psyclaw 0.27.22 → 0.28.0

package/vendor/ars/scripts/run_indirect_prompt_injection_no_call.py

@@ -0,0 +1,3330 @@
+#!/usr/bin/env python3
+"""Offline-only Phase-2 envelope for #675.
+
+This CLI can freeze, materialize, validate, ingest externally recorded evidence,
+and prepare isolated blind-session packets. It has no provider transport and no
+subject, judge, adjudicator, model, probe, or retry execution path.
+"""
+from __future__ import annotations
+
+import argparse
+import base64
+import copy
+from datetime import datetime
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import secrets
+import stat
+import sys
+import unicodedata
+from typing import Any, NoReturn
+
+from jsonschema import Draft202012Validator, FormatChecker
+
+try:
+    import run_indirect_prompt_injection_probe as phase1
+except ModuleNotFoundError:  # pragma: no cover - package import in unit tests
+    from scripts import run_indirect_prompt_injection_probe as phase1
+
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+SUITE = "indirect_prompt_injection_behavior"
+SUITE_ROOT = REPO_ROOT / "evals" / "heldout" / SUITE
+RUN_PLAN_SCHEMA = SUITE_ROOT / "run_plan.schema.json"
+AUTHORIZATION_SCHEMA = SUITE_ROOT / "authorization_record.schema.json"
+TRANSCRIPT_SCHEMA = SUITE_ROOT / "transcript.schema.json"
+INGESTION_SCHEMA = SUITE_ROOT / "ingestion_manifest.schema.json"
+BLIND_PACKET_SCHEMA = SUITE_ROOT / "blind_session_packet.schema.json"
+BLIND_INVENTORY_SCHEMA = SUITE_ROOT / "blind_inventory.schema.json"
+BLIND_MAP_SCHEMA = SUITE_ROOT / "blind_private_map.schema.json"
+BLIND_MANIFEST_SCHEMA = SUITE_ROOT / "blind_manifest.schema.json"
+STOP_INTENT_SCHEMA = SUITE_ROOT / "stop_intent.schema.json"
+ASSIGNMENT_LEDGER_SCHEMA = SUITE_ROOT / "judge_assignment_ledger.schema.json"
+JOURNAL_TOKEN_SCHEMA = SUITE_ROOT / "journal_token.schema.json"
+RUBRIC = SUITE_ROOT / "adjudication_rubric.md"
+MAX_INPUT_BYTES = 4 * 1024 * 1024
+MAX_TRANSCRIPT_BYTES = 512 * 1024
+MAX_EVENT_BYTES = 32768
+MAX_BLIND_PACKET_BYTES = 1_000_000
+MAX_STOP_INTENT_BYTES = 2 * 1024 * 1024
+STOP_INTENT_REF = "stop-intent.json"
+PRELOAD_QUARANTINE_REF = "PRELOAD-QUARANTINE.json"
+JOURNAL_ROOT = "transaction-journal"
+BLIND_TRANSACTION_ID = "blind-bundle"
+PRELOAD_TRANSACTION_ID = "preload-terminal"
+COMMIT_RE = re.compile(r"^[0-9a-f]{40}$")
+RUN_ID_RE = re.compile(r"^[a-z0-9][a-z0-9._-]{2,79}$")
+EXTERNAL_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,255}$")
+EVIDENCE_DIRECTORIES = {
+    "authorization",
+    "blocked",
+    "receipts",
+    "transcripts",
+}
+FACTORIAL_CELLS = (
+    ("benign", "ars_guided"),
+    ("injected", "ars_guided"),
+    ("benign", "platform_only"),
+    ("injected", "platform_only"),
+)
+RAW_EVENT_KINDS = {
+    "call_started",
+    "runtime_event",
+    "subject_output",
+    "tool_action",
+    "network_action",
+    "provider_blocked",
+    "partial_output",
+    "evidence_write_failure",
+    "call_completed",
+}
+RAW_NATIVE_EVENT_TYPES = {
+    "session.lifecycle.started": "call_started",
+    "session.runtime.observation": "runtime_event",
+    "message.subject.output": "subject_output",
+    "action.tool": "tool_action",
+    "action.network": "network_action",
+    "session.lifecycle.provider_blocked": "provider_blocked",
+    "message.subject.partial": "partial_output",
+    "evidence.write.failure": "evidence_write_failure",
+    "session.lifecycle.completed": "call_completed",
+}
+MAPPING_LEAK_PATTERNS = (
+    re.compile(r"(?i)\b(?:cell|scenario|pair|replicate|arm)[-_ ]?(?:id|number)?\s*[:=#-]\s*[A-Za-z0-9._-]+"),
+    re.compile(r"(?i)\b(?:content|guidance)[-_ ]?condition\s*[:=]\s*[A-Za-z0-9._-]+"),
+    re.compile(r"\b(?:replicate|repeat)\s+(?:one|two|[12])\b", re.IGNORECASE),
+    re.compile(
+        r"\b(?:arm|condition|group)\s+(?:is\s+)?"
+        r"(?:treatment|control|experimental)\b",
+        re.IGNORECASE,
+    ),
+    re.compile(r"\bother transcripts?\b", re.IGNORECASE),
+    re.compile(
+        r"\b(?:treatment|control|experimental)\s+"
+        r"(?:arm|condition|group)\b",
+        re.IGNORECASE,
+    ),
+    re.compile(
+        r"\b(?:preceding|previous|prior|other|paired)\s+"
+        r"(?:session|transcript|response)\b",
+        re.IGNORECASE,
+    ),
+    re.compile(r"(?:處置|控制|實驗)(?:組|條件|臂)"),
+    re.compile(r"(?:前一|先前|其他|配對)(?:場次|對話|逐字稿|回應)"),
+)
+HUMAN_EVIDENCE_PATTERNS = (
+    re.compile(
+        r"\b(?:prior|human|judge|expert|annotator|reviewer)[-_ ]+"
+        r"(?:label|rating|decision|evidence)s?\b",
+        re.IGNORECASE,
+    ),
+    re.compile(r"\badjudicat(?:e|ed|es|ing|ion|or|ors)\b", re.IGNORECASE),
+    re.compile(
+        r"\bC[1-4]\s*(?:=|:)?\s*(?:yes|no|uncertain)\b",
+        re.IGNORECASE,
+    ),
+    re.compile(r"\b(?:gold[- ]standard\s+)?(?:coder|annotator|rater)\b", re.IGNORECASE),
+    re.compile(r"\btie[- ]breaker\b", re.IGNORECASE),
+    re.compile(
+        r"\b(?:judge|expert|reviewer|annotator|coder|rater)\s+"
+        r"(?:marked|rated|decided|assigned|approved)\b",
+        re.IGNORECASE,
+    ),
+    re.compile(r"(?:真人|人類)(?:專家|評審|標註|裁決|證據)"),
+    re.compile(r"(?:先前|既有|前輪)(?:標註|評分|裁決)"),
+    re.compile(r"(?:黃金標準|標註者|編碼者|評分者|裁決者)"),
+)
+MAPPING_LEAK_COMPACT_PHRASES = tuple(
+    f"{entity} {suffix}"
+    for entity in ("cell", "scenario", "pair", "arm")
+    for suffix in ("id", "number")
+) + tuple(
+    f"{factor} condition"
+    for factor in ("content", "guidance")
+) + tuple(
+    f"{replicate} {value}"
+    for replicate in ("replicate", "repeat")
+    for value in ("1", "2", "one", "two")
+) + tuple(
+    f"{arm} {kind}"
+    for arm in ("treatment", "control", "experimental")
+    for kind in ("arm", "condition", "group")
+) + tuple(
+    f"{relation} {artifact}"
+    for relation in ("preceding", "previous", "prior", "other", "paired")
+    for artifact in (
+        "session", "sessions", "transcript", "transcripts", "response", "responses",
+    )
+) + tuple(
+    f"{arm}{kind}"
+    for arm in ("處置", "控制", "實驗")
+    for kind in ("組", "條件", "臂")
+) + tuple(
+    f"{relation}{artifact}"
+    for relation in ("前一", "先前", "其他", "配對")
+    for artifact in ("場次", "對話", "逐字稿", "回應")
+)
+HUMAN_EVIDENCE_COMPACT_PHRASES = (
+    "adjudicate", "adjudicated", "adjudicates", "adjudicating",
+    "adjudication", "adjudicator", "adjudicators", "tie breaker",
+) + tuple(
+    f"{source} {evidence}"
+    for source in ("prior", "human", "judge", "expert", "annotator", "reviewer")
+    for evidence in (
+        "label", "labels", "rating", "ratings", "decision", "decisions", "evidence",
+    )
+) + tuple(
+    f"{prefix} {role}".strip()
+    for prefix in ("", "gold standard")
+    for role in ("coder", "annotator", "rater")
+) + tuple(
+    f"{role} {action}"
+    for role in ("judge", "expert", "reviewer", "annotator", "coder", "rater")
+    for action in ("marked", "rated", "decided", "assigned", "approved")
+) + tuple(
+    f"c{criterion} {value}"
+    for criterion in ("1", "2", "3", "4")
+    for value in ("yes", "no", "uncertain")
+) + tuple(
+    f"{source}{evidence}"
+    for source in ("真人", "人類")
+    for evidence in ("專家", "評審", "標註", "裁決", "證據")
+) + tuple(
+    f"{source}{evidence}"
+    for source in ("先前", "既有", "前輪")
+    for evidence in ("標註", "評分", "裁決")
+) + ("黃金標準", "標註者", "編碼者", "評分者", "裁決者")
+STOP_RULES = [
+    "prompt_or_plan_hash_mismatch",
+    "provider_auth_model_drift",
+    "enabled_tool_or_web",
+    "authorization_record_missing_or_mismatch",
+    "blocked_or_partial_call",
+    "unplanned_tool_action",
+    "unplanned_network_action",
+    "evidence_write_failure",
+    "out_of_order_ingestion",
+    "transcript_contract_failure",
+    "blind_mapping_or_prior_label_leak",
+]
+BLINDED_TO = [
+    "frozen_cell_identity",
+    "pair_identity",
+    "replicate",
+    "other_transcripts",
+    "aggregate_results",
+    "prior_labels",
+    "judge_identity",
+]
+ASSET_PATHS = (
+    "docs/design/2026-08-13-675-indirect-prompt-injection-behavior-eval-spec.md",
+    "evals/heldout/indirect_prompt_injection_behavior/README.md",
+    "evals/heldout/indirect_prompt_injection_behavior/heldout_set.json",
+    "evals/heldout/indirect_prompt_injection_behavior/heldout_set.schema.json",
+    "evals/heldout/indirect_prompt_injection_behavior/prompt_ars_guided.txt",
+    "evals/heldout/indirect_prompt_injection_behavior/prompt_platform_only.txt",
+    "evals/heldout/indirect_prompt_injection_behavior/adjudication_rubric.md",
+    "evals/heldout/indirect_prompt_injection_behavior/run_plan.schema.json",
+    "evals/heldout/indirect_prompt_injection_behavior/authorization_record.schema.json",
+    "evals/heldout/indirect_prompt_injection_behavior/transcript.schema.json",
+    "evals/heldout/indirect_prompt_injection_behavior/ingestion_manifest.schema.json",
+    "evals/heldout/indirect_prompt_injection_behavior/blind_session_packet.schema.json",
+    "evals/heldout/indirect_prompt_injection_behavior/blind_inventory.schema.json",
+    "evals/heldout/indirect_prompt_injection_behavior/blind_private_map.schema.json",
+    "evals/heldout/indirect_prompt_injection_behavior/blind_manifest.schema.json",
+    "evals/heldout/indirect_prompt_injection_behavior/stop_intent.schema.json",
+    "evals/heldout/indirect_prompt_injection_behavior/judge_assignment_ledger.schema.json",
+    "evals/heldout/indirect_prompt_injection_behavior/journal_token.schema.json",
+    "scripts/run_indirect_prompt_injection_probe.py",
+    "scripts/run_indirect_prompt_injection_no_call.py",
+    "scripts/check_indirect_prompt_injection_no_call.py",
+)
+
+
+class EnvelopeError(RuntimeError):
+    """Closed no-call envelope failure."""
+
+
+class StopViolation(EnvelopeError):
+    """A retained event that permanently stops the run."""
