D3's preflight and install recording become the toolchain step: a bounded run of the item's driver model that makes the build VM and the project's own files (pins, setup docs, CI configuration) agree, with the repository as the record. The harness starts it when the VM isn't set up for the project (and then it edits nothing in the repository); the driver requests it once work is agreed, and its edits land in the current milestone. Versions stay facts the harness reads itself; a rebuilt VM's new host key is trusted only on the operator's word. D1 gains the rule that until the go-ahead the agent only looks: anything that changes something is refused by the fast path, so what the work needs goes in the restatement. The Development Plan's M4.2 follows: the toolchain step, in place of recording installs. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE