phronesis 1.0.0

package/vendor/core/src/actions.js

@@ -0,0 +1,2140 @@
+// The shared action core — T2.2's spine (core-0008; specs/ontology.md §"Action type
+// contract"; contract decisions D1–D12 in harness/tasks/core-0008-action-spine.md).
+//
+// One `runAction({ type, payload, ctx })` path that EVERY action type and EVERY caller
+// (the `phronesis act` CLI today; daemon/GUI/MCP adapters later) routes through —
+// identical schema validation, permission gate, event emission, and staged atomic
+// write regardless of who calls. No business logic lives outside this module and its
+// writers (action-writers.js); adapters only parse and delegate (D7).
+//
+// The contract order, with the audit and the gate placed deliberately (D5/D6):
+//   1. schema-validate the payload + execution context (incl. domain registered, D10)
+//      — an ill-formed call fails closed BEFORE it is a proposal: no event;
+//   2. emit `action_type.requested` — the proposal is now audited;
+//   3. permission gate — a refused approval-required call exits non-zero with NO
+//      `committed`, but the `requested` event already recorded the attempt (denials
+//      leave a trail);
+//   4. compute the deterministic target, assemble frontmatter + body;
+//   5. stage to temp → validate the staged artifact against the ontology contract →
+//      atomic rename (rules.md:167 — no partial write survives any failure);
+//   6. emit `action_type.committed`; return { ok, path, changes_summary }.
+//
+// Hooks (D11, completed by core-0013/D3): the pre_*/post_* step of the spec's contract
+// rides the event pair — pre ≈ `requested` before the write, post ≈ `committed` after
+// it — and since core-0013 the V1 executor fires registry-matched hook commands
+// SYNCHRONOUSLY (hook-executor.js; subscriptions live in the install registry's
+// top-level `hooks` array). requested-subscribed hooks fire PRE-WRITE, only after
+// every pipeline refusal point has passed (permission/exposure/collision/build's
+// second factors) — a refused proposal fires NO hooks, though its requested trail
+// stays in the stream (D6; Codex round on core-0013). A gate-kind hook failing there
+// refuses the write; at `committed` the write is already real, so a gate failure
+// surfaces without rollback (agents do not delete). ambient/mutation failures are
+// audited, never blocking. Every fire — success, failure, skip — lands in
+// .phronesis/audit.log.
+//
+// Approval (D5 — detective at T2.2, preventive in T3.2): `ask-once`/`requires-approval`
+// actions refuse without an approval signal. The signal travels on a channel separate
+// from the action payload — `ctx.approvalSource`, an adapter-set value (the `act` CLI
+// reads env PHRONESIS_APPROVAL_SOURCE) — and is recorded VERBATIM as `approval_source`
+// on `action_type.committed`. It is provenance, not proof: argv and env are both
+// caller-controlled, so this layer cannot prevent an agent from self-approving; the
+// preventive guarantee (that the signal reflects real human assent) is T3.2's
+// porcelain, the sole legitimate setter after a real interaction.
+
+import { join, resolve, relative, sep, isAbsolute } from 'node:path';
+import { readFile, readdir } from 'node:fs/promises';
+import yaml from 'js-yaml';
+import fse from 'fs-extra';
+import { ENUMS, LINK_RELS, RE_SLUG, SLUG_SOURCE, DATE_RE, TYPE_DIR, classifyTarget } from './contract.js';
+import {
+  buildActionTypesSection,
+  resolveActionTypesAgainst,
+  layoutPattern,
+} from './action-registry.js';
+import { resolveHooks, executeHooksFor, matchingHooks, readAuditLog } from './hook-executor.js';
+import { checkObjectContent } from './validate-object.js';
+import { appendEvent, readEvents, localDateStamp } from './event-log.js';
+import { digestFile } from './content-digest.js';
+import { resolveInstall } from './install-root.js';
+import { DEFAULT_DOMAIN } from './layout.js';
+import {
+  slugify,
+  serializeFrontmatter,
+  formatLogEntry,
+  appendLogBlock,
+  splitObjectSource,
+  stageValidateRename,
+  stageValidateRenameAll,
+} from './action-writers.js';
+
+// --- Payload schemas (D2 — hand-rolled, zero-dep) ------------------------------------
+//
+// A JS field-spec object per action satisfies ontology's "JSON schema" for 6 fixed
+// shapes; no ajv (revisit at T2.4 if standard JSON-Schema serialization is wanted).
+// Semantic inputs live HERE, in the payload — execution context (session/domain/actor/
+// surface/dir) and the approval signal are deliberately out-of-payload (D5).
+// Unknown payload fields fail closed: a schema that ignores what it does not know
+// would let a typo'd field silently drop operator intent.
+
+function checkLinksField(links, errors) {
+  if (!Array.isArray(links)) {
+    errors.push('links: must be a list');
+    return;
+  }
+  links.forEach((link, i) => {
+    if (link === null || typeof link !== 'object' || Array.isArray(link)) {
+      errors.push(`links[${i}]: must be a mapping with rel + target`);
+      return;
+    }
+    const extra = Object.keys(link).filter((k) => !['rel', 'target', 'forward'].includes(k));
+    if (extra.length) errors.push(`links[${i}]: unknown key(s): ${extra.join(', ')}`);
+    if (!link.rel) errors.push(`links[${i}]: missing rel`);
+    else if (!LINK_RELS.includes(link.rel)) {
+      errors.push(`links[${i}]: rel "${link.rel}" is not in the link vocabulary`);
+    }
+    if (link.target === undefined || link.target === null || link.target === '') {
+      errors.push(`links[${i}]: missing target`);
+      return;
+    }
+    const cls = classifyTarget(link.target);
+    if (cls.form === 'invalid') {
+      errors.push(`links[${i}]: target "${link.target}" matches no link-target form`);
+      return;
+    }
+    if (link.forward !== undefined && typeof link.forward !== 'boolean') {
+      errors.push(`links[${i}]: forward must be a boolean`);
+    }
+    if (link.forward === true && !cls.domainObject) {
+      errors.push(`links[${i}]: forward:true is only allowed on domain-object targets (not "${link.target}")`);
+    }
+  });
+}
+
+function isCalendarDate(s) {
+  const [y, m, d] = s.split('-').map(Number);
+  const dt = new Date(Date.UTC(y, m - 1, d));
+  return dt.getUTCFullYear() === y && dt.getUTCMonth() === m - 1 && dt.getUTCDate() === d;
+}
+
+function checkField(name, spec, value, errors) {
+  if (value === undefined) {
+    if (spec.required) errors.push(`missing required payload field: ${name}`);
+    return;
+  }
+  // null is PRESENT and invalid, never "absent": agents fill optional JSON fields with
+  // null constantly, and a null that slips the schema either crashes the handler after
+  // the requested event (breaking the no-event-before-validity ordering) or commits
+  // `field: null` junk into canonical state. Fail closed here, where step 1 lives.
+  if (value === null) {
+    errors.push(`${name}: null is not a valid value — omit the field instead`);
+    return;
+  }
+  switch (spec.kind) {
+    case 'string':
+      if (typeof value !== 'string') errors.push(`${name}: must be a string`);
+      else if (spec.nonEmpty && value.trim() === '') errors.push(`${name}: must be a non-empty string`);
+      break;
+    case 'slug':
+      if (typeof value !== 'string' || !RE_SLUG.test(value)) {
+        errors.push(`${name}: "${value}" is not a kebab-case slug`);
+      }
+      break;
+    case 'date':
+      // Shape AND calendar validity: DATE_RE alone admits 2026-02-31, and a date an
+      // action persists is a date something later schedules on (the daemon's
+      // `outcome.due`-style jobs, T4.1). The frontmatter contract stays shape-only
+      // (changing it is a spec mutation); the action layer fails closed here.
+      if (typeof value !== 'string' || !DATE_RE.test(value) || !isCalendarDate(value)) {
+        errors.push(`${name}: "${value}" is not YYYY-MM-DD (a real calendar date)`);
+      }
+      break;
+    case 'enum':
+      if (!spec.values.includes(value)) {
+        errors.push(`${name}: "${value}" is not one of ${spec.values.join(' | ')}`);
+      }
+      break;
+    case 'links':
+      checkLinksField(value, errors);
+      break;
+    case 'paths':
+      // A non-empty list of install-relative source-path strings (compile's
+      // source_paths[], core-0017). The full DECLARED source set: trust is the MAX over
+      // it (H4), so an empty list has no set to derive trust from — fail closed here. The
+      // strings' raw-path validity + per-source trust are re-derived by the handler (it
+      // reads each source's ingest provenance), never trusted from the payload.
+      if (!Array.isArray(value)) {
+        errors.push(`${name}: must be a list of source paths`);
+      } else if (value.length === 0) {
+        errors.push(`${name}: must list at least one source path (trust is resolved over the declared set)`);
+      } else {
+        value.forEach((p, i) => {
+          if (typeof p !== 'string' || p.trim() === '') {
+            errors.push(`${name}[${i}]: must be a non-empty path string`);
+          } else if (isAbsolute(p) || p.split(/[\\/]/).includes('..')) {
+            // source_paths are PORTABLE install-relative raw paths (Q8). An absolute path
+            // (e.g. /Users/…/install/domains/…) would leak a machine-local path into
+            // provenance + the candidate event — exported, non-portable state. A `..`
+            // segment escapes the install. Reject both pre-event, fail-closed.
+            errors.push(
+              `${name}[${i}]: "${p}" must be an install-relative path (no leading "/" or ".." segments) — source paths are portable workspace-relative, never machine-absolute`,
+            );
+          }
+        });
+      }
+      break;
+    default:
+      errors.push(`${name}: schema kind "${spec.kind}" has no check (fail closed)`);
+  }
+}
+
+function validatePayload(type, schema, payload) {
+  const errors = [];
+  if (payload === null || typeof payload !== 'object' || Array.isArray(payload)) {
+    return ['payload must be a JSON object'];
+  }
+  const allowed = Object.keys(schema);
+  for (const k of Object.keys(payload)) {
+    if (!allowed.includes(k)) {
+      errors.push(`payload field "${k}" is not in the ${type} schema (allowed: ${allowed.join(', ')})`);
+    }
+  }
+  for (const [name, spec] of Object.entries(schema)) {
+    checkField(name, spec, payload[name], errors);
+  }
+  return errors;
+}
+
+// Copy payload links into frontmatter shape: rel + target always, forward only when
+// asserted — never propagate extra keys into the artifact.
+function fmLinks(links) {
+  return links.map(({ rel, target, forward }) =>
+    forward === true ? { rel, target, forward: true } : { rel, target },
+  );
+}
+
+// Frontmatter provenance.authored_by from the event actor vocabulary: the operator's
+// own invocation is a human-authored artifact; every agentic path is agent. (hybrid is
+// a compile-flow value; seed is vendor-shipped — neither originates here.)
+function authoredByFrom(actor) {
+  return actor === 'operator' ? 'human' : 'agent';
+}
+
+// Deterministic basenames must stay inside every filesystem's limits: a runaway title
+// slugifies into a >255-byte basename and fails ENAMETOOLONG *after* the requested
+// event. Fail closed in prepare (pre-event) instead — no silent truncation, which
+// would quietly change the deterministic path contract.
+const MAX_NAME_LENGTH = 120;
+
+function checkNameLength(name) {
+  if (name.length > MAX_NAME_LENGTH) {
+    return [`computed name "${name.slice(0, 40)}…" is ${name.length} chars (max ${MAX_NAME_LENGTH}) — supply a shorter slug`];
+  }
+  return [];
+}
+
+// --- The two reference actions (D3/D9/D12) -------------------------------------------
+
+const DECISION_CALIBRATION = [
+  'expected_outcome',
+  'success_signal',
+  'observation_source',
+  'review_prompt',
+  'review_date',
+  'confidence',
+];
+
+// `log_decision` — the new-file writer (auto-run). Deterministic path (D3): local day
+// (or payload `created`) + slugified title (or payload `slug`); frontmatter `name` is
+// the FULL basename `YYYY-MM-DD-{slug}` (the validator requires name == filename).
+// New-file: collisions fail closed — never overwrite an existing decision.
