_version: _contractVersion, ...persistableState } = ingested.state;
-        await store.saveState(persistableState);
-        return { kind: "transition", state: persistableState };
+        // Same as the recovery verb above: the version is the store's to write,
+        // not a boundary decoration to peel off before persisting.
+        await store.saveState(ingested.state);
+        return { kind: "transition", state: ingested.state };
     }
     const baselineCommit = await headCommit(root);
     if (!baselineCommit) {
@@ -844,23 +1048,21 @@ async function buildImplementDispatchStep(ctx) {
     // `FrictionRunLinks`). Each reference is sourced from the envelope that owns it — the
     // persisted handoff record for the dispatch run, the step contract's own run id for
     // the step — never synthesized from the other.
-    await linkFrictionRunIds(artifactsDir, stateRunId(state), { step_run_id: runId, dispatch_run_id: handoff.handoff_record.run_id }, "remediate-code");
+    await linkFrictionRunIds(artifactsDir, requireStateRunId(state), { step_run_id: runId, dispatch_run_id: handoff.handoff_record.run_id }, "remediate-code");
     // The issues were logged above, before any exit path. What follows is the
     // RENDER — a channel that survives exactly as long as the host reads this one
     // step, and that is reached only when nothing was accepted.
-    const resultDiagnostics = ingested.issues.length === 0
-        ? ""
-        : `
-## Result status requiring attention
-
-${ingested.issues
-            .map((issue) => `- ${issue.work_item_id ? `\`${issue.work_item_id}\`: ` : ""}${issue.message}${issue.result_path ? ` (\`${issue.result_path}\`)` : ""}`)
-            .join("\n")}
-
-The workload was restored from its tool-owned digest when necessary. Repair or
-complete only the named result files; do not rewrite the workload or its
-baseline.
-`;
+    //
+    // THREE STATES, THREE SECTIONS, because they have three different remedies and
+    // a reader must not have to parse prose to tell them apart (the measured
+    // friction: a host parser special-casing "no result file exists"):
+    //   rejected               — something was written and refused; repair it.
+    //   missing + commit       — the edits LANDED but no result exists; write the
+    //                            result FOR THE COMMIT THAT IS ALREADY THERE.
+    //   missing, no commit     — nothing yet; write it when the work is done.
+    // The classification is on CODES, never message text, so rewording a message
+    // cannot move an item between sections.
+    const diagnostics = remediationResultDiagnostics(ingested);
     const nextCommand = loaderCommand("next-step");
     return {
         kind: "emit",
@@ -881,7 +1083,7 @@ It contains the complete, dependency-safe current frontier. Complete every work
 item and write its exact prompt-bound result contract to its \`result_path\`.
 The host owns execution choices, grouping, and concurrency; audit-tools performs
 no launch, routing, or quota decision. Do not start a later dependency level.
-${resultDiagnostics}
+${diagnostics}
 
 After all completed changes are merged and their result files exist, run:
 
@@ -948,9 +1150,18 @@ async function handleComplete(root, artifactsDir, state) {
  * event AND every surfaced agent-feedback reflection carries a disposition; an empty
  * set (zero events AND zero reflections) is trivially "disposed". Keyed only off
  * `(artifactsDir, runId)`; never coupled to any repo's backlog doc.
+ *
+ * A state with NO plan id can name no run, and since the decision MATERIALIZES
+ * the record it keys, guessing a key there would mint one. It returns `null`
+ * instead — "there is no run here to close out", which is the truthful answer
+ * for a state whose plan is gone. Callers that hold the run's plan get a
+ * decision; callers past the run boundary get nothing to render.
