Cruxible

Added

• Config-declared write tiers (write_tier): entity and relationship
  types may declare write_tier: governed_write to open their direct-write
  surface (add_entity / add_relationship / batch_direct_write) to
  governed_write actors. Undeclared types keep requiring graph_write;
  mixed payloads are gated at the strictest touched type; mutation guards
  and write_policy run unchanged after the tier check. Config lint
  rejects non-write tiers (read_only, admin) and tier declarations on
  proposal_only/mint_only types. See "Config-Declared Write Tiers"
  in the config reference.
• agent-operation kit: scratchpad notes + Decision acceptance guard:
  state_note_kind gains scratchpad — an implementer's mid-flight
  working state. StateNote and its attachment edges declare
  write_tier: governed_write, so implementer agents can write notes
  without graph_write. Curated note reads (recent_state_notes,
  state_notes_for_work_item, state_notes_for_review_request, and the
  bounded note sets of the context queries) exclude scratchpad notes; the
  new work_item_scratchpad query replays a work item's scratchpad notes
  in created order for mid-flight pickup. A new
  decision_acceptance_requires_authorized_actor mutation guard requires
  the authorized-reviewer actor to move a Decision to accepted —
  including create-with-accepted (proposed decisions stay writable at the
  normal tier). Trust boundary, on the record: the note surface (all
  kinds, creates and updates) is now governed_write territory — note
  content is governed_write-trust while verdicts and lifecycle stay
  actor-guarded; see the kit README's Note-Surface Trust Boundary.

Fixed

• Config reload refuses to strand stored graph records: reloading a
  config that no longer declares entity or relationship types present in
  the stored graph used to succeed silently and break every read of
  those records. Reload now refuses before any write, listing the
  stranded types with counts; --allow-orphans proceeds explicitly and
  the response carries the stranding report. Every successful reload now
  reports its type delta, and a reload with a corrupted current config
  still works as the repair path (delta reported as unknown).
• Snapshot clones are reachable on auth-enabled daemons: cloning used
  to mint a new instance with no credentials at all — instance-scoped
  source credentials couldn't reach it and nothing could be claimed or
  recovered. The clone response now returns a one-time ADMIN credential
  for the new instance (same conventions as credential claim-bootstrap);
  auth-disabled daemons are unchanged.
• Heterogeneous query returns are labeled correctly: queries returning
  AnyEntity now project entity_type and entity_id for every row
  instead of mislabeling rows under the entry point's key, and composed
  configs that select keys from unresolved return types fail config lint
  instead of silently disabling the check.