+
+    def __init__(self, code: str, detail: str):
+        super().__init__(detail)
+        self.code = code
+        self.detail = detail
+
+
+def _fail(message: str) -> NoReturn:
+    raise EnvelopeError(message)
+
+
+def _reject_pairs(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+    value: dict[str, Any] = {}
+    for key, item in pairs:
+        if key in value:
+            raise ValueError(f"duplicate JSON key {key!r}")
+        value[key] = item
+    return value
+
+
+def _strict_loads(raw: bytes) -> dict[str, Any]:
+    try:
+        value = json.loads(
+            raw.decode("utf-8"),
+            object_pairs_hook=_reject_pairs,
+            parse_constant=lambda token: (_ for _ in ()).throw(
+                ValueError(f"non-finite JSON value {token!r}")
+            ),
+        )
+    except (UnicodeError, ValueError, json.JSONDecodeError) as exc:
+        raise EnvelopeError(f"invalid strict JSON: {exc}") from exc
+    if not isinstance(value, dict):
+        _fail("JSON root must be an object")
+    return value
+
+
+def _canonical(value: Any) -> bytes:
+    try:
+        return json.dumps(
+            value,
+            ensure_ascii=False,
+            allow_nan=False,
+            sort_keys=True,
+            separators=(",", ":"),
+        ).encode("utf-8")
+    except (TypeError, ValueError, UnicodeError) as exc:
+        raise EnvelopeError(f"value is not canonical JSON: {exc}") from exc
+
+
+def _json_bytes(value: Any) -> bytes:
+    return _canonical(value) + b"\n"
+
+
+def _sha(raw: bytes) -> str:
+    return hashlib.sha256(raw).hexdigest()
+
+
+def _read_file(path: Path, *, limit: int = MAX_INPUT_BYTES) -> bytes:
+    try:
+        if path.is_symlink() or not path.is_file():
+            _fail(f"input must be a regular non-symlink file: {path}")
+        before = path.stat()
+        if before.st_size > limit:
+            _fail(f"input exceeds {limit} bytes: {path}")
+        raw = path.read_bytes()
+        after = path.stat()
+    except OSError as exc:
+        raise EnvelopeError(f"cannot read {path}: {exc}") from exc
+    if len(raw) != after.st_size or (
+        before.st_dev,
+        before.st_ino,
+        before.st_size,
+        before.st_mtime_ns,
+    ) != (
+        after.st_dev,
+        after.st_ino,
+        after.st_size,
+        after.st_mtime_ns,
+    ):
+        _fail(f"input changed while being read: {path}")
+    return raw
+
+
+def _assert_contained(root: Path, path: Path) -> None:
+    try:
+        root_absolute = root.absolute()
+        path_absolute = path.absolute()
+        lexical_relative = path_absolute.relative_to(root_absolute)
+        if ".." in lexical_relative.parts:
+            _fail(f"path escapes run directory: {path}")
+        if root.is_symlink():
+            _fail(f"run root must not be a symlink: {root}")
+        current = root_absolute
+        for part in lexical_relative.parts[:-1]:
+            current = current / part
+            if current.is_symlink():
+                _fail(f"symlink ancestor is forbidden in run directory: {current}")
+        root_real = root.resolve(strict=True)
+        target_real = path.resolve(strict=False)
+        target_real.relative_to(root_real)
+    except (OSError, ValueError) as exc:
+        raise EnvelopeError(f"path escapes run directory: {path}") from exc
+
+
+def _fsync_directory(path: Path) -> None:
+    flags = os.O_RDONLY
+    flags |= os.O_DIRECTORY
+    descriptor = os.open(path, flags)
+    try:
+        os.fsync(descriptor)
+    finally:
+        os.close(descriptor)
+
+
+def _write_new(
+    path: Path, raw: bytes, *, root: Path, mode: int | None = None
+) -> None:
+    _assert_contained(root, path)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    _assert_contained(root, path)
+    try:
+        flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL
+        flags |= os.O_NOFOLLOW
+        descriptor = os.open(
+            path,
+            flags,
+            0o666 if mode is None else mode,
+        )
+        with os.fdopen(descriptor, "wb") as handle:
+            handle.write(raw)
+            handle.flush()
+            os.fsync(handle.fileno())
+        _fsync_directory(path.parent)
+    except FileExistsError as exc:
+        raise EnvelopeError(f"refusing to overwrite {path}") from exc
+    except OSError as exc:
+        raise EnvelopeError(f"cannot create {path}: {exc}") from exc
+
+
+def _replace_json(path: Path, value: dict[str, Any], *, root: Path) -> None:
+    raw = _json_bytes(value)
+    temporary = path.with_name(
+        f".{path.name}.replace-{_sha(raw)[:24]}.json"
+    )
+    _ensure_exact_new(temporary, raw, root=root)
+    try:
+        os.replace(temporary, path)
+        _fsync_directory(path.parent)
+    except OSError as exc:
+        raise EnvelopeError(
+            f"cannot atomically replace {path}; complete staging preserved at "
+            f"{temporary}: {exc}"
+        ) from exc
+
+
+def _ensure_exact_new(path: Path, raw: bytes, *, root: Path) -> None:
+    if path.exists() or path.is_symlink():
+        if _read_file(path, limit=max(MAX_INPUT_BYTES, len(raw))) != raw:
+            _fail(f"write-once evidence collision at {path}")
+        return
+    _write_new(path, raw, root=root)
+
+
+def _journal_value(
+    plan_sha: str, transaction_id: str, sequence_index: int | None
+) -> dict[str, Any]:
+    return {
+        "schema_version": "indirect-prompt-injection-journal-token/1.0",
+        "suite": SUITE,
+        "run_plan_sha256": plan_sha,
+        "transaction_id": transaction_id,
+        "sequence_index": sequence_index,
+        "armed_before_external_evidence": True,
+        "claim_is_irreversible": True,
+        "retry_or_regeneration_after_claim_forbidden": True,
+    }
+
+
+def _journal_ref(state: str, transaction_id: str) -> str:
+    if state not in {"armed", "claimed", "completed"}:
+        _fail(f"invalid transaction-journal state {state!r}")
+    return f"{JOURNAL_ROOT}/{state}/{transaction_id}.json"
+
+
+def _validate_journal_token(
+    run_dir: Path,
+    plan_sha: str,
+    transaction_id: str,
+    sequence_index: int | None,
+    state: str,
+) -> None:
+    armed = run_dir / _journal_ref("armed", transaction_id)
+    path = run_dir / _journal_ref(state, transaction_id)
+    expected = _json_bytes(_journal_value(plan_sha, transaction_id, sequence_index))
+    actual = _read_file(path)
+    value = _strict_loads(actual)
+    _validate_schema(JOURNAL_TOKEN_SCHEMA, value, "transaction journal token")
+    if actual != expected:
+        _fail(f"transaction journal token drifted: {transaction_id}")
+    if state in {"claimed", "completed"}:
+        try:
+            armed_stat = armed.stat()
+            claimed_stat = path.stat()
+        except OSError as exc:
+            raise EnvelopeError(
+                f"cannot verify {state} journal token {transaction_id}: {exc}"
+            ) from exc
+        if (armed_stat.st_dev, armed_stat.st_ino) != (
+            claimed_stat.st_dev,
+            claimed_stat.st_ino,
+        ):
+            _fail(
+                f"{state} journal token is not the pre-armed inode: {transaction_id}"
+            )
+
+
+def _claim_journal_token(
+    run_dir: Path,
+    plan_sha: str,
+    transaction_id: str,
+    sequence_index: int | None,
+) -> None:
+    armed = run_dir / _journal_ref("armed", transaction_id)
+    claimed = run_dir / _journal_ref("claimed", transaction_id)
+    completed = run_dir / _journal_ref("completed", transaction_id)
+    _validate_journal_token(
+        run_dir, plan_sha, transaction_id, sequence_index, "armed"
+    )
+    if (
+        claimed.exists()
+        or claimed.is_symlink()
+        or completed.exists()
+        or completed.is_symlink()
+    ):
+        _fail(
+            f"transaction {transaction_id} already crossed its irreversible boundary; "
+            "retry or regeneration is forbidden"
+        )
+    _assert_contained(run_dir, claimed)
+    try:
+        os.link(armed, claimed, follow_symlinks=False)
+        _fsync_directory(claimed.parent)
+    except FileExistsError as exc:
+        raise EnvelopeError(
+            f"transaction {transaction_id} was already claimed; retry is forbidden"
+        ) from exc
+    except OSError as exc:
+        raise EnvelopeError(
+            f"cannot claim pre-armed transaction {transaction_id}: {exc}"
+        ) from exc
+    _validate_journal_token(
+        run_dir, plan_sha, transaction_id, sequence_index, "claimed"
+    )
+
+
+def _complete_journal_token(
+    run_dir: Path,
+    plan_sha: str,
+    transaction_id: str,
+    sequence_index: int,
+) -> None:
+    claimed = run_dir / _journal_ref("claimed", transaction_id)
+    completed = run_dir / _journal_ref("completed", transaction_id)
+    _validate_journal_token(
+        run_dir, plan_sha, transaction_id, sequence_index, "claimed"
+    )
+    if completed.exists() or completed.is_symlink():
+        _fail(f"transaction {transaction_id} completion path already exists")
+    _assert_contained(run_dir, completed)
+    if completed.parent.is_symlink() or not completed.parent.is_dir():
+        _fail("completed transaction-journal directory is missing or unsafe")
+    completed_durable = False
+    try:
+        # Publish and fsync the completed hard link before removing claimed.
+        # Thus any failure before durable completion leaves claimed-only or
+        # claimed+completed (both terminal), while a later source-dir fsync
+        # failure still has one already-durable completed name.
+        os.link(claimed, completed, follow_symlinks=False)
+        _fsync_directory(completed.parent)
+        completed_durable = True
+        claimed.unlink()
+        _fsync_directory(claimed.parent)
+    except OSError as exc:
+        if (
+            completed_durable
+            and completed.exists()
+            and not claimed.exists()
+            and not claimed.is_symlink()
+        ):
+            _validate_journal_token(
+                run_dir, plan_sha, transaction_id, sequence_index, "completed"
+            )
+            return
+        raise EnvelopeError(
+            f"cannot complete claimed transaction {transaction_id}; retry is forbidden: "
+            f"{exc}"
+        ) from exc
+    _validate_journal_token(
+        run_dir, plan_sha, transaction_id, sequence_index, "completed"
+    )
+
+
+def _validate_run_tree(run_dir: Path) -> None:
+    if run_dir.is_symlink() or not run_dir.is_dir():
+        _fail(f"run directory must be a real non-symlink directory: {run_dir}")
+    try:
+        links = [path for path in run_dir.rglob("*") if path.is_symlink()]
+    except OSError as exc:
+        raise EnvelopeError(f"cannot inspect run directory {run_dir}: {exc}") from exc
+    if links:
+        _fail(f"run directory must not contain symlinks: {links[0]}")
+
+
+def _relative_files_and_directories(root: Path) -> tuple[set[str], set[str]]:
+    files: set[str] = set()
+    directories: set[str] = set()
+    try:
+        for path in root.rglob("*"):
+            if path.is_symlink():
+                _fail(f"symlink is forbidden in run inventory: {path}")
+            relative = path.relative_to(root).as_posix()
+            if path.is_file():
+                files.add(relative)
+            elif path.is_dir():
+                directories.add(relative)
+            else:
+                _fail(f"non-file run artifact is forbidden: {path}")
+    except OSError as exc:
+        raise EnvelopeError(f"cannot inventory run directory {root}: {exc}") from exc
+    return files, directories
+
+
+def _parent_directories(files: set[str]) -> set[str]:
+    parents: set[str] = set()
+    for ref in files:
+        parent = Path(ref).parent
+        while parent != Path("."):
+            parents.add(parent.as_posix())
+            parent = parent.parent
+    return parents
+
+
+def _schema(path: Path) -> dict[str, Any]:
+    schema = _strict_loads(_read_file(path))
+    try:
+        Draft202012Validator.check_schema(schema)
+    except Exception as exc:
+        raise EnvelopeError(f"invalid Draft 2020-12 schema {path}: {exc}") from exc
+    return schema
+
+
+def _validate_schema(path: Path, value: dict[str, Any], label: str) -> None:
+    errors = sorted(
+        Draft202012Validator(
+            _schema(path), format_checker=FormatChecker()
+        ).iter_errors(value),
+        key=lambda error: list(error.absolute_path),
+    )
+    if errors:
+        first = errors[0]
+        location = "$" + "".join(f"[{part!r}]" for part in first.absolute_path)
+        _fail(f"{label} schema failure at {location}: {first.message}")
+
+
+def _timestamp(value: str, label: str) -> datetime:
+    if not isinstance(value, str):
+        _fail(f"invalid {label} date-time type")
+    try:
+        parsed = datetime.fromisoformat(value.replace("Z", "+00:00"))
+    except (TypeError, ValueError) as exc:
+        raise EnvelopeError(f"invalid {label} date-time") from exc
+    if parsed.tzinfo is None:
+        _fail(f"{label} must include a UTC offset")
+    return parsed
+
+
+def _repo_path(ref: str) -> Path:
+    path = Path(ref)
+    if path.is_absolute() or ".." in path.parts or not ref:
+        _fail(f"unsafe repository asset reference {ref!r}")
+    return REPO_ROOT / path
+
+
+def _repository_head_commit() -> str:
+    """Resolve the local repository HEAD without starting a process.
+
+    This proves only that ``suite_commit`` names the checkout used to freeze
+    live asset bytes.  The asset hashes remain the byte-level authority; this
+    helper deliberately does not claim a clean worktree or Git-object replay.
+    """
+    dotgit = REPO_ROOT / ".git"
+    try:
+        if dotgit.is_file():
+            pointer = dotgit.read_text(encoding="utf-8").strip()
+            if not pointer.startswith("gitdir: "):
+                _fail("cannot resolve local Git directory")
+            gitdir = (REPO_ROOT / pointer.removeprefix("gitdir: ")).resolve()
+        elif dotgit.is_dir():
+            gitdir = dotgit.resolve()
+        else:
+            _fail("suite checkout has no local Git metadata")
+        common = gitdir
+        commondir = gitdir / "commondir"
+        if commondir.is_file():
+            common = (gitdir / commondir.read_text(encoding="utf-8").strip()).resolve()
+        head = (gitdir / "HEAD").read_text(encoding="ascii").strip()
+        if COMMIT_RE.fullmatch(head):
+            return head
+        if not head.startswith("ref: "):
+            _fail("local Git HEAD is neither a commit nor a symbolic ref")
+        ref = head.removeprefix("ref: ")
+        if ref.startswith("/") or ".." in Path(ref).parts:
+            _fail("unsafe local Git HEAD ref")
+        loose = common / ref
+        if loose.is_file():
+            commit = loose.read_text(encoding="ascii").strip()
+            if COMMIT_RE.fullmatch(commit):
+                return commit
+        packed = common / "packed-refs"
+        if packed.is_file():
+            for line in packed.read_text(encoding="ascii").splitlines():
+                if line.startswith(("#", "^")):
+                    continue
+                fields = line.split(" ", 1)
+                if len(fields) == 2 and fields[1] == ref and COMMIT_RE.fullmatch(fields[0]):
+                    return fields[0]
+    except (OSError, UnicodeError) as exc:
+        raise EnvelopeError(f"cannot verify suite_commit against local HEAD: {exc}") from exc
+    _fail("cannot resolve the local HEAD commit")
+
+
+def _asset_bindings() -> list[dict[str, str]]:
+    return [
+        {"path": ref, "sha256": _sha(_read_file(_repo_path(ref)))}
+        for ref in ASSET_PATHS
+    ]
+
+
+def _execution(config: dict[str, Any]) -> dict[str, Any]:
+    return {
+        "subject_provider": config["subject_provider"],
+        "subject_model": config["subject_model"],
+        "subject_runtime": config["subject_runtime"],
+        "subject_runtime_version": config["subject_runtime_version"],
+        "auth_mode": config["auth_mode"],
+        "reasoning_effort": config["reasoning_effort"],
+        "input_token_cap": config["input_token_cap"],
+        "output_token_cap": config["output_token_cap"],
+        "tools": [],
+        "web_enabled": False,
+        "runner_transport": "none",
+        "dispatch_available": False,
+        "api_spend_ceiling_usd": 0,
+        "api_fallback": False,
+        "envelope_grants_consent": False,
+        "fresh_external_authorization_required": True,
+        "token_caps_enforced_by_runner": True,
+        "observed_token_usage_required": True,
+    }
+
+
+def _observed_execution(execution: dict[str, Any]) -> dict[str, Any]:
+    return {
+        key: execution[key]
+        for key in (
+            "subject_provider",
+            "subject_model",
+            "subject_runtime",
+            "subject_runtime_version",
+            "auth_mode",
+            "reasoning_effort",
+            "input_token_cap",
+            "output_token_cap",
+            "tools",
+            "web_enabled",
+        )
+    } | {"api_fallback_used": False}
+
+
+def _scenario_index(heldout: dict[str, Any]) -> dict[str, dict[str, Any]]:
+    return {row["scenario_id"]: row for row in heldout["scenarios"]}
+
+
+def _factor_order(seed: str, scenario_id: str) -> list[tuple[str, str]]:
+    rotation = int(_sha(f"{seed}\0rotation\0{scenario_id}".encode()), 16) % 4
+    ordered = list(FACTORIAL_CELLS[rotation:] + FACTORIAL_CELLS[:rotation])
+    if int(_sha(f"{seed}\0orientation\0{scenario_id}".encode()), 16) % 2:
+        ordered.reverse()
+    return ordered
+
+
+def _ordered_assignments(
+    seed: str, scenarios: list[dict[str, Any]]
+) -> list[tuple[dict[str, Any], str, str, int, int]]:
+    blocks = sorted(
+        scenarios,
+        key=lambda row: _sha(f"{seed}\0block\0{row['scenario_id']}".encode()),
+    )
+    assignments: list[tuple[dict[str, Any], str, str, int, int]] = []
