# CODE-DESIGN-ANA-SEMI-ROOT-PREFLIGHT-ORCHESTRATION-V007-V006

- 事项：`DEV-ANA-SEMI-ROOT-PREFLIGHT-ORCHESTRATION-V007-REPAIR-20260725-001`
- 计划：`DEV-PLAN-ANA-SEMI-ROOT-PREFLIGHT-ORCHESTRATION-V007-IMPLEMENTATION-R5`
- task_id：`TASK-DEV-ANA-SEMI-ROOT-PREFLIGHT-ORCHESTRATION-V007-REPAIR-PLAN-20260725-002`
- submission_id：`SUBMIT-DEV-ANA-SEMI-ROOT-PREFLIGHT-ORCHESTRATION-V007-REPAIR-PLAN-V006`
- 当前唯一角色：`dev.developer.ana.cai`
- 独立审核角色：`dev.reviewer.ana.cai`
- predecessor：`CODE-DESIGN-ANA-SEMI-ROOT-PREFLIGHT-ORCHESTRATION-V007-V005`
- predecessor bytes/SHA-256：`18778/037aa85d0702b04602a5381334c5d9ab7e278dd119c3462a74277e97b06be151`
- predecessor review：`AUDIT-DEV-ANA-SEMI-ROOT-PREFLIGHT-ORCHESTRATION-V007-REPAIR-PLAN-V005=HOLD/3/3`
- 当前状态：`PENDING_INDEPENDENT_REPAIR_PLAN_REREVIEW`
- authorization：`NOT_ISSUED`

## 1. 修订范围与继承

本版只关闭 V005 审核的三个 blocker：

1. `BLOCK-REPAIR-PLAN-01=R18_FINAL_TERMINAL_PRECEDES_PACKAGE_CLOSURE`；
2. `BLOCK-REPAIR-PLAN-02=R14_ABSENT_STATUS_AND_R20_TRUTH_TABLE_NOT_TOTAL`；
3. `BLOCK-REPAIR-PLAN-03=NEW_CHAIN_INVOCATION_AND_CONTRACT_FAILURE_MAPPING_UNFROZEN`。

V005 已通过的下列合同全部继承且不得回退：旧 A001/run/I01—I12 immutable、旧 I13—I16 absent；新 R01—R20 和新 run 路径；R02 唯一 JCS writer；五个固定正向/closure 向量；R14-before-throw；`23+VALID_TEST_FAIL+CLOSED→23` 与 R14 absent/invalid→27；CreateNew/no-overwrite、zero secret/network/database/formal target 和角色分离。

本版仍不授权创建 R01—R20、编译、测试、synthetic、proof、mysql、SQL、数据库或业务动作。

## 2. R18 改为 pre-package as-of terminal

R18 不再声称 final，也不记录尚未尝试的 R19/R20。其 schema 改为 `ANA-SEMI-IMPLEMENTATION-PREPACKAGE-ASOF-JCS-V002`，固定在任何 receipt/manifest 尝试之前物化。

R18 顶层 key 恰好为：

`schema_id,run_id,as_of_phase,primary_phase,primary_exit_code,primary_stop_code,primary_evidence_target_id,primary_evidence_state,as_of_closure_state,as_of_exit_code,materialized_as_of_target_ids,absent_as_of_target_ids,outer_process_count,csc_process_count,harness_process_count,synthetic_child_process_count,network_count,database_count,credential_count,status`

固定规则：

- `as_of_phase=PRE_PACKAGE_BEFORE_RECEIPT`。
- `materialized_as_of_target_ids` 与 `absent_as_of_target_ids` 的 universe **只含 R01—R18**，ordinal 排序、互斥且并集恰好 18 项；R19/R20 禁止出现。
- `as_of_closure_state=PRIMARY_CLOSED|PACKAGE_UNCLOSED`；不得出现 receipt/manifest closure。
- `as_of_exit_code` 是时点值：正常 primary 为 `0|11..24|28`；R14/R15 evidence absent/invalid、R18 前状态不确定为 27。
- `status=PASS|PRIMARY_FAILED_CLOSED|PACKAGE_UNCLOSED`。
- R18 CreateNew/write/flush/close/reopen/parse/hash 失败时不得伪造 R18；R19/R20 均不启动，由外部 native final 报 `R18_ABSENT|R18_INVALID` 与 final exit 27。

