chati-dev 4.5.16 → 4.5.28

package/node_modules/@chati/rail/src/index.js

@@ -1,8 +1,14 @@
-import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
-import { dirname } from 'node:path';
+import {
+  closeSync, constants, existsSync, fstatSync, fsyncSync, ftruncateSync, lstatSync, mkdirSync,
+  openSync, readSync, renameSync, unlinkSync, writeSync,
+} from 'node:fs';
+import { hostname } from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { basename, dirname, join, parse, resolve, sep } from 'node:path';
 import { ContractError, canonicalize, sha256 } from '@chati/core';
 import { createAttemptBinding, validateAttemptBinding, verifyLocalGitCommit } from '@chati/planning';
-import { acceptReview, decideReviewProgress } from '@chati/review-council';
+import { acceptReview, decideReviewProgress, selectCanonicalReviewer, validateAdjudicationDecision } from '@chati/review-council';
 
 const RFC3339 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
 const TASK_CLOSED_STATES = new Set(['merged', 'blocked', 'cancelled']);
@@ -10,11 +16,40 @@ const EXECUTABLE_ATTEMPT_STATE = 'active';
 const REVIEW_DECISIONS = new Set(['accept', 'normal-rework', 'AI_ADJUDICATION', 'blocked', 'required-human-decision']);
 const LOCK_RETRIES = 50;
 const LOCK_WAIT = new Int32Array(new SharedArrayBuffer(4));
+const LOCK_STALE_AFTER_MS = 30_000;
+const JOURNAL_MAX_BYTES = 64 * 1024 * 1024;
+const JOURNAL_RECORD_MAX_BYTES = 4 * 1024 * 1024;
+const RAIL_SECURITY_TEST_HOOKS = Symbol.for('chati.rail.security-test-hooks');
+const BROWSER_ARTIFACT_KINDS = new Set(['screenshot', 'dom', 'network', 'trace', 'download', 'console']);
+const BROWSER_EVIDENCE_KEYS = new Set([
+  'schema_version', 'manifest_type', 'evidence_class', 'browser_session_id', 'task_id',
+  'policy_ref', 'tool', 'allowed_domain', 'classification', 'commit_ref',
+  'delegation_manifest_hash', 'observed_at', 'artifacts', 'evidence_ref', 'authority_receipt',
+  'tenant_ref',
+]);
+const BROWSER_ARTIFACT_KEYS = new Set([
+  'artifact_id', 'kind', 'sanitized_ref', 'redaction_status', 'retention_class', 'content_sha256',
+]);
+
+function runSecurityTestHook(name, detail) {
+  const hook = globalThis[RAIL_SECURITY_TEST_HOOKS]?.[name];
+  if (typeof hook === 'function') hook(detail);
+}
 
 function fail(code, message, details = {}) {
   throw new ContractError(code, message, details);
 }
 
+function trustedGitEnvironment(source = process.env) {
+  const environment = Object.fromEntries(Object.entries(source).filter(([key]) => !key.startsWith('GIT_')));
+  return {
+    ...environment,
+    GIT_CONFIG_NOSYSTEM: '1',
+    GIT_CONFIG_GLOBAL: process.platform === 'win32' ? 'NUL' : '/dev/null',
+    GIT_TERMINAL_PROMPT: '0',
+  };
+}
+
 function assertObject(value, code, label) {
   if (!value || typeof value !== 'object' || Array.isArray(value)) fail(code, `${label} must be an object`);
 }
@@ -29,6 +64,197 @@ function assertStringArray(value, code, label, { allowEmpty = true } = {}) {
   }
 }
 
+function assertAllowedKeys(value, allowed, code, label) {
+  if (Object.keys(value).some((key) => !allowed.has(key))) fail(code, `${label} contains unsupported fields`);
+}
+
+export function browserEvidenceMaterial(evidence = {}) {
+  return canonicalize({
+    schema_version: evidence.schema_version,
+    manifest_type: evidence.manifest_type,
+    evidence_class: evidence.evidence_class,
+    browser_session_id: evidence.browser_session_id,
+    task_id: evidence.task_id,
+    policy_ref: evidence.policy_ref,
+    tool: evidence.tool,
+    allowed_domain: evidence.allowed_domain,
+    classification: evidence.classification,
+    commit_ref: evidence.commit_ref,
+    delegation_manifest_hash: evidence.delegation_manifest_hash,
+    observed_at: evidence.observed_at,
+    artifacts: evidence.artifacts,
+    ...(evidence.tenant_ref === undefined ? {} : { tenant_ref: evidence.tenant_ref }),
+  });
+}
+
+function validateRealBrowserEvidence({
+  evidence, task, attemptId, commitRef, acceptanceEvidenceRefs, delegationManifest, verifyAuthority,
+}) {
+  assertObject(evidence, 'REAL_BROWSER_EVIDENCE_REQUIRED', 'browser_evidence');
+  assertAllowedKeys(evidence, BROWSER_EVIDENCE_KEYS, 'INVALID_BROWSER_EVIDENCE', 'browser_evidence');
+  if (evidence.schema_version !== 1
+    || evidence.manifest_type !== 'BrowserRuntimeEvidenceManifest'
+    || evidence.evidence_class !== 'real-browser') {
+    fail('REAL_BROWSER_EVIDENCE_REQUIRED', 'browser completion requires evidence classified as real-browser, not delegation or simulation');
+  }
+  for (const field of [
+    'browser_session_id', 'task_id', 'policy_ref', 'tool', 'allowed_domain', 'classification',
+    'commit_ref', 'delegation_manifest_hash', 'observed_at', 'evidence_ref',
+  ]) assertString(evidence[field], 'INVALID_BROWSER_EVIDENCE', `browser_evidence.${field}`);
+  if (!RFC3339.test(evidence.observed_at) || Number.isNaN(Date.parse(evidence.observed_at))) {
+    fail('INVALID_BROWSER_EVIDENCE', 'browser_evidence.observed_at must be RFC3339');
+  }
+  if (!Array.isArray(evidence.artifacts) || evidence.artifacts.length === 0) {
+    fail('REAL_BROWSER_ARTIFACT_REQUIRED', 'real browser evidence requires at least one redacted artifact');
+  }
+  const artifactIds = new Set();
+  for (const artifact of evidence.artifacts) {
+    assertObject(artifact, 'INVALID_BROWSER_EVIDENCE', 'browser artifact');
+    if (Object.keys(artifact).length !== BROWSER_ARTIFACT_KEYS.size) {
+      fail('INVALID_BROWSER_EVIDENCE', 'browser artifact has an invalid closed schema');
+    }
+    assertAllowedKeys(artifact, BROWSER_ARTIFACT_KEYS, 'INVALID_BROWSER_EVIDENCE', 'browser artifact');
+    for (const field of ['artifact_id', 'kind', 'sanitized_ref', 'redaction_status', 'retention_class', 'content_sha256']) {
+      assertString(artifact[field], 'INVALID_BROWSER_EVIDENCE', `browser artifact.${field}`);
+    }
+    if (!BROWSER_ARTIFACT_KINDS.has(artifact.kind)
+      || artifact.redaction_status !== 'redacted'
+      || artifact.retention_class !== task.browser_policy.artifact_policy.retention_class
+      || !/^[a-f0-9]{64}$/.test(artifact.content_sha256)
+      || artifactIds.has(artifact.artifact_id)) {
+      fail('INVALID_BROWSER_EVIDENCE', 'browser artifact kind, redaction, retention, digest, and identity must be valid');
+    }
+    artifactIds.add(artifact.artifact_id);
+    if (!acceptanceEvidenceRefs.includes(artifact.sanitized_ref)) {
+      fail('BROWSER_ARTIFACT_NOT_ACCEPTED', 'every real browser artifact must be present in acceptance_evidence_refs');
+    }
+  }
+  assertObject(delegationManifest, 'BROWSER_DELEGATION_EVIDENCE_REQUIRED', 'browser delegation manifest');
+  const delegationCore = { ...delegationManifest };
+  delete delegationCore.manifest_hash;
+  if (delegationManifest.manifest_type !== 'BrowserDelegationManifest'
+    || delegationManifest.evidence_class !== 'delegation-only'
+    || delegationManifest.delegation?.status !== 'delegated'
+    || delegationManifest.delegation?.evidence_status !== 'required'
+    || delegationManifest.manifest_hash !== sha256(delegationCore)) {
+    fail('INVALID_BROWSER_DELEGATION_EVIDENCE', 'browser evidence requires the exact canonical delegated browser manifest');
+  }
+  const policy = task.browser_policy;
+  if (evidence.task_id !== task.task_id
+    || evidence.task_id !== delegationManifest.task_id
+    || evidence.browser_session_id !== delegationManifest.browser_session_id
+    || evidence.policy_ref !== policy.policy_id
+    || evidence.policy_ref !== delegationManifest.policy_ref
+    || evidence.tool !== policy.tool
+    || evidence.tool !== delegationManifest.tool
+    || evidence.allowed_domain !== delegationManifest.allowed_domain
+    || evidence.classification !== delegationManifest.classification
+    || evidence.commit_ref !== commitRef
+    || evidence.delegation_manifest_hash !== delegationManifest.manifest_hash
+    || (delegationManifest.tenant_ref ?? null) !== (evidence.tenant_ref ?? null)) {
+    fail('BROWSER_EVIDENCE_BINDING_MISMATCH', 'real browser evidence is not bound to the task, delegation, project data class, and result commit');
+  }
+  const material = browserEvidenceMaterial(evidence);
+  const evidenceRef = `browser-evidence://sha256/${sha256(material)}`;
+  if (evidence.evidence_ref !== evidenceRef || !acceptanceEvidenceRefs.includes(evidenceRef)) {
+    fail('BROWSER_EVIDENCE_REF_MISMATCH', 'real browser evidence must use its content-addressed acceptance reference');
+  }
+  assertObject(evidence.authority_receipt, 'UNTRUSTED_BROWSER_EVIDENCE', 'browser_evidence.authority_receipt');
+  verifyAuthority(evidence.authority_receipt, {
+    purpose: 'rail_evidence', authority_kind: 'rail_browser', attempt_id: attemptId,
+    commit_ref: commitRef, verdict: 'passed', evidence_digest: sha256(material),
+    observed_at: evidence.observed_at,
+  });
+  return canonicalize(evidence);
+}
+
+function parseAdjudicationOutput(text) {
+  if (typeof text !== 'string') fail('INVALID_ADJUDICATION_RECORD', 'adjudication_output must be a string');
+  const matches = [...text.matchAll(/<CHATI_RAIL_ADJUDICATION>\s*([\s\S]*?)\s*<\/CHATI_RAIL_ADJUDICATION>/g)];
+  if (matches.length !== 1) fail('INVALID_ADJUDICATION_RECORD', 'adjudication_output must contain exactly one envelope');
+  try { return validateAdjudicationDecision(JSON.parse(matches[0][1])); }
+  catch (error) { return fail(error.code || 'INVALID_ADJUDICATION_RECORD', error.message); }
+}
+
+export function deriveAdjudicationConsensus({ handoff_id, attempt_id, evidence }) {
+  if (!adjudicationEntriesAgree(evidence)) {
+    fail('ADJUDICATION_CONSENSUS_MISMATCH', 'adjudicators must agree on both the outcome and its substantive correction material');
+  }
+  const digest = sha256(evidence.map((entry) => ({ invocation: entry.invocation, decision: entry.decision })));
+  const outcome = evidence[0].decision.outcome;
+  const decision_ref = `rail-adjudication-consensus://${handoff_id}/${attempt_id}/${digest.slice(0, 24)}`;
+  if (outcome === 'bounded-correction') {
+    return validateAdjudicationDecision({ outcome, decision_ref, correction_ref: `rail-adjudication-correction://${handoff_id}/${attempt_id}/${digest.slice(0, 24)}` });
+  }
+  if (outcome === 'handoff-revision') {
+    return validateAdjudicationDecision({ outcome, decision_ref, handoff_revision_ref: `rail-handoff-revision://${handoff_id}/${attempt_id}/${digest.slice(0, 24)}` });
+  }
+  return validateAdjudicationDecision({
+    outcome, decision_ref, authority_reason: evidence[0].decision.authority_reason,
+    authority_reason_ref: `rail-adjudication-authority://${handoff_id}/${attempt_id}/${digest.slice(0, 24)}`,
+  });
+}
+
+export function adjudicationEntriesAgree(entries) {
+  if (entries.length === 0) return false;
+  const outcome = entries[0].decision.outcome;
+  if (!entries.every((entry) => entry.decision.outcome === outcome)) return false;
+  const substantiveField = {
+    'bounded-correction': 'correction_ref',
+    'handoff-revision': 'handoff_revision_ref',
+    'blocked-authority': 'authority_reason',
+  }[outcome];
+  if (!substantiveField) return false;
+  return entries.every((entry) => entry.decision[substantiveField] === entries[0].decision[substantiveField]);
+}
+
+export function adjudicationAttemptState(decision) {
+  if (decision?.outcome === 'handoff-revision') return 'cancelled';
+  if (decision?.outcome === 'blocked-authority') return 'blocked';
+  return 'active';
+}
+
+function unresolvedAdjudication(records, attemptId) {
+  const latestControl = records.filter((record) => ['review_decided', 'adjudication_decided'].includes(record.type)
+    && record.payload?.attempt_id === attemptId).at(-1);
+  return latestControl?.type === 'review_decided'
+    && latestControl.payload?.decision?.decision === 'AI_ADJUDICATION'
+    ? latestControl
+    : null;
+}
+
+function adjudicationRoundState(records, attemptId, reviewRef, selected) {
+  const observations = records
+    .filter((record) => record.type === 'adjudication_observed'
+      && record.payload?.attempt_id === attemptId
+      && record.payload?.review_ref === reviewRef)
+    .map((record) => record.payload.observation);
+  const orderedRound = (round) => selected.map((candidate) => observations.find((entry) =>
+    entry.round === round
+    && entry.invocation.provider_id === candidate.provider_id
+    && entry.invocation.harness_id === candidate.harness_id
+    && sha256(entry.invocation.model_pin) === sha256(candidate.model_pin))).filter(Boolean);
+  const roundOne = orderedRound(1);
+  const roundTwo = orderedRound(2);
+  if (roundOne.length < selected.length) {
+    return { round: 1, observations, current: roundOne, prior_decisions: [], complete: false };
+  }
+  if (adjudicationEntriesAgree(roundOne)) {
+    return { round: 1, observations, current: roundOne, prior_decisions: [], complete: true };
+  }
+  const prior_decisions = roundOne.map((entry, index) => canonicalize({
+    anonymous_ref: `independent-decision-${index + 1}`,
+    decision: entry.decision,
+  }));
+  return {
+    round: 2,
+    observations,
+    current: roundTwo,
+    prior_decisions,
+    complete: roundTwo.length === selected.length,
+  };
+}
+
 function timestamp(clock) {
   if (typeof clock !== 'function') fail('MISSING_CLOCK', 'a deterministic clock function is required');
   const value = clock();
@@ -52,60 +278,350 @@ function stableEventId(sequence, event) {
 function checkpointPath(journalPath) { return `${journalPath}.checkpoint`; }
 function lockPath(journalPath) { return `${journalPath}.lock`; }
 
