onto-mcp 0.4.11 → 0.4.13

package/dist/core-runtime/reconstruct/maturation-validation.js

@@ -1,9 +1,12 @@
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { parse as parseYaml } from "yaml";
+import { atomicWriteYamlDocument as writeYamlDocument } from "../artifact-io.js";
 import { sourceSafetyRowIdForObservation } from "./source-safety-validation.js";
 import { materialAdmissionIdForPurposeElement } from "./material-admission-validation.js";
+import { isRevisionBlocker } from "./post-seed-validation.js";
+import { assertObligation } from "./obligation-assertion.js";
 const MATERIALITY_VALUES = [
     "blocker",
     "high",
@@ -52,10 +55,6 @@ function isoNow() {
 async function readYamlDocument(filePath) {
     return parseYaml(await fs.readFile(filePath, "utf8"));
 }
-async function writeYamlDocument(filePath, value) {
-    await fs.mkdir(path.dirname(filePath), { recursive: true });
-    await fs.writeFile(filePath, stringifyYaml(value), "utf8");
-}
 async function sha256FileIfPresent(filePath) {
     if (!filePath)
         return null;
@@ -135,6 +134,59 @@ function duplicateIds(values) {
 function sameResolvedRef(left, right) {
     return path.resolve(left) === path.resolve(right);
 }
+/**
+ * Index actionability matrix rows by the dimensions used to compute a delta's
+ * affected_matrix_row_refs, so the build/validate intersection is O(rows + refs)
+ * per delta instead of a per-delta linear scan over the whole matrix.
+ *
+ * Row indices (not matrix_row_ids) are stored so that the downstream projection
+ * reproduces the exact multiplicity and ordering of
+ * `matrixRows.filter(...).map((row) => row.matrix_row_id)`.
+ */
+function indexActionabilityRowsByDelta(matrixRows) {
+    const bySourceRef = new Map();
+    const byObservationId = new Map();
+    const add = (map, key, index) => {
+        const bucket = map.get(key);
+        if (bucket)
+            bucket.add(index);
+        else
+            map.set(key, new Set([index]));
+    };
+    matrixRows.forEach((row, index) => {
+        for (const ref of row.member_source_refs) {
+            add(bySourceRef, path.resolve(ref), index);
+        }
+        for (const ref of row.cross_material_ref_refs) {
+            add(bySourceRef, path.resolve(ref), index);
+        }
+        for (const ref of row.supporting_refs) {
+            add(byObservationId, ref, index);
+        }
+    });
+    return { bySourceRef, byObservationId };
+}
+/**
+ * Resolve the sorted matrix_row_ids affected by a delta row, equivalent to
+ * `matrixRows.filter((row) => member/cross resolves to source_ref OR
+ * supporting_refs includes observation_id).map((row) => row.matrix_row_id).sort()`.
+ */
+function affectedMatrixRowRefsForDelta(matrixRows, index, deltaRow) {
+    const matched = new Set();
+    for (const rowIndex of index.bySourceRef.get(path.resolve(deltaRow.source_ref)) ??
+        []) {
+        matched.add(rowIndex);
+    }
+    for (const rowIndex of index.byObservationId.get(deltaRow.observation_id) ?? []) {
+        matched.add(rowIndex);
+    }
+    const refs = [];
+    matrixRows.forEach((row, rowIndex) => {
+        if (matched.has(rowIndex))
+            refs.push(row.matrix_row_id);
+    });
+    return refs.sort();
+}
 function violation(args) {
     return {
         code: args.code,
@@ -205,12 +257,83 @@ function matrixRowNeedsFrontier(row) {
         row.maturity_level !== "L4_validated_for_purpose" &&
         row.limitation_refs.length === 0;
 }
+// Maturation value-read cut (design §13.3). Shared discharge→residual+readiness derivation
+// used by BOTH the matrix builder and its validator (derive-and-assert). Pure/deterministic,
+// no I/O.
+// Baseline limitations cleared by VALIDATED, SATISFIED value-discharges, keyed by
+// baseline_row_id. Only a discharge artifact whose validation is `valid` contributes (global
+// gate, mirrors the answer-claims pattern), and only entries with satisfaction_status ===
+// "satisfied" subtract — refuted/inconclusive never discharge (§4.3 four conditions). The
+// validator builds this independently and never trusts the matrix's stamped residual.
+function buildValidatedDischargeIndex(discharge, dischargeValidation) {
+    const byBaselineRowId = new Map();
+    if (dischargeValidation?.validation_status !== "valid")
+        return byBaselineRowId;
+    for (const entry of discharge?.discharges ?? []) {
+        if (entry.satisfaction_status !== "satisfied")
+            continue;
+        for (const baselineRowRef of entry.target_baseline_row_refs) {
+            const bucket = byBaselineRowId.get(baselineRowRef) ?? new Set();
+            for (const lim of entry.target_limitation_refs)
+                bucket.add(lim);
+            byBaselineRowId.set(baselineRowRef, bucket);
+        }
+    }
+    return byBaselineRowId;
+}
+// The terminal readiness for a material row whose value-dependent limitations were cleared to
+// zero residual by value-read discharge. `dischargedForRow > 0` distinguishes a residual that
+// reached zero BY discharge (→ value_resolved) from one that was always zero (→ the natural
+// frontier_required / closed case). A forged value_resolved with no real discharge therefore
+// falls through to frontier_required/closed and is rejected by the validator's readiness
+// assert. matrixRowNeedsFrontier is unchanged (called with the residual).
+function deriveMemberReadiness(args) {
+    if (args.residualLimitationRefs.length > 0)
+        return "limitation_backed";
+    if (isMaterialMaturationRow({ materiality: args.materiality }) &&
+        args.maturityLevel !== "L4_validated_for_purpose" &&
+        args.dischargedForRow > 0) {
+        return "value_resolved";
+    }
+    if (matrixRowNeedsFrontier({
+        materiality: args.materiality,
+        maturity_level: args.maturityLevel,
+        limitation_refs: args.residualLimitationRefs,
+    })) {
+        return "frontier_required";
+    }
+    return "closed";
+}
 function maturityLevelRank(level) {
     return MATURITY_LEVELS.indexOf(level);
 }
 function higherMaturityLevel(current, next) {
     return maturityLevelRank(next) > maturityLevelRank(current) ? next : current;
 }
+// Site-7 proportional terminal (design 20260706 §5): the SINGLE certification choke point.
+// A judge-support-shortfall (degraded) claim must never certify — it is excluded from the
+// positive sets that raise maturity (L3/L4), and every baseline row it matches carries a
+// deterministic limitation token so member_readiness degrades to limitation_backed and the
+// continuation decision weighs it by materiality. The matrix BUILDER and VALIDATOR both
+// derive through these helpers (derive-and-assert lockstep); an expansion citing a degraded
+// claim is likewise non-positive so it cannot co-lift a row to L4.
+const JUDGE_SUPPORT_SHORTFALL_TOKEN_PREFIX = "judge_support_shortfall:";
+function judgeSupportShortfallIds(validation) {
+    return new Set(validation?.judge_support_shortfall_claim_ids);
+}
+export function judgeSupportShortfallToken(claimId) {
+    return `${JUDGE_SUPPORT_SHORTFALL_TOKEN_PREFIX}${claimId}`;
+}
+function positiveAnswerClaim(claim, shortfallIds) {
+    return claim.answer_status === "answered" &&
+        claim.limitation_refs.length === 0 &&
+        !shortfallIds.has(claim.answer_claim_id);
+}
+function positiveExpansion(expansion, shortfallIds) {
+    return (expansion.operation === "add" || expansion.operation === "refine") &&
+        expansion.limitation_refs.length === 0 &&
+        !expansion.answer_claim_refs.some((ref) => shortfallIds.has(ref));
+}
 function answerClaimMatchesBaselineRow(claim, row) {
     return claim.purpose_element_refs.includes(row.purpose_element_ref) &&
         claim.target_surface_refs.includes(row.actionability_surface_ref) &&
@@ -256,6 +379,7 @@ export function buildMaturationBaselineArtifact(args) {
             purpose_confirmation_validation_ref: args.purposeConfirmationValidationRef,
             source_material_admission_ledger_ref: args.sourceMaterialAdmissionLedgerRef,
             source_material_admission_validation_ref: args.sourceMaterialAdmissionValidationRef,
+            candidate_limitation_refs: [],
             baseline_rows: [],
         };
     }
@@ -266,10 +390,12 @@ export function buildMaturationBaselineArtifact(args) {
         const resolvedEvidence = rowEvidence.length > 0
             ? rowEvidence
             : element.supporting_evidence_refs;
-        const limitationRefs = [
-            ...stringArray(seedElement?.limitation_refs),
-            ...candidate.limitation_refs,
-        ];
+        // Row-level limitations are the row's own seed-element limitations only.
+        // Candidate-level limitations are surfaced once at the baseline top-level
+        // (candidate_limitation_refs) so they constrain the actionable claim without
+        // forcing every surface×dimension row to limitation_backed (which would dead
+        // the maturation answer machine — frontier/closure/ledger/judge all skipped).
+        const limitationRefs = stringArray(seedElement?.limitation_refs);
         const coverage = questionCoverage({
             seedRefs,
             competencyQuestions: args.competencyQuestions,
@@ -338,6 +464,7 @@ export function buildMaturationBaselineArtifact(args) {
         purpose_confirmation_validation_ref: args.purposeConfirmationValidationRef,
         source_material_admission_ledger_ref: args.sourceMaterialAdmissionLedgerRef,
         source_material_admission_validation_ref: args.sourceMaterialAdmissionValidationRef,
+        candidate_limitation_refs: candidate.limitation_refs,
         baseline_rows: rows.map((row) => ({
             ...row,
             blocking_reason: needsFrontier(row)
@@ -346,8 +473,55 @@ export function buildMaturationBaselineArtifact(args) {
         })),
     };
 }
+// M1 conservation — derive-from-authority. The closed set of required maturation
+// tuples is enumerated once from the selected purpose candidate's required_elements
+// (the same element x surface x dimension enumeration the baseline builder performs),
+// so the validator can prove every required tuple is present exactly once instead of
+// only checking that the rows that ARE present resolve. Coverage authority is the
+// TUPLE, not the (slug-derived) baseline_row_id, which is verified separately.
+function baselineTupleKey(elementId, surfaceRef, dimensionRef) {
+    return JSON.stringify([elementId, surfaceRef, dimensionRef]);
+}
+function sameRefSet(a, b) {
+    if (a.length !== b.length)
+        return false;
+    const seen = new Set(a);
+    return b.every((ref) => seen.has(ref));
+}
+// Exact array equality (order- and multiplicity-sensitive). Used for matrix fields
+// the builder copies VERBATIM from the baseline row, where set-equality would miss a
+// reorder or a duplicate-occurrence swap (e.g. [a,a,b] -> [a,b,b]: same length+set).
+function sameRefArray(a, b) {
+    return a.length === b.length && a.every((ref, index) => ref === b[index]);
+}
+// Cross-artifact lineage binding: a consumed validation must record the upstream ref that is
+// actually supplied here, so a valid validation produced against a DIFFERENT upstream cannot
+// bless this artifact. Returns a violation when the recorded and supplied refs disagree.
+function validationLineageViolation(args) {
+    const recorded = args.recordedUpstreamRef ?? null;
+    const supplied = args.suppliedUpstreamRef ?? null;
+    if (recorded === supplied)
+        return null;
+    return violation({
+        code: "conflicting_state",
+        message: args.message,
+        subjectId: recorded ?? supplied,
+    });
+}
+function deriveExpectedBaselineTuples(selected) {
+    const tuples = new Set();
+    for (const element of selected?.adequacy_frame.required_elements ?? []) {
+        for (const surfaceRef of element.actionability_surface_refs) {
+            for (const dimensionRef of element.maturity_dimension_refs) {
+                tuples.add(baselineTupleKey(element.element_id, surfaceRef, dimensionRef));
+            }
+        }
+    }
+    return tuples;
+}
 export function validateMaturationBaseline(args) {
     const violations = [];
+    const assertedObligationIds = [];
     const baseline = args.maturationBaseline;
     const selected = selectedPurposeCandidate({
         sourcePurposeCandidates: args.sourcePurposeCandidates,
@@ -365,6 +539,25 @@ export function validateMaturationBaseline(args) {
             subjectId: baseline.session_id,
         }));
     }
+    // candidate_limitation_refs are the source-level authority that holds an otherwise
+    // closed run at actionable_limited; a stale/edited baseline that drops them (then
+    // copied faithfully into the matrix) would pass the matrix check yet let
+    // continuation project actionable_ready. Anchor them to the selected candidate.
+    const expectedCandidateLimitations = new Set(selected?.limitation_refs ?? []);
+    const actualCandidateLimitations = new Set(baseline.candidate_limitation_refs);
+    const candidateLimitationsMatch = expectedCandidateLimitations.size === actualCandidateLimitations.size &&
+        [...expectedCandidateLimitations].every((ref) => actualCandidateLimitations.has(ref));
+    if (!candidateLimitationsMatch) {
+        violations.push(violation({
+            code: "conflicting_state",
+            message: "maturation baseline candidate_limitation_refs must match the selected purpose candidate's limitation_refs",
+            subjectId: "candidate_limitation_refs",
+        }));
+    }
+    // G(a) slice 2: record reaching the source-reconstruct-record enforcement UNCONDITIONALLY (this
+    // check has no data-dependent guard) so the obligation is proven wired on every call. Audited to a
+    // distinct enforcement site (source_reconstruct_record_missing) before recording — no laundering.
+    assertObligation(assertedObligationIds, "require_source_reconstruct_record_ref_and_sha256_before_maturation_baseline_consumption");
     if (!baseline.source_reconstruct_record_ref || !args.sourceReconstructRecordSha256) {
         violations.push(violation({
             code: "source_reconstruct_record_missing",
@@ -394,6 +587,10 @@ export function validateMaturationBaseline(args) {
             subjectId: "baseline_rows",
         }));
     }
+    // G(a) slice 2: record reaching the per-row mixed-lineage enforcement region UNCONDITIONALLY
+    // (before the row loop) so the obligation is proven wired even for a baseline with zero rows.
+    // Audited to a distinct enforcement site (mixed_lineage_missing, below) before recording.
+    assertObligation(assertedObligationIds, "validate_mixed_baseline_rows_preserve_member_material_and_cross_material_lineage");
     for (const row of baseline.baseline_rows) {
         if (seen.has(row.baseline_row_id)) {
             violations.push(violation({
@@ -453,7 +650,19 @@ export function validateMaturationBaseline(args) {
             row.member_target_material_kind !== null &&
             row.member_source_refs.length > 0 &&
             row.cross_material_ref_refs.length > 0;
-        if (mixedTarget && !hasLineage && row.limitation_refs.length === 0) {
+        // Mixed-target lineage is row-scoped by default: each row grounds itself by its
+        // own member lineage or its own limitation, because a stray candidate limitation
+        // does not name a row's member/source. The one exception is a candidate that is
+        // ITSELF limitation-backed — the upstream purpose validator already accepted its
+        // limitation_refs as justifying gaps (e.g. unrecoverable mixed-member lineage), so
+        // its rows may lean on that acknowledgment rather than failing baseline validation.
