From 742f15297e11a85b42330932cc5a41b1871b9e3b Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 11:58:23 +0900
Subject: [PATCH 01/29] omx(team): auto-checkpoint worker-1 [1]

---
 README.md                                  |   5 +-
 context-guard-kit/experimental_registry.py | 236 ++++++++++++++++++++-
 tests/test_context_guard_kit.py            | 187 +++++++++++++++-
 3 files changed, 425 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index aa7c8a1..9c864f0 100644
--- a/README.md
+++ b/README.md
@@ -119,7 +119,7 @@ If you need a savings claim, measure it on your own tasks:
 - It does not execute command manifests as code or trust arbitrary `PATH`/current-working-directory helpers during setup or packaged smoke checks.
 - It does not replace real before/after measurement when you need a savings claim.
 - Local RAM/disk receipts can help reduce what you send next, but they do **not** replace Anthropic's provider prompt cache or guarantee cache hits. Recheck Anthropic prompt-caching and pricing docs before release or billing claims: https://docs.anthropic.com/en/build-with-claude/prompt-caching and https://platform.claude.com/docs/en/about-claude/pricing.
-- Experimental helpers are mostly dry-run checker/planner surfaces, including a design-only external-forwarding opt-in gate. Explicit local runtimes exist only for caller-supplied context-diff replacement payloads, caller-supplied visual crop/OCR evidence packs, caller-supplied learned-compression prose candidates, self-hosted metrics JSONL sidecar records, local-proxy runtime-gate JSONL records, and one-shot `serve local-proxy` loopback forwarding with a private ready-file nonce, optional `--response-sandbox` compact artifact envelopes for safe UTF-8 responses, plus optional shifted-cost diagnostic JSONL rows for successful forwarded requests.
+- Experimental helpers are mostly dry-run checker/planner surfaces, including a plan-only `image-context-pack` evaluation gate and a design-only external-forwarding opt-in gate. Explicit local runtimes exist only for caller-supplied context-diff replacement payloads, caller-supplied visual crop/OCR evidence packs, caller-supplied learned-compression prose candidates, self-hosted metrics JSONL sidecar records, local-proxy runtime-gate JSONL records, and one-shot `serve local-proxy` loopback forwarding with a private ready-file nonce, optional `--response-sandbox` compact artifact envelopes for safe UTF-8 responses, plus optional shifted-cost diagnostic JSONL rows for successful forwarded requests.
 - ContextGuard does not ship learned/synthetic compressor execution, embeddings, rerankers, model calls, generated replacement text, screenshot capture, image cropping, OCR execution, image parsing, external OCR/image services, self-hosted KV/latent inference optimization beyond explicit local metrics recording, or broader proxy forwarding beyond literal-loopback, one-request HTTP forwarding with credential material blocked.
 - It does not alias the old `/claude-token-optimizer:*` Claude Code slash-command namespace. Use `/context-guard:*` after installing this plugin.
 
@@ -441,6 +441,7 @@ context-guard experiments plan context-diff-compaction --json < change.diff
 context-guard experiments emit context-diff-compaction --receipt-id <artifact-id> --reexpand-command "context-guard-artifact get <artifact-id> --full" --replacement-file compact-diff.txt --json < change.diff
 context-guard experiments plan visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --missed-context-note "outside crop omitted"
 context-guard experiments emit visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --ocr-text "visible text" --ocr-confidence 0.9 --ocr-error-note "glyph may be uncertain" --missed-context-note "outside crop omitted"
+context-guard experiments plan image-context-pack --json --exact-text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --provider-boundary-ack --missed-context-note "omitted text remains retrievable before any future image pack is used"
 context-guard experiments plan learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" < sanitized-prose.txt
 context-guard experiments emit learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --replacement-file compact-prose.txt < sanitized-prose.txt
 context-guard experiments plan self-hosted-metrics-ledger --json --latency-ms 123.5 --peak-memory-mb 2048 --quality-score 0.98
@@ -469,6 +470,7 @@ Shipped experimental checker/planner surfaces, plus explicit local context-diff,
 | --- | --- | --- |
 | `context-diff-compaction` | Dry-run diff advice plus an explicit `emit ... --receipt-id ... --reexpand-command ...` runtime for caller-supplied compact replacements. | `plan` emits no replacement. `emit` requires reviewable hunks, exact local artifact re-expand metadata whose stored content matches the input diff, and a smaller caller-supplied replacement; ContextGuard does not generate semantic compression or support hosted token/cost savings claims. |
 | `visual-crop-ocr` | Dry-run visual evidence advice plus an explicit `emit visual-crop-ocr` runtime for caller-supplied evidence packs. | `emit` requires a full visual evidence receipt, missed-context note, and complete user-supplied crop and/or OCR evidence; ContextGuard does not capture screenshots, crop images, run OCR, parse images, call external services, write files, or support hosted token/cost savings claims. |
+| `image-context-pack` | Pxpipe-inspired dry-run plan metadata only for future image/context packing evaluation. | `plan` emits no image, replacement, evidence pack, binary artifact, ledger, listener, or proxy. It requires explicit opt-in, exact text fallback receipt/re-expand metadata before omitted text is used, protected-zone denial, missed-context notes, and provider/model measured matched-task boundaries. `visual-crop-ocr` remains the caller-supplied visual evidence-pack surface; `image-context-pack` is not a duplicate emitter or verified exact binary/image fallback. |
 | `learned-compression` | Deny-by-default policy checks plus an explicit `emit learned-compression` runtime for caller-supplied compact prose candidates with verified exact fallback content. | `emit` requires sanitized trusted prose, protected-signal denial, a verified local fallback artifact matching the input, and a smaller caller-supplied prose candidate; ContextGuard does not run compressors, embeddings, rerankers, model calls, subprocesses, external services, generated replacement text, or hosted savings claims. |
