yam-flow 2.5.0 → 2.6.0

package/dist/lib/gate-result.js

@@ -0,0 +1,219 @@
+import { createHash } from 'node:crypto';
+const GATE_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,95}$/;
+const BOUNDARIES = new Set(['release', 'update', 'mission', 'generic']);
+const CHECK_STATUSES = new Set(['passed', 'failed', 'skipped']);
+export function buildStrictGateResult(input = {}) {
+    const gateId = boundedText(input.gate_id || '', 96);
+    const boundary = BOUNDARIES.has(input.boundary) ? input.boundary : 'generic';
+    const contractErrors = [];
+    if (!GATE_ID_PATTERN.test(gateId))
+        contractErrors.push('gate_id_invalid');
+    if (!BOUNDARIES.has(input.boundary))
+        contractErrors.push('boundary_invalid');
+    if (Array.isArray(input.checks) && input.checks.length > 128)
+        contractErrors.push('check_limit_exceeded');
+    if (Array.isArray(input.blockers) && input.blockers.length > 64)
+        contractErrors.push('blocker_limit_exceeded');
+    if (Array.isArray(input.evidence) && input.evidence.length > 128)
+        contractErrors.push('evidence_limit_exceeded');
+    const checks = Array.isArray(input.checks) ? input.checks.slice(0, 128).map((check, index) => {
+        const id = boundedText(check?.id || '', 96);
+        const status = CHECK_STATUSES.has(check?.status) ? check?.status : 'failed';
+        if (!GATE_ID_PATTERN.test(id))
+            contractErrors.push(`check_id_invalid:${index}`);
+        if (!CHECK_STATUSES.has(check?.status))
+            contractErrors.push(`check_status_invalid:${id || index}`);
+        return {
+            id,
+            status,
+            note: boundedText(check?.note || '', 512),
+            required: check?.required !== false
+        };
+    }) : [];
+    if (!checks.length)
+        contractErrors.push('checks_missing');
+    const checkIds = checks.map((check) => check.id).filter(Boolean);
+    if (new Set(checkIds).size !== checkIds.length)
+        contractErrors.push('duplicate_check_id');
+    const blockers = uniqueBounded(input.blockers, 64, 512);
+    const evidence = uniqueBounded(input.evidence, 128, 512);
+    if (!evidence.length)
+        contractErrors.push('evidence_missing');
+    for (const check of checks) {
+        if (check.required && check.status !== 'passed')
+            blockers.push(`${check.id || 'unnamed_check'}: ${check.note || 'required gate check did not pass'}`);
+    }
+    for (const error of contractErrors)
+        blockers.push(`gate_contract_invalid: ${error}`);
+    const finalBlockers = [...new Set(blockers)];
+    const contractValid = contractErrors.length === 0;
+    const passed = contractValid && finalBlockers.length === 0;
+    const generatedAt = new Date().toISOString();
+    const nextAction = boundedText(input.next_action || finalBlockers[0] || 'gate passed; retain the evidence digest with the dependent completion claim', 512);
+    const uniqueContractErrors = [...new Set(contractErrors)];
+    const truthStatus = passed ? 'verified' : 'blocked';
+    const canonical = {
+        schema: 'yam.gate-result.v1',
+        generated_at: generatedAt,
+        gate_id: gateId,
+        boundary,
+        status: passed ? 'passed' : 'failed',
+        checks,
+        blockers: finalBlockers,
+        evidence,
+        next_action: nextAction,
+        contract_valid: contractValid,
+        contract_errors: uniqueContractErrors,
+        truth_status: truthStatus
+    };
+    return {
+        schema: 'yam.gate-result.v1',
+        generated_at: generatedAt,
+        gate_id: gateId,
+        boundary,
+        status: passed ? 'passed' : 'failed',
+        checks,
+        blockers: finalBlockers,
+        evidence,
+        next_action: nextAction,
+        contract_valid: contractValid,
+        contract_errors: uniqueContractErrors,
+        digest: `sha256:${createHash('sha256').update(stableJson(canonical)).digest('hex')}`,
+        truth_status: truthStatus
+    };
+}
+export function verifyStrictGateResult(value) {
+    const errors = [];
+    const record = value && typeof value === 'object' ? value : {};
+    if (record.schema !== 'yam.gate-result.v1')
+        errors.push('schema_invalid');
+    if (typeof record.generated_at !== 'string' || !isIsoDate(record.generated_at))
+        errors.push('generated_at_invalid');
+    if (!GATE_ID_PATTERN.test(String(record.gate_id || '')))
+        errors.push('gate_id_invalid');
+    if (!BOUNDARIES.has(record.boundary))
+        errors.push('boundary_invalid');
+    if (!['passed', 'failed'].includes(String(record.status || '')))
+        errors.push('status_invalid');
+    const checks = Array.isArray(record.checks) ? record.checks : [];
+    const blockers = Array.isArray(record.blockers) ? record.blockers : [];
+    const evidence = Array.isArray(record.evidence) ? record.evidence : [];
+    const contractErrors = Array.isArray(record.contract_errors) ? record.contract_errors : [];
+    if (!checks.length)
+        errors.push('checks_missing');
+    if (checks.length > 128)
+        errors.push('check_limit_exceeded');
+    if (blockers.length > 64)
+        errors.push('blocker_limit_exceeded');
+    if (evidence.length > 128)