  */
 export async function decideRemediateFrictionCloseout(artifactsDir, state) {
-    return decideFrictionTriage(artifactsDir, stateRunId(state), "remediate-code");
+    const runId = stateRunId(state);
+    if (!runId)
+        return null;
+    return decideFrictionTriage(artifactsDir, runId, "remediate-code");
 }
 /**
  * Copy an unusable extracted plan somewhere recoverable and PROVE the copy
@@ -1000,6 +1211,7 @@ async function handlePendingExtractedPlan(root, artifactsDir, existing, extracte
 // captured into the artifact dir; before this, the durable tree held no trace
 // that a plan had been destroyed or that findings had been dropped.
 runLogger) {
+    // <!-- comment-symbol-exempt: names deliberately-retired symbols; this block records that history -->
     // The discard-and-re-extract recovery below covers EXACTLY the region whose
     // failures mean the extracted PLAN is unusable: normalization and grounding.
     // It deliberately stops there. Everything after it — sizing, the dirty
@@ -1018,7 +1230,7 @@ runLogger) {
     let mergeMap;
     let grounding;
     try {
-        ({ plan, sourceFindings, mergeMap } = normalizeExtractedPlan(extractedPlan, 
+        ({ plan, sourceFindings, mergeMap } = normalizeExtractedPlan(root, extractedPlan, 
         // Persisted by the confirm step; planning spawns nothing (the
         // backend-independent planning contract), so it never detects here.
         (await readProjectFacts(artifactsDir)) ?? neutralProjectFacts()));
@@ -1553,7 +1765,7 @@ async function handleReadyIntakeContractPipeline(root, artifactsDir, options, ru
         const auditFindings = await readAuditFindingsOnce();
         const originals = extractAuditFindings(auditFindings);
         if (originals.length > 0) {
-            const checkpoint = await readOptionalJsonFile(join(artifactsDir, "intent_checkpoint.json"));
+            const checkpoint = await readIntentCheckpoint(join(artifactsDir, "intent_checkpoint.json"));
             const filter = await runFindingFilterPass(originals, {
                 root,
                 checkpoint: checkpoint ?? undefined,
@@ -2212,8 +2424,8 @@ async function handlePlanning(root, artifactsDir, state, store) {
         if (halt)
             return { kind: "emit", step: halt };
     }
-    // Document phase dissolved (N-R13): planning transitions directly to
-    // implementing, and the host workload reads finding context directly.
+    // Document phase dissolved: planning transitions directly to implementing,
+    // and the host workload reads finding context directly.
     const implementBlocks = dispatchFrontier(state);
     if (implementBlocks.length > 0) {
         if (state.plan) {
@@ -2331,7 +2543,7 @@ function finalGateDisabledReason(options) {
  * were indistinguishable after the fact.
  */
 async function recordFinalGateOutcome(ctx) {
-    const ran = ctx.outcome === "executed";
+    const verdict = carriesGateVerdict(ctx.outcome);
     await writeFinalGateOutcomeRecord(ctx.artifactsDir, {
         scope: ctx.scope,
         outcome: ctx.outcome,
@@ -2346,9 +2558,10 @@ async function recordFinalGateOutcome(ctx) {
         note: `${ctx.gateKey} outcome=${ctx.outcome} ` +
             // "n/a", never "true": a gate that ran nothing has no verdict, and the
             // durable record it is written beside carries `passed: null` for the
-            // same reason.
-            `passed=${ran ? String(ctx.passed) : "n/a"} ` +
-            `commands=${ran ? String(ctx.commandsRun) : "0"}` +
+            // same reason. A `history` outcome DOES carry a verdict — a judge ruled
+            // on this exact tree — so it prints its verdict like an executed one.
+            `passed=${verdict ? String(ctx.passed) : "n/a"} ` +
+            `commands=${verdict ? String(ctx.commandsRun) : "0"}` +
             (ctx.reason === undefined ? "" : ` reason=${ctx.reason}`),
         ...(ctx.durationMs === undefined ? {} : { duration_ms: ctx.durationMs }),
     });
@@ -2372,26 +2585,56 @@ async function recordFinalGateOutcome(ctx) {
  * the captured output, which stays in the artifact where a multi-KB suite log
  * costs nothing.