+        // (Candidate limitations still never mark a row limitation_backed, so frontier
+        // gating is unaffected.)
+        const candidateLimitationBacked = selected?.purpose_source_status === "limitation_backed" ||
+            selected?.adequacy_frame.frame_status === "limitation_backed";
+        const mixedLineageExempt = row.limitation_refs.length > 0 ||
+            (candidateLimitationBacked && baseline.candidate_limitation_refs.length > 0);
+        if (mixedTarget && !hasLineage && !mixedLineageExempt) {
             violations.push(violation({
                 code: "mixed_lineage_missing",
                 message: "mixed-material baseline row must preserve member lineage or cite a limitation",
@@ -461,6 +670,39 @@ export function validateMaturationBaseline(args) {
             }));
         }
     }
+    // M1 coverage conservation: derive the closed required-tuple set from the selected
+    // candidate and prove every required tuple is present exactly once. The per-row loop
+    // above only checks that PRESENT rows resolve, so a deleted required row (erasing
+    // blocker/high scope) or a duplicated tuple would otherwise pass silently.
+    // G(a): record reaching the coverage block UNCONDITIONALLY (before the `if (selected)`
+    // guard) so the obligation is proven wired even for inputs with no selected candidate.
+    assertObligation(assertedObligationIds, "validate_baseline_rows_cover_selected_purpose_frame_required_elements");
+    if (selected) {
+        const expectedTuples = deriveExpectedBaselineTuples(selected);
+        const presentTupleCounts = new Map();
+        for (const row of baseline.baseline_rows) {
+            const key = baselineTupleKey(row.purpose_element_ref, row.actionability_surface_ref, row.maturity_dimension_ref);
+            presentTupleCounts.set(key, (presentTupleCounts.get(key) ?? 0) + 1);
+        }
+        for (const tuple of expectedTuples) {
+            if (!presentTupleCounts.has(tuple)) {
+                violations.push(violation({
+                    code: "missing_required_coverage",
+                    message: `required maturation tuple has no baseline row: ${tuple}`,
+                    subjectId: tuple,
+                }));
+            }
+        }
+        for (const [tuple, count] of presentTupleCounts) {
+            if (count > 1 && expectedTuples.has(tuple)) {
+                violations.push(violation({
+                    code: "conflicting_state",
+                    message: `multiple baseline rows cover one required maturation tuple: ${tuple}`,
+                    subjectId: tuple,
+                }));
+            }
+        }
+    }
     return {
         schema_version: "1",
         session_id: baseline.session_id,
@@ -477,6 +719,7 @@ export function validateMaturationBaseline(args) {
         validation_results: violations.length === 0
             ? ["maturation_baseline_valid"]
             : ["maturation_baseline_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
@@ -484,29 +727,60 @@ export function buildActionabilityMatrixArtifact(args) {
     const answerClaims = args.maturationAnswerClaimsValidation?.validation_status === "valid"
         ? args.maturationAnswerClaims?.answer_claims ?? []
         : [];
+    const shortfallIds = judgeSupportShortfallIds(args.maturationAnswerClaimsValidation);
     const expansions = args.ontologyExpansionValidation?.validation_status === "valid"
         ? args.ontologyExpansion?.expansions ?? []
         : [];
+    // Maturation value-read cut: baseline limitations cleared by validated satisfied
+    // discharges, keyed by baseline_row_id (design §13.3). Empty when no discharge is threaded
+    // or its validation is not valid → the subtract below is a no-op (default-off).
+    const dischargedLimitationsByBaselineRow = buildValidatedDischargeIndex(args.maturationValueDischarge, args.maturationValueDischargeValidation);
+    // Reverse link: a row's blocking_question_refs name the maturation frontier
+    // question(s) authored for it. Questions only exist once the frontier is authored
+    // from the (pre-frontier) baseline matrix, so this is populated on the current-matrix
+    // recompute when a VALIDATED frontier is threaded in and left empty otherwise (the
+    // baseline matrix passes no frontier → []). Indexed by baseline_row_id, which the
+    // frontier question references via baseline_row_refs.
+    const frontierQuestions = args.maturationQuestionFrontierValidation?.validation_status === "valid"
+        ? args.maturationQuestionFrontier?.questions ?? []
+        : [];
+    const blockingQuestionsByBaselineRow = new Map();
+    for (const question of frontierQuestions) {
+        for (const baselineRowRef of question.baseline_row_refs) {
+            const bucket = blockingQuestionsByBaselineRow.get(baselineRowRef);
+            if (bucket)
+                bucket.push(question.question_id);
+            else {
+                blockingQuestionsByBaselineRow.set(baselineRowRef, [question.question_id]);
+            }
+        }
+    }
     return {
         schema_version: "1",
         session_id: args.sessionId,
         created_at: isoNow(),
         maturation_baseline_ref: args.maturationBaselineRef,
         maturation_baseline_validation_ref: args.maturationBaselineValidationRef,
+        candidate_limitation_refs: args.maturationBaseline.candidate_limitation_refs,
         rows: args.maturationBaseline.baseline_rows.map((row) => {
             const matchingAnswerClaims = answerClaims.filter((claim) => answerClaimMatchesBaselineRow(claim, row));
             const matchingExpansions = expansions.filter((expansion) => expansionMatchesBaselineRow(expansion, row));
-            const positiveAnswerClaims = matchingAnswerClaims.filter((claim) => claim.answer_status === "answered" &&
-                claim.limitation_refs.length === 0);
-            const positiveExpansions = matchingExpansions.filter((expansion) => (expansion.operation === "add" || expansion.operation === "refine") &&
-                expansion.limitation_refs.length === 0);
+            const positiveAnswerClaims = matchingAnswerClaims.filter((claim) => positiveAnswerClaim(claim, shortfallIds));
+            const positiveExpansions = matchingExpansions.filter((expansion) => positiveExpansion(expansion, shortfallIds));
             let maturityLevel = row.maturity_level;
             const supportingRefs = [
                 ...row.supporting_seed_refs,
                 ...row.supporting_validation_refs,
                 ...row.supporting_evidence_refs.map((ref) => ref.observation_id),
             ];
-            const limitationRefs = [...row.limitation_refs];
+            // Value-read discharge subtracts ONLY this baseline row's value-dependent limitations
+            // that a validated satisfied discharge targeted; claim/expansion limitations below are
+            // never discharged (they are separate evidence caveats). dischargedForRow counts the
+            // baseline limitations actually cleared — the value_resolved gate (design §13.3).
+            const dischargedLimsForRow = dischargedLimitationsByBaselineRow.get(row.baseline_row_id) ??
+                new Set();
+            const dischargedForRow = row.limitation_refs.filter((ref) => dischargedLimsForRow.has(ref)).length;
+            const limitationRefs = row.limitation_refs.filter((ref) => !dischargedLimsForRow.has(ref));
             if (matchingAnswerClaims.length > 0 && args.maturationAnswerClaimsValidationRef) {
                 supportingRefs.push(args.maturationAnswerClaimsValidationRef);
             }
@@ -519,6 +793,12 @@ export function buildActionabilityMatrixArtifact(args) {
                     supportingRefs.push(ref.observation_id);
                 }
                 limitationRefs.push(...claim.limitation_refs);
+                // Site-7 degrade token: a matching judge-support-shortfall claim leaves a named
+                // residual limitation, so the row reads limitation_backed (not closed) and the
+                // shortfall reaches decision.limitation_refs — the honest-disclosure channel.
+                if (shortfallIds.has(claim.answer_claim_id)) {
+                    limitationRefs.push(judgeSupportShortfallToken(claim.answer_claim_id));
+                }
             }
             for (const expansion of matchingExpansions) {
                 supportingRefs.push(expansion.expansion_id, ...expansion.answer_claim_refs);
@@ -533,16 +813,17 @@ export function buildActionabilityMatrixArtifact(args) {
             if (positiveAnswerClaims.length > 0 && positiveExpansions.length > 0) {
                 maturityLevel = higherMaturityLevel(maturityLevel, "L4_validated_for_purpose");
             }
-            const frontierRequired = matrixRowNeedsFrontier({
+            // Shared derivation (builder ↔ validator). A value_resolved row has residual 0 and
+            // dischargedForRow > 0, so matrixRowNeedsFrontier would return true for it — therefore
+            // blocking_question_refs / next_action below gate on memberReadiness, NOT on a raw
+            // frontierRequired boolean, or the validator's reverse-link check would reject it
+            // (design §13.1 latent-defect fix).
+            const memberReadiness = deriveMemberReadiness({
                 materiality: row.materiality,
-                maturity_level: maturityLevel,
-                limitation_refs: limitationRefs,
+                maturityLevel,
+                residualLimitationRefs: limitationRefs,
+                dischargedForRow,
             });
-            const memberReadiness = limitationRefs.length > 0
-                ? "limitation_backed"
-                : frontierRequired
-                    ? "frontier_required"
-                    : "closed";
             return {
                 matrix_row_id: `matrix-${slug(row.baseline_row_id)}`,
                 baseline_row_refs: [row.baseline_row_id],
@@ -560,13 +841,19 @@ export function buildActionabilityMatrixArtifact(args) {
                 competency_assessment_refs: row.competency_assessment_refs,
                 maturity_level: maturityLevel,
                 supporting_refs: [...new Set(supportingRefs)],
-                blocking_question_refs: [],
+                // Only an open (frontier_required) row is blocked; a closed, value_resolved, or
+                // limitation-backed row carries no open blocking questions.
+                blocking_question_refs: memberReadiness === "frontier_required"
+                    ? [...new Set(blockingQuestionsByBaselineRow.get(row.baseline_row_id) ?? [])]
+                    : [],
                 limitation_refs: [...new Set(limitationRefs)],
-                next_action: frontierRequired
+                next_action: memberReadiness === "frontier_required"
                     ? "Create a maturation frontier question for this row."
                     : memberReadiness === "limitation_backed"
                         ? "Keep the limitation visible in continuation decisions."
-                        : "Preserve the closed row as current actionability support.",
+                        : memberReadiness === "value_resolved"
+                            ? "Preserve the value-read discharge as current actionability support (value-grounded, not L4-validated)."
+                            : "Preserve the closed row as current actionability support.",
             };
         }),
     };
@@ -574,13 +861,43 @@ export function buildActionabilityMatrixArtifact(args) {
 export function validateActionabilityMatrix(args) {
     const matrix = args.actionabilityMatrix;
     const violations = [];
+    const assertedObligationIds = [];
     const baselineRows = new Map(args.maturationBaseline.baseline_rows.map((row) => [row.baseline_row_id, row]));
     const answerClaims = args.maturationAnswerClaimsValidation?.validation_status === "valid"
         ? args.maturationAnswerClaims?.answer_claims ?? []
         : [];
+    const shortfallIds = judgeSupportShortfallIds(args.maturationAnswerClaimsValidation);
     const expansions = args.ontologyExpansionValidation?.validation_status === "valid"
         ? args.ontologyExpansion?.expansions ?? []
         : [];
+    // Maturation value-read cut: rebuild the validated discharge index from the consumed
+    // discharge artifact INDEPENDENTLY (derive-and-assert). The per-row readiness recompute and
+    // the dropped-baseline-limitation check below use this, never the matrix's stamped residual.
+    const dischargedLimitationsByBaselineRow = buildValidatedDischargeIndex(args.maturationValueDischarge, args.maturationValueDischargeValidation);
+    // Reverse-link conservation for blocking_question_refs: when a validated question
+    // frontier is threaded in (the current-matrix recompute), index each question by the
+    // baseline rows it names so the matrix's reverse link can be proven to mirror the
+    // frontier's forward link. Absent/invalid frontier (the baseline matrix) → the rows
+    // must carry no blocking questions yet.
+    const frontierAvailable = args.maturationQuestionFrontierValidation?.validation_status === "valid";
+    // qid -> the baseline rows it names (forward link), and the inverse baseline-row -> qids
+    // so the matrix's reverse link can be proven to be the EXACT set (not merely a subset)
+    // of the frontier questions naming each row.
+    const frontierQuestionBaselineRows = new Map();
+    const frontierQuestionsByBaselineRow = new Map();
+    if (frontierAvailable) {
+        for (const question of args.maturationQuestionFrontier?.questions ?? []) {
+            frontierQuestionBaselineRows.set(question.question_id, new Set(question.baseline_row_refs));
+            for (const baselineRowRef of question.baseline_row_refs) {
+                const bucket = frontierQuestionsByBaselineRow.get(baselineRowRef);
+                if (bucket)
+                    bucket.add(question.question_id);
+                else {
+                    frontierQuestionsByBaselineRow.set(baselineRowRef, new Set([question.question_id]));
+                }
+            }
+        }
+    }
     const seen = new Set();
     if (matrix.session_id !== args.maturationBaseline.session_id) {
         violations.push(violation({
@@ -589,6 +906,21 @@ export function validateActionabilityMatrix(args) {
             subjectId: matrix.session_id,
         }));
     }
+    // Continuation trusts matrix.candidate_limitation_refs to keep an otherwise closed
+    // run at actionable_limited, so the matrix must faithfully carry the validated
+    // baseline's candidate limitations — a stale/edited matrix that drops them would
+    // otherwise let continuation project actionable_ready despite the source limitation.
+    const baselineCandidateLimitations = new Set(args.maturationBaseline.candidate_limitation_refs);
+    const matrixCandidateLimitations = new Set(matrix.candidate_limitation_refs);
+    const candidateLimitationsMatch = baselineCandidateLimitations.size === matrixCandidateLimitations.size &&
+        [...baselineCandidateLimitations].every((ref) => matrixCandidateLimitations.has(ref));
+    if (!candidateLimitationsMatch) {
+        violations.push(violation({
+            code: "conflicting_state",
+            message: "actionability matrix candidate_limitation_refs must match the validated maturation baseline",
+            subjectId: "candidate_limitation_refs",
+        }));
+    }
     if (args.maturationBaselineValidation.validation_status !== "valid") {
         violations.push(violation({
             code: "prior_validation_invalid",
@@ -596,6 +928,132 @@ export function validateActionabilityMatrix(args) {
             subjectId: args.maturationBaselineValidationRef ?? null,
         }));
     }
+    // The question frontier is a PAIR of declared inputs (the artifact and its validation);
+    // they must be supplied together. A half-threaded call (one side only) would silently
+    // fall back to the pre-frontier rules and accept an unlinked current matrix, so fail loud.
+    const frontierProvided = args.maturationQuestionFrontier != null;
+    const frontierValidationProvided = args.maturationQuestionFrontierValidation != null;
+    if (frontierProvided !== frontierValidationProvided) {
+        violations.push(violation({
+            code: "missing_required_ref",
+            message: "actionability matrix question frontier and its validation must be supplied together",
+            subjectId: args.maturationQuestionFrontierValidationRef ??