-function parseJournal(journalPath) {
-  if (!existsSync(journalPath)) return [];
-  const lines = readFileSync(journalPath, 'utf8').split('\n').filter(Boolean);
+function ensureSafeDirectory(path, { create = false } = {}) {
+  const absolute = resolve(path);
+  const root = parse(absolute).root;
+  let current = root;
+  for (const segment of absolute.slice(root.length).split(sep).filter(Boolean)) {
+    current = resolve(current, segment);
+    let stat;
+    try { stat = lstatSync(current); }
+    catch (error) {
+      if (error?.code !== 'ENOENT' || !create) throw error;
+      try { mkdirSync(current, { mode: 0o700 }); }
+      catch (mkdirError) { if (mkdirError?.code !== 'EEXIST') throw mkdirError; }
+      stat = lstatSync(current);
+    }
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+      fail('UNSAFE_JOURNAL_DIRECTORY', 'journal directory chain must contain only real directories', { path: current });
+    }
+  }
+  return absolute;
+}
+
+function openDirectoryForSync(path, { create = false } = {}) {
+  const absolute = resolve(path);
+  if (process.platform === 'linux') {
+    const root = parse(absolute).root;
+    const segments = absolute.slice(root.length).split(sep).filter(Boolean);
+    let fd = openSync(root, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+    try {
+      for (const segment of segments) {
+        const childPath = join(`/proc/self/fd/${fd}`, segment);
+        let childFd;
+        try {
+          childFd = openSync(childPath, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+        } catch (error) {
+          if (error?.code !== 'ENOENT' || !create) {
+            if (['ELOOP', 'ENOTDIR'].includes(error?.code)) {
+              fail('UNSAFE_JOURNAL_DIRECTORY', 'journal directory chain must contain only real directories');
+            }
+            throw error;
+          }
+          try { mkdirSync(childPath, { mode: 0o700 }); }
+          catch (mkdirError) { if (mkdirError?.code !== 'EEXIST') throw mkdirError; }
+          childFd = openSync(childPath, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+        }
+        const childStat = fstatSync(childFd);
+        if (!childStat.isDirectory()) {
+          closeSync(childFd);
+          fail('UNSAFE_JOURNAL_DIRECTORY', 'journal directory chain must contain only real directories');
+        }
+        closeSync(fd);
+        fd = childFd;
+      }
+      return { fd, path: absolute, stat: fstatSync(fd), reference: `/proc/self/fd/${fd}` };
+    } catch (error) {
+      closeSync(fd);
+      throw error;
+    }
+  }
+  const safePath = ensureSafeDirectory(absolute, { create });
+  const fd = openSync(safePath, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+  const stat = fstatSync(fd);
+  if (!stat.isDirectory()) { closeSync(fd); fail('UNSAFE_JOURNAL_DIRECTORY', 'journal parent must be a directory'); }
+  return { fd, path: safePath, stat, reference: safePath };
+}
+
+function sameIdentity(left, right) {
+  return left?.dev === right?.dev && left?.ino === right?.ino;
+}
+
+function sameSnapshot(left, right) {
+  return sameIdentity(left, right)
+    && left?.mode === right?.mode
+    && left?.uid === right?.uid
+    && left?.gid === right?.gid
+    && left?.nlink === right?.nlink
+    && left?.size === right?.size
+    && left?.mtimeMs === right?.mtimeMs
+    && left?.ctimeMs === right?.ctimeMs;
+}
+
+function readDescriptorBounded(fd, maxBytes, code, label) {
+  const chunks = [];
+  const buffer = Buffer.allocUnsafe(64 * 1024);
+  let total = 0;
+  while (total <= maxBytes) {
+    const wanted = Math.min(buffer.length, (maxBytes + 1) - total);
+    const bytesRead = readSync(fd, buffer, 0, wanted, null);
+    if (bytesRead === 0) break;
+    chunks.push(Buffer.from(buffer.subarray(0, bytesRead)));
+    total += bytesRead;
+  }
+  if (total > maxBytes) fail(code, `${label} exceeds its safety limit`);
+  return Buffer.concat(chunks, total).toString('utf8');
+}
+
+function readRegularBoundedRecord(path, { allowMissing = false, label = 'journal', maxBytes = JOURNAL_MAX_BYTES } = {}) {
+  let fd;
+  try {
+    fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+  } catch (error) {
+    if (allowMissing && error?.code === 'ENOENT') return null;
+    if (['ELOOP', 'ENXIO', 'EISDIR'].includes(error?.code)) fail('UNSAFE_JOURNAL_FILE', `${label} must not be a symlink, FIFO or directory`);
+    throw error;
+  }
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.nlink !== 1) fail('UNSAFE_JOURNAL_FILE', `${label} must be a regular single-link file`);
+    if (stat.size > maxBytes) fail('JOURNAL_SIZE_LIMIT', `${label} exceeds its safety limit`);
+    runSecurityTestHook('afterJournalStateStat', { path, label, fd });
+    const content = readDescriptorBounded(fd, maxBytes, 'JOURNAL_SIZE_LIMIT', label);
+    const after = fstatSync(fd);
+    if (!sameSnapshot(stat, after)) fail('JOURNAL_STORAGE_CONFLICT', `${label} changed while it was read`);
+    return { content, stat: after };
+  } finally { closeSync(fd); }
+}
+
+function readRegularBounded(path, options) {
+  return readRegularBoundedRecord(path, options)?.content ?? null;
+}
+
+function processIsAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; } catch (error) { return error?.code === 'EPERM'; }
+}
+
+function readLockOwner(path) {
+  try {
+    const raw = readRegularBounded(path, { allowMissing: true, label: 'journal lock', maxBytes: 16 * 1024 });
+    if (raw === null) return null;
+    const owner = JSON.parse(raw);
+    if (!owner || typeof owner !== 'object' || typeof owner.token !== 'string') return null;
+    return owner;
+  } catch { return null; }
+}
+
+function recoverStaleLock(path) {
+  let stat;
+  try { stat = lstatSync(path); } catch (error) { return error?.code === 'ENOENT'; }
+  if (stat.isSymbolicLink() || !stat.isFile() || stat.nlink !== 1) return false;
+  const owner = readLockOwner(path);
+  const sameHostOwnerAlive = owner?.hostname === hostname() && processIsAlive(owner.pid);
+  if (sameHostOwnerAlive) return false;
+  // Cross-host liveness cannot be proven from a local PID namespace. Remote
+  // locks are never stolen automatically; an operator must reconcile/remove
+  // them after proving the owner is gone.
+  if (owner?.hostname && owner.hostname !== hostname()) return false;
+  if (!owner && Date.now() - stat.mtimeMs < LOCK_STALE_AFTER_MS) return false;
+  const recoveryPath = `${path}.recovery`;
+  let recoveryFd;
+  try {
+    recoveryFd = openSync(recoveryPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    const recoveryBytes = Buffer.from(JSON.stringify({ pid: process.pid, hostname: hostname(), token: randomUUID() }));
+    writeSync(recoveryFd, recoveryBytes, 0, recoveryBytes.length);
+    fsyncSync(recoveryFd);
+  } catch {
+    if (recoveryFd !== undefined) closeSync(recoveryFd);
+    return false;
+  }
+  const quarantine = `${path}.stale.${process.pid}.${Date.now()}`;
+  try {
+    const current = lstatSync(path);
+    const currentOwner = readLockOwner(path);
+    if (!sameIdentity(stat, current) || currentOwner?.token !== owner?.token) return false;
+    renameSync(path, quarantine);
+    const quarantined = lstatSync(quarantine);
+    const quarantinedOwner = readLockOwner(quarantine);
+    if (!sameIdentity(stat, quarantined) || quarantinedOwner?.token !== owner?.token) {
+      try { if (!existsSync(path)) renameSync(quarantine, path); } catch { /* preserve quarantine fail-closed */ }
+      return false;
+    }
+    unlinkSync(quarantine);
+    return true;
+  } catch (error) {
+    if (error?.code === 'ENOENT') return true;
+    return false;
+  } finally {
+    if (recoveryFd !== undefined) closeSync(recoveryFd);
+    try { unlinkSync(recoveryPath); } catch { /* fail closed if another process changed it */ }
+  }
+}
+
+function parseJournal(journalPath, { repair = false, directory = null } = {}) {
+  if (!directory) ensureSafeDirectory(dirname(journalPath));
+  const activeJournalPath = directory
+    ? join(directory.reference, basename(journalPath))
+    : journalPath;
+  const journal = readRegularBoundedRecord(activeJournalPath, { allowMissing: true });
+  const rawJournal = journal?.content ?? null;
+  const raw = rawJournal ?? '';
+  const hasTail = Boolean(raw && !raw.endsWith('\n'));
+  const completeJournal = hasTail ? raw.slice(0, raw.lastIndexOf('\n') + 1) : raw;
+  const lines = completeJournal.split('\n').filter(Boolean);
   const records = [];
   let previous_hash = 'GENESIS';
-  for (const [index, line] of lines.entries()) {
+  const parseRecord = (line, index, priorHash) => {
     let record;
     try { record = JSON.parse(line); } catch { fail('JOURNAL_CORRUPT', 'journal contains malformed JSONL', { line: index + 1 }); }
     assertObject(record, 'JOURNAL_CORRUPT', 'journal record');
     const { record_hash, chain_hash, previous_hash: record_previous_hash, ...material } = record;
     assertString(record_hash, 'JOURNAL_CORRUPT', 'record_hash');
     assertString(chain_hash, 'JOURNAL_CORRUPT', 'chain_hash');
-    if (record_previous_hash !== previous_hash) fail('JOURNAL_CHAIN_MISMATCH', 'journal previous hash does not match prior record', { event_id: record.event_id });
+    if (record_previous_hash !== priorHash) fail('JOURNAL_CHAIN_MISMATCH', 'journal previous hash does not match prior record', { event_id: record.event_id });
     if (sha256(material) !== record_hash) fail('JOURNAL_INTEGRITY_MISMATCH', 'journal record hash does not match material', { event_id: record.event_id });
-    if (sha256({ previous_hash, record_hash }) !== chain_hash) fail('JOURNAL_CHAIN_MISMATCH', 'journal chain hash does not match record', { event_id: record.event_id });
-    previous_hash = chain_hash;
-    records.push(Object.freeze(canonicalize(record)));
-  }
-  const checkpointFile = checkpointPath(journalPath);
-  if (existsSync(checkpointFile)) {
-    let checkpoint;
-    try { checkpoint = JSON.parse(readFileSync(checkpointFile, 'utf8')); } catch { fail('JOURNAL_CHECKPOINT_CORRUPT', 'journal checkpoint is malformed'); }
+    if (sha256({ previous_hash: priorHash, record_hash }) !== chain_hash) fail('JOURNAL_CHAIN_MISMATCH', 'journal chain hash does not match record', { event_id: record.event_id });
+    return Object.freeze(canonicalize(record));
+  };
+  for (const [index, line] of lines.entries()) {
+    const record = parseRecord(line, index, previous_hash);
+    previous_hash = record.chain_hash;
+    records.push(record);
+  }
+  const tail = hasTail ? raw.slice(raw.lastIndexOf('\n') + 1) : null;
+  let completeTail = false;
+  if (tail !== null) {
+    try {
+      const record = parseRecord(tail, records.length, previous_hash);
+      previous_hash = record.chain_hash;
+      records.push(record);
+      completeTail = true;
+    } catch { /* the durable checkpoint decides whether partial bytes are repairable */ }
+  }
+  const checkpointFile = directory
+    ? join(directory.reference, basename(checkpointPath(journalPath)))
+    : checkpointPath(journalPath);
+  const rawCheckpoint = readRegularBounded(checkpointFile, {
+    allowMissing: true, label: 'journal checkpoint', maxBytes: JOURNAL_RECORD_MAX_BYTES,
+  });
+  let checkpoint = null;
+  let validCommittedState = false;
+  let validPendingState = false;
+  if (rawCheckpoint !== null) {
+    try { checkpoint = JSON.parse(rawCheckpoint); } catch { fail('JOURNAL_CHECKPOINT_CORRUPT', 'journal checkpoint is malformed'); }
     assertObject(checkpoint, 'JOURNAL_CHECKPOINT_CORRUPT', 'journal checkpoint');
-    if (checkpoint.schema_version !== 1 || checkpoint.record_count !== records.length || checkpoint.chain_hash !== previous_hash || checkpoint.last_event_id !== records.at(-1)?.event_id) {
-      fail('JOURNAL_TRUNCATION_DETECTED', 'journal does not match its persisted checkpoint');
+    const currentAnchor = {
+      record_count: records.length,
+      chain_hash: previous_hash,
+      last_event_id: records.at(-1)?.event_id ?? null,
+    };
+    const matches = (anchor) => Boolean(anchor
+      && anchor.record_count === currentAnchor.record_count
+      && anchor.chain_hash === currentAnchor.chain_hash
+      && (anchor.last_event_id ?? null) === currentAnchor.last_event_id);
+    if (checkpoint.schema_version === 1) {
+      if (!matches(checkpoint)) fail('JOURNAL_TRUNCATION_DETECTED', 'journal does not match its persisted checkpoint');
+      validCommittedState = true;
+    } else if (checkpoint.schema_version === 2) {
+      assertObject(checkpoint.committed, 'JOURNAL_CHECKPOINT_CORRUPT', 'journal checkpoint committed anchor');
+      validCommittedState = matches(checkpoint.committed);
+      validPendingState = checkpoint.pending !== null && matches(checkpoint.pending);
+      if (!validCommittedState && !validPendingState) {
+        fail('JOURNAL_TRUNCATION_DETECTED', 'journal does not match either durable checkpoint state');
+      }
+    } else {
+      fail('JOURNAL_CHECKPOINT_CORRUPT', 'journal checkpoint schema is unsupported');
+    }
+  }
+  const incompleteTail = tail !== null && !completeTail;
+  const missingDelimiter = tail !== null && completeTail;
+  if (checkpoint === null && (incompleteTail || missingDelimiter)) {
+    fail('JOURNAL_CORRUPT', 'journal contains an uncheckpointed trailing record');
+  }
+  const safeIncompleteTail = incompleteTail && validCommittedState
+    && checkpoint?.schema_version === 2 && checkpoint.pending !== null;
+  if (incompleteTail && !safeIncompleteTail) {
+    fail('JOURNAL_TRUNCATION_DETECTED', 'journal was truncated below its durable high-water mark');
+  }
+  let identity = journal?.stat ?? null;
+  if ((safeIncompleteTail || missingDelimiter) && repair) {
+    const fd = openSync(activeJournalPath, constants.O_RDWR | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+    try {
+      const before = fstatSync(fd);
+      if (!before.isFile() || before.nlink !== 1) fail('UNSAFE_JOURNAL_FILE', 'journal must be a regular single-link file');
+      if (!sameSnapshot(before, journal.stat)) fail('JOURNAL_STORAGE_CONFLICT', 'journal changed between load and tail repair');
+      const expectedContent = safeIncompleteTail ? completeJournal : `${raw}\n`;
+      const repairedBytes = Buffer.byteLength(expectedContent);
+      if (safeIncompleteTail) {
+        ftruncateSync(fd, repairedBytes);
+      } else {
+        const newline = Buffer.from('\n');
+        const written = writeSync(fd, newline, 0, newline.length, before.size);
+        if (written !== newline.length) fail('JOURNAL_STORAGE_CONFLICT', 'journal delimiter repair was incomplete');
+      }
+      fsyncSync(fd);
+      const afterRepair = fstatSync(fd);
+      if (!sameIdentity(before, afterRepair)
+        || afterRepair.mode !== before.mode || afterRepair.uid !== before.uid || afterRepair.gid !== before.gid
+        || afterRepair.nlink !== before.nlink || afterRepair.size !== repairedBytes) {
+        fail('JOURNAL_STORAGE_CONFLICT', 'journal changed during tail repair');
+      }
+      const verifiedContent = readDescriptorBounded(fd, JOURNAL_MAX_BYTES, 'JOURNAL_SIZE_LIMIT', 'journal');
+      const afterRead = fstatSync(fd);
+      if (verifiedContent !== expectedContent || !sameSnapshot(afterRepair, afterRead)) {
+        fail('JOURNAL_STORAGE_CONFLICT', 'journal content changed during tail repair verification');
+      }
+      identity = afterRead;
+    } finally { closeSync(fd); }
+    if (directory) fsyncSync(directory.fd);
+    else {
+      const openedDirectory = openDirectoryForSync(dirname(journalPath));
+      try { fsyncSync(openedDirectory.fd); } finally { closeSync(openedDirectory.fd); }
     }
   }
-  return records;
+  if (rawJournal === null && checkpoint !== null && !validCommittedState && !validPendingState) {
+    fail('JOURNAL_TRUNCATION_DETECTED', 'journal file is missing below its durable high-water mark');
+  }
+  return { records, identity };
 }
 
 function isExpired(claim, now) {
   return Date.parse(claim.lease.expires_at) <= Date.parse(now);
 }
 
-function validateRecoveryReconciliation(reconciliation, attempt, effects, gitDir) {
-  assertObject(reconciliation, 'INVALID_RECOVERY', 'reconciliation');
-  if (reconciliation.status !== 'safe_to_resume') fail('RECOVERY_RECONCILIATION_REQUIRED', 'recovery requires safe_to_resume reconciliation');
-  for (const field of ['process', 'heartbeat', 'git', 'ci']) assertObject(reconciliation[field], 'RECOVERY_RECONCILIATION_REQUIRED', `reconciliation.${field}`);
-  if (reconciliation.process.status !== 'not_running') fail('RECOVERY_PROCESS_UNRESOLVED', 'recovery requires an observed non-running prior process');
-  assertStringArray(reconciliation.process.evidence_refs, 'RECOVERY_PROCESS_UNRESOLVED', 'reconciliation.process.evidence_refs', { allowEmpty: false });
-  if (reconciliation.heartbeat.status !== 'expired') fail('RECOVERY_HEARTBEAT_UNRESOLVED', 'recovery requires an expired heartbeat observation');
-  assertString(reconciliation.heartbeat.observed_at, 'RECOVERY_HEARTBEAT_UNRESOLVED', 'reconciliation.heartbeat.observed_at');
-  assertStringArray(reconciliation.heartbeat.evidence_refs, 'RECOVERY_HEARTBEAT_UNRESOLVED', 'reconciliation.heartbeat.evidence_refs', { allowEmpty: false });
-  if (reconciliation.git.status !== 'matched' || reconciliation.git.commit_ref !== attempt.git_commit_ref) fail('RECOVERY_GIT_UNRESOLVED', 'recovery Git reconciliation must match the bound commit');
-  assertStringArray(reconciliation.git.evidence_refs, 'RECOVERY_GIT_UNRESOLVED', 'reconciliation.git.evidence_refs', { allowEmpty: false });
-  verifyLocalGitCommit({ git_dir: gitDir, git_commit_ref: attempt.git_commit_ref });
-  if (!['not_started', 'passed', 'failed'].includes(reconciliation.ci.status)) fail('RECOVERY_CI_UNRESOLVED', 'recovery CI status must be explicit');
-  assertStringArray(reconciliation.ci.evidence_refs, 'RECOVERY_CI_UNRESOLVED', 'reconciliation.ci.evidence_refs', { allowEmpty: false });
-  if (!Array.isArray(reconciliation.effects)) fail('RECOVERY_EFFECTS_UNRESOLVED', 'recovery requires an effect reconciliation array');
-  const provided = new Map(reconciliation.effects.map((effect) => [effect?.idempotency_key, effect]));
-  for (const effect of effects) {
-    const item = provided.get(effect.idempotency_key);
-    if (!item || !['receipted', 'not_sent'].includes(item.status)) fail('RECOVERY_EFFECTS_UNRESOLVED', 'every prepared effect requires a resolved outcome', { idempotency_key: effect.idempotency_key });
-    if (effect.receipt_ref && (item.status !== 'receipted' || item.receipt_ref !== effect.receipt_ref)) fail('RECOVERY_EFFECTS_UNRESOLVED', 'receipt reconciliation does not match journal', { idempotency_key: effect.idempotency_key });
+function claimProcessPid(attempt) {
+  const match = /^process:\/\/chati\/(\d+)$/.exec(attempt.claim.harness_process_id || '');
+  if (!match) fail('RECOVERY_PROCESS_UNRESOLVED', 'claim process identity is not locally observable');
+  return Number(match[1]);
+}
+
+function observeStoppedClaimProcess(attempt) {
+  if (attempt.claim.hostname !== hostname()) {
+    fail('RECOVERY_REMOTE_PROCESS_UNVERIFIABLE', 'automatic recovery cannot prove a process stopped on another host');
+  }
+  const pid = claimProcessPid(attempt);
+  try {
+    process.kill(pid, 0);
+    fail('RECOVERY_PROCESS_STILL_RUNNING', 'the prior claim process is still running', { pid });
+  } catch (error) {
+    if (error?.code !== 'ESRCH') throw error;
+  }
+  return pid;
+}
+
+function verifyCommitDescendsFrom({ git_dir, base_commit_ref, result_commit_ref }) {
+  verifyLocalGitCommit({ git_dir, git_commit_ref: base_commit_ref });
+  verifyLocalGitCommit({ git_dir, git_commit_ref: result_commit_ref });
+  if (base_commit_ref === result_commit_ref) {
+    fail('GIT_RESULT_COMMIT_REQUIRED', 'result commit must differ from the sealed base commit');
+  }
+  try {
+    execFileSync('git', ['-C', git_dir, 'merge-base', '--is-ancestor', base_commit_ref, result_commit_ref], {
+      stdio: 'ignore', env: trustedGitEnvironment(),
+    });
+  } catch {
+    fail('GIT_RESULT_NOT_DESCENDANT', 'result commit must descend from the sealed base commit');
   }
 }
 