  *
- * COST OF THE PAUSE, stated in the prompt rather than discovered: there is no
- * cached verdict, so EVERY next-step taken while the suite is red re-runs the
- * whole gate — a full build plus the whole suite, minutes, holding the phase
- * lock throughout. That is the deliberate price of having no counter to strand
- * the run on, and it makes polling expensive: the host should re-run once it has
- * actually fixed something, not on a timer.
+ * COST OF THE PAUSE. The gate's verdict is cached against the TREE CONTENT, so
+ * re-entering a boundary with the tree untouched serves the recorded verdict —
+ * the pause re-emits from cache without spawning a builder or a suite. A green
+ * on a fixed tree, and a re-run on a tree that MOVED, both go to the floor as
+ * before: the cache is an equality check on content, never a counter and never a
+ * reason to skip a tree nobody judged.
  */
 async function emitFinalGateRedStep(ctx) {
     const { root, artifactsDir, state, scope, gate, runLogger } = ctx;
     const failed = gate.results.find((r) => !r.passed);
-    const recordPath = await writeFinalGateRedRecord(artifactsDir, scope, failed);
+    const recordPath = await writeFinalGateRedRecord(artifactsDir, scope, failed, {
+        root,
+        state,
+    });
     const failingCommand = failed
         ? `${failed.argv.join(" ")} (exit ${String(failed.exit_code)})`
         : "(the gate reported no failing command)";
+    // Read the attribution back OFF THE RECORD rather than recomputing it: the
+    // record is the durable statement, and a prompt that derived its own answer
+    // from a fresh git read could disagree with the artifact the same step points
+    // at. Absent (the record was written by the no-state path, or attribution
+    // chose not to run) means no verdict is asserted, which is exactly what the
+    // prompt then says.
+    const attribution = (await readOptionalJsonFile(recordPath))?.attribution;
+    const attributionBlock = renderGateAttribution(attribution);
     runLogger.event({
         phase: "next-step",
         kind: "outcome",
         obligation: state.status,
-        note: `final_gate_red scope=${scope} command=${failed ? failed.argv.join(" ") : "unknown"}`,
+        note: `final_gate_red scope=${scope} command=${failed ? failed.argv.join(" ") : "unknown"}` +
+            (attribution ? ` attribution=${attribution.verdict}` : ""),
     });
+    // THE BINDING, named in the prompt. The verdict this pause repeats is cached
+    // against the CONTENT of the tree, so an operator who reads "the suite is
+    // still red" and fixes something the run cannot see — or, worse, who assumes
+    // the message will change on its own — is left looping on a red that is being
+    // SERVED, not observed. State the id and state exactly what moves it: any
+    // edit to a non-ignored file outside the run's own artifacts. This is the
+    // same carve-out `worktreeContentId` applies, said in the operator's terms.
+    const bindingBlock = ctx.tree === undefined
+        ? "Binding: this gate re-runs the floor on every arrival here, so this red\n" +
+            "describes the tree as it stands right now."
+        : ctx.tree === null
+            ? "Binding: no tree content id could be taken, so this red is NOT cached —\n" +
+                "the floor will run again on your next next-step whatever you change."
+            : `Binding: this red is bound to tree \`${ctx.tree}\`. Any edit to a file\n` +
+                `outside \`${AUDIT_TOOLS_DIRNAME}/\` — and outside anything git ignores — moves that\n` +
+                "id, which invalidates the cached verdict and makes the next next-step run\n" +
+                "the WHOLE floor again against what you changed. Editing nothing leaves the\n" +
+                "id identical, so the cached red is served back without spawning anything.";
     const nextCommand = loaderCommand("next-step");
     return {
         kind: "emit",
@@ -2420,6 +2663,10 @@ A red here is whole-repo and says nothing about which remediation item caused
 it — it may not be this run's doing at all (a commit landed alongside the run is
 enough). So this is a PAUSE, not a verdict on the work.
 
+${attributionBlock}
+
+${bindingBlock}
+
 Fix the failing command — or confirm it was already broken independently of this
 run — then run:
 
@@ -2428,10 +2675,11 @@ run — then run:
 The gate re-runs from scratch. The moment it is green the run continues exactly
 where it left off.