+                args.actionabilityMatrixRef ?? null,
+        }));
+    }
+    // Current-matrix mode is signalled by post-frontier authority inputs (answer claims and
+    // ontology expansion are authored AFTER the frontier). Whenever any are present, the
+    // frontier pair is required — otherwise a current matrix with frontier_required rows and
+    // empty blocking_question_refs would validate under the pre-frontier (baseline) rules.
+    // Only the true baseline matrix (no post-frontier inputs AND no frontier) may omit it.
+    const postFrontierInputsPresent = args.maturationAnswerClaims != null ||
+        args.maturationAnswerClaimsValidation != null ||
+        args.ontologyExpansion != null ||
+        args.ontologyExpansionValidation != null;
+    if (postFrontierInputsPresent &&
+        !(frontierProvided && frontierValidationProvided)) {
+        violations.push(violation({
+            code: "missing_required_ref",
+            message: "current-matrix actionability validation (carrying answer-claim or expansion inputs) requires the question frontier and its validation",
+            subjectId: args.maturationQuestionFrontierValidationRef ??
+                args.actionabilityMatrixRef ?? null,
+        }));
+    }
+    // A supplied question-frontier validation is a declared input authority: distinguish
+    // "no frontier supplied" (the pre-frontier baseline matrix, legitimately empty) from
+    // "supplied but invalid". The latter must fail rather than silently fall back to the
+    // pre-frontier rules (which would let an empty blocking_question_refs pass even though
+    // the required frontier authority failed validation).
+    if (args.maturationQuestionFrontierValidation &&
+        args.maturationQuestionFrontierValidation.validation_status !== "valid") {
+        violations.push(violation({
+            code: "prior_validation_invalid",
+            message: "actionability matrix requires valid maturation question frontier validation when one is supplied",
+            subjectId: args.maturationQuestionFrontierValidationRef ?? null,
+        }));
+    }
+    // Bind the frontier validation to the frontier artifact it is consumed with: a valid
+    // validation of a DIFFERENT frontier must not bless the supplied (possibly stale/edited)
+    // frontier, whose questions would otherwise satisfy blocking_question_refs unvalidated.
+    if (frontierProvided && frontierAvailable) {
+        const recordedFrontierRef = args.maturationQuestionFrontierValidation?.maturation_question_frontier_ref ?? null;
+        if (recordedFrontierRef !== (args.maturationQuestionFrontierRef ?? null)) {
+            violations.push(violation({
+                code: "conflicting_state",
+                message: "actionability matrix question frontier validation must validate the supplied question frontier",
+                subjectId: args.maturationQuestionFrontierValidationRef ??
+                    args.maturationQuestionFrontierRef ?? null,
+            }));
+        }
+    }
+    // Cross-artifact lineage chain: the consumed validations must form a consistent lineage —
+    // each must have been produced against the upstream validation that is actually supplied
+    // here (baseline-validation <- frontier-validation <- answer-claims-validation <-
+    // ontology-expansion-validation). A valid validation produced against a different upstream
+    // cannot bless this matrix. (Each check is gated on the consumed validation being present &
+    // valid, so the pre-frontier baseline matrix trips none of them. Binding each validation to
+    // its OWN source artifact — beyond the frontier above — is a smaller residual; see the
+    // follow-up note.)
+    for (const lineage of [
+        frontierAvailable
+            ? validationLineageViolation({
+                recordedUpstreamRef: args.maturationQuestionFrontierValidation?.maturation_baseline_validation_ref,
+                suppliedUpstreamRef: args.maturationBaselineValidationRef,
+                message: "actionability matrix question frontier validation must be produced against the supplied maturation baseline validation",
+            })
+            : null,
+        args.maturationAnswerClaimsValidation?.validation_status === "valid"
+            ? validationLineageViolation({
+                recordedUpstreamRef: args.maturationAnswerClaimsValidation.maturation_question_frontier_validation_ref,
+                suppliedUpstreamRef: args.maturationQuestionFrontierValidationRef,
+                message: "actionability matrix answer-claims validation must be produced against the supplied question frontier validation",
+            })
+            : null,
+        args.ontologyExpansionValidation?.validation_status === "valid"
+            ? validationLineageViolation({
+                recordedUpstreamRef: args.ontologyExpansionValidation.maturation_answer_claims_validation_ref,
+                suppliedUpstreamRef: args.maturationAnswerClaimsValidationRef,
+                message: "actionability matrix ontology expansion validation must be produced against the supplied answer-claims validation",
+            })
+            : null,
+    ]) {
+        if (lineage)
+            violations.push(lineage);
+    }
+    // G(a): record reaching the matrix row-id/baseline-ref-close block UNCONDITIONALLY (before
+    // the per-row loop) so the obligation is proven wired even for an empty matrix. One fn serves
+    // two validators; the recorded id attributes to whichever validator this mode is (below).
+    assertObligation(assertedObligationIds, "validate_matrix_row_ids_are_stable_and_baseline_row_refs_close");
+    // G(a) slice 3: mode-ALIGNED recording. This fn serves two validators by mode
+    // (postFrontierInputsPresent → validator_id) and a shared enforcement region satisfies a
+    // DIFFERENTLY-NAMED obligation per mode, so each stamp's obligation_id is mode-conditional and is
+    // emitted ONLY when the mode (and, for the frontier-gated pair, the frontier branch) matches the
+    // registry's validator attribution — never minting a (validator_id, obligation_id) pair the
+    // registry lacks. Each recorded pair was audited to a distinct enforcement region (no laundering);
+    // obligations with no distinct enforcement stay parked with ledger audit notes (the current-mode
+    // expansion-alt is absent, the blocker/high-L4 rule is missing, "support" rules push no violation,
+    // the maturity-level rule is distributed across other regions, the preserve-seed rule is defensive).
+    if (postFrontierInputsPresent) {
+        // CURRENT mode → actionability-matrix-validator.
+        // identity preservation + maturity-upgrade citation region (conflicting_state identity /
+        // missing_required_ref upgrade, below).
+        assertObligation(assertedObligationIds, "validate_matrix_rows_derive_from_validated_baseline_and_any_applicable_validated_deltas");
+        if (frontierAvailable) {
+            // the frontier reverse-link validation (the frontierAvailable `else` branch below).
+            assertObligation(assertedObligationIds, "validate_blocking_question_refs_against_validated_question_frontier");
+        }
+    }
+    else {
+        // BASELINE mode → baseline-actionability-matrix-validator.
+        // strict baseline-row-ref resolution (unknown_id / conflicting_state on baseline_row_refs).
+        assertObligation(assertedObligationIds, "reject_matrix_rows_without_baseline_row_ref");
+        // baseline payload conservation (conflicting_state on identity / maturity-no-reduce).
+        assertObligation(assertedObligationIds, "validate_matrix_rows_derive_from_validated_baseline_without_maturation_deltas");
+        if (!frontierAvailable) {
+            // reject blocking refs before the frontier exists (the `!frontierAvailable` branch below).
+            assertObligation(assertedObligationIds, "reject_blocking_question_refs_before_question_frontier_authoring");
+        }
+    }
     for (const row of matrix.rows) {
         if (seen.has(row.matrix_row_id)) {
             violations.push(violation({
@@ -605,6 +1063,13 @@ export function validateActionabilityMatrix(args) {
             }));
         }
         seen.add(row.matrix_row_id);
+        if (row.baseline_row_refs.length !== 1) {
+            violations.push(violation({
+                code: "conflicting_state",
+                message: "matrix row must reference exactly one baseline row",
+                subjectId: row.matrix_row_id,
+            }));
+        }
         const baselineRef = row.baseline_row_refs[0] ?? null;
         const baselineRow = baselineRef ? baselineRows.get(baselineRef) : null;
         if (!baselineRow) {
@@ -622,6 +1087,31 @@ export function validateActionabilityMatrix(args) {
                 subjectId: row.matrix_row_id,
             }));
         }
+        // M1 payload conservation: a matrix row can cite baseline A while mutating the
+        // identity/lineage fields it must inherit. Assert the baseline-immutable set is
+        // preserved (materiality is checked above; maturity/support/limitation/readiness
+        // legitimately change by validated rules, so are NOT asserted). The builder copies
+        // member-lineage AND competency refs VERBATIM from the baseline row, so they are
+        // compared with exact array equality (multiplicity- and order-sensitive): a
+        // set-only check would let a duplicate-occurrence swap or a competency-ref tamper
+        // pass undetected.
+        const identityPreserved = row.purpose_element_ref === baselineRow.purpose_element_ref &&
+            row.actionability_surface_ref === baselineRow.actionability_surface_ref &&
+            row.maturity_dimension_ref === baselineRow.maturity_dimension_ref &&
+            row.materiality_ref === baselineRow.materiality_ref &&
+            row.member_target_material_kind === baselineRow.member_target_material_kind &&
+            sameRefArray(row.member_scope_refs, baselineRow.member_scope_refs) &&
+            sameRefArray(row.member_source_refs, baselineRow.member_source_refs) &&
+            sameRefArray(row.cross_material_ref_refs, baselineRow.cross_material_ref_refs) &&
+            sameRefArray(row.competency_question_refs, baselineRow.competency_question_refs) &&
+            sameRefArray(row.competency_assessment_refs, baselineRow.competency_assessment_refs);
+        if (!identityPreserved) {
+            violations.push(violation({
+                code: "conflicting_state",
+                message: "matrix row must preserve the baseline row's identity and member-lineage fields",
+                subjectId: row.matrix_row_id,
+            }));
+        }
         if (maturityLevelRank(row.maturity_level) <
             maturityLevelRank(baselineRow.maturity_level)) {
             violations.push(violation({
@@ -631,11 +1121,9 @@ export function validateActionabilityMatrix(args) {
             }));
         }
         const matchingAnswerClaims = answerClaims.filter((claim) => answerClaimMatchesBaselineRow(claim, baselineRow) &&
-            claim.answer_status === "answered" &&
-            claim.limitation_refs.length === 0);
+            positiveAnswerClaim(claim, shortfallIds));
         const matchingExpansions = expansions.filter((expansion) => expansionMatchesBaselineRow(expansion, baselineRow) &&
-            (expansion.operation === "add" || expansion.operation === "refine") &&
-            expansion.limitation_refs.length === 0);
+            positiveExpansion(expansion, shortfallIds));
         if (row.maturity_level !== baselineRow.maturity_level) {
             const claimsCanRaiseToL3 = matchingAnswerClaims.length > 0;
             const claimsCanRaiseToL4 = matchingAnswerClaims.length > 0 && matchingExpansions.length > 0;
@@ -675,18 +1163,157 @@ export function validateActionabilityMatrix(args) {
                 }));
             }
         }
-        const expectedReadiness = row.limitation_refs.length > 0
-            ? "limitation_backed"
-            : matrixRowNeedsFrontier(row)
-                ? "frontier_required"
-                : "closed";
+        // Derive-and-assert (design §13.3 F2): recompute the discharge effect from the
+        // INDEPENDENTLY rebuilt validated discharge index — never trust the matrix's stamped
+        // residual. (a) every baseline limitation the matrix dropped from this row must have
+        // been cleared by a validated satisfied discharge; (b) member_readiness must equal the
+        // shared derivation using the recomputed dischargedForRow, so a forged value_resolved
+        // with no real discharge is rejected (it falls through to frontier_required/closed). The
+        // residual LENGTH still reads the stamped row.limitation_refs (claim/expansion caveats are
+        // trusted as before), but a forged shrink is caught by (a).
+        const dischargedLimsForRow = dischargedLimitationsByBaselineRow.get(baselineRow.baseline_row_id) ??
+            new Set();
+        const stampedLimitationRefs = new Set(row.limitation_refs);
+        for (const baselineLim of baselineRow.limitation_refs) {
+            if (!stampedLimitationRefs.has(baselineLim) &&
+                !dischargedLimsForRow.has(baselineLim)) {
+                violations.push(violation({
+                    code: "conflicting_state",
+                    message: "matrix row dropped a baseline limitation without a validated satisfied value-discharge",
+                    subjectId: row.matrix_row_id,
+                }));
+            }
+        }
+        // Site-7 token conservation (design 20260706 §5): stamped claim/expansion caveats are
+        // otherwise trusted, so a stale/edited matrix could silently DROP the judge-support-
+        // shortfall token and un-exclude the row. Re-derive the expected tokens from the claims
+        // + validation authority and require each on the stamped row (mirror of the dropped-
+        // baseline-limitation check above).
+        for (const claim of answerClaims) {
+            if (!shortfallIds.has(claim.answer_claim_id))
+                continue;
+            if (!answerClaimMatchesBaselineRow(claim, baselineRow))
+                continue;
+            if (!stampedLimitationRefs.has(judgeSupportShortfallToken(claim.answer_claim_id))) {
+                violations.push(violation({
+                    code: "conflicting_state",
+                    message: "matrix row dropped the judge-support-shortfall limitation token for a matching degraded claim",
+                    subjectId: row.matrix_row_id,
+                }));
+            }
+        }
+        const dischargedForRow = baselineRow.limitation_refs.filter((ref) => dischargedLimsForRow.has(ref)).length;
+        const expectedReadiness = deriveMemberReadiness({
+            materiality: row.materiality,
+            maturityLevel: row.maturity_level,
+            residualLimitationRefs: row.limitation_refs,
+            dischargedForRow,
+        });
         if (row.member_readiness !== expectedReadiness) {
             violations.push(violation({
                 code: "conflicting_state",
-                message: "matrix member_readiness must follow material L4, frontier, or limitation state",
+                message: "matrix member_readiness must follow material L4, frontier, value-discharge, or limitation state",
                 subjectId: row.matrix_row_id,
             }));
         }
+        // blocking_question_refs reverse-link conservation (G track):
+        // before the frontier exists (baseline matrix) the row must cite no questions;
+        // once the validated frontier exists (current matrix) an open frontier_required row
+        // must cite its blocking question(s), a closed/limitation-backed row must cite none,
+        // and every cited ref must resolve to a frontier question that names this row.
+        if (!frontierAvailable) {
+            if (row.blocking_question_refs.length > 0) {
+                violations.push(violation({
+                    code: "conflicting_state",
+                    message: "matrix row cannot cite blocking questions before the question frontier exists",
+                    subjectId: row.matrix_row_id,
+                }));
+            }
+        }
+        else {
+            const rowIsFrontier = row.member_readiness === "frontier_required";
+            const citedQuestions = new Set(row.blocking_question_refs);
+            if (rowIsFrontier) {
+                // Exact reverse link: an open row must cite EVERY validated frontier question that
+                // names it, not merely one of them — otherwise a stale/edited matrix could drop one
+                // of several questions for a row and still hide an open blocking question.
+                const expectedQuestions = new Set();
+                for (const baselineRowRef of row.baseline_row_refs) {
+                    for (const questionId of frontierQuestionsByBaselineRow.get(baselineRowRef) ??
