Workspace, review scope and sandboxes — package invariants

One entry per package, verbatim from the engine map this tree replaces. The generated map-packages.md lists every package with its purpose and interfaces; these leaves carry the invariants. iterion map find|impact|path answer the exact questions.

• pkg/workspacetrack/ — workspace versioning: content-addressed capture/restore of the files a run produces, with a store-global object pool at <store>/workspace-objects/ and per-run chained snapshot manifests + stat cache under <store>/runs/<id>/workspace/. Backs iterion rewind's file restore for runs with no isolated worktree — the default shape, where git cannot serve because the workspace is the operator's live checkout and git add -A would stage their own work. worktree: auto runs keep the per-node git snapshots. Ignore rules are iterion's own (.iterionignore, falling back to .gitignore). That restore is SCOPED (--restore-scope produced, the in-place default): it puts back only the paths the run is recorded to have changed — the union of the diffs between consecutive boundaries in [pre:<pivot> … the run's last boundary] — because the documented loop is "edit the files, THEN rewind", so a full-tree restore reverts the operator's own work along with the run's (issue #380). What iterion cannot attribute it REPORTS (files.overwritten / files.left_in_place) rather than guesses. The engine writes a fail:<node>:<iter> boundary when a node's execution does not complete, a pause:<node>:<iter> one when it parks, and a resume:<node>:<iter> one when it picks back up (instead of overwriting pre:, which used to redefine "what this node started from" as "whatever is on disk now"). Without them pre: (an alias, which does not advance the chain head) would be the newest boundary and the scope would be empty. pause:/fail: open and resume: closes the interval in which NOTHING of the run executes — the only window where authorship is decidable, which the scope excludes; it is read from the CLOSING end because a label is a pointer the engine re-points, while a snapshot's own Label is written once. See docs/workspace-versioning.md

• pkg/git/ — Git helpers (worktree create/finalize, branch detection, fast-forward checks)

• pkg/reviewtopology/ — Resolves the credential-derived topology vars, each opt-in by var declaration (InjectAll at every launch surface): the mono/dual review topology (review_mode / mono_family, ADR-052 — auto resolves to mono on any detected family whose slot has a servable route (a backed family with none refuses the launch, #1221 below; dual only where none is detected at all, deleting a mono_family pin with it), so dual is an explicit spend; consumed by review-pr and evolve), the cross-model plan-review switch (plan_review, ADR-091 — auto → on iff ≥2 distinct model families are credentialed; it gates ONLY the peer review of the 7 campaign bots' plan phase — the phase itself runs by default, plan_phase: off being its own switch, and the campaign receives the plan stamped with its plan_provenance), and the raw family list (llm_families) so any bot can build its own policy without a new engine role var. On cloud, cloudpublisher derives the family set from the run's SEALED bundle (all five credential tiers) and injects the same vars onto queued runs. A mono_family no credential serves — or one a credential backs whose slot has no servable route (#1221: the inventory publishes each family as its candidate routes with launch states in llmroute's failure-class vocabulary, so a GLM-only host without the claude_code CLI refuses at launch instead of dying at the reviewer node) — refuses rather than being silently substituted, at BOTH moments that can still refuse and through one read-only predicate (RefusePinnedFamily): at launch (#2258), and at RESUME on every lane — cloud (SubmitResume, against the bundle it re-seals), studio/API/detached (runview.Service.Resume) and iterion resume, each against the set its own launch reads. A resume replays the inputs FROZEN at launch, so nothing else re-judges them and a run whose credential died since used to come back, start and die at its first review node — on the forge lane, a required check going dark on every pull request of the repo (#1221, measured 2026-09-22). The judgement writes nothing: the frozen inputs stay the launch's byte for byte. The refusal is typed (ErrUnservableFamily) because it is PERMANENT — the cloud auto-retry sweeper abandons such a run with the reason on its document instead of re-arming a queued→failed flap until the attempt budget burns. See docs/adr/052-review-topology-mono-dual.md + docs/adr/091-fallback-skip-route-and-plan-peer-review.md

• pkg/sandbox/ — Sandbox engine: Docker/Kubernetes drivers, devcontainer parsing, CONNECT proxy

• pkg/runshell/ — Spawns an interactive post-mortem PTY shell in a preserved run worktree (studio "Open shell"); Unix-only with a Windows stub

• pkg/cloud/ — Cloud-mode runtime wiring (queue dispatch, runner orchestration, multitenancy)