pomaster 0.5.3 → 0.6.1

package/dist/bin.js

@@ -6461,7 +6461,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve3.call(this, root, ref);
+      let _sch = resolve4.call(this, root, ref);
       if (_sch === void 0) {
         const schema2 = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -6488,7 +6488,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve3(root, ref) {
+    function resolve4(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -7313,7 +7313,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve3(baseURI, relativeURI, options) {
+    function resolve4(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const {
         parsed: baseParsed,
@@ -7675,7 +7675,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve3,
+      resolve: resolve4,
       resolveComponent,
       equal,
       serialize,
@@ -18526,8 +18526,286 @@ var init_evidence_spec_schema = __esm({
   }
 });
 
+// packages/schemas/dist/assets/22-design-tokens.schema.json
+var design_tokens_schema_default;
+var init_design_tokens_schema = __esm({
+  "packages/schemas/dist/assets/22-design-tokens.schema.json"() {
+    design_tokens_schema_default = {
+      $schema: "http://json-schema.org/draft-07/schema#",
+      $id: "https://pomaster.dev/schemas/design-tokens/v1-draft.json",
+      title: "Design Tokens Contract\uFF08.pomaster/baseline/frontend/design-tokens.yaml \xB7 F-M1 \u6700\u5C0F\u5408\u540C\uFF0C09-10 R3 \u6279\uFF09",
+      description: "Project Baseline \u539F\u6587 \xA716 design-tokens.yaml Contract \u7684\u673A\u5668\u5F62\u6001\uFF1A\u8BED\u4E49 token \u5355\u4E00\u5408\u540C\u9762\uFF08\u989C\u8272/\u5B57\u4F53/\u95F4\u8DDD/\u5706\u89D2/\u9634\u5F71/\u5C42\u7EA7/\u5BC6\u5EA6/\u5E03\u5C40/\u52A8\u6548/\u65AD\u70B9\u4E5D\u7EC4\uFF09\u2014\u2014UI \u53EA\u80FD\u4ECE\u672C\u5408\u540C\u7684\u8BED\u4E49 token \u4E0E\u6279\u51C6\u7EC4\u4EF6\u53D6\u5F97\u89C6\u89C9\u89C4\u5219\uFF0CAgent Context \u6D88\u8D39\u8BED\u4E49 token \u800C\u975E\u88F8\u6570\u503C\uFF08\xA717 \u8BBE\u8BA1\u539F\u5219\uFF09\u3002\n\u8D77\u6B65\u503C\u7EAA\u5F8B\uFF1A\u6570\u503C\u6765\u6E90\u4EC5\u4E24\u7C7B\u2014\u2014POMaster Default Design \u9884\u8BBE\u9ED8\u8BA4\u503C\uFF08origin=preset\uFF0Cadvisory \u6027\u8D28\uFF0COwner \u786E\u8BA4\u524D\u4E0D\u6784\u6210\u9879\u76EE\u4E8B\u5B9E\uFF09\u6216\u7559\u7A7A\uFF08\u8D77\u6B65\u503C UNKNOWN / null\uFF09\u5F85 Owner \u51B3\u7B56\uFF1B\u539F\u6587\u793A\u4F8B\u6570\u503C\u7981\u4F2A\u9020\u6210\u9879\u76EE\u4E8B\u5B9E\uFF08PRD \xA77.1 NON-AUTHORITATIVE\uFF09\u3002\n\u547D\u540D\u6536\u655B\u5B9A\u7A3F\uFF1A\u539F\u6587 \xA716 layout.section_gap vs \xA717 spacing.section_gap \u4E8C\u9009\u4E00\uFF0C\u5B9A\u7A3F = spacing.section_gap\uFF08\u95F4\u8DDD\u8BED\u4E49\u5F52 spacing \u7EC4\uFF1Blayout \u7EC4\u7559\u7ED9\u9875\u9762\u7ED3\u6784\u952E\uFF0C\u65AD\u70B9\u8BED\u4E49\u5F52 breakpoints \u7EC4\uFF09\u2014\u2014\u672C schema \u7684 layout \u7EC4\u952E\u96C6\u4E0D\u542B section_gap\u3002",
+      "x-pomaster-file-role": "22-design-tokens.schema.json \u2014\u2014 Design Token \u5408\u540C\uFF08F-M1 \u6700\u5C0F\u5408\u540C\uFF0C09-10 R3 \u6279\uFF09\u3002\u843D\u76D8\u8F7D\u4F53 .pomaster/baseline/frontend/design-tokens.yaml\uFF08schema \u63CF\u8FF0\u5176 YAML \u540C\u6784\u5F62\u6001\u2014\u2014yaml \u88C5\u8F7D\u7ECF CLI baseline-tokens.ts \u8BFB\u53D6\u540E\u6821\u9A8C\uFF09\uFF1B\u540C\u65F6\u662F B6D \u6279\u64AD\u79CD\u5206\u6BCD\u589E\u91CF\uFF08seeds/manifest.json 26 \u4EF6\uFF09\u4E0E\u786E\u8BA4\u8D44\u4EA7\u6E05\u5355\u7B2C 25 \u6587\u4EF6\uFF08BASELINE_CONFIRM_TARGETS\u2014\u2014confirm digest \u5FEB\u7167/closeout \u6821\u9A8C/preset \u5FEB\u7167\u58F0\u660E\u4E09\u6D88\u8D39\u9762\u540C\u6E90\uFF0Cschema \u6821\u9A8C\u4E0E digest \u786E\u8BA4\u6B63\u4EA4\uFF1Adigest \u9762\u53EA\u770B\u5B57\u8282\uFF0C\u672C schema \u7BA1\u5F62\u72B6\uFF09\u3002",
+      "x-pomaster-vocab-source": "Baseline PRD \u539F\u6587 \xA713-21\uFF08\xA716 \u5206\u7EC4\u9AA8\u67B6\u9010\u5B57 + \xA717 \u547D\u540D\u6536\u655B\u5B9A\u7A3F + \xA719 preset\u2192customize\u2192baseline \u901A\u8DEF + \xA775 UNKNOWN/\u6309\u9700\u589E\u957F\u5408\u6CD5\uFF09\u3002origin \u8BCD\u5F62\u95ED\u5305 preset|customized|owner \u4E3A\u672C\u6587\u4EF6\u672C\u5730\u95ED\u5305\uFF0820-sources-authority \u5F00\u653E\u7EF4\u5EA6\u8BCD\u5148\u4F8B\u540C\u6CD5\u2014\u2014\u96F6\u4E2D\u592E\u8BCD\u8868 PR\uFF1B\u8DE8\u5305\u6D88\u8D39\u65F6\u518D\u8D70\u8BCD\u6C47\u8868 PR \u5E73\u79FB\uFF09\u3002UNKNOWN \u8D77\u6B65\u8BCD\u5F62\u4E0E baseline/stack.yaml \u53F0\u8D26\u540C\u6E90\uFF08B6d \u64AD\u79CD\u7EAA\u5F8B\uFF09\u3002",
+      "x-pomaster-contract": {
+        local_origin_closure: "origin \u4E09\u503C\u672C\u5730\u95ED\u5305\uFF1Apreset\uFF08\u64AD\u79CD\u9AA8\u67B6/\u9884\u8BBE\u9ED8\u8BA4\uFF0Cadvisory\uFF09| customized\uFF08Owner \u5728 preset \u57FA\u7840\u4E0A\u5B9A\u5236\uFF09| owner\uFF08Owner \u5168\u6743\u81EA\u8457\uFF09\u3002meta.customized \u662F\u72EC\u7ACB\u673A\u5668\u4F4D\uFF08\u5E03\u5C14\uFF09\u2014\u2014origin \u8868\u6765\u6E90\uFF0Ccustomized \u8868\u5B9A\u5236\u4E8B\u5B9E\uFF1BP-D1 customize/diff/confirm \u5168\u6D41\u7A0B\uFF08\u542B per-token origin \u5143\u6570\u636E\uFF09\u5728\u540E\u7EED\u63D0\u6848\u6269\u4F4D\uFF0C\u672C\u5408\u540C\u53EA\u51BB\u7ED3 meta \u7EA7\u673A\u5668\u4F4D\u3002",
+        advisory_preset_values: "origin=preset \u7684\u6570\u503C\u662F advisory\uFF08\u975E\u9879\u76EE\u4E8B\u5B9E\uFF09\uFF1A\u786E\u8BA4\uFF08baseline confirm\uFF09\u524D\u4E0D\u6784\u6210\u6743\u5A01\uFF1BP-D1 \u5B8C\u6574\u63D0\u6848\u524D\u672C\u5408\u540C\u4E0D\u5185\u7F6E\u4EFB\u4F55\u9884\u8BBE\u9ED8\u8BA4\u503C\u2014\u2014\u672C\u4ED3\u672A\u767B\u8BB0 POMaster Default Design \u6570\u503C\uFF0C\u64AD\u79CD\u9762\u5168\u53F6 UNKNOWN\u3002",
+        confirm_target: "\u672C\u6587\u4EF6\u662F\u786E\u8BA4\u8D44\u4EA7\u6E05\u5355\u7B2C 25 \u6587\u4EF6\uFF1A\u4FEE\u6539/\u5220\u9664 = BASELINE_DRIFT\uFF08digest \u9762\u68C0\u51FA\uFF0C\u4E0E schema \u5F62\u72B6\u5224\u5377\u6B63\u4EA4\u2014\u2014\u5F62\u72B6\u8FDD\u89C4\u7531\u88C5\u8F7D\u9762 fail-closed \u62D2\u7EDD\uFF0C\u4E0D\u6DF7\u5165 digest \u6BD4\u5BF9\uFF09\u3002",
+        not_governed_object: "\u672C\u5408\u540C\u4E0D\u662F governed object\uFF1A\u4E0D\u8FDB truth-index\u3001\u4E0D\u8D70 store \u4E8B\u52A1\u3001\u65E0 lifecycle/authority.owner \u4FE1\u5C01\u2014\u2014\u8BBE\u8BA1 token \u662F\u9879\u76EE\u5E73\u9762\u586B\u5199\u9762\uFF08\u4E0E 20-sources-authority registry \u540C\u57DF\uFF1A\u9879\u76EE\u53EF\u7F16\u8F91\u3001seed-once \u64AD\u79CD\u3001Owner \u5168\u6743\uFF09\u3002",
+        groups_closed_keys_open: "\u4E5D\u7EC4\u8BCD\u5F62\u4E0E\u7EC4\u5185\u952E\u96C6\u6309 \xA716 \u9AA8\u67B6\u5C01\u95ED\uFF08\u952E\u96C6\u6F02\u79FB\u5373 schema \u5931\u8D25\u2014\u2014\u5355\u4E00\u8BCD\u5F62\u6E90\u7EAA\u5F8B\uFF0C\u4E0E stack.yaml \u952E\u96C6\u540C\u6CD5\uFF09\uFF1Btoken \u589E\u957F\u901A\u9053 = \u663E\u5F0F schema \u4FEE\u8BA2\uFF08\xA775\u300Cgrows only when the project earns the need\u300D\u2014\u2014\u7981 Owner \u5728\u7EC4\u5185\u81EA\u9020\u952E\u7ED5\u8FC7\u8BCD\u5F62\u6E90\uFF09\u3002"
+      },
+      type: "object",
+      additionalProperties: false,
+      required: ["meta"],
+      properties: {
+        meta: {
+          type: "object",
+          additionalProperties: false,
+          required: ["origin", "customized"],
+          properties: {
+            origin: {
+              enum: ["preset", "customized", "owner"],
+              title: "\u6765\u6E90\u673A\u5668\u4F4D\uFF08\u672C\u5730\u4E09\u503C\u95ED\u5305\uFF09",
+              description: "preset = \u64AD\u79CD\u9AA8\u67B6/\u9884\u8BBE\u9ED8\u8BA4\uFF08advisory\u2014\u2014Owner \u786E\u8BA4\u524D\u4E0D\u6784\u6210\u9879\u76EE\u4E8B\u5B9E\uFF09\uFF1Bcustomized = Owner \u5728 preset \u57FA\u7840\u4E0A\u5B9A\u5236\uFF1Bowner = Owner \u5168\u6743\u81EA\u8457\u3002"
+            },
+            customized: {
+              type: "boolean",
+              title: "Owner \u5B9A\u5236\u673A\u5668\u4F4D",
+              description: "true = \u6587\u4EF6\u7ECF Owner \u5B9A\u5236\uFF08P-D1 customize/diff/confirm \u9762\u6D88\u8D39\uFF1B\u4E0E origin \u6B63\u4EA4\u2014\u2014origin \u8868\u6765\u6E90\uFF0Ccustomized \u8868\u5B9A\u5236\u4E8B\u5B9E\uFF09\u3002"
+            }
+          }
+        },
+        color: {
+          $ref: "#/definitions/color_group",
+          title: "\u989C\u8272\u8BED\u4E49 token\uFF08brand/surface/text/border/semantic\uFF09"
+        },
+        typography: {
+          $ref: "#/definitions/typography_group",
+          title: "\u5B57\u4F53\u8BED\u4E49 token\uFF08family/size/weight/line_height\uFF09"
+        },
+        spacing: {
+          $ref: "#/definitions/spacing_group",
+          title: "\u95F4\u8DDD token\uFF08xs..xxl + section_gap\u2014\u2014\u547D\u540D\u6536\u655B\u5B9A\u7A3F\u843D\u4F4D\uFF09"
+        },
+        radius: {
+          $ref: "#/definitions/radius_group",
+          title: "\u5706\u89D2 token\uFF08sm/md/lg\uFF09"
+        },
+        elevation: {
+          $ref: "#/definitions/elevation_group",
+          title: "\u9634\u5F71/\u5C42\u7EA7 token\uFF08card/popover/modal\uFF09"
+        },
+        density: {
+          $ref: "#/definitions/density_group",
+          title: "\u5BC6\u5EA6 token\uFF08\u63A7\u4EF6/\u8868\u683C\u884C\u9AD8\uFF09"
+        },
+        layout: {
+          $ref: "#/definitions/layout_group",
+          title: "\u5E03\u5C40\u7ED3\u6784 token\uFF08\u9875\u9762\u7EA7\uFF1B\u4E0D\u542B section_gap\u2014\u2014\u95F4\u8DDD\u8BED\u4E49\u5F52 spacing \u7EC4\uFF09"
+        },
+        motion: {
+          $ref: "#/definitions/motion_group",
+          title: "\u52A8\u6548\u65F6\u957F token\uFF08fast/normal/slow\uFF09"
+        },
+        breakpoints: {
+          $ref: "#/definitions/breakpoints_group",
+          title: "\u54CD\u5E94\u5F0F\u65AD\u70B9 token\uFF08sm/md/lg/xl\uFF09"
+        }
+      },
+      definitions: {
+        token_value: {
+          description: "\u5355 token \u503C\uFF1A\u8D77\u6B65\u503C UNKNOWN\uFF08\u5B57\u7B26\u4E32\u5360\u4F4D\u2014\u2014\u4E0E baseline/stack.yaml \u540C\u6E90\u8BCD\u5F62\uFF09\u6216 null\uFF08\u7559\u7A7A\uFF09= \u5F85 Owner \u51B3\u7B56\uFF1BOwner \u56DE\u586B\u540E\u4E3A\u975E\u7A7A\u5B57\u7B26\u4E32\uFF08\u5982\u8272\u503C/\u5C3A\u5BF8\u8BCD\u5F62\uFF09\u6216\u6570\u503C\u3002\u793A\u4F8B\u6570\u503C\u7981\u5165\u64AD\u79CD\u9762\uFF08NON-AUTHORITATIVE\uFF09\u3002",
+          anyOf: [
+            {
+              type: "string",
+              minLength: 1,
+              maxLength: 256
+            },
+            {
+              type: "number"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        color_group: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            brand: {
+              type: "object",
+              additionalProperties: false,
+              properties: {
+                primary: { $ref: "#/definitions/token_value" },
+                secondary: { $ref: "#/definitions/token_value" }
+              },
+              title: "\u54C1\u724C\u8272\uFF08primary/secondary\uFF09"
+            },
+            surface: {
+              type: "object",
+              additionalProperties: false,
+              properties: {
+                page: { $ref: "#/definitions/token_value" },
+                container: { $ref: "#/definitions/token_value" },
+                elevated: { $ref: "#/definitions/token_value" }
+              },
+              title: "\u8868\u9762\u8272\uFF08page/container/elevated\uFF09"
+            },
+            text: {
+              type: "object",
+              additionalProperties: false,
+              properties: {
+                primary: { $ref: "#/definitions/token_value" },
+                secondary: { $ref: "#/definitions/token_value" },
+                tertiary: { $ref: "#/definitions/token_value" },
+                disabled: { $ref: "#/definitions/token_value" }
+              },
+              title: "\u6587\u672C\u8272\uFF08primary/secondary/tertiary/disabled\uFF09"
+            },
+            border: {
+              type: "object",
+              additionalProperties: false,
+              properties: {
+                default: { $ref: "#/definitions/token_value" },
+                subtle: { $ref: "#/definitions/token_value" },
+                strong: { $ref: "#/definitions/token_value" }
+              },
+              title: "\u8FB9\u6846\u8272\uFF08default/subtle/strong\uFF09"
+            },
+            semantic: {
+              type: "object",
+              additionalProperties: false,
+              properties: {
+                success: { $ref: "#/definitions/token_value" },
+                warning: { $ref: "#/definitions/token_value" },
+                error: { $ref: "#/definitions/token_value" },
+                info: { $ref: "#/definitions/token_value" }
+              },
+              title: "\u8BED\u4E49\u72B6\u6001\u8272\uFF08success/warning/error/info\uFF09"
+            }
+          }
+        },
+        typography_group: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            family: {
+              type: "object",
+              additionalProperties: false,
+              properties: {
+                sans: { $ref: "#/definitions/token_value" },
+                mono: { $ref: "#/definitions/token_value" }
+              },
+              title: "\u5B57\u4F53\u65CF\uFF08sans/mono\uFF09"
+            },
+            size: {
+              type: "object",
+              additionalProperties: false,
+              properties: {
+                caption: { $ref: "#/definitions/token_value" },
+                body: { $ref: "#/definitions/token_value" },
+                body_large: { $ref: "#/definitions/token_value" },
+                title_small: { $ref: "#/definitions/token_value" },
+                title_medium: { $ref: "#/definitions/token_value" },
+                title_large: { $ref: "#/definitions/token_value" }
+              },
+              title: "\u5B57\u53F7\uFF08caption/body/body_large/title_small/title_medium/title_large\uFF09"
+            },
+            weight: {
+              type: "object",
+              additionalProperties: false,
+              properties: {
+                regular: { $ref: "#/definitions/token_value" },
+                medium: { $ref: "#/definitions/token_value" },
+                semibold: { $ref: "#/definitions/token_value" }
+              },
+              title: "\u5B57\u91CD\uFF08regular/medium/semibold\uFF09"
+            },
+            line_height: {
+              type: "object",
+              additionalProperties: false,
+              properties: {
+                compact: { $ref: "#/definitions/token_value" },
+                normal: { $ref: "#/definitions/token_value" },
+                relaxed: { $ref: "#/definitions/token_value" }
+              },
+              title: "\u884C\u9AD8\uFF08compact/normal/relaxed\uFF09"
+            }
+          }
+        },
+        spacing_group: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            xs: { $ref: "#/definitions/token_value" },
+            sm: { $ref: "#/definitions/token_value" },
+            md: { $ref: "#/definitions/token_value" },
+            lg: { $ref: "#/definitions/token_value" },
+            xl: { $ref: "#/definitions/token_value" },
+            xxl: { $ref: "#/definitions/token_value" },
+            section_gap: {
+              $ref: "#/definitions/token_value",
+              title: "\u8282\u95F4\u8DDD\uFF08\u547D\u540D\u6536\u655B\u5B9A\u7A3F\uFF1A\u539F\u6587 \xA717 spacing.section_gap \u9010\u5B57\uFF1B\xA716 layout.section_gap \u5E9F\u5F03\uFF09",
+              description: "\u95F4\u8DDD\u8BED\u4E49\u5F52 spacing \u7EC4\uFF08\xA717 \u8BED\u4E49 token \u5148\u4F8B\uFF09\uFF1Blayout \u7EC4\u4E0D\u627F\u8F7D\u672C\u952E\u3002"
+            }
+          }
+        },
+        radius_group: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            sm: { $ref: "#/definitions/token_value" },
+            md: { $ref: "#/definitions/token_value" },
+            lg: { $ref: "#/definitions/token_value" }
+          }
+        },
+        elevation_group: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            card: { $ref: "#/definitions/token_value" },
+            popover: { $ref: "#/definitions/token_value" },
+            modal: { $ref: "#/definitions/token_value" }
+          }
+        },
+        density_group: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            control_height: { $ref: "#/definitions/token_value" },
+            compact_control_height: { $ref: "#/definitions/token_value" },
+            table_row_height: { $ref: "#/definitions/token_value" },
+            compact_table_row_height: { $ref: "#/definitions/token_value" }
+          }
+        },
+        layout_group: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            page_padding: { $ref: "#/definitions/token_value" },
+            content_max_width: { $ref: "#/definitions/token_value" },
+            sidebar_width: { $ref: "#/definitions/token_value" },
+            header_height: { $ref: "#/definitions/token_value" }
+          },
+          title: "\u5E03\u5C40\u7ED3\u6784\u952E\uFF08page_padding/content_max_width/sidebar_width/header_height\u2014\u2014\xA716 \u952E\u96C6\u51CF section_gap\uFF09"
+        },
+        motion_group: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            fast: { $ref: "#/definitions/token_value" },
+            normal: { $ref: "#/definitions/token_value" },
+            slow: { $ref: "#/definitions/token_value" }
+          }
+        },
+        breakpoints_group: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            sm: { $ref: "#/definitions/token_value" },
+            md: { $ref: "#/definitions/token_value" },
+            lg: { $ref: "#/definitions/token_value" },
+            xl: { $ref: "#/definitions/token_value" }
+          }
+        }
+      }
+    };
+  }
+});
+
 // packages/schemas/dist/src/vocab.js
-var IR_SCHEMA_DIALECT, LIFECYCLE_VALUES, CONFIDENCE_VALUES, EVIDENCE_VALUES, CHANGE_VALUES, LIFECYCLE_TRANSITIONS, SOURCE_TYPE_ALL_VALUES, SOURCE_TYPE_FORBIDDEN_VALUES, GOVERNED_ID_PREFIXES, ALIASES_V0, TRUTH_BODY_KINDS, CATALOG_ENFORCEMENT_VALUES, CATALOG_CLASSIFICATION_VALUES, CATALOG_LANE_VALUES, CATALOG_CHANGE_CLASS_VALUES, CATALOG_GOVERNANCE_PROFILE_VALUES, RECONCILE_DELTA_KINDS, VERDICT_VALUES, ORIGIN_VALUES, VERIFICATION_VERDICT_VALUES, PRODUCER_KIND_VALUES, ACTOR_TYPE_VALUES, RUN_TRIGGER_VALUES, DENOMINATOR_STATUS_VALUES, DISCOVERY_CHAIN_VALUES, DISCOVERY_CHAIN_TRANSITIONS, DISCOVERY_PROMOTION_BASIS_VALUES, BLUEPRINT_ENVELOPE_STATUS_VALUES, RESEARCH_FINDING_CONFIDENCE_VALUES, RESEARCH_EVIDENCE_LEVEL_VALUES, RESEARCH_AUTHORITY_EFFECT_VALUES, RESEARCH_MODE_VALUES, EXCEPTION_CLASSIFICATION_VALUES, KNOWLEDGE_KIND_VALUES, KNOWLEDGE_STATUS_VALUES, KNOWLEDGE_TRANSITIONS, KNOWLEDGE_PROMOTION_AUTHORITY_VALUES, KNOWLEDGE_CONFIDENCE_VALUES, EXECUTION_RUNTIME_VALUES, EXECUTION_IDENTITY_KIND_VALUES, EXECUTION_ROLE_VALUES, LOCK_KIND_VALUES, AGENT_ROLE_POOL_VALUES, RUNTIME_CAPABILITY_VALUES, RUNTIME_DEGRADATION_RULE_IDS, WORD_FORM_DOMAIN_VALUES, EQUIVALENCE_STATUS_VALUES, PORTABILITY_CANONICAL_SET_VALUES, PORTABILITY_RUNTIME_REBUILD_VALUES, PORTABILITY_FORBIDDEN_DEPENDENCY_VALUES, MEMORY_DRIFT, HARVEST_BUCKET_VALUES, HARVEST_PRIMARY_BUCKETS, HARVEST_SPECIAL_EXIT_VALUES, MEMORY_CLASS_VALUES, REVIEW_STATE_VALUES, HARVEST_SOURCE_VALUES, HARVEST_CONFIDENCE_VALUES, MEMORY_CLI_ERROR_VALUES, OWNER_ESCALATION_REQUIRED, PHASE_TIMELINE_VALUES, PRODUCTION_SIGNAL_SOURCE_VALUES, DIAGNOSIS_KIND_VALUES, BAND_PREDICATE_OPERATOR_VALUES, CONTROL_BAND_EVALUATION_STATUS_VALUES, CAPABILITY_OUTCOME_METRIC_STATUS_VALUES, CAPABILITY_OUTCOME_METRIC_KEY_VALUES, SELF_IMPROVEMENT_SIGNAL_VALUES, SELF_IMPROVEMENT_SIGNAL_PRD_LABELS, POMASTER_SELF_IMPROVEMENT_CANDIDATE, DETECTED_BY_TOOL_SIGNAL, PRODUCTION_CLI_ERROR_VALUES, RELATION_TYPE_VALUES, RELATION_ORIGIN_VALUES, RELATION_ENDPOINT_DOMAIN_VALUES, RELATION_CONFIDENCE_VALUES, SUBSTRATE_LAYER_VALUES, RESOLUTION_MATCH_CLASS_VALUES, OBJECT_FAMILY_VALUES, CATALOG_KIND_VALUES;
+var IR_SCHEMA_DIALECT, LIFECYCLE_VALUES, CONFIDENCE_VALUES, EVIDENCE_VALUES, CHANGE_VALUES, LIFECYCLE_TRANSITIONS, SOURCE_TYPE_ALL_VALUES, SOURCE_TYPE_FORBIDDEN_VALUES, BINDING_CLASS_VALUES, BINDING_STATUS_VALUES, GOVERNED_ID_PREFIXES, ALIASES_V0, TRUTH_BODY_KINDS, CATALOG_ENFORCEMENT_VALUES, CATALOG_CLASSIFICATION_VALUES, CATALOG_LANE_VALUES, CATALOG_CHANGE_CLASS_VALUES, CATALOG_GOVERNANCE_PROFILE_VALUES, RECONCILE_DELTA_KINDS, VERDICT_VALUES, ORIGIN_VALUES, VERIFICATION_VERDICT_VALUES, PRODUCER_KIND_VALUES, ACTOR_TYPE_VALUES, RUN_TRIGGER_VALUES, DENOMINATOR_STATUS_VALUES, DISCOVERY_CHAIN_VALUES, DISCOVERY_CHAIN_TRANSITIONS, DISCOVERY_PROMOTION_BASIS_VALUES, BLUEPRINT_ENVELOPE_STATUS_VALUES, RESEARCH_FINDING_CONFIDENCE_VALUES, RESEARCH_EVIDENCE_LEVEL_VALUES, RESEARCH_AUTHORITY_EFFECT_VALUES, RESEARCH_MODE_VALUES, EXCEPTION_CLASSIFICATION_VALUES, KNOWLEDGE_KIND_VALUES, KNOWLEDGE_STATUS_VALUES, KNOWLEDGE_TRANSITIONS, KNOWLEDGE_PROMOTION_AUTHORITY_VALUES, KNOWLEDGE_CONFIDENCE_VALUES, EXECUTION_RUNTIME_VALUES, EXECUTION_IDENTITY_KIND_VALUES, EXECUTION_ROLE_VALUES, LOCK_KIND_VALUES, AGENT_ROLE_POOL_VALUES, RUNTIME_CAPABILITY_VALUES, RUNTIME_DEGRADATION_RULE_IDS, WORD_FORM_DOMAIN_VALUES, EQUIVALENCE_STATUS_VALUES, PORTABILITY_CANONICAL_SET_VALUES, PORTABILITY_RUNTIME_REBUILD_VALUES, PORTABILITY_FORBIDDEN_DEPENDENCY_VALUES, MEMORY_DRIFT, HARVEST_BUCKET_VALUES, HARVEST_PRIMARY_BUCKETS, HARVEST_SPECIAL_EXIT_VALUES, MEMORY_CLASS_VALUES, REVIEW_STATE_VALUES, HARVEST_SOURCE_VALUES, HARVEST_CONFIDENCE_VALUES, MEMORY_CLI_ERROR_VALUES, OWNER_ESCALATION_REQUIRED, PHASE_TIMELINE_VALUES, PRODUCTION_SIGNAL_SOURCE_VALUES, DIAGNOSIS_KIND_VALUES, BAND_PREDICATE_OPERATOR_VALUES, CONTROL_BAND_EVALUATION_STATUS_VALUES, CAPABILITY_OUTCOME_METRIC_STATUS_VALUES, CAPABILITY_OUTCOME_METRIC_KEY_VALUES, SELF_IMPROVEMENT_SIGNAL_VALUES, SELF_IMPROVEMENT_SIGNAL_PRD_LABELS, POMASTER_SELF_IMPROVEMENT_CANDIDATE, DETECTED_BY_TOOL_SIGNAL, PRODUCTION_CLI_ERROR_VALUES, RELATION_TYPE_VALUES, RELATION_ORIGIN_VALUES, RELATION_ENDPOINT_DOMAIN_VALUES, RELATION_CONFIDENCE_VALUES, SUBSTRATE_LAYER_VALUES, RESOLUTION_MATCH_CLASS_VALUES, OBJECT_FAMILY_VALUES, CATALOG_KIND_VALUES;
 var init_vocab = __esm({
   "packages/schemas/dist/src/vocab.js"() {
     "use strict";
@@ -18572,6 +18850,12 @@ var init_vocab = __esm({
       "prototype_html_scrape",
       "ai_invention"
     ];
+    BINDING_CLASS_VALUES = [
+      "page_to_dir",
+      "contract_operation_to_operationId",
+      "capability_to_file"
+    ];
+    BINDING_STATUS_VALUES = ["confirmed", "derived", "stale"];
     GOVERNED_ID_PREFIXES = [
       "PAGE",
       "CAPABILITY",
@@ -19059,7 +19343,7 @@ function performanceBudgetPropertyNames() {
   }
   return Object.keys(properties).sort();
 }
-var TRUTH_INDEX_ID, OBJECT_ENVELOPE_ID, GATE_RESULT_ID, KEYBINDING_ID, DENOMINATOR_ID, PRODUCER_ID, EVIDENCE_RECORDS_ID, DISCOVERY_STATE_CHAIN_ID, MSD_UNCERTAINTY_ID, RESEARCH_ARTIFACT_ID, EXCEPTION_LEDGER_ID, KNOWLEDGE_ENTRY_ID, EQUIVALENCE_REGISTRY_ID, MEMORY_HARVEST_ID, PRODUCTION_BAND_ID, EXECUTION_TRACE_ID, PERCEPTION_RECEIPTS_ID, DECISION_GRAPH_ID, SOFTWARE_GRAPH_RELATIONS_ID, SOURCES_AUTHORITY_ID, EVIDENCE_SPEC_ID, truthIndexSchema, objectEnvelopeSchema, gateResultSchema, keybindingSchema, denominatorSchema, producerSchema, evidenceRecordsSchema, discoveryStateChainSchema, msdUncertaintySchema, researchArtifactSchema, exceptionLedgerSchema, knowledgeEntrySchema, equivalenceRegistrySchema, memoryHarvestSchema, productionBandSchema, executionTraceSchema, perceptionReceiptsSchema, decisionGraphSchema, softwareGraphRelationsSchema, sourcesAuthoritySchema, evidenceSpecSchema, allSchemas, performanceBudgetDefinition, PERFORMANCE_BUDGET_FIELDS;
+var TRUTH_INDEX_ID, OBJECT_ENVELOPE_ID, GATE_RESULT_ID, KEYBINDING_ID, DENOMINATOR_ID, PRODUCER_ID, EVIDENCE_RECORDS_ID, DISCOVERY_STATE_CHAIN_ID, MSD_UNCERTAINTY_ID, RESEARCH_ARTIFACT_ID, EXCEPTION_LEDGER_ID, KNOWLEDGE_ENTRY_ID, EQUIVALENCE_REGISTRY_ID, MEMORY_HARVEST_ID, PRODUCTION_BAND_ID, EXECUTION_TRACE_ID, PERCEPTION_RECEIPTS_ID, DECISION_GRAPH_ID, SOFTWARE_GRAPH_RELATIONS_ID, SOURCES_AUTHORITY_ID, EVIDENCE_SPEC_ID, DESIGN_TOKENS_ID, truthIndexSchema, objectEnvelopeSchema, gateResultSchema, keybindingSchema, denominatorSchema, producerSchema, evidenceRecordsSchema, discoveryStateChainSchema, msdUncertaintySchema, researchArtifactSchema, exceptionLedgerSchema, knowledgeEntrySchema, equivalenceRegistrySchema, memoryHarvestSchema, productionBandSchema, executionTraceSchema, perceptionReceiptsSchema, decisionGraphSchema, softwareGraphRelationsSchema, sourcesAuthoritySchema, evidenceSpecSchema, designTokensSchema, allSchemas, performanceBudgetDefinition, PERFORMANCE_BUDGET_FIELDS;
 var init_src = __esm({
   "packages/schemas/dist/src/index.js"() {
     "use strict";
@@ -19084,6 +19368,7 @@ var init_src = __esm({
     init_software_graph_relations_schema();
     init_sources_authority_schema();
     init_evidence_spec_schema();
+    init_design_tokens_schema();
     init_vocab();
     TRUTH_INDEX_ID = "https://pomaster.dev/schemas/truth-index/v1-draft.json";
     OBJECT_ENVELOPE_ID = "https://pomaster.dev/schemas/object-envelope/v1-draft.json";
@@ -19106,6 +19391,7 @@ var init_src = __esm({
     SOFTWARE_GRAPH_RELATIONS_ID = "https://pomaster.dev/schemas/software-graph-relations/v1-draft.json";
     SOURCES_AUTHORITY_ID = "https://pomaster.dev/schemas/sources-authority/v1-draft.json";
     EVIDENCE_SPEC_ID = "https://pomaster.dev/schemas/evidence-spec/v1-draft.json";
+    DESIGN_TOKENS_ID = "https://pomaster.dev/schemas/design-tokens/v1-draft.json";
     truthIndexSchema = asSchema(truth_index_schema_default, TRUTH_INDEX_ID);
     objectEnvelopeSchema = asSchema(object_envelope_schema_default, OBJECT_ENVELOPE_ID);
     gateResultSchema = asSchema(gate_result_schema_default, GATE_RESULT_ID);
@@ -19127,6 +19413,7 @@ var init_src = __esm({
     softwareGraphRelationsSchema = asSchema(software_graph_relations_schema_default, SOFTWARE_GRAPH_RELATIONS_ID);
     sourcesAuthoritySchema = asSchema(sources_authority_schema_default, SOURCES_AUTHORITY_ID);
     evidenceSpecSchema = asSchema(evidence_spec_schema_default, EVIDENCE_SPEC_ID);
+    designTokensSchema = asSchema(design_tokens_schema_default, DESIGN_TOKENS_ID);
     allSchemas = {
       truthIndex: truthIndexSchema,
       objectEnvelope: objectEnvelopeSchema,
@@ -19148,7 +19435,8 @@ var init_src = __esm({
       decisionGraph: decisionGraphSchema,
       softwareGraphRelations: softwareGraphRelationsSchema,
       sourcesAuthority: sourcesAuthoritySchema,
-      evidenceSpec: evidenceSpecSchema
+      evidenceSpec: evidenceSpecSchema,
+      designTokens: designTokensSchema
     };
     performanceBudgetDefinition = definitionOf(objectEnvelopeSchema, "PerformanceBudget");
     PERFORMANCE_BUDGET_FIELDS = performanceBudgetPropertyNames();
@@ -24576,7 +24864,7 @@ function assertAuthorityBoundaries(paths, raw, tx) {
     }
   }
   if (denies.length > 0) {
-    throw new GovernanceError("AUTHORITY_BOUNDARY_DENY", `\u6743\u5A01\u7EF4\u5EA6\u95F8\u963B\u65AD\uFF08D-4\uFF09\uFF1A\u672C\u4E8B\u52A1\u5B58\u5728\u975E\u6743\u5A01\u6765\u6E90\u9A71\u52A8\u7684\u89E6\u53CA\u7EF4\u5EA6\u2014\u2014${denies.length} \u9879\u8D8A\u754C\uFF1A${denies.join("\uFF1B")}`, "\u6539\u7531\u5BF9\u8BE5\u7EF4\u5EA6 authoritative \u7684\u6765\u6E90\u9A71\u52A8\u672C\u53D8\u66F4\uFF08sources/index.yaml \u53CC\u8F74\u7533\u62A5\uFF09\uFF1B\u6216\u7531 Owner \u4FEE\u8BA2 authority.json map/boundary_rules \u7684\u7EF4\u5EA6\u5F52\u5C5E\uFF08\u63A8\u7FFB\u8FB9\u754C=Owner \u88C1\u5B9A\uFF0C\u7559\u75D5 owner-adjudications \u53F0\u8D26\uFF09\u3002\u672C\u4E8B\u52A1\u96F6\u843D\u76D8\u3002", {
+    throw new GovernanceError("AUTHORITY_BOUNDARY_DENY", `\u6743\u5A01\u7EF4\u5EA6\u95F8\u963B\u65AD\uFF08D-4\uFF09\uFF1A\u672C\u4E8B\u52A1\u5B58\u5728\u975E\u6743\u5A01\u6765\u6E90\u9A71\u52A8\u7684\u89E6\u53CA\u7EF4\u5EA6\u2014\u2014${denies.length} \u9879\u8D8A\u754C\uFF1A${denies.join("\uFF1B")}`, "\u6539\u7531\u5BF9\u8BE5\u7EF4\u5EA6 authoritative \u7684\u6765\u6E90\u9A71\u52A8\u672C\u53D8\u66F4\uFF08sources/index.yaml \u53CC\u8F74\u7533\u62A5\uFF09\uFF1B\u6216\u7531 Owner \u4FEE\u8BA2 authority.json map/boundary_rules \u7684\u7EF4\u5EA6\u5F52\u5C5E\uFF08\u63A8\u7FFB\u8FB9\u754C=Owner \u88C1\u5B9A\uFF1B\u7559\u75D5\u4F4D\u7F6E\u7531 Owner \u58F0\u660E\u2014\u2014\u4EA7\u54C1\u4ED3 corpus/master/cutover/owner-adjudications.md \u53F0\u8D26\uFF08\u96F6\u7A0B\u5E8F\u8BFB\u5199\uFF09\u6216\u6D88\u8D39\u9879\u76EE\u5185 Owner \u81EA\u9009\u7559\u75D5\u5904\uFF09\u3002\u672C\u4E8B\u52A1\u96F6\u843D\u76D8\u3002", {
       denies,
       boundary_rules_deny: faces.boundary_rules.filter((rule) => rule.effect === "deny").length,
       sources_registry_present: registry !== null
@@ -32534,17 +32822,17 @@ async function doctorProbes(store) {
   return { probes, ok };
 }
 function defaultRunner(command, args) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     try {
       const child = spawn(command, [...args], { shell: false, timeout: 1e4 });
       let stdout = "";
       child.stdout?.on("data", (chunk) => {
         stdout += chunk.toString("utf8");
       });
-      child.on("error", () => resolve3({ code: -1, stdout: "" }));
-      child.on("close", (code) => resolve3({ code: code ?? -1, stdout }));
+      child.on("error", () => resolve4({ code: -1, stdout: "" }));
+      child.on("close", (code) => resolve4({ code: code ?? -1, stdout }));
     } catch {
-      resolve3({ code: -1, stdout: "" });
+      resolve4({ code: -1, stdout: "" });
     }
   });
 }
@@ -37116,7 +37404,7 @@ var init_adapter_types = __esm({
 });
 