+const logDecision = {
+  permission: 'auto-run',
+  newFileOnly: true,
+  targetLayout: 'domains/{domain}/compiled/decisions/YYYY-MM-DD-{slug}.md',
+  schema: {
+    title: { kind: 'string', required: true, nonEmpty: true },
+    body: { kind: 'string' },
+    slug: { kind: 'slug' },
+    created: { kind: 'date' },
+    exposure: { kind: 'enum', values: ENUMS.exposure },
+    expected_outcome: { kind: 'string' },
+    success_signal: { kind: 'string' },
+    observation_source: { kind: 'string' },
+    review_prompt: { kind: 'string' },
+    review_date: { kind: 'date' },
+    confidence: { kind: 'enum', values: ENUMS.confidence },
+    links: { kind: 'links' },
+  },
+  prepare(payload, { domain, now }) {
+    const dateStamp = payload.created || localDateStamp(now);
+    const slug = payload.slug || slugify(payload.title);
+    if (!slug) {
+      return { errors: [`title "${payload.title}" yields an empty slug — supply a payload "slug"`] };
+    }
+    const name = `${dateStamp}-${slug}`;
+    const lengthErrors = checkNameLength(name);
+    if (lengthErrors.length) return { errors: lengthErrors };
+    return {
+      errors: [],
+      plan: { relPath: `domains/${domain}/compiled/decisions/${name}.md`, name, dateStamp },
+    };
+  },
+  async build({ payload, plan, domain, session, actor }) {
+    const fm = {
+      type: 'decision',
+      name: plan.name,
+      title: payload.title,
+      domain,
+      exposure: payload.exposure || 'private', // D9 — never auto-promote beyond private
+      created: plan.dateStamp,
+    };
+    for (const f of DECISION_CALIBRATION) {
+      if (payload[f] !== undefined) fm[f] = payload[f];
+    }
+    if (payload.links !== undefined) fm.links = fmLinks(payload.links);
+    fm.provenance = { origin_session_id: session, authored_by: authoredByFrom(actor) };
+    const body = payload.body ? `\n${String(payload.body).trim()}\n` : '';
+    return {
+      content: `${serializeFrontmatter(fm)}${body}`,
+      linksUpdated: payload.links ? payload.links.length : 0,
+      changesSummary: `logged decision "${payload.title}" → ${plan.relPath}`,
+    };
+  },
+};
+
+// `enrich_person` — the append-or-create writer. Auto-run when the person exists;
+// ask-once when new (the gate refuses creation without an approval signal).
+// Append = read existing (prior-conformance checked, E3 policy — uniform across every
+// existing-file path since core-0009) → append one D12 dated block →
+// stage→validate→rename; the prior bytes are preserved verbatim (frontmatter
+// untouched — create-only fields are refused on append, not silently dropped).
+const enrichPerson = {
+  permission: 'ask-once-if-new',
+  newFileOnly: false,
+  targetLayout: 'domains/{domain}/compiled/people/{name}.md',
+  schema: {
+    name: { kind: 'slug', required: true },
+    insight: { kind: 'string', required: true, nonEmpty: true },
+    title: { kind: 'string', nonEmpty: true },
+    date: { kind: 'date' },
+    exposure: { kind: 'enum', values: ENUMS.exposure },
+    links: { kind: 'links' },
+  },
+  prepare(payload, { domain, now }) {
+    const dateStamp = payload.date || localDateStamp(now);
+    const lengthErrors = checkNameLength(payload.name);
+    if (lengthErrors.length) return { errors: lengthErrors };
+    return {
+      errors: [],
+      plan: {
+        relPath: `domains/${domain}/compiled/people/${payload.name}.md`,
+        name: payload.name,
+        dateStamp,
+      },
+    };
+  },
+  async build({ payload, plan, domain, session, actor, installRoot, exists }) {
+    if (exists) {
+      const createOnly = ['title', 'exposure', 'links'].filter((f) => payload[f] !== undefined);
+      if (createOnly.length) {
+        throw new Error(
+          `enrich_person: ${createOnly.join(', ')} only apply when creating a new person — "${payload.name}" exists, and append preserves its frontmatter verbatim`,
+        );
+      }
+      const target = await readConformantTarget({
+        installRoot,
+        relPath: plan.relPath,
+        type: 'enrich_person',
+      });
+      return {
+        content: appendLogBlock(target.content, plan.dateStamp, payload.insight),
+        linksUpdated: 0,
+        changesSummary: `appended a ${plan.dateStamp} insight to person "${payload.name}"`,
+      };
+    }
+    if (!payload.title) {
+      throw new Error('enrich_person: creating a new person requires a "title" in the payload');
+    }
+    const fm = {
+      type: 'person',
+      name: payload.name,
+      title: payload.title,
+      domain,
+      exposure: payload.exposure || 'private',
+      created: plan.dateStamp,
+    };
+    if (payload.links !== undefined) fm.links = fmLinks(payload.links);
+    fm.provenance = { origin_session_id: session, authored_by: authoredByFrom(actor) };
+    return {
+      content: `${serializeFrontmatter(fm)}\n## Log\n\n${formatLogEntry(plan.dateStamp, payload.insight)}`,
+      linksUpdated: payload.links ? payload.links.length : 0,
+      changesSummary: `created person "${payload.name}" with a ${plan.dateStamp} insight`,
+    };
+  },
+};
+
+// --- The three single-file writers (core-0009; per-action decisions E1–E3) ------------
+
+// Read an EXISTING target and refuse to modify one that fails the contract independent
+// of this edit (E3's prior-conformance policy, applied to every read-modify-write path):
+// the staged whole-file validation would catch it anyway, but as a confusing schema
+// error on an edit that didn't cause it. Returns { content, fm, body } when conformant.
+async function readConformantTarget({ installRoot, relPath, type }) {
+  const content = await readFile(join(installRoot, relPath), 'utf8');
+  const errors = await checkObjectContent({ installRoot, relPath, content });
+  if (errors.length) {
+    throw new Error(
+      `${type}: target ${relPath} fails the ontology contract independent of this edit — run \`phronesis validate\`/migrate first (${errors.join('; ')})`,
+    );
+  }
+  const split = splitObjectSource(content);
+  // Unreachable after a green contract check (no frontmatter is a contract failure),
+  // kept as a guard so a future contract loosening cannot turn this into a crash.
+  if (!split) throw new Error(`${type}: target ${relPath} has no frontmatter block`);
+  return {
+    content,
+    fm: yaml.load(split.yamlSource, { schema: yaml.JSON_SCHEMA }),
+    body: split.body,
+  };
+}
+
+// `update_project_state` — the project append-or-create writer. UPDATE (the common
+// case) is auto-run: appends one dated D12 block, optionally updating the headline
+// frontmatter fields (`title`, `status`) by VALUE — the body, including the prior log,
+// is carried over verbatim (the D12 writer may trim trailing blank lines inside the
+// Log section before appending; everything else is byte-preserved). CREATE follows the
+// new-object ask-once rule (E1, uniform with enrich_person): refuse without an
+// approval signal. `exposure` and `links` are create-only — append never silently
+// rewrites the permission posture or the link graph. No `updated:` stamp in V1: the
+// dated block carries the date.
+const updateProjectState = {
+  permission: 'ask-once-if-new',
+  newFileOnly: false,
+  targetLayout: 'domains/{domain}/compiled/projects/{name}.md',
+  schema: {
+    name: { kind: 'slug', required: true },
+    update: { kind: 'string', required: true, nonEmpty: true },
+    title: { kind: 'string', nonEmpty: true },
+    status: { kind: 'enum', values: ENUMS.status },
+    date: { kind: 'date' },
+    exposure: { kind: 'enum', values: ENUMS.exposure },
+    links: { kind: 'links' },
+  },
+  prepare(payload, { domain, now }) {
+    const dateStamp = payload.date || localDateStamp(now);
+    const lengthErrors = checkNameLength(payload.name);
+    if (lengthErrors.length) return { errors: lengthErrors };
+    return {
+      errors: [],
+      plan: {
+        relPath: `domains/${domain}/compiled/projects/${payload.name}.md`,
+        name: payload.name,
+        dateStamp,
+      },
+    };
+  },
+  async build({ payload, plan, domain, session, actor, installRoot, exists }) {
+    if (exists) {
+      const createOnly = ['exposure', 'links'].filter((f) => payload[f] !== undefined);
+      if (createOnly.length) {
+        throw new Error(
+          `update_project_state: ${createOnly.join(', ')} only apply when creating a new project — "${payload.name}" exists, and updates never rewrite its permission posture or links`,
+        );
+      }
+      const target = await readConformantTarget({
+        installRoot,
+        relPath: plan.relPath,
+        type: 'update_project_state',
+      });
+      const headline = ['title', 'status'].filter((f) => payload[f] !== undefined);
+      let base = target.content;
+      if (headline.length) {
+        const fm = target.fm;
+        for (const f of headline) fm[f] = payload[f];
+        base = `${serializeFrontmatter(fm)}${target.body}`;
+      }
+      const set = headline.length ? ` and set ${headline.map((f) => `${f}: ${payload[f]}`).join(', ')}` : '';
+      return {
+        content: appendLogBlock(base, plan.dateStamp, payload.update),
+        linksUpdated: 0,
+        changesSummary: `appended a ${plan.dateStamp} update to project "${payload.name}"${set}`,
+      };
+    }
+    if (!payload.title) {
+      throw new Error('update_project_state: creating a new project requires a "title" in the payload');
+    }
+    const fm = {
+      type: 'project',
+      name: payload.name,
+      title: payload.title,
+      domain,
+      exposure: payload.exposure || 'private',
+      created: plan.dateStamp,
+    };
+    if (payload.status !== undefined) fm.status = payload.status;
+    if (payload.links !== undefined) fm.links = fmLinks(payload.links);
+    fm.provenance = { origin_session_id: session, authored_by: authoredByFrom(actor) };
+    return {
+      content: `${serializeFrontmatter(fm)}\n## Log\n\n${formatLogEntry(plan.dateStamp, payload.update)}`,
+      linksUpdated: payload.links ? payload.links.length : 0,
+      changesSummary: `created project "${payload.name}" with a ${plan.dateStamp} update`,
+    };
+  },
+};
+
+// `track_commitment` — the commitment new-file writer (auto-run). Mirrors log_decision:
+// deterministic dated path (D3), name == full basename, collision fails closed. `due`
+// is required and date-validated but NOT persisted into any index here (E2/D4): the
+// reminder that fires on its arrival is the daemon's `outcome.due`-style job (T4.1).
+const trackCommitment = {
+  permission: 'auto-run',
+  newFileOnly: true,
+  targetLayout: 'domains/{domain}/compiled/commitments/YYYY-MM-DD-{slug}.md',
+  schema: {
+    title: { kind: 'string', required: true, nonEmpty: true },
+    due: { kind: 'date', required: true },
+    body: { kind: 'string' },
+    slug: { kind: 'slug' },
+    created: { kind: 'date' },
+    exposure: { kind: 'enum', values: ENUMS.exposure },
+    links: { kind: 'links' },
+  },
+  prepare(payload, { domain, now }) {
+    const dateStamp = payload.created || localDateStamp(now);
+    const slug = payload.slug || slugify(payload.title);
+    if (!slug) {
+      return { errors: [`title "${payload.title}" yields an empty slug — supply a payload "slug"`] };
+    }
+    const name = `${dateStamp}-${slug}`;
+    const lengthErrors = checkNameLength(name);
+    if (lengthErrors.length) return { errors: lengthErrors };
+    return {
+      errors: [],
+      plan: { relPath: `domains/${domain}/compiled/commitments/${name}.md`, name, dateStamp },
+    };
+  },
+  async build({ payload, plan, domain, session, actor }) {
+    const fm = {
+      type: 'commitment',
+      name: plan.name,
+      title: payload.title,
+      domain,
+      exposure: payload.exposure || 'private',
+      created: plan.dateStamp,
+      due: payload.due,
+    };
+    if (payload.links !== undefined) fm.links = fmLinks(payload.links);
+    fm.provenance = { origin_session_id: session, authored_by: authoredByFrom(actor) };
+    const body = payload.body ? `\n${String(payload.body).trim()}\n` : '';
+    return {
+      content: `${serializeFrontmatter(fm)}${body}`,
+      linksUpdated: payload.links ? payload.links.length : 0,
+      changesSummary: `tracked commitment "${payload.title}" (due ${payload.due}) → ${plan.relPath}`,
+    };
+  },
+};
+
+// `record_outcome` — the read-modify-write of an EXISTING decision (E3; requires
+// operator approval, trust-scopes :24). Two-factor: the permission gate consumes the
+// approval signal (D5), and the build refuses without a non-empty operator-authored
+// `lesson` — BOTH refusals land after `action_type.requested`, so the denial leaves a
+// trail (D6). The target is a semantic input and lives in the payload. Writes exactly
+// three fields — `outcome_status`, `outcome_recorded` (stamped), `lesson` — preserving
+// the body byte-for-byte and every other frontmatter field by VALUE (the reserialize
+// may normalize formatting; the gate asserts value equality, E3).
+const recordOutcome = {
+  permission: 'requires-approval',
+  approvalFloor: true, // the code-resident floor (G4) — never read from the registry
+  newFileOnly: false,
+  targetLayout: 'domains/{domain}/compiled/decisions/{name}.md',
+  note: 'updates an existing decision in place',
+  schema: {
+    target: { kind: 'string', required: true, nonEmpty: true },
+    outcome_status: { kind: 'enum', values: ENUMS.outcome_status, required: true },
+    // Present-ness is the schema's concern; the NON-EMPTY check is the second approval
+    // factor and deliberately lives post-event in build (denials must leave a trail).
+    lesson: { kind: 'string' },
+  },
+  prepare(payload, { domain, now }) {
+    const prefix = 'decisions/';
+    const name = payload.target.startsWith(prefix) ? payload.target.slice(prefix.length) : null;
+    if (!name || !RE_SLUG.test(name)) {
+      return {
+        errors: [
+          `target "${payload.target}" must name a decision in the active domain as decisions/{name} (e.g. decisions/2026-01-10-adopt-seat-pricing)`,
+        ],
+      };
+    }
+    return {
+      errors: [],
+      // dateStamp is the outcome_recorded stamp (build gets no clock of its own — D7
+      // determinism flows through prepare's injectable `now`).