+                        []) {
+                        expectedQuestions.add(questionId);
+                    }
+                }
+                // The supplied frontier must actually name this open material row. An empty
+                // expected set means a stale/edited/mismatched frontier (e.g. a valid validation
+                // paired with a different frontier artifact) — without this guard the coverage
+                // loop below would be vacuous and an unresolved row would validate with empty refs.
+                if (expectedQuestions.size === 0) {
+                    violations.push(violation({
+                        code: "missing_required_coverage",
+                        message: "frontier-required matrix row has no matching question in the supplied frontier",
+                        subjectId: row.matrix_row_id,
+                    }));
+                }
+                for (const expectedQuestionId of expectedQuestions) {
+                    if (!citedQuestions.has(expectedQuestionId)) {
+                        violations.push(violation({
+                            code: "missing_required_coverage",
+                            message: "frontier-required matrix row must cite every blocking maturation question that names it",
+                            subjectId: row.matrix_row_id,
+                        }));
+                    }
+                }
+            }
+            if (!rowIsFrontier && row.blocking_question_refs.length > 0) {
+                violations.push(violation({
+                    code: "conflicting_state",
+                    message: "closed or limitation-backed matrix row cannot cite open blocking questions",
+                    subjectId: row.matrix_row_id,
+                }));
+            }
+            for (const questionRef of row.blocking_question_refs) {
+                const questionBaselineRows = frontierQuestionBaselineRows.get(questionRef);
+                if (!questionBaselineRows) {
+                    violations.push(violation({
+                        code: "unknown_id",
+                        message: "matrix blocking_question_refs must resolve to the validated question frontier",
+                        subjectId: questionRef,
+                    }));
+                    continue;
+                }
+                const namesRow = row.baseline_row_refs.some((ref) => questionBaselineRows.has(ref));
+                if (!namesRow) {
+                    violations.push(violation({
+                        code: "conflicting_state",
+                        message: "matrix blocking question must name this row's baseline ref (reverse link must mirror the frontier)",
+                        subjectId: row.matrix_row_id,
+                    }));
+                }
+            }
+        }
+    }
+    // M1 coverage conservation: every baseline row must map to exactly one matrix row.
+    // The loop above only checks that PRESENT matrix rows resolve to a baseline row, so a
+    // matrix that DROPS a baseline row (erasing its scope from the downstream claim) would
+    // otherwise pass silently.
+    const matrixCoverageCounts = new Map();
+    for (const row of matrix.rows) {
+        for (const ref of row.baseline_row_refs) {
+            matrixCoverageCounts.set(ref, (matrixCoverageCounts.get(ref) ?? 0) + 1);
+        }
+    }
+    for (const baselineRowId of baselineRows.keys()) {
+        const count = matrixCoverageCounts.get(baselineRowId) ?? 0;
+        if (count !== 1) {
+            violations.push(violation({
+                code: count === 0 ? "missing_required_coverage" : "conflicting_state",
+                message: count === 0
+                    ? `baseline row has no actionability matrix row: ${baselineRowId}`
+                    : `baseline row is covered by multiple matrix rows: ${baselineRowId}`,
+                subjectId: baselineRowId,
+            }));
+        }
     }
     return {
         schema_version: "1",
@@ -696,18 +1323,26 @@ export function validateActionabilityMatrix(args) {
         maturation_baseline_validation_ref: args.maturationBaselineValidationRef ?? null,
         maturation_answer_claims_validation_ref: args.maturationAnswerClaimsValidationRef ?? null,
         ontology_expansion_validation_ref: args.ontologyExpansionValidationRef ?? null,
+        maturation_question_frontier_validation_ref: args.maturationQuestionFrontierValidationRef ?? null,
         validation_status: violations.length === 0 ? "valid" : "invalid",
         matrix_row_count: matrix.rows.length,
         frontier_required_row_count: matrix.rows.filter((row) => row.member_readiness === "frontier_required").length,
         validation_results: violations.length === 0
             ? ["actionability_matrix_valid"]
             : ["actionability_matrix_invalid"],
+        // G(a) attribution: the mode (computed above as postFrontierInputsPresent) selects which of
+        // the two validators served by this fn owns the recorded obligation pair.
+        validator_id: postFrontierInputsPresent
+            ? "actionability-matrix-validator"
+            : "baseline-actionability-matrix-validator",
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
 export function validateMaturationQuestionFrontier(args) {
     const frontier = args.maturationQuestionFrontier;
     const violations = [];
+    const assertedObligationIds = [];
     const baselineRows = new Map(args.maturationBaseline.baseline_rows.map((row) => [row.baseline_row_id, row]));
     const materialFrontierBaselineRows = new Set(args.actionabilityMatrix.rows
         .filter((row) => row.member_readiness === "frontier_required")
@@ -735,6 +1370,13 @@ export function validateMaturationQuestionFrontier(args) {
             subjectId: args.actionabilityMatrixValidationRef ?? null,
         }));
     }
+    // G(a) slice 6: record the two question-frontier obligations with a distinct, audited enforcement
+    // region, before the per-question loop so they fire on a zero-question frontier. The other four
+    // obligations stay parked with ledger audit notes — authority-need first-class scoping and the
+    // competency/domain-trace refs are NOT validated here (NOT_FOUND), and the answer_status enum and
+    // the seed+limitation authority clauses are unenforced (the obligation names are broader than code).
+    assertObligation(assertedObligationIds, "require_blocker_and_high_questions_to_have_closure_frontier_limitation_or_authority_need");
+    assertObligation(assertedObligationIds, "require_unique_question_id");
     for (const question of frontier.questions) {
         if (seen.has(question.question_id)) {
             violations.push(violation({
@@ -812,6 +1454,7 @@ export function validateMaturationQuestionFrontier(args) {
         validation_results: violations.length === 0
             ? ["maturation_question_frontier_valid"]
             : ["maturation_question_frontier_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
@@ -849,6 +1492,19 @@ function questionMap(frontier) {
 export function validateMaturationClosureFrontier(args) {
     const frontier = args.maturationClosureFrontier;
     const violations = [];
+    // G(a) slice 25 — RECORD only the 3 obligations that fully enforce their named scope with no
+    // runtime/registry/edge gaps (codex R1 found this validator is NOT cleanly structural — 7 obligations
+    // have deeper gaps, see obligation-coverage-ledger.yaml notes): #2 dup-source only de-dupes the id, not
+    // same-target-ref duplicates (runtime re-entry throws); #4 accepts exists:false/skipped inventory rows
+    // (runtime buildReconstructSourceObservation returns null); #10 mixed-lineage never fires (source
+    // requests carry concrete per-ref kinds, never "mixed"); #1 authority-dedup keys on the whole
+    // question_refs set, missing per-question overlap; #8/#9 don't reject empty question_refs; and #6/#8/#9
+    // read the maturation-question-frontier ARTIFACT which the registry does not declare as an input
+    // authority (declared≠wired, slice-14 pattern). Stamped before any per-request guard (zero-row input).
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "reject_semantic_only_locations");
+    assertObligation(assertedObligationIds, "require_unique_authority_request_id");
+    assertObligation(assertedObligationIds, "validate_authority_request_kind_expected_response_kind_and_scope");
     const materialQuestions = materialQuestionIds(args.maturationQuestionFrontier);
     const questions = questionMap(args.maturationQuestionFrontier);
     const sourceRequestsSeen = new Set();
@@ -1053,6 +1709,7 @@ export function validateMaturationClosureFrontier(args) {
         validation_results: violations.length === 0
             ? ["maturation_closure_frontier_valid"]
             : ["maturation_closure_frontier_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
@@ -1171,12 +1828,239 @@ export function validateMaturationAuthorityResponse(args) {
         violations,
     };
 }
+// Maturation value-read cut (design §13.5 F4/F5). Governance + structural validator for the
+// value-discharge artifact. Mirrors the answer-support source-safety precondition gate and the
+// per-evidence consumption_allowed check, and adds the F4 read-path constraint: value evidence
+// may come ONLY from an already-observed, runtime-target (basis A) source — reading a non-target
+// source would leak its raw values into the discharge prompt. Structural: each discharge may only
+// target a limitation that actually exists on its baseline row. The matrix derive-and-assert
+// consumes ONLY discharges whose validation here is `valid`.
+export function validateMaturationValueDischarge(args) {
+    const discharge = args.maturationValueDischarge;
+    const violations = [];
+    const baselineRows = new Map(args.maturationBaseline.baseline_rows.map((row) => [row.baseline_row_id, row]));
+    const sourceObservationsById = new Map(args.sourceObservations.observations.map((o) => [o.observation_id, o]));
+    const safetyRowsById = new Map((args.sourceSafetyLedger?.safety_rows ?? []).map((r) => [r.safety_row_id, r]));
+    if (discharge.session_id !== args.maturationBaseline.session_id) {
+        violations.push(violation({
+            code: "session_id_mismatch",
+            message: "value discharge session_id must match maturation baseline",
+            subjectId: discharge.session_id,
+        }));
+    }
+    if (args.maturationBaselineValidation.validation_status !== "valid") {
+        violations.push(violation({
+            code: "prior_validation_invalid",
+            message: "value discharge requires valid maturation baseline validation",
+            subjectId: args.maturationBaselineValidationRef ?? null,
+        }));
+    }
+    const hasDischarges = discharge.discharges.length > 0;
+    // Source-safety precondition (replicates the answer-support gate, F5): discharges make
+    // material claims, so the safety ledger and its valid validation must be supplied and
+    // certify the consumed ledger before the per-evidence consumption checks run.
+    if (hasDischarges && !args.sourceSafetyLedger) {
+        violations.push(violation({
+            code: "missing_required_ref",
+            message: "value discharge requires the source safety ledger",
+            subjectId: args.sourceSafetyLedgerRef ?? null,
+        }));
+    }
+    if (hasDischarges && !args.sourceSafetyLedgerValidation) {
+        violations.push(violation({
+            code: "prior_validation_invalid",
+            message: "value discharge requires source safety ledger validation",
+            subjectId: args.sourceSafetyLedgerValidationRef ?? null,
+        }));
+    }
+    if (args.sourceSafetyLedgerValidation &&
+        args.sourceSafetyLedgerValidation.validation_status !== "valid") {
+        violations.push(violation({
+            code: "prior_validation_invalid",
+            message: "value discharge requires valid source safety ledger validation",
+            subjectId: args.sourceSafetyLedgerValidationRef ?? null,
+        }));
+    }
+    if (args.sourceSafetyLedger &&
+        args.sourceSafetyLedgerValidation &&
+        args.sourceSafetyLedgerValidationRef &&
+        args.sourceSafetyLedgerValidation.source_safety_ledger_ref &&
+        path.resolve(args.sourceSafetyLedgerValidation.source_safety_ledger_ref) !==
+            path.resolve(args.sourceSafetyLedgerRef ?? "")) {
+        violations.push(violation({
+            code: "prior_validation_invalid",
+            message: "value discharge source safety ledger validation must certify the consumed source safety ledger",
+            subjectId: args.sourceSafetyLedgerValidationRef ?? null,
+        }));
+    }
+    const seen = new Set();
+    let satisfiedCount = 0;
+    for (const entry of discharge.discharges) {
+        if (seen.has(entry.discharge_id)) {
+            violations.push(violation({
+                code: "duplicate_id",
+                message: "value discharge entries require a unique discharge_id",
+                subjectId: entry.discharge_id,
+            }));
+        }
+        seen.add(entry.discharge_id);
+        if (entry.satisfaction_status === "satisfied")
+            satisfiedCount += 1;
+        // Structural: each targeted limitation must actually exist on the targeted baseline row —
+        // a discharge cannot subtract a phantom limitation (matrix derive-and-assert depends on this).
+        for (const baselineRowRef of entry.target_baseline_row_refs) {
+            const baselineRow = baselineRows.get(baselineRowRef);
+            if (!baselineRow) {
+                violations.push(violation({
+                    code: "unknown_id",
+                    message: "value discharge target_baseline_row_refs must resolve to maturation baseline rows",
+                    subjectId: baselineRowRef,
+                }));
+                continue;
+            }
+            const baselineLimitations = new Set(baselineRow.limitation_refs);
+            for (const limitationRef of entry.target_limitation_refs) {
+                if (!baselineLimitations.has(limitationRef)) {
+                    violations.push(violation({
+                        code: "missing_required_ref",
+                        message: "value discharge target_limitation_refs must exist on the targeted baseline row's limitation_refs",
+                        subjectId: `${baselineRowRef}:${limitationRef}`,
+                    }));
+                }
+            }
+        }
+        // Governance (F4/F5): the value evidence must come from an ALREADY-OBSERVED, runtime-target
+        // (basis A) source whose material_claim safety row is consumption_allowed. A non-target
+        // source is rejected outright — reading it would leak its raw values into the prompt.
+        const observationId = entry.value_evidence_ref.observation_id;
+        const observation = sourceObservationsById.get(observationId);
+        if (!observation) {
+            violations.push(violation({
+                code: "unknown_id",
+                message: "value discharge value_evidence_ref.observation_id must resolve to an already-observed source",
+                subjectId: observationId,
+            }));
+            continue;
+        }
+        if (observation.is_runtime_target_source !== true) {
+            violations.push(violation({
+                code: "conflicting_state",
+                message: "value discharge may read only runtime-target sources (basis A); a non-target source cannot be read",
+                subjectId: observationId,
+            }));
+        }
+        const expectedAuthorizationRef = `${observationId}:material_claim`;
+        if (entry.value_evidence_authorization_ref !== expectedAuthorizationRef) {
+            violations.push(violation({
+                code: "conflicting_state",
+                message: "value discharge value_evidence_authorization_ref must be the canonical <observation_id>:material_claim ref",
+                subjectId: entry.value_evidence_authorization_ref,
+            }));
+        }
+        if (args.sourceSafetyLedger) {
+            const materialClaimRowId = sourceSafetyRowIdForObservation(observation, "material_claim");
+            const materialClaimRow = safetyRowsById.get(materialClaimRowId);
+            if (!materialClaimRow ||
+                materialClaimRow.proof_sufficiency_state !== "sufficient_for_claim" ||
+                materialClaimRow.visibility_tier !== "consumption_allowed") {
+                violations.push(violation({
+                    code: "missing_required_ref",
+                    message: "value discharge evidence must have an observation-specific material_claim source-safety row that is consumption_allowed and sufficient for claim",
+                    subjectId: observationId,
+                }));
+            }
+        }
+        // Provenance floor (design §15.4): a `satisfied` discharge must rest on a REAL, COMPLETE,
+        // content-bound read — otherwise it cannot drive value_resolved. A 0-cell read (dead/empty), a
+        // truncated read (partial view), or a content-hash mismatch vs the authorized observation's
+        // observed bytes (file changed between observation and the re-read) → reject. This makes
+        // cells_read / read_truncated / read_content_sha256 REAL consumers, not inert provenance
+        // (FRP-1 / issue-008 / GL-1). refuted/inconclusive discharges never subtract, so they are exempt.
