[planner] 読取りVerifyと出力担当を分けて元義務を保持する

dev-reports/issue-490/design.md

@@ -0,0 +1,41 @@
+# Issue #490 design
+
+Baseline: `b13ef093e462084956bb792e10616d6848e00f40`, including #466,
+#478 and #488. The working tree was clean. Read the full reviewed Issue
+narrative (R1–R5), frozen campaign decision/report, harness and relevant code.
+
+The defect is in `admission::preserve`: every same-kind/path Verify is
+collected as an output owner. A later package reader therefore prevents an
+otherwise intact original reader from satisfying the all-owner boundary.
+
+Add a leaf module for supported reader obligations. Initially support the
+closed profile package-manifest inspection instruction and the existing exact
+Next.js package-check grammar. Require both: neither Verify kind, a path,
+instruction wording alone, nor arbitrary JavaScript establishes read-only
+behavior. Creation instructions, side effects and unknown external scripts
+continue through the existing ownership rule. No runtime metadata is changed.
+
+Match each acquired reader to one distinct proposed reader containing its
+instruction, expected result, all required inputs and complete check group.
+Keep reader order and both sides of the original executable-owner boundaries,
+including split owners. Additional readers do not enlarge output ownership.
+Model and host capture, formation, lint, registration, fallback and the existing
+three-attempt limit remain authoritative.
+
+Port frozen P01/P02-D input and N01–N07 differences into portable corpus.
+First reproduce P02-D failure through normal generation, persistence, before-phase
+and registration. Add atomic-duty, acquired before/update/after, non-applicability,
+host fallback and runtime pass/fail/missing controls. Preserve registration paths,
+commands, producer scope and the artifact-only README rule. Record original build
+loss separately as an unresolved preset-conversion diagnostic.
+
+Run focused regressions, related #466/#478/#488 and corpus checks, fmt, clippy and
+the complete test suite using the dispatched dedicated target/cache/tmp/runtime.
+This is a planner change, not a release or live application evaluation. Commit
+only task-owned code, portable fixtures and the three worker contract documents.
+
+The existing flow file was already at its total growth limit with a zero test
+budget. Move its unchanged phase-entry sequence (resolve, persist, before-phase,
+register) to `phase/phase_entry.rs` and call it from flow. Test checkpoint/observation
+hooks live in that leaf; production order, events and error handoffs are preserved.
+This reduces the chokepoint rather than raising its baseline.

dev-reports/issue-490/implementation-summary.md

@@ -0,0 +1,64 @@
+# Issue #490 implementation
+
+Supported package readers now retain one complete obligation on one distinct
+Verify execution instead of joining all same-path readers into an output-owner
+set. Matching preserves instruction, expected result, required inputs, complete
+checks, reader order and both sides of original executable owners (including
+split outputs). No expected_paths, runtime prechecks or registered paths are
+removed. Unclassified Verify steps sharing the input remain potential owners
+and block the exemption.
+
+Support requires the exact existing package-manifest inspection instruction and
+nonempty commands accepted by the exact generated Next.js package-check grammar.
+Other instructions, creation work, arbitrary inline code, unknown external
+scripts and model read-only claims retain the existing ownership rule. There is
+no side-effect inference or unconditional Verify exemption.
+
+`admission::preserve` calls the new reader leaf, then applies the unchanged owner
+rule to other obligations. Existing model/host acquisition, #488 projection,
+formation, lint, finish/fallback, registration, final acceptance and the
+three-attempt limit remain in place. Events and schemas are unchanged.
+
+The phase-entry sequence was mechanically extracted from `phase/flow.rs` to
+`phase/phase_entry.rs` so portable replay hooks fit without increasing guardrail
+baselines. The product still resolves, saves, runs before_phase and registers
+before execution, with the same error handoffs and event order. Test hooks only
+restore the witnessed setup checkpoint, observe persisted/registered state and
+stop after successful core registration. They do not modify proposals or bypass
+Admission. The flow chokepoint shrank from 1,690 to 1,575 lines.
+
+## Regression evidence
+
+- P02-D failed before the production change with the documented complete-scope /
+  all-owner-boundary error, exhausted three attempts and never registered core.
+  The same portable raw input now registers with both package paths intact.
+- P01 registers; N01–N05/N07 refuse their targeted loss and leave the core contract
+  unchanged. N06 is host reaugmentation recovery, explicitly separate from
+  acquired-host refusal evidence.
+- R1: actual Admission capture and finish/fallback tests reject missing reader
+  instruction, result, checks, input, instruction/check collage, distributed
+  checks and ID/path-only correspondence.
+- R2: a history acquiring both before/update/after obligations has a passing
+  control. Either deletion, cross-update movement or one-execution merge fails.
+  Normal-flow tests also register the positive and refuse deletions/movements.
+- R3: creation, side-effect, external-script and self-declared-reader controls
+  do not receive the exemption, including extra unknown same-path Verify steps.
+- R4: every P02-D step has pinned metadata/precheck flags. Original, retained and
+  added readers run real package checks for pass, wrong-port failure and missing
+  input. Pass short-circuits; failures reach the existing execution/repair path
+  and propagate its controlled error. The same runtime test passes with original
+  ownership wiring and the fix; missing input remains a missing-path and existing
+  dependency-boundary result.
+- R5: the existing #478 acquired-host Admission and finish/fallback refusal test
+  remains unchanged and is included in related/full verification.
+- Registration retains the old contract and adds exactly README.md,
+  verify-ui.cjs and node verify-ui.cjs. The sole new producer is script-only
+  Implement/pass. Saved/reloaded plan, before_phase result, live contract and
+  saved contract agree. `test -f README.md` remains only in the plan.
+
+The committed corpus contains normalized frozen inputs, acquisition history,
+variants, expected registration/runtime metadata and provenance hashes. Tests
+need no historical run or local absolute path. Original preset build loss is
+retained in a separate stage-correct diagnostic; it is not fixed by #490.
+No live app/model/GUI success, #488 projection improvement, release or Issue
+lifecycle change is claimed.