 // packages/gauntlet-lite/dist/detectors.js
-import { statSync as statSync4, readFileSync as readFileSync12 } from "node:fs";
+import { statSync as statSync4, readFileSync as readFileSync13 } from "node:fs";
 import { join as pathJoin } from "node:path";
 function platformDetectorFacts(projectRoot) {
   const isWindows = process.platform === "win32";
@@ -37135,7 +37423,7 @@ function platformDetectorFacts(projectRoot) {
     },
     readTextFile: (absolutePath) => {
       try {
-        return readFileSync12(absolutePath, "utf8");
+        return readFileSync13(absolutePath, "utf8");
       } catch {
         return null;
       }
@@ -37786,7 +38074,7 @@ var init_normalize_common = __esm({
 
 // packages/gauntlet-lite/dist/pytest-leg.js
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { mkdtempSync, readFileSync as readFileSync13, rmSync as rmSync4 } from "node:fs";
+import { mkdtempSync, readFileSync as readFileSync14, rmSync as rmSync5 } from "node:fs";
 import { tmpdir } from "node:os";
 import { join as join9 } from "node:path";
 import { performance as performance2 } from "node:perf_hooks";
@@ -37824,11 +38112,11 @@ function runPytestLeg(plan, spawnFn = pytestSpawn) {
   let stdout = run.stdout;
   if (reportDir !== null) {
     try {
-      stdout = readFileSync13(join9(reportDir, "junit.xml"), "utf8");
+      stdout = readFileSync14(join9(reportDir, "junit.xml"), "utf8");
     } catch {
     }
     try {
-      rmSync4(reportDir, { recursive: true, force: true });
+      rmSync5(reportDir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -38894,7 +39182,7 @@ var init_browser_adapter = __esm({
 
 // packages/gauntlet-lite/dist/playwright-leg.js
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync14, rmSync as rmSync5 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync15, rmSync as rmSync6 } from "node:fs";
 import { isAbsolute as pathIsAbsolute, join as pathJoin2, relative as pathRelative, resolve as pathResolve } from "node:path";
 import { performance as performance5 } from "node:perf_hooks";
 function isPlainObject2(value) {
@@ -39035,10 +39323,10 @@ function runPlaywrightLeg(plan, spawnFn = playwrightSpawn, executableProbe = pla
     };
   }
   try {
-    rmSync5(reportAbs, { force: true });
+    rmSync6(reportAbs, { force: true });
   } catch {
   }
-  if (existsSync12(reportAbs)) {
+  if (existsSync13(reportAbs)) {
     return {
       plan,
       kind: "pre_run_failed",
@@ -39057,7 +39345,7 @@ function runPlaywrightLeg(plan, spawnFn = playwrightSpawn, executableProbe = pla
   });
   let reportText = null;
   try {
-    reportText = readFileSync14(reportAbs, "utf8");
+    reportText = readFileSync15(reportAbs, "utf8");
   } catch {
     reportText = null;
   }
@@ -40049,7 +40337,7 @@ var init_oasdiff_leg = __esm({
 
 // packages/gauntlet-lite/dist/schemathesis-leg.js
 import { spawnSync as spawnSync7 } from "node:child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync15, rmSync as rmSync6 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync16, rmSync as rmSync7 } from "node:fs";
 import { isAbsolute as pathIsAbsolute2, join as pathJoin3, relative as pathRelative2, resolve as pathResolve2 } from "node:path";
 import { performance as performance8 } from "node:perf_hooks";
 function pathEscapesProjectRoot2(projectRoot, absolutePath) {
@@ -40114,10 +40402,10 @@ function runSchemathesisLeg(plan, spawnFn = schemathesisSpawn, executableProbe =
     };
   }
   try {
-    rmSync6(reportAbs, { force: true });
+    rmSync7(reportAbs, { force: true });
   } catch {
   }
-  if (existsSync13(reportAbs)) {
+  if (existsSync14(reportAbs)) {
     return {
       plan,
       kind: "pre_run_failed",
@@ -40136,7 +40424,7 @@ function runSchemathesisLeg(plan, spawnFn = schemathesisSpawn, executableProbe =
   });
   let reportText = null;
   try {
-    reportText = readFileSync15(reportAbs, "utf8");
+    reportText = readFileSync16(reportAbs, "utf8");
   } catch {
     reportText = null;
   }
@@ -40443,7 +40731,7 @@ var init_schemathesis_leg = __esm({
 });
 
 // packages/gauntlet-lite/dist/contract-adapter.js
-import { readFileSync as readFileSync16 } from "node:fs";
+import { readFileSync as readFileSync17 } from "node:fs";
 import { join as pathJoin4 } from "node:path";
 import { performance as performance9 } from "node:perf_hooks";
 function readContractConfig(facts) {
@@ -40817,7 +41105,7 @@ function createContractAdapter(options = {}) {
       }
       let text;
       try {
-        text = readFileSync16(pathJoin4(plan.projectRoot, plan.openapiPath ?? ""), "utf8");
+        text = readFileSync17(pathJoin4(plan.projectRoot, plan.openapiPath ?? ""), "utf8");
       } catch {
         return {
           plan,
@@ -41350,7 +41638,7 @@ var init_import_linter_leg = __esm({
 });
 
 // packages/gauntlet-lite/dist/architecture-adapter.js
-import { readdirSync as readdirSync18, readFileSync as readFileSync17 } from "node:fs";
+import { readdirSync as readdirSync18, readFileSync as readFileSync18 } from "node:fs";
 import { join as pathJoin5, sep as pathSep } from "node:path";
 import { performance as performance12 } from "node:perf_hooks";
 function readArchitectureConfig(facts) {
@@ -41742,7 +42030,7 @@ function createArchitectureAdapter(options = {}) {
         filesCovered++;
         let text;
         try {
-          text = readFileSync17(pathJoin5(plan.projectRoot, relative3), "utf8");
+          text = readFileSync18(pathJoin5(plan.projectRoot, relative3), "utf8");
         } catch {
           continue;
         }
@@ -41885,7 +42173,7 @@ var init_architecture_adapter = __esm({
 
 // packages/gauntlet-lite/dist/coverage-leg.js
 import { spawnSync as spawnSync10 } from "node:child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync18, rmSync as rmSync7 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync19, rmSync as rmSync8 } from "node:fs";
 import { join as pathJoin6, dirname as pathDirname, isAbsolute as pathIsAbsolute3, relative as pathRelative3, resolve as pathResolve3 } from "node:path";
 import { performance as performance13 } from "node:perf_hooks";
 function resolveCoverageProvisionalThresholdsForTier(tier) {
@@ -41946,10 +42234,10 @@ function runCoverageLeg(plan, spawnFn = coverageSpawn, executableProbe = platfor
     };
   }
   try {
-    rmSync7(reportAbs, { force: true });
+    rmSync8(reportAbs, { force: true });
   } catch {
   }
-  if (existsSync14(reportAbs)) {
+  if (existsSync15(reportAbs)) {
     return {
       plan,
       kind: "pre_run_failed",
@@ -41969,7 +42257,7 @@ function runCoverageLeg(plan, spawnFn = coverageSpawn, executableProbe = platfor
   });
   let reportText = null;
   try {
-    reportText = readFileSync18(reportAbs, "utf8");
+    reportText = readFileSync19(reportAbs, "utf8");
   } catch {
     reportText = null;
   }
@@ -42534,7 +42822,7 @@ var init_crap = __esm({
 });
 
 // packages/gauntlet-lite/dist/coverage-adapter.js
-import { readFileSync as readFileSync19 } from "node:fs";
+import { readFileSync as readFileSync20 } from "node:fs";
 import { join as pathJoin7 } from "node:path";
 import { performance as performance14 } from "node:perf_hooks";
 function isPlainObject3(value) {
@@ -43007,7 +43295,7 @@ function createCrapGateAdapter() {
       }
       const readOrNull = (relative3) => {
         try {
-          return readFileSync19(pathJoin7(plan.projectRoot, relative3), "utf8");
+          return readFileSync20(pathJoin7(plan.projectRoot, relative3), "utf8");
         } catch {
           return null;
         }
@@ -43052,7 +43340,7 @@ var init_coverage_adapter = __esm({
 
 // packages/gauntlet-lite/dist/mutation-leg.js
 import { spawnSync as spawnSync11 } from "node:child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync20, rmSync as rmSync8 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync21, rmSync as rmSync9 } from "node:fs";
 import { join as pathJoin8, isAbsolute as pathIsAbsolute4, relative as pathRelative4, resolve as pathResolve4 } from "node:path";
 import { performance as performance15 } from "node:perf_hooks";
 function runMutationLeg(plan, spawnFn = mutationSpawn, executableProbe = platformExecutableProbe) {
@@ -43104,10 +43392,10 @@ function runMutationLeg(plan, spawnFn = mutationSpawn, executableProbe = platfor
     };
   }
   try {
-    rmSync8(reportAbs, { force: true });
+    rmSync9(reportAbs, { force: true });
   } catch {
   }
-  if (existsSync15(reportAbs)) {
+  if (existsSync16(reportAbs)) {
     return {
       plan,
       kind: "pre_run_failed",
@@ -43126,7 +43414,7 @@ function runMutationLeg(plan, spawnFn = mutationSpawn, executableProbe = platfor
   });
   let reportText = null;
   try {
-    reportText = readFileSync20(reportAbs, "utf8");
+    reportText = readFileSync21(reportAbs, "utf8");
   } catch {
     reportText = null;
   }
@@ -43881,7 +44169,7 @@ var init_mutation_adapter = __esm({
 
 // packages/gauntlet-lite/dist/performance-leg.js
 import { spawnSync as spawnSync12 } from "node:child_process";
-import { existsSync as existsSync16, readFileSync as readFileSync21, rmSync as rmSync9 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync22, rmSync as rmSync10 } from "node:fs";
 import { isAbsolute as pathIsAbsolute5, join as pathJoin9, relative as pathRelative5, resolve as pathResolve5 } from "node:path";
 import { performance as performance17 } from "node:perf_hooks";
 function performanceCapabilityNote(runner) {
@@ -44114,10 +44402,10 @@ function runPerformanceLeg(plan, spawnFn = performanceSpawn, executableProbe = p
     };
   }
   try {
-    rmSync9(reportAbs, { force: true });
+    rmSync10(reportAbs, { force: true });
   } catch {
   }
-  if (existsSync16(reportAbs)) {
+  if (existsSync17(reportAbs)) {
     return {
       plan,
       kind: "pre_run_failed",
@@ -44136,7 +44424,7 @@ function runPerformanceLeg(plan, spawnFn = performanceSpawn, executableProbe = p
   });
   let reportText = null;
   try {
-    reportText = readFileSync21(reportAbs, "utf8");
+    reportText = readFileSync22(reportAbs, "utf8");
   } catch {
     reportText = null;
   }
@@ -44945,7 +45233,7 @@ var init_performance_adapter = __esm({
 
 // packages/gauntlet-lite/dist/security-leg.js
 import { spawnSync as spawnSync13 } from "node:child_process";
-import { existsSync as existsSync17, readFileSync as readFileSync22, rmSync as rmSync10 } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync23, rmSync as rmSync11 } from "node:fs";
 import { isAbsolute as pathIsAbsolute6, join as pathJoin10, relative as pathRelative6, resolve as pathResolve6 } from "node:path";
 import { performance as performance19 } from "node:perf_hooks";
 function securityCapabilityNote(runner) {
@@ -45000,10 +45288,10 @@ function runSecurityLeg(plan, spawnFn = securitySpawn, executableProbe = platfor
     };
   }
   try {
-    rmSync10(reportAbs, { force: true });
+    rmSync11(reportAbs, { force: true });
   } catch {
   }
-  if (existsSync17(reportAbs)) {
+  if (existsSync18(reportAbs)) {
     return {
       plan,
       kind: "pre_run_failed",
@@ -45022,7 +45310,7 @@ function runSecurityLeg(plan, spawnFn = securitySpawn, executableProbe = platfor
   });
   let reportText = null;
   try {
-    reportText = readFileSync22(reportAbs, "utf8");
+    reportText = readFileSync23(reportAbs, "utf8");
   } catch {
     reportText = null;
   }
@@ -46954,7 +47242,7 @@ function readCliPackageVersion() {
 }
 function resolveCliVersion() {
   if (true) {
-    return "0.5.3";
+    return "0.6.1";
   }
   return readCliPackageVersion();
 }
@@ -48650,10 +48938,10 @@ async function runContextCompile(rootDir, role, deps, inputs, options) {
         applicability: applicabilityViewOf(inputs),
         verificationRefs
       });
-      const { mkdirSync: mkdirSync4, writeFileSync: writeFileSync6 } = await import("node:fs");
+      const { mkdirSync: mkdirSync4, writeFileSync: writeFileSync7 } = await import("node:fs");
       try {
         mkdirSync4(contextsDirPath(rootDir), { recursive: true });
-        writeFileSync6(`${contextsDirPath(rootDir)}/${fileName}`, `${JSON.stringify(document, null, 2)}
+        writeFileSync7(`${contextsDirPath(rootDir)}/${fileName}`, `${JSON.stringify(document, null, 2)}
 `, "utf8");
         manifestPath = relativePath;
         persisted = true;
@@ -48939,7 +49227,7 @@ var COMMAND_PANORAMA_LINES = [
   "pomaster doctor",
   "pomaster portability bootstrap/check",
   "pomaster update --check/--yes",
-  "pomaster baseline set/confirm        # set = \u5355\u952E\u540E\u8865\u9500\u8D26\uFF1Bconfirm = \u57FA\u7EBF\u786E\u8BA4 gate\uFF0814 unknowns \u9500\u8D26\u540E digest \u5FEB\u7167\u2014\u2014closeout \u963B\u65AD\u7801\u4E0E doctor/status \u786E\u8BA4\u6001\u7684\u6D88\u8D39\u6E90\uFF09",
+  "pomaster baseline set/confirm        # set = \u5355\u952E\u540E\u8865\u9500\u8D26\uFF1Bconfirm = \u57FA\u7EBF\u786E\u8BA4 gate\uFF08\u963B\u585E\u96C6\u6E05\u96F6\u540E digest \u5FEB\u7167\u2014\u2014closeout \u963B\u65AD\u7801\u4E0E doctor/status \u786E\u8BA4\u6001\u7684\u6D88\u8D39\u6E90\uFF09",
   "",
   "# \u2460 DISCOVERY \u2014\u2014 \u9700\u6C42\u62F7\u95EE/\u95EE\u9898\u95F8/\u51B3\u8BAE\u56FE\uFF08Brainstorm/Question Gate\uFF1BD-5\uFF0C\u88C1\u51B3 18\uFF09",
   "pomaster brainstorm start/question-gate/status/decide/promote",
@@ -48987,7 +49275,7 @@ var COMMAND_PANORAMA_LINES = [
   "pomaster handoff <task> --to <role>",
   "pomaster session attach/refresh/list",
   "pomaster lock acquire/heartbeat/release/steal/list",
-  "pomaster execution begin/end/list",
+  "pomaster execution begin/end/list/audit",
   "pomaster trace show/list"
 ];
 var CAPABILITY_OVERVIEW = [
@@ -49447,7 +49735,7 @@ var SKILL_MANIFEST = [
         "pomaster agents status",
         "pomaster session attach/refresh/list",
         "pomaster lock acquire/heartbeat/release/steal/list",
-        "pomaster execution begin/end/list",
+        "pomaster execution begin/end/list/audit",
         "pomaster trace show/list",
         "pomaster run <task>",
         "pomaster handoff <task> --to <role>"
@@ -49554,10 +49842,10 @@ var FACET_DIR = {
 };
 async function countSeededAssets(rootDir) {
   const { readdir: readdir3 } = await import("node:fs/promises");
-  const { join: join16 } = await import("node:path");
+  const { join: join18 } = await import("node:path");
   const pomasterDir = toPosix(buildStorePaths(rootDir).pomasterDir);
   async function countFiles(relative3) {
-    const absolute = join16(pomasterDir, ...relative3.split("/"));
+    const absolute = join18(pomasterDir, ...relative3.split("/"));
     let entries;
     try {
       entries = await readdir3(absolute, { withFileTypes: true });
@@ -49587,11 +49875,11 @@ function seededAssetsHumanLine(counts) {
 }
 async function countLegacySpecFiles(rootDir) {
   const { readdir: readdir3 } = await import("node:fs/promises");
-  const { join: join16 } = await import("node:path");
+  const { join: join18 } = await import("node:path");
   const pomasterDir = toPosix(buildStorePaths(rootDir).pomasterDir);
   const legacyDirs = ["specs/hard/frontend", "specs/hard/backend"];
   async function countFiles(relative3) {
-    const absolute = join16(pomasterDir, ...relative3.split("/"));
+    const absolute = join18(pomasterDir, ...relative3.split("/"));
     let entries;
     try {
       entries = await readdir3(absolute, { withFileTypes: true });
@@ -49945,6 +50233,156 @@ function specPreplantHumanLine(presentation) {
 init_dist();
 import { writeFile } from "node:fs/promises";
 
