Architecture: the toolchain step (D3), and only looking before the go-ahead (D1)

D3's preflight and install recording become the toolchain step: a
bounded run of the item's driver model that makes the build VM and the
project's own files (pins, setup docs, CI configuration) agree, with
the repository as the record. The harness starts it when the VM isn't
set up for the project (and then it edits nothing in the repository);
the driver requests it once work is agreed, and its edits land in the
current milestone. Versions stay facts the harness reads itself; a
rebuilt VM's new host key is trusted only on the operator's word.

D1 gains the rule that until the go-ahead the agent only looks:
anything that changes something is refused by the fast path, so what
the work needs goes in the restatement.

The Development Plan's M4.2 follows: the toolchain step, in place of
recording installs.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

docs/Development-Plan.md

@@ -377,7 +377,7 @@ agent merging behind protection it can't satisfy, verified by a test (D4, D5, #6
 
 ### Phase 4 — The environment
 
-**M4.1 Toolchain preflight, M4.2 recording installs, M4.3 environment repair.**
+**M4.1 Toolchain preflight, M4.2 the toolchain step, M4.3 environment repair.**
 *Pre-approved.* All on the build VM (D3).
 
 **M4.1** is **done** (this PR). A model works out and sets up what a project
@@ -402,6 +402,18 @@ needs; code makes sure that happens, bounds it and checks the result.
   without it), preflight runs on the driver's model, gaps don't block. Turning
   off unattended upgrades and the template's baseline are template choices.
 
+**M4.2** *(revised with the operator: in place of recording installs).* The
+preflight becomes **the toolchain step** (D3): make the VM and the project's own
+files agree, with the repository as the record rather than a harness-kept one.
+- Started by the harness when the VM isn't set up for the project (M4.1's
+  checks): it sets the VM up from the repository and edits nothing there.
+- Requested by the driver (`toolchain_step(reason)`) once work is agreed: it
+  installs, then brings pins, setup docs and CI configuration in step; the edits
+  land in the current milestone's PR. Refused before the go-ahead.
+- Run in a transcript of its own; the driver sees only its report.
+- With it, D1's rule made structural: until the go-ahead the fast path refuses
+  anything that isn't harmless, so needs go in the restatement.
+
 ### Phase 5 — Memory
 
 **M5.1 The vault.** *Pre-approved.* The folder, per-agent mounts, control tools,