 | `self-hosted-metrics-ledger` | Dry-run preview plus an explicit `record ... --ledger-jsonl` runtime for local/model-server latency, memory, quality, energy, throughput, and local-cost metrics. | The dry-run preview does not write a ledger; the explicit record command writes only local JSONL sidecars and still does not support hosted API token/cost savings claims. |
 | `local-proxy` | Localhost-only advisory metadata, design-only `plan local-proxy-external-forwarding` review for future external forwarding, an explicit `record local-proxy-runtime-gate --ledger-jsonl` runtime for one local gate row, an explicit one-shot `serve local-proxy` loopback forwarding MVP, optional `--response-sandbox` compact artifact envelopes, and optional `--diagnostic-ledger-jsonl` shifted-cost diagnostics for successful forwarded requests. | `plan` writes no ledger. `record` writes only after localhost-only metadata and `--runtime-gate-ack`; it starts no listener, forwards no traffic, and performs no DNS lookup. `serve` additionally requires `--forwarding-gate-ack --once`, a private `--ready-file` nonce handoff, literal loopback bind/target IPs, nonzero ports, bounded bytes/timeouts, and credential-free requests; it performs no external forwarding, no CONNECT/TLS proxying, no API-key persistence, and no hosted-savings claim. `--response-sandbox` can store safe UTF-8 response text as a sanitized local artifact receipt and return a compact envelope with redacted rehydration command templates; it does not claim hosted token/cost savings. `--diagnostic-ledger-jsonl` writes only successful-forward diagnostics with no raw headers/bodies and no hosted-savings claim. `plan local-proxy-external-forwarding` emits threat-model/allowlist/redaction/provider-evidence design metadata only and still performs no DNS lookup, external service call, traffic forwarding, credential persistence, or hosted-savings claim. |
@@ -481,6 +483,7 @@ ContextGuard does not yet ship:
 
 - learned/synthetic compressor execution or generated replacement text beyond the caller-supplied learned candidate emitter
 - generated crop/OCR or visual-token pruning runtime beyond the caller-supplied visual evidence-pack emitter
+- generated image-context-pack renderers, binary/image artifact fallback, or pxpipe-style proxy/runtime beyond the plan-only evaluation gate
 - self-hosted KV/latent optimization beyond explicit local metrics recording
 - external, daemon, or credential-bearing proxy forwarding beyond the one-shot literal-loopback local proxy MVP
 
diff --git a/context-guard-kit/experimental_registry.py b/context-guard-kit/experimental_registry.py
index fd44d5c..eb5880b 100755
--- a/context-guard-kit/experimental_registry.py
+++ b/context-guard-kit/experimental_registry.py
@@ -67,6 +67,8 @@
 LOCAL_PROXY_READY_SCHEMA_VERSION = "contextguard.experiments.local-proxy-ready.v1"
 LOCAL_PROXY_EXTERNAL_DESIGN_SCHEMA_VERSION = "contextguard.experiments.local-proxy-external-forwarding-design.v1"
 LOCAL_PROXY_RESPONSE_SANDBOX_SCHEMA_VERSION = "contextguard.experiments.local-proxy-response-sandbox.v1"
+IMAGE_CONTEXT_PACK_PLAN_SCHEMA_VERSION = "contextguard.experiments.image-context-pack-plan.v1"
+IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY = "provider-measured-matched-tasks-required"
 LOCAL_PROXY_DEFAULT_BIND_HOST = "127.0.0.1"
 LOCAL_PROXY_DEFAULT_BIND_PORT = 0
 LOCAL_PROXY_DEFAULT_TARGET_HOST = "127.0.0.1"
@@ -259,6 +261,53 @@ def to_json(self, *, enabled: bool = False) -> dict[str, Any]:
             "OCR confidence/error notes when OCR is present, and missed-context guardrails before human review."
         ),
     ),
+    Experiment(
+        id="image-context-pack",
+        name="Pxpipe-inspired image context pack planning gate",
+        summary=(
+            "Plan-only evaluation gate for pxpipe-inspired image/context packing without rendering images, "
+            "emitting visual artifacts, or changing runtime behavior."
+        ),
+        stability="experimental",
+        default_enabled=False,
+        risk_level="high",
+        claim_boundary=(
+            "Image/request byte reductions are proxy evidence only; hosted token/cost savings require "
+            "provider-measured matched successful tasks."
+        ),
+        gate_requirements=(
+            "explicit opt-in",
+            "verified exact text artifact fallback before omitted text is used",
+            "protected-zone denial",
+            "provider/model measurement boundary",
+            "missed-context guardrails",
+            "relation to visual-crop-ocr",
+        ),
+        runtime_status="available-plan-only",
+        commands=("context-guard experiments plan image-context-pack",),
+        opt_in_flags=(
+            "plan image-context-pack",
+            "--exact-text-fallback-receipt",
+            "--reexpand-command",
+            "--provider-boundary-ack",
+            "--protected-zone-policy deny",
+            "--missed-context-note",
+            "--image-size",
+            "--packed-image-size",
+        ),
+        config_effect=(
+            "Registry enablement records project-local intent only; image-context-pack exposes only a deterministic "
+            "plan command. It does not add an emit/record/serve runtime, render images, run OCR, call models, proxy "
+            "traffic, write binary artifacts, or duplicate the caller-supplied visual-crop-ocr evidence-pack emitter."
+        ),
+        evidence_contract=(
+            "Plans require explicit opt-in, exact text fallback receipt/re-expand metadata before omitted exact text "
+            "is used, protected-zone denial for code/diffs/identifiers/hashes/paths/numeric constants/JSON keys/"
+            "stack frames/secrets/prompt-like instructions, provider/model measured matched-task boundaries, "
+            "missed-context guardrails, and an explicit relation_to_visual_crop_ocr statement: visual-crop-ocr "
+            "remains caller-supplied visual evidence only and is not a verified exact binary/image fallback."