+        errors.push('evidence_limit_exceeded');
+    if (!Array.isArray(record.blockers) || blockers.some((item) => typeof item !== 'string'))
+        errors.push('blockers_invalid');
+    if (!Array.isArray(record.evidence) || !evidence.length || evidence.some((item) => typeof item !== 'string' || !item.trim()))
+        errors.push('evidence_missing');
+    if (typeof record.contract_valid !== 'boolean')
+        errors.push('contract_valid_missing');
+    if (!Array.isArray(record.contract_errors) || contractErrors.some((item) => typeof item !== 'string'))
+        errors.push('contract_errors_invalid');
+    if (record.contract_valid === true && contractErrors.length)
+        errors.push('contract_valid_with_errors');
+    if (record.contract_valid === false && !contractErrors.length)
+        errors.push('contract_invalid_without_errors');
+    if (record.status === 'passed' && record.contract_valid !== true)
+        errors.push('passed_with_invalid_contract');
+    if (typeof record.next_action !== 'string' || !record.next_action.trim())
+        errors.push('next_action_missing');
+    if (!['verified', 'blocked'].includes(String(record.truth_status || '')))
+        errors.push('truth_status_invalid');
+    if (record.status === 'passed' && record.truth_status !== 'verified')
+        errors.push('passed_truth_mismatch');
+    if (record.status === 'failed' && record.truth_status !== 'blocked')
+        errors.push('failed_truth_mismatch');
+    for (const [index, check] of checks.entries()) {
+        if (!check || typeof check !== 'object') {
+            errors.push(`check_invalid:${index}`);
+            continue;
+        }
+        const row = check;
+        if (!GATE_ID_PATTERN.test(String(row.id || '')))
+            errors.push(`check_id_invalid:${index}`);
+        if (!CHECK_STATUSES.has(row.status))
+            errors.push(`check_status_invalid:${index}`);
+        if (typeof row.note !== 'string')
+            errors.push(`check_note_invalid:${index}`);
+        if (typeof row.required !== 'boolean')
+            errors.push(`check_required_invalid:${index}`);
+    }
+    const checkIds = checks
+        .filter((check) => check && typeof check === 'object')
+        .map((check) => String(check.id || ''))
+        .filter(Boolean);
+    if (new Set(checkIds).size !== checkIds.length)
+        errors.push('duplicate_check_id');
+    if (record.status === 'passed' && Array.isArray(record.blockers) && record.blockers.length > 0)
+        errors.push('passed_with_blockers');
+    if (record.status === 'passed' && checks.length) {
+        const failedRequired = checks.some((check) => {
+            if (!check || typeof check !== 'object')
+                return true;
+            const row = check;
+            return row.required !== false && row.status !== 'passed';
+        });
+        if (failedRequired)
+            errors.push('passed_with_failed_required_check');
+    }
+    if (record.status === 'failed') {
+        const hasFailedRequired = checks.some((check) => {
+            if (!check || typeof check !== 'object')
+                return false;
+            const row = check;
+            return row.required !== false && row.status !== 'passed';
+        });
+        if (record.contract_valid === true && blockers.length === 0 && !hasFailedRequired)
+            errors.push('failed_without_blocker_or_failed_check');
+    }
+    const canonical = {
+        schema: record.schema,
+        generated_at: record.generated_at,
+        gate_id: String(record.gate_id || ''),
+        boundary: record.boundary,
+        status: record.status,
+        checks,
+        blockers,
+        evidence,
+        next_action: record.next_action,
+        contract_valid: record.contract_valid,
+        contract_errors: contractErrors,
+        truth_status: record.truth_status
+    };
+    const expectedDigest = `sha256:${createHash('sha256').update(stableJson(canonical)).digest('hex')}`;
+    if (typeof record.digest !== 'string' || record.digest !== expectedDigest)
+        errors.push('digest_invalid');
+    return {
+        schema: 'yam.gate-result-verification.v1',
+        valid: errors.length === 0,
+        errors: [...new Set(errors)],
+        truth_status: errors.length ? 'blocked' : 'verified',
+        next_action: errors.length ? `reject the gate result and repair: ${errors[0]}` : 'gate result contract is structurally valid'
+    };
+}
+function isIsoDate(value) {
+    return !Number.isNaN(Date.parse(value)) && new Date(value).toISOString() === value;
+}
+function uniqueBounded(value, maxItems, maxChars) {
+    if (!Array.isArray(value))
+        return [];
+    return [...new Set(value.map((item) => boundedText(item, maxChars)).filter(Boolean))].slice(0, maxItems);
+}
+function boundedText(value, max) {
+    return String(value || '').replace(/[\r\n\u0000-\u001f\u007f]+/g, ' ').trim().slice(0, max);
+}
+function stableJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map((item) => stableJson(item)).join(',')}]`;
+    if (value && typeof value === 'object') {
+        const record = value;
+        return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(',')}}`;
+    }
+    return JSON.stringify(value);
+}