@@ -117,35 +633,94 @@ export class RailEngine {
   #journalPath;
   #clock;
   #records;
+  #activeDirectory;
+  #journalIdentity;
+  #authorityVerifier;
 
-  constructor({ journal_path, clock } = {}) {
+  constructor({ journal_path, clock, authority_verifier = null } = {}) {
     assertString(journal_path, 'INVALID_JOURNAL_PATH', 'journal_path');
     this.#journalPath = journal_path;
     this.#clock = clock;
-    this.#records = parseJournal(journal_path);
+    if (authority_verifier !== null && typeof authority_verifier !== 'function') {
+      fail('INVALID_RAIL_AUTHORITY_VERIFIER', 'authority_verifier must be a function');
+    }
+    this.#authorityVerifier = authority_verifier;
+    const loaded = parseJournal(journal_path);
+    this.#records = loaded.records;
+    this.#journalIdentity = loaded.identity;
   }
 
   get journalPath() { return this.#journalPath; }
   get records() { return Object.freeze([...this.#records]); }
 
-  #exclusive(action) {
-    mkdirSync(dirname(this.#journalPath), { recursive: true });
-    const path = lockPath(this.#journalPath);
-    let descriptor;
-    for (let retry = 0; retry < LOCK_RETRIES; retry += 1) {
-      try { descriptor = openSync(path, 'wx', 0o600); break; } catch (error) {
-        if (error?.code !== 'EEXIST') throw error;
-        // Wait briefly for the other local transaction, never steal its lock.
-        Atomics.wait(LOCK_WAIT, 0, 0, 2);
+  #verifyAuthority(kind, receipt, expected) {
+    if (!this.#authorityVerifier || this.#authorityVerifier({ kind, receipt, expected }) !== true) {
+      fail('UNTRUSTED_RAIL_AUTHORITY_RECEIPT', `${kind} requires a receipt from the configured terminal authority`);
+    }
+  }
+
+  #assertDirectoryStable() {
+    if (!this.#activeDirectory) fail('UNSAFE_JOURNAL_DIRECTORY', 'journal mutation requires a pinned parent directory');
+    let canonical;
+    try { canonical = openDirectoryForSync(this.#activeDirectory.path); }
+    catch { fail('UNSAFE_JOURNAL_DIRECTORY', 'journal directory chain changed during mutation'); }
+    try {
+      const pinned = fstatSync(this.#activeDirectory.fd);
+      if (!pinned.isDirectory() || !sameIdentity(pinned, this.#activeDirectory.stat)
+        || pinned.mode !== this.#activeDirectory.stat.mode
+        || pinned.uid !== this.#activeDirectory.stat.uid
+        || pinned.gid !== this.#activeDirectory.stat.gid
+        || !canonical.stat.isDirectory()
+        || !sameIdentity(canonical.stat, this.#activeDirectory.stat)) {
+        fail('UNSAFE_JOURNAL_DIRECTORY', 'journal parent changed during mutation');
       }
+    } finally {
+      closeSync(canonical.fd);
+    }
+  }
+
+  #activeEntry(path) {
+    if (!this.#activeDirectory) {
+      fail('UNSAFE_JOURNAL_DIRECTORY', 'journal parent changed during mutation');
     }
-    if (descriptor === undefined) fail('JOURNAL_LOCK_BUSY', 'journal mutation lock is already held');
+    return join(this.#activeDirectory.reference, basename(path));
+  }
+
+  #exclusive(action) {
+    const directory = openDirectoryForSync(dirname(this.#journalPath), { create: true });
+    this.#activeDirectory = directory;
+    const path = this.#activeEntry(lockPath(this.#journalPath));
+    let descriptor;
+    let lockToken;
     try {
-      this.#records = parseJournal(this.#journalPath);
+      for (let retry = 0; retry < LOCK_RETRIES; retry += 1) {
+        try {
+          descriptor = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+          lockToken = `${process.pid}-${Date.now()}-${randomUUID()}`;
+          const ownerBytes = Buffer.from(JSON.stringify({ schema_version: 1, pid: process.pid, hostname: hostname(), token: lockToken, acquired_at: new Date().toISOString() }));
+          writeSync(descriptor, ownerBytes, 0, ownerBytes.length);
+          fsyncSync(descriptor);
+          fsyncSync(directory.fd);
+          break;
+        } catch (error) {
+          if (descriptor !== undefined) { closeSync(descriptor); descriptor = undefined; }
+          if (error?.code !== 'EEXIST') throw error;
+          if (recoverStaleLock(path)) continue;
+          Atomics.wait(LOCK_WAIT, 0, 0, 2);
+        }
+      }
+      if (descriptor === undefined) fail('JOURNAL_LOCK_BUSY', 'journal mutation lock is already held');
+      const loaded = parseJournal(this.#journalPath, { repair: true, directory });
+      this.#records = loaded.records;
+      this.#journalIdentity = loaded.identity;
       return action();
     } finally {
-      closeSync(descriptor);
-      unlinkSync(path);
+      if (descriptor !== undefined) {
+        closeSync(descriptor);
+        if (readLockOwner(path)?.token === lockToken) { unlinkSync(path); fsyncSync(directory.fd); }
+      }
+      this.#activeDirectory = undefined;
+      closeSync(directory.fd);
     }
   }
 
@@ -153,12 +728,54 @@ export class RailEngine {
     if (isExpired(attempt.claim, now)) fail(code, 'operation requires a live claim lease', { attempt_id: attempt.attempt_id });
   }
 
-  #writeCheckpoint(record) {
-    const checkpoint = canonicalize({ schema_version: 1, record_count: this.#records.length, last_event_id: record.event_id, chain_hash: record.chain_hash });
-    const target = checkpointPath(this.#journalPath);
-    const temporary = `${target}.${process.pid}.tmp`;
-    writeFileSync(temporary, JSON.stringify(checkpoint), { encoding: 'utf8', mode: 0o600 });
-    renameSync(temporary, target);
+  #writeCheckpointFile(checkpoint) {
+    this.#assertDirectoryStable();
+    const target = this.#activeEntry(checkpointPath(this.#journalPath));
+    const temporary = `${target}.${process.pid}.${randomUUID()}.tmp`;
+    let fd;
+    try {
+      fd = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+      const bytes = Buffer.from(JSON.stringify(checkpoint));
+      if (bytes.length > JOURNAL_RECORD_MAX_BYTES) fail('JOURNAL_SIZE_LIMIT', 'journal checkpoint exceeds the record safety limit');
+      writeSync(fd, bytes, 0, bytes.length);
+      fsyncSync(fd);
+      closeSync(fd);
+      fd = undefined;
+      this.#assertDirectoryStable();
+      renameSync(temporary, target);
+      fsyncSync(this.#activeDirectory.fd);
+    } finally {
+      if (fd !== undefined) closeSync(fd);
+      try { if (existsSync(temporary)) unlinkSync(temporary); } catch { /* preserve primary failure */ }
+    }
+  }
+
+  #journalAnchor(records = this.#records) {
+    return canonicalize({
+      record_count: records.length,
+      last_event_id: records.at(-1)?.event_id ?? null,
+      chain_hash: records.at(-1)?.chain_hash ?? 'GENESIS',
+    });
+  }
+
+  #writePendingCheckpoint(record) {
+    this.#writeCheckpointFile(canonicalize({
+      schema_version: 2,
+      committed: this.#journalAnchor(),
+      pending: {
+        record_count: this.#records.length + 1,
+        last_event_id: record.event_id,
+        chain_hash: record.chain_hash,
+      },
+    }));
+  }
+
+  #writeCheckpoint() {
+    this.#writeCheckpointFile(canonicalize({
+      schema_version: 2,
+      committed: this.#journalAnchor(),
+      pending: null,
+    }));
   }
 
   #append(type, payload, causation_id) {
@@ -174,10 +791,50 @@ export class RailEngine {
     const record_hash = sha256(material);
     const previous_hash = this.#records.at(-1)?.chain_hash ?? 'GENESIS';
     const record = Object.freeze(canonicalize({ ...material, record_hash, previous_hash, chain_hash: sha256({ previous_hash, record_hash }) }));
-    mkdirSync(dirname(this.#journalPath), { recursive: true });
-    appendFileSync(this.#journalPath, `${JSON.stringify(record)}\n`, { encoding: 'utf8', flag: 'a' });
-    this.#records.push(record);
-    this.#writeCheckpoint(record);
+    const bytes = Buffer.from(`${JSON.stringify(record)}\n`);
+    if (bytes.length > JOURNAL_RECORD_MAX_BYTES) fail('JOURNAL_SIZE_LIMIT', 'journal record exceeds the 4 MiB safety limit');
+    // Two-phase checkpointing makes both crash windows reconstructible:
+    // pending + old journal means append never happened; pending + new journal
+    // means append succeeded and only checkpoint finalization was interrupted.
+    this.#writePendingCheckpoint(record);
+    this.#assertDirectoryStable();
+    runSecurityTestHook('beforeJournalAppend', { journalPath: this.#journalPath, type });
+    this.#assertDirectoryStable();
+    const existed = this.#journalIdentity !== null;
+    let fd;
+    try {
+      fd = openSync(this.#activeEntry(this.#journalPath), constants.O_WRONLY | constants.O_APPEND
+        | (existed ? 0 : constants.O_CREAT | constants.O_EXCL)
+        | (constants.O_NOFOLLOW || 0), 0o600);
+    } catch (error) {
+      if (!existed && error?.code === 'EEXIST') fail('JOURNAL_STORAGE_CONFLICT', 'journal appeared after canonical state was loaded');
+      throw error;
+    }
+    try {
+      const stat = fstatSync(fd);
+      if (!stat.isFile() || stat.nlink !== 1) fail('UNSAFE_JOURNAL_FILE', 'journal must be a regular single-link file');
+      if (existed && !sameSnapshot(stat, this.#journalIdentity)) fail('JOURNAL_STORAGE_CONFLICT', 'journal changed between load and append');
+      if (stat.size + bytes.length > JOURNAL_MAX_BYTES) fail('JOURNAL_SIZE_LIMIT', 'journal exceeds the 64 MiB safety limit');
+      let offset = 0;
+      while (offset < bytes.length) offset += writeSync(fd, bytes, offset, bytes.length - offset);
+      fsyncSync(fd);
+      const after = fstatSync(fd);
+      if (!sameIdentity(stat, after)
+        || after.mode !== stat.mode || after.uid !== stat.uid || after.gid !== stat.gid
+        || after.nlink !== stat.nlink || after.size !== stat.size + bytes.length) {
+        fail('JOURNAL_STORAGE_CONFLICT', 'journal changed during append');
+      }
+    } finally { closeSync(fd); }
+    if (!existed) fsyncSync(this.#activeDirectory.fd);
+    const expectedRecords = [...this.#records, record];
+    this.#assertDirectoryStable();
+    const verified = parseJournal(this.#journalPath, { directory: this.#activeDirectory });
+    if (sha256(verified.records) !== sha256(expectedRecords)) {
+      fail('JOURNAL_STORAGE_CONFLICT', 'journal content changed during append');
+    }
+    this.#records = verified.records;
+    this.#journalIdentity = verified.identity;
+    this.#writeCheckpoint();
     return record;
   }
 
@@ -190,9 +847,18 @@ export class RailEngine {
         const current = attempts.get(payload.attempt_id);
         if (current) current.claim = { ...current.claim, lease: payload.lease };
       }
+      if (type === 'attempt_relinquished') {
+        const current = attempts.get(payload.attempt_id);
+        if (current) current.claim = { ...current.claim, lease: payload.lease };
+      }
       if (type === 'attempt_recovered') {
         const current = attempts.get(payload.attempt_id);
-        if (current) { current.claim = payload.claim; current.state = payload.resume_state ?? 'active'; current.recovery_event_id = record.event_id; }
+        if (current) {
+          current.claim = payload.claim;
+          current.state = payload.resume_state ?? 'active';
+          current.claim_event_id = record.event_id;
+          current.recovery_event_id = record.event_id;
+        }
       }
       if (type === 'attempt_completed') {
         const current = attempts.get(payload.completion.attempt_id);
@@ -202,6 +868,10 @@ export class RailEngine {
         const current = attempts.get(payload.attempt_id);
         if (current) current.state = type === 'attempt_blocked' ? 'blocked' : 'cancelled';
       }
+      if (type === 'adjudication_decided' && adjudicationAttemptState(payload.decision) !== 'active') {
+        const current = attempts.get(payload.attempt_id);
+        if (current) current.state = adjudicationAttemptState(payload.decision);
+      }
     }
     return attempts;
   }
@@ -218,6 +888,438 @@ export class RailEngine {
     return effects;
   }
 
