audit-tools 0.52.5 → 0.54.0

package/dist/remediate/steps/contractPipeline.js

@@ -1,3892 +1,305 @@
-import { bindContractReviewPrompt, validateContractReviewInput } from "../contractPipeline/contractReviewBinding.js";
-import { CONCEPTUAL_CRITIQUE_REPAIR_TARGETS } from "../../shared/types/contractPipeline/design.js";
-import { ImplementationContextSchema } from "../../shared/types/contractPipeline/implementation.js";
-import { CounterexampleSchema } from "../../shared/types/contractPipeline/obligations.js";
-// sites-pinned: tests/remediate/contract-pipeline.test.ts, tests/remediate/dc3.test.ts, tests/remediate/contract-pipeline-adversarial.test.ts, tests/remediate/step-prompt-sketch-drift.test.ts
-//   contract-pipeline: the promotion computes no finding field FindingSchema would drop.
-//   dc3: the fan-out wording (needs, not mechanism) and the TRANSPORT report for a
-//   partially returned wave.
-/**
- * Contract-pipeline gate for ALL remediation starts (both paths).
- *
- * When intake is ready, next-step routes through the resumable
- * contract_goal → context → design → critique → obligations → assessment →
- * critic → judge → implementation DAG pipeline before producing an extracted
- * plan that feeds the document/implement/close flow.
- *
- * Path A (structured audit-findings.json): a path_a_seed.json is written to
- * the contract directory before the first phase step, so goal_normalization
- * and context_collection prompts can reference the auditor findings directly.
- * Path B (document/conversation): enters the pipeline directly from intake.
- *
- * Worker outputs are untrusted until validated: each invocation first ingests
- * raw worker-written payloads into validated envelopes (recording dependency
- * content hashes), then archives stale artifacts so the staleness DAG
- * re-derives everything downstream of a repair. The adversarial critic →
- * judge → repair loop lives across next-step invocations with its state in
- * the contract artifacts plus repair-state.json; repairs are capped so a
- * non-converging judge can never oscillate forever.
- */
+// sites-pinned: tests/remediate/executable-plan-identity.test.ts, tests/remediate/executable-plan-safety.test.ts, tests/remediate/contract-review-independence.test.ts
+import { randomUUID } from "node:crypto";
 import { existsSync } from "node:fs";
-import { mkdir, readFile, rename, rm } from "node:fs/promises";
-import { isAbsolute, join, resolve } from "node:path";
-import { writeJsonFile, readOptionalJsonFile, formatValidationIssues, hashContent, stableStringify, isRecord, withFsRetry, auditReadOf, projectApprovedFindings, captureStepBoundaryFriction, climbOutOfAuditTools, partitionCommandsByDeclaredShape, splitSequentialCommandChain, normalizeRepoPath, repoRelativePath, toPosixPath, neutralProjectFacts, } from "audit-tools/shared";
-import { createStepEmissionScaffold, } from "../../shared/steps/stepEmissionScaffold.js";
-import { OBLIGATION_KIND_PRIORITY, } from "../contractPipeline/obligationKinds.js";
-import { CP_ARTIFACT_NAMES, contractArtifactExists, contractArtifactFilePath, contractInputFilePath, contractPipelineDir, detectStaleArtifacts, dropReviewSnapshot, envelopePayload, envelopeSemanticHash, isEnvelope, pathASeedFilePath, payloadSemanticHash, readContractArtifact, stampToolCreatedAt, writeContractArtifact, writeDerivedContractArtifact, } from "../contractPipeline/artifactStore.js";
-import { readIntakeRiskSignal, writeIntakeRiskSignal, escalateRiskSignal, decompositionRiskEvidence, adversarialDepthForTier, roundTripGranularityForTier, } from "../riskSignal.js";
-import { phaseOrdinalForObligations, moduleSlug, moduleSlugForObligationId, renderPhaseCutSection, detectContractTokenCycles, } from "../contractPipeline/phaseCut.js";
-import { ensurePhaseCutArtifact, readPhaseCutArtifact } from "../contractPipeline/phaseCutArtifact.js";
-import { detectCyclicSeamObligations, validateAuthoredCycleBreak, } from "../contractPipeline/cyclicSeamResolution.js";
-import { deriveObligationLedger, deriveFinalizedModuleContracts, buildTestValidatorPlanScaffold, buildImplementationDagScaffold, acceptedCounterexampleIds, advisoryCritiqueItems, } from "../contractPipeline/derive.js";
-import { ensureNodeId, toBlockId } from "../contractPipeline/idRegistry.js";
-import { captureReviewSnapshot, computeReReviewDelta, isReviewArtifact, readReviewSnapshot, renderReReviewSection, reviewSnapshotExists, } from "../contractPipeline/reviewSnapshot.js";
-import { captureTestPlanCarry, readTestPlanCarry, } from "../contractPipeline/testPlanCarry.js";
-import { CYCLIC_SEAM_BREAK_STRATEGIES, CYCLIC_SEAM_RESOLUTION_STATUSES_OFFERED, isCyclicSeamBreakStrategy, sketchValues, } from "../contractPipeline/sketchSource.js";
-import { readRepairState, writeRepairState, counterexamplesByIdOf, counterexampleKeyOf, counterexampleWaiversPath, foldCounterexampleWaivers, waivedAcceptedIds, waivedJudgeAcceptedIds, } from "../contractPipeline/repairState.js";
-import { renderContractPipelinePrompt, renderContractRepairPrompt, CONTRACT_PIPELINE_PHASE_ORDER, PHASE_TO_ARTIFACT, reviewRequirementForRole, } from "./contractPipelinePrompts.js";
-// The seven cross-artifact validators this module used to call one by one are
-// gone from this list on purpose: every one of them is now reached through
-// `evaluateContractPipelineCrossGateOutcomes`, so a call site cannot read a
-// gate's issue array without also seeing whether the gate RAN
-// (the branch-on-evaluated rule). What remains here are the checks that are not
-// part of that eight-gate set.
-import { CONTRACT_PIPELINE_VALIDATORS, CP_MODULE_CONTRACTS_VERSION, validateGoalIdConsistency, validateWorkBlockSeamPreparation, validateContractCitationGrounding, validateDecompositionFileScope, } from "../validation/contractPipeline.js";
-// Imported from the owning gate module directly (as derive.ts does): this
-// loop-core path consumes the single outcome-based entry point and its
-// evaluated/skipped vocabulary together.
-import { evaluateContractPipelineCrossGateOutcomes, enumerateRepoTreePaths, isInsideGitWorkTree, isTestablePhaseObligation, } from "../validation/contractPipelineGates.js";
-import { compareCodeUnits } from "../../shared/compareCodeUnits.js";
+import { readFile, stat } from "node:fs/promises";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { z } from "zod";
+import { hashContent, stableStringify, readOptionalJsonFile, writeJsonFile, repoRelativePath, toPosixPath, FindingSchema, AuditReadSchema } from "audit-tools/shared";
+import { bindWorkerPrompt } from "../../shared/submission/workerPromptBinding.js";
+import { parseReviewSubmissionEnvelope, reviewIndependenceIssue } from "../../shared/types/reviewIndependence.js";
+import { readIntakeRiskSignal, adversarialDepthForTier, escalateRiskSignal, writeIntakeRiskSignal, decompositionRiskEvidence } from "../riskSignal.js";
 import { writeCurrentStep } from "./stepWriter.js";
 import { loaderCommand } from "./prompts.js";
-import { intakePaths, readProjectFacts } from "../intake.js";
-// ── Phase → artifact name mapping ─────────────────────────────────────────────
-// PHASE_TO_ARTIFACT is single-sourced in contractPipelinePrompts.ts (it also
-// derives CONTRACT_PIPELINE_PHASE_ORDER from the same object). Imported here so
-// the phase set lives in exactly one place.
-/** Producing phase per artifact, for re-emitting a step after failed validation. */
-const ARTIFACT_TO_PHASE = {
-    ...Object.fromEntries(Object.entries(PHASE_TO_ARTIFACT).map(([phase, artifact]) => [artifact, phase])),
-};
-// ── Phase → step kind mapping ──────────────────────────────────────────────────
-const CONTRACT_STEP_KIND = "contract_pipeline";
-/**
- * Granularity collapse GROUPS (T1 slice 4b). Each group is a run of CONSECUTIVE
- * phases that folds into ONE round-trip at the `collapsed` granularity — i.e.
- * only at the `low` tier (see `roundTripGranularityForTier`). Collapse is
- * best-effort: any member artifact the worker omits or writes malformed is
- * re-emitted as its own fine-grained step by `nextMissingContractPhase`, so no
- * work is ever lost.
- *
- * These are the ONLY two safe groups, and the gaps between them are not
- * oversights — each is a property worth more than the round-trip it would save.
- * The full per-phase map is `docs/reviews/low-tier-phase-cost-2026-08-25.md`;
- * the boundaries that matter here:
- *
- *   - The framing group STOPS at `decomposition`. Keeping the decomposition→
- *     drafting boundary lets the slice-4a escalate-on-evidence intercept read
- *     the fresh decomposition and raise the tier — un-collapsing everything
- *     after it — before any contract is drafted or the module wave fans out.
- *   - `critique`, `critic` and `judge` are independent-adversary phases and can
- *     never join a group with what they review. Collapsing critic+judge is the
- *     sharpest case: the judge verdict is the SOLE admission to implementation
- *     planning, so one worker emitting both artifacts could write zero
- *     counterexamples plus `approved` and let the loop certify its own exit.
- *   - `implementation_planning` is the phase `judgeRepairGate` protects, and its
- *     scaffold is built from the judge's accepted counterexamples, which do not
- *     exist at judge-render time.
- *
- * A collapsed section carries exactly what its fine-grained step would have
- * carried — see `collapsedSectionExtra`.
- */
-const COLLAPSE_GROUPS = [
-    // Framing: scope the change top-down. One coherent authoring act, no
-    // adversarial judgment, no deterministic derivation interleaved.
-    ["goal_normalization", "context_collection", "decomposition"],
-    // Authoring tail: the test/validator plan and the author's OWN coverage
-    // self-assessment. `assessment` is deliberately not an independent-critic
-    // phase, and `contract_assessment_report` already depends on
-    // `test_validator_plan` — the same later-reads-earlier shape the framing
-    // group relies on. The critic reviews both afterwards, unchanged.
-    ["test_validator_plan", "assessment"],
-];
-// ── Bounded-loop caps ─────────────────────────────────────────────────────────
-/**
- * Runaway backstop for the judge↔repair loop — the LOUD exception path, NOT the
- * normal terminator. The loop normally terminates by *convergence*: it keeps
- * repairing only while each round surfaces a genuinely NEW accepted counterexample
- * (real progress), reaches a fixpoint when the judge approves, and escalates to the
- * user the moment a round re-accepts an already-addressed counterexample without
- * progress (a stall/oscillation). This ceiling exists only so a pathological run
- * that keeps minting brand-new accepted counterexamples forever cannot loop without
- * bound; hitting it is itself an escalation (loud), never a silent proceed. It is
- * deliberately generous — a genuinely deep but converging design (each round a new
- * real defect) must not be cut mid-convergence (the failure mode of the former N=2).
- */
-export const MAX_CONTRACT_REPAIR_ITERATIONS = 8;
-/** Maximum implementation_dag regenerations after traceability rejections. */
-export const MAX_DAG_REGENERATION_ATTEMPTS = 2;
-/**
- * Maximum LLM cycle-break resolution attempts before routing to user-decision
- * (and, if that also fails, to `blocked`).
- */
-export const MAX_CYCLIC_SEAM_RESOLUTION_ATTEMPTS = 2;
-function cyclicSeamRepairStatePath(artifactsDir) {
-    return join(contractPipelineDir(artifactsDir), "cyclic-seam-repair-state.json");
-}
-export async function readCyclicSeamRepairState(artifactsDir) {
-    const state = await readOptionalJsonFile(cyclicSeamRepairStatePath(artifactsDir));
-    return (state ?? {
-        schema_version: "remediate-code-contract-pipeline/cyclic-seam-repair-state/v1alpha1",
-        attempts: [],
-        user_decision_emitted: false,
-    });
-}
-export async function writeCyclicSeamRepairState(artifactsDir, state) {
-    await mkdir(contractPipelineDir(artifactsDir), { recursive: true });
-    await writeJsonFile(cyclicSeamRepairStatePath(artifactsDir), state);
-}
-// ── Envelope handling ─────────────────────────────────────────────────────────
-/**
- * Render a pre-filled skeleton section (S3 scaffold) for the partially-derivable
- * phases. The tool derives the structure/ids/cross-refs from the already-present
- * obligation ledger and leaves only the judgment slots blank, so the worker fills
- * sentences/commands rather than emitting a whole artifact from scratch. Returns
- * undefined when there is nothing to scaffold (no testable obligations / no nodes).
- */
-async function buildScaffoldSection(phase, artifactsDir) {
-    const ledger = envelopePayload(await readContractArtifact(artifactsDir, "obligation_ledger"));
-    if (phase === "test_validator_plan") {
-        const prior = await readTestPlanCarry(artifactsDir);
-        const scaffold = buildTestValidatorPlanScaffold(ledger, prior);
-        if (scaffold.test_specs.length === 0)
-            return undefined;
-        const carriedCount = scaffold.test_specs.filter((s) => s.assertions.length > 0).length;
-        const path = contractInputFilePath(artifactsDir, "test_validator_plan");
-        const carryNote = carriedCount > 0
-            ? `\n\n**Carried from the prior round (C3):** ${carriedCount} spec(s) already have assertions — their obligation premise is unchanged, so keep them as-is unless you intend to revise. Only the specs with an EMPTY \`assertions\` array need authoring.`
-            : "";
-        return `## Pre-filled Skeleton — fill only the blank slots
-
-The obligation ledger was derived deterministically. Below is the test-plan skeleton: one spec per testable obligation, with \`obligation_id\`, \`name\`, \`kind\`, and \`scope_anchors\` already filled. Fill ONLY each \`assertions\` array — every spec needs at least one positive (satisfied-path) assertion AND one negative (failure-path) assertion. The negative assertion MUST name one of the spec's \`scope_anchors\` (the touched symbol/file) and must not be an unscoped repo-wide scan, or it fails the negative-scoping gate. Do not add, remove, or rename specs. If an obligation is genuinely untestable, keep the spec's \`obligation_id\` and \`name\`, and replace its \`kind\`, \`scope_anchors\` and \`assertions\` with \`"inapplicable_claim": { "obligation_id": "<the same obligation_id>", "reason": "<a reason the ledger can disprove>" }\`.${carryNote}
-
-\`\`\`json
-${JSON.stringify(scaffold, null, 2)}
-\`\`\`
-
-Self-check before next-step: \`${loaderCommand(`validate-artifact --name test_validator_plan --file ${path}`)}\``;
-    }
-    if (phase === "implementation_planning") {
-        const judge = envelopePayload(await readContractArtifact(artifactsDir, "judge_report"));
-        const finalized = envelopePayload(await readContractArtifact(artifactsDir, "finalized_module_contracts"));
-        const scaffold = buildImplementationDagScaffold(ledger, acceptedCounterexampleIds(judge), finalized);
-        if (scaffold.nodes.length === 0)
-            return undefined;
-        const advisory = advisoryCritiqueItems(envelopePayload(await readContractArtifact(artifactsDir, "conceptual_design_critique")));
-        const advisoryBlock = advisory.length > 0
-            ? `\n\nAdvisory conceptual-critique items (no obligation/counterexample of their own — give each a home in some node's \`addressed_critique_items\` and let it shape that node's implementation; do NOT smuggle them into test assertions):\n${advisory
-                .map((a) => `- \`${a.id}\`: ${a.description}`)
-                .join("\n")}`
-            : "";
-        const path = contractInputFilePath(artifactsDir, "implementation_dag");
-        return `## Pre-filled Skeleton — fill only the blank slots
-
-Below is the implementation-DAG skeleton: ONE node per module (its obligations already grouped), covering every obligation and accepted counterexample. Each node's \`depends_on\` is already DERIVED from the finalized contracts' data-flow (a node depends on the modules whose \`artifact:<name>\` outputs it consumes) — keep it unless you know an ordering is wrong. Fill ONLY each node's \`title\`, \`description\`, and \`targeted_commands\`. You MAY further merge or split nodes and refine \`depends_on\`/\`edges\` ordering, as long as every obligation stays covered (in \`satisfies_obligations\` or \`verification_obligation_ids\`) and every accepted counterexample stays in some node's \`addresses_counterexamples\`.${advisoryBlock}
-
-\`\`\`json
-${JSON.stringify(scaffold, null, 2)}
-\`\`\`
-
-Self-check before next-step: \`${loaderCommand(`validate-artifact --name implementation_dag --file ${path}`)}\``;
-    }
-    return undefined;
-}
-/**
- * Archive an artifact into `<contract>/history/` instead of deleting it, so a
- * repair loop never silently destroys an LLM output. Two disjoint files exist
- * per artifact (D3): the host's plain INPUT (`<name>.input.json` — the LLM
- * emission) and the tool's canonical envelope (`<name>.json` — regenerable
- * bookkeeping). On a stale/invalid re-emit BOTH are moved to history: the input
- * to preserve the LLM output AND free its path for a fresh host Write, the
- * canonical so the completion gate (`contractArtifactExists`) re-fires and the
- * producing phase re-emits. The returned `archivedPath` references the input
- * archive when present (what the host re-authors), else the canonical archive.
- * A tool-derived artifact with no input file (e.g. a merged-shard artifact)
- * archives only its canonical envelope. If any move throws, the rest are left
- * in place (`originalFree: false`) rather than silently dropped. `renameFn` is a
- * DI seam so a failed history move is testable.
- */
-export async function archiveContractArtifact(artifactsDir, name, label, renameFn = rename) {
-    const inputSource = contractInputFilePath(artifactsDir, name);
-    const canonicalSource = contractArtifactFilePath(artifactsDir, name);
-    const hasInput = existsSync(inputSource);
-    const hasCanonical = existsSync(canonicalSource);
-    // The `invalid` label rejects the artifact this snapshot is the verdict FOR, so
-    // the snapshot dies with it — unconditionally, and before the nothing-to-
-    // archive short-circuit below, so an orphaned snapshot is cleaned up too. A
-    // surviving copy is worse than an absent one: ingest captures a fresh snapshot
-    // only AFTER its own staleness pass, so the NEXT invocation would diff the new
-    // payload against a verdict about content the reviewer never saw. Dropped even
-    // when the history move itself fails, because the re-emit that follows tells
-    // the worker to overwrite the input in place — the old verdict is void either
-    // way.
-    //
-    // The `stale` label must NOT drop it, and that asymmetry is the whole point:
-    // staleness is what re-opens a review phase, and the diff-based re-review only
-    // fires when a prior snapshot is there to diff against. Dropping on the stale
-    // path would silently turn every staleness re-emit back into the blind full
-    // review this mechanism exists to avoid.
-    if (label === "invalid") {
-        await dropReviewSnapshot(artifactsDir, name);
-    }
-    if (!hasInput && !hasCanonical)
-        return { originalFree: true };
-    const historyDir = join(contractPipelineDir(artifactsDir), "history");
-    await mkdir(historyDir, { recursive: true });
-    const stamp = Date.now();
-    let archivedPath;
-    // Preserve the host's plain output (the LLM emission) first, freeing the input
-    // path so the rewrite signpost's fresh Write lands cleanly.
-    if (hasInput) {
-        const dest = join(historyDir, `${name}.${label}-${stamp}.input.json`);
-        archivedPath = dest;
-        try {
-            await withFsRetry(() => renameFn(inputSource, dest));
-        }
-        catch {
-            return { archivedPath, originalFree: false };
-        }
-    }
-    // Clear the tool-derived canonical envelope so the completion gate re-fires.
-    if (hasCanonical) {
-        const dest = join(historyDir, `${name}.${label}-${stamp}.json`);
-        try {
-            await withFsRetry(() => renameFn(canonicalSource, dest));
-        }
-        catch {
-            return { archivedPath: archivedPath ?? dest, originalFree: false };
-        }
-        archivedPath = archivedPath ?? dest;
-    }
-    return { archivedPath, originalFree: true };
-}
-/**
- * The explicit re-author signpost appended to every inline rejection re-emit:
- * the prior output was archived, so the worker must Write a fresh complete
- * artifact at the ORIGINAL path — never Edit the previous (now-archived) file.
- */
-export function rejectionRewriteInstruction(archived) {
-    // Back-compat: a bare path argument behaves as a successful (originalFree) archive.
-    const outcome = typeof archived === "string" || archived === undefined
-        ? { archivedPath: archived, originalFree: true }
-        : archived;
-    const where = outcome.archivedPath
-        ? `\`${outcome.archivedPath}\``
-        : "the contract history directory";
-    if (outcome.originalFree === false) {
-        // Honor archiveContractArtifact's originalFree signal: the history move failed,
-        // so the rejected file is STILL at its original path. Tell the host to
-        // overwrite it in place — a fresh Write that replaces the stale content is the
-        // only way the re-emit lands (the path is not free).
-        return `\n\n> The previous output could not be archived and REMAINS at its original path; overwrite it with a fresh complete artifact (a full Write that replaces the file) — do NOT Edit incrementally.`;
-    }
-    return `\n\n> Prior output archived to ${where}; Write a fresh complete artifact at its original path — do NOT Edit the previous file.`;
-}
-/**
- * Derive validated canonical envelopes from the host's plain INPUT files (D3).
- * The host writes the bare payload the role schema describes to
- * `<name>.input.json`; the tool reads it here, validates it, and writes the
- * content-hash envelope to the canonical `<name>.json` — the host's input file
- * is never mutated in place. CP_ARTIFACT_NAMES is dependency-ordered, so
- * dependencies are enveloped before their dependents and dependency hashes are
- * always available.
- */
-export async function ingestContractArtifacts(artifactsDir, adversarialDepth) {
-    const ingested = [];
-    const invalid = [];
-    const stale = [];
-    const depth = adversarialDepth ?? (await resolveAdversarialDepth(artifactsDir)).adversarialDepth;
-    for (const name of CP_ARTIFACT_NAMES) {
-        const raw = await readOptionalJsonFile(contractInputFilePath(artifactsDir, name));
-        if (raw === undefined || raw === null)
-            continue;
-        // The host writes a plain payload; defensively unwrap if an envelope slipped
-        // into the input path so ingest and the validate-artifact self-check agree.
-        const role = ARTIFACT_TO_PHASE[name] ?? "";
-        const requirement = reviewRequirementForRole(role, depth);
-        const reviewed = await validateContractReviewInput({
-            artifactsDir, artifact: name, role, requirement,
-            raw: requirement === "ordinary" && isEnvelope(raw) ? raw.payload : raw,
-        });
-        if (!reviewed.ok) {
-            if (reviewed.code === "dependency_stale") {
-                stale.push(name);
-                continue;
-            }
-            invalid.push({ name, issues: [{ severity: "error", path: `${name}.review`, message: reviewed.issue }], ...(reviewed.code === "review_unavailable" ? { unavailable: true } : {}) });
-            continue;
-        }
-        const bare = reviewed.payload;
-        // The host has no clock: stamp the tool-owned `created_at` before validation
-        // so the host never has to invent a timestamp (B4). No-op when already present.
-        const payload = stampToolCreatedAt(bare, new Date().toISOString());
-        // Idempotency: the input file persists across next-step calls, so skip
-        // re-ingesting an input whose canonical envelope already reflects it. The
-        // semantic projection strips the tool-stamped `created_at`, so a no-op
-        // re-ingest is stable (it does NOT re-fire snapshots or rewrite the
-        // envelope); only a genuine host edit re-derives.
-        const requiredIssues = reviewed.provenance
-            ? CONTRACT_PIPELINE_VALIDATORS[name](payload, name).filter(issue => issue.severity === "error")
-            : undefined;
-        if (requiredIssues && requiredIssues.length > 0) {
-            invalid.push({ name, issues: requiredIssues });
-            continue;
-        }
-        const existing = await readContractArtifact(artifactsDir, name);
-        const sameReview = !reviewed.provenance || (existing?.review_provenance?.prompt_sha256 === reviewed.provenance.prompt_sha256 &&
-            existing.review_provenance.requirement === reviewed.provenance.requirement &&
-            stableStringify(existing.review_provenance.review) === stableStringify(reviewed.provenance.review));
-        if (existing && sameReview && envelopeSemanticHash(existing) === payloadSemanticHash(name, payload)) {
-            continue;
-        }
-        const issues = requiredIssues ?? CONTRACT_PIPELINE_VALIDATORS[name](payload, name).filter((issue) => issue.severity === "error");
-        if (issues.length > 0) {
-            invalid.push({ name, issues });
-            continue;
-        }
-        await writeContractArtifact(artifactsDir, name, payload, reviewed.provenance);
-        ingested.push(name);
-        // Repair-revert fix: an ingested aggregated `module_contracts` payload (a
-        // degenerate single-agent draft, or a direct edit) is written back through to
-        // the per-module shards so shards ≡ aggregate stays an invariant — otherwise a
-        // later upstream cascade (e.g. a module_decomposition edit) re-merges the STALE
-        // shards and silently reverts the change. No-op for every non-sharded artifact
-        // (`finalized_module_contracts` is deterministically derived, never sharded).
-        await propagateAggregateToShards(artifactsDir, name, payload);
-        // Snapshot a freshly-produced review verdict + the upstreams it reviewed, so
-        // a later staleness re-emit can be diff-based (B2). No-op for non-review
-        // artifacts. Captured at ingest, when the upstreams are in the exact state
-        // the worker reviewed.
-        if (isReviewArtifact(name)) {
-            await captureReviewSnapshot(artifactsDir, name, payload, new Date().toISOString());
-        }
-        // C3: snapshot the authored test-plan so a later re-emit can diff-carry the
-        // assertions of unchanged obligations instead of forcing a full re-author.
-        if (name === "test_validator_plan") {
-            await captureTestPlanCarry(artifactsDir, payload, new Date().toISOString());
-        }
-    }
-    return { ingested, invalid, ...(stale.length > 0 ? { stale } : {}) };
-}
-/**
- * Determine whether the contract pipeline should be entered for this run.
- * The pipeline is entered for ALL intake source types (structured_audit,
- * document, conversation) when an extracted-plan.json has not yet been
- * produced. Path A (structured_audit) seeds the pipeline via a path_a_seed.json
- * before the first phase step, so goal_normalization and context_collection
- * prompts can reference the auditor findings.
- */
-export function shouldEnterContractPipeline(artifactsDir, _intakeSourceType) {
-    const paths = intakePaths(artifactsDir);
-    // If an extracted plan already exists, the pipeline has completed.
-    if (existsSync(paths.extractedPlan)) {
-        return { shouldHandleContractPipeline: false, pipelineComplete: true };
-    }
-    // Check whether the implementation_dag exists (pipeline complete, awaiting extraction).
-    if (contractArtifactExists(artifactsDir, "implementation_dag")) {
-        return { shouldHandleContractPipeline: true, pipelineComplete: true };
-    }
-    return { shouldHandleContractPipeline: true, pipelineComplete: false };
-}
-/** Return the first pipeline phase whose output artifact does not exist. */
-export function nextMissingContractPhase(artifactsDir) {
-    for (const phase of CONTRACT_PIPELINE_PHASE_ORDER) {
-        const artifactName = PHASE_TO_ARTIFACT[phase];
-        if (!artifactName)
-            continue;
-        if (!contractArtifactExists(artifactsDir, artifactName)) {
-            return phase;
-        }
+import { renderPlanAuthorPrompt, renderPlanReviewPrompt, reviewRequirementForRole } from "./contractPipelinePrompts.js";
+import { executionPlanPaths, PlanSourceSchema, readPlanSource, readCanonicalPlan, ingestExecutionPlan, readPlanReviewHistory, readPlanReview, readApprovedExecutionPlan, CritiqueSchema, CriticSchema, PlanJudgeSchema, PlanRiskDecisionSchema, PLAN_REVIEW_ROLES, executionPlanContextIssues, PlanReviewReceiptSchema, readExecutionIntent, } from "../contractPipeline/executionPlan.js";
+export { readApprovedExecutionPlan } from "../contractPipeline/executionPlan.js";
+export async function resolveAdversarialDepth(artifactsDir) {
+    let riskSignal = await readIntakeRiskSignal(artifactsDir);
+    const canonical = await readCanonicalPlan(artifactsDir);
+    if (riskSignal && canonical) {
+        const files = [...new Set(canonical.plan.units.flatMap(unit => unit.allowed_files))];
+        // The run's existing shared classifier remains the policy authority.