package/dist/lib/skill-installation.js

@@ -1,6 +1,7 @@
 import { createHash, randomUUID } from 'node:crypto';
 import fsp from 'node:fs/promises';
 import path from 'node:path';
+import { compareStableText } from './stable-order.js';
 export const INSTALL_RECEIPT_NAME = '.yam-flow-install-receipt.json';
 export const INSTALL_LOCK_NAME = '.yam-flow-install.lock';
 export const INSTALL_RECEIPT_SCHEMA = 'yam.install-receipt.v1';
@@ -70,7 +71,7 @@ async function collectTreeManifest(root, prefix = '') {
     const files = [];
     async function walk(current, relative) {
         const entries = await fsp.readdir(current, { withFileTypes: true });
-        entries.sort((left, right) => left.name.localeCompare(right.name));
+        entries.sort((left, right) => compareStableText(left.name, right.name));
         for (const entry of entries) {
             const absolute = path.join(current, entry.name);
             const nextRelative = relative ? path.join(relative, entry.name) : entry.name;
@@ -86,7 +87,7 @@ async function collectTreeManifest(root, prefix = '') {
         }
     }
     await walk(root, '');
-    return files.sort((left, right) => left.path.localeCompare(right.path));
+    return files.sort((left, right) => compareStableText(left.path, right.path));
 }
 async function expectedInstallManifest(sourceRoot, skills) {
     const referencesRoot = path.join(sourceRoot, 'references');
@@ -112,7 +113,7 @@ async function expectedInstallManifest(sourceRoot, skills) {
             });
         }
     }
-    return files.sort((left, right) => left.path.localeCompare(right.path));
+    return files.sort((left, right) => compareStableText(left.path, right.path));
 }
 async function copyTree(source, target) {
     const stat = await fsp.lstat(source);
@@ -137,8 +138,11 @@ async function copyTree(source, target) {
     }
 }
 function manifestDigest(files) {
+    return digestManifestFiles([...files].sort((left, right) => compareStableText(left.path, right.path)));
+}
+function digestManifestFiles(files) {
     const digest = createHash('sha256');
-    for (const file of [...files].sort((left, right) => left.path.localeCompare(right.path))) {
+    for (const file of files) {
         digest.update(file.path);
         digest.update('\0');
         digest.update(String(file.bytes));
@@ -148,6 +152,20 @@ function manifestDigest(files) {
     }
     return digest.digest('hex');
 }
+function allowsLegacyManifestOrder(version) {
+    const match = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(String(version || ''));
+    if (!match)
+        return false;
+    const major = Number(match[1]);
+    const minor = Number(match[2]);
+    const patch = Number(match[3]);
+    return major < 2 || (major === 2 && (minor < 5 || (minor === 5 && patch === 0)));
+}
+function receiptManifestDigestMatches(files, digest, version) {
+    if (digest === manifestDigest(files))
+        return true;
+    return allowsLegacyManifestOrder(version) && digest === digestManifestFiles(files);
+}
 function manifestIssues(expected, actual, label) {
     const issues = [];
     const expectedByPath = new Map(expected.map((file) => [file.path, file]));
@@ -236,7 +254,7 @@ function ownershipReceiptIssues(receipt, packageName, destination) {
     if (value.integrity?.file_count !== files.length) {
         issues.push('install receipt file count does not match its manifest');
     }
-    if (value.integrity?.source_digest !== manifestDigest(files)) {
+    if (!receiptManifestDigestMatches(files, value.integrity?.source_digest, value.package?.version)) {
         issues.push('install receipt source digest does not match its manifest');
     }
     if (Array.isArray(value.skills)) {