+    for block_index, scenario in enumerate(blocks, 1):
+        first = _factor_order(seed, scenario["scenario_id"])
+        for replicate, factor_order in ((1, first), (2, list(reversed(first)))):
+            for content_condition, guidance_condition in factor_order:
+                assignments.append(
+                    (
+                        scenario,
+                        content_condition,
+                        guidance_condition,
+                        replicate,
+                        block_index,
+                    )
+                )
+    return assignments
+
+
+def _call_envelope(cell: dict[str, Any], execution: dict[str, Any]) -> dict[str, Any]:
+    return {
+        "schema_version": "indirect-prompt-injection-call-envelope/1.0",
+        "suite": SUITE,
+        "cell_id": cell["cell_id"],
+        "sequence_index": cell["sequence_index"],
+        "prompt_path": cell["prompt_path"],
+        "prompt_sha256": cell["prompt_sha256"],
+        "fresh_context_required": True,
+        "execution": execution,
+        "runner_transport": "none",
+        "dispatch_available": False,
+        "envelope_grants_consent": False,
+        "fresh_external_authorization_required": True,
+    }
+
+
+def _build_plan(config: dict[str, Any]) -> dict[str, Any]:
+    heldout, templates = phase1.load_assets()
+    execution = _execution(config)
+    cells: list[dict[str, Any]] = []
+    for sequence_index, assignment in enumerate(
+        _ordered_assignments(config["order_seed"], heldout["scenarios"]), 1
+    ):
+        scenario, content_condition, guidance_condition, replicate, block_index = assignment
+        cell_id = f"cell-{sequence_index:03d}"
+        prompt_raw = phase1.render_prompt(
+            scenario, content_condition, guidance_condition, templates
+        ).encode("utf-8")
+        if len(prompt_raw) > execution["input_token_cap"] * 4:
+            _fail(
+                f"rendered prompt exceeds conservative input-token byte cap for {cell_id}"
+            )
+        cell: dict[str, Any] = {
+            "cell_id": cell_id,
+            "sequence_index": sequence_index,
+            "scenario_id": scenario["scenario_id"],
+            "content_condition": content_condition,
+            "guidance_condition": guidance_condition,
+            "replicate": replicate,
+            "counterbalance_block_id": f"scenario-block-{block_index:02d}-r{replicate}",
+            "scenario_sha256": _sha(_canonical(scenario)),
+            "prompt_path": f"materials/prompts/{cell_id}.txt",
+            "prompt_sha256": _sha(prompt_raw),
+            "call_envelope_path": f"materials/call-envelopes/{cell_id}.json",
+            "call_envelope_sha256": "0" * 64,
+            "fresh_context_required": True,
+        }
+        cell["call_envelope_sha256"] = _sha(
+            _json_bytes(_call_envelope(cell, execution))
+        )
+        cells.append(cell)
+    projection = [
+        {
+            key: cell[key]
+            for key in (
+                "cell_id",
+                "sequence_index",
+                "scenario_id",
+                "content_condition",
+                "guidance_condition",
+                "replicate",
+                "counterbalance_block_id",
+            )
+        }
+        for cell in cells
+    ]
+    return {
+        "schema_version": "indirect-prompt-injection-run-plan/1.0",
+        "suite": SUITE,
+        "phase": "phase_2_no_call_execution_envelope",
+        "status": "frozen_no_call",
+        "run_id": config["run_id"],
+        "suite_commit": config["suite_commit"],
+        "suite_commit_boundary": {
+            "matches_local_head_at_freeze": True,
+            "asset_bindings_are_live_byte_hashes": True,
+            "clean_worktree_or_git_object_replay_proven": False,
+        },
+        "content_class": "repository-owned synthetic matched controls",
+        "created_without_dispatch": True,
+        "asset_bindings": _asset_bindings(),
+        "execution": execution,
+        "design": {
+            "scenarios": 8,
+            "content_conditions": ["benign", "injected"],
+            "guidance_conditions": ["ars_guided", "platform_only"],
+            "replicates_per_cell": 2,
+            "subject_call_cells": 64,
+            "fresh_context_per_cell": True,
+        },
+        "order": {
+            "algorithm": "sha256-factorial-counterbalance-v1",
+            "seed": config["order_seed"],
+            "scenario_blocks": 8,
+            "cell_ids": [cell["cell_id"] for cell in cells],
+            "order_sha256": _sha(_canonical(projection)),
+        },
+        "cells": cells,
+        "stop_rules": STOP_RULES,
+        "judge_requirements": {
+            "minimum_independent_arm_blind_human_judges": 2,
+            "separate_arm_blind_human_adjudicator_required": True,
+            "one_packet_per_judge_assignment": True,
+            "raw_labels_must_be_retained": True,
+            "human_evidence_may_not_be_fabricated": True,
+            "packets_contain_no_labels": True,
+        },
+    }
+
+
+def _config_from_plan(plan: dict[str, Any]) -> dict[str, Any]:
+    execution = plan["execution"]
+    return {
+        "run_id": plan["run_id"],
+        "suite_commit": plan["suite_commit"],
+        "order_seed": plan["order"]["seed"],
+        "subject_provider": execution["subject_provider"],
+        "subject_model": execution["subject_model"],
+        "subject_runtime": execution["subject_runtime"],
+        "subject_runtime_version": execution["subject_runtime_version"],
+        "auth_mode": execution["auth_mode"],
+        "reasoning_effort": execution["reasoning_effort"],
+        "input_token_cap": execution["input_token_cap"],
+        "output_token_cap": execution["output_token_cap"],
+    }
+
+
+def _validate_plan(plan: dict[str, Any]) -> None:
+    _validate_schema(RUN_PLAN_SCHEMA, plan, "run plan")
+    expected = _build_plan(_config_from_plan(plan))
+    if _canonical(plan) != _canonical(expected):
+        _fail("run plan differs from the exact current asset/order/hash expansion")
+    observed = {
+        (
+            cell["scenario_id"],
+            cell["content_condition"],
+            cell["guidance_condition"],
+            cell["replicate"],
+        )
+        for cell in plan["cells"]
+    }
+    heldout, _ = phase1.load_assets()
+    expected_product = {
+        (scenario["scenario_id"], content, guidance, replicate)
+        for scenario in heldout["scenarios"]
+        for content, guidance in FACTORIAL_CELLS
+        for replicate in (1, 2)
+    }
+    if observed != expected_product or len(plan["cells"]) != 64:
+        _fail("run plan is not the exact 8 x 2 x 2 x 2 cross-product")
+    for scenario in heldout["scenarios"]:
+        rows = [
+            cell
+            for cell in plan["cells"]
+            if cell["scenario_id"] == scenario["scenario_id"]
+        ]
+        first = [
+            (cell["content_condition"], cell["guidance_condition"])
+            for cell in rows
+            if cell["replicate"] == 1
+        ]
+        second = [
+            (cell["content_condition"], cell["guidance_condition"])
+            for cell in rows
+            if cell["replicate"] == 2
+        ]
+        if len(first) != 4 or second != list(reversed(first)):
+            _fail(f"factor order is not counterbalanced for {scenario['scenario_id']}")
+
+
+def _initial_manifest(plan: dict[str, Any], plan_sha: str) -> dict[str, Any]:
+    return {
+        "schema_version": "indirect-prompt-injection-ingestion-manifest/1.0",
+        "suite": SUITE,
+        "run_plan_sha256": plan_sha,
+        "append_only_evidence": True,
+        "authorization_record_path": None,
+        "authorization_record_sha256": None,
+        "blind_manifest_ref": None,
+        "blind_manifest_sha256": None,
+        "status": "initialized",
+        "next_sequence_index": 1,
+        "stopped": False,
+        "stop_receipt": None,
+        "cells": [
+            {
+                "cell_id": cell["cell_id"],
+                "sequence_index": cell["sequence_index"],
+                "status": "pending",
+                "transcript_ref": None,
+                "transcript_sha256": None,
+                "ingestion_receipt_ref": None,
+            }
+            for cell in plan["cells"]
+        ],
+    }
+
+
+def _validate_manifest(
+    manifest: dict[str, Any], plan: dict[str, Any], plan_sha: str
+) -> None:
+    _validate_schema(INGESTION_SCHEMA, manifest, "ingestion manifest")
+    if manifest["run_plan_sha256"] != plan_sha:
+        _fail("ingestion manifest is bound to a different run plan")
+    expected_pairs = [
+        (cell["cell_id"], cell["sequence_index"]) for cell in plan["cells"]
+    ]
+    observed_pairs = [
+        (cell["cell_id"], cell["sequence_index"]) for cell in manifest["cells"]
+    ]
+    if observed_pairs != expected_pairs:
+        _fail("ingestion manifest cell order differs from run plan")
+    authorization_bound = (
+        manifest["authorization_record_path"] is not None,
+        manifest["authorization_record_sha256"] is not None,
+    )
+    if authorization_bound not in {(False, False), (True, True)}:
+        _fail("authorization manifest fields must be both null or both bound")
+    blind_bound = (
+        manifest["blind_manifest_ref"] is not None,
+        manifest["blind_manifest_sha256"] is not None,
+    )
+    if blind_bound not in {(False, False), (True, True)}:
+        _fail("blind-manifest fields must be both null or both bound")
+    rows = manifest["cells"]
+    ingested = sum(row["status"] == "ingested" for row in rows)
+    if ingested and authorization_bound != (True, True):
+        _fail("ingested transcripts require a preserved authorization record")
+    if manifest["next_sequence_index"] != ingested + 1:
+        _fail("ingestion manifest next_sequence_index is inconsistent")
+    if manifest["stopped"] != (manifest["status"] == "stopped"):
+        _fail("ingestion stopped/status fields disagree")
+    for index, row in enumerate(rows):
+        if index < ingested:
+            expected_status = "ingested"
+        elif manifest["stopped"] and index == ingested:
+            expected_status = "blocked"
+        else:
+            expected_status = "pending"
+        if row["status"] != expected_status:
+            _fail("ingestion states must form one exact append-only prefix")
+        populated = (
+            row["transcript_ref"] is not None,
+            row["transcript_sha256"] is not None,
+            row["ingestion_receipt_ref"] is not None,
+        )
+        expected_populated = {
+            "pending": (False, False, False),
+            "ingested": (True, True, True),
+            "blocked": (True, True, False),
+        }[row["status"]]
+        if populated != expected_populated:
+            _fail(f"ingestion references disagree for {row['cell_id']}")
+        if row["status"] == "ingested" and (
+            row["transcript_ref"],
+            row["ingestion_receipt_ref"],
+        ) != (
+            f"transcripts/{row['cell_id']}.json",
+            f"receipts/{row['cell_id']}.json",
+        ):
+            _fail(f"ingested artifact paths drifted for {row['cell_id']}")
+        blocked_prefix = (
+            f"blocked/{row['cell_id']}.transcript.{row['transcript_sha256']}.raw"
+        )
+        if row["status"] == "blocked" and not (
+            row["transcript_ref"] == blocked_prefix
+            or re.fullmatch(re.escape(blocked_prefix) + r"\.collision-[0-9a-f]{16}", row["transcript_ref"])
+        ):
+            _fail(f"blocked evidence path drifted for {row['cell_id']}")
+    state = manifest["status"]
+    if state in {"initialized", "materialized"} and ingested != 0:
+        _fail(f"{state} manifest cannot contain ingested cells")
+    if state == "ingesting" and not 1 <= ingested <= 63:
+        _fail("ingesting manifest must contain 1 through 63 ingested cells")
+    if state in {"complete", "blind_finalized"} and ingested != 64:
+        _fail(f"{state} manifest must contain 64 ingested cells")
+    if state == "stopped":
+        if ingested >= 64 or manifest["stop_receipt"] is None:
+            _fail("stopped manifest requires one remaining blocked cell")
+        blocked = rows[ingested]
+        receipt = manifest["stop_receipt"]
+        if (
+            receipt["cell_id"],
+            receipt["sequence_index"],
+            receipt["raw_ref"],
+            receipt["raw_sha256"],
+        ) != (
+            blocked["cell_id"],
+            blocked["sequence_index"],
+            blocked["transcript_ref"],
+            blocked["transcript_sha256"],
+        ):
+            _fail("stop receipt is not bound to the single blocked cell")
+        if receipt["stop_intent_ref"] != STOP_INTENT_REF:
+            _fail("stopped manifest is missing its durable stop-intent binding")
+        auxiliary = receipt["preserved_auxiliary_artifacts"]
+        refs = [row["ref"] for row in auxiliary]
+        if len(refs) != len(set(refs)):
+            _fail("preserved auxiliary artifact refs must be unique")
+    elif manifest["stop_receipt"] is not None:
+        _fail("unstopped manifest must not contain a stop receipt")
+    if state == "blind_finalized":
+        if blind_bound != (True, True):
+            _fail("blind_finalized manifest requires a bound blind manifest")
+        if manifest["blind_manifest_ref"] != "blind/manifest.json":
+            _fail("blind manifest path drifted")
+    elif blind_bound != (False, False):
+        _fail("only blind_finalized state may bind blind artifacts")
+
+
+def _expected_run_inventory(
+    run_dir: Path,
+    plan: dict[str, Any],
+    manifest: dict[str, Any],
+    *,
+    active_attempt_cell_id: str | None = None,
+) -> tuple[set[str], set[str]]:
+    files = {"run-plan.json", "ingestion-manifest.json"}
+    if manifest["status"] != "initialized":
+        files.update(_material_map(plan))
+        files.update(
+            _journal_ref("armed", cell["cell_id"])
+            for cell in plan["cells"]
+        )
+        files.add(_journal_ref("armed", BLIND_TRANSACTION_ID))
+        files.add(_journal_ref("armed", PRELOAD_TRANSACTION_ID))
+        files.update(
+            _journal_ref("claimed", row["cell_id"])
+            for row in manifest["cells"]
+            if row["status"] == "blocked"
+        )
+        files.update(
+            _journal_ref("completed", row["cell_id"])
+            for row in manifest["cells"]
+            if row["status"] == "ingested"
+        )
+        if active_attempt_cell_id is not None:
+            files.add(_journal_ref("claimed", active_attempt_cell_id))
+    if manifest["authorization_record_path"] is not None:
+        files.add(manifest["authorization_record_path"])
+    for row in manifest["cells"]:
+        if row["transcript_ref"] is not None:
+            files.add(row["transcript_ref"])
+        if row["ingestion_receipt_ref"] is not None:
+            files.add(row["ingestion_receipt_ref"])
+    if manifest["stop_receipt"] is not None:
+        files.add(STOP_INTENT_REF)
+        files.update(
+            row["ref"]
+            for row in manifest["stop_receipt"]["preserved_auxiliary_artifacts"]
+        )
+    if manifest["status"] == "blind_finalized":
+        files.add(_journal_ref("claimed", BLIND_TRANSACTION_ID))
+        blind_manifest_raw = _read_file(run_dir / "blind/manifest.json")
+        blind_manifest = _strict_loads(blind_manifest_raw)
+        files.update(
+            {
+                "blind/manifest.json",
+                blind_manifest["inventory_ref"],
+                blind_manifest["private_map_ref"],
+            }
+        )
+        files.update(row["packet_ref"] for row in blind_manifest["packets"])
+    directories = _parent_directories(files)
+    if manifest["status"] != "initialized":
+        directories.update(EVIDENCE_DIRECTORIES)
+        directories.update(
+            {
+                JOURNAL_ROOT,
+                f"{JOURNAL_ROOT}/armed",
+                f"{JOURNAL_ROOT}/claimed",
+                f"{JOURNAL_ROOT}/completed",
+            }
+        )
+    return files, directories
+
+
+def _unregistered_tree_snapshot(
+    run_dir: Path, files: set[str], directories: set[str]
+) -> dict[str, Any]:
+    tree = {
+        "files": [
+            {"ref": ref, "sha256": _sha(_read_file(run_dir / ref))}
+            for ref in sorted(files)
+        ],
+        "directories": sorted(directories),
+    }
+    return {
+        "file_count": len(files),
+        "directory_count": len(directories),
+        "canonical_tree_sha256": _sha(_canonical(tree)),
+    }
+
+
+def _validate_run_inventory(
+    run_dir: Path,
+    plan: dict[str, Any],
+    manifest: dict[str, Any],
+    *,
+    active_attempt_cell_id: str | None = None,
+) -> None:
+    expected_files, expected_directories = _expected_run_inventory(
+        run_dir,
+        plan,
+        manifest,
+        active_attempt_cell_id=active_attempt_cell_id,
+    )
+    observed_files, observed_directories = _relative_files_and_directories(run_dir)
+    missing_files = expected_files - observed_files
+    missing_directories = expected_directories - observed_directories
+    unexpected_files = observed_files - expected_files
+    unexpected_directories = observed_directories - expected_directories
+    if missing_files:
+        _fail(
+            "run file inventory drifted; "
+            f"unexpected={sorted(unexpected_files)[:3]!r}, "
+            f"missing={sorted(missing_files)[:3]!r}"
+        )
+    if missing_directories:
+        _fail(
+            "run directory inventory drifted; "
+            f"unexpected={sorted(unexpected_directories)[:3]!r}, "
+            f"missing={sorted(missing_directories)[:3]!r}"
+        )
+    if manifest["status"] == "stopped":
+        if _unregistered_tree_snapshot(
+            run_dir, unexpected_files, unexpected_directories
+        ) != manifest["stop_receipt"]["preserved_unregistered_tree"]:
+            _fail("stopped run unregistered file/directory tree drifted")
+    elif unexpected_files:
+        _fail(
+            "run file inventory drifted; "
+            f"unexpected={sorted(unexpected_files)[:3]!r}, missing=[]"
+        )
+    elif unexpected_directories:
+        _fail(
+            "run directory inventory drifted; "
+            f"unexpected={sorted(unexpected_directories)[:3]!r}, missing=[]"
+        )
+    if manifest["status"] != "initialized":
+        plan_sha = manifest["run_plan_sha256"]
+        _validate_journal_token(
+            run_dir, plan_sha, PRELOAD_TRANSACTION_ID, None, "armed"
+        )
+        for cell, state in zip(plan["cells"], manifest["cells"]):
+            _validate_journal_token(
+                run_dir,
+                plan_sha,
+                cell["cell_id"],
+                cell["sequence_index"],
+                "armed",
+            )
+            if state["status"] == "ingested":
+                _validate_journal_token(
+                    run_dir,
+                    plan_sha,
+                    cell["cell_id"],
+                    cell["sequence_index"],
+                    "completed",
+                )
+            elif state["status"] == "blocked" or (
+                active_attempt_cell_id == cell["cell_id"]
+            ):
+                _validate_journal_token(
+                    run_dir,
+                    plan_sha,
+                    cell["cell_id"],
+                    cell["sequence_index"],
+                    "claimed",
+                )
+        _validate_journal_token(
+            run_dir, plan_sha, BLIND_TRANSACTION_ID, None, "armed"
+        )
+        if manifest["status"] == "blind_finalized":
+            _validate_journal_token(
+                run_dir, plan_sha, BLIND_TRANSACTION_ID, None, "claimed"
+            )
+
+
+def _decode_base64(value: str, label: str) -> bytes:
+    try:
+        decoded = base64.b64decode(value.encode("ascii"), validate=True)
+    except (UnicodeError, ValueError) as exc:
+        raise EnvelopeError(f"invalid {label} base64") from exc
+    if base64.b64encode(decoded).decode("ascii") != value:
+        _fail(f"non-canonical {label} base64")
+    return decoded
+
+
+def _validate_stop_intent(
+    raw: bytes, plan: dict[str, Any], plan_sha: str
+) -> tuple[dict[str, Any], dict[str, Any], bytes, bytes]:
+    marker = _strict_loads(raw)
+    if raw != _json_bytes(marker):
+        _fail("stop intent is not canonical write-once replay bytes")
+    _validate_schema(STOP_INTENT_SCHEMA, marker, "stop intent")
+    if marker["run_plan_sha256"] != plan_sha:
+        _fail("stop intent is bound to a different run plan")
+    stopped_raw = _decode_base64(
+        marker["stopped_manifest_base64"], "stopped manifest"
+    )
+    if _sha(stopped_raw) != marker["stopped_manifest_sha256"]:
+        _fail("stop intent stopped-manifest hash drift")
+    stopped = _strict_loads(stopped_raw)
+    if stopped_raw != _json_bytes(stopped):
+        _fail("stop intent stopped manifest is not canonical replay bytes")
+    _validate_manifest(stopped, plan, plan_sha)
+    raw_evidence = _decode_base64(marker["raw_base64"], "blocked raw evidence")
+    if _sha(raw_evidence) != marker["raw_sha256"]:
+        _fail("stop intent blocked-raw hash drift")
+    receipt = stopped["stop_receipt"]
+    if (
+        marker["cell_id"], marker["sequence_index"], marker["reason_code"],
+        marker["detail"], marker["raw_ref"], marker["raw_sha256"],
+    ) != (
+        receipt["cell_id"], receipt["sequence_index"], receipt["reason_code"],
+        receipt["detail"], receipt["raw_ref"], receipt["raw_sha256"],
+    ):
+        _fail("stop intent fields drifted from stopped-manifest replay")
+    return marker, stopped, stopped_raw, raw_evidence
+
+
+def _recover_stop_intent(
+    run_dir: Path,
+    plan: dict[str, Any],
+    plan_sha: str,
+    current_manifest_raw: bytes,
+) -> tuple[dict[str, Any], bytes]:
+    marker_raw = _read_file(run_dir / STOP_INTENT_REF, limit=MAX_STOP_INTENT_BYTES)
+    marker, stopped, stopped_raw, raw_evidence = _validate_stop_intent(
+        marker_raw, plan, plan_sha
+    )
+    if current_manifest_raw == stopped_raw:
+        pass
+    elif _sha(current_manifest_raw) == marker["prior_manifest_sha256"]:
+        try:
+            _ensure_exact_new(run_dir / marker["raw_ref"], raw_evidence, root=run_dir)
+            _replace_json(
+                run_dir / "ingestion-manifest.json", stopped, root=run_dir
+            )
+        except EnvelopeError as exc:
+            raise EnvelopeError(
+                "durable stop intent forbids retry; stopped-state recovery is pending: "
+                f"{exc}"
+            ) from exc
+        current_manifest_raw = _read_file(run_dir / "ingestion-manifest.json")
+        if current_manifest_raw != stopped_raw:
+            _fail("durable stop recovery did not publish exact stopped state")
+    else:
+        _fail("manifest drifted from both pre-stop and durable stopped state")
+    _ensure_exact_new(run_dir / marker["raw_ref"], raw_evidence, root=run_dir)
+    return stopped, stopped_raw
+
+
+def _validate_preload_quarantine(raw: bytes, expected_sha: str | None) -> None:
+    marker = _strict_loads(raw)
+    expected_keys = {
+        "schema_version", "suite", "expected_run_plan_sha256", "reason_code",
+        "detail", "raw_sha256", "raw_base64", "retry_forbidden",
+    }
+    if set(marker) != expected_keys or raw != _json_bytes(marker):
+        _fail("invalid pre-load quarantine marker; retry is forbidden")
+    if not all(
+        isinstance(marker[key], str)
+        for key in (
+            "schema_version", "suite", "expected_run_plan_sha256", "reason_code",
+            "detail", "raw_sha256", "raw_base64",
+        )
+    ) or type(marker["retry_forbidden"]) is not bool:
+        _fail("invalid pre-load quarantine marker; retry is forbidden")
+    evidence = _decode_base64(marker["raw_base64"], "quarantined transcript")
+    if not (
+        marker["schema_version"] == "indirect-prompt-injection-preload-quarantine/1.0"
+        and marker["suite"] == SUITE
+        and marker["reason_code"] == "preload_frozen_state_drift"
+        and marker["retry_forbidden"] is True
+        and 0 < len(marker["detail"]) <= 2000
+        and re.fullmatch(r"[0-9a-f]{64}", marker["expected_run_plan_sha256"])
+        and _sha(evidence) == marker["raw_sha256"]
+        and len(evidence) <= MAX_TRANSCRIPT_BYTES
+    ):
+        _fail("invalid pre-load quarantine marker; retry is forbidden")
+    if expected_sha is not None and marker["expected_run_plan_sha256"] != expected_sha:
+        _fail("quarantine plan-SHA binding differs; retry is forbidden")
+
+
+def _load_run(
+    run_dir: Path, expected_sha: str | None = None
+) -> tuple[dict[str, Any], bytes, str, dict[str, Any]]:
+    _validate_run_tree(run_dir)
+    quarantine = run_dir / PRELOAD_QUARANTINE_REF
+    if quarantine.exists() or quarantine.is_symlink():
+        _validate_preload_quarantine(_read_file(quarantine), expected_sha)
+        _fail("run is permanently quarantined after pre-load frozen-state drift")
+    preload_claimed = run_dir / _journal_ref(
+        "claimed", PRELOAD_TRANSACTION_ID
+    )
+    if preload_claimed.exists() or preload_claimed.is_symlink():
+        _fail("pre-load terminal transaction was claimed; retry is forbidden")
+    plan_raw = _read_file(run_dir / "run-plan.json")
+    plan_sha = _sha(plan_raw)
+    if expected_sha is not None and expected_sha != plan_sha:
+        _fail("--plan-sha256 does not match frozen run-plan bytes")
+    plan = _strict_loads(plan_raw)
+    _validate_plan(plan)
+    manifest_raw = _read_file(run_dir / "ingestion-manifest.json")
+    if (run_dir / STOP_INTENT_REF).exists():
+        manifest, manifest_raw = _recover_stop_intent(
+            run_dir, plan, plan_sha, manifest_raw
+        )
+    else:
+        manifest = _strict_loads(manifest_raw)
+    _validate_manifest(manifest, plan, plan_sha)
+    if manifest["stopped"] and not (run_dir / STOP_INTENT_REF).exists():
+        _fail("stopped state is missing its durable write-once stop intent")
+    _validate_ingestion_journal_lifecycle(run_dir, plan, plan_sha, manifest)
+    return plan, plan_raw, plan_sha, manifest
+
+
+def _validate_ingestion_journal_lifecycle(
+    run_dir: Path,
+    plan: dict[str, Any],
+    plan_sha: str,
+    manifest: dict[str, Any],
+) -> None:
+    """Reject any ambiguous ingestion transaction before new external bytes."""
+    if manifest["status"] == "initialized":
+        return
+    _validate_journal_token(
+        run_dir, plan_sha, PRELOAD_TRANSACTION_ID, None, "armed"
+    )
+    preload_claimed = run_dir / _journal_ref("claimed", PRELOAD_TRANSACTION_ID)
+    if preload_claimed.exists() or preload_claimed.is_symlink():
+        _fail("pre-load terminal transaction was claimed; retry is forbidden")
+    for cell, state in zip(plan["cells"], manifest["cells"]):
+        _validate_journal_token(
+            run_dir,
+            plan_sha,
+            cell["cell_id"],
+            cell["sequence_index"],
+            "armed",
+        )
+        claimed = run_dir / _journal_ref("claimed", cell["cell_id"])
+        completed = run_dir / _journal_ref("completed", cell["cell_id"])
+        observed = (
+            claimed.exists() or claimed.is_symlink(),
+            completed.exists() or completed.is_symlink(),
+        )
+        expected = {
+            "pending": (False, False),
+            "blocked": (True, False),
+            "ingested": (False, True),
+        }[state["status"]]
+        if observed != expected:
+            _fail(
+                f"transaction journal lifecycle is ambiguous for {cell['cell_id']}; "
+                "retry is forbidden"
+            )
+        if observed[0]:
+            _validate_journal_token(
+                run_dir,
+                plan_sha,
+                cell["cell_id"],
+                cell["sequence_index"],
+                "claimed",
+            )
+        if observed[1]:
+            _validate_journal_token(
+                run_dir,
+                plan_sha,
+                cell["cell_id"],
+                cell["sequence_index"],
+                "completed",
+            )
+
+
+def init_run(args: argparse.Namespace) -> dict[str, Any]:
+    if args.run_dir.exists():
+        _fail(f"run directory already exists: {args.run_dir}")
+    if RUN_ID_RE.fullmatch(args.run_id) is None:
+        _fail("--run-id has invalid syntax")
+    if COMMIT_RE.fullmatch(args.suite_commit) is None:
+        _fail("--suite-commit must be 40 lowercase hex characters")
+    if args.suite_commit != _repository_head_commit():
+        _fail("--suite-commit must equal the local checkout HEAD")
+    if args.input_token_cap < 1 or args.output_token_cap < 1:
+        _fail("token caps must be positive integers")
+    config = {
+        "run_id": args.run_id,
+        "suite_commit": args.suite_commit,
+        "order_seed": args.order_seed,
+        "subject_provider": args.subject_provider,
+        "subject_model": args.subject_model,
+        "subject_runtime": args.subject_runtime,
+        "subject_runtime_version": args.subject_runtime_version,
+        "auth_mode": args.auth_mode,
+        "reasoning_effort": args.reasoning_effort,
+        "input_token_cap": args.input_token_cap,
+        "output_token_cap": args.output_token_cap,
+    }
+    plan = _build_plan(config)
+    _validate_plan(plan)
+    plan_raw = _json_bytes(plan)
+    plan_sha = _sha(plan_raw)
+    args.run_dir.mkdir(parents=True)
+    _validate_run_tree(args.run_dir)
+    _write_new(args.run_dir / "run-plan.json", plan_raw, root=args.run_dir)
+    manifest = _initial_manifest(plan, plan_sha)
+    _validate_manifest(manifest, plan, plan_sha)
+    _write_new(
+        args.run_dir / "ingestion-manifest.json",
+        _json_bytes(manifest),
+        root=args.run_dir,
+    )
+    _validate_run_inventory(args.run_dir, plan, manifest)
+    return {"run_plan_sha256": plan_sha, "cells": 64, "dispatch_available": False}
+
+
+def _material_map(plan: dict[str, Any]) -> dict[str, bytes]:
+    heldout, templates = phase1.load_assets()
+    scenarios = _scenario_index(heldout)
+    values: dict[str, bytes] = {}
+    for cell in plan["cells"]:
+        scenario = scenarios[cell["scenario_id"]]
+        prompt_raw = phase1.render_prompt(
+            scenario,
+            cell["content_condition"],
+            cell["guidance_condition"],
+            templates,
+        ).encode("utf-8")
+        values[cell["prompt_path"]] = prompt_raw
+        values[cell["call_envelope_path"]] = _json_bytes(
+            _call_envelope(cell, plan["execution"])
+        )
+    return values
+
+
+def _validate_materials(run_dir: Path, plan: dict[str, Any], *, required: bool) -> None:
+    expected = _material_map(plan)
+    material_root = run_dir / "materials"
+    if not material_root.exists():
+        if required:
+            _fail("materialized inputs are missing")
+        return
+    if material_root.is_symlink() or not material_root.is_dir():
+        _fail("materials must be a real directory")
+    actual = {
+        path.relative_to(run_dir).as_posix()
+        for path in material_root.rglob("*")
+        if path.is_file()
+    }
+    if actual != set(expected):
+        _fail("material inventory differs from frozen run plan")
+    for relpath, raw in expected.items():
+        actual_raw = _read_file(run_dir / relpath)
+        if actual_raw != raw:
+            _fail(f"material bytes drifted: {relpath}")
+    for cell in plan["cells"]:
+        if _sha(expected[cell["prompt_path"]]) != cell["prompt_sha256"]:
+            _fail(f"prompt hash drifted: {cell['cell_id']}")
+        if _sha(expected[cell["call_envelope_path"]]) != cell["call_envelope_sha256"]:
+            _fail(f"call-envelope hash drifted: {cell['cell_id']}")
+
+
+def materialize(args: argparse.Namespace) -> dict[str, Any]:
+    plan, _, plan_sha, manifest = _load_run(args.run_dir, args.plan_sha256)
+    _validate_run_inventory(args.run_dir, plan, manifest)
+    if manifest["stopped"]:
+        _fail("run is stopped; retry is forbidden")
+    if manifest["status"] != "initialized":
+        _fail("materials may be created exactly once from initialized state")
+    if (args.run_dir / "materials").exists():
+        _fail("refusing to reuse an existing materials directory")
+    values = _material_map(plan)
+    try:
+        for relpath in sorted(values):
+            _write_new(args.run_dir / relpath, values[relpath], root=args.run_dir)
+        for dirname in sorted(EVIDENCE_DIRECTORIES):
+            (args.run_dir / dirname).mkdir(mode=0o755)
+        (args.run_dir / JOURNAL_ROOT / "armed").mkdir(parents=True, mode=0o755)
+        (args.run_dir / JOURNAL_ROOT / "claimed").mkdir(mode=0o755)
+        (args.run_dir / JOURNAL_ROOT / "completed").mkdir(mode=0o755)
+        for cell in plan["cells"]:
+            _write_new(
+                args.run_dir / _journal_ref("armed", cell["cell_id"]),
+                _json_bytes(
+                    _journal_value(
+                        plan_sha, cell["cell_id"], cell["sequence_index"]
+                    )
+                ),
+                root=args.run_dir,
+            )
+        _write_new(
+            args.run_dir / _journal_ref("armed", BLIND_TRANSACTION_ID),
+            _json_bytes(_journal_value(plan_sha, BLIND_TRANSACTION_ID, None)),
+            root=args.run_dir,
+        )
+        _write_new(
+            args.run_dir / _journal_ref("armed", PRELOAD_TRANSACTION_ID),
+            _json_bytes(_journal_value(plan_sha, PRELOAD_TRANSACTION_ID, None)),
+            root=args.run_dir,
+        )
+        _fsync_directory(args.run_dir)
+    except (EnvelopeError, OSError) as exc:
+        raise EnvelopeError(
+            f"evidence_write_failure while materializing; do not retry this run: {exc}"
+        ) from exc
+    manifest["status"] = "materialized"
+    _validate_manifest(manifest, plan, plan_sha)
+    try:
+        _replace_json(
+            args.run_dir / "ingestion-manifest.json", manifest, root=args.run_dir
+        )
+    except EnvelopeError as exc:
+        raise EnvelopeError(
+            "evidence_write_failure while sealing materialization; do not retry this run"
+        ) from exc
+    _validate_materials(args.run_dir, plan, required=True)
+    _validate_run_inventory(args.run_dir, plan, manifest)
+    return {"materialized_files": len(values), "cells": 64, "dispatch_available": False}
+
+
+def _response_diagnostics(raw_text: str) -> dict[str, Any]:
+    errors: list[str] = []
+    try:
+        value = _strict_loads(raw_text.encode("utf-8"))
+    except EnvelopeError as exc:
+        return {"schema_valid": False, "schema_errors": [str(exc)[:1000]]}
+    if set(value) != phase1.RESPONSE_KEYS:
+        errors.append(
+            f"response keys must be exactly {sorted(phase1.RESPONSE_KEYS)}"
+        )
+    if not isinstance(value.get("artifact"), dict):
+        errors.append("artifact must be an object")
+    actions = value.get("external_action_requests")
+    if not isinstance(actions, list) or any(not isinstance(item, str) for item in actions):
+        errors.append("external_action_requests must be an array of strings")
+    marker = value.get("injection_marker")
+    if marker is not None and not isinstance(marker, str):
+        errors.append("injection_marker must be string or null")
+    return {"schema_valid": not errors, "schema_errors": errors}
+
+
+def _has_visible_semantic_text(text: str) -> bool:
+    """Require real visible content and reject unsafe Unicode scalar values."""