+      plan: { relPath: `domains/${domain}/compiled/decisions/${name}.md`, name, dateStamp: localDateStamp(now) },
+    };
+  },
+  async build({ payload, plan, installRoot, exists }) {
+    if (typeof payload.lesson !== 'string' || payload.lesson.trim() === '') {
+      throw new Error(
+        'record_outcome: a non-empty operator-authored "lesson" is required — the lesson is the operator\'s authoring act, the second approval factor',
+      );
+    }
+    if (!exists) {
+      throw new Error(
+        `record_outcome: ${plan.relPath} does not exist — record an outcome only on a logged decision`,
+      );
+    }
+    const target = await readConformantTarget({
+      installRoot,
+      relPath: plan.relPath,
+      type: 'record_outcome',
+    });
+    const fm = target.fm;
+    // Re-recording is a legitimate flow (pending → met; partial → reversed) but it
+    // REPLACES prior operator-authored canonical content — say so in the summary
+    // rather than letting the overwrite pass as a first recording.
+    const prior =
+      fm.outcome_status !== undefined || fm.lesson !== undefined
+        ? ` (replaced prior outcome "${fm.outcome_status ?? 'unset'}" and its lesson)`
+        : '';
+    fm.outcome_status = payload.outcome_status;
+    fm.outcome_recorded = plan.dateStamp;
+    fm.lesson = payload.lesson;
+    return {
+      content: `${serializeFrontmatter(fm)}${target.body}`,
+      linksUpdated: 0,
+      changesSummary: `recorded outcome "${payload.outcome_status}" on ${payload.target}${prior}`,
+    };
+  },
+};
+
+// --- promote_to_codex (core-0010; per-action decisions F1–F4) --------------------------
+
+const RE_FROM_SEED = new RegExp(`^${SLUG_SOURCE}(?:/${SLUG_SOURCE})?$`);
+
+// Resolve a from_seed reference to { collection, slug }. Explicit `{collection}/{slug}`
+// resolves directly; a bare slug is accepted when it matches exactly ONE seed
+// collection (the spec's bare-slug examples) and fails closed on collision (F3).
+async function resolveSeedRef({ installRoot, fromSeed }) {
+  if (fromSeed.includes('/')) {
+    const [collection, slug] = fromSeed.split('/');
+    return { collection, slug };
+  }
+  const seedRoot = join(installRoot, 'codex', 'seed');
+  let collections = [];
+  try {
+    collections = (await readdir(seedRoot, { withFileTypes: true }))
+      .filter((e) => e.isDirectory())
+      .map((e) => e.name);
+  } catch (err) {
+    // Only an ABSENT seed tree means "no collections"; an unreadable one is its own
+    // problem and must not masquerade as not-found.
+    if (err.code !== 'ENOENT') {
+      throw new Error(`promote_to_codex: could not read codex/seed/: ${err.message}`);
+    }
+    collections = [];
+  }
+  const matches = [];
+  for (const collection of collections) {
+    if (await fse.pathExists(join(seedRoot, collection, `${fromSeed}.md`))) {
+      matches.push(collection);
+    }
+  }
+  if (matches.length > 1) {
+    throw new Error(
+      `promote_to_codex: from_seed "${fromSeed}" is ambiguous — it exists in ${matches
+        .map((c) => `codex/seed/${c}/`)
+        .join(' and ')}; name it as {collection}/{slug}`,
+    );
+  }
+  if (matches.length === 0) {
+    throw new Error(
+      `promote_to_codex: from_seed "${fromSeed}" does not resolve to any codex/seed/{collection}/${fromSeed}.md`,
+    );
+  }
+  return { collection: matches[0], slug: fromSeed };
+}
+
+// F2 convergence is SEMANTIC, not byte-bound: the crash that leaves codex-without-
+// tombstone also destroys the session (and may cross midnight), so the recovery re-run
+// arrives with a different session id / day / rationale wording — its rebuilt bytes can
+// NEVER match. An existing destination counts as this promotion's committed first write
+// when it is a contract-valid codex-principle-personal whose provenance ties it to the
+// SAME source (the supersedes link on the insight path; adopted_from_seed on the seed
+// path). Anything else at the destination fails closed. (Found by the core-0010
+// adversarial review: byte-identity convergence only held for same-session replays.)
+async function isPriorPromotion({ installRoot, relPath, existing, sameSource }) {
+  if ((await checkObjectContent({ installRoot, relPath, content: existing })).length) return false;
+  const split = splitObjectSource(existing);
+  if (!split) return false;
+  const fm = yaml.load(split.yamlSource, { schema: yaml.JSON_SCHEMA });
+  if (!fm || fm.type !== 'codex-principle-personal') return false;
+  return sameSource(fm);
+}
+
+// `promote_to_codex` — the ONLY cross-layer write: domain insight (or shipped seed) →
+// installation-shared `codex/personal/`. Requires approval (Scope 1) AND an
+// operator-authored `rationale` (the second factor — no silent graduation); the
+// operator-authored path additionally requires an explicit `stance` (a judgment, no
+// silent default; the seed path defaults to `adopted` — adoption IS adoption, F3).
+//
+// F1 — tombstone, never delete (security.md: agents do not delete): the operator-
+// authored path writes the codex object AND marks the source insight
+// `status: superseded` + a `superseded-by` link; the source file remains. The seed
+// path never touches `codex/seed/` — read, never write.
+//
+// F2 — two-file transaction with all-or-nothing intent: both artifacts are staged and
+// validated before either commits; commits land codex-object-FIRST (the recoverable
+// direction). A death between the writes leaves codex-without-tombstone until a re-run,
+// which detects the identical codex object (no-op) and completes the tombstone — never
+// codex-without-tombstone permanently, never tombstone-without-codex.
+//
+// The codex object does NOT copy the source insight's links: an insight's bare-slug
+// targets resolve in ITS domain, and the codex is unaffiliated — a copied bare slug
+// could never resolve (the validator would refuse it). The promoted object carries one
+// `supersedes` link back to the full-path source instead; seed links (already valid
+// from codex context) copy by value.
+const promoteToCodex = {
+  permission: 'requires-approval',
+  approvalFloor: true, // the code-resident floor (G4) — never read from the registry
+  newFileOnly: false, // collision handled per-write: identical re-run converges (F2)
+  targetLayout: 'codex/personal/{slug}.md',
+  note: 'plus a source tombstone on the insight path',
+  schema: {
+    insight: { kind: 'slug' },
+    from_seed: { kind: 'string', nonEmpty: true },
+    // rationale and stance presence are the post-event second factors (checked in
+    // build, so the denial leaves a requested trail); the schema checks types only.
+    rationale: { kind: 'string' },
+    stance: { kind: 'enum', values: ENUMS.stance },
+    slug: { kind: 'slug' },
+  },
+  prepare(payload, { now }) {
+    const hasInsight = payload.insight !== undefined;
+    const hasSeed = payload.from_seed !== undefined;
+    if (hasInsight === hasSeed) {
+      return {
+        errors: [
+          'exactly one of "insight" (operator-authored path) or "from_seed" (adoption path) is required',
+        ],
+      };
+    }
+    if (hasSeed && !RE_FROM_SEED.test(payload.from_seed)) {
+      return {
+        errors: [
+          `from_seed "${payload.from_seed}" must be {collection}/{slug} (or a bare slug that resolves unambiguously)`,
+        ],
+      };
+    }
+    const slug =
+      payload.slug || (hasInsight ? payload.insight : payload.from_seed.split('/').pop());
+    const lengthErrors = checkNameLength(slug);
+    if (lengthErrors.length) return { errors: lengthErrors };
+    return {
+      errors: [],
+      plan: {
+        relPath: `codex/personal/${slug}.md`,
+        name: slug,
+        dateStamp: localDateStamp(now),
+      },
+    };
+  },
+  async build({ payload, plan, domain, session, actor, installRoot }) {
+    if (typeof payload.rationale !== 'string' || payload.rationale.trim() === '') {
+      throw new Error(
+        'promote_to_codex: a non-empty operator-authored "rationale" is required — no silent graduation into the codex',
+      );
+    }
+
+    if (payload.insight !== undefined) {
+      // --- Operator-authored path: codex object + source tombstone (two writes, F2).
+      if (payload.stance === undefined) {
+        throw new Error(
+          `promote_to_codex: promoting your own insight requires an explicit "stance" (${ENUMS.stance.join(' | ')}) — a judgment, not a default`,
+        );
+      }
+      const srcRel = `domains/${domain}/compiled/insights/${payload.insight}.md`;
+      if (!(await fse.pathExists(join(installRoot, srcRel)))) {
+        throw new Error(
+          `promote_to_codex: ${srcRel} does not exist — promote an insight that is compiled in the active domain`,
+        );
+      }
+      const src = await readConformantTarget({
+        installRoot,
+        relPath: srcRel,
+        type: 'promote_to_codex',
+      });
+
+      // Only an ACTIVE insight — or the exact re-run of THIS promotion — may proceed.
+      // Superseded-without-a-link, superseded-by-something-else, and archived all
+      // refuse: promoting them would silently rewrite a status the operator (or a
+      // prior promotion) already set.
+      const codexTarget = `codex/personal/${plan.name}`;
+      const supersededBy = (src.fm.links || []).filter((l) => l && l.rel === 'superseded-by');
+      const foreign = supersededBy.filter((l) => l.target !== codexTarget);
+      const tombstonedByThisPromotion =
+        src.fm.status === 'superseded' && supersededBy.length > 0 && foreign.length === 0;
+      const active = src.fm.status === undefined || src.fm.status === 'active';
+      if (!active && !tombstonedByThisPromotion) {
+        throw new Error(
+          `promote_to_codex: ${srcRel} has status "${src.fm.status}"${
+            foreign.length ? ` and is superseded by "${foreign[0].target}"` : ''
+          } — only an active insight (or a re-run of this exact promotion) can be promoted`,
+        );
+      }
+
+      const codexFm = {
+        type: 'codex-principle-personal',
+        name: plan.name,
+        title: src.fm.title,
+        exposure: 'private', // D9 — codex principles start private
+        created: plan.dateStamp,
+        stance: payload.stance,
+        links: [{ rel: 'supersedes', target: srcRel }],
+        provenance: { origin_session_id: session, authored_by: authoredByFrom(actor) },
+      };
+      const codexContent = appendLogBlock(
+        `${serializeFrontmatter(codexFm)}${src.body}`,
+        plan.dateStamp,
+        `Promoted from ${srcRel}. Rationale: ${payload.rationale.trim()}`,
+      );
+
+      // Semantic convergence (F2): an existing destination that IS a prior promotion
+      // of this source counts as the committed first write; anything else fails closed.
+      let codexCommitted = false;
+      const codexAbs = join(installRoot, plan.relPath);
+      if (await fse.pathExists(codexAbs)) {
+        const existing = await readFile(codexAbs, 'utf8');
+        codexCommitted =
+          existing === codexContent ||
+          (await isPriorPromotion({
+            installRoot,
+            relPath: plan.relPath,
+            existing,
+            sameSource: (fm) =>
+              (fm.links || []).some((l) => l && l.rel === 'supersedes' && l.target === srcRel),
+          }));
+        if (!codexCommitted) {
+          throw new Error(
+            `promote_to_codex: ${plan.relPath} already exists and is not a prior promotion of ${srcRel} — fail closed (resolve the destination out-of-band)`,
+          );
+        }
+      }
+
+      const tombFm = { ...src.fm }; // shallow clone — never mutate the parsed source
+      tombFm.status = 'superseded';
+      const alreadyLinked = supersededBy.some((l) => l.target === codexTarget);
+      if (!alreadyLinked) {
+        tombFm.links = [...(tombFm.links || []), { rel: 'superseded-by', target: codexTarget }];
+      }
+      const tombContent = `${serializeFrontmatter(tombFm)}${src.body}`;
+
+      // Write only what this run actually changes; count only the edges it adds.
+      const writes = [];
+      let linksUpdated = 0;
+      if (!codexCommitted) {
+        // Codex object FIRST — the recoverable direction (F2). skipIfIdentical stays
+        // as the race-window backstop.
+        writes.push({ relPath: plan.relPath, content: codexContent, overwrite: false, skipIfIdentical: true });
+        linksUpdated += 1; // the supersedes edge
+      }
+      if (tombContent !== src.content) {
+        writes.push({ relPath: srcRel, content: tombContent, overwrite: true });
+        if (!alreadyLinked) linksUpdated += 1; // the superseded-by edge
+      }
+      const noOp = writes.length === 0;
+      const changesSummary = noOp
+        ? `insight "${payload.insight}" is already promoted to ${plan.relPath} — no changes (idempotent re-run)`
+        : codexCommitted
+          ? `completed the promotion of insight "${payload.insight}" → ${plan.relPath} (codex object from a prior run; source tombstoned, not deleted)`
+          : `promoted insight "${payload.insight}" → ${plan.relPath} (source tombstoned, not deleted)`;
+      return { writes, noOp, linksUpdated, changesSummary };
+    }
+
+    // --- Adoption-from-seed path: ONE write; codex/seed/ is immutable — read, never write.