## 3. 唯一外部 native final

R18 后的真实 final 只存在于发送给 management/reviewer 的单次原生 terminal，不再落入任何 project target。schema_id 固定 `NATIVE-ANA-SEMI-IMPLEMENTATION-FINAL-V006`，字段恰好为：

`schema_id,run_id,authorization_id,attempt_id,started_at,finished_at,outer_process_started,outer_exit_code,primary_phase,primary_exit_code,primary_stop_code,prepackage_terminal_state,package_closure_state,final_exit_code,artifact_rows,r20_external_bytes,r20_external_sha256,outer_process_count,csc_process_count,harness_process_count,synthetic_child_process_count,proof_process_count,config_editor_process_count,mysql_process_count,query_count,database_connection_performed,network_access,credential_access,formal_target_count,BATCH_001_status,darkline_restored,status`

规则：

- `artifact_rows` 恰好 20 行、R01—R20 各一行；每行 key 恰好 `target_id,expected_presence,materialized,exists,status,bytes,sha256,created_at,upstream_stop_code`，按 target_id ordinal 排序。
- `package_closure_state=CLOSED|R18_ABSENT|R18_INVALID|RECEIPT_ATTEMPTED_NO_OUTPUT|RECEIPT_PARTIAL_INVALID|MANIFEST_ATTEMPTED_NO_OUTPUT|MANIFEST_PARTIAL_INVALID|PACKAGE_STATE_UNCERTAIN|NOT_APPLICABLE_SOURCE_OR_OUTER_STOP`。
- final 优先级唯一：`PACKAGE_STATE_UNCERTAIN|R18_ABSENT|R18_INVALID→27`；receipt 两态→25；manifest 两态→26；CLOSED→R18.as_of_exit_code；source/outer 未启动→`final_exit_code=null`。
- R20 严格合法且 materialized 时，`r20_external_bytes/SHA-256` 非空并等于外部独占复算；其他 closure 均为 null。禁止回写 R20。
- `status=PASS|PRIMARY_FAILED_CLOSED|PACKAGE_UNCLOSED|STOP_BEFORE_OUTER`。
- 该 native object 不写文件、不参与 R20 hash、不被 receipt/manifest 引用，因此 DAG 无环。

## 4. expected_presence 与状态字面值

固定 expected_presence：

| target | expected_presence |
|---|---|
| R01—R08 | `REQUIRED_BEFORE_OUTER` |
| R09 | `CONDITIONAL_ON_CSC_ATTEMPT` |
| R10 | `CONDITIONAL_ON_PUBLISH_ATTEMPT` |
| R11—R13 | `CONDITIONAL_ON_CSC_STAGE` |
| R14 | `CONDITIONAL_ON_L0_PRODUCER` |
| R15 | `CONDITIONAL_ON_L1_PRODUCER` |
| R16 | `REQUIRED_ON_CONTRACT_STAGE` |
| R17 | `CONDITIONAL_ON_R16_PASS` |
| R18 | `REQUIRED_ON_INNER_TERMINAL` |
| R19 | `CONDITIONAL_ON_R18_VALID` |
| R20 | `SELF_CONDITIONAL_ON_R19_VALID` |

状态 enum 完整升级为：

`SOURCE_FROZEN|COMPILER_STAGING_READY|COMPILER_STAGING_PARTIAL|COMPILER_STAGING_INVALID|BUILD_PUBLISHED|BUILD_PUBLISH_PARTIAL|RAW_CAPTURED|PROCESS_RESULT_PASS|PROCESS_RESULT_FAIL|TEST_PASS|TEST_FAIL|TEST_OUTPUT_INVALID|CONTRACT_PASS|CONTRACT_FAIL|PREPACKAGE_TERMINAL_PASS|PREPACKAGE_TERMINAL_FAIL|ATTEMPTED_NO_OUTPUT|RECEIPT_FINALIZED|RECEIPT_PARTIAL_INVALID|MANIFEST_SELF_EXTERNAL_HASH|MANIFEST_PARTIAL_INVALID|NOT_RUN_UPSTREAM_STOP`

通用行规则：

- `materialized=true ⇔ exists=true`。合法 materialized 行 bytes/hash/created_at 非空；R20 合法 self 行唯一例外：bytes/hash=null，外部 hash 进入 native final。
- `ATTEMPTED_NO_OUTPUT|NOT_RUN_UPSTREAM_STOP` 必须 `materialized=false,exists=false,bytes/hash/created_at=null,upstream_stop_code non-null`。
- `TEST_OUTPUT_INVALID|RECEIPT_PARTIAL_INVALID|MANIFEST_PARTIAL_INVALID` 必须 materialized=true，bytes/hash/created_at/upstream 非空。
- `NOT_RUN_UPSTREAM_STOP` 只表示 producer 未进入；producer 已进入但文件 absent 必须 `ATTEMPTED_NO_OUTPUT`。

## 5. Primary-by-target authoritative truth table

缩写仅用于本表，构建 R20/native final 时必须展开为完整字面值：`N=NOT_RUN_UPSTREAM_STOP`，`A=ATTEMPTED_NO_OUTPUT`，`SR=COMPILER_STAGING_READY`，`SP=COMPILER_STAGING_PARTIAL`，`SI=COMPILER_STAGING_INVALID`，`BP=BUILD_PUBLISHED`，`BPP=BUILD_PUBLISH_PARTIAL`，`RAW=RAW_CAPTURED`，`PRP/PRF=PROCESS_RESULT_PASS/FAIL`，`TP/TF/TI=TEST_PASS/TEST_FAIL/TEST_OUTPUT_INVALID`，`CP/CF=CONTRACT_PASS/FAIL`，`PTP/PTF=PREPACKAGE_TERMINAL_PASS/FAIL`。

内部 primary 的 R01—R08 恒为 materialized `SOURCE_FROZEN`、upstream=null。表中 N/A 行物理 absent；所有 failure/partial/attempted 行 upstream=该行 stop；成功且已完成的行 upstream=null。

| ID / primary | R09 | R10 | R11-R12 | R13 | R14 | R15 | R16 | R17 | R18 | primary/final-as-of |
|---|---|---|---|---|---|---|---|---|---|---|
| P00 R16_CONTRACT_FAIL | N | N | N | N | N | N | CF | N | PTF | `11/11` |
| P01 R17_CONTRACT_FAIL | N | N | N | N | N | N | CP | CF | PTF | `11/11` |
| P02 CSC_START_STOP | N | N | RAW | PRF | N | N | CP | CP | PTF | `12/12` |
| P03A CSC_TIMEOUT_NO_OUTPUT | A | N | RAW | PRF | N | N | CP | CP | PTF | `13/13` |
| P03B CSC_TIMEOUT_PARTIAL | SP | N | RAW | PRF | N | N | CP | CP | PTF | `13/13` |
| P04A CSC_NONZERO_NO_OUTPUT | A | N | RAW | PRF | N | N | CP | CP | PTF | `14/14` |
| P04B CSC_NONZERO_PARTIAL | SP | N | RAW | PRF | N | N | CP | CP | PTF | `14/14` |
| P05 CSC_OUTPUT_INVALID | SI | N | RAW | PRF | N | N | CP | CP | PTF | `15/15` |
| P06A PUBLISH_NO_OUTPUT | SR | A | RAW | PRF | N | N | CP | CP | PTF | `16/16` |
| P06B PUBLISH_PARTIAL | SR | BPP | RAW | PRF | N | N | CP | CP | PTF | `16/16` |
| P07 ASSEMBLY_PATH_HASH | SR | BP | RAW | PRP | N | N | CP | CP | PTF | `17/17` |
| P08 ASSEMBLY_ALREADY_LOADED | SR | BP | RAW | PRP | N | N | CP | CP | PTF | `18/18` |
| P09 ASSEMBLY_LOAD_FAILED | SR | BP | RAW | PRP | N | N | CP | CP | PTF | `19/19` |
| P10 ASSEMBLY_LOAD_CONFLICT | SR | BP | RAW | PRP | N | N | CP | CP | PTF | `20/20` |
| P11 ASSEMBLY_API | SR | BP | RAW | PRP | N | N | CP | CP | PTF | `21/21` |
| P12 L0_MODULE_DOTSOURCE | SR | BP | RAW | PRP | N | N | CP | CP | PTF | `22/22` |
| P13 L0_MODULE_OUTPUT | SR | BP | RAW | PRP | TI | N | CP | CP | PTF | `22/22` |
| P14 L1_MODULE_DOTSOURCE | SR | BP | RAW | PRP | TP | N | CP | CP | PTF | `22/22` |
| P15 L1_MODULE_OUTPUT | SR | BP | RAW | PRP | TP | TI | CP | CP | PTF | `22/22` |
| P16 L0_CHECK_FAIL_CLOSED | SR | BP | RAW | PRP | TF | N | CP | CP | PTF | `23/23` |
| P17 L0_WRITER_ATTEMPTED_ABSENT | SR | BP | RAW | PRP | A | N | CP | CP | PTF | `23/27` |
| P18 L0_MATERIALIZED_INVALID | SR | BP | RAW | PRP | TI | N | CP | CP | PTF | `23/27` |
| P19 L1_CHECK_FAIL_CLOSED | SR | BP | RAW | PRP | TP | TF | CP | CP | PTF | `24/24` |
| P20 L1_WRITER_ATTEMPTED_ABSENT | SR | BP | RAW | PRP | TP | A | CP | CP | PTF | `24/27` |
| P21 L1_MATERIALIZED_INVALID | SR | BP | RAW | PRP | TP | TI | CP | CP | PTF | `24/27` |
| P22 PASS | SR | BP | RAW | PRP | TP | TP | CP | CP | PTP | `0/0` |

`VALIDATION_PRECHECK_STOP` 发生在 R16 前：R01—R08=`SOURCE_FROZEN`，R09—R20 全部 N，outer exit=11，由 external native final 报 `NOT_APPLICABLE_SOURCE_OR_OUTER_STOP`，不得为了 package 再运行不可信代码。`SOURCE_CREATE_STOP` 报 R01—R08 actual partial、R09—R20 N，outer 未启动/exit null；`OUTER_START_STOP` 报 R01—R08 frozen、R09—R20 N，outer 未启动/exit null。

## 6. Package closure overlay

第 5 节每个内部 primary 与下列 closure 只允许作笛卡尔组合；这是完整 R01—R20 truth table，无其他组合：

| closure | R18 | R19 | R20 | external final exit |
|---|---|---|---|---:|
| C0 CLOSED | 按 primary 为 PTP/PTF | `RECEIPT_FINALIZED` | `MANIFEST_SELF_EXTERNAL_HASH` | R18.as_of_exit |
| C1 R18_ATTEMPTED_ABSENT | `ATTEMPTED_NO_OUTPUT` | N | N | 27 |
| C2 R18_MATERIALIZED_INVALID | `TEST_OUTPUT_INVALID` | N | N | 27 |
| C3 RECEIPT_ATTEMPTED_ABSENT | PTP/PTF | `ATTEMPTED_NO_OUTPUT` | N | 25 |
| C4 RECEIPT_PARTIAL_INVALID | PTP/PTF | `RECEIPT_PARTIAL_INVALID` | N | 25 |
| C5 MANIFEST_ATTEMPTED_ABSENT | PTP/PTF | `RECEIPT_FINALIZED` | `ATTEMPTED_NO_OUTPUT` | 26 |
| C6 MANIFEST_PARTIAL_INVALID | PTP/PTF | `RECEIPT_FINALIZED` | `MANIFEST_PARTIAL_INVALID` | 26 |
| C7 PACKAGE_STATE_UNCERTAIN | 按 actual | 按 actual | 按 actual | 27 |

C0 才有合法 20-row R20；C1—C7 由 external native final 的 20-row artifact_rows 逐项报告。任何 attempted-but-absent target 使用 A，不得使用 N。R14 producer 未进入（P02—P12）为 N；R14 producer 进入但 absent（P17）为 A；R14 已物化但 invalid（P13/P18）为 TI，三态完全分离。R15 同理。