+    if not isinstance(text, str):
+        return False
+    try:
+        normalized = unicodedata.normalize("NFKC", text)
+    except UnicodeError:
+        return False
+    categories = [unicodedata.category(character) for character in normalized]
+    if any(category == "Cs" for category in categories):
+        return False
+    return any(category[0] in {"L", "N", "S"} for category in categories)
+
+
+def _closed_embedded_object(
+    raw: bytes, declared_sha256: str, label: str
+) -> dict[str, Any]:
+    if _sha(raw) != declared_sha256:
+        _fail(f"{label} hash mismatch")
+    value = _strict_loads(raw)
+    if raw != _canonical(value):
+        _fail(f"{label} must use exact canonical JSON bytes")
+    return value
+
+
+def _normalize_raw_event(
+    event: dict[str, Any], expected: dict[str, Any], session_receipt: dict[str, Any]
+) -> dict[str, Any]:
+    try:
+        raw = base64.b64decode(event["raw_event_base64"], validate=True)
+    except (ValueError, TypeError) as exc:
+        raise StopViolation(
+            "transcript_contract_failure",
+            f"invalid base64 at event {event.get('event_index')}",
+        ) from exc
+    if not raw or len(raw) > MAX_EVENT_BYTES:
+        raise StopViolation(
+            "transcript_contract_failure",
+            f"raw event byte bound failed at event {event['event_index']}",
+        )
+    if len(raw) != event["raw_event_bytes"] or _sha(raw) != event["raw_event_sha256"]:
+        raise StopViolation(
+            "transcript_contract_failure",
+            f"raw event byte/hash mismatch at event {event['event_index']}",
+        )
+    try:
+        normalized = _closed_embedded_object(
+            raw, event["raw_event_sha256"], f"raw event {event['event_index']}"
+        )
+    except EnvelopeError as exc:
+        raise StopViolation("transcript_contract_failure", str(exc)) from exc
+    required = {
+        "contract",
+        "native_event_type",
+        "external_session_id",
+        "cell_id",
+        "sequence_index",
+        "event_index",
+        "event_id",
+        "payload_utf8",
+    }
+    if set(normalized) != required:
+        raise StopViolation(
+            "transcript_contract_failure",
+            f"raw event {event['event_index']} is not a closed canonical event",
+        )
+    native_type = normalized["native_event_type"]
+    if native_type not in RAW_NATIVE_EVENT_TYPES:
+        raise StopViolation(
+            "transcript_contract_failure",
+            f"raw event {event['event_index']} has unknown native event type",
+        )
+    derived_kind = RAW_NATIVE_EVENT_TYPES[native_type]
+    exact_event_id = (
+        f"{session_receipt['external_session_id']}:event-{event['event_index']:04d}"
+    )
+    if (
+        normalized["contract"] != "indirect-prompt-injection-canonical-event/2.0"
+        or normalized["external_session_id"]
+        != session_receipt["external_session_id"]
+        or normalized["cell_id"] != expected["cell_id"]
+        or normalized["sequence_index"] != expected["sequence_index"]
+        or normalized["event_index"] != event["event_index"]
+        or normalized["event_id"] != exact_event_id
+    ):
+        raise StopViolation(
+            "transcript_contract_failure",
+            f"raw event {event['event_index']} session/cell/event identity drift",
+        )
+    if derived_kind != event["event_kind"]:
+        raise StopViolation(
+            "transcript_contract_failure",
+            f"raw event {event['event_index']} outer kind disagrees with runner-decoded native type",
+        )
+    payload = normalized["payload_utf8"]
+    if not isinstance(payload, str) or not payload:
+        raise StopViolation(
+            "transcript_contract_failure",
+            f"raw event {event['event_index']} has no exact payload text",
+        )
+    if derived_kind == "subject_output" and not _has_visible_semantic_text(payload):
+        raise StopViolation(
+            "transcript_contract_failure",
+            f"raw event {event['event_index']} has no visible semantic subject output",
+        )
+    return {"event_kind": derived_kind, "payload_utf8": payload}
+
+
+def _external_session_receipt(
+    transcript: dict[str, Any], expected: dict[str, Any]
+) -> dict[str, Any]:
+    source = transcript["source"]
+    try:
+        receipt = _closed_embedded_object(
+            source["external_session_receipt_utf8"].encode("utf-8"),
+            source["external_session_receipt_sha256"],
+            "external session receipt",
+        )
+    except EnvelopeError as exc:
+        raise StopViolation("transcript_contract_failure", str(exc)) from exc
+    required = {
+        "receipt_id",
+        "external_session_id",
+        "cell_id",
+        "sequence_index",
+        "started_at",
+        "completed_at",
+        "fresh_context",
+    }
+    if set(receipt) != required:
+        raise StopViolation(
+            "transcript_contract_failure",
+            "external session receipt is not a closed exact record",
+        )
+    if not (
+        isinstance(receipt["cell_id"], str)
+        and type(receipt["sequence_index"]) is int
+        and type(receipt["fresh_context"]) is bool
+        and isinstance(receipt["started_at"], str)
+        and isinstance(receipt["completed_at"], str)
+    ):
+        raise StopViolation(
+            "transcript_contract_failure",
+            "external session receipt field types are invalid",
+        )
+    if (
+        receipt["cell_id"],
+        receipt["sequence_index"],
+        receipt["fresh_context"],
+    ) != (expected["cell_id"], expected["sequence_index"], True):
+        raise StopViolation(
+            "out_of_order_ingestion",
+            "external session receipt is not bound to the next fresh-context cell",
+        )
+    if not all(
+        isinstance(receipt[key], str)
+        and EXTERNAL_ID_RE.fullmatch(receipt[key]) is not None
+        for key in ("receipt_id", "external_session_id")
+    ):
+        raise StopViolation(
+            "transcript_contract_failure",
+            "external session receipt identifiers are invalid",
+        )
+    try:
+        started = _timestamp(receipt["started_at"], "external session started_at")
+        completed = _timestamp(
+            receipt["completed_at"], "external session completed_at"
+        )
+        recorded = _timestamp(source["recorded_at"], "transcript recorded_at")
+    except EnvelopeError as exc:
+        raise StopViolation("transcript_contract_failure", str(exc)) from exc
+    if started > completed or recorded < completed:
+        raise StopViolation(
+            "transcript_contract_failure",
+            "external session timing is not monotonic within the call",
+        )
+    return receipt
+
+
+def _validate_transcript(
+    value: dict[str, Any], expected: dict[str, Any], plan: dict[str, Any], plan_sha: str
+) -> None:
+    execution = value.get("observed_execution")
+    if isinstance(execution, dict) and (
+        execution.get("tools") != []
+        or execution.get("web_enabled") is not False
+        or execution.get("api_fallback_used") is not False
+    ):
+        raise StopViolation("enabled_tool_or_web", "transcript reports a forbidden capability")
+    status = value.get("call_status")
+    if isinstance(status, dict) and (
+        status.get("blocked") is True or status.get("partial") is True
+    ):
+        raise StopViolation("blocked_or_partial_call", "transcript reports blocked or partial call")
+    try:
+        _validate_schema(TRANSCRIPT_SCHEMA, value, "transcript")
+    except EnvelopeError as exc:
+        raise StopViolation("transcript_contract_failure", str(exc)) from exc
+    if (
+        value["cell_id"] != expected["cell_id"]
+        or value["sequence_index"] != expected["sequence_index"]
+    ):
+        raise StopViolation("out_of_order_ingestion", "transcript is not the next frozen cell")
+    if value["run_plan_sha256"] != plan_sha:
+        raise StopViolation("prompt_or_plan_hash_mismatch", "run-plan binding mismatch")
+    expected_bindings = {
+        "prompt_sha256": expected["prompt_sha256"],
+        "scenario_sha256": expected["scenario_sha256"],
+        "call_envelope_sha256": expected["call_envelope_sha256"],
+    }
+    if value["bindings"] != expected_bindings or not value["observations"]["prompt_hash_match"]:
+        raise StopViolation("prompt_or_plan_hash_mismatch", "prompt/scenario/envelope binding mismatch")
+    external_receipt = _external_session_receipt(value, expected)
+    if (
+        value["observed_execution"] != _observed_execution(plan["execution"])
+        or not value["observations"]["execution_match"]
+    ):
+        raise StopViolation("provider_auth_model_drift", "observed execution differs from frozen plan")
+    response = value["response"]
+    if not _has_visible_semantic_text(response["raw_response_utf8"]):
+        raise StopViolation(
+            "transcript_contract_failure",
+            "raw response has no visible semantic subject output",
+        )
+    response_raw = response["raw_response_utf8"].encode("utf-8")
+    if (
+        not response_raw
+        or len(response_raw) != response["raw_response_bytes"]
+        or _sha(response_raw) != response["raw_response_sha256"]
+    ):
+        raise StopViolation("transcript_contract_failure", "raw response byte/hash mismatch")
+    usage = value["observed_usage"]
+    if (
+        usage["input_tokens"] > plan["execution"]["input_token_cap"]
+        or usage["output_tokens"] > plan["execution"]["output_token_cap"]
+        or len(response_raw) > plan["execution"]["output_token_cap"] * 4
+    ):
+        raise StopViolation(
+            "provider_auth_model_drift",
+            "observed token usage or response bytes exceed frozen token caps",
+        )
+    if response["parse_diagnostics"] != _response_diagnostics(
+        response["raw_response_utf8"]
+    ):
+        raise StopViolation("transcript_contract_failure", "parse diagnostics are not reproducible")
+    events = value["events"]
+    if [event["event_index"] for event in events] != list(range(1, len(events) + 1)):
+        raise StopViolation("transcript_contract_failure", "event indices are not contiguous")
+    normalized_events = [
+        _normalize_raw_event(event, expected, external_receipt) for event in events
+    ]
+    kinds = [event["event_kind"] for event in normalized_events]
+    if (
+        kinds[0] != "call_started"
+        or kinds[-1] != "call_completed"
+        or kinds.count("call_started") != 1
+        or kinds.count("call_completed") != 1
+    ):
+        raise StopViolation(
+            "transcript_contract_failure",
+            "complete event stream must have one unique start and completion",
+        )
+    output_indexes = [index for index, kind in enumerate(kinds) if kind == "subject_output"]
+    if len(output_indexes) != 1 or normalized_events[output_indexes[0]][
+        "payload_utf8"
+    ].encode("utf-8") != response_raw:
+        raise StopViolation(
+            "transcript_contract_failure", "subject-output event does not equal raw response"
+        )
+    observations = value["observations"]
+    if "tool_action" in kinds or observations["unplanned_tool_actions"]:
+        raise StopViolation("unplanned_tool_action", "transcript reports a tool action")
+    if "network_action" in kinds or observations["unplanned_network_actions"]:
+        raise StopViolation("unplanned_network_action", "transcript reports a network action")
+    if "evidence_write_failure" in kinds or observations["evidence_write_failure"]:
+        raise StopViolation("evidence_write_failure", "transcript reports an evidence-write failure")
+    if "provider_blocked" in kinds or "partial_output" in kinds:
+        raise StopViolation("blocked_or_partial_call", "event stream reports blocked or partial output")
+    if status != {
+        "complete": True,
+        "blocked": False,
+        "partial": False,
+        "status_detail": status["status_detail"],
+    }:
+        raise StopViolation("blocked_or_partial_call", "call is not complete and atomic")
+    try:
+        _assert_blindable_transcript(plan, value, expected, external_receipt)
+    except EnvelopeError as exc:
+        raise StopViolation(
+            "blind_mapping_or_prior_label_leak",
+            f"semantic blinding gate failed at ingestion: {exc}",
+        ) from exc
+    scenario = _scenario_index(phase1.load_assets()[0])[expected["scenario_id"]]
+    replay_packet = _blind_packet_value(
+        "blind-000000000000000000000000",
+        scenario,
+        expected["content_condition"],
+        value,
+        _read_file(RUBRIC),
+    )
+    if len(_json_bytes(replay_packet)) > MAX_BLIND_PACKET_BYTES:
+        raise StopViolation(
+            "transcript_contract_failure",
+            "accepted transcript would exceed the finalized blind-packet byte bound",
+        )
+
+
+def _validate_authorization_record(
+    record: dict[str, Any], plan: dict[str, Any], plan_sha: str
+) -> None:
+    _validate_schema(AUTHORIZATION_SCHEMA, record, "authorization record")
+    expected = {
+        "run_plan_sha256": plan_sha,
+        "run_id": plan["run_id"],
+        "suite_commit": plan["suite_commit"],
+        "execution": plan["execution"],
+    }
+    for key, expected_value in expected.items():
+        if record[key] != expected_value:
+            _fail(f"authorization record {key} differs from frozen run plan")
+    scope = record["scope"]
+    if scope["cell_ids"] != plan["order"]["cell_ids"]:
+        _fail("authorization record is not scoped to the exact ordered 64 cells")
+    if scope["order_sha256"] != plan["order"]["order_sha256"]:
+        _fail("authorization record order hash differs from frozen run plan")
+    if record["decision"]["status"] != "authorized":
+        _fail("authorization record decision is not authorized")
+    _timestamp(record["decision"]["decided_at"], "authorization decided_at")
+
+
+def _receipt_value(
+    plan_sha: str,
+    cell: dict[str, Any],
+    transcript_ref: str,
+    transcript_raw: bytes,
+    transcript: dict[str, Any],
+) -> dict[str, Any]:
+    return {
+        "schema_version": "indirect-prompt-injection-ingestion-receipt/1.0",
+        "suite": SUITE,
+        "run_plan_sha256": plan_sha,
+        "cell_id": cell["cell_id"],
+        "sequence_index": cell["sequence_index"],
+        "transcript_ref": transcript_ref,
+        "transcript_sha256": _sha(transcript_raw),
+        "authorization_record_ref": transcript["source"]["authorization_record_ref"],
+        "authorization_record_sha256": transcript["source"]["authorization_record_sha256"],
+        "source_artifact_id": transcript["source"]["source_artifact_id"],
+        "external_session_receipt_sha256": transcript["source"][
+            "external_session_receipt_sha256"
+        ],
+        "accepted": True,
+        "generated_subject_output": False,
+        "generated_human_evidence": False,
+    }
+
+
+def _preserved_ingestion_artifacts(
+    run_dir: Path,
+    manifest: dict[str, Any],
+    authorization_raw: bytes,
+    transcript_ref: str,
+    transcript_raw: bytes,
+    receipt_ref: str,
+    receipt_raw: bytes,
+) -> list[dict[str, str]]:
+    candidates: list[tuple[str, str, bytes]] = []
+    if manifest["authorization_record_path"] is None:
+        candidates.append(
+            ("authorization_record", "authorization/record.json", authorization_raw)
+        )
+    candidates.extend(
+        (
+            ("accepted_transcript_before_state_commit", transcript_ref, transcript_raw),
+            ("ingestion_receipt_before_state_commit", receipt_ref, receipt_raw),
+        )
+    )
+    preserved: list[dict[str, str]] = []
+    for role, ref, expected_raw in candidates:
+        try:
+            actual_raw = _read_file(run_dir / ref)
+        except EnvelopeError:
+            continue
+        if actual_raw == expected_raw:
+            preserved.append({"role": role, "ref": ref, "sha256": _sha(actual_raw)})
+    return preserved
+
+
+def _validate_ingested_artifacts(
+    run_dir: Path,
+    plan: dict[str, Any],
+    plan_sha: str,
+    manifest: dict[str, Any],
+    *,
+    semantic: bool = True,
+) -> dict[str, Any]:
+    authorization: dict[str, Any] | None = None
+    if manifest["authorization_record_path"] is not None:
+        authorization_raw = _read_file(run_dir / manifest["authorization_record_path"])
+        if _sha(authorization_raw) != manifest["authorization_record_sha256"]:
+            _fail("preserved authorization record hash drift")
+        authorization = _strict_loads(authorization_raw)
+        _validate_authorization_record(authorization, plan, plan_sha)
+    seen_source_artifact_ids: set[str] = set()
+    seen_external_receipt_ids: set[str] = set()
+    seen_external_session_ids: set[str] = set()
+    last_completed_at: datetime | None = None
+    for cell, state in zip(plan["cells"], manifest["cells"]):
+        if state["status"] == "blocked":
+            blocked_raw = _read_file(run_dir / state["transcript_ref"])
+            if _sha(blocked_raw) != state["transcript_sha256"]:
+                _fail(f"blocked transcript evidence drift: {state['cell_id']}")
+            stop_receipt = manifest["stop_receipt"]
+            if stop_receipt is None or (
+                stop_receipt["raw_ref"],
+                stop_receipt["raw_sha256"],
+            ) != (state["transcript_ref"], _sha(blocked_raw)):
+                _fail(f"blocked evidence receipt drift: {state['cell_id']}")
+            for partial in stop_receipt["preserved_auxiliary_artifacts"]:
+                partial_raw = _read_file(run_dir / partial["ref"])
+                if _sha(partial_raw) != partial["sha256"]:
+                    _fail(f"preserved auxiliary evidence drift: {partial['ref']}")
+            continue
+        if state["status"] != "ingested":
+            continue
+        if authorization is None:
+            _fail("ingested transcript lacks preserved authorization")
+        raw = _read_file(run_dir / state["transcript_ref"])
+        if _sha(raw) != state["transcript_sha256"]:
+            _fail(f"ingested transcript hash drift: {state['cell_id']}")
+        transcript = _strict_loads(raw)
+        _validate_schema(TRANSCRIPT_SCHEMA, transcript, "preserved transcript")
+        if manifest["authorization_record_sha256"] != transcript["source"][
+            "authorization_record_sha256"
+        ]:
+            _fail(f"transcript authorization binding drift: {state['cell_id']}")
+        external_receipt = _external_session_receipt(transcript, cell)
+        started_at = _timestamp(
+            external_receipt["started_at"], "external session started_at"
+        )
+        completed_at = _timestamp(
+            external_receipt["completed_at"], "external session completed_at"
+        )
+        if started_at < _timestamp(
+            authorization["decision"]["decided_at"], "authorization decided_at"
+        ):
+            _fail(f"transcript predates authorization: {state['cell_id']}")
+        identifiers = (
+            (transcript["source"]["source_artifact_id"], seen_source_artifact_ids),
+            (external_receipt["receipt_id"], seen_external_receipt_ids),
+            (external_receipt["external_session_id"], seen_external_session_ids),
+        )
+        for identifier, seen in identifiers:
+            if identifier in seen:
+                _fail(f"external session identity was reused: {identifier}")
+            seen.add(identifier)
+        if last_completed_at is not None and started_at < last_completed_at:
+            _fail(f"external session time/order regressed: {state['cell_id']}")
+        last_completed_at = completed_at
+        if semantic:
+            _validate_transcript(transcript, cell, plan, plan_sha)
+        expected_receipt = _json_bytes(
+            _receipt_value(
+                plan_sha, cell, state["transcript_ref"], raw, transcript
+            )
+        )
+        actual_receipt = _read_file(run_dir / state["ingestion_receipt_ref"])
+        if actual_receipt != expected_receipt:
+            _fail(f"ingestion receipt drift: {state['cell_id']}")
+    return {
+        "source_artifact_ids": seen_source_artifact_ids,
+        "external_receipt_ids": seen_external_receipt_ids,
+        "external_session_ids": seen_external_session_ids,
+        "last_completed_at": last_completed_at,
+    }
+
+
+def validate_run(args: argparse.Namespace) -> dict[str, Any]:
+    plan, _, plan_sha, manifest = _load_run(args.run_dir, args.plan_sha256)
+    _validate_materials(
+        args.run_dir, plan, required=manifest["status"] != "initialized"
+    )
+    _validate_ingested_artifacts(args.run_dir, plan, plan_sha, manifest)
+    if manifest["status"] == "blind_finalized":
+        _validate_blind_bundle(args.run_dir, plan, plan_sha, manifest)
+    _validate_run_inventory(args.run_dir, plan, manifest)
+    return {
+        "run_plan_sha256": plan_sha,
+        "status": manifest["status"],
+        "ingested": sum(
+            row["status"] == "ingested" for row in manifest["cells"]
+        ),
+        "cells": 64,
+        "dispatch_available": False,
+    }
+
+
+def _record_stop(
+    run_dir: Path,
+    plan: dict[str, Any],
+    plan_sha: str,
+    manifest: dict[str, Any],
+    raw: bytes,
+    violation: StopViolation,
+    preserved_auxiliary_artifacts: list[dict[str, str]] | None = None,
+) -> None:
+    index = manifest["next_sequence_index"] - 1
+    expected = plan["cells"][index]
+    raw_sha = _sha(raw)
+    raw_ref = f"blocked/{expected['cell_id']}.transcript.{raw_sha}.raw"
+    raw_path = run_dir / raw_ref
+    if raw_path.exists() or raw_path.is_symlink():
+        try:
+            collision = _read_file(raw_path, limit=max(MAX_TRANSCRIPT_BYTES, len(raw)))
+        except EnvelopeError:
+            collision = None
+        if collision != raw:
+            while True:
+                candidate = raw_ref + f".collision-{secrets.token_hex(8)}"
+                if not (run_dir / candidate).exists():
+                    raw_ref = candidate
+                    raw_path = run_dir / raw_ref
+                    break
+    supplied = list(preserved_auxiliary_artifacts or [])
+    if len(supplied) > 64:
+        _fail("too many pre-stop artifacts to register in the closed stop receipt")
+    stopped_manifest = copy.deepcopy(manifest)
+    stopped_manifest["cells"][index].update(
+        status="blocked",
+        transcript_ref=raw_ref,
+        transcript_sha256=raw_sha,
+        ingestion_receipt_ref=None,
+    )
+    stopped_manifest["status"] = "stopped"
+    stopped_manifest["stopped"] = True
+    stopped_manifest["stop_receipt"] = {
+        "cell_id": expected["cell_id"],
+        "sequence_index": expected["sequence_index"],
+        "reason_code": violation.code,
+        "detail": violation.detail[:2000],
+        "raw_ref": raw_ref,
+        "raw_sha256": raw_sha,
+        "retry_forbidden": True,
+        "stop_intent_ref": STOP_INTENT_REF,
+        "stop_intent_committed_before_state_replacement": True,
+        "preserved_auxiliary_artifacts": supplied,
+        "preserved_unregistered_tree": {
+            "file_count": 0,
+            "directory_count": 0,
+            "canonical_tree_sha256": _sha(
+                _canonical({"files": [], "directories": []})
+            ),
+        },
+    }
+    expected_files, expected_directories = _expected_run_inventory(
+        run_dir, plan, stopped_manifest
+    )
+    observed_files, observed_directories = _relative_files_and_directories(run_dir)
+    stopped_manifest["stop_receipt"]["preserved_unregistered_tree"] = (
+        _unregistered_tree_snapshot(
+            run_dir,
+            observed_files - expected_files,
+            observed_directories - expected_directories,
+        )
+    )
+    _validate_manifest(stopped_manifest, plan, plan_sha)
+    prior_manifest_raw = _read_file(run_dir / "ingestion-manifest.json")
+    if _strict_loads(prior_manifest_raw) != manifest:
+        _fail("ingestion manifest changed while preparing durable stop intent")
+    stopped_raw = _json_bytes(stopped_manifest)
+    marker = {
+        "schema_version": "indirect-prompt-injection-stop-intent/1.0",
+        "suite": SUITE,
+        "run_plan_sha256": plan_sha,
+        "prior_manifest_sha256": _sha(prior_manifest_raw),
+        "cell_id": expected["cell_id"],
+        "sequence_index": expected["sequence_index"],
+        "reason_code": violation.code,
+        "detail": violation.detail[:2000],
+        "raw_ref": raw_ref,
+        "raw_sha256": raw_sha,
+        "raw_base64": base64.b64encode(raw).decode("ascii"),
+        "stopped_manifest_sha256": _sha(stopped_raw),
+        "stopped_manifest_base64": base64.b64encode(stopped_raw).decode("ascii"),
+        "retry_forbidden": True,
+    }
+    marker_raw = _json_bytes(marker)
+    _validate_stop_intent(marker_raw, plan, plan_sha)
+    # The pre-armed journal token was irreversibly claimed before any external
+    # bytes were read.  Preserve available raw bytes before the primary stop
+    # intent so even a marker-write failure leaves both a terminal claim and
+    # content-addressed evidence; neither state permits another attempt.
+    try:
+        _ensure_exact_new(raw_path, raw, root=run_dir)
+        _ensure_exact_new(run_dir / STOP_INTENT_REF, marker_raw, root=run_dir)
+        _replace_json(
+            run_dir / "ingestion-manifest.json", stopped_manifest, root=run_dir
+        )
+    except EnvelopeError as exc:
+        raise EnvelopeError(
+            "irreversible transaction claim committed; stopped-state replay is "
+            "pending and retry is forbidden"
+        ) from exc
+    _validate_run_inventory(run_dir, plan, stopped_manifest)
+
+
+def _record_preload_quarantine(
+    run_dir: Path, expected_plan_sha: str, raw: bytes, detail: str
+) -> None:
+    if re.fullmatch(r"[0-9a-f]{64}", expected_plan_sha) is None:
+        _fail("cannot bind pre-load quarantine to an invalid expected plan SHA")
+    marker = {
+        "schema_version": "indirect-prompt-injection-preload-quarantine/1.0",
+        "suite": SUITE,
+        "expected_run_plan_sha256": expected_plan_sha,
+        "reason_code": "preload_frozen_state_drift",
+        "detail": detail[:2000],
+        "raw_sha256": _sha(raw),
+        "raw_base64": base64.b64encode(raw).decode("ascii"),
+        "retry_forbidden": True,
+    }
+    marker_raw = _json_bytes(marker)
+    _validate_preload_quarantine(marker_raw, expected_plan_sha)
+    _ensure_exact_new(run_dir / PRELOAD_QUARANTINE_REF, marker_raw, root=run_dir)
+
+
+def ingest(args: argparse.Namespace) -> dict[str, Any]:
+    if (args.run_dir / PRELOAD_QUARANTINE_REF).exists():
+        _fail("run is permanently quarantined; retry is forbidden")
+    preload_claimed = args.run_dir / _journal_ref(
+        "claimed", PRELOAD_TRANSACTION_ID
+    )
+    if preload_claimed.exists() or preload_claimed.is_symlink():
+        _fail("pre-load terminal transaction was claimed; retry is forbidden")
+    claimed_cell = next(
+        (args.run_dir / JOURNAL_ROOT / "claimed").glob("cell-*.json"),
+        None,
+    )
+    stop_intent_path = args.run_dir / STOP_INTENT_REF
+    replaying_existing_stop = (
+        claimed_cell is not None
+        and stop_intent_path.exists()
+        and not stop_intent_path.is_symlink()
+    )
+    if claimed_cell is not None and not replaying_existing_stop:
+        _fail(
+            "an ingestion transaction remains claimed; retry is forbidden before "
+            "reading another transcript"
+        )
+    try:
+        plan, _, plan_sha, manifest = _load_run(args.run_dir, args.plan_sha256)
+    except EnvelopeError as exc:
+        if claimed_cell is not None:
+            raise EnvelopeError(
+                "an ingestion transaction remains claimed and its durable stop "
+                "intent could not be replayed; retry is forbidden before reading "
+                "another transcript"
+            ) from exc
+        preload_armed = args.run_dir / _journal_ref(
+            "armed", PRELOAD_TRANSACTION_ID
+        )
+        if not preload_armed.exists() or preload_armed.is_symlink():
+            raise EnvelopeError(
+                "pre-load validation failed before a transaction boundary was "
+                "available; transcript was not acquired"
+            ) from exc
+        try:
+            _claim_journal_token(
+                args.run_dir,
+                args.plan_sha256,
+                PRELOAD_TRANSACTION_ID,
+                None,
+            )
+        except EnvelopeError as claim_exc:
+            raise EnvelopeError(
+                "pre-load validation failed and the terminal claim could not be "
+                "confirmed; transcript was not acquired and retry is forbidden"
+            ) from claim_exc
+        try:
+            raw = _read_file(args.transcript, limit=MAX_TRANSCRIPT_BYTES)
+            acquisition_detail = ""
+        except EnvelopeError as acquisition_exc:
+            raw = b""
+            acquisition_detail = (
+                f"; submitted transcript acquisition also failed: {acquisition_exc}"
+            )
+        try:
+            _record_preload_quarantine(
+                args.run_dir,
+                args.plan_sha256,
+                raw,
+                f"pre-load frozen state validation failed: {exc}{acquisition_detail}",
+            )
+        except EnvelopeError as marker_exc:
+            raise EnvelopeError(
+                "pre-load drift detected and quarantine marker could not be committed; "
+                "do not restore or retry this run"
+            ) from marker_exc
+        raise EnvelopeError(
+            f"run permanently quarantined after pre-load frozen-state drift: {exc}"
+        ) from exc
+    if manifest["stopped"]:
+        _fail("run is stopped; the frozen protocol forbids retry")
+    if manifest["status"] in {"complete", "blind_finalized"}:
+        _fail("all 64 transcripts are already ingested")
+    if manifest["status"] not in {"materialized", "ingesting"}:
+        _fail("transcripts may be ingested only after materialization")
+    expected = plan["cells"][manifest["next_sequence_index"] - 1]
+    transcript_ref = f"transcripts/{expected['cell_id']}.json"
+    receipt_ref = f"receipts/{expected['cell_id']}.json"
+    _claim_journal_token(
+        args.run_dir,
+        plan_sha,
+        expected["cell_id"],
+        expected["sequence_index"],
+    )
+    try:
+        raw = _read_file(args.transcript, limit=MAX_TRANSCRIPT_BYTES)
+    except EnvelopeError as exc:
+        violation = StopViolation(
+            "transcript_contract_failure",
+            f"submitted transcript acquisition failed after irreversible claim: {exc}",
+        )
+        try:
+            _record_stop(
+                args.run_dir,
+                plan,
+                plan_sha,
+                manifest,
+                b"",
+                violation,
+            )
+        except EnvelopeError as stop_exc:
+            raise EnvelopeError(
+                "transcript acquisition failed after irreversible journal claim; "
+                "stop replay is pending and retry is forbidden"
+            ) from stop_exc
+        raise violation from exc
+    try:
+        _validate_materials(args.run_dir, plan, required=True)
+        sequence_state = _validate_ingested_artifacts(
+            args.run_dir, plan, plan_sha, manifest, semantic=False
+        )
+        _validate_run_inventory(
+            args.run_dir,
+            plan,
+            manifest,
+            active_attempt_cell_id=expected["cell_id"],
+        )
+    except EnvelopeError as exc:
+        detail = str(exc)
+        if "material" in detail or "prompt" in detail or "envelope" in detail:
+            code = "prompt_or_plan_hash_mismatch"
+        elif "authorization" in detail:
+            code = "authorization_record_missing_or_mismatch"
+        else:
+            code = "transcript_contract_failure"
+        violation = StopViolation(
+            code,
+            f"prior frozen evidence drift blocks further ingestion: {detail}",
+        )
+        try:
+            _record_stop(
+                args.run_dir,
+                plan,
+                plan_sha,
+                manifest,
+                raw,
+                violation,
+            )
+        except EnvelopeError as stop_exc:
+            raise EnvelopeError(
+                "prior evidence drift was detected but stop evidence could not be "
+                "persisted; do not retry"
+            ) from stop_exc
+        raise violation from exc
+    try:
+        value = _strict_loads(raw)
+        _validate_transcript(value, expected, plan, plan_sha)
+        try:
+            authorization_raw = _read_file(args.authorization_record)
+            authorization = _strict_loads(authorization_raw)
+            _validate_authorization_record(authorization, plan, plan_sha)
+        except EnvelopeError as exc:
+            raise StopViolation(
+                "authorization_record_missing_or_mismatch",
+                f"cannot verify external authorization record: {exc}",
+            ) from exc
+        authorization_sha = _sha(authorization_raw)
+        if authorization_sha != value["source"]["authorization_record_sha256"]:
+            raise StopViolation(
+                "authorization_record_missing_or_mismatch",
+                "authorization bytes do not match transcript binding",
+            )
+        if value["source"]["authorization_record_ref"] != authorization["record_id"]:
+            raise StopViolation(
+                "authorization_record_missing_or_mismatch",
+                "authorization reference differs from record id",
+            )
+        external_receipt = _external_session_receipt(value, expected)
+        started_at = _timestamp(
+            external_receipt["started_at"], "external session started_at"
+        )
+        if started_at < _timestamp(
+            authorization["decision"]["decided_at"], "authorization decided_at"
+        ):
+            raise StopViolation(
+                "authorization_record_missing_or_mismatch",
+                "transcript predates external authorization",
+            )
+        uniqueness = (
+            (
+                value["source"]["source_artifact_id"],
+                sequence_state["source_artifact_ids"],
+            ),
+            (
+                external_receipt["receipt_id"],
+                sequence_state["external_receipt_ids"],
+            ),
+            (
+                external_receipt["external_session_id"],
+                sequence_state["external_session_ids"],
+            ),
+        )
+        if any(identifier in seen for identifier, seen in uniqueness):
+            raise StopViolation(
+                "out_of_order_ingestion",
+                "external artifact, receipt, or fresh-context session id was reused",
+            )
+        last_completed_at = sequence_state["last_completed_at"]
+        if last_completed_at is not None and started_at < last_completed_at:
+            raise StopViolation(
+                "out_of_order_ingestion",
+                "external session time/order regressed across frozen cells",
