chati-dev 4.5.27 → 4.5.29

package/src/orchestrator/cli.js

@@ -12,9 +12,24 @@
  */
 
 import { resolveFrameworkDir } from '../utils/framework-dir.js';
+import { DELEGATED_EXECUTION_BOUNDARY } from '../utils/execution-role.js';
+import { findAgentHandoffPath } from '../utils/handoff-paths.js';
+import {
+  rejectLegacyAgentResult, rejectAgentResult, revalidateQaAfterCouncil, pinHeldCouncilQaSubject, releaseAgentExecution, summarizePendingInteraction,
+  inspectPlanningCorrectionRollback, rollbackPlanningCorrection, getPendingPlanningRollbackTarget,
+  reservePlanningContractRevision, settlePlanningContractRevision, getPlanningContractRevisionOwner,
+  MAX_PLANNING_RECONCILIATION_TARGETS,
+} from './session-manager.js';
+import { withUpgradeMaintenance } from '../upgrade/maintenance.js';
+import { executePlanningReconciliation } from '../terminal/run-planning-reconciliation.js';
+import { persistPlanningContractRevision, planningContractRevisionCapability } from './planning-contract-revision.js';
 import { parseProviderConfig } from '../utils/config-parser.js';
 import { isFeatureEnabled } from '../utils/feature-flags.js';
 import { runScriptTask, formatScriptHandoff } from '../executors/runner.js';
+import {
+  directoryPathSync, duplicateDirectorySync, linkAtSync, lstatAtSync, mkdirAtSync,
+  openAtSync, readDirectorySync, renameAtSync, unlinkAtSync,
+} from '@chati/core';
 
 import {
   loadSession, readSessionSafe, initSession, updateSession, transitionSessionLifecycle, rollbackSessionLifecycle,
@@ -47,10 +62,13 @@ import {
 import { analyzeDeviationImpact, applyDeviation } from './index.js';
 import { detectQuickFlow, detectStandardFlow } from './index.js';
 import { getAgentFile } from '../terminal/prompt-builder.js';
+import { getQaThreshold, assertQaCorrectionTarget } from './pipeline-manager.js';
+import { isPlanningQaOutcomeValid } from '../terminal/handoff-parser.js';
+import { getAgentTimeout } from '../terminal/agent-attempt-budget.js';
 import {
   readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync,
-  lstatSync, realpathSync, renameSync, rmSync, openSync, closeSync, constants,
-  fstatSync, fchmodSync, chmodSync, readSync, linkSync, unlinkSync, fsyncSync, writeSync,
+  openSync, closeSync, constants,
+  fstatSync, fchmodSync, readSync, fsyncSync, writeSync,
 } from 'fs';
 import { basename, join, parse, resolve, dirname, relative, isAbsolute, sep } from 'path';
 import { fileURLToPath } from 'url';
@@ -67,10 +85,12 @@ import { updateProjectContext } from '../memory/magic-docs.js';
 import {
   loadRuntimeInstallationV2, resolveRuntimeInvocationV2,
   resolveRuntimeAdjudicationV2, describeRuntimeInstallationV2, V2_PLANNING_AGENTS,
-  assertV2PlanningPredecessors,
+  assertV2PlanningPredecessors, resolveRuntimeCouncilGatePolicyV2,
 } from './runtime-installation-v2.js';
-import { compilePlanningHandoff, PLANNING_V2_TASKS_PATH } from './planning-runtime.js';
-import { persistRailHandoff } from './rail-runtime.js';
+import { compilePlanningHandoff, PLANNING_V2_TASKS_CANDIDATE_PATH } from './planning-runtime.js';
+import { persistRailHandoff, persistRailHandoffCouncilBinding } from './rail-runtime.js';
+import { assertCouncilGateApproved } from './council-gate-runtime.js';
+import { executeCouncilGate } from '../terminal/run-council-gate.js';
 import {
   installationAuthorityProjectScope, signHostAuthorityPayload, verifyHostAuthorityPayload,
 } from '../installer-v2/installation-authority.js';
@@ -118,8 +138,8 @@ function samePublishedRuntimeFile(left, right) {
 }
 
 function openRuntimeDirectoryNoFollow(runtimePath) {
-  if (process.platform !== 'linux') {
-    throw Object.assign(new Error('Runtime request authority requires Linux descriptor-relative filesystem operations'), { code: 'UNSUPPORTED_RUNTIME_REQUEST_PLATFORM' });
+  if (!['linux', 'darwin'].includes(process.platform)) {
+    throw Object.assign(new Error(`Runtime request authority requires descriptor-relative operations; unsupported platform: ${process.platform}`), { code: 'UNSUPPORTED_RUNTIME_REQUEST_PLATFORM' });
   }
   const absolute = resolve(runtimePath);
   const root = parse(absolute).root;
@@ -128,15 +148,15 @@ function openRuntimeDirectoryNoFollow(runtimePath) {
   let fd;
   try {
     fd = anchor
-      ? openSync(`/proc/self/fd/${anchor.descriptor}`, constants.O_RDONLY | (constants.O_DIRECTORY || 0))
+      ? duplicateDirectorySync(anchor.descriptor)
       : openSync(root, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
   } finally {
     if (anchor) closeSync(anchor.descriptor);
   }
   try {
     for (const segment of segments) {
-      const child = openSync(
-        join(`/proc/self/fd/${fd}`, segment),
+      const child = openAtSync(
+        fd, segment,
         constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0),
       );
       const stat = fstatSync(child);
@@ -147,7 +167,8 @@ function openRuntimeDirectoryNoFollow(runtimePath) {
       closeSync(fd);
       fd = child;
     }
-    return { fd, stat: fstatSync(fd), absolute, reference: `/proc/self/fd/${fd}` };
+    // reference is diagnostic only. Persistence uses fd plus explicit names.
+    return { fd, stat: fstatSync(fd), absolute, reference: directoryPathSync(fd) };
   } catch (error) {
     closeSync(fd);
     if (['ELOOP', 'ENOTDIR'].includes(error?.code)) {
@@ -174,8 +195,8 @@ function assertRuntimeDirectoryRecord(record) {
 }
 
 function openScriptHandoffDirectoryNoFollow(directoryPath, { create = false } = {}) {
-  if (process.platform !== 'linux') {
-    throw Object.assign(new Error('Script handoff persistence requires Linux descriptor-relative filesystem operations'), { code: 'UNSUPPORTED_SCRIPT_HANDOFF_PLATFORM' });
+  if (!['linux', 'darwin'].includes(process.platform)) {
+    throw Object.assign(new Error(`Script handoff persistence requires descriptor-relative operations; unsupported platform: ${process.platform}`), { code: 'UNSUPPORTED_SCRIPT_HANDOFF_PLATFORM' });
   }
   const absolute = resolve(directoryPath);
   const root = parse(absolute).root;
@@ -184,22 +205,21 @@ function openScriptHandoffDirectoryNoFollow(directoryPath, { create = false } =
   let fd;
   try {
     fd = anchor
-      ? openSync(`/proc/self/fd/${anchor.descriptor}`, constants.O_RDONLY | (constants.O_DIRECTORY || 0))
+      ? duplicateDirectorySync(anchor.descriptor)
       : openSync(root, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
   } finally {
     if (anchor) closeSync(anchor.descriptor);
   }
   try {
     for (const segment of segments) {
-      const entry = join(`/proc/self/fd/${fd}`, segment);
       let child;
       try {
-        child = openSync(entry, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+        child = openAtSync(fd, segment, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
       } catch (error) {
         if (error?.code !== 'ENOENT' || !create) throw error;
-        try { mkdirSync(entry, { mode: 0o700 }); }
+        try { mkdirAtSync(fd, segment, { mode: 0o700 }); }
         catch (mkdirError) { if (mkdirError?.code !== 'EEXIST') throw mkdirError; }
-        child = openSync(entry, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+        child = openAtSync(fd, segment, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
       }
       const stat = fstatSync(child);
       if (!stat.isDirectory()) {
@@ -209,7 +229,8 @@ function openScriptHandoffDirectoryNoFollow(directoryPath, { create = false } =
       closeSync(fd);
       fd = child;
     }
-    return { fd, stat: fstatSync(fd), absolute, reference: `/proc/self/fd/${fd}` };
+    // reference is diagnostic only. Persistence uses fd plus explicit names.
+    return { fd, stat: fstatSync(fd), absolute, reference: directoryPathSync(fd) };
   } catch (error) {
     closeSync(fd);
     if (['ELOOP', 'ENOTDIR'].includes(error?.code)) {
@@ -242,56 +263,52 @@ export function shellQuote(value) {
   return `'${String(value).replaceAll("'", `'"'"'`)}'`;
 }
 
-function ensureRuntimeResponsePath(projectDir, filename) {
+function captureRuntimePath(projectDir, filename) {
   if (!/^[A-Za-z0-9_-]+\.json$/.test(filename)) {
     throw Object.assign(new Error('Runtime response filename is not path-safe'), { code: 'UNSAFE_RUNTIME_PATH' });
   }
   const projectPath = resolve(projectDir);
-  const chatiPath = join(projectPath, '.chati');
-  if (!existsSync(chatiPath) || lstatSync(chatiPath).isSymbolicLink() || !lstatSync(chatiPath).isDirectory()) {
-    throw Object.assign(new Error('The .chati directory must be a real directory'), { code: 'UNSAFE_RUNTIME_PATH' });
-  }
-  const realProject = realpathSync(projectPath);
-  const realChati = realpathSync(chatiPath);
-  const chatiRelative = relative(realProject, realChati);
-  if (!chatiRelative || chatiRelative.startsWith('..') || isAbsolute(chatiRelative)) {
-    throw Object.assign(new Error('The .chati directory must remain inside the project'), { code: 'UNSAFE_RUNTIME_PATH' });
-  }
-  const runtimePath = join(chatiPath, 'runtime');
-  if (!existsSync(runtimePath)) mkdirSync(runtimePath, { mode: 0o700 });
-  const runtimeStat = lstatSync(runtimePath);
-  if (runtimeStat.isSymbolicLink() || !runtimeStat.isDirectory()) {
-    throw Object.assign(new Error('The .chati/runtime directory must be a real directory'), { code: 'UNSAFE_RUNTIME_PATH' });
-  }
-  if (typeof process.getuid !== 'function' || runtimeStat.uid === process.getuid()) chmodSync(runtimePath, 0o700);
-  const realRuntime = realpathSync(runtimePath);
-  const runtimeRelative = relative(realChati, realRuntime);
-  if (!runtimeRelative || runtimeRelative.startsWith('..') || isAbsolute(runtimeRelative)) {
-    throw Object.assign(new Error('The runtime directory must remain inside .chati'), { code: 'UNSAFE_RUNTIME_PATH' });
-  }
-  const target = join(realRuntime, filename);
-  if (existsSync(target)) {
-    const targetStat = lstatSync(target);
-    if (targetStat.isSymbolicLink() || !targetStat.isFile()) {
+  const runtimePath = join(projectPath, '.chati', 'runtime');
+  const project = openRuntimeDirectoryNoFollow(projectPath);
+  let chatiFd;
+  let fd;
+  try {
+    chatiFd = openAtSync(project.fd, '.chati', constants.O_RDONLY | constants.O_DIRECTORY);
+    runRuntimeSecurityTestHook('beforeRuntimeDirectoryCreate', { projectPath, runtimePath });
+    try { fd = openAtSync(chatiFd, 'runtime', constants.O_RDONLY | constants.O_DIRECTORY); }
+    catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+      try { mkdirAtSync(chatiFd, 'runtime', { mode: 0o700 }); }
+      catch (mkdirError) { if (mkdirError.code !== 'EEXIST') throw mkdirError; }
+      fd = openAtSync(chatiFd, 'runtime', constants.O_RDONLY | constants.O_DIRECTORY);
+    }
+    const runtimeIdentity = fstatSync(fd);
+    if (typeof process.getuid !== 'function' || runtimeIdentity.uid === process.getuid()) fchmodSync(fd, 0o700);
+    let existing;
+    try { existing = lstatAtSync(fd, filename); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; }
+    // An interrupted claim restore may temporarily have exactly two links.
+    // Recovery authenticates that pair before normal single-link checks run.
+    if (existing && (existing.isSymbolicLink() || !existing.isFile())) {
       throw Object.assign(new Error('The runtime response target must be a regular file'), { code: 'UNSAFE_RUNTIME_PATH' });
     }
+    const reference = directoryPathSync(fd);
+    const record = {
+      projectDir: projectPath, target: join(runtimePath, filename), targetName: filename,
+      targetEntry: join(reference, filename), runtimePath, runtimeIdentity, fd, reference,
+    };
+    assertRuntimeDirectoryRecord(record);
+    return record;
+  } catch (error) {
+    if (fd !== undefined) closeSync(fd);
+    if (['ELOOP', 'ENOTDIR'].includes(error.code)) {
+      throw Object.assign(new Error('Runtime storage must contain only real directories'), { code: 'UNSAFE_RUNTIME_PATH', cause: error });
+    }
+    throw error;
+  } finally {
+    if (chatiFd !== undefined) closeSync(chatiFd);
+    closeSync(project.fd);
   }
-  return target;
-}
-
-function captureRuntimePath(projectDir, filename) {
-  const target = ensureRuntimeResponsePath(projectDir, filename);
-  const runtimePath = dirname(target);
-  const opened = openRuntimeDirectoryNoFollow(runtimePath);
-  return {
-    projectDir: resolve(projectDir),
-    target,
-    targetEntry: join(opened.reference, basename(target)),
-    runtimePath,
-    runtimeIdentity: opened.stat,
-    fd: opened.fd,
-    reference: opened.reference,
-  };
 }
 
 function closeRuntimeRecord(record) {
@@ -305,10 +322,10 @@ function runtimeProcessAlive(pid) {
   try { process.kill(pid, 0); return true; } catch (error) { return error?.code === 'EPERM'; }
 }
 