+        const evidence = decompositionRiskEvidence({ moduleCount: canonical.plan.units.length, fileScopes: files });
+        const raised = evidence ? escalateRiskSignal(riskSignal, evidence) : riskSignal;
+        if (raised !== riskSignal) {
+            riskSignal = raised;
+            await writeIntakeRiskSignal(artifactsDir, raised);
+        }
+    }
+    return { riskSignal, adversarialDepth: adversarialDepthForTier(riskSignal?.tier) };
+}
+async function sourceDigests(paths) {
+    return Promise.all([...new Set(paths)].sort().map(async (path) => ({ path, sha256: hashContent(await readFile(path, "utf8")) })));
+}
+export async function writePathASeedFromFindings(artifactsDir, sourcePath, payload) {
+    const raw = payload;
+    const findings = (raw.findings ?? []).map(finding => FindingSchema.parse(finding));
+    const paths = executionPlanPaths(artifactsDir);
+    const existing = await readPlanSource(artifactsDir);
+    if (existing) {
+        if (stableStringify(existing.findings) !== stableStringify(findings))
+            throw new Error("Approved source findings changed during this run; preserve the current run and explicitly start a new source selection.");
+        return;
     }
-    return null;
-}
-/**
- * Write a Path-A seed file from a parsed audit-findings report.
- * The seed is written once (idempotent: skipped when it already exists).
- * goal_normalization and context_collection prompts detect the seed and
- * include its contents so every pipeline node traces to an auditor finding.
- */
-export async function writePathASeedFromFindings(artifactsDir, auditFindingsPath, auditFindings) {
-    // Contract-claiming input must pass the strict shared validator before even
-    // the idempotence shortcut. No seed/state/plan artifact may be derived from a
-    // partially parsed or permissively defaulted report.
-    const approved = projectApprovedFindings(auditFindings);
-    const seedPath = pathASeedFilePath(artifactsDir);
-    if (existsSync(seedPath))
-        return; // idempotent
-    const findings = [...approved.findings].sort((left, right) => compareCodeUnits(left.id, right.id));
-    const affectedFilesSet = new Set();
-    const findingsSummary = findings.map((finding) => ({
-        id: finding.id,
-        title: finding.title,
-        lens: finding.lens,
+    const audit = AuditReadSchema.safeParse(raw.audit_read);
+    await writeJsonFile(paths.source, PlanSourceSchema.parse({
+        plan_id: `plan-${randomUUID()}`, findings, audit_read: audit.success ? audit.data : null,
+        sources: await sourceDigests([sourcePath]), intent: await readExecutionIntent(artifactsDir),
     }));
-    for (const finding of findings) {
-        for (const affectedFile of finding.affected_files) {
-            affectedFilesSet.add(affectedFile.path);
-        }
-    }
-    const workBlocks = approved.workBlocks
-        .map((block) => ({
-        ...block,
-        finding_ids: [...block.finding_ids].sort(),
-        unit_ids: [...block.unit_ids].sort(),
-        owned_files: [...block.owned_files].sort(),
-        depends_on: [...block.depends_on].sort(),
-    }))
-        .sort((a, b) => compareCodeUnits(a.id, b.id));
-    // Code-unit order, not ICU collation, on EVERY persisted seed array: the
-    // seed order must not depend on the host's ICU collation, and seam ids are
-    // hex now — a locale that orders digits against letters differently would
-    // reshuffle the file.
-    const workBlockSeams = approved.workBlockSeams
-        .map((seam) => ({
-        ...seam,
-        block_ids: [...seam.block_ids].sort(compareCodeUnits),
-    }))
-        .sort((a, b) => compareCodeUnits(a.id, b.id));
-    const affectedFiles = [...affectedFilesSet].sort();
-    const seed = {
-        schema_version: "remediate-code-contract-pipeline/path-a-seed/v1alpha2",
-        audit_findings_path: auditFindingsPath,
-        finding_count: findings.length,
-        findings_summary: findingsSummary,
-        affected_files: affectedFiles,
-        work_blocks: workBlocks,
-        work_block_seams: workBlockSeams,
-        source_digests: await hashSeedSourcePaths(seedRepoRoot(artifactsDir), auditFindingsPath, affectedFiles),
-        created_at: new Date().toISOString(),
-    };
-    await mkdir(contractPipelineDir(artifactsDir), { recursive: true });
-    await writeJsonFile(seedPath, seed);
-}
-/**
- * The repository root that owns `artifactsDir`, for resolving the seed's
- * repo-relative `affected_files`. Derived through the shared
- * `climbOutOfAuditTools` rather than a hand-rolled `../..`, so the one
- * `.audit-tools` layout rule stays single-sourced (and a caller that hands us a
- * dir outside the tree simply gets that dir back, which resolves relative paths
- * against it — the same thing every other artifact path in this module does).
- */
-function seedRepoRoot(artifactsDir) {
-    return climbOutOfAuditTools(artifactsDir);
-}
-/** Absolute form of a seed-recorded path (absolute entries pass through). */
-function resolveSeedSourcePath(root, path) {
-    return isAbsolute(path) ? path : resolve(root, path);
-}
-/**
- * sha256 every seed source path that EXISTS at seed-build time. A path that is
- * absent is not recorded at all — the seed binds what it actually read, and a
- * finding citing a file that does not exist yet (a new-file remediation) must
- * not mint a digest that can never match.
- */
-async function hashSeedSourcePaths(root, auditFindingsPath, affectedFiles) {
-    const digests = [];
-    // Content-derived order (path-sorted, deduped): an incidentally-ordered array
-    // would churn the seed's content hash on every re-derivation.
-    const candidates = [...new Set([auditFindingsPath, ...affectedFiles])].sort((left, right) => compareCodeUnits(left, right));
-    for (const path of candidates) {
-        const absolute = resolveSeedSourcePath(root, path);
-        let content;
-        try {
-            content = await readFile(absolute);
-        }
-        catch {
-            continue; // Not readable at seed time — nothing to bind.
-        }
-        digests.push({ path, sha256: hashContent(content) });
-    }
-    return digests;
 }
-/** The tool-named host lane: the operator's drift acceptances land here. */
-export function seedSourceAcceptancesPath(artifactsDir) {
-    return join(contractPipelineDir(artifactsDir), "seed-source-acceptances.json");
-}
-/**
- * Read the operator's acceptances, keyed by the same path normalization the
- * mismatch side uses. A malformed entry is DROPPED, never widened: an acceptance
- * missing its rationale or its decider records no decision, and treating it as
- * one would turn a shape defect into a silent bypass of the alarm.
- */
-export async function readSeedSourceAcceptances(artifactsDir) {
-    const raw = await readOptionalJsonFile(seedSourceAcceptancesPath(artifactsDir));
-    const byPath = new Map();
-    if (!isRecord(raw) || !Array.isArray(raw.acceptances))
-        return byPath;
-    for (const entry of raw.acceptances) {
-        if (!isRecord(entry))
-            continue;
-        const path = entry.path;
-        const rationale = entry.rationale;
-        const acceptedBy = entry.accepted_by;
-        if (typeof path !== "string" ||
-            path.trim().length === 0 ||
-            typeof rationale !== "string" ||
-            rationale.trim().length === 0 ||
-            typeof acceptedBy !== "string" ||
-            acceptedBy.trim().length === 0) {
-            continue;
-        }
-        byPath.set(normalizeRepoPath(path), {
-            path: path.trim(),
-            rationale: rationale.trim(),
-            accepted_by: acceptedBy.trim(),
-        });
-    }
-    return byPath;
-}
-/**
- * The seed paths the operator's acceptance file covers, applied to the drifted
- * set under the ONE path normalization both sides share; everything else blocks.
- *
- * This is the accept path and it is deliberately the ONLY automatic one: the
- * gate cannot tell a benign drift from a falsifying one, and the one predicate
- * that claimed to (cited line counts) was unsound — see {@link SeedSourceAcceptance}.
- */
-export async function partitionSeedSourceDrift(artifactsDir, mismatches) {
-    if (mismatches.length === 0)
-        return { accepted: [], blocking: [] };
-    const acceptances = await readSeedSourceAcceptances(artifactsDir);
-    if (acceptances.size === 0)
-        return { accepted: [], blocking: [...mismatches] };
-    const accepted = [];
-    const blocking = [];
-    for (const mismatch of mismatches) {
-        const acceptance = acceptances.get(normalizeRepoPath(mismatch.path));
-        if (acceptance) {
-            accepted.push({ ...acceptance, mismatch });
-            continue;
-        }
-        blocking.push(mismatch);
-    }
-    return { accepted, blocking };
-}
-/**
- * Seed source-digest binding — re-hash every path the path_a seed recorded and
- * report the ones that moved. Pure over (root, seed): the caller decides what a
- * mismatch means, so this is directly red-green testable without a pipeline.
- *
- * A seed with no `source_digests` (written before the field existed) binds
- * nothing and yields no mismatches.
- */
-export async function detectSeedSourceDigestMismatches(root, seed) {
-    const mismatches = [];
-    for (const entry of seed?.source_digests ?? []) {
-        if (typeof entry?.path !== "string" || typeof entry?.sha256 !== "string")
-            continue;
-        const absolute = resolveSeedSourcePath(root, entry.path);
-        let actual = null;
-        try {
-            actual = hashContent(await readFile(absolute));
-        }
-        catch {
-            actual = null;
-        }
-        if (actual !== entry.sha256) {
-            mismatches.push({ path: entry.path, expected: entry.sha256, actual });
-        }
-    }
-    return mismatches;
-}
-/**
- * Infer the most appropriate repair target from judge classifications when no
- * explicit repair_directive is provided. Examines only accepted classifications
- * and keyword-matches their rationale text.
- *
- * Priority (first match wins):
- *   obligation/ledger/invariant/constraint keywords → obligation_ledger
- *   assessment/finding/gap keywords                 → contract_assessment_report
- *   fallback                                        → finalized_module_contracts
- */
-export function inferRepairTarget(
-// Widened to match the guard below rather than the other way round: judge
-// reports are read back from artifact JSON, so `classifications` genuinely
-// arrives absent on a malformed/partial report. The declared-required type
-// said that could not happen while the body defended against it — and a
-// signature that disagrees with its own null-guard makes one of them dead.
-classifications) {
-    const accepted = (classifications ?? []).filter((c) => c.classification === "accepted");
-    const text = accepted.map((c) => c.rationale).join(" ").toLowerCase();
-    if (/obligation|ledger|invariant violated|constraint/.test(text)) {
-        return "obligation_ledger";
-    }
-    if (/assessment|contract finding|gap identified/.test(text)) {
-        return "contract_assessment_report";
-    }
-    return "finalized_module_contracts";
-}
-function inferRepairDirective(judge) {
-    return {
-        target: inferRepairTarget(judge.classifications),
-        instruction: "Address every judge-accepted counterexample in the judge report's classifications.",
-    };
-}
-/** Judge-accepted counterexample ids from a judge report's classifications. */
-function acceptedCeIdsOf(judge) {
-    return (judge?.classifications ?? [])
-        .filter((c) => c.classification === "accepted")
-        .map((c) => c.counterexample_id);
-}
-/**
- * Decide whether implementation planning may proceed. Convergence-terminated,
- * NOT capped at an arbitrary count:
- *   - approved verdict ⇒ proceed (the fixpoint);
- *   - a needs_repair verdict that surfaces a NEW accepted counterexample (one not
- *     already addressed by a prior repair) ⇒ repair (genuine progress);
- *   - a needs_repair verdict whose accepted counterexamples were ALL already
- *     addressed ⇒ escalate (stall/oscillation — the repair loop is not converging,
- *     surface the outstanding counterexamples to the user instead of silently
- *     shipping residual risk or looping);
- *   - the runaway backstop (MAX_CONTRACT_REPAIR_ITERATIONS) ⇒ escalate (loud).
- * The former fixed N=2 cap that proceeded-with-residual-risk at an arbitrary count
- * is gone: a deep-but-converging run is no longer cut mid-convergence, and a
- * genuinely non-converging run is surfaced rather than buried.
- */
-export async function evaluateJudgeGate(artifactsDir) {
-    const judgeEnvelope = await readContractArtifact(artifactsDir, "judge_report");
-    if (!judgeEnvelope)
-        return { kind: "proceed" };
-    const judge = envelopePayload(judgeEnvelope);
-    if (!judge || judge.verdict === "approved")
-        return { kind: "proceed" };
-    // Content-fingerprint keying (not raw id): two independent adversarial
-    // rounds may each label their genuinely-distinct top counterexample with
-    // the SAME reviewer id string (e.g. "CE-001", the prompt schema's own
-    // example value). Keying convergence on the raw id would then read "same CE
-    // re-accepted after a repair" and falsely escalate while a real new defect
-    // is being correctly repaired. Resolve each accepted id against the live
-    // counterexample artifact and key on content instead; an id with no
-    // matching counterexample falls back to raw-id keying — today's behavior —
-    // so nothing regresses when content can't be resolved. The keying is
-    // single-sourced with the waiver ledger (counterexampleKeyOf).
-    const cePayload = envelopePayload(await readContractArtifact(artifactsDir, "counterexample"));
-    const ceById = counterexamplesByIdOf(cePayload);
-    const keyOf = (rawId) => counterexampleKeyOf(ceById, rawId);
-    const acceptedIds = acceptedCeIdsOf(judge);
-    // Owner waivers (open-bugs.md:108, the recorded resolution verb): fold the
-    // host-written waiver file BEFORE any convergence math, so a waiver recorded
-    // against a blocked escalation unblocks this same invocation — including one
-    // recorded after a repair for this judge hash was already dispatched. An
-    // invalid file escalates loudly and applies NOTHING (never half-applied).
-    const fold = await foldCounterexampleWaivers(artifactsDir, {
-        counterexamplesById: ceById,
-        judgeAcceptedIds: new Set(acceptedIds),
+async function ensureSource(options) {
+    const existing = await readPlanSource(options.artifactsDir);
+    if (existing)
+        return existing;
+    const sources = await sourceDigests(options.sourcePaths ?? []);
+    const requestText = (await Promise.all(sources.map(source => readFile(source.path, "utf8")))).join("\n\n");
+    const id = `plan-${randomUUID()}`;
+    const source = PlanSourceSchema.parse({
+        plan_id: id, findings: [], audit_read: null, sources, intent: await readExecutionIntent(options.artifactsDir),
+        request: { id: `request-${randomUUID()}`, text: requestText || "Implement the operator's confirmed request.", source_paths: sources.map(entry => entry.path) },
     });
-    if (fold.issues.length > 0) {
-        return {
-            kind: "escalate",
-            reason: "invalid_waivers",
-            outstanding: acceptedIds,
-            waiverIssues: fold.issues,
-            note: "The counterexample waiver file was refused and nothing was applied. " +
-                "Fix or delete it, then re-run next-step.",
-        };
-    }
-    const repairState = await readRepairState(artifactsDir);
-    const waived = waivedAcceptedIds(repairState, ceById, acceptedIds);
-    const unwaivedAccepted = acceptedIds.filter((id) => !waived.has(id));
-    // Every accepted counterexample carries a recorded owner waiver → the
-    // needs_repair verdict is resolved by decision: proceed.
-    if (acceptedIds.length > 0 && unwaivedAccepted.length === 0) {
-        return { kind: "proceed" };
-    }
-    const judgeHash = judgeEnvelope.content_hash;
-    // ONE-TIME UPGRADE EFFECT: `computeHash` now serializes with
-    // `stableStringify` (artifactStore.ts), so a repair-ledger entry recorded
-    // before that change stores a key-order-sensitive `judge_hash` the recomputed
-    // value can never equal. A run sitting mid-repair-loop across the upgrade
-    // therefore misses on this compare and escalates ONCE as "not converging".
-    // Deliberate: the escalation is fail-safe (the operator resolves it and the
-    // loop re-enters on the freshly hashed report), and back-compat code for a
-    // value the next read recomputes would be carried forever for one run.
-    const alreadyHandled = repairState.repairs.some((repair) => repair.judge_hash === judgeHash);
-    // Map judge.repair_directive.target if present; if absent, infer from classifications.
-    //
-    // The validator admits only the declared owning artifacts plus the legacy
-    // `design_spec` alias (a report from an older release); `counterexample` is
-    // refused at ingestion with its reason, never swapped here. The legacy alias
-    // falls through to the inferred target, as it always has.
-    const rawDirective = judge.repair_directive;
-    const directive = rawDirective
-        ? {
-            target: rawDirective.target === "design_spec"
-                ? inferRepairDirective(judge).target
-                : rawDirective.target,
-            instruction: rawDirective.instruction,
-        }
-        : inferRepairDirective(judge);
-    const addressed = new Set(repairState.repairs.filter((repair) => (repair.target === "design_spec" ? "finalized_module_contracts" : repair.target) === directive.target).flatMap((r) => r.addressed_ce_fingerprints ??
-        (r.accepted_ce_ids ?? []).map((id) => `id:${id}`)));
-    const newAccepted = unwaivedAccepted.filter((id) => !addressed.has(keyOf(id)));
-    const newAcceptedFingerprints = newAccepted.map(keyOf);
-    // Idempotent re-entry: this exact judge report already drove a repair (its hash
-    // is recorded). Re-emit the same repair directive; do not re-evaluate convergence
-    // (the repair has not yet produced a fresh judge report).
-    if (alreadyHandled) {
-        return {
-            kind: "repair",
-            directive,
-            judgeHash,
-            acceptedCeIds: newAccepted,
-            addressedCeFingerprints: newAcceptedFingerprints,
-        };
-    }
-    // Runaway backstop (loud) — the exception path, not the normal terminator.
-    if (repairState.repairs.length >= MAX_CONTRACT_REPAIR_ITERATIONS) {
-        return {
-            kind: "escalate",
-            reason: "runaway",
-            outstanding: unwaivedAccepted,
-            note: `The judge↔repair loop reached its runaway backstop (${repairState.repairs.length} repair rounds) without converging. Each round was still surfacing accepted counterexamples. This is pathological non-convergence — review the outstanding counterexamples and the contract design with the user before proceeding.`,
-        };
-    }
-    // Progress: a new accepted counterexample (or the first round) ⇒ repair.
-    if (repairState.repairs.length === 0 || newAccepted.length > 0) {
-        return {
-            kind: "repair",
-            directive,
-            judgeHash,
-            acceptedCeIds: newAccepted,
-            addressedCeFingerprints: newAcceptedFingerprints,
-        };
-    }
-    // Stall: a needs_repair verdict whose every accepted counterexample was already
-    // addressed by a prior repair ⇒ the loop is not converging ⇒ escalate.
-    return {
-        kind: "escalate",
-        reason: "stall",
-        outstanding: unwaivedAccepted,
-        note: `The judge re-accepted counterexample(s) that a prior repair already addressed (${unwaivedAccepted.join(", ") || "none newly accepted"}), with no new accepted counterexample this round. The repair loop is not converging on these items. Resolve them with the user — adjust the contract design, or record an owner waiver accepting them as known limitations — before the plan can be promoted.`,
-    };
-}
-/** Blocking-severity critique item ids from a conceptual_design_critique payload. */
-function blockingCritiqueIds(critique) {
-    const items = isRecord(critique) && Array.isArray(critique.items) ? critique.items : [];
-    return items
-        .filter((item) => isRecord(item))
-        .filter((item) => item.severity === "blocking")
-        .map((item) => (typeof item.id === "string" ? item.id : ""))
-        .filter((id) => id.length > 0);
-}
-/**
- * Decide whether the pipeline may advance past the conceptual-design critique.
- *
- * The routing signal is MECHANICAL and derived only from the critique items: a
- * critique carrying ANY `severity: "blocking"` item means the design is not
- * approved and must be repaired — regardless of the author-stated `verdict`
- * string. This closes the contradictory-combo gap: a critique that marks items
- * `blocking` while declaring `approved` / `approved_with_concerns` (which the
- * pipeline previously waved through, since only a judge verdict ever gated
- * anything) no longer silently proceeds. Enforce-in-tooling: the verdict label
- * is advisory display; the blocking-item set is the contract.
- *
- * Convergence-terminated, mirroring {@link evaluateJudgeGate}: the first blocking
- * critique ⇒ repair its declared owner (legacy: `finalized_module_contracts`); repairing it
- * re-stales and re-emits the critique (it depends on the finalized contracts), so
- * a clean re-critique ⇒ proceed (the fixpoint). A fresh critique whose blocking
- * ids were ALL already addressed by a prior repair, with none new ⇒ escalate
- * (stall — the design loop is not converging) rather than repair forever; the
- * runaway backstop also escalates (loud).
- */
-export async function evaluateCritiqueGate(artifactsDir) {
-    const env = await readContractArtifact(artifactsDir, "conceptual_design_critique");
-    if (!env)
-        return { kind: "proceed" };
-    const critique = envelopePayload(env);
-    const blockingIds = blockingCritiqueIds(critique);
-    if (blockingIds.length === 0)
-        return { kind: "proceed" };
-    const requestedTarget = isRecord(critique) ? critique.repair_target : undefined;
-    if (requestedTarget !== undefined &&
-        !CONCEPTUAL_CRITIQUE_REPAIR_TARGETS.includes(requestedTarget)) {
-        return { kind: "escalate", reason: "unsupported_target", blocking: blockingIds,
-            note: `Unsupported critique repair_target ${JSON.stringify(requestedTarget)}; correct the critique to name finalized_module_contracts or module_decomposition.` };
-    }
-    const target = requestedTarget === "module_decomposition"
-        ? "module_decomposition" : "finalized_module_contracts";
-    const repairState = await readRepairState(artifactsDir);
-    const critiqueRepairs = repairState.critique_repairs ?? [];
-    const critiqueHash = env.content_hash;
-    // ONE-TIME UPGRADE EFFECT, the critique gate's twin of the judge site above:
-    // a `critique_hash` recorded before `computeHash` moved to `stableStringify`
-    // cannot equal the recomputed value, so an in-flight design-repair loop
-    // crossing the upgrade escalates once as a stall instead of re-emitting.
-    // Fail-safe and deliberately not mitigated — see that site for the reasoning.
-    const alreadyHandled = critiqueRepairs.some((r) => r.critique_hash === critiqueHash);
-    // Idempotent re-entry: this exact critique already drove a repair (its design
-    // repair has not yet produced a fresh critique). Re-emit the same repair.
-    if (alreadyHandled) {
-        return { kind: "repair", critiqueHash, blockingIds, target };
-    }
-    const addressed = new Set(critiqueRepairs
-        .filter((repair) => (repair.target ?? "finalized_module_contracts") === target)
-        .flatMap((repair) => repair.blocking_ids ?? []));
-    const newBlocking = blockingIds.filter((id) => !addressed.has(id));
-    // Runaway backstop (loud) — pathological non-convergence.
-    if (critiqueRepairs.length >= MAX_CONTRACT_REPAIR_ITERATIONS) {
-        return {
-            kind: "escalate",
-            reason: "runaway",
-            blocking: blockingIds,
-            note: `The conceptual-design critique↔repair loop reached its runaway backstop (${critiqueRepairs.length} repair rounds) while still raising blocking concerns. Review the critique and contract design with the user before proceeding.`,
-        };
-    }
-    // Progress: a new blocking concern (or the first round) ⇒ repair the design.
-    if (critiqueRepairs.length === 0 || newBlocking.length > 0) {
-        return { kind: "repair", critiqueHash, blockingIds, target };
-    }
-    // Stall: every blocking concern was already addressed by a prior repair, none
-    // new ⇒ the design loop is not converging ⇒ escalate to the user.
-    return {
-        kind: "escalate",
-        reason: "stall",
-        blocking: blockingIds,
-        note: `The conceptual-design critique re-raised blocking concern(s) that a prior design repair already addressed (${blockingIds.join(", ")}), with none newly raised. The design is not converging on these concerns. Resolve them with the user — revise the contract design or downgrade the concerns to advisory — before the pipeline can proceed.`,
-    };
+    await writeJsonFile(executionPlanPaths(options.artifactsDir).source, source);
+    return source;
 }
-/**
- * The traceability invariant: no implementation_dag node may exist without
- * tracing to an obligation from the ledger (satisfies_obligations or
- * verification_obligation_ids) or to a judge-accepted counterexample
- * (addresses_counterexamples). Untraceable nodes are unattributable work — the
- * exact thing the contract pipeline exists to prevent.
- */
-export async function validateImplementationDagTraceability(artifactsDir) {
-    const dag = envelopePayload(await readContractArtifact(artifactsDir, "implementation_dag"));
-    if (!dag) {
-        return { ok: false, violations: ["implementation_dag is missing."] };
-    }
-    const ledger = envelopePayload(await readContractArtifact(artifactsDir, "obligation_ledger"));
-    const judge = envelopePayload(await readContractArtifact(artifactsDir, "judge_report"));
-    const obligationIds = new Set((ledger?.obligations ?? []).map((obligation) => obligation.id));
-    const acceptedCounterexampleIds = new Set((judge?.classifications ?? [])
-        .filter((entry) => entry.classification === "accepted")
-        .map((entry) => entry.counterexample_id));
-    const violations = [];
-    const nodes = Array.isArray(dag.nodes) ? dag.nodes : [];
-    if (nodes.length === 0) {
-        violations.push("implementation_dag has no nodes; nothing would be implemented.");
-    }
-    // A node that resolves to no write scope is undispatchable: no worktree seed, no
-    // write boundary, no paths to inline for a single-shot worker. It used to reach
-    // the dispatch boundary anyway and fail there with "there is nothing a worker
-    // could be scoped to" — cascade-blocking its dependents, three steps from the
-    // cause. Refusing HERE puts it in front of the regeneration loop this validator
-    // already feeds, and names the slug that failed to join.
-    const { resolve: resolveWriteScope, availableSlugs } = await buildNodeWriteScopeResolver(artifactsDir);
-    for (const node of nodes) {
-        const tracedObligations = [
-            ...(node.satisfies_obligations ?? []),
-            ...(node.verification_obligation_ids ?? []),
-        ].filter((id) => obligationIds.has(id));
-        const tracedCounterexamples = (node.addresses_counterexamples ?? []).filter((id) => acceptedCounterexampleIds.has(id));
-        if (tracedObligations.length === 0 && tracedCounterexamples.length === 0) {
-            violations.push(`Node "${node.id}" traces to no obligation from the obligation ledger and no judge-accepted counterexample.`);
-        }
-        if (resolveWriteScope(node).length === 0) {
-            const carried = [
-                ...(node.satisfies_obligations ?? []),
-                ...(node.verification_obligation_ids ?? []),
-            ];
-            violations.push(`Node "${node.id}" resolves to an EMPTY write scope, so nothing could be dispatched for it. ` +
-                `It declares no output_files/files_likely_touched, and none of its obligation ids ` +
-                `(${carried.join(", ") || "none"}) begins with "OBL-<module>-" for any module in ` +
-                `module_decomposition (${availableSlugs.join(", ") || "no modules declared"}). ` +
-                `Declare the node's output_files, or name its obligations after a decomposed module.`);
-        }
-    }
-    return { ok: violations.length === 0, violations };
-}
-/**
- * Run the fail-closed contract-obligation gates against the persisted contract
- * artifacts: paired obligations, evidence threading, source-scoped digest
- * coverage, and INV-CO-12 reconciliation derivation.