 
-Re-run it DELIBERATELY, not on a timer: there is no cached verdict, so every
-next-step taken while the suite is red re-runs the entire gate — a full build
-plus the whole suite, minutes, holding the run's phase lock the whole time.
-Fix something first, then re-run.
+Re-run it DELIBERATELY, not on a timer. The gate's verdict is cached against the
+content of the tree, so a re-run with nothing changed serves the recorded verdict
+without spawning anything — and the moment you fix something the tree moves, the
+cache misses, and the whole floor (a full build plus the suite, minutes, holding
+the run's phase lock) runs against your change. Fix something first, then re-run.
 `,
             allowedCommands: [nextCommand],
             stopCondition: "Stop. Make the repository suite green, then re-run next-step to resume the run.",
@@ -2481,19 +2729,87 @@ async function runPhaseBoundaryGate(ctx) {
         });
         return null;
     }
+    // The TREE this verdict will be about. Taken BEFORE the floor runs so the
+    // cached verdict describes the state the floor actually saw; taken ONCE so
+    // the identity written and the identity read back cannot be two derivations
+    // that disagree.
+    //
+    // A boundary that re-dispatches work will get a different id on the next call
+    // and the floor re-runs — which is correct: the tree it certified is gone.
+    const tree = await worktreeContentId(root);
+    const gateKey = `phase_boundary_gate phase=${phase}`;
+    // THE CACHE. The fold re-enters this boundary on every next-step taken before
+    // the next phase dispatches, and the floor is build + typecheck + the whole
+    // suite — minutes, holding the phase lock. Re-running it on a tree that cannot
+    // have changed since the last verdict buys nothing: the answer is already
+    // known and was already recorded. A HIT is therefore a full substitute,
+    // including for a RED one (see {@link readFinalGateVerdict} — the pause is
+    // rebuilt from the cached results rather than re-derived).
+    const cached = await readFinalGateVerdict(artifactsDir, scope, tree);
+    if (cached !== undefined) {
+        // Recorded as a distinct outcome from a real run: the judge is `history`,
+        // not a spawned command, and `commands_run` counts what HISTORY held, never
+        // what this call executed. `passed` is echoed unchanged, so a cached green
+        // still reads green and a cached red still reads red.
+        await recordFinalGateOutcome({
+            artifactsDir,
+            state,
+            scope,
+            gateKey,
+            runLogger,
+            outcome: "history",
+            passed: cached.passed,
+            commandsRun: cached.results.length,
+            reason: `a verdict for this exact tree content is already recorded (scope "${cached.scope}", ` +
+                `recorded_at ${cached.recorded_at}); the floor was NOT re-run because the tree it ` +
+                "would run against has not changed",
+        });
+        if (cached.passed)
+            return null; // cached green (or scope-out) → dispatch
+        // Cached RED. The run has not progressed since that verdict — the pause
+        // mutates nothing — so re-entering it is the same pause, rebuilt from the
+        // cached command results so the record keeps its failing command, exit code
+        // and output tail.
+        return emitFinalGateRedStep({
+            root,
+            artifactsDir,
+            state,
+            scope,
+            gate: {
+                passed: false,
+                results: cached.results,
+                outcome: cached.outcome,
+                scoped_out: cached.scoped_out,
+                runtime_residual: RUNTIME_RESIDUAL_DECLARATION,
+            },
+            // The RECORD's own tree, not the freshly-measured one: the prompt must
+            // name the identity the cached verdict is actually bound to, which is the
+            // one readFinalGateVerdict just matched on.