dev-reports/issue-490/verification.md

@@ -0,0 +1,75 @@
+# Issue #490 verification
+
+- Status: `passed`
+
+## Checks
+
+- `cargo test --offline --lib issue490 -- --nocapture`: `passed`
+- `cargo test --offline --lib recovery_step_plan_binding`: `passed`
+- `cargo test --offline --test corpus_regression --test generality_guardrails`: `passed`
+- `cargo fmt --all -- --check`: `passed`
+- `cargo clippy --offline --all-targets -- -D warnings`: `passed`
+- `cargo test`: `passed`
+- `git diff --check`: `passed`
+
+## Results and boundaries
+
+The focused suite passed all 8 tests (with per-case loops). Related binding tests
+passed 57, including the unchanged
+`issue478_admission_and_fallback_refuse_missing_or_nonexecuting_host_duties`,
+#466 finite retry/fallback/registration and #488 admission/registration controls.
+Corpus passed 7 tests; guardrails passed 10 without baseline changes.
+The complete cargo test command exited 0: library tests passed 2,632 with 19
+existing ignored tests, followed by successful integration and documentation
+tests. Existing opt-in/ignored tests were not enabled. Final clippy has no warnings.
+
+Before the production fix, the normal-flow P02-D test failed with exit 101:
+`formation lost original check/expected result or its complete scope and boundary`.
+It exhausted the existing three attempts and did not register core. The P01 /
+N01–N07 companion test passed on that baseline. This expected red regression is
+the before-fix demonstration, not a failed final check. After the fix, identical
+P02-D input passes generation, save/reload, before_phase and normal registration,
+with no path deletion or Admission intervention.
+
+The runtime test was also run successfully with the original admission ownership
+wiring temporarily restored (`cargo test --offline --lib issue490_runtime --
+--nocapture`), then with the fix and again in the complete suite. It pins metadata
+and precheck applicability for all six proposed steps and executes nine reader
+controls: original/retained/additional reader × pass/wrong-port/missing input.
+Missing package.json retains both missing-path and existing dependency-boundary
+observations; failure and absence enter the ordinary executor/repair boundary
+and propagate its controlled error. Neither is counted as a successful precheck.
+No runtime verification implementation was changed.
+
+Normal-flow observations assert exact script/path additions, unchanged existing
+commands/paths, script-only Implement/pass producer, complete model/host
+instructions, unchanged saved/read-back plan and agreement between live and saved
+run contracts. README existence stays a plan check, excluded from final-success
+commands by the existing artifact-only rule. Reader-attribute and acquired
+before/update/after matrices additionally exercise actual Admission capture and
+finish/fallback; full-flow controls independently test registration/refusal.
+N06 is recorded as host restoration, not evidence of host-loss refusal.
+
+The separate build-loss diagnostic reproduces the frozen sanitized-to-preset
+transition, including its original conversion goal, and remains a known issue.
+No live application, GUI, model service or #488 projection improvement is claimed.
+This is not a release task; release build/version/hash checks are not applicable.
+
+## Execution environment and evidence
+
+Baseline commit: `b13ef093e462084956bb792e10616d6848e00f40`.
+Every cargo process exported the dispatched dedicated locations:
+
+```text
+CARGO_TARGET_DIR=/Volumes/SSD_NX/tmp/commandagent-orchestrate-490-20260917-01/target
+CARGO_HOME=/Volumes/SSD_NX/tmp/commandagent-orchestrate-490-20260917-01/cache/cargo
+TMPDIR=/Volumes/SSD_NX/tmp/commandagent-orchestrate-490-20260917-01/tmp
+```
+
+Raw logs remain uncommitted in that run's `runtime/`: `pre-fix.log`,
+`runtime-baseline.log`, `focused.log`, `related.log`, `corpus-guardrails.log`,
+`fmt-check.log`, `clippy.log`, and `full-test.log`. The portable corpus's provenance
+hashes and absence of local absolute paths were checked. CI uses only committed
+fixtures and temporary workspaces; it does not require these logs or the old SSD
+campaign. HOME, live `.anvil`, frozen experiments and external Issue state were
+not changed.

src/planner/recovery_step_plan_binding.rs

@@ -16,6 +16,7 @@ mod literal_marker_formation;
 pub(crate) mod package_owner_scope;
 mod package_script_formation;
 pub(crate) mod profile_augmentation;
+mod reader_obligations;
 mod verifier_formation;
 
 pub(crate) fn bind_generated(

src/planner/recovery_step_plan_binding/admission.rs

@@ -355,7 +355,11 @@ fn check_model_ownership(
 }
 
 pub(super) fn preserve(original: &StepPlan, proposed: &StepPlan) -> anyhow::Result<()> {
+    super::reader_obligations::preserve(original, proposed)?;
     for step in &original.steps {
+        if super::reader_obligations::supported(step) {
+            continue;
+        }
         let mut owner_indices = Vec::new();
         for path in &step.expected_paths {
             let expected = scope::normalized(path)?;

src/planner/recovery_step_plan_binding/issue466_tests.rs

@@ -171,3 +171,6 @@ mod issue484;
 
 #[path = "issue488_tests.rs"]
 mod issue488;
+
+#[path = "issue490_tests.rs"]
+mod issue490;