feat(edit): evaluate frozen constraints read-only

docs/api/facade-actions.md

@@ -82,7 +82,7 @@ Reading the tables:
 | --- | --- | --- | --- |
 | `ast_diff` | `diff_snapshot_id`, `file_path`, `include_node_bodies`, `language`, `mode`, `new_file`, `new_ref`, `new_source`, `old_file`, `old_ref`, `old_source`, `output_format` | `success`*, `verdict`*, `agent_summary`, `error` + action payload | `--ast-diff` |
 | `classify` | `diff_snapshot_id`, `file_path`, `hunk_cap`, `include_ast_nodes`, `language`, `mode`, `new_ref`, `new_source`, `old_ref`, `old_source`, `output_format` | `success`*, `verdict`*, `agent_summary`, `error` + action payload | `--semantic-classify` |
-| `constraints` | `output_format`, `path_filter`, `severity_min` | `success`*, `verdict`*, `agent_summary`, `error` + action payload | `--check-constraints` |
+| `constraints` | `diff_snapshot_id`, `output_format`, `path_filter`, `persist`, `scope_paths`, `severity_min` | `success`*, `verdict`*, `agent_summary`, `error` + action payload | `--check-constraints` |
 | `guard` | `modification_type`*, `symbol`*, `file_path` | `success`*, `verdict`*, `agent_summary`, `error` + action payload | `--modification-guard` |
 | `impact` | `agent_summary_only`, `capture_diff_snapshot`, `compact_only`, `include_tests`, `mode`, `output_format`, `pr_url`, `resource_profile`, `scope_mode`, `scope_paths` — `capture_diff_snapshot` is an explicit boolean producer available only to same-process POSIX consumers | `success`*, `verdict`*, `agent_summary`, `error` + action payload | `--change-impact` |
 | `pr` | `include_call_graph`, `mode`, `output_format`, `pr_url` | `success`*, `verdict`*, `agent_summary`, `error` + action payload | `--pr-review` |

tests/integration/test_diff_snapshot_capture.py

@@ -245,19 +245,16 @@ def test_frozen_scope_inventory_does_not_admit_post_capture_mutation(
 
 
 @POSIX_SNAPSHOT_TEST
-def test_staged_symlink_records_unsupported_source_kind(tmp_path: Path) -> None:
-    # PR #1252 review thread 3746878582.
+def test_staged_symlink_cannot_claim_shared_authoritative_generation(
+    tmp_path: Path,
+) -> None:
     root = _repo(tmp_path)
     (root / "module.py").symlink_to("old.py")
     _git(root, "add", "module.py")
 
     result = snapshots.DiffSnapshotRegistry().create(str(root), "staged", [])
 
-    assert result["success"] is True
-    record = next(
-        item for item in result["changed_records"] if item["path"] == "module.py"
-    )
-    assert (record["new_kind"], record["new_mode"]) == ("symlink", "120000")
+    assert result == {"success": False, "error_code": "SOURCE_SCOPE_UNSAFE"}
 
 
 def test_entry_parts_rejects_malformed_git_header() -> None:
@@ -485,3 +482,44 @@ def test_directory_replacement_captures_deletion_and_untracked_ancestor(
     assert sorted(records) == ["pkg", "pkg/nested.py"]
     assert records["pkg/nested.py"]["new_available"] is False
     assert records["pkg"]["old_available"] is False
+
+
+@POSIX_SNAPSHOT_TEST
+def test_staged_snapshot_constraint_config_comes_from_index_plane(
+    tmp_path: Path,
+) -> None:
+    # PR #1254 review 3765536002: staged constraints are index-plane evidence.
+    root = _repo(tmp_path)
+    config = root / "architectural-constraints.yml"
+    config.write_bytes(b"version: 1\nconstraints: []\n")
+    _git(root, "add", config.name)
+    config.write_bytes(b"version: 1\nconstraints: [invalid-worktree]\n")
+    registry = snapshots.DiffSnapshotRegistry()
+
+    created = registry.create(str(root), "staged", [])
+    consumer, error = registry.acquire(str(created["diff_snapshot_id"]), str(root))
+
+    assert error is None
+    assert consumer is not None
+    assert consumer.snapshot.constraint_config_path == config.name
+    assert consumer.snapshot.constraint_config_data == b"version: 1\nconstraints: []\n"
+    assert consumer.snapshot.staged_config_matches_worktree is False
+    consumer.release()
+
+
+@POSIX_SNAPSHOT_TEST
+def test_staged_snapshot_records_source_plane_divergence(tmp_path: Path) -> None:
+    # PR #1254 review 3765536016: live graphs cannot represent dirty staged sources.
+    root = _repo(tmp_path)
+    (root / "old.py").write_text("value = 2\n")
+    _git(root, "add", "old.py")
+    (root / "old.py").write_text("value = 3\n")
+    registry = snapshots.DiffSnapshotRegistry()
+
+    created = registry.create(str(root), "staged", [])
+    consumer, error = registry.acquire(str(created["diff_snapshot_id"]), str(root))
+
+    assert error is None
+    assert consumer is not None
+    assert consumer.snapshot.staged_source_matches_worktree is False
+    consumer.release()

tests/integration/test_diff_snapshot_registry.py

@@ -226,7 +226,11 @@ def oracle(*args, deadline=None):
     monkeypatch.setattr(snapshots.time, "monotonic", lambda: 100.0)
     monkeypatch.setattr(snapshots, "oracle_generation", oracle)
     consumer, error = registry.acquire(str(created["diff_snapshot_id"]), str(tmp_path))
-    assert (consumer, error, deadlines) == (None, "DIFF_SNAPSHOT_EXPIRED", [135.0])
+    assert (consumer, error, deadlines) == (
+        None,
+        "DIFF_SNAPSHOT_EXPIRED",
+        [135.0, 135.0],
+    )
 
 
 def test_strict_scope_binds_only_scoped_change_and_valid_scope(monkeypatch):

tests/unit/_diff_snapshot_support.py

@@ -41,6 +41,28 @@ def fake_oracle(project_root, mode="diff", *, deadline=None, manifest=None):
         return "sg_test", identity
 
     monkeypatch.setattr(snapshots, "oracle_generation", fake_oracle)
+    monkeypatch.setattr(
+        snapshots, "shared_source_generation", lambda *_a, **_k: "sg_test"
+    )
+    from types import SimpleNamespace
+
+    import tree_sitter_analyzer.index_source_snapshot as source_snapshot
+
+    monkeypatch.setattr(
+        source_snapshot,
+        "capture_current_source_snapshot",
+        lambda *_a, **_k: SimpleNamespace(
+            state="exact", generation="sg_test", reason=None
+        ),
+    )
+    monkeypatch.setattr(
+        snapshots,
+        "frozen_index_constraint_config",
+        lambda *_a, **_k: (None, None, ()),
+    )
+    monkeypatch.setattr(
+        snapshots, "frozen_index_sources_match_worktree", lambda *_a, **_k: True
+    )
     monkeypatch.setattr(
         snapshots,
         "capture_inventory",