+        ),
+    ),
     Experiment(
         id="learned-compression",
         name="Learned/synthetic compression candidate gate",
@@ -1735,6 +1784,167 @@ def command_plan_visual_crop_ocr(args: argparse.Namespace) -> int:
     return 0
 
 
+def image_context_pack_size_payload(raw: str | None) -> tuple[dict[str, Any] | None, bool]:
+    size = parse_int_tuple(raw, count=2)
+    if raw is None or not str(raw).strip():
+        return None, True
+    if size is None:
+        return None, False
+    width, height = size
+    if width <= 0 or height <= 0:
+        return {"width": width, "height": height}, False
+    return {"width": width, "height": height}, True
+
+
+def image_context_pack_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
+    receipt_id = args.exact_text_fallback_receipt.strip() if args.exact_text_fallback_receipt else None
+    reexpand_command = args.reexpand_command.strip() if args.reexpand_command else None
+    reexpand_valid, fallback_blocker = valid_learned_reexpand_command(receipt_id, reexpand_command)
+    fallback_blocker_map = {
+        "missing_exact_fallback": "missing_exact_text_fallback",
+        "invalid_reexpand_command": "invalid_exact_text_reexpand_command",
+    }
+    source_size, source_size_valid = image_context_pack_size_payload(args.image_size)
+    packed_size, packed_size_valid = image_context_pack_size_payload(args.packed_image_size)
+    missed_context_notes = clean_values(args.missed_context_note)
+    protected_policy = (args.protected_zone_policy or "deny").strip().lower()
+
+    blockers: list[str] = []
+    if fallback_blocker:
+        blockers.append(fallback_blocker_map.get(fallback_blocker, fallback_blocker))
+    if not args.provider_boundary_ack:
+        blockers.append("missing_provider_measurement_boundary")
+    if not missed_context_notes:
+        blockers.append("missing_missed_context_note")
+    if protected_policy != "deny":
+        blockers.append("protected_zone_denial_required")
+    if not source_size_valid:
+        blockers.append("invalid_image_size")
+    if not packed_size_valid:
+        blockers.append("invalid_packed_image_size")
+    blockers = list(dict.fromkeys(blockers))
+
+    source_area = source_size["width"] * source_size["height"] if source_size and source_size_valid else None
+    packed_area = packed_size["width"] * packed_size["height"] if packed_size and packed_size_valid else None
+    area_delta = source_area - packed_area if source_area is not None and packed_area is not None else None
+    ready = not blockers
+
+    return {
+        "tool": TOOL_NAME,
+        "schema_version": CONFIG_SCHEMA_VERSION,
+        "plan_schema_version": IMAGE_CONTEXT_PACK_PLAN_SCHEMA_VERSION,
+        "experiment_id": "image-context-pack",
+        "mode": "dry_run",
+        "status": "ready_for_plan_review" if ready else "blocked_until_image_context_pack_gate_ready",
+        "plan_only": {
+            "command_advertised": True,
+            "emit_command_available": False,
+            "record_command_available": False,
+            "serve_command_available": False,
+            "runtime_behavior_changed": False,
+            "replacement_or_visual_evidence_emitted": False,
+        },
+        "external_services": {
+            "called": False,
+            "network": False,
+            "model_calls": False,
+            "ocr_service": None,
+            "image_service": None,
+            "proxy_forwarding": False,
+        },
+        "runtime_side_effects": {
+            "files_written": False,
+            "image_rendering": False,
+            "ocr_execution": False,
+            "image_parsing": False,
+            "binary_artifacts_written": False,
+            "proxy_forwarding": False,
+            "stable_runtime_behavior_changed": False,
+        },
+        "text_fallback": {
+            "required": True,
+            "available": bool(reexpand_valid),
+            "receipt_id": receipt_id,
+            "reexpand_command": reexpand_command,
+            "verified": False,
+            "must_be_verified_before_omitted_text_is_used": True,
+            "note": (
+                "This dry-run validates only local receipt/re-expand shape. A future runtime must verify exact "
+                "text artifact content before relying on omitted exact text."
+            ),
+        },
+        "protected_zones": {
+            "policy": protected_policy,
+            "override_allowed": False,
+            "denied_classes": [
+                "code",
+                "diffs",
+                "identifiers",
+                "hashes",
+                "paths",
+                "numeric_constants",
+                "json_keys",
+                "stack_frames",
+                "secrets",
+                "prompt_like_instructions",
+            ],
+        },
+        "image_pack_plan": {
+            "source_label": sanitize_self_hosted_text(args.source_label) if args.source_label else "manual-plan",
+            "source_image_size": source_size,
+            "packed_image_size": packed_size,
+            "source_area": source_area,
+            "packed_area": packed_area,
+            "area_delta": area_delta,
+            "area_reduction_is_proxy_only": area_delta is not None,
+            "image_or_request_byte_reductions_are_proxy_evidence_only": True,
+        },
+        "measurement_boundary": {
+            "provider_boundary_acknowledged": bool(args.provider_boundary_ack),
+            "provider_boundary_policy": IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY,
+            "provider_measured_matched_tasks_required_for_hosted_claims": True,
+            "provider_model_specific": True,
+            "hosted_api_token_savings_claim_allowed": False,
+            "hosted_api_cost_savings_claim_allowed": False,
+        },
+        "relation_to_visual_crop_ocr": {
+            "visual_crop_ocr_is_existing_surface": True,
+            "visual_crop_ocr_remains_caller_supplied_visual_evidence_pack": True,
+            "image_context_pack_is_planning_gate_not_duplicate_emitter": True,
+            "verified_exact_binary_or_image_fallback_claimed": False,
+        },
+        "review_plan": {
+            "readiness_blockers": blockers,
+            "missed_context_notes": missed_context_notes,
+            "next_steps": [
+                "Keep exact text artifact fallback verified before any future image/context packing omits source text.",
+                "Deny protected evidence zones before any future lossy visual packing is considered.",
+                "Measure provider/model token and cost fields on matched successful tasks before any hosted savings claim.",
+                "Use visual-crop-ocr only for caller-supplied visual evidence packs; this gate emits no images or evidence.",
+            ],
+        },
+        "claim_boundary": (
+            "Dry-run image-context-pack planning only; image/request byte reductions are proxy evidence and no hosted "
+            "token/cost savings claim is allowed without provider-measured matched successful tasks."
+        ),
+        "candidate_replacement": None,
+    }
+
+
+def command_plan_image_context_pack(args: argparse.Namespace) -> int:
+    payload = image_context_pack_plan_payload(args)
+    if args.json:
+        emit_json(payload)
+    else:
+        print("ContextGuard image-context-pack plan (dry-run only)")
+        print("No image rendering, OCR/image service, model call, proxy forwarding, binary artifact, or replacement was emitted.")
+        print(f"Status: {payload['status']}")
+        if payload["review_plan"]["readiness_blockers"]:
+            print(f"Readiness blockers: {', '.join(payload['review_plan']['readiness_blockers'])}")
+        print(payload["claim_boundary"])
+    return 0
+
+
 def visual_crop_ocr_evidence_pack_payload(args: argparse.Namespace) -> dict[str, Any]:
     payload = visual_crop_ocr_plan_payload(args)
     blockers = list(payload["review_plan"]["readiness_blockers"])
@@ -4467,6 +4677,30 @@ def build_parser() -> argparse.ArgumentParser:
     visual_ocr.add_argument("--json", action="store_true", help="Emit JSON output.")
     visual_ocr.set_defaults(func=command_plan_visual_crop_ocr)
 
+    image_context_pack = plan_sub.add_parser(
+        "image-context-pack",
+        help="Dry-run a plan-only pxpipe-inspired image/context packing gate without rendering images.",
+    )
+    image_context_pack.add_argument("--source-label", help="Safe label for this image/context packing plan.")