- *
- * Branch on `evaluated` before trusting emptiness. This no longer flattens four `ValidationIssue[]`
- * into one array, where a gate that never RAN and a gate that ran CLEAN both
- * contributed nothing and were indistinguishable. It consumes the shared
- * gate-outcome record and branches on `evaluated` first: at this boundary every
- * phase artifact exists, so a skipped gate is a violation, not a pass. See
- * {@link consumeGateOutcomes} for the per-boundary `required` policy and the one
- * declared exception (`digest_coverage`).
- */
-export async function evaluateContractObligationsPromotionGate(artifactsDir, root = climbOutOfAuditTools(artifactsDir), inputs) {
-    const outcomes = await evaluateContractPipelineCrossGateOutcomes(inputs ?? (await readCrossGateInputs(artifactsDir, root)));
-    return consumeGateOutcomes(outcomes, PROMOTION_GATES, PROMOTION_REQUIRED_GATES);
-}
-/**
- * Pre-adversarial structural floor (S5). The subset of the contract-obligation
- * gates whose inputs all exist by the time the critic phase is reached
- * (paired-obligation coverage, source-scoped digest coverage, and seam
- * reconciliation derivation — none of which need the judge verdict or the
- * implementation_dag). Running them BEFORE the expensive critic/judge loop means
- * the adversarial phases only ever see structurally-sound obligations, tests, and
- * contracts, and a structural gap is re-emitted to the precise responsible phase
- * instead of being discovered at promotion (after the adversarial budget is spent)
- * and re-emitted to the wrong phase. The full {@link evaluateContractObligationsPromotionGate}
- * — including the evidence-threading check that needs the judge + DAG — still runs
- * at promotion as the fail-closed backstop; this gate never replaces it.
- *
- * Returns the first failing gate's responsible phase + rendered error lines, or
- * null when the structural floor is clean. Branches on each outcome's
- * `evaluated` before its empty issue list is allowed to mean clean
- * (the branch-on-evaluated rule); `contract_finalization`, `seam_reconciliation`
- * and `test_validator_plan` all precede `critic` in the phase order, so a
- * skipped gate here is a malformed payload rather than an absent one.
- */
-export async function evaluatePreCriticStructuralGate(artifactsDir, root = climbOutOfAuditTools(artifactsDir), inputs) {
-    const outcomes = await evaluateContractPipelineCrossGateOutcomes(inputs ?? (await readCrossGateInputs(artifactsDir, root)));
-    // Upstream-owned checks first: a derivation/coverage gap is fixed in the
-    // finalized contracts (the obligation ledger is derived from them).
-    const design = consumeGateOutcomes(outcomes, ["reconciliation_derivation", "digest_coverage"], PRE_CRITIC_REQUIRED_GATES);
-    if (!design.ok) {
-        return {
-            phase: "contract_finalization",
-            errorLines: design.violations.map((violation) => `- ${violation}`),
-        };
-    }
-    // A testable obligation without a paired spec is fixed in the test plan
-    // (skeleton-scaffolded from the derived ledger).
-    const tests = consumeGateOutcomes(outcomes, ["paired_obligations"], PRE_CRITIC_REQUIRED_GATES);
-    if (!tests.ok) {
-        return {
-            phase: "test_validator_plan",
-            errorLines: tests.violations.map((violation) => `- ${violation}`),
-        };
-    }
-    return null;
-}
-// ── M-B3: source-grounded citation gate (repo-tree knownPaths) ────────────────
-//
-// A contract finding that cites a file path or a code symbol must point at
-// something REAL in the working tree. The gate runs at two boundaries:
-//
-//  1. PRE-CRITIC: ground the module_decomposition's `file_scope` citations
-//     (each module declares the files it owns; file_scope lives in the
-//     decomposition — the finalized contracts carry interface fields, not
-//     paths). A module that cites only a path that does not exist AND no real
-//     symbol is hallucinating its scope before the adversarial budget is ever
-//     spent — re-emit the `decomposition` phase (the phase that OWNS file_scope,
-//     so re-authoring it can actually fix the bad path; re-emitting a downstream
-//     phase like contract_finalization could never change file_scope → loops).
-//  2. PROMOTION BACKSTOP: ground every promoted extracted-plan finding's
-//     citations before the plan is handed to the document/implement flow.
-//
-// Fail-closed ONLY when the working tree itself is unreadable (git ls-files
-// returns nothing) — a normal run with legitimately new-file scopes is not
-// bricked, because a finding grounds if ANY cited path OR symbol is real.
-/**
- * Map module_decomposition modules to Finding-shaped citations the shared
- * grounding gate consumes: each module's `file_scope` → affected_files (the
- * declared paths it owns), its name + responsibilities → summary (for the
- * symbol-shaped grounding fallback). The decomposition is where file_scope
- * lives — the finalized contracts carry interface fields (inputs/outputs/
- * invariants), not paths — so a module that declares only a non-existent
- * file_scope path is the pre-critic hallucination this catches.
- *
- * A module that declares NO file_scope at all contributes no citation (there is
- * nothing to ground) — it is not a hallucination, just an undeclared scope.
- */
-function decompositionModulesToCitations(decompositionPayload) {
-    const modules = isRecord(decompositionPayload) && Array.isArray(decompositionPayload.modules)
-        ? decompositionPayload.modules
-        : [];
-    const citations = [];
-    for (const [i, mod] of modules.entries()) {
-        if (!isRecord(mod))
-            continue;
-        const fileScope = Array.isArray(mod.file_scope)
-            ? mod.file_scope.filter((p) => typeof p === "string")
-            : [];
-        if (fileScope.length === 0)
-            continue;
-        const name = typeof mod.name === "string" ? mod.name : `module-${i}`;
-        const responsibilities = typeof mod.responsibilities === "string" ? mod.responsibilities : "";
-        citations.push({
-            id: name,
-            title: name,
-            category: "module_contract",
-            severity: "medium",
-            confidence: "high",
-            lens: "architecture",
-            summary: `${name} ${responsibilities}`,
-            affected_files: fileScope.map((path) => ({ path })),
-        });
-    }
-    return citations;
+async function emit(options, prompt, status = "ready") {
+    const paths = executionPlanPaths(options.artifactsDir);
+    return writeCurrentStep({
+        stepKind: "contract_pipeline", status, runId: options.runId, repoRoot: options.root,
+        artifactsDir: options.artifactsDir,
+        prompt: `${prompt}\n\nAfter writing the requested response, run \`${loaderCommand("next-step")}\`.`,
+        allowedCommands: [loaderCommand("next-step")],
+        stopCondition: "Complete only the bound planning/review assignment, then call next-step.",
+        artifactPaths: { source: paths.source, execution_plan: paths.canonical, plan_submission: paths.submission },
+    });
 }
 /**
- * Pre-critic citation grounding over the module decomposition's file scope.
- * Returns rendered error lines (re-emit contract_finalization) or null when clean
- * — including a clean fail-closed pass (the gate's own repo-tree issue is surfaced
- * as an error line so an unreadable tree is loud, never silent).
+ * The repair bound is spent for this review cycle. Nothing records an operator override of a reviewer's refusal (by design;
+ * #14 removed waivers), so the step names the only working exits: a revised plan that is reviewed again, or cancelling the run.
  */
-async function evaluatePreCriticCitationGrounding(artifactsDir, repoRoot) {
-    const decomposition = envelopePayload(await readContractArtifact(artifactsDir, "module_decomposition"));
-    const citations = decompositionModulesToCitations(decomposition);
-    if (citations.length === 0)
-        return null;
-    const result = await validateContractCitationGrounding(citations, repoRoot);
-    // The same boundary owns the re-export-shim rule: a file_scope that grounds
-    // only at a barrel is as unfixable downstream as one that does not ground at
-    // all, and the decomposition prompt states the rule as binding.
-    // Its tree-readability issue repeats the citation gate's own, so it is dropped.
-    const shimIssues = (await validateDecompositionFileScope(decomposition, repoRoot)).issues.filter((issue) => issue.path !== "decomposition_file_scope.repo_tree");
-    const errors = [...result.issues, ...shimIssues].filter((issue) => issue.severity === "error");
-    if (errors.length === 0)
-        return null;
-    return { errorLines: errors.map((issue) => `- [${issue.path}] ${issue.message}`) };
+function repairBoundSpent(options, review, kind, remaining) {
+    return emit(options, `${review} has not converged after eight repair decisions in this review cycle. There is no operator override of the reviewers' refusal. To continue, revise the plan so it addresses every one of these ${kind}, and write the complete revision to ${executionPlanPaths(options.artifactsDir).submission}; the revision is reviewed again. Otherwise the operator may cancel the run. Do not implement an unapproved plan.\n\nRemaining ${kind}:\n${JSON.stringify(remaining, null, 2)}`, "blocked");
 }
-/**
- * Promotion-backstop citation grounding over the promoted extracted-plan
- * findings. Returns rendered violation lines, or null when every finding grounds.
- */
-export async function evaluatePromotedPlanCitationGrounding(artifactsDir, repoRoot) {
-    const plan = await readOptionalJsonFile(intakePaths(artifactsDir).extractedPlan);
-    const findings = isRecord(plan) && Array.isArray(plan.findings)
-        ? plan.findings
-        : [];
-    if (findings.length === 0)
-        return null;
-    const result = await validateContractCitationGrounding(findings, repoRoot);
-    const errors = result.issues.filter((issue) => issue.severity === "error");
-    if (errors.length === 0)
-        return null;
-    return { violations: errors.map((issue) => `[${issue.path}] ${issue.message}`) };
+async function authorStep(options, source, canonical, reason) {
+    const paths = executionPlanPaths(options.artifactsDir);
+    return emit(options, renderPlanAuthorPrompt({ root: options.root, source, canonical,
+        history: await readPlanReviewHistory(options.artifactsDir), sourcePath: paths.source,
+        planPath: paths.canonical, outputPath: paths.submission, reason }));
 }
-// ── DC-3: parallel per-module contract drafting ───────────────────────────────
-//
-// `module_contract_drafting` (→ module_contracts) aggregates a `module_contracts[]`
-// array keyed by module name. DC-3 exposes one bounded host workload per module,
-// replacing the former single sequential workload — each agent reads its own
-// module's file scope, so no single agent owns both sides of a seam. Each agent
-// writes a per-module SHARD; the orchestrator merges all shards into the
-// aggregated artifact — byte-identical in shape to the single-agent output — and
-// guarantees the merge is COMPLETE (every decomposed module present) before
-// downstream derivation runs. A missing shard re-emits the wave (never a partial
-// aggregate). `contract_finalization` is NOT a parallel wave: it is derived
-// deterministically from the drafts + seam report (see the deterministic
-// contract_finalization fast path), no fresh source read.
-/** The phase(s) that fan out per module, and the artifact each produces. */
-const PARALLEL_MODULE_PHASES = {
-    module_contract_drafting: "module_contracts",
+/** Review dependencies are declarations over one revision, never a second artifact-state graph. */
+const REVIEW_DEPENDENCIES = {
+    critique: [], critic: ["critique"], judge: ["critique", "critic"],
 };
-export function isParallelModulePhase(phase) {
-    return phase === "module_contract_drafting";
-}
-/** Read the decomposed modules (name + responsibilities + file_scope) in order. */
-async function readDecomposedModules(artifactsDir) {
-    const decomposition = envelopePayload(await readContractArtifact(artifactsDir, "module_decomposition"));
-    const modules = isRecord(decomposition) && Array.isArray(decomposition.modules)
-        ? decomposition.modules
-        : [];
-    const result = [];
-    for (const mod of modules) {
-        if (!isRecord(mod) || typeof mod.name !== "string" || mod.name.length === 0) {
-            continue;
-        }
-        result.push({
-            name: mod.name,
-            responsibilities: typeof mod.responsibilities === "string" ? mod.responsibilities : "",
-            file_scope: Array.isArray(mod.file_scope)
-                ? mod.file_scope.filter((p) => typeof p === "string")
-                : [],
-        });
-    }
-    return result;
-}
-/**
- * Characters that disqualify a finalized-contract entry from being read as a
- * repo-relative write target: any whitespace (prose), `:` (the `artifact:<name>`
- * ordering token and the Windows drive form), and the glob/redirect set no
- * legal declared path carries.
- */
-const NON_WRITE_TARGET_CHARS = /[\s:*?"<>|]/u;
-/**
- * A finalized module contract's `outputs` / `side_effects` are FREE PROSE that
- * may name a file ("src/foo.ts") or may describe an effect ("writes the run
- * ledger under .audit-tools") or carry an ordering token
- * ("artifact:validated-roster" — see ARTIFACT_TOKEN_PATTERN in phaseCut.ts).
- * Only the first kind is a write target, so this is a deliberately CONSERVATIVE
- * parse: an entry qualifies only when it reads unambiguously as a repo-relative
- * path, and everything else is silently dropped — prose stays prose. A false
- * positive here would widen a worker's write scope on the strength of a
- * sentence, which is strictly worse than the manual widening this replaces.
- *
- * Returns the forward-slashed path, or null when the entry is not one.
- */
-function contractDeclaredWriteTarget(entry) {
-    if (typeof entry !== "string")
-        return null;
-    const trimmed = entry.trim();
-    if (trimmed.length === 0)
-        return null;
-    if (NON_WRITE_TARGET_CHARS.test(trimmed))
-        return null;
-    // Absolute (POSIX or Windows-UNC) forms are not repo-relative.
-    if (trimmed.startsWith("/") || trimmed.startsWith("\\"))
-        return null;
-    const normalized = trimmed.replace(/\\/gu, "/");
-    if (normalized.split("/").includes(".."))
-        return null;
-    // A bare word ("session") is an interface name, not a path. Require either a
-    // path separator or a file extension.
-    if (!normalized.includes("/") && !/\.[a-z0-9]{1,6}$/iu.test(normalized))
-        return null;
-    return normalized;
-}
-/**
- * The path-parseable write targets each finalized module contract declares,
- * keyed by `moduleSlug(name)` — the SAME identity the obligation ids encode, so
- * this map joins to the decomposition's modules without a second name space.
- *
- * Degrades to an empty map when the artifact is absent or malformed: this
- * resolver runs on the VALIDATOR's refusal path, so a bad contracts file must
- * cost the widening, never wedge every subsequent next-step with a throw.
- */
-async function readModuleContractWriteTargets(artifactsDir) {
-    let finalized;
-    try {
-        finalized = envelopePayload(await readContractArtifact(artifactsDir, "finalized_module_contracts"));
-    }
-    catch {
-        return new Map();
-    }
-    const entries = isRecord(finalized) && Array.isArray(finalized.module_contracts)
-        ? finalized.module_contracts
-        : [];
-    const bySlug = new Map();
-    for (const entry of entries) {
-        if (!isRecord(entry) || typeof entry.name !== "string")
-            continue;
-        const slug = moduleSlug(entry.name);
-        if (slug.length === 0)
-            continue;
-        const targets = bySlug.get(slug) ?? [];
-        const declared = [
-            ...(Array.isArray(entry.outputs) ? entry.outputs : []),
-            ...(Array.isArray(entry.side_effects) ? entry.side_effects : []),
-        ];
-        for (const raw of declared) {
-            const target = contractDeclaredWriteTarget(raw);
-            if (target !== null && !targets.includes(target))
-                targets.push(target);
-        }
-        bySlug.set(slug, targets);
-    }
-    return bySlug;
-}
-/**
- * Single source for "which files may this DAG node write". The scope is the
- * UNION of two declarations, never one overriding the other:
- *
- *  - the node's own declared files (`output_files`, else `files_likely_touched`);
- *  - the path-parseable write targets (`outputs` + `side_effects`) declared by
- *    the finalized contract of the module(s) the node's obligations belong to,
- *    resolved by longest-`OBL-<slug>-` prefix so a short slug never mis-claims a
- *    longer module's targets.
- *
- * A node that declared NO files of its own additionally inherits the
- * `file_scope` of those same modules — that inheritance is the scope-less
- * FALLBACK only, and is deliberately not unioned into a node that did declare.
- *
- * ⚠ The declared-files-win EARLY RETURN this used to perform is deliberately
- * superseded (owner decision, nightly ledger 2026-08-20). The module contract is
- * where a module's write targets are declared, and they never reached the node
- * scope — so an implementer was handed an obligation whose declared target file
- * was missing from `allowed_files`, and a human widened it by hand (four
- * recoveries in one wave). Union, not precedence.
- *
- * ⚠ Shared by the PROMOTER (which derives the scope) and the VALIDATOR (which
- * refuses when it resolves to nothing) on purpose. Two copies of this resolution
- * would drift, and the drift is invisible: the validator would pass a node the
- * promoter then writes scope-less.
- *
- * The join it performs is between two INDEPENDENTLY AUTHORED name spaces — the
- * obligation id's slug and the decomposition's module names — which is exactly
- * where it fails. Observed 2026-08-09: nodes carrying `OBL-attribution-capture-…`
- * and `OBL-verdict-capture-…` matched no module, because the decomposition had
- * named them `dispatch-attribution-capture` and `verdict-capture-audit` /
- * `verdict-capture-remediate`. Their siblings matched and dispatched; these two
- * resolved to nothing and died later at the dispatch boundary with "there is
- * nothing a worker could be scoped to", three steps from the cause.
- */
-async function buildNodeWriteScopeResolver(artifactsDir) {
-    const decomposedModules = await readDecomposedModules(artifactsDir);
-    const contractTargetsBySlug = await readModuleContractWriteTargets(artifactsDir);
-    const moduleScopesBySlug = decomposedModules.map((m) => ({
-        slug: moduleSlug(m.name),
-        files: m.file_scope,
-        targets: contractTargetsBySlug.get(moduleSlug(m.name)) ?? [],
-    }));
-    // The join is the EXACT one (`idRegistry.moduleSlugForObligationId`), not a
-    // longest-prefix match. Longest-prefix guessed whenever one module slug
-    // prefixed another: with `auth` and `auth-service` both decomposed the guess
-    // resolved correctly by luck of the sort, but with `auth-service` out of
-    // scope, `OBL-auth-service-contract` matched `auth` and the node silently
-    // took `auth`'s targets — another module's write boundary, granted without
-    // anyone choosing it. The suffix grammar makes the unresolvable case
-    // UNRESOLVABLE, which the empty-scope refusal below already reports loudly.
-    const scopeBySlug = new Map(moduleScopesBySlug.map((m) => [m.slug, m]));
-    const knownSlugs = new Set(scopeBySlug.keys());
-    const resolve = (node) => {
-        const declared = [...new Set(node.output_files ?? node.files_likely_touched ?? [])];
-        const obligationIds = [
-            ...(node.satisfies_obligations ?? []),
-            ...(node.verification_obligation_ids ?? []),
-        ];
-        const inherited = new Set();
-        const ownedTargets = new Set();
-        for (const id of obligationIds) {
-            const slug = moduleSlugForObligationId(id, knownSlugs);
-            const owner = slug === null ? undefined : scopeBySlug.get(slug);
-            if (!owner)
-                continue;
-            // file_scope inheritance is the scope-less fallback ONLY; the contract's
-            // declared targets are unioned in either way.
-            if (declared.length === 0)
-                for (const f of owner.files)
-                    inherited.add(f);
-            for (const t of owner.targets)
-                ownedTargets.add(t);
-        }
-        // Content-derived order: the node's own declarations first, in the order
-        // they were declared, then the added targets path-sorted — so the resolved
-        // scope (which reaches the plan's content hash through affected_files)
-        // never churns on module ordering.
-        const base = declared.length > 0 ? declared : [...inherited];
-        const added = [...ownedTargets]
-            .filter((t) => !base.includes(t))
-            .sort((left, right) => compareCodeUnits(left, right));
-        return [...base, ...added];
-    };
-    return { resolve, availableSlugs: moduleScopesBySlug.map((m) => m.slug) };
-}
-/** The goal_id carried by module_decomposition (authoritative for the merge). */
-async function readDecompositionGoalId(artifactsDir) {
-    const decomposition = envelopePayload(await readContractArtifact(artifactsDir, "module_decomposition"));
-    return isRecord(decomposition) && typeof decomposition.goal_id === "string"
-        ? decomposition.goal_id
-        : "";
-}
-/** Filesystem-safe shard id for a module name (the merge re-keys by name, not id). */
-function moduleShardId(moduleName) {
-    const slug = moduleName.replace(/[^A-Za-z0-9._-]+/g, "_").replace(/^_+|_+$/g, "");
-    // Keep names disjoint even after slugging by appending a short content hash.
-    return `${slug || "module"}-${hashContent(moduleName, { length: 8 })}`;
-}
-/** Directory holding one per-module shard for a given parallel phase. */
-function moduleWaveDir(artifactsDir, phase) {
-    return join(contractPipelineDir(artifactsDir), "module-waves", phase);
-}
-function moduleShardPath(artifactsDir, phase, moduleName) {
-    return join(moduleWaveDir(artifactsDir, phase), `${moduleShardId(moduleName)}.json`);
-}
-/**
- * Scan the per-module shards for a phase against the decomposed module set. A
- * shard counts as present only when it parses to an object whose module-contract
- * `name` matches the decomposed module it is filed under — a stray/mismatched
- * shard never satisfies completeness.
- */
-async function scanModuleShards(artifactsDir, phase, modules) {
-    const present = new Map();
-    const missing = [];
-    for (const mod of modules) {
-        const shard = await readOptionalJsonFile(moduleShardPath(artifactsDir, phase, mod.name));
-        const contract = extractShardContract(shard, mod.name);
-        if (contract) {
-            present.set(mod.name, contract);
-        }
+async function reviewStep(options, canonical, role) {
+    const paths = executionPlanPaths(options.artifactsDir), rolePaths = paths.review(role);
+    const history = await readPlanReviewHistory(options.artifactsDir);
+    const dependencies = await Promise.all(REVIEW_DEPENDENCIES[role].map(dependency => readPlanReview(options.artifactsDir, dependency, canonical.revision_sha256)));
+    const ownerDecision = await readOptionalJsonFile(join(paths.directory, "owner-decision.json"));
+    const inputSha = hashContent(stableStringify({ revision: canonical.revision_sha256, role, dependencies, history, ownerDecision }));
+    const prior = await readPlanReview(options.artifactsDir, role, canonical.revision_sha256);
+    const { adversarialDepth } = await resolveAdversarialDepth(options.artifactsDir);
+    const requirement = reviewRequirementForRole(role, adversarialDepth);
+    const body = renderPlanReviewPrompt({ role, root: options.root, sourcePath: paths.source, planPath: paths.canonical,
+        canonical, history, priorReviewPaths: REVIEW_DEPENDENCIES[role].map(dependency => paths.review(dependency).accepted), requirement });
+    const bound = bindWorkerPrompt(body + `\nInput binding: ${inputSha}`, prompt_sha256 => JSON.stringify({
+        contract_version: "review-submission/v1", prompt_sha256,
+        review: { mode: requirement === "independent" ? "independent" : "degraded", reason: "<how the context meets the review policy>" },
+        result: "<the role's result object>",
+    }, null, 2));
+    if (prior?.input_sha256 === inputSha &&
+        prior.provenance.reviewed_content_hash === canonical.revision_sha256 &&
+        prior.provenance.requirement === requirement &&
+        prior.provenance.prompt_sha256 === bound.sha256 &&
+        !reviewIndependenceIssue(requirement, prior.provenance.review))
+        return prior;
+    const request = { role, revision_sha256: canonical.revision_sha256, input_sha256: inputSha, prompt_sha256: bound.sha256, requirement };
+    const issued = await readOptionalJsonFile(rolePaths.request);
+    const raw = await readOptionalJsonFile(rolePaths.submission);
+    let errors = [];
+    if (raw !== undefined && stableStringify(issued) === stableStringify(request)) {
+        const result = parseReviewSubmissionEnvelope(raw, { requirement, promptSha256: bound.sha256 });
+        if (!result.ok)
+            errors = [result.issue];
         else {
-            missing.push(mod.name);
-        }
-    }
-    return { present, missing };
-}
-/**
- * Normalize a worker-written shard into the single module-contract record for
- * `moduleName`. Accepts either the bare contract object (`{ name, ... }`) or the
- * aggregated wrapper shape (`{ module_contracts: [{ name, ... }] }`) so a worker
- * that mirrored the aggregate schema for one module still merges. Returns null
- * when no record for `moduleName` is found.
- */
-function extractShardContract(shard, moduleName) {
-    if (!isRecord(shard))
-        return null;
-    if (Array.isArray(shard.module_contracts)) {
-        const match = shard.module_contracts.find((entry) => isRecord(entry) && entry.name === moduleName);
-        return isRecord(match) ? match : null;
-    }
-    if (shard.name === moduleName)
-        return shard;
-    return null;
-}
-/**
- * Merge complete per-module shards into the aggregated `module_contracts`
- * artifact, byte-identical in shape to the former single-agent output: the same envelope
- * (`contract_version`, `goal_id`, `module_contracts[]`, `created_at`) with one
- * entry per module in DECOMPOSITION order (deterministic, not directory order).
- * Caller guarantees completeness first.
- */
-function mergeModuleShards(modules, present, goalId) {
-    const contractVersion = CP_MODULE_CONTRACTS_VERSION;
-    const moduleContracts = modules.map((mod) => present.get(mod.name));
-    return {
-        contract_version: contractVersion,
-        goal_id: goalId,
-        module_contracts: moduleContracts,
-        created_at: new Date().toISOString(),
-    };
-}
-/**
- * Write-through invariant (repair-revert fix): the per-module shards under
- * `module-waves/module_contract_drafting/` are the single source of truth for the
- * aggregated `module_contracts` artifact — the aggregate is a pure re-merge of
- * them. When that aggregate is instead ingested directly (a degenerate
- * single-agent draft, or a direct edit), decompose it back into its shards
- * (matched by module `name`, in decomposition order) so a later cascade that
- * re-merges the shards reproduces the change instead of reverting to the stale
- * shards. No-op for any artifact that is not a sharded module-phase artifact
- * (`finalized_module_contracts` is deterministically derived, never sharded), or a
- * payload lacking a `module_contracts[]` array.
- */
-async function propagateAggregateToShards(artifactsDir, name, payload) {
-    const phase = (Object.entries(PARALLEL_MODULE_PHASES).find(([, artifact]) => artifact === name)?.[0]);
-    if (!phase)
-        return;
-    if (!isRecord(payload) || !Array.isArray(payload.module_contracts))
-        return;
-    const contracts = payload.module_contracts;
-    const modules = await readDecomposedModules(artifactsDir);
-    for (const mod of modules) {
-        const entry = contracts.find((c) => isRecord(c) && c.name === mod.name);
-        if (entry) {
-            await writeJsonFile(moduleShardPath(artifactsDir, phase, mod.name), entry);
-        }
-    }
-}
-// ── Step builder ──────────────────────────────────────────────────────────────
-/**
- * Resolve the adversarial-depth dial for a run (extracted from
- * buildNextContractPipelineStep for testability; behavior-preserving).
- *
- * The depth derives from the intake risk signal (the slice-2 shared signal).
- * Escalate-on-evidence (optimistic-start): the run begins at the cheap intake
- * tier; once decomposition reveals the work's actual shape, the tier is raised
- * for THIS and every subsequent next-step. The raise is idempotent + convergent
- * (escalateRiskSignal no-ops once the tier already covers the evidence), and the
- * signal is rewritten only on a real raise. Absent signal ⇒ undefined ⇒ the
- * renderer applies its fail-safe full depth (floor is `light`, never off).