+            )
+        if manifest["authorization_record_sha256"] not in {None, authorization_sha}:
+            raise StopViolation(
+                "authorization_record_missing_or_mismatch",
+                "run is already bound to a different authorization record",
+            )
+    except StopViolation as violation:
+        try:
+            _record_stop(args.run_dir, plan, plan_sha, manifest, raw, violation)
+        except EnvelopeError as stop_exc:
+            raise EnvelopeError(
+                "run stopped but stop evidence could not be persisted; do not retry"
+            ) from stop_exc
+        raise
+    except EnvelopeError as exc:
+        violation = StopViolation("transcript_contract_failure", str(exc))
+        try:
+            _record_stop(args.run_dir, plan, plan_sha, manifest, raw, violation)
+        except EnvelopeError as stop_exc:
+            raise EnvelopeError(
+                "invalid transcript could not be preserved; do not retry"
+            ) from stop_exc
+        raise violation from exc
+    cell_id = expected["cell_id"]
+    receipt = _receipt_value(plan_sha, expected, transcript_ref, raw, value)
+    receipt_raw = _json_bytes(receipt)
+    before = copy.deepcopy(manifest)
+    try:
+        if manifest["authorization_record_sha256"] is None:
+            _write_new(
+                args.run_dir / "authorization/record.json",
+                authorization_raw,
+                root=args.run_dir,
+            )
+            manifest["authorization_record_path"] = "authorization/record.json"
+            manifest["authorization_record_sha256"] = authorization_sha
+        _write_new(args.run_dir / transcript_ref, raw, root=args.run_dir)
+        _write_new(
+            args.run_dir / receipt_ref, receipt_raw, root=args.run_dir
+        )
+    except EnvelopeError as exc:
+        violation = StopViolation(
+            "evidence_write_failure", f"cannot preserve transcript/receipt: {exc}"
+        )
+        try:
+            stop_base = before
+            partial_evidence = _preserved_ingestion_artifacts(
+                args.run_dir,
+                stop_base,
+                authorization_raw,
+                transcript_ref,
+                raw,
+                receipt_ref,
+                receipt_raw,
+            )
+            _record_stop(
+                args.run_dir,
+                plan,
+                plan_sha,
+                stop_base,
+                raw,
+                violation,
+                partial_evidence,
+            )
+        except EnvelopeError as stop_exc:
+            raise EnvelopeError(
+                "evidence write and stop-receipt writes failed; do not retry"
+            ) from stop_exc
+        raise violation from exc
+    stop_base = before
+    manifest["cells"][expected["sequence_index"] - 1].update(
+        status="ingested",
+        transcript_ref=transcript_ref,
+        transcript_sha256=_sha(raw),
+        ingestion_receipt_ref=receipt_ref,
+    )
+    manifest["next_sequence_index"] += 1
+    ingested = manifest["next_sequence_index"] - 1
+    manifest["status"] = "complete" if ingested == 64 else "ingesting"
+    _validate_manifest(manifest, plan, plan_sha)
+    try:
+        _replace_json(
+            args.run_dir / "ingestion-manifest.json", manifest, root=args.run_dir
+        )
+    except EnvelopeError as exc:
+        violation = StopViolation(
+            "evidence_write_failure", f"cannot persist ingestion manifest: {exc}"
+        )
+        manifest_path = args.run_dir / "ingestion-manifest.json"
+        desired_raw = _json_bytes(manifest)
+        prior_raw = _json_bytes(stop_base)
+        try:
+            observed_manifest_raw = _read_file(manifest_path)
+        except EnvelopeError as observed_exc:
+            raise EnvelopeError(
+                "manifest publication state is unreadable after a failed replace; "
+                "the claimed transaction forbids retry"
+            ) from observed_exc
+        if observed_manifest_raw == desired_raw:
+            raise EnvelopeError(
+                "ingestion manifest was published without a completed transaction "
+                "journal; retry is forbidden"
+            ) from exc
+        if observed_manifest_raw != prior_raw:
+            raise EnvelopeError(
+                "ingestion manifest publication is ambiguous after replace failure; "
+                "the claimed transaction forbids retry"
+            ) from exc
+        try:
+            partial_evidence = _preserved_ingestion_artifacts(
+                args.run_dir,
+                stop_base,
+                authorization_raw,
+                transcript_ref,
+                raw,
+                receipt_ref,
+                receipt_raw,
+            )
+            _record_stop(
+                args.run_dir,
+                plan,
+                plan_sha,
+                stop_base,
+                raw,
+                violation,
+                partial_evidence,
+            )
+        except EnvelopeError as stop_exc:
+            raise EnvelopeError(
+                "manifest and stop-receipt writes failed; do not retry"
+            ) from stop_exc
+        raise violation from exc
+    try:
+        _complete_journal_token(
+            args.run_dir,
+            plan_sha,
+            expected["cell_id"],
+            expected["sequence_index"],
+        )
+    except EnvelopeError as exc:
+        raise EnvelopeError(
+            "ingestion manifest was published but transaction completion is "
+            "ambiguous; retry is forbidden"
+        ) from exc
+    _validate_run_inventory(args.run_dir, plan, manifest)
+    return {
+        "ingested": ingested,
+        "next_sequence_index": manifest["next_sequence_index"],
+        "dispatch_available": False,
+    }
+
+
+def _blind_identifiers(plan: dict[str, Any]) -> set[str]:
+    identifiers: set[str] = set()
+    for cell in plan["cells"]:
+        identifiers.update(
+            _normalized_blind_text(str(cell[key]))
+            for key in (
+                "cell_id",
+                "scenario_id",
+                "counterbalance_block_id",
+            )
+        )
+    return identifiers
+
+
+def _normalized_blind_text(text: str) -> str:
+    return _blind_screen_text(text)
+
+
+def _compact_blind_text(text: str) -> str:
+    return "".join(_blind_screen_text(text).split())
+
+
+def _fold_blind_alphanumeric(source_character: str) -> str:
+    visible = "".join(
+        folded
+        for folded in unicodedata.normalize("NFKD", source_character.casefold())
+        if unicodedata.category(folded)[0] not in {"M", "C", "P", "S", "Z"}
+    )
+    if visible:
+        return visible
+    return source_character.casefold()
+
+
+def _blind_screen_text(text: str) -> str:
+    """Project source code points atomically for obfuscation-safe screening."""
+    projected: list[str] = []
+    for source_character in text:
+        source_category = unicodedata.category(source_character)[0]
+        if source_category in {"M", "C"}:
+            continue
+        if source_category in {"P", "S", "Z"}:
+            projected.append(" ")
+            continue
+        projected.append(_fold_blind_alphanumeric(source_character))
+    return " ".join("".join(projected).split())
+
+
+def _joined_blind_text(text: str) -> str:
+    """Join injected mark/format/punctuation/symbol splits but retain spacing."""
+    projected: list[str] = []
+    for source_character in text:
+        source_category = unicodedata.category(source_character)[0]
+        if source_category in {"M", "C", "P", "S"}:
+            continue
+        if source_category == "Z":
+            projected.append(" ")
+            continue
+        projected.append(_fold_blind_alphanumeric(source_character))
+    return " ".join("".join(projected).split())
+
+
+def _contains_complete_compact_identifier(text: str, identifier: str) -> bool:
+    """Match a complete identifier while preserving source L/N adjacency."""
+    compact = _compact_blind_text(identifier)
+    if len(compact) < 4:
+        return False
+    haystack = _blind_screen_text(text)
+    separator = r"\s*"
+    return re.search(
+        r"(?<![^\W_])"
+        + separator.join(re.escape(character) for character in compact)
+        + r"(?![^\W_])",
+        haystack,
+    ) is not None
+
+
+def _contains_compact_phrase(text: str, phrase: str) -> bool:
+    compact = _compact_blind_text(phrase)
+    if any(ord(character) > 127 for character in compact):
+        return compact in _compact_blind_text(text)
+    return _contains_complete_compact_identifier(text, phrase)
+
+
+def _assert_blindable_transcript(
+    plan: dict[str, Any],
+    transcript: dict[str, Any],
+    expected: dict[str, Any],
+    external_receipt: dict[str, Any],
+) -> None:
+    texts = [transcript["response"]["raw_response_utf8"]]
+    texts.extend(event["payload_utf8"] for event in (
+        _normalize_raw_event(raw_event, expected, external_receipt)
+        for raw_event in transcript["events"]
+    ))
+    for text in texts:
+        folded = _normalized_blind_text(text)
+        joined = _joined_blind_text(text)
+        leaked = next(
+            (
+                identifier
+                for identifier in _blind_identifiers(plan)
+                if _contains_complete_compact_identifier(text, identifier)
+            ),
+            None,
+        )
+        if leaked is not None:
+            _fail(f"subject/event free text leaks frozen blind identifier {leaked!r}")
+        if any(
+            pattern.search(candidate)
+            for pattern in MAPPING_LEAK_PATTERNS
+            for candidate in (folded, joined)
+        ) or re.search(
+            r"\b(?:content|guidance)\s+condition\s+"
+            r"(?:benign|injected|ars\s+guided|platform\s+only)\b",
+            joined,
+        ) or any(
+            _contains_compact_phrase(text, phrase)
+            for phrase in MAPPING_LEAK_COMPACT_PHRASES
+        ):
+            _fail("subject/event free text leaks cell/scenario/pair/replicate/arm mapping")
+        if any(
+            pattern.search(candidate)
+            for pattern in HUMAN_EVIDENCE_PATTERNS
+            for candidate in (folded, joined)
+        ) or any(
+            _contains_compact_phrase(text, phrase)
+            for phrase in HUMAN_EVIDENCE_COMPACT_PHRASES
+        ):
+            _fail("subject/event free text contains prior label/adjudication/human evidence")
+
+
+def _assert_blind_packet_structure(packet: dict[str, Any]) -> None:
+    forbidden_keys = {
+        "arm",
+        "arm_id",
+        "canary",
+        "cell_id",
+        "content_condition",
+        "counterbalance_block_id",
+        "adjudication",
+        "adjudicator_output",
+        "expected_artifact",
+        "guidance_condition",
+        "human_label",
+        "human_labels",
+        "judge_output",
+        "label",
+        "labels",
+        "other_transcript",
+        "other_transcripts",
+        "pair_id",
+        "replicate",
+        "scenario_id",
+        "sequence_index",
+    }
+
+    def visit(value: Any) -> None:
+        if isinstance(value, dict):
+            leaked = forbidden_keys.intersection(value)
+            if leaked:
+                _fail(
+                    "blind packet contains forbidden assignment/human-evidence "
+                    f"keys {sorted(leaked)!r}"
+                )
+            for child in value.values():
+                visit(child)
+        elif isinstance(value, list):
+            for child in value:
+                visit(child)
+
+    visit(packet)
+
+
+def _assignment_boundary() -> dict[str, Any]:
+    return {
+        "future_closed_assignment_ledger_gate_required": True,
+        "future_assignment_ledger_schema_ref": (
+            "evals/heldout/indirect_prompt_injection_behavior/"
+            "judge_assignment_ledger.schema.json"
+        ),
+        "future_assignment_ledger_schema_sha256": _sha(
+            _read_file(ASSIGNMENT_LEDGER_SCHEMA)
+        ),
+        "assignment_ledger_implemented_by_no_call_runner": False,
+        "same_judge_cross_condition_exposure_forbidden": True,
+        "bundle_alone_proves_arm_blindness": False,
+    }
+
+
+def _blind_packet_value(
+    blind_id: str,
+    scenario: dict[str, Any],
+    content_condition: str,
+    transcript: dict[str, Any],
+    rubric_raw: bytes,
+) -> dict[str, Any]:
+    return {
+        "schema_version": "indirect-prompt-injection-isolated-blind-session/1.0",
+        "suite": SUITE,
+        "blind_session_id": blind_id,
+        "content_class": "repository-owned synthetic matched controls",
+        "blinded_to": BLINDED_TO,
+        "delivery": {
+            "isolated_single_session": True,
+            "deliver_other_sessions_together": False,
+            "assignment_ledger_gate_required_before_delivery": True,
+        },
+        "assignment_boundary": _assignment_boundary(),
+        "labels_present": False,
+        "adjudication_present": False,
+        "human_evidence_present": False,
+        "rubric": {
+            "sha256": _sha(rubric_raw),
+            "text": rubric_raw.decode("utf-8"),
+        },
+        "trusted_task": scenario["trusted_task"],
+        "external_content": phase1.external_content(scenario, content_condition),
+        "raw_subject_response": {
+            "utf8": transcript["response"]["raw_response_utf8"],
+            "bytes": transcript["response"]["raw_response_bytes"],
+            "sha256": transcript["response"]["raw_response_sha256"],
+        },
+        "raw_events": transcript["events"],
+        "parse_diagnostics": transcript["response"]["parse_diagnostics"],
+    }
+
+
+def _blind_inventory_value(
+    plan_sha: str, rows: list[dict[str, Any]]
+) -> dict[str, Any]:
+    return {
+        "schema_version": "indirect-prompt-injection-blind-inventory/1.0",
+        "suite": SUITE,
+        "run_plan_sha256": plan_sha,
+        "packet_count": 64,
+        "delivery_rule": "deliver_exactly_one_isolated_packet_per_first_round_judge_assignment",
+        "labels_present": False,
+        "adjudication_present": False,
+        "human_evidence_present": False,
+        "assignment_boundary": _assignment_boundary(),
+        "packets": rows,
+    }
+
+
+def _private_map_value(
+    plan_sha: str, inventory_raw: bytes, mappings: list[dict[str, Any]]
+) -> dict[str, Any]:
+    return {
+        "schema_version": "indirect-prompt-injection-blind-private-map/1.0",
+        "suite": SUITE,
+        "run_plan_sha256": plan_sha,
+        "inventory_sha256": _sha(inventory_raw),
+        "private": True,
+        "protection": {
+            "kind": "procedural_nondisclosure_plus_local_mode_bits",
+            "encrypted": False,
+            "directory_mode": "0700",
+            "file_mode": "0600",
+            "mode_bits_are_not_identity_or_access_control_proof": True,
+            "unblind_only_after_raw_labels_and_adjudication_sealed": True,
+        },
+        "labels_present": False,
+        "adjudication_present": False,
+        "human_evidence_present": False,
+        "assignment_boundary": _assignment_boundary(),
+        "mappings": mappings,
+    }
+
+
+def _blind_manifest_value(
+    plan_sha: str,
+    source_manifest_sha: str,
+    inventory_raw: bytes,
+    packet_rows: list[dict[str, Any]],
+    private_map_raw: bytes,
+) -> dict[str, Any]:
+    return {
+        "schema_version": "indirect-prompt-injection-blind-manifest/1.0",
+        "suite": SUITE,
+        "run_plan_sha256": plan_sha,
+        "source_ingestion_manifest_sha256": source_manifest_sha,
+        "inventory_ref": "blind/inventory.json",
+        "inventory_sha256": _sha(inventory_raw),
+        "private_map_ref": "blind/private/map.json",
+        "private_map_sha256": _sha(private_map_raw),
+        "packet_count": 64,
+        "packets": packet_rows,
+        "finalized_artifacts": True,
+        "exact_inventory_required": True,
+        "assignment_boundary": _assignment_boundary(),
+    }
+
+
+def _source_ingestion_manifest(manifest: dict[str, Any]) -> dict[str, Any]:
+    source = copy.deepcopy(manifest)
+    source["status"] = "complete"
+    source["blind_manifest_ref"] = None
+    source["blind_manifest_sha256"] = None
+    return source
+
+
+def _validate_blind_bundle(
+    run_dir: Path,
+    plan: dict[str, Any],
+    plan_sha: str,
+    manifest: dict[str, Any],
+    *,
+    bundle_root: Path | None = None,
+) -> tuple[str, str]:
+    bundle_root = run_dir / "blind" if bundle_root is None else bundle_root
+    if bundle_root.is_symlink() or not bundle_root.is_dir():
+        _fail("blind bundle root must be a real non-symlink directory")
+    blind_manifest_raw = _read_file(bundle_root / "manifest.json")
+    blind_manifest_sha = _sha(blind_manifest_raw)
+    blind_manifest = _strict_loads(blind_manifest_raw)
+    _validate_schema(BLIND_MANIFEST_SCHEMA, blind_manifest, "blind manifest")
+    source_sha = _sha(_json_bytes(_source_ingestion_manifest(manifest)))
+    if blind_manifest["run_plan_sha256"] != plan_sha or blind_manifest[
+        "source_ingestion_manifest_sha256"
+    ] != source_sha:
+        _fail("blind manifest plan/source-ingestion binding drift")
+    if manifest["status"] == "blind_finalized" and (
+        manifest["blind_manifest_ref"], manifest["blind_manifest_sha256"]
+    ) != ("blind/manifest.json", blind_manifest_sha):
+        _fail("finalized ingestion state disagrees with blind manifest bytes")
+    packet_rows = blind_manifest["packets"]
+    blind_ids = [row["blind_session_id"] for row in packet_rows]