+    const { collection, slug: seedSlug } = await resolveSeedRef({
+      installRoot,
+      fromSeed: payload.from_seed,
+    });
+    const seedRel = `codex/seed/${collection}/${seedSlug}.md`;
+    if (!(await fse.pathExists(join(installRoot, seedRel)))) {
+      throw new Error(`promote_to_codex: ${seedRel} does not exist`);
+    }
+    const seed = await readConformantTarget({
+      installRoot,
+      relPath: seedRel,
+      type: 'promote_to_codex',
+    });
+
+    const codexFm = {
+      type: 'codex-principle-personal',
+      name: plan.name,
+      title: seed.fm.title,
+      exposure: 'private',
+      created: plan.dateStamp,
+      stance: payload.stance || 'adopted', // F3 — adoption IS adoption; override-able
+    };
+    if (seed.fm.links !== undefined) codexFm.links = seed.fm.links;
+    codexFm.provenance = {
+      origin_session_id: session,
+      authored_by: authoredByFrom(actor),
+      adopted_from_seed: `${collection}/${seedSlug}`,
+    };
+    const codexContent = appendLogBlock(
+      `${serializeFrontmatter(codexFm)}${seed.body}`,
+      plan.dateStamp,
+      `Adopted from ${seedRel}. Rationale: ${payload.rationale.trim()}`,
+    );
+
+    // Same semantic convergence as the insight path: a destination that is already
+    // THIS seed's adoption is a no-op re-run, anything else fails closed. (Adopting
+    // the same seed under an explicit DIFFERENT slug is permitted — an operator
+    // choice made with approval; surfacing duplicate adoptions is lint's job, T5.3.)
+    const codexAbs = join(installRoot, plan.relPath);
+    if (await fse.pathExists(codexAbs)) {
+      const existing = await readFile(codexAbs, 'utf8');
+      const adopted =
+        existing === codexContent ||
+        (await isPriorPromotion({
+          installRoot,
+          relPath: plan.relPath,
+          existing,
+          sameSource: (fm) =>
+            fm.provenance && fm.provenance.adopted_from_seed === `${collection}/${seedSlug}`,
+        }));
+      if (!adopted) {
+        throw new Error(
+          `promote_to_codex: ${plan.relPath} already exists and is not an adoption of ${seedRel} — fail closed (resolve the destination out-of-band)`,
+        );
+      }
+      return {
+        writes: [],
+        noOp: true,
+        linksUpdated: 0,
+        changesSummary: `seed "${collection}/${seedSlug}" is already adopted at ${plan.relPath} — no changes (idempotent re-run)`,
+      };
+    }
+
+    return {
+      writes: [
+        { relPath: plan.relPath, content: codexContent, overwrite: false, skipIfIdentical: true },
+      ],
+      linksUpdated: seed.fm.links ? seed.fm.links.length : 0,
+      changesSummary: `adopted seed "${collection}/${seedSlug}" → ${plan.relPath} (seed untouched)`,
+    };
+  },
+};
+
+// --- compile (core-0017 / T5.1; the flagship agentic quality-gate writer) -------------
+//
+// The 7th action type — the only one whose CONTENT is model-judged (by the skill,
+// skills/compile/SKILL.md) but whose COMMIT stays deterministic (this handler, H1). It
+// writes the two synthesis primitives `insight` + `organization` (H2) and routes by
+// trust: a run over trusted sources auto-writes canonical compiled/ state; a run touching
+// ANY untrusted source drafts the WHOLE run to .phronesis/drafts/ and ends at
+// compile.candidate, awaiting operator accept/reject (H3/H4; specs/security.md
+// untrusted-content isolation). It is append-or-create (H8): a new object is created; an
+// existing one gets a dated ## Log entry + an idempotent evidence-link append (the
+// link-append mode no other writer has — an insight's enriched-by set IS its provenance
+// and grows per source). Agency lives in the SKILL; the handler is the enforcement that
+// degrades away (change 0013): on return, raw/degraded/ captures reconcile through it.
+
+// H4 #1 — trust is RE-DERIVED, never payload-claimed. A source is `trusted` only when an
+// in-install, readable raw file carries provenance `trust_tier: trusted`; everything else
+// (missing file, no frontmatter, no/non-`trusted` trust_tier, a non-raw path, a path that
+// escapes the install) is `untrusted` — the security.md "everything else is untrusted"
+// default, fail-closed. An escaping or non-raw path is classified untrusted and never read.
+async function deriveSourceTrust(installRoot, sourcePath) {
+  const abs = resolve(installRoot, sourcePath);
+  const rel = relative(installRoot, abs);
+  if (rel === '' || rel.startsWith('..')) return 'untrusted';
+  if (classifyTarget(rel).form !== 'raw-source') return 'untrusted';
+  let content;
+  try {
+    content = await readFile(abs, 'utf8');
+  } catch {
+    return 'untrusted';
+  }
+  const split = splitObjectSource(content);
+  if (!split) return 'untrusted';
+  let fm;
+  try {
+    fm = yaml.load(split.yamlSource, { schema: yaml.JSON_SCHEMA });
+  } catch {
+    return 'untrusted';
+  }
+  return fm && typeof fm === 'object' && !Array.isArray(fm) && fm.trust_tier === 'trusted'
+    ? 'trusted'
+    : 'untrusted';
+}
+
+// Trust over the FULL declared set (H4): the MAX where untrusted dominates — any untrusted
+// source drafts the whole run. (Residual: an agent that UNDER-declares its sources is
+// outside the handler's deterministic reach; the Rule of Two — external action + codex
+// promotion independently human-gated — is the backstop. A deterministic manifest-vs-ingest
+// cross-check is deferred to V1.5, which has the connector audit stream.)
+async function resolveRunTrust(installRoot, sourcePaths) {
+  for (const sp of sourcePaths) {
+    if ((await deriveSourceTrust(installRoot, sp)) === 'untrusted') return 'untrusted';
+  }
+  return 'trusted';
+}
+
+function compileProvenance({ session, actor, sourcePaths, suspicious }) {
+  const prov = { origin_session_id: session, authored_by: authoredByFrom(actor) };
+  if (sourcePaths && sourcePaths.length) prov.source_paths = [...sourcePaths];
+  // suspicious_payload (Q6 — a reason string: the richer signal for T7.5's batch
+  // pull-out; presence is the flag, so it degrades identically to a bool). No contract
+  // change needed — the validator checks provenance.authored_by only and tolerates extra
+  // subfields (promote_to_codex already stamps provenance.adopted_from_seed).
+  if (suspicious !== undefined) prov.suspicious_payload = suspicious;
+  return prov;
+}
+
+// Idempotent evidence-link append (H8): add each ABSENT payload link to frontmatter `links`
+// — never rewrite or remove an existing edge (rel+target identity). Returns
+// { content, added }. The deliberate divergence from update_project_state/enrich_person
+// (which refuse links on append): an insight's links are provenance that grows per source.
+function appendLinksIfAbsent(target, payloadLinks) {
+  if (!payloadLinks || payloadLinks.length === 0) return { content: target.content, added: 0 };
+  const existing = Array.isArray(target.fm.links) ? target.fm.links : [];
+  const present = (l) => existing.some((e) => e && e.rel === l.rel && e.target === l.target);
+  const toAdd = fmLinks(payloadLinks).filter((l) => !present(l));
+  if (toAdd.length === 0) return { content: target.content, added: 0 };
+  const fm = { ...target.fm, links: [...existing, ...toAdd] };
+  return { content: `${serializeFrontmatter(fm)}${target.body}`, added: toAdd.length };
+}
+
+const compile = {
+  permission: 'auto-run', // the lattice value; the untrusted→draft TRUST gate is
+  // code-resident write-routing (H6), not a permission value — the two compose: the
+  // permission gate admits the call, the trust gate routes the write.
+  newFileOnly: false, // append-or-create (H8)
+  targetLayoutByObjectType: {
+    insight: `domains/{domain}/compiled/${TYPE_DIR.insight}/{name}.md`,
+    organization: `domains/{domain}/compiled/${TYPE_DIR.organization}/{name}.md`,
+  },
+  note: 'agentic quality-gate writer for insight + organization (trusted→canonical, untrusted→draft)',
+  schema: {
+    object_type: { kind: 'enum', values: ['insight', 'organization'], required: true },
+    name: { kind: 'slug', required: true },
+    // title is create-only (H8): required when creating, refused on append — so it is
+    // OPTIONAL in the schema (an update omits it) and required-on-create in build, exactly
+    // like enrich_person's title. Schema-requiring it would reject every legitimate update.
+    title: { kind: 'string', nonEmpty: true },
+    body: { kind: 'string', required: true, nonEmpty: true },
+    source_paths: { kind: 'paths', required: true },
+    links: { kind: 'links' },
+    exposure: { kind: 'enum', values: ENUMS.exposure },
+    suspicious_payload: { kind: 'string', nonEmpty: true },
+  },
+  async prepare(payload, { domain, now, installRoot }) {
+    const typeDir = TYPE_DIR[payload.object_type];
+    // object_type is enum-validated upstream, but only insight/organization have a
+    // compile type-dir; guard fail-closed against a future enum/handler drift.
+    if (payload.object_type !== 'insight' && payload.object_type !== 'organization') {
+      return { errors: [`compile writes insight | organization only, not "${payload.object_type}"`] };
+    }
+    const lengthErrors = checkNameLength(payload.name);
+    if (lengthErrors.length) return { errors: lengthErrors };
+    const trust = await resolveRunTrust(installRoot, payload.source_paths);
+    return {
+      errors: [],
+      plan: {
+        // The CANONICAL path is plan.relPath: the layout check, the exists/permission
+        // gate, and (on the trusted path) the write all key on it. draftRelPath is where
+        // untrusted bytes land — validated AS the canonical shape (H3's path split).
+        relPath: `domains/${domain}/compiled/${typeDir}/${payload.name}.md`,
+        draftRelPath: `.phronesis/drafts/${domain}/${typeDir}/${payload.name}.md`,
+        name: payload.name,
+        objectType: payload.object_type,
+        dateStamp: localDateStamp(now),
+        trust,
+      },
+    };
+  },
+  async build({ payload, plan, domain, session, actor, installRoot, exists }) {
+    const drafting = plan.trust === 'untrusted';
+    // suspicious_payload is an agent-lifted reason string from instruction-shaped UNTRUSTED
+    // content — cap it before it reaches durable state (frontmatter on create, the
+    // compile.candidate event on draft). Operator-facing by design (security.md:46/:52), so
+    // a length cap, not redaction; capping at the source covers both sinks.
+    const suspicious =
+      typeof payload.suspicious_payload === 'string'
+        ? payload.suspicious_payload.slice(0, 500)
+        : payload.suspicious_payload;
+    const draftResult = (content, linksUpdated, verb) => ({
+      content,
+      draft: {
+        writeRelPath: plan.draftRelPath,
+        sourcePaths: [...payload.source_paths],
+        links: payload.links ? fmLinks(payload.links) : [],
+        ...(suspicious !== undefined ? { suspicious } : {}),
+      },
+      linksUpdated,
+      changesSummary: `compile: drafted ${verb} ${plan.objectType} "${payload.name}" (untrusted source — pending operator review) → ${plan.draftRelPath}`,
+    });
+
+    if (exists) {
+      // --- UPDATE (append-or-create existing path, H8) ---
+      const createOnly = ['title', 'exposure'].filter((f) => payload[f] !== undefined);
+      if (createOnly.length) {
+        throw new Error(
+          `compile: ${createOnly.join(', ')} only apply when creating a new ${plan.objectType} — "${payload.name}" exists; an update appends a dated ## Log entry + idempotent evidence links and never rewrites the headline or exposure`,
+        );
+      }
+      const tgt = await readConformantTarget({ installRoot, relPath: plan.relPath, type: 'compile' });
+      const linkRes = appendLinksIfAbsent(tgt, payload.links);
+      let next = linkRes.content;
+      const entry = formatLogEntry(plan.dateStamp, payload.body);
+      // Idempotent ## Log append: a byte-identical entry already present (a same-day
+      // re-run) is NOT re-added — this is what makes a byte-identical re-compile a no-op
+      // while a materially-new payload (a different entry body) appends a dated block.
+      if (!next.includes(entry)) next = appendLogBlock(next, plan.dateStamp, payload.body);
+
+      if (drafting) {
+        // Untrusted update → a draft of the UPDATED object (existing bytes + new entry +
+        // new links), canonical untouched until accept. An identical re-draft converges
+        // by re-staging + re-firing compile.candidate (no canonical change either way).
+        // suspicious_payload rides the compile.candidate event (the durable review-surface
+        // record per security.md:52) — on the update path the existing object's frontmatter
+        // provenance is carried over verbatim (H8), so the flag is review-time here, not
+        // re-stamped into provenance the way the create path does.
+        return draftResult(next, linkRes.added, 'an update to');
+      }
+      if (next === tgt.content) {
+        // H8 — byte-identical re-compile: a full no-op (requested + committed{no_op:true},
+        // no file write), the promote_to_codex convergence pattern.