- */
-export async function resolveAdversarialDepth(artifactsDir) {
-    let riskSignal = await readIntakeRiskSignal(artifactsDir);
-    if (riskSignal) {
-        const modules = await readDecomposedModules(artifactsDir);
-        if (modules.length > 0) {
-            const evidence = decompositionRiskEvidence({
-                moduleCount: modules.length,
-                fileScopes: modules.flatMap((m) => m.file_scope),
-            });
-            if (evidence) {
-                const raised = escalateRiskSignal(riskSignal, evidence);
-                if (raised !== riskSignal) {
-                    await writeIntakeRiskSignal(artifactsDir, raised);
-                    riskSignal = raised;
+            const schema = role === "critique" ? CritiqueSchema : role === "critic" ? CriticSchema : PlanJudgeSchema;
+            const parsed = schema.safeParse(result.result);
+            if (!parsed.success)
+                errors = parsed.error.issues.map(issue => `${issue.path.join(".")}: ${issue.message}`);
+            else {
+                const payload = parsed.data;
+                const reqIds = new Set(canonical.plan.requirements.map(entry => entry.id));
+                const unitIds = new Set(canonical.plan.units.map(entry => entry.id));
+                if (role === "critique" || role === "critic") {
+                    const references = role === "critique" ? CritiqueSchema.parse(payload).issues : CriticSchema.parse(payload).counterexamples;
+                    if (new Set(references.map(entry => entry.id)).size !== references.length)
+                        errors.push("Review issue identities must be unique.");
+                    for (const entry of references) {
+                        if (entry.requirement_ids.some(id => !reqIds.has(id)) || entry.unit_ids.some(id => !unitIds.has(id)))
+                            errors.push(`Review issue ${entry.id} references missing plan entities.`);
+                    }
+                }
+                if (role === "judge") {
+                    const judge = PlanJudgeSchema.parse(payload);
+                    const critic = CriticSchema.parse(dependencies[1]?.result);
+                    const ids = new Set([...history.accepted_ids, ...critic.counterexamples.map(entry => entry.id)]);
+                    const given = judge.classifications.map(entry => entry.counterexample_id);
+                    if (given.length !== ids.size || new Set(given).size !== given.length || given.some(id => !ids.has(id)))
+                        errors.push("Judge must classify every current/previously accepted counterexample exactly once.");
+                    const assessed = judge.requirement_assessments.map(entry => entry.requirement_id);
+                    if (assessed.length !== reqIds.size || new Set(assessed).size !== assessed.length || assessed.some(id => !reqIds.has(id)))
+                        errors.push("Judge must assess every requirement exactly once.");
+                    const disposed = new Set(canonical.plan.source_dispositions.map(entry => entry.finding_id));
+                    const reviewed = judge.disposition_assessments.map(entry => entry.finding_id);
+                    if (reviewed.length !== disposed.size || new Set(reviewed).size !== reviewed.length || reviewed.some(id => !disposed.has(id)))
+                        errors.push("Judge must assess every source disposition exactly once.");
+                    if (canonical.plan.request_disposition && !judge.request_disposition_assessment)
+                        errors.push("Judge must assess the evidence-backed request disposition.");
+                    if (judge.verdict === "approved" && (judge.request_disposition_assessment?.verdict === "insufficient" || judge.classifications.some(entry => entry.classification === "accepted") || judge.requirement_assessments.some(entry => entry.verdict !== "satisfied") || judge.disposition_assessments.some(entry => entry.verdict !== "satisfied")))
+                        errors.push("An approval cannot contain unresolved counterexamples or insufficient evidence.");
+                }
+                if (!errors.length) {
+                    const receipt = { ...request, provenance: { requirement, prompt_sha256: bound.sha256, review: result.review, reviewed_content_hash: canonical.revision_sha256 }, result: payload };
+                    // Only canonical accepted receipts are downstream inputs.
+                    const { requirement: _requirement, prompt_sha256: _prompt, ...accepted } = receipt;
+                    const previousReceipt = PlanReviewReceiptSchema.safeParse(await readOptionalJsonFile(rolePaths.accepted));
+                    if (previousReceipt.success) {
+                        const old = previousReceipt.data;
+                        await writeJsonFile(join(paths.directory, "history", "reviews", `${old.revision_sha256}-${role}-${old.input_sha256}.json`), old);
+                    }
+                    await writeJsonFile(join(paths.directory, "submissions", `${canonical.revision_sha256}-${role}-${bound.sha256}.json`), raw);
+                    await writeJsonFile(rolePaths.accepted, accepted);
+                    return accepted;
                 }
             }
         }
     }
-    return {
-        riskSignal,
-        adversarialDepth: riskSignal ? adversarialDepthForTier(riskSignal.tier) : undefined,
-    };
-}
-// ── Writers ───────────────────────────────────────────────────────────────────
-/** The artifact-path map every emitted step carries (existing artifacts only). */
-function contractStepArtifactPaths(ctx, outputPath) {
-    const stepArtifactPaths = {};
-    if (outputPath)
-        stepArtifactPaths.output = outputPath;
-    for (const [key, value] of Object.entries(ctx.artifactPaths)) {
-        if (value && existsSync(value))
-            stepArtifactPaths[key] = value;
-    }
-    if (ctx.sourcePaths) {
-        stepArtifactPaths.source_manifest = ctx.paths.sourceManifest;
-        stepArtifactPaths.remediation_brief = ctx.paths.brief;
-    }
-    return stepArtifactPaths;
-}
-function writeContractPromptStep(ctx, params) {
-    const nextCommand = loaderCommand("next-step");
-    const prompt = `${params.prompt}
-
-After writing the output file, run:
-
-\`${nextCommand}\`
-`;
-    return writeCurrentStep({
-        stepKind: CONTRACT_STEP_KIND,
-        status: "ready",
-        runId: ctx.runId,
-        repoRoot: ctx.root,
-        artifactsDir: ctx.artifactsDir,
-        prompt,
-        allowedCommands: [nextCommand],
-        stopCondition: params.stopCondition,
-        artifactPaths: contractStepArtifactPaths(ctx, params.outputPath),
-    });
-}
-async function writeContractPhaseStep(ctx, phase, extraSection) {
-    if (phase === "cyclic_seam_resolution") {
-        // One text for this phase: a generic re-emit carries the same ledger-rewrite
-        // instructions as the gate's own attempt (see renderCyclicSeamResolutionPrompt).
-        const graph = await readSeamObligationGraph(ctx.artifactsDir);
-        const outputPath = contractInputFilePath(ctx.artifactsDir, "cyclic_seam_resolution");
-        return writeContractPromptStep(ctx, {
-            prompt: renderCyclicSeamResolutionPrompt({
-                cycleDescriptions: renderCycleDescriptions(detectCyclicSeamObligations(graph.nodes)),
-                ledgerInputPath: contractInputFilePath(ctx.artifactsDir, "obligation_ledger"),
-                outputPath,
-                extraSection: extraSection ? `\n${extraSection}` : undefined,
-            }),
-            outputPath,
-            stopCondition: CYCLIC_SEAM_RESOLUTION_STOP,
-        });
-    }
-    const rendered = renderContractPipelinePrompt({
-        role: phase,
-        artifactPaths: ctx.artifactPaths,
-        artifactReadPaths: ctx.artifactReadPaths,
-        sourcePaths: ctx.sourcePaths,
-        repoRoot: ctx.root,
-        pathASeedPath: ctx.pathASeedPath,
-        adversarialDepth: ctx.adversarialDepth,
-    });
-    const prompt = await bindContractReviewPrompt({
-        artifactsDir: ctx.artifactsDir, artifact: PHASE_TO_ARTIFACT[phase], role: phase,
-        emissionId: ctx.runId, requirement: reviewRequirementForRole(phase, ctx.adversarialDepth),
-        prompt: extraSection ? `${rendered.prompt}\n${extraSection}` : rendered.prompt,
-    });
-    return writeContractPromptStep(ctx, {
-        prompt,
-        outputPath: rendered.outputPath,
-        stopCondition: `Stop after writing the contract-pipeline output for phase "${phase}" and running next-step.`,
-    });
-}
-function writeContractBlockedStep(ctx, params) {
-    return writeCurrentStep({
-        stepKind: CONTRACT_STEP_KIND,
-        status: "blocked",
-        runId: ctx.runId,
-        repoRoot: ctx.root,
-        artifactsDir: ctx.artifactsDir,
-        prompt: params.prompt,
-        allowedCommands: [],
-        stopCondition: params.stopCondition,
-    });
-}
-/**
- * T1 slice 4b: ONE round-trip whose prompt concatenates the rendered specs of
- * several consecutive authoring phases. The worker writes every named artifact
- * top-down (each later phase's inputs are the files it wrote in the earlier
- * sections of the same round-trip), then runs next-step once. The group header
- * overrides the per-section "stop after writing" lines so they are not read as
- * three separate stop points.
- */
-/**
- * The extra section a collapsed member carries, mirroring the gate that would
- * have claimed that phase on its own — so collapsing changes the number of
- * round-trips and nothing else about what the worker is told.
- *
- * This is load-bearing, not tidiness. `collapsedRoundTripGate` is registered
- * BEFORE `scaffoldedPhaseGate`, so without this a group containing
- * `test_validator_plan` would silently drop the S3 skeleton the worker is
- * supposed to fill in, and the collapse would quietly make that phase HARDER
- * rather than cheaper.
- */
-async function collapsedSectionExtra(phase, artifactsDir) {
-    if (phase === "test_validator_plan" || phase === "implementation_planning") {
-        return await buildScaffoldSection(phase, artifactsDir);
-    }
-    return await buildReReviewSection(phase, artifactsDir);
+    else if (raw !== undefined)
+        errors = ["A current tool-issued request is required; a stale response cannot authorize this revision."];
+    await writeJsonFile(rolePaths.request, request);
+    return emit(options, `${bound.text}\n\nWrite the complete bound response to ${rolePaths.submission}.${errors.length ? `\nRefused response:\n${errors.join("\n")}` : ""}`);
 }
-async function writeCollapsedRoundTripStep(ctx, phases) {
-    const sections = await Promise.all(phases.map(async (phase, index) => ({
-        phase,
-        rendered: renderContractPipelinePrompt({
-            role: phase,
-            artifactPaths: ctx.artifactPaths,
-            artifactReadPaths: Object.fromEntries(Object.entries(ctx.artifactReadPaths).filter(([name]) => !phases.slice(0, index).some(earlier => PHASE_TO_ARTIFACT[earlier] === name))),
-            sourcePaths: ctx.sourcePaths,
-            repoRoot: ctx.root,
-            pathASeedPath: ctx.pathASeedPath,
-            adversarialDepth: ctx.adversarialDepth,
-        }),
-        extra: await collapsedSectionExtra(phase, ctx.artifactsDir),
-    })));
-    const outputPaths = sections.map((s) => s.rendered.outputPath);
-    const header = `# Collapsed Authoring Round-Trip — ${phases.length} Phases
-
-This is a low-complexity change, so these ${phases.length} coherent authoring phases are combined into a SINGLE round-trip. Complete EVERY section below — author them top-down, writing each artifact to its named path (each later section's inputs are the files you write in the earlier sections of this same round-trip). Then run next-step ONCE.
-
-Treat any per-section "Stop after you write the output file" / "Do not start the next phase" instruction as scoped to that section only — it does NOT mean stop the round-trip. Finish all sections first.
-
-If you cannot complete a section (an artifact would be malformed), write the ones you can and run next-step: the pipeline re-emits any missing or invalid artifact as its own fine-grained step, so no work is lost.
-
-Artifacts to produce (in order):
-${outputPaths.map((p, i) => `${i + 1}. \`${p}\` (${phases[i]})`).join("\n")}`;
-    const boundSections = await Promise.all(sections.map(async (section) => bindContractReviewPrompt({
-        artifactsDir: ctx.artifactsDir, artifact: PHASE_TO_ARTIFACT[section.phase], role: section.phase,
-        emissionId: ctx.runId, requirement: reviewRequirementForRole(section.phase, ctx.adversarialDepth),
-        prompt: section.extra ? `${section.rendered.prompt}\n${section.extra}` : section.rendered.prompt,
-    })));
-    const body = boundSections.map(prompt => `\n---\n\n${prompt}`).join("\n");
-    return writeContractPromptStep(ctx, {
-        prompt: `${header}\n${body}`,
-        outputPath: outputPaths[outputPaths.length - 1],
-        stopCondition: `Stop after writing all ${phases.length} collapsed artifacts (${phases.join(", ")}) and running next-step once.`,
-    });
-}
-/**
- * The TRANSPORT-failure report for a re-emitted module wave, or `""` on a first
- * dispatch.
- *
- * A shard absent after dispatch is NOT a refusal of the work and NOT a contract
- * the worker got wrong — it is an item that was published and did not come back.
- * The two used to be indistinguishable: the re-emitted wave was byte-identical
- * to the first one, so a host that lost items mid-output saw only "run this
- * wave again", and nothing named the loss. Naming it is what lets a host
- * respond to the right thing (re-deliver the missing items, or report that it
- * cannot run them) instead of re-running a wave whose other shards already
- * exist.
- *
- * The classification is stated in the prompt because that is the channel the
- * host actually reads — the re-emission IS the delivery. It is a RE-EMISSION
- * report, so the absence is derived from the shards on disk, never from a
- * worker's claim that it wrote one.
- */
-function transportReport(absent, total) {
-    // A PARTIAL return is the transport fact. All-absent is not reported, and the
-    // reason is that NOTHING PERSISTED CAN TELL THE TWO APART. Searched, so the
-    // claim is not an assumption: no dispatch marker exists under the artifacts
-    // dir (the wave directory holds only the shards `scanModuleShards` reads, so a
-    // wave emitted-and-lost leaves the same entries as one never emitted); the
-    // rejected-payload archive covers AGGREGATED artifacts, never a shard, so an
-    // unparseable shard is simply absent; `current-step.json` is overwritten by
-    // EVERY emission and is a request, not a receipt — the tool cannot observe
-    // that a host read it; and this writer has no `runLogger` seam at all, so no
-    // emission is recorded in the run log either. Inventing the distinction would
-    // mean guessing, and guessing here fires a transport failure on every ordinary
-    // first emission — a report that is wrong on the normal case is one a host
-    // learns to ignore, which costs more than the distinguishable half is worth.
-    //
-    // So the report is scoped to what it can actually ASSERT: some items came back
-    // and some did not. That case needs no dispatch record, because the returned
-    // shards ARE the record that a wave was published.
-    if (absent.length === 0 || absent.length === total)
-        return "";
-    const list = absent.map((name) => `\`${name}\``).join(", ");
-    return `> **TRANSPORT failure — ${absent.length} of ${total} items did not return.** The previous wave published ${list}, and no valid shard exists for ${absent.length === 1 ? "it" : "them"} on disk. This is a DELIVERY failure, not a refusal: the item was published and did not come back, which says nothing about whether the work is right. Re-deliver ${absent.length === 1 ? "that item" : "those items"} — the other ${total - absent.length} shard(s) are already present and must NOT be re-run. If the host cannot deliver ${absent.length === 1 ? "it" : "them"} independently, say so rather than serializing the whole wave through one context.
-`;
-}
-/**
- * DC-3: fan a parallel phase out to one bounded item per module. The host owns
- * grouping, concurrency, and execution choices; this tool supplies only the
- * complete coherent workload. Each item writes a per-module shard, and the next
- * next-step merges every shard into the aggregated artifact before any
- * downstream derivation. A degenerate decomposition (zero or one module) falls
- * back to the single aggregated step.
- */
-async function writeParallelModuleWaveStep(ctx, phase) {
-    const modules = await readDecomposedModules(ctx.artifactsDir);
-    if (modules.length <= 1) {
-        return writeContractPhaseStep(ctx, phase);
-    }
-    // THE TRANSPORT REPORT. This wave is emitted either as the FIRST dispatch (no
-    // shard on disk yet — an empty missing set) or as a RE-emission after a
-    // previous wave came back with shards absent. The two are different facts and
-    // used to render identically: a host that lost two of nine items mid-output
-    // got the same undiagnosed "run this wave" it got the first time, so the only
-    // thing that ever noticed the loss was a repeat of the same prompt. The set is
-    // read from disk here rather than threaded through the plan, because the plan
-    // is a pure classifier and the shard scan is a filesystem fact.
-    const absent = (await scanModuleShards(ctx.artifactsDir, phase, modules)).missing;
-    const inputArtifact = "module_decomposition";
-    const inputPaths = ["goal_spec", "context_bundle", "module_decomposition"].map((key) => `- \`${ctx.artifactPaths[key]}\` (${key})`);
-    const moduleLines = modules
-        .map((mod, i) => {
-        const shardPath = moduleShardPath(ctx.artifactsDir, phase, mod.name);
-        const scope = mod.file_scope.length > 0
-            ? mod.file_scope.map((p) => `\`${p}\``).join(", ")
-            : "_(no declared file scope)_";
-        return `${i + 1}. **${mod.name}** — file scope: ${scope}\n   - Write this module's contract to exactly: \`${shardPath}\``;
-    })
-        .join("\n");
-    const perModuleSchema = `{
-  "name": "<module-name — must equal the assigned module>",
-  "inputs": ["<what this module receives>"],
-  "outputs": ["<what this module produces>"],
-  "invariants": ["<invariant that must hold — include a verification_obligation note>"],
-  "side_effects": ["<observable side-effects with owner>"],
-  "validation_boundary": "<what this module validates vs. what callers must guarantee>",
-  "failure_modes": ["<ways this module can fail and how callers should handle them>"],
-  "neighbor_needs": [{ "neighbor": "<module-name>", "needs": "<what this module needs>" }]
-}`;
-    const taskVerb = "draft its module contract";
-    const cwdNote = `\n> Set the shell/tool working directory to \`${ctx.root}\` before running any commands.\n`;
-    const nextCommand = loaderCommand("next-step");
-    // THE STEP STATES WHAT IT NEEDS, NOT A MECHANISM. It used to say "dispatch one
-    // sub-agent PER MODULE" — a mechanism the host may not have (in-process
-    // subagents are not universal, and the fallback is a shell-out lane this tool
-    // neither knows nor sizes for). Two of nine such dispatches died mid-output
-    // and only the step's presence check noticed. What the work actually requires
-    // is stated instead: N INDEPENDENT CONTEXTS with no shared authorship. A host
-    // with subagents dispatches N of them; a host without runs the items however
-    // it can, as long as no single context drafts both sides of a seam — which is
-    // the property the seam-reconciliation gate downstream depends on.
-    const prompt = `# Per-Module Contract Drafting (${modules.length} modules)
-
-This phase publishes one bounded item per module. Complete all ${modules.length} items below; the host owns how they are grouped or executed.
-${transportReport(absent, modules.length)}
-
-**What this work needs:** ${modules.length} independent contexts, one per module — no shared authorship. Each module's contract must be drafted by a context that has NOT drafted any module it seams against. That independence is the input the seam reconciliation relies on: a single context drafting both sides of a seam reconciles the seam against itself and reports no mismatch, however mismatched the interfaces are. The host chooses the mechanism; if it has no way to run ${modules.length} independent contexts, say so rather than serializing them through one — a serialized draft is worse than a re-emitted wave, because it produces a wrong aggregate that nothing downstream can detect.
-
-Each item reads only its module's file scope, then writes ONLY that module's contract shard — no item owns both sides of a seam, and no item writes the aggregated artifact.
-${cwdNote}
-## Shared Inputs (every item may read these)
-
-${inputPaths.join("\n")}
-
-## Per-Module Assignments — one independent context each
-
-For each module, an independent context reads its file scope from \`${inputArtifact}\` and ${taskVerb}, writing the result to the module's shard path:
-
-${moduleLines}
-
-Each shard must be a single JSON object of this shape (the orchestrator merges all shards into the aggregated \`${PHASE_TO_ARTIFACT[phase]}\` artifact — do NOT write that file yourself):
-
-\`\`\`json
-${perModuleSchema}
-\`\`\`
-
-## After Every Item Finishes
-
-Once every module's shard above has been written (all ${modules.length}), run:
-
-\`${nextCommand}\`
-
-The orchestrator verifies every module shard is present, merges them into \`${PHASE_TO_ARTIFACT[phase]}\`, and advances. If any shard is missing, this same wave is re-emitted for the missing modules — never a partial aggregate. Do not re-run items whose shard is already present.
-
-**Stop after the per-module shards are written and you run next-step.** Do not edit source files. Do not write the aggregated artifact. Do not advance further.
-`;
-    return writeCurrentStep({
-        stepKind: CONTRACT_STEP_KIND,
-        status: "ready",
-        runId: ctx.runId,
-        repoRoot: ctx.root,
-        artifactsDir: ctx.artifactsDir,
-        prompt,
-        allowedCommands: [nextCommand],
-        stopCondition: `Stop after writing every per-module shard for phase "${phase}" and running next-step.`,
-        artifactPaths: contractStepArtifactPaths(ctx),
-    });
-}
-/**
- * The ONE writer dispatch behind the scaffold's single emission call site. Each
- * underlying writer is reached from exactly here.
- */
-async function writeContractStepPlan(ctx, plan) {
-    switch (plan.via) {
-        case "phase":
-            return await writeContractPhaseStep(ctx, plan.phase, plan.extraSection);
-        case "step":
-            return await writeContractPromptStep(ctx, plan);
-        case "blocked":
-            return await writeContractBlockedStep(ctx, plan);
-        case "module_wave":
-            return await writeParallelModuleWaveStep(ctx, plan.phase);
-        case "collapsed_round_trip":
-            return await writeCollapsedRoundTripStep(ctx, plan.phases);
-        case "rederive":
-            // A deterministic artifact was just written; the frontier moved, so the
-            // whole walk re-runs against the new state rather than guessing the phase.
-            return await buildNextContractPipelineStep(ctx.options);
-        case "pipeline_complete":
-            return null;
-    }
-}
-// ── Branch on `evaluated`: consuming the shared gate-outcome record ─────
-/**
- * Read every contract-pipeline payload from disk, plus the intake
- * finding-enumeration, in the shape the shared cross-gate evaluator consumes.
- * Always a fresh read — there is no payload cache to go stale.
- */
-async function readCrossGateInputs(artifactsDir, root) {
-    const payloads = new Map();
-    for (const name of CP_ARTIFACT_NAMES) {
-        const envelope = await readContractArtifact(artifactsDir, name);
-        if (envelope)
-            payloads.set(name, envelopePayload(envelope));
-    }
-    const findingEnumeration = await readOptionalJsonFile(intakePaths(artifactsDir).findingEnumeration);
-    // Waived counterexamples (open-bugs.md:108): the coverage gates must not
-    // demand DAG nodes for a counterexample the owner recorded as an accepted
-    // limitation — that would recreate the judge-gate wedge one gate later.
-    const repairState = await readRepairState(artifactsDir);
-    return {
-        payloads,
-        findingEnumeration,
-        root,
-        waivedCounterexampleIds: waivedJudgeAcceptedIds(repairState, payloads.get("judge_report"), payloads.get("counterexample")),
-    };
-}
-/**
- * Read every contract-pipeline payload FRESH for the shared cross-gates.
- *
- * REFUSES before this invocation's ingestion + staleness-archive pass has run.
- * EVERY in-pipeline cross-gate read goes through here — including the two
- * exported helpers, which take the payloads this reader produced rather than
- * reading again — so there is no in-pipeline path to a payload that skipped the
- * check.
- * That is the freshness half of The branch-on-evaluated freshness rule, made mechanical: a
- * gate cannot be handed a payload snapshot taken before its own step archived
- * the stale copy, because the only way to obtain payloads declines to produce
- * them until `artifactsSettled` is set.
- */
-async function readCrossGatePayloads(ctx) {
-    if (!ctx.artifactsSettled) {
-        throw new Error("contract pipeline: cross-gate payloads were requested before this invocation's " +
-            "ingestion + staleness-archive pass ran. A gate must read artifact payloads AFTER " +
-            "the archive pass, never from a snapshot taken before it.");
+/** One author/revision loop, with independent review over the executable plan itself. */
+export async function buildNextContractPipelineStep(options) {
+    const source = await ensureSource(options);
+    if (stableStringify(source.intent ?? null) !== stableStringify(await readExecutionIntent(options.artifactsDir) ?? null)) {
+        return emit(options, "The confirmed scope or intent changed after this plan's input was captured. The saved plan and execution evidence are preserved. Restore the agreed checkpoint or explicitly start a new run with the changed scope; the previous review cannot authorize it.", "blocked");
     }
-    return await readCrossGateInputs(ctx.artifactsDir, ctx.root);
-}
-/**
- * Consume a subset of the shared cross-gate outcomes, branching on `evaluated`
- * BEFORE an empty `issues` array is allowed to mean "clean".
- *
- * `required` is DECLARED PER CALL SITE, as data, because "did not run" means
- * different things at different boundaries. At a boundary whose upstream phase
- * order guarantees the gate's input exists, a skip is a refusal — its empty
- * issue list is proof of nothing. Earlier in the pipeline the same skip means
- * "not applicable yet", and the gate is simply not required there.
- *
- * THE UNCOVERED HALF, stated rather than implied: `digest_coverage` is the one
- * gate of the eight whose skip is a DOMAIN non-applicability (a source that is
- * not finding-enumerable) rather than a missing payload, so no boundary lists
- * it as required and a genuinely absent finding-enumeration file for an
- * enumerable source still skips silently. Closing that needs the gate module to
- * expose its enumerability predicate — an edit outside this work item's write
- * scope.