+    image_context_pack.add_argument("--image-size", help="Optional source image/context canvas size as width,height integers.")
+    image_context_pack.add_argument("--packed-image-size", help="Optional planned packed image size as width,height integers.")
+    image_context_pack.add_argument("--exact-text-fallback-receipt", help="Local exact text artifact receipt id for omitted source text.")
+    image_context_pack.add_argument("--reexpand-command", help="Local exact text re-expand command bound to the receipt id.")
+    image_context_pack.add_argument(
+        "--provider-boundary-ack",
+        action="store_true",
+        help="Acknowledge hosted claims require provider-measured matched successful tasks for the target model.",
+    )
+    image_context_pack.add_argument(
+        "--protected-zone-policy",
+        default="deny",
+        choices=("deny", "allow"),
+        help="Protected evidence handling; only deny can pass the plan gate.",
+    )
+    image_context_pack.add_argument("--missed-context-note", action="append", help="Potential context omitted by a future pack. Repeatable.")
+    image_context_pack.add_argument("--json", action="store_true", help="Emit JSON output.")
+    image_context_pack.set_defaults(func=command_plan_image_context_pack)
+
     self_hosted = plan_sub.add_parser(
         "self-hosted-metrics-ledger",
         help="Dry-run self-hosted/local metrics ledger sidecar evidence without writing a ledger.",
@@ -4757,7 +4991,7 @@ def normalize_negative_csv_option_values(argv: list[str] | None) -> list[str] |
         argv = sys.argv[1:]
     normalized: list[str] = []
     pending_csv_option: str | None = None
-    csv_options = {"--crop-bounds"}
+    csv_options = {"--crop-bounds", "--image-size", "--packed-image-size"}
     for token in argv:
         if pending_csv_option is not None:
             normalized.append(f"{pending_csv_option}={token}")
diff --git a/tests/test_context_guard_kit.py b/tests/test_context_guard_kit.py
index 871a625..5ca34a1 100644
--- a/tests/test_context_guard_kit.py
+++ b/tests/test_context_guard_kit.py
@@ -1669,6 +1669,25 @@ def test_experimental_registry_describes_safe_explicit_flag_surfaces(self):
                         self.assertIn("full visual evidence receipt", visual_ocr["evidence_contract"])
                         self.assertIn("missed-context", visual_ocr["evidence_contract"].lower())
 
+                        image_context_pack = experiments["image-context-pack"]
+                        self.assertFalse(image_context_pack["default_enabled"])
+                        self.assertEqual(image_context_pack["runtime_status"], "available-plan-only")
+                        self.assertEqual(image_context_pack["commands"], ["context-guard experiments plan image-context-pack"])
+                        self.assertIn("plan image-context-pack", image_context_pack["opt_in_flags"])
+                        self.assertIn("--exact-text-fallback-receipt", image_context_pack["opt_in_flags"])
+                        self.assertIn("--provider-boundary-ack", image_context_pack["opt_in_flags"])
+                        self.assertIn("--protected-zone-policy deny", image_context_pack["opt_in_flags"])
+                        self.assertIn("deterministic plan command", image_context_pack["config_effect"])
+                        self.assertIn("does not add an emit/record/serve runtime", image_context_pack["config_effect"])
+                        self.assertIn("render images", image_context_pack["config_effect"])
+                        self.assertIn("proxy traffic", image_context_pack["config_effect"])
+                        self.assertIn("visual-crop-ocr", image_context_pack["evidence_contract"])
+                        self.assertIn("verified exact text artifact fallback", image_context_pack["evidence_contract"])
+                        self.assertIn("provider/model measured matched-task", image_context_pack["evidence_contract"])
+                        self.assertNotIn("emit image-context-pack", " ".join(image_context_pack["commands"]))
+                        self.assertNotIn("record image-context-pack", " ".join(image_context_pack["commands"]))
+                        self.assertNotIn("serve image-context-pack", " ".join(image_context_pack["commands"]))
+
                         learned = experiments["learned-compression"]
                         self.assertEqual(learned["runtime_status"], "available-explicit-runtime")
                         self.assertIn("context-guard experiments plan learned-compression", learned["commands"])
@@ -2794,7 +2813,16 @@ def test_experimental_visual_crop_ocr_dispatcher_and_no_service_surface(self):
                 self.assertIsNone(payload["candidate_replacement"])
 
         package = json.loads((ROOT / "package.json").read_text(encoding="utf-8"))
-        for name in ("context-guard-ocr", "context-guard-crop", "context-guard-visual-token"):
+        for name in (
+            "context-guard-ocr",
+            "context-guard-crop",
+            "context-guard-visual-token",
+            "context-guard-image-context-pack",
+            "context-guard-image-pack",
+            "context-guard-image-renderer",
+            "context-guard-image-parser",
+            "context-guard-proxy",
+        ):
             self.assertNotIn(name, package["bin"])
             self.assertFalse((PLUGIN_BIN / name).exists())
         source = (KIT_DIR / "experimental_registry.py").read_text(encoding="utf-8")
@@ -2802,6 +2830,163 @@ def test_experimental_visual_crop_ocr_dispatcher_and_no_service_surface(self):
             self.assertNotIn(forbidden, source)
         self.assertIn("LOCAL_PROXY_FORWARD_SCHEMA_VERSION", source)
 
+    def test_experimental_image_context_pack_plan_only_contract(self):
+        receipt = "0123456789abcdef"
+        for script in EXPERIMENT_SCRIPTS:
+            with self.subTest(script=script):
+                proc = subprocess.run(
+                    [
+                        sys.executable,
+                        str(script),
+                        "plan",
+                        "image-context-pack",
+                        "--exact-text-fallback-receipt",
+                        receipt,
+                        "--reexpand-command",
+                        f"context-guard-artifact get {receipt} --full",
+                        "--provider-boundary-ack",
+                        "--missed-context-note",
+                        "summary table footer remains available through exact text fallback",
+                        "--image-size",
+                        "800,600",
+                        "--packed-image-size",
+                        "400,300",
+                        "--json",
+                    ],
+                    text=True,
+                    capture_output=True,
+                    check=True,
+                )
+                payload = json.loads(proc.stdout)
+                self.assertEqual(payload["tool"], "context-guard-experiments")
+                self.assertEqual(payload["schema_version"], "contextguard.experiments.v1")
+                self.assertEqual(payload["plan_schema_version"], "contextguard.experiments.image-context-pack-plan.v1")