-function finalizeRuntimeRequestRestore(runtimeRecord, claimEntry, canonicalEntry, expectedIdentity) {
+function finalizeRuntimeRequestRestore(runtimeRecord, claimName, canonicalName, expectedIdentity) {
   assertRuntimeDirectoryRecord(runtimeRecord);
-  const claimStat = lstatSync(claimEntry, { bigint: true });
-  const canonicalStat = lstatSync(canonicalEntry, { bigint: true });
+  const claimStat = lstatAtSync(runtimeRecord.fd, claimName, { bigint: true });
+  const canonicalStat = lstatAtSync(runtimeRecord.fd, canonicalName, { bigint: true });
   if (claimStat.isSymbolicLink() || !claimStat.isFile()
     || canonicalStat.isSymbolicLink() || !canonicalStat.isFile()
     || !sameRuntimeIdentity(claimStat, expectedIdentity)
@@ -317,10 +334,10 @@ function finalizeRuntimeRequestRestore(runtimeRecord, claimEntry, canonicalEntry
     || claimStat.nlink !== 2n || canonicalStat.nlink !== 2n) {
     throw Object.assign(new Error('Runtime request restoration links do not identify one safe file'), { code: 'RUNTIME_REQUEST_CLAIM_CONFLICT' });
   }
-  unlinkSync(claimEntry);
+  unlinkAtSync(runtimeRecord.fd, claimName);
   fsyncSync(runtimeRecord.fd);
   assertRuntimeDirectoryRecord(runtimeRecord);
-  const restored = lstatSync(canonicalEntry, { bigint: true });
+  const restored = lstatAtSync(runtimeRecord.fd, canonicalName, { bigint: true });
   if (restored.isSymbolicLink() || !restored.isFile()
     || !sameRuntimeIdentity(restored, expectedIdentity) || restored.nlink !== 1n) {
     throw Object.assign(new Error('Restored runtime request did not become one canonical link'), { code: 'RUNTIME_REQUEST_CLAIM_CONFLICT' });
@@ -330,7 +347,7 @@ function finalizeRuntimeRequestRestore(runtimeRecord, claimEntry, canonicalEntry
 
 function recoverInterruptedRuntimeClaim(runtimeRecord) {
   const claimPattern = /^\.claimed-(\d+)-[A-Fa-f0-9-]{36}\.json$/;
-  const claims = readdirSync(runtimeRecord.reference)
+  const claims = readDirectorySync(runtimeRecord.fd)
     .map((name) => ({ name, match: name.match(claimPattern) }))
     .filter((entry) => entry.match);
   if (claims.length === 0) return false;
@@ -339,18 +356,18 @@ function recoverInterruptedRuntimeClaim(runtimeRecord) {
   }
   const [{ name, match }] = claims;
   const claimEntry = join(runtimeRecord.reference, name);
-  const claimStat = lstatSync(claimEntry, { bigint: true });
+  const claimStat = lstatAtSync(runtimeRecord.fd, name, { bigint: true });
   if (claimStat.isSymbolicLink() || !claimStat.isFile()
     || ![1n, 2n].includes(claimStat.nlink)
     || claimStat.size > BigInt(RUNTIME_JSON_MAX_BYTES)) {
     throw Object.assign(new Error('Interrupted runtime claim is not a safe request file'), { code: 'INVALID_RUNTIME_JSON' });
   }
   let canonical;
-  try { canonical = lstatSync(runtimeRecord.targetEntry, { bigint: true }); }
+  try { canonical = lstatAtSync(runtimeRecord.fd, runtimeRecord.targetName, { bigint: true }); }
   catch (error) { if (error?.code !== 'ENOENT') throw error; }
   if (canonical) {
     if (sameRuntimeIdentity(canonical, claimStat)) {
-      return finalizeRuntimeRequestRestore(runtimeRecord, claimEntry, runtimeRecord.targetEntry, claimStat);
+      return finalizeRuntimeRequestRestore(runtimeRecord, name, runtimeRecord.targetName, claimStat);
     }
   }
   if (runtimeProcessAlive(Number(match[1]))) {
@@ -362,17 +379,18 @@ function recoverInterruptedRuntimeClaim(runtimeRecord) {
   if (claimStat.nlink !== 1n) {
     throw Object.assign(new Error('Interrupted runtime claim is not a safe request file'), { code: 'INVALID_RUNTIME_JSON' });
   }
-  linkSync(claimEntry, runtimeRecord.targetEntry);
+  linkAtSync(runtimeRecord.fd, name, runtimeRecord.fd, runtimeRecord.targetName);
   runRuntimeSecurityTestHook('afterRuntimeClaimRestoreLink', { claimPath: claimEntry, canonicalPath: runtimeRecord.targetEntry });
-  return finalizeRuntimeRequestRestore(runtimeRecord, claimEntry, runtimeRecord.targetEntry, claimStat);
+  return finalizeRuntimeRequestRestore(runtimeRecord, name, runtimeRecord.targetName, claimStat);
 }
 
 function writePrivateRuntimeJson(runtimeRecord, payload, { preserveExisting = false } = {}) {
   if (runtimeRecord?.fd === undefined || runtimeRecord?.fd === null
-    || !runtimeRecord?.targetEntry || !runtimeRecord?.reference) {
+    || !runtimeRecord?.targetName) {
     throw Object.assign(new Error('Runtime response persistence requires a pinned runtime directory'), { code: 'UNSAFE_RUNTIME_PATH' });
   }
-  const temporary = join(runtimeRecord.reference, `.pending-${process.pid}-${randomUUID()}.tmp`);
+  const temporaryName = `.pending-${process.pid}-${randomUUID()}.tmp`;
+  const temporary = join(runtimeRecord.reference, temporaryName);
   let descriptor;
   let written;
   let publicationAttempted = false;
@@ -387,7 +405,7 @@ function writePrivateRuntimeJson(runtimeRecord, payload, { preserveExisting = fa
     assertRuntimeDirectoryRecord(runtimeRecord);
 
     let existing;
-    try { existing = lstatSync(runtimeRecord.targetEntry, { bigint: true }); }
+    try { existing = lstatAtSync(runtimeRecord.fd, runtimeRecord.targetName, { bigint: true }); }
     catch (error) { if (error?.code !== 'ENOENT') throw error; }
     if (existing) {
       if (existing.isSymbolicLink() || !existing.isFile() || existing.nlink !== 1n) {
@@ -396,8 +414,8 @@ function writePrivateRuntimeJson(runtimeRecord, payload, { preserveExisting = fa
       if (preserveExisting) return;
     }
 
-    descriptor = openSync(
-      temporary,
+    descriptor = openAtSync(
+      runtimeRecord.fd, temporaryName,
       constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0),
       0o600,
     );
@@ -422,8 +440,8 @@ function writePrivateRuntimeJson(runtimeRecord, payload, { preserveExisting = fa
       throw Object.assign(new Error('The temporary runtime response changed before publication'), { code: 'UNSAFE_RUNTIME_PATH' });
     }
     publicationAttempted = true;
-    renameSync(temporary, runtimeRecord.targetEntry);
-    const committed = lstatSync(runtimeRecord.targetEntry, { bigint: true });
+    renameAtSync(runtimeRecord.fd, temporaryName, runtimeRecord.fd, runtimeRecord.targetName);
+    const committed = lstatAtSync(runtimeRecord.fd, runtimeRecord.targetName, { bigint: true });
     if (committed.isSymbolicLink() || !committed.isFile() || !samePublishedRuntimeFile(committed, written)
       || !samePublishedRuntimeFile(fstatSync(descriptor, { bigint: true }), written)) {
       throw Object.assign(new Error('The published runtime response differs from its pinned temporary file'), { code: 'UNSAFE_RUNTIME_PATH' });
@@ -433,11 +451,11 @@ function writePrivateRuntimeJson(runtimeRecord, payload, { preserveExisting = fa
     published = true;
   } finally {
     if (descriptor !== undefined) closeSync(descriptor);
-    try { unlinkSync(temporary); } catch { /* preserve primary response result */ }
+    try { unlinkAtSync(runtimeRecord.fd, temporaryName); } catch { /* preserve primary response result */ }
     if (publicationAttempted && !published && written) {
       try {
-        const current = lstatSync(runtimeRecord.targetEntry, { bigint: true });
-        if (current.isFile() && !current.isSymbolicLink() && !sameRuntimeIdentity(current, written)) unlinkSync(runtimeRecord.targetEntry);
+        const current = lstatAtSync(runtimeRecord.fd, runtimeRecord.targetName, { bigint: true });
+        if (current.isFile() && !current.isSymbolicLink() && !sameRuntimeIdentity(current, written)) unlinkAtSync(runtimeRecord.fd, runtimeRecord.targetName);
       } catch { /* preserve primary response result */ }
     }
   }
@@ -483,8 +501,8 @@ function claimRuntimeRequest(runtimeRecord) {
     assertRuntimeDirectoryRecord(runtimeRecord);
     recoverInterruptedRuntimeClaim(runtimeRecord);
     runRuntimeSecurityTestHook('beforeRuntimeRequestOpen', { canonicalPath, directory: runtimeRecord.runtimePath });
-    claim.fd = openSync(
-      claim.canonicalEntry,
+    claim.fd = openAtSync(
+      runtimeRecord.fd, runtimeRecord.targetName,
       constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0),
     );
     claim.identity = fstatSync(claim.fd, { bigint: true });
@@ -494,9 +512,9 @@ function claimRuntimeRequest(runtimeRecord) {
     }
     runRuntimeSecurityTestHook('beforeRuntimeClaimRename', { canonicalPath, claimPath: claim.claimPath });
     assertRuntimeDirectoryRecord(runtimeRecord);
-    renameSync(claim.canonicalEntry, claim.claimPath);
+    renameAtSync(runtimeRecord.fd, runtimeRecord.targetName, runtimeRecord.fd, claimName);
     fsyncSync(runtimeRecord.fd);
-    const claimedPathStat = lstatSync(claim.claimPath, { bigint: true });
+    const claimedPathStat = lstatAtSync(runtimeRecord.fd, claimName, { bigint: true });
     if (claimedPathStat.isSymbolicLink() || !claimedPathStat.isFile()
       || !sameRuntimeIdentity(claimedPathStat, claim.identity)) {
       throw Object.assign(new Error('Runtime JSON changed while it was being claimed'), { code: 'INVALID_RUNTIME_JSON' });
@@ -518,26 +536,26 @@ function claimRuntimeRequest(runtimeRecord) {
 function restoreRuntimeRequest(claim) {
   if (!claim?.claimPath || !claim.identity) return false;
   let current;
-  try { current = lstatSync(claim.claimPath, { bigint: true }); }
+  try { current = lstatAtSync(claim.runtimeRecord.fd, claim.claimName, { bigint: true }); }
   catch (error) { if (error?.code === 'ENOENT') return false; throw error; }
   if (current.isSymbolicLink() || !current.isFile() || !sameRuntimeIdentity(current, claim.identity)) return false;
   try {
-    linkSync(claim.claimPath, claim.canonicalEntry);
+    linkAtSync(claim.runtimeRecord.fd, claim.claimName, claim.runtimeRecord.fd, claim.runtimeRecord.targetName);
   } catch (error) {
     if (error?.code !== 'EEXIST') throw error;
-    const canonical = lstatSync(claim.canonicalEntry, { bigint: true });
+    const canonical = lstatAtSync(claim.runtimeRecord.fd, claim.runtimeRecord.targetName, { bigint: true });
     if (!sameRuntimeIdentity(canonical, current)) return false;
-    return finalizeRuntimeRequestRestore(claim.runtimeRecord, claim.claimPath, claim.canonicalEntry, claim.identity);
+    return finalizeRuntimeRequestRestore(claim.runtimeRecord, claim.claimName, claim.runtimeRecord.targetName, claim.identity);
   }
   runRuntimeSecurityTestHook('afterRuntimeRequestRestoreLink', { claimPath: claim.claimPath, canonicalPath: claim.canonicalEntry });
-  return finalizeRuntimeRequestRestore(claim.runtimeRecord, claim.claimPath, claim.canonicalEntry, claim.identity);
+  return finalizeRuntimeRequestRestore(claim.runtimeRecord, claim.claimName, claim.runtimeRecord.targetName, claim.identity);
 }
 