package/dist/lib/stable-order.d.ts

@@ -0,0 +1 @@
+export declare function compareStableText(left: string, right: string): number;

package/dist/lib/stable-order.js

@@ -0,0 +1,5 @@
+export function compareStableText(left, right) {
+    if (left === right)
+        return 0;
+    return left < right ? -1 : 1;
+}

package/dist/lib/trust-kernel.js

@@ -1,3 +1,4 @@
+import { verifyStrictGateResult } from './gate-result.js';
 export const TRUTH_STATUSES = Object.freeze([
     'verified',
     'proven',
@@ -1023,7 +1024,22 @@ function missionCompletionCap(value = '') {
         if (!parsed || typeof parsed !== 'object')
             return weakestTruth(weakest, 'blocked');
         const gate = buildMissionCompletionGate(parsed);
-        return weakestTruth(weakest, gate.truth_status);
+        const record = parsed;
+        const strictGate = record.gate_result && typeof record.gate_result === 'object'
+            ? record.gate_result
+            : null;
+        const reportedContract = record.gate_contract && typeof record.gate_contract === 'object'
+            ? record.gate_contract
+            : null;
+        const strictVerification = verifyStrictGateResult(strictGate);
+        const strictReady = Boolean(strictGate
+            && strictGate.boundary === 'mission'
+            && strictGate.gate_id === 'mission-completion'
+            && strictGate.status === 'passed'
+            && strictVerification.valid
+            && reportedContract?.valid === true
+            && reportedContract?.truth_status === 'verified');
+        return weakestTruth(weakest, strictReady ? gate.truth_status : 'blocked');
     }, 'proven');
 }
 function strongestSupportedTruth(rows = []) {