## 7. 新链工具与 exact argv

固定工具：

- PowerShell：`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe` / `455680` bytes / SHA-256=`9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3` / version=`10.0.19041.1 (WinBuild.160101.0800)`。
- csc：`C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe` / `2569696` bytes / SHA-256=`aae1db57f898ca8bda18590c56f86ced6d0ead80c22033b76fdfe9119706f116` / version=`4.8.9232.0 built by: NET481REL1LAST_C`。

argv canonical preimage 统一为 `UTF8("ANA-SEMI-ARGV-V001" + NUL + argv[0] + ... + NUL + argv[n-1])`，token 间一个 NUL、无尾随 NUL。

outer 15 tokens 按序固定：

1. `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`
2. `-NoProfile`
3. `-NonInteractive`
4. `-ExecutionPolicy`
5. `Bypass`
6. `-File`
7. `E:\mb-ms-doc\project-info\dev\ana-dev\test\Invoke-AnaSemiImplementationValidationV002.ps1`
8. `-ProjectRoot`
9. `E:\mb-ms-doc\project-info`
10. `-RunRoot`
11. `E:\mb-ms-doc\project-info\dev\ana-dev\tmp\RUN-DEV-ANA-SEMI-ROOT-PREFLIGHT-V007-REPAIR-IMPLEMENTATION-20260725-001`
12. `-CscPath`
13. `C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe`
14. `-ExpectedVectorsPath`
15. `E:\mb-ms-doc\project-info\dev\ana-dev\test\V007ExpectedVectors.R1.json`

outer count=`15`，canonical preimage bytes=`542`，SHA-256=`88d1d345c5b0d27776f6473e042d6c2a3220ad4e4bb013792526ef681cf4089b`。

csc 11 tokens 按序固定：

1. `C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe`
2. `/nologo`
3. `/target:library`
4. `/optimize+`
5. `/debug-`
6. `/checked+`
7. `/platform:anycpu`
8. `/warnaserror+`
9. `/utf8output`
10. `/out:E:\mb-ms-doc\project-info\dev\ana-dev\tmp\RUN-DEV-ANA-SEMI-ROOT-PREFLIGHT-V007-REPAIR-IMPLEMENTATION-20260725-001\staging\AnaSemi.NativeProcessRunnerV006.dll`
11. `E:\mb-ms-doc\project-info\dev\ana-dev\AnaSemi.NativeProcessRunnerV006.R1.cs`

csc count=`11`，canonical preimage bytes=`409`，SHA-256=`d80313814b3aa19fa559e9ee0ec50e58fc78f87f9405d77a73e156ec95865a6e`。

process 顺序：outer exactly 1；outer 内先 R16、再 R17；二者 PASS 后 csc `0..1`；csc 完成且 R09 合法后 CreateNew publish R10；随后只允许一次 `[Reflection.Assembly]::LoadFile((Resolve-Path R10).Path)`，exact full name=`AnaSemi.NativeProcessRunnerV006, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null`；再依次 R14/R15/R18/R19/R20。outer timeout=`180000ms`、kill-wait=`10000ms`；csc timeout=`60000ms`、kill-wait=`10000ms`。无法确认退出、stream close 或 argv roundtrip 即 final 27/no retry。

`UseShellExecute=false,CreateNoWindow=true`；csc logical argv 必须用 V007 已审 Windows quoting 形成唯一 `ProcessStartInfo.Arguments`，再以 `CommandLineToArgvW` roundtrip 逐 token ordinal 相等并复算同一 hash。I13 记录 csc count/hash；external native final 记录 outer/csc count/hash。禁止 shell 拼接、额外 option、第二次 LoadFile 或第二个 compiler。