- */
-export function consumeGateOutcomes(outcomes, selected, required) {
-    const violations = [];
-    for (const gate of selected) {
-        const outcome = outcomes.find((candidate) => candidate.gate === gate);
-        if (!outcome) {
-            violations.push(`[${gate}] produced no outcome record; the gate set changed without this call site.`);
-            continue;
+    for (const entry of source.sources) {
+        let actual;
+        try {
+            actual = hashContent(await readFile(entry.path, "utf8"));
         }
-        if (!outcome.evaluated) {
-            if (required.has(gate)) {
-                violations.push(`[${gate}] did not run (${outcome.reason ?? "no reason recorded"}). Its empty ` +
-                    `issue list is not proof of a clean gate at this boundary.`);
+        catch {
+            actual = "missing";
+        }
+        if (actual !== entry.sha256)
+            return emit(options, `The agreed input ${entry.path} changed or disappeared. The current plan is preserved. Restore the agreed source or explicitly start a new run; an old review cannot authorize changed source evidence.`, "blocked");
+    }
+    const state = await readOptionalJsonFile(join(options.artifactsDir, "state.json"));
+    const acceptedUnits = new Map();
+    for (const unit of state?.plan?.units ?? []) {
+        const entry = unit;
+        if (["resolved", "resolved_no_change"].includes(state?.items?.[entry.id]?.status ?? ""))
+            acceptedUnits.set(entry.id, unit);
+    }
+    const ingestion = await ingestExecutionPlan({ ...options, acceptedUnits });
+    const canonical = await readCanonicalPlan(options.artifactsDir);
+    if (ingestion.issues.length || !canonical)
+        return authorStep(options, source, canonical, ingestion.issues.join("\n"));
+    if (await readApprovedExecutionPlan(options.artifactsDir))
+        return options.forceRevision && !ingestion.changed ? authorStep(options, source, canonical, "The operator requested a revised plan. Preserve accepted execution units and add explicit follow-up work where needed.") : null;
+    const contextIssues = await executionPlanContextIssues(options.root, canonical);
+    if (contextIssues.length)
+        return authorStep(options, source, canonical, contextIssues.join("\n"));
+    if (source.request || canonical.plan.source_dispositions.some(entry => entry.status === "deferred")) {
+        const decisionPath = join(executionPlanPaths(options.artifactsDir).directory, "owner-decision.json");
+        const rawDecision = await readOptionalJsonFile(decisionPath);
+        const decision = z.object({ revision_sha256: z.string(), confirmed_by: z.literal("host"), approved_unit_ids: z.array(z.string()), declined_units: z.array(z.object({ id: z.string(), reason: z.string().min(1) }).strict()), deferred_findings: z.array(z.object({ finding_id: z.string(), reason: z.string().min(1) }).strict()).default([]) }).strict().safeParse(rawDecision);
+        const ids = canonical.plan.units.map(unit => unit.id);
+        const covered = decision.success ? [...decision.data.approved_unit_ids, ...decision.data.declined_units.map(unit => unit.id)] : [];
+        if (!decision.success || decision.data.revision_sha256 !== canonical.revision_sha256 || new Set(covered).size !== ids.length || covered.length !== ids.length || covered.some(id => !ids.includes(id)) || canonical.plan.source_dispositions.filter(entry => entry.status === "deferred").some(entry => !decision.data.deferred_findings.some(chosen => chosen.finding_id === entry.finding_id))) {
+            return emit(options, `# Confirm the requested change plan\n\nPresent the concrete execution units, affected boundaries and unresolved choices in ${executionPlanPaths(options.artifactsDir).canonical}. Batch scope/behavior questions now. Preserve the operator's existing intent and permissions; never silently discard requested work. Record the operator's unit choices in ${decisionPath}:\n${JSON.stringify({ revision_sha256: canonical.revision_sha256, confirmed_by: "host", approved_unit_ids: ids, declined_units: [], deferred_findings: canonical.plan.source_dispositions.filter(entry => entry.status === "deferred").map(entry => ({ finding_id: entry.finding_id, reason: entry.reason })) }, null, 2)}\nA declined unit requires {id,reason}. Proposed finding deferrals require explicit operator confirmation in deferred_findings; an author or judge cannot silently opt out of approved work. For an empty plan, explicitly confirm its evidence-backed request disposition. A material plan revision requires a new decision.`, "blocked");
+        }
+    }
+    const pendingRepair = await readPlanReviewHistory(options.artifactsDir);
+    if (pendingRepair.repair_revision === canonical.revision_sha256)
+        return authorStep(options, source, canonical, pendingRepair.repair_reason);
+    for (const role of PLAN_REVIEW_ROLES) {
+        const result = await reviewStep(options, canonical, role);
+        if ("step_kind" in result)
+            return result;
+        if (role === "critique") {
+            const critique = CritiqueSchema.parse(result.result);
+            if (critique.verdict !== "approved" || critique.issues.some(issue => issue.blocking)) {
+                const history = await readPlanReviewHistory(options.artifactsDir);
+                if (history.repair_rounds >= 8)
+                    return repairBoundSpent(options, "Conceptual review", "design issues", critique.issues);
+                await writeJsonFile(executionPlanPaths(options.artifactsDir).history, { ...history, repair_rounds: history.repair_rounds + 1, repair_revision: canonical.revision_sha256, repair_reason: JSON.stringify(critique) });
+                return authorStep(options, source, canonical, JSON.stringify(critique, null, 2));
             }
-            continue;
-        }
-        for (const issue of outcome.issues) {
-            if (issue.severity === "error")
-                violations.push(`[${issue.path}] ${issue.message}`);
-        }
-    }
-    return { ok: violations.length === 0, violations };
-}
-/** Locate one gate's outcome in the canonical-order outcome list. */
-function gateOutcomeOf(outcomes, gate) {
-    return outcomes.find((candidate) => candidate.gate === gate);
-}
-/**
- * The gates the PROMOTION boundary requires to have actually run. Every phase
- * artifact exists by the time `nextPhase` is null, so a skip here can only mean
- * a payload went missing or malformed — never "too early".
- */
-const PROMOTION_REQUIRED_GATES = new Set([
-    "paired_obligations",
-    "evidence_threaded",
-    "reconciliation_derivation",
-]);
-/** The subset of gates the promotion boundary consumes. */
-const PROMOTION_GATES = [
-    "paired_obligations",
-    "evidence_threaded",
-    "digest_coverage",
-    "reconciliation_derivation",
-];
-/**
- * The gates the PRE-CRITIC structural floor requires. `contract_finalization`,
- * `seam_reconciliation` and `test_validator_plan` all precede `critic` in the
- * phase order, so their artifacts exist by the time this boundary is reached.
- */
-const PRE_CRITIC_REQUIRED_GATES = new Set([
-    "paired_obligations",
-    "reconciliation_derivation",
-]);
-// ── Gates, in execution order ─────────────────────────────────────────────────
-/**
- * Seed source-digest binding. Re-hash every source path the path_a seed
- * recorded, against the digest it recorded at seed-build time, and refuse with
- * a classified blocked step on a mismatch — rather than spending the whole
- * design pipeline on content that no longer holds the findings the seed
- * enumerates. Runs first, before anything is ingested or derived.
- *
- * The refusal names the operator's ACCEPT lane: a drift the operator has
- * reviewed and judged not to invalidate the findings is recorded in
- * `seed-source-acceptances.json` and stops blocking. That lane exists because
- * the gate cannot tell a version bump from a behaviour change, and the honest
- * answer to "can the tool tell?" is no — see `SeedSourceAcceptance`.
- */
-const seedSourceDigestGate = async (ctx) => {
-    if (!ctx.pathASeedPath)
-        return null;
-    const seed = await readOptionalJsonFile(ctx.pathASeedPath);
-    const allMismatches = await detectSeedSourceDigestMismatches(ctx.root, seed);
-    if (allMismatches.length === 0)
-        return null;
-    // A digest is a WHOLE-FILE byte binding, so it moves for changes no finding is
-    // about — a release `version` bump in `package.json` moved the digest of every
-    // finding that cited it and blocked the run. The operator's acceptance file is
-    // the way to say "reviewed, and the findings still hold"; anything it does not
-    // cover still blocks. The tool cannot infer this (see `SeedSourceAcceptance`),
-    // so it enforces the record's shape and the join, never the judgment.
-    const { accepted, blocking } = await partitionSeedSourceDrift(ctx.artifactsDir, allMismatches);
-    if (blocking.length === 0)
-        return null;
-    const acceptedLines = accepted
-        .map((entry) => `- \`${entry.path}\` — accepted by ${entry.accepted_by}: ${entry.rationale}`)
-        .join("\n");
-    const lines = blocking
-        .map((mismatch) => `- \`${mismatch.path}\` — recorded \`${mismatch.expected.slice(0, 12)}…\`, ` +
-        `now ${mismatch.actual ? `\`${mismatch.actual.slice(0, 12)}…\`` : "**unreadable**"}`)
-        .join("\n");
-    return {
-        via: "blocked",
-        prompt: `# Source Content Changed Since the Audit Seed Was Built
-
-The path-A seed records a sha256 for every source it was built from. The following no longer match, so the findings this pipeline is designing against may no longer describe the code:
-
-${lines}
-
-The findings this pipeline is designing against were derived from the recorded content, so re-deriving them is the only thing that makes the design sound again. Decide with the user:
-
-1. **Re-run the audit extraction** against the current tree, so the findings describe the code as it now stands; or
-2. **Restore the drifted sources** to the content the audit read, if the change was unintended; or
-3. **Accept the drift**, when the operator has reviewed it and the findings still hold — a release version bump touches no finding the seed enumerates. Write to \`${seedSourceAcceptancesPath(ctx.artifactsDir)}\`:
-
-\`\`\`json
-{
-  "acceptances": [
-    { "path": "<the path above, repo-relative>", "rationale": "<why the findings still hold>", "accepted_by": "<who decided>" }
-  ]
-}
-\`\`\`
-
-The tool does not and cannot infer this: it can see that bytes moved and cannot see whether a finding citing those bytes is still true. Record an acceptance ONLY for a decision the operator actually made — the record names its decider.
-${acceptedLines ? `\nAlready accepted this run (not blocking):\n\n${acceptedLines}\n` : ""}
-Only as an explicit LAST resort — an accepted, recorded decision to design against findings that no longer match the code — delete \`${ctx.pathASeedPath}\` and re-run next-step. That rebuilds the seed from the CURRENT sources while keeping the OLD findings, which clears this alarm without re-deriving anything.`,
-        stopCondition: "Stop — the contract pipeline is blocked on a source whose content no longer matches the audit seed.",
-    };
-};
-/**
- * Ingest raw worker outputs into validated envelopes. An output that fails
- * validation is archived and its producing phase re-emitted with the validation
- * errors — LLM output is untrusted until validated.
- */
-const invalidIngestionGate = async (ctx) => {
-    const ingestion = await ingestContractArtifacts(ctx.artifactsDir, ctx.adversarialDepth);
-    for (const name of ingestion.stale ?? []) {
-        const archived = await archiveContractArtifact(ctx.artifactsDir, name, "stale", ctx.options.renameFn);
-        if (!archived.originalFree) {
-            return { via: "blocked", prompt: `# Stale review context could not be archived\n\nThe inputs to ${name} changed. Its old review cannot be accepted. Unlock or remove the stale submission at \`${contractInputFilePath(ctx.artifactsDir, name)}\` and its canonical artifact, then run next-step.`, stopCondition: "Stop until the stale review artifacts can be archived; never accept the old review." };
         }
-    }
-    // Continue the existing staleness/consistency walk. Re-emitting this downstream
-    // reviewer now would skip upstream repairs and ask it to review invalid inputs.
-    if (ingestion.invalid.length === 0)
-        return null;
-    const first = ingestion.invalid[0];
-    if (first.unavailable) {
-        return { via: "blocked", prompt: `# Required review context unavailable
-
-${formatValidationIssues(first.issues)}
-
-Keep the submitted declaration for diagnosis. When an independent context is available, replace the response at \`${contractInputFilePath(ctx.artifactsDir, first.name)}\` using the current bound prompt, then run \`${loaderCommand("next-step")}\`. Do not substitute self-review or remove the required review.`, stopCondition: "Stop until a review context satisfying the required policy is available." };
-    }
-    const archived = await archiveContractArtifact(ctx.artifactsDir, first.name, "invalid", ctx.options.renameFn);
-    return {
-        via: "phase",
-        phase: ARTIFACT_TO_PHASE[first.name] ?? "goal_normalization",
-        extraSection: `## Validation Errors From the Previous Attempt
-
-The previous \`${first.name}\` output failed validation and was archived. Fix every issue below in the rewritten output:
-
-${formatValidationIssues(first.issues)}
-${rejectionRewriteInstruction(archived)}`,
-    };
-};
-/**
- * Archive stale artifacts so the staleness DAG re-derives everything downstream
- * of a repaired (re-ingested) upstream artifact — and ABORT when an archive
- * fails.
- *
- * COR-114e4941: the returned ArchiveOutcome used to be discarded here, alone
- * among the four archive call sites. `originalFree: false` means the move
- * failed and the stale file is STILL at its canonical path, where
- * `contractArtifactExists` (a bare `existsSync`) reports it as present — so the
- * producing phase was never re-emitted and every downstream derivation (the
- * obligation ledger, the phase cut, the DAG) was built on content the staleness
- * DAG had already declared invalid. Refusing here is the only ordering that
- * keeps that impossible: the frontier is not resolved until every stale
- * artifact is genuinely out of the way.
- */
-const staleArchiveGate = async (ctx) => {
-    const staleness = await detectStaleArtifacts(ctx.artifactsDir);
-    for (const name of staleness.stale) {
-        const archived = await archiveContractArtifact(ctx.artifactsDir, name, "stale", ctx.options.renameFn);
-        if (archived.originalFree)
-            continue;
-        const phase = ARTIFACT_TO_PHASE[name];
-        if (phase) {
-            return {
-                via: "phase",
-                phase,
-                extraSection: `## A Stale \`${name}\` Could Not Be Archived
-
-\`${name}\` is stale (an upstream it depends on changed) but the tool could not move it into the contract history directory, so the stale content is still at its canonical path. The pipeline will not derive anything downstream of it.
-
-Rewrite \`${name}\` from its current upstreams.
-${rejectionRewriteInstruction(archived)}`,
-            };
-        }
-        return {
-            via: "blocked",
-            prompt: `# A Stale Derived Artifact Could Not Be Archived
-
-\`${name}\` is stale but could not be moved into the contract history directory, and it is tool-derived — no authoring phase owns it, so it cannot simply be re-emitted.
-
-Remove or unlock \`${contractArtifactFilePath(ctx.artifactsDir, name)}\` (and its \`.input.json\` sibling if present), then re-run next-step so the pipeline re-derives it from the current upstreams. Proceeding on the stale copy would build the obligation ledger, phase cut and implementation DAG on content the staleness DAG has already declared invalid.`,
-            stopCondition: "Stop — the contract pipeline is blocked on a stale artifact that could not be archived.",
-        };
-    }
-    // OBL-m-friction-inv-5 (post_repair_rederive): when a judge needs_repair →
-    // regenerate-target landed, the re-ingested target makes its downstream
-    // artifacts stale and they are archived above — the REAL remediate
-    // post-repair re-derive site. Route this backend-observed step-boundary fact
-    // through the single CE-005 chokepoint. Discriminator = repair target
-    // artifact id + repair iteration count, so re-recording the same re-derive is
-    // a collision-free no-op (CE-006).
-    if (staleness.stale.length > 0) {
-        const repairState = await readRepairState(ctx.artifactsDir);
-        const lastRepair = repairState.repairs[repairState.repairs.length - 1];
-        if (lastRepair) {
-            const iteration = repairState.repairs.length;
-            await captureStepBoundaryFriction(ctx.artifactsDir, ctx.runId, {
-                eventType: "post_repair_rederive",
-                discriminator: `${lastRepair.target}:${iteration}`,
-                note: `Post-repair re-derive: repair iteration ${iteration} of "${lastRepair.target}" ` +
-                    `made ${staleness.stale.length} downstream artifact(s) stale; they were archived so ` +
-                    `the staleness DAG re-derives the back half.`,
-                category: "trap",
-            }, "remediate-code");
-        }
-    }
-    // Ingestion + archiving are done: payloads read from here on are this
-    // invocation's own view. Nothing downstream may read them before this point.
-    ctx.artifactsSettled = true;
-    return null;
-};
-/**
- * Resolve the phase frontier — the one gate that never emits. It sits HERE, and
- * not at the top, because archiving a stale artifact re-opens its producing
- * phase: computing the frontier before the archive pass would read a phase as
- * satisfied by a file the pipeline has just declared invalid.
- */
-const phaseFrontierGate = (ctx) => {
-    ctx.nextPhase = nextMissingContractPhase(ctx.artifactsDir);
-    return null;
-};
-/**
- * Goal-ID consistency (ARC-86b18f1b): every persisted artifact that carries a
- * goal_id must agree on the same value. A mismatch means two runs were
- * interleaved; re-emit the earliest mismatched phase so the worker can correct
- * it. Deliberately phase-independent.
- */
-const goalIdConsistencyGate = async (ctx) => {
-    const goalIdArtifacts = {};
-    for (const name of CP_ARTIFACT_NAMES) {
-        const envelope = await readContractArtifact(ctx.artifactsDir, name);
-        if (envelope)
-            goalIdArtifacts[name] = envelopePayload(envelope);
-    }
-    const goalIdErrors = validateGoalIdConsistency(goalIdArtifacts).filter((issue) => issue.severity === "error");
-    if (goalIdErrors.length === 0)
-        return null;
-    // issue.path is "<artifact_name>.goal_id"; extract the artifact name.
-    const firstPath = goalIdErrors[0]?.path ?? "";
-    const mismatchedArtifact = firstPath.replace(/\.goal_id$/, "");
-    const archived = await archiveContractArtifact(ctx.artifactsDir, mismatchedArtifact, "invalid", ctx.options.renameFn);
-    return {
-        via: "phase",
-        phase: ARTIFACT_TO_PHASE[mismatchedArtifact] ?? "goal_normalization",
-        extraSection: `## Goal-ID Consistency Error
-
-Every contract-pipeline artifact must share the same goal_id. The following mismatch was detected:
-
-${goalIdErrors.map((issue) => `- [${issue.path}] ${issue.message}`).join("\n")}
-
-Rewrite the output so its goal_id matches the goal_id established in goal_spec.json.
-${rejectionRewriteInstruction(archived)}`,
-    };
-};
-/**
- * Finalized-module-SET gate (INV-CO-13). `deriveFinalizedModuleContracts` maps
- * the drafts 1:1, so the deterministic path can never violate this — but it is
- * not the only writer: a judge or critique repair re-emits contract_finalization
- * as an LLM step, ingested under a SHAPE-ONLY validator that structurally cannot
- * see the drafts. A rewrite that merges modules under an invented name and drops
- * another would otherwise be accepted, and the phase cut, the derived obligation
- * ids and the DAG write-scope join would all then be built on a module set that
- * has already lost a module.
- *
- * DELIBERATELY PHASE-INDEPENDENT, like the goal-ID gate: rewriting
- * finalized_module_contracts stales its declared dependent
- * conceptual_design_critique, which the staleness gate archives BEFORE the
- * frontier is resolved — so the phase right after a corrupting rewrite is
- * `critique`, not `critic`. Gating at the critic boundary would not fire until
- * critique, obligation_ledger, cyclic_seam_resolution, test_validator_plan and
- * assessment had all been re-spent on the collapsed set.
- *
- * The gate is NOT in `PRE_CRITIC_REQUIRED_GATES` / `PROMOTION_REQUIRED_GATES`
- * because at this phase-independent position a not-evaluated outcome genuinely
- * means "the drafted or finalized contracts do not exist yet" — the branch on
- * `evaluated` is taken, and its declared meaning here is "not yet applicable".
- */
-const finalizedModuleSetGate = async (ctx) => {
-    const outcomes = await evaluateContractPipelineCrossGateOutcomes(await readCrossGatePayloads(ctx));
-    const outcome = gateOutcomeOf(outcomes, "finalized_module_set_preserved");
-    if (!outcome?.evaluated)
-        return null;
-    const moduleSetErrors = outcome.issues.filter((issue) => issue.severity === "error");
-    if (moduleSetErrors.length === 0)
-        return null;
-    const archived = await archiveContractArtifact(ctx.artifactsDir, "finalized_module_contracts", "invalid", ctx.options.renameFn);
-    return {
-        via: "phase",
-        phase: "contract_finalization",
-        extraSection: `## Finalized Module Set Does Not Match the Drafted Contracts
-
-Finalization carries every drafted module contract through — it may incorporate seam-reconciliation decisions into a module's interface, but it may never drop, merge, rename, or invent a module. The following mismatches were detected:
-
-${moduleSetErrors.map((issue) => `- [${issue.path}] ${issue.message}`).join("\n")}
-${rejectionRewriteInstruction(archived)}`,
-    };
-};
-/**
- * Path-A overlap topology gate. A required audit seam is not advisory:
- * decomposition must name exactly one seam-preparation module and keep distinct
- * implementation modules for the participating work blocks. Checked before
- * module contracts fan out, so the seam is shaped once and downstream authors
- * can work in parallel against it.
- */
-const workBlockSeamGate = async (ctx) => {
-    if (!contractArtifactExists(ctx.artifactsDir, "module_decomposition"))
-        return null;
-    const seed = await readOptionalJsonFile(pathASeedFilePath(ctx.artifactsDir));
-    if (!seed)
-        return null;
-    const decomposition = envelopePayload(await readContractArtifact(ctx.artifactsDir, "module_decomposition"));
-    const seamIssues = validateWorkBlockSeamPreparation(seed, decomposition).filter((issue) => issue.severity === "error");
-    if (seamIssues.length === 0)
-        return null;
-    const archived = await archiveContractArtifact(ctx.artifactsDir, "module_decomposition", "invalid", ctx.options.renameFn);
-    return {
-        via: "phase",
-        phase: "decomposition",
-        extraSection: `## Audit Work-Block Seam Errors
-
-The module decomposition dropped or blurred required audit work-block seams. Fix every issue below. Keep implementation work blocks distinct, add exactly one seam-preparation module per required seam (one module may prepare several seams), and list the corresponding source_work_block_ids / prepares_seam_ids:
-
-${seamIssues.map((issue) => `- [${issue.path}] ${issue.message}`).join("\n")}
-${rejectionRewriteInstruction(archived)}`,
-    };
-};
-/**
- * Conceptual-design-critique gate (A1). Once the critique exists, a blocking
- * concern routes a design repair BEFORE any downstream artifact is derived. The
- * signal is mechanical (any blocking item), so the author's verdict label can't
- * wave a blocking concern through. Convergence-terminated: repairing the
- * finalized contracts re-stales + re-emits the critique, a clean re-critique
- * proceeds, a stalled loop escalates to the user.
- */
-const conceptualCritiqueGate = async (ctx) => {
-    if (!contractArtifactExists(ctx.artifactsDir, "conceptual_design_critique"))
-        return null;
-    const gate = await evaluateCritiqueGate(ctx.artifactsDir);
-    if (gate.kind === "repair") {
-        const repairState = await readRepairState(ctx.artifactsDir);
-        const critiqueRepairs = repairState.critique_repairs ?? [];
-        if (!critiqueRepairs.some((repair) => repair.critique_hash === gate.critiqueHash)) {
-            critiqueRepairs.push({
-                critique_hash: gate.critiqueHash,
-                target: gate.target,
-                at: new Date().toISOString(),
-                blocking_ids: gate.blockingIds,
-            });
-            repairState.critique_repairs = critiqueRepairs;
-            await writeRepairState(ctx.artifactsDir, repairState);
-        }
-        const rendered = renderContractRepairPrompt({
-            trigger: "critique",
-            target: gate.target,
-            instruction: "Revise the design to resolve every BLOCKING concern in the conceptual design critique " +
-                `(${gate.blockingIds.join(", ")}). Read conceptual_design_critique.json for each concern's ` +
-                `description, then apply targeted edits to ${gate.target} so the blocking concerns no longer apply.`,
-            artifactPaths: ctx.artifactPaths,
-            artifactReadPaths: ctx.artifactReadPaths,
-            repoRoot: ctx.root,
-        });
-        return {
-            via: "step",
-            prompt: rendered.prompt,
-            outputPath: rendered.outputPath,
-            stopCondition: `Stop after repairing ${gate.target} to resolve the blocking critique concerns and running next-step.`,
-        };
-    }
-    if (gate.kind === "escalate") {
-        await captureStepBoundaryFriction(ctx.artifactsDir, ctx.runId, {
-            eventType: "repair_round",
-            discriminator: `critique_nonconvergence:${gate.reason}`,
-            note: `Conceptual-design critique↔repair loop escalated (${gate.reason}): ${gate.note}`,
-            category: "trap",
-        }, "remediate-code");
-        return {
-            via: "blocked",
-            prompt: `# Conceptual-Design Critique Did Not Converge
-
-${gate.note}
-
-## Outstanding blocking concerns
-
-${gate.blocking.map((id) => `- ${id}`).join("\n")}
-
-Read conceptual_design_critique.json, decide with the user how to resolve each blocking concern (revise the contract design and re-run, or downgrade it to advisory), then re-run next-step.`,
-            stopCondition: "Stop — the contract pipeline is blocked on a non-converging conceptual-design critique pending a user decision.",
-        };
-    }
-    return null;
-};
-/**
- * Deterministic obligation-ledger derivation (S1). The ledger is a pure function
- * of the finalized module contracts (every invariant/failure mode/module → an
- * obligation), so the tool generates it rather than an LLM phase: the structure
- * can never be malformed, no judgment is spent on a mechanical restructuring,
- * and a weak model is never asked to emit it from scratch.
- */
-const obligationLedgerDerivationGate = async (ctx) => {
-    if (ctx.nextPhase !== "obligation_ledger")
-        return null;
-    const finalizedPayload = envelopePayload(await readContractArtifact(ctx.artifactsDir, "finalized_module_contracts"));
-    await writeDerivedContractArtifact(ctx.artifactsDir, "obligation_ledger", deriveObligationLedger(finalizedPayload));
-    return { via: "rederive" };
-};
-/**
- * Degenerate seam_reconciliation collapse. A single-module decomposition has NO
- * inter-module seams, so seam_reconciliation is a structural no-op: write an
- * empty seam report deterministically (no host round-trip). The empty report
- * makes validateReconciliationDerivation pass vacuously. A multi-module
- * decomposition falls through to the LLM seam_reconciliation step (which
- * mismatches exist is a judgment call).
- */
-const degenerateSeamReconciliationGate = async (ctx) => {
-    if (ctx.nextPhase !== "seam_reconciliation")
-        return null;
-    const modules = await readDecomposedModules(ctx.artifactsDir);
-    if (modules.length > 1)
-        return null;
-    const drafted = envelopePayload(await readContractArtifact(ctx.artifactsDir, "module_contracts"));
-    const goalId = isRecord(drafted) && typeof drafted.goal_id === "string" ? drafted.goal_id : "";
-    await writeDerivedContractArtifact(ctx.artifactsDir, "seam_reconciliation_report", {
-        contract_version: "remediate-code-contract-pipeline/seam-reconciliation-report/v1alpha1",
-        goal_id: goalId,
-        mismatches: [],
-        created_at: new Date().toISOString(),
-    });
-    return { via: "rederive" };
-};
-/** Render the cycle section for the LLM finalization step: every declared-graph
- *  cycle, its members, and the exact artifact tokens forming each edge. */
-function renderTokenCycleSection(cycles) {
-    const parts = cycles.map((cycle, i) => {
-        const edges = cycle.edges
-            .map((e) => `- \`${e.consumer}\` depends on \`${e.producer}\` via \`artifact:${e.artifact}\` ` +
-            `(${e.consumer} consumes it; ${e.producer} produces it)`)
-            .join("\n");
-        return `### Cycle ${i + 1}: [${cycle.members.join(", ")}]\n\n${edges}`;
-    });
-    return `## Cyclic Artifact-Token Dependencies — Resolve These In Your Output
-
-The drafted contracts declare a CYCLIC artifact-token flow. Implementation ordering derives from
-producer/consumer \`artifact:<name>\` tokens ALONE, so the declared flow must be acyclic — a cycle
-cannot be phased, and the finalized contracts are REJECTED at validation while one remains.
-
-${parts.join("\n\n")}
-
-Rewrite the finalized \`inputs\`/\`outputs\` so one direction owns each flow: move an artifact token
-to the module that genuinely produces it, split a shared primitive into an earlier module's output,
-or drop a token that does not describe a real data handoff. Keep the module SET unchanged — do not
-add, drop, rename, or merge modules.`;
-}
-/**
- * Deterministic contract_finalization (all module counts). Finalization is a
- * mechanical merge, not fresh authoring: carry each drafted module contract's
- * interface fields verbatim (dropping neighbor_needs — ordering derives from
- * the artifact-token graph alone, open-bugs.md:106) and attach
- * the agreed_interface of every seam that touches the module as a
- * seam_adjustment. The judgment already happened at seam_reconciliation.
- * Attaching each agreed interface verbatim guarantees the INV-CO-12
- * reconciliation-derivation gate passes. A downstream gate that still finds the
- * merge inadequate re-emits contract_finalization as an LLM step — the only path
- * that still needs judgment. A CYCLIC declared token graph takes that LLM path
- * up front: the mechanical merge would carry the cycle verbatim into an
- * artifact validation refuses, so the gate emits the finalization step with the
- * cycle named instead of deriving.
- */
-const contractFinalizationDerivationGate = async (ctx) => {
-    if (ctx.nextPhase !== "contract_finalization")
-        return null;
-    const drafted = envelopePayload(await readContractArtifact(ctx.artifactsDir, "module_contracts"));
-    const cycles = detectContractTokenCycles(drafted);
-    if (cycles.length > 0) {
-        return {
-            via: "phase",
-            phase: "contract_finalization",
-            extraSection: renderTokenCycleSection(cycles),
-        };
-    }
-    const seamReport = envelopePayload(await readContractArtifact(ctx.artifactsDir, "seam_reconciliation_report"));
-    await writeDerivedContractArtifact(ctx.artifactsDir, "finalized_module_contracts", deriveFinalizedModuleContracts(drafted, seamReport));
-    return { via: "rederive" };
-};
-/**
- * Judge gate: implementation planning is reachable only through an approved
- * verdict (the fixpoint) or a convergent targeted repair. A stalled /
- * non-converging repair loop escalates to the user (blocked) instead of silently
- * proceeding with residual risk.
- */
-const judgeRepairGate = async (ctx) => {
-    if (ctx.nextPhase !== "implementation_planning")
-        return null;
-    const gate = await evaluateJudgeGate(ctx.artifactsDir);
-    if (gate.kind === "repair") {
-        const repairTarget = gate.directive.target;
-        const repairState = await readRepairState(ctx.artifactsDir);
-        if (!repairState.repairs.some((repair) => repair.judge_hash === gate.judgeHash)) {
-            repairState.repairs.push({
-                judge_hash: gate.judgeHash,
-                target: repairTarget,
-                at: new Date().toISOString(),
-                accepted_ce_ids: gate.acceptedCeIds,
-                addressed_ce_fingerprints: gate.addressedCeFingerprints,
-            });
-            await writeRepairState(ctx.artifactsDir, repairState);
-        }
-        const rendered = renderContractRepairPrompt({
-            trigger: "judge",
-            target: repairTarget,
-            instruction: gate.directive.instruction,
-            artifactPaths: ctx.artifactPaths,
-            artifactReadPaths: ctx.artifactReadPaths,
-            repoRoot: ctx.root,
-        });
-        return {
-            via: "step",
-            prompt: rendered.prompt,
-            outputPath: rendered.outputPath,
-            stopCondition: `Stop after rewriting "${repairTarget}" per the judge repair directive and running next-step.`,
-        };
-    }
-    if (gate.kind === "escalate") {
-        // Non-convergence (stall or runaway backstop): surface it to the user loudly
-        // rather than promoting a plan over an un-converged contract. The
-        // outstanding accepted counterexamples are named so the user can resolve
-        // them (revise the contract design or accept them as known limitations).
-        await captureStepBoundaryFriction(ctx.artifactsDir, ctx.runId, {
-            eventType: "repair_round",
-            discriminator: `judge_nonconvergence:${gate.reason}`,
-            note: `Judge↔repair loop escalated (${gate.reason}): ${gate.note}`,
-            category: "trap",
-        }, "remediate-code");
-        const waiversPath = counterexampleWaiversPath(ctx.artifactsDir);
-        const waiverIssuesSection = gate.waiverIssues && gate.waiverIssues.length > 0
-            ? `\n\n## Waiver file refused — fix these first\n\n${gate.waiverIssues
-                .map((issue) => `- ${issue}`)
-                .join("\n")}`
-            : "";
-        const heading = gate.reason === "invalid_waivers"
-            ? "# The Counterexample Waiver File Was Refused"
-            : "# Judge↔Repair Loop Did Not Converge";
-        return {
-            via: "blocked",
-            prompt: `${heading}
-
-${gate.note}${waiverIssuesSection}
-
-## Outstanding accepted counterexamples (unwaived)
-
-${gate.outstanding.length > 0
-                ? gate.outstanding.map((id) => `- ${id}`).join("\n")
-                : "_(none newly accepted this round)_"}
-
-## Record an owner waiver (the recorded resolution verb)
-
-To accept an outstanding counterexample as a KNOWN LIMITATION of this run, write the operator's decision to:
-
-\`${waiversPath}\`
-
-\`\`\`json
-{
-  "waivers": [
-    { "ce_id": "<id from the list above>", "rationale": "<why this is acceptable>", "waived_by": "<who decided>" }
-  ]
-}
-\`\`\`
-
-The next next-step validates the file, records each waiver in repair-state.json (attributable, content-fingerprint-keyed), consumes the file, and proceeds once every outstanding counterexample is repaired or waived. Record a waiver ONLY for a decision the operator actually made — the record names its decider.
-
-Read the judge_report and counterexample artifacts, decide with the user how to resolve each outstanding counterexample (revise the contract design and re-run, or record a waiver as above), then re-run next-step.`,
-            stopCondition: "Stop — the contract pipeline is blocked on a non-converging judge↔repair loop pending a user decision.",
-        };
-    }
-    return null;
-};
-/** Bounded re-emit of implementation_planning, then blocked — the shared shape
- *  of the four promotion rejections (integrity, traceability, obligation gates,
- *  citation grounding). Single-sourced so the four cannot drift into four
- *  different recovery contracts. */
-async function dagRegenerationPlan(ctx, params) {
-    const repairState = await readRepairState(ctx.artifactsDir);
-    if (repairState.dag_regenerations.length >= MAX_DAG_REGENERATION_ATTEMPTS) {
-        return {
-            via: "blocked",
-            prompt: `# ${params.heading} ${repairState.dag_regenerations.length + 1} Times
-
-${params.blockedBody}
-
-${params.violations.map((violation) => `- ${violation}`).join("\n")}
-`,
-            stopCondition: `Stop after reporting the failure to the user.`,
-        };
-    }
-    repairState.dag_regenerations.push({
-        violations: params.violations,
-        at: new Date().toISOString(),
-    });
-    await writeRepairState(ctx.artifactsDir, repairState);
-    const archived = await archiveContractArtifact(ctx.artifactsDir, "implementation_dag", "invalid", ctx.options.renameFn);
-    return {
-        via: "phase",
-        phase: "implementation_planning",
-        extraSection: `${params.reEmitBody}
-
-${params.violations.map((violation) => `- ${violation}`).join("\n")}
-${rejectionRewriteInstruction(archived)}`,
-    };
-}
-/**
- * All phases exist: enforce referential integrity, traceability, the
- * fail-closed contract-obligation gates, and the Path-A canonical-block join,
- * then convert the implementation_dag into an extracted plan and ground its citations.
- */
-const implementationPlanPromotionGate = async (ctx) => {
-    if (ctx.nextPhase)
-        return null;
-    // Path-A canonical-block membership (inv-2), FIRST in this walk so a late
-    // source_finding_ids violation fails before any other gate executes instead
-    // of throwing out of the promoter below and wedging every subsequent
-    // next-step (COR-114e4941). Same bounded re-emit as every other promotion
-    // rejection; no gate has executed past it.
-    const pathARefusals = await collectPathARefusals(ctx.artifactsDir);
-    if (pathARefusals.length > 0) {
-        return await dagRegenerationPlan(ctx, {
-            heading: "Path-A Canonical Block Join Failed",
-            blockedBody: "The implementation_dag repeatedly declares source_finding_ids that cannot be joined to a canonical audit work block:",
-            reEmitBody: `## Path-A Canonical Block Errors From the Previous Attempt
-
-Each node's source_finding_ids must name exactly one canonical audit work block, and together the nodes must cover every block exactly once. Fix every entry below:`,
-            violations: pathARefusals,
-        });
-    }
-    // ONE payload read for the whole promotion boundary, shared by the integrity
-    // gate and the contract-obligation gates below. Both consume the SAME
-    // post-archive payloads, and nothing between these two consumers writes an
-    // artifact — so a second read bought no freshness and re-paid the whole
-    // read-and-parse of every contract-pipeline artifact (plus the repair-state
-    // and finding-enumeration reads it carries), on the path every plan promotion
-    // walks. The freshness RULE is unchanged and still enforced: the read below is
-    // `readCrossGatePayloads`, which refuses before this invocation's ingestion +
-    // staleness-archive pass, so neither consumer can be handed a pre-archive
-    // snapshot.
-    const crossGatePayloads = await readCrossGatePayloads(ctx);
-    // DAG referential integrity + bidirectional coverage (ARC-86b18f1b-2), run
-    // before the traceability check so specific referential violations are
-    // reported first (traceability is a superset check).
-    const outcomes = await evaluateContractPipelineCrossGateOutcomes(crossGatePayloads);
-    const integrity = gateOutcomeOf(outcomes, "implementation_dag_integrity");
-    if (!integrity?.evaluated) {
-        return await dagRegenerationPlan(ctx, {
-            heading: "Implementation DAG Could Not Be Checked",
-            blockedBody: "The implementation_dag integrity gate could not run, so its empty issue list proves nothing:",
-            reEmitBody: `## The Implementation DAG Could Not Be Checked
-
-The referential-integrity gate could not run against the previous output, so it was never shown to be sound. Rewrite a complete implementation_dag:`,
-            violations: [integrity?.reason ?? "no outcome record was produced for the gate"],
-        });
-    }
-    const integrityErrors = integrity.issues.filter((issue) => issue.severity === "error");
-    if (integrityErrors.length > 0) {
-        return await dagRegenerationPlan(ctx, {
-            heading: "Implementation DAG Failed Referential Integrity",
-            blockedBody: "The implementation_dag repeatedly contains referential integrity or coverage violations:",
-            reEmitBody: `## Referential Integrity Errors From the Previous Attempt
-
-The previous implementation_dag was rejected and archived due to referential integrity violations. Fix every issue below:`,
-            violations: integrityErrors.map((issue) => `[${issue.path}] ${issue.message}`),
-        });
-    }
-    const traceability = await validateImplementationDagTraceability(ctx.artifactsDir);
-    if (!traceability.ok) {
-        return await dagRegenerationPlan(ctx, {
-            heading: "Implementation DAG Failed Traceability",
-            blockedBody: "The implementation_dag repeatedly contains nodes that trace to no obligation and no judge-accepted counterexample:",
-            reEmitBody: `## Traceability Errors From the Previous Attempt
-
-The previous implementation_dag was rejected and archived. Every node must trace to at least one obligation from the obligation ledger or one judge-accepted counterexample:`,
-            violations: traceability.violations,
-        });
-    }
-    // Contract-obligations promotion gates: fail-closed cross-artifact checks that
-    // must pass before a plan is promoted. These are the invariants that keep the
-    // workflow correct regardless of host strength, so they are enforced here,
-    // never left to host discretion.
-    const obligationGate = await evaluateContractObligationsPromotionGate(ctx.artifactsDir, ctx.root, crossGatePayloads);
-    if (!obligationGate.ok) {
-        return await dagRegenerationPlan(ctx, {
-            heading: "Contract-Obligation Gates Failed",
-            blockedBody: "The contract-obligation promotion gates repeatedly failed and the plan cannot be promoted:",
-            reEmitBody: `## Contract-Obligation Gate Errors From the Previous Attempt
-
-The previous implementation_dag (and/or upstream contract artifacts) failed the fail-closed contract-obligation gates. Fix every issue below before the plan can be promoted:`,
-            violations: obligationGate.violations,
-        });
-    }
-    // Write-scope + command SHAPE, before anything is promoted. These refusals
-    // used to throw out of the promoter — an unclassified stack that wedged every
-    // subsequent next-step, reachable from an LLM form as ordinary as a
-    // leading-slash "repo-relative" path. They take the same bounded re-emit as
-    // every other promotion rejection now.
-    const scopeRefusals = await collectDagWriteScopeRefusals(ctx.artifactsDir, ctx.root);
-    if (scopeRefusals.length > 0) {
-        return await dagRegenerationPlan(ctx, {
-            heading: "Block Write Scope Failed",
-            blockedBody: "The implementation_dag repeatedly declares a write scope or targeted command the plan cannot carry:",
-            reEmitBody: `## Write-Scope and Command Errors From the Previous Attempt
-
-Each node's declared write scope becomes the block \`touched_files\` a host binds an implementer to and re-checks against the landed diff, and each targeted command is executed verbatim through a shell. Fix every entry below:`,
-            violations: scopeRefusals,
-        });
-    }
-    await promoteImplementationDagToExtractedPlan(ctx.artifactsDir, ctx.root);
-    // M-B3 source-grounded citation gate (promotion backstop): ground every
-    // promoted extracted-plan finding's citations against the working tree.
-    const citationGate = await evaluatePromotedPlanCitationGrounding(ctx.artifactsDir, ctx.root);
-    if (citationGate) {
-        // The plan was promoted to extracted-plan.json BEFORE this gate ran, so the
-        // ungrounded marker is now on disk. Remove it before any return — otherwise
-        // a subsequent next-step reads the promoted plan and hands it straight to
-        // handlePendingExtractedPlan, bypassing the re-emit and completing the
-        // pipeline on hallucinated citations.
-        await rm(ctx.paths.extractedPlan, { force: true });
-        // The grounding-driven re-emit is a backend-observed step-boundary fact:
-        // route it through the single CE-005 chokepoint as phase_reemit.
-        await captureStepBoundaryFriction(ctx.artifactsDir, ctx.runId, {
-            eventType: "phase_reemit",
-            discriminator: "implementation_planning:citation_grounding:promotion",
-            note: "implementation_planning re-emitted: a promoted plan finding cited a " +
-                "component that does not exist in the working tree (M-B3 citation grounding).",
-            category: "trap",
-        }, "remediate-code");
-        return await dagRegenerationPlan(ctx, {
-            heading: "Citation Grounding Failed",
-            blockedBody: "The promoted plan repeatedly cites components that do not exist in the working tree:",
-            reEmitBody: `## Source-Grounded Citation Gate Errors From the Previous Attempt
-
-The previous implementation_dag produced findings that cite components not present in the working tree. Every cited path or symbol must point at something real:`,
-            violations: citationGate.violations,
-        });
-    }
-    // Normalized block write scope, tracked-tree half. Runs AFTER the
-    // citation gate because the two overlap but neither contains the other: a
-    // finding grounds on any real path OR symbol, so a node with plausible prose
-    // can ground while the write scope a host would bind a worker to is still
-    // fabricated. Same bounded recovery, same plan removal.
-    const writeScopeGate = await evaluatePromotedPlanWriteScope(ctx.artifactsDir, ctx.root);
-    if (writeScopeGate) {
-        await rm(ctx.paths.extractedPlan, { force: true });
-        return await dagRegenerationPlan(ctx, {
-            heading: "Block Write Scope Failed",
-            blockedBody: "The promoted plan repeatedly declares a block write scope that does not exist in the working tree:",
-            reEmitBody: `## Block Write-Scope Errors From the Previous Attempt
-
-Each node's declared write scope becomes the block \`touched_files\` a host binds an implementer to and re-checks against the landed diff. The following entries name a directory that does not exist:`,
-            violations: writeScopeGate.violations,
-        });
-    }
-    return { via: "pipeline_complete" };
-};
-/** Render the detected cycles for a prompt. */
-function renderCycleDescriptions(cycles) {
-    return cycles
-        .map((cycle, index) => `Cycle ${index + 1}: [${cycle.members.join(", ")}]`)
-        .join("\n");
-}
-/** Build the seam-obligation graph from the obligation ledger AS IT STANDS NOW. */
-async function readSeamObligationGraph(artifactsDir) {
-    const envelope = await readContractArtifact(artifactsDir, "obligation_ledger");
-    const ledger = envelopePayload(envelope);
-    const obligationIds = new Set((ledger?.obligations ?? []).map((o) => o.id));
-    return {
-        nodes: (ledger?.obligations ?? []).map((obligation) => ({
-            id: obligation.id,
-            needs: (obligation.depends_on ?? []).filter((dep) => obligationIds.has(dep)),
-        })),
-        goalId: ledger?.goal_id ?? "",
-        ledgerHash: envelope?.content_hash ?? "unknown",
-    };
-}
-/**
- * Cyclic-seam resolution gate: runs after obligation_ledger is present and
- * before assessment. Detects circular interface-definition obligations, then
- * routes to an LLM resolution step when cycles are found. Cap:
- * MAX_CYCLIC_SEAM_RESOLUTION_ATTEMPTS; on exhaustion, route to a user-decision
- * step (then blocked if still unresolved).
- */
-const cyclicSeamResolutionGate = async (ctx) => {
-    if (ctx.nextPhase !== "cyclic_seam_resolution")
-        return null;
-    const graph = await readSeamObligationGraph(ctx.artifactsDir);
-    const detectedCycles = detectCyclicSeamObligations(graph.nodes);
-    if (detectedCycles.length === 0) {
-        await writeDerivedContractArtifact(ctx.artifactsDir, "cyclic_seam_resolution", {
-            contract_version: "remediate-code-contract-pipeline/cyclic-seam-resolution/v1alpha1",
-            goal_id: graph.goalId,
-            cycles: [],
-            status: "no_cycles",
-            created_at: new Date().toISOString(),
-        });
-        return { via: "rederive" };
-    }
-    const repairState = await readCyclicSeamRepairState(ctx.artifactsDir);
-    const attemptsForLedger = repairState.attempts.filter((attempt) => attempt.ledger_hash === graph.ledgerHash);
-    // Guard: the artifact exists and is already marked resolved/no_cycles. This
-    // branch should not normally be reached (the artifact exists, so the frontier
-    // skips it), but re-deriving is the safe answer.
-    const existingResolution = envelopePayload(await readContractArtifact(ctx.artifactsDir, "cyclic_seam_resolution"));
-    if (existingResolution &&
-        (existingResolution.status === "resolved" ||
-            existingResolution.status === "no_cycles")) {
-        return { via: "rederive" };
-    }
-    const cycleDescriptions = renderCycleDescriptions(detectedCycles);
-    if (attemptsForLedger.length >= MAX_CYCLIC_SEAM_RESOLUTION_ATTEMPTS) {
-        if (!repairState.user_decision_emitted) {
-            repairState.user_decision_emitted = true;
-            await writeCyclicSeamRepairState(ctx.artifactsDir, repairState);
-            return {
-                via: "blocked",
-                prompt: `# Cyclic Seam Resolution — User Decision Required
-
-The automatic cycle-break resolution reached its cap (${MAX_CYCLIC_SEAM_RESOLUTION_ATTEMPTS} attempt(s)) without producing a valid cycle-free obligation graph. The following obligation cycles remain unresolved:
-
-${cycleDescriptions}
-
-**Choose one of the two sanctioned break strategies per cycle:**
-
-1. **Mediator module** — Introduce a third obligation/module that both sides depend on. The mediator owns the shared primitive; neither original module defines an interface for the other.
-2. **Single authority** — Designate one obligation/module as the definitive owner of the co-defined interface. The other becomes a consumer only. This is recorded as a named, scoped exception.
-
-To proceed, manually rewrite \`${contractInputFilePath(ctx.artifactsDir, "obligation_ledger")}\` so that no circular \`depends_on\` references exist, then delete \`${contractInputFilePath(ctx.artifactsDir, "cyclic_seam_resolution")}\` and \`${cyclicSeamRepairStatePath(ctx.artifactsDir)}\` and re-run next-step.
-
-If you choose to stop instead, this run will remain blocked.
-`,
-                stopCondition: "Stop after presenting the user-decision prompt. Do not attempt further resolution.",
-            };
-        }
-        // The user decision was emitted and cycles are still present — blocked.
-        return {
-            via: "blocked",
-            prompt: `# Cyclic Seam Resolution — Blocked
-
-Cycles in the obligation graph remain unresolved after the automatic cap and a user-decision step. The run cannot proceed without manual intervention.
-
-${cycleDescriptions}
-
-Manually rewrite the obligation_ledger to remove circular depends_on references, delete the cyclic_seam_resolution artifact and cyclic-seam-repair-state.json, and re-run next-step.
-`,
-            stopCondition: "Stop — the run is blocked on cyclic seam resolution.",
-        };
-    }
-    // Emit the LLM cyclic-seam-resolution step.
-    const outputPath = contractInputFilePath(ctx.artifactsDir, "cyclic_seam_resolution");
-    const ledgerInputPath = contractInputFilePath(ctx.artifactsDir, "obligation_ledger");
-    const priorRejection = [...repairState.attempts]
-        .reverse()
-        .find((attempt) => attempt.ledger_hash === graph.ledgerHash && attempt.recheck_reason)?.recheck_reason;
-    const rejectionSection = priorRejection
-        ? `\n## Why the Previous Attempt Was Rejected\n\n${priorRejection}\n`
-        : "";
-    repairState.attempts.push({
-        ledger_hash: graph.ledgerHash,
-        at: new Date().toISOString(),
-        recheck_passed: false,
-    });
-    await writeCyclicSeamRepairState(ctx.artifactsDir, repairState);
-    return {
-        via: "step",
-        prompt: renderCyclicSeamResolutionPrompt({
-            cycleDescriptions,
-            ledgerInputPath,
-            outputPath,
-            extraSection: rejectionSection,
-        }),
-        outputPath,
-        stopCondition: CYCLIC_SEAM_RESOLUTION_STOP,
-    };
-};
-const CYCLIC_SEAM_RESOLUTION_STOP = "Stop after rewriting the obligation_ledger, writing the cyclic_seam_resolution output file, and running next-step.";
-/**
- * The ONE worker prompt for cyclic-seam resolution. The gate emits it for each
- * attempt, and every generic re-emit of the phase (a refused ingestion, a stale
- * archive, a goal-id mismatch) emits it too — a second, shorter text used to
- * reach the worker on those re-emits and left out the ledger rewrite that the
- * re-check requires, so the retry was refused for a rule it was never told.
- *
- * The worker writes only `resolved`: `no_cycles` is the tool's own record, and
- * the re-check refuses any record while the ledger still has a cycle.
- */
-export function renderCyclicSeamResolutionPrompt(params) {
-    const { cycleDescriptions, ledgerInputPath, outputPath } = params;
-    return `# Cyclic Seam Resolution
-
-The obligation ledger has circular interface-definition obligations. Break each cycle with one of the two strategies below. Then rewrite the ledger and write the resolution record.
-
-## Detected Cycles
-
-${cycleDescriptions}
-${params.extraSection ?? ""}
-## Break Strategies
-
-For each cycle, choose one:
-
-1. **Mediator** — Designate a third obligation that both sides depend on. The mediator owns the shared primitive; neither original obligation defines an interface for the other. The mediator must exist in the ledger and must not be a member of the cycle.
-2. **Single authority** — Designate one of the cycle's own obligations as the owner of the interface. The others become consumers only. Name the scoped exception in \`exception_registration\`.
-
-## Required Inputs
-
-- \`${ledgerInputPath}\` (obligation_ledger)
-
-## Your Task
-
-Write two files. The record alone does not break a cycle:
-
-1. **Rewrite \`${ledgerInputPath}\`** so each cycle's \`depends_on\` edges route through the obligation you designate. The tool runs cycle detection again on the ledger you leave; it refuses the record while any cycle remains.
-2. **Write the resolution record** to exactly \`${outputPath}\`, with one entry per cycle:
-
-\`\`\`json
-{
-  "contract_version": "remediate-code-contract-pipeline/cyclic-seam-resolution/v1alpha1",
-  "goal_id": "<from obligation_ledger>",
-  "cycles": [
-    {
-      "members": ["<obligation-id>", "..."],
-      "break_strategy": "${sketchValues(CYCLIC_SEAM_BREAK_STRATEGIES)}",
-      "designated_obligation_id": "<the mediator, or the single authority — must exist in the rewritten ledger>",
-      "resolution_description": "<what was changed and why>",
-      "exception_registration": "<if single_authority: the named scoped exception; otherwise null>"
-    }
-  ],
-  "status": "${sketchValues(CYCLIC_SEAM_RESOLUTION_STATUSES_OFFERED)}"
-}
-\`\`\`
-
-**Stop after you write the two files.** Do not edit source files. Do not start the next phase.
-`;
-}
-/**
- * Cyclic-seam RE-CHECK. The worker has written a `resolved` record; verify the
- * break it actually authored against the obligation graph as it actually
- * stands, and archive + loop back when it does not hold.
- *
- * TST-61cff370 / TST-114e4941: this check used to be vacuous. It fabricated a
- * synthetic node per cycle — `{ id: "_mediator_A_B", needs: [] }` or
- * `{ id: "_authority_A_B", needs: [] }` — and asked whether redirecting the
- * cycle's edges at that edge-free sink would be acyclic, against the SAME
- * unmodified ledger. For any single detected cycle the answer is yes by
- * construction, so the re-check could never reject: a worker could claim
- * `status: "resolved"` while changing nothing, and the pipeline advanced. It
- * now reads the designated obligation off the record and validates it against
- * the live graph — see `validateAuthoredCycleBreak`.
- */
-const cyclicSeamRecheckGate = async (ctx) => {
-    const resolutionEnvelope = await readContractArtifact(ctx.artifactsDir, "cyclic_seam_resolution");
-    if (!resolutionEnvelope)
-        return null;
-    const resolution = envelopePayload(resolutionEnvelope);
-    if (!resolution)
-        return null;
-    // The record never decides whether cycles remain — the live ledger does. A
-    // `no_cycles` record (the tool's own, or a worker's) passes only while the
-    // ledger is acyclic, and a `resolved` record passes only when every per-cycle
-    // break holds AND no cycle is left anywhere. Before, any status other than
-    // `resolved`, or a `resolved` record with an empty `cycles` list, advanced the
-    // pipeline with the cycles still in the ledger.
-    const graph = await readSeamObligationGraph(ctx.artifactsDir);
-    const remaining = detectCyclicSeamObligations(graph.nodes);
-    let rejection;
-    if (resolution.status !== "resolved") {
-        if (remaining.length === 0)
-            return null;
-        rejection =
-            `The resolution record says status ${JSON.stringify(resolution.status ?? null)}, but the ` +
-                `obligation ledger still has ${remaining.length} cycle(s):\n\n${renderCycleDescriptions(remaining)}\n\n` +
-                `Break each cycle in the ledger, then write status "resolved" with one entry per cycle.`;
-    }
-    const cycleRecords = !rejection && Array.isArray(resolution.cycles)
-        ? resolution.cycles
-        : [];
-    for (const cycleRecord of cycleRecords) {
-        if (!Array.isArray(cycleRecord.members))
-            continue;
-        const members = cycleRecord.members.filter((member) => typeof member === "string");
-        const strategy = cycleRecord.break_strategy;
-        // The vocabulary is the shared declaration the prompt sketch also renders
-        // (`contractPipeline/sketchSource.ts`). It was two inline literals here and
-        // a hand-written alternation in the prompt — three statements of one rule,
-        // in two modules, none of which the contract validator checked at all.
-        if (!isCyclicSeamBreakStrategy(strategy)) {
-            rejection =
-                `Cycle [${members.join(", ")}] declares break_strategy ` +
-                    `${JSON.stringify(strategy ?? null)}, which is not one of: ${CYCLIC_SEAM_BREAK_STRATEGIES.join(", ")}.`;
-            break;
-        }
-        const authored = {
-            strategy,
-            designatedId: typeof cycleRecord.designated_obligation_id === "string"
-                ? cycleRecord.designated_obligation_id
-                : undefined,
-        };
-        const validation = validateAuthoredCycleBreak({ members }, graph.nodes, authored);
-        if (!validation.accepted) {
-            rejection = validation.reason ?? `Cycle [${members.join(", ")}] was not resolved.`;
-            break;
+        if (role === "judge") {
+            const judge = PlanJudgeSchema.parse(result.result);
+            const history = await readPlanReviewHistory(options.artifactsDir);
+            if (judge.verdict !== "approved") {
+                const critic = CriticSchema.parse((await readPlanReview(options.artifactsDir, "critic", canonical.revision_sha256))?.result);
+                const counterexamples = new Map(history.counterexamples.map(entry => [entry.id, entry]));
+                for (const example of critic.counterexamples)
+                    counterexamples.set(example.id, example);
+                const acceptedIds = judge.classifications.filter(entry => entry.classification === "accepted").map(entry => entry.counterexample_id);
+                if (history.repair_rounds >= 8)
+                    return repairBoundSpent(options, "Plan review", "judge-accepted counterexamples", acceptedIds.map(id => counterexamples.get(id) ?? { id }));
+                await writeJsonFile(executionPlanPaths(options.artifactsDir).history, { counterexamples: [...counterexamples.values()], accepted_ids: acceptedIds, repair_rounds: history.repair_rounds + 1, repair_revision: canonical.revision_sha256, repair_reason: JSON.stringify(judge) });
+                return authorStep(options, source, canonical, JSON.stringify(judge, null, 2));
+            }
+            const residuals = judge.classifications.filter(entry => entry.classification === "residual_risk");
+            if (residuals.length) {
+                const riskPath = join(executionPlanPaths(options.artifactsDir).directory, "risk-decisions.json");
+                const risk = PlanRiskDecisionSchema.safeParse(await readOptionalJsonFile(riskPath));
+                if (!risk.success || risk.data.revision_sha256 !== canonical.revision_sha256 || residuals.some(entry => !risk.data.accepted_counterexample_ids.includes(entry.counterexample_id)))
+                    return emit(options, `# Accept or repair remaining risks\n\nThe independent judge proposes these residual risks, which remain the operator's choice:\n${JSON.stringify(residuals, null, 2)}\nAsk the operator to accept them or revise the plan. Explicit acceptance is recorded at ${riskPath}: ${JSON.stringify({ revision_sha256: canonical.revision_sha256, confirmed_by: "host", accepted_counterexample_ids: residuals.map(entry => entry.counterexample_id) })}. Never infer risk acceptance from the judge's classification.`, "blocked");
+            }
+            const finalCritic = CriticSchema.parse((await readPlanReview(options.artifactsDir, "critic", canonical.revision_sha256))?.result);
+            const finalExamples = new Map(history.counterexamples.map(entry => [entry.id, entry]));
+            for (const entry of finalCritic.counterexamples)
+                finalExamples.set(entry.id, entry);
+            // Approval closes this review cycle: the repair bound is per cycle, so a later revision of the approved plan starts at zero.