 function consumeRuntimeRequest(claim) {
   if (!claim?.claimPath || !claim.identity) return true;
-  const current = lstatSync(claim.claimPath, { bigint: true });
+  const current = lstatAtSync(claim.runtimeRecord.fd, claim.claimName, { bigint: true });
   if (current.isSymbolicLink() || !current.isFile() || !sameRuntimeIdentity(current, claim.identity)) return false;
-  unlinkSync(claim.claimPath);
+  unlinkAtSync(claim.runtimeRecord.fd, claim.claimName);
   fsyncSync(claim.runtimeRecord.fd);
   assertRuntimeDirectoryRecord(claim.runtimeRecord);
   return true;
@@ -557,7 +575,7 @@ function scriptExecutionReceiptDigest(receipt) {
 
 function persistExecutedRuntimeRequest(runtimeRecord, claim, request, result, executedAt) {
   assertRuntimeDirectoryRecord(runtimeRecord);
-  const current = lstatSync(claim.claimPath, { bigint: true });
+  const current = lstatAtSync(runtimeRecord.fd, claim.claimName, { bigint: true });
   if (current.isSymbolicLink() || !current.isFile() || !sameRuntimeIdentity(current, claim.identity)) {
     throw Object.assign(new Error('The claimed request changed before its execution receipt was persisted'), { code: 'INVALID_RUNTIME_JSON' });
   }
@@ -579,8 +597,9 @@ function persistExecutedRuntimeRequest(runtimeRecord, claim, request, result, ex
     authority_id: proof.authority_id,
     signature: proof.signature,
   };
-  const temporary = join(runtimeRecord.reference, `.executed-${process.pid}-${randomUUID()}.tmp`);
-  const claimBackup = join(runtimeRecord.reference, `.receipt-backup-${process.pid}-${randomUUID()}.tmp`);
+  const temporaryName = `.executed-${process.pid}-${randomUUID()}.tmp`;
+  const temporary = join(runtimeRecord.reference, temporaryName);
+  const backupName = `.receipt-backup-${process.pid}-${randomUUID()}.tmp`;
   const originalClaimIdentity = claim.identity;
   let temporaryDescriptor;
   let written;
@@ -589,7 +608,7 @@ function persistExecutedRuntimeRequest(runtimeRecord, claim, request, result, ex
   let backupCreated = false;
   try {
     const bytes = Buffer.from(JSON.stringify(receipt));
-    temporaryDescriptor = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    temporaryDescriptor = openAtSync(runtimeRecord.fd, temporaryName, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
     let offset = 0;
     while (offset < bytes.length) offset += writeSync(temporaryDescriptor, bytes, offset, bytes.length - offset);
     fsyncSync(temporaryDescriptor);
@@ -599,7 +618,7 @@ function persistExecutedRuntimeRequest(runtimeRecord, claim, request, result, ex
       throw Object.assign(new Error('The temporary execution receipt is not a private regular file'), { code: 'INVALID_RUNTIME_JSON' });
     }
     assertRuntimeDirectoryRecord(runtimeRecord);
-    const beforeRename = lstatSync(claim.claimPath, { bigint: true });
+    const beforeRename = lstatAtSync(runtimeRecord.fd, claim.claimName, { bigint: true });
     if (beforeRename.isSymbolicLink() || !beforeRename.isFile() || !sameRuntimeIdentity(beforeRename, claim.identity)) {
       throw Object.assign(new Error('The claimed request changed before its execution receipt was committed'), { code: 'INVALID_RUNTIME_JSON' });
     }
@@ -608,43 +627,43 @@ function persistExecutedRuntimeRequest(runtimeRecord, claim, request, result, ex
     if (!sameRuntimeFileSnapshot(fstatSync(temporaryDescriptor, { bigint: true }), written)) {
       throw Object.assign(new Error('The temporary execution receipt changed before publication'), { code: 'INVALID_RUNTIME_JSON' });
     }
-    linkSync(claim.claimPath, claimBackup);
+    linkAtSync(runtimeRecord.fd, claim.claimName, runtimeRecord.fd, backupName);
     backupCreated = true;
-    const backup = lstatSync(claimBackup, { bigint: true });
+    const backup = lstatAtSync(runtimeRecord.fd, backupName, { bigint: true });
     if (backup.isSymbolicLink() || !backup.isFile() || !sameRuntimeIdentity(backup, originalClaimIdentity)
       || backup.nlink !== 2n) {
       throw Object.assign(new Error('The original request could not be protected during receipt publication'), { code: 'INVALID_RUNTIME_JSON' });
     }
     publicationAttempted = true;
-    renameSync(temporary, claim.claimPath);
+    renameAtSync(runtimeRecord.fd, temporaryName, runtimeRecord.fd, claim.claimName);
     fsyncSync(runtimeRecord.fd);
-    claim.identity = lstatSync(claim.claimPath, { bigint: true });
+    claim.identity = lstatAtSync(runtimeRecord.fd, claim.claimName, { bigint: true });
     if (!claim.identity.isFile() || claim.identity.isSymbolicLink?.() || !samePublishedRuntimeFile(claim.identity, written)
       || !samePublishedRuntimeFile(fstatSync(temporaryDescriptor, { bigint: true }), written)) {
       throw Object.assign(new Error('The execution receipt is not a private regular file'), { code: 'INVALID_RUNTIME_JSON' });
     }
     assertRuntimeDirectoryRecord(runtimeRecord);
-    unlinkSync(claimBackup);
+    unlinkAtSync(runtimeRecord.fd, backupName);
     backupCreated = false;
     fsyncSync(runtimeRecord.fd);
     published = true;
     return receipt;
   } finally {
     if (temporaryDescriptor !== undefined) closeSync(temporaryDescriptor);
-    try { unlinkSync(temporary); } catch { /* preserve primary receipt result */ }
+    try { unlinkAtSync(runtimeRecord.fd, temporaryName); } catch { /* preserve primary receipt result */ }
     if (publicationAttempted && !published && backupCreated) {
       try {
-        const backup = lstatSync(claimBackup, { bigint: true });
+        const backup = lstatAtSync(runtimeRecord.fd, backupName, { bigint: true });
         if (!backup.isSymbolicLink() && backup.isFile() && sameRuntimeIdentity(backup, originalClaimIdentity)) {
-          renameSync(claimBackup, claim.claimPath);
-          claim.identity = lstatSync(claim.claimPath, { bigint: true });
+          renameAtSync(runtimeRecord.fd, backupName, runtimeRecord.fd, claim.claimName);
+          claim.identity = lstatAtSync(runtimeRecord.fd, claim.claimName, { bigint: true });
           fsyncSync(runtimeRecord.fd);
           backupCreated = false;
         }
       } catch { /* preserve primary receipt result */ }
     }
     if (backupCreated) {
-      try { unlinkSync(claimBackup); } catch { /* preserve primary receipt result */ }
+      try { unlinkAtSync(runtimeRecord.fd, backupName); } catch { /* preserve primary receipt result */ }
     }
   }
 }
@@ -657,8 +676,8 @@ function writeDurableScriptHandoff(path, content) {
     closeSync(directory.fd);
     throw Object.assign(new Error('The script handoff target is not canonical'), { code: 'UNSAFE_SCRIPT_HANDOFF_PATH' });
   }
-  const temporary = join(directory.reference, `.${name}.${process.pid}.${randomUUID()}.tmp`);
-  const destination = join(directory.reference, name);
+  const temporaryName = `.${name}.${process.pid}.${randomUUID()}.tmp`;
+  const temporary = join(directory.reference, temporaryName);
   let descriptor;
   let written;
   let publicationAttempted = false;
@@ -667,7 +686,7 @@ function writeDurableScriptHandoff(path, content) {
     assertScriptHandoffDirectoryRecord(directory);
     runRuntimeSecurityTestHook('beforeScriptHandoffTempOpen', { handoffPath: path, temporary, directory: directory.absolute });
     assertScriptHandoffDirectoryRecord(directory);
-    descriptor = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    descriptor = openAtSync(directory.fd, temporaryName, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
     const bytes = Buffer.from(content);
     let offset = 0;
     while (offset < bytes.length) offset += writeSync(descriptor, bytes, offset, bytes.length - offset);
@@ -680,7 +699,7 @@ function writeDurableScriptHandoff(path, content) {
     runRuntimeSecurityTestHook('beforeScriptHandoffCommit', { handoffPath: path, temporary, directory: directory.absolute });
     assertScriptHandoffDirectoryRecord(directory);
     let existing;
-    try { existing = lstatSync(destination, { bigint: true }); }
+    try { existing = lstatAtSync(directory.fd, name, { bigint: true }); }
     catch (error) { if (error?.code !== 'ENOENT') throw error; }
     if (existing && (existing.isSymbolicLink() || !existing.isFile() || existing.nlink !== 1n)) {
       throw Object.assign(new Error('The script handoff destination must be a regular single-link file'), { code: 'UNSAFE_SCRIPT_HANDOFF_PATH' });
@@ -689,8 +708,8 @@ function writeDurableScriptHandoff(path, content) {
       throw Object.assign(new Error('The temporary script handoff changed before publication'), { code: 'UNSAFE_SCRIPT_HANDOFF_PATH' });
     }
     publicationAttempted = true;
-    renameSync(temporary, destination);
-    const committed = lstatSync(destination, { bigint: true });
+    renameAtSync(directory.fd, temporaryName, directory.fd, name);
+    const committed = lstatAtSync(directory.fd, name, { bigint: true });
     if (committed.isSymbolicLink() || !committed.isFile() || !samePublishedRuntimeFile(committed, written)
       || !samePublishedRuntimeFile(fstatSync(descriptor, { bigint: true }), written)) {
       throw Object.assign(new Error('The published script handoff differs from its pinned temporary file'), { code: 'UNSAFE_SCRIPT_HANDOFF_PATH' });
@@ -700,11 +719,11 @@ function writeDurableScriptHandoff(path, content) {
     published = true;
   } finally {
     if (descriptor !== undefined) closeSync(descriptor);
-    try { unlinkSync(temporary); } catch { /* preserve primary handoff result */ }
+    try { unlinkAtSync(directory.fd, temporaryName); } catch { /* preserve primary handoff result */ }
     if (publicationAttempted && !published && written) {
       try {
-        const current = lstatSync(destination, { bigint: true });
-        if (current.isFile() && !current.isSymbolicLink() && !sameRuntimeIdentity(current, written)) unlinkSync(destination);
+        const current = lstatAtSync(directory.fd, name, { bigint: true });
+        if (current.isFile() && !current.isSymbolicLink() && !sameRuntimeIdentity(current, written)) unlinkAtSync(directory.fd, name);
       } catch { /* preserve primary handoff result */ }
     }
     closeSync(directory.fd);
@@ -1002,6 +1021,55 @@ export function readBriefAndRefCorpus(projectDir) {
   return corpus;
 }
 
+/** Closed, canonical Brief declaration only. Prose/UX self-assessment is not authority. */
+export function hasExplicitNonVisualBrief(content) {
+  if (typeof content !== 'string' || detectPremiumRefs(content).detected) return false;
+  const source = content.replace(/\r\n/g, '\n');
+  const sections = [...source.matchAll(/^## ([^\n]+)\n([\s\S]*?)(?=^## |$(?![\s\S]))/gm)];
+  function declaration(title, key) {
+    const matches = sections.filter(section => section[1].trim() === title);
+    // A second declaration anywhere in the document is ambiguous, even when
+    // a parser could otherwise select the preferred canonical section.
+    const keyPattern = new RegExp(`^[ \\t]*(?:${key}|"${key}"|'${key}')[ \\t]*:`, 'gm');
+    if (matches.length !== 1 || [...source.matchAll(keyPattern)].length !== 1) return null;
+    const block = matches[0][2].trim().match(/^```ya?ml\n([\s\S]*?)\n```$/);
+    if (!block || block[1].includes('```')) return null;
+    try {
+      const value = yaml.load(block[1], { schema: yaml.JSON_SCHEMA });
+      return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+    } catch { return null; }
+  }
+  const quality = declaration('Visual Quality', 'visual_quality');
+  const references = declaration('Visual References', 'visual_references');
+  return Boolean(quality && references
+    && Object.keys(quality).length === 1 && quality.visual_quality === 'not_applicable'
+    && Object.keys(references).every(key => key === 'visual_references' || key === 'reference_synthesis')
+    && (!Object.hasOwn(references, 'reference_synthesis') || typeof references.reference_synthesis === 'string')
+    && Array.isArray(references.visual_references) && references.visual_references.length === 0);
+}
+
+function resolveNonVisualUxApplicability(projectDir, artifact) {
+  if (!artifact) return null;
+  const council = resolveRuntimeCouncilGatePolicyV2({ artifact, stage: 'discovery' });
+  if (!council.enabled) return null;
+  try {
+    // No new council inference here. Missing/rejected/stale/wrong-project or
+    // malformed approval retains the existing mandatory visual path.
+    const approved = assertCouncilGateApproved({ projectDir, artifact, stage: 'discovery', policy: council.policy });
+    const brief = approved.material.find(item => item.path === 'artifacts/1-Brief/brief-report.md');
+    if (!brief || !hasExplicitNonVisualBrief(brief.content)) return null;
+    // A downstream visual reference analysis conflicts with an empty reference
+    // declaration. It cannot grant an exemption or silently be ignored, even
+    // if an animation inventory already exists.
+    try {
+      if (readFileSync(join(projectDir, 'artifacts/4-UX/reference-analysis.md'), 'utf8').trim()) return null;
+    } catch (error) { if (error.code !== 'ENOENT') return null; }
+    return Object.freeze({
+      status: 'not_applicable', source: brief.path, sha256: brief.sha256, discovery_gate_id: approved.plan.gate_id,
+    });
+  } catch { return null; }
+}
+
 // ---------------------------------------------------------------------------
 // State-at-a-glance card (Fase 8)
 //
@@ -1200,14 +1268,142 @@ function parseArgs(argv) {
   return args;
 }
 
-function output(data) {
+function writeOutput(data) {
   process.stdout.write(JSON.stringify(data, null, 2) + '\n');
 }
 
+/** True when every automatic Planning recovery route is consumed without a QA
+ * authorization: all reconciliation targets settled as denied, none pending.
+ * Exported for tests; the advance path reports this state as terminal. */
+export function planningRecoveryBudgetExhausted(session, agent = 'qa-planning') {
+  const reconciliations = session?.agents?.[agent]?.planning_reconciliations;
+  if (!Array.isArray(reconciliations) || reconciliations.length < MAX_PLANNING_RECONCILIATION_TARGETS) return false;
+  if (reconciliations.some(entry => entry?.authorization)) return false;
+  return !reconciliations.some(entry => ['reserved', 'running', 'outcome_unknown'].includes(entry?.status));
+}
+
 function errorResult(message, code) {
   return { action: 'error', error: message, code: code || 'UNKNOWN' };
 }
 
+const COUNCIL_STAGE_BY_COMPLETING_AGENT = Object.freeze({
+  brief: 'discovery',
+  'qa-planning': 'planning',
+  tasks: 'execution-design',
+});
+
+function councilGateSessionRecord(result) {
+  return {
+    gate_id: result.gate_id,
+    stage: result.stage,
+    verdict: result.decision.verdict,
+    decision_path: result.decision_path,
+    member_count: result.member_count,
+  };
+}
+
+/**
+ * Applies the automatic quality council exactly once per content-addressed
+ * artifact bundle. A prior rework decision remains blocking until planning
+ * changes, so retries cannot consume providers on unchanged evidence.
+ */
+export async function enforceRuntimeCouncilGate({
+  projectDir,
+  agent,
+  session,
+  artifact,
+  handoff,
+  executeCouncil = executeCouncilGate,
+} = {}) {
+  const stage = COUNCIL_STAGE_BY_COMPLETING_AGENT[agent];
+  if (!stage) return Object.freeze({ required: false, reason: 'NO_COUNCIL_STAGE_FOR_AGENT' });
+  if (agent === 'qa-planning') {
+    const subject = pinHeldCouncilQaSubject(projectDir, session);
+    try { subject?.assertCurrent(); } finally { subject?.close(); }
+  }
+  const configured = resolveRuntimeCouncilGatePolicyV2({ artifact, stage });
+  if (!configured.enabled) {
+    if (configured.reason === 'GUIDED_COUNCIL_REQUIRED') {
+      return Object.freeze({
+        required: true,
+        approved: false,
+        blocked: true,
+        stage,
+        code: 'GUIDED_COUNCIL_REQUIRED',
+        message: 'this installation selected fewer than two eligible providers, so the automatic council cannot be bypassed. Reconfigure the installation with two selected review providers before advancing.',
+      });
+    }
+    return Object.freeze({ required: false, reason: configured.reason });
+  }
+  const options = {
+    projectDir,
+    stage,
+    artifact,
+    policy: configured.policy,
+    language: session?.language || 'en',
+    ...(handoff === undefined ? {} : { handoff }),
+  };
+  try {
+    const approved = assertCouncilGateApproved(options);
+    const result = Object.freeze({
+      ok: true,
+      stage,
+      gate_id: approved.plan.gate_id,
+      member_count: approved.plan.selection.member_count,
+      decision: approved.decision,
+      decision_path: approved.path,
+      reused: true,
+    });
+    await updateSession(projectDir, {
+      council_gates: { ...(session?.council_gates || {}), [stage]: councilGateSessionRecord(result) },
+    });
+    return Object.freeze({ required: true, approved: true, result });
+  } catch (error) {
+    if (error?.code === 'COUNCIL_GATE_REWORK_REQUIRED') {
+      return Object.freeze({
+        required: true,
+        stage,
+        approved: false,
+        blocked: true,
+        code: error.code,
+        message: error.message,
+        blockers: error.details?.blockers || [],
+        gate_id: error.details?.gate_id || null,
+      });
+    }
+    if (!['COUNCIL_GATE_DECISION_MISSING', 'COUNCIL_GATE_DECISION_STALE'].includes(error?.code)) throw error;
+  }
+  let result;
+  try {
+    result = await executeCouncil(options);
+  } catch (error) {
+    // A fresh real council verifies its persisted decision and throws on
+    // rework. Classify that exactly like cached rework above, not as a broken
+    // provider installation. All other execution/authority errors propagate.
+    if (error?.code !== 'COUNCIL_GATE_REWORK_REQUIRED') throw error;
+    return Object.freeze({
+      required: true,
+      stage,
+      approved: false,
+      blocked: true,
+      code: error.code,
+      message: error.message,
+      blockers: error.details?.blockers || [],
+      gate_id: error.details?.gate_id || null,
+    });
+  }
+  await updateSession(projectDir, {
+    council_gates: { ...(session?.council_gates || {}), [stage]: councilGateSessionRecord(result) },
+  });
+  return Object.freeze({
+    required: true,
+    approved: result.ok,
+    blocked: !result.ok,
+    ...(result.ok ? {} : { code: 'COUNCIL_GATE_REWORK_REQUIRED', blockers: result.decision.blocking_findings }),
+    result,
+  });
+}
+
 /**
  * Build a pipeline state object from session data.
  * The session-manager and pipeline-manager use slightly different shapes;
@@ -1273,7 +1469,7 @@ export function buildSpawnCommand(agent, projectDir, previousAgent, provider, ti
     ...(routing.reasoning_escalation ? ['--reasoning-escalation'] : []),
     ...(routing.execution_claim_id ? ['--execution-claim-id', shellQuote(routing.execution_claim_id)] : []),
     ...(strictProvider ? ['--strict-provider'] : []),
-    '--timeout', String(timeout || 600000),
+    '--timeout', String(timeout ?? getAgentTimeout(agent)),
   ];
   return parts.join(' ');
 }
@@ -1461,11 +1657,11 @@ function closeNativeLockStorage(storage) {
 }
 
 function openWorkingDirectoryAnchor(absolute) {
-  if (process.platform !== 'linux') return null;
+  if (!['linux', 'darwin'].includes(process.platform)) return null;
   let descriptor;
   try {
     descriptor = openSync('.', constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
-    const workingDirectory = realpathSync(`/proc/self/fd/${descriptor}`);
+    const workingDirectory = directoryPathSync(descriptor);
     const targetRelative = relative(workingDirectory, absolute);
     if (targetRelative === '..' || targetRelative.startsWith(`..${sep}`) || isAbsolute(targetRelative)) {
       closeSync(descriptor);
@@ -1479,8 +1675,8 @@ function openWorkingDirectoryAnchor(absolute) {
 }
 
 function openNativeLockStorage(projectDir, targetPath) {
-  if (process.platform !== 'linux') {
-    return nativeLockFailure('UNSAFE_NATIVE_LOCK_PATH', 'native lock projection requires Linux descriptor-relative storage');
+  if (!['linux', 'darwin'].includes(process.platform)) {
+    return nativeLockFailure('UNSAFE_NATIVE_LOCK_PATH', `native lock projection requires descriptor-relative storage; unsupported platform: ${process.platform}`);
   }
   const project = resolve(projectDir);
   const target = resolve(targetPath);
@@ -1502,7 +1698,7 @@ function openNativeLockStorage(projectDir, targetPath) {
     let descriptor;
     try {
       descriptor = anchor
-        ? openSync(`/proc/self/fd/${anchor.descriptor}`, constants.O_RDONLY | (constants.O_DIRECTORY || 0))
+        ? duplicateDirectorySync(anchor.descriptor)
         : openSync(root, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
     } finally {
       if (anchor) closeSync(anchor.descriptor);
@@ -1510,8 +1706,8 @@ function openNativeLockStorage(projectDir, targetPath) {
     descriptors.push(descriptor);
     snapshots.push(nativeLockSnapshot(fstatSync(descriptor)));
     for (const segment of segments) {
-      descriptor = openSync(
-        join(`/proc/self/fd/${descriptor}`, segment),
+      descriptor = openAtSync(
+        descriptor, segment,
         constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0),
       );
       const stat = fstatSync(descriptor);
@@ -1548,12 +1744,11 @@ function assertNativeLockStorage(storage) {
 }
 
 function readHarnessProjection(storage) {
-  const reference = join(`/proc/self/fd/${storage.descriptor}`, storage.name);
   let descriptor;
   try {
-    const pathStat = lstatSync(reference, { bigint: true });
+    const pathStat = lstatAtSync(storage.descriptor, storage.name, { bigint: true });
     if (pathStat.isSymbolicLink()) return nativeLockFailure('UNSAFE_NATIVE_LOCK_PATH', 'native lock must not be a symlink');
-    descriptor = openSync(reference, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+    descriptor = openAtSync(storage.descriptor, storage.name, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
     const before = fstatSync(descriptor, { bigint: true });
     if (!before.isFile() || before.nlink !== 1n) return nativeLockFailure('UNSAFE_NATIVE_LOCK_PATH', 'native lock must be a single-link regular file');
     if (before.size > NATIVE_LOCK_MAX_BYTES_BIGINT) return nativeLockFailure('NATIVE_LOCK_SIZE_LIMIT', 'native lock exceeds the 256 KiB safety limit');
@@ -1565,7 +1760,7 @@ function readHarnessProjection(storage) {
       offset += count;
     }
     const after = fstatSync(descriptor, { bigint: true });
-    const finalPath = lstatSync(reference, { bigint: true });
+    const finalPath = lstatAtSync(storage.descriptor, storage.name, { bigint: true });
     const snapshot = (stat) => ({
       dev: stat.dev, ino: stat.ino, mode: stat.mode, uid: stat.uid, gid: stat.gid,
       nlink: stat.nlink, size: stat.size, mtimeNs: stat.mtimeNs, ctimeNs: stat.ctimeNs,
@@ -1583,17 +1778,14 @@ function readHarnessProjection(storage) {
 }
 
 function writeHarnessProjectionAtomic(storage, content, expected) {
-  const reference = `/proc/self/fd/${storage.descriptor}`;
   const temporaryName = `.${storage.name}.${process.pid}.${randomUUID()}.tmp`;
-  const temporary = join(reference, temporaryName);
-  const destination = join(reference, storage.name);
   let descriptor;
   let replaced = false;
   try {
     if (Buffer.byteLength(content, 'utf8') > NATIVE_LOCK_MAX_BYTES) {
       return nativeLockFailure('NATIVE_LOCK_SIZE_LIMIT', 'projected native lock exceeds the 256 KiB safety limit');
     }
-    descriptor = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    descriptor = openAtSync(storage.descriptor, temporaryName, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
     const bytes = Buffer.from(content, 'utf8');
     let offset = 0;
     while (offset < bytes.length) offset += writeSync(descriptor, bytes, offset, bytes.length - offset, null);
@@ -1601,7 +1793,7 @@ function writeHarnessProjectionAtomic(storage, content, expected) {
     closeSync(descriptor);
     descriptor = undefined;
     assertNativeLockStorage(storage);
-    const current = lstatSync(destination, { bigint: true });
+    const current = lstatAtSync(storage.descriptor, storage.name, { bigint: true });
     const currentSnapshot = {
       dev: current.dev, ino: current.ino, mode: current.mode, uid: current.uid, gid: current.gid,
       nlink: current.nlink, size: current.size, mtimeNs: current.mtimeNs, ctimeNs: current.ctimeNs,
@@ -1609,7 +1801,7 @@ function writeHarnessProjectionAtomic(storage, content, expected) {
     if (current.isSymbolicLink() || !sameNativeLockSnapshot(currentSnapshot, expected)) {
       return nativeLockFailure('UNSAFE_NATIVE_LOCK_PATH', 'native lock changed before atomic replacement');
     }
-    renameSync(temporary, destination);
+    renameAtSync(storage.descriptor, temporaryName, storage.descriptor, storage.name);
     replaced = true;
     fsyncSync(storage.descriptor);
   } catch (error) {
@@ -1617,7 +1809,7 @@ function writeHarnessProjectionAtomic(storage, content, expected) {
     throw error;
   } finally {
     if (descriptor !== undefined) closeSync(descriptor);
-    rmSync(temporary, { force: true });
+    unlinkAtSync(storage.descriptor, temporaryName, { force: true });
   }
   return undefined;
 }
@@ -1651,7 +1843,9 @@ function projectSessionLocks(projectDir, { resumeMsg = null } = {}) {
         const lockInner = active
           ? `## Session Lock: ACTIVE
 
-**Chati.dev session is ACTIVE.** Follow these rules for EVERY message:
+${DELEGATED_EXECUTION_BOUNDARY}
+
+**Chati.dev session is ACTIVE.** The user-facing coordinator follows these rules for EVERY user message:
 
 1. Read \`${target.orchestratorPath}\` and follow its routing logic
 2. Route ALL user messages through the current agent: \`${session.current_agent}\`
@@ -1731,6 +1925,24 @@ function removeSessionLock(projectDir, resumeMsg) {
 // Sub-command handlers
 // ---------------------------------------------------------------------------
 
+function classifyParallelExecutions(nextInfo, session) {
+  if (!nextInfo?.isParallel || nextInfo.group.length < 2) return null;
+  const incomplete = nextInfo.group.filter(agent => (
+    !session.completed_agents?.includes(agent) && session.agents?.[agent]?.status !== 'completed'
+  ));
+  const held = incomplete.filter(agent => session.agents?.[agent]?.status === 'awaiting_advance'
+    || session.agents?.[agent]?.execution_claim_state === 'awaiting_advance');
+  const now = Date.now();
+  const live = incomplete.filter(agent => {
+    const state = session.agents?.[agent];
+    const expiry = Date.parse(state?.execution_claim_expires_at || '');
+    return state?.status === 'in_progress' && Boolean(state.execution_claim_id)
+      && Number.isFinite(expiry) && expiry > now;
+  });
+  return { held, live, dispatchable: incomplete.filter(agent => !held.includes(agent) && !live.includes(agent)) };
+}
+
+
 async function handleNext(projectDir) {
   const result = await _handleNextInner(projectDir);
   let dispatchMutation = null;
@@ -1755,8 +1967,9 @@ async function handleNext(projectDir) {
     } : null;
     if (result.model_info?.source === 'installation-v2') {
       const dispatchedAgents = Array.isArray(result.parallel_spawn_commands) && result.parallel_spawn_commands.length > 0
-        ? result.parallel_spawn_commands.map((entry) => ({ agent: entry.agent, binding: entry.agent === result.agent ? binding : null }))
-        : [{ agent: result.agent, binding }];
+        ? result.parallel_spawn_commands.map((entry) => ({ agent: entry.agent, taskId: `${entry.agent}-task`,
+          binding: entry.agent === result.agent ? binding : resolveAgentModel(entry.agent, projectDir) }))
+        : [{ agent: result.agent, taskId: `${result.agent}-task`, binding }];
       const claimed = claimAgentExecutions(projectDir, dispatchedAgents);
       if (!claimed.saved) {
         return errorResult(`Could not persist canonical agent state: ${claimed.error}`, 'SESSION_WRITE_FAILED');
@@ -1886,6 +2099,9 @@ async function _handleNextInner(projectDir) {
   const installationV2 = loadRuntimeInstallationV2(projectDir);
   const runtimePipeline = getRuntimeAgentPipeline(projectDir, session);
 
+  let revisionOwner;
+  try { revisionOwner = getPlanningContractRevisionOwner(session, projectDir); }
+  catch (error) { return errorResult(error.message, error.code); }
   const pending = session.pending_interaction;
   if (pending?.status === 'relay_in_flight') {
     const relayStartedAt = Date.parse(pending.relay_started_at || '');
@@ -2067,22 +2283,48 @@ async function _handleNextInner(projectDir) {
   }
 
   // Check for in-progress agent (resume scenario)
-  const currentAgent = session.current_agent || null;
+  let rollbackAgent;
+  try { rollbackAgent = getPendingPlanningRollbackTarget(session); }
+  catch (error) { return errorResult(error.message, error.code); }
+  const currentAgent = revisionOwner || rollbackAgent || session.current_agent || null;
   const completedAgents = session.completed_agents || [];
-  if (currentAgent && !completedAgents.includes(currentAgent)) {
+  const lastCompletedAgent = completedAgents.includes(session.last_handoff) ? session.last_handoff
+    : completedAgents.includes(session.current_agent) ? session.current_agent
+      : completedAgents.findLast(agent => getAgentDefinition(agent)) || null;
+  const peerRecovery = installationV2 && !rollbackAgent && !revisionOwner
+    ? getNextAgent(lastCompletedAgent || currentAgent, completedAgents, { recoverPlanningPeers: true }) : null;
+  // A legacy QA/Phases cursor must not hide an unfinished Planning member.
+  // Its claim or held result stays intact; the reservation/start guard prevents
+  // a stale downstream command from launching before the predecessors finish.
+  if (currentAgent && !completedAgents.includes(currentAgent)
+    && (!peerRecovery?.isParallel || peerRecovery.group.includes(currentAgent))) {
     const agent = currentAgent;
     const agentStatus = session.agents?.[agent]?.status;
-    if (agentStatus === 'awaiting_advance') {
+    const resumeGroup = installationV2 && !rollbackAgent && !revisionOwner
+      ? getNextAgent(session.last_handoff || currentAgent, completedAgents, { recoverPlanningPeers: true }) : null;
+    const runnablePeer = !session.agents?.[agent]?.content_review_pending && resumeGroup?.group.includes(agent)
+      && classifyParallelExecutions(resumeGroup, session)?.dispatchable.some(peer => peer !== agent);
+    if (agentStatus === 'awaiting_advance' && !runnablePeer) {
       return {
         action: 'awaiting_agent_advance',
         agent,
         code: 'AGENT_AWAITING_ADVANCE',
+        result_status: session.agents[agent].execution_result_status || null,
+        execution_claim_id: session.agents[agent].execution_claim_id || null,
+        execution_finished_at: session.agents[agent].execution_finished_at || null,
+        requires_recovery: session.agents[agent].execution_result_status !== 'complete',
+        content_rejection_command: ['detail', 'architect', 'ux', 'qa-planning'].includes(agent)
+          && session.agents[agent].execution_result_status === 'complete'
+          && session.agents[agent].execution_claim_id && session.agents[agent].execution_finished_at
+          ? `node .chati.dev/orchestrator/chati-router.js reject-result --agent ${shellQuote(agent)} --execution-claim-id ${shellQuote(session.agents[agent].execution_claim_id)} --execution-finished-at ${shellQuote(session.agents[agent].execution_finished_at)} --reason <content-review-reason>` : null,
         pipeline_progress: getPipelineProgress(pipelineState),
         session: { language: session.language, project_type: session.project_type || session.project?.type, execution_mode: session.execution_mode },
-        status_summary: `${agent} finished its routed process and is waiting for canonical advance.`,
+        status_summary: session.agents[agent].execution_result_status === 'complete'
+          ? `${agent} returned complete and is waiting for canonical advance.`
+          : `${agent} has a legacy ambiguous result. Do not advance it as successful; inspect its original result before negative recovery.`,
       };
     }
-    if (agentStatus === 'in_progress') {
+    if (agentStatus === 'in_progress' || agentStatus === 'pending_rework' || rollbackAgent === agent) {
       const agentFile = getAgentFile(agent, projectDir) || null;
       const agentDef = getAgentDefinition(agent);
       const isInteractive = INTERACTIVE_AGENTS.includes(agent);
@@ -2119,7 +2361,7 @@ async function _handleNextInner(projectDir) {
         agent,
         agent_file: agentFile,
         phase: agentDef?.phase || session.mode,
-        spawn_command: buildSpawnCommand(agent, projectDir, session.last_handoff || 'none', modelInfo.provider, 600000, modelInfo.model, modelInfo.source === 'installation-v2', modelInfo),
+        spawn_command: buildSpawnCommand(agent, projectDir, session.last_handoff || 'none', modelInfo.provider, getAgentTimeout(agent), modelInfo.model, modelInfo.source === 'installation-v2', modelInfo),
         parallel_spawn_command: null,
         parallel_agents: [],
         handoff_status: { valid: true, missing: [], warnings: ['Resuming in-progress agent'] },
@@ -2128,13 +2370,13 @@ async function _handleNextInner(projectDir) {
         context_bracket: estimateContextBracket(completedAgents.length, runtimePipeline.length),
         pipeline_progress: getPipelineProgress(pipelineState),
         session: { language: session.language, project_type: session.project_type || session.project?.type, execution_mode: session.execution_mode, user_level: session.user_level || 'auto' },
-        status_summary: `Resuming ${agent} (in progress).`,
+        status_summary: `${agentStatus === 'pending_rework' ? 'Reworking' : 'Resuming'} ${agent}.`,
       };
     }
   }
 
   // Determine last completed agent
-  const lastAgent = session.last_handoff || session.current_agent || null;
+  const lastAgent = lastCompletedAgent;
 
   // If no agent has started yet, route to first agent
   if (!lastAgent || completedAgents.length === 0) {
@@ -2164,7 +2406,8 @@ async function _handleNextInner(projectDir) {
   // Get next agent — if lastAgent is not in AGENT_PIPELINE (e.g. qa-planning
   // which lives inside Planning Team), fall back to the last completed agent
   // that IS in the pipeline so we can find the correct successor.
-  let nextInfo = getNextAgent(lastAgent, completedAgents);
+  let nextInfo = revisionOwner ? { next: revisionOwner, isParallel: false, group: [revisionOwner] }
+    : getNextAgent(lastAgent, completedAgents, { recoverPlanningPeers: Boolean(installationV2) });
 
   if ((!nextInfo || !nextInfo.next) && lastAgent) {
     const agentInPipeline = getAgentDefinition(lastAgent);
@@ -2173,7 +2416,7 @@ async function _handleNextInner(projectDir) {
       const pipelineNames = AGENT_PIPELINE.map((a) => a.name);
       for (let i = completedAgents.length - 1; i >= 0; i--) {
         if (pipelineNames.includes(completedAgents[i])) {
-          nextInfo = getNextAgent(completedAgents[i], completedAgents);
+          nextInfo = getNextAgent(completedAgents[i], completedAgents, { recoverPlanningPeers: Boolean(installationV2) });
           if (nextInfo && nextInfo.next) break;
         }
       }
@@ -2194,17 +2437,12 @@ async function _handleNextInner(projectDir) {
   // Parallel groups can be resumed after only a subset has completed. Never
   // send completed members back through the claim layer, and do not let a live
   // claim for one member prevent an unclaimed sibling from being dispatched.
-  // A successful member waiting for canonical advance still takes precedence,
-  // because its result must be committed before the group can progress.
+  // Held results cannot be redispatched or treated as accepted, but they must
+  // not prevent a separate unfinished member from recovering its own attempt.
   if (installationV2 && nextInfo.isParallel && nextInfo.group.length > 1) {
-    const incompleteGroup = nextInfo.group.filter((agent) => (
-      !completedAgents.includes(agent) && session.agents?.[agent]?.status !== 'completed'
-    ));
-    const awaitingAdvance = incompleteGroup.find((agent) => (
-      session.agents?.[agent]?.status === 'awaiting_advance'
-      || session.agents?.[agent]?.execution_claim_state === 'awaiting_advance'
-    ));
-    if (awaitingAdvance) {
+    const { held, live: liveAgents, dispatchable: dispatchableGroup } = classifyParallelExecutions(nextInfo, session);
+    const awaitingAdvance = held[0];
+    if (dispatchableGroup.length === 0 && awaitingAdvance) {
       return {
         action: 'awaiting_agent_advance',
         agent: awaitingAdvance,
@@ -2214,16 +2452,6 @@ async function _handleNextInner(projectDir) {
         status_summary: `${awaitingAdvance} finished its routed process and is waiting for canonical advance.`,
       };
     }
-    const now = Date.now();
-    const liveAgents = incompleteGroup.filter((agent) => {
-      const state = session.agents?.[agent];
-      const expiry = Date.parse(state?.execution_claim_expires_at || '');
-      return state?.status === 'in_progress'
-        && Boolean(state.execution_claim_id)
-        && Number.isFinite(expiry)
-        && expiry > now;
-    });
-    const dispatchableGroup = incompleteGroup.filter((agent) => !liveAgents.includes(agent));
     if (dispatchableGroup.length === 0 && liveAgents.length > 0) {
       return {
         action: 'agent_execution_in_flight',
@@ -2305,10 +2533,10 @@ async function _handleNextInner(projectDir) {
     teamData = { team_id: teamId, team_type: 'build', members: teamConfig.members };
   } else if (isInteractive) {
     action = 'spawn_routed_interactive';
-    spawnCommand = buildSpawnCommand(nextAgent, projectDir, lastAgent, modelInfo.provider, 600000, modelInfo.model, modelInfo.source === 'installation-v2', modelInfo);
+    spawnCommand = buildSpawnCommand(nextAgent, projectDir, lastAgent, modelInfo.provider, getAgentTimeout(nextAgent), modelInfo.model, modelInfo.source === 'installation-v2', modelInfo);
   } else {
     action = 'spawn_autonomous';
-    spawnCommand = buildSpawnCommand(nextAgent, projectDir, lastAgent, modelInfo.provider, 600000, modelInfo.model, modelInfo.source === 'installation-v2', modelInfo);
+    spawnCommand = buildSpawnCommand(nextAgent, projectDir, lastAgent, modelInfo.provider, getAgentTimeout(nextAgent), modelInfo.model, modelInfo.source === 'installation-v2', modelInfo);
   }
 
   // Surface criteria (Article XVII): even in autonomous mode, a high-stakes
@@ -2622,14 +2850,109 @@ async function handleScaffoldDecision(projectDir, session, decision, agent, scor
   };
 }
 
+async function handleRejectResult(projectDir, args) {
+  if (!loadRuntimeInstallationV2(projectDir)) return errorResult('Content rejection requires Planning v2.', 'V2_INSTALLATION_REQUIRED');
+  const binding = resolveAgentModel(args.agent, projectDir);
+  const result = rejectAgentResult(projectDir, { agent: args.agent, claimId: args['execution-claim-id'],
+    finishedAt: args['execution-finished-at'], reason: args.reason, binding });
+  if (!result.saved || !result.rejected) return errorResult(result.error, result.code || 'SESSION_WRITE_FAILED');
+  let projection;
+  try { projection = writeSessionLock(projectDir, args.agent); }
+  catch (error) { projection = { projected: false, error: error.message }; }
+  return { rejected: true, advanced: false, retry_ready: true, agent: args.agent,
+    projection: { projected: projection?.projected === true, ...(projection?.error ? { error: projection.error } : {}) },
+    status_summary: 'Complete execution preserved with content rejection. No gate advanced; invoke next separately for rework.' };
+}
+
+async function handleRevalidateQa(projectDir, args) {
+  const agent = args.agent || 'qa-planning';
+  const result = revalidateQaAfterCouncil(projectDir, { agent, claimId: args['execution-claim-id'],
+    finishedAt: args['execution-finished-at'], gateId: args['council-gate-id'] });
+  if (!result.saved || !result.revalidated) return errorResult(result.error, result.code || 'SESSION_WRITE_FAILED');
+  return projectPlanningQaReservation(projectDir, agent, result, 'revalidated');
+}
+
+async function handleReconcilePlanning(projectDir, args) {
+  const agent = args.agent || 'qa-planning';
+  const result = await executePlanningReconciliation({ projectDir, match: { agent,
+    claimId: args['execution-claim-id'], finishedAt: args['execution-finished-at'], gateId: args['council-gate-id'] } });
+  if (!result.settled) return errorResult(result.error, result.code || 'PLANNING_RECONCILIATION_FAILED');
+  if (!result.authorized) return { reconciled: true, authorized: false, advanced: false, blocked: true,
+    code: 'PLANNING_RECONCILIATION_DENIED',
+    decision_path: result.decision_path, assessments: result.assessments,
+    status_summary: 'The bounded assessment denied fresh QA. Preserve the held result and fix the cited material; unchanged bytes cannot launch another assessment.' };
+  return projectPlanningQaReservation(projectDir, agent, result, 'reconciled');
+}
+
+async function handleRevisePlanningContract(projectDir, args) {
+  const rawDirection = args['direction-json'];
+  if (typeof rawDirection !== 'string' || !rawDirection || Buffer.byteLength(rawDirection, 'utf8') > 16 * 1024) {
+    return errorResult('Missing or oversized --direction-json.', 'PLANNING_CONTRACT_REVISION_INPUT_INVALID');
+  }
+  let direction;
+  try { direction = JSON.parse(rawDirection); }
+  catch { return errorResult('--direction-json must be valid closed-schema JSON.', 'PLANNING_CONTRACT_REVISION_INPUT_INVALID'); }
+  const match = { agent: args.agent || 'qa-planning', claimId: args['execution-claim-id'],
+    finishedAt: args['execution-finished-at'], gateId: args['council-gate-id'], direction,
+    ...(args['previous-revision'] === undefined ? {} : { previousRevisionId: args['previous-revision'] }) };
+  const reserved = reservePlanningContractRevision(projectDir, match);
+  if (!reserved.saved || !reserved.reserved) return errorResult(reserved.error, reserved.code || 'PLANNING_CONTRACT_REVISION_FAILED');
+  const reservation = reserved.reservation;
+  let decision;
+  try {
+    if (reservation.status === 'reserved') decision = persistPlanningContractRevision({ projectDir, reservation });
+  } catch (error) {
+    return errorResult(error.message, error.code || 'PLANNING_CONTRACT_REVISION_FAILED');
+  }
+  const settled = settlePlanningContractRevision(projectDir, { ...match,
+    revisionId: reservation.request.revision_id, launchNonce: reservation.launch_nonce,
+    ...(decision ? { decisionSha256: decision.sha256 } : {}) });
+  if (!settled.saved || !settled.settled) return errorResult(settled.error, settled.code || 'PLANNING_CONTRACT_REVISION_FAILED');
+  if (settled.reused && [2, 3].includes(settled.revision.request.schema_version)) return { revised: true, reused: true, advanced: false,
+    revision_id: settled.revision.request.revision_id, decision_path: settled.revision.decision_path,
+    status_summary: 'This explicit direction was already consumed. No owner or automatic budget was reopened; use next for the current canonical state.' };
+  let projection;
+  try { projection = writeSessionLock(projectDir, 'detail'); }
+  catch (error) { projection = { projected: false, error: error.message }; }
+  try {
+    recordEvent(projectDir, EventType.CORRECTION_ESCALATED, 'orchestrator', {
+      source: 'planning_contract_revision', revision_id: settled.revision.request.revision_id,
+      source_gate_id: settled.revision.request.source_gate_id, target_agent: 'detail',
+    });
+  } catch { /* Canonical session and immutable decision remain authoritative. */ }
+  return { revised: true, reused: settled.reused === true, advanced: false, retry_ready: true,
+    revision_id: settled.revision.request.revision_id, decision_path: settled.revision.decision_path,
+    target_agent: 'detail', projection: { projected: projection?.projected === true,
+      ...(projection?.error ? { error: projection.error } : {}) },
+    status_summary: 'Planning ownership reopened at detail. Run detail, architect, UX, genuine fresh QA and the normal council; this direction approves no Planning content.' };
+}
+
+function projectPlanningQaReservation(projectDir, agent, result, operation) {
+  let projection;
+  try { projection = writeSessionLock(projectDir, agent); }
+  catch (error) { projection = { projected: false, error: error.message }; }
+  if (!projection?.projected) {
+    const released = releaseAgentExecution(projectDir, { agent, claimId: result.claimId });
+    return { [operation]: true, advanced: false, spawn_command: null,
+      code: 'SESSION_PROJECTION_FAILED', error: projection?.error, retry_ready: released.saved && released.released,
+      status_summary: 'Revalidation authorization is preserved. Repair the projection, then invoke next; no provider was started.' };
+  }
+  return { [operation]: true, reused: result.reused === true, advanced: false, action: 'spawn_autonomous', agent,
+    execution_claim_id: result.claimId, model_info: result.binding,
+    spawn_command: buildSpawnCommand(agent, projectDir, result.session.last_handoff || 'ux',
+      result.binding.provider, getAgentTimeout(agent), result.binding.model, true,
+      { ...result.binding, execution_claim_id: result.claimId }),
+    status_summary: 'Historical QA preserved. Run this one-shot command for a genuine new verdict, then canonical advance and a fresh council.' };
+}
+
 async function handleAdvance(projectDir, args) {
   const agent = args.agent;
-  const score = parseInt(args.score, 10);
-  const status = args.status || 'completed';
+  const score = args.score === undefined || args.score === '' ? NaN : Number(args.score);
+  const status = args.status === 'complete' ? 'completed' : (args.status || 'completed');
   const decision = args.decision || null;
 
   if (!agent) return errorResult('Missing --agent flag', 'MISSING_AGENT');
-  if (isNaN(score)) return errorResult('Missing or invalid --score flag', 'MISSING_SCORE');
+  if (!Number.isFinite(score) || score < 0 || score > 100) return errorResult('Missing or invalid --score flag', 'MISSING_SCORE');
 
   const { loaded, session } = loadSession(projectDir);
   if (!loaded || !session) return errorResult('No session found', 'NO_SESSION');
@@ -2666,6 +2989,21 @@ async function handleAdvance(projectDir, args) {
     );
   }
 
+  // Non-complete outcomes cannot enter completion, artifact merge or pipeline
+  // transitions. A legacy ambiguous hold can only be settled negatively by its
+  // exact identity; callers must invoke next separately to reserve a retry.
+  if (status !== 'completed') {
+    if (runtimeV2 && status === 'error' && args['execution-finished-at']) {
+      const recovery = rejectLegacyAgentResult(projectDir, { agent, finishedAt: args['execution-finished-at'] });
+      if (!recovery.saved || !recovery.recovered) {
+        return errorResult(recovery.error, recovery.code || 'SESSION_WRITE_FAILED');
+      }
+      return { advanced: false, recovered: true, retry_ready: true, agent,
+        status_summary: 'Legacy result recorded as failure. No gate advanced; invoke next to retry.' };
+    }
+    return errorResult('Only a complete agent result can advance the pipeline.', 'AGENT_RESULT_NOT_COMPLETE');
+  }
+
   if (runtimeV2 && agent === 'tasks' && status === 'completed' && score < 95) {
     return {
       advanced: false,
@@ -2704,13 +3042,32 @@ async function handleAdvance(projectDir, args) {
     };
   }
 
-  if (runtimeV2 && status === 'completed' && agentState?.status !== 'awaiting_advance') {
+  if (runtimeV2 && (agentState?.status !== 'awaiting_advance'
+    || agentState?.execution_claim_state !== 'awaiting_advance' || agentState?.execution_result_status !== 'complete')) {
     return errorResult(
       `Agent ${agent} has no successful routed result awaiting canonical advance.`,
       'V2_AGENT_RESULT_NOT_HELD',
     );
   }
 
+  let qaVerdict = null;
+  if (runtimeV2 && agent === 'qa-planning') {
+    const review = agentState.execution_qa_result;
+    const threshold = getQaThreshold(agent, projectDir);
+    if (review) {
+      if (!isPlanningQaOutcomeValid(review, threshold)) {
+        return errorResult('The held QA outcome is invalid.', 'QA_RESULT_UNVERIFIED');
+      }
+      if (review.score !== score) return errorResult('The supplied score does not match the held QA outcome.', 'QA_RESULT_SCORE_MISMATCH');
+      qaVerdict = review.gate_result;
+    } else {
+      // Old complete holds prove execution, not approval. Compatibility is
+      // strictly negative: never infer a passing plan from an old score100.
+      if (score >= threshold) return errorResult('This legacy QA hold has no verified plan outcome; only negative correction is supported.', 'QA_RESULT_UNVERIFIED');
+      qaVerdict = 'needs_correction';
+    }
+  }
+
   // Handle user_preview decisions
   if (decision) {
     const pipelineState = sessionToPipelineState(session, projectDir);
@@ -2737,29 +3094,33 @@ async function handleAdvance(projectDir, args) {
   // Agents (e.g. qa-implementation) write Decision Trail entries to their handoff
   // instead of directly editing session.yaml (blocked by mode-governance hook).
   let handoffData = {};
-  // Handoff files live at <frameworkDir>/artifacts/handoffs/<agent>-handoff.md
-  // EXCEPT when artifacts/ is user-facing (non-framework). Currently install
-  // writes artifacts to project root <projectDir>/artifacts/. Check both locations
-  // to cover legacy + current layouts.
-  const fwDir = resolveFrameworkDir(projectDir);
-  const handoffCandidates = [
-    join(projectDir, 'artifacts', 'handoffs', `${agent}-handoff.md`),
-    join(projectDir, fwDir, 'artifacts', 'handoffs', `${agent}-handoff.md`),
-  ];
-  const handoffPath = handoffCandidates.find(p => existsSync(p));
-  if (handoffPath) {
-    try {
+  let compiledRailHandoff = null;
+  let visualApplicability = null;
+  try {
+    const handoffPath = findAgentHandoffPath(projectDir, agent);
+    if (handoffPath) {
       const handoffMarkdown = readFileSync(handoffPath, 'utf-8');
       handoffData = parseHandoffDecisionTrail(handoffMarkdown);
       // Fase 10 auto-gate — parse scaffold candidates/signals alongside Decision Trail.
       const scaffold = parseHandoffScaffoldSignals(handoffMarkdown);
       handoffData.scaffold_candidates = scaffold.scaffold_candidates;
       handoffData.scaffold_signals = scaffold.scaffold_signals;
-    } catch {
-      // Non-fatal: if handoff can't be read, skip Decision Trail / scaffold merge
     }
+  } catch (error) {
+    if (error.code === 'INVALID_HANDOFF_DECISION_TRAIL') return errorResult(error.message, error.code);
+    // Non-fatal: unreadable handoffs do not merge a Decision Trail or scaffold.
+    // Do not fall back to older handoffs after selecting a new-format output.
   }
 
+  if (runtimeV2 && agent === 'qa-planning' && qaVerdict === 'needs_correction'
+    && !handoffData.decision_trail_entries?.some(entry => entry.resolved === false)) {
+    return errorResult('Negative QA correction requires preserved unresolved findings.', 'QA_FINDINGS_REQUIRED');
+  }
+  const correctionTarget = args['correction-target'] || null;
+  try {
+    assertQaCorrectionTarget(sessionToPipelineState(session, projectDir), agent, { score, qaVerdict, correctionTarget, handoffData });
+  } catch (error) { return errorResult(error.message, error.code); }
+
   // Deterministic gates: block advance if required artifacts are missing.
 
   // V2 replaces the legacy Build/Deploy entry with a sealed, project-local
@@ -2773,18 +3134,17 @@ async function handleAdvance(projectDir, args) {
   // dependencies and ClickUp references.
   if (agent === 'tasks' && status === 'completed' && score >= 95 && loadRuntimeInstallationV2(projectDir)) {
     try {
-      const handoff = compilePlanningHandoff({ projectDir });
-      handoffData.rail_handoff = persistRailHandoff({ projectDir, handoff });
+      compiledRailHandoff = compilePlanningHandoff({ projectDir, promoteCandidate: true });
     } catch (error) {
       return {
         advanced: false,
         blocked: true,
         reason: error.code || 'RAIL_HANDOFF_COMPILATION_FAILED',
         message: error.message,
-        expected_artifact: PLANNING_V2_TASKS_PATH,
+        expected_artifact: PLANNING_V2_TASKS_CANDIDATE_PATH,
         action_required: {
           owner: 'Tasks and QA Planning agents',
-          artifact: PLANNING_V2_TASKS_PATH,
+          artifact: PLANNING_V2_TASKS_CANDIDATE_PATH,
           requirements: ['source artifacts', 'task IDs and dependencies', 'Given-When-Then criteria', 'execution scopes', 'AI and human estimates', 'ClickUp references'],
         },
       };
@@ -3171,6 +3531,24 @@ async function handleAdvance(projectDir, args) {
 
   // UX (brand-architect) gate
   if (agent === 'ux') {
+    visualApplicability = resolveNonVisualUxApplicability(projectDir, runtimeV2);
+    if (visualApplicability) {
+      const handoff = (await loadHandoffContext(projectDir, 'ux')).context.handoff;
+      let specification = '';
+      try { specification = readFileSync(join(projectDir, 'artifacts/4-UX/ux-specification.md'), 'utf8').trim(); }
+      catch { /* A missing/unreadable specification cannot be exempted. */ }
+      // The documented handoff sections do not require frontmatter. This v2
+      // branch has already required a canonical complete routed result above;
+      // absent metadata is not an inferred completion, while an explicit
+      // non-complete declaration must still block even with a complete hold.
+      const compatibleStatus = handoff?.status === 'complete' || handoff?.status_declared === false;
+      if (!specification || !compatibleStatus || !validateHandoffIntegrity(handoff, 'qa-planning').valid) {
+        return {
+          advanced: false, blocked: true, reason: 'ux_non_visual_artifacts_missing',
+          message: 'A non-visual Brief exempts only visual deliverables. A non-empty ux-specification.md and complete UX handoff with summary/outputs remain required.',
+        };
+      }
+    }
     // Fase 7 — Task-to-UX fidelity. Before checking brandbook.html, verify that
     // if the brief or reference-analysis cites premium animation references,
     // the brand-architect has produced the animation-inventory artifact. The
@@ -3178,7 +3556,7 @@ async function handleAdvance(projectDir, args) {
     // reveals" instead of the specific patterns the user's references
     // encode, and qa-visual has no per-pattern checklist for Mode 2.
     const inventoryPath = join(projectDir, 'artifacts', '4-UX', 'animation-inventory.md');
-    if (!existsSync(inventoryPath)) {
+    if (!visualApplicability && !existsSync(inventoryPath)) {
       const corpus = readBriefAndRefCorpus(projectDir);
       const refs = detectPremiumRefs(corpus);
       if (refs.detected) {
@@ -3204,18 +3582,147 @@ async function handleAdvance(projectDir, args) {
     }
 