## 8. R07 STOP enum 与 outer 映射

R07 只允许以下 STOP，未知值唯一转 `STOP_UNKNOWN_CODE/28`：

- precheck/contract：`STOP_VALIDATION_PRECHECK`、`STOP_TARGET_ALREADY_EXISTS_OR_PATH_ESCAPE`、`STOP_TOOL_PATH_HASH_VERSION_DRIFT`、`STOP_OUTER_ARGV_DRIFT`、`STOP_CSC_ARGV_DRIFT`、`STOP_JCS_MODULE_LOAD_OR_API_DRIFT`、`STOP_R16_JCS_CONTRACT`、`STOP_R17_L0_CLOSURE_CONTRACT`（exit 11）。
- csc/publish：`STOP_CSC_PROCESS_START_FAILED/12`、`STOP_CSC_TIMEOUT/13`、`STOP_CSC_NONZERO_EXIT/14`、`STOP_CSC_OUTPUT_INVALID/15`、`STOP_BUILD_PUBLISH_CREATE_NEW_OR_VERIFY_FAILED/16`。
- assembly：`STOP_ASSEMBLY_PATH_OR_HASH_DRIFT/17`、`STOP_ASSEMBLY_ALREADY_LOADED/18`、`STOP_ASSEMBLY_LOAD_FAILED/19`、`STOP_ASSEMBLY_LOAD_CONFLICT/20`、`STOP_ASSEMBLY_PUBLIC_API_DRIFT/21`。
- module：`STOP_L0_MODULE_DOTSOURCE_OUTPUT_DRIFT`、`STOP_L0_MODULE_SUCCESS_OUTPUT_DRIFT`、`STOP_L1_MODULE_DOTSOURCE_OUTPUT_DRIFT`、`STOP_L1_MODULE_SUCCESS_OUTPUT_DRIFT`（exit 22）。
- L0：`STOP_L0_SOURCE_CANONICAL_DRIFT`、`STOP_L0_CSC_OR_PUBLISH_DRIFT`、`STOP_L0_PROPERTY_CONTRACT_DRIFT`、`STOP_L0_POWERSHELL_AST_DRIFT`、`STOP_L0_PROHIBITED_API`、`STOP_L0_TOP_LEVEL_SIDE_EFFECT`、`STOP_L0_EXPECTED_VECTOR_BINDING`，以及 inherited `STOP_ASSEMBLY_PUBLIC_API_DRIFT`（exit 23 only after R14 valid TEST_FAIL）。
- L1：`STOP_L1_ARGV_QUOTING`、`STOP_L1_ARGV_FINGERPRINT`、`STOP_L1_ENVELOPE_EXTRA`、`STOP_L1_ENVELOPE_MISSING`、`STOP_L1_RESULT_STATE_MATRIX`、`STOP_L1_RAW_PREIMAGE`、`STOP_L1_REAL_13_TARGET_CONTRACT`、`STOP_L1_SYNTHETIC_30_TARGET_CONTRACT`、`STOP_L1_CREATE_NEW_DECISION`（exit 24 only after R15 valid TEST_FAIL）。
- package：`STOP_PREPACKAGE_TERMINAL_CREATE_NEW_OR_VERIFY_FAILED/27`、`STOP_RECEIPT_CREATE_NEW_OR_VERIFY_FAILED/25`、`STOP_MANIFEST_CREATE_NEW_OR_VERIFY_FAILED/26`、`STOP_PACKAGE_STATE_UNCERTAIN/27`、`STOP_UNKNOWN_CODE/28`。

R02 内部拒错 STOP 只进入 R16 case actual，不直接逃逸：`STOP_JCS_PARSE_OR_CANONICAL_DRIFT|STOP_JCS_STRING_ESCAPE_DRIFT|STOP_JCS_DUPLICATE_KEY|STOP_JCS_UNSUPPORTED_NUMBER|STOP_JCS_INVALID_SURROGATE|STOP_JCS_TARGET_ALREADY_EXISTS`。任何不在 R16 expected row 的实际 STOP 统一升级 `STOP_R16_JCS_CONTRACT/11`。

## 9. R16 exact 12-row contract

R16 恰好 12 行，顺序如下；`base64` 是唯一 raw byte preimage，bytes/hash 必须复算匹配：

| case_id | expected | expected_stop | bytes | SHA-256 | base64 |
|---|---|---|---:|---|---|
| JCS-PATH-001 | PASS | null | 60 | `fdc584feaf575a8ba805867b1465f48be1f095639630cc10f13c58415a83d873` | `eyJwYXRoIjoiRTpcXG1iLW1zLWRvY1xccHJvamVjdC1pbmZvXFxkZXZcXGFuYS1kZXZcXHRtcFxceCJ9` |
| JCS-ESCAPE-002 | PASS | null | 51 | `36113c2f15426ed6adc4c02224ddb3d19318c8a77fbf11dab373d29dba112220` | `eyJwYXRoIjoiRTpcXHhcXFwicVxcXCIiLCJ0YWIiOiJhXHRiIiwidGV4dCI6IuS4rSJ9` |
| NEG-ILLEGAL-SINGLE-BACKSLASH | STOP | STOP_JCS_PARSE_OR_CANONICAL_DRIFT | 15 | `712027ab87d7e6e1dafb45b5d03b4aeb6e95dd27961e32655ce8f07e95c0bf6a` | `eyJwYXRoIjoiRTpceCJ9` |
| NEG-DOUBLE-DECODE-DRIFT | STOP | STOP_JCS_STRING_ESCAPE_DRIFT | 18 | `e3c10e7bf74507eefd531ed3bd99b3dba6b649487f006bb7c6fbcb5f7437764f` | `eyJwYXRoIjoiRTpcXFxceCJ9` |
| NEG-TRAILING-LF | STOP | STOP_JCS_PARSE_OR_CANONICAL_DRIFT | 61 | `0238d827a4b440b646d39abf0565e6f0bd7215a09c8566c88413e2e623ede968` | `eyJwYXRoIjoiRTpcXG1iLW1zLWRvY1xccHJvamVjdC1pbmZvXFxkZXZcXGFuYS1kZXZcXHRtcFxceCJ9Cg==` |
| NEG-BOM | STOP | STOP_JCS_PARSE_OR_CANONICAL_DRIFT | 63 | `c168879605bebec02d0380bae2305de3bcd195263e55af7d8daa59873f694b52` | `77u/eyJwYXRoIjoiRTpcXG1iLW1zLWRvY1xccHJvamVjdC1pbmZvXFxkZXZcXGFuYS1kZXZcXHRtcFxceCJ9` |
| NEG-DUPLICATE-KEY | STOP | STOP_JCS_DUPLICATE_KEY | 13 | `1c53ee0df7b12fd4d65b976120c7fa6b847dc41dffd7f0331c3237a1ceab1756` | `eyJhIjoxLCJhIjoyfQ==` |
| NEG-NON-ORDINAL-KEY | STOP | STOP_JCS_PARSE_OR_CANONICAL_DRIFT | 13 | `a1d46c3cdb4e5795c8d637f80daeb578ebb1a9a65dc1ed5f11f51794c3c89f3a` | `eyJiIjoxLCJhIjoyfQ==` |
| NEG-FLOAT | STOP | STOP_JCS_UNSUPPORTED_NUMBER | 9 | `cb14d55cfe562fd6592d919f5dfacfa8708687b746a1d110c6dd5529c410e772` | `eyJuIjoxLjV9` |
| NEG-UNPAIRED-SURROGATE | STOP | STOP_JCS_INVALID_SURROGATE | 14 | `d06a70a1ca4d3ac4099cd5f35ecbb551be652247e0950c05790e8f0c58010851` | `eyJzIjoiXHVkODAwIn0=` |
| NEG-CREATE-NEW-CONFLICT | STOP | STOP_JCS_TARGET_ALREADY_EXISTS | 60 | `37928e5fd1eff63c7cec693293540c1ab8d723ebf80868fe3fd16393ca10dbaf` | `eyJwYXRoIjoicmVzZXJ2ZWQtY3JlYXRlLW5ldy1jb25mbGljdCIsInRhcmdldF9leGlzdHMiOnRydWV9` |
| NEG-WHITESPACE-DRIFT | STOP | STOP_JCS_PARSE_OR_CANONICAL_DRIFT | 14 | `7e580465f751205b8eab6c632d987e20be521090f0eaa8cc330f3fd8d4dc09e8` | `eyJhIjoxLCAiYiI6Mn0=` |

每行 actual 必须等于 expected；12/12 才 R16=`CONTRACT_PASS`。任一 mismatch 仍先完整物化 R16=`CONTRACT_FAIL`，primary=`PRECHECK/11/STOP_R16_JCS_CONTRACT`，R17/csc 不运行；R18 记录 P00，随后按 closure overlay 收口。