+        return {
+          writes: [],
+          noOp: true,
+          linksUpdated: 0,
+          changesSummary: `compile: ${plan.objectType} "${payload.name}" is unchanged from this source — no-op (idempotent re-run)`,
+        };
+      }
+      return {
+        content: next,
+        linksUpdated: linkRes.added,
+        changesSummary: `compile: updated ${plan.objectType} "${payload.name}"${
+          linkRes.added ? ` (+${linkRes.added} evidence link${linkRes.added === 1 ? '' : 's'})` : ' (changelog)'
+        } → ${plan.relPath}`,
+      };
+    }
+
+    // --- CREATE (the spokes→hub model: links + exposure set at creation, H7/H8) ---
+    if (!payload.title) {
+      throw new Error(`compile: creating a new ${plan.objectType} requires a "title" in the payload`);
+    }
+    const fm = {
+      type: plan.objectType,
+      name: plan.name,
+      title: payload.title,
+      domain,
+      exposure: payload.exposure || 'private', // H7 — trusted auto-write is private only
+      created: plan.dateStamp,
+    };
+    if (payload.links !== undefined) fm.links = fmLinks(payload.links);
+    fm.provenance = compileProvenance({ session, actor, sourcePaths: payload.source_paths, suspicious });
+    const content = `${serializeFrontmatter(fm)}\n## Log\n\n${formatLogEntry(plan.dateStamp, payload.body)}`;
+    const linksUpdated = payload.links ? payload.links.length : 0;
+    if (drafting) return draftResult(content, linksUpdated, 'a new');
+    return {
+      content,
+      linksUpdated,
+      changesSummary: `compile: created ${plan.objectType} "${payload.name}" → ${plan.relPath}`,
+    };
+  },
+};
+
+// --- The code table (core-0011 externalized schema/permission/layout to the install
+// registry; this table is the trusted baseline it is validated against) --------------
+//
+// All 7 V1 action types are REGISTERED (name → permission default + target layout) and
+// all 7 carry handlers — the core-0008 reference pair, the core-0009 single-file writers,
+// core-0010's promote_to_codex, and core-0017's compile (the agentic quality-gate writer;
+// its target is the per-object_type map, H2b). Permission defaults are
+// specs/trust-scopes.md §Scope 1 (update_project_state's
+// create-missing branch is ask-once per E1, uniform with enrich_person — the
+// table's auto-run row is the update-existing common case).
+//
+// Since core-0011 (T2.4) the operator-facing registration lives in the install's
+// `.phronesis/registry.json` `action_types` section: runAction resolves the EFFECTIVE
+// schema / permission / targetLayout from it per call (action-registry.js holds the
+// lattice: permission floor via `approvalFloor`, tighten-only schemas, fixed layouts).
+// This table stays the code-resident floor + handler source the section is generated
+// from and validated against. `targetLayout` is checked contract: prepare()'s computed
+// relPath must match it (the run-time layoutPattern check), and a registry layout that
+// differs from it fails closed at load.
+//
+// Concurrency assumption: ONE writer per installation at a time (the V1 reality — one
+// operator, one session). Two simultaneous appends to the same object are last-write-
+// wins; serialization is the daemon's job (T4.1) when multi-caller surfaces arrive.
+export const ACTION_REGISTRY = {
+  log_decision: logDecision,
+  enrich_person: enrichPerson,
+  update_project_state: updateProjectState,
+  track_commitment: trackCommitment,
+  record_outcome: recordOutcome,
+  promote_to_codex: promoteToCodex,
+  compile,
+};
+
+export function listActionTypes() {
+  return Object.keys(ACTION_REGISTRY);
+}
+
+// The scaffold's action_types section (apps/cli registryJson consumes this) and the
+// per-install effective-table resolver, both bound to the code table — adapters and
+// the `registry status` surface never pass the table themselves.
+export function defaultActionTypesSection() {
+  return buildActionTypesSection(ACTION_REGISTRY);
+}
+
+export function resolveActionTypes(registry) {
+  return resolveActionTypesAgainst({ registry, codeTable: ACTION_REGISTRY });
+}
+
+// --- Permission gate (D5 — detective; specs/trust-scopes.md Scope 1) ------------------
+
+export function permissionGate(permission, { exists = false, approvalSource } = {}) {
+  const signal = typeof approvalSource === 'string' && approvalSource.trim() !== '';
+  if (permission === 'auto-run') return { allowed: true, gated: false };
+  if (permission === 'ask-once-if-new') {
+    if (exists) return { allowed: true, gated: false };
+    if (signal) return { allowed: true, gated: true };
+    return {
+      allowed: false,
+      reason:
+        'creating a NEW file is approval-gated (ask-once) — no approval signal present. An approving adapter sets PHRONESIS_APPROVAL_SOURCE (T3.2 porcelain is the legitimate setter).',
+    };
+  }
+  if (permission === 'requires-approval') {
+    if (signal) return { allowed: true, gated: true };
+    return { allowed: false, reason: 'requires operator approval — no approval signal present.' };
+  }
+  return { allowed: false, reason: `permission "${permission}" has no gate rule (fail closed).` };
+}
+
+// --- Execution-context resolution (D10) -----------------------------------------------
+
+// Resolve the active domain: explicit ctx.domain, else the domains/{slug}/ the cwd sits
+// in, else DEFAULT_DOMAIN — and the resolved slug MUST be in the install registry. An
+// unregistered domain refuses; an action must never conjure a phantom domains/{slug}/
+// tree as a side effect (the event-log --dir fail-closed lesson, applied to domains).
+// The registry is read ONCE per runAction (it also carries action_types since T2.4)
+// and passed in parsed. EXPORTED since core-0014: the retrieval surface (search.js)
+// resolves its default scope through this exact function — one resolver, two consumers
+// (the rules.md shared-matcher class applied to domain resolution; a re-typed sibling
+// would drift on the registered-domain refusal).
+export function resolveDomain({ installRoot, registry, domain, cwd }) {
+  let slug = domain;
+  if (!slug && cwd) {
+    const parts = relative(installRoot, resolve(cwd)).split(sep);
+    if (parts[0] === 'domains' && parts[1]) slug = parts[1];
+  }
+  if (!slug) slug = DEFAULT_DOMAIN;
+
+  const registered = Array.isArray(registry.domains) ? registry.domains : [];
+  if (!registered.includes(slug)) {
+    throw new Error(
+      `domain "${slug}" is not registered in this installation (registered: ${registered.join(', ') || 'none'}). Refusing — actions never create a domain as a side effect.`,
+    );
+  }
+  return slug;
+}
+
+// --- runAction — the one shared path ---------------------------------------------------
+
+// ctx (execution context — everything that is NOT action semantics):
+//   dir              explicit install dir (marker-checked; optional)
+//   cwd              where the caller runs (install/domain discovery; default process.cwd())
+//   session          REQUIRED — session_id on both events
+//   domain           explicit domain slug (else cwd-derived, else DEFAULT_DOMAIN; D10)
+//   actor / surface  event identity (defaults: agent / cli, like `event emit`)
+//   invocation_id    attribution provenance supplied by a skill adapter or controlled
+//                    harness; caller-controlled metadata, never authority
+//   approvalSource   the adapter-set approval signal (D5); recorded verbatim when gated
+//   now              injectable clock for deterministic tests (D7 equivalence)
+export async function runAction({ type, payload = {}, ctx = {} } = {}) {
+  // 1 — registration + execution context + payload schema: fail closed BEFORE any event.
+  // Own-property check, never a truthy prototype-chain lookup: `act constructor`
+  // must be an unknown type, not Object.prototype.constructor wearing a trench coat.
+  if (!Object.hasOwn(ACTION_REGISTRY, type)) {
+    throw new Error(`unknown action type "${type}" — registered: ${listActionTypes().join(', ')}`);
+  }
+
+  const installed = resolveInstall({ dir: ctx.dir, cwd: ctx.cwd });
+  if (installed.error) throw new Error(installed.error);
+  const installRoot = installed.root;
+
+  const session = ctx.session;
+  if (typeof session !== 'string' || session === '') {
+    throw new Error('execution context: session is required (a non-empty session id).');
+  }
+  const actor = ctx.actor || 'agent';
+  const surface = ctx.surface || 'cli';
+  const invocationId =
+    typeof ctx.invocation_id === 'string' && ctx.invocation_id.trim() !== ''
+      ? ctx.invocation_id
+      : undefined;
+  const now = ctx.now || new Date();
+
+  // invocation_id is execution-context provenance, not action semantics. A model can
+  // place arbitrary JSON in payload, so discard a payload-supplied value before schema
+  // validation, planning, event logging, or writing. The adapter/harness context is the
+  // only source the core ever stamps; it remains provenance, not proof.
+  let actionPayload = payload;
+  if (payload !== null && typeof payload === 'object' && !Array.isArray(payload)) {
+    actionPayload = { ...payload };
+    delete actionPayload.invocation_id;
+  }
+
+  let registry;
+  try {
+    registry = await fse.readJson(join(installRoot, '.phronesis', 'registry.json'));
+  } catch (err) {
+    throw new Error(`could not read the install registry (.phronesis/registry.json): ${err.message}`);
+  }
+
+  // T2.4 — the EFFECTIVE table for this install: registry schema/permission/layout
+  // over the code handlers, validated against the code-resident floor (G3–G6). An
+  // invalid section disables the whole action layer (all-or-nothing, fail closed);
+  // an absent one means the compiled defaults. A type whose entry was removed from
+  // a present section is unregistered here and refuses.
+  const resolved = resolveActionTypes(registry);
+  if (resolved.errors.length) {
+    throw new Error(
+      `invalid .phronesis/registry.json (action-type registry) — the action layer is disabled until it is fixed (run \`phronesis registry status\`; removing the action_types section restores built-in defaults): ${resolved.errors.join('; ')}`,
+    );
+  }
+  // The V1 hook executor's subscriptions load with the same all-or-nothing policy
+  // (core-0013 H1): an invalid hooks section disables the action layer — the pipeline
+  // cannot honor a contract it cannot parse. An ABSENT section means no hooks.
+  const hookRes = resolveHooks(registry);
+  if (hookRes.errors.length) {
+    throw new Error(
+      `invalid .phronesis/registry.json (hooks) — the action layer is disabled until it is fixed (run \`phronesis registry status\`; an absent hooks section means no registered hooks): ${hookRes.errors.join('; ')}`,
+    );
+  }
+
+  const effective = resolved.effective[type];
+  if (!effective) {
+    throw new Error(
+      `"${type}" is not registered in this installation's action_types (.phronesis/registry.json) — registered: ${Object.keys(resolved.effective).join(', ') || 'none'}.`,
+    );
+  }
+  // Deferral/relocation refusals fire AFTER the effective-table lookup, so the table
+  // is authoritative: an install that unregistered `compile` hears "not registered"
+  // — the same answer `registry status` gives — never a stale "registered, but
+  // deferred" from the code table alone.
+  if (effective.deferredTo) {
+    throw new Error(
+      `"${type}" is registered, but its handler is deferred to ${effective.deferredTo} (the agentic quality-gate action) — not runnable yet.`,
+    );
+  }
+  if (effective.implementedIn) {
+    throw new Error(
+      `"${type}" is registered, but its handler lands in ${effective.implementedIn} — not runnable yet (fail closed).`,
+    );
+  }
+
+  const domain = resolveDomain({ installRoot, registry, domain: ctx.domain, cwd: ctx.cwd });
+
+  const schemaErrors = validatePayload(type, effective.schema, actionPayload);
+  if (schemaErrors.length) {
+    throw new Error(`invalid ${type} payload: ${schemaErrors.join('; ')}`);
+  }
+  // prepare may be async (compile re-derives source trust from disk, core-0017 H4);
+  // await passes a plain object straight through, so the six sync handlers are unchanged.
+  // installRoot is in the ctx so a handler that reads provenance to PLAN (compile's trust
+  // routing) can — reading a source's trust is gating, not judging its content (H1/Q8).
+  const prepared = await effective.prepare(actionPayload, { domain, now, installRoot });
+  if (prepared.errors.length) {
+    throw new Error(`invalid ${type} payload: ${prepared.errors.join('; ')}`);
+  }
+  const { plan } = prepared;
+
+  // G6 — the registered layout is checked contract, not decoration: the computed
+  // PRIMARY target must sit inside it, failing closed BEFORE it becomes a proposal.
+  // Scope: this covers plan.relPath only — a multi-write transaction's secondary
+  // writes (promote_to_codex's tombstone) are constrained by the staged ontology
+  // validation, not by this pattern. compile (H2b) checks the canonical relPath against
+  // the layout for ITS object_type — discriminator bound to path, so a mismatch fails
+  // closed (the canonical path is what the trusted write AND the draft validate against).
+  const layoutForType = effective.targetLayoutByObjectType
+    ? effective.targetLayoutByObjectType[plan.objectType]
+    : effective.targetLayout;
+  if (!layoutForType || !layoutPattern(layoutForType, { domain }).test(plan.relPath)) {
+    throw new Error(
+      `${type}: computed target ${plan.relPath} escapes the registered layout ${layoutForType || effective.targetLayout || '(none for object_type)'} — fail closed`,
+    );
+  }
+
+  // 2 — the call is well-formed: it is now a PROPOSAL, audited before the gate (D6) so
+  // a denial still leaves a trail.
+  const requestedEvent = await appendEvent({
+    installRoot,
+    type: 'action_type.requested',
+    session_id: session,
+    actor,
+    surface,
+    payload: { action_type: type, params: actionPayload, ...(invocationId ? { invocation_id: invocationId } : {}) },
+    now,
+  });
+
+  // 3 — permission gate (D5). Refusal: non-zero, no committed, requested already logged.
+  const exists = await fse.pathExists(join(installRoot, plan.relPath));
+  const gate = permissionGate(effective.permission, { exists, approvalSource: ctx.approvalSource });
+  if (!gate.allowed) {
+    throw new Error(`${type} refused: ${gate.reason}`);
+  }
+
+  // 3b — exposure escalation gate. Ontology: exposure is the primary permission posture
+  // and "the agent never auto-promotes beyond private" — so a payload-supplied exposure
+  // above the private default is an opt-UP and consumes the same approval signal the
+  // permission gate does (D9 read fail-closed; refusal is audited like any denial).
+  // EXCEPTION (core-0017 H7): on compile's untrusted DRAFT path the exposure is a
+  // SUGGESTION surfaced at draft review, not a canonical escalation — operator approval
+  // happens at accept (acceptance IS the approval). So only the canonical write paths
+  // consume the gate here; a draft carries its suggested exposure to review.
+  const signal = typeof ctx.approvalSource === 'string' && ctx.approvalSource.trim() !== '';
+  const drafting = plan.trust === 'untrusted'; // compile-only; undefined ⇒ false elsewhere
+  const exposureGated = typeof actionPayload.exposure === 'string' && actionPayload.exposure !== 'private';
+  if (exposureGated && !signal && !drafting) {
+    throw new Error(
+      `${type} refused: exposure "${actionPayload.exposure}" exceeds the private default — opting an object up requires an approval signal (the agent never auto-promotes beyond private).`,
+    );
+  }
+  const recordApproval = gate.gated || (exposureGated && !drafting);
+
+  // 4 — collision policy (D3): new-file actions never overwrite.
+  if (effective.newFileOnly && exists) {
+    throw new Error(
+      `${type} refused: ${plan.relPath} already exists (new-file actions fail closed on collision — never overwrite).`,
+    );
+  }
+
+  // 5 — assemble, then stage → validate-against-the-contract → atomic rename. A handler
+  // returning `writes` is a multi-destination transaction (promote_to_codex's codex
+  // object + source tombstone) and names its own per-write collision semantics; the
+  // single-content shape stays the default for every single-file action.
+  const built = await effective.build({ payload: actionPayload, plan, domain, session, actor, installRoot, exists });
+
+  // 5b — requested-subscribed hooks fire PRE-WRITE, after EVERY pipeline refusal point
+  // (permission, exposure, collision, build's post-event second factors) — core-0013
+  // H6 as amended by the Codex round: a proposal the pipeline itself refuses fires NO
+  // hooks, because a mutation hook executing a command for an unapproved proposal
+  // would be side effects an agent can drive by proposing actions it knows will
+  // refuse. The stream still carries the refused proposal's requested trail (D6); a
+  // gate-kind failure here refuses the write with that same trail. (The V1.5 daemon
+  // subscribes to the stream, where refused proposals are visible — its firing
+  // semantics are recorded as that packet's question, changes/0001 T4.1.)
+  const requestedHooks = await executeHooksFor({
+    installRoot,
+    hooks: hookRes.hooks,
+    event: requestedEvent,
+  });
+  if (requestedHooks.gateFailures.length) {
+    const f = requestedHooks.gateFailures[0];
+    throw new Error(
+      `${type} refused by gate hook "${f.id}" at action_type.requested: ${f.error}${
+        f.stderrTail ? ` — ${f.stderrTail.trim()}` : ''
+      } (every fire is audited in .phronesis/audit.log)`,
+    );
+  }
+
+  // 5c — compile's untrusted TERMINAL (core-0017 H3): a draft, not a commit. The bytes
+  // are written to .phronesis/drafts/ but validated AS their canonical compiled/ shape
+  // (the validateRelPath path split — contextFor rejects a drafts/ path otherwise), and
+  // the run ends at compile.candidate. NO action_type.committed fires — no canonical
+  // state changed — so the committed-subscribed projection hook (H5) does NOT run for a
+  // draft (correct: the projection tracks canonical state). Operator accept/reject
+  // (compileAccept/compileReject) is where the canonical write and its committed land.
+  // The draft overwrites any prior candidate at this path (idempotent convergence: an
+  // identical re-draft re-fires the same candidate, no new canonical state).
+  if (built.draft) {
+    await stageValidateRename({
+      installRoot,
+      relPath: built.draft.writeRelPath,
+      validateRelPath: plan.relPath,
+      content: built.content,
+      overwrite: true,
+    });
+    try {
+      // change 0027 (D2): bind the candidate to the EXACT persisted draft bytes. Re-read the
+      // file just written (not built.content) and digest the raw bytes via the SAME shared
+      // digestFile that `compile review`'s classifyDrafts re-hashes with — so the handler and
+      // the verifier can never disagree about "the bytes". HANDLER-computed, never caller-supplied:
+      // content_digest is not a compile action-input field, so validatePayload rejects an attempt
+      // to forge it (a forgeable digest would defeat the whole check).
+      const content_digest = await digestFile(join(installRoot, built.draft.writeRelPath));
+      await appendEvent({
+        installRoot,
+        type: 'compile.candidate',
+        session_id: session,
+        actor,
+        surface,
+        payload: {
+          source_paths: built.draft.sourcePaths,
+          draft_path: built.draft.writeRelPath,
+          links: built.draft.links,
+          ...(built.draft.suspicious !== undefined
+            ? { suspicious_payload: built.draft.suspicious }
+            : {}),
+          content_digest,
+        },
+        now,
+      });
+    } catch (err) {
+      // Same "WAS written, but the audit failed" guarantee as the committed path: the
+      // draft already landed; say so plainly so a re-run is an idempotent re-draft, not a
+      // blind retry into a confusing state.
+      throw new Error(
+        `${type}: the draft WAS written to ${built.draft.writeRelPath}, but the compile.candidate audit event failed to append: ${err.message}`,
+      );
+    }
+    return { ok: true, path: built.draft.writeRelPath, draft: true, changes_summary: built.changesSummary };
+  }
+
+  if (built.writes) {
+    if (built.writes.length) await stageValidateRenameAll({ installRoot, writes: built.writes });
+  } else {
+    await stageValidateRename({
+      installRoot,
+      relPath: plan.relPath,
+      content: built.content,
+      overwrite: exists && !effective.newFileOnly,
+    });
+  }
+
+  // 6 — the write is real: audit the commit (approval_source only when a gate actually
+  // consumed a signal — D5 provenance, not flag-presence). If THIS append fails, the
+  // artifact already landed: say so plainly instead of implying total failure, so the
+  // operator knows state changed and a new-file retry will (correctly) hit collision.
+  // `wrote` is the transaction's committed write set (a skipIfIdentical race-window
+  // no-op stays in it — it is part of the audited transaction) — the failure message
+  // and the `paths` audit both derive from it (0012 riders): a multi-write transaction
+  // names EVERY file (the tombstone is canonical state too), a single-write
+  // transaction whose one file IS `path` adds no redundant array, and a converging
+  // no-op logs no phantom mutation.
+  const wrote = built.writes ? built.writes.map((w) => w.relPath) : [plan.relPath];
+  let committedEvent;
+  try {
+    committedEvent = await appendEvent({
+      installRoot,
+      type: 'action_type.committed',
+      session_id: session,
+      actor,
+      surface,
+      payload: {
+        action_type: type,
+        path: plan.relPath,
+        ...(wrote.length && !(wrote.length === 1 && wrote[0] === plan.relPath)
+          ? { paths: wrote }
+          : {}),
+        links_updated: built.linksUpdated,
+        ...(built.noOp ? { no_op: true } : {}),
+        ...(invocationId ? { invocation_id: invocationId } : {}),
+        ...(recordApproval ? { approval_source: ctx.approvalSource } : {}),
+      },
+      now,
+    });
+  } catch (err) {
+    throw new Error(
+      wrote.length
+        ? `${type}: the artifact WAS written to ${wrote.join(' and ')}, but the action_type.committed audit event failed to append: ${err.message}`
+        : `${type}: the run was a no-op (nothing written), but the action_type.committed audit event failed to append: ${err.message}`,
+    );
+  }
+
+  // 6b — the committed emit point is the second hook execution point (core-0013 H6).
+  // The write is already real, so EVERY failure past this line — a gate-kind hook, or
+  // the executor's own audit append dying — surfaces WITHOUT rollback (agents do not
+  // delete) in the same "WAS written, but" shape as a failed event append, so the
+  // operator knows state changed and never retries blindly into a collision.
+  let committedHooks;
+  try {
+    committedHooks = await executeHooksFor({
+      installRoot,
+      hooks: hookRes.hooks,
+      event: committedEvent,
+    });
+  } catch (err) {
+    throw new Error(
+      wrote.length
+        ? `${type}: the artifact WAS written to ${wrote.join(' and ')}, but hook execution after action_type.committed failed: ${err.message}`
+        : `${type}: the run was a no-op (nothing written), but hook execution after action_type.committed failed: ${err.message}`,
+    );
+  }
+  if (committedHooks.gateFailures.length) {
+    const f = committedHooks.gateFailures[0];
+    const detail = `${f.error}${f.stderrTail ? ` — ${f.stderrTail.trim()}` : ''}`;
+    throw new Error(
+      wrote.length
+        ? `${type}: the artifact WAS written to ${wrote.join(' and ')}, but gate hook "${f.id}" failed at action_type.committed: ${detail} (audited in .phronesis/audit.log; the write is not rolled back)`
+        : `${type}: the run was a no-op (nothing written), but gate hook "${f.id}" failed at action_type.committed: ${detail} (audited in .phronesis/audit.log)`,
+    );
+  }
+
+  return { ok: true, path: plan.relPath, changes_summary: built.changesSummary };
+}
+
+// --- compile accept / reject (core-0017 H9; the operator review primitives) ------------
+//
+// A draft (compile.candidate) is transient, non-canonical state in .phronesis/drafts/.
+// Accept promotes it to compiled/ (a canonical write that rides the same validated atomic
+// writer + emits its OWN requested/committed pair so the pair stays session_id-coherent —
+// the original compile's requested fired in the AGENT session, accept's in the operator
+// REVIEW session). Reject discards it. Batch-approval UX is T7.5; this ships the
+// primitives + the compile.accepted/rejected events. ("agents do not delete" governs
+// CANONICAL state; a .phronesis/drafts/ file is a temp, so reject may remove it.)
+
+// Map a draft path to its canonical accepted path, validating the shape (fail closed on
+// anything that is not .phronesis/drafts/{domain}/{insights|organizations}/{name}.md).
+function resolveDraftPaths(installRoot, draftPathArg) {
+  if (typeof draftPathArg !== 'string' || draftPathArg.trim() === '') {
+    return { error: 'a draft path is required' };
+  }
+  const abs = resolve(installRoot, draftPathArg);
+  const rel = relative(installRoot, abs);
+  const parts = rel.split(sep);
+  if (parts[0] !== '.phronesis' || parts[1] !== 'drafts' || parts.length !== 5 || !parts[4].endsWith('.md')) {
+    return { error: `"${draftPathArg}" is not a compile draft path (.phronesis/drafts/{domain}/{type-dir}/{name}.md)` };
+  }
+  const [, , domain, typeDir, file] = parts;
+  if (typeDir !== TYPE_DIR.insight && typeDir !== TYPE_DIR.organization) {
+    return {
+      error: `draft type-dir "${typeDir}" is not a compile object dir (${TYPE_DIR.insight} | ${TYPE_DIR.organization})`,
+    };
+  }
+  return {
+    draftRel: `.phronesis/drafts/${domain}/${typeDir}/${file}`,
+    acceptedRel: `domains/${domain}/compiled/${typeDir}/${file}`,
+    domain,
+  };
+}
+
+function reviewCtx({ dir, cwd, session, surface, now }) {
+  const installed = resolveInstall({ dir, cwd });
+  if (installed.error) throw new Error(installed.error);
+  if (typeof session !== 'string' || session === '') {
+    throw new Error('execution context: session is required (the review session id).');
+  }
+  return {
+    installRoot: installed.root,
+    session,
+    // actor is HARD-SET to operator (event-log.md:51 + change 0015 #7: accept/reject are
+    // operator-driven). Never threaded from a flag/env — an agent-driven environment must
+    // not be able to attribute a promotion-to-canonical to itself (the draft gate's point).
+    actor: 'operator',
+    surface: surface || 'cli',
+    now: now || new Date(),
+  };
+}
+
+// The frontmatter links of a parsed object (rel+target pairs only) — used at accept to
+// count the edges a promotion actually ADDS over the canonical original (links_updated).
+function frontmatterLinks(fm) {
+  return fm && Array.isArray(fm.links) ? fm.links.filter((l) => l && l.rel && l.target) : [];
+}
+
+// Promote a draft to canonical compiled/ state. Emits action_type.requested →
+// (atomic validated move draft→compiled/, draft discarded) → action_type.committed
+// (approval_source recorded — acceptance IS the approval) → compile.accepted. A failure
+// AFTER the move surfaces the spine's "WAS moved, but the audit failed" guarantee — no
+// rollback, so the operator knows canonical state already changed.