     const brandbookPath = join(projectDir, 'artifacts', '4-UX', 'brandbook.html');
-    if (!existsSync(brandbookPath)) {
+    if (!visualApplicability && !existsSync(brandbookPath)) {
       return {
         advanced: false,
         blocked: true,
         reason: 'brandbook_html_missing',
-        message: 'brandbook.html is a mandatory deliverable for the UX agent. Write artifacts/4-UX/brandbook.html before advancing.',
+        message: 'brandbook.html is required unless the current council-approved Brief explicitly declares non-visual scope. Write artifacts/4-UX/brandbook.html or resolve the upstream applicability declaration before advancing.',
+      };
+    }
+  }
+
+  // The product-level council follows deterministic artifact checks. It gates
+  // the three user-visible planning boundaries and never substitutes an
+  // unselected provider when a configured member is unavailable.
+  if (runtimeV2 && status === 'completed' && qaVerdict !== 'needs_correction') {
+    try {
+      const council = await enforceRuntimeCouncilGate({
+        projectDir,
+        agent,
+        session,
+        artifact: runtimeV2,
+        ...(compiledRailHandoff ? { handoff: compiledRailHandoff } : {}),
+      });
+      if (council.required && !council.approved) {
+        const revisionCapability = agent === 'qa-planning'
+          && (session.planning_contract_revisions?.length || session.agents[agent]?.planning_reconciliations?.some(entry => entry.authorization))
+          ? planningContractRevisionCapability(projectDir, session, council.result?.gate_id || council.gate_id)
+          : null;
+        // Every automatic recovery budget can be consumed without a single QA
+        // authorization (all reconciliation targets denied). That state is
+        // terminal for the automatic route and must be reported as such instead
+        // of pointing the operator at a command that can only fail again.
+        const reconciliationBudgetExhausted = agent === 'qa-planning' && !revisionCapability
+          && planningRecoveryBudgetExhausted(session, agent);
+        return {
+          advanced: false,
+          blocked: true,
+          reason: council.code || 'COUNCIL_GATE_REWORK_REQUIRED',
+          message: council.message || `The ${council.result?.stage || council.stage} planning council recorded accepted blocking findings. Rework the frozen artifacts before advancing.`,
+          stage: council.result?.stage || council.stage,
+          gate_id: council.result?.gate_id || council.gate_id || null,
+          blockers: council.blockers || council.result?.decision?.blocking_findings || [],
+          ...(reconciliationBudgetExhausted ? { recovery_budget_exhausted: true } : {}),
+          action_required: {
+            owner: 'planning artifact owner',
+            next_step: agent === 'qa-planning'
+              ? reconciliationBudgetExhausted
+                ? 'Automatic recovery budgets are exhausted: rejection, council revalidation and every reconciliation target were consumed without a QA authorization. No automatic command can approve this Planning. Reopen Planning with new technical direction through deviation --type rollback --target <detail|architect|ux> --confirm true, correct the accepted findings, then run genuine fresh QA and the council again.'
+                : revisionCapability
+                ? revisionCapability.available
+                  ? `Automatic recovery budgets remain exhausted. A distinct explicit controller direction may use revise-planning-contract${revisionCapability.previousRevisionId ? ` --previous-revision ${revisionCapability.previousRevisionId}` : ''} with this exact held claim, finished-at, council-gate-id and closed direction JSON. Preserve current bytes until genuine owners reopen; this direction approves no Planning content.`
+                  : `Preserve the held QA, council findings and recovery history. Contract reopening is unavailable at this boundary (${revisionCapability.code}); resolve that boundary before requesting a direction.`
+                : session.agents[agent]?.council_revalidations?.length
+                  ? 'Correct the accepted findings without changing the held QA report. Use reconcile-planning with the exact held claim, finished-at and this council-gate-id. It assesses only readiness for genuine fresh QA; it cannot approve Planning.'
+                  : 'resolve the accepted findings without changing the held QA report. Use reject-result while its budget remains; at the limit use revalidate-qa with the exact held claim, finished-at and this council-gate-id. Execute genuine QA, then advance.'
+              : 'resolve the accepted high or critical findings, then re-run the canonical advance after the artifact delta',
+          },
+        };
+      }
+    } catch (error) {
+      return {
+        advanced: false,
+        blocked: true,
+        reason: error.code || 'COUNCIL_GATE_EXECUTION_FAILED',
+        message: error.message,
+        action_required: error.code === 'COUNCIL_GATE_PROMPT_SIZE_LIMIT' ? {
+          owner: 'planning artifact owner',
+          next_step: 'reduce the frozen planning artifacts to fit the council material budget, preserve explicit scope and criteria, then re-run advance. No provider was invoked and no provider reconfiguration is needed.',
+          ...error.details,
+        } : {
+          owner: 'installation owner',
+          next_step: 'restore the selected council provider or explicitly reconfigure the installation. No provider fallback was used.',
+        },
+      };
+    }
+  }
+
+  // A Tasks completion only becomes an executable RAIL authority after the
+  // execution-design council approved the exact frozen planning bundle above.
+  // Keep the compiler output in memory until that point, so a blocked council
+  // cannot leave a dispatchable handoff behind for a manual RAIL invocation.
+  if (compiledRailHandoff) {
+    try {
+      const council = resolveRuntimeCouncilGatePolicyV2({ artifact: runtimeV2, stage: 'execution-design' });
+      if (council.reason === 'GUIDED_COUNCIL_REQUIRED') {
+        return {
+          advanced: false,
+          blocked: true,
+          reason: 'GUIDED_COUNCIL_REQUIRED',
+          message: 'this installation has no autonomous council quorum. Reconfigure it with two selected review providers before creating a dispatchable RAIL handoff.',
+        };
+      }
+      const persisted = persistRailHandoff({ projectDir, handoff: compiledRailHandoff });
+      const council_binding = council.enabled
+        ? persistRailHandoffCouncilBinding({
+          projectDir,
+          handoff: compiledRailHandoff,
+          artifact: runtimeV2,
+          policy: council.policy,
+        })
+        : undefined;
+      handoffData.rail_handoff = Object.freeze({
+        ...persisted,
+        ...(council_binding ? { council_binding } : {}),
+      });
+    } catch (error) {
+      return {
+        advanced: false,
+        blocked: true,
+        reason: error.code || 'RAIL_HANDOFF_PERSISTENCE_FAILED',
+        message: error.message,
+        expected_artifact: PLANNING_V2_TASKS_CANDIDATE_PATH,
+        action_required: {
+          owner: 'Tasks and QA Planning agents',
+          artifact: PLANNING_V2_TASKS_CANDIDATE_PATH,
+          requirements: ['source artifacts', 'task IDs and dependencies', 'Given-When-Then criteria', 'execution scopes', 'AI and human estimates', 'ClickUp references'],
+        },
+      };
+    }
+  }
+
+  // Handoff/council awaits above may have yielded after the first applicability
+  // snapshot. Revalidate the SAME approved subject and reference conflicts
+  // immediately before the synchronous session mutation. Never commit a stale
+  // visual exemption after an upstream edit.
+  if (visualApplicability) {
+    const current = resolveNonVisualUxApplicability(projectDir, runtimeV2);
+    if (!current || current.sha256 !== visualApplicability.sha256
+      || current.discovery_gate_id !== visualApplicability.discovery_gate_id) {
+      return {
+        advanced: false, blocked: true, reason: 'ux_visual_applicability_changed',
+        message: 'Visual applicability changed before UX completion. Review the current Brief and visual references; no completion was recorded.',
       };
     }
   }
 
   // Record completion (merges Decision Trail entries from handoff into session.yaml)
-  await recordAgentCompletion(projectDir, { agent, status, score, handoffData });
+  runRuntimeSecurityTestHook('beforeAgentCompletionCommit', { projectDir, agent });
+  const completion = recordAgentCompletion(projectDir, { agent, status, score, handoffData,
+    ...(runtimeV2 ? { expectedResult: { claimId: agentState.execution_claim_id, finishedAt: agentState.execution_finished_at } } : {}),
+  });
+  if (!completion.saved) return errorResult(completion.error, completion.code || 'SESSION_WRITE_FAILED');
   recordEvent(projectDir, EventType.AGENT_COMPLETED, agent, { score, status });
 
   // A v2 task graph has become an immutable RAIL handoff. Do not silently
@@ -3270,7 +3777,8 @@ async function handleAdvance(projectDir, args) {
   // unapplied. If so, return an action_required response with the 3-option
   // decision payload. qa-planning stays marked complete; the user's next
   // advance call must carry --decision apply|skip|dryrun.
-  if (status === 'completed' && score >= 95 && agent === 'qa-planning') {
+  if (status === 'completed' && score >= 95 && agent === 'qa-planning'
+    && (!runtimeV2 || qaVerdict === 'approved')) {
     const { session: postQa } = loadSession(projectDir);
     const gate = checkScaffoldGate(postQa || session);
     if (gate.fires) {
@@ -3292,6 +3800,8 @@ async function handleAdvance(projectDir, args) {
 
   const advanceResult = advancePipeline(pipelineState, agent, {
     score,
+    qaVerdict,
+    correctionTarget,
     handoffData,
     findings: handoffData?.decision_trail_entries || [],
   });
@@ -3419,7 +3929,7 @@ async function handleAdvance(projectDir, args) {
         max_cycles: 2,
         findings_count: (c.findings || []).length,
         pipeline_progress: getPipelineProgress(advanceResult.state || pipelineState),
-        status_summary: `${agent} scored ${c.score ?? 'n/a'} (below threshold). Fault origin: ${c.faultOrigin}. Re-opening ${c.target} (correction cycle ${c.cycle} of 2). Claude must invoke ${c.target} with the findings.`,
+        status_summary: `${agent} requires correction (score ${c.score ?? 'n/a'}). Fault origin: ${c.faultOrigin}. Re-opening ${c.target} (correction cycle ${c.cycle} of 2). The controller must invoke ${c.target} on its bound provider with the findings.`,
       },
     };
   }
@@ -3474,7 +3984,10 @@ async function handleAdvance(projectDir, args) {
   }
 
   const next = await handleNext(projectDir);
-  return { advanced: true, agent_completed: agent, score, phase_transition: phaseTransition, next };
+  return {
+    advanced: true, agent_completed: agent, score, phase_transition: phaseTransition, next,
+    ...(visualApplicability ? { visual_applicability: visualApplicability } : {}),
+  };
 }
 
 async function handleInit(projectDir, args) {
@@ -3766,7 +4279,7 @@ async function handleStatus(projectDir) {
     execution_mode: session.execution_mode || 'interactive',
     active_harness: session.active_harness || null,
     current_execution_binding: session.current_execution_binding || null,
-    pending_interaction: session.pending_interaction || null,
+    pending_interaction: summarizePendingInteraction(session.pending_interaction),
   };
 }
 
@@ -3832,6 +4345,24 @@ async function handleDeviation(projectDir, args) {
   const { loaded, session } = loadSession(projectDir);
   if (!loaded || !session) return errorResult('No session found', 'NO_SESSION');
 
+  if (type === 'rollback' && loadRuntimeInstallationV2(projectDir)) {
+    let impact;
+    try { impact = inspectPlanningCorrectionRollback(projectDir, session, target); }
+    catch (error) { return errorResult(error.message, error.code || 'PLANNING_CORRECTION_INVALID'); }
+    if (!confirm) return { impact, applied: false, changes: [], new_state: null };
+    runRuntimeSecurityTestHook('beforePlanningCorrectionCommit', { projectDir, target });
+    const result = rollbackPlanningCorrection(projectDir, target);
+    if (!result.saved || !result.applied) return errorResult(result.error, result.code || 'SESSION_WRITE_FAILED');
+    let projection;
+    try {
+      projection = writeSessionLock(projectDir, target, {
+        phase: result.session.mode, mode: result.session.execution_mode || 'interactive',
+      });
+    } catch (error) { projection = { projected: false, error: error.message }; }
+    return { impact: result.impact, applied: true, changes: result.changes,
+      new_state: { current_agent: result.session.current_agent }, projection };
+  }
+
   const pipelineState = sessionToPipelineState(session, projectDir);
 
   const details = { targetAgent: target };
@@ -4997,8 +5528,21 @@ function handleAssessCoverage(args) {
 // Main entry point
 // ---------------------------------------------------------------------------
 
-export async function runOrchestrate(subCommand, argv, projectDir) {
+export async function runOrchestrate(subCommand, argv, projectDir, { write = writeOutput } = {}) {
+  let result;
+  try {
+    result = await withUpgradeMaintenance(projectDir, () => runOrchestrateUnderMaintenance(subCommand, argv, projectDir));
+  } catch (err) {
+    result = errorResult(`Orchestrate error: ${err.message}`, err.code || 'INTERNAL_ERROR');
+    process.exitCode = 1;
+  }
+  write(result);
+}
+
+async function runOrchestrateUnderMaintenance(subCommand, argv, projectDir) {
   const args = parseArgs(argv);
+  let result;
+  const output = (value) => { result = value; };
 
   try {
     switch (subCommand) {
@@ -5008,6 +5552,18 @@ export async function runOrchestrate(subCommand, argv, projectDir) {
       case 'advance':
         output(await handleAdvance(projectDir, args));
         break;
+      case 'reject-result':
+        output(await handleRejectResult(projectDir, args));
+        break;
+      case 'revalidate-qa':
+        output(await handleRevalidateQa(projectDir, args));
+        break;
+      case 'reconcile-planning':
+        output(await handleReconcilePlanning(projectDir, args));
+        break;
+      case 'revise-planning-contract':
+        output(await handleRevisePlanningContract(projectDir, args));
+        break;
       case 'init':
         output(await handleInit(projectDir, args));
         break;
@@ -5075,11 +5631,12 @@ export async function runOrchestrate(subCommand, argv, projectDir) {
         output(await handleRunScriptTask(projectDir, args));
         break;
       default:
-        output(errorResult(`Unknown sub-command: ${subCommand}. Valid: next, advance, init, validate-handoff, status, deviation, exit, providers, detect-flow, backlog, qa-plan-score, qa-impl-score, scan, spawn-team, team-status, team-dissolve`, 'UNKNOWN_COMMAND'));
+        output(errorResult(`Unknown sub-command: ${subCommand}. Valid: next, advance, reject-result, revalidate-qa, reconcile-planning, revise-planning-contract, init, validate-handoff, status, deviation, exit, providers, detect-flow, backlog, qa-plan-score, qa-impl-score, scan, spawn-team, team-status, team-dissolve`, 'UNKNOWN_COMMAND'));
         break;
     }
   } catch (err) {
     output(errorResult(`Orchestrate error: ${err.message}`, err.code || 'INTERNAL_ERROR'));
     process.exitCode = 1;
   }
+  return result;
 }