## 10. R17 exact 7-row closure contract

前三行继承 V005；新增四行固定如下：

| case_id | bytes/SHA-256 | expected mapping |
|---|---|---|
| L0-CLOSED-001 | `204/9f2a10fd3a9d0e245360fc2b747c0caa72420a893b7aca69a520af30fdcf8984` | `23+VALID_TEST_FAIL+CLOSED→23` |
| L0-ABSENT-002 | `200/025c6b6639ac6be0d9632c63685a60b87608f0603cf16058f5229bf9e8ba4110` | `23+ABSENT+PACKAGE_UNCLOSED→27` |
| L0-INVALID-003 | `202/76cf9f52a5953cba615355701b9c52ca12bcedfc4703d32882a1ed2be6949777` | `23+INVALID+PACKAGE_UNCLOSED→27` |
| L0-NOT-RUN-004 | `210/a529b7aa4a774d5dfc2b44269b2f1719053ae75e0cb82de63810e4f3d7d538b4` | `22+NOT_APPLICABLE+CLOSED→22` |
| R18-FAIL-005 | `208/15ec20bffc0cc216633f69058589feaac8656327e5284b9442ec1c1c9de648ff` | `23+VALID_TEST_FAIL+R18 failure→27` |
| R19-FAIL-006 | `211/3ef9229a1d165900a1df8e9759918b6c16391503cc889282d5328dcc2aa1417f` | `23+VALID_TEST_FAIL+receipt failure→25` |
| R20-FAIL-007 | `212/19468bd96b2bd4d17cb570776c63c71d7893f94ac4fd8074538a3ffa98c73c03` | `23+VALID_TEST_FAIL+manifest failure→26` |

R17 key、preimage 和 SHA-256 均使用 V005 六键 canonical object；新增四行 exact preimage 逐字为：

- `{"case_id":"L0_PRODUCER_NOT_ENTERED","closure_exit_code":22,"closure_state":"CLOSED","primary_evidence_state":"NOT_APPLICABLE","primary_exit_code":22,"primary_stop_code":"STOP_L0_MODULE_DOTSOURCE_OUTPUT_DRIFT"}`
- `{"case_id":"R18_CREATE_FAILED","closure_exit_code":27,"closure_state":"PACKAGE_UNCLOSED","primary_evidence_state":"VALID_TEST_FAIL","primary_exit_code":23,"primary_stop_code":"STOP_L0_SOURCE_CANONICAL_DRIFT"}`
- `{"case_id":"R19_CREATE_FAILED","closure_exit_code":25,"closure_state":"RECEIPT_CREATE_STOP","primary_evidence_state":"VALID_TEST_FAIL","primary_exit_code":23,"primary_stop_code":"STOP_L0_SOURCE_CANONICAL_DRIFT"}`
- `{"case_id":"R20_CREATE_FAILED","closure_exit_code":26,"closure_state":"MANIFEST_CREATE_STOP","primary_evidence_state":"VALID_TEST_FAIL","primary_exit_code":23,"primary_stop_code":"STOP_L0_SOURCE_CANONICAL_DRIFT"}`

7/7 才 R17=`CONTRACT_PASS`。任一 mismatch 先完整物化 R17=`CONTRACT_FAIL`，primary=`PRECHECK/11/STOP_R17_L0_CLOSURE_CONTRACT`，csc 不运行；R18 记录 P01，随后按 closure overlay 收口。

## 11. Authoritative DAG 与当前门禁

唯一 DAG 修订为：

`V007 design/audit + V006 plan/audit → R01-R08 → R16 → R17 → csc/R09/R11/R12 → CreateNew publish R10 → R13 → unique LoadFile(R10) → R14 → R15 → R18(pre-package as-of) → R19 → R20(self hash blank) → external native final(R20 external hash if valid)`。

source/outer/validation precheck 不能安全进入该 DAG 时，只生成 external native STOP，不创建 package。R18 不引用 R19/R20；R19 不引用自身/R20；R20 记录 R01—R19、self bytes/hash blank；external final 记录 R20 hash，严格无环。

独立复审只需确认三个 V005 blocker 是否关闭、两个原 implementation blocker 的计划层状态是否保持/推进。审核 PASS 后仍只能把 V006 与审核终态提交 management 请求**全新** run/attempt/target 的单次实现授权；不得在审核或请求阶段物化 R01—R20。旧 A001/run 永久 history-only，Git 非阻断且不得 clean/stage/revert，BATCH-001 继续 HELD。