package/dist/lib/ueye-artifacts.js

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto';
 import { constants as fsConstants } from 'node:fs';
 import fsp from 'node:fs/promises';
 import path from 'node:path';
+import { compareStableText } from './stable-order.js';
 export async function inspectImageFile(file) {
     const absolute = path.resolve(file);
     const buffer = await fsp.readFile(absolute);
@@ -46,7 +47,7 @@ export async function upsertUeyeAsset(input) {
         manifest.assets[existingIndex] = entry;
     else
         manifest.assets.push(entry);
-    manifest.assets.sort((left, right) => left.id.localeCompare(right.id));
+    manifest.assets.sort((left, right) => compareStableText(left.id, right.id));
     manifest.updated_at = new Date().toISOString();
     await writeJsonAtomic(manifestPath, manifest);
     const warnings = assetWarnings(entry);
@@ -152,7 +153,7 @@ export async function archiveUeyeRevision(input) {
     else {
         history.revisions.push(entry);
     }
-    history.revisions.sort((left, right) => left.round - right.round || left.artifact_id.localeCompare(right.artifact_id));
+    history.revisions.sort((left, right) => left.round - right.round || compareStableText(left.artifact_id, right.artifact_id));
     history.updated_at = new Date().toISOString();
     await writeJsonAtomic(manifestPath, history);
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yam-flow",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "description": "Progressive proof-first agent flow: start fast, deepen deliberately, stay honest by design.",
   "type": "module",
   "author": "0kim0bos",
@@ -52,7 +52,7 @@
     "doctor": "node ./dist/bin/yam.js doctor",
     "list": "node ./dist/bin/yam.js list",
     "examples": "node ./dist/bin/yam.js examples",
-    "verify:self": "npm run build && node --check ./dist/bin/yam.js && node --check ./dist/lib/trust-kernel.js && node --check ./dist/lib/skill-installation.js && node --check ./dist/lib/external-updates.js && npm run hook-latency-smoke && node ./scripts/external-updates-smoke.mjs && node ./scripts/install-transaction-smoke.mjs && node ./dist/bin/yam.js verify && node ./dist/bin/yam.js doctor",
+    "verify:self": "npm run build && node --check ./dist/bin/yam.js && node --check ./dist/lib/trust-kernel.js && node --check ./dist/lib/skill-installation.js && node --check ./dist/lib/external-updates.js && node --check ./dist/lib/gate-result.js && node --check ./dist/lib/benchmark-promotion.js && node --check ./dist/lib/design-production.js && npm run hook-latency-smoke && node ./scripts/external-updates-smoke.mjs && node ./scripts/install-transaction-smoke.mjs && node ./scripts/trust-adoptions-smoke.mjs && node ./scripts/design-production-smoke.mjs && npm run package-secrets:check && npm run package-secrets-smoke && node ./dist/bin/yam.js verify && node ./dist/bin/yam.js doctor",
     "prepare": "npm run build",
     "prepack": "npm run verify:self",
     "prepublishOnly": "npm run verify:self",
@@ -61,10 +61,14 @@
     "forbidden-names:check": "node ./scripts/check-forbidden-names.mjs",
     "study-note:check": "node ./dist/bin/yam.js study-note check --json",
     "package-boundary:check": "node ./scripts/check-package-boundary.mjs",
+    "package-secrets:check": "node ./scripts/check-package-secrets.mjs",
+    "package-secrets-smoke": "node ./scripts/package-secrets-smoke.mjs",
     "dist:freshness": "node ./scripts/check-dist-freshness.mjs",
     "registry:check": "node ./scripts/check-registry-version.mjs",
     "cli-smoke": "node ./scripts/cli-smoke.mjs",
     "external-updates-smoke": "npm run build && node ./scripts/external-updates-smoke.mjs",
+    "trust-adoptions-smoke": "npm run build && node ./scripts/trust-adoptions-smoke.mjs",
+    "design-production-smoke": "npm run build && node ./scripts/design-production-smoke.mjs",
     "hook-latency-smoke": "node ./scripts/hook-latency-smoke.mjs",
     "install-transaction-smoke": "npm run build && node ./scripts/install-transaction-smoke.mjs",
     "release:check": "npm run typecheck && npm run forbidden-names:check && npm run verify:self && npm run dist:freshness && npm run package-boundary:check && npm run registry:check && npm run cli-smoke",

package/references/ueye.md

@@ -70,6 +70,7 @@ Use these when the task depends on visual truth, reference matching, or design q
 7. Deep Visual Review, when Ueye needs Deep-grade verification.
 8. Asset Manifest, when local reference media affects the design.
 9. Revision History, when an iterative visual artifact is about to be replaced.
+10. Demand-Gated Design Production receipt, only for repeated plan review or large coordinated multi-asset work.
 
 Default bound:
 
@@ -89,6 +90,19 @@ Record source URL/page when known, a license or usage note, operator-provided st
 
 Use `yam ueye revision archive` before replacing an artifact during an iterative design pass. Archives are written to numbered round folders with exclusive-copy behavior, so a different payload cannot silently overwrite an existing round. `yam ueye revision verify` recomputes hashes before the history supports a done claim.
 