+        if (entry.satisfaction_status === "satisfied") {
+            const evidence = entry.value_evidence_ref;
+            if (evidence.cells_read <= 0) {
+                violations.push(violation({
+                    code: "conflicting_state",
+                    message: "a satisfied value discharge must be backed by a non-empty cell read (cells_read > 0)",
+                    subjectId: entry.discharge_id,
+                }));
+            }
+            if (evidence.read_truncated) {
+                violations.push(violation({
+                    code: "conflicting_state",
+                    message: "a satisfied value discharge cannot rest on a truncated (incomplete) cell read",
+                    subjectId: entry.discharge_id,
+                }));
+            }
+            const observedContentSha256 = observation.structural_data
+                ?.workbook_inventory?.content_sha256;
+            // Fail-closed (design §16.2, onto issue-013): a satisfied discharge must be content-bound to the
+            // authorized observation's observed bytes. If the observation carries NO observed content hash to
+            // bind against, the binding cannot be proven → reject rather than silently skip the check.
+            if (typeof observedContentSha256 !== "string" || observedContentSha256.length === 0) {
+                violations.push(violation({
+                    code: "conflicting_state",
+                    message: "a satisfied value discharge requires the authorized observation to carry an observed content_sha256 to content-bind against",
+                    subjectId: entry.discharge_id,
+                }));
+            }
+            else if (evidence.read_content_sha256 !== observedContentSha256) {
+                violations.push(violation({
+                    code: "conflicting_state",
+                    message: "value discharge read_content_sha256 must match the authorized observation's observed content_sha256 (the source changed between observation and the maturation re-read)",
+                    subjectId: entry.discharge_id,
+                }));
+            }
+        }
+    }
+    return {
+        schema_version: "1",
+        session_id: discharge.session_id,
+        created_at: isoNow(),
+        maturation_value_discharge_ref: args.maturationValueDischargeRef ?? null,
+        source_safety_ledger_validation_ref: args.sourceSafetyLedgerValidationRef ?? null,
+        source_observation_reentry_validation_ref: null,
+        maturation_baseline_validation_ref: args.maturationBaselineValidationRef ?? null,
+        validation_status: violations.length === 0 ? "valid" : "invalid",
+        discharge_count: discharge.discharges.length,
+        satisfied_discharge_count: satisfiedCount,
+        validation_results: violations.length === 0
+            ? ["maturation_value_discharge_valid"]
+            : ["maturation_value_discharge_invalid"],
+        asserted_obligation_ids: [],
+        violations,
+    };
+}
 export function validateAnswerSupportLedger(args) {
     const ledger = args.answerSupportLedger;
     const violations = [];
+    // G(a) slice 21 — record the obligations this validator genuinely enforces (RECORD 4/9). The
+    // other 5 stay parked (see obligation-coverage-ledger.yaml notes): contradictions-bounded is
+    // enforced by validateMaturationAnswerClaims (DELEGATED); the frontier→valid-lineage-index-
+    // validation check is an unscoped global precondition (PARTIAL); the external/runtime + generic
+    // support-mode-required-refs obligations have no distinct, non-overlapping enforcement here; and
+    // user_confirmation is presence-only (it never resolves user_confirmation_refs to the confirmation
+    // authority — an arbitrary ref passes whenever a valid purpose-confirmation exists; PARTIAL, codex
+    // R1). Stamped before any per-cluster guard so the recorder fires on zero-row input.
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "validate_evidence_cluster_question_refs");
+    assertObligation(assertedObligationIds, "require_two_independent_evidence_refs_for_convergent_source_evidence_unless_direct_authority");
+    assertObligation(assertedObligationIds, "require_frontier_triggered_evidence_to_resolve_to_valid_reentry_validation");
+    assertObligation(assertedObligationIds, "require_observation_specific_evidence_support_source_safety_row_with_claim_sufficiency_and_replay");
     const questions = questionMap(args.maturationQuestionFrontier);
     const evidenceIndex = evidenceRefIndex(args.sourceObservations);
     const lineageObservationIds = new Set(args.sourceObservationLineageIndex?.lineage_rows.flatMap((row) => row.added_observation_ids) ?? []);
+    // Index added_observation_id -> first lineage row, mirroring the `.find`
+    // (first-match) semantics so per-ref lookups are O(1) instead of a nested
+    // linear scan over every lineage row.
+    const lineageRowByObservationId = new Map();
+    for (const row of args.sourceObservationLineageIndex?.lineage_rows ?? []) {
+        for (const observationId of row.added_observation_ids) {
+            if (!lineageRowByObservationId.has(observationId)) {
+                lineageRowByObservationId.set(observationId, row);
+            }
+        }
+    }
     const reentryValidationsByRef = new Map((args.sourceObservationReentryValidations ?? []).map((item) => [
         item.ref,
         item.validation,
@@ -1414,10 +2298,19 @@ export function validateAnswerSupportLedger(args) {
                 }));
             }
             const observation = sourceObservationsById.get(ref.observation_id);
-            const lineageRow = args.sourceObservationLineageIndex?.lineage_rows.find((row) => row.added_observation_ids.includes(ref.observation_id)) ?? null;
-            const refCarriesLineage = Boolean(observation?.round_id ||
-                observation?.observation_batch_id ||
-                observation?.triggering_frontier_validation_ref);
+            const lineageRow = lineageRowByObservationId.get(ref.observation_id) ??
+                null;
+            // Defect-3 G1: a per-ref lineage-index row only exists for genuine frontier
+            // RE-ENTRY observations, which the producer stamps with a
+            // triggering_frontier_validation_ref. The INITIAL observation carries the
+            // sentinel round_id "initial_source_frontier" and an "...:initial" batch id
+            // but is NOT a re-entry and never appears in the lineage index, so keying
+            // this per-ref resolution on round_id/observation_batch_id over-fired on
+            // every single-source run. triggering_frontier_validation_ref is the
+            // canonical lineage-bearing marker (set at run.ts re-observation callers).
+            // The broader index-PRESENCE predicate sourceBackedEvidenceCarriesLineage
+            // (above) is intentionally LEFT BROAD — do not narrow it here.
+            const refCarriesLineage = Boolean(observation?.triggering_frontier_validation_ref);
             if (refCarriesLineage &&
                 args.sourceObservationLineageIndex &&
                 !lineageRow) {
@@ -1484,8 +2377,7 @@ export function validateAnswerSupportLedger(args) {
                 }
                 if (!observation ||
                     !publicOutputRow ||
-                    (publicOutputRow.visibility_tier !== "consumption_allowed" &&
-                        publicOutputRow.visibility_tier !== "redacted_output_only")) {
+                    publicOutputRow.visibility_tier !== "consumption_allowed") {
                     violations.push(violation({
                         code: "missing_required_ref",
                         message: "answer support evidence used in public output must have an observation-specific public_output source-safety row",
@@ -1572,17 +2464,37 @@ export function validateAnswerSupportLedger(args) {
         validation_results: violations.length === 0
             ? ["answer_support_ledger_valid"]
             : ["answer_support_ledger_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
 export function validateMaturationAnswerClaims(args) {
     const artifact = args.maturationAnswerClaims;
     const violations = [];
+    const assertedObligationIds = [];
+    const judgeSupportShortfallClaimIds = new Set();
     const questions = questionMap(args.maturationQuestionFrontier);
     const clusters = new Map(args.answerSupportLedger.evidence_clusters.map((cluster) => [
         cluster.evidence_cluster_id,
         cluster,
     ]));
+    // B-6 judge gate. judgeActive = orchestrator supplied a non-null judgment whose
+    // validation is valid. judgeSupported keys a confirmed support by IDENTITY
+    // (`${evidence_cluster_ref}#${evidenceRefKey}`) so the per-claim sufficiency
+    // count below can re-key it by INDEPENDENCE. With the judge gate active (R4) a
+    // convergent_source_evidence claim is FAIL-CLOSED on judgeActive: an
+    // absent/invalid judgment makes such a claim invalid (see the per-claim branch).
+    // Non-convergent claims are unaffected.
+    const judgeActive = Boolean(args.answerSupportJudgment) &&
+        args.answerSupportJudgmentValidation?.validation_status === "valid";
+    const judgeSupported = new Set();
+    if (judgeActive && args.answerSupportJudgment) {
+        for (const judgment of args.answerSupportJudgment.judgments) {
+            if (judgment.supports === "supported") {
+                judgeSupported.add(`${judgment.evidence_cluster_ref}#${evidenceRefKey(judgment.evidence_ref)}`);
+            }
+        }
+    }
     const seen = new Set();
     const answeredQuestions = new Set();
     if (artifact.session_id !== args.maturationQuestionFrontier.session_id) {
@@ -1606,6 +2518,15 @@ export function validateMaturationAnswerClaims(args) {
             subjectId: args.maturationQuestionFrontierValidationRef ?? null,
         }));
     }
+    // G(a) slice 4: record the two answer-claims obligations with a distinct, audited enforcement region,
+    // UNCONDITIONALLY before the per-claim loop so they are proven wired even on a zero-claim input. The
+    // judge pair is the live-enforced #57/#58 gate (insufficient_independent_evidence / fail-closed
+    // prior_validation_invalid in the convergent-source block below) — recording it here closes its
+    // enforced_pending_instrumentation tier. The other three obligations stay parked with ledger audit
+    // notes (the "OR frontier"/"OR authority" alternatives are unimplemented; dimension/purpose refs are
+    // presence-checked, not resolved against the question), rather than being laundered into recorded.
+    assertObligation(assertedObligationIds, "require_convergent_source_evidence_claims_to_have_two_independent_judge_confirmed_supports");
+    assertObligation(assertedObligationIds, "validate_answer_claim_question_refs");
     for (const claim of artifact.answer_claims) {
         if (seen.has(claim.answer_claim_id)) {
             violations.push(violation({
@@ -1677,6 +2598,73 @@ export function validateMaturationAnswerClaims(args) {
                 }));
             }
         }
+        // B-6 sufficiency (composes with the contradiction-bounded check above; a
+        // convergent claim must pass BOTH). Count INDEPENDENT judge-confirmed
+        // supports across all cited clusters: IDENTITY key joins to the judge
+        // verdict, INDEPENDENCE key (source_ref:location, byte-identical to the
+        // ledger envelope) is counted so same-source refs collapse to one.
+        if (claim.support_mode === "convergent_source_evidence") {
+            if (!judgeActive) {
+                // Fail-closed: the answer-support judge gate is active (R4), so a
+                // convergent-source claim REQUIRES a valid judgment. judgeActive is
+                // false exactly when the judgment artifact is absent or its validation
+                // is not valid — either way the convergent claim cannot be trusted.
+                violations.push(violation({
+                    code: "prior_validation_invalid",
+                    message: "convergent source evidence claim requires a valid answer-support judgment",
+                    subjectId: claim.answer_claim_id,
+                }));
+            }
+            else {
+                // Count the claim's OWN supporting_evidence_refs that are judge-confirmed
+                // in one of its cited clusters, not every ref in those clusters. Downstream
+                // (claim projection, ontology expansion) consumes supporting_evidence_refs,
+                // so sufficiency must be carried by the evidence the claim actually cites.
+                const independentConfirmed = new Set();
+                for (const ref of claim.supporting_evidence_refs) {
+                    const judgeConfirmed = claim.evidence_cluster_refs.some((clusterRef) => judgeSupported.has(`${clusterRef}#${evidenceRefKey(ref)}`));
+                    if (judgeConfirmed) {
+                        independentConfirmed.add(`${normalizedPathRef(ref.source_ref)}:${normalizedPathRef(ref.location)}`);
+                    }
+                }
+                if (independentConfirmed.size < 2) {
+                    // Site-7 proportional terminal (design 20260706 §4.1): split the shortfall
+                    // disposition by a QUESTION-scoped pool computed directly from the judgment
+                    // artifact's supported verdicts (never joined through the claim's own refs, so
+                    // a future ref-serialization divergence cannot mass-degrade):
+                    //   - pool >= 2 → the question COULD be certified; the author under-cited refs
+                    //     or clusters → violation stays (bug catcher, crash).
+                    //   - pool < 2 AND the judge supported >= 1 ref somewhere in the run (functioned
+                    //     contrast control) → the source cannot certify this question → degrade:
+                    //     recorded in judge_support_shortfall_claim_ids, the artifact stays valid,
+                    //     and the actionability matrix blocks certification downstream.
+                    //   - pool < 2 AND the judge supported NOTHING run-wide → indistinguishable from
+                    //     judge dysfunction (an all-not_supported judgment is schema-valid), so the
+                    //     loud violation is kept.
+                    const questionClusterIds = new Set(args.answerSupportLedger.evidence_clusters
+                        .filter((cluster) => cluster.support_mode === "convergent_source_evidence" &&
+                        cluster.question_refs.includes(claim.question_id))
+                        .map((cluster) => cluster.evidence_cluster_id));
+                    const questionPoolIndependent = new Set();
+                    for (const judgment of args.answerSupportJudgment?.judgments ?? []) {
+                        if (judgment.supports === "supported" &&
+                            questionClusterIds.has(judgment.evidence_cluster_ref)) {
+                            questionPoolIndependent.add(`${normalizedPathRef(judgment.evidence_ref.source_ref)}:${normalizedPathRef(judgment.evidence_ref.location)}`);
+                        }
+                    }
+                    if (questionPoolIndependent.size < 2 && judgeSupported.size > 0) {
+                        judgeSupportShortfallClaimIds.add(claim.answer_claim_id);
+                    }
+                    else {
+                        violations.push(violation({
+                            code: "insufficient_independent_evidence",
+                            message: "convergent answer claim requires at least two independent judge-confirmed supports",
+                            subjectId: claim.answer_claim_id,
+                        }));
+                    }
+                }
+            }
+        }
         if (claim.evidence_cluster_refs.length === 0) {
             violations.push(violation({
                 code: "support_mode_missing_authority",
@@ -1698,13 +2686,16 @@ export function validateMaturationAnswerClaims(args) {
         created_at: isoNow(),
         maturation_answer_claims_ref: args.maturationAnswerClaimsRef ?? null,
         answer_support_ledger_validation_ref: args.answerSupportLedgerValidationRef ?? null,
+        answer_support_judgment_validation_ref: args.answerSupportJudgmentValidationRef ?? null,
         maturation_question_frontier_validation_ref: args.maturationQuestionFrontierValidationRef ?? null,
         validation_status: violations.length === 0 ? "valid" : "invalid",
         answer_claim_count: artifact.answer_claims.length,
         answered_question_count: answeredQuestions.size,
+        judge_support_shortfall_claim_ids: [...judgeSupportShortfallClaimIds].sort(),
         validation_results: violations.length === 0
             ? ["maturation_answer_claims_valid"]
             : ["maturation_answer_claims_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
@@ -1722,6 +2713,25 @@ export function validateOntologyExpansion(args) {
         defer: 0,
         reject: 0,
     };
+    // G(a) slice 9: record the two obligations whose enforcement matches the authoritative contract
+    // (ontology-seeding-and-maturation-design.md §"ontology-expansion-validation.yaml must enforce"),
+    // before the per-expansion loop so they fire on a zero-expansion artifact:
+    //   - validate_expansion_answer_claim_refs — every answer_claim_refs[] item resolves to a valid
+    //     answer claim (unknown_id) and add/refine cites ≥1 (missing_required_ref).