+            tree: cached.tree,
+            runLogger,
+        });
+    }
     const gateStart = Date.now();
     runLogger.event({
         phase: "next-step",
         kind: "executor_start",
         obligation: state.status,
-        note: `phase_boundary_gate phase=${phase}`,
+        note: gateKey,
     });
     const gate = await runToolOwnedFinalGate(root, { runner: options.finalGateRunner });
+    await writeFinalGateVerdict(artifactsDir, {
+        scope,
+        tree,
+        passed: gate.passed,
+        scoped_out: gate.scoped_out,
+        outcome: gate.outcome,
+        results: gate.results,
+    });
     await recordFinalGateOutcome({
         artifactsDir,
         state,
         scope,
-        gateKey: `phase_boundary_gate phase=${phase}`,
+        gateKey,
         runLogger,
         outcome: gate.outcome,
         passed: gate.passed,
@@ -2513,6 +2829,9 @@ async function runPhaseBoundaryGate(ctx) {
         state,
         scope,
         gate,
+        // The id taken BEFORE the floor ran, which is what writeFinalGateVerdict
+        // just recorded — so the prompt names the binding the cache will match on.
+        tree,
         runLogger,
     });
 }
@@ -2557,6 +2876,10 @@ async function handleAllTerminalTransition(root, artifactsDir, state, store, opt
             // one at a phase boundary, so it gets the same answer: record and pause.
             // The run does NOT advance to `closing` — closing on a red would write a
             // report claiming an outcome the suite never corroborated.
+            // No `tree` here on purpose: this funnel caches nothing (it runs the floor
+            // on every arrival), so there is no verdict record for a red to be bound
+            // to, and the prompt says exactly that instead of naming an id that would
+            // be re-measured on the next call anyway.
             return emitFinalGateRedStep({
                 root,
                 artifactsDir,
@@ -2592,6 +2915,23 @@ async function handleAllTerminalTransition(root, artifactsDir, state, store, opt
 async function handleClosing(root, artifactsDir, state, runLogger, store) {
     const closeStart = Date.now();
     runLogger.event({ phase: "next-step", kind: "executor_start", obligation: state.status, note: "close" });
+    // THE FRICTION WALK IS DECIDED HERE, BEFORE THE CLOSE TOUCHES DISK.
+    //
+    // `runClosePhase` ends by archiving the run's friction record into the
+    // promoted deliverables and deleting the artifacts dir. Both the record and
+    // the state's plan id — the key that names it — are gone after that, so this
+    // is the last moment a decision can name the run it is closing out. Deciding
+    // here also MATERIALIZES the plan-keyed record, which is what gives the host
+    // a file to append to during the walk.
+    //
+    // An unsatisfied walk short-circuits the close ENTIRELY: no tests, no closing
+    // action, no archive, no removal. The run stays open on the plan-keyed record
+    // and is emitted as the blocking friction step; once disposed, the next
+    // `next-step` re-decides it as satisfied and falls through to a real close.
+    const frictionTriage = await decideRemediateFrictionCloseout(artifactsDir, state);
+    if (frictionTriage && frictionTriage.action !== "disposed") {
+        return { kind: "emit", step: await buildFrictionWalkStep(root, artifactsDir, state, frictionTriage) };
+    }
     const closed = await runClosePhase(state, { root, artifactsDir }, runLogger);
     runLogger.event({ phase: "next-step", kind: "executor_end", obligation: state.status, note: "close", duration_ms: Date.now() - closeStart });
     if (closed.status !== "complete") {
@@ -2602,10 +2942,10 @@ async function handleClosing(root, artifactsDir, state, runLogger, store) {
     // Close-complete CROSSES the engine boundary: `complete` is a pre-intake
     // obligation, unreachable from a main-engine transition. Emit the durable
     // report directly, passing exactly what the original recursion reloaded — the
-    // artifact dir is DELETED on a fully-green close (reload → null → stateRunId
-    // falls back to "run") and PRESERVED on a not-green complete (reload → the
-    // saved complete state → its plan_id). `store.loadState()` reproduces both, so
-    // present_report is identical to the cascade.
+    // artifact dir is DELETED on a fully-green close (reload → null, and a null
+    // state renders no friction block) and PRESERVED on a not-green complete
+    // (reload → the saved complete state → its plan_id). `store.loadState()`
+    // reproduces both, so present_report is identical to the cascade.