+### Demand-Gated Design Production
+
+Do not start this phase for a one-off review or single-asset edit. When repeated exact-element plan feedback or a large coordinated asset set creates real review cost, use `yam ueye production` to bind:
+
+- operator-asserted demand evidence;
+- a local static Canvas on fixed session-specific evidence paths;
+- exact anchored comments and an explicit approve/request-changes verdict;
+- no more than two revision rounds, each linked to a Canvas comment and at least one new Ueye archive;
+- a final gallery whose revision references come from the final round; and
+- one immutable phase receipt.
+
+Path/hash/reference integrity can complete the phase evidence, but overall truth remains partial. The gallery and phase receipt do not verify visual quality, licensing, or implementation correctness.
+
 ### Visual Evidence Inventory
 
 Record the real screens and image sources behind the review.

package/skills/ueye/SKILL.md

@@ -40,6 +40,7 @@ Do not use for:
 - For follow-up visual reviews, keep continuity explicit: previous report/source, current report/source, comparison delta, resolved findings, new findings, and next action.
 - Record surface context when it matters: provider context, provider badge, execution surface, app surface, browser surface, control mode, preserved URL/state, and evidence id.
 - Generated media can guide direction, but it cannot verify the implemented screen without implementation screenshot evidence.
+- Keep the Demand-Gated Design Production Phase dormant unless repeated plan annotation or a large coordinated multi-asset set creates real review cost; ordinary and single-asset work stays on the normal Ueye path.
 - Prefer the in-app browser for interactive visual checks. Do not switch to a profile-dependent browser unless the user explicitly asks or the task requires existing cookies, sessions, extensions, or profile state.
 - Ueye owns the design completion gate. Do not rely on a separate code-risk route to catch sloppy visual completion.
 - Draft or needs-polish work may stay fast; a `done` claim requires recorded design gate evidence.
@@ -63,6 +64,8 @@ Do not use for:
    - When local reference assets materially shape the design, record them with `yam ueye asset add` before editing.
    - Use `do_not_replace` for protected identity assets and enable `allowed_for_edit` only when usage rights and task scope support editing.
    - Before overwriting an iterative visual artifact, preserve the current file with `yam ueye revision archive`.
+   - Only when real repeated-review or multi-asset demand exists, use `yam ueye production`: record an exact anchored Canvas review, explicitly close it, run at most two source-comment-linked rounds with a fresh Ueye archive in each round, bind the gallery to the final round, then finalize one phase receipt.
+   - Treat phase demand as operator-asserted and keep gallery visual, license, and implementation correctness `not_verified` until their separate checks pass.
 7. Check default, loading, error, empty, disabled, hover/focus, and mobile states when relevant.
 8. Run browser/screenshot verification when feasible.
    - Prefer the in-app browser for local pages, localhost, file URLs, and ordinary visual QA.
@@ -137,6 +140,12 @@ Use these artifacts for reference-led implementation or serious visual review. K
    - archive the current file under a numbered round before editing it.
    - never overwrite a different archived payload for the same artifact and round.
    - verify the revision manifest before using it in a visual `done` claim.
+12. Demand-Gated Design Production receipt, only when repeated plan review or large multi-asset coordination triggers it:
+   - keep Canvas session/render files on their fixed local `.yam/ueye/design-production/<session>/` paths.
+   - record exact line/unique-text/bounded-region findings and an explicit verdict.
+   - stop after acceptance, an integrity blocker, or two revisions; never loop a third time automatically.
+   - require each round to link a Canvas comment and a newly archived Ueye revision, and bind gallery artifacts to the final round.
+   - keep demand evidence operator-asserted and the overall phase truth `partial`; the phase receipt is not a visual/license/implementation correctness gate.
 
 ## Visual Truth Caps
 
@@ -152,6 +161,7 @@ Use these artifacts for reference-led implementation or serious visual review. K
 - Mock or invented screenshots: cap the result at `partial` and mark the source.
 - Browser unavailable but source files reviewed: report implementation verification separately from visual verification.
 - Generated callout images may improve review quality, but missing generated images must not block ordinary Ueye work.
+- Missing demand or a one-off/single-asset task must not auto-start the design production phase.
 
 ## Design Checks
 
@@ -188,3 +198,4 @@ Report:
 - Truth status and visual verification cap.
 - Handoff when useful: fix-first visual issues, remaining tasks, recommended direction, why that next step matters, blocker kind, safe retry, evidence level/stamp, and owner scope when another route or person may continue.
 - Asset manifest and revision history status when reference media or iterative artifact replacement materially affected the work.
+- Demand trigger, bounded revision stop, final gallery state, and phase receipt when the opt-in design production phase was actually used.