+                self.assertEqual(payload["experiment_id"], "image-context-pack")
+                self.assertEqual(payload["mode"], "dry_run")
+                self.assertEqual(payload["status"], "ready_for_plan_review")
+                self.assertEqual(payload["review_plan"]["readiness_blockers"], [])
+                self.assertTrue(payload["plan_only"]["command_advertised"])
+                self.assertFalse(payload["plan_only"]["emit_command_available"])
+                self.assertFalse(payload["plan_only"]["record_command_available"])
+                self.assertFalse(payload["plan_only"]["serve_command_available"])
+                self.assertFalse(payload["plan_only"]["replacement_or_visual_evidence_emitted"])
+                self.assertFalse(payload["external_services"]["called"])
+                self.assertFalse(payload["external_services"]["network"])
+                self.assertFalse(payload["external_services"]["model_calls"])
+                self.assertFalse(payload["external_services"]["proxy_forwarding"])
+                self.assertFalse(payload["runtime_side_effects"]["files_written"])
+                self.assertFalse(payload["runtime_side_effects"]["image_rendering"])
+                self.assertFalse(payload["runtime_side_effects"]["ocr_execution"])
+                self.assertFalse(payload["runtime_side_effects"]["image_parsing"])
+                self.assertFalse(payload["runtime_side_effects"]["binary_artifacts_written"])
+                self.assertFalse(payload["runtime_side_effects"]["proxy_forwarding"])
+                self.assertTrue(payload["text_fallback"]["required"])
+                self.assertTrue(payload["text_fallback"]["available"])
+                self.assertFalse(payload["text_fallback"]["verified"])
+                self.assertTrue(payload["text_fallback"]["must_be_verified_before_omitted_text_is_used"])
+                self.assertEqual(payload["protected_zones"]["policy"], "deny")
+                self.assertFalse(payload["protected_zones"]["override_allowed"])
+                for protected_class in ("code", "diffs", "identifiers", "hashes", "paths", "numeric_constants", "json_keys", "stack_frames", "secrets", "prompt_like_instructions"):
+                    self.assertIn(protected_class, payload["protected_zones"]["denied_classes"])
+                self.assertTrue(payload["measurement_boundary"]["provider_boundary_acknowledged"])
+                self.assertTrue(payload["measurement_boundary"]["provider_measured_matched_tasks_required_for_hosted_claims"])
+                self.assertFalse(payload["measurement_boundary"]["hosted_api_token_savings_claim_allowed"])
+                self.assertFalse(payload["measurement_boundary"]["hosted_api_cost_savings_claim_allowed"])
+                self.assertTrue(payload["image_pack_plan"]["image_or_request_byte_reductions_are_proxy_evidence_only"])
+                self.assertEqual(payload["image_pack_plan"]["source_area"], 480000)
+                self.assertEqual(payload["image_pack_plan"]["packed_area"], 120000)
+                self.assertEqual(payload["image_pack_plan"]["area_delta"], 360000)
+                relation = payload["relation_to_visual_crop_ocr"]
+                self.assertTrue(relation["visual_crop_ocr_is_existing_surface"])
+                self.assertTrue(relation["visual_crop_ocr_remains_caller_supplied_visual_evidence_pack"])
+                self.assertTrue(relation["image_context_pack_is_planning_gate_not_duplicate_emitter"])
+                self.assertFalse(relation["verified_exact_binary_or_image_fallback_claimed"])
+                self.assertIn("proxy evidence", payload["claim_boundary"])
+                self.assertIsNone(payload["candidate_replacement"])
+
+    def test_experimental_image_context_pack_blocks_missing_or_unsafe_gates(self):
+        receipt = "0123456789abcdef"
+        cases = [
+            (
+                "missing-provider-boundary",
+                [
+                    "--exact-text-fallback-receipt",
+                    receipt,
+                    "--reexpand-command",
+                    f"context-guard-artifact get {receipt} --full",
+                    "--missed-context-note",
+                    "footer omitted",
+                ],
+                "missing_provider_measurement_boundary",
+            ),
+            (
+                "protected-zone-override",
+                [
+                    "--exact-text-fallback-receipt",
+                    receipt,
+                    "--reexpand-command",
+                    f"context-guard-artifact get {receipt} --full",
+                    "--provider-boundary-ack",
+                    "--missed-context-note",
+                    "footer omitted",
+                    "--protected-zone-policy",
+                    "allow",
+                ],
+                "protected_zone_denial_required",
+            ),
+            (
+                "malformed-image-size",
+                [
+                    "--exact-text-fallback-receipt",
+                    receipt,
+                    "--reexpand-command",
+                    f"context-guard-artifact get {receipt} --full",
+                    "--provider-boundary-ack",
+                    "--missed-context-note",
+                    "footer omitted",
+                    "--image-size",
+                    "-1,600",
+                ],
+                "invalid_image_size",
+            ),
+            (
+                "missing-exact-text-fallback",
+                [
+                    "--provider-boundary-ack",
+                    "--missed-context-note",
+                    "footer omitted",
+                ],
+                "missing_exact_text_fallback",
+            ),
+        ]
+        for script in EXPERIMENT_SCRIPTS:
+            for name, args, expected_blocker in cases:
+                with self.subTest(script=script, case=name):
+                    proc = subprocess.run(
+                        [sys.executable, str(script), "plan", "image-context-pack", *args, "--json"],
+                        text=True,
+                        capture_output=True,
+                        check=True,
+                    )
+                    payload = json.loads(proc.stdout)
+                    self.assertEqual(payload["experiment_id"], "image-context-pack")
+                    self.assertEqual(payload["status"], "blocked_until_image_context_pack_gate_ready")
+                    self.assertIn(expected_blocker, payload["review_plan"]["readiness_blockers"])
+                    self.assertFalse(payload["external_services"]["called"])
+                    self.assertFalse(payload["runtime_side_effects"]["files_written"])
+
+    def test_experimental_image_context_pack_emit_is_unavailable(self):
+        for script in EXPERIMENT_SCRIPTS:
+            with self.subTest(script=script):
+                proc = subprocess.run(
+                    [sys.executable, str(script), "emit", "image-context-pack", "--json"],
+                    text=True,
+                    capture_output=True,
+                )
+                self.assertEqual(proc.returncode, 2)
+                self.assertIn("invalid choice", proc.stderr)
+                self.assertNotIn("Traceback", proc.stderr + proc.stdout)