+  #reviewEvidence(attemptId) {
+    return this.#records
+      .filter((record) => record.type === 'review_decided' && record.payload?.attempt_id === attemptId)
+      .map((record) => {
+        if (!record.payload.review || !record.payload.invocation) {
+          fail('REVIEW_HISTORY_INCOMPLETE', 'canonical review history is missing immutable review material', {
+            attempt_id: attemptId,
+            review_ref: record.payload.review_ref,
+          });
+        }
+        return canonicalize({
+          review: record.payload.review,
+          invocation: record.payload.invocation,
+          lineage: {
+            base_commit_ref: record.payload.base_commit_ref,
+            result_commit_ref: record.payload.result_commit_ref,
+          },
+        });
+      });
+  }
+
+  #executionEvidence(attemptId, { successfulOnly = false } = {}) {
+    return this.#records
+      .filter((record) => record.type === 'execution_recorded' && record.payload?.attempt_id === attemptId)
+      .map((record) => record.payload.execution_evidence)
+      .filter((evidence) => !successfulOnly || (
+        evidence.execution?.exit_status === 0 && typeof evidence.result_commit_ref === 'string'
+      ));
+  }
+
+  executionEvidenceForAttempt(attemptId, { successful_only = false } = {}) {
+    assertString(attemptId, 'INVALID_EXECUTION_EVIDENCE', 'attempt_id');
+    return Object.freeze(this.#executionEvidence(attemptId, { successfulOnly: successful_only })
+      .map((entry) => Object.freeze(entry)));
+  }
+
+  reviewEvidenceForAttempt(attemptId) {
+    assertString(attemptId, 'INVALID_REVIEW_DECISION', 'attempt_id');
+    return Object.freeze(this.#reviewEvidence(attemptId).map((entry) => Object.freeze(entry)));
+  }
+
+  reserveExecutionLaunch({
+    attempt_id, claim_id, operator_id, harness_process_id, invocation,
+  } = {}) {
+    return this.#exclusive(() => {
+      for (const [field, value] of Object.entries({
+        attempt_id, claim_id, operator_id, harness_process_id,
+      })) assertString(value, 'INVALID_EXECUTION_LAUNCH_RESERVATION', field);
+      assertObject(invocation, 'INVALID_EXECUTION_LAUNCH_RESERVATION', 'invocation');
+      assertString(invocation.invocation_id, 'INVALID_EXECUTION_LAUNCH_RESERVATION', 'invocation.invocation_id');
+      assertString(invocation.launch_nonce, 'INVALID_EXECUTION_LAUNCH_RESERVATION', 'invocation.launch_nonce');
+      assertString(invocation.prompt_digest, 'INVALID_EXECUTION_LAUNCH_RESERVATION', 'invocation.prompt_digest');
+      const attempt = this.#attempts().get(attempt_id);
+      if (!attempt || attempt.state !== EXECUTABLE_ATTEMPT_STATE) {
+        fail('ATTEMPT_NOT_ACTIVE', 'execution launch reservation requires an active attempt', { attempt_id });
+      }
+      if (attempt.claim.claim_id !== claim_id || attempt.claim.operator_id !== operator_id) {
+        fail('CLAIM_OWNER_MISMATCH', 'execution launch reservation must belong to the active claim owner', { attempt_id });
+      }
+      if (attempt.claim.harness_process_id !== harness_process_id) {
+        fail('RAIL_CLAIM_PROCESS_MISMATCH', 'execution launch reservation must belong to the active supervisor process', { attempt_id });
+      }
+      this.#assertLiveLease(attempt, timestamp(this.#clock));
+      if (invocation.attempt_id !== attempt_id || invocation.action !== 'build'
+        || invocation.prompt_kind === 'rework') {
+        fail('EXECUTION_INVOCATION_MISMATCH', 'initial execution launch reservation is not bound to this build attempt');
+      }
+      const binding = attempt.execution_binding;
+      if (!binding
+        || invocation.provider_id !== binding.provider_id
+        || invocation.harness_id !== binding.harness_id
+        || invocation.model_pin?.model_id !== binding.model_id
+        || invocation.model_pin?.reasoning_configuration !== binding.reasoning_configuration) {
+        fail('EXECUTION_BINDING_MISMATCH', 'execution launch reservation does not match the sealed task binding');
+      }
+      const existing = this.#records.find((record) => record.type === 'execution_launch_reserved'
+        && record.payload?.invocation?.launch_nonce === invocation.launch_nonce);
+      if (existing) {
+        if (sha256(existing.payload.invocation) !== sha256(invocation)
+          || existing.payload.claim_event_id !== attempt.claim_event_id) {
+          fail('EXECUTION_LAUNCH_NONCE_CONFLICT', 'launch nonce is already reserved for different execution material');
+        }
+        return Object.freeze(canonicalize({ ...existing.payload, event_id: existing.event_id, replay: true }));
+      }
+      const unresolvedReservation = this.#records.find((record) => record.type === 'execution_launch_reserved'
+        && record.payload?.attempt_id === attempt_id
+        && !this.#records.some((candidate) => candidate.type === 'execution_dispatched'
+          && candidate.payload?.invocation?.launch_nonce === record.payload.invocation.launch_nonce));
+      if (unresolvedReservation) {
+        fail('RAIL_INITIAL_LAUNCH_UNRESOLVED', 'a prior initial launch reservation has no authenticated provider dispatch');
+      }
+      const unresolvedDispatch = this.#records.find((record) => record.type === 'execution_dispatched'
+        && record.payload?.attempt_id === attempt_id
+        && record.payload?.run_kind === 'initial'
+        && !this.#records.some((candidate) => candidate.type === 'execution_recorded'
+          && candidate.payload?.execution_evidence?.receipt_nonce === record.payload.invocation.launch_nonce));
+      if (unresolvedDispatch) {
+        fail('RAIL_INITIAL_DISPATCH_UNRESOLVED', 'a prior initial provider launch has no canonical completion or recovery reconciliation');
+      }
+      const payload = canonicalize({
+        attempt_id, claim_id, operator_id, harness_process_id,
+        claim_event_id: attempt.claim_event_id, invocation,
+        reserved_at: timestamp(this.#clock),
+      });
+      const record = this.#append('execution_launch_reserved', payload, attempt.claim_event_id);
+      return Object.freeze(canonicalize({ ...payload, event_id: record.event_id, replay: false }));
+    });
+  }
+
+  recordExecutionDispatch({
+    attempt_id, claim_id, operator_id, invocation, launch_receipt, project_dir,
+    browser_manifest = null, run_kind = 'initial', source_decision_ref = null, rework_reservation_id = null,
+  } = {}) {
+    return this.#exclusive(() => {
+      for (const [field, value] of Object.entries({ attempt_id, claim_id, operator_id })) {
+        assertString(value, 'INVALID_EXECUTION_DISPATCH', field);
+      }
+      assertObject(invocation, 'INVALID_EXECUTION_DISPATCH', 'invocation');
+      assertObject(launch_receipt, 'INVALID_EXECUTION_DISPATCH', 'launch_receipt');
+      assertString(invocation.launch_nonce, 'INVALID_EXECUTION_DISPATCH', 'invocation.launch_nonce');
+      assertString(invocation.prompt_digest, 'INVALID_EXECUTION_DISPATCH', 'invocation.prompt_digest');
+      assertString(project_dir, 'INVALID_EXECUTION_DISPATCH', 'project_dir');
+      if (browser_manifest !== null) assertObject(browser_manifest, 'INVALID_EXECUTION_DISPATCH', 'browser_manifest');
+      const attempt = this.#attempts().get(attempt_id);
+      if (!attempt || attempt.state !== EXECUTABLE_ATTEMPT_STATE) fail('ATTEMPT_NOT_ACTIVE', 'execution dispatch requires an active attempt', { attempt_id });
+      this.#verifyAuthority('execution_launch', launch_receipt, {
+        purpose: 'terminal_launch', authority_kind: 'rail_execution',
+        invocation_id: invocation.invocation_id, launch_nonce: invocation.launch_nonce,
+        provider_id: invocation.provider_id, harness_id: invocation.harness_id,
+        model_id: invocation.model_pin?.model_id,
+        reasoning_configuration: invocation.model_pin?.reasoning_configuration,
+        task_id: attempt?.task_id,
+        working_dir: resolve(project_dir),
+        prompt_digest: invocation.prompt_digest,
+      });
+      if (attempt.claim.claim_id !== claim_id || attempt.claim.operator_id !== operator_id) {
+        fail('CLAIM_OWNER_MISMATCH', 'execution dispatch must be recorded by the active claim owner', { attempt_id });
+      }
+      this.#assertLiveLease(attempt, timestamp(this.#clock));
+      if (invocation.attempt_id !== attempt_id || invocation.action !== 'build') {
+        fail('EXECUTION_INVOCATION_MISMATCH', 'execution dispatch invocation is not bound to this build attempt');
+      }
+      if (!['initial', 'rework'].includes(run_kind)) fail('INVALID_EXECUTION_DISPATCH', 'run_kind must be initial or rework');
+      if (run_kind === 'rework') {
+        for (const [field, value] of Object.entries({ source_decision_ref, rework_reservation_id })) {
+          assertString(value, 'INVALID_EXECUTION_DISPATCH', field);
+        }
+        if (invocation.prompt_kind !== 'rework'
+          || invocation.source_decision_ref !== source_decision_ref
+          || invocation.rework_reservation_id !== rework_reservation_id) {
+          fail('EXECUTION_REWORK_RESERVATION_MISMATCH', 'rework dispatch must bind its canonical source decision and reservation');
+        }
+        const reservation = [...this.#records].reverse().find((record) => record.type === 'rework_reserved'
+          && record.payload?.attempt_id === attempt_id
+          && record.payload?.source_decision_ref === source_decision_ref);
+        const released = this.#records.some((record) => record.type === 'rework_reservation_released'
+          && record.payload?.reservation_id === rework_reservation_id);
+        if (!reservation
+          || released
+          || reservation.payload.reservation_id !== rework_reservation_id
+          || reservation.payload.claim_event_id !== attempt.claim_event_id
+          || reservation.payload.claim_id !== claim_id
+          || reservation.payload.operator_id !== operator_id) {
+          fail('RAIL_REWORK_RESERVATION_REQUIRED', 'rework dispatch requires the active claim-generation reservation');
+        }
+        const launchReservation = this.#records.find((record) => record.type === 'rework_launch_reserved'
+          && record.payload?.invocation?.launch_nonce === invocation.launch_nonce);
+        if (!launchReservation
+          || launchReservation.payload.attempt_id !== attempt_id
+          || launchReservation.payload.claim_id !== claim_id
+          || launchReservation.payload.operator_id !== operator_id
+          || launchReservation.payload.claim_event_id !== attempt.claim_event_id
+          || launchReservation.payload.source_decision_ref !== source_decision_ref
+          || launchReservation.payload.reservation_id !== rework_reservation_id
+          || sha256(launchReservation.payload.invocation) !== sha256(invocation)) {
+          fail('RAIL_REWORK_LAUNCH_RESERVATION_REQUIRED', 'rework dispatch requires its exact canonical pre-launch intent');
+        }
+        const priorDispatches = this.#records.filter((record) => record.type === 'execution_dispatched'
+          && record.payload?.attempt_id === attempt_id
+          && record.payload?.invocation?.rework_reservation_id === rework_reservation_id);
+        const unreceipted = priorDispatches.find((dispatch) => !this.#records.some((record) => record.type === 'execution_recorded'
+          && record.payload?.execution_evidence?.receipt_nonce === dispatch.payload.invocation.launch_nonce));
+        if (unreceipted) {
+          fail('RAIL_REWORK_DISPATCH_UNRESOLVED', 'a prior launch in this rework reservation has no canonical completion evidence');
+        }
+      } else if (source_decision_ref !== null || rework_reservation_id !== null || invocation.prompt_kind === 'rework') {
+        fail('INVALID_EXECUTION_DISPATCH', 'initial execution cannot carry rework reservation material');
+      }
+      const binding = attempt.execution_binding;
+      if (!binding
+        || invocation.provider_id !== binding.provider_id
+        || invocation.harness_id !== binding.harness_id
+        || invocation.model_pin?.model_id !== binding.model_id
+        || invocation.model_pin?.reasoning_configuration !== binding.reasoning_configuration) {
+        fail('EXECUTION_BINDING_MISMATCH', 'execution dispatch does not match the sealed task provider, harness, model and reasoning binding');
+      }
+      const expectedExecutionBase = this.#executionEvidence(attempt_id, { successfulOnly: true })
+        .at(-1)?.result_commit_ref ?? attempt.git_commit_ref;
+      if (launch_receipt.purpose !== 'terminal_launch'
+        || launch_receipt.authority_kind !== 'rail_execution'
+        || launch_receipt.invocation_id !== invocation.invocation_id
+        || launch_receipt.launch_nonce !== invocation.launch_nonce
+        || launch_receipt.provider_id !== invocation.provider_id
+        || launch_receipt.harness_id !== invocation.harness_id
+        || launch_receipt.model_id !== invocation.model_pin?.model_id
+        || launch_receipt.reasoning_configuration !== invocation.model_pin?.reasoning_configuration
+        || launch_receipt.task_id !== attempt.task_id
+        || launch_receipt.working_dir !== resolve(project_dir)
+        || launch_receipt.prompt_digest !== invocation.prompt_digest
+        || launch_receipt.execution_base_commit_ref !== expectedExecutionBase
+        || launch_receipt.execution_launch_head_ref !== expectedExecutionBase
+        || launch_receipt.execution_worktree_clean !== true
+        || !/^[a-f0-9]{64}$/.test(launch_receipt.execution_repository_identity_digest || '')
+        || !/^[a-f0-9]{64}$/.test(launch_receipt.execution_preexisting_commits_digest || '')
+        || !/^[a-f0-9]{64}$/.test(launch_receipt.command_digest || '')
+        || !Number.isInteger(launch_receipt.process_pid) || launch_receipt.process_pid <= 0
+        || typeof launch_receipt.process_hostname !== 'string' || !launch_receipt.process_hostname
+        || !(launch_receipt.process_group_id === null
+          || (Number.isInteger(launch_receipt.process_group_id) && launch_receipt.process_group_id > 0))
+        || launch_receipt.process_containment_kind !== 'bubblewrap_pid_namespace_v1'
+        || typeof launch_receipt.process_containment_id !== 'string' || !launch_receipt.process_containment_id
+        || !/^[a-f0-9]{64}$/.test(launch_receipt.process_containment_digest || '')
+        || typeof launch_receipt.authority_signature !== 'string') {
+        fail('EXECUTION_LAUNCH_RECEIPT_MISMATCH', 'launch receipt does not echo the exact canonical invocation');
+      }
+      const existing = this.#records.find((record) => record.type === 'execution_dispatched'
+        && record.payload?.invocation?.launch_nonce === invocation.launch_nonce);
+      if (existing) {
+        if (sha256(existing.payload.invocation) !== sha256(invocation)
+          || sha256(existing.payload.launch_receipt) !== sha256(launch_receipt)
+          || sha256(existing.payload.browser_manifest ?? null) !== sha256(browser_manifest)) {
+          fail('EXECUTION_LAUNCH_NONCE_CONFLICT', 'launch nonce is already bound to different dispatch material');
+        }
+        return Object.freeze(canonicalize({ ...existing.payload, event_id: existing.event_id, replay: true }));
+      }
+      if (run_kind === 'initial') {
+        const reservation = this.#records.find((record) => record.type === 'execution_launch_reserved'
+          && record.payload?.invocation?.launch_nonce === invocation.launch_nonce);
+        if (!reservation
+          || reservation.payload.attempt_id !== attempt_id
+          || reservation.payload.claim_id !== claim_id
+          || reservation.payload.operator_id !== operator_id
+          || reservation.payload.claim_event_id !== attempt.claim_event_id
+          || sha256(reservation.payload.invocation) !== sha256(invocation)) {
+          fail('RAIL_EXECUTION_LAUNCH_RESERVATION_REQUIRED', 'initial execution dispatch requires its exact canonical pre-launch reservation');
+        }
+        const unresolved = this.#records.find((record) => record.type === 'execution_dispatched'
+          && record.payload?.attempt_id === attempt_id
+          && record.payload?.run_kind === 'initial'
+          && !this.#records.some((candidate) => candidate.type === 'execution_recorded'
+            && candidate.payload?.execution_evidence?.receipt_nonce === record.payload.invocation.launch_nonce));
+        if (unresolved) {
+          fail('RAIL_INITIAL_DISPATCH_UNRESOLVED', 'a prior initial provider launch has no canonical completion or recovery reconciliation');
+        }
+      }
+      const record = this.#append('execution_dispatched', {
+        attempt_id, claim_id, operator_id, invocation, launch_receipt,
+        ...(browser_manifest ? { browser_manifest } : {}),
+        run_kind, ...(source_decision_ref ? { source_decision_ref } : {}),
+        ...(rework_reservation_id ? { rework_reservation_id } : {}),
+      });
+      return Object.freeze(canonicalize({ ...record.payload, event_id: record.event_id, replay: false }));
+    });
+  }
+
+  recordExecutionEvidence({
+    attempt_id, claim_id, operator_id, invocation, execution, base_commit_ref,
+    result_commit_ref = null, run_kind = 'initial', source_decision_ref = null,
+    receipt_nonce, git_dir,
+  } = {}) {
+    return this.#exclusive(() => {
+      for (const [field, value] of Object.entries({ attempt_id, claim_id, operator_id, receipt_nonce, git_dir })) {
+        assertString(value, 'INVALID_EXECUTION_EVIDENCE', field);
+      }
+      assertObject(invocation, 'INVALID_EXECUTION_EVIDENCE', 'invocation');
+      assertObject(execution, 'INVALID_EXECUTION_EVIDENCE', 'execution');
+      this.#verifyAuthority('execution_completion', execution.terminal_authority_receipt, {
+        purpose: 'terminal_completion', authority_kind: 'rail_execution',
+        invocation_id: invocation.invocation_id, launch_nonce: invocation.launch_nonce,
+        terminal_id: execution.terminal_id, provider_id: invocation.provider_id,
+        harness_id: invocation.harness_id, model_id: invocation.model_pin?.model_id,
+        reasoning_configuration: invocation.model_pin?.reasoning_configuration,
+        exit_status: execution.exit_status,
+      });
+      if (!['initial', 'rework'].includes(run_kind)) fail('INVALID_EXECUTION_EVIDENCE', 'run_kind must be initial or rework');
+      if (!Number.isInteger(execution.exit_status)) fail('INVALID_EXECUTION_EVIDENCE', 'execution.exit_status must be an integer');
+      const attempt = this.#attempts().get(attempt_id);
+      if (!attempt || attempt.state !== EXECUTABLE_ATTEMPT_STATE) fail('ATTEMPT_NOT_ACTIVE', 'execution evidence requires an active attempt', { attempt_id });
+      if (attempt.claim.claim_id !== claim_id || attempt.claim.operator_id !== operator_id) {
+        fail('CLAIM_OWNER_MISMATCH', 'execution evidence must be receipted by the active claim owner', { attempt_id });
+      }
+      this.#assertLiveLease(attempt, timestamp(this.#clock));
+      if (invocation.attempt_id !== attempt_id) fail('EXECUTION_INVOCATION_MISMATCH', 'execution invocation is not bound to the active attempt');
+      if (receipt_nonce !== invocation.launch_nonce) fail('EXECUTION_LAUNCH_NONCE_MISMATCH', 'execution evidence must echo the dispatched launch nonce');
+      const dispatch = this.#records.find((record) => record.type === 'execution_dispatched'
+        && record.payload?.attempt_id === attempt_id
+        && record.payload?.claim_id === claim_id
+        && record.payload?.operator_id === operator_id
+        && record.payload?.invocation?.launch_nonce === receipt_nonce);
+      if (!dispatch || sha256(dispatch.payload.invocation) !== sha256(invocation)) {
+        fail('EXECUTION_DISPATCH_REQUIRED', 'execution evidence requires an exact canonical dispatch record');
+      }
+      if (execution.terminal_id !== dispatch.payload.launch_receipt.terminal_id
+        || execution.provider !== invocation.harness_id
+        || execution.model !== invocation.model_pin?.model_id
+        || execution.reasoning_configuration !== invocation.model_pin?.reasoning_configuration) {
+        fail('EXECUTION_TERMINAL_EVIDENCE_MISMATCH', 'terminal evidence does not match the canonical dispatch receipt and model binding');
+      }
+      if (execution.terminal_authority_receipt?.purpose !== 'terminal_completion'
+        || execution.terminal_authority_receipt?.authority_kind !== 'rail_execution'
+        || execution.terminal_authority_receipt?.launch_receipt_digest !== sha256(dispatch.payload.launch_receipt)
+        || execution.terminal_authority_receipt?.launch_nonce !== receipt_nonce
+        || execution.terminal_authority_receipt?.terminal_id !== execution.terminal_id
+        || execution.terminal_authority_receipt?.exit_status !== execution.exit_status
+        || execution.terminal_authority_receipt?.execution_base_commit_ref !== base_commit_ref
+        || execution.terminal_authority_receipt?.execution_launch_head_ref !== dispatch.payload.launch_receipt.execution_launch_head_ref
+        || execution.terminal_authority_receipt?.execution_repository_identity_digest !== dispatch.payload.launch_receipt.execution_repository_identity_digest
+        || execution.terminal_authority_receipt?.execution_preexisting_commits_digest !== dispatch.payload.launch_receipt.execution_preexisting_commits_digest
+        || typeof execution.terminal_authority_receipt?.authority_signature !== 'string') {
+        fail('EXECUTION_TERMINAL_AUTHORITY_MISMATCH', 'completion receipt does not bind the canonical launch and terminal result');
+      }
+      const resultStatus = execution.terminal_authority_receipt.execution_result_status;
+      const invalidOutput = execution.exit_status === 0 && resultStatus === 'invalid_output';
+      let executionFailureCode = null;
+      let canonicalResultCommitRef = result_commit_ref;
+      let reportedResultCommitRef = null;
+      if (invalidOutput) {
+        if (![
+          'RAIL_EXECUTION_OUTPUT_INVALID',
+          'RAIL_EXECUTION_LAUNCH_NONCE_MISMATCH',
+          'RAIL_EXECUTION_REPOSITORY_CHANGED',
+          'RAIL_EXECUTION_RESULT_PREEXISTED',
+          'RAIL_EXECUTION_RESULT_HEAD_MISMATCH',
+          'RAIL_EXECUTION_RESULT_NOT_DESCENDANT',
+          'RAIL_EXECUTION_WORKTREE_DIRTY',
+          'RAIL_EXECUTION_GIT_STATE_UNAVAILABLE',
+        ]
+          .includes(execution.terminal_authority_receipt.execution_result_error_code)
+          || execution.terminal_authority_receipt.result_commit_ref !== undefined
+          || result_commit_ref !== null) {
+          fail('EXECUTION_RESULT_RECEIPT_MISMATCH', 'invalid execution output must be signed as a result-less terminal contract failure');
+        }
+        executionFailureCode = execution.terminal_authority_receipt.execution_result_error_code;
+      } else if (execution.exit_status === 0) {
+        if (resultStatus !== undefined && resultStatus !== 'valid') {
+          fail('EXECUTION_RESULT_RECEIPT_MISMATCH', 'successful terminal execution has an invalid signed result status');
+        }
+        if (execution.terminal_authority_receipt.result_commit_ref !== result_commit_ref) {
+          fail('EXECUTION_RESULT_RECEIPT_MISMATCH', 'result commit must be the commit parsed and signed by the terminal authority');
+        }
+        if (execution.terminal_authority_receipt.execution_result_head_ref !== result_commit_ref
+          || execution.terminal_authority_receipt.execution_result_preexisted !== false
+          || execution.terminal_authority_receipt.execution_worktree_clean !== true) {
+          fail('EXECUTION_RESULT_RECEIPT_MISMATCH', 'successful execution must prove a new clean final HEAD created after launch');
+        }
+      } else {
+        if (resultStatus !== undefined && resultStatus !== 'process_failed') {
+          fail('EXECUTION_RESULT_RECEIPT_MISMATCH', 'failed terminal execution has an invalid signed result status');
+        }
+        executionFailureCode = 'TERMINAL_EXIT_NONZERO';
+      }
+      if (this.#records.some((record) => record.type === 'execution_recorded'
+        && record.payload?.execution_evidence?.receipt_nonce === receipt_nonce)) {
+        fail('EXECUTION_LAUNCH_ALREADY_RECEIPTED', 'this canonical launch already has execution evidence');
+      }
+      const successful = this.#executionEvidence(attempt_id, { successfulOnly: true });
+      const expectedBase = successful.at(-1)?.result_commit_ref ?? attempt.git_commit_ref;
+      if (base_commit_ref !== expectedBase) fail('EXECUTION_BASE_MISMATCH', 'execution base must equal the latest canonical successful result or sealed base');
+      if (run_kind === 'rework') {
+        assertString(source_decision_ref, 'INVALID_EXECUTION_EVIDENCE', 'source_decision_ref');
+        assertString(invocation.rework_reservation_id, 'INVALID_EXECUTION_EVIDENCE', 'invocation.rework_reservation_id');
+        if (invocation.prompt_kind !== 'rework'
+          || invocation.source_decision_ref !== source_decision_ref
+          || dispatch.payload.run_kind !== 'rework'
+          || dispatch.payload.source_decision_ref !== source_decision_ref
+          || dispatch.payload.rework_reservation_id !== invocation.rework_reservation_id) {
+          fail('EXECUTION_REWORK_RESERVATION_MISMATCH', 'rework evidence must bind the canonical reservation and source decision');
+        }
+        const authorized = this.#records.some((record) => record.payload?.attempt_id === attempt_id && (
+          (record.type === 'review_decided'
+            && record.payload.review_ref === source_decision_ref
+            && record.payload.decision?.decision === 'normal-rework')
+          || (record.type === 'adjudication_decided'
+            && record.payload.adjudication_ref === source_decision_ref
+            && record.payload.decision?.outcome === 'bounded-correction')
+        ));
+        if (!authorized) fail('EXECUTION_REWORK_NOT_AUTHORIZED', 'rework execution must reference a canonical rework decision');
+      } else if (source_decision_ref !== null) {
+        fail('INVALID_EXECUTION_EVIDENCE', 'initial execution must not carry source_decision_ref');
+      }
+      if (execution.exit_status === 0 && !invalidOutput) {
+        assertString(result_commit_ref, 'INVALID_EXECUTION_EVIDENCE', 'result_commit_ref');
+        try {
+          verifyCommitDescendsFrom({ git_dir, base_commit_ref, result_commit_ref });
+        } catch (error) {
+          if (!['GIT_COMMIT_NOT_FOUND', 'GIT_RESULT_COMMIT_REQUIRED', 'GIT_RESULT_NOT_DESCENDANT'].includes(error?.code)) throw error;
+          executionFailureCode = error.code;
+          reportedResultCommitRef = result_commit_ref;
+          canonicalResultCommitRef = null;
+        }
+        if (run_kind === 'rework' && successful.some((entry) => entry.source_decision_ref === source_decision_ref)) {
+          fail('RAIL_REWORK_ALREADY_EXECUTED', 'this decision already has a successful rework execution');
+        }
+      } else if (result_commit_ref !== null) {
+        fail('INVALID_EXECUTION_EVIDENCE', 'failed execution cannot bind a result commit');
+      }
+      const core = canonicalize({
+        schema_version: 2,
+        attempt_id,
+        task_id: attempt.task_id,
+        handoff_id: attempt.handoff_id,
+        run_kind,
+        base_commit_ref,
+        outcome: canonicalResultCommitRef ? 'succeeded' : 'failed',
+        ...(canonicalResultCommitRef ? { result_commit_ref: canonicalResultCommitRef } : {}),
+        ...(reportedResultCommitRef ? { reported_result_commit_ref: reportedResultCommitRef } : {}),
+        ...(executionFailureCode ? { failure_code: executionFailureCode } : {}),
+        ...(source_decision_ref ? { source_decision_ref } : {}),
+        receipt_nonce,
+        invocation,
+        execution,
+      });
+      const evidence_id = `execution-${sha256(core).slice(0, 24)}`;
+      const existing = this.#records.find((record) => record.type === 'execution_recorded'
+        && record.payload?.execution_evidence?.evidence_id === evidence_id);
+      if (existing) return Object.freeze(canonicalize({ ...existing.payload.execution_evidence, event_id: existing.event_id, replay: true }));
+      const evidence = canonicalize({ ...core, evidence_id, digest: sha256(core) });
+      const record = this.#append('execution_recorded', { attempt_id, execution_evidence: evidence });
+      return Object.freeze(canonicalize({ ...evidence, event_id: record.event_id, replay: false }));
+    });
+  }
+
   #currentClaimForTask(taskId) {
     const now = timestamp(this.#clock);
     for (const attempt of this.#attempts().values()) {
@@ -244,6 +1346,7 @@ export class RailEngine {
     if (!latest || latest.payload.decision?.decision !== 'accept' || !uniqueReviews.has(latest.payload.review_ref)) {
       fail('REVIEW_NOT_ACCEPTED', 'completion requires the latest canonical review decision to accept the attempt', { attempt_id: attemptId });
     }
+    return latest;
   }
 