     // (Regression-locked in next-step-implement-dispatch.)
     return {
         kind: "emit",
@@ -2846,8 +3186,21 @@ async function buildConfirmIntentStep(ctx) {
     const nextCommand = loaderCommand("next-step");
     const checkpointPath = join(artifactsDir, "intent_checkpoint.json");
     // Read the pre-drafted checkpoint if one exists (confirmed_by: "draft").
-    const draft = await readOptionalJsonFile(checkpointPath);
+    //
+    // This is the GATE, and it reads LENIENTLY on purpose: a checkpoint whose
+    // `closing_action` is outside the vocabulary must reach the refusal below,
+    // where the prompt names the offending value and the legal set. A strict read
+    // would replace that affordance with a zod error. Every field consumed here as
+    // a VALUE is still checked by name (`isClosingAction`, `customCommandOf`).
+    //
+    // The REFUSED values come from `rejected`, never from `draft`: the returned
+    // checkpoint is schema-valid, so an out-of-vocabulary key is ABSENT from it
+    // (see `parseIntentCheckpointLenient`). The value the refusal quotes is the one
+    // the host WROTE, which is exactly what `rejected` carries.
+    const draftRead = await readIntentCheckpointLenient(checkpointPath);
+    const draft = draftRead.checkpoint;
     const isDraft = draft?.confirmed_by === "draft";
+    const rejectedClosingAction = draftRead.rejected.find((field) => field.key === "closing_action");
     // Closing action: DETECTED candidates, presented for the host to choose
     // from; the tool never selects one (owner decision 92b0e2dd7cfdc06d).
     const facts = await detectProjectFacts(root);
@@ -2857,7 +3210,9 @@ async function buildConfirmIntentStep(ctx) {
     const closingSection = renderClosingActionSection(facts);
     // A confirmed checkpoint whose closing_action is not in the vocabulary
     // re-enters this step by name — a refusal, never a silent default.
-    const rawChoice = draft?.confirmed_by === "host" ? draft.closing_action : undefined;
+    const rawChoice = draft?.confirmed_by === "host"
+        ? (draft.closing_action ?? rejectedClosingAction?.value)
+        : undefined;
     const refusal = rawChoice !== undefined && !isClosingAction(rawChoice)
         ? `> **Refused:** \`closing_action\` ${JSON.stringify(rawChoice)} is not one of ${CLOSING_ACTIONS.map((a) => `\`${a}\``).join(", ")}. Rewrite the checkpoint with a valid value, or omit the field for \`none\`.\n`
         : rawChoice === "custom" && customCommandOf(draft) === null
@@ -3159,10 +3514,12 @@ export const PRE_INTAKE_PRIORITY = [
  */
 export function buildPreIntakeObligations(ctx, snapshot) {
     const { artifactsDir, inputResolution } = ctx;
-    const { existingCheckpoint, resumeAck, entryState, suppliedInputUnchanged, guidanceFileSupplied } = snapshot;
+    const { existingCheckpoint, rejectedCheckpointFields, resumeAck, entryState, suppliedInputUnchanged, guidanceFileSupplied } = snapshot;
     const ip = intakePaths(artifactsDir);
     const checkpointPath = join(artifactsDir, "intent_checkpoint.json");
     const ackPath = join(artifactsDir, "confirm_resume_ack.json");
+    /** The refused `closing_action`, if the schema dropped one — see the `fires` note. */
+    const rejectedClosingAction = rejectedCheckpointFields.find((field) => field.key === "closing_action");
     const interpretationPath = join(artifactsDir, INTENT_INTERPRETATION_FILENAME);
     const reportPath = join(dirname(artifactsDir), "remediation-report.md");
     return [
@@ -3230,8 +3587,18 @@ export function buildPreIntakeObligations(ctx, snapshot) {
                 // A host-confirmed checkpoint carrying a closing_action outside the
                 // vocabulary is not a confirmation: the step re-emits naming the value
                 // (owner decision 92b0e2dd7cfdc06d — never a silent default).