+
     def test_experimental_visual_crop_ocr_emit_runtime(self):
         for script in EXPERIMENT_SCRIPTS:
             with self.subTest(script=script):

From 31dcc912bfdcdb6374cb77e14556cab87df057a6 Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 11:58:23 +0900
Subject: [PATCH 02/29] omx(team): auto-checkpoint worker-2 [2]

---
 README.md                                     |  11 +-
 context-guard-kit/README.md                   |   4 +-
 context-guard-kit/experimental_registry.py    | 232 +++++------
 plugins/context-guard/README.md               |   5 +-
 .../experimental-token-reduction-radar.md     |  16 +-
 tests/test_context_guard_kit.py               | 362 ++++++++++--------
 6 files changed, 332 insertions(+), 298 deletions(-)

diff --git a/README.md b/README.md
index 9c864f0..922696e 100644
--- a/README.md
+++ b/README.md
@@ -80,7 +80,7 @@ ContextGuard complements provider and semantic caches, and works alongside promp
 | Provider prompt/context caching | Reusing stable prompt prefixes. | Complementary; ContextGuard helps keep the changing tail of context smaller and cleaner, `context-guard-audit` can flag likely volatile prefix layouts, and `context-guard cost` can warn when an Anthropic request is likely to cache-write instead of cache-read. |
 | Semantic response cache | Reusing answers to identical or similar requests. | Complementary; ContextGuard does not serve cached AI answers. |
 | Prompt/context compression | Shortening text that is already selected for the model. | Adjacent; ContextGuard trims and summarizes local output, but does not promise lossless semantic compression. |
-| Experimental planners and local runtimes | Default-off and explicit-command-only; covers local-proxy plans and gate records plus narrow local runtimes for caller-supplied context-diff, visual evidence-pack, learned-compression, and self-hosted metrics evidence. | The local proxy `record` command starts no listener and forwards no traffic; `serve local-proxy` binds and forwards only literal loopback IPs for one bounded request; `--response-sandbox` can replace a safe UTF-8 upstream body with a compact local artifact rehydration envelope. Compressor/model execution, OCR/crop services, external forwarding, credential persistence, and hosted-savings claims stay out of scope until a separate evidence gate and future PR allow them. |
+| Experimental planners and local runtimes | Default-off and explicit-command-only; covers plan-only `image-context-pack` plus local-proxy plans/gate records and narrow local runtimes for caller-supplied context-diff, visual evidence-pack, learned-compression, and self-hosted metrics evidence. | `image-context-pack` is a pxpipe-inspired dry-run planning gate only: it does not render images, run OCR, emit replacements, store binary image artifacts, call providers, or proxy traffic, and it requires exact text fallback plus provider-measured matched-task evidence before claims. The local proxy `record` command starts no listener and forwards no traffic; `serve local-proxy` binds and forwards only literal loopback IPs for one bounded request; `--response-sandbox` can replace a safe UTF-8 upstream body with a compact local artifact rehydration envelope. Compressor/model execution, OCR/crop services, external forwarding, credential persistence, and hosted-savings claims stay out of scope until a separate evidence gate and future PR allow them. |
 | ContextGuard | Avoiding unnecessary files, logs, repeated failures, and noisy output before they enter agent context. | Local guardrails, reversible artifacts, and measurement. |
 
 Related patterns that informed the design:
@@ -119,8 +119,8 @@ If you need a savings claim, measure it on your own tasks:
 - It does not execute command manifests as code or trust arbitrary `PATH`/current-working-directory helpers during setup or packaged smoke checks.
 - It does not replace real before/after measurement when you need a savings claim.
 - Local RAM/disk receipts can help reduce what you send next, but they do **not** replace Anthropic's provider prompt cache or guarantee cache hits. Recheck Anthropic prompt-caching and pricing docs before release or billing claims: https://docs.anthropic.com/en/build-with-claude/prompt-caching and https://platform.claude.com/docs/en/about-claude/pricing.
-- Experimental helpers are mostly dry-run checker/planner surfaces, including a plan-only `image-context-pack` evaluation gate and a design-only external-forwarding opt-in gate. Explicit local runtimes exist only for caller-supplied context-diff replacement payloads, caller-supplied visual crop/OCR evidence packs, caller-supplied learned-compression prose candidates, self-hosted metrics JSONL sidecar records, local-proxy runtime-gate JSONL records, and one-shot `serve local-proxy` loopback forwarding with a private ready-file nonce, optional `--response-sandbox` compact artifact envelopes for safe UTF-8 responses, plus optional shifted-cost diagnostic JSONL rows for successful forwarded requests.
-- ContextGuard does not ship learned/synthetic compressor execution, embeddings, rerankers, model calls, generated replacement text, screenshot capture, image cropping, OCR execution, image parsing, external OCR/image services, self-hosted KV/latent inference optimization beyond explicit local metrics recording, or broader proxy forwarding beyond literal-loopback, one-request HTTP forwarding with credential material blocked.
+- Experimental helpers are mostly dry-run checker/planner surfaces, including the plan-only pxpipe-inspired `image-context-pack` gate and a design-only external-forwarding opt-in gate. Explicit local runtimes exist only for caller-supplied context-diff replacement payloads, caller-supplied visual crop/OCR evidence packs, caller-supplied learned-compression prose candidates, self-hosted metrics JSONL sidecar records, local-proxy runtime-gate JSONL records, and one-shot `serve local-proxy` loopback forwarding with a private ready-file nonce, optional `--response-sandbox` compact artifact envelopes for safe UTF-8 responses, plus optional shifted-cost diagnostic JSONL rows for successful forwarded requests.
+- ContextGuard does not ship learned/synthetic compressor execution, embeddings, rerankers, model calls, generated replacement text, screenshot capture, image rendering, image cropping, OCR execution, image parsing, external OCR/image services, binary image fallback claims, self-hosted KV/latent inference optimization beyond explicit local metrics recording, or broader proxy forwarding beyond literal-loopback, one-request HTTP forwarding with credential material blocked.
 - It does not alias the old `/claude-token-optimizer:*` Claude Code slash-command namespace. Use `/context-guard:*` after installing this plugin.
 
 Legacy local CLI wrappers (`claude-token-*`, `claude-read-symbol`, `claude-trim-output`, and `claude-sanitize-output`) still ship as package files under `plugins/context-guard/bin/` so existing plugin-path automation can migrate gradually. npm global/`npx` bin links intentionally expose only the canonical `context-guard`/`context-guard-*` commands; call the legacy wrappers by package/plugin path if you still need them.