+// The hooks subscribed to action_type.committed whose effect is PROVABLY CONVERGENT —
+// re-running them recomputes from canonical state and double-acts nothing — so on a resume
+// with an ambiguous (firing-only) receipt they are safe to replay. V1's only committed
+// compile hook is the active-context projection refresh (layout.js:79). Every OTHER
+// committed hook is default-denied on an ambiguous receipt (L8): an operator/skill-added hook
+// may carry a non-idempotent side effect, so a firing-only receipt fails closed to manual
+// repair. A new hook earns recovery only by a deliberate addition to this set (a spec change),
+// never implicitly. (Codex round 9: hard-coded set, not a registry attribute — HOOK_ENTRY_KEYS
+// rejects unknown keys, so a `recoverable` attribute would need a hooks schema change.)
+export const CONVERGENT_COMMITTED_HOOKS = new Set(['compile-active-context']);
+
+// The compile.accepted payload — shared by the fresh accept and the resumable reconcile so
+// the change-0025 batch-correlation fields (optional batch_id + rationale, absent on a
+// single-draft accept) are stamped in exactly one place.
+function compileAcceptedPayload({ draftRel, acceptedRel, batchId, rationale }) {
+  return {
+    draft_path: draftRel,
+    accepted_path: acceptedRel,
+    ...(typeof batchId === 'string' && batchId !== '' ? { batch_id: batchId } : {}),
+    ...(typeof rationale === 'string' && rationale !== '' ? { rationale } : {}),
+  };
+}
+
+export async function compileAccept({
+  dir,
+  cwd,
+  draftPath,
+  session,
+  surface,
+  approvalSource,
+  now,
+  batchId,
+  rationale,
+  recordBoundary,
+} = {}) {
+  const ctx = reviewCtx({ dir, cwd, session, surface, now });
+  const { installRoot } = ctx;
+  const realSignal = typeof approvalSource === 'string' && approvalSource.trim() !== '';
+
+  const paths = resolveDraftPaths(installRoot, draftPath);
+  if (paths.error) throw new Error(`compile accept: ${paths.error}`);
+  const { draftRel, acceptedRel, domain } = paths;
+
+  let registry;
+  try {
+    registry = await fse.readJson(join(installRoot, '.phronesis', 'registry.json'));
+  } catch (err) {
+    throw new Error(`could not read the install registry (.phronesis/registry.json): ${err.message}`);
+  }
+  // Accept is a canonical write, so it honors the SAME action-layer gate runAction does
+  // (adversarial review): a malformed action_types section disables the layer all-or-
+  // nothing, and an unregistered/deferred compile refuses — a draft must not back-door
+  // around the registry the spine enforces. Plus the hooks loader (the projection refresh).
+  const resolved = resolveActionTypes(registry);
+  if (resolved.errors.length) {
+    throw new Error(
+      `invalid .phronesis/registry.json (action-type registry) — the action layer is disabled until it is fixed (run \`phronesis registry status\`): ${resolved.errors.join('; ')}`,
+    );
+  }
+  const eff = resolved.effective.compile;
+  if (!eff) {
+    throw new Error(
+      "compile accept: \"compile\" is not registered in this installation's action_types — cannot promote a draft to a type the install does not run.",
+    );
+  }
+  if (eff.deferredTo || eff.implementedIn) {
+    throw new Error('compile accept: the compile handler is not runnable in this installation (deferred) — cannot promote.');
+  }
+  const hookRes = resolveHooks(registry);
+  if (hookRes.errors.length) {
+    throw new Error(
+      `invalid .phronesis/registry.json (hooks) — the action layer is disabled until it is fixed: ${hookRes.errors.join('; ')}`,
+    );
+  }
+  // Never conjure a domain as a side effect (the resolveDomain posture, applied to the
+  // promotion path) — a draft whose domain segment is unregistered refuses.
+  if (!Array.isArray(registry.domains) || !registry.domains.includes(domain)) {
+    throw new Error(
+      `compile accept: draft domain "${domain}" is not registered in this installation (registered: ${(registry.domains || []).join(', ') || 'none'}) — refusing.`,
+    );
+  }
+
+  const draftAbs = join(installRoot, draftRel);
+  let content;
+  try {
+    content = await readFile(draftAbs, 'utf8');
+  } catch {
+    throw new Error(
+      `compile accept: no draft at ${draftRel} (already accepted or rejected, or never staged).`,
+    );
+  }
+  // Parse the draft frontmatter once: its exposure gates the escalation check, its links
+  // feed the accurate links_updated count.
+  const draftSplit = splitObjectSource(content);
+  let draftFm = null;
+  if (draftSplit) {
+    try {
+      draftFm = yaml.load(draftSplit.yamlSource, { schema: yaml.JSON_SCHEMA });
+    } catch {
+      draftFm = null;
+    }
+  }
+  const draftExposure = draftFm && typeof draftFm === 'object' ? draftFm.exposure : undefined;
+
+  // A fresh requested in the REVIEW session (H9 Q9 — keeps the requested/committed pair
+  // session_id-coherent; the original compile's requested fired in the agent session).
+  const requestedEvent = await appendEvent({
+    installRoot,
+    type: 'action_type.requested',
+    session_id: ctx.session,
+    actor: ctx.actor,
+    surface: ctx.surface,
+    payload: { action_type: 'compile', params: { accept: draftRel } },
+    now: ctx.now,
+  });
+
+  // Exposure escalation at accept (H7, post-requested so the refusal leaves a trail): a
+  // draft carries its suggested exposure unenforced (the draft path bypasses the spine's
+  // escalation gate), so promoting one ABOVE private to canonical requires a real approval
+  // signal here — the bare accept is the approval for a PRIVATE object only, never an
+  // above-private escalation. (Adversarial review: a synthetic approval must not auto-bless
+  // an untrusted draft's suggested context-ok/shareable.)
+  if (typeof draftExposure === 'string' && draftExposure !== 'private' && !realSignal) {
+    throw new Error(
+      `compile accept: this draft sets exposure "${draftExposure}" above private — promoting it requires an approval signal (set PHRONESIS_APPROVAL_SOURCE; the bare accept approves a private object only).`,
+    );
+  }
+  const approval = realSignal ? approvalSource : 'operator:compile-accept';
+
+  // The move: validate the draft bytes AS the canonical path, land atomically (overwrite
+  // when canonical exists — the H8 update case; fresh write for create), then discard the
+  // transient draft. The move completes BEFORE the committed audit (H9 failure semantics).
+  const canonicalExists = await fse.pathExists(join(installRoot, acceptedRel));
+  // links_updated = the edges this promotion ADDS over the canonical original (create:
+  // all of them; update: the new evidence edges only) — accurate audit fidelity (review).
+  let linksAdded = frontmatterLinks(draftFm).length;
+  if (canonicalExists) {
+    try {
+      const origSplit = splitObjectSource(await readFile(join(installRoot, acceptedRel), 'utf8'));
+      const origFm = origSplit ? yaml.load(origSplit.yamlSource, { schema: yaml.JSON_SCHEMA }) : null;
+      const origSet = new Set(frontmatterLinks(origFm).map((l) => JSON.stringify([l.rel, l.target])));
+      linksAdded = frontmatterLinks(draftFm).filter((l) => !origSet.has(JSON.stringify([l.rel, l.target]))).length;
+    } catch {
+      // keep the draft-total fallback if the original is unreadable
+    }
+  }
+  // Requested-subscribed hooks fire PRE-MOVE — after the exposure refusal point, before the
+  // write — exactly as the spine runs them before any canonical write (5b). A gate-kind
+  // failure refuses the promotion (the requested trail stays; the draft is untouched);
+  // mutation/ambient fire is audited, never blocking. Without this, accept — the
+  // untrusted→canonical trust boundary — would skip the very gate hooks a direct compile is
+  // subject to (adversarial review P1: a gate hook on action_type.requested filtered to
+  // compile refused a compile but not its promotion).
+  const requestedHooks = await executeHooksFor({ installRoot, hooks: hookRes.hooks, event: requestedEvent });
+  if (requestedHooks.gateFailures.length) {
+    const f = requestedHooks.gateFailures[0];
+    throw new Error(
+      `compile accept refused by gate hook "${f.id}" at action_type.requested: ${f.error}${
+        f.stderrTail ? ` — ${f.stderrTail.trim()}` : ''
+      } (audited in .phronesis/audit.log; the draft is untouched)`,
+    );
+  }
+  await stageValidateRename({ installRoot, relPath: acceptedRel, content, overwrite: canonicalExists });
+  try {
+    await fse.remove(draftAbs);
+  } catch (err) {
+    throw new Error(
+      `compile accept: the artifact WAS promoted to ${acceptedRel}, but discarding the draft ${draftRel} failed: ${err.message} (re-run accept — the move is idempotent)`,
+    );
+  }
+  // The move is the point of no return. Tell the journal the draft is gone + canonical is
+  // present + the intent needed to finish (the draft can no longer re-supply it) BEFORE the
+  // post-move boundaries, so a crash at any of them is recoverable (L7). recordBoundary is a
+  // best-effort durability hook — core owns the boundary SEQUENCE; the caller persists it.
+  await recordBoundary?.('moved', {
+    accepted_path: acceptedRel,
+    draft_path: draftRel,
+    approval_source: approval,
+    links_added: linksAdded,
+    batch_id: batchId,
+    rationale,
+  });
+
+  let committedEvent;
+  try {
+    committedEvent = await appendEvent({
+      installRoot,
+      type: 'action_type.committed',
+      session_id: ctx.session,
+      actor: ctx.actor,
+      surface: ctx.surface,
+      payload: { action_type: 'compile', path: acceptedRel, links_updated: linksAdded, approval_source: approval },
+      now: ctx.now,
+    });
+  } catch (err) {
+    throw new Error(
+      `compile accept: the artifact WAS moved to ${acceptedRel}, but the action_type.committed audit event failed to append: ${err.message}`,
+    );
+  }
+  // Record the committed event_id the moment it succeeds — the cursor keys on THIS id, never
+  // by path (an update-accept has a prior committed for the same accepted_path; by-path would
+  // read that stale prior as "done" and skip the boundary, round-10 BLOCKER).
+  await recordBoundary?.('committed', { event_id: committedEvent.id });
+
+  // committed-subscribed hooks fire here (the H5 active-context projection refresh rides
+  // this event — accepting a draft changes canonical state, so the projection must
+  // refresh, exactly as a direct trusted compile does).
+  let committedHooks;
+  try {
+    committedHooks = await executeHooksFor({ installRoot, hooks: hookRes.hooks, event: committedEvent });
+  } catch (err) {
+    throw new Error(
+      `compile accept: the artifact WAS moved to ${acceptedRel}, but hook execution after action_type.committed failed: ${err.message}`,
+    );
+  }
+  if (committedHooks.gateFailures.length) {
+    const f = committedHooks.gateFailures[0];
+    throw new Error(
+      `compile accept: the artifact WAS moved to ${acceptedRel}, but gate hook "${f.id}" failed at action_type.committed: ${f.error}${
+        f.stderrTail ? ` — ${f.stderrTail.trim()}` : ''
+      } (audited in .phronesis/audit.log; the write is not rolled back)`,
+    );
+  }
+  await recordBoundary?.('projection', {});
+
+  try {
+    await appendEvent({
+      installRoot,
+      type: 'compile.accepted',
+      session_id: ctx.session,
+      actor: ctx.actor,
+      surface: ctx.surface,
+      payload: compileAcceptedPayload({ draftRel, acceptedRel, batchId, rationale }),
+      now: ctx.now,
+    });
+  } catch (err) {
+    throw new Error(
+      `compile accept: the artifact WAS moved + committed to ${acceptedRel}, but the compile.accepted audit event failed to append: ${err.message}`,
+    );
+  }
+  await recordBoundary?.('accepted', {});
+
+  return {
+    ok: true,
+    draft_path: draftRel,
+    accepted_path: acceptedRel,
+    approval_source: approval,
+    ...(typeof batchId === 'string' && batchId !== '' ? { batch_id: batchId } : {}),
+    ...(typeof rationale === 'string' && rationale !== '' ? { rationale } : {}),
+  };
+}
+
+async function findCommittedEvent(installRoot, eventId) {
+  if (typeof eventId !== 'string' || eventId === '') return null;
+  const events = await readEvents({ installRoot, type: 'action_type.committed' });
+  return events.find((e) => e.id === eventId) || null;
+}
+
+// L8 — replay the committed-subscribed hooks on a resume, governed by per-hook recoverability.
+// Per matched committed hook, read its audit receipt keyed on the committed event_id (NOT the
+// session, NOT the path — the firing/fired/failed line carries event_id, hook-executor.js):
+//   - a settled GATE `failed` receipt → the gate REFUSED (the fresh path throws) → FAIL CLOSED;
+//   - a clean settled receipt (`fired`, or a NON-gate `failed` = ran-but-non-blocking) → SKIP;
+//   - NO receipt → it never ran → RUN it (and enforce its gate result, as the fresh path does);
+//   - a firing-only (ambiguous) receipt → re-run ONLY if the hook is provably convergent
+//     (CONVERGENT_COMMITTED_HOOKS); otherwise FAIL CLOSED → manual repair (a non-idempotent
+//     side effect may or may not have completed; neither blind replay nor blind skip is safe).
+// The gate enforcement (failed-receipt fail-closed + replay-gateFailures check) mirrors
+// compileAccept's committed-gate boundary so resume can never become a gate-AVOIDANCE path.
+async function reconcileCommittedHooks({ installRoot, hooks, committedEvent }) {
+  const matched = matchingHooks(hooks, committedEvent);
+  if (!matched.length) return;
+  const audit = await readAuditLog(installRoot);
+  for (const hook of matched) {
+    const receipts = audit.filter((e) => e.hook === hook.id && e.event_id === committedEvent.id);
+    const failed = receipts.some((e) => e.outcome === 'failed');
+    const fired = receipts.some((e) => e.outcome === 'fired');
+    // A settled FAILED receipt on a GATE hook is a refusal the FRESH path throws on
+    // (compileAccept's committed-gate check) — recovery must NOT approve past it. Treating a
+    // `failed` receipt as merely "settled, skip" turned the recovery path into a gate-AVOIDANCE
+    // path (the highest-risk finding): a committed gate hook that blocked the fresh accept would
+    // be silently skipped on resume and compile.accepted appended anyway. Surface it; do not
+    // mark the boundary done.
+    if (failed && hook.kind === 'gate') {
+      throw new Error(
+        `resume compile accept: committed gate hook "${hook.id}" has a settled FAILED receipt for committed event ` +
+          `${committedEvent.id} — the gate refused this promotion and recovery must not approve past it. Resolve the ` +
+          'gate failure by hand, then re-run the resume.',
+      );
+    }
+    // A clean settled receipt (a `fired`, or a NON-gate `failed` = ran-but-non-blocking, exactly
+    // as the fresh path treats a non-gate failure) → the hook ran to completion → boundary done
+    // for it, skip (no double-act).
+    if (fired || failed) continue;
+    const firingOnly = receipts.some((e) => e.outcome === 'firing');
+    if (firingOnly && !CONVERGENT_COMMITTED_HOOKS.has(hook.id)) {
+      throw new Error(
+        `resume compile accept: committed hook "${hook.id}" has an ambiguous receipt (a "firing" line with no ` +
+          `"fired"/"failed" for committed event ${committedEvent.id}) and is NOT in the convergent set ` +
+          `{${[...CONVERGENT_COMMITTED_HOOKS].join(', ')}} — it may carry a non-idempotent side effect. FAILING ` +
+          'CLOSED: resolve it by hand (confirm whether the side effect completed), then re-run the resume.',
+      );
+    }
+    // no receipt (never ran) OR firing-only + convergent (idempotent recompute) → run it. A
+    // convergent re-run goes through executeHooksFor's quota gate, which counts the prior
+    // 'firing' line — so a convergent hook with max_per_session <= 1 would silently
+    // skipped-quota on replay (a stale projection masquerading as recovered). Enforce the
+    // invariant rather than hope: a convergent hook MUST carry quota > 1 (the V1
+    // compile-active-context ships 500).
+    if (firingOnly && (hook.quota?.max_per_session ?? 0) <= 1) {
+      throw new Error(
+        `resume compile accept: convergent hook "${hook.id}" has max_per_session=${hook.quota?.max_per_session} — ` +
+          'too tight for a recovery replay (the prior firing line consumes the quota). Raise its quota; failing closed.',
+      );
+    }
+    // Run it, and ENFORCE the gate result exactly as the fresh committed-hook boundary does
+    // (compileAccept throws on committedHooks.gateFailures). A committed GATE hook that fails on
+    // replay halts the reconcile: the canonical write is already landed and cannot roll back, but
+    // compile.accepted must NOT be appended past a refusing gate.
+    const { gateFailures } = await executeHooksFor({ installRoot, hooks: [hook], event: committedEvent });
+    if (gateFailures.length) {
+      const f = gateFailures[0];
+      throw new Error(
+        `resume compile accept: committed gate hook "${f.id}" failed on replay at action_type.committed: ${f.error}` +
+          `${f.stderrTail ? ` — ${f.stderrTail.trim()}` : ''} — recovery must not approve past a gate refusal ` +
+          '(the canonical write is not rolled back; resolve the gate failure by hand).',
+      );
+    }
+  }
+}
+
+// Resume a compileAccept that crashed AFTER the move, reconciling only the MISSING post-move
+// boundaries, in order, idempotently (L7). The draft is GONE, so the caller supplies the
+// `intent` (from the durable journal — accepted_path, draft_path, approval_source, links_added,
+// batch_id, rationale) plus the per-boundary `statusCursor`. The cursor keys the committed
+// boundary on the recorded `action_type.committed` event_id, NEVER by accepted_path (an
+// update-accept has a prior committed for the same path; by-path would skip the boundary and
+// re-create the malformed spine, round-10 BLOCKER). The PRE-move `action_type.requested` +
+// requested gate-hooks are NOT replayed (L7.2): they are pre-canonical-change and already
+// fired; re-driving them would duplicate `requested` and could let a requested gate-hook refuse
+// recovery of an already-canonical artifact. Core owns the boundary SEQUENCE (the single
+// canonical-mutation owner); the caller supplies intent + cursor, not order.
+export async function resumeCompileAccept({ dir, cwd, intent, statusCursor, session, surface, now, recordBoundary } = {}) {
+  const ctx = reviewCtx({ dir, cwd, session, surface, now });
+  const { installRoot } = ctx;
+  if (!intent || typeof intent.accepted_path !== 'string' || intent.accepted_path === '') {
+    throw new Error('resume compile accept: intent.accepted_path is required (the journal-recorded canonical path).');
+  }
+  const acceptedRel = intent.accepted_path;
+  const draftRel = typeof intent.draft_path === 'string' ? intent.draft_path : null;
+  const cursor = statusCursor && typeof statusCursor === 'object' ? { ...statusCursor } : {};
+
+  // Containment: the journal is operator-owned (hand-editable) trust state, so never trust its
+  // accepted_path blindly — a forged path could fire the projection hook + an audit pair against
+  // an arbitrary location. It must be a canonical compiled/ path with no traversal. (Resume only
+  // APPENDS events; it performs no write, so this guards the audit-forgery surface, not a write.)
+  if (!/^domains\/[a-z0-9][a-z0-9-]*\/compiled\/[a-z][a-z-]*\/[^/]+\.md$/.test(acceptedRel) || acceptedRel.split('/').includes('..')) {
+    throw new Error(`resume compile accept: intent.accepted_path "${acceptedRel}" is not a canonical compiled/ path — refusing.`);
+  }
+
+  // Ground truth: a post-move resume requires the canonical artifact to be present. If it is
+  // missing the move never completed — this is NOT a post-move state; the caller must run a
+  // fresh accept instead of a resume.
+  if (!(await fse.pathExists(join(installRoot, acceptedRel)))) {
+    throw new Error(
+      `resume compile accept: canonical artifact ${acceptedRel} is absent — not a post-move state. Run a fresh accept, not a resume.`,
+    );
+  }
+
+  let registry;
+  try {
+    registry = await fse.readJson(join(installRoot, '.phronesis', 'registry.json'));
+  } catch (err) {
+    throw new Error(`could not read the install registry (.phronesis/registry.json): ${err.message}`);
+  }
+  const hookRes = resolveHooks(registry);
+  if (hookRes.errors.length) {
+    throw new Error(`invalid .phronesis/registry.json (hooks) — the action layer is disabled until it is fixed: ${hookRes.errors.join('; ')}`);
+  }
+
+  const approval = typeof intent.approval_source === 'string' && intent.approval_source !== '' ? intent.approval_source : 'operator:compile-accept';
+  const linksAdded = Number.isInteger(intent.links_added) ? intent.links_added : 0;
+
+  // Boundary: action_type.committed. If the cursor RECORDS a committed event_id, that boundary
+  // already happened — verify the event is in the live stream and reuse it. If the cursor
+  // claims it but the event is ABSENT (archived/purged between crash and resume, or a bad
+  // cursor), do NOT blind-append: a fresh committed would duplicate the one in cold storage.
+  // FAIL CLOSED — the same posture L8 takes for an ambiguous receipt. Only when the cursor does
+  // NOT claim committed do we genuinely append (the moved-but-no-committed boundary).
+  let committedEvent = null;
+  if (cursor.committed && cursor.committed.done && cursor.committed.event_id) {
+    committedEvent = await findCommittedEvent(installRoot, cursor.committed.event_id);
+    if (!committedEvent) {
+      throw new Error(
+        `resume compile accept: the journal records committed event ${cursor.committed.event_id} for ${acceptedRel} ` +
+          'but it is absent from the live event stream (archived/purged?). FAILING CLOSED to avoid a duplicate ' +
+          'committed — verify the spine by hand (the committed may be in cold storage) before resuming.',
+      );
+    }
+    // Existence is not enough: the recorded event_id must be the action_type.committed for THIS
+    // compile artifact. The journal is operator-owned (hand-editable) trust state — a stale or
+    // forged cursor pointing at ANOTHER compile's committed (or a non-compile committed) would
+    // let resume reuse it and append compile.accepted for this path atop an unrelated committed —
+    // a malformed spine. Verify action_type + path; FAIL CLOSED on a mismatch (same posture as
+    // the absent-event branch and the accepted_path containment check above).
+    if (committedEvent.payload?.action_type !== 'compile' || committedEvent.payload?.path !== acceptedRel) {
+      throw new Error(
+        `resume compile accept: the journal records committed event ${cursor.committed.event_id} for ${acceptedRel}, ` +
+          `but that event is action_type.committed for ` +
+          `${committedEvent.payload?.action_type ?? '(none)'}/${committedEvent.payload?.path ?? '(no path)'} — ` +
+          'the cursor does not name THIS artifact (a stale or hand-edited journal). FAILING CLOSED.',
+      );
+    }
+  }
+  if (!committedEvent) {
+    committedEvent = await appendEvent({
+      installRoot,
+      type: 'action_type.committed',
+      session_id: ctx.session,
+      actor: ctx.actor,
+      surface: ctx.surface,
+      payload: { action_type: 'compile', path: acceptedRel, links_updated: linksAdded, approval_source: approval },
+      now: ctx.now,
+    });
+    cursor.committed = { done: true, event_id: committedEvent.id };
+    await recordBoundary?.('committed', { event_id: committedEvent.id });
+  }
+
+  // Boundary: committed-subscribed hooks (the projection refresh) — L8-governed.
+  if (!(cursor.projection && cursor.projection.done)) {
+    await reconcileCommittedHooks({ installRoot, hooks: hookRes.hooks, committedEvent });
+    cursor.projection = { done: true };
+    await recordBoundary?.('projection', {});
+  }
+
+  // Boundary: compile.accepted (with the change-0025 batch correlation).
+  if (!(cursor.accepted && cursor.accepted.done)) {
+    await appendEvent({
+      installRoot,
+      type: 'compile.accepted',
+      session_id: ctx.session,
+      actor: ctx.actor,
+      surface: ctx.surface,
+      payload: compileAcceptedPayload({ draftRel, acceptedRel, batchId: intent.batch_id, rationale: intent.rationale }),
+      now: ctx.now,
+    });
+    cursor.accepted = { done: true };
+    await recordBoundary?.('accepted', {});
+  }
+
+  return {
+    ok: true,
+    resumed: true,
+    draft_path: draftRel,
+    accepted_path: acceptedRel,
+    ...(typeof intent.batch_id === 'string' && intent.batch_id !== '' ? { batch_id: intent.batch_id } : {}),
+    ...(typeof intent.rationale === 'string' && intent.rationale !== '' ? { rationale: intent.rationale } : {}),
+    status_cursor: cursor,
+  };
+}
+
+// Discard a draft. Emits compile.rejected after the delete; a failure AFTER the delete
+// surfaces the "WAS discarded, but the audit failed" guarantee (no missing-draft blind
+// retry). No canonical state changes, so no committed and no hooks.
+export async function compileReject({ dir, cwd, draftPath, reason, session, surface, now } = {}) {
+  const ctx = reviewCtx({ dir, cwd, session, surface, now });
+  const { installRoot } = ctx;
+
+  const paths = resolveDraftPaths(installRoot, draftPath);
+  if (paths.error) throw new Error(`compile reject: ${paths.error}`);
+  const { draftRel } = paths;
+
+  const draftAbs = join(installRoot, draftRel);
+  if (!(await fse.pathExists(draftAbs))) {
+    throw new Error(`compile reject: no draft at ${draftRel} (already accepted or rejected, or never staged).`);
+  }
+  await fse.remove(draftAbs);
+
+  try {
+    await appendEvent({
+      installRoot,
+      type: 'compile.rejected',
+      session_id: ctx.session,
+      actor: ctx.actor,
+      surface: ctx.surface,
+      payload: { draft_path: draftRel, ...(reason ? { reason } : {}) },
+      now: ctx.now,
+    });
+  } catch (err) {
+    throw new Error(
+      `compile reject: the draft WAS discarded (${draftRel}), but the compile.rejected audit event failed to append: ${err.message}`,
+    );
+  }
+
+  return { ok: true, draft_path: draftRel, rejected: true };
+}