+            await writeJsonFile(executionPlanPaths(options.artifactsDir).history, { counterexamples: [...finalExamples.values()], accepted_ids: [], repair_rounds: 0 });
+            const paths = executionPlanPaths(options.artifactsDir);
+            const reviews = Object.fromEntries(await Promise.all(PLAN_REVIEW_ROLES.map(async (role) => [role, hashContent(stableStringify(await readPlanReview(options.artifactsDir, role, canonical.revision_sha256)))])));
+            await writeJsonFile(paths.approval, { revision_sha256: canonical.revision_sha256, judge_input_sha256: result.input_sha256,
+                owner_decision_sha256: hashContent(stableStringify(await readOptionalJsonFile(join(paths.directory, "owner-decision.json")) ?? null)),
+                risk_decision_sha256: hashContent(stableStringify(await readOptionalJsonFile(join(paths.directory, "risk-decisions.json")) ?? null)),
+                history_sha256: hashContent(stableStringify(await readPlanReviewHistory(options.artifactsDir))), review_sha256: reviews });
         }
     }
-    if (!rejection && remaining.length > 0) {
-        rejection =
-            `The obligation ledger still has ${remaining.length} cycle(s) that no accepted break ` +
-                `removed:\n\n${renderCycleDescriptions(remaining)}\n\nBreak each of them in the ledger, ` +
-                `and record one entry per cycle.`;
-    }
-    if (!rejection)
-        return null;
-    const repairState = await readCyclicSeamRepairState(ctx.artifactsDir);
-    const last = repairState.attempts.at(-1);
-    // Carry the reason forward so the NEXT resolution prompt says what failed,
-    // instead of re-asking for the same claim and burning the attempt cap on an
-    // unexplained retry. A record that appeared without a matching emitted
-    // attempt (a resumed run, a hand-written artifact) still gets its rejection
-    // recorded — the outcome is the attempt.
-    if (last && last.ledger_hash === graph.ledgerHash) {
-        last.recheck_passed = false;
-        last.recheck_reason = rejection;
-    }
-    else {
-        repairState.attempts.push({
-            ledger_hash: graph.ledgerHash,
-            at: new Date().toISOString(),
-            recheck_passed: false,
-            recheck_reason: rejection,
-        });
-    }
-    await writeCyclicSeamRepairState(ctx.artifactsDir, repairState);
-    const archived = await archiveContractArtifact(ctx.artifactsDir, "cyclic_seam_resolution", "invalid", ctx.options.renameFn);
-    if (!archived.originalFree) {
-        // The rejected record is STILL at its canonical path, and re-deriving would
-        // read the same record, reject it again, fail to archive it again — an
-        // unbounded loop with no cap to stop it: the attempt ledger updates the
-        // same entry in place (one ledger hash), and `rederive` carries no depth
-        // bound. This branch is what makes the re-check's new ability to REJECT
-        // safe; before the re-check could reject, the failure was unreachable.
-        return {
-            via: "blocked",
-            prompt: `# A Rejected Cyclic-Seam Resolution Could Not Be Archived
-
-The cycle-break re-check rejected the resolution record:
-
-${rejection}
-
-The record could not be moved into the contract history directory, so it is still at its canonical path. Re-running would read the same rejected record and loop without bound, so the run stops here instead.
-
-Remove or unlock \`${contractArtifactFilePath(ctx.artifactsDir, "cyclic_seam_resolution")}\` (and its \`.input.json\` sibling if present), then re-run next-step so the resolution phase is re-emitted with the rejection above.`,
-            stopCondition: "Stop — a rejected cyclic-seam resolution could not be archived and would otherwise loop.",
-        };
-    }
-    // Re-enter to emit the next attempt or the cap.
-    return { via: "rederive" };
-};
-/**
- * Design-spec structural gates before the adversarial critic phase, in the order
- * they run: the design artifact's own structure, then the cheap cross-artifact
- * floor, then citation grounding. Error-severity gate failures re-emit the
- * responsible phase; warning-only results (e.g. circular obligation
- * dependencies) ride the critic prompt as advisory.
- */
-const preCriticStructuralGate = async (ctx) => {
-    if (ctx.nextPhase !== "critic")
-        return null;
-    const outcomes = await evaluateContractPipelineCrossGateOutcomes(await readCrossGatePayloads(ctx));
-    // (a) The design artifact itself. `contract_finalization` precedes `critic`,
-    //     so a not-evaluated outcome here means the payload is malformed, not
-    //     absent — its empty issue list is not proof of a clean design.
-    const designSpec = gateOutcomeOf(outcomes, "design_spec");
-    if (!designSpec?.evaluated) {
-        return {
-            via: "phase",
-            phase: "contract_finalization",
-            extraSection: `## Design Structural Gates Could Not Run
-
-The finalized module contracts could not be checked before adversarial review: ${designSpec?.reason ?? "no outcome record was produced for the design gate"}. Rewrite a complete, well-formed finalized_module_contracts artifact.
-`,
-        };
-    }
-    const gateErrors = designSpec.issues.filter((issue) => issue.severity === "error");
-    if (gateErrors.length > 0) {
-        return {
-            via: "phase",
-            phase: "contract_finalization",
-            extraSection: `## Design Structural Gate Errors
-
-The contract_finalization output failed deterministic structural gates. Fix every issue below before adversarial review can begin:
-
-${gateErrors.map((issue) => `- [${issue.path}] ${issue.message}`).join("\n")}
-`,
-        };
-    }
-    const gateWarnings = designSpec.issues.filter((issue) => issue.severity === "warning");
-    if (gateWarnings.length > 0) {
-        return {
-            via: "phase",
-            phase: "critic",
-            extraSection: `## Advisory: Design Structural Warnings
-
-The following structural issues were detected and should inform your adversarial review. They do not block the pipeline but may indicate areas of design fragility:
-
-${gateWarnings.map((issue) => `- [${issue.path}] ${issue.message}`).join("\n")}
-`,
-        };
-    }
-    // (b) Pre-adversarial structural floor (S5): the cheap cross-artifact checks
-    //     whose inputs all exist by the critic phase, so the adversarial loop only
-    //     ever sees structurally-sound obligations/tests/contracts and a gap is
-    //     re-emitted to the precise responsible phase instead of being discovered
-    //     at promotion after the adversarial budget is spent.
-    const preCriticGate = await evaluatePreCriticStructuralGate(ctx.artifactsDir, ctx.root, await readCrossGatePayloads(ctx));
-    if (preCriticGate) {
-        return {
-            via: "phase",
-            phase: preCriticGate.phase,
-            extraSection: `## Pre-Adversarial Structural Gate Errors
-
-The ${preCriticGate.phase} output failed deterministic structural gates. Fix every issue below before adversarial review begins:
-
-${preCriticGate.errorLines.join("\n")}
-`,
-        };
-    }
-    // (c) M-B3 source-grounded citation gate at the pre-critic boundary: ground
-    //     the module_decomposition's file_scope citations against the working tree
-    //     before the adversarial loop. A module citing only a non-existent path and
-    //     no real symbol is re-emitted to the `decomposition` phase — the phase that
-    //     OWNS file_scope (the finalized contracts carry interface fields, not
-    //     paths, so re-emitting contract_finalization could never change file_scope
-    //     and an ungrounded scope would loop forever).
-    const preCriticCitationGate = await evaluatePreCriticCitationGrounding(ctx.artifactsDir, ctx.root);
-    if (preCriticCitationGate) {
-        await captureStepBoundaryFriction(ctx.artifactsDir, ctx.runId, {
-            eventType: "phase_reemit",
-            discriminator: "decomposition:citation_grounding:pre_critic",
-            note: "decomposition re-emitted: a module's file_scope cited a component " +
-                "that does not exist in the working tree, or only re-export shims.",
-            category: "trap",
-        }, "remediate-code");
-        return {
-            via: "phase",
-            phase: "decomposition",
-            extraSection: `## Module File Scope Errors
-
-A module's file_scope does not point at real logic in the working tree. Fix each path below in the decomposition: every path must exist, and each module must own at least one file that holds its logic, not only files that re-export:
-
-${preCriticCitationGate.errorLines.join("\n")}
-`,
-        };
-    }
     return null;
-};
-/**
- * DC-3 merge intercept: when a parallel phase's aggregated artifact is still
- * missing, merge the per-module shards into it once they are ALL present.
- * Returns true when the aggregate was written. A missing shard (or a degenerate
- * ≤1-module decomposition, which never used the shard path) returns false, and
- * the caller re-emits the wave — never a partial aggregate. After a complete
- * merge the artifact is written enveloped and the pipeline re-derives; the
- * seam_reconciliation / critique pass downstream stays the consistency gate over
- * the merged contracts.
- */
-async function tryMergeModuleShards(artifactsDir, phase) {
-    const modules = await readDecomposedModules(artifactsDir);
-    if (modules.length <= 1)
-        return false;
-    const scan = await scanModuleShards(artifactsDir, phase, modules);
-    if (scan.missing.length > 0)
-        return false;
-    // goal_id: the upstream module_decomposition is authoritative (every artifact
-    // shares one goal_id; the goal-ID consistency gate enforces it). Fall back to
-    // a shard's goal_id only if the decomposition somehow lacks one.
-    const decompositionGoalId = await readDecompositionGoalId(artifactsDir);
-    const goalId = decompositionGoalId ||
-        [...scan.present.values()]
-            .map((contract) => (typeof contract.goal_id === "string" ? contract.goal_id : undefined))
-            .find((candidate) => Boolean(candidate)) ||
-        "";
-    await writeDerivedContractArtifact(artifactsDir, PARALLEL_MODULE_PHASES[phase], mergeModuleShards(modules, scan.present, goalId));
-    return true;
 }
-/**
- * Parallel-capable phase (DC-3): `module_contract_drafting` fans out to one
- * agent per module. The aggregated `module_contracts` artifact is missing here,
- * so first try to merge per-module shards (the worker may have just written
- * them) — a COMPLETE shard set merges into the aggregated artifact and the
- * pipeline re-derives; anything else re-emits the wave (which itself falls back
- * to the single aggregated step for a degenerate ≤1-module decomposition).
- */
-const parallelModuleWaveGate = async (ctx) => {
-    const phase = ctx.nextPhase;
-    if (phase === null || !isParallelModulePhase(phase))
-        return null;
-    const merged = await tryMergeModuleShards(ctx.artifactsDir, phase);
-    return merged ? { via: "rederive" } : { via: "module_wave", phase };
-};
-/**
- * Auto-phasing (T3): at the conceptual-design critique, hand the critic the
- * tool-DERIVED phase cut so it assesses design quality WITHIN a mechanically
- * dependency-ordered foundations→consumers phasing, instead of rejecting an
- * arbitrary N-goal change as "over-scoped" and forcing the host to re-scope by
- * hand at intake. The cut is derived from the finalized module contracts'
- * producer/consumer artifact-token edges and PERSISTED as `phase_cut.json`, so the cut
- * the critic sees and the cut the implementation-DAG promotion enforces are one
- * source. Only injected when there is a genuine multi-phase cut to communicate.
- */
-const phaseCutCritiqueGate = async (ctx) => {
-    if (ctx.nextPhase !== "critique")
-        return null;
-    const cut = await ensurePhaseCutArtifact(ctx.artifactsDir);
-    if (!cut || cut.phases.length <= 1)
-        return null;
-    const reReview = await buildReReviewSection("critique", ctx.artifactsDir);
-    const phaseCutSection = renderPhaseCutSection(cut);
-    return {
-        via: "phase",
-        phase: "critique",
-        extraSection: reReview ? `${phaseCutSection}\n${reReview}` : phaseCutSection,
-    };
-};
-/**
- * Granularity collapse (T1 slice 4b): for low-complexity work, fold the suffix
- * [nextPhase .. end of its group] into ONE round-trip producing several
- * artifacts, instead of one gated step per phase. Reads the POST-escalation
- * riskSignal (the escalate-on-evidence intercept may have already raised the
- * tier), so the dial is never frozen at run start — `fine` for medium/high keeps
- * full per-phase isolation. Only collapses a genuine multi-phase suffix, so a
- * lone trailing member falls through to its ordinary per-phase step.
- */
-const collapsedRoundTripGate = (ctx) => {
-    const phase = ctx.nextPhase;
-    if (phase === null ||
-        roundTripGranularityForTier(ctx.riskSignal?.tier) !== "collapsed") {
-        return null;
-    }
-    const group = COLLAPSE_GROUPS.find((g) => g.includes(phase));
-    if (!group)
-        return null;
-    const suffix = group.slice(group.indexOf(phase));
-    if (suffix.length <= 1)
-        return null;
-    return { via: "collapsed_round_trip", phases: [...suffix] };
-};
-/**
- * Skeleton-scaffolded phases (S3): the tool pre-fills structure/ids from the
- * derived obligation ledger so the worker fills only the judgment slots.
- */
-const scaffoldedPhaseGate = async (ctx) => {
-    const phase = ctx.nextPhase;
-    if (phase !== "test_validator_plan" && phase !== "implementation_planning") {
-        return null;
-    }
-    return {
-        via: "phase",
-        phase,
-        extraSection: await buildScaffoldSection(phase, ctx.artifactsDir),
-    };
-};
-/**
- * The fallback: the ordinary per-phase step. Diff-based re-review (B2) rides it
- * — when a verdict-bearing review phase is re-emitted because an upstream
- * changed, the worker gets its prior verdict plus the precise
- * changed-since-last-review delta, so it re-affirms cheaply or revises only the
- * affected items rather than running blind.
- *
- * Reached only when every gate declined, which by construction means
- * `nextPhase` is a real phase: the promotion gate above never declines when the
- * frontier is null.
- */
-const ordinaryPhaseStep = async (ctx) => {
-    const phase = ctx.nextPhase;
-    if (phase === null) {
-        throw new Error("contract pipeline: the gate walk reached the fallback with no next phase — " +
-            "the promotion gate must handle a null frontier.");
-    }
-    return {
-        via: "phase",
-        phase,
-        extraSection: await buildReReviewSection(phase, ctx.artifactsDir),
-    };
-};
-/**
- * THE ORDERED GATE TABLE. Insertion order IS execution order (the walk consumes
- * the scaffold's derived `handledKeys`), names are unique by construction (a
- * duplicate object key is a compile error), and no gate can emit a step of its
- * own — the scaffold owns the single emission site.
- */
-const CONTRACT_PIPELINE_GATES = {
-    seed_source_digest_bound: seedSourceDigestGate,
-    ingested_artifact_invalid: invalidIngestionGate,
-    stale_artifact_archived: staleArchiveGate,
-    phase_frontier_resolved: phaseFrontierGate,
-    goal_id_consistent: goalIdConsistencyGate,
-    finalized_module_set_preserved: finalizedModuleSetGate,
-    work_block_seam_prepared: workBlockSeamGate,
-    conceptual_critique_converged: conceptualCritiqueGate,
-    obligation_ledger_derived: obligationLedgerDerivationGate,
-    degenerate_seam_reconciliation_collapsed: degenerateSeamReconciliationGate,
-    contract_finalization_derived: contractFinalizationDerivationGate,
-    judge_repair_converged: judgeRepairGate,
-    implementation_plan_promoted: implementationPlanPromotionGate,
-    cyclic_seam_resolved: cyclicSeamResolutionGate,
-    cyclic_seam_rechecked: cyclicSeamRecheckGate,
-    pre_critic_structural: preCriticStructuralGate,
-    parallel_module_wave: parallelModuleWaveGate,
-    phase_cut_critique: phaseCutCritiqueGate,
-    collapsed_round_trip: collapsedRoundTripGate,
-    scaffolded_phase: scaffoldedPhaseGate,
-};
-/**
- * Bind the ONE shared step-emission scaffold to an invocation's context.
- *
- * Scaffold ADOPTER, never a second scaffold: this consumes `createStepEmissionScaffold` from
- * `audit-tools/shared` — the same scaffold the audit orchestrator entry point
- * drives — rather than a second one of this module's own. The pipeline's
- * numbered early-return-and-re-emit shape is `emitFirstApplicable`, a row shape
- * in that table, not a fork of it.
- */
-function createContractPipelineEmission(ctx) {
-    return createStepEmissionScaffold({
-        table: CONTRACT_PIPELINE_GATES,
-        fallback: ordinaryPhaseStep,
-        write: (plan) => writeContractStepPlan(ctx, plan),
-        // The pipeline's externally-observable emission is the PERSISTED step
-        // contract, which `write` has just produced; the CLI renders it to the host.
-        // There is deliberately no second stdout announcement here.
-        log: () => { },
-    });
-}
-/**
- * The gate walk order, exported so a drift guard reads the real set instead of
- * reconstructing one by reflecting over a chain of `if` statements.
- *
- * This and the scaffold's `handledKeys` are BOTH `Object.keys` of the SAME
- * object literal, and the walk consumes `handledKeys` directly — so the two
- * agree by construction, not by a test that compares them. No such test exists,
- * and none is needed: there is no second list to drift from.
- */
-export const CONTRACT_PIPELINE_GATE_ORDER = Object.freeze(Object.keys(CONTRACT_PIPELINE_GATES));
-/**
- * Build and write the next contract-pipeline step.
- * Returns null when the pipeline is complete and the extracted plan is ready.
- */
-export async function buildNextContractPipelineStep(options) {
-    const { root, artifactsDir, runId, sourcePaths } = options;
-    // Adversarial-depth dial (T1 slices 3/4): derive the depth for the critique /
-    // critic phases from the intake risk signal, escalating on decomposition
-    // evidence. The (possibly raised) riskSignal is also consumed by the
-    // granularity-collapse gate, so it is carried on the context alongside it.
-    const { riskSignal, adversarialDepth } = await resolveAdversarialDepth(artifactsDir);
-    // Writes and reads are distinct: hosts submit to *.input.json; accepted
-    // upstreams are canonical envelopes whose payload field holds domain data.
-    // Collapsed ordinary authoring sections may read staged raw outputs earlier
-    // in that same round trip, before they have been ingested.
-    const artifactPaths = {};
-    const artifactReadPaths = {};
-    for (const name of CP_ARTIFACT_NAMES) {
-        artifactPaths[name] = contractInputFilePath(artifactsDir, name);
-        artifactReadPaths[name] = contractArtifactFilePath(artifactsDir, name);
-    }
-    const seedPath = pathASeedFilePath(artifactsDir);
-    const ctx = {
-        options,
-        root,
-        artifactsDir,
-        runId,
-        sourcePaths,
-        paths: intakePaths(artifactsDir),
-        artifactPaths,
-        artifactReadPaths,
-        // Present only for structured_audit runs.
-        pathASeedPath: existsSync(seedPath) ? seedPath : undefined,
-        riskSignal,
-        adversarialDepth,
-        artifactsSettled: false,
-        nextPhase: null,
-    };
-    const emission = createContractPipelineEmission(ctx);
-    return await emission.emitFirstApplicable([...emission.handledKeys], ctx);
-}
-/**
- * Build the diff-based re-review section for a review phase being re-emitted after
- * staleness, or undefined when this is not a re-review (non-review phase, or no
- * prior snapshot). See `reviewSnapshot.ts`.
- */
-async function buildReReviewSection(phase, artifactsDir) {
-    const artifact = PHASE_TO_ARTIFACT[phase];
-    if (!artifact || !isReviewArtifact(artifact))
-        return undefined;
-    if (!reviewSnapshotExists(artifactsDir, artifact))
-        return undefined;
-    const snapshot = await readReviewSnapshot(artifactsDir, artifact);
-    if (!snapshot)
-        return undefined;
-    const delta = await computeReReviewDelta(artifactsDir, artifact, snapshot);
-    return renderReReviewSection(artifact, snapshot, delta);
-}
-// ── DAG → extracted plan conversion ──────────────────────────────────────────
-// ── Obligation-kind → lens/severity mappings ──────────────────────────────────
-// <!-- comment-symbol-exempt: names deliberately-retired symbols; this block records that history -->
-/**
- * The obligation-kind vocabulary, in priority order (higher index = higher
- * priority; `invariant` is highest).
- *
- * MNT-114e4941-3: this used to be a THIRD independent copy of the vocabulary —
- * a local `type ObligationKind` union beside derive.ts's `TESTABLE_KINDS` and
- * contractPipelineGates.ts's `TESTABLE_OBLIGATION_KINDS`, with nothing forcing
- * the three to agree, while the ledger's own `obligation.kind` is typed as a
- * bare `string`. The consequence was not theoretical: an unrecognized kind was
- * CAST to this union, scored -1 by `indexOf`, and then indexed the lens map to
- * `undefined` — so a ledger kind outside these four promoted a finding with
- * `lens: undefined`.
- *
- * Membership and priority are now derived from the single definition list in
- * `contractPipeline/obligationKinds.ts`. An unrecognized kind is not dropped or
- * cast: it is routed through the shared `isTestablePhaseObligation` predicate.
- */
-export { OBLIGATION_KIND_PRIORITY };
-const OBLIGATION_KIND_SET = new Set(OBLIGATION_KIND_PRIORITY);
-/**
- * Classify a raw ledger `kind` string (which the ledger types as a bare
- * `string`) into this module's vocabulary. A recognized kind maps to itself; an
- * unrecognized one is classified by the SHARED testability predicate rather
- * than guessed here — testable ⇒ `behavioral` (the testable default, so it
- * carries a real lens and a mid severity), otherwise ⇒ `structural`.
- */
-export function classifyObligationKind(kind) {
-    if (OBLIGATION_KIND_SET.has(kind))
-        return kind;
-    return isTestablePhaseObligation(kind) ? "behavioral" : "structural";
-}
-function deriveObligationLensAndSeverity(kinds) {
-    if (kinds.length === 0) {
-        return { lens: "correctness", severity: "medium" };
-    }
-    // Pick the highest-priority kind.
-    let topKind = kinds[0];
-    for (const kind of kinds) {
-        if (OBLIGATION_KIND_PRIORITY.indexOf(kind) >
-            OBLIGATION_KIND_PRIORITY.indexOf(topKind)) {
-            topKind = kind;
-        }
-    }
-    const lensMap = {
-        invariant: "security",
-        behavioral: "correctness",
-        structural: "architecture",
-        test: "tests",
-    };
-    const severityMap = {
-        invariant: "high",
-        behavioral: "medium",
-        structural: "low",
-        test: "low",
-    };
-    return { lens: lensMap[topKind], severity: severityMap[topKind] };
-}
-// ── Normalized block write scope + declared command shape ─────────────────────────────────────
-//
-// `touched_files` is the PROMPT-BOUND WRITE SCOPE the host-handoff substrate
-// enforces against the landed diff, and `targeted_commands` are executed
-// verbatim through a shell in the repository root. That consumer can check the
-// SHAPE of what it is handed; it can never check whether the shape is CORRECT
-// for this repository. So the producer normalizes here: an absolute or
-// separator-inconsistent path becomes one canonical repo-relative form, a path
-// that escapes the repository is refused outright, and a command carrying shell
-// chaining or substitution is refused rather than handed to a shell.
-/**
- * The tracked-path corpus for write-scope checking, or null when the tree
- * cannot be read. Null degrades to "shape-only normalization" exactly as the
- * M-B3 citation gate degrades on an unreadable tree — a fixture directory or a
- * fresh checkout must not be bricked, only an unsound path in a REAL tree is
- * refused.
- */
-async function readTrackedWriteScopeCorpus(root) {
-    if (!(await isInsideGitWorkTree(root)))
-        return null;
-    const files = await enumerateRepoTreePaths(root);
-    if (files.size === 0)
-        return null;
-    const directories = new Set();
+export function normalizeBlockTouchedFiles(root, files, id) {
+    const normalized = new Set(), refusals = [];
     for (const path of files) {
-        const segments = path.split("/");
-        for (let i = 1; i < segments.length; i += 1) {
-            directories.add(segments.slice(0, i).join("/"));
-        }
-    }
-    return { files, directories };
-}
-export function normalizeBlockTouchedFiles(root, files, blockId) {
-    const normalized = new Set();
-    const refusals = [];
-    for (const raw of files) {
-        const candidate = typeof raw === "string" ? raw.trim() : "";
-        if (candidate.length === 0) {
-            refusals.push(`Block "${blockId}" declares an empty touched_files entry.`);
-            continue;
-        }
-        const directoryIntent = /[\\/]$/u.test(candidate);
-        const portableCandidate = toPosixPath(candidate);
-        const absolute = isAbsolute(portableCandidate)
-            ? portableCandidate
-            : resolve(root, portableCandidate);
         try {
-            const normalizedPath = repoRelativePath(root, absolute, `block "${blockId}" touched_files entry`);
-            normalized.add(directoryIntent ? `${normalizedPath}/` : normalizedPath);
+            const relative = repoRelativePath(root, isAbsolute(toPosixPath(path)) ? toPosixPath(path) : resolve(root, toPosixPath(path)), `Unit ${id} write scope`);
+            normalized.add(/[\\/]$/u.test(path) ? `${relative}/` : relative);
         }
         catch {
-            refusals.push(`Block "${blockId}" declares the touched_files entry ${JSON.stringify(raw)}, which ` +
-                `does not resolve to a path beneath the repository root. A POSIX-absolute form ` +
-                `("/src/x.ts") is read as absolute, not repo-relative — drop the leading slash. The ` +
-                `write scope is re-checked against the landed diff, so it may only name paths ` +
-                `beneath ${root}.`);
+            refusals.push(`Unit ${id} write scope ${path} must remain beneath ${root}.`);
         }
     }
-    // Content-derived order: an incidentally-ordered write scope would churn the
-    // plan's content hash on every re-promotion.
-    return {
-        touched_files: [...normalized].sort((left, right) => compareCodeUnits(left, right)),
-        refusals,
-    };
+    return { touched_files: [...normalized].sort(), refusals };
 }
-/**
- * The tracked-tree half of The normalized-write-scope invariant, run against
- * the PROMOTED plan so a violation takes the same bounded re-emit path the M-B3
- * citation gate takes, rather than throwing out of the promotion.
- *
- * It exists because the citation gate is NOT a superset: a finding grounds if
- * ANY cited path OR SYMBOL is real, so a node whose prose names a real symbol
- * can ground while its declared write scope is still fabricated — and the write
- * scope is what a host binds a worker to.
- *
- * A path that is not tracked but whose parent directory IS stays legal: a
- * remediation block legitimately creates new files, and dropping a declared
- * write target is the failure mode that strands an implementer with an
- * obligation it has no scope to discharge. Fail-open on an unreadable tree, as
- * the citation gate does.