@@ -439,6 +439,7 @@ context-guard experiments list
 context-guard experiments status --json
 context-guard experiments plan context-diff-compaction --json < change.diff
 context-guard experiments emit context-diff-compaction --receipt-id <artifact-id> --reexpand-command "context-guard-artifact get <artifact-id> --full" --replacement-file compact-diff.txt --json < change.diff
+context-guard experiments plan image-context-pack --json --explicit-opt-in --exact-text-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --protected-zone-policy deny --provider-measurement-boundary provider-measured-matched-tasks-required --missed-context-note "omitted text remains exactly retrievable" --image-size 800,600
 context-guard experiments plan visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --missed-context-note "outside crop omitted"
 context-guard experiments emit visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --ocr-text "visible text" --ocr-confidence 0.9 --ocr-error-note "glyph may be uncertain" --missed-context-note "outside crop omitted"
 context-guard experiments plan image-context-pack --json --exact-text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --provider-boundary-ack --missed-context-note "omitted text remains retrievable before any future image pack is used"
@@ -454,6 +455,8 @@ context-guard experiments enable output-receipt-trim --root .
 context-guard experiments disable output-receipt-trim --root .
 ```
 
+`plan image-context-pack` is intentionally plan-only and side-effect free: it emits deterministic JSON metadata, does not render or parse images, does not run OCR, does not store binary image artifacts, does not call providers or proxy traffic, and does not duplicate `visual-crop-ocr`. Any future omission of exact text must keep a verified exact text fallback, deny protected zones, record missed-context guardrails, and treat image/request byte reductions as proxy evidence until provider-measured matched tasks prove token/cost deltas.
+
 The local-proxy examples are intentionally split by side effect:
 
 - `plan local-proxy` produces advisory metadata only; it does not enable forwarding.
@@ -470,7 +473,7 @@ Shipped experimental checker/planner surfaces, plus explicit local context-diff,
 | --- | --- | --- |
 | `context-diff-compaction` | Dry-run diff advice plus an explicit `emit ... --receipt-id ... --reexpand-command ...` runtime for caller-supplied compact replacements. | `plan` emits no replacement. `emit` requires reviewable hunks, exact local artifact re-expand metadata whose stored content matches the input diff, and a smaller caller-supplied replacement; ContextGuard does not generate semantic compression or support hosted token/cost savings claims. |
 | `visual-crop-ocr` | Dry-run visual evidence advice plus an explicit `emit visual-crop-ocr` runtime for caller-supplied evidence packs. | `emit` requires a full visual evidence receipt, missed-context note, and complete user-supplied crop and/or OCR evidence; ContextGuard does not capture screenshots, crop images, run OCR, parse images, call external services, write files, or support hosted token/cost savings claims. |
-| `image-context-pack` | Pxpipe-inspired dry-run plan metadata only for future image/context packing evaluation. | `plan` emits no image, replacement, evidence pack, binary artifact, ledger, listener, or proxy. It requires explicit opt-in, exact text fallback receipt/re-expand metadata before omitted text is used, protected-zone denial, missed-context notes, and provider/model measured matched-task boundaries. `visual-crop-ocr` remains the caller-supplied visual evidence-pack surface; `image-context-pack` is not a duplicate emitter or verified exact binary/image fallback. |
+| `image-context-pack` | Pxpipe-inspired dry-run planning gate for future image/context packing evaluation. | Plan-only: it emits JSON metadata but no image, replacement, file, binary artifact, OCR, model call, provider call, or proxy traffic. It requires explicit opt-in, protected-zone denial, missed-context notes, exact text fallback that must be verified before omitted text is relied on, and provider-measured matched successful tasks before hosted token/cost savings claims. `visual-crop-ocr` remains the caller-supplied visual evidence-pack surface, not a verified exact binary/image fallback. |
 | `learned-compression` | Deny-by-default policy checks plus an explicit `emit learned-compression` runtime for caller-supplied compact prose candidates with verified exact fallback content. | `emit` requires sanitized trusted prose, protected-signal denial, a verified local fallback artifact matching the input, and a smaller caller-supplied prose candidate; ContextGuard does not run compressors, embeddings, rerankers, model calls, subprocesses, external services, generated replacement text, or hosted savings claims. |
 | `self-hosted-metrics-ledger` | Dry-run preview plus an explicit `record ... --ledger-jsonl` runtime for local/model-server latency, memory, quality, energy, throughput, and local-cost metrics. | The dry-run preview does not write a ledger; the explicit record command writes only local JSONL sidecars and still does not support hosted API token/cost savings claims. |
 | `local-proxy` | Localhost-only advisory metadata, design-only `plan local-proxy-external-forwarding` review for future external forwarding, an explicit `record local-proxy-runtime-gate --ledger-jsonl` runtime for one local gate row, an explicit one-shot `serve local-proxy` loopback forwarding MVP, optional `--response-sandbox` compact artifact envelopes, and optional `--diagnostic-ledger-jsonl` shifted-cost diagnostics for successful forwarded requests. | `plan` writes no ledger. `record` writes only after localhost-only metadata and `--runtime-gate-ack`; it starts no listener, forwards no traffic, and performs no DNS lookup. `serve` additionally requires `--forwarding-gate-ack --once`, a private `--ready-file` nonce handoff, literal loopback bind/target IPs, nonzero ports, bounded bytes/timeouts, and credential-free requests; it performs no external forwarding, no CONNECT/TLS proxying, no API-key persistence, and no hosted-savings claim. `--response-sandbox` can store safe UTF-8 response text as a sanitized local artifact receipt and return a compact envelope with redacted rehydration command templates; it does not claim hosted token/cost savings. `--diagnostic-ledger-jsonl` writes only successful-forward diagnostics with no raw headers/bodies and no hosted-savings claim. `plan local-proxy-external-forwarding` emits threat-model/allowlist/redaction/provider-evidence design metadata only and still performs no DNS lookup, external service call, traffic forwarding, credential persistence, or hosted-savings claim. |
diff --git a/context-guard-kit/README.md b/context-guard-kit/README.md
index 57ee72f..63957e0 100644
--- a/context-guard-kit/README.md
+++ b/context-guard-kit/README.md
@@ -74,6 +74,8 @@ python3 context-guard-kit/sanitize_output.py -- git diff
 
 `experimental_registry.py plan visual-crop-ocr`은 전체 visual evidence 요약 기록과 crop/OCR fixture note를 점검하는 dry-run metadata planner이고, `experimental_registry.py emit visual-crop-ocr`은 caller-supplied crop/OCR 근거를 위한 명시적 로컬 evidence-pack runtime입니다. visual lane은 screenshot 캡처, image crop, screenshot parsing, OCR 실행, OCR/image service 호출, evidence file 쓰기, replacement evidence 생성, hosted savings 주장을 하지 않습니다.
