[2217173240]

Mixed single/batch record_fact input silently discarded the top-level fact, while prove_goal could report success after a failed graph write and could omit goals beyond the latest 1000. Validate fact input before any write or audit consumption, and commit evidence authorization, proof edges, goal state and complete goal counts in one PostgreSQL transaction. Tool completion flags change only after a successful commit. Preserve legacy single receipts and ordered partial-success batch receipts.

Acquire task/source locks before exploration and node locks to preserve task-deletion lock ordering. Keep one-hop live source authorization and revalidate nodes under lock. Natural-language goal acceptance and concurrent post-commit goal changes retain their existing contracts.

Resolve GHSA-mrhx-c7xc-m3w5 by updating the frontend and recon lockfiles to Zod 4.6.6 within their existing dependency ranges. Both dependency audits report zero vulnerabilities; frontend type checking and 230 unit tests pass, and recon tests report 10 passes with two existing Chromium skips.

Keep covered facts visible when a cold-graph query fails, and make budget/turn termination receipts refer to actual tool write receipts. These two narrow adaptations follow RuochenPan / RC-CHN's 055c06df and 210a4a66, AGPL-3.0. Source attribution and behavior are documented in docs/fork-integrations.md and docs/evidence-provenance.md.

Validation:

• Complete agent and db package tests with -race -count=1 passed against separate fresh PostgreSQL 16 databases; the live-model review test was explicitly excluded.
• Actual PostgreSQL failures cover INSERT, UPDATE, zero affected rows, COUNT, deferred COMMIT rejection and selective cold-graph reads. Rollback preserves proof edges, goal state and tool completion flags.
• Real database concurrency covers owner/source deletion lock ordering; count tests include 1001 goals with the oldest still open.
• Input tests verify prewrite rejection, audit preservation, default/overridden intents and ordered partial success.
• Independent review passed after correcting the lock-order finding; git diff --check passed.

All local runtime verification uses isolated databases and existing local code. No model, paid-provider or real-target requests were made. Exact-HEAD quality and CodeQL checks are required before normal merge.