- */
-export async function evaluatePromotedPlanWriteScope(artifactsDir, root) {
-    const corpus = await readTrackedWriteScopeCorpus(root);
-    if (!corpus)
-        return null;
-    const plan = await readOptionalJsonFile(intakePaths(artifactsDir).extractedPlan);
-    const violations = [];
-    for (const block of Array.isArray(plan?.blocks) ? plan.blocks : []) {
-        const blockId = typeof block.block_id === "string" ? block.block_id : "(unnamed block)";
-        const touched = Array.isArray(block.touched_files) ? block.touched_files : [];
-        violations.push(...writeScopeCorpusViolations(corpus, touched.filter((path) => typeof path === "string"), `Block "${blockId}"`));
-    }
-    return violations.length > 0 ? { violations } : null;
-}
-/**
- * The ONE tracked-tree membership rule for a declared write-scope path: legal
- * when the file is tracked, sits at the repo root, or its parent directory
- * exists in the tracked tree (a block legitimately creates NEW files in
- * existing directories). Shared by the promotion gate above and the
- * clarification scope-delta validation, so the two cannot drift.
- */
-function writeScopeCorpusViolations(corpus, paths, label) {
-    const violations = [];
-    for (const path of paths) {
-        const key = normalizeRepoPath(path);
-        const parent = key.includes("/") ? key.slice(0, key.lastIndexOf("/")) : "";
-        if (corpus.files.has(key) || parent === "" || corpus.directories.has(parent)) {
-            continue;
-        }
-        violations.push(`${label} declares the write-scope path "${path}", whose directory does ` +
-            `not exist in the tracked tree.`);
-    }
-    return violations;
-}
-/**
- * Tracked-tree parity for a POST-promotion write-scope widening
- * (open-bugs.md:110): a clarification scope delta must clear the same rule the
- * promotion gate enforced, or the delta lane becomes a bypass of it. Returns
- * violation lines; [] on an unreadable tree (fail-open, exactly as the
- * promotion gate degrades).
- */
 export async function checkWriteScopePathsAgainstTrackedTree(root, paths, label) {
-    const corpus = await readTrackedWriteScopeCorpus(root);
-    if (!corpus)
-        return [];
-    return writeScopeCorpusViolations(corpus, paths, label);
-}
-export function normalizeBlockTargetedCommands(commands, blockId) {
-    // The ONE mechanical repair: a bare `&&` chain already MEANS "these
-    // invocations, in order", which is what two entries mean, so it is split here
-    // rather than spending a whole DAG regeneration on it (open-bugs: one dispatch
-    // emitted `npm run build && npm run check` on 23 nodes and the DAG was
-    // regenerated twice for a defect with a mechanical answer). Everything the
-    // split cannot faithfully restate — a pipe, a redirect, `;`, substitution, an
-    // inadmissible half — still takes the bounded re-emit below.
-    const partitioned = partitionCommandsByDeclaredShape(commands, (kind, raw) => kind === "empty"
-        ? `Block "${blockId}" declares an empty targeted_commands entry.`
-        : `Block "${blockId}" declares the targeted_commands entry ${JSON.stringify(raw)}, ` +
-            `which carries shell chaining, substitution or redirection. A targeted command is ` +
-            `executed verbatim through a shell, so it must be one invocation — split it into ` +
-            `separate entries.`, splitSequentialCommandChain);
-    return { targeted_commands: partitioned.commands, refusals: partitioned.refusals };
-}
-/**
- * Collect every write-scope and command refusal the promotion WOULD hit, before
- * a plan is written. Runs the same two normalizers over the same derived node
- * scope the promoter uses, so this pre-check and the promotion cannot disagree
- * about what is refusable — and the refusal reaches the host as the bounded
- * `implementation_planning` re-emit every other promotion rejection takes,
- * rather than as a thrown stack that wedges every subsequent next-step.
- */
-export async function collectDagWriteScopeRefusals(artifactsDir, root) {
-    const dag = envelopePayload(await readContractArtifact(artifactsDir, "implementation_dag"));
-    const nodes = Array.isArray(dag?.nodes) ? dag.nodes : [];
-    if (nodes.length === 0)
-        return [];
-    const { resolve: deriveNodeFiles } = await buildNodeWriteScopeResolver(artifactsDir);
-    const refusals = [];
-    for (const [index, node] of nodes.entries()) {
-        const blockId = toBlockId(ensureNodeId(node.id, index));
-        refusals.push(...normalizeBlockTouchedFiles(root, deriveNodeFiles(node), blockId).refusals, ...normalizeBlockTargetedCommands(node.targeted_commands ?? [], blockId).refusals);
-    }
-    return refusals;
-}
-/**
- * The ONE Path-A canonical-group membership evaluator, in ONE body.
- *
- * The promoter and the pre-promotion gate ask the byte-identical question — is
- * each DAG node's `source_finding_ids` declaration a canonical audit work block,
- * exactly once each? — and they used to answer it with two hand-mirrored copies
- * of the same forty lines: one returning refusal lines, one throwing. Two copies
- * of an identity rule drift, and a drift between THESE two is the worst kind:
- * the gate would certify a DAG promotable and the promoter would then throw on
- * it, or (worse) the gate would refuse a DAG the promoter would have accepted,
- * wedging a run behind a rule nothing in the emitter can satisfy.
- *
- * So the body is `ok`/`refusals`, plus the node→canonical-group map the promoter
- * needs for its projection, and each caller renders what it needs from the SAME
- * result. `refusals` is empty exactly when the DAG is promotable on this axis;
- * `byNodeId` is populated exactly on that path.
- *
- * The caller supplies `nodes` and `approvedSource` because they read them for
- * their own purposes too (the gate must not read the DAG twice; the promoter
- * filters the canonical group map through its own sort).
- */
-function evaluatePathACanonicalGroups(params) {
-    const { nodes, approvedSource, seedPresent } = params;
-    const byNodeId = new Map();
-    if (nodes.length === 0)
-        return { refusals: [], byNodeId };
-    if (!nodes.some((node) => Array.isArray(node.source_finding_ids))) {
-        return { refusals: [], byNodeId };
-    }
-    if (!approvedSource) {
-        return {
-            refusals: [
-                "implementation_dag declares source_finding_ids but no Path-A seed is present, so the ids cannot be joined to a canonical audit work block.",
-            ],
-            byNodeId,
-        };
-    }
-    if (!seedPresent) {
-        return {
-            refusals: [
-                "implementation_dag declares source_finding_ids but no Path-A seed is present, so the ids cannot be joined to a canonical audit work block.",
-            ],
-            byNodeId,
-        };
-    }
-    const signature = (ids) => JSON.stringify([...ids].sort((left, right) => compareCodeUnits(left, right)));
-    const canonicalGroups = new Map(approvedSource.workBlocks.map((block) => [
-        signature(block.finding_ids),
-        [...block.finding_ids].sort((left, right) => compareCodeUnits(left, right)),
-    ]));
-    const usedGroups = new Set();
-    const refusals = [];
-    for (const [index, node] of nodes.entries()) {
-        const nodeId = ensureNodeId(node.id, index);
-        const sourceIds = node.source_finding_ids;
-        if (!Array.isArray(sourceIds) || sourceIds.length === 0) {
-            refusals.push(`implementation_dag node "${nodeId}" must declare source_finding_ids for Path-A promotion.`);
-            continue;
-        }
-        const uniqueIds = [...new Set(sourceIds)];
-        if (uniqueIds.length !== sourceIds.length) {
-            refusals.push(`implementation_dag node "${nodeId}" repeats a source_finding_ids member.`);
-        }
-        const groupSignature = signature(uniqueIds);
-        const canonicalGroup = canonicalGroups.get(groupSignature);
-        if (!canonicalGroup) {
-            refusals.push(`implementation_dag node "${nodeId}" source_finding_ids do not match a canonical audit work block.`);
-            continue;
-        }
-        if (usedGroups.has(groupSignature)) {
-            refusals.push(`implementation_dag node "${nodeId}" duplicates a canonical audit work block.`);
-        }
-        usedGroups.add(groupSignature);
-        byNodeId.set(nodeId, canonicalGroup);
-    }
-    if (refusals.length === 0 && usedGroups.size !== canonicalGroups.size) {
-        refusals.push("implementation_dag source_finding_ids do not cover every canonical audit work block exactly once.");
-    }
-    return { refusals, byNodeId };
-}
-/**
- * Path-A canonical-block membership validation, run BEFORE anything is promoted
- * (OBL-seam-prep-remediate-core-inv-2 / COR-114e4941). These are exactly the
- * checks the promoter itself performs while building its node→canonical-group
- * map — but there they THROW out of `promoteImplementationDagToExtractedPlan`,
- * an unclassified stack that wedged every subsequent next-step. Hoisted here so
- * an invalid `source_finding_ids` declaration takes the same bounded re-emit as
- * every other promotion rejection, with no gate having executed past it.
- *
- * The checks themselves are {@link evaluatePathACanonicalGroups} — the ONE body
- * both this gate and the promoter call, so the gate can never certify a DAG the
- * promoter then refuses.
- *
- * Returns one line per violation; empty means the DAG is promotable on this
- * axis (or Path A is not in play at all).
- */
-export async function collectPathARefusals(artifactsDir) {
-    const dag = envelopePayload(await readContractArtifact(artifactsDir, "implementation_dag"));
-    const nodes = Array.isArray(dag?.nodes) ? dag.nodes : [];
-    if (nodes.length === 0)
-        return [];
-    if (!nodes.some((node) => Array.isArray(node.source_finding_ids)))
-        return [];
-    const pathASeed = await readOptionalJsonFile(pathASeedFilePath(artifactsDir));
-    const approvedSource = pathASeed
-        ? projectApprovedFindings(await readOptionalJsonFile(pathASeed.audit_findings_path))
-        : undefined;
-    return evaluatePathACanonicalGroups({
-        nodes,
-        approvedSource,
-        seedPresent: pathASeed !== undefined,
-    }).refusals;
-}
-/**
- * What the AUDIT read, for the run whose Path-A seed lives in `artifactsDir` —
- * the value plan application stamps onto `state.plan.audit_read`.
- *
- * Read by the TOOL from the seed's own source report, which passed the strict
- * shared validator (`projectApprovedFindings`) before it may answer. It never
- * rides `extracted-plan.json`: that file is host-writable, and the close
- * phase's evidence leg turns this commit into terminal dispositions, so a
- * host-supplied value would let a host author its own `refuted`.
- *
- * BOUND TO THE SEED'S OWN DIGEST. The seed recorded a sha256 of the source
- * report when it was built (`source_digests`); the bytes read here must hash to
- * it, so a report swapped afterwards — even for another VALID report — answers
- * `null`. The file is read ONCE and the same bytes are hashed and parsed. A seed
- * that carries no digest for its source binds nothing, and an unbound commit is
- * not one this function will vouch for.
- *
- * `null` — "no commit is known" — when there is no seed (the run did not start
- * from a findings report), the source is unbound, changed, unreadable or
- * invalid, or the report itself states `null`.
- */
-export async function readSeedAuditRead(artifactsDir) {
-    const pathASeed = await readOptionalJsonFile(pathASeedFilePath(artifactsDir));
-    if (!pathASeed)
-        return null;
-    const bound = (pathASeed.source_digests ?? []).find((entry) => entry?.path === pathASeed.audit_findings_path);
-    if (typeof bound?.sha256 !== "string")
-        return null;
-    let source;
-    try {
-        const bytes = await readFile(pathASeed.audit_findings_path);
-        if (hashContent(bytes) !== bound.sha256)
-            return null;
-        source = JSON.parse(bytes.toString("utf8"));
-    }
-    catch {
-        return null;
-    }
-    try {
-        projectApprovedFindings(source);
-    }
-    catch {
-        return null;
-    }
-    return auditReadOf(source);
-}
-/**
- * Convert a completed ImplementationDAG into the extracted-plan.json format
- * that the existing handlePendingExtractedPlan/applyPlanPipeline path consumes.
- *
- * `root` defaults to the repository that owns `artifactsDir`, so the existing
- * one-argument callers keep working while the pipeline passes the run's real
- * root for write-scope normalization.
- */
-export async function promoteImplementationDagToExtractedPlan(artifactsDir, root = climbOutOfAuditTools(artifactsDir)) {
-    const paths = intakePaths(artifactsDir);
-    const dagEnvelope = await readContractArtifact(artifactsDir, "implementation_dag");
-    if (!dagEnvelope)
-        return;
-    const dag = envelopePayload(dagEnvelope);
-    const pathASeed = await readOptionalJsonFile(pathASeedFilePath(artifactsDir));
-    const approvedSource = pathASeed
-        ? projectApprovedFindings(await readOptionalJsonFile(pathASeed.audit_findings_path))
-        : undefined;
-    // Load obligation_ledger for lens/severity derivation (graceful: may be absent).
-    const ledgerPayload = envelopePayload(await readContractArtifact(artifactsDir, "obligation_ledger"));
-    const obligationMap = new Map();
-    if (ledgerPayload?.obligations) {
-        for (const obl of ledgerPayload.obligations) {
-            // Classified, never cast: an unrecognized kind used to index the lens map
-            // to `undefined` and promote a lens-less finding (MNT-114e4941-3).
-            obligationMap.set(obl.id, classifyObligationKind(String(obl.kind ?? "")));
-        }
-    }
-    // Auto-phasing (T3): read the persisted phase cut and re-key its module-phase
-    // map by `moduleSlug(name)` — the fragment the obligation ledger encodes into
-    // `OBL-<slug>-…` ids. The block phase ordinal is then derived MECHANICALLY from
-    // each node's obligations (never trusting a worker-carried field, which a node
-    // merge could drop), so a foundation block always sorts below the consumers that
-    // depend on it. Absent cut (single module / no finalized contracts) → no
-    // ordinals, i.e. one phase, no barrier.
-    const phaseCut = await readPhaseCutArtifact(artifactsDir);
-    const slugToOrdinal = new Map();
-    if (phaseCut) {
-        for (const [name, ordinal] of Object.entries(phaseCut.module_phase)) {
-            slugToOrdinal.set(moduleSlug(name), ordinal);
-        }
-    }
-    const lastOrdinal = Math.max(0, ...slugToOrdinal.values());
-    const hasMultiPhase = phaseCut ? phaseCut.phases.length > 1 : false;
-    // Approved-contract attachment (open-bugs.md:474): resolve each node's
-    // obligation-id slugs against the finalized module contracts, so every
-    // promoted block carries VERBATIM the contract(s) it implements and the
-    // dispatch prompt can bind the worker to the approved interface — the
-    // workflow must never depend on the DAG author restating declared values.
-    const finalizedForBlocks = envelopePayload(await readContractArtifact(artifactsDir, "finalized_module_contracts"));
-    const contractByModuleName = new Map();
-    const contractSlugToName = new Map();
-    for (const mod of finalizedForBlocks?.module_contracts ?? []) {
-        if (isRecord(mod) && typeof mod.name === "string" && mod.name.length > 0) {
-            contractByModuleName.set(mod.name, mod);
-            contractSlugToName.set(moduleSlug(mod.name), mod.name);
-        }
-    }
-    const contractSlugs = new Set(contractSlugToName.keys());
-    const moduleContractsForNode = (node) => {
-        const names = new Set();
-        for (const obligationId of [
-            ...(node.satisfies_obligations ?? []),
-            ...(node.verification_obligation_ids ?? []),
-        ]) {
-            const slug = moduleSlugForObligationId(obligationId, contractSlugs);
-            const name = slug === null ? undefined : contractSlugToName.get(slug);
-            if (name !== undefined)
-                names.add(name);
-        }
-        return [...names]
-            .sort((left, right) => compareCodeUnits(left, right))
-            .map((name) => ({ module: name, contract: contractByModuleName.get(name) }));
-    };
-    // Root-cause fix for scope-less nodes: the DAG's write scope
-    // (`output_files`/`files_likely_touched`) is host-authored and a coarse
-    // "Remediate <module>" decomposition can leave it EMPTY, which promotes a
-    // finding with empty affected_files AND a block with empty touched_files — an
-    // undispatchable node (no worktree seed, no write scope, no paths for a
-    // single-shot worker to inline) that silently dooms the whole run and
-    // cascade-blocks its dependents. Derive the write scope DETERMINISTICALLY from
-    // the module decomposition instead of trusting the host to have filled it: each
-    // node's obligations are `OBL-<moduleSlug>-…`, and every module declares its
-    // `file_scope`, so a node that declared no files inherits the file_scope of the
-    // module(s) its obligations belong to. A node that DID declare files still gains
-    // those modules' finalized-contract write targets (P38) — the scope is a UNION,
-    // not a precedence. Single-sourced with the DAG validator, which refuses a node
-    // this resolves to nothing for — see buildNodeWriteScopeResolver.
-    const { resolve: deriveNodeFiles } = await buildNodeWriteScopeResolver(artifactsDir);
-    const nodes = (Array.isArray(dag?.nodes) ? [...dag.nodes] : []).sort((left, right) => compareCodeUnits(String(left.id), String(right.id)));
-    // Path-A promotion is an identity-preserving projection. DAG node ids describe
-    // implementation tasks; they may not replace the canonical auditor finding
-    // ids or split/merge the canonical coherence components.
-    const canonicalItemsByNodeId = new Map();
-    if (approvedSource &&
-        nodes.some((node) => Array.isArray(node.source_finding_ids))) {
-        // The SAME evaluator `collectPathARefusals` runs as the pre-promotion gate.
-        // The projection this loop used to build inline was a second copy of that
-        // gate's rule, and the two could disagree about which declarations are
-        // canonical — the gate certifying a DAG this throws on, or the reverse.
-        // This side renders refusals as the THROW the promoter's contract promises.
-        const evaluation = evaluatePathACanonicalGroups({
-            nodes,
-            approvedSource,
-            seedPresent: true,
-        });
-        if (evaluation.refusals.length > 0) {
-            throw new Error(evaluation.refusals.join("\n"));
-        }
-        for (const [nodeId, canonicalGroup] of evaluation.byNodeId) {
-            canonicalItemsByNodeId.set(nodeId, [...canonicalGroup]);
-        }
-    }
-    let findings = nodes.map((node, index) => {
-        const id = ensureNodeId(node.id, index);
-        const contractObligations = [...new Set(node.satisfies_obligations ?? [])];
-        const verificationObligations = [
-            ...new Set(node.verification_obligation_ids ?? []),
-        ];
-        const addressedCounterexamples = [
-            ...new Set(node.addresses_counterexamples ?? []),
-        ];
-        const obligationEvidence = [
-            ...contractObligations.map((obligationId) => `Satisfies contract obligation: ${obligationId}`),
-            ...verificationObligations.map((obligationId) => `Verifies contract obligation: ${obligationId}`),
-            ...addressedCounterexamples.map((counterexampleId) => `Addresses accepted counterexample: ${counterexampleId}`),
-        ];
-        // Derive lens and severity from obligation kinds; fall back when ledger absent.
-        const satisfiedKinds = contractObligations
-            .map((id) => obligationMap.get(id))
-            .filter((k) => k !== undefined);
-        const { lens, severity } = deriveObligationLensAndSeverity(satisfiedKinds);
-        return {
-            id,
-            title: node.title ?? node.description ?? `Contract-pipeline task ${index + 1}`,
-            category: "General",
-            severity,
-            confidence: "high",
-            lens,
-            summary: node.description ?? node.title ?? "",
-            // output_files (declared write scope) takes priority over files_likely_touched,
-            // unioned with the owning module contract's declared write targets; when the
-            // node declared neither, it inherits the module file_scope (deriveNodeFiles)
-            // so the finding is never scope-less. Map each path to the { path } shape that
-            // Finding.affected_files expects.
-            affected_files: deriveNodeFiles(node).map((p) => ({ path: p })),
-            evidence: obligationEvidence.length > 0
-                ? obligationEvidence
-                : [node.description ?? node.title ?? `Contract-pipeline task ${id}`],
-            // The implementation description already lives in summary.
-            contract_goal_id: dag?.goal_id,
-            contract_obligation_ids: contractObligations,
-            verification_obligation_ids: verificationObligations,
-            targeted_commands: node.targeted_commands ?? [],
-            // Distinct node instructions travel on the block, not the finding.
-        };
-    });
-    if (approvedSource && canonicalItemsByNodeId.size > 0) {
-        const nodeByFindingId = new Map();
-        for (const [index, node] of nodes.entries()) {
-            const nodeId = ensureNodeId(node.id, index);
-            for (const findingId of canonicalItemsByNodeId.get(nodeId) ?? []) {
-                nodeByFindingId.set(findingId, node);
-            }
+    const issues = [];
+    for (const path of paths) {
+        try {
+            const relative = repoRelativePath(root, path, label);
+            const target = resolve(root, relative);
+            if (!existsSync(target) && !(await stat(dirname(target))).isDirectory())
+                issues.push(`${label}: parent directory for ${path} does not exist.`);
         }
-        findings = [...approvedSource.findings]
-            .sort((left, right) => compareCodeUnits(left.id, right.id))
-            .map((finding) => {
-            const node = nodeByFindingId.get(finding.id);
-            const contractObligations = [...new Set(node.satisfies_obligations ?? [])];
-            const verificationObligations = [
-                ...new Set(node.verification_obligation_ids ?? []),
-            ];
-            return {
-                ...finding,
-                affected_files: [...finding.affected_files].sort((left, right) => compareCodeUnits(left.path, right.path)),
-                contract_goal_id: dag?.goal_id,
-                contract_obligation_ids: contractObligations,
-                verification_obligation_ids: verificationObligations,
-                targeted_commands: [...(node.targeted_commands ?? [])],
-                // The source finding stays intact; its node instructions travel on the block.
-            };
-        });
-    }
-    // finding_id → { obligation_ids, node_ids } trace. Each promoted finding maps
-    // 1:1 to a DAG node, so its node_ids are itself plus every node it depends on
-    // (the upstream nodes whose output it builds on). obligation_ids unions the
-    // satisfied and verification obligations. This is the auditable backward trace
-    // from a remediation finding to the contract obligations it discharges.
-    const nodeIdSet = new Set(nodes.map((n, i) => ensureNodeId(n.id, i)));
-    const traceability = {};
-    for (const [index, node] of nodes.entries()) {
-        const id = ensureNodeId(node.id, index);
-        const obligationIds = [
-            ...new Set([
-                ...(node.satisfies_obligations ?? []),
-                ...(node.verification_obligation_ids ?? []),
-            ]),
-        ];
-        const dependsOn = (node.depends_on ?? []).filter((dep) => nodeIdSet.has(dep));
-        const nodeIds = [...new Set([id, ...dependsOn])];
-        const findingIds = canonicalItemsByNodeId.get(id) ?? [id];
-        for (const findingId of findingIds) {
-            traceability[findingId] = {
-                obligation_ids: obligationIds,
-                node_ids: nodeIds,
-            };
+        catch {
+            issues.push(`${label}: invalid/unavailable write path ${path}.`);
         }
     }
-    const counterexamplePayload = envelopePayload(await readContractArtifact(artifactsDir, "counterexample"));
-    const counterexampleEntries = isRecord(counterexamplePayload) && Array.isArray(counterexamplePayload.counterexamples)
-        ? counterexamplePayload.counterexamples.map(entry => CounterexampleSchema.parse(entry)) : [];
-    const counterexamplesById = new Map(counterexampleEntries.map(entry => [entry.id, entry]));
-    const blocks = nodes.map((node, index) => {
-        const nodeId = ensureNodeId(node.id, index);
-        const deps = (node.depends_on ?? []).map((depId) => toBlockId(depId));
-        // Same derivation as the finding's affected_files: declared write scope, else
-        // the module file_scope inherited via the node's obligations — so the block's
-        // file-ownership scheduler never sees an empty (undispatchable) touched set.
-        // Normalized before it leaves this producer: the host-handoff substrate binds
-        // this list as the write scope and can validate its shape but never its
-        // correctness.
-        // Refusals are collected, not thrown: `collectDagWriteScopeRefusals` runs
-        // these same two normalizers at the promotion gate and re-emits, so by the
-        // time promotion runs there is nothing left to refuse. The throw below is a
-        // BACKSTOP for a caller that skipped that gate — never the operator-facing
-        // path.
-        //
-        // "Nothing left to refuse" is now TRUE BY CONSTRUCTION, not by hope: the
-        // command half asks the ONE shared `commandLeavesDeclaredShape` predicate
-        // that the host-handoff consumer asks, so a command this gate admits cannot
-        // be refused downstream (and vice versa). It used to be a claim about two
-        // independent implementations that disagreed in both directions.
-        const scope = normalizeBlockTouchedFiles(root, deriveNodeFiles(node), toBlockId(nodeId));
-        const commands = normalizeBlockTargetedCommands(node.targeted_commands ?? [], toBlockId(nodeId));
-        const refusals = [...scope.refusals, ...commands.refusals];
-        if (refusals.length > 0) {
-            throw new Error(`implementation_dag node "${nodeId}" has an unpromotable write scope, which the ` +
-                `promotion gate should have refused first: ${refusals.join(" | ")}`);
-        }
-        const touchedFiles = scope.touched_files;
-        const targetedCommands = commands.targeted_commands;
-        // Phase ordinal from the union of this node's obligations (max → fail-toward-
-        // later). Only stamped when there is a genuine multi-phase cut, so a single-
-        // phase change carries no ordinal and the scheduler runs no barrier.
-        const phaseOrdinal = hasMultiPhase
-            ? phaseOrdinalForObligations([
-                ...(node.satisfies_obligations ?? []),
-                ...(node.verification_obligation_ids ?? []),
-            ], slugToOrdinal, lastOrdinal)
-            : undefined;
-        const blockModuleContracts = moduleContractsForNode(node);
-        const counterexamples = [...new Set(node.addresses_counterexamples ?? [])].map(id => {
-            const entry = counterexamplesById.get(id);
-            if (!entry)
-                throw new Error(`Implementation node ${nodeId} names missing counterexample ${id}; repair the upstream counterexample binding.`);
-            return entry;
-        });
-        const implementationContext = ImplementationContextSchema.parse({
-            ...(approvedSource && node.description ? { description: node.description } : {}),
-            ...(node.preconditions !== undefined ? { preconditions: node.preconditions } : {}),
-            ...(node.expected_changes !== undefined ? { expected_changes: node.expected_changes } : {}),
-            ...(counterexamples.length > 0 ? { counterexamples } : {}),
-        });
-        return {
-            block_id: toBlockId(nodeId),
-            items: canonicalItemsByNodeId.get(nodeId) ?? [nodeId],
-            ...(Object.keys(implementationContext).length > 0 ? { implementation_context: implementationContext } : {}),
-            // INV-remediate-pipeline-02: a block with prerequisites is never
-            // wave-dispatched as independent — parallel_safe derives from depends_on.
-            parallel_safe: deps.length === 0,
-            dependencies: deps,
-            // touched_files is REQUIRED on the block contract; promote the node's
-            // declared write scope so the file-ownership scheduler can read it.
-            touched_files: touchedFiles,
-            ...(phaseOrdinal !== undefined ? { phase_ordinal: phaseOrdinal } : {}),
-            ...(targetedCommands.length > 0 ? { targeted_commands: targetedCommands } : {}),
-            ...(blockModuleContracts.length > 0
-                ? { module_contracts: blockModuleContracts }
-                : {}),
-        };
-    });
-    // Detected at the confirm step and persisted, never chosen: the candidates
-    // the host picks from (owner decision 92b0e2dd7cfdc06d). Planning reads the
-    // artifact and spawns nothing (the backend-independent planning contract).
-    const facts = (await readProjectFacts(artifactsDir)) ?? neutralProjectFacts();
-    const extractedPlan = {
-        plan_id: dag?.goal_id ?? `CP-PLAN-${Date.now()}`,
-        goal_id: dag?.goal_id,
-        findings,
-        blocks,
-        // finding_id → { obligation_ids, node_ids } backward trace.
-        traceability,
-        project_type: facts.project_type,
-        candidate_closing_actions: facts.candidate_closing_actions,
-        source: "contract_pipeline",
-    };
-    await writeJsonFile(paths.extractedPlan, extractedPlan);
+    return issues;
 }
 //# sourceMappingURL=contractPipeline.js.map