+// packages/cli/dist/fs-cas.js
+import { existsSync as existsSync10, linkSync as linkSync2, readFileSync as readFileSync10, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
+var nodeCasSwapFs = {
+  writeFileSync: writeFileSync4,
+  renameSync: renameSync3,
+  readFileSync: readFileSync10,
+  linkSync: linkSync2,
+  existsSync: existsSync10,
+  rmSync: rmSync4
+};
+var CLAIM_RETRY_DELAYS_MS = [20, 50, 100];
+function sleepSync2(ms) {
+  if (ms <= 0)
+    return;
+  const buffer = new Int32Array(new SharedArrayBuffer(4));
+  try {
+    Atomics.wait(buffer, 0, 0, ms);
+  } catch {
+    const end = performance.now() + ms;
+    while (performance.now() < end) {
+    }
+  }
+}
+function errnoOf(error) {
+  if (typeof error !== "object" || error === null || !("code" in error))
+    return null;
+  const code = error.code;
+  return typeof code === "string" ? code : null;
+}
+function isNotFoundError2(error) {
+  return errnoOf(error) === "ENOENT";
+}
+function isTransientClaimError(error) {
+  const code = errnoOf(error);
+  return code === "EPERM" || code === "EACCES";
+}
+function classifyContentionOrFault(error, stepCause) {
+  const code = errnoOf(error);
+  if (code === "ENOENT" || code === "EPERM" || code === "EACCES") {
+    return { kind: "contended", cause: `${stepCause}\uFF08${code}\uFF09\u2014\u2014\u5E76\u53D1\u4EA4\u9519/\u77AC\u65F6\u9501\uFF0C\u6574\u94FE\u91CD\u8BFB\u91CD\u7B97` };
+  }
+  return { kind: "fault", code: code ?? "UNKNOWN", cause: `${stepCause}\u2014\u2014\u6301\u7EED\u73AF\u5883\u6545\u969C\uFF08\u91CD\u8BD5\u65E0\u76CA\uFF09` };
+}
+function renameWithLiarDefense(fs, op, dst) {
+  withBoundedRetry2(fs, () => {
+    try {
+      op();
+    } catch (error) {
+      if (isNotFoundError2(error) && fs.existsSync(dst))
+        return;
+      throw error;
+    }
+  });
+}
+function removeBestEffort2(fs, path) {
+  try {
+    fs.rmSync(path, { force: true });
+  } catch {
+  }
+}
+var casSequence = 0;
+function uniqueAdjacentPath2(target, tag) {
+  casSequence += 1;
+  return `${target}.${tag}-${process.pid}-${casSequence}`;
+}
+function withBoundedRetry2(fs, op) {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      op();
+      return;
+    } catch (error) {
+      if (attempt >= CLAIM_RETRY_DELAYS_MS.length || !isTransientClaimError(error))
+        throw error;
+      sleepSync2(CLAIM_RETRY_DELAYS_MS[attempt]);
+    }
+  }
+}
+function casSwapFile(target, expected, next, fs = nodeCasSwapFs) {
+  const tmp = uniqueAdjacentPath2(target, "r1tmp");
+  try {
+    fs.writeFileSync(tmp, next, "utf8");
+  } catch (error) {
+    removeBestEffort2(fs, tmp);
+    return classifyContentionOrFault(error, "tmp \u843D\u76D8\u5931\u8D25\uFF08\u8BA4\u9886\u524D\u843D\u76D8\u4F4D\uFF09");
+  }
+  const claim = uniqueAdjacentPath2(target, "r1claim");
+  try {
+    renameWithLiarDefense(fs, () => fs.renameSync(target, claim), claim);
+  } catch (error) {
+    removeBestEffort2(fs, tmp);
+    if (isNotFoundError2(error))
+      return { kind: "absent" };
+    if (isTransientClaimError(error)) {
+      return {
+        kind: "contended",
+        cause: `\u8BA4\u9886 rename \u77AC\u65F6\u9501\u6709\u754C\u91CD\u8BD5\u8017\u5C3D\uFF08${errnoOf(error) ?? "UNKNOWN"}\uFF09\u2014\u2014\u76EE\u6807\u6301\u7EED\u88AB\u5E76\u53D1\u65B9\u9501\u4F4F`
+      };
+    }
+    return {
+      kind: "fault",
+      code: errnoOf(error) ?? "UNKNOWN",
+      cause: "\u8BA4\u9886 rename \u6301\u7EED\u73AF\u5883\u6545\u969C\uFF08\u91CD\u8BD5\u65E0\u76CA\uFF09"
+    };
+  }
+  let claimedBytes = null;
+  try {
+    claimedBytes = fs.readFileSync(claim, "utf8");
+  } catch {
+    claimedBytes = null;
+  }
+  if (claimedBytes !== expected) {
+    try {
+      renameWithLiarDefense(fs, () => fs.renameSync(claim, target), target);
+    } catch (error) {
+      removeBestEffort2(fs, tmp);
+      if (isNotFoundError2(error)) {
+        return {
+          kind: "contended",
+          cause: "\u56DE\u88C5\u6B65\u8BA4\u9886\u6587\u4EF6\u88AB\u5E76\u53D1\u65B9\u4EA4\u9519\u53D6\u8D70\uFF08claim \u4F4D ENOENT \u4E14 target \u7F3A\u5E2D\uFF09\u2014\u2014\u4E16\u4EE3\u968F\u5BF9\u624B\u8BA4\u9886\u6536\u655B\uFF0C\u6574\u94FE\u91CD\u8BFB"
+        };
+      }
+      if (isTransientClaimError(error)) {
+        return {
+          kind: "contended",
+          cause: `\u56DE\u88C5\u5F52\u8FD8\u539F\u4F4D rename \u77AC\u65F6\u9501\u6709\u754C\u91CD\u8BD5\u8017\u5C3D\uFF08${errnoOf(error) ?? "UNKNOWN"}\uFF09\u2014\u2014claim \u539F\u6837\u7559\u76D8`
+        };
+      }
+      return {
+        kind: "fault",
+        code: errnoOf(error) ?? "UNKNOWN",
+        cause: "\u56DE\u88C5\u5F52\u8FD8\u539F\u4F4D rename \u6301\u7EED\u73AF\u5883\u6545\u969C\u2014\u2014claim \u539F\u6837\u7559\u76D8\uFF08\u8BA4\u9886\u5185\u5BB9\u672A\u53D7\u635F\uFF09"
+      };
+    }
+    removeBestEffort2(fs, tmp);
+    return { kind: "conflict" };
+  }
+  try {
+    fs.linkSync(tmp, target);
+  } catch (error) {
+    removeBestEffort2(fs, tmp);
+    if (errnoOf(error) === "EEXIST") {
+      return { kind: "conflict" };
+    }
+    return classifyContentionOrFault(error, "link \u56DE\u88C5\u5931\u8D25\uFF08\u5B89\u88C5\u4F4D\uFF09\u2014\u2014claim \u539F\u6837\u7559\u76D8\uFF08\u8BA4\u9886\u5185\u5BB9\u672A\u53D7\u635F\uFF09");
+  }
+  removeBestEffort2(fs, tmp);
+  removeBestEffort2(fs, claim);
+  return { kind: "swapped" };
+}
+
 // packages/cli/dist/interactive-keys.js
 var CHECKLIST_KEYS = {
   /** ↑ */
@@ -50051,9 +50489,9 @@ function deniedReasonToCode(reason) {
   }
 }
 function parseActorArgv(raw) {
-  const sep2 = raw.indexOf(":");
-  const type2 = sep2 === -1 ? "" : raw.slice(0, sep2);
-  const name = sep2 === -1 ? "" : raw.slice(sep2 + 1);
+  const sep3 = raw.indexOf(":");
+  const type2 = sep3 === -1 ? "" : raw.slice(0, sep3);
+  const name = sep3 === -1 ? "" : raw.slice(sep3 + 1);
   if (!ACTOR_TYPE_VALUES.includes(type2) || name.length === 0) {
     return {
       error: {
@@ -50735,54 +51173,28 @@ async function observePackageStack(rootDir) {
   }
   return { source: "package.json", values };
 }
-async function applyStackObservations(rootDir, observation, files) {
-  let observed = 0;
-  let skippedResolved = 0;
+async function registerStackObservationCandidates(rootDir, observation) {
   const lane = "frontend";
   const laneKeys = STACK_KEYS[lane];
-  const stackRelative = baselineStackRelative(lane);
-  const stackFile = await readTextFile(`${rootDir}/${stackRelative}`);
+  const stackFile = await readTextFile(`${rootDir}/${baselineStackRelative(lane)}`);
   if (stackFile.kind !== "ok")
-    return { observed, skipped_resolved: skippedResolved };
+    return { observed: 0, skipped_resolved: 0, candidates: [] };
   const parse = parseStackYaml(stackFile.text, laneKeys);
   if (!parse.ok)
-    return { observed, skipped_resolved: skippedResolved };
-  const lines = stackFile.text.split("\n");
-  const wordForms = /* @__PURE__ */ new Set();
-  let stackChanged = false;
+    return { observed: 0, skipped_resolved: 0, candidates: [] };
+  const candidates = [];
+  let skippedResolved = 0;
   for (const key of laneKeys) {
     const value = observation.values.get(key);
     if (value === void 0)
       continue;
-    const current = parse.parsed.values.get(key) ?? "";
-    if (isResolved(current)) {
+    if (isResolved(parse.parsed.values.get(key) ?? "")) {
       skippedResolved += 1;
       continue;
     }
-    const lineIndex = parse.parsed.lineOf.get(key);
-    if (lineIndex === void 0)
-      continue;
-    lines[lineIndex] = `${key}: ${value} # ${OBSERVED_ANNOTATION}`;
-    wordForms.add(unknownsWordForm(lane, key));
-    observed += 1;
-    stackChanged = true;
-  }
-  if (stackChanged) {
-    const nextStack = lines.join("\n");
-    if (nextStack !== stackFile.text) {
-      await writeFile(`${rootDir}/${stackRelative}`, nextStack, "utf8");
-      files.push({ file: stackRelative, action: "updated" });
-    }
-    const manifestFile = await readTextFile(`${rootDir}/${BASELINE_MANIFEST_RELATIVE}`);
-    if (manifestFile.kind === "ok") {
-      const { next } = removeUnknownEntries(manifestFile.text, wordForms);
-      if (next !== manifestFile.text) {
-        await writeFile(`${rootDir}/${BASELINE_MANIFEST_RELATIVE}`, next, "utf8");
-        files.push({ file: BASELINE_MANIFEST_RELATIVE, action: "updated" });
-      }
-    }
+    candidates.push({ lane, key, value, source: "package.json" });
   }
-  return { observed, skipped_resolved: skippedResolved };
+  return { observed: candidates.length, skipped_resolved: skippedResolved, candidates };
 }
 function isStackValueResolved(value) {
   return isResolved(value);
@@ -50798,8 +51210,227 @@ async function loadLaneStackValues(rootDir, lane) {
 function unknownsWordForm(lane, key) {
   return `baseline/${lane}/stack.yaml:${key}`;
 }
-var UNKNOWN_ENTRY_LINE = /^\s*-\s*(.+?)\s*$/;
-var UNKNOWN_ENTRY_COUNT = /^\s*-\s*baseline\/(?:frontend|backend)\/stack\.yaml:[A-Za-z0-9_-]+\s*$/;
+var FLAT_ENTRY_LINE = /^\s*-\s*(\S.*?)\s*$/;
+var STRUCTURED_ENTRY_KEY_LINE = /^(\s*)-\s*key\s*:\s*(.*?)\s*$/;
+var STRUCTURED_FIELD_LINE = /^(\s*)([A-Za-z][A-Za-z0-9_-]*)\s*:\s*(.*)$/;
+var STACK_WORD_FORM_PATTERN = /^baseline\/(frontend|backend)\/stack\.yaml:([A-Za-z0-9_-]+)$/;
+var BASELINE_UNKNOWN_APPLICABILITY_VALUES = ["BLOCKING", "NOT_APPLICABLE", "DEFERRED"];
+var MSD_UNKNOWN_CLASSIFICATION_VALUES = [
+  "BLOCKER_CANDIDATE",
+  "HARD_BLOCKER",
+  "SOFT_UNCERTAINTY",
+  "ASSUMPTION",
+  "DEFERRED_DECISION",
+  "DISCOVERY_REQUIRED",
+  "SUSPECTED_ISSUE",
+  "NON_BLOCKING_GAP",
+  "FUTURE_CONSIDERATION",
+  "OUT_OF_SCOPE"
+];
+var STRUCTURED_ROW_FIELD_KEYS = [
+  "applicability",
+  "statement",
+  "classification",
+  "resolution",
+  "blocker_triage",
+  "assumption_risk",
+  "requires_authority"
+];
+function leadingSpaces(line) {
+  const match = /^[ \t]*/.exec(line);
+  return match === null ? 0 : match[0].length;
+}
+function parseUnknownLedger(text) {
+  const lines = text.split("\n");
+  const block = confirmedBlockRange(lines);
+  const entries = [];
+  let damage = null;
+  const setDamage = (detail) => {
+    if (damage === null)
+      damage = detail;
+  };
+  const registered = /* @__PURE__ */ new Map();
+  for (let i = 0; i < lines.length; i += 1) {
+    if (insideConfirmedBlock(i, block))
+      continue;
+    const line = lines[i] ?? "";
+    if (line.trim() === "" || line.startsWith("#"))
+      continue;
+    const structured = STRUCTURED_ENTRY_KEY_LINE.exec(line);
+    if (structured !== null) {
+      const dashIndent = leadingSpaces(structured[1] ?? "");
+      const wordForm = (structured[2] ?? "").trim();
+      let end = i + 1;
+      let fieldIndent = null;
+      const fields = /* @__PURE__ */ new Map();
+      while (end < lines.length) {
+        const candidate = lines[end] ?? "";
+        if (candidate.trim() === "" || candidate.startsWith("#")) {
+          let peek = end + 1;
+          while (peek < lines.length && ((lines[peek] ?? "").trim() === "" || (lines[peek] ?? "").startsWith("#"))) {
+            peek += 1;
+          }
+          if (peek >= lines.length || leadingSpaces(lines[peek] ?? "") <= dashIndent)
+            break;
+          end = peek;
+          continue;
+        }
+        const indent = leadingSpaces(candidate);
+        if (indent <= dashIndent)
+          break;
+        if (fieldIndent === null)
+          fieldIndent = indent;
+        if (indent === fieldIndent) {
+          const field = STRUCTURED_FIELD_LINE.exec(candidate);
+          if (field === null) {
+            setDamage(`\u7ED3\u6784\u5316\u884C\uFF08${wordForm === "" ? "<key \u7F3A\u5E2D>" : wordForm}\uFF09\u5B57\u6BB5\u884C\u4E0D\u53EF\u8BC6\u522B: ${candidate.trim()}`);
+          } else if (!STRUCTURED_ROW_FIELD_KEYS.includes(field[2] ?? "")) {
+            setDamage(`\u7ED3\u6784\u5316\u884C\u5B57\u6BB5\u51FA\u952E\u96C6\u95ED\u5305: ${field[2]}\uFF08\u5408\u6CD5\u5B57\u6BB5: ${STRUCTURED_ROW_FIELD_KEYS.join(" / ")}\u2014\u2014\u95ED\u5305\u6F14\u8FDB\u8D70\u63D0\u6848\u4FEE\u8BA2\u7981\u53E6\u9020\u8BCD\u5F62\uFF09`);
+          } else if (fields.has(field[2] ?? "")) {
+            setDamage(`\u7ED3\u6784\u5316\u884C\u5B57\u6BB5\u91CD\u590D: ${field[2]}`);
+          } else {
+            fields.set(field[2] ?? "", stripTrailingComment(field[3] ?? "").trim());
+          }
+        } else if (indent < fieldIndent) {
+          setDamage(`\u7ED3\u6784\u5316\u884C\uFF08${wordForm === "" ? "<key \u7F3A\u5E2D>" : wordForm}\uFF09\u5B57\u6BB5\u7F29\u8FDB\u4E0D\u4E00\u81F4: ${candidate.trim()}`);
+        }
+        end += 1;
+      }
+      let shapeDetail = null;
+      const fail6 = (detail) => {
+        if (shapeDetail === null)
+          shapeDetail = detail;
+      };
+      if (wordForm === "") {
+        fail6("\u7ED3\u6784\u5316\u884C key \u8BCD\u5F62\u7F3A\u5E2D\uFF08\u5FC5\u586B\uFF09");
+      } else {
+        const stackMatch = STACK_WORD_FORM_PATTERN.exec(wordForm);
+        if (stackMatch !== null && !STACK_KEYS[stackMatch[1]].includes(stackMatch[2] ?? "")) {
+          fail6(`\u7ED3\u6784\u5316\u884C\u952E\u51FA 14 \u952E\u95ED\u5305: ${wordForm}\uFF08frontend/backend \u4E24 lane \u952E\u96C6\u95ED\u5305\u5F3A\u5236\u2014\u2014\u5F00\u653E\u57DF\u952E\u540D\u624D\u4E0D\u8BBE\u95ED\u5305\uFF09`);
+        }
+      }
+      let applicability = "BLOCKING";
+      const rawApplicability = fields.get("applicability");
+      if (rawApplicability !== void 0) {
+        if (!BASELINE_UNKNOWN_APPLICABILITY_VALUES.includes(rawApplicability)) {
+          fail6(`\u7ED3\u6784\u5316\u884C applicability \u51FA\u4E09\u503C\u95ED\u5305: ${rawApplicability}\uFF08\u5408\u6CD5\u8BCD\u5F62: ${BASELINE_UNKNOWN_APPLICABILITY_VALUES.join(" | ")}\uFF09`);
+        } else {
+          applicability = rawApplicability;
+        }
+      }
+      const statement = fields.get("statement") ?? null;
+      if (statement === null || statement.length === 0) {
+        fail6("\u7ED3\u6784\u5316\u884C\u7F3A statement\uFF08MSD unknown_item \u540C\u6784\u5FC5\u586B\uFF1BminLength 1 \u7981\u7A7A\u6CDB\u5360\u4F4D\uFF09");
+      }
+      const classification = fields.get("classification") ?? null;
+      if (classification === null) {
+        fail6("\u7ED3\u6784\u5316\u884C\u7F3A classification\uFF08MSD unknown_item \u540C\u6784\u5FC5\u586B\uFF09");
+      } else if (!MSD_UNKNOWN_CLASSIFICATION_VALUES.includes(classification)) {
+        fail6(`\u7ED3\u6784\u5316\u884C classification \u51FA\u5341\u5206\u7C7B\u95ED\u5305: ${classification}\uFF0809-msd-uncertainty unknown_classification \u9010\u5B57\u590D\u7528\uFF0C\u96F6\u65B0\u503C\uFF09`);
+      }
+      if (shapeDetail !== null)
+        setDamage(shapeDetail);
+      entries.push({
+        wordForm,
+        structured: true,
+        applicability,
+        statement,
+        classification,
+        lineStart: i,
+        lineEnd: end
+      });
+      const seenStructured = registered.get(wordForm) ?? { flat: 0, structured: 0 };
+      seenStructured.structured += 1;
+      registered.set(wordForm, seenStructured);
+      i = end - 1;
+      continue;
+    }
+    const flat = FLAT_ENTRY_LINE.exec(line);
+    if (flat === null)
+      continue;
+    const flatWordForm = stripTrailingComment(flat[1] ?? "").trim();
+    entries.push({
+      wordForm: flatWordForm,
+      structured: false,
+      applicability: "BLOCKING",
+      statement: null,
+      classification: null,
+      lineStart: i,
+      lineEnd: i + 1
+    });
+    const seenFlat = registered.get(flatWordForm) ?? { flat: 0, structured: 0 };
+    seenFlat.flat += 1;
+    registered.set(flatWordForm, seenFlat);
+  }
+  for (const [wordForm, kinds] of registered) {
+    if (kinds.structured > 1) {
+      setDamage(`\u952E\u91CD\u590D\u7ED3\u6784\u5316\u767B\u8BB0: ${wordForm}\uFF08\u8C41\u514D\u8BED\u4E49\u4E0D\u53EF\u5224\u2014\u2014\u4FDD\u7559\u4E00\u884C\u7ED3\u6784\u5316\u767B\u8BB0\uFF09`);
+    } else if (kinds.structured === 1 && kinds.flat > 0) {
+      setDamage(`\u952E flat+\u7ED3\u6784\u5316\u91CD\u590D\u767B\u8BB0: ${wordForm}\uFF08flat \u884C\u7F3A\u7701 BLOCKING \u4E0E\u8C41\u514D\u767B\u8BB0\u51B2\u7A81\u2014\u2014\u5220 flat \u884C\u6216\u964D\u7EA7\u7ED3\u6784\u5316\u884C\uFF09`);
+    }
+  }
+  return { entries, damage };
+}
+function insideConfirmedBlock(index, block) {
+  return block !== null && index >= block.start && index < block.end;
+}
+function removeUnknownEntries(text, wordForms) {
+  const ledger = parseUnknownLedger(text);
+  if (ledger.entries.length === 0)
+    return { next: text, removed: 0 };
+  const removeLines = /* @__PURE__ */ new Set();
+  let removed = 0;
+  for (const entry of ledger.entries) {
+    if (!wordForms.has(entry.wordForm))
+      continue;
+    removed += 1;
+    for (let i = entry.lineStart; i < entry.lineEnd; i += 1)
+      removeLines.add(i);
+  }
+  if (removed === 0)
+    return { next: text, removed: 0 };
+  const lines = text.split("\n");
+  return { next: lines.filter((_, index) => !removeLines.has(index)).join("\n"), removed };
+}
+function countUnknownEntries(text) {
+  return parseUnknownLedger(text).entries.length;
+}
+function stackValueResolvedAt(wordForm, stackValues) {
+  const match = STACK_WORD_FORM_PATTERN.exec(wordForm);
+  if (match === null)
+    return false;
+  const lane = match[1];
+  const key = match[2] ?? "";
+  if (!STACK_KEYS[lane].includes(key))
+    return false;
+  return isResolved(stackValues.get(lane)?.get(key) ?? "");
+}
+function computeBlockingSet(ledger, stackValues) {
+  if (ledger.damage !== null)
+    return { ok: false, detail: ledger.damage };
+  const blocking = /* @__PURE__ */ new Set();
+  const rowWordForms = /* @__PURE__ */ new Set();
+  const counts = { BLOCKING: 0, NOT_APPLICABLE: 0, DEFERRED: 0 };
+  for (const entry of ledger.entries) {
+    counts[entry.applicability] += 1;
+    rowWordForms.add(entry.wordForm);
+    if (entry.structured && entry.applicability !== "BLOCKING" && !stackValueResolvedAt(entry.wordForm, stackValues)) {
+      continue;
+    }
+    blocking.add(entry.wordForm);
+  }
+  for (const lane of BASELINE_LANES) {
+    for (const key of STACK_KEYS[lane]) {
+      const wordForm = unknownsWordForm(lane, key);
+      if (rowWordForms.has(wordForm))
+        continue;
+      if (!isResolved(stackValues.get(lane)?.get(key) ?? "")) {
+        blocking.add(wordForm);
+      }
+    }
+  }
+  return { ok: true, blocking: [...blocking], applicability_counts: counts };
+}
 function confirmedBlockRange(lines) {
   const start = lines.findIndex((line) => CONFIRMED_KEY_LINE.test(line));
   if (start < 0)
@@ -50816,30 +51447,6 @@ function confirmedBlockRange(lines) {
   }
   return { start, end };
 }
-function insideConfirmedBlock(index, block) {
-  return block !== null && index >= block.start && index < block.end;
-}
-function removeUnknownEntries(text, wordForms) {
-  const lines = text.split("\n");
-  const block = confirmedBlockRange(lines);
-  let removed = 0;
-  const kept = lines.filter((line, index) => {
-    if (insideConfirmedBlock(index, block))
-      return true;
-    const match = UNKNOWN_ENTRY_LINE.exec(line);
-    if (match !== null && wordForms.has(match[1] ?? "")) {
-      removed += 1;
-      return false;
-    }
-    return true;
-  });
-  return { next: kept.join("\n"), removed };
-}
-function countUnknownEntries(text) {
-  const lines = text.split("\n");
-  const block = confirmedBlockRange(lines);
-  return lines.filter((line, index) => !insideConfirmedBlock(index, block) && UNKNOWN_ENTRY_COUNT.test(line)).length;
-}
 var BASELINE_CONFIRMED_PLACEHOLDER = /^confirmed\s*:/m;
 async function readTextFile(absolutePath) {
   try {
@@ -50874,7 +51481,13 @@ async function resolveRemainingQuestions(rootDir) {
   for (const lane of BASELINE_LANES) {
     const relative3 = baselineStackRelative(lane);
     const file = await readTextFile(`${rootDir}/${relative3}`);
-    const laneQuestions = STACK_QUESTIONS.filter((q) => q.lane === lane && !(lane === "frontend" && observation !== null && observation.values.has(q.key)));
+    const laneQuestions = STACK_QUESTIONS.filter((q) => q.lane === lane).map((question) => {
+      const observedValue = lane === "frontend" && observation !== null ? observation.values.get(question.key) : void 0;
+      return observedValue === void 0 ? question : {
+        ...question,
+        observed: { lane, key: question.key, value: observedValue, source: "package.json" }
+      };
+    });
     if (file.kind === "absent") {
       questions.push(...laneQuestions);
       continue;
@@ -50894,9 +51507,14 @@ async function resolveRemainingQuestions(rootDir) {
   }
   return { kind: "ready", questions };
 }
+function observationCandidateLine(question) {
+  return question.observed === void 0 ? null : `  \u89C2\u5BDF\u5019\u9009: ${question.observed.value} ${OBSERVED_ANNOTATION}\uFF08\u9009\u578B\u8BE5\u503C\u5373\u91C7\u7EB3\uFF1B\u672A\u91C7\u7EB3\u4FDD\u6301 UNKNOWN\uFF09`;
+}
 function renderQuestionFrame(question, cursor, buffer, progress, error) {
+  const candidateLine = observationCandidateLine(question);
   const lines = [
     `? ${question.label}\uFF08${question.lane}.${question.key}\uFF1B\u2191\u2193\u9009\u62E9 / \u76F4\u63A5\u952E\u5165\u81EA\u5B9A\u4E49\u503C / \u56DE\u8F66\u786E\u8BA4 / Ctrl+C \u4E2D\u6B62\uFF09[${progress}]`,
+    ...candidateLine === null ? [] : [candidateLine],
     ...question.options.map((option, i) => i === cursor ? `\u25C9 ${option}` : ` \u25EF ${option}`),
     `${cursor === question.options.length ? "" : " "}\u270E \u81EA\u5B9A\u4E49: ${buffer}`
   ];
@@ -50956,6 +51574,9 @@ async function promptQuestionNumbered(question, position, total, io) {
   const customIndex = question.options.length + 1;
   const renderBlock = () => {
     io.write(`[${position}/${total}] ${question.label}\uFF08${question.lane}.${question.key}\uFF09\uFF1A`);
+    const candidateLine = observationCandidateLine(question);
+    if (candidateLine !== null)
+      io.write(candidateLine);
     question.options.forEach((option, i) => io.write(`  ${i + 1}. ${option}`));
     io.write(`  ${customIndex}. <\u76F4\u63A5\u952E\u5165\u81EA\u5B9A\u4E49\u503C>`);
     io.write("\u7F16\u53F7\u6216\u81EA\u5B9A\u4E49\u503C\uFF08\u5FC5\u7B54\u2014\u2014\u7A7A\u8F93\u5165\u4E0D\u4F5C\u9009\u62E9\uFF09\uFF1A");
@@ -51084,78 +51705,79 @@ function failBaselineSet(code, message, hint, input) {
     confirmation_invalidated: false
   }, [{ code, message, hint }], [`baseline set: FAILED \u2014 ${code}`, `  ${message}`, `  hint: ${hint}`]);
 }
-async function runBaselineSet(rootDir, input) {
-  if (!BASELINE_LANES.includes(input.lane)) {
-    return failBaselineSet("SCHEMA_INVALID", `\u975E\u6CD5 lane \u8BCD\u5F62\uFF1A${input.lane}\uFF1B\u5408\u6CD5\u8BCD\u5F62\uFF1A${BASELINE_LANES.join(" | ")}`, "\u793A\u4F8B\uFF1Apomaster baseline set --lane frontend --key framework --value vue3", input);
-  }
-  const lane = input.lane;
-  const keys = STACK_KEYS[lane];
-  if (!keys.includes(input.key)) {
-    return failBaselineSet("SCHEMA_INVALID", `\u975E\u6CD5\u952E\u8BCD\u5F62\uFF1A${input.key}\uFF1B${lane} \u952E\u96C6\u95ED\u5305\uFF1A${keys.join(" | ")}`, `\u952E\u96C6\u4E0E ${baselineStackRelative(lane)} \u64AD\u79CD\u952E\u5E8F\u4E00\u4E00\u5BF9\u5E94\uFF08baseline-seeds \u9489\u5B9A\uFF09\u3002`, input);
-  }
-  if (input.value === "UNKNOWN") {
-    return failBaselineSet("SCHEMA_INVALID", "UNKNOWN \u662F\u8D77\u6B65\u7F3A\u5E2D\u8BCD\u5F62\uFF0C\u4E0D\u53EF\u4F5C\u4E3A\u9009\u578B\u503C", "\u663E\u5F0F\u9009\u578B\u503C\u7ECF init \u95EE\u5377\u6216\u672C\u547D\u4EE4\u5199\u5165\uFF1B\u56DE\u9000/\u64A4\u9500\u5DF2\u9500\u8D26\u952E\u8D70\u6CBB\u7406\u901A\u8DEF\u3002", input);
-  }
-  if (!STACK_VALUE_PATTERN.test(input.value)) {
-    return failBaselineSet("SCHEMA_INVALID", `\u503C\u8BCD\u5F62\u975E\u6CD5\uFF1A${input.value}\uFF08\u5141\u8BB8 [A-Za-z0-9] \u8D77\u59CB\u3001[A-Za-z0-9 _./+#()-]\u3001\u2264${STACK_VALUE_MAX_LENGTH} \u5B57\u7B26\uFF09`, "\u793A\u4F8B\uFF1A--value vue3\u3001--value 'Spring Boot'\u3001--value none", input);
-  }
+var BASELINE_SET_TX_ATTEMPTS = 4;
+var BASELINE_SET_TX_BACKOFF_MS = [20, 50, 100];
+function settled(outcome) {
+  return { kind: "settled", outcome };
+}
+async function baselineSetAttempt(rootDir, input, lane, attempt, casFs = nodeCasSwapFs) {
   const stackRelative = baselineStackRelative(lane);
   const stackFile = await readTextFile(`${rootDir}/${stackRelative}`);
   if (stackFile.kind !== "ok") {
+    if (stackFile.kind === "absent") {
+      if (attempt > 0) {
+        return { kind: "contended", viaStackAbsent: true };
+      }
+      const manifestProbe = await readTextFile(`${rootDir}/${BASELINE_MANIFEST_RELATIVE}`);
+      if (manifestProbe.kind === "ok") {
+        return { kind: "contended", viaStackAbsent: true };
+      }
+    }
     const error = baselineFileError(stackRelative, stackFile);
-    return failBaselineSet(error.code, error.message, error.hint, input);
+    return settled(failBaselineSet(error.code, error.message, error.hint, input));
   }
   const manifestFile = await readTextFile(`${rootDir}/${BASELINE_MANIFEST_RELATIVE}`);
   if (manifestFile.kind !== "ok") {
+    if (attempt > 0 && manifestFile.kind === "absent") {
+      return { kind: "contended" };
+    }
     const error = baselineFileError(BASELINE_MANIFEST_RELATIVE, manifestFile);
-    return failBaselineSet(error.code, error.message, error.hint, input);
+    return settled(failBaselineSet(error.code, error.message, error.hint, input));
   }
   const parse = parseStackYaml(stackFile.text, STACK_KEYS[lane]);
   if (!parse.ok) {
-    return failBaselineSet("INVALID_STATE", `${stackRelative} \u7ED3\u6784\u4E0D\u53EF\u89E3\u6790: ${parse.detail}`, "\u4FEE\u590D\u6216\u4ECE git \u6062\u590D\u8BE5\u6587\u4EF6\u540E\u91CD\u8BD5\uFF1B\u672C\u547D\u4EE4\u4E0D\u731C\u6D4B\u91CD\u5199\u9879\u76EE\u57FA\u7EBF\u6587\u4EF6\u3002", input);
+    return settled(failBaselineSet("INVALID_STATE", `${stackRelative} \u7ED3\u6784\u4E0D\u53EF\u89E3\u6790: ${parse.detail}`, "\u4FEE\u590D\u6216\u4ECE git \u6062\u590D\u8BE5\u6587\u4EF6\u540E\u91CD\u8BD5\uFF1B\u672C\u547D\u4EE4\u4E0D\u731C\u6D4B\u91CD\u5199\u9879\u76EE\u57FA\u7EBF\u6587\u4EF6\u3002", input));
   }
   const confirmedWordFormPresent = BASELINE_CONFIRMED_PLACEHOLDER.test(manifestFile.text);
   const recordParse = parseConfirmedBlock(manifestFile.text);
   const recordValid = recordParse.kind === "ok";
   if (recordValid || confirmedWordFormPresent) {
     if (input.change === void 0) {
-      return failBaselineSet("BASELINE_ALREADY_CONFIRMED", recordValid ? recordParse.record.pending !== void 0 ? `baseline \u786E\u8BA4\u8BB0\u5F55\u5728\u5EA7\u4E14\u53D8\u66F4\u6279\u5728\u9014\uFF08pending-change\uFF1Bchange_ref=${recordParse.record.pending.change_ref}\uFF09\u2014\u2014\u7EE7\u7EED\u4FEE\u6539\u987B\u643A\u540C ref\uFF0C\u6216\u643A\u540C ref confirm \u7EC8\u7ED3` : "baseline \u5DF2\u786E\u8BA4\uFF08manifest \u5728\u5EA7\u786E\u8BA4\u8BB0\u5F55\uFF09\uFF1B\u786E\u8BA4\u540E\u9879\u76EE\u67B6\u6784\u4E0D\u5141\u8BB8\u76F4\u63A5\u4FEE\u6539" : "baseline \u786E\u8BA4\u8BB0\u5F55\u5728\u5EA7\uFF08\u7ED3\u6784\u635F\u574F\uFF09\u2014\u2014\u9879\u76EE\u67B6\u6784\u4E0D\u5141\u8BB8\u76F4\u63A5\u4FEE\u6539\uFF08\u635F\u574F\u5757\u4FEE\u590D\u8D70 confirm \u91CD\u5EFA\uFF09", "\u4FEE\u6539\u8D70\u6CBB\u7406\u901A\u8DEF\uFF1A\u5148\u7ACB CHANGE.* \u5BF9\u8C61\uFF0C\u518D pomaster baseline set --change <CHANGE-id>\uFF08\u5199\u5165\u8F6C pending-change\uFF09\uFF0C\u5B8C\u6210\u540E\u643A\u540C ref pomaster baseline confirm \u91CD\u786E\u8BA4\u3002", input);
+      return settled(failBaselineSet("BASELINE_ALREADY_CONFIRMED", recordValid ? recordParse.record.pending !== void 0 ? `baseline \u786E\u8BA4\u8BB0\u5F55\u5728\u5EA7\u4E14\u53D8\u66F4\u6279\u5728\u9014\uFF08pending-change\uFF1Bchange_ref=${recordParse.record.pending.change_ref}\uFF09\u2014\u2014\u7EE7\u7EED\u4FEE\u6539\u987B\u643A\u540C ref\uFF0C\u6216\u643A\u540C ref confirm \u7EC8\u7ED3` : "baseline \u5DF2\u786E\u8BA4\uFF08manifest \u5728\u5EA7\u786E\u8BA4\u8BB0\u5F55\uFF09\uFF1B\u786E\u8BA4\u540E\u9879\u76EE\u67B6\u6784\u4E0D\u5141\u8BB8\u76F4\u63A5\u4FEE\u6539" : "baseline \u786E\u8BA4\u8BB0\u5F55\u5728\u5EA7\uFF08\u7ED3\u6784\u635F\u574F\uFF09\u2014\u2014\u9879\u76EE\u67B6\u6784\u4E0D\u5141\u8BB8\u76F4\u63A5\u4FEE\u6539\uFF08\u635F\u574F\u5757\u4FEE\u590D\u8D70 confirm \u91CD\u5EFA\uFF09", "\u4FEE\u6539\u8D70\u6CBB\u7406\u901A\u8DEF\uFF1A\u5148\u7ACB CHANGE.* \u5BF9\u8C61\uFF0C\u518D pomaster baseline set --change <CHANGE-id>\uFF08\u5199\u5165\u8F6C pending-change\uFF09\uFF0C\u5B8C\u6210\u540E\u643A\u540C ref pomaster baseline confirm \u91CD\u786E\u8BA4\u3002", input));
     }
     if (!recordValid) {
-      return failBaselineSet("INVALID_STATE", "manifest \u786E\u8BA4\u8BB0\u5F55\u7ED3\u6784\u635F\u574F\u2014\u2014set \u4E0D\u5728\u635F\u574F\u8BB0\u5F55\u4E0A\u6388\u6743\u5199\u76D8", "\u5148 pomaster baseline confirm \u91CD\u5EFA\u786E\u8BA4\u8BB0\u5F55\uFF08\u635F\u574F\u5757\u4FEE\u590D\u4E0D\u9700\u8981\u901A\u9053\uFF09\uFF0C\u518D\u8D70\u6CBB\u7406\u901A\u8DEF set --change\u3002", input);
+      return settled(failBaselineSet("INVALID_STATE", "manifest \u786E\u8BA4\u8BB0\u5F55\u7ED3\u6784\u635F\u574F\u2014\u2014set \u4E0D\u5728\u635F\u574F\u8BB0\u5F55\u4E0A\u6388\u6743\u5199\u76D8", "\u5148 pomaster baseline confirm \u91CD\u5EFA\u786E\u8BA4\u8BB0\u5F55\uFF08\u635F\u574F\u5757\u4FEE\u590D\u4E0D\u9700\u8981\u901A\u9053\uFF09\uFF0C\u518D\u8D70\u6CBB\u7406\u901A\u8DEF set --change\u3002", input));
     }
     if (recordParse.record.pending !== void 0 && input.change !== recordParse.record.pending.change_ref) {
-      return failBaselineSet("SCHEMA_INVALID", `pending-change \u53D8\u66F4\u6279\u7531 ${recordParse.record.pending.change_ref} \u6301\u6709\u2014\u2014\u540C\u6279\u8FDE\u6539\u987B\u643A\u540C ref\uFF08\u6279\u5185 ${recordParse.record.pending.batch.length} \u952E\uFF09`, `\u7EE7\u7EED\u4FEE\u6539: pomaster baseline set --change ${recordParse.record.pending.change_ref}\uFF1B\u7EC8\u7ED3: pomaster baseline confirm --change ${recordParse.record.pending.change_ref}\u3002`, input);
+      return settled(failBaselineSet("SCHEMA_INVALID", `pending-change \u53D8\u66F4\u6279\u7531 ${recordParse.record.pending.change_ref} \u6301\u6709\u2014\u2014\u540C\u6279\u8FDE\u6539\u987B\u643A\u540C ref\uFF08\u6279\u5185 ${recordParse.record.pending.batch.length} \u952E\uFF09`, `\u7EE7\u7EED\u4FEE\u6539: pomaster baseline set --change ${recordParse.record.pending.change_ref}\uFF1B\u7EC8\u7ED3: pomaster baseline confirm --change ${recordParse.record.pending.change_ref}\u3002`, input));
     }
     const changeError = await validateBaselineChangeRef(rootDir, input.change);
     if (changeError !== null) {
-      return failBaselineSet(changeError.code, changeError.message, changeError.hint, input);
+      return settled(failBaselineSet(changeError.code, changeError.message, changeError.hint, input));
     }
   } else if (input.change !== void 0) {
-    return failBaselineSet("SCHEMA_INVALID", `--change \u4EC5\u5728\u5DF2\u786E\u8BA4\u57FA\u7EBF\u4E0A\u88AB\u6D88\u8D39\uFF08\u6CBB\u7406\u901A\u8DEF\u6388\u6743\u786E\u8BA4\u5FEB\u7167\u5185\u6587\u4EF6\u7684\u4FEE\u6539\uFF09\uFF1B\u5F53\u524D baseline \u65E0\u786E\u8BA4\u8BB0\u5F55`, "\u76F4\u63A5 set \u5373\u53EF\uFF08\u540E\u8865\u9500\u8D26\u901A\u8DEF\u4E0D\u8981\u6C42\u6388\u6743\uFF09\uFF1B\u786E\u8BA4\u8D70 pomaster baseline confirm\u3002", input);
+    return settled(failBaselineSet("SCHEMA_INVALID", `--change \u4EC5\u5728\u5DF2\u786E\u8BA4\u57FA\u7EBF\u4E0A\u88AB\u6D88\u8D39\uFF08\u6CBB\u7406\u901A\u8DEF\u6388\u6743\u786E\u8BA4\u5FEB\u7167\u5185\u6587\u4EF6\u7684\u4FEE\u6539\uFF09\uFF1B\u5F53\u524D baseline \u65E0\u786E\u8BA4\u8BB0\u5F55`, "\u76F4\u63A5 set \u5373\u53EF\uFF08\u540E\u8865\u9500\u8D26\u901A\u8DEF\u4E0D\u8981\u6C42\u6388\u6743\uFF09\uFF1B\u786E\u8BA4\u8D70 pomaster baseline confirm\u3002", input));
   }
   const current = parse.parsed.values.get(input.key) ?? "";
   const fileReports = [];
   let change = "NO_CHANGE";
   let confirmationInvalidated = false;
   let nextManifest = manifestFile.text;
+  let nextStack = stackFile.text;
+  let stackTouched = false;
   let pendingRecord;
   if (current !== input.value) {
+    stackTouched = true;
     if (isResolved(current) && !recordValid) {
-      return failBaselineSet("BASELINE_KEY_ALREADY_SET", `${stackRelative}:${input.key} \u5DF2\u9500\u8D26\u4E3A ${current}\uFF1Bset \u4E0D\u505A\u6539\u578B`, "answered \u7A33\u5B9A\u8BED\u4E49\uFF1A\u5DF2\u7B54\u952E\u7684\u6539\u578B\u8D70\u6CBB\u7406\u901A\u8DEF\u2014\u2014\u786E\u8BA4\u540E\u6301\u6709\u6548 --change \u91CD\u653E\u672C\u547D\u4EE4\uFF08\u5199\u5165\u8F6C pending-change\uFF09\uFF0C\u6216\u7ECF\u9879\u76EE\u81EA\u6709\u8BC4\u5BA1\u624B\u5DE5\u4FEE\u6539\u3002", input);
+      return settled(failBaselineSet("BASELINE_KEY_ALREADY_SET", `${stackRelative}:${input.key} \u5DF2\u9500\u8D26\u4E3A ${current}\uFF1Bset \u4E0D\u505A\u6539\u578B`, "answered \u7A33\u5B9A\u8BED\u4E49\uFF1A\u5DF2\u7B54\u952E\u7684\u6539\u578B\u8D70\u6CBB\u7406\u901A\u8DEF\u2014\u2014\u786E\u8BA4\u540E\u6301\u6709\u6548 --change \u91CD\u653E\u672C\u547D\u4EE4\uFF08\u5199\u5165\u8F6C pending-change\uFF09\uFF0C\u6216\u7ECF\u9879\u76EE\u81EA\u6709\u8BC4\u5BA1\u624B\u5DE5\u4FEE\u6539\u3002", input));
     }
     const lines = stackFile.text.split("\n");
     const lineIndex = parse.parsed.lineOf.get(input.key);
     if (lineIndex === void 0) {
-      return failBaselineSet("INVALID_STATE", `${stackRelative} \u7F3A\u5C11\u952E\u884C\uFF1A${input.key}`, "\u57FA\u7EBF\u6587\u4EF6\u7ED3\u6784\u6F02\u79FB\u2014\u2014\u6062\u590D\u64AD\u79CD\u5F62\u6001\u6216\u624B\u5DE5\u5BF9\u9F50\u952E\u96C6\u540E\u91CD\u8BD5\u3002", input);
+      return settled(failBaselineSet("INVALID_STATE", `${stackRelative} \u7F3A\u5C11\u952E\u884C\uFF1A${input.key}`, "\u57FA\u7EBF\u6587\u4EF6\u7ED3\u6784\u6F02\u79FB\u2014\u2014\u6062\u590D\u64AD\u79CD\u5F62\u6001\u6216\u624B\u5DE5\u5BF9\u9F50\u952E\u96C6\u540E\u91CD\u8BD5\u3002", input));
     }
     lines[lineIndex] = `${input.key}: ${input.value}`;
-    const nextStack = lines.join("\n");
-    if (nextStack !== stackFile.text) {
-      await writeFile(`${rootDir}/${stackRelative}`, nextStack, "utf8");
-      change = "UPDATED";
-    }
-    fileReports.push({ file: stackRelative, action: "updated" });
+    nextStack = lines.join("\n");
     if (recordValid && input.change !== void 0 && nextStack !== stackFile.text) {
       const prior = recordParse.record.pending;
       const entry = unknownsWordForm(lane, input.key);
@@ -51163,19 +51785,42 @@ async function runBaselineSet(rootDir, input) {
       pendingRecord = { ...recordParse.record, pending: { change_ref: input.change, batch } };
       confirmationInvalidated = true;
     }
-  } else {
-    fileReports.push({ file: stackRelative, action: "unchanged" });
   }
   const { next: afterLedger, removed } = removeUnknownEntries(nextManifest, /* @__PURE__ */ new Set([unknownsWordForm(lane, input.key)]));
   nextManifest = afterLedger;
   if (pendingRecord !== void 0) {
     nextManifest = upsertConfirmedBlock(nextManifest, pendingRecord);
   }
+  let manifestCommitted = false;
   if (nextManifest !== manifestFile.text) {
-    await writeFile(`${rootDir}/${BASELINE_MANIFEST_RELATIVE}`, nextManifest, "utf8");
-    fileReports.push({ file: BASELINE_MANIFEST_RELATIVE, action: "updated" });
+    const cas = casSwapFile(`${rootDir}/${BASELINE_MANIFEST_RELATIVE}`, manifestFile.text, nextManifest, casFs);
+    if (cas.kind === "fault") {
+      return settled(failBaselineSet("BASELINE_WRITE_CONFLICT", `baseline \u63D0\u4EA4\u9047\u6301\u7EED\u6587\u4EF6\u7CFB\u7EDF\u6545\u969C\uFF08${BASELINE_MANIFEST_RELATIVE}\uFF1A${cas.cause}\uFF1Berrno=${cas.code}\uFF09\u2014\u2014\u975E\u5E76\u53D1\u4EA4\u9519\uFF0C\u91CD\u8BD5\u65E0\u76CA`, "\u5148\u5904\u7F6E\u6587\u4EF6\u7CFB\u7EDF\u6545\u969C\uFF08\u78C1\u76D8\u7A7A\u95F4/\u6743\u9650/\u6740\u8F6F\u9501\uFF09\uFF0C\u518D\u91CD\u8DD1\u672C\u547D\u4EE4\uFF1A\u91CD\u8DD1\u5728\u65B0\u9C9C\u76D8\u9762\u4E0A\u91CD\u653E\u540C\u4E00\u5224\u5377\u94FE\uFF08\u5E76\u53D1\u4FEE\u6539\u6309\u4E32\u884C\u91CD\u8BD5\u6536\u655B\uFF09\u3002", input));
+    }
+    if (cas.kind !== "swapped") {
+      return cas.kind === "contended" ? { kind: "contended", viaCasCause: `manifest\uFF1A${cas.cause}` } : { kind: "contended" };
+    }
+    manifestCommitted = true;
+    change = "UPDATED";
+  }
+  if (nextStack !== stackFile.text) {
+    const cas = casSwapFile(`${rootDir}/${stackRelative}`, stackFile.text, nextStack, casFs);
+    if (cas.kind === "fault") {
+      return settled(failBaselineSet("BASELINE_WRITE_CONFLICT", `baseline \u63D0\u4EA4\u9047\u6301\u7EED\u6587\u4EF6\u7CFB\u7EDF\u6545\u969C\uFF08${stackRelative}\uFF1A${cas.cause}\uFF1Berrno=${cas.code}\uFF09\u2014\u2014\u975E\u5E76\u53D1\u4EA4\u9519\uFF0C\u91CD\u8BD5\u65E0\u76CA`, "\u5148\u5904\u7F6E\u6587\u4EF6\u7CFB\u7EDF\u6545\u969C\uFF08\u78C1\u76D8\u7A7A\u95F4/\u6743\u9650/\u6740\u8F6F\u9501\uFF09\uFF0C\u518D\u91CD\u8DD1\u672C\u547D\u4EE4\uFF1A\u91CD\u8DD1\u5728\u65B0\u9C9C\u76D8\u9762\u4E0A\u91CD\u653E\u540C\u4E00\u5224\u5377\u94FE\uFF08\u5E76\u53D1\u4FEE\u6539\u6309\u4E32\u884C\u91CD\u8BD5\u6536\u655B\uFF09\u3002", input));
+    }
+    if (cas.kind !== "swapped") {
+      return cas.kind === "contended" ? { kind: "contended", viaCasCause: `stack\uFF1A${cas.cause}` } : { kind: "contended" };
+    }
     change = "UPDATED";
   }
+  if (stackTouched) {
+    fileReports.push({ file: stackRelative, action: "updated" });
+  } else {
+    fileReports.push({ file: stackRelative, action: "unchanged" });
+  }
+  if (manifestCommitted) {
+    fileReports.push({ file: BASELINE_MANIFEST_RELATIVE, action: "updated" });
+  }
   const result2 = {
     change,
     lane,
@@ -51190,7 +51835,43 @@ async function runBaselineSet(rootDir, input) {
     ...fileReports.map((report) => `  ${report.action.padEnd(10)} ${report.file}${removed > 0 && report.file === BASELINE_MANIFEST_RELATIVE ? `\uFF08\u9500\u8D26 ${removed} \u6761\uFF09` : ""}`),
     `  unknowns remaining: ${result2.unknowns_remaining}`
   ];
-  return okOutcome("baseline set", result2, human);
+  return settled(okOutcome("baseline set", result2, human));
+}
+async function runBaselineSet(rootDir, input, casFs = nodeCasSwapFs) {
+  if (!BASELINE_LANES.includes(input.lane)) {
+    return failBaselineSet("SCHEMA_INVALID", `\u975E\u6CD5 lane \u8BCD\u5F62\uFF1A${input.lane}\uFF1B\u5408\u6CD5\u8BCD\u5F62\uFF1A${BASELINE_LANES.join(" | ")}`, "\u793A\u4F8B\uFF1Apomaster baseline set --lane frontend --key framework --value vue3", input);
+  }
+  const lane = input.lane;
+  const keys = STACK_KEYS[lane];
+  if (!keys.includes(input.key)) {
+    return failBaselineSet("SCHEMA_INVALID", `\u975E\u6CD5\u952E\u8BCD\u5F62\uFF1A${input.key}\uFF1B${lane} \u952E\u96C6\u95ED\u5305\uFF1A${keys.join(" | ")}`, `\u952E\u96C6\u4E0E ${baselineStackRelative(lane)} \u64AD\u79CD\u952E\u5E8F\u4E00\u4E00\u5BF9\u5E94\uFF08baseline-seeds \u9489\u5B9A\uFF09\u3002`, input);
+  }
+  if (input.value === "UNKNOWN") {
+    return failBaselineSet("SCHEMA_INVALID", "UNKNOWN \u662F\u8D77\u6B65\u7F3A\u5E2D\u8BCD\u5F62\uFF0C\u4E0D\u53EF\u4F5C\u4E3A\u9009\u578B\u503C", "\u663E\u5F0F\u9009\u578B\u503C\u7ECF init \u95EE\u5377\u6216\u672C\u547D\u4EE4\u5199\u5165\uFF1B\u56DE\u9000/\u64A4\u9500\u5DF2\u9500\u8D26\u952E\u8D70\u6CBB\u7406\u901A\u8DEF\u3002", input);
+  }
+  if (!STACK_VALUE_PATTERN.test(input.value)) {
+    return failBaselineSet("SCHEMA_INVALID", `\u503C\u8BCD\u5F62\u975E\u6CD5\uFF1A${input.value}\uFF08\u5141\u8BB8 [A-Za-z0-9] \u8D77\u59CB\u3001[A-Za-z0-9 _./+#()-]\u3001\u2264${STACK_VALUE_MAX_LENGTH} \u5B57\u7B26\uFF09`, "\u793A\u4F8B\uFF1A--value vue3\u3001--value 'Spring Boot'\u3001--value none", input);
+  }
+  let lastContendedViaStackAbsent = false;
+  let lastContendedCasCause = null;
+  for (let attempt = 0; ; attempt += 1) {
+    if (attempt >= BASELINE_SET_TX_ATTEMPTS) {
+      if (lastContendedViaStackAbsent) {
+        return failBaselineSet("BASELINE_WRITE_CONFLICT", `baseline \u5199\u5165\u94FE\u672A\u6536\u655B\uFF08${BASELINE_SET_TX_ATTEMPTS} \u8F6E\u6709\u754C\u91CD\u8BD5\u5185 ${baselineStackRelative(lane)} \u6301\u7EED\u7F3A\u5E2D\uFF09\uFF1A\u53EF\u80FD\u4E3A\u5E76\u53D1 CAS \u8BA4\u9886\u7A97\u53E3\u672A\u6536\u655B\uFF0C\u4E5F\u53EF\u80FD\u4E3A\u8BE5\u6587\u4EF6\u88AB\u771F\u5B9E\u5220\u9664\u2014\u2014\u7F3A\u5E2D\u4E0D\u731C\u6D4B\u91CD\u5199`, "\u7A0D\u540E\u91CD\u8DD1\u672C\u547D\u4EE4\u5373\u53EF\uFF1A\u8BA4\u9886\u7A97\u53E3\u6536\u655B\u540E\u91CD\u8DD1\u5728\u65B0\u9C9C\u76D8\u9762\u4E0A\u6309\u4E32\u884C\u8BED\u4E49\u843D\u76D8\uFF1B\u82E5\u91CD\u8DD1\u4ECD\u62A5\u672C\u9519\u8BEF\uFF0C\u8BE5\u6587\u4EF6\u5F88\u53EF\u80FD\u5DF2\u88AB\u771F\u5B9E\u5220\u9664\u2014\u2014\u4ECE git \u6062\u590D\u6216\u91CD\u8DD1 pomaster init \u64AD\u79CD\uFF08seed-once-missing-only\uFF09\u3002", input);
+      }
+      const causeNote = lastContendedCasCause === null ? "" : `\uFF08\u6700\u8FD1\u8BA4\u9886\u4EA4\u9519\u6210\u56E0\uFF1A${lastContendedCasCause}\uFF09`;
+      return failBaselineSet("BASELINE_WRITE_CONFLICT", `baseline \u5E76\u53D1\u5199\u5165\u51B2\u7A81\uFF08${BASELINE_SET_TX_ATTEMPTS} \u8F6E\u91CD\u8BFB\u91CD\u7B97\u540E\u4ECD\u4E0E\u4ED6\u4EBA\u5199\u5165\u4EA4\u9519\uFF1B${baselineStackRelative(lane)} \u4E0E ${BASELINE_MANIFEST_RELATIVE} \u7684\u8BFB-\u6539-\u5199\u94FE\uFF09${causeNote}`, "\u7A0D\u540E\u91CD\u8DD1\u672C\u547D\u4EE4\u5373\u53EF\uFF1A\u91CD\u8DD1\u5728\u65B0\u9C9C\u76D8\u9762\u4E0A\u91CD\u653E\u540C\u4E00\u5224\u5377\u94FE\uFF08\u5E76\u53D1\u4FEE\u6539\u6309\u4E32\u884C\u91CD\u8BD5\u6536\u655B\u2014\u2014\u5BA1\u8BA1 R1 \u4FEE\u590D\u8BED\u4E49\uFF09\u3002", input);
+    }
+    if (attempt > 0) {
+      sleepSync2(BASELINE_SET_TX_BACKOFF_MS[Math.min(attempt - 1, BASELINE_SET_TX_BACKOFF_MS.length - 1)]);
+    }
+    const attemptOutcome = await baselineSetAttempt(rootDir, input, lane, attempt, casFs);
+    if (attemptOutcome.kind === "settled") {
+      return attemptOutcome.outcome;
+    }
+    lastContendedViaStackAbsent = attemptOutcome.viaStackAbsent === true;
+    lastContendedCasCause = attemptOutcome.viaCasCause ?? null;
+  }
 }
 function renderBaselineQuizHumanLine(baseline) {
   if (baseline.skipped === "non_interactive") {
@@ -51235,10 +51916,12 @@ var BASELINE_MD_FACES = [
   `${stripStorePrefix(BASELINE_PLATFORM_DIR_RELATIVE)}/observability.md`,
   `${stripStorePrefix(BASELINE_PLATFORM_DIR_RELATIVE)}/delivery.md`
 ];
+var BASELINE_DESIGN_TOKENS_TARGET = `${stripStorePrefix(BASELINE_FRONTEND_DIR_RELATIVE)}/design-tokens.yaml`;
 var BASELINE_CONFIRM_TARGETS = [
   stripStorePrefix(baselineStackRelative("frontend")),
   stripStorePrefix(baselineStackRelative("backend")),
-  ...BASELINE_MD_FACES
+  ...BASELINE_MD_FACES,
+  BASELINE_DESIGN_TOKENS_TARGET
 ];
 function baselineConfirmTargetPath(rootDir, target) {
   return `${rootDir}/${POMASTER_DIR}/${target}`;
@@ -51435,11 +52118,6 @@ function upsertConfirmedBlock(text, record) {
   return stripped.endsWith("\n") ? stripped + block : `${stripped}
 ${block}`;
 }
-function listUnknownEntries(text) {
-  const lines = text.split("\n");
-  const block = confirmedBlockRange(lines);
-  return lines.map((line, index) => insideConfirmedBlock(index, block) ? "" : UNKNOWN_ENTRY_LINE.exec(line)?.[1]?.trim() ?? "").filter((wordForm) => UNKNOWN_ENTRY_COUNT.test(`- ${wordForm}`));
-}
 async function readGenerationSeq(rootDir) {
   try {
     const { readFile: readFile18 } = await import("node:fs/promises");
@@ -51505,7 +52183,8 @@ async function runBaselineConfirm(rootDir, input = {}) {
     return failBaselineConfirm(error.code, error.message, error.hint, -1);
   }
   const unknownsRemaining = countUnknownEntries(manifestFile.text);
-  const unsettled = new Set(listUnknownEntries(manifestFile.text));
+  const ledger = parseUnknownLedger(manifestFile.text);
+  const stackValuesByLane = /* @__PURE__ */ new Map();
   for (const lane of BASELINE_LANES) {
     const stackRelative = baselineStackRelative(lane);
     const stackFile = await readTextFile(`${rootDir}/${stackRelative}`);
@@ -51517,15 +52196,25 @@ async function runBaselineConfirm(rootDir, input = {}) {
     if (!parse.ok) {
       return failBaselineConfirm("INVALID_STATE", `${stackRelative} \u7ED3\u6784\u4E0D\u53EF\u89E3\u6790: ${parse.detail}`, "\u4FEE\u590D\u6216\u4ECE git \u6062\u590D\u8BE5\u6587\u4EF6\u540E\u91CD\u8BD5\uFF1Bconfirm \u4E0D\u731C\u6D4B\u91CD\u5199\u9879\u76EE\u57FA\u7EBF\u6587\u4EF6\u3002", unknownsRemaining);
     }
-    for (const key of STACK_KEYS[lane]) {
-      if (!isResolved(parse.parsed.values.get(key) ?? "")) {
-        unsettled.add(unknownsWordForm(lane, key));
-      }
-    }
+    stackValuesByLane.set(lane, parse.parsed.values);
   }
-  if (unsettled.size > 0) {
-    const ordered = STACK_QUESTIONS.filter((question) => unsettled.has(unknownsWordForm(question.lane, question.key))).map((question) => unknownsWordForm(question.lane, question.key));
-    return failBaselineConfirm("BASELINE_UNKNOWNS_REMAINING", `unknowns \u672A\u5168\u9500\u8D26\uFF08${unsettled.size} \u952E\uFF09\uFF1A${ordered.join("\u3001")}${ordered.length < unsettled.size ? "\u3001<\u53F0\u8D26\u5916\u8BCD\u5F62>" : ""}`, "\u9010\u952E\u56DE\u586B\uFF1ATTY \u91CD\u8DD1 pomaster init \u95EE\u5377\uFF08\u5DF2\u7B54\u952E\u5E42\u7B49\u4E0D\u91CD\u590D\u95EE\uFF09\u6216 pomaster baseline set --lane <lane> --key <key> --value <value>\uFF1B\u5168\u90E8\u9500\u8D26\u540E\u518D confirm\u3002", unknownsRemaining);
+  const blockingJudgement = computeBlockingSet(ledger, stackValuesByLane);
+  if (!blockingJudgement.ok) {
+    return failBaselineConfirm("INVALID_STATE", `${BASELINE_MANIFEST_RELATIVE} unknowns \u53F0\u8D26\u7ED3\u6784\u5316\u884C\u5F62\u72B6\u635F\u574F: ${blockingJudgement.detail}`, "\u4FEE\u590D\u6216\u4ECE git \u6062\u590D\u8BE5\u6587\u4EF6\u540E\u91CD\u8BD5\uFF1Bconfirm \u4E0D\u731C\u6D4B\u635F\u574F\u53F0\u8D26\u7684\u8BED\u4E49\uFF08\u5F62\u72B6\u95F8\u7981\u9759\u9ED8\u5FFD\u7565\u2014\u2014P-C1\uFF09\u3002", -1);
+  }
+  if (blockingJudgement.blocking.length > 0) {
+    const blocking = new Set(blockingJudgement.blocking);
+    const ordered = [];
+    for (const question of STACK_QUESTIONS) {
+      const wordForm = unknownsWordForm(question.lane, question.key);
+      if (blocking.delete(wordForm))
+        ordered.push(wordForm);
+    }
+    for (const entry of ledger.entries) {
+      if (blocking.delete(entry.wordForm))
+        ordered.push(entry.wordForm);
+    }
+    return failBaselineConfirm("BASELINE_UNKNOWNS_REMAINING", `\u963B\u585E\u96C6\u672A\u9500\u8D26\uFF08${blockingJudgement.blocking.length} \u952E\uFF09\uFF1A${ordered.join("\u3001")}`, "\u963B\u585E\u952E\u9010\u952E\u56DE\u586B\uFF1ATTY \u91CD\u8DD1 pomaster init \u95EE\u5377\uFF08\u5DF2\u7B54\u952E\u5E42\u7B49\u4E0D\u91CD\u590D\u95EE\uFF09\u6216 pomaster baseline set --lane <lane> --key <key> --value <value>\uFF1B\u4E0D\u963B\u585E\u5F53\u524D\u589E\u91CF\u7684\u952E\u7531 Owner \u624B\u7F16 manifest \u767B\u8BB0\u8C41\u514D\uFF08\u7ED3\u6784\u5316\u884C applicability: NOT_APPLICABLE/DEFERRED + statement/classification\uFF09\u2014\u2014\u963B\u585E\u96C6\u6E05\u96F6\u540E\u518D confirm\u3002", unknownsRemaining);
   }
   const snapshot = await computeConfirmDigests(rootDir);
   if (!snapshot.ok) {
@@ -51703,7 +52392,7 @@ async function baselineGateErrors(rootDir) {
       {
         code: "BASELINE_NOT_CONFIRMED",
         message: `baseline \u672A\u786E\u8BA4${detail}\u2014\u2014\u9879\u76EE\u67B6\u6784\u672A\u7ECF Owner \u786E\u8BA4\uFF08confirm gate\uFF1AR-L\uFF09`,
-        hint: "pomaster baseline confirm\uFF08\u524D\u63D0\uFF1A14 unknowns \u5168\u9500\u8D26\uFF09\u2014\u2014\u786E\u8BA4\u8BB0\u5F55\u4E0E digest \u5FEB\u7167\u5199\u5165 baseline/manifest.yaml \u540E\u91CD\u8DD1 closeout\u3002"
+        hint: "pomaster baseline confirm\uFF08\u524D\u63D0\uFF1A\u963B\u585E\u96C6\u6E05\u96F6\u2014\u2014\u8C41\u514D\u767B\u8BB0\u884C\u4E0D\u963B\u585E\uFF09\u2014\u2014\u786E\u8BA4\u8BB0\u5F55\u4E0E digest \u5FEB\u7167\u5199\u5165 baseline/manifest.yaml \u540E\u91CD\u8DD1 closeout\u3002"
       }
     ];
   }
@@ -51728,17 +52417,45 @@ async function baselineGateErrors(rootDir) {
   }
   return [];
 }
+async function readBaselineBlockingPresentation(rootDir) {
+  const manifestFile = await readTextFile(`${rootDir}/${BASELINE_MANIFEST_RELATIVE}`);
+  if (manifestFile.kind !== "ok")
+    return { remaining: null };
+  const stackValues = /* @__PURE__ */ new Map();
+  for (const lane of BASELINE_LANES) {
+    const loaded = await loadLaneStackValues(rootDir, lane);
+    if (!loaded.ok)
+      return { remaining: null };
+    stackValues.set(lane, loaded.values);
+  }
+  const judgement = computeBlockingSet(parseUnknownLedger(manifestFile.text), stackValues);
+  if (!judgement.ok)
+    return { remaining: null };
+  return { remaining: judgement.blocking.length, applicability_summary: judgement.applicability_counts };
+}
 async function readBaselineConfirmationPresentation(rootDir) {
   const read = await readBaselineConfirmation(rootDir);
   if (read.kind === "manifest-absent" || read.kind === "manifest-unreadable")
     return null;
+  const blocking = await readBaselineBlockingPresentation(rootDir);
+  const blockingFields = {
+    blocking_remaining: blocking.remaining,
+    ...blocking.applicability_summary !== void 0 ? { applicability_summary: blocking.applicability_summary } : {}
+  };
   if (read.kind === "record-invalid") {
-    return { state: "unconfirmed", unknowns_remaining: read.unknowns_remaining, at_seq: null, drifted_files: [] };
+    return {
+      state: "unconfirmed",
+      unknowns_remaining: read.unknowns_remaining,
+      ...blockingFields,
+      at_seq: null,
+      drifted_files: []
+    };
   }
   const driftedFiles = read.mismatches.map((mismatch) => `${mismatch.target}${mismatch.note !== null ? `\uFF08${mismatch.note}\uFF09` : ""}`);
   return {
     state: read.state,
     unknowns_remaining: read.unknowns_remaining,
+    ...blockingFields,
     at_seq: read.record.at_seq,
     drifted_files: driftedFiles,
     ...read.record.pending !== void 0 ? { pending_change: { change_ref: read.record.pending.change_ref, batch: read.record.pending.batch } } : {},
@@ -51746,7 +52463,7 @@ async function readBaselineConfirmationPresentation(rootDir) {
   };
 }
 function baselineConfirmationHumanLine(presentation) {
-  const unknowns = `unknowns remaining: ${presentation.unknowns_remaining}`;
+  const unknowns = `unknowns remaining: ${presentation.unknowns_remaining}` + (presentation.blocking_remaining === null ? "\uFF08\u963B\u585E \u4E0D\u53EF\u5224\uFF09" : `\uFF08\u963B\u585E ${presentation.blocking_remaining}\uFF09`);
   if (presentation.state === "confirmed") {
     const ackNote = presentation.ack !== void 0 ? `\uFF1B\u4E0A\u6B21\u786E\u8BA4\u4E3A\u624B\u6539\u58F0\u660E\uFF08ack note: ${presentation.ack.note}\uFF09` : "";
     return `  baseline gate: \u5DF2\u786E\u8BA4\uFF08at_seq=${presentation.at_seq}${ackNote}\uFF1B${unknowns}\uFF09\u2014\u2014closeout \u6536\u53E3\u5224\u5377\u5728\u5EA7`;
@@ -51757,7 +52474,7 @@ function baselineConfirmationHumanLine(presentation) {
   if (presentation.state === "drifted") {
     return `  baseline gate: \u5DF2\u6F02\u79FB\uFF08at_seq=${presentation.at_seq}\uFF1B${presentation.drifted_files.length} \u6587\u4EF6\u4E0E\u786E\u8BA4\u5FEB\u7167\u4E0D\u7B26\uFF1A${presentation.drifted_files.join("\u3001")}\uFF09\u2014\u2014\u91CD\u786E\u8BA4: pomaster baseline confirm --change <CHANGE-id> \u6216 --ack-drifted --note "<\u7406\u7531>"\uFF08\u88F8\u91CD\u786E\u8BA4\u62D2\u7EDD\uFF1BAI \u4EE3\u8DD1 ack \u987B\u6301 Owner \u6307\u793A\uFF09`;
   }
-  return `  baseline gate: \u672A\u786E\u8BA4\uFF08${unknowns}\uFF09\u2014\u2014\u786E\u8BA4: pomaster baseline confirm\uFF0814 unknowns \u5168\u9500\u8D26\u540E\uFF09`;
+  return `  baseline gate: \u672A\u786E\u8BA4\uFF08${unknowns}\uFF09\u2014\u2014\u786E\u8BA4: pomaster baseline confirm\uFF08\u963B\u585E\u96C6\u6E05\u96F6\u540E\uFF09`;
 }
 var BASELINE_CHANGE_ID_PATTERN = /^CHANGE\.[A-Za-z0-9][A-Za-z0-9_-]*$/;
 var BASELINE_CHANGE_ACTIVE_LIFECYCLES = ["PROPOSED", "CURRENT"];
@@ -53189,11 +53906,11 @@ async function runInit(rootDir, options = {}) {
   const packageObservation = await observePackageStack(rootDir);
   let observation = ZERO_OBSERVATION;
   if (packageObservation !== null) {
-    const applied = await applyStackObservations(rootDir, packageObservation, files);
+    const registered = await registerStackObservationCandidates(rootDir, packageObservation);
     observation = {
       source: packageObservation.source,
-      observed: applied.observed,
-      skipped_resolved: applied.skipped_resolved
+      observed: registered.observed,
+      skipped_resolved: registered.skipped_resolved
     };
   }
   let baseline;
@@ -53312,7 +54029,7 @@ async function runInit(rootDir, options = {}) {
   }
   const entryLine = heavy ? "  entry: \u91CD\u5165\u53E3\u9ED8\u8BA4\uFF08skills \u5E93 + hooks \u6CE8\u5165\uFF1B\u4FEE\u590D/\u91CD\u5EFA = \u91CD\u8DD1 pomaster init\uFF09" : "  entry: \u6700\u5C0F\u5F62\u6001\uFF08--platforms none\uFF1A\u96F6\u5E73\u53F0\u4EA7\u7269\uFF0C\u65E0\u91CD\u5165\u53E3\u5B89\u88C5\u7269\uFF09";
   const baselineLine = renderBaselineQuizHumanLine(baseline);
-  const observationLine = observation.source === null ? "  observation: package.json \u89C2\u5BDF\u9762\u7F3A\u5E2D\uFF08\u7F3A\u5E2D/\u4E0D\u53EF\u89E3\u6790\uFF09\u2014\u2014\u6280\u672F\u6808 UNKNOWN \u4FDD\u6301\uFF0C\u95EE\u5377\u5206\u6BCD\u4E0D\u53D7\u51CF" : `  observation: package.json \u2192 stack \u89C2\u5BDF\u56DE\u586B ${String(observation.observed)} \u952E\uFF08[Observed: package.json] \u6CE8\u8BB0\uFF1B${String(observation.skipped_resolved)} \u952E\u5DF2\u9500\u8D26\u8DF3\u8FC7\uFF09`;
+  const observationLine = observation.source === null ? "  observation: package.json \u89C2\u5BDF\u9762\u7F3A\u5E2D\uFF08\u7F3A\u5E2D/\u4E0D\u53EF\u89E3\u6790\uFF09\u2014\u2014\u6280\u672F\u6808 UNKNOWN \u4FDD\u6301\uFF0C\u95EE\u5377\u5206\u6BCD\u4E0D\u53D7\u51CF" : `  observation: package.json \u2192 \u89C2\u5BDF\u5019\u9009\u767B\u8BB0 ${String(observation.observed)} \u952E\uFF08[Observed: package.json] \u6CE8\u8BB0\u968F\u95EE\u5377\u5448\u73B0\uFF0Cadoption \u524D\u4E0D\u5165\u57FA\u7EBF\uFF1B${String(observation.skipped_resolved)} \u952E\u5DF2\u91C7\u7EB3\u5206\u8D26\u51FA\u5C40\uFF09`;
   const presetLine = renderBaselinePresetHumanLine(presetDraft);
   const human = [
     ...INIT_LOGO_LINES,
@@ -53456,7 +54173,7 @@ async function readCapabilityTipsEnabled(rootDir) {
 }
 
 // packages/cli/dist/next-action.js
-import { existsSync as existsSync10, readdirSync as readdirSync16, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync11, readdirSync as readdirSync16, readFileSync as readFileSync11 } from "node:fs";
 import { join as join6 } from "node:path";
 var NEXT_ACTION_SNAPSHOT_INCOMPLETE = "NEXT_ACTION_SNAPSHOT_INCOMPLETE";
 var ACTIVE_LIFECYCLE_VALUES = ["PROPOSED", "CURRENT"];
@@ -53490,6 +54207,7 @@ function emptySnapshot(initialized) {
     task_execution_active: false,
     baseline_gate_codes: [],
     baseline_unknowns_remaining: null,
+    baseline_blocking_remaining: null,
     baseline_pending_change_ref: null
   };
 }
@@ -53506,7 +54224,7 @@ function parseLedgerRow(row2) {
   };
 }
 function evidenceDirCounts(dir, pattern) {
-  if (!existsSync10(dir))
+  if (!existsSync11(dir))
     return 0;
   let count = 0;
   try {
@@ -53594,7 +54312,7 @@ async function collectNextActionSnapshot(rootDir, warnings) {
     boundRefs = [...expiredBoundRefs, ...activeBoundRefs].sort();
   }
   const firstTask = activeTasks[0];
-  const taskManifestPresent = firstTask !== void 0 ? existsSync10(contextsManifestPath(rootDir, firstTask.id)) : false;
+  const taskManifestPresent = firstTask !== void 0 ? existsSync11(contextsManifestPath(rootDir, firstTask.id)) : false;
   let taskManifestFreshness = "absent";
   let taskManifestRole = null;
   if (firstTask !== void 0 && taskManifestPresent) {
@@ -53682,6 +54400,7 @@ async function collectNextActionSnapshot(rootDir, warnings) {
     task_execution_active: taskExecutionActive,
     baseline_gate_codes: baselineGateCodeList,
     baseline_unknowns_remaining: baselinePresentation?.unknowns_remaining ?? null,
+    baseline_blocking_remaining: baselinePresentation?.blocking_remaining ?? null,
     baseline_pending_change_ref: baselinePresentation?.pending_change?.change_ref ?? null
   };
 }
@@ -53694,7 +54413,7 @@ function scanTaskExecutionActive(rootDir, taskId, warnings) {
   if (taskId === void 0)
     return false;
   const dir = executionsDirPath(rootDir);
-  if (!existsSync10(dir))
+  if (!existsSync11(dir))
     return false;
   let names;
   try {
@@ -53712,7 +54431,7 @@ function scanTaskExecutionActive(rootDir, taskId, warnings) {
       continue;
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync10(join6(dir, name), "utf8"));
+      parsed = JSON.parse(readFileSync11(join6(dir, name), "utf8"));
     } catch {
       warnings.push({
         code: NEXT_ACTION_SNAPSHOT_INCOMPLETE,
@@ -53769,12 +54488,13 @@ var NEXT_ACTION_ROUTE_TABLE = [
     })
   },
   {
-    // T2 R5：baseline 未确认（或已漂移）且 unknowns 全销账时，收口前的唯一缺口就是
-    // 确认仪式——此刻任何任务内推进（closeout 判卷会被 BASELINE_NOT_CONFIRMED/
-    // BASELINE_DRIFT 阻断）都先还这笔账。unknowns_remaining>0 时问卷分母未销账，
-    // 指 confirm 只会被 confirm 自身闸拒——不路由（诚实缺席）。
+    // T2 R5 + P-C1 T13：baseline 未确认（或已漂移）且阻塞集清零时，收口前的唯一缺口
+    // 就是确认仪式——此刻任何任务内推进（closeout 判卷会被 BASELINE_NOT_CONFIRMED/
+    // BASELINE_DRIFT 阻断）都先还这笔账。判据 = blocking_remaining（§6.9）：豁免登记行
+    // 在册（unknowns 总口径 > 0 而阻塞 0）照常路由；阻塞键在册时指 confirm 只会被
+    // confirm 自身闸拒——不路由（诚实缺席）；null 不可判 fail-closed 不路由。
     id: "R_BASELINE_NOT_READY",
-    when: (s) => s.baseline_unknowns_remaining === 0 && (s.baseline_gate_codes.includes("BASELINE_NOT_CONFIRMED") || s.baseline_gate_codes.includes("BASELINE_DRIFT")) ? true : false,
+    when: (s) => s.baseline_blocking_remaining === 0 && (s.baseline_gate_codes.includes("BASELINE_NOT_CONFIRMED") || s.baseline_gate_codes.includes("BASELINE_DRIFT")) ? true : false,
     render: (s) => {
       if (s.baseline_gate_codes.includes("BASELINE_DRIFT")) {
         return {
@@ -53793,7 +54513,7 @@ var NEXT_ACTION_ROUTE_TABLE = [
       return {
         beat: "0",
         command: "pomaster baseline confirm",
-        reason: "baseline \u672A\u786E\u8BA4\uFF08unknowns \u5DF2\u5168\u9500\u8D26\u2014\u2014\u786E\u8BA4\u662F\u552F\u4E00\u5269\u4F59\u7F3A\u53E3\uFF1Bcloseout \u5224\u5377\u4F1A\u88AB BASELINE_NOT_CONFIRMED \u963B\u65AD\uFF09"
+        reason: "baseline \u672A\u786E\u8BA4\uFF08\u963B\u585E\u96C6\u5DF2\u6E05\u96F6\u2014\u2014\u786E\u8BA4\u662F\u552F\u4E00\u5269\u4F59\u7F3A\u53E3\uFF1Bcloseout \u5224\u5377\u4F1A\u88AB BASELINE_NOT_CONFIRMED \u963B\u65AD\uFF09"
       };
     }
   },
@@ -54875,7 +55595,7 @@ function runtimeStorePaths(store) {
 }
 
 // packages/cli/dist/view.js
-import { existsSync as existsSync11, readFileSync as readFileSync11, readdirSync as readdirSync17 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync12, readdirSync as readdirSync17 } from "node:fs";
 import { join as join7 } from "node:path";
 init_dist();
 
@@ -55419,18 +56139,18 @@ async function runViewTask(rootDir, input) {
 var DECISION_GRAPH_SIDECAR_FILENAME = "decision-graph.json";
 function scanConflictReviewItems(rootDir) {
   const baseDir = discoveryScratchpadsDirPath(rootDir);
-  if (!existsSync11(baseDir))
+  if (!existsSync12(baseDir))
     return { items: [] };
   const items = [];
   for (const dirent of readdirSync17(baseDir, { withFileTypes: true })) {
     if (!dirent.isDirectory())
       continue;
     const sidecarPath = join7(discoveryScratchpadDirPath(rootDir, dirent.name), DECISION_GRAPH_SIDECAR_FILENAME);
-    if (!existsSync11(sidecarPath))
+    if (!existsSync12(sidecarPath))
       continue;
     let graph;
     try {
-      graph = JSON.parse(readFileSync11(sidecarPath, "utf8"));
+      graph = JSON.parse(readFileSync12(sidecarPath, "utf8"));
     } catch (err) {
       return {
         error: {
@@ -55636,7 +56356,7 @@ async function runViewDecision(rootDir, input) {
     }, emptyResult6);
   }
   const padDir = discoveryScratchpadDirPath(rootDir, input.discoveryId);
-  if (!existsSync11(padDir)) {
+  if (!existsSync12(padDir)) {
     return failView(command, {
       code: "SCRATCHPAD_NOT_FOUND",
       message: `scratchpad \u4E0D\u5B58\u5728: ${toPosix(`${DISCOVERY_SCRATCHPADS_RELATIVE}/${input.discoveryId}`)}`,
@@ -55644,7 +56364,7 @@ async function runViewDecision(rootDir, input) {
     }, emptyResult6);
   }
   const sidecarPath = join7(padDir, "decision-graph.json");
-  if (!existsSync11(sidecarPath)) {
+  if (!existsSync12(sidecarPath)) {
     return failView(command, {
       code: "DECISION_GRAPH_NOT_FOUND",
       message: `scratchpad ${input.discoveryId} \u65E0 decision-graph sidecar\uFF08${toPosix(`${DISCOVERY_SCRATCHPADS_RELATIVE}/${input.discoveryId}/decision-graph.json`)} \u7F3A\u5E2D\uFF09`,
@@ -55653,7 +56373,7 @@ async function runViewDecision(rootDir, input) {
   }
   let graph;
   try {
-    graph = JSON.parse(readFileSync11(sidecarPath, "utf8"));
+    graph = JSON.parse(readFileSync12(sidecarPath, "utf8"));
   } catch (err) {
     return failView(command, {
       code: "SCHEMA_INVALID",
@@ -57886,7 +58606,7 @@ ${" ".repeat(18)}note: ${row2.note}`}`)
 
 // packages/cli/dist/exec-guard.js
 init_dist();
-import { readFileSync as readFileSync23 } from "node:fs";
+import { readFileSync as readFileSync24 } from "node:fs";
 import { readFile as readFile12 } from "node:fs/promises";
 function isFATALCode(err) {
   return typeof err === "object" && err !== null && (err.reason === "unknown_prefix" || err.reason === "grammar");
@@ -57963,7 +58683,7 @@ async function runExecGuard(rootDir, input) {
   let text;
   if (input.attempt === "-") {
     try {
-      text = readFileSync23(0, "utf8");
+      text = readFileSync24(0, "utf8");
     } catch (err) {
       return malformed("ATTEMPT_MALFORMED", `stdin \u8BFB\u53D6\u5931\u8D25\uFF1A${err instanceof Error ? err.message : String(err)}`, "stdin \u5F62\u6001\u8981\u6C42\u7BA1\u9053\u4F20\u5165 attempt JSON\uFF08echo \u2026 | pomaster exec-guard --attempt -\uFF09\u3002");
     }
@@ -58135,9 +58855,1316 @@ async function runReconcile(rootDir, input) {
   ], [summary, `  hint: ${RECONCILE_DIRTY_HINT}`]);
 }
 
+// packages/cli/dist/recon.js
+init_dist2();
+init_dist();
+import { spawnSync as spawnSync14 } from "node:child_process";
+import { existsSync as existsSync19, mkdtempSync as mkdtempSync2, readdirSync as readdirSync19, readFileSync as readFileSync25, rmSync as rmSync12 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join10, sep as sep2 } from "node:path";
+import { performance as performance21 } from "node:perf_hooks";
+var RECON_IMPORT_GRAPH_SENSOR_CAPABILITY = "SENSOR.BUILD.STATIC";
+var RECON_IMPORT_GRAPH_OPERATION = "scan_import_graph";
+var RECON_IMPORT_GRAPH_ADAPTER = "pomaster-cli";
+if (!SENSOR_ID_PATTERN.test(RECON_IMPORT_GRAPH_SENSOR_CAPABILITY)) {
+  throw new Error(`RECON_IMPORT_GRAPH_SENSOR_CAPABILITY \u8BCD\u5F62\u6F02\u79FB\uFF08\u987B SENSOR.<DOMAIN>.<KIND>\uFF09\uFF1A${RECON_IMPORT_GRAPH_SENSOR_CAPABILITY}`);
+}
+var RECON_SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".vue"
+]);
+var RECON_SKIP_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  "dist",
+  ".git",
+  "coverage",
+  ".pomaster"
+]);
+var RECON_UNMAPPED_PRESENTATION_CAP = 20;
+function collectReconSourceFiles(rootDir, dir, out) {
+  let entries;
+  try {
+    entries = readdirSync19(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    const full = join10(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (RECON_SKIP_DIRS.has(entry.name))
+        continue;
+      collectReconSourceFiles(rootDir, full, out);
+      continue;
+    }
+    if (!entry.isFile())
+      continue;
+    const dot = entry.name.lastIndexOf(".");
+    if (dot === -1 || !RECON_SOURCE_EXTENSIONS.has(entry.name.slice(dot)))
+      continue;
+    const relative3 = full.slice(rootDir.length).split(sep2).join("/").replace(/^\//, "");
+    out.push(relative3);
+  }
+}
+function allocateObservationId(observationsDir) {
+  let max = 0;
+  let names;
+  try {
+    names = readdirSync19(observationsDir);
+  } catch {
+    names = [];
+  }
+  for (const name of names) {
+    const match = /^OBS-([0-9]+)\.json$/.exec(name);
+    if (match !== null) {
+      const value = Number(match[1]);
+      if (Number.isFinite(value) && value > max)
+        max = value;
+    }
+  }
+  return `OBS-${String(max + 1).padStart(4, "0")}`;
+}
+function emptyReconResult() {
+  return {
+    observation: null,
+    observation_id: null,
+    receipt_path: null,
+    source_files: null,
+    objects_resolved: null,
+    external_imports: null,
+    unmapped_count: null,
+    confidence: null,
+    captured_at_seq: null,
+    report_blob: null,
+    unmapped_stdout_capped: false
+  };
+}
+function reconFail(error) {
+  return failOutcome("recon import-graph", emptyReconResult(), [error], [`recon import-graph: FAILED \u2014 ${error.code}
+  hint: ${error.hint}`]);
+}
+var RECON_EMPTY_MAPPING = {};
+function observationRecordOf(receipt) {
+  return {
+    record_type: "observation_receipt",
+    ...receipt,
+    artifact_refs: artifactRefsToSnake(receipt.artifact_refs)
+  };
+}
+async function runReconImportGraph(rootDir, input) {
+  const executionResolution = resolveExecutionId(input.executionId, void 0);
+  if ("fail" in executionResolution || executionResolution.executionId === null) {
+    return reconFail({
+      code: "SCHEMA_INVALID",
+      message: "fail" in executionResolution ? executionResolution.fail : `execution_id \u7F3A\u5E2D\uFF08OBS \u56DE\u6267 execution_id \u5FC5\u586B\u2014\u2014\xA76.13 \u8BC1\u660E\u4E49\u52A1\uFF09`,
+      hint: "\u5148 pomaster execution begin \u767B\u8BB0\u6267\u884C\u8EAB\u4EFD\uFF08AGX-n\uFF09\uFF0C\u518D\u4EE5 --execution-id \u4F20\u5165\uFF08S1 \u7981\u81EA\u9020\u8EAB\u4EFD\uFF09\u3002"
+    });
+  }
+  const executionId = executionResolution.executionId;
+  const initialized = await requireInitialized(rootDir);
+  if ("error" in initialized)
+    return reconFail(initialized.error);
+  if (!existsSync19(`${executionsDirPath(rootDir)}/${executionId}.json`)) {
+    return reconFail({
+      code: "EXECUTION_NOT_FOUND",
+      message: `execution_id \u672A\u767B\u8BB0\uFF08executions/ \u6863\u6848\u7F3A\u5931\uFF09\uFF1A${executionId}`,
+      hint: "\u5148 pomaster execution begin \u767B\u8BB0\u6267\u884C\u8EAB\u4EFD\uFF08.pomaster/executions/AGX-*.json \u662F\u8EAB\u4EFD\u552F\u4E00\u4E8B\u5B9E\u6E90\uFF09\uFF1B\u5DF2\u5C01\u53E3\u6267\u884C\u5141\u8BB8\u4E8B\u540E\u8865\u5F55\u3002"
+    });
+  }
+  const paths = buildStorePaths(rootDir);
+  const rawFiles = [];
+  collectReconSourceFiles(rootDir, rootDir, rawFiles);
+  rawFiles.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+  const files = [];
+  const readFailures = [];
+  for (const relative3 of rawFiles) {
+    try {
+      files.push({ path: relative3, content: readFileSync25(join10(rootDir, relative3), "utf8") });
+    } catch (error) {
+      readFailures.push(`${relative3}: unreadable (${error instanceof Error ? error.message : String(error)})`);
+    }
+  }
+  if (files.length === 0) {
+    try {
+      const observationId = allocateObservationId(paths.observationsDir);
+      const receipt = buildObservationReceipt({
+        observationId,
+        executionId,
+        sensorCapability: RECON_IMPORT_GRAPH_SENSOR_CAPABILITY,
+        adapter: RECON_IMPORT_GRAPH_ADAPTER,
+        operation: RECON_IMPORT_GRAPH_OPERATION,
+        surface: "STRUCTURAL_REALITY",
+        result: "INCONCLUSIVE",
+        capturedAtSeq: initialized.seq,
+        artifactRefs: [],
+        normalizedFacts: [
+          "recon_surface: import-graph",
+          "source_files: 0",
+          "zero_denominator: true"
+        ]
+      });
+      const persisted = persistObservationRecord(paths.evidenceDir, observationRecordOf(receipt));
+      const receiptPath = `${POMASTER_DIR}/evidence/${persisted.relativePath}`;
+      return failOutcome("recon import-graph", {
+        ...emptyReconResult(),
+        observation: "INCONCLUSIVE",
+        observation_id: receipt.observation_id,
+        receipt_path: receiptPath,
+        source_files: 0,
+        captured_at_seq: initialized.seq
+      }, [
+        {
+          code: "RECON_INCONCLUSIVE",
+          message: `\u96F6\u6E90\u6587\u4EF6\uFF08\u96F6\u5206\u6BCD\uFF09\u2014\u2014INCONCLUSIVE \u8D1F\u503C\u515C\u5E95\u843D\u8D26\uFF0C\u4E0D\u4F2A\u9020\u7EFF\uFF1A${receiptPath}`,
+          hint: "\u679A\u4E3E\u95ED\u5305 .ts/.tsx/.js/.jsx/.mjs/.cjs/.vue\uFF08\u8DF3\u8FC7 node_modules/dist/.git/coverage/.pomaster\uFF09\u2014\u2014\u786E\u8BA4\u5BBF\u4E3B\u6E90\u7801\u6839\u975E\u7A7A\u540E\u91CD\u8DD1\uFF1B\u96F6\u5206\u6BCD\u7981\u5F53\u6EE1\u5206\u3002"
+        }
+      ], [
+        "recon import-graph: INCONCLUSIVE \u2014 \u96F6\u6E90\u6587\u4EF6\uFF08\u96F6\u5206\u6BCD\u7981\u5F53\u6EE1\u5206\uFF0C\u4E0D\u4F2A\u9020\u7EFF\uFF09",
+        `observation receipt: ${receiptPath}\uFF08result=INCONCLUSIVE\uFF1Bartifact_refs \u7A7A\u2014\u2014\u65E0\u62A5\u544A blob \u53EF\u80CC\u4E66\uFF09`,
+        "\u679A\u4E3E\u95ED\u5305\uFF1A.ts/.tsx/.js/.jsx/.mjs/.cjs/.vue\uFF08\u8DF3\u8FC7 node_modules/dist/.git/coverage/.pomaster\uFF09"
+      ]);
+    } catch (error) {
+      if (error instanceof GovernanceError)
+        return reconFail(governanceErrorToCliError(error));
+      throw error;
+    }
+  }
+  try {
+    const sourceSha = sha256OfCanonical(files.map((file) => ({ path: file.path, content: file.content })));
+    const analysis = analyzeImportGraph({
+      files,
+      mapping: RECON_EMPTY_MAPPING,
+      sourceSha
+    });
+    const reportBytes = Buffer.from(`${JSON.stringify({
+      recon_surface: "import-graph",
+      report: analysis.report,
+      external_imports: analysis.externalImports,
+      unmapped: analysis.unmapped,
+      scanned_files: files.map((file) => file.path),
+      source_read_failures: readFailures
+    }, null, 2)}
+`, "utf8");
+    const blob = persistEvidenceArtifact(paths.evidenceDir, { media: "json", bytes: reportBytes });
+    const observationId = allocateObservationId(paths.observationsDir);
+    const receipt = buildObservationReceipt({
+      observationId,
+      executionId,
+      sensorCapability: RECON_IMPORT_GRAPH_SENSOR_CAPABILITY,
+      adapter: RECON_IMPORT_GRAPH_ADAPTER,
+      operation: RECON_IMPORT_GRAPH_OPERATION,
+      surface: "STRUCTURAL_REALITY",
+      result: "OBSERVED",
+      capturedAtSeq: initialized.seq,
+      artifactRefs: [
+        {
+          sha256: blob.sha256,
+          media: blob.media,
+          byteSize: blob.byteSize,
+          storagePath: blob.storagePath
+        }
+      ],
+      normalizedFacts: [
+        "recon_surface: import-graph",
+        `source_files: ${String(files.length)}`,
+        `objects_resolved: ${String(analysis.report.objects_resolved)}`,
+        `external_imports: ${String(analysis.externalImports)}`,
+        `unmapped: ${String(analysis.unmapped.length)}`,
+        `edge_proposals_not_registered: ${String(analysis.edges.length)}`,
+        `confidence: ${analysis.report.confidence}`,
+        ...readFailures.length > 0 ? [`source_read_failures: ${String(readFailures.length)}`] : []
+      ]
+    });
+    const persisted = persistObservationRecord(paths.evidenceDir, observationRecordOf(receipt));
+    const receiptPath = `${POMASTER_DIR}/evidence/${persisted.relativePath}`;
+    const human = [
+      `recon import-graph: OBSERVED \u2014 ${String(files.length)} \u4E2A\u6E90\u6587\u4EF6\uFF08confidence ${analysis.report.confidence}\uFF09`,
+      `mapping \u547D\u4E2D\uFF08objects_resolved\uFF09: ${String(analysis.report.objects_resolved)} \u2014\u2014 mapping \u6052\u7A7A\uFF08\u8001\u9879\u76EE\u65E0 governed id \u5206\u6BCD\uFF1Bunmapped \u6E05\u5355\u5373\u4EA7\u51FA\uFF09`,
+      `externalImports\uFF08\u88F8\u5305\u540D import \u8BA1\u6570\uFF09: ${String(analysis.externalImports)}`,
+      `unmapped: ${String(analysis.unmapped.length)} \u6761\uFF08\u7981\u9759\u9ED8\u4E22\u5F03\uFF1B\u5B8C\u6574\u6E05\u5355\u89C1 report blob\uFF09`
+    ];
+    for (const row2 of analysis.unmapped.slice(0, RECON_UNMAPPED_PRESENTATION_CAP)) {
+      human.push(`  - ${row2.source} -> ${row2.specifier} (${row2.reason})`);
+    }
+    if (analysis.unmapped.length > RECON_UNMAPPED_PRESENTATION_CAP) {
+      human.push(`  \u2026\uFF08\u5176\u4F59 ${String(analysis.unmapped.length - RECON_UNMAPPED_PRESENTATION_CAP)} \u6761\u89C1 report blob ${blob.storagePath}\uFF09`);
+    }
+    human.push(`report blob: ${blob.storagePath}\uFF08${blob.sha256}\uFF1Bmedia=json\uFF09`);
+    human.push(`observation receipt: ${receiptPath}\uFF08result=OBSERVED\uFF1Bsurface=STRUCTURAL_REALITY\uFF1Bcaptured_at_seq=${String(initialized.seq)}\uFF09`);
+    human.push(`CALLS \u8FB9\u63D0\u6848 ${String(analysis.edges.length)} \u6761\u96F6\u843D\u76D8\uFF08\u767B\u8BB0\u5F52\u6D88\u8D39\u65B9 relations.registerRelation\u2014\u2014\u672C\u6279\u4E0D\u8C03\u7528\uFF09`);
+    const warnings = [];
+    if (readFailures.length > 0) {
+      warnings.push({
+        code: "RECON_SOURCE_UNREADABLE",
+        message: `${String(readFailures.length)} \u4E2A\u767B\u8BB0\u5728\u518C\u7684\u6E90\u6587\u4EF6\u8BFB\u53D6\u5931\u8D25\uFF08\u5DF2\u62AB\u9732\u975E\u9759\u9ED8\u8DF3\u8FC7\uFF1B\u4E0D\u8BA1\u5165\u626B\u63CF\u5206\u6BCD\uFF09\uFF1A${readFailures.join("; ")}`,
+        hint: "\u6838\u67E5\u6587\u4EF6\u6743\u9650/\u5360\u7528\u540E\u91CD\u8DD1\uFF1B\u8BFB\u5931\u8D25\u6E05\u5355\u5DF2\u968F report blob \u843D\u76D8\uFF08source_read_failures\uFF09\u3002"
+      });
+    }
+    return okOutcome("recon import-graph", {
+      observation: "OBSERVED",
+      observation_id: receipt.observation_id,
+      receipt_path: receiptPath,
+      source_files: files.length,
+      objects_resolved: analysis.report.objects_resolved,
+      external_imports: analysis.externalImports,
+      unmapped_count: analysis.unmapped.length,
+      confidence: analysis.report.confidence,
+      captured_at_seq: initialized.seq,
+      report_blob: {
+        sha256: blob.sha256,
+        storage_path: blob.storagePath,
+        byte_size: blob.byteSize
+      },
+      unmapped_stdout_capped: analysis.unmapped.length > RECON_UNMAPPED_PRESENTATION_CAP
+    }, human, warnings);
+  } catch (error) {
+    if (error instanceof GovernanceError)
+      return reconFail(governanceErrorToCliError(error));
+    throw error;
+  }
+}
+var RECON_MIGRATION_STACKS = [
+  "prisma",
+  "flyway",
+  "liquibase",
+  "alembic",
+  "django_style"
+];
+var RECON_MIGRATION_STACK_WORD_FORMS = {
+  prisma: "prisma/migrations/ + migration_lock.toml + <14\u4F4D\u65F6\u95F4\u6233>_<name> \u5B50\u76EE\u5F55",
+  flyway: "db/migration/ + V*__*.sql",
+  liquibase: "db.changelog.{xml,yaml,json} + changelog \u76EE\u5F55",
+  alembic: "alembic/versions/ + alembic.ini",
+  django_style: "migrations/ \u76EE\u5F55\uFF08\u6392\u9664 prisma/migrations \u8BCD\u5F62\u2014\u2014\u540C\u4E00\u7269\u7406\u76EE\u5F55\u7981\u53CC\u6808\u53CC\u8BA1\uFF09"
+};
+var RECON_PRISMA_MIGRATION_DIR = /^[0-9]{14}_.+/;
+var RECON_FLYWAY_FILE = /^V.+__.+\.sql$/;
+var RECON_LIQUIBASE_MARKER_BASENAMES = /* @__PURE__ */ new Set([
+  "db.changelog.xml",
+  "db.changelog.yaml",
+  "db.changelog.json"
+]);
+var RECON_MIGRATIONS_SKIP_DIRS = /* @__PURE__ */ new Set([
+  ...RECON_SKIP_DIRS,
+  ".venv",
+  "venv",
+  "vendor",
+  "target",
+  "build"
+]);
+function scanHostTree(rootDir) {
+  const files = [];
+  const dirs = [];
+  const unreadableDirs = [];
+  const walk = (dir, relative3) => {
+    let entries;
+    try {
+      entries = readdirSync19(dir, { withFileTypes: true });
+    } catch {
+      unreadableDirs.push(relative3 === "" ? "." : relative3);
+      return;
+    }
+    for (const entry of entries) {
+      const full = join10(dir, entry.name);
+      const rel = relative3 === "" ? entry.name : `${relative3}/${entry.name}`;
+      if (entry.isDirectory()) {
+        if (RECON_MIGRATIONS_SKIP_DIRS.has(entry.name))
+          continue;
+        dirs.push(rel);
+        walk(full, rel);
+        continue;
+      }
+      if (!entry.isFile())
+        continue;
+      files.push(rel);
+    }
+  };
+  walk(rootDir, "");
+  const byAsc = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+  return {
+    files: [...files].sort(byAsc),
+    dirs: [...dirs].sort(byAsc),
+    unreadableDirs: [...unreadableDirs].sort(byAsc)
+  };
+}
+function basenameOf(posixPath) {
+  const index = posixPath.lastIndexOf("/");
+  return index === -1 ? posixPath : posixPath.slice(index + 1);
+}
+function parentOf(posixPath) {
+  const index = posixPath.lastIndexOf("/");
+  return index === -1 ? "" : posixPath.slice(0, index);
+}
+function isSuffixWordForm(dirPath, wordForm) {
+  return dirPath === wordForm || dirPath.endsWith(`/${wordForm}`);
+}
+function filesUnderDir(files, dirPrefix) {
+  const prefix = `${dirPrefix}/`;
+  return files.filter((file) => file.startsWith(prefix));
+}
+function sortedUnique(values) {
+  return [...new Set(values)].sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+}
+function detectMigrationStacks(scan) {
+  const prismaRoots = scan.dirs.filter((dir) => isSuffixWordForm(dir, "prisma/migrations"));
+  const prismaMarkers = scan.files.filter((file) => prismaRoots.includes(parentOf(file)) && basenameOf(file) === "migration_lock.toml");
+  const prismaMigrationDirs = prismaRoots.flatMap((root) => scan.dirs.filter((dir) => dir.startsWith(`${root}/`) && RECON_PRISMA_MIGRATION_DIR.test(basenameOf(dir))));
+  const prismaFiles = prismaMigrationDirs.flatMap((dir) => filesUnderDir(scan.files, dir));
+  const flywayRoots = scan.dirs.filter((dir) => isSuffixWordForm(dir, "db/migration"));
+  const flywayFiles = flywayRoots.flatMap((root) => filesUnderDir(scan.files, root).filter((file) => RECON_FLYWAY_FILE.test(basenameOf(file))));
+  const liquibaseMarkers = scan.files.filter((file) => RECON_LIQUIBASE_MARKER_BASENAMES.has(basenameOf(file)));
+  const liquibaseDirs = scan.dirs.filter((dir) => basenameOf(dir) === "changelog");
+  const liquibaseFiles = liquibaseDirs.flatMap((dir) => filesUnderDir(scan.files, dir)).filter((file) => !liquibaseMarkers.includes(file));
+  const alembicMarkers = scan.files.filter((file) => basenameOf(file) === "alembic.ini");
+  const alembicVersionDirs = scan.dirs.filter((dir) => isSuffixWordForm(dir, "alembic/versions"));
+  const alembicFiles = alembicVersionDirs.flatMap((dir) => filesUnderDir(scan.files, dir));
+  const djangoDirs = scan.dirs.filter((dir) => basenameOf(dir) === "migrations" && !isSuffixWordForm(dir, "prisma/migrations"));
+  const djangoFiles = djangoDirs.flatMap((dir) => filesUnderDir(scan.files, dir));
+  const row2 = (stack, detected, migrationFiles, markerFiles) => ({
+    stack,
+    detected,
+    migration_files: sortedUnique(migrationFiles),
+    marker_files: sortedUnique(markerFiles)
+  });
+  return [
+    row2("prisma", prismaRoots.length > 0, prismaFiles, prismaMarkers),
+    row2("flyway", flywayRoots.length > 0, flywayFiles, []),
+    row2("liquibase", liquibaseMarkers.length > 0 || liquibaseDirs.length > 0, liquibaseFiles, liquibaseMarkers),
+    row2("alembic", alembicMarkers.length > 0 || alembicVersionDirs.length > 0, alembicFiles, alembicMarkers),
+    row2("django_style", djangoDirs.length > 0, djangoFiles, [])
+  ];
+}
+function allocateEnvironmentReceiptId(observationsDir) {
+  let max = 0;
+  let names;
+  try {
+    names = readdirSync19(observationsDir);
+  } catch {
+    names = [];
+  }
+  for (const name of names) {
+    const match = /^ENVREC-([0-9]+)\.json$/.exec(name);
+    if (match !== null) {
+      const value = Number(match[1]);
+      if (Number.isFinite(value) && value > max)
+        max = value;
+    }
+  }
+  return `ENVREC-${String(max + 1).padStart(4, "0")}`;
+}
+function emptyReconMigrationsResult() {
+  return {
+    observation: null,
+    receipt_id: null,
+    receipt_path: null,
+    captured_at_seq: null,
+    stacks: [],
+    detected_stacks: null,
+    scanned_files: null,
+    scanned_dirs: null,
+    unreadable_dirs: []
+  };
+}
+function reconMigrationsFail(error) {
+  return failOutcome("recon migrations", emptyReconMigrationsResult(), [error], [`recon migrations: FAILED \u2014 ${error.code}
+  hint: ${error.hint}`]);
+}
+function scanDenominatorLine(scan) {
+  return `\u626B\u63CF\u5206\u6BCD: ${String(scan.files.length)} \u6587\u4EF6/${String(scan.dirs.length)} \u76EE\u5F55\uFF08\u8DF3\u8FC7 node_modules/dist/.git/coverage/.pomaster + .venv/venv/vendor/target/build \u4F9D\u8D56\u4E0E\u6784\u5EFA\u4EA7\u7269\uFF09`;
+}
+function stackWordFormLines() {
+  return RECON_MIGRATION_STACKS.map((stack) => `  - ${stack}: ${RECON_MIGRATION_STACK_WORD_FORMS[stack]}`);
+}
+function unreadableWarnings(scan) {
+  if (scan.unreadableDirs.length === 0)
+    return [];
+  return [
+    {
+      code: "RECON_SCAN_UNREADABLE",
+      message: `${String(scan.unreadableDirs.length)} \u4E2A\u76EE\u5F55\u4E0D\u53EF\u8BFB\uFF08\u5DF2\u62AB\u9732\u975E\u9759\u9ED8\u8DF3\u8FC7\uFF1B\u5176\u5185\u5BB9\u7F3A\u5E2D\u4E8E\u76D8\u70B9\u5206\u6BCD\uFF09\uFF1A${scan.unreadableDirs.join("; ")}`,
+      hint: "\u6838\u67E5\u76EE\u5F55\u6743\u9650/\u5360\u7528\u540E\u91CD\u8DD1\uFF1B\u4E0D\u53EF\u8BFB\u6E05\u5355\u5DF2\u968F result.unreadable_dirs \u643A\u5E26\u3002"
+    }
+  ];
+}
+async function runReconMigrations(rootDir, input) {
+  const executionResolution = resolveExecutionId(input.executionId, void 0);
+  if ("fail" in executionResolution || executionResolution.executionId === null) {
+    return reconMigrationsFail({
+      code: "SCHEMA_INVALID",
+      message: "fail" in executionResolution ? executionResolution.fail : `execution_id \u7F3A\u5E2D\uFF08ENVREC \u56DE\u6267 execution_id \u5FC5\u586B\u2014\u2014\xA76.7 \u901A\u8DEF\u951A\uFF09`,
+      hint: "\u5148 pomaster execution begin \u767B\u8BB0\u6267\u884C\u8EAB\u4EFD\uFF08AGX-n\uFF09\uFF0C\u518D\u4EE5 --execution-id \u4F20\u5165\uFF08S1 \u7981\u81EA\u9020\u8EAB\u4EFD\uFF09\u3002"
+    });
+  }
+  const executionId = executionResolution.executionId;
+  const initialized = await requireInitialized(rootDir);
+  if ("error" in initialized)
+    return reconMigrationsFail(initialized.error);
+  if (!existsSync19(`${executionsDirPath(rootDir)}/${executionId}.json`)) {
+    return reconMigrationsFail({
+      code: "EXECUTION_NOT_FOUND",
+      message: `execution_id \u672A\u767B\u8BB0\uFF08executions/ \u6863\u6848\u7F3A\u5931\uFF09\uFF1A${executionId}`,
+      hint: "\u5148 pomaster execution begin \u767B\u8BB0\u6267\u884C\u8EAB\u4EFD\uFF08.pomaster/executions/AGX-*.json \u662F\u8EAB\u4EFD\u552F\u4E00\u4E8B\u5B9E\u6E90\uFF09\uFF1B\u5DF2\u5C01\u53E3\u6267\u884C\u5141\u8BB8\u4E8B\u540E\u8865\u5F55\u3002"
+    });
+  }
+  const paths = buildStorePaths(rootDir);
+  const scan = scanHostTree(rootDir);
+  const stacks = detectMigrationStacks(scan);
+  const detectedStacks = stacks.filter((row2) => row2.detected).length;
+  if (detectedStacks === 0) {
+    return failOutcome("recon migrations", {
+      ...emptyReconMigrationsResult(),
+      observation: "NOT_RUN",
+      stacks,
+      detected_stacks: 0,
+      scanned_files: scan.files.length,
+      scanned_dirs: scan.dirs.length,
+      unreadable_dirs: scan.unreadableDirs
+    }, [
+      {
+        code: "RECON_MIGRATIONS_NOT_RUN",
+        message: "\u4E94\u6808 migration \u8BCD\u5F62\u9762\u5168\u7F3A\u5E2D\uFF08prisma/flyway/liquibase/alembic/django_style\uFF09\u2014\u2014\u672C\u8DD1\u96F6\u76D8\u70B9\u4EA7\u51FA\uFF08\u4E0D\u4F2A\u9020\u7A7A\u8DD1\u7EFF\uFF09",
+        hint: "\u82E5\u9879\u76EE\u786E\u6709 migration\uFF0C\u591A\u534A\u7ECF\u8BCD\u5F62\u9762\u5916\u6808\u627F\u8F7D\uFF08knex/typeorm/golang-migrate/rails db/migrate \u7B49\u2014\u2014\u672C\u6279\u6E05\u5355\u4E3A\u5C01\u95ED\u679A\u4E3E\uFF09\uFF1B\u7F3A\u5E2D = \u65E0\u76D8\u70B9\u4EA7\u51FA\uFF0C\u4E0D\u662F\u300C\u65E0 migration\u300D\u65AD\u8A00\u3002\u786E\u8BA4\u5BBF\u4E3B\u6839\u540E\u91CD\u8DD1\u3002"
+      }
+    ], [
+      "recon migrations: NOT_RUN \u2014 \u4E94\u6808\u8BCD\u5F62\u9762\u5168\u7F3A\u5E2D\uFF08\u96F6\u76D8\u70B9\u4EA7\u51FA\uFF0C\u4E0D\u4F2A\u9020\u7A7A\u8DD1\u7EFF\uFF09",
+      scanDenominatorLine(scan),
+      ...stackWordFormLines(),
+      "\u96F6\u843D\u76D8\uFF1A\u65E0 ENVREC \u56DE\u6267\u4EA7\u51FA\uFF08NOT_RUN \u65E0\u8DD1\u8BED\u4E49\u2014\u2014memory-harvest \u76EE\u5F55\u7F3A\u5E2D\u5148\u4F8B\u540C\u65CF\uFF09"
+    ], unreadableWarnings(scan));
+  }
+  try {
+    const receipt = buildEnvironmentReceipt({
+      // observed 侧：repository_ref 是唯一诚实在场项（被盘点的 worktree 身份）；
+      // 其余六项实测未确认 → null 显式缺席（禁占位词冒充——Case H 诚实形态）。
+      environment_ref: null,
+      repository_ref: toPosix(rootDir),
+      revision_ref: null,
+      build_identity: null,
+      runtime_instance: null,
+      base_url: null,
+      dataset_ref: null,
+      auth_role: null,
+      feature_flags: null
+    }, executionId, "WRONG_OR_UNVERIFIED_INSTANCE");
+    const recordId = allocateEnvironmentReceiptId(paths.observationsDir);
+    const persisted = persistObservationRecord(paths.evidenceDir, { record_type: "environment_receipt", ...receipt }, { recordId });
+    const receiptPath = `${POMASTER_DIR}/evidence/${persisted.relativePath}`;
+    const human = [
+      `recon migrations: OBSERVED \u2014 ${String(detectedStacks)}/${String(RECON_MIGRATION_STACKS.length)} \u6808\u8BCD\u5F62\u9762\u5728\u573A\uFF08ENVREC ${recordId}\uFF09`,
+      scanDenominatorLine(scan)
+    ];
+    for (const row2 of stacks) {
+      if (!row2.detected) {
+        human.push(`  ${row2.stack}: \u8BCD\u5F62\u7F3A\u5E2D\uFF08${RECON_MIGRATION_STACK_WORD_FORMS[row2.stack]}\uFF09`);
+        continue;
+      }
+      const markerNote = row2.marker_files.length > 0 ? ` + ${String(row2.marker_files.length)} \u6807\u8BB0\uFF08${row2.marker_files.join(", ")}\uFF09` : "";
+      human.push(`  ${row2.stack}: \u547D\u4E2D \u2014 ${String(row2.migration_files.length)} migration \u5355\u5143${markerNote}`);
+      for (const file of row2.migration_files)
+        human.push(`    - ${file}`);
+    }
+    human.push(`receipt: ${receiptPath}\uFF08record_type=environment_receipt\uFF1Bdoctor_verdict=WRONG_OR_UNVERIFIED_INSTANCE\u2014\u2014\u7EAF\u8BFB\u76D8\u76D8\u70B9\u4E0D\u786E\u8BA4 runtime \u5B9E\u4F8B\u8EAB\u4EFD\uFF0C\xA76.7 \u5B9E\u6D4B null \u539F\u6837\u4FDD\u7559\uFF09`);
+    human.push("\u76D8\u70B9\u4E0D\u78B0 stack \u5206\u6BCD\uFF1A\u540E\u7AEF\u6808\u952E\u4ECD Owner \u95EE\u5377\u9762\uFF08\u96F6 stack.yaml \u5199\u53E3\u2014\u2014\u5B57\u8282\u5FEB\u7167\u6D4B\u8BD5\u9489\uFF09");
+    human.push("\u4E94\u6808\u5206\u6BCD\u6052\u5168\u5448\u73B0\uFF1B\u8BCD\u5F62\u7F3A\u5E2D \u2260 migration \u7F3A\u5E2D\uFF08knex/typeorm/golang-migrate \u7B49\u8BCD\u5F62\u9762\u5916\u6808\u4E0D\u5728\u672C\u6279\u6E05\u5355\u2014\u2014\u76D8\u70B9\u662F\u8BCD\u5F62\u679A\u4E3E\u975E stack \u65AD\u8A00\uFF09");
+    return okOutcome("recon migrations", {
+      observation: "OBSERVED",
+      receipt_id: recordId,
+      receipt_path: receiptPath,
+      captured_at_seq: initialized.seq,
+      stacks,
+      detected_stacks: detectedStacks,
+      scanned_files: scan.files.length,
+      scanned_dirs: scan.dirs.length,
+      unreadable_dirs: scan.unreadableDirs
+    }, human, unreadableWarnings(scan));
+  } catch (error) {
+    if (error instanceof GovernanceError)
+      return reconMigrationsFail(governanceErrorToCliError(error));
+    throw error;
+  }
+}
+var RECON_SBOM_TOOL = "cdxgen";
+var RECON_SBOM_INSTALL_HINT = "npm install -g @cyclonedx/cdxgen\uFF08Apache-2.0\uFF09\u540E\u91CD\u8DD1\uFF1B\u6216\u786E\u8BA4 PATH \u542B cdxgen \u53EF\u6267\u884C\u4F53";
+var RECON_SBOM_SENSOR_CAPABILITY = "SENSOR.BUILD.STATIC";
+var RECON_SBOM_OPERATION = "scan_sbom";
+var RECON_SBOM_ADAPTER = "cdxgen";
+var RECON_SBOM_TIMEOUT_MS = 3e5;
+var CYCLONEDX_BOM_FORMAT = "CycloneDX";
+if (!SENSOR_ID_PATTERN.test(RECON_SBOM_SENSOR_CAPABILITY)) {
+  throw new Error(`RECON_SBOM_SENSOR_CAPABILITY \u8BCD\u5F62\u6F02\u79FB\uFF08\u987B SENSOR.<DOMAIN>.<KIND>\uFF09\uFF1A${RECON_SBOM_SENSOR_CAPABILITY}`);
+}
+var reconSbomSpawn = (command, options) => {
+  const startedAt = performance21.now();
+  const res = spawnSync14(command, {
+    shell: true,
+    cwd: options.cwd,
+    timeout: options.timeoutMs,
+    encoding: "utf8",
+    maxBuffer: SPAWN_MAX_BUFFER_BYTES,
+    windowsHide: true,
+    env: stripQuotesFromPathEnv({ ...process.env })
+  });
+  const externalMs = Math.max(0, Math.round(performance21.now() - startedAt));
+  return {
+    status: res.status,
+    stdout: res.stdout ?? "",
+    stderr: res.stderr ?? "",
+    error: res.error?.message ?? null,
+    externalMs
+  };
+};
+function parseCycloneDxBom(bytes) {
+  let root;
+  try {
+    root = JSON.parse(bytes.toString("utf8"));
+  } catch {
+    return null;
+  }
+  if (root === null || typeof root !== "object" || Array.isArray(root))
+    return null;
+  const record = root;
+  if (record["bomFormat"] !== CYCLONEDX_BOM_FORMAT)
+    return null;
+  const specVersion = record["specVersion"];
+  if (typeof specVersion !== "string" || /^[0-9]+\.[0-9]+/.test(specVersion) === false)
+    return null;
+  const components = record["components"];
+  const dependencies = record["dependencies"];
+  if (!Array.isArray(components) || !Array.isArray(dependencies))
+    return null;
+  return {
+    bom_format: CYCLONEDX_BOM_FORMAT,
+    spec_version: specVersion,
+    components,
+    dependencies
+  };
+}
+function emptyReconSbomResult() {
+  return {
+    observation: null,
+    observation_id: null,
+    receipt_path: null,
+    bom_format: null,
+    spec_version: null,
+    components: null,
+    dependencies: null,
+    tool_exit: null,
+    tool_path: null,
+    captured_at_seq: null,
+    bom_blob: null
+  };
+}
+function reconSbomFail(error) {
+  return failOutcome("recon sbom", emptyReconSbomResult(), [error], [`recon sbom: FAILED \u2014 ${error.code}
+  hint: ${error.hint}`]);
+}
+async function runReconSbom(rootDir, input) {
+  const executionResolution = resolveExecutionId(input.executionId, void 0);
+  if ("fail" in executionResolution || executionResolution.executionId === null) {
+    return reconSbomFail({
+      code: "SCHEMA_INVALID",
+      message: "fail" in executionResolution ? executionResolution.fail : `execution_id \u7F3A\u5E2D\uFF08OBS \u56DE\u6267 execution_id \u5FC5\u586B\u2014\u2014\xA76.13 \u8BC1\u660E\u4E49\u52A1\uFF09`,
+      hint: "\u5148 pomaster execution begin \u767B\u8BB0\u6267\u884C\u8EAB\u4EFD\uFF08AGX-n\uFF09\uFF0C\u518D\u4EE5 --execution-id \u4F20\u5165\uFF08S1 \u7981\u81EA\u9020\u8EAB\u4EFD\uFF09\u3002"
+    });
+  }
+  const executionId = executionResolution.executionId;
+  const initialized = await requireInitialized(rootDir);
+  if ("error" in initialized)
+    return reconSbomFail(initialized.error);
+  if (!existsSync19(`${executionsDirPath(rootDir)}/${executionId}.json`)) {
+    return reconSbomFail({
+      code: "EXECUTION_NOT_FOUND",
+      message: `execution_id \u672A\u767B\u8BB0\uFF08executions/ \u6863\u6848\u7F3A\u5931\uFF09\uFF1A${executionId}`,
+      hint: "\u5148 pomaster execution begin \u767B\u8BB0\u6267\u884C\u8EAB\u4EFD\uFF08.pomaster/executions/AGX-*.json \u662F\u8EAB\u4EFD\u552F\u4E00\u4E8B\u5B9E\u6E90\uFF09\uFF1B\u5DF2\u5C01\u53E3\u6267\u884C\u5141\u8BB8\u4E8B\u540E\u8865\u5F55\u3002"
+    });
+  }
+  const paths = buildStorePaths(rootDir);
+  const probe = input.inject?.executableProbe ?? ((executable) => findExecutableOnPath(executable, platformDetectorFacts(rootDir)));
+  const spawnFn = input.inject?.spawnFn ?? reconSbomSpawn;
+  const toolPath = probe(RECON_SBOM_TOOL);
+  if (toolPath === null) {
+    return failOutcome("recon sbom", emptyReconSbomResult(), [
+      {
+        code: "RECON_SBOM_NOT_INSTALLED",
+        message: `${RECON_SBOM_TOOL} \u4E0D\u5728 PATH\uFF08SBOM \u91C7\u96C6\u817F\u5DE5\u5177\u7F3A\u5E2D\u2014\u2014\u663E\u5F0F\u7F3A\u5E2D\u4E0D\u4F2A\u9020\u7A7A\u8DD1\uFF09`,
+        hint: RECON_SBOM_INSTALL_HINT
+      }
+    ], [
+      "recon sbom: NOT_INSTALLED \u2014 cdxgen \u4E0D\u5728 PATH\uFF08\u5DE5\u5177\u7F3A\u5E2D\u663E\u5F0F\u5448\u73B0\uFF0C\u4E0D\u4F2A\u9020\uFF09",
+      `install: ${RECON_SBOM_INSTALL_HINT}`
+    ]);
+  }
+  const tmpDir = mkdtempSync2(join10(tmpdir2(), "pomaster-recon-sbom-"));
+  try {
+    const outPath = join10(tmpDir, "bom.json");
+    const command = `${RECON_SBOM_TOOL} -r -o "${outPath}" "${rootDir}"`;
+    const run = spawnFn(command, { cwd: rootDir, timeoutMs: RECON_SBOM_TIMEOUT_MS });
+    const stderrSnippet = run.stderr.trim().slice(0, 200);
+    if (run.error !== null || run.status === null) {
+      return failOutcome("recon sbom", { ...emptyReconSbomResult(), tool_exit: run.status, tool_path: toolPath }, [
+        {
+          code: "RECON_SBOM_NOT_RUN",
+          message: `${RECON_SBOM_TOOL} \u5B50\u8FDB\u7A0B\u672A\u80FD\u6267\u884C\uFF08status=${String(run.status)}, error=${run.error ?? "unknown"}\uFF09\u2014\u2014\u5DE5\u5177\u6267\u884C\u5931\u8D25\u96F6\u843D\u76D8\uFF08\u4E0D\u4F2A\u9020\u7A7A\u8DD1\u7EFF\uFF09${stderrSnippet.length > 0 ? `\uFF1Bstderr \u6458\u5F55\uFF1A${stderrSnippet}` : ""}`,
+          hint: "\u6838\u67E5 cdxgen \u53EF\u7528\u6027\uFF08cdxgen --version\uFF09\u540E\u91CD\u8DD1\uFF1B\u8D85\u65F6\u4E0A\u754C 300s\u2014\u2014\u5927\u578B\u4ED3\u53EF\u91CD\u8DD1\u4E00\u6B21\u6392\u9664\u5076\u53D1\u3002"
+        }
+      ], [
+        `recon sbom: NOT_RUN \u2014 ${RECON_SBOM_TOOL} \u5B50\u8FDB\u7A0B\u672A\u80FD\u6267\u884C\uFF1B\u96F6\u843D\u76D8\u4E0D\u4F2A\u9020\u7A7A\u8DD1\u7EFF`,
+        ...stderrSnippet.length > 0 ? [`stderr \u6458\u5F55: ${stderrSnippet}`] : []
+      ]);
+    }
+    if (run.status !== 0) {
+      return failOutcome("recon sbom", { ...emptyReconSbomResult(), tool_exit: run.status, tool_path: toolPath }, [
+        {
+          code: "RECON_SBOM_NOT_RUN",
+          message: `${RECON_SBOM_TOOL} \u6267\u884C\u5931\u8D25\uFF08exit=${String(run.status)}\uFF09\u2014\u2014\u5DE5\u5177\u6267\u884C\u9519\u8BEF\u96F6\u843D\u76D8\uFF08\u4E0D\u4F2A\u9020\u7A7A\u8DD1\u7EFF\uFF09${stderrSnippet.length > 0 ? `\uFF1Bstderr \u6458\u5F55\uFF1A${stderrSnippet}` : ""}`,
+          hint: "\u6838\u67E5 cdxgen \u53EF\u7528\u6027\uFF08cdxgen --version\uFF09\u4E0E\u5BBF\u4E3B\u9879\u76EE\u53EF\u8BFB\u6027\u540E\u91CD\u8DD1\uFF1B\u8D85\u65F6\u4E0A\u754C 300s\u3002"
+        }
+      ], [
+        `recon sbom: NOT_RUN \u2014 ${RECON_SBOM_TOOL} exit ${String(run.status)}\uFF08\u5DE5\u5177\u6267\u884C\u9519\u8BEF\uFF09\uFF1B\u96F6\u843D\u76D8\u4E0D\u4F2A\u9020\u7A7A\u8DD1\u7EFF`,
+        ...stderrSnippet.length > 0 ? [`stderr \u6458\u5F55: ${stderrSnippet}`] : []
+      ]);
+    }
+    if (!existsSync19(outPath)) {
+      return failOutcome("recon sbom", { ...emptyReconSbomResult(), tool_exit: run.status, tool_path: toolPath }, [
+        {
+          code: "RECON_SBOM_NOT_RUN",
+          message: `${RECON_SBOM_TOOL} exit 0 \u4F46 BOM \u4EA7\u51FA\u6587\u4EF6\u7F3A\u5E2D\uFF08-o ${outPath} \u672A\u843D\u76D8\uFF09\u2014\u2014\u96F6\u89C2\u5BDF\u53EF\u505A\uFF0C\u96F6\u843D\u76D8\uFF08\u4E0D\u4F2A\u9020\u7A7A\u8DD1\u7EFF\uFF09`,
+          hint: "\u6838\u67E5 cdxgen \u7248\u672C\u5BF9 `-r -o <file> <root>` \u8BCD\u5F62\u7684\u517C\u5BB9\u6027\u540E\u91CD\u8DD1\u3002"
+        }
+      ], [`recon sbom: NOT_RUN \u2014 exit 0 \u4F46 BOM \u4EA7\u51FA\u6587\u4EF6\u7F3A\u5E2D\uFF1B\u96F6\u843D\u76D8\u4E0D\u4F2A\u9020\u7A7A\u8DD1\u7EFF`]);
+    }
+    let bomBytes = null;
+    try {
+      bomBytes = readFileSync25(outPath);
+    } catch {
+      bomBytes = null;
+    }
+    const bom = bomBytes === null ? null : parseCycloneDxBom(bomBytes);
+    if (bomBytes === null || bom === null) {
+      const receipt2 = buildObservationReceipt({
+        observationId: allocateObservationId(paths.observationsDir),
+        executionId,
+        sensorCapability: RECON_SBOM_SENSOR_CAPABILITY,
+        adapter: RECON_SBOM_ADAPTER,
+        operation: RECON_SBOM_OPERATION,
+        surface: "STRUCTURAL_REALITY",
+        result: "INCONCLUSIVE",
+        capturedAtSeq: initialized.seq,
+        artifactRefs: [],
+        normalizedFacts: [
+          "recon_surface: sbom",
+          ...bomBytes === null ? ["bom_unreadable: true"] : ["bom_parse_failed: true", `bom_byte_size: ${String(bomBytes.length)}`],
+          `tool_exit: ${String(run.status)}`,
+          "stack_candidates_not_registered: true"
+        ]
+      });
+      const persisted2 = persistObservationRecord(paths.evidenceDir, observationRecordOf(receipt2));
+      const receiptPath2 = `${POMASTER_DIR}/evidence/${persisted2.relativePath}`;
+      return failOutcome("recon sbom", {
+        ...emptyReconSbomResult(),
+        observation: "INCONCLUSIVE",
+        observation_id: receipt2.observation_id,
+        receipt_path: receiptPath2,
+        tool_exit: run.status,
+        tool_path: toolPath,
+        captured_at_seq: initialized.seq
+      }, [
+        {
+          code: "RECON_SBOM_INCONCLUSIVE",
+          message: `BOM \u56DE\u8BFB\u5931\u8D25\uFF08${bomBytes === null ? "\u4EA7\u51FA\u6587\u4EF6\u4E0D\u53EF\u8BFB" : "\u89E3\u6790\u5931\u8D25/\u8BCD\u5F62\u6F02\u79FB"}\uFF09\u2014\u2014INCONCLUSIVE \u8D1F\u503C\u515C\u5E95\u843D\u8D26\uFF0C\u4E0D\u4F2A\u9020\u7EFF\uFF1A${receiptPath2}`,
+          hint: "\u6838\u67E5 cdxgen \u7248\u672C\u4EA7\u51FA\u8BCD\u5F62\uFF08bomFormat=CycloneDX + specVersion + components[]/dependencies[] \u6570\u7EC4\u4F4D\uFF09\u540E\u91CD\u8DD1\uFF1B\u6B8B\u7F3A\u4EA7\u51FA\u4E0D\u6309\u9ED8\u8BA4\u503C\u8BA1\u6570\u3002"
+        }
+      ], [
+        "recon sbom: INCONCLUSIVE \u2014 BOM \u56DE\u8BFB\u5931\u8D25\uFF08\u89E3\u6790\u5931\u8D25/\u8BCD\u5F62\u6F02\u79FB\uFF0C\u8D1F\u503C\u515C\u5E95\u843D\u8D26\u4E0D\u4F2A\u9020\u7EFF\uFF09",
+        `observation receipt: ${receiptPath2}\uFF08result=INCONCLUSIVE\uFF1Bartifact_refs \u7A7A\u2014\u2014\u6B8B\u7F3A\u4EA7\u51FA\u4E0D\u662F\u8BC1\u636E\uFF0C\u65E0 blob \u53EF\u80CC\u4E66\uFF09`
+      ]);
+    }
+    const blob = persistEvidenceArtifact(paths.evidenceDir, { media: "json", bytes: bomBytes });
+    const observationId = allocateObservationId(paths.observationsDir);
+    const receipt = buildObservationReceipt({
+      observationId,
+      executionId,
+      sensorCapability: RECON_SBOM_SENSOR_CAPABILITY,
+      adapter: RECON_SBOM_ADAPTER,
+      operation: RECON_SBOM_OPERATION,
+      surface: "STRUCTURAL_REALITY",
+      result: "OBSERVED",
+      capturedAtSeq: initialized.seq,
+      artifactRefs: [
+        {
+          sha256: blob.sha256,
+          media: blob.media,
+          byteSize: blob.byteSize,
+          storagePath: blob.storagePath
+        }
+      ],
+      normalizedFacts: [
+        "recon_surface: sbom",
+        "bom_format: CycloneDX",
+        `spec_version: ${bom.spec_version}`,
+        `components: ${String(bom.components.length)}`,
+        `dependencies: ${String(bom.dependencies.length)}`,
+        `tool_exit: ${String(run.status)}`,
+        "stack_candidates_not_registered: true"
+      ]
+    });
+    const persisted = persistObservationRecord(paths.evidenceDir, observationRecordOf(receipt));
+    const receiptPath = `${POMASTER_DIR}/evidence/${persisted.relativePath}`;
+    const human = [
+      `recon sbom: OBSERVED \u2014 CycloneDX BOM\uFF08specVersion ${bom.spec_version}\uFF1Bcomponents ${String(bom.components.length)} / dependencies ${String(bom.dependencies.length)}\uFF09`,
+      `tool: ${RECON_SBOM_TOOL}\uFF08PATH \u547D\u4E2D: ${toolPath}\uFF1Bexit ${String(run.status)}\uFF09`,
+      `bom blob: ${blob.storagePath}\uFF08${blob.sha256}\uFF1Bmedia=json\u2014\u2014cdxgen \u4EA7\u51FA\u539F\u6837\u5B57\u8282\u96F6\u6539\u5199\uFF09`,
+      `observation receipt: ${receiptPath}\uFF08result=OBSERVED\uFF1Bsurface=STRUCTURAL_REALITY\uFF1Bcaptured_at_seq=${String(initialized.seq)}\uFF09`,
+      "stack \u5019\u9009\u5316\u4E0D\u5728\u672C\u6279\uFF08Proposal \u524D\u7F6E\uFF09\uFF1A\u4EA7\u7269\u53EA\u5230 sidecar \u5448\u73B0\u2014\u2014\u96F6 StackObservationCandidate \u767B\u8BB0\u3001\u96F6 stack.yaml \u5199\u53E3\uFF08\u5B57\u8282\u5FEB\u7167\u6D4B\u8BD5\u9489\uFF09"
+    ];
+    return okOutcome("recon sbom", {
+      observation: "OBSERVED",
+      observation_id: receipt.observation_id,
+      receipt_path: receiptPath,
+      bom_format: bom.bom_format,
+      spec_version: bom.spec_version,
+      components: bom.components.length,
+      dependencies: bom.dependencies.length,
+      tool_exit: run.status,
+      tool_path: toolPath,
+      captured_at_seq: initialized.seq,
+      bom_blob: {
+        sha256: blob.sha256,
+        storage_path: blob.storagePath,
+        byte_size: blob.byteSize
+      }
+    }, human);
+  } catch (error) {
+    if (error instanceof GovernanceError)
+      return reconSbomFail(governanceErrorToCliError(error));
+    throw error;
+  } finally {
+    rmSync12(tmpDir, { recursive: true, force: true });
+  }
+}
+
+// packages/cli/dist/execution-audit.js
+init_dist2();
+init_dist();
+init_src();
+import { spawnSync as spawnSync15 } from "node:child_process";
+import { readdirSync as readdirSync20, readFileSync as readFileSync26, realpathSync, statSync as statSync5 } from "node:fs";
+import { join as join11, resolve as resolve2 } from "node:path";
+var EXECUTION_AUDIT_SENSOR_CAPABILITY = "SENSOR.BUILD.STATIC";
+var EXECUTION_AUDIT_OPERATION = "audit_mutation_scope";
+var EXECUTION_AUDIT_ADAPTER = "pomaster-cli";
+var EXECUTION_AUDIT_GIT_TIMEOUT_MS = 12e4;
+var EXECUTION_AUDIT_PRESENTATION_CAP = 20;
+var KEYBINDINGS_DIR_RELATIVE = `${TRUTH_OBJECTS_DIR_RELATIVE.replace(/\/objects$/, "")}/keybindings`;
+var KEYBINDING_ROW_ID_PATTERN = /^KEYBINDING\.[A-Z][A-Z0-9_]{0,31}\.[A-Z][A-Z0-9_]{0,31}(\.[A-Z][A-Z0-9_]{0,31})*$/;
+var KEYBINDING_OPERATION_ID_TOKEN_PATTERN = /^[A-Za-z][A-Za-z0-9_.-]*$/;
+if (!SENSOR_ID_PATTERN.test(EXECUTION_AUDIT_SENSOR_CAPABILITY)) {
+  throw new Error(`EXECUTION_AUDIT_SENSOR_CAPABILITY \u8BCD\u5F62\u6F02\u79FB\uFF08\u987B SENSOR.<DOMAIN>.<KIND>\uFF09\uFF1A${EXECUTION_AUDIT_SENSOR_CAPABILITY}`);
+}
+function emptyExecutionAuditResult() {
+  return {
+    observation: null,
+    observation_id: null,
+    receipt_path: null,
+    execution_id: null,
+    diff_base: null,
+    diff_base_resolved: null,
+    captured_at_seq: null,
+    changed_files: null,
+    in_scope: null,
+    out_of_scope: null,
+    unmapped: null,
+    excluded_skip_dirs: null,
+    tracked_changed: null,
+    untracked: null,
+    binding_files: null,
+    binding_rows: null,
+    binding_rows_path_anchored: null,
+    binding_rows_non_path: null,
+    binding_rows_malformed: null,
+    permits: null,
+    permits_missing: null,
+    out_of_scope_items: [],
+    report_blob: null,
+    out_of_scope_stdout_capped: false
+  };
+}
+function executionAuditFail(error) {
+  return failOutcome("execution audit", emptyExecutionAuditResult(), [error], [`execution audit: FAILED \u2014 ${error.code}
+  hint: ${error.hint}`]);
+}
+function isPlainObject9(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isRepoRelativePosixAnchor(value) {
+  return value.length > 0 && !value.includes("\\") && !value.startsWith("/") && !/^[A-Za-z]:[\\/]/.test(value);
+}
+function loadKeybindingTable(rootDir) {
+  const dir = join11(rootDir, ...KEYBINDINGS_DIR_RELATIVE.split("/"));
+  let names;
+  try {
+    names = readdirSync20(dir).filter((name) => name.endsWith(".json")).sort();
+  } catch {
+    return { present: false, files: 0, rows: [], malformed: [] };
+  }
+  if (names.length === 0) {
+    return { present: false, files: 0, rows: [], malformed: [] };
+  }
+  const rows = [];
+  const malformed2 = [];
+  for (const name of names) {
+    const file = `${KEYBINDINGS_DIR_RELATIVE}/${name}`;
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync26(join11(dir, name), "utf8"));
+    } catch (error) {
+      malformed2.push({
+        file,
+        reason: `json_parse_failed (${error instanceof Error ? error.message : String(error)})`
+      });
+      continue;
+    }
+    if (!isPlainObject9(parsed)) {
+      malformed2.push({ file, reason: "row_not_object" });
+      continue;
+    }
+    const id = parsed["id"];
+    const bindingClass = parsed["binding_class"];
+    const canonicalId = parsed["canonical_id"];
+    const physicalPath = parsed["physical_path"];
+    const bindingStatus = parsed["binding_status"];
+    if (typeof id !== "string" || !KEYBINDING_ROW_ID_PATTERN.test(id)) {
+      malformed2.push({ file, reason: `id \u8BCD\u5F62\u975E\u6CD5\uFF08\u987B KEYBINDING.<DOMAIN>.<NAME> \u81F3\u5C11\u4E24\u6BB5\uFF09: ${JSON.stringify(id ?? null)}` });
+      continue;
+    }
+    if (typeof bindingClass !== "string" || !BINDING_CLASS_VALUES.includes(bindingClass)) {
+      malformed2.push({ file, reason: `binding_class \u8BCD\u8868\u5916: ${JSON.stringify(bindingClass ?? null)}` });
+      continue;
+    }
+    if (typeof canonicalId !== "string") {
+      malformed2.push({ file, reason: "canonical_id \u7F3A\u5E2D\u6216\u975E\u5B57\u7B26\u4E32" });
+      continue;
+    }
+    try {
+      parseGovernedId(canonicalId);
+    } catch {
+      malformed2.push({ file, reason: `canonical_id \u975E closed-world governed id: ${canonicalId}` });
+      continue;
+    }
+    if (typeof physicalPath !== "string") {
+      malformed2.push({ file, reason: "physical_path \u7F3A\u5E2D\u6216\u975E\u5B57\u7B26\u4E32" });
+      continue;
+    }
+    if (bindingClass === "contract_operation_to_operationId") {
+      if (!KEYBINDING_OPERATION_ID_TOKEN_PATTERN.test(physicalPath)) {
+        malformed2.push({ file, reason: `operationId token \u8BCD\u5F62\u975E\u6CD5: ${JSON.stringify(physicalPath)}` });
+        continue;
+      }
+    } else if (!isRepoRelativePosixAnchor(physicalPath)) {
+      malformed2.push({ file, reason: `physical_path \u975E repo \u76F8\u5BF9 posix \u951A: ${JSON.stringify(physicalPath)}` });
+      continue;
+    }
+    if (typeof bindingStatus !== "string" || !BINDING_STATUS_VALUES.includes(bindingStatus)) {
+      malformed2.push({ file, reason: `binding_status \u8BCD\u8868\u5916: ${JSON.stringify(bindingStatus ?? null)}` });
+      continue;
+    }
+    rows.push({ file, id, bindingClass, canonicalId, physicalPath, bindingStatus });
+  }
+  return { present: true, files: names.length, rows, malformed: malformed2 };
+}
+function bindingMatchesPath(row2, posixPath) {
+  if (row2.bindingClass === "contract_operation_to_operationId")
+    return false;
+  if (row2.bindingClass === "capability_to_file")
+    return row2.physicalPath === posixPath;
+  return posixPath === row2.physicalPath || posixPath.startsWith(`${row2.physicalPath}/`);
+}
+function loadPermitScopes(rootDir, permitIds, currentSeq) {
+  let raw;
+  try {
+    raw = readFileSync26(join11(rootDir, ...PERMITS_RELATIVE.split("/")), "utf8");
+  } catch {
+    return { scopes: [], missing: [...permitIds] };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    return {
+      error: {
+        code: "SCHEMA_INVALID",
+        message: `state/permits.json \u65E0\u6CD5\u89E3\u6790\uFF08\u635F\u574F\u6216\u624B\u6539\uFF09\uFF1A${error instanceof Error ? error.message : String(error)}`,
+        hint: "\u8BB8\u53EF\u53F0\u8D26\u7531 kernel \u4E8B\u52A1\u7EF4\u62A4\uFF1B\u4ECE git \u6062\u590D\u540E\u91CD\u8BD5\u3002"
+      }
+    };
+  }
+  const record = isPlainObject9(parsed) ? parsed : null;
+  const permits = record === null ? null : record["permits"];
+  if (!Array.isArray(permits)) {
+    return {
+      error: {
+        code: "SCHEMA_INVALID",
+        message: "state/permits.json \u7ED3\u6784\u975E\u6CD5\uFF08permits \u975E\u6570\u7EC4\uFF09",
+        hint: "\u8BB8\u53EF\u53F0\u8D26\u7531 kernel \u4E8B\u52A1\u7EF4\u62A4\uFF1B\u4ECE git \u6062\u590D\u540E\u91CD\u8BD5\u3002"
+      }
+    };
+  }
+  const scopes = [];
+  const missing = [];
+  for (const permitId of permitIds) {
+    const row2 = permits.find((entry) => isPlainObject9(entry) && entry["permit_ref"] === permitId);
+    if (row2 === void 0 || !isPlainObject9(row2)) {
+      missing.push(permitId);
+      continue;
+    }
+    const scope = row2["scope"];
+    const subjectIdsRaw = isPlainObject9(scope) ? scope["subject_ids"] : void 0;
+    const subjectIds = Array.isArray(subjectIdsRaw) ? subjectIdsRaw.filter((entry) => typeof entry === "string") : [];
+    const stolenAtSeq = row2["stolen_at_seq"];
+    const expiresAtSeq = row2["expires_at_seq"];
+    const status = typeof stolenAtSeq === "number" ? "stolen" : typeof expiresAtSeq === "number" && currentSeq >= expiresAtSeq ? "expired" : "active";
+    scopes.push({ permit_ref: permitId, subject_ids: subjectIds, status });
+  }
+  return { scopes, missing };
+}
+function judgeMutationScope(changedPaths, rows, scopes) {
+  const pathAnchoredRows = rows.filter((row2) => row2.bindingClass !== "contract_operation_to_operationId");
+  const scopeSurface = scopes.length === 0 ? "\u7A7A scope \u9762\uFF08execution \u65E0\u5728\u518C permit \u6216\u5F15\u7528\u672A\u89E3\u6790\u2014\u2014scope \u9762\u4E3A\u7A7A\uFF0C\u4EFB\u4F55\u6620\u5C04\u5747\u4E0D\u53EF\u6388\u4E88 in-scope\uFF09" : scopes.map((permit) => `${permit.permit_ref}[${permit.status}]`).join(", ");
+  return changedPaths.map((path) => {
+    const matched = pathAnchoredRows.filter((row2) => bindingMatchesPath(row2, path));
+    if (matched.length === 0) {
+      return {
+        path,
+        classification: "unmapped",
+        mappings: [],
+        basis: `unmapped\uFF1A\u65E0 KEYBINDING \u5728\u518C\u7ED1\u5B9A\u547D\u4E2D\uFF08path-anchored \u884C ${String(pathAnchoredRows.length)} \u884C\u5206\u6BCD\uFF09\u2014\u2014\u8BDA\u5B9E\u6E05\u5355\u975E\u9519\u8BEF\uFF08recon unmapped \u540C\u6B3E\u7981\u9759\u9ED8\u4E22\u5F03\uFF09`
+      };
+    }
+    const mappings = matched.map((row2) => {
+      const hit = scopes.find((permit) => permit.subject_ids.includes(row2.canonicalId));
+      return {
+        governed_id: row2.canonicalId,
+        binding_id: row2.id,
+        binding_class: row2.bindingClass,
+        binding_status: row2.bindingStatus,
+        in_scope: hit !== void 0,
+        permit_ref: hit?.permit_ref ?? null,
+        permit_status: hit?.status ?? null
+      };
+    });
+    const inScope = mappings.some((mapping) => mapping.in_scope);
+    const basis = inScope ? `in-scope\uFF1A${mappings.filter((mapping) => mapping.in_scope).map((mapping) => `${mapping.governed_id}\uFF08${mapping.binding_id}\xB7${mapping.binding_status}\uFF09\u2208 ${mapping.permit_ref}[${mapping.permit_status}] scope.subject_ids`).join("; ")}` : `out-of-scope\uFF1A${mappings.map((mapping) => `${mapping.governed_id}\uFF08${mapping.binding_id}\xB7${mapping.binding_status}\uFF09`).join("; ")} \u2209 ${scopeSurface}\u2014\u2014\u5224\u5B9A\u4F9D\u636E = kernel checkPermit scope.subject_ids \u6210\u5458\u5224\u636E`;
+    return {
+      path,
+      classification: inScope ? "in_scope" : "out_of_scope",
+      mappings,
+      basis
+    };
+  });
+}
+function gitRun(rootDir, args) {
+  const res = spawnSync15("git", [...args], {
+    cwd: rootDir,
+    timeout: EXECUTION_AUDIT_GIT_TIMEOUT_MS,
+    maxBuffer: SPAWN_MAX_BUFFER_BYTES,
+    encoding: "utf8",
+    windowsHide: true
+  });
+  return {
+    status: res.status,
+    stdout: res.stdout ?? "",
+    stderr: res.stderr ?? "",
+    error: res.error?.message ?? null
+  };
+}
+function splitNulList(stdout) {
+  return stdout.split("\0").filter((entry) => entry.length > 0).map((entry) => toPosix(entry));
+}
+function pathHasSkippedSegment(posixPath) {
+  return posixPath.split("/").some((segment) => RECON_SKIP_DIRS.has(segment));
+}
+function normalizedDirIdentity(path) {
+  let resolved = path;
+  try {
+    resolved = realpathSync(path);
+  } catch {
+    resolved = resolve2(path);
+  }
+  return toPosix(resolved).toLowerCase().replace(/\/$/, "");
+}
+function sameDirectoryIdentity(a, b) {
+  if (normalizedDirIdentity(a) === normalizedDirIdentity(b))
+    return true;
+  try {
+    const sa = statSync5(a, { bigint: true });
+    const sb = statSync5(b, { bigint: true });
+    return sa.dev === sb.dev && sa.ino === sb.ino && sa.ino !== 0n;
+  } catch {
+    return false;
+  }
+}
+async function runExecutionAudit(rootDir, input) {
+  const executionResolution = resolveExecutionId(input.executionId, void 0);
+  if ("fail" in executionResolution || executionResolution.executionId === null) {
+    return executionAuditFail({
+      code: "SCHEMA_INVALID",
+      message: "fail" in executionResolution ? executionResolution.fail : `execution_id \u7F3A\u5E2D\uFF08OBS \u56DE\u6267 execution_id \u5FC5\u586B\u2014\u2014\xA76.13 \u8BC1\u660E\u4E49\u52A1\uFF09`,
+      hint: "\u5148 pomaster execution begin \u767B\u8BB0\u6267\u884C\u8EAB\u4EFD\uFF08AGX-n\uFF09\uFF0C\u518D\u4EE5 --execution-id \u4F20\u5165\uFF08S1 \u7981\u81EA\u9020\u8EAB\u4EFD\uFF09\u3002"
+    });
+  }
+  const executionId = executionResolution.executionId;
+  const diffBase = typeof input.diffBase === "string" ? input.diffBase.trim() : "";
+  if (diffBase.length === 0) {
+    return executionAuditFail({
+      code: "MUTATION_SCOPE_NO_ANCHOR",
+      message: "--diff-base \u7F3A\u5E2D\uFF08git diff \u8D77\u59CB\u951A\u5FC5\u586B\u2014\u2014execution record \u5B9E\u8BFB\u786E\u8BA4\u65E0 ref/seq \u951A\u5B57\u6BB5\uFF0C\u951A\u7531\u8C03\u7528\u65B9\u7533\u62A5\uFF09",
+      hint: "\u4EE5 execution begin \u65F6\u523B\u7684\u5DE5\u4F5C\u533A\u57FA\u7EBF ref\uFF08commit/branch/tag\uFF09\u4F20\u5165 --diff-base\uFF1B\u975E git \u5DE5\u4F5C\u533A\u5BA1\u8BA1\u4E0D\u53EF\u7528\uFF08PRD Out of Scope\uFF1A\u65E0\u7248\u672C\u951A\u663E\u5F0F\u62A5\u9519\uFF0C\u4E0D\u505A fs \u5FEB\u7167\u515C\u5E95\uFF09\u3002"
+    });
+  }
+  const initialized = await requireInitialized(rootDir);
+  if ("error" in initialized)
+    return executionAuditFail(initialized.error);
+  let executionRecord;
+  try {
+    executionRecord = readExecutionRecordById(buildStorePaths(rootDir), executionId);
+  } catch (error) {
+    if (error instanceof GovernanceError)
+      return executionAuditFail(governanceErrorToCliError(error));
+    throw error;
+  }
+  if (executionRecord === null) {
+    return executionAuditFail({
+      code: "EXECUTION_NOT_FOUND",
+      message: `execution_id \u672A\u767B\u8BB0\uFF08executions/ \u6863\u6848\u7F3A\u5931\uFF09\uFF1A${executionId}`,
+      hint: "\u5148 pomaster execution begin \u767B\u8BB0\u6267\u884C\u8EAB\u4EFD\uFF08.pomaster/executions/AGX-*.json \u662F\u8EAB\u4EFD\u552F\u4E00\u4E8B\u5B9E\u6E90\uFF09\uFF1B\u5DF2\u5C01\u53E3\u6267\u884C\u5141\u8BB8\u4E8B\u540E\u5BA1\u8BA1\u3002"
+    });
+  }
+  const toplevel = gitRun(rootDir, ["rev-parse", "--show-toplevel"]);
+  if (toplevel.error !== null || toplevel.status !== 0 || toplevel.stdout.trim().length === 0) {
+    return executionAuditFail({
+      code: "MUTATION_SCOPE_NOT_GIT_WORKTREE",
+      message: `\u975E git \u5DE5\u4F5C\u533A\uFF08git rev-parse --show-toplevel \u5931\u8D25\uFF1A${toplevel.error ?? `exit ${String(toplevel.status)}`}\uFF09\u2014\u2014\u65E0\u7248\u672C\u951A\u5BA1\u8BA1\u4E0D\u53EF\u7528\uFF0C\u96F6\u843D\u76D8`,
+      hint: "PRD Out of Scope\uFF1A\u975E git \u5DE5\u4F5C\u533A\u663E\u5F0F\u62A5\u9519\uFF0C\u4E0D\u505A fs \u5FEB\u7167\u515C\u5E95\uFF1B\u786E\u8BA4\u5BBF\u4E3B\u9879\u76EE\u4E3A git \u4ED3\u5E93\u540E\u91CD\u8DD1\u3002"
+    });
+  }
+  if (!sameDirectoryIdentity(toplevel.stdout.trim(), rootDir)) {
+    return executionAuditFail({
+      code: "MUTATION_SCOPE_NOT_WORKTREE_ROOT",
+      message: `store \u6839\u975E worktree \u6839\uFF08toplevel=${toPosix(toplevel.stdout.trim())} \u2260 root=${toPosix(resolve2(rootDir))}\uFF09\u2014\u2014diff \u8DEF\u5F84\u9762\u53EA\u5BF9 worktree \u6839\u6210\u7ACB\uFF0C\u7981\u8DEF\u5F84\u524D\u7F00\u63A8\u65AD`,
+      hint: "\u5728 git worktree \u6839\uFF08.pomaster/ \u6240\u5728\u7684\u4ED3\u5E93\u6839\uFF09\u91CD\u8DD1\uFF1B\u5B50\u76EE\u5F55 store \u4E0D\u5728\u672C\u901A\u8DEF\u652F\u6301\u9762\u3002"
+    });
+  }
+  const baseResolved = gitRun(rootDir, ["rev-parse", "--verify", "--quiet", diffBase]);
+  const baseResolvedSha = baseResolved.stdout.trim();
+  if (baseResolved.error !== null || baseResolved.status !== 0 || baseResolvedSha.length === 0) {
+    return executionAuditFail({
+      code: "MUTATION_SCOPE_BAD_BASE",
+      message: `--diff-base \u65E0\u6CD5\u89E3\u6790\u4E3A\u5BF9\u8C61\uFF08git rev-parse --verify ${diffBase} \u5931\u8D25\uFF1A${baseResolved.error ?? `exit ${String(baseResolved.status)}`}\uFF09\u2014\u2014\u96F6\u843D\u76D8`,
+      hint: "\u8D77\u59CB\u951A\u987B\u4E3A\u53EF\u89E3\u6790\u7684 commit/branch/tag\uFF08\u5982 execution begin \u65F6\u7684 HEAD sha\uFF09\uFF1Bgit rev-parse <ref> \u53EF\u5148\u884C\u4EBA\u5DE5\u5BF9\u8D26\u3002"
+    });
+  }
+  const trackedRun = gitRun(rootDir, ["diff", "--name-only", "-z", baseResolvedSha]);
+  if (trackedRun.error !== null || trackedRun.status !== 0) {
+    return executionAuditFail({
+      code: "MUTATION_SCOPE_GIT_FAILED",
+      message: `git diff \u6536\u96C6\u5931\u8D25\uFF08exit=${String(trackedRun.status)}, error=${trackedRun.error ?? "unknown"}\uFF09\u2014\u2014diff \u9762\u4E0D\u53EF\u5F97\u96F6\u843D\u76D8${trackedRun.stderr.trim().length > 0 ? `\uFF1Bstderr \u6458\u5F55\uFF1A${trackedRun.stderr.trim().slice(0, 200)}` : ""}`,
+      hint: "\u6838\u67E5 git \u53EF\u7528\u6027\u4E0E\u4ED3\u5E93\u5065\u5EB7\uFF08git status\uFF09\u540E\u91CD\u8DD1\uFF1B\u8D85\u65F6\u4E0A\u754C 120s\u3002"
+    });
+  }
+  const untrackedRun = gitRun(rootDir, ["ls-files", "--others", "--exclude-standard", "-z"]);
+  if (untrackedRun.error !== null || untrackedRun.status !== 0) {
+    return executionAuditFail({
+      code: "MUTATION_SCOPE_GIT_FAILED",
+      message: `git ls-files \u6536\u96C6\u5931\u8D25\uFF08untracked \u9762\uFF1Bexit=${String(untrackedRun.status)}, error=${untrackedRun.error ?? "unknown"}\uFF09\u2014\u2014diff \u9762\u4E0D\u53EF\u5F97\u96F6\u843D\u76D8`,
+      hint: "\u6838\u67E5 git \u53EF\u7528\u6027\u540E\u91CD\u8DD1\u3002"
+    });
+  }
+  const trackedPaths = splitNulList(trackedRun.stdout);
+  const untrackedPaths = splitNulList(untrackedRun.stdout);
+  const merged = [.../* @__PURE__ */ new Set([...trackedPaths, ...untrackedPaths])];
+  const excludedPaths = merged.filter((path) => pathHasSkippedSegment(path)).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+  const changedPaths = merged.filter((path) => !pathHasSkippedSegment(path)).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+  const table = loadKeybindingTable(rootDir);
+  const permitLoad = loadPermitScopes(rootDir, executionRecord.permit_ids, initialized.seq);
+  if ("error" in permitLoad)
+    return executionAuditFail(permitLoad.error);
+  const scopes = permitLoad.scopes;
+  const missingPermits = permitLoad.missing;
+  const judgments = judgeMutationScope(changedPaths, table.rows, scopes);
+  const inScopeItems = judgments.filter((item) => item.classification === "in_scope");
+  const outScopeItems = judgments.filter((item) => item.classification === "out_of_scope");
+  const unmappedItems = judgments.filter((item) => item.classification === "unmapped");
+  try {
+    const storePaths = buildStorePaths(rootDir);
+    const reportBytes = Buffer.from(`${JSON.stringify({
+      audit_surface: "mutation-scope",
+      execution_id: executionRecord.execution_id,
+      execution_started_at: executionRecord.started_at,
+      execution_ended_at: executionRecord.ended_at,
+      diff_base: diffBase,
+      diff_base_resolved: baseResolvedSha,
+      counts: {
+        tracked_changed: trackedPaths.length,
+        untracked: untrackedPaths.length,
+        changed_files: changedPaths.length,
+        in_scope: inScopeItems.length,
+        out_of_scope: outScopeItems.length,
+        unmapped: unmappedItems.length,
+        excluded_skip_dirs: excludedPaths.length,
+        binding_files: table.files,
+        binding_rows: table.rows.length,
+        binding_rows_path_anchored: table.rows.filter((row2) => row2.bindingClass !== "contract_operation_to_operationId").length,
+        binding_rows_non_path: table.rows.filter((row2) => row2.bindingClass === "contract_operation_to_operationId").length,
+        binding_rows_malformed: table.malformed.length,
+        permits: scopes.length,
+        permits_missing: missingPermits.length
+      },
+      in_scope: inScopeItems,
+      out_of_scope: outScopeItems,
+      unmapped: unmappedItems,
+      excluded_paths: excludedPaths,
+      malformed_rows: table.malformed,
+      binding_table_present: table.present,
+      permits_view: scopes.map((permit) => ({
+        permit_ref: permit.permit_ref,
+        status: permit.status,
+        subject_ids: permit.subject_ids
+      }))
+    }, null, 2)}
+`, "utf8");
+    const blob = persistEvidenceArtifact(storePaths.evidenceDir, {
+      media: "json",
+      bytes: reportBytes
+    });
+    const observationId = allocateObservationId(storePaths.observationsDir);
+    const receipt = buildObservationReceipt({
+      observationId,
+      executionId,
+      sensorCapability: EXECUTION_AUDIT_SENSOR_CAPABILITY,
+      adapter: EXECUTION_AUDIT_ADAPTER,
+      operation: EXECUTION_AUDIT_OPERATION,
+      surface: "STRUCTURAL_REALITY",
+      result: "OBSERVED",
+      capturedAtSeq: initialized.seq,
+      artifactRefs: [
+        {
+          sha256: blob.sha256,
+          media: blob.media,
+          byteSize: blob.byteSize,
+          storagePath: blob.storagePath
+        }
+      ],
+      normalizedFacts: [
+        "audit_surface: mutation-scope",
+        `diff_base_resolved: ${baseResolvedSha}`,
+        `tracked_changed: ${String(trackedPaths.length)}`,
+        `untracked: ${String(untrackedPaths.length)}`,
+        `changed_files: ${String(changedPaths.length)}`,
+        `in_scope: ${String(inScopeItems.length)}`,
+        `out_of_scope: ${String(outScopeItems.length)}`,
+        `unmapped: ${String(unmappedItems.length)}`,
+        `excluded_skip_dirs: ${String(excludedPaths.length)}`,
+        `binding_rows: ${String(table.rows.length)}`,
+        `binding_rows_malformed: ${String(table.malformed.length)}`,
+        `permits: ${String(scopes.length)}`,
+        `permits_missing: ${String(missingPermits.length)}`,
+        ...changedPaths.length === 0 ? ["zero_diff: true"] : []
+      ]
+    });
+    const persisted = persistObservationRecord(storePaths.evidenceDir, observationRecordOf(receipt));
+    const receiptPath = `${POMASTER_DIR}/evidence/${persisted.relativePath}`;
+    const human = [
+      `execution audit: OBSERVED \u2014 \u53D8\u66F4\u6587\u4EF6 ${String(changedPaths.length)}\uFF08in ${String(inScopeItems.length)} / out ${String(outScopeItems.length)} / unmapped ${String(unmappedItems.length)}\uFF1Bexcluded ${String(excludedPaths.length)}\u2014\u2014node_modules/dist/.git/coverage/.pomaster \u6392\u9664\u95ED\u5305\uFF09`,
+      `diff \u951A: ${diffBase} \u2192 ${baseResolvedSha}\uFF08execution ${executionRecord.execution_id} started_at=${executionRecord.started_at}\u2014\u2014\u951A\u7531\u8C03\u7528\u65B9\u7533\u62A5\uFF0Cexecution record \u65E0 ref/seq \u951A\u5B57\u6BB5\uFF09`
+    ];
+    if (outScopeItems.length > 0) {
+      human.push(`\u8D8A\u754C\uFF08${String(outScopeItems.length)} \u9879\u2014\u2014\u53D8\u66F4\u8DEF\u5F84 \u2209 permit scope\uFF0C\u5904\u7F6E\u5F52 Owner\uFF09\uFF1A`);
+      for (const item of outScopeItems.slice(0, EXECUTION_AUDIT_PRESENTATION_CAP)) {
+        human.push(`  - ${item.path} \u2014 ${item.basis}`);
+      }
+      if (outScopeItems.length > EXECUTION_AUDIT_PRESENTATION_CAP) {
+        human.push(`  \u2026\uFF08\u5176\u4F59 ${String(outScopeItems.length - EXECUTION_AUDIT_PRESENTATION_CAP)} \u6761\u89C1 report blob ${blob.storagePath}\uFF09`);
+      }
+    }
+    if (unmappedItems.length > 0) {
+      human.push(`unmapped\uFF08${String(unmappedItems.length)} \u6761\u2014\u2014\u65E0 KEYBINDING \u5728\u518C\u7ED1\u5B9A\u547D\u4E2D\uFF0C\u8BDA\u5B9E\u6E05\u5355\u975E\u9519\u8BEF${table.present ? "" : "\uFF1B\u672C\u5DE5\u4F5C\u533A\u65E0 KEYBINDING \u7ED1\u5B9A\u8868\uFF08\u5168 unmapped \u5408\u6CD5\u6001\uFF09"}\uFF09\uFF1A`);
+      for (const item of unmappedItems.slice(0, EXECUTION_AUDIT_PRESENTATION_CAP)) {
+        human.push(`  - ${item.path}`);
+      }
+      if (unmappedItems.length > EXECUTION_AUDIT_PRESENTATION_CAP) {
+        human.push(`  \u2026\uFF08\u5176\u4F59 ${String(unmappedItems.length - EXECUTION_AUDIT_PRESENTATION_CAP)} \u6761\u89C1 report blob ${blob.storagePath}\uFF09`);
+      }
+    }
+    human.push(`binding \u8868: ${String(table.files)} \u6587\u4EF6 / ${String(table.rows.length)} \u884C\uFF08path-anchored ${String(table.rows.length - table.rows.filter((row2) => row2.bindingClass === "contract_operation_to_operationId").length)} / non-path(operationId) ${String(table.rows.filter((row2) => row2.bindingClass === "contract_operation_to_operationId").length)} / malformed ${String(table.malformed.length)}${table.present ? "" : "\uFF1B\u76EE\u5F55\u7F3A\u5E2D=\u65E0\u8868"})`, `permit scope \u9762: ${String(scopes.length)} \u4E2A permit\uFF08${scopes.map((permit) => `${permit.permit_ref}:${permit.status}`).join(", ") || "\u65E0"}\uFF09+ missing ${String(missingPermits.length)}`, `report blob: ${blob.storagePath}\uFF08${blob.sha256}\uFF1Bmedia=json\u2014\u2014\u4E09\u5206\u7C7B\u5168\u91CF\u6E05\u5355/\u6392\u9664\u6E05\u5355/malformed \u884C\u8F7D\u4F53\uFF09`, `observation receipt: ${receiptPath}\uFF08result=OBSERVED\uFF1Bsurface=STRUCTURAL_REALITY\uFF1Bcaptured_at_seq=${String(initialized.seq)}\uFF09`, "\u96F6\u6743\u5A01\u5199\u53E3\uFF1A\u4EA7\u7269\u53EA\u843D evidence/{blobs,observations}/ sidecar\uFF08\u5B57\u8282\u5FEB\u7167\u6D4B\u8BD5\u9489\uFF09\uFF1B\u8D8A\u754C\u5448\u62A5\u4E0D\u963B\u65AD\u2014\u2014\u5904\u7F6E\u5F52 Owner\uFF08Detection \u534A\u8FB9\uFF09");
+    const warnings = [];
+    if (missingPermits.length > 0) {
+      warnings.push({
+        code: "PERMIT_REF_UNRESOLVED",
+        message: `execution.permit_ids \u5F15\u7528\u7684 ${String(missingPermits.length)} \u4E2A permit \u672A\u5728\u53F0\u8D26\u89E3\u6790\uFF08scope \u9762\u6536\u7A84\u2014\u2014\u7F3A\u5931 scope \u4E0D\u6388\u4E88 in-scope\uFF09\uFF1A${missingPermits.join("; ")}`,
+        hint: "\u6838\u67E5 execution begin --permit \u4E0E permit issue \u53F0\u8D26\uFF08state/permits.json\uFF09\u5BF9\u8D26\uFF1B\u5F15\u7528\u7F3A\u5931\u5C5E\u62AB\u9732\u975E\u653E\u884C\u3002"
+      });
+    }
+    if (table.malformed.length > 0) {
+      warnings.push({
+        code: "KEYBINDING_ROW_MALFORMED",
+        message: `${String(table.malformed.length)} \u4E2A KEYBINDING \u884C\u8BCD\u5F62\u6821\u9A8C\u5931\u8D25\uFF08\u5DF2\u62AB\u9732\u975E\u9759\u9ED8\u8DF3\u8FC7\uFF0C\u4E0D\u5165\u6620\u5C04\u5206\u6BCD\uFF09\uFF1A${table.malformed.map((row2) => row2.file).join("; ")}`,
+        hint: "04-keybinding \u884C\u5BF9\u8C61\u8BCD\u5F62\u5951\u7EA6\u89C1 packages/schemas/assets/04-keybinding.schema.json\uFF1Bmalformed \u6E05\u5355\u5DF2\u968F report blob \u843D\u76D8\u3002"
+      });
+    }
+    const result2 = {
+      observation: "OBSERVED",
+      observation_id: receipt.observation_id,
+      receipt_path: receiptPath,
+      execution_id: executionRecord.execution_id,
+      diff_base: diffBase,
+      diff_base_resolved: baseResolvedSha,
+      captured_at_seq: initialized.seq,
+      changed_files: changedPaths.length,
+      in_scope: inScopeItems.length,
+      out_of_scope: outScopeItems.length,
+      unmapped: unmappedItems.length,
+      excluded_skip_dirs: excludedPaths.length,
+      tracked_changed: trackedPaths.length,
+      untracked: untrackedPaths.length,
+      binding_files: table.files,
+      binding_rows: table.rows.length,
+      binding_rows_path_anchored: table.rows.filter((row2) => row2.bindingClass !== "contract_operation_to_operationId").length,
+      binding_rows_non_path: table.rows.filter((row2) => row2.bindingClass === "contract_operation_to_operationId").length,
+      binding_rows_malformed: table.malformed.length,
+      permits: scopes.length,
+      permits_missing: missingPermits.length,
+      out_of_scope_items: outScopeItems,
+      report_blob: {
+        sha256: blob.sha256,
+        storage_path: blob.storagePath,
+        byte_size: blob.byteSize
+      },
+      out_of_scope_stdout_capped: outScopeItems.length > EXECUTION_AUDIT_PRESENTATION_CAP
+    };
+    if (outScopeItems.length > 0) {
+      return failOutcome("execution audit", result2, [
+        {
+          code: "MUTATION_SCOPE_OUT_OF_SCOPE",
+          message: `\u8D8A\u754C\u53D8\u66F4 ${String(outScopeItems.length)} \u9879\uFF08execution ${executionRecord.execution_id} vs \u951A ${diffBase}\uFF09\uFF1A${outScopeItems.map((item) => item.path).join("; ")}`,
+          hint: "\u8D8A\u754C\u660E\u7EC6\u89C1 stdout/result/report blob\uFF1B\u628A\u76EE\u6807\u5BF9\u8C61\u7EB3\u5165 permit \u8303\u56F4\u987B\u56DE FRAMEWORK LOCK \u91CD\u5BA1\u5347\u7EA7\uFF08D20\uFF09\uFF0C\u4E0D\u5F97\u65C1\u8DEF\u6269\u6743\u2014\u2014\u672C\u547D\u4EE4\u53EA\u89C2\u5BDF\u5448\u62A5\uFF0C\u5904\u7F6E\u5F52 Owner\u3002"
+        }
+      ], human, warnings);
+    }
+    return okOutcome("execution audit", result2, human, warnings);
+  } catch (error) {
+    if (error instanceof GovernanceError)
+      return executionAuditFail(governanceErrorToCliError(error));
+    throw error;
+  }
+}
+
 // packages/cli/dist/record.js
 init_dist();
-import { existsSync as existsSync18, readFileSync as readFileSync24 } from "node:fs";
+import { existsSync as existsSync20, readFileSync as readFileSync27 } from "node:fs";
 function emptyGateRunResult() {
   return {
     grn: null,
@@ -58156,7 +60183,7 @@ function gateRunFail(error) {
 }
 function readFromBytes(path) {
   try {
-    return { bytes: readFileSync24(path, "utf8") };
+    return { bytes: readFileSync27(path, "utf8") };
   } catch (err) {
     return {
       code: EVIDENCE_MALFORMED_CODE,
@@ -58238,7 +60265,7 @@ async function runRecordGateRun(rootDir, input) {
     });
   }
   const executionId = executionResolution.executionId;
-  if (executionId !== null && !existsSync18(`${executionsDirPath(rootDir)}/${executionId}.json`)) {
+  if (executionId !== null && !existsSync20(`${executionsDirPath(rootDir)}/${executionId}.json`)) {
     return gateRunFail({
       code: "EXECUTION_NOT_FOUND",
       message: `execution_id \u672A\u767B\u8BB0\uFF08executions/ \u6863\u6848\u7F3A\u5931\uFF09\uFF1A${executionId}`,
@@ -58294,7 +60321,7 @@ async function runRecordGateRun(rootDir, input) {
     grn = input.grn;
     let targetBytes = null;
     try {
-      targetBytes = readFileSync24(`${runsDir}/${grn}.json`, "utf8");
+      targetBytes = readFileSync27(`${runsDir}/${grn}.json`, "utf8");
     } catch {
       targetBytes = null;
     }
@@ -58489,7 +60516,7 @@ async function runRecordClaim(rootDir, input) {
     });
   }
   const executionId = executionResolution.executionId;
-  if (executionId !== null && !existsSync18(`${executionsDirPath(rootDir)}/${executionId}.json`)) {
+  if (executionId !== null && !existsSync20(`${executionsDirPath(rootDir)}/${executionId}.json`)) {
     return claimFail({
       code: "EXECUTION_NOT_FOUND",
       message: `execution_id \u672A\u767B\u8BB0\uFF08executions/ \u6863\u6848\u7F3A\u5931\uFF09\uFF1A${executionId}`,
@@ -58516,7 +60543,7 @@ async function runRecordClaim(rootDir, input) {
     clm = input.clm;
     let targetBytes = null;
     try {
-      targetBytes = readFileSync24(`${claimsDir}/${clm}.json`, "utf8");
+      targetBytes = readFileSync27(`${claimsDir}/${clm}.json`, "utf8");
     } catch {
       targetBytes = null;
     }
@@ -58630,7 +60657,7 @@ async function runRecordVerification(rootDir, input) {
   const claimPath = `${claimsDirPath(rootDir)}/${input.clm}.json`;
   let bytes = null;
   try {
-    bytes = readFileSync24(claimPath, "utf8");
+    bytes = readFileSync27(claimPath, "utf8");
   } catch {
     bytes = null;
   }
@@ -58679,7 +60706,7 @@ async function runRecordVerification(rootDir, input) {
     });
   }
   const executionId = executionResolution.executionId;
-  if (executionId !== null && !existsSync18(`${executionsDirPath(rootDir)}/${executionId}.json`)) {
+  if (executionId !== null && !existsSync20(`${executionsDirPath(rootDir)}/${executionId}.json`)) {
     return verificationFail({
       code: "EXECUTION_NOT_FOUND",
       message: `execution_id \u672A\u767B\u8BB0\uFF08executions/ \u6863\u6848\u7F3A\u5931\uFF09\uFF1A${executionId}`,
@@ -58737,9 +60764,9 @@ async function runRecordVerification(rootDir, input) {
 // packages/cli/dist/closeout.js
 init_dist();
 init_src();
-import { readdirSync as readdirSync19 } from "node:fs";
+import { readdirSync as readdirSync21 } from "node:fs";
 import { readFile as readFile13 } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { join as join12 } from "node:path";
 function emptyResult4(task) {
   return {
     task,
@@ -58804,7 +60831,7 @@ function grnOrdinal(grn) {
 var GRN_SIDECAR_PATTERN = /^GRN-[0-9]+(?:\..+)?$/;
 function listGrnSidecarFiles(runsDir) {
   try {
-    return readdirSync19(runsDir).filter((name) => GRN_SIDECAR_PATTERN.test(name) && !name.endsWith(".json")).sort();
+    return readdirSync21(runsDir).filter((name) => GRN_SIDECAR_PATTERN.test(name) && !name.endsWith(".json")).sort();
   } catch {
     return [];
   }
@@ -58812,7 +60839,7 @@ function listGrnSidecarFiles(runsDir) {
 async function readRunRecord(runsDir, fileName) {
   let parsed;
   try {
-    parsed = JSON.parse(await readFile13(join10(runsDir, fileName), "utf8"));
+    parsed = JSON.parse(await readFile13(join12(runsDir, fileName), "utf8"));
   } catch (err) {
     return { damage: `evidence/runs/${fileName}: JSON \u65E0\u6CD5\u89E3\u6790 \u2014 ${err instanceof Error ? err.message : String(err)}` };
   }
@@ -58833,7 +60860,7 @@ async function readRunRecord(runsDir, fileName) {
 async function readClaimRecord(claimsDir, fileName) {
   let bytes;
   try {
-    bytes = await readFile13(join10(claimsDir, fileName), "utf8");
+    bytes = await readFile13(join12(claimsDir, fileName), "utf8");
   } catch {
     return { missing: true };
   }
@@ -58896,7 +60923,7 @@ async function runCloseout(rootDir, input) {
       hint: "change \u7684\u5B8C\u6210\u5224\u5377\u7ECF\u7531\u5176 affected TASKs \u9010\u4EFB\u52A1 closeout\uFF1Bkind \u8BCD\u5F62\u89C1 02b kind-payloads\u3002"
     }, withKind);
   }
-  const bodyPath = join10(rootDir, POMASTER_DIR, ...row2.bodyRef.split("/"));
+  const bodyPath = join12(rootDir, POMASTER_DIR, ...row2.bodyRef.split("/"));
   let bodyRaw;
   try {
     bodyRaw = await readFile13(bodyPath, "utf8");
@@ -59033,7 +61060,7 @@ async function runCloseout(rootDir, input) {
   const claimsDirForSpec = claimsDirPath(rootDir);
   const specRows = index.objects.filter((row3) => row3.id.startsWith("SPEC."));
   for (const specRow of specRows) {
-    const specBodyPath = join10(rootDir, POMASTER_DIR, ...specRow.bodyRef.split("/"));
+    const specBodyPath = join12(rootDir, POMASTER_DIR, ...specRow.bodyRef.split("/"));
     let specRaw;
     try {
       specRaw = await readFile13(specBodyPath, "utf8");
@@ -59418,8 +61445,8 @@ function kernelErrorOf2(err) {
 
 // packages/cli/dist/catalog.js
 init_dist();
-import { writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join11 } from "node:path";
+import { writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join13 } from "node:path";
 function emptyMaterial() {
   return {
     title_zh: null,
@@ -59637,7 +61664,7 @@ async function runCatalogRelock(deps) {
   try {
     catalogRoot = catalogRootOf(deps);
     report = relockCatalog(catalogRoot);
-    writeFileSync4(join11(catalogRoot, LOCK_FILE_NAME), `${JSON.stringify(report.next, null, 2)}
+    writeFileSync5(join13(catalogRoot, LOCK_FILE_NAME), `${JSON.stringify(report.next, null, 2)}
 `, "utf8");
     verification = verifyCatalogLock(catalogRoot);
   } catch (error) {
@@ -59986,7 +62013,7 @@ async function runGraph(input) {
 }
 
 // packages/cli/dist/eval.js
-import { existsSync as existsSync19, readFileSync as readFileSync25 } from "node:fs";
+import { existsSync as existsSync21, readFileSync as readFileSync28 } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 init_dist();
 var EVAL_SUITES = ["behavioral"];
@@ -60007,7 +62034,7 @@ function loadSeeds(seedsPath = BEHAVIORAL_SEEDS_PATH) {
   if (lower.endsWith(".yaml") || lower.endsWith(".yml")) {
     throw new Error(`eval \u547D\u4EE4\u6D88\u8D39\u9762\u4E3A seeds.json\uFF0C\u4E0D\u63A5\u53D7 yaml \u8F7D\u7269\uFF08${seedsPath}\uFF09\u3002PRD \xA794.2 yaml \u8F7D\u7269\uFF08tests/behavioral/eval-cases.yaml\uFF09\u662F\u767B\u8BB0\u5F62\u6001\uFF1Aschema \u6821\u9A8C\u4E0E json \u540C\u6784\u951A\u5B9A\u5728 tests/behavioral/eval-carrier.spec.ts\uFF08js-yaml devDependency + ajv\uFF0Ctests \u9762\uFF09\uFF1B\u5224\u5377\u8BF7\u6CE8\u5165 seeds.json \u6216\u7701\u7565 seedsPath \u7528\u4ED3\u5E93\u7F3A\u7701\u8D26\u672C\u3002`);
   }
-  const raw = JSON.parse(readFileSync25(seedsPath, "utf8"));
+  const raw = JSON.parse(readFileSync28(seedsPath, "utf8"));
   const file = raw;
   if (!Array.isArray(file.seeds)) {
     throw new Error(`seeds.json \u5F62\u6001\u975E\u6CD5\uFF1A\u7F3A seeds \u6570\u7EC4\uFF08${seedsPath}\uFF09`);
@@ -60267,7 +62294,7 @@ async function runEval(input) {
     ], [`eval: FAILED \u2014 EVAL_SUITE_UNKNOWN\uFF08${input.suite}\uFF09`]);
   }
   const seedsPath = input.seedsPath ?? BEHAVIORAL_SEEDS_PATH;
-  if (!existsSync19(seedsPath)) {
+  if (!existsSync21(seedsPath)) {
     return failOutcome(command, { suite: input.suite, seeds_path: seedsPath, report: zeroReport() }, [
       {
         code: "SEEDS_NOT_AVAILABLE",
@@ -60578,7 +62605,7 @@ async function runAuditTask(rootDir, input) {
 init_dist();
 init_src();
 import { readFile as readFile15 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { join as join14 } from "node:path";
 async function runLedgerRecord(rootDir, input, deps) {
   const emptyResult6 = {
     ledger_ref: "",
@@ -60667,7 +62694,7 @@ async function runLedgerRecord(rootDir, input, deps) {
 }
 async function runLedgerList(rootDir, input) {
   const classificationFilter = input.classification?.trim() ? input.classification.trim() : null;
-  const path = join12(rootDir, POMASTER_DIR, "state", "exception-ledger.json");
+  const path = join14(rootDir, POMASTER_DIR, "state", "exception-ledger.json");
   let raw;
   try {
     raw = await readFile15(path, "utf8");
@@ -60756,31 +62783,31 @@ async function runLedgerList(rootDir, input) {
 
 // packages/cli/dist/knowledge.js
 init_dist();
-import { existsSync as existsSync22 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync24 } from "node:fs";
+import { join as join17 } from "node:path";
 
 // packages/cli/dist/research.js
 init_src();
 init_dist();
-import { existsSync as existsSync21 } from "node:fs";
+import { existsSync as existsSync23 } from "node:fs";
 import { mkdir as mkdir2, readFile as readFile17, readdir as readdir2, writeFile as writeFile5 } from "node:fs/promises";
-import { join as join14 } from "node:path";
+import { join as join16 } from "node:path";
 
 // packages/cli/dist/brainstorm.js
 init_src();
 init_dist();
-import { existsSync as existsSync20 } from "node:fs";
+import { existsSync as existsSync22 } from "node:fs";
 import { mkdir, readdir, readFile as readFile16, writeFile as writeFile4 } from "node:fs/promises";
-import { isAbsolute, join as join13, relative as relative2, resolve as resolve2 } from "node:path";
+import { isAbsolute, join as join15, relative as relative2, resolve as resolve3 } from "node:path";
 var PROMOTE_TARGETS = ["CHANGE", "TASK"];
 function scratchpadRefOf(id) {
   return `.pomaster/discovery/scratchpads/${id}/`;
 }
 function stateFilePath(rootDir, id) {
-  return join13(discoveryScratchpadDirPath(rootDir, id), "state.json");
+  return join15(discoveryScratchpadDirPath(rootDir, id), "state.json");
 }
 function metaFilePath(rootDir, id) {
-  return join13(discoveryScratchpadDirPath(rootDir, id), "meta.json");
+  return join15(discoveryScratchpadDirPath(rootDir, id), "meta.json");
 }
 function cliError(err) {
   if (err instanceof GovernedIdParseError) {
@@ -60797,7 +62824,7 @@ function cliError(err) {
   };
 }
 async function readJsonFile(path) {
-  if (!existsSync20(path))
+  if (!existsSync22(path))
     return null;
   try {
     return JSON.parse(await readFile16(path, "utf8"));
@@ -60872,7 +62899,7 @@ async function runBrainstormStart(rootDir, input) {
     ], [`brainstorm start: FAILED \u2014 id \u8BCD\u5F62\u975E\u6CD5\uFF08${id}\uFF09`]);
   }
   if (id === void 0) {
-    const existing = existsSync20(padsDir) ? await readdir(padsDir) : [];
+    const existing = existsSync22(padsDir) ? await readdir(padsDir) : [];
     let seq2 = 1;
     while (existing.includes(`idea-${String(seq2).padStart(3, "0")}`))
       seq2 += 1;
@@ -60880,7 +62907,7 @@ async function runBrainstormStart(rootDir, input) {
   }
   const padDir = discoveryScratchpadDirPath(rootDir, id);
   const statePath = stateFilePath(rootDir, id);
-  if (existsSync20(padDir)) {
+  if (existsSync22(padDir)) {
     const existingState = await readJsonFile(statePath);
     if (existingState !== null && typeof existingState === "object") {
       const file = existingState;
@@ -60969,7 +62996,7 @@ async function runBrainstormStart(rootDir, input) {
 }
 async function runBrainstormStatus(rootDir) {
   const padsDir = discoveryScratchpadsDirPath(rootDir);
-  if (!existsSync20(padsDir)) {
+  if (!existsSync22(padsDir)) {
     return okOutcome("brainstorm status", { scratchpads: [] }, [
       "brainstorm status\uFF1A\u65E0\u6D3B\u8DC3 discovery\uFF08scratchpads \u76EE\u5F55\u4E0D\u5B58\u5728\u2014\u2014\u663E\u5F0F\u7A7A\uFF0C\u975E\u9759\u9ED8\uFF09",
       "  \u5F00\u59CB\u4E00\u6B21\u8BA8\u8BBA\uFF1Apomaster brainstorm start [--ephemeral]"
@@ -61404,7 +63431,7 @@ async function runBrainstormPromote(rootDir, input) {
   let txPath = null;
   let txOutError = null;
   if (input.txOut !== void 0) {
-    const resolvedTx = resolve2(rootDir, input.txOut);
+    const resolvedTx = resolve3(rootDir, input.txOut);
     const relPosix = relative2(rootDir, resolvedTx).split("\\").join("/");
     const escapes = relPosix.length === 0 || relPosix === ".." || relPosix.startsWith("../") || isAbsolute(relPosix);
     if (escapes) {
@@ -61434,7 +63461,7 @@ async function runBrainstormPromote(rootDir, input) {
     return fail6(txOutError, [`brainstorm promote: FAILED \u2014 SCHEMA_INVALID (--tx-out)`]);
   }
   if (txPath === null) {
-    txPath = join13(discoveryScratchpadDirPath(rootDir, input.discoveryId), "promote-tx.json");
+    txPath = join15(discoveryScratchpadDirPath(rootDir, input.discoveryId), "promote-tx.json");
   }
   try {
     await mkdir(discoveryScratchpadDirPath(rootDir, input.discoveryId), { recursive: true });
@@ -61561,11 +63588,11 @@ var UNKNOWN_TRIAGE_KEYS = [
 ];
 var DECISION_GRAPH_FILENAME = "decision-graph.json";
 function decisionGraphPath(rootDir, id) {
-  return join13(discoveryScratchpadDirPath(rootDir, id), DECISION_GRAPH_FILENAME);
+  return join15(discoveryScratchpadDirPath(rootDir, id), DECISION_GRAPH_FILENAME);
 }
 var DECISION_INPUTS_FILENAME = "decision-inputs.json";
 function decisionInputsPath(rootDir, id) {
-  return join13(discoveryScratchpadDirPath(rootDir, id), DECISION_INPUTS_FILENAME);
+  return join15(discoveryScratchpadDirPath(rootDir, id), DECISION_INPUTS_FILENAME);
 }
 async function loadDecisionGraph(rootDir, id) {
   const graphPath = decisionGraphPath(rootDir, id);
@@ -62310,7 +64337,7 @@ async function resolveResearchHost(rootDir, hostOption) {
         }
       };
     }
-    if (!existsSync21(join14(rootDir, ...host.split("/")))) {
+    if (!existsSync23(join16(rootDir, ...host.split("/")))) {
       return {
         error: {
           code: "RESEARCH_HOST_NOT_FOUND",
@@ -62322,7 +64349,7 @@ async function resolveResearchHost(rootDir, hostOption) {
     return { host };
   }
   const padsDir = discoveryScratchpadsDirPath(rootDir);
-  if (!existsSync21(padsDir)) {
+  if (!existsSync23(padsDir)) {
     return {
       error: {
         code: "RESEARCH_HOST_NOT_FOUND",
@@ -62335,7 +64362,7 @@ async function resolveResearchHost(rootDir, hostOption) {
   const active = [];
   for (const id of entries) {
     try {
-      const raw = JSON.parse(await readFile17(join14(padsDir, id, "state.json"), "utf8"));
+      const raw = JSON.parse(await readFile17(join16(padsDir, id, "state.json"), "utf8"));
       if (typeof raw.state === "string" && (raw.state === "DISCOVERY" || raw.state === "READY_TO_PROMOTE")) {
         active.push(id);
       }
@@ -62363,7 +64390,7 @@ async function resolveResearchHost(rootDir, hostOption) {
   return { host: `.pomaster/discovery/scratchpads/${active[0]}/` };
 }
 async function readIndexYaml(indexPath) {
-  if (!existsSync21(indexPath))
+  if (!existsSync23(indexPath))
     return null;
   try {
     return JSON.parse(await readFile17(indexPath, "utf8"));
@@ -62450,11 +64477,11 @@ async function runResearchStart(rootDir, input) {
   const created = [];
   const skipped = [];
   try {
-    const researchDir = join14(rootDir, ...artifactRoot.split("/"));
+    const researchDir = join16(rootDir, ...artifactRoot.split("/"));
     await mkdir2(researchDir, { recursive: true });
     for (const fileName of RESEARCH_ARTIFACT_FILES) {
-      const filePath = join14(researchDir, fileName);
-      if (existsSync21(filePath)) {
+      const filePath = join16(researchDir, fileName);
+      if (existsSync23(filePath)) {
         skipped.push(`${artifactRoot}${fileName}`);
         continue;
       }
@@ -62525,8 +64552,8 @@ async function runResearchList(rootDir, hostArg) {
     ], [`research list: FAILED \u2014 SCHEMA_INVALID`]);
   }
   const hostRef = normalizeDir(hostArg);
-  const hostDir = join14(rootDir, ...hostRef.split("/"));
-  if (!existsSync21(hostDir)) {
+  const hostDir = join16(rootDir, ...hostRef.split("/"));
+  if (!existsSync23(hostDir)) {
     return failOutcome("research list", { host_ref: hostRef, artifacts: [] }, [
       {
         code: "RESEARCH_HOST_NOT_FOUND",
@@ -62535,7 +64562,7 @@ async function runResearchList(rootDir, hostArg) {
       }
     ], [`research list: FAILED \u2014 RESEARCH_HOST_NOT_FOUND (${hostRef})`]);
   }
-  const indexPath = join14(hostDir, "research", "index.yaml");
+  const indexPath = join16(hostDir, "research", "index.yaml");
   const index = await readIndexYaml(indexPath);
   const artifacts = [];
   if (index !== null) {
@@ -62592,8 +64619,8 @@ async function runResearchInspect(rootDir, researchId) {
       }
     ], [`research inspect: FAILED \u2014 SCHEMA_INVALID`]);
   }
-  const hostDir = join14(rootDir, ...hostRef.split("/"));
-  if (!existsSync21(hostDir)) {
+  const hostDir = join16(rootDir, ...hostRef.split("/"));
+  if (!existsSync23(hostDir)) {
     return failOutcome("research inspect", {
       research_id: researchId,
       artifact_root: artifactRoot,
@@ -62610,9 +64637,9 @@ async function runResearchInspect(rootDir, researchId) {
       }
     ], [`research inspect: FAILED \u2014 RESEARCH_HOST_NOT_FOUND (${hostRef})`]);
   }
-  const researchDir = join14(hostDir, "research");
-  const indexPath = join14(researchDir, "index.yaml");
-  if (!existsSync21(indexPath)) {
+  const researchDir = join16(hostDir, "research");
+  const indexPath = join16(researchDir, "index.yaml");
+  if (!existsSync23(indexPath)) {
     return failOutcome("research inspect", {
       research_id: researchId,
       artifact_root: artifactRoot,
@@ -62666,7 +64693,7 @@ async function runResearchInspect(rootDir, researchId) {
   }
   const files = RESEARCH_ARTIFACT_FILES.map((f) => ({
     file: f,
-    present: existsSync21(join14(researchDir, f))
+    present: existsSync23(join16(researchDir, f))
   }));
   const missing = files.filter((f) => !f.present).map((f) => f.file);
   const rawFindings = Array.isArray(index.findings) ? index.findings : [];
@@ -62775,8 +64802,8 @@ async function runResearchInspect(rootDir, researchId) {
   }, human, warnings);
 }
 async function scratchpadDiscoveryState(rootDir, id) {
-  const statePath = join14(discoveryScratchpadDirPath(rootDir, id), "state.json");
-  if (!existsSync21(statePath)) {
+  const statePath = join16(discoveryScratchpadDirPath(rootDir, id), "state.json");
+  if (!existsSync23(statePath)) {
     return {
       error: {
         code: "SCRATCHPAD_NOT_FOUND",
@@ -62824,7 +64851,7 @@ function requestsOfIndex(index) {
 async function mutateIndexRequests(indexPath, artifactRoot, hostRef, mutate) {
   let index;
   let created = false;
-  if (existsSync21(indexPath)) {
+  if (existsSync23(indexPath)) {
     let parsed;
     try {
       parsed = JSON.parse(await readFile17(indexPath, "utf8"));
@@ -62851,7 +64878,7 @@ async function mutateIndexRequests(indexPath, artifactRoot, hostRef, mutate) {
   const changed = mutate(index);
   if (!changed && !created)
     return { created, changed: false };
-  await mkdir2(join14(indexPath, ".."), { recursive: true });
+  await mkdir2(join16(indexPath, ".."), { recursive: true });
   await writeFile5(indexPath, `${JSON.stringify(index, null, 2)}
 `, "utf8");
   return { created, changed: true };
@@ -62920,9 +64947,9 @@ async function runResearchRequest(rootDir, input) {
       hint: `\u8DEF\u7531\u952E\u8BCD\u5F62\uFF1A${Object.keys(RESEARCH_MODE_ROUTE_HINTS).join(" | ")}\u3002`
     }, [`research request: FAILED \u2014 SCHEMA_INVALID (--gap)`]);
   }
-  const indexPath = join14(discoveryScratchpadDirPath(rootDir, input.discoveryId), "research", "index.yaml");
+  const indexPath = join16(discoveryScratchpadDirPath(rootDir, input.discoveryId), "research", "index.yaml");
   let existingIndex = null;
-  if (existsSync21(indexPath)) {
+  if (existsSync23(indexPath)) {
     try {
       existingIndex = JSON.parse(await readFile17(indexPath, "utf8"));
     } catch {
@@ -63165,7 +65192,7 @@ async function runResearchHandoff(rootDir, input) {
       }
     }
   }
-  const indexPath = join14(discoveryScratchpadDirPath(rootDir, input.discoveryId), "research", "index.yaml");
+  const indexPath = join16(discoveryScratchpadDirPath(rootDir, input.discoveryId), "research", "index.yaml");
   const statusMap = /* @__PURE__ */ new Map();
   for (const id of handoff.answered_requests)
     statusMap.set(id, "answered");
@@ -63466,8 +65493,8 @@ async function loadResearchFinding(rootDir, researchId, findingNumber) {
       }
     };
   }
-  const indexPath = join15(rootDir, ...artifactRoot.split("/"), "index.yaml");
-  if (!existsSync22(indexPath)) {
+  const indexPath = join17(rootDir, ...artifactRoot.split("/"), "index.yaml");
+  if (!existsSync24(indexPath)) {
     return {
       error: {
         code: "RESEARCH_ARTIFACT_NOT_FOUND",
@@ -63682,7 +65709,7 @@ async function runKnowledgeDemote(rootDir, input, deps) {
 
 // packages/cli/dist/memory.js
 init_dist();
-import { readFileSync as readFileSync26 } from "node:fs";
+import { readFileSync as readFileSync29 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 var [MEMORY_ENTRY_NOT_FOUND, MEMORY_ALREADY_REVIEWED, MEMORY_REVIEW_REQUIRED, MEMORY_ALREADY_PROMOTED, MEMORY_PROMOTE_OWNER_REQUIRED, MEMORY_CAPTURE_DUPLICATE, MEMORY_HARVEST_NOT_RUN] = MEMORY_CLI_ERROR_VALUES;
 function toCliError2(err, docSection) {
@@ -63751,7 +65778,7 @@ function readStdinText() {
     };
   }
   try {
-    return { text: readFileSync26(0, "utf8") };
+    return { text: readFileSync29(0, "utf8") };
   } catch (err) {
     return {
       error: {
@@ -64329,7 +66356,7 @@ async function runMemoryAudit(rootDir, input) {
 
 // packages/cli/dist/production.js
 init_dist();
-import { readFileSync as readFileSync27 } from "node:fs";
+import { readFileSync as readFileSync30 } from "node:fs";
 var [BAND_SCHEMA_INVALID, BAND_NOT_FOUND, OBSERVATION_NOT_EVALUABLE, CHALLENGE_REJECTED, EVIDENCE_NOT_FOUND] = PRODUCTION_CLI_ERROR_VALUES;
 var NO_AUTO_APPLY_NOTE = "\u5448\u62A5\u6001\u2014\u2014\u4E0D\u5F97\u81EA\u52A8\u5E94\u7528\uFF08PRD \xA790.4 L5695 \u9010\u5B57\uFF09\uFF1APOMASTER_SELF_IMPROVEMENT_CANDIDATE \u65E0\u4EFB\u4F55\u81EA\u52A8\u5E94\u7528\u901A\u8DEF\uFF0C\u300C\u5E94\u7528\u300D\u6C38\u8FDC\u662F\u4EBA/Owner \u7ECF\u6CBB\u7406\u9762\u7684\u663E\u5F0F\u52A8\u4F5C";
 function fail5(result2, command, error) {
@@ -64591,7 +66618,7 @@ async function runProductionEvaluate(rootDir, input) {
     const filePath = input.observationsFile.trim();
     let text;
     try {
-      text = readFileSync27(filePath, "utf8");
+      text = readFileSync30(filePath, "utf8");
     } catch (err) {
       return fail5(empty, command, {
         code: OBSERVATION_NOT_EVALUABLE,
@@ -65175,7 +67202,7 @@ async function runTraceList(rootDir) {
 