   claimTask({ handoff, task_id, attempt_id, operator_id, harness_process_id, git_dir, lease_ttl_ms = 300000 } = {}) {
@@ -266,6 +1369,7 @@ export class RailEngine {
       attempt_id,
       operator_id,
       harness_process_id,
+      hostname: hostname(),
       lease: { acquired_at, expires_at: plusMs(acquired_at, lease_ttl_ms), heartbeat_at: acquired_at },
       idempotency_scope: `task:${task_id}:attempt:${attempt_id}`,
     });
@@ -274,22 +1378,285 @@ export class RailEngine {
     });
   }
 
-  heartbeat({ attempt_id, claim_id, operator_id, lease_ttl_ms = 300000 } = {}) {
+  heartbeat({ attempt_id, claim_id, operator_id, harness_process_id, lease_ttl_ms = 300000 } = {}) {
     return this.#exclusive(() => {
     assertString(attempt_id, 'INVALID_HEARTBEAT', 'attempt_id');
     assertString(claim_id, 'INVALID_HEARTBEAT', 'claim_id');
     assertString(operator_id, 'INVALID_HEARTBEAT', 'operator_id');
+    assertString(harness_process_id, 'INVALID_HEARTBEAT', 'harness_process_id');
     const attempt = this.#attempts().get(attempt_id);
     if (!attempt || ![EXECUTABLE_ATTEMPT_STATE, 'ready_to_merge'].includes(attempt.state)) fail('ATTEMPT_NOT_ACTIVE', 'attempt is not active', { attempt_id });
     if (attempt.claim.claim_id !== claim_id || attempt.claim.operator_id !== operator_id) fail('CLAIM_OWNER_MISMATCH', 'only the active claim owner may heartbeat', { attempt_id });
+    if (attempt.claim.harness_process_id !== harness_process_id) {
+      fail('RAIL_CLAIM_PROCESS_MISMATCH', 'only the process bound to the active claim may heartbeat', { attempt_id });
+    }
     const heartbeat_at = timestamp(this.#clock);
     this.#assertLiveLease(attempt, heartbeat_at);
-    const lease = { ...attempt.claim.lease, heartbeat_at, expires_at: plusMs(heartbeat_at, lease_ttl_ms) };
+    const requestedExpiry = plusMs(heartbeat_at, lease_ttl_ms);
+    const expires_at = Date.parse(requestedExpiry) > Date.parse(attempt.claim.lease.expires_at)
+      ? requestedExpiry
+      : attempt.claim.lease.expires_at;
+    const lease = { ...attempt.claim.lease, heartbeat_at, expires_at };
     const record = this.#append('attempt_heartbeat', { attempt_id, claim_id, lease }, attempt.claim_event_id);
     return Object.freeze(canonicalize({ attempt_id, claim_id, lease, event_id: record.event_id }));
     });
   }
 
+  relinquishAttempt({ attempt_id, claim_id, operator_id, harness_process_id, reason = 'supervisor_exit' } = {}) {
+    return this.#exclusive(() => {
+      for (const [field, value] of Object.entries({ attempt_id, claim_id, operator_id, harness_process_id, reason })) {
+        assertString(value, 'INVALID_RELINQUISH', field);
+      }
+      const attempt = this.#attempts().get(attempt_id);
+      if (!attempt || ![EXECUTABLE_ATTEMPT_STATE, 'ready_to_merge'].includes(attempt.state)) {
+        fail('ATTEMPT_NOT_ACTIVE', 'only an active attempt can relinquish its lease', { attempt_id });
+      }
+      if (attempt.claim.claim_id !== claim_id || attempt.claim.operator_id !== operator_id) {
+        fail('CLAIM_OWNER_MISMATCH', 'only the active claim owner may relinquish its lease', { attempt_id });
+      }
+      if (attempt.claim.harness_process_id !== harness_process_id) {
+        fail('RAIL_CLAIM_PROCESS_MISMATCH', 'only the process bound to the active claim may relinquish its lease', { attempt_id });
+      }
+      const relinquished_at = timestamp(this.#clock);
+      const lease = { ...attempt.claim.lease, expires_at: relinquished_at };
+      const record = this.#append('attempt_relinquished', {
+        attempt_id, claim_id, harness_process_id, reason, relinquished_at, lease,
+      }, attempt.claim_event_id);
+      return Object.freeze(canonicalize({ attempt_id, claim_id, reason, relinquished_at, lease, event_id: record.event_id }));
+    });
+  }
+
+  reserveRework({
+    attempt_id, claim_id, operator_id, harness_process_id,
+    source_decision_ref, reservation_id,
+  } = {}) {
+    return this.#exclusive(() => {
+      for (const [field, value] of Object.entries({
+        attempt_id, claim_id, operator_id, harness_process_id, source_decision_ref, reservation_id,
+      })) assertString(value, 'INVALID_REWORK_RESERVATION', field);
+      const attempt = this.#attempts().get(attempt_id);
+      if (!attempt || attempt.state !== EXECUTABLE_ATTEMPT_STATE) {
+        fail('ATTEMPT_NOT_ACTIVE', 'rework reservation requires an active attempt', { attempt_id });
+      }
+      if (attempt.claim.claim_id !== claim_id || attempt.claim.operator_id !== operator_id) {
+        fail('CLAIM_OWNER_MISMATCH', 'rework reservation must belong to the active claim owner', { attempt_id });
+      }
+      if (attempt.claim.harness_process_id !== harness_process_id) {
+        fail('RAIL_CLAIM_PROCESS_MISMATCH', 'rework reservation must belong to the active supervisor process', { attempt_id });
+      }
+      this.#assertLiveLease(attempt, timestamp(this.#clock));
+      const latestControl = this.#records.filter((record) => ['review_decided', 'adjudication_decided'].includes(record.type)
+        && record.payload?.attempt_id === attempt_id).at(-1);
+      const authorized = (latestControl?.type === 'review_decided'
+          && latestControl.payload.review_ref === source_decision_ref
+          && latestControl.payload.decision?.decision === 'normal-rework')
+        || (latestControl?.type === 'adjudication_decided'
+          && latestControl.payload.adjudication_ref === source_decision_ref
+          && latestControl.payload.decision?.outcome === 'bounded-correction');
+      if (!authorized) fail('RAIL_REWORK_NOT_AUTHORIZED', 'the latest canonical decision does not authorize this rework reservation');
+      if (this.#executionEvidence(attempt_id, { successfulOnly: true })
+        .some((entry) => entry.source_decision_ref === source_decision_ref)) {
+        fail('RAIL_REWORK_ALREADY_EXECUTED', 'this decision already has a successful rework execution');
+      }
+      const existingReservations = this.#records.filter((record) => record.type === 'rework_reserved'
+        && record.payload?.attempt_id === attempt_id
+        && record.payload?.source_decision_ref === source_decision_ref);
+      for (const existing of existingReservations) {
+        const released = this.#records.find((record) => record.type === 'rework_reservation_released'
+          && record.payload?.reservation_id === existing.payload.reservation_id);
+        if (existing.payload.reservation_id === reservation_id
+          && existing.payload.claim_event_id === attempt.claim_event_id
+          && existing.payload.harness_process_id === harness_process_id
+          && !released) {
+          return Object.freeze(canonicalize({ ...existing.payload, event_id: existing.event_id, replay: true }));
+        }
+        if (!released && existing.payload.claim_event_id === attempt.claim_event_id) {
+          fail('RAIL_REWORK_ALREADY_RESERVED', 'this decision already has an active rework reservation');
+        }
+        if (!released) {
+          const launches = this.#records.filter((record) => record.type === 'rework_launch_reserved'
+            && record.payload?.attempt_id === attempt_id
+            && record.payload?.reservation_id === existing.payload.reservation_id);
+          const dispatches = this.#records.filter((record) => record.type === 'execution_dispatched'
+            && record.payload?.attempt_id === attempt_id
+            && record.payload?.run_kind === 'rework'
+            && record.payload?.rework_reservation_id === existing.payload.reservation_id);
+          const unresolvedLaunches = launches.filter((launch) => !dispatches.some((dispatch) =>
+            dispatch.payload?.invocation?.launch_nonce === launch.payload.invocation.launch_nonce));
+          if (unresolvedLaunches.length > 0) {
+            fail('RAIL_REWORK_LAUNCH_UNRESOLVED', 'the previous rework reservation has a launch intent without authenticated provider dispatch', {
+              reservation_id: existing.payload.reservation_id,
+              launch_nonces: unresolvedLaunches.map((launch) => launch.payload.invocation.launch_nonce),
+            });
+          }
+          const unresolved = dispatches.filter((dispatch) => !this.#records.some((record) => record.type === 'execution_recorded'
+            && record.payload?.execution_evidence?.receipt_nonce === dispatch.payload.invocation.launch_nonce));
+          if (unresolved.length > 0) {
+            fail('RAIL_REWORK_DISPATCH_UNRESOLVED', 'the previous rework reservation has a dispatch without canonical execution evidence', {
+              reservation_id: existing.payload.reservation_id,
+              launch_nonces: unresolved.map((dispatch) => dispatch.payload.invocation.launch_nonce),
+            });
+          }
+          if (!attempt.recovery_event_id) {
+            fail('RAIL_REWORK_RECONCILIATION_REQUIRED', 'a previous rework reservation may only be reconciled by a recovered supervisor');
+          }
+          this.#append('rework_reservation_released', canonicalize({
+            attempt_id, claim_id, operator_id, harness_process_id,
+            source_decision_ref, reservation_id: existing.payload.reservation_id,
+            reason: dispatches.length > 0 ? 'recovered_after_canonical_execution' : 'recovered_before_launch_intent',
+            reconciled_claim_event_id: existing.payload.claim_event_id,
+          }), attempt.recovery_event_id);
+        }
+      }
+      const payload = canonicalize({
+        attempt_id, claim_id, operator_id, harness_process_id,
+        claim_event_id: attempt.claim_event_id, source_decision_ref, reservation_id,
+      });
+      const record = this.#append('rework_reserved', payload);
+      return Object.freeze(canonicalize({ ...payload, event_id: record.event_id, replay: false }));
+    });
+  }
+
+  reserveReworkLaunch({
+    attempt_id, claim_id, operator_id, harness_process_id,
+    source_decision_ref, reservation_id, invocation,
+  } = {}) {
+    return this.#exclusive(() => {
+      for (const [field, value] of Object.entries({
+        attempt_id, claim_id, operator_id, harness_process_id,
+        source_decision_ref, reservation_id,
+      })) assertString(value, 'INVALID_REWORK_LAUNCH_RESERVATION', field);
+      assertObject(invocation, 'INVALID_REWORK_LAUNCH_RESERVATION', 'invocation');
+      assertString(invocation.invocation_id, 'INVALID_REWORK_LAUNCH_RESERVATION', 'invocation.invocation_id');
+      assertString(invocation.launch_nonce, 'INVALID_REWORK_LAUNCH_RESERVATION', 'invocation.launch_nonce');
+      assertString(invocation.prompt_digest, 'INVALID_REWORK_LAUNCH_RESERVATION', 'invocation.prompt_digest');
+      const attempt = this.#attempts().get(attempt_id);
+      if (!attempt || attempt.state !== EXECUTABLE_ATTEMPT_STATE) {
+        fail('ATTEMPT_NOT_ACTIVE', 'rework launch reservation requires an active attempt', { attempt_id });
+      }
+      if (attempt.claim.claim_id !== claim_id || attempt.claim.operator_id !== operator_id) {
+        fail('CLAIM_OWNER_MISMATCH', 'rework launch reservation must belong to the active claim owner', { attempt_id });
+      }
+      if (attempt.claim.harness_process_id !== harness_process_id) {
+        fail('RAIL_CLAIM_PROCESS_MISMATCH', 'rework launch reservation must belong to the active supervisor process', { attempt_id });
+      }
+      this.#assertLiveLease(attempt, timestamp(this.#clock));
+      if (invocation.attempt_id !== attempt_id || invocation.action !== 'build'
+        || invocation.prompt_kind !== 'rework'
+        || invocation.source_decision_ref !== source_decision_ref
+        || invocation.rework_reservation_id !== reservation_id) {
+        fail('EXECUTION_REWORK_RESERVATION_MISMATCH', 'rework launch intent must bind the canonical source decision and reservation');
+      }
+      const binding = attempt.execution_binding;
+      if (!binding
+        || invocation.provider_id !== binding.provider_id
+        || invocation.harness_id !== binding.harness_id
+        || invocation.model_pin?.model_id !== binding.model_id
+        || invocation.model_pin?.reasoning_configuration !== binding.reasoning_configuration) {
+        fail('EXECUTION_BINDING_MISMATCH', 'rework launch reservation does not match the sealed task binding');
+      }
+      const reservation = [...this.#records].reverse().find((record) => record.type === 'rework_reserved'
+        && record.payload?.attempt_id === attempt_id
+        && record.payload?.source_decision_ref === source_decision_ref);
+      const released = this.#records.some((record) => record.type === 'rework_reservation_released'
+        && record.payload?.reservation_id === reservation_id);
+      if (!reservation || released
+        || reservation.payload.reservation_id !== reservation_id
+        || reservation.payload.claim_event_id !== attempt.claim_event_id
+        || reservation.payload.claim_id !== claim_id
+        || reservation.payload.operator_id !== operator_id) {
+        fail('RAIL_REWORK_RESERVATION_REQUIRED', 'rework launch intent requires the active claim-generation reservation');
+      }
+      const existing = this.#records.find((record) => record.type === 'rework_launch_reserved'
+        && record.payload?.invocation?.launch_nonce === invocation.launch_nonce);
+      if (existing) {
+        if (sha256(existing.payload.invocation) !== sha256(invocation)
+          || existing.payload.reservation_id !== reservation_id
+          || existing.payload.claim_event_id !== attempt.claim_event_id) {
+          fail('EXECUTION_LAUNCH_NONCE_CONFLICT', 'launch nonce is already reserved for different rework material');
+        }
+        return Object.freeze(canonicalize({ ...existing.payload, event_id: existing.event_id, replay: true }));
+      }
+      const unresolvedLaunch = this.#records.find((record) => record.type === 'rework_launch_reserved'
+        && record.payload?.attempt_id === attempt_id
+        && record.payload?.reservation_id === reservation_id
+        && !this.#records.some((candidate) => candidate.type === 'execution_dispatched'
+          && candidate.payload?.invocation?.launch_nonce === record.payload.invocation.launch_nonce));
+      if (unresolvedLaunch) {
+        fail('RAIL_REWORK_LAUNCH_UNRESOLVED', 'a prior rework launch intent has no authenticated provider dispatch');
+      }
+      const unresolvedDispatch = this.#records.find((record) => record.type === 'execution_dispatched'
+        && record.payload?.attempt_id === attempt_id
+        && record.payload?.run_kind === 'rework'
+        && record.payload?.rework_reservation_id === reservation_id
+        && !this.#records.some((candidate) => candidate.type === 'execution_recorded'
+          && candidate.payload?.execution_evidence?.receipt_nonce === record.payload.invocation.launch_nonce));
+      if (unresolvedDispatch) {
+        fail('RAIL_REWORK_DISPATCH_UNRESOLVED', 'a prior rework provider launch has no canonical completion evidence');
+      }
+      const payload = canonicalize({
+        attempt_id, claim_id, operator_id, harness_process_id,
+        claim_event_id: attempt.claim_event_id, source_decision_ref,
+        reservation_id, invocation, reserved_at: timestamp(this.#clock),
+      });
+      const record = this.#append('rework_launch_reserved', payload, reservation.event_id);
+      return Object.freeze(canonicalize({ ...payload, event_id: record.event_id, replay: false }));
+    });
+  }
+
+  releaseReworkReservation({
+    attempt_id, claim_id, operator_id, harness_process_id,
+    source_decision_ref, reservation_id, reason = 'supervisor_exit',
+  } = {}) {
+    return this.#exclusive(() => {
+      for (const [field, value] of Object.entries({
+        attempt_id, claim_id, operator_id, harness_process_id,
+        source_decision_ref, reservation_id, reason,
+      })) assertString(value, 'INVALID_REWORK_RESERVATION_RELEASE', field);
+      const attempt = this.#attempts().get(attempt_id);
+      if (!attempt || attempt.state !== EXECUTABLE_ATTEMPT_STATE) {
+        fail('ATTEMPT_NOT_ACTIVE', 'rework reservation release requires an active attempt', { attempt_id });
+      }
+      if (attempt.claim.claim_id !== claim_id || attempt.claim.operator_id !== operator_id) {
+        fail('CLAIM_OWNER_MISMATCH', 'only the active claim owner may release a rework reservation', { attempt_id });
+      }
+      if (attempt.claim.harness_process_id !== harness_process_id) {
+        fail('RAIL_CLAIM_PROCESS_MISMATCH', 'only the reserving supervisor process may release rework', { attempt_id });
+      }
+      const reservation = [...this.#records].reverse().find((record) => record.type === 'rework_reserved'
+        && record.payload?.attempt_id === attempt_id
+        && record.payload?.source_decision_ref === source_decision_ref);
+      if (!reservation || reservation.payload.reservation_id !== reservation_id
+        || reservation.payload.claim_event_id !== attempt.claim_event_id) {
+        fail('RAIL_REWORK_RESERVATION_MISMATCH', 'rework reservation release does not match the active claim generation');
+      }
+      const existing = this.#records.find((record) => record.type === 'rework_reservation_released'
+        && record.payload?.reservation_id === reservation_id);
+      if (existing) return Object.freeze(canonicalize({ ...existing.payload, event_id: existing.event_id, replay: true }));
+      const unresolvedLaunch = this.#records.find((record) => record.type === 'rework_launch_reserved'
+        && record.payload?.reservation_id === reservation_id
+        && !this.#records.some((candidate) => candidate.type === 'execution_dispatched'
+          && candidate.payload?.invocation?.launch_nonce === record.payload.invocation.launch_nonce));
+      if (unresolvedLaunch) {
+        fail('RAIL_REWORK_LAUNCH_UNRESOLVED', 'rework reservation cannot be released while a launch intent lacks authenticated dispatch');
+      }
+      const unresolvedDispatch = this.#records.find((record) => record.type === 'execution_dispatched'
+        && record.payload?.run_kind === 'rework'
+        && record.payload?.rework_reservation_id === reservation_id
+        && !this.#records.some((candidate) => candidate.type === 'execution_recorded'
+          && candidate.payload?.execution_evidence?.receipt_nonce === record.payload.invocation.launch_nonce));
+      if (unresolvedDispatch) {
+        fail('RAIL_REWORK_DISPATCH_UNRESOLVED', 'rework reservation cannot be released while a dispatch lacks canonical execution evidence');
+      }
+      const payload = canonicalize({
+        attempt_id, claim_id, operator_id, harness_process_id,
+        source_decision_ref, reservation_id, reason,
+      });
+      const record = this.#append('rework_reservation_released', payload);
+      return Object.freeze(canonicalize({ ...payload, event_id: record.event_id, replay: false }));
+    });
+  }
+
   prepareEffect({ attempt_id, claim_id, side_effect_class, idempotency_key, effect_ref } = {}) {
     return this.#exclusive(() => {
     for (const [field, value] of Object.entries({ attempt_id, claim_id, side_effect_class, idempotency_key, effect_ref })) assertString(value, 'INVALID_EFFECT', field);
@@ -324,39 +1691,436 @@ export class RailEngine {
     });
   }
 