+    //   - require_concept_economy_rationale_when_surface_increases — the contract scopes this to
+    //     `operation: add` with `increases_surface`, which the per-expansion check enforces exactly
+    //     (missing_required_ref when rationale.trim().length < 24). A refine row that sets
+    //     increases_surface is OUT of the contract clause, not an enforcement gap.
+    // PARKED (not recorded): prevent_in_place_seed_authority_rewrite — the contract clause is unscoped
+    // ("no expansion rewrites seed authority in place") but the check only rejects refs whose
+    // path.basename(ref) === "ontology-seed.yaml", so an LLM-authored anchored ref (e.g.
+    // "ontology-seed.yaml#semantic_layer/object-new") bypasses it; narrower than the contract.
+    // Also parked: the evidence-refs obligation — evidence_refs are resolved against the cited answer
+    // claims' carried supporting_evidence_refs (a proxy), not the answer-support-ledger/seed authority
+    // the name names. See obligation-coverage-ledger.yaml notes. No laundering.
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "validate_expansion_answer_claim_refs");
+    assertObligation(assertedObligationIds, "require_concept_economy_rationale_when_surface_increases");
     if (artifact.session_id !== args.maturationAnswerClaims.session_id) {
         violations.push(violation({
             code: "session_id_mismatch",
@@ -1826,6 +2836,7 @@ export function validateOntologyExpansion(args) {
         validation_results: violations.length === 0
             ? ["ontology_expansion_valid"]
             : ["ontology_expansion_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
@@ -2035,6 +3046,14 @@ export function validateMaturationConvergenceLedger(args) {
     const answerClaimIds = new Set(args.maturationAnswerClaims.answer_claims.map((claim) => claim.answer_claim_id));
     const answerSupportIds = new Set(args.answerSupportLedger.evidence_clusters.map((cluster) => cluster.evidence_cluster_id));
     const expansionIds = new Set(args.ontologyExpansion.expansions.map((expansion) => expansion.expansion_id));
+    // G(a) obligation recorder (INV-OBLIGATION-COVERAGE-1). Only the closure-row delta-ref match is a
+    // clean, fully-proving structural enforcer; it is stamped before the round loop so it records on
+    // zero-round input too (vacuously true when no closure rows exist, like the slice-2/15 row checks).
+    // The other six convergence obligations are parked with audit notes — see obligation-coverage-ledger.yaml
+    // (ready-projection gate deferred per contract h; positive-support exclusion / disposition-value /
+    // carried-forward-or-blocked-with-refs / source-delta validation-status all under-enforced).
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "validate_closure_source_observation_delta_refs_match_source_observation_delta_validation");
     if (ledger.session_id !== args.maturationQuestionFrontier.session_id) {
         violations.push(violation({
             code: "session_id_mismatch",
@@ -2376,18 +3395,15 @@ export function validateMaturationConvergenceLedger(args) {
         validation_results: violations.length === 0
             ? ["maturation_convergence_ledger_valid"]
             : ["maturation_convergence_ledger_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
 export function buildMaturationSourceDeltaArtifact(args) {
     const matrixRows = args.actionabilityMatrix.rows;
+    const actionabilityIndex = indexActionabilityRowsByDelta(matrixRows);
     const impactRows = (args.sourceObservationDelta?.delta_rows ?? []).map((deltaRow) => {
-        const affectedMatrixRowRefs = matrixRows
-            .filter((row) => row.member_source_refs.some((ref) => sameResolvedRef(ref, deltaRow.source_ref)) ||
-            row.cross_material_ref_refs.some((ref) => sameResolvedRef(ref, deltaRow.source_ref)) ||
-            row.supporting_refs.includes(deltaRow.observation_id))
-            .map((row) => row.matrix_row_id)
-            .sort();
+        const affectedMatrixRowRefs = affectedMatrixRowRefsForDelta(matrixRows, actionabilityIndex, deltaRow);
         return {
             impact_row_id: `maturation-source-delta:${slug(deltaRow.delta_row_id)}`,
             delta_row_id: deltaRow.delta_row_id,
@@ -2426,7 +3442,9 @@ export function buildMaturationSourceDeltaArtifact(args) {
 export function validateMaturationSourceDelta(args) {
     const artifact = args.maturationSourceDelta;
     const violations = [];
-    const matrixRowIds = new Set(args.actionabilityMatrix.rows.map((row) => row.matrix_row_id));
+    const matrixRows = args.actionabilityMatrix.rows;
+    const matrixRowIds = new Set(matrixRows.map((row) => row.matrix_row_id));
+    const actionabilityIndex = indexActionabilityRowsByDelta(matrixRows);
     const deltaRowsById = new Map((args.sourceObservationDelta?.delta_rows ?? []).map((row) => [
         row.delta_row_id,
         row,
@@ -2504,12 +3522,7 @@ export function validateMaturationSourceDelta(args) {
                 }));
             }
         }
-        const expectedAffectedMatrixRowRefs = args.actionabilityMatrix.rows
-            .filter((matrixRow) => matrixRow.member_source_refs.some((ref) => sameResolvedRef(ref, deltaRow.source_ref)) ||
-            matrixRow.cross_material_ref_refs.some((ref) => sameResolvedRef(ref, deltaRow.source_ref)) ||
-            matrixRow.supporting_refs.includes(deltaRow.observation_id))
-            .map((matrixRow) => matrixRow.matrix_row_id)
-            .sort();
+        const expectedAffectedMatrixRowRefs = affectedMatrixRowRefsForDelta(matrixRows, actionabilityIndex, deltaRow);
         if (row.affected_matrix_row_refs.join("\0") !==
             expectedAffectedMatrixRowRefs.join("\0")) {
             violations.push(violation({
@@ -2608,15 +3621,50 @@ export async function writeMaturationSourceDeltaValidationArtifact(args) {
     await writeYamlDocument(args.outputPath, validation);
     return validation;
 }
+// M4b: revision blockers (reject/defer) carried to the next maturation round, derived from
+// revision-proposal.yaml and GATED on a valid revision-proposal-validation. Shared by the
+// continuation builder and validator so the two derive the identical set from the same
+// validated authority (no asymmetry → no spurious conservation mismatch on the invalid path).
+function revisionBlockerLimitationRefs(revisionProposal, revisionProposalValidation) {
+    if (revisionProposalValidation.validation_status !== "valid")
+        return [];
+    return revisionProposal.proposals
+        .filter(isRevisionBlocker)
+        .map((proposal) => `revision-blocker:${proposal.proposal_id}`);
+}
 export function buildMaturationContinuationDecisionArtifact(args) {
     const materialRows = args.actionabilityMatrix.rows.filter((row) => row.materiality === "blocker" || row.materiality === "high");
     const frontierRows = materialRows.filter((row) => row.member_readiness === "frontier_required");
     const limitationRows = materialRows.filter((row) => row.member_readiness === "limitation_backed");
+    // Maturation value-read cut (design §13.2). value_resolved rows had their value-dependent
+    // limitations discharged to zero residual — they are a non-blocking anchor: like a closed
+    // row they can support a bounded actionable claim, so the two `closedRows === 0` blocked
+    // arms below also gate on `valueResolvedRows.length === 0`, and a value_resolved-only run
+    // routes to actionable_limited (not actionable_ready — these rows are value-grounded, not
+    // L4-validated). deriveMemberReadiness gates value_resolved on `material`, so every
+    // value_resolved row is material → this equals the all-rows value_resolved set.
+    const valueResolvedRows = materialRows.filter((row) => row.member_readiness === "value_resolved");
     const blockingRowRefs = frontierRows.map((row) => row.matrix_row_id);
     const authorityRequestRefs = args.maturationClosureFrontier.authority_requests.map((request) => request.authority_request_id);
     const unresolvedAuthorityResponses = args.maturationAuthorityResponse.responses.filter((response) => response.response_status !== "provided");
     const finalRequestionStatus = args.maturationConvergenceLedgerValidation.final_requestion_pass_status;
     const closedRows = args.actionabilityMatrix.rows.filter((row) => row.member_readiness === "closed");
+    // Purpose-candidate-level limitations bound the overall claim but do not gate any
+    // single row's frontier; when present they keep the claim at actionable_limited
+    // even if every row is closed (the source itself is acknowledged as partial).
+    const candidateLimitationRefs = args.actionabilityMatrix.candidate_limitation_refs;
+    const hasCandidateLimitations = candidateLimitationRefs.length > 0;
+    // An unproven final re-question convergence is its own limitation on the claim,
+    // independent of candidate or row limitations — so it must be recorded whenever it
+    // holds, not only when it is the sole reason for actionable_limited. Otherwise the
+    // candidate-limitation branch below would preempt it and the public claim (which
+    // projects only decision.limitation_refs) would silently drop it.
+    const convergenceUnproven = finalRequestionStatus !== "no_new_material_question";
+    // M4b: unresolved reject/defer proposals are carried-forward scope that must keep the
+    // continuation below actionable_ready, independent of row readiness. Computed once here;
+    // the field/fold below is unconditional (a higher-priority branch can win while blockers
+    // exist), only the decision_state downgrade is branch-gated.
+    const revisionBlockerRefs = revisionBlockerLimitationRefs(args.revisionProposal, args.revisionProposalValidation);
     let decisionState;
     let rationale;
     const convergenceLimitationRefs = [];
@@ -2628,23 +3676,52 @@ export function buildMaturationContinuationDecisionArtifact(args) {
         decisionState = "blocked";
         rationale = "Material rows remain frontier-required, but no validated next source or authority response can advance them.";
     }
-    else if (limitationRows.length > 0 && closedRows.length === 0) {
+    else if (limitationRows.length > 0 &&
+        closedRows.length === 0 &&
+        valueResolvedRows.length === 0) {
         decisionState = "blocked";
-        rationale = "Material rows remain limitation-backed and no closed row can support a bounded actionable claim.";
+        rationale = "Material rows remain limitation-backed and no closed or value-resolved row can support a bounded actionable claim.";
     }
     else if (limitationRows.length > 0) {
         decisionState = "actionable_limited";
         rationale = "No material frontier remains, but named limitations constrain the actionability claim.";
     }
-    else if (finalRequestionStatus !== "no_new_material_question") {
+    else if (revisionBlockerRefs.length > 0 &&
+        closedRows.length === 0 &&
+        valueResolvedRows.length === 0) {
+        // Unresolved revision blockers with no closed or value-resolved row cannot support a
+        // bounded actionable claim, and actionable_limited with zero included rows is itself
+        // invalid → blocked.
+        decisionState = "blocked";
+        rationale = "Unresolved reject/defer revision proposals remain and no closed or value-resolved row can support a bounded actionable claim.";
+    }
+    else if (revisionBlockerRefs.length > 0) {
+        decisionState = "actionable_limited";
+        rationale = "All material rows are closed or value-resolved, but unresolved reject/defer revision proposals carry scope to the next maturation round and constrain the actionability claim.";
+    }
+    else if (hasCandidateLimitations) {
+        decisionState = "actionable_limited";
+        rationale = "All material rows are closed or value-resolved, but purpose-candidate-level limitations constrain the actionability claim and signal next-round source frontier.";
+    }
+    else if (convergenceUnproven) {
         decisionState = "actionable_limited";
-        convergenceLimitationRefs.push(`maturation-final-requestion:${finalRequestionStatus}`);
         rationale = "No material frontier remains, but final re-question convergence has not proven actionable readiness.";
     }
+    else if (valueResolvedRows.length > 0) {
+        // Value-read discharge cleared the value-dependent limitations on these material rows,
+        // but they are value-grounded (not L4-validated) — a bounded actionable claim, not full
+        // readiness. Reached only when no blocker/limitation/candidate/convergence constraint
+        // already routed to actionable_limited above (design §13.2 branch 8.5).
+        decisionState = "actionable_limited";
+        rationale = "No material frontier remains; value-read discharge resolved the value-dependent limitations, supporting a bounded actionable claim on a value-grounded (not L4-validated) basis.";
+    }
     else {
         decisionState = "actionable_ready";
         rationale = "All material rows are closed for the declared purpose.";
     }
+    if (convergenceUnproven) {
+        convergenceLimitationRefs.push(`maturation-final-requestion:${finalRequestionStatus}`);
+    }
     const nextFrontierRefs = [
         ...args.maturationQuestionFrontier.questions
             .filter((question) => question.current_answer_status !== "answerable" &&
@@ -2666,19 +3743,38 @@ export function buildMaturationContinuationDecisionArtifact(args) {
         authority_request_refs: authorityRequestRefs,
         authority_response_refs: args.maturationAuthorityResponse.responses.map((response) => response.authority_response_id),
         claim_scope: {
-            included_row_refs: closedRows.map((row) => row.matrix_row_id),
+            // Value-read cut (design §13.4 F6③): the claimable set is closed ∪ value_resolved —
+            // a value_resolved row is value-grounded but claimable. The continuation validator and
+            // the actionable-ontology validator mirror this exact partition (disjoint by
+            // construction: included ∩ excluded = ∅).
+            included_row_refs: args.actionabilityMatrix.rows
+                .filter((row) => row.member_readiness === "closed" ||
+                row.member_readiness === "value_resolved")
+                .map((row) => row.matrix_row_id),
             excluded_row_refs: args.actionabilityMatrix.rows
-                .filter((row) => row.member_readiness !== "closed")
+                .filter((row) => row.member_readiness !== "closed" &&
+                row.member_readiness !== "value_resolved")
                 .map((row) => row.matrix_row_id),
             exclusion_rationale: limitationRows.length > 0 || frontierRows.length > 0
                 ? "Rows outside the trusted claim remain limitation-backed or frontier-required."
                 : null,
         },
+        // M4b: unconditional — recorded regardless of which decision_state branch won, so the
+        // validator's superset+conservation hold even when an earlier branch (ask_user/blocked)
+        // is chosen while blockers exist (mirrors convergenceLimitationRefs).
+        revision_blocker_limitation_refs: revisionBlockerRefs,
         limitation_refs: [
             ...new Set([
                 ...args.actionabilityMatrix.rows.flatMap((row) => row.limitation_refs),
+                ...candidateLimitationRefs,
                 ...args.ontologyExpansionValidation.violations.map((item) => item.subject_id ?? "ontology_expansion_validation"),
                 ...convergenceLimitationRefs,
+                ...revisionBlockerRefs,
+                // Value-read cut (design §13.4 F6④): each value_resolved row contributes an explicit
+                // value-read basis ref so the public claim honestly records that its actionability
+                // rests on value-read discharge (not L4 validation), and a pure value_resolved-only
+                // run satisfies the "actionable_limited needs excluded refs or limitation refs" gate.
+                ...valueResolvedRows.map((row) => `maturation-value-read-basis:${row.matrix_row_id}`),
             ]),
         ],
     };
@@ -2686,6 +3782,24 @@ export function buildMaturationContinuationDecisionArtifact(args) {
 export function validateMaturationContinuationDecision(args) {
     const decision = args.maturationContinuationDecision;
     const violations = [];
+    // G(a) slice 22 — record the obligations this validator genuinely enforces (RECORD 4/9, all clean
+    // derive-and-assert / single-facet gates from the M1/M4b conservation work). The other 5 stay parked
+    // (see obligation-coverage-ledger.yaml notes): "continuation_state against validated matrix and
+    // frontier_state" is AMBIGUOUS (intent split across the blanket prior-validation loop / claim_scope
+    // partition / material-rows gate); "continue/ask_user/blocked against available next authority" is
+    // PARTIAL (the named `blocked` state has no enforcement); the revision-proposal binding is gated on the
+    // caller-supplied optional `revisionProposalRef` (no internal guarantee — codex R1, slice-18); the
+    // "material blocker/high row remains unclosed" gate only catches `frontier_required`, not the
+    // `limitation_backed` half of "unclosed" (codex R1, subset-of-scope); and "limitation_refs and
+    // row_scope for actionable_limited" only firmly enforces row_scope — the limitation-ref facet is a weak
+    // excluded-OR-limitation presence check that a limitation_backed excluded row with dropped
+    // limitation_refs satisfies (codex R2, name-broader-than-code). Stamped before any per-row/per-state
+    // guard so the recorder fires on zero-row input.
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "reject_actionable_ready_until_final_requestion_convergence_is_proven");
+    assertObligation(assertedObligationIds, "reject_actionable_ready_when_unresolved_revision_blockers_remain");
+    assertObligation(assertedObligationIds, "require_revision_blocker_refs_in_continuation_limitation_refs");
+    assertObligation(assertedObligationIds, "validate_revision_blocker_limitation_refs_against_validated_revision_proposal");
     const matrixRows = new Map(args.actionabilityMatrix.rows.map((row) => [
         row.matrix_row_id,
         row,
@@ -2716,6 +3830,7 @@ export function validateMaturationContinuationDecision(args) {
         maturation_authority_response: args.maturationAuthorityResponseValidation.validation_status,
         ontology_expansion: args.ontologyExpansionValidation.validation_status,
         maturation_convergence_ledger: args.maturationConvergenceLedgerValidation.validation_status,
+        revision_proposal: args.revisionProposalValidation.validation_status,
     })) {
         if (status !== "valid") {
             violations.push(violation({
@@ -2745,6 +3860,33 @@ export function validateMaturationContinuationDecision(args) {
             }));
         }
     }
+    // M1 partition conservation: recompute the claim_scope partition from the matrix and
+    // require the decision to match it. The resolve check above only verifies the listed refs
+    // exist, so a claim_scope that OMITS rows would pass and the public claim would preserve
+    // the omission. Value-read cut (design §13.4 F6③): the claimable (included) set is
+    // closed ∪ value_resolved; everything else is excluded (mirrors the builder exactly).
+    const expectedIncluded = args.actionabilityMatrix.rows
+        .filter((row) => row.member_readiness === "closed" ||
+        row.member_readiness === "value_resolved")
+        .map((row) => row.matrix_row_id);
+    const expectedExcluded = args.actionabilityMatrix.rows
+        .filter((row) => row.member_readiness !== "closed" &&
+        row.member_readiness !== "value_resolved")
+        .map((row) => row.matrix_row_id);
+    if (!sameRefSet(decision.claim_scope.included_row_refs, expectedIncluded)) {
+        violations.push(violation({
+            code: "conflicting_state",
+            message: "continuation claim_scope included_row_refs must equal the matrix's closed and value-resolved rows",
+            subjectId: "claim_scope.included_row_refs",
+        }));
+    }
+    if (!sameRefSet(decision.claim_scope.excluded_row_refs, expectedExcluded)) {
+        violations.push(violation({
+            code: "conflicting_state",
+            message: "continuation claim_scope excluded_row_refs must equal the matrix's non-closed, non-value-resolved rows",
+            subjectId: "claim_scope.excluded_row_refs",
+        }));
+    }
     const hasAuthorityNeed = decision.authority_request_refs.length > 0;
     if (decision.decision_state === "actionable_ready" && materialOpenRows.length > 0) {
         violations.push(violation({
@@ -2753,6 +3895,85 @@ export function validateMaturationContinuationDecision(args) {
             subjectId: "actionable_ready",
         }));
     }
+    // Value-read cut (design §13.4): value_resolved rows are value-grounded, not L4-validated,
+    // so a saved/edited decision cannot project actionable_ready while any remain — the bounded
+    // claim is at most actionable_limited (mirrors the builder's branch ordering).
+    if (decision.decision_state === "actionable_ready" &&
+        args.actionabilityMatrix.rows.some((row) => row.member_readiness === "value_resolved")) {
+        violations.push(violation({
+            code: "conflicting_state",
+            message: "actionable_ready cannot be projected while value-resolved (value-grounded, not L4) rows remain",
+            subjectId: "actionable_ready",
+        }));
+    }
+    // Mirror the builder: purpose-candidate-level limitations constrain the overall
+    // claim, so a saved/edited decision cannot project actionable_ready while the
+    // matrix carries them (the bounded claim is at most actionable_limited).
+    if (decision.decision_state === "actionable_ready" &&
+        args.actionabilityMatrix.candidate_limitation_refs.length > 0) {
+        violations.push(violation({
+            code: "conflicting_state",
+            message: "actionable_ready cannot be projected while purpose-candidate-level limitations remain",
+            subjectId: "actionable_ready",
+        }));
+    }
+    // The public claim projects decision.limitation_refs, so every matrix candidate
+    // limitation must survive into it — a saved/edited limited decision that drops them
+    // (keeping only excluded rows or other limitation refs) would erase the source-level
+    // limitation from the downstream claim even though the validated matrix still carries it.
+    const decisionLimitationRefs = new Set(decision.limitation_refs);
+    if (args.actionabilityMatrix.candidate_limitation_refs.some((ref) => !decisionLimitationRefs.has(ref))) {
+        violations.push(violation({
+            code: "missing_required_ref",
+            message: "continuation decision limitation_refs must include every matrix candidate limitation",
+            subjectId: "candidate_limitation_refs",
+        }));
+    }
+    // M4b — revision-blocker conservation gate (derive-and-assert, not trust the field).
+    // onto finding-002 + codex: bind the consumed revision-proposal-validation to the consumed
+    // revision-proposal so a stale/mismatched/unbound valid validation cannot certify a
+    // different proposal set (resume/manual substitution). When the consumed proposal ref is
+    // known and the validation is being trusted (valid), require a matching NON-NULL ref —
+    // a null revision_proposal_ref (pure/manual validations) is not acceptable certification.
+    if (args.revisionProposalRef &&
+        args.revisionProposalValidation.validation_status === "valid" &&
+        (!args.revisionProposalValidation.revision_proposal_ref ||
+            path.resolve(args.revisionProposalValidation.revision_proposal_ref) !==
+                path.resolve(args.revisionProposalRef))) {
+        violations.push(violation({
+            code: "conflicting_state",
+            message: "continuation decision must consume the revision-proposal validation that certifies the consumed revision-proposal",
+            subjectId: "revision_proposal_ref",
+        }));
+    }
+    // Recompute the blocker set from the validated authority (gated on valid, symmetric with
+    // the builder) and assert the decision field equals it — the field is not trusted.
+    // Normalize a missing field ([] for pre-M4b persisted decisions) so revalidation produces
+    // an invalid result rather than throwing.
+    const decisionRevisionBlockerRefs = decision.revision_blocker_limitation_refs ?? [];
+    const expectedRevisionBlockerRefs = revisionBlockerLimitationRefs(args.revisionProposal, args.revisionProposalValidation);
+    if (!sameRefSet(decisionRevisionBlockerRefs, expectedRevisionBlockerRefs)) {
+        violations.push(violation({
+            code: "conflicting_state",
+            message: "continuation decision revision_blocker_limitation_refs must equal the reject/defer proposals derived from the validated revision-proposal",
+            subjectId: "revision_blocker_limitation_refs",
+        }));
+    }
+    if (expectedRevisionBlockerRefs.some((ref) => !decisionLimitationRefs.has(ref))) {
+        violations.push(violation({
+            code: "missing_required_ref",
+            message: "continuation decision limitation_refs must include every revision blocker ref",
+            subjectId: "revision_blocker_limitation_refs",
+        }));
+    }
+    if (decision.decision_state === "actionable_ready" &&
+        expectedRevisionBlockerRefs.length > 0) {
+        violations.push(violation({
+            code: "conflicting_state",
+            message: "actionable_ready cannot be projected while unresolved revision blockers remain",
+            subjectId: "actionable_ready",
+        }));
+    }
     if (decision.decision_state === "actionable_ready" &&
         args.maturationConvergenceLedgerValidation.final_requestion_pass_status !==
             "no_new_material_question") {
@@ -2813,6 +4034,7 @@ export function validateMaturationContinuationDecision(args) {
         validation_results: violations.length === 0
             ? ["maturation_continuation_decision_valid"]
             : ["maturation_continuation_decision_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
@@ -2911,6 +4133,17 @@ export function validateActionableOntology(args) {
     const expansionIds = new Set(args.ontologyExpansion.expansions.map((expansion) => expansion.expansion_id));
     const projectedMatrixRefs = new Set();
     const projectionIds = new Set();
+    // G(a) obligation recorder (INV-OBLIGATION-COVERAGE-1). The four obligations below have a distinct,
+    // name-matching enforcer reached unconditionally (the per-row trace check fires per projected row, so
+    // its stamp also records on zero-row input). The other three convergence/projection obligations are
+    // parked with audit notes — see obligation-coverage-ledger.yaml (material blocker/high closure is
+    // delegated to the continuation-decision validator; per-surface static/kinetic/dynamic closure is not
+    // checked here; proof-authority recheck is a blanket downstream-claim reject, not a validation).
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "reject_actionable_ready_until_final_requestion_convergence_is_proven");
+    assertObligation(assertedObligationIds, "validate_actionability_claim_against_maturation_continuation_decision");
+    assertObligation(assertedObligationIds, "validate_actionable_limited_claim_scope_rows");
+    assertObligation(assertedObligationIds, "require_every_projected_row_to_trace_to_seed_expansion_or_limitation");
     if (artifact.session_id !== args.actionabilityMatrix.session_id) {
         violations.push(violation({
             code: "session_id_mismatch",
@@ -3016,10 +4249,12 @@ export function validateActionableOntology(args) {
                 subjectId: row.projection_row_id,
             }));
         }
-        if (row.claim_scope === "included" && matrixRow.member_readiness !== "closed") {
+        if (row.claim_scope === "included" &&
+            matrixRow.member_readiness !== "closed" &&
+            matrixRow.member_readiness !== "value_resolved") {
             violations.push(violation({
                 code: "conflicting_state",
-                message: "included actionable ontology rows must be closed in the actionability matrix",
+                message: "included actionable ontology rows must be closed or value-resolved in the actionability matrix",
                 subjectId: row.matrix_row_ref,
             }));
         }
@@ -3069,6 +4304,7 @@ export function validateActionableOntology(args) {
         validation_results: violations.length === 0
             ? ["actionable_ontology_valid"]
             : ["actionable_ontology_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
@@ -3196,7 +4432,7 @@ export async function writeMaturationBaselineValidationArtifact(args) {
 }
 export async function writeActionabilityMatrixArtifact(args) {
     const maturationBaseline = await readYamlDocument(args.maturationBaselinePath);
-    const [maturationAnswerClaims, maturationAnswerClaimsValidation, ontologyExpansion, ontologyExpansionValidation,] = await Promise.all([
+    const [maturationAnswerClaims, maturationAnswerClaimsValidation, ontologyExpansion, ontologyExpansionValidation, maturationQuestionFrontier, maturationQuestionFrontierValidation, maturationValueDischarge, maturationValueDischargeValidation,] = await Promise.all([
         args.maturationAnswerClaimsPath
             ? readYamlDocument(args.maturationAnswerClaimsPath)
             : Promise.resolve(null),
@@ -3209,6 +4445,18 @@ export async function writeActionabilityMatrixArtifact(args) {
         args.ontologyExpansionValidationPath
             ? readYamlDocument(args.ontologyExpansionValidationPath)
             : Promise.resolve(null),
+        args.maturationQuestionFrontierPath
+            ? readYamlDocument(args.maturationQuestionFrontierPath)
+            : Promise.resolve(null),
+        args.maturationQuestionFrontierValidationPath
+            ? readYamlDocument(args.maturationQuestionFrontierValidationPath)
+            : Promise.resolve(null),
+        args.maturationValueDischargePath
+            ? readYamlDocument(args.maturationValueDischargePath)
+            : Promise.resolve(null),
+        args.maturationValueDischargeValidationPath
+            ? readYamlDocument(args.maturationValueDischargeValidationPath)
+            : Promise.resolve(null),
     ]);
     const artifact = buildActionabilityMatrixArtifact({
         sessionId: args.sessionId,
@@ -3218,15 +4466,19 @@ export async function writeActionabilityMatrixArtifact(args) {
         maturationAnswerClaims,
         maturationAnswerClaimsValidation,
         maturationAnswerClaimsValidationRef: args.maturationAnswerClaimsValidationPath ?? null,
+        maturationValueDischarge,
+        maturationValueDischargeValidation,
         ontologyExpansion,
         ontologyExpansionValidation,
         ontologyExpansionValidationRef: args.ontologyExpansionValidationPath ?? null,
+        maturationQuestionFrontier,
+        maturationQuestionFrontierValidation,
     });
     await writeYamlDocument(args.outputPath, artifact);
     return artifact;
 }
 export async function writeActionabilityMatrixValidationArtifact(args) {
-    const [actionabilityMatrix, maturationBaseline, maturationBaselineValidation, maturationAnswerClaims, maturationAnswerClaimsValidation, ontologyExpansion, ontologyExpansionValidation,] = await Promise.all([
+    const [actionabilityMatrix, maturationBaseline, maturationBaselineValidation, maturationAnswerClaims, maturationAnswerClaimsValidation, ontologyExpansion, ontologyExpansionValidation, maturationQuestionFrontier, maturationQuestionFrontierValidation, maturationValueDischarge, maturationValueDischargeValidation,] = await Promise.all([
         readYamlDocument(args.actionabilityMatrixPath),
         readYamlDocument(args.maturationBaselinePath),
         readYamlDocument(args.maturationBaselineValidationPath),
@@ -3242,6 +4494,18 @@ export async function writeActionabilityMatrixValidationArtifact(args) {
         args.ontologyExpansionValidationPath
             ? readYamlDocument(args.ontologyExpansionValidationPath)
             : Promise.resolve(null),
+        args.maturationQuestionFrontierPath
+            ? readYamlDocument(args.maturationQuestionFrontierPath)
+            : Promise.resolve(null),
+        args.maturationQuestionFrontierValidationPath
+            ? readYamlDocument(args.maturationQuestionFrontierValidationPath)
+            : Promise.resolve(null),
+        args.maturationValueDischargePath
+            ? readYamlDocument(args.maturationValueDischargePath)
+            : Promise.resolve(null),
+        args.maturationValueDischargeValidationPath
+            ? readYamlDocument(args.maturationValueDischargeValidationPath)
+            : Promise.resolve(null),
     ]);
     const validation = validateActionabilityMatrix({
         actionabilityMatrix,
@@ -3252,9 +4516,15 @@ export async function writeActionabilityMatrixValidationArtifact(args) {
         maturationAnswerClaims,
         maturationAnswerClaimsValidation,
         maturationAnswerClaimsValidationRef: args.maturationAnswerClaimsValidationPath ?? null,
+        maturationValueDischarge,
+        maturationValueDischargeValidation,
         ontologyExpansion,
         ontologyExpansionValidation,
         ontologyExpansionValidationRef: args.ontologyExpansionValidationPath ?? null,
+        maturationQuestionFrontier,
+        maturationQuestionFrontierValidation,
+        maturationQuestionFrontierValidationRef: args.maturationQuestionFrontierValidationPath ?? null,
+        maturationQuestionFrontierRef: args.maturationQuestionFrontierPath ?? null,
     });
     await writeYamlDocument(args.outputPath, validation);
     return validation;
@@ -3404,6 +4674,170 @@ export async function writeAnswerSupportLedgerValidationArtifact(args) {
     await writeYamlDocument(args.outputPath, validation);
     return validation;
 }
+// B-5 answer-support judge validation. Structural author!=judge attribution is
+// enforced upstream (separate authored artifact + 1:1 telemetry mapping); this
+// validator therefore NEVER compares directive_author.author_id (spoofable).
+// Obligations: refs resolve (unknown_id) / supports enum (invalid_enum) /
+// rationale present (missing_required_ref) / one verdict per (cluster, evidence)
+// pair (duplicate_id) / convergent coverage — every cited evidence_ref of a
+// convergent_source_evidence cluster must be judged (reuses missing_required_coverage).
+export function validateAnswerSupportJudgment(args) {
+    const artifact = args.answerSupportJudgment;
+    const ledger = args.answerSupportLedger;
+    const violations = [];
+    const SUPPORTS_VALUES = ["supported", "not_supported"];
+    if (artifact.session_id !== ledger.session_id) {
+        violations.push(violation({
+            code: "session_id_mismatch",
+            message: "answer support judgment session_id must match the support ledger",
+            subjectId: artifact.session_id,
+        }));
+    }
+    if (args.answerSupportLedgerValidation.validation_status !== "valid") {
+        violations.push(violation({
+            code: "prior_validation_invalid",
+            message: "answer support judgment requires a valid support-ledger validation",
+            subjectId: args.answerSupportLedgerValidationRef ?? "answer-support-ledger-validation",
+        }));
+    }
+    const clusters = new Map(ledger.evidence_clusters.map((cluster) => [cluster.evidence_cluster_id, cluster]));
+    const evidenceKeysByCluster = new Map(ledger.evidence_clusters.map((cluster) => [
+        cluster.evidence_cluster_id,
+        new Set(cluster.evidence_refs.map(evidenceRefKey)),
+    ]));
+    // IDENTITY keys a judgment actually covered, per cluster (drives coverage D).
+    const judgedKeysByCluster = new Map();
+    const seen = new Set();
+    let supportedJudgmentCount = 0;
+    // G(a) slice 8: record the four judgment obligations before the per-judgment loop (and the D
+    // convergent-coverage loop) so they fire on a zero-judgment artifact. Each maps to a distinct
+    // audited block — A ref resolution (unknown_id) / B supports enum (invalid_enum) / C rationale_ref
+    // (missing_required_ref) / D convergent coverage (missing_required_coverage). No laundering.
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "validate_judgment_refs_resolve_to_answer_support_ledger_clusters_and_evidence");
+    assertObligation(assertedObligationIds, "require_supports_enum_for_each_judgment");
+    assertObligation(assertedObligationIds, "require_rationale_ref_for_each_judgment");
+    assertObligation(assertedObligationIds, "require_convergent_clusters_to_judge_every_cited_evidence_ref");
+    for (const judgment of artifact.judgments) {
+        if (seen.has(judgment.judgment_id)) {
+            violations.push(violation({
+                code: "duplicate_id",
+                message: "answer support judgment ids must be unique",
+                subjectId: judgment.judgment_id,
+            }));
+        }
+        else {
+            seen.add(judgment.judgment_id);
+        }
+        // A: cluster ref + evidence ref resolve to a cited evidence in the ledger.
+        const evidenceKey = evidenceRefKey(judgment.evidence_ref);
+        const clusterKeys = evidenceKeysByCluster.get(judgment.evidence_cluster_ref);
+        if (!clusters.has(judgment.evidence_cluster_ref) || !clusterKeys) {
+            violations.push(violation({
+                code: "unknown_id",
+                message: "judgment evidence_cluster_ref must resolve to a support-ledger cluster",
+                subjectId: judgment.evidence_cluster_ref,
+            }));
+        }
+        else if (!clusterKeys.has(evidenceKey)) {
+            violations.push(violation({
+                code: "unknown_id",
+                message: "judgment evidence_ref must resolve to a cited evidence ref in its cluster",
+                subjectId: judgment.judgment_id,
+            }));
+        }
+        else {
+            const covered = judgedKeysByCluster.get(judgment.evidence_cluster_ref) ??
+                new Set();
+            // One verdict per (cluster, evidence) IDENTITY pair: a second judgment for
+            // the same pair (e.g. a contradictory supported + not_supported) must be
+            // invalid. Otherwise B-6 would launder it — judgeSupported only ADDS
+            // 'supported' keys, so a conflict silently resolves to "supported wins" and
+            // an ambiguous ref counts toward convergent sufficiency. Reuses duplicate_id.
+            if (covered.has(evidenceKey)) {
+                violations.push(violation({
+                    code: "duplicate_id",
+                    message: "answer support judgment must record at most one verdict per (cluster, evidence) pair",
+                    subjectId: judgment.judgment_id,
+                }));
+            }
+            else {
+                covered.add(evidenceKey);
+                judgedKeysByCluster.set(judgment.evidence_cluster_ref, covered);
+            }
+        }
+        // B: supports enum (raw projection of supported count, NOT sufficiency).
+        if (!SUPPORTS_VALUES.includes(judgment.supports)) {
+            violations.push(violation({
+                code: "invalid_enum",
+                message: `invalid supports verdict ${judgment.supports}`,
+                subjectId: judgment.judgment_id,
+            }));
+        }
+        else if (judgment.supports === "supported") {
+            supportedJudgmentCount += 1;
+        }
+        // C: rationale ref present (existence only, content not read).
+        if (!judgment.rationale_ref || judgment.rationale_ref.trim().length === 0) {
+            violations.push(violation({
+                code: "missing_required_ref",
+                message: "answer support judgment must cite a rationale_ref",
+                subjectId: judgment.judgment_id,
+            }));
+        }
+    }
+    // D: convergent coverage (Codex #3) — every cited evidence_ref of a
+    // convergent_source_evidence cluster must have a judgment row, so an
+    // unfavorable/ambiguous ref cannot be silently omitted. Reuses the existing
+    // missing_required_coverage failure kind (same "required coverage missing"
+    // family). Non-convergent clusters do not trigger coverage.
+    for (const cluster of ledger.evidence_clusters) {
+        if (cluster.support_mode !== "convergent_source_evidence")
+            continue;
+        const covered = judgedKeysByCluster.get(cluster.evidence_cluster_id) ??
+            new Set();
+        for (const ref of cluster.evidence_refs) {
+            if (!covered.has(evidenceRefKey(ref))) {
+                violations.push(violation({
+                    code: "missing_required_coverage",
+                    message: "convergent cluster requires a judgment for every cited evidence ref",
+                    subjectId: cluster.evidence_cluster_id,
+                }));
+            }
+        }
+    }
+    return {
+        schema_version: "1",
+        session_id: artifact.session_id,
+        created_at: isoNow(),
+        answer_support_judgment_ref: args.answerSupportJudgmentRef ?? null,
+        answer_support_ledger_validation_ref: args.answerSupportLedgerValidationRef ?? null,
+        validation_status: violations.length === 0 ? "valid" : "invalid",
+        judgment_count: artifact.judgments.length,
+        supported_judgment_count: supportedJudgmentCount,
+        validation_results: violations.length === 0
+            ? ["answer_support_judgment_valid"]
+            : ["answer_support_judgment_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
+        violations,
+    };
+}
+export async function writeAnswerSupportJudgmentValidationArtifact(args) {
+    const [answerSupportJudgment, answerSupportLedger, answerSupportLedgerValidation,] = await Promise.all([
+        readYamlDocument(args.answerSupportJudgmentPath),
+        readYamlDocument(args.answerSupportLedgerPath),
+        readYamlDocument(args.answerSupportLedgerValidationPath),
+    ]);
+    const validation = validateAnswerSupportJudgment({
+        answerSupportJudgment,
+        answerSupportJudgmentRef: args.answerSupportJudgmentPath,
+        answerSupportLedger,
+        answerSupportLedgerValidation,
+        answerSupportLedgerValidationRef: args.answerSupportLedgerValidationPath,
+    });
+    await writeYamlDocument(args.outputPath, validation);
+    return validation;
+}
 export async function writeMaturationAnswerClaimsValidationArtifact(args) {
     const [maturationAnswerClaims, answerSupportLedger, answerSupportLedgerValidation, maturationQuestionFrontier, maturationQuestionFrontierValidation,] = await Promise.all([
         readYamlDocument(args.maturationAnswerClaimsPath),
@@ -3412,6 +4846,14 @@ export async function writeMaturationAnswerClaimsValidationArtifact(args) {
         readYamlDocument(args.maturationQuestionFrontierPath),
         readYamlDocument(args.maturationQuestionFrontierValidationPath),
     ]);
+    const [answerSupportJudgment, answerSupportJudgmentValidation] = await Promise.all([
+        args.answerSupportJudgmentPath
+            ? readYamlDocument(args.answerSupportJudgmentPath)
+            : Promise.resolve(null),
+        args.answerSupportJudgmentValidationPath
+            ? readYamlDocument(args.answerSupportJudgmentValidationPath)
+            : Promise.resolve(null),
+    ]);
     const validation = validateMaturationAnswerClaims({
         maturationAnswerClaims,
         maturationAnswerClaimsRef: args.maturationAnswerClaimsPath,
@@ -3421,6 +4863,10 @@ export async function writeMaturationAnswerClaimsValidationArtifact(args) {
         maturationQuestionFrontier,
         maturationQuestionFrontierValidation,
         maturationQuestionFrontierValidationRef: args.maturationQuestionFrontierValidationPath,
+        answerSupportJudgment,
+        answerSupportJudgmentRef: args.answerSupportJudgmentPath ?? null,
+        answerSupportJudgmentValidation,
+        answerSupportJudgmentValidationRef: args.answerSupportJudgmentValidationPath ?? null,
     });
     await writeYamlDocument(args.outputPath, validation);
     return validation;
@@ -3515,7 +4961,7 @@ export async function writeMaturationConvergenceLedgerValidationArtifact(args) {
     return validation;
 }
 export async function writeMaturationContinuationDecisionArtifact(args) {
-    const [actionabilityMatrix, maturationQuestionFrontier, maturationClosureFrontier, maturationClosureFrontierValidation, maturationAuthorityResponse, ontologyExpansionValidation, maturationConvergenceLedgerValidation,] = await Promise.all([
+    const [actionabilityMatrix, maturationQuestionFrontier, maturationClosureFrontier, maturationClosureFrontierValidation, maturationAuthorityResponse, ontologyExpansionValidation, maturationConvergenceLedgerValidation, revisionProposal, revisionProposalValidation,] = await Promise.all([
         readYamlDocument(args.actionabilityMatrixPath),
         readYamlDocument(args.maturationQuestionFrontierPath),
         readYamlDocument(args.maturationClosureFrontierPath),
@@ -3523,6 +4969,8 @@ export async function writeMaturationContinuationDecisionArtifact(args) {
         readYamlDocument(args.maturationAuthorityResponsePath),
         readYamlDocument(args.ontologyExpansionValidationPath),
         readYamlDocument(args.maturationConvergenceLedgerValidationPath),
+        readYamlDocument(args.revisionProposalPath),
+        readYamlDocument(args.revisionProposalValidationPath),
     ]);
     const artifact = buildMaturationContinuationDecisionArtifact({
         sessionId: args.sessionId,
@@ -3535,12 +4983,14 @@ export async function writeMaturationContinuationDecisionArtifact(args) {
         maturationClosureFrontierValidation,
         maturationAuthorityResponse,
         ontologyExpansionValidation,
+        revisionProposal,
+        revisionProposalValidation,
     });
     await writeYamlDocument(args.outputPath, artifact);
     return artifact;
 }
 export async function writeMaturationContinuationDecisionValidationArtifact(args) {
-    const [maturationContinuationDecision, actionabilityMatrix, actionabilityMatrixValidation, maturationQuestionFrontierValidation, maturationClosureFrontierValidation, answerSupportLedgerValidation, maturationAuthorityResponseValidation, ontologyExpansionValidation, maturationConvergenceLedgerValidation,] = await Promise.all([
+    const [maturationContinuationDecision, actionabilityMatrix, actionabilityMatrixValidation, maturationQuestionFrontierValidation, maturationClosureFrontierValidation, answerSupportLedgerValidation, maturationAuthorityResponseValidation, ontologyExpansionValidation, maturationConvergenceLedgerValidation, revisionProposal, revisionProposalValidation,] = await Promise.all([
         readYamlDocument(args.maturationContinuationDecisionPath),
         readYamlDocument(args.actionabilityMatrixPath),
         readYamlDocument(args.actionabilityMatrixValidationPath),
@@ -3550,6 +5000,8 @@ export async function writeMaturationContinuationDecisionValidationArtifact(args
         readYamlDocument(args.maturationAuthorityResponseValidationPath),
         readYamlDocument(args.ontologyExpansionValidationPath),
         readYamlDocument(args.maturationConvergenceLedgerValidationPath),
+        readYamlDocument(args.revisionProposalPath),
+        readYamlDocument(args.revisionProposalValidationPath),
     ]);
     const validation = validateMaturationContinuationDecision({
         maturationContinuationDecision,
@@ -3569,6 +5021,9 @@ export async function writeMaturationContinuationDecisionValidationArtifact(args
         ontologyExpansionValidationRef: args.ontologyExpansionValidationPath,
         maturationConvergenceLedgerValidation,
         maturationConvergenceLedgerValidationRef: args.maturationConvergenceLedgerValidationPath,
+        revisionProposal,
+        revisionProposalValidation,
+        revisionProposalRef: args.revisionProposalPath,
     });
     await writeYamlDocument(args.outputPath, validation);
     return validation;