 // packages/cli/dist/agents.js
 init_dist();
-import { existsSync as existsSync23, readFileSync as readFileSync28, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync25, readFileSync as readFileSync31, writeFileSync as writeFileSync6 } from "node:fs";
 var GATEKEEPER_DRIFT_OBSERVED = "GATEKEEPER_DRIFT_OBSERVED";
 var SUPERVISOR_TRIGGER_OBSERVED = "SUPERVISOR_TRIGGER_OBSERVED";
 async function runAgentsStatus(rootDir, input = {}) {
@@ -65335,10 +67362,10 @@ var DISPATCH_PACK_WRITE_FAILED = "IO_WRITE_FAILED";
 async function referenceSection(rootDir, taskId, warnings) {
   const lines = [];
   const manifestPath = `${contextsDirPath(rootDir)}/${taskId}.context.json`;
-  if (existsSync23(manifestPath)) {
+  if (existsSync25(manifestPath)) {
     let generatedAtSeq = null;
     try {
-      const parsed = JSON.parse(readFileSync28(manifestPath, "utf8"));
+      const parsed = JSON.parse(readFileSync31(manifestPath, "utf8"));
       const seq2 = isRecord6(parsed) ? parsed.generated_at_seq : void 0;
       if (typeof seq2 === "number")
         generatedAtSeq = seq2;
@@ -65499,7 +67526,7 @@ async function runAgentsDispatchPack(rootDir, input) {
   let outFile = null;
   if (input.out !== void 0) {
     try {
-      writeFileSync5(input.out, `${packLines.join("\n")}
+      writeFileSync6(input.out, `${packLines.join("\n")}
 `, "utf8");
       outFile = toPosix(input.out);
     } catch (err) {
@@ -65670,6 +67697,10 @@ async function runMigrateTrellisSpec(rootDir, input) {
   }
 }
 
+// packages/cli/dist/baseline-tokens.js
+init_js_yaml();
+init_src();
+
 // packages/cli/dist/index.js
 var defaultIo = {
   stdout: (line) => process.stdout.write(`${line}
@@ -65718,7 +67749,7 @@ function createProgram(runs, io = defaultIo) {
     });
     record({ command: "init", outcome, asJson });
   });
-  const baseline = program2.command("baseline").description("Project Engineering Baseline \u9500\u8D26\u4E0E\u786E\u8BA4 gate \u901A\u8DEF\uFF08R-M/R-L\uFF09\uFF1Aset = \u5355\u952E\u663E\u5F0F\u5199\u5165 .pomaster/baseline/<lane>/stack.yaml \u5E76\u540C\u6B65\u9500\u8D26 manifest unknowns \u53F0\u8D26\uFF08TTY init \u6280\u672F\u6808\u95EE\u5377\u7684\u975E\u4EA4\u4E92\u5B6A\u751F\u2014\u2014CI/\u811A\u672C\u573A\u666F\uFF1B\u952E\u8BCD\u5F62 fail-closed\uFF1B\u5DF2\u7B54\u952E\u6539\u578B\u62D2\u7EDD\uFF09\uFF1Bconfirm = \u57FA\u7EBF\u786E\u8BA4\u65BD\u65AD\uFF0814 unknowns \u5168\u9500\u8D26\u540E manifest \u8BB0 confirmed digest \u5FEB\u7167\u2014\u201424 \u6587\u4EF6\u5355\u4E00\u8D44\u4EA7\u6E05\u5355\uFF1B\u91CD\u786E\u8BA4\u4E09\u901A\u9053 --change / --ack-drifted --note / \u88F8\u91CD\u786E\u8BA4\u62D2\u7EDD\uFF1Bcloseout/doctor/status \u6D88\u8D39\u786E\u8BA4\u6001\uFF09");
+  const baseline = program2.command("baseline").description("Project Engineering Baseline \u9500\u8D26\u4E0E\u786E\u8BA4 gate \u901A\u8DEF\uFF08R-M/R-L\uFF09\uFF1Aset = \u5355\u952E\u663E\u5F0F\u5199\u5165 .pomaster/baseline/<lane>/stack.yaml \u5E76\u540C\u6B65\u9500\u8D26 manifest unknowns \u53F0\u8D26\uFF08TTY init \u6280\u672F\u6808\u95EE\u5377\u7684\u975E\u4EA4\u4E92\u5B6A\u751F\u2014\u2014CI/\u811A\u672C\u573A\u666F\uFF1B\u952E\u8BCD\u5F62 fail-closed\uFF1B\u5DF2\u7B54\u952E\u6539\u578B\u62D2\u7EDD\uFF09\uFF1Bconfirm = \u57FA\u7EBF\u786E\u8BA4\u65BD\u65AD\uFF08\u963B\u585E\u96C6\u6E05\u96F6\u540E manifest \u8BB0 confirmed digest \u5FEB\u7167\u2014\u201425 \u6587\u4EF6\u5355\u4E00\u8D44\u4EA7\u6E05\u5355\uFF1B\u91CD\u786E\u8BA4\u4E09\u901A\u9053 --change / --ack-drifted --note / \u88F8\u91CD\u786E\u8BA4\u62D2\u7EDD\uFF1Bcloseout/doctor/status \u6D88\u8D39\u786E\u8BA4\u6001\uFF09");
   baseline.command("set").description("\u5355\u952E\u540E\u8865\u9500\u8D26/\u6CBB\u7406\u901A\u8DEF\u4FEE\u6539\uFF1A--lane <frontend|backend> --key <lane \u952E\u96C6\u95ED\u5305> --value <\u9009\u578B\u503C>\uFF08UNKNOWN \u8D77\u6B65\u8BCD\u5F62\u4E0D\u53EF\u4F5C\u503C\uFF1B\u540C\u503C\u91CD\u653E\u5E42\u7B49 NO_CHANGE \u5E76\u81EA\u6108\u53F0\u8D26\u6F0F\u9500\uFF1B\u5F02\u503C\u6539\u578B BASELINE_KEY_ALREADY_SET \u663E\u5F0F\u62D2\u7EDD\uFF1B\u786E\u8BA4\u6001\u5728\u5EA7\u65E0 --change \u2192 BASELINE_ALREADY_CONFIRMED\uFF0C\u6301 --change <CHANGE-id> \u4E14\u5BF9\u8C61\u5728\u518C\u3001lifecycle \u5408\u6CD5 \u2192 \u5199\u5165\u5E76\u8F6C pending-change\u2014\u2014\u540C\u4E00 CHANGE \u8FDE\u6539\u591A\u952E\u5168\u7A0B\u5141\u8BB8\uFF0C\u643A\u540C ref confirm \u7EC8\u7ED3\uFF09").requiredOption("--lane <lane>", "\u6280\u672F\u6808 lane\uFF08frontend | backend\uFF09").requiredOption("--key <key>", "stack.yaml \u952E\uFF08lane \u952E\u96C6\u95ED\u5305\uFF1Afrontend framework|language|build|router|state|grid|ui|css|testing\uFF1Bbackend language|framework|persistence|database|cache\uFF09").requiredOption("--value <value>", "\u9009\u578B\u503C\uFF08\u4FDD\u5B88\u8BCD\u5F62\uFF1A[A-Za-z0-9] \u8D77\u59CB\u3001[A-Za-z0-9 _./+#()-]\u3001\u2264120 \u5B57\u7B26\uFF1BUNKNOWN \u4E0D\u53EF\u4F5C\u503C\uFF09").option("--change <change-id>", "\u6CBB\u7406\u901A\u8DEF\u6388\u6743\uFF08\u4EC5\u786E\u8BA4\u6001\u5728\u5EA7\u65F6\u88AB\u6D88\u8D39\uFF09\uFF1ACHANGE.* \u5BF9\u8C61\u5728\u518C\u4E14 lifecycle \u2208 PROPOSED|CURRENT\uFF08kernel \u6821\u9A8C\uFF09\uFF1B\u5F02\u503C\u5199\u5165\u8F6C pending-change\uFF08\u8BB0\u5F55\u4FDD\u7559\uFF09\uFF0C\u643A\u540C ref confirm \u7EC8\u7ED3").option("--json", "machine-readable JSON output (\xA745)").action(async (opts, command) => {
     const outcome = await runBaselineSet(resolveDir(command), {
       lane: opts.lane,
@@ -65732,7 +67763,7 @@ function createProgram(runs, io = defaultIo) {
       asJson: command.opts().json === true
     });
   });
-  baseline.command("confirm").description('\u57FA\u7EBF\u786E\u8BA4\u65BD\u65AD\uFF08R-L gate\uFF1Bverdict + exit code\uFF09\uFF1A\u524D\u63D0 = 14 unknowns \u5168\u9500\u8D26\uFF08BASELINE_UNKNOWNS_REMAINING fail-closed \u9010\u6761\u5217\u51FA\u7F3A\u952E\uFF09\uFF1B\u52A8\u4F5C = manifest.yaml \u5199 confirmed \u786E\u8BA4\u8BB0\u5F55\uFF08at_seq \u65F6\u70B9\u951A + 24 \u6587\u4EF6\u786E\u8BA4\u8D44\u4EA7\u6E05\u5355 sha256 \u5FEB\u7167 = 2 stack.yaml + 22 md\u2014\u2014N1 \u5355\u4E00\u5206\u6BCD\uFF0Cmanifest \u4E0D\u81EA\u5F15\u7528\uFF09\uFF1B\u521D\u6B21\u786E\u8BA4\u4E0D\u9700\u8981\u4EFB\u4F55\u901A\u9053\uFF1B\u5DF2\u786E\u8BA4\u4E14 digest \u65E0\u6F02\u79FB \u2192 NO_CHANGE \u96F6\u5199\u5165\uFF1B\u91CD\u786E\u8BA4\u4E09\u901A\u9053\uFF08N2/Owner 09-06 \u8865\u88C1\u5B9A\uFF09\uFF1A--change <CHANGE-id>\uFF08\u6CBB\u7406\u901A\u8DEF\uFF1Adrifted \u8986\u76D6 / pending \u540C ref \u7EC8\u7ED3\uFF09\u6216 --ack-drifted --note "<\u7406\u7531>"\uFF08Owner \u624B\u6539\u58F0\u660E\uFF1Ajournal BASELINE_ACK \u7559\u75D5 + \u8BB0\u5F55 ack \u6807\u8BB0\uFF1BAI \u4EE3\u8DD1\u987B\u6301 Owner \u6307\u793A\uFF09\uFF1B\u88F8\u91CD\u786E\u8BA4 = BASELINE_RECONFIRM_REQUIRES_CHANGE \u663E\u5F0F\u62D2\u7EDD\uFF1Bcloseout \u6D88\u8D39\uFF1ABASELINE_NOT_CONFIRMED / BASELINE_DRIFT \u4E24\u963B\u585E\u7801').option("--change <change-id>", "\u91CD\u786E\u8BA4\u901A\u9053 1\uFF08\u6CBB\u7406\u901A\u8DEF\uFF09\uFF1ACHANGE.* \u5BF9\u8C61\u5728\u518C\u4E14 lifecycle \u2208 PROPOSED|CURRENT\uFF1Bdrifted \u91CD\u786E\u8BA4\u7684\u6388\u6743\u8986\u76D6 / pending-change \u53D8\u66F4\u6279\u7684\u540C ref \u7EC8\u7ED3").option("--ack-drifted", "\u91CD\u786E\u8BA4\u901A\u9053 2\uFF08Owner \u624B\u6539\u58F0\u660E\uFF09\uFF1A\u663E\u5F0F\u58F0\u660E\u5F53\u524D\u6F02\u79FB\u4E3A\u6388\u6743\u624B\u6539\uFF0822 \u4EFD md \u65E0\u6CBB\u7406\u5199\u547D\u4EE4\u7684\u624B\u6539/\u8865\u6587\u6863\u901A\u8DEF\uFF09\uFF1B\u987B\u4E0E --note \u540C\u7528\uFF1Bjournal \u843D BASELINE_ACK \u7559\u75D5\uFF1BAI \u4EE3\u8DD1\u987B\u6301 Owner \u6307\u793A").option("--note <note>", "\u624B\u6539\u58F0\u660E\u7406\u7531\uFF08--ack-drifted \u5FC5\u586B\uFF1B\u5355\u884C \u2264200 \u5B57\u7B26\uFF1B\u5165 manifest ack \u6BB5\u4E0E journal\uFF09").option("--json", "machine-readable JSON output (\xA745)").action(async (_opts, command) => {
+  baseline.command("confirm").description('\u57FA\u7EBF\u786E\u8BA4\u65BD\u65AD\uFF08R-L gate\uFF1Bverdict + exit code\uFF09\uFF1A\u524D\u63D0 = \u963B\u585E\u96C6\u6E05\u96F6\uFF08P-C1\uFF1Aunknowns \u53F0\u8D26\u53CC\u8BCD\u5F62\u2014\u2014\u8C41\u514D\u767B\u8BB0\u884C\u4E0D\u963B\u585E\uFF0C\u963B\u585E\u952E BASELINE_UNKNOWNS_REMAINING fail-closed \u9010\u6761\u5217\u51FA\uFF0C\u7ED3\u6784\u5316\u884C\u5F62\u72B6\u635F\u574F INVALID_STATE\uFF09\uFF1B\u52A8\u4F5C = manifest.yaml \u5199 confirmed \u786E\u8BA4\u8BB0\u5F55\uFF08at_seq \u65F6\u70B9\u951A + 25 \u6587\u4EF6\u786E\u8BA4\u8D44\u4EA7\u6E05\u5355 sha256 \u5FEB\u7167 = 2 stack.yaml + 22 md + 1 design-tokens.yaml\u2014\u2014N1 \u5355\u4E00\u5206\u6BCD\uFF0CADR-20 \u6269 25\uFF0Cmanifest \u4E0D\u81EA\u5F15\u7528\uFF09\uFF1B\u521D\u6B21\u786E\u8BA4\u4E0D\u9700\u8981\u4EFB\u4F55\u901A\u9053\uFF1B\u5DF2\u786E\u8BA4\u4E14 digest \u65E0\u6F02\u79FB \u2192 NO_CHANGE \u96F6\u5199\u5165\uFF1B\u91CD\u786E\u8BA4\u4E09\u901A\u9053\uFF08N2/Owner 09-06 \u8865\u88C1\u5B9A\uFF09\uFF1A--change <CHANGE-id>\uFF08\u6CBB\u7406\u901A\u8DEF\uFF1Adrifted \u8986\u76D6 / pending \u540C ref \u7EC8\u7ED3\uFF09\u6216 --ack-drifted --note "<\u7406\u7531>"\uFF08Owner \u624B\u6539\u58F0\u660E\uFF1Ajournal BASELINE_ACK \u7559\u75D5 + \u8BB0\u5F55 ack \u6807\u8BB0\uFF1BAI \u4EE3\u8DD1\u987B\u6301 Owner \u6307\u793A\uFF09\uFF1B\u88F8\u91CD\u786E\u8BA4 = BASELINE_RECONFIRM_REQUIRES_CHANGE \u663E\u5F0F\u62D2\u7EDD\uFF1Bcloseout \u6D88\u8D39\uFF1ABASELINE_NOT_CONFIRMED / BASELINE_DRIFT \u4E24\u963B\u585E\u7801').option("--change <change-id>", "\u91CD\u786E\u8BA4\u901A\u9053 1\uFF08\u6CBB\u7406\u901A\u8DEF\uFF09\uFF1ACHANGE.* \u5BF9\u8C61\u5728\u518C\u4E14 lifecycle \u2208 PROPOSED|CURRENT\uFF1Bdrifted \u91CD\u786E\u8BA4\u7684\u6388\u6743\u8986\u76D6 / pending-change \u53D8\u66F4\u6279\u7684\u540C ref \u7EC8\u7ED3").option("--ack-drifted", "\u91CD\u786E\u8BA4\u901A\u9053 2\uFF08Owner \u624B\u6539\u58F0\u660E\uFF09\uFF1A\u663E\u5F0F\u58F0\u660E\u5F53\u524D\u6F02\u79FB\u4E3A\u6388\u6743\u624B\u6539\uFF0822 \u4EFD md \u65E0\u6CBB\u7406\u5199\u547D\u4EE4\u7684\u624B\u6539/\u8865\u6587\u6863\u901A\u8DEF\uFF09\uFF1B\u987B\u4E0E --note \u540C\u7528\uFF1Bjournal \u843D BASELINE_ACK \u7559\u75D5\uFF1BAI \u4EE3\u8DD1\u987B\u6301 Owner \u6307\u793A").option("--note <note>", "\u624B\u6539\u58F0\u660E\u7406\u7531\uFF08--ack-drifted \u5FC5\u586B\uFF1B\u5355\u884C \u2264200 \u5B57\u7B26\uFF1B\u5165 manifest ack \u6BB5\u4E0E journal\uFF09").option("--json", "machine-readable JSON output (\xA745)").action(async (_opts, command) => {
     const opts = command.opts();
     const outcome = await runBaselineConfirm(resolveDir(command), {
       ...opts.change !== void 0 ? { change: opts.change } : {},
@@ -66751,6 +68782,17 @@ function createProgram(runs, io = defaultIo) {
       asJson: command.opts().json === true
     });
   });
+  execution.command("audit").description("\u53D8\u66F4\u8D8A\u754C\u5BA1\u8BA1\uFF08Detection \u534A\u8FB9\uFF09\uFF1Agit diff \u8D77\u59CB\u951A\u6536\u96C6\u6267\u884C\u671F\u5B9E\u9645\u53D8\u66F4\u6587\u4EF6\u96C6\uFF08--diff-base \u8C03\u7528\u65B9\u7533\u62A5\u2014\u2014execution record \u65E0 ref/seq \u951A\u5B57\u6BB5\uFF1Buntracked \u540C\u6536\uFF1B\u8DEF\u5F84\u6E05\u6D17\u6CBF recon \u679A\u4E3E\u6392\u9664\u95ED\u5305 node_modules/dist/.git/coverage/.pomaster\uFF09\u2192 KEYBINDING \u5728\u518C\u7ED1\u5B9A\u89E3\u6790 governed id\uFF08\u672A\u547D\u4E2D unmapped \u8BDA\u5B9E\u6E05\u5355\u7981\u9759\u9ED8\u4E22\u5F03\uFF1B\u65E0\u7ED1\u5B9A\u8868\u5DE5\u4F5C\u533A\u5168 unmapped \u8BDA\u5B9E\u5448\u73B0\u975E\u9519\u8BEF\uFF09\u2192 \u5BF9\u7167 execution.permit_ids \u7684 permit scope.subject_ids \u5224 in/out-of-scope\uFF08\u5224\u5377\u951A kernel checkPermit \u6210\u5458\u5224\u5B9A\u5355\u4E00\u5B9E\u73B0\uFF09\u2192 \u5BA1\u8BA1\u62A5\u544A blob + OBS \u56DE\u6267\u843D 17 sidecar\uFF08result=OBSERVED \u5E26 blob ref\uFF09+ stdout \u8D8A\u754C\u9010\u6761\u660E\u7EC6\uFF08path + \u5224\u5B9A\u4F9D\u636E\uFF09\uFF1B\u8D8A\u754C\u5B58\u5728 exit 1 \u4E0D\u4F2A\u9020\u7EFF\uFF1B\u975E git \u5DE5\u4F5C\u533A/\u951A\u7F3A\u5E2D/\u951A\u65E0\u6548 fail-closed \u96F6\u843D\u76D8\uFF08\u4E0D\u505A fs \u5FEB\u7167\u515C\u5E95\uFF09").requiredOption("--execution-id <AGX-n>", "\u6267\u884C\u8EAB\u4EFD\u951A\uFF08AGX-<\u5E74\u4EFD>-<\u5E8F\u53F7>\uFF1BOBS \u56DE\u6267 execution_id \u5FC5\u586B\u2014\u2014S1 \u7981\u81EA\u9020\u8EAB\u4EFD\uFF0C\u987B\u4E3A executions/ \u5DF2\u767B\u8BB0\u6863\u6848\uFF0C\u5DF2\u5C01\u53E3\u6267\u884C\u5141\u8BB8\u4E8B\u540E\u5BA1\u8BA1\uFF09").requiredOption("--diff-base <git-ref>", "diff \u8D77\u59CB\u951A\uFF08commit/branch/tag\u2014\u2014execution begin \u65F6\u523B\u7684\u5DE5\u4F5C\u533A\u57FA\u7EBF ref\uFF1Bexecution record \u5B9E\u8BFB\u65E0 ref/seq \u951A\u5B57\u6BB5\uFF0C\u951A\u7531\u8C03\u7528\u65B9\u7533\u62A5\uFF1A\u7F3A\u5E2D/\u65E0\u6548 = \u663E\u5F0F\u62A5\u9519\u96F6\u843D\u76D8\uFF09").option("--json", "machine-readable JSON output (\xA745)").action(async (opts, command) => {
+    const outcome = await runExecutionAudit(resolveDir(command), {
+      executionId: opts.executionId,
+      diffBase: opts.diffBase
+    });
+    record({
+      command: "execution audit",
+      outcome,
+      asJson: command.opts().json === true
+    });
+  });
   const trace = program2.command("trace").description("Execution Trace \u547D\u4EE4\u9762\uFF08\xA78/\xA714 P0.5-3\uFF09\uFF1Ashow = \u6D3E\u751F\u6295\u5F71\u7EAF\u8BFB\uFF08\u5C01\u5B58\u5728\u5EA7=\u5C01\u5B58\u5FEB\u7167+stale \u5BF9\u8D26\u663E\u5F0F\uFF1B--seal --retention <\u56DB\u6863> = \u663E\u5F0F\u7269\u5316\u5BA1\u8BA1\u5FEB\u7167\uFF09/ list = \u5C01\u5B58\u6E05\u5355\uFF1BTrace \u662F Identity \u7684\u6D3E\u751F\u6295\u5F71\u4FA7\u8F66\uFF08A19 Identity Is Not Trace\uFF09\uFF0CCLI \u96F6\u5224\u5377\u96F6 GC");
   trace.command("show").description("\u6309 AGX \u5448\u73B0 Execution Trace Manifest\uFF08\xA78.2 \u95ED\u5F62\u6001 12 \u952E\uFF09\uFF1A\u7F3A\u7701 = \u7EAF\u6295\u5F71 on-demand\uFF08journal TX_APPLIED \u5199\u8DB3\u8FF9 + evidence GRN/CLM \u6536\u636E\u2014\u2014\u96F6\u65B0\u91C7\u96C6\u5668\uFF0C\u540C state \u91CD\u653E\u5B57\u8282\u7A33\u5B9A\uFF09\uFF1B\u5C01\u5B58\u5728\u5EA7 = \u5C01\u5B58\u5FEB\u7167 + canonical \u91CD\u653E\u5BF9\u8D26\uFF08stale \u663E\u5F0F\u5448\u73B0\u975E\u9519\u8BEF\u2014\u2014\u5FEB\u7167\u4E0D\u5192\u5145\u65B0\u9C9C\uFF09\uFF1B--seal --retention <\u6863> = \u663E\u5F0F\u7269\u5316\uFF08retention \u5FC5\u586B\u6210\u5BF9\uFF1AEPHEMERAL\u2192runtime/traces \u53EF\u4E22\u5F03\uFF0CTASK/INCIDENT/AUDIT_RETENTION\u2192traces/ durable \u8FDB Git\uFF1B\u4EC5\u8BB0\u5F55\u4E0D GC\u2014\u2014\u88C1\u51B3 8 \u2461\uFF09\uFF1B\u8BCD\u5F62\u975E\u6CD5/\u672A\u767B\u8BB0\u6863\u6848/\u8BCD\u8868\u5916/\u91CD\u590D\u5C01\u5B58\u539F\u7801\u900F\u4F20\uFF08SCHEMA_INVALID/EXECUTION_NOT_FOUND/VOCAB_INVALID_VALUE/TRACE_ALREADY_SEALED\uFF09").argument("<execution-id>", "\u6267\u884C\u8EAB\u4EFD\uFF08AGX-<4\u4F4D\u5E74\u4EFD>-<\u5E8F\u53F7>\uFF1B\u7981\u81EA\u9020\u7B2C\u4E8C\u79CD EXEC-* \u8EAB\u4EFD\u2014\u2014\xA716 Case A\uFF09").option("--seal", "\u663E\u5F0F\u5C01\u5B58\uFF1A\u7269\u5316\u5F53\u524D\u6295\u5F71\u4E3A\u5BA1\u8BA1\u5FEB\u7167\uFF08\u4E0E --retention \u6210\u5BF9\u5FC5\u586B\uFF1B\u91CD\u590D\u5C01\u5B58 TRACE_ALREADY_SEALED \u663E\u5F0F\u62D2\u7EDD\uFF09").option("--retention <retention>", "\u7559\u5B58\u6863\uFF08PRD \xA78.3 \u56DB\u6863\u9010\u5B57\uFF1AEPHEMERAL | TASK_RETENTION | INCIDENT_RETENTION | AUDIT_RETENTION\uFF1B\u8BCD\u8868\u5916 VOCAB_INVALID_VALUE fail-closed\u2014\u2014\u4EC5\u8BB0\u5F55\u4E0D GC\uFF09").option("--json", "machine-readable JSON output (\xA745)").action(async (executionId, opts, command) => {
     const outcome = await runTraceShow(resolveDir(command), executionId, {
@@ -66810,6 +68852,37 @@ function createProgram(runs, io = defaultIo) {
       asJson: command.opts().json === true
     });
   });
+  const recon = program2.command("recon").description("\u5BBF\u4E3B\u4EE3\u7801\u4E8B\u5B9E recon \u7F16\u6392\u58F3\uFF08F-M5 \u9996\u6279\u4E09\u4E59 B8/B4/B1\uFF1BB10 \u4E59\uFF09\uFF1A\u679A\u4E3E \u2192 \u5206\u6790/\u91C7\u96C6 \u2192 blob+17 \u89C2\u5BDF\u56DE\u6267 sidecar \u2192 \u5448\u73B0\u2014\u2014\u4EA7\u7269\u53EA\u843D evidence/{blobs,observations}/ sidecar \u5E73\u9762\uFF0C\u96F6\u6743\u5A01\u6587\u4EF6\u5199\u53E3\u96F6 store \u4E8B\u52A1\uFF08persistObservationRecord \u9996\u4E2A\u751F\u4EA7\u6D88\u8D39\u65B9\uFF09");
+  recon.command("import-graph").description("\u5BBF\u4E3B\u6E90\u6587\u4EF6 import \u56FE\u9759\u6001\u626B\u63CF\uFF08B8 \u4E59\uFF09\uFF1AcollectSourceFiles \u5F62\u6001\u679A\u4E3E\uFF08\u8DF3\u8FC7 node_modules/dist/.git/coverage/.pomaster\uFF1B.ts/.tsx/.js/.jsx/.mjs/.cjs/.vue\uFF09\u2192 kernel analyzeImportGraph \u7EAF\u51FD\u6570\u76F4\u8C03\uFF08\u96F6\u7B2C\u4E8C\u5B9E\u73B0\uFF1Bmapping \u6052\u7A7A\u2014\u2014\u8001\u9879\u76EE\u65E0 governed id\uFF0Cunmapped \u6E05\u5355\u5373\u4EA7\u51FA\u7981\u9759\u9ED8\u4E22\u5F03\uFF09\u2192 \xA7148 \u62A5\u544A\u843D blob\uFF08persistEvidenceArtifact \u5185\u5BB9\u5BFB\u5740\uFF09\u2192 OBS \u56DE\u6267\u843D 17 sidecar\uFF08persistObservationRecord\uFF1Bresult=OBSERVED \u5E26 blob ref\u3001surface=STRUCTURAL_REALITY\u3001sensor=SENSOR.BUILD.STATIC\uFF09\u2192 \u5448\u73B0\uFF08mapping \u547D\u4E2D/externalImports/unmapped \u6E05\u5355/confidence\uFF09\uFF1B\u96F6\u6E90\u6587\u4EF6 \u2192 INCONCLUSIVE \u8D1F\u503C\u515C\u5E95\u843D\u8D26\u4E0D\u4F2A\u9020\u7EFF").requiredOption("--execution-id <AGX-n>", "\u6267\u884C\u8EAB\u4EFD\u951A\uFF08AGX-<\u5E74\u4EFD>-<\u5E8F\u53F7>\uFF1BOBS \u56DE\u6267 execution_id \u5FC5\u586B\u2014\u2014S1 \u7981\u81EA\u9020\u8EAB\u4EFD\uFF0C\u987B\u4E3A executions/ \u5DF2\u767B\u8BB0\u6863\u6848\uFF0C\u5DF2\u5C01\u53E3\u6267\u884C\u5141\u8BB8\u4E8B\u540E\u8865\u5F55\uFF09").option("--json", "machine-readable JSON output (\xA745)").action(async (opts, command) => {
+    const outcome = await runReconImportGraph(resolveDir(command), {
+      executionId: opts.executionId
+    });
+    record({
+      command: "recon import-graph",
+      outcome,
+      asJson: command.opts().json === true
+    });
+  });
+  recon.command("migrations").description("migration \u76EE\u5F55\u76D8\u70B9\uFF08B4 \u4E59\uFF09\uFF1A\u4E94\u6808\u8BCD\u5F62\u9762\u7EAF\u8BFB\u76D8\u679A\u4E3E\uFF08prisma/flyway/liquibase/alembic/django_style\u2014\u2014\u96F6\u5916\u90E8\u4F9D\u8D56\u96F6\u5DE5\u5177\u6267\u884C\uFF0Cliquibase/flyway \u5DE5\u5177\u672C\u4F53 license \u7EA2\u706F\u4E0D\u6267\u884C\uFF1B\u8DF3\u8FC7 node_modules/dist/.git/coverage/.pomaster/.venv/venv/vendor/target/build\uFF09\u2192 ENVREC \u56DE\u6267\u843D 17 sidecar\uFF08persistObservationRecord \u663E\u5F0F recordId\uFF1Bdoctor_verdict=WRONG_OR_UNVERIFIED_INSTANCE\u2014\u2014\u7EAF\u8BFB\u76D8\u76D8\u70B9\u4E0D\u786E\u8BA4\u5B9E\u4F8B\u8EAB\u4EFD\uFF09\u2192 \u5448\u73B0\uFF08\u5404\u6808\u547D\u4E2D\u8BA1\u6570 + \u6587\u4EF6\u6E05\u5355\u5168\u91CF\u96F6\u622A\u65AD\uFF09\uFF1B\u4E94\u6808\u8BCD\u5F62\u9762\u5168\u7F3A\u5E2D \u2192 NOT_RUN \u4E0D\u4F2A\u9020\u7A7A\u8DD1\u7EFF\uFF1B\u76D8\u70B9\u4E0D\u78B0 stack \u5206\u6BCD\uFF08\u96F6 stack.yaml \u5199\u53E3\uFF0C\u8BCD\u5F62\u76D8\u70B9\u975E stack \u65AD\u8A00\uFF09").requiredOption("--execution-id <AGX-n>", "\u6267\u884C\u8EAB\u4EFD\u951A\uFF08AGX-<\u5E74\u4EFD>-<\u5E8F\u53F7>\uFF1BENVREC \u56DE\u6267 execution_id \u5FC5\u586B\u2014\u2014S1 \u7981\u81EA\u9020\u8EAB\u4EFD\uFF0C\u987B\u4E3A executions/ \u5DF2\u767B\u8BB0\u6863\u6848\uFF0C\u5DF2\u5C01\u53E3\u6267\u884C\u5141\u8BB8\u4E8B\u540E\u8865\u5F55\uFF09").option("--json", "machine-readable JSON output (\xA745)").action(async (opts, command) => {
+    const outcome = await runReconMigrations(resolveDir(command), {
+      executionId: opts.executionId
+    });
+    record({
+      command: "recon migrations",
+      outcome,
+      asJson: command.opts().json === true
+    });
+  });
+  recon.command("sbom").description("SBOM \u4F9D\u8D56\u6E05\u5355\u91C7\u96C6\u817F\uFF08B1 \u4E59(a)\uFF0Ccdxgen Apache-2.0\uFF09\uFF1Adetect \u63A2 cdxgen \u5728 PATH\uFF08findExecutableOnPath \u5355\u4E00\u63A2\u6D4B\u9762\u2014\u2014\u7F3A\u5E2D \u2192 NOT_INSTALLED \u663E\u5F0F\u7F3A\u5E2D\u5E26 reason+installHint \u4E0D\u4F2A\u9020\uFF09\u2192 spawn `cdxgen -r -o <tmp>/bom.json <root>`\uFF08\u771F\u5B9E spawnSync\uFF1B64MB maxBuffer\uFF1BPATH \u5F15\u53F7\u6D88\u6BD2\uFF1Btmp \u7528 os.tmpdir \u6D3E\u751F\u8FD0\u884C\u540E\u6E05\u7406\uFF09\u2192 CycloneDX \u8BCD\u5F62\u6821\u9A8C\u56DE\u8BFB\uFF08bomFormat=CycloneDX + specVersion + components[]/dependencies[]\u2014\u2014\u89E3\u6790\u5931\u8D25/\u8BCD\u5F62\u6F02\u79FB \u2192 INCONCLUSIVE \u8D1F\u503C\u515C\u5E95\u843D\u8D26\u7981\u9ED8\u8BA4\u503C\uFF09\u2192 BOM \u539F\u6837\u5B57\u8282\u843D blob\uFF08persistEvidenceArtifact\uFF09\u2192 OBS \u56DE\u6267\u843D 17 sidecar\uFF08result=OBSERVED \u5E26 blob ref\uFF1Bsurface=STRUCTURAL_REALITY\u2014\u2014PRD \xA76.4 dependency graph \u2208 \u7ED3\u6784\u4E8B\u5B9E\u9762\uFF09\u2192 \u5448\u73B0\uFF08components/dependencies \u8BA1\u6570\uFF09\uFF1Bstack \u5019\u9009\u5316\u4E0D\u5728\u672C\u6279\uFF08Proposal \u524D\u7F6E\uFF09\u2014\u2014\u96F6 StackObservationCandidate \u89E6\u78B0\u96F6 stack.yaml \u5199\u53E3").requiredOption("--execution-id <AGX-n>", "\u6267\u884C\u8EAB\u4EFD\u951A\uFF08AGX-<\u5E74\u4EFD>-<\u5E8F\u53F7>\uFF1BOBS \u56DE\u6267 execution_id \u5FC5\u586B\u2014\u2014S1 \u7981\u81EA\u9020\u8EAB\u4EFD\uFF0C\u987B\u4E3A executions/ \u5DF2\u767B\u8BB0\u6863\u6848\uFF0C\u5DF2\u5C01\u53E3\u6267\u884C\u5141\u8BB8\u4E8B\u540E\u8865\u5F55\uFF09").option("--json", "machine-readable JSON output (\xA745)").action(async (opts, command) => {
+    const outcome = await runReconSbom(resolveDir(command), {
+      executionId: opts.executionId
+    });
+    record({
+      command: "recon sbom",
+      outcome,
+      asJson: command.opts().json === true
+    });
+  });
   return program2;
 }
 function collectValues(value, previous) {
@@ -66817,12 +68890,12 @@ function collectValues(value, previous) {
 }
 function readLineFromStdin() {
   const rl = createInterface({ input: process.stdin });
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     rl.once("line", (line) => {
-      resolve3(line);
+      resolve4(line);
       rl.close();
     });
-    rl.once("close", () => resolve3(null));
+    rl.once("close", () => resolve4(null));
   });
 }
 function takeKeyToken(buffer) {
@@ -66840,7 +68913,7 @@ function takeKeyToken(buffer) {
   return head === void 0 ? null : { token: head, rest: buffer.slice(1) };
 }
 function pumpStdinKeys(handler) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let buffer = "";
     const cleanup = () => {
       process.stdin.removeListener("data", onData);
@@ -66849,7 +68922,7 @@ function pumpStdinKeys(handler) {
     };
     const onDone = () => {
       cleanup();
-      resolve3();
+      resolve4();
     };
     const onData = (chunk) => {
       buffer += typeof chunk === "string" ? chunk : chunk.toString("utf8");
@@ -66860,7 +68933,7 @@ function pumpStdinKeys(handler) {
         buffer = token.rest;
         if (!handler(token.token)) {
           cleanup();
-          resolve3();
+          resolve4();
           return;
         }
       }