+  recordReviewDispatch({ attempt_id, invocation, launch_receipt, installation, snapshot, project_dir, working_dir = project_dir } = {}) {
+    return this.#exclusive(() => {
+      assertString(attempt_id, 'INVALID_REVIEW_DISPATCH', 'attempt_id');
+      assertObject(invocation, 'INVALID_REVIEW_DISPATCH', 'invocation');
+      assertObject(launch_receipt, 'INVALID_REVIEW_DISPATCH', 'launch_receipt');
+      assertString(invocation.invocation_id, 'INVALID_REVIEW_DISPATCH', 'invocation.invocation_id');
+      assertString(invocation.launch_nonce, 'INVALID_REVIEW_DISPATCH', 'invocation.launch_nonce');
+      assertString(invocation.prompt_digest, 'INVALID_REVIEW_DISPATCH', 'invocation.prompt_digest');
+      assertString(project_dir, 'INVALID_REVIEW_DISPATCH', 'project_dir');
+      assertString(working_dir, 'INVALID_REVIEW_DISPATCH', 'working_dir');
+      const attempt = this.#attempts().get(attempt_id);
+      if (!attempt || attempt.state !== EXECUTABLE_ATTEMPT_STATE) fail('ATTEMPT_NOT_ACTIVE', 'review dispatch requires an active attempt');
+      this.#assertLiveLease(attempt, timestamp(this.#clock));
+      if (unresolvedAdjudication(this.#records, attempt_id)) {
+        fail('RAIL_ADJUDICATION_REQUIRED', 'a canonical AI adjudication decision is required before another review can be dispatched');
+      }
+      if (invocation.attempt_id !== attempt_id || invocation.action !== 'review') fail('REVIEW_INVOCATION_MISMATCH', 'review launch is not bound to this attempt');
+      const selected = selectCanonicalReviewer({
+        installation, snapshot,
+        builder_identity: {
+          provider_id: attempt.execution_binding.provider_id,
+          model_id: attempt.execution_binding.model_id,
+        },
+        clock: this.#clock,
+      });
+      if (invocation.provider_id !== selected.provider_id
+        || invocation.harness_id !== selected.harness_id
+        || invocation.model_pin?.model_id !== selected.model_pin.model_id
+        || invocation.model_pin?.catalog_snapshot_ref !== selected.model_pin.catalog_snapshot_ref
+        || invocation.model_pin?.reasoning_configuration !== selected.model_pin.reasoning_configuration) {
+        fail('NONCANONICAL_REVIEWER', 'review launch must use the strongest canonical independent reviewer');
+      }
+      this.#verifyAuthority('review_launch', launch_receipt, {
+        purpose: 'terminal_launch', authority_kind: 'rail_review',
+        invocation_id: invocation.invocation_id, launch_nonce: invocation.launch_nonce,
+        provider_id: invocation.provider_id, harness_id: invocation.harness_id,
+        model_id: invocation.model_pin?.model_id,
+        reasoning_configuration: invocation.model_pin?.reasoning_configuration,
+        task_id: attempt.task_id,
+        working_dir: resolve(working_dir),
+        prompt_digest: invocation.prompt_digest,
+      });
+      if (launch_receipt.task_id !== attempt.task_id
+        || launch_receipt.working_dir !== resolve(working_dir)
+        || launch_receipt.prompt_digest !== invocation.prompt_digest
+        || !/^[a-f0-9]{64}$/.test(launch_receipt.command_digest || '')
+        || launch_receipt.process_containment_kind !== 'bubblewrap_pid_namespace_v1'
+        || typeof launch_receipt.process_containment_id !== 'string' || !launch_receipt.process_containment_id
+        || !/^[a-f0-9]{64}$/.test(launch_receipt.process_containment_digest || '')) {
+        fail('REVIEW_LAUNCH_RECEIPT_MISMATCH', 'review launch receipt must bind the canonical prompt, task, working directory and command');
+      }
+      const prior = this.#records.find((record) => ['execution_dispatched', 'review_dispatched', 'adjudication_dispatched'].includes(record.type)
+        && record.payload?.invocation?.launch_nonce === invocation.launch_nonce);
+      if (prior) fail('RAIL_LAUNCH_NONCE_CONFLICT', 'launch nonce is already registered');
+      const record = this.#append('review_dispatched', { attempt_id, invocation, launch_receipt });
+      return Object.freeze(canonicalize({ ...record.payload, event_id: record.event_id }));
+    });
+  }
+
+  recordAdjudicationDispatch({ attempt_id, review_ref, invocation, launch_receipt, project_dir, working_dir = project_dir } = {}) {
+    return this.#exclusive(() => {
+      for (const [field, value] of Object.entries({ attempt_id, review_ref })) assertString(value, 'INVALID_ADJUDICATION_DISPATCH', field);
+      assertObject(invocation, 'INVALID_ADJUDICATION_DISPATCH', 'invocation');
+      assertObject(launch_receipt, 'INVALID_ADJUDICATION_DISPATCH', 'launch_receipt');
+      assertString(invocation.invocation_id, 'INVALID_ADJUDICATION_DISPATCH', 'invocation.invocation_id');
+      assertString(invocation.launch_nonce, 'INVALID_ADJUDICATION_DISPATCH', 'invocation.launch_nonce');
+      assertString(invocation.prompt_digest, 'INVALID_ADJUDICATION_DISPATCH', 'invocation.prompt_digest');
+      assertString(project_dir, 'INVALID_ADJUDICATION_DISPATCH', 'project_dir');
+      assertString(working_dir, 'INVALID_ADJUDICATION_DISPATCH', 'working_dir');
+      const attempt = this.#attempts().get(attempt_id);
+      if (!attempt || attempt.state !== EXECUTABLE_ATTEMPT_STATE) fail('ATTEMPT_NOT_ACTIVE', 'adjudication dispatch requires an active attempt');
+      this.#assertLiveLease(attempt, timestamp(this.#clock));
+      const reviewRecord = [...this.#records].reverse().find((record) => record.type === 'review_decided' && record.payload?.attempt_id === attempt_id);
+      if (!reviewRecord || reviewRecord.payload.review_ref !== review_ref || reviewRecord.payload.decision?.decision !== 'AI_ADJUDICATION') {
+        fail('ADJUDICATION_NOT_AUTHORIZED', 'review does not authorize adjudication dispatch');
+      }
+      const selected = reviewRecord.payload.decision.adjudicators.some((candidate) =>
+        candidate.provider_id === invocation.provider_id
+        && candidate.harness_id === invocation.harness_id
+        && sha256(candidate.model_pin) === sha256(invocation.model_pin));
+      if (!selected || invocation.attempt_id !== attempt_id || invocation.action !== 'adjudication') {
+        fail('UNSELECTED_ADJUDICATOR', 'adjudication launch is not an exact selected invocation');
+      }
+      const roundState = adjudicationRoundState(
+        this.#records, attempt_id, review_ref, reviewRecord.payload.decision.adjudicators,
+      );
+      if (roundState.complete) fail('ADJUDICATION_ROUND_COMPLETE', 'the canonical adjudication round is already complete');
+      const alreadyObserved = roundState.current.some((entry) =>
+        entry.invocation.provider_id === invocation.provider_id
+        && entry.invocation.harness_id === invocation.harness_id);
+      if (alreadyObserved) fail('ADJUDICATOR_ALREADY_OBSERVED', 'this adjudicator already has canonical evidence in the current round');
+      if (invocation.adjudication_round !== roundState.round
+        || invocation.prior_decisions_digest !== sha256(roundState.prior_decisions)) {
+        fail('NONCANONICAL_ADJUDICATION_ROUND', 'adjudication launch is not bound to the canonical round and prior decisions');
+      }
+      this.#verifyAuthority('adjudication_launch', launch_receipt, {
+        purpose: 'terminal_launch', authority_kind: 'rail_adjudication',
+        invocation_id: invocation.invocation_id, launch_nonce: invocation.launch_nonce,
+        provider_id: invocation.provider_id, harness_id: invocation.harness_id,
+        model_id: invocation.model_pin?.model_id,
+        reasoning_configuration: invocation.model_pin?.reasoning_configuration,
+        task_id: attempt.task_id,
+        working_dir: resolve(working_dir),
+        prompt_digest: invocation.prompt_digest,
+      });
+      if (launch_receipt.task_id !== attempt.task_id
+        || launch_receipt.working_dir !== resolve(working_dir)
+        || launch_receipt.prompt_digest !== invocation.prompt_digest
+        || !/^[a-f0-9]{64}$/.test(launch_receipt.command_digest || '')
+        || launch_receipt.process_containment_kind !== 'bubblewrap_pid_namespace_v1'
+        || typeof launch_receipt.process_containment_id !== 'string' || !launch_receipt.process_containment_id
+        || !/^[a-f0-9]{64}$/.test(launch_receipt.process_containment_digest || '')) {
+        fail('ADJUDICATION_LAUNCH_RECEIPT_MISMATCH', 'adjudication launch receipt must bind the canonical prompt, task, working directory and command');
+      }
+      const prior = this.#records.find((record) => ['execution_dispatched', 'review_dispatched', 'adjudication_dispatched'].includes(record.type)
+        && record.payload?.invocation?.launch_nonce === invocation.launch_nonce);
+      if (prior) fail('RAIL_LAUNCH_NONCE_CONFLICT', 'launch nonce is already registered');
+      const record = this.#append('adjudication_dispatched', { attempt_id, review_ref, invocation, launch_receipt });
+      return Object.freeze(canonicalize({ ...record.payload, event_id: record.event_id }));
+    });
+  }
+
+  /** Journals each terminal-authorized adjudicator result before another round may start. */
+  recordAdjudicationObservation({
+    attempt_id, review_ref, invocation, decision, adjudication_output, terminal_authority_receipt,
+  } = {}) {
+    return this.#exclusive(() => {
+      for (const [field, value] of Object.entries({ attempt_id, review_ref })) assertString(value, 'INVALID_ADJUDICATION_OBSERVATION', field);
+      assertObject(invocation, 'INVALID_ADJUDICATION_OBSERVATION', 'invocation');
+      assertObject(terminal_authority_receipt, 'INVALID_ADJUDICATION_OBSERVATION', 'terminal_authority_receipt');
+      const attempt = this.#attempts().get(attempt_id);
+      if (!attempt || attempt.state !== EXECUTABLE_ATTEMPT_STATE) fail('ATTEMPT_NOT_ACTIVE', 'adjudication observation requires an active attempt');
+      this.#assertLiveLease(attempt, timestamp(this.#clock));
+      const reviewRecord = [...this.#records].reverse().find((record) => record.type === 'review_decided'
+        && record.payload?.attempt_id === attempt_id);
+      if (!reviewRecord || reviewRecord.payload.review_ref !== review_ref
+        || reviewRecord.payload.decision?.decision !== 'AI_ADJUDICATION') {
+        fail('ADJUDICATION_NOT_AUTHORIZED', 'the latest review decision does not authorize adjudication evidence');
+      }
+      const expected = reviewRecord.payload.decision.adjudicators;
+      const selected = expected.find((candidate) => candidate.provider_id === invocation.provider_id
+        && candidate.harness_id === invocation.harness_id
+        && sha256(candidate.model_pin) === sha256(invocation.model_pin));
+      if (!selected || invocation.attempt_id !== attempt_id || invocation.action !== 'adjudication') {
+        fail('UNSELECTED_ADJUDICATOR', 'adjudication observation is not from an exact selected invocation');
+      }
+      const roundState = adjudicationRoundState(this.#records, attempt_id, review_ref, expected);
+      if (roundState.complete || invocation.adjudication_round !== roundState.round
+        || invocation.prior_decisions_digest !== sha256(roundState.prior_decisions)) {
+        fail('NONCANONICAL_ADJUDICATION_ROUND', 'adjudication observation is not bound to the canonical round and prior decisions');
+      }
+      if (roundState.current.some((entry) => entry.invocation.provider_id === invocation.provider_id
+        && entry.invocation.harness_id === invocation.harness_id)) {
+        fail('ADJUDICATOR_ALREADY_OBSERVED', 'this adjudicator already has canonical evidence in the current round');
+      }
+      const dispatch = this.#records.find((record) => record.type === 'adjudication_dispatched'
+        && record.payload?.attempt_id === attempt_id
+        && record.payload?.review_ref === review_ref
+        && record.payload?.invocation?.launch_nonce === invocation.launch_nonce);
+      if (!dispatch || sha256(dispatch.payload.invocation) !== sha256(invocation)) {
+        fail('ADJUDICATION_DISPATCH_REQUIRED', 'adjudication observation requires its exact canonical launch');
+      }
+      this.#verifyAuthority('adjudication_completion', terminal_authority_receipt, {
+        purpose: 'terminal_completion', authority_kind: 'rail_adjudication',
+        invocation_id: invocation.invocation_id, launch_nonce: invocation.launch_nonce,
+        provider_id: invocation.provider_id, harness_id: invocation.harness_id,
+        model_id: invocation.model_pin?.model_id,
+        reasoning_configuration: invocation.model_pin?.reasoning_configuration,
+        exit_status: 0,
+      });
+      if (terminal_authority_receipt.launch_receipt_digest !== sha256(dispatch.payload.launch_receipt)
+        || terminal_authority_receipt.terminal_id !== dispatch.payload.launch_receipt.terminal_id
+        || terminal_authority_receipt.stdout_digest !== sha256(adjudication_output)) {
+        fail('ADJUDICATION_TERMINAL_AUTHORITY_MISMATCH', 'adjudication observation does not bind its canonical launch and full stdout');
+      }
+      const parsedDecision = parseAdjudicationOutput(adjudication_output);
+      if (sha256(parsedDecision) !== sha256(validateAdjudicationDecision(decision))) {
+        fail('ADJUDICATION_PAYLOAD_MISMATCH', 'adjudication observation differs from terminal-authorized stdout');
+      }
+      const observation = canonicalize({
+        round: roundState.round,
+        invocation,
+        decision: parsedDecision,
+        adjudication_output,
+        terminal_authority_receipt,
+      });
+      const existing = this.#records.find((record) => record.type === 'adjudication_observed'
+        && record.payload?.observation?.invocation?.launch_nonce === invocation.launch_nonce);
+      if (existing) {
+        if (sha256(existing.payload.observation) !== sha256(observation)) {
+          fail('ADJUDICATION_OBSERVATION_CONFLICT', 'launch nonce already has different adjudication evidence');
+        }
+        return Object.freeze(canonicalize({ ...observation, event_id: existing.event_id, replay: true }));
+      }
+      const record = this.#append('adjudication_observed', { attempt_id, review_ref, observation });
+      return Object.freeze(canonicalize({ ...observation, event_id: record.event_id, replay: false }));
+    });
+  }
+
   /**
    * Persists the Review Council transition that controls the next RAIL step.
-   * Review evidence itself remains external to this package, but the immutable
-   * reference and its selected decision become part of the canonical journal.
+   * Full review and invocation evidence is journaled with the immutable
+   * reference so review rounds cannot be reset through mutable external files.
    */
-  recordReviewDecision({ attempt_id, review_ref, decision, review, invocation, prior_review_evidence = [], installation, snapshot } = {}) {
+  recordReviewDecision({ attempt_id, review_ref, decision, review, invocation, terminal_authority_receipt, installation, snapshot, git_dir, result_commit_ref } = {}) {
     return this.#exclusive(() => {
       assertString(attempt_id, 'INVALID_REVIEW_DECISION', 'attempt_id');
       assertString(review_ref, 'INVALID_REVIEW_DECISION', 'review_ref');
       assertObject(decision, 'INVALID_REVIEW_DECISION', 'decision');
       if (!REVIEW_DECISIONS.has(decision.decision)) fail('INVALID_REVIEW_DECISION', 'decision is not a Review Council outcome');
+      assertObject(terminal_authority_receipt, 'INVALID_REVIEW_DECISION', 'terminal_authority_receipt');
+      this.#verifyAuthority('review_completion', terminal_authority_receipt, {
+        purpose: 'terminal_completion', authority_kind: 'rail_review',
+        invocation_id: invocation?.invocation_id, launch_nonce: invocation?.launch_nonce,
+        provider_id: invocation?.provider_id, harness_id: invocation?.harness_id,
+        model_id: invocation?.model_pin?.model_id,
+        reasoning_configuration: invocation?.model_pin?.reasoning_configuration,
+        exit_status: 0,
+      });
+      if (terminal_authority_receipt.purpose !== 'terminal_completion'
+        || terminal_authority_receipt.authority_kind !== 'rail_review'
+        || terminal_authority_receipt.invocation_id !== invocation?.invocation_id
+        || terminal_authority_receipt.launch_nonce !== invocation?.launch_nonce
+        || terminal_authority_receipt.exit_status !== 0
+        || typeof terminal_authority_receipt.authority_signature !== 'string') {
+        fail('REVIEW_TERMINAL_AUTHORITY_MISMATCH', 'review decision requires a successful authorized reviewer completion');
+      }
       const attempt = this.#attempts().get(attempt_id);
       if (!attempt || attempt.state !== EXECUTABLE_ATTEMPT_STATE) fail('ATTEMPT_NOT_ACTIVE', 'review decision requires an active attempt', { attempt_id });
       this.#assertLiveLease(attempt, timestamp(this.#clock));
+      const dispatch = this.#records.find((record) => record.type === 'review_dispatched'
+        && record.payload?.attempt_id === attempt_id
+        && record.payload?.invocation?.launch_nonce === invocation?.launch_nonce);
+      if (!dispatch || sha256(dispatch.payload.invocation) !== sha256(invocation)) {
+        fail('REVIEW_DISPATCH_REQUIRED', 'review completion requires an exact canonical launch');
+      }
+      if (terminal_authority_receipt.launch_receipt_digest !== sha256(dispatch.payload.launch_receipt)
+        || terminal_authority_receipt.terminal_id !== dispatch.payload.launch_receipt.terminal_id) {
+        fail('REVIEW_TERMINAL_AUTHORITY_MISMATCH', 'review completion does not bind the canonical launch');
+      }
+      assertString(git_dir, 'INVALID_REVIEW_DECISION', 'git_dir');
+      assertString(result_commit_ref, 'INVALID_REVIEW_DECISION', 'result_commit_ref');
       const validated = acceptReview({ review, invocation, installation, snapshot, clock: this.#clock });
       if (validated.attempt_id !== attempt_id) fail('REVIEW_ATTEMPT_MISMATCH', 'review is not bound to this RAIL attempt');
       const expectedRef = `rail-review://${attempt.handoff_id}/${attempt_id}/${validated.review_id}`;
       if (review_ref !== expectedRef) fail('REVIEW_REFERENCE_MISMATCH', 'review reference is not bound to the claimed handoff and attempt');
-      const expected = decideReviewProgress({ prior_review_evidence, current_review: validated, reviewer_invocation: invocation, installation, snapshot, clock: this.#clock });
-      if (sha256(expected) !== sha256(decision)) fail('REVIEW_DECISION_MISMATCH', 'journal decision does not match validated Review Council evidence');
       const existing = this.#records.find((record) => record.type === 'review_decided' && record.payload?.review_ref === review_ref);
       if (existing) {
-        if (existing.payload.attempt_id !== attempt_id || sha256(existing.payload.decision) !== sha256(decision)) {
+        if (existing.payload.attempt_id !== attempt_id
+          || existing.payload.result_commit_ref !== result_commit_ref
+          || sha256(existing.payload.decision) !== sha256(decision)
+          || sha256(existing.payload.review) !== sha256(validated)
+          || sha256(existing.payload.invocation) !== sha256(invocation)
+          || sha256(existing.payload.terminal_authority_receipt) !== sha256(terminal_authority_receipt)) {
           fail('REVIEW_DECISION_CONFLICT', 'review reference is already bound to different decision material', { review_ref });
         }
         return Object.freeze(canonicalize({ ...existing.payload, event_id: existing.event_id, replay: true }));
       }
-      const record = this.#append('review_decided', { attempt_id, task_id: attempt.task_id, review_ref, decision: canonicalize(decision) });
+      if (unresolvedAdjudication(this.#records, attempt_id)) {
+        fail('RAIL_ADJUDICATION_REQUIRED', 'a canonical AI adjudication decision is required before another review can be accepted');
+      }
+      if (this.#records.some((record) => record.type === 'review_decided'
+        && record.payload?.terminal_authority_receipt?.launch_nonce === invocation.launch_nonce)) {
+        fail('REVIEW_LAUNCH_ALREADY_RECEIPTED', 'this review launch already has a canonical decision');
+      }
+      const executionEvidence = this.#executionEvidence(attempt_id, { successfulOnly: true }).at(-1);
+      if (!executionEvidence || executionEvidence.result_commit_ref !== result_commit_ref) {
+        fail('REVIEW_EXECUTION_EVIDENCE_MISMATCH', 'review must bind the latest successful execution receipted in the canonical journal');
+      }
+      const latestControl = this.#records.filter((record) => ['review_decided', 'adjudication_decided'].includes(record.type)
+        && record.payload?.attempt_id === attempt_id).at(-1);
+      const requiredReworkSource = latestControl?.type === 'review_decided'
+        && latestControl.payload.decision?.decision === 'normal-rework'
+        ? latestControl.payload.review_ref
+        : latestControl?.type === 'adjudication_decided'
+          && latestControl.payload.decision?.outcome === 'bounded-correction'
+          ? latestControl.payload.adjudication_ref
+          : null;
+      if (requiredReworkSource && executionEvidence.source_decision_ref !== requiredReworkSource) {
+        fail('RAIL_REWORK_RESULT_REQUIRED', 'a successful canonical rework for the latest decision is required before another review');
+      }
+      verifyCommitDescendsFrom({ git_dir, base_commit_ref: attempt.git_commit_ref, result_commit_ref });
+      const priorReviewEvidence = this.#reviewEvidence(attempt_id);
+      const expected = decideReviewProgress({
+        prior_review_evidence: priorReviewEvidence,
+        current_review: validated,
+        reviewer_invocation: invocation,
+        installation,
+        snapshot,
+        clock: this.#clock,
+      });
+      if (sha256(expected) !== sha256(decision)) fail('REVIEW_DECISION_MISMATCH', 'journal decision does not match canonical Review Council history');
+      const record = this.#append('review_decided', {
+        attempt_id, task_id: attempt.task_id, review_ref,
+        base_commit_ref: attempt.git_commit_ref, result_commit_ref,
+        review: canonicalize(validated),
+        invocation: canonicalize(invocation),
+        terminal_authority_receipt: canonicalize(terminal_authority_receipt),
+        review_digest: sha256({ review: validated, invocation }),
+        decision: canonicalize(decision),
+      });
       return Object.freeze(canonicalize({ attempt_id, task_id: attempt.task_id, review_ref, decision, event_id: record.event_id, replay: false }));
     });
   }
 
-  recoverAttempt({ attempt_id, operator_id, harness_process_id, reconciliation, git_dir, lease_ttl_ms = 300000 } = {}) {
+  /** Persists the bounded consensus reached by the selected adjudication council. */
+  recordAdjudicationDecision({ attempt_id, review_ref, evidence } = {}) {
+    return this.#exclusive(() => {
+      for (const [field, value] of Object.entries({ attempt_id, review_ref })) assertString(value, 'INVALID_ADJUDICATION_RECORD', field);
+      if (!Array.isArray(evidence) || evidence.length === 0) fail('INVALID_ADJUDICATION_RECORD', 'adjudication evidence must be a non-empty array');
+      const attempt = this.#attempts().get(attempt_id);
+      if (!attempt || attempt.state !== EXECUTABLE_ATTEMPT_STATE) fail('ATTEMPT_NOT_ACTIVE', 'adjudication requires an active attempt', { attempt_id });
+      this.#assertLiveLease(attempt, timestamp(this.#clock));
+      const reviewRecord = [...this.#records].reverse().find((record) => record.type === 'review_decided'
+        && record.payload?.attempt_id === attempt_id);
+      if (!reviewRecord || reviewRecord.payload.review_ref !== review_ref
+        || reviewRecord.payload.decision?.decision !== 'AI_ADJUDICATION') {
+        fail('ADJUDICATION_NOT_AUTHORIZED', 'the latest review decision does not authorize AI adjudication');
+      }
+      const expected = reviewRecord.payload.decision.adjudicators;
+      if (evidence.length !== expected.length) fail('ADJUDICATION_COUNCIL_INCOMPLETE', 'every selected adjudicator must provide evidence');
+      const seen = new Set();
+      const normalizedEvidence = evidence.map((entry) => {
+        assertObject(entry, 'INVALID_ADJUDICATION_RECORD', 'adjudication evidence entry');
+        assertObject(entry.invocation, 'INVALID_ADJUDICATION_RECORD', 'adjudication evidence invocation');
+        assertObject(entry.terminal_authority_receipt, 'INVALID_ADJUDICATION_RECORD', 'terminal_authority_receipt');
+        assertString(entry.invocation.invocation_id, 'INVALID_ADJUDICATION_RECORD', 'invocation.invocation_id');
+        assertString(entry.invocation.launch_nonce, 'INVALID_ADJUDICATION_RECORD', 'invocation.launch_nonce');
+        const key = `${entry.invocation.provider_id}/${entry.invocation.harness_id}`;
+        if (seen.has(key)) fail('DUPLICATE_ADJUDICATOR', 'an adjudicator may appear only once');
+        seen.add(key);
+        const selected = expected.find((candidate) => candidate.provider_id === entry.invocation.provider_id
+          && candidate.harness_id === entry.invocation.harness_id
+          && sha256(candidate.model_pin) === sha256(entry.invocation.model_pin));
+        if (!selected || entry.invocation.action !== 'adjudication') fail('UNSELECTED_ADJUDICATOR', 'adjudication evidence contains an unselected invocation');
+        if (entry.invocation.attempt_id !== attempt_id) fail('ADJUDICATION_ATTEMPT_MISMATCH', 'adjudication invocation is not bound to this attempt');
+        const dispatch = this.#records.find((record) => record.type === 'adjudication_dispatched'
+          && record.payload?.attempt_id === attempt_id
+          && record.payload?.review_ref === review_ref
+          && record.payload?.invocation?.launch_nonce === entry.invocation.launch_nonce);
+        if (!dispatch || sha256(dispatch.payload.invocation) !== sha256(entry.invocation)) {
+          fail('ADJUDICATION_DISPATCH_REQUIRED', 'adjudication completion requires an exact canonical launch');
+        }
+        this.#verifyAuthority('adjudication_completion', entry.terminal_authority_receipt, {
+          purpose: 'terminal_completion', authority_kind: 'rail_adjudication',
+          invocation_id: entry.invocation.invocation_id, launch_nonce: entry.invocation.launch_nonce,
+          provider_id: entry.invocation.provider_id, harness_id: entry.invocation.harness_id,
+          model_id: entry.invocation.model_pin?.model_id,
+          reasoning_configuration: entry.invocation.model_pin?.reasoning_configuration,
+          exit_status: 0,
+        });
+        if (entry.terminal_authority_receipt.launch_receipt_digest !== sha256(dispatch.payload.launch_receipt)
+          || entry.terminal_authority_receipt.terminal_id !== dispatch.payload.launch_receipt.terminal_id
+          || entry.terminal_authority_receipt.stdout_digest !== sha256(entry.adjudication_output)) {
+          fail('ADJUDICATION_TERMINAL_AUTHORITY_MISMATCH', 'adjudication completion does not bind its canonical launch and full stdout');
+        }
+        const parsedDecision = parseAdjudicationOutput(entry.adjudication_output);
+        if (sha256(parsedDecision) !== sha256(validateAdjudicationDecision(entry.decision))) {
+          fail('ADJUDICATION_PAYLOAD_MISMATCH', 'adjudication decision differs from terminal-authorized stdout');
+        }
+        return canonicalize({
+          invocation: entry.invocation,
+          decision: parsedDecision,
+          terminal_authority_receipt: entry.terminal_authority_receipt,
+        });
+      });
+      const roundState = adjudicationRoundState(this.#records, attempt_id, review_ref, expected);
+      const canonicalEvidence = roundState.current.map((entry) => canonicalize({
+        invocation: entry.invocation,
+        decision: entry.decision,
+        terminal_authority_receipt: entry.terminal_authority_receipt,
+      }));
+      if (!roundState.complete || sha256(normalizedEvidence) !== sha256(canonicalEvidence)) {
+        fail('ADJUDICATION_OBSERVATIONS_REQUIRED', 'final adjudication must equal the complete canonical observed round');
+      }
+      const outcome = normalizedEvidence[0].decision.outcome;
+      if (!adjudicationEntriesAgree(normalizedEvidence)) {
+        fail('ADJUDICATION_CONSENSUS_MISMATCH', 'the final decision is not unanimous across selected adjudicators');
+      }
+      const decision = deriveAdjudicationConsensus({ handoff_id: attempt.handoff_id, attempt_id, evidence: normalizedEvidence });
+      const adjudication_ref = `rail-adjudication://${attempt.handoff_id}/${attempt_id}/adjudication-${sha256({ review_ref, evidence: normalizedEvidence, decision }).slice(0, 24)}`;
+      const existing = this.#records.find((record) => record.type === 'adjudication_decided' && record.payload?.attempt_id === attempt_id);
+      if (existing) {
+        if (existing.payload.review_ref !== review_ref || existing.payload.adjudication_ref !== adjudication_ref
+          || sha256(existing.payload.decision) !== sha256(decision)
+          || sha256(existing.payload.evidence) !== sha256(normalizedEvidence)) {
+          fail('ADJUDICATION_RECORD_CONFLICT', 'attempt already has different adjudication material');
+        }
+        return Object.freeze(canonicalize({ ...existing.payload, event_id: existing.event_id, replay: true }));
+      }
+      const record = this.#append('adjudication_decided', {
+        attempt_id, task_id: attempt.task_id, review_ref, adjudication_ref,
+        decision, evidence: normalizedEvidence,
+      });
+      let terminalTransition;
+      const terminalState = adjudicationAttemptState(decision);
+      if (terminalState === 'cancelled') {
+        terminalTransition = this.#append('attempt_cancelled', {
+          attempt_id,
+          task_id: attempt.task_id,
+          claim_id: attempt.claim.claim_id,
+          reason: 'handoff_revision_required',
+          adjudication_ref,
+          handoff_revision_ref: decision.handoff_revision_ref,
+          cancelled_at: timestamp(this.#clock),
+        }, record.event_id);
+      } else if (terminalState === 'blocked') {
+        terminalTransition = this.#append('attempt_blocked', {
+          attempt_id,
+          task_id: attempt.task_id,
+          claim_id: attempt.claim.claim_id,
+          reason: 'adjudication_authority_required',
+          adjudication_ref,
+          authority_reason: decision.authority_reason,
+          authority_reason_ref: decision.authority_reason_ref,
+          blocked_at: timestamp(this.#clock),
+        }, record.event_id);
+      }
+      return Object.freeze(canonicalize({
+        attempt_id, task_id: attempt.task_id, review_ref, adjudication_ref,
+        decision, evidence: normalizedEvidence, event_id: record.event_id,
+        ...(terminalTransition
+          ? { [terminalState === 'cancelled' ? 'attempt_cancellation_event_id' : 'attempt_block_event_id']: terminalTransition.event_id }
+          : {}),
+        replay: false,
+      }));
+    });
+  }
+
+  recoverAttempt({ attempt_id, operator_id, harness_process_id, git_dir, lease_ttl_ms = 300000 } = {}) {
     return this.#exclusive(() => {
     for (const [field, value] of Object.entries({ attempt_id, operator_id, harness_process_id })) assertString(value, 'INVALID_RECOVERY', field);
     assertString(git_dir, 'INVALID_RECOVERY', 'git_dir');
@@ -364,7 +2128,79 @@ export class RailEngine {
     if (!attempt || ![EXECUTABLE_ATTEMPT_STATE, 'ready_to_merge'].includes(attempt.state)) fail('ATTEMPT_NOT_RECOVERABLE', 'attempt is not recoverable', { attempt_id });
     const now = timestamp(this.#clock);
     if (!isExpired(attempt.claim, now)) fail('LEASE_STILL_ACTIVE', 'active lease cannot be recovered', { attempt_id });
-    validateRecoveryReconciliation(reconciliation, attempt, [...this.#effects().values()].filter((effect) => effect.attempt_id === attempt_id), git_dir);
+    const latestClaimMutation = [...this.#records].reverse().find((record) =>
+      ['attempt_claimed', 'attempt_heartbeat', 'attempt_relinquished', 'attempt_recovered'].includes(record.type)
+      && (record.payload?.attempt_id === attempt_id || record.payload?.attempt?.attempt_id === attempt_id));
+    const explicitlyRelinquished = latestClaimMutation?.type === 'attempt_relinquished';
+    const stoppedPid = explicitlyRelinquished
+      ? claimProcessPid(attempt)
+      : observeStoppedClaimProcess(attempt);
+    const successfulExecution = this.#executionEvidence(attempt_id, { successfulOnly: true }).at(-1);
+    const expectedRecoveryCommit = successfulExecution?.result_commit_ref ?? attempt.git_commit_ref;
+    verifyLocalGitCommit({ git_dir, git_commit_ref: attempt.git_commit_ref });
+    verifyLocalGitCommit({ git_dir, git_commit_ref: expectedRecoveryCommit });
+    const unresolvedLaunchReservations = this.#records.filter((record) => record.type === 'execution_launch_reserved'
+      && record.payload?.attempt_id === attempt_id
+      && !this.#records.some((candidate) => candidate.type === 'execution_dispatched'
+        && candidate.payload?.invocation?.launch_nonce === record.payload.invocation.launch_nonce));
+    if (unresolvedLaunchReservations.length > 0) {
+      fail('RECOVERY_EXECUTION_LAUNCH_UNRESOLVED', 'automatic recovery cannot prove whether a reserved provider launch started before the supervisor stopped', {
+        launch_nonces: unresolvedLaunchReservations.map((record) => record.payload.invocation.launch_nonce),
+      });
+    }
+    const unresolvedInitialDispatches = this.#records.filter((record) => record.type === 'execution_dispatched'
+      && record.payload?.attempt_id === attempt_id
+      && record.payload?.run_kind === 'initial'
+      && !this.#records.some((candidate) => candidate.type === 'execution_recorded'
+        && candidate.payload?.execution_evidence?.receipt_nonce === record.payload.invocation.launch_nonce));
+    if (unresolvedInitialDispatches.length > 0) {
+      fail('RECOVERY_EXECUTION_DISPATCH_UNRESOLVED', 'automatic recovery cannot authorize another mutating provider after an interrupted initial dispatch', {
+        launch_nonces: unresolvedInitialDispatches.map((record) => record.payload.invocation.launch_nonce),
+      });
+    }
+    const unresolvedReworkLaunches = this.#records.filter((record) => record.type === 'rework_launch_reserved'
+      && record.payload?.attempt_id === attempt_id
+      && !this.#records.some((candidate) => candidate.type === 'execution_dispatched'
+        && candidate.payload?.invocation?.launch_nonce === record.payload.invocation.launch_nonce));
+    if (unresolvedReworkLaunches.length > 0) {
+      fail('RECOVERY_REWORK_LAUNCH_UNRESOLVED', 'automatic recovery cannot prove whether a reserved rework launch started before the supervisor stopped', {
+        launch_nonces: unresolvedReworkLaunches.map((record) => record.payload.invocation.launch_nonce),
+      });
+    }
+    const unresolvedReworkDispatches = this.#records.filter((record) => record.type === 'execution_dispatched'
+      && record.payload?.attempt_id === attempt_id
+      && record.payload?.run_kind === 'rework'
+      && !this.#records.some((candidate) => candidate.type === 'execution_recorded'
+        && candidate.payload?.execution_evidence?.receipt_nonce === record.payload.invocation.launch_nonce));
+    if (unresolvedReworkDispatches.length > 0) {
+      fail('RECOVERY_REWORK_DISPATCH_UNRESOLVED', 'automatic recovery cannot authorize another mutating provider after an interrupted rework dispatch', {
+        launch_nonces: unresolvedReworkDispatches.map((record) => record.payload.invocation.launch_nonce),
+      });
+    }
+    const recoveryCausation = attempt.claim_event_id;
+    const effects = [...this.#effects().values()].filter((effect) => effect.attempt_id === attempt_id);
+    const unresolved = effects.filter((effect) => !effect.receipt_ref);
+    if (unresolved.length > 0) {
+      fail('RECOVERY_EFFECTS_UNRESOLVED', 'prepared effects without canonical receipts require external reconciliation before recovery', {
+        idempotency_keys: unresolved.map((effect) => effect.idempotency_key),
+      });
+    }
+    const priorCompletion = [...this.#records].reverse().find((record) => record.type === 'attempt_completed'
+      && record.payload?.completion?.attempt_id === attempt_id);
+    const reconciliation = canonicalize({
+      schema_version: 2,
+      status: 'safe_to_resume',
+      process: explicitlyRelinquished
+        ? { status: 'relinquished', pid: stoppedPid, evidence_refs: [`rail-observation://process/${attempt.claim.claim_id}/relinquished`] }
+        : { status: 'not_running', pid: stoppedPid, evidence_refs: [`rail-observation://process/${attempt.claim.claim_id}/not-running`] },
+      heartbeat: { status: 'expired', observed_at: now, evidence_refs: [`rail-observation://lease/${attempt.claim.claim_id}/expired`] },
+      git: { status: 'matched', commit_ref: expectedRecoveryCommit, evidence_refs: [`rail-observation://git/${expectedRecoveryCommit}`] },
+      ci: priorCompletion
+        ? { status: priorCompletion.payload.completion.ci.verdict, evidence_refs: priorCompletion.payload.completion.ci.evidence_refs }
+        : { status: 'not_started', evidence_refs: [`rail-observation://ci/${attempt_id}/not-started`] },
+      effects: effects.map((effect) => ({ idempotency_key: effect.idempotency_key, status: 'receipted', receipt_ref: effect.receipt_ref })),
+      execution_dispatches: [],
+    });
     const claim = canonicalize({
       ...attempt.claim,
       operator_id,
@@ -372,12 +2208,16 @@ export class RailEngine {
       lease: { acquired_at: now, heartbeat_at: now, expires_at: plusMs(now, lease_ttl_ms) },
     });
     const resume_state = attempt.state;
-    const record = this.#append('attempt_recovered', { attempt_id, claim, reconciliation, resume_state }, attempt.claim_event_id);
+    const record = this.#append('attempt_recovered', { attempt_id, claim, reconciliation, resume_state }, recoveryCausation);
     return Object.freeze(canonicalize({ attempt_id, claim, resume_state, event_id: record.event_id }));
     });
   }
 
-  completeAttempt({ completion_id, attempt_id, claim_id, operator_id, state, git, ci, reviews, acceptance_evidence_refs, completed_at, metrics, handoff } = {}) {
+  completeAttempt({
+    completion_id, attempt_id, claim_id, operator_id, state, git, ci, reviews,
+    acceptance_evidence_refs, acceptance_authority_receipt, browser_evidence,
+    completed_at, metrics, handoff,
+  } = {}) {
     return this.#exclusive(() => {
     assertString(completion_id, 'INVALID_COMPLETION', 'completion_id');
     assertString(attempt_id, 'INVALID_COMPLETION', 'attempt_id');
@@ -410,22 +2250,66 @@ export class RailEngine {
     const allowedTransition = (attempt?.state === EXECUTABLE_ATTEMPT_STATE && state === 'ready_to_merge') || (attempt?.state === 'ready_to_merge' && state === 'merged');
     if (!allowedTransition) fail('INVALID_COMPLETION_TRANSITION', 'completion transition is not allowed for attempt state', { attempt_id, state, current_state: attempt?.state });
     validateAttemptBinding({ attempt, handoff });
+    const task = handoff.tasks.find((candidate) => candidate.task_id === attempt.task_id);
+    let verifiedBrowserEvidence;
+    if (task?.requires_browser === true) {
+      const browserDispatch = [...this.#records].reverse().find((record) => record.type === 'execution_dispatched'
+        && record.payload?.attempt_id === attempt_id
+        && record.payload?.run_kind === 'initial'
+        && record.payload?.browser_manifest);
+      verifiedBrowserEvidence = validateRealBrowserEvidence({
+        evidence: browser_evidence,
+        task,
+        attemptId: attempt_id,
+        commitRef: git.result_ref,
+        acceptanceEvidenceRefs: acceptance_evidence_refs,
+        delegationManifest: browserDispatch?.payload?.browser_manifest,
+        verifyAuthority: (receipt, expected) => this.#verifyAuthority('browser_evidence', receipt, expected),
+      });
+    } else if (browser_evidence !== undefined) {
+      fail('UNEXPECTED_BROWSER_EVIDENCE', 'non-browser task completion must not claim real browser evidence');
+    }
     if (attempt.claim.claim_id !== claim_id || attempt.claim.operator_id !== operator_id) fail('CLAIM_OWNER_MISMATCH', 'only the active claim owner may complete an attempt', { attempt_id });
     this.#assertLiveLease(attempt, timestamp(this.#clock));
-    this.#assertAcceptedReviews(attempt_id, reviews);
-    if (!git.commit_refs.includes(attempt.git_commit_ref)) fail('GIT_COMMIT_MISMATCH', 'completion must include the sealed attempt commit', { attempt_id });
+    assertString(git.base_ref, 'INVALID_COMPLETION', 'git.base_ref');
+    assertString(git.result_ref, 'INVALID_COMPLETION', 'git.result_ref');
+    if (git.base_ref !== attempt.git_commit_ref) fail('GIT_BASE_MISMATCH', 'completion base_ref must equal the sealed attempt commit', { attempt_id });
+    if (!git.commit_refs.includes(git.base_ref) || !git.commit_refs.includes(git.result_ref)) {
+      fail('GIT_COMMIT_MISMATCH', 'completion commit_refs must include both sealed base and reviewed result commits', { attempt_id });
+    }
     for (const commit of git.commit_refs) verifyLocalGitCommit({ git_dir: git.git_dir, git_commit_ref: commit });
-    if (ci.commit_ref !== undefined && ci.commit_ref !== attempt.git_commit_ref) fail('CI_SHA_MISMATCH', 'CI evidence must be bound to sealed attempt commit', { attempt_id });
+    verifyCommitDescendsFrom({ git_dir: git.git_dir, base_commit_ref: git.base_ref, result_commit_ref: git.result_ref });
+    assertString(ci.commit_ref, 'INVALID_COMPLETION', 'ci.commit_ref');
+    if (ci.commit_ref !== git.result_ref) fail('CI_SHA_MISMATCH', 'CI evidence must be bound to the reviewed result commit', { attempt_id });
+    assertObject(ci.authority_receipt, 'UNTRUSTED_CI_EVIDENCE', 'ci.authority_receipt');
+    this.#verifyAuthority('ci_evidence', ci.authority_receipt, {
+      purpose: 'rail_evidence', authority_kind: 'rail_ci', attempt_id,
+      commit_ref: git.result_ref, verdict: 'passed', evidence_digest: sha256(ci.evidence_refs),
+    });
+    assertObject(acceptance_authority_receipt, 'UNTRUSTED_ACCEPTANCE_EVIDENCE', 'acceptance_authority_receipt');
+    this.#verifyAuthority('acceptance_evidence', acceptance_authority_receipt, {
+      purpose: 'rail_evidence', authority_kind: 'rail_acceptance', attempt_id,
+      commit_ref: git.result_ref, verdict: 'passed', evidence_digest: sha256(acceptance_evidence_refs),
+    });
+    if (unresolvedAdjudication(this.#records, attempt_id)) {
+      fail('RAIL_ADJUDICATION_REQUIRED', 'attempt completion requires the pending AI adjudication to be decided first');
+    }
+    const acceptedReview = this.#assertAcceptedReviews(attempt_id, reviews);
+    if (acceptedReview.payload.result_commit_ref !== git.result_ref) {
+      fail('REVIEW_GIT_MISMATCH', 'accepted review must be bound to the completion result commit', { attempt_id });
+    }
     const now = timestamp(this.#clock);
     const completion = canonicalize({
       completion_id,
       attempt_id,
       task_id: attempt.task_id,
       state,
-      git: { ...(git.base_ref ? { base_ref: git.base_ref } : {}), commit_refs: git.commit_refs, ...(git.pr_ref ? { pr_ref: git.pr_ref } : {}) },
-      ci: { evidence_refs: ci.evidence_refs, verdict: ci.verdict, ...(ci.commit_ref ? { commit_ref: ci.commit_ref } : {}) },
+      git: { base_ref: git.base_ref, result_ref: git.result_ref, commit_refs: git.commit_refs, ...(git.pr_ref ? { pr_ref: git.pr_ref } : {}) },
+      ci: { evidence_refs: ci.evidence_refs, verdict: ci.verdict, commit_ref: ci.commit_ref, authority_receipt: ci.authority_receipt },
       reviews,
       acceptance_evidence_refs,
+      acceptance_authority_receipt,
+      ...(verifiedBrowserEvidence === undefined ? {} : { browser_evidence: verifiedBrowserEvidence }),
       ...(metrics === undefined ? {} : { metrics }),
       completed_at: completed_at ?? now,
     });