+                //
+                // The refused value comes from `rejectedCheckpointFields` as well as from
+                // the parsed checkpoint, and it must: the lenient read DROPS a key the
+                // schema refused, so an out-of-vocabulary `closing_action` is absent from
+                // `existingCheckpoint` and the read of it alone would answer `undefined`
+                // — "no answer given, so no question" — leaving every branch of `fires`
+                // false and advancing on a checkpoint whose action was never accepted.
+                // `confirmed_by` survives the drop, which is exactly what makes that
+                // silent pass possible; reading the rejection back is what closes it.
                 const chosenClosingAction = existingCheckpoint?.confirmed_by === "host"
-                    ? existingCheckpoint.closing_action
+                    ? (existingCheckpoint.closing_action ??
+                        rejectedClosingAction?.value)
                     : undefined;
                 const invalidClosingAction = (chosenClosingAction !== undefined && !isClosingAction(chosenClosingAction)) ||
                     (chosenClosingAction === "custom" && customCommandOf(existingCheckpoint) === null);
@@ -3501,6 +3868,15 @@ export function buildMainObligations(ctx) {
             execute: async (state) => {
                 const s = requireState(state);
                 s.status = "waiting_for_clarification";
+                // The binding is scoped to `implementing` (INV-RSM-STATE-COMPLETE: the
+                // load gate rejects a `host_handoff` under any other status, and the
+                // store's write hook enforces the same rule). Leaving the status
+                // without clearing the record produced a state the tool itself could
+                // not read back — a state that only escaped because nothing validated
+                // the write path. Dropping it here is also what the field MEANS: the
+                // pending workload it digests is about to be re-prepared for the
+                // answered item.
+                delete s.host_handoff;
                 await store.saveState(s);
                 return { kind: "transition", state: s };
             },
@@ -3676,9 +4052,27 @@ async function advanceUnderPhaseLock(deps) {
     // Pre-read the once-async signals the pre-intake derive()s consume
     // synchronously (no transition inside this advance call rewrites either file).
     const checkpointPath = join(artifactsDir, "intent_checkpoint.json");
-    const existingCheckpoint = existsSync(checkpointPath)
-        ? await readOptionalJsonFile(checkpointPath)
+    // LENIENT: this read feeds the pre-intake derive()s, whose confirmation
+    // obligation is what REFUSES a malformed checkpoint by name and re-asks. A
+    // strict read here would pre-empt that obligation with a thrown load error.
+    //
+    // Every consumer of the VALUE here uses a validated field (as a value, or as a
+    // presence question on a DIFFERENT field), never quotes an offending one — the
+    // prompt that quotes the refused value is `buildConfirmIntentStep`, which reads
+    // the raw rejections itself. So this site takes the plain lenient read, whose
+    // value is schema-valid.
+    //
+    // The REJECTIONS are threaded beside it rather than discarded, because one
+    // consumer is not a value read: `confirm_intent`'s `fires` asks whether the
+    // checkpoint carries an ACCEPTED answer, and a refused `closing_action` is a
+    // key the lenient read DROPPED — so the parsed value cannot answer for it, and
+    // asking only the parsed value reads a refusal as "no answer given, so no
+    // question". Strict is not the alternative: it would replace the gate's named
+    // refusal with a thrown load error.
+    const checkpointRead = existsSync(checkpointPath)
+        ? await readIntentCheckpointLenient(checkpointPath)
         : undefined;
+    const existingCheckpoint = checkpointRead?.checkpoint;
     const resumeAck = await readOptionalJsonFile(join(artifactsDir, "confirm_resume_ack.json"));
     // Whether a supplied `--input` matches the input the existing run was built
     // from — so re-passing the same `--input` (the loader does this each next-step)
@@ -3701,6 +4095,7 @@ async function advanceUnderPhaseLock(deps) {
         priority: PRE_INTAKE_PRIORITY,
         obligations: buildPreIntakeObligations(ctx, {
             existingCheckpoint,
+            rejectedCheckpointFields: checkpointRead?.rejected ?? [],
             resumeAck,
             entryState: state,
             suppliedInputUnchanged,