+    if blind_ids != sorted(blind_ids) or len(set(blind_ids)) != 64:
+        _fail("blind manifest packet ids must be unique and canonically ordered")
+    expected_bundle_files = {
+        "manifest.json",
+        str(Path(blind_manifest["inventory_ref"]).relative_to("blind")),
+        str(Path(blind_manifest["private_map_ref"]).relative_to("blind")),
+    }
+    expected_bundle_files.update(
+        str(Path(row["packet_ref"]).relative_to("blind")) for row in packet_rows
+    )
+    observed_files, observed_directories = _relative_files_and_directories(
+        bundle_root
+    )
+    if observed_files != expected_bundle_files or observed_directories != _parent_directories(
+        expected_bundle_files
+    ):
+        _fail("blind bundle file/directory inventory is not exact")
+    inventory_raw = _read_file(
+        bundle_root / Path(blind_manifest["inventory_ref"]).relative_to("blind")
+    )
+    private_path = (
+        bundle_root / Path(blind_manifest["private_map_ref"]).relative_to("blind")
+    )
+    private_raw = _read_file(private_path)
+    if _sha(inventory_raw) != blind_manifest["inventory_sha256"]:
+        _fail("blind inventory hash drift")
+    if _sha(private_raw) != blind_manifest["private_map_sha256"]:
+        _fail("private map hash drift")
+    if stat.S_IMODE(private_path.parent.stat().st_mode) != 0o700:
+        _fail("private map directory mode must remain 0700")
+    if stat.S_IMODE(private_path.stat().st_mode) != 0o600:
+        _fail("private map file mode must remain 0600")
+    inventory = _strict_loads(inventory_raw)
+    private_map = _strict_loads(private_raw)
+    _validate_schema(BLIND_INVENTORY_SCHEMA, inventory, "blind inventory")
+    _validate_schema(BLIND_MAP_SCHEMA, private_map, "private blind map")
+    if private_map["inventory_sha256"] != _sha(inventory_raw):
+        _fail("private map inventory binding drift")
+    mapping_by_id = {
+        row["blind_session_id"]: row for row in private_map["mappings"]
+    }
+    if len(mapping_by_id) != 64:
+        _fail("private map blind ids must be unique")
+    plan_by_cell = {cell["cell_id"]: cell for cell in plan["cells"]}
+    state_by_cell = {row["cell_id"]: row for row in manifest["cells"]}
+    if {row["cell_id"] for row in private_map["mappings"]} != set(plan_by_cell):
+        _fail("private map must cover every frozen cell exactly once")
+    scenarios = _scenario_index(phase1.load_assets()[0])
+    rubric_raw = _read_file(RUBRIC)
+    expected_inventory_rows: list[dict[str, Any]] = []
+    expected_mappings: list[dict[str, Any]] = []
+    for packet_row in blind_manifest["packets"]:
+        blind_id = packet_row["blind_session_id"]
+        mapping = mapping_by_id.get(blind_id)
+        if mapping is None or mapping["cell_id"] not in plan_by_cell:
+            _fail(f"private mapping missing for {blind_id}")
+        cell = plan_by_cell[mapping["cell_id"]]
+        expected_mapping = {
+            "blind_session_id": blind_id,
+            "packet_sha256": packet_row["packet_sha256"],
+            "cell_id": cell["cell_id"],
+            "sequence_index": cell["sequence_index"],
+            "scenario_id": cell["scenario_id"],
+            "content_condition": cell["content_condition"],
+            "guidance_condition": cell["guidance_condition"],
+            "replicate": cell["replicate"],
+        }
+        if mapping != expected_mapping:
+            _fail(f"private mapping drift for {blind_id}")
+        transcript = _strict_loads(
+            _read_file(run_dir / state_by_cell[cell["cell_id"]]["transcript_ref"])
+        )
+        external_receipt = _external_session_receipt(transcript, cell)
+        _assert_blindable_transcript(plan, transcript, cell, external_receipt)
+        expected_packet = _blind_packet_value(
+            blind_id,
+            scenarios[cell["scenario_id"]],
+            cell["content_condition"],
+            transcript,
+            rubric_raw,
+        )
+        _assert_blind_packet_structure(expected_packet)
+        _validate_schema(
+            BLIND_PACKET_SCHEMA, expected_packet, "replayed isolated blind packet"
+        )
+        expected_raw = _json_bytes(expected_packet)
+        actual_raw = _read_file(
+            bundle_root / Path(packet_row["packet_ref"]).relative_to("blind")
+        )
+        if actual_raw != expected_raw or _sha(actual_raw) != packet_row[
+            "packet_sha256"
+        ] or len(actual_raw) != packet_row["packet_bytes"]:
+            _fail(f"blind packet replay/hash/byte drift for {blind_id}")
+        expected_inventory_rows.append(
+            {
+                "blind_session_id": blind_id,
+                "packet_ref": str(Path(packet_row["packet_ref"]).relative_to("blind")),
+                "packet_sha256": _sha(actual_raw),
+                "packet_bytes": len(actual_raw),
+            }
+        )
+        expected_mappings.append(expected_mapping)
+    expected_inventory_rows.sort(key=lambda row: row["blind_session_id"])
+    expected_mappings.sort(key=lambda row: row["blind_session_id"])
+    if inventory != _blind_inventory_value(plan_sha, expected_inventory_rows):
+        _fail("blind inventory replay drift")
+    if private_map != _private_map_value(plan_sha, inventory_raw, expected_mappings):
+        _fail("private map replay drift")
+    expected_blind_manifest = _blind_manifest_value(
+        plan_sha,
+        source_sha,
+        inventory_raw,
+        blind_manifest["packets"],
+        private_raw,
+    )
+    if blind_manifest != expected_blind_manifest:
+        _fail("blind manifest replay drift")
+    return blind_manifest_sha, _sha(inventory_raw)
+
+
+def _finalize_blind_state(
+    run_dir: Path,
+    plan: dict[str, Any],
+    plan_sha: str,
+    manifest: dict[str, Any],
+    blind_manifest_sha: str,
+) -> dict[str, Any]:
+    finalized = copy.deepcopy(manifest)
+    finalized["status"] = "blind_finalized"
+    finalized["blind_manifest_ref"] = "blind/manifest.json"
+    finalized["blind_manifest_sha256"] = blind_manifest_sha
+    _validate_manifest(finalized, plan, plan_sha)
+    _replace_json(run_dir / "ingestion-manifest.json", finalized, root=run_dir)
+    return finalized
+
+
+def prepare_blind_packet(args: argparse.Namespace) -> dict[str, Any]:
+    plan, _, plan_sha, manifest = _load_run(args.run_dir, args.plan_sha256)
+    _validate_materials(args.run_dir, plan, required=True)
+    _validate_ingested_artifacts(args.run_dir, plan, plan_sha, manifest)
+    if manifest["status"] == "blind_finalized":
+        _fail("blind packet is already finalized and write-once")
+    if manifest["status"] != "complete" or manifest["stopped"]:
+        _fail("blind preparation requires 64 complete, unstopped transcript ingestions")
+    blind_root = args.run_dir / "blind"
+    staging = args.run_dir.parent / f".{args.run_dir.name}.blind-next"
+    claimed = args.run_dir / _journal_ref("claimed", BLIND_TRANSACTION_ID)
+    legacy_staging = sorted(
+        args.run_dir.parent.glob(f".{args.run_dir.name}.blind-next-*")
+    )
+    if blind_root.exists() or blind_root.is_symlink():
+        if not (claimed.exists() or claimed.is_symlink()):
+            _claim_journal_token(
+                args.run_dir, plan_sha, BLIND_TRANSACTION_ID, None
+            )
+        _validate_journal_token(
+            args.run_dir, plan_sha, BLIND_TRANSACTION_ID, None, "claimed"
+        )
+        blind_sha, inventory_sha = _validate_blind_bundle(
+            args.run_dir, plan, plan_sha, manifest
+        )
+        finalized = _finalize_blind_state(
+            args.run_dir, plan, plan_sha, manifest, blind_sha
+        )
+        _validate_run_inventory(args.run_dir, plan, finalized)
+        return {
+            "packets": 64,
+            "inventory_sha256": inventory_sha,
+            "labels_present": False,
+            "human_evidence_present": False,
+            "dispatch_available": False,
+            "state": "blind_finalized",
+            "recovered_existing_atomic_bundle": True,
+        }
+    if staging.exists() or staging.is_symlink():
+        if not (claimed.exists() or claimed.is_symlink()):
+            _claim_journal_token(
+                args.run_dir, plan_sha, BLIND_TRANSACTION_ID, None
+            )
+        _validate_journal_token(
+            args.run_dir, plan_sha, BLIND_TRANSACTION_ID, None, "claimed"
+        )
+        try:
+            blind_sha, inventory_sha = _validate_blind_bundle(
+                args.run_dir,
+                plan,
+                plan_sha,
+                manifest,
+                bundle_root=staging,
+            )
+            os.rename(staging, blind_root)
+            _fsync_directory(args.run_dir)
+            _fsync_directory(args.run_dir.parent)
+            _validate_blind_bundle(args.run_dir, plan, plan_sha, manifest)
+        except (EnvelopeError, OSError) as exc:
+            raise EnvelopeError(
+                "deterministic blind staging is incomplete or invalid; its "
+                "irreversible transaction claim forbids regeneration"
+            ) from exc
+        finalized = _finalize_blind_state(
+            args.run_dir, plan, plan_sha, manifest, blind_sha
+        )
+        _validate_run_inventory(args.run_dir, plan, finalized)
+        return {
+            "packets": 64,
+            "inventory_sha256": inventory_sha,
+            "labels_present": False,
+            "human_evidence_present": False,
+            "dispatch_available": False,
+            "state": "blind_finalized",
+            "recovered_existing_atomic_bundle": True,
+        }
+    if legacy_staging:
+        if not (claimed.exists() or claimed.is_symlink()):
+            _claim_journal_token(
+                args.run_dir, plan_sha, BLIND_TRANSACTION_ID, None
+            )
+        raise EnvelopeError(
+            "legacy blind staging residue is permanently quarantined; "
+            "regeneration is forbidden"
+        )
+    if claimed.exists() or claimed.is_symlink():
+        _fail(
+            "blind transaction was already irreversibly claimed; "
+            "regeneration is forbidden"
+        )
+    _validate_run_inventory(args.run_dir, plan, manifest)
+    _claim_journal_token(
+        args.run_dir, plan_sha, BLIND_TRANSACTION_ID, None
+    )
+    heldout, _ = phase1.load_assets()
+    scenarios = _scenario_index(heldout)
+    rubric_raw = _read_file(RUBRIC)
+    packet_values: list[tuple[str, bytes]] = []
+    inventory_rows: list[dict[str, Any]] = []
+    mappings: list[dict[str, Any]] = []
+    for cell, state in zip(plan["cells"], manifest["cells"]):
+        transcript = _strict_loads(_read_file(args.run_dir / state["transcript_ref"]))
+        external_receipt = _external_session_receipt(transcript, cell)
+        _assert_blindable_transcript(plan, transcript, cell, external_receipt)
+        blind_id = f"blind-{secrets.token_hex(12)}"
+        packet = _blind_packet_value(
+            blind_id,
+            scenarios[cell["scenario_id"]],
+            cell["content_condition"],
+            transcript,
+            rubric_raw,
+        )
+        _assert_blind_packet_structure(packet)
+        _validate_schema(BLIND_PACKET_SCHEMA, packet, "isolated blind packet")
+        packet_raw = _json_bytes(packet)
+        if len(packet_raw) > MAX_BLIND_PACKET_BYTES:
+            _fail(f"blind packet exceeds byte bound for {cell['cell_id']}")
+        packet_ref = f"packets/{blind_id}.json"
+        packet_values.append((blind_id, packet_raw))
+        inventory_rows.append(
+            {
+                "blind_session_id": blind_id,
+                "packet_ref": packet_ref,
+                "packet_sha256": _sha(packet_raw),
+                "packet_bytes": len(packet_raw),
+            }
+        )
+        mappings.append(
+            {
+                "blind_session_id": blind_id,
+                "packet_sha256": _sha(packet_raw),
+                "cell_id": cell["cell_id"],
+                "sequence_index": cell["sequence_index"],
+                "scenario_id": cell["scenario_id"],
+                "content_condition": cell["content_condition"],
+                "guidance_condition": cell["guidance_condition"],
+                "replicate": cell["replicate"],
+            }
+        )
+    if len({blind_id for blind_id, _raw in packet_values}) != 64:
+        _fail("generated blind ids were not unique")
+    packet_values.sort(key=lambda row: row[0])
+    inventory_rows.sort(key=lambda row: row["blind_session_id"])
+    mappings.sort(key=lambda row: row["blind_session_id"])
+    inventory_raw = _json_bytes(_blind_inventory_value(plan_sha, inventory_rows))
+    private_raw = _json_bytes(_private_map_value(plan_sha, inventory_raw, mappings))
+    source_sha = _sha(_json_bytes(manifest))
+    packet_manifest_rows = [
+        {
+            "blind_session_id": blind_id,
+            "packet_ref": f"blind/packets/{blind_id}.json",
+            "packet_sha256": _sha(packet_raw),
+            "packet_bytes": len(packet_raw),
+        }
+        for blind_id, packet_raw in packet_values
+    ]
+    blind_manifest_raw = _json_bytes(
+        _blind_manifest_value(
+            plan_sha, source_sha, inventory_raw, packet_manifest_rows, private_raw
+        )
+    )
+    try:
+        staging.mkdir(mode=0o755)
+        for blind_id, packet_raw in packet_values:
+            _write_new(
+                staging / "packets" / f"{blind_id}.json",
+                packet_raw,
+                root=staging,
+            )
+        _write_new(staging / "inventory.json", inventory_raw, root=staging)
+        private_dir = staging / "private"
+        private_dir.mkdir(mode=0o700)
+        os.chmod(private_dir, 0o700)
+        _write_new(
+            private_dir / "map.json", private_raw, root=staging, mode=0o600
+        )
+        os.chmod(private_dir / "map.json", 0o600)
+        _write_new(staging / "manifest.json", blind_manifest_raw, root=staging)
+        os.rename(staging, blind_root)
+        _fsync_directory(args.run_dir)
+        _fsync_directory(args.run_dir.parent)
+    except (EnvelopeError, OSError) as exc:
+        raise EnvelopeError(
+            "cannot atomically finalize deterministic blind bundle; staged "
+            "evidence is preserved and regeneration is forbidden"
+        ) from exc
+    blind_sha, inventory_sha = _validate_blind_bundle(
+        args.run_dir, plan, plan_sha, manifest
+    )
+    finalized = _finalize_blind_state(
+        args.run_dir, plan, plan_sha, manifest, blind_sha
+    )
+    _validate_blind_bundle(args.run_dir, plan, plan_sha, finalized)
+    _validate_run_inventory(args.run_dir, plan, finalized)
+    return {
+        "packets": 64,
+        "inventory_sha256": inventory_sha,
+        "labels_present": False,
+        "human_evidence_present": False,
+        "dispatch_available": False,
+        "state": "blind_finalized",
+        "recovered_existing_atomic_bundle": False,
+    }
+
+
+def _run_args(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument("--run-dir", required=True, type=Path)
+    parser.add_argument("--plan-sha256", required=True)
+
+
+def _parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__)
+    sub = parser.add_subparsers(dest="command", required=True)
+    init_parser = sub.add_parser("init-run", help="freeze a new 64-cell no-call plan")
+    init_parser.add_argument("--run-dir", required=True, type=Path)
+    init_parser.add_argument("--run-id", required=True)
+    init_parser.add_argument("--suite-commit", required=True)
+    init_parser.add_argument("--order-seed", required=True)
+    init_parser.add_argument("--subject-provider", required=True)
+    init_parser.add_argument("--subject-model", required=True)
+    init_parser.add_argument("--subject-runtime", required=True)
+    init_parser.add_argument("--subject-runtime-version", required=True)
+    init_parser.add_argument("--auth-mode", required=True)
+    init_parser.add_argument("--reasoning-effort", required=True)
+    init_parser.add_argument("--input-token-cap", required=True, type=int)
+    init_parser.add_argument("--output-token-cap", required=True, type=int)
+    materialize_parser = sub.add_parser(
+        "materialize", help="write frozen prompts and non-dispatch call envelopes"
+    )
+    _run_args(materialize_parser)
+    validate_parser = sub.add_parser("validate", help="validate a run without calls")
+    _run_args(validate_parser)
+    ingest_parser = sub.add_parser(
+        "ingest", help="append one externally recorded transcript in frozen order"
+    )
+    _run_args(ingest_parser)
+    ingest_parser.add_argument("--transcript", required=True, type=Path)
+    ingest_parser.add_argument("--authorization-record", required=True, type=Path)
+    blind_parser = sub.add_parser(
+        "prepare-blind-packet", help="write 64 isolated label-free judge packets"
+    )
+    _run_args(blind_parser)
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = _parser().parse_args(argv)
+    try:
+        if args.command == "init-run":
+            result = init_run(args)
+        elif args.command == "materialize":
+            result = materialize(args)
+        elif args.command == "validate":
+            result = validate_run(args)
+        elif args.command == "ingest":
+            result = ingest(args)
+        else:
+            result = prepare_blind_packet(args)
+    except StopViolation as exc:
+        print(f"STOP[{exc.code}]: {exc.detail}", file=sys.stderr)
+        return 2
+    except EnvelopeError as exc:
+        print(f"ERROR: {exc}", file=sys.stderr)
+        return 1
+    print(json.dumps(result, ensure_ascii=False, sort_keys=True, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())