 
+`experimental_registry.py plan image-context-pack`은 pxpipe-inspired plan-only dry-run planning gate입니다. explicit opt-in, verified exact text fallback, protected-zone denial, provider-measured boundary, missed-context guardrail을 기록하지만 image rendering/parsing, OCR execution, model/provider call, proxy traffic, binary image artifact storage, replacement emit은 하지 않습니다. `visual-crop-ocr`은 계속 caller-supplied visual evidence pack surface이며 verified exact binary/image fallback이 아닙니다.
+
 `experimental_registry.py plan learned-compression`은 정제된 trusted prose와 exact fallback handle을 위한 deny-by-default dry-run safety checker이고, `experimental_registry.py emit learned-compression`은 검증된 exact fallback 내용이 있을 때 caller-supplied compact prose를 내보내는 명시적 로컬 candidate emitter입니다. learned lane은 learned/synthetic compressor 실행, embedding, model call, reranker, subprocess, external service, generated replacement text를 실행하지 않으며 hosted savings도 주장하지 않습니다.
 
 `experimental_registry.py plan self-hosted-metrics-ledger`는 명시적 local/model-server latency, memory, quality, energy, throughput, local-cost sidecar evidence를 미리 보는 dry-run preview이며 ledger 파일을 쓰지 않습니다. `experimental_registry.py record self-hosted-metrics-ledger --ledger-jsonl ...`은 로컬 JSONL sidecar row 하나를 명시적으로 쓰지만, self-hosted telemetry를 hosted API token/cost savings claim으로 바꾸지 않습니다.
@@ -82,7 +84,7 @@ python3 context-guard-kit/sanitize_output.py -- git diff
 
 `benchmark_runner.py`는 `research/benchmark-plan.md`의 고정 task/variant 실험을 실행합니다. `variant_prompt_files`는 선택된 task/variant를 필터링한 뒤 필요한 file-backed prompt만 읽으므로 선택하지 않은 fixture의 누락 파일이 선택된 실행을 깨지 않습니다. `--ledger-jsonl`은 subagent·artifact 등 외부 실행 표면으로 옮겨간 token/cost와 run별 측정 가능 여부를 남기고, 선택적 `self_hosted_metrics` provider payload는 run별 sidecar로만 기록합니다. `--report-json`은 baseline 대비 실제 token/cost 절감과 proxy byte 감소를 분리한 A/B report를 생성하며, `--dashboard-md`는 같은 report에서 Markdown dashboard를 렌더링합니다. `--evidence-jsonl` replay는 provider와 `success_command`를 실행하지 않는 deterministic import mode이고, synthetic/manual evidence는 public hosted-savings claim 불가로 강제됩니다. `self_hosted_metrics`는 CSV/report 요약에 접지 않습니다. Report의 `matched_pair_evidence`는 성공한 baseline/variant task bucket을 transform, quality gate, 측정 가능 여부, claim boundary와 연결하므로 절감 주장을 쓰기 전에 이 항목을 확인하세요. Report의 `default_matrix`는 같은 evidence에서 trimming, artifact escrow, tool pruning, cache advice, adaptive-k, optional compression을 `default-on`/`advisory`/`experimental`/`reject/rework`로 분류하지만, report-only metadata이며 runtime default나 hosted savings claim을 바꾸지 않습니다. Report의 `public_claim_readiness`는 public hosted-savings claim의 최종 release gate로, matched successful task, provider-measured primary token/cost, quality non-inferiority, shifted-cost accounting, 명시적 confidence/failure note, complete provider-export provenance가 모두 통과하지 않으면 `claim_allowed=false`로 unsupported claim을 금지합니다.
 
-`../research/experimental-token-reduction-radar.md`는 learned compression, generated crop/OCR/visual-token pruning, self-hosted KV/latent inference optimization 같은 선택적 미래 실험을 문서화한 gate입니다. `../docs/experimental-benchmark-fixtures.md`에는 fixture-only task/variant 시작 예시가 있습니다. 이 radar와 fixture는 hosted API token/cost 절감을 보장하지 않습니다. 현재 제공되는 helper surface는 명시적 local context-diff emit, visual evidence-pack emit, learned candidate emit, self-hosted metrics record, local proxy gate record, one-shot literal-loopback local proxy serve with optional response artifact envelope, design-only external-forwarding plan 같은 좁은 local surface뿐이며, hosted API token/cost 절감 주장은 provider가 측정한 matched-task 근거가 있을 때만 허용합니다. Radar의 later-roadmap gate는 neural/semantic compression, trust-tiered injection-aware compression, generated visual-token reduction, broader external/daemon/hostname-DNS/credential-bearing local proxy forwarding constraints를 별도 미래 PR이 gate를 통과하기 전까지 experimental/non-shipped로 유지합니다.
+`../research/experimental-token-reduction-radar.md`는 learned compression, generated crop/OCR/visual-token pruning, self-hosted KV/latent inference optimization 같은 선택적 미래 실험을 문서화한 gate입니다. `../docs/experimental-benchmark-fixtures.md`에는 fixture-only task/variant 시작 예시가 있습니다. 이 radar와 fixture는 hosted API token/cost 절감을 보장하지 않습니다. 현재 제공되는 helper surface는 plan-only image-context-pack dry-run gate, 명시적 local context-diff emit, visual evidence-pack emit, learned candidate emit, self-hosted metrics record, local proxy gate record, one-shot literal-loopback local proxy serve with optional response artifact envelope, design-only external-forwarding plan 같은 좁은 local surface뿐이며, hosted API token/cost 절감 주장은 provider가 측정한 matched-task 근거가 있을 때만 허용합니다. Radar의 later-roadmap gate는 neural/semantic compression, trust-tiered injection-aware compression, generated visual-token reduction, broader external/daemon/hostname-DNS/credential-bearing local proxy forwarding constraints를 별도 미래 PR이 gate를 통과하기 전까지 experimental/non-shipped로 유지합니다.
 
 `claude_transcript_cost_audit.py --recommend`의 기본 출력은 공유 시 안전하도록 transcript 경로를 `basename#hash`, 명령을 `command#hash` 형태로 익명화합니다. 로컬 원문 식별자가 꼭 필요할 때만 `--show-paths` 또는 `--show-commands`를 추가하세요.
 대용량/손상 transcript 방어를 위해 파일 단위 `--max-file-bytes`, JSONL record 단위 `--max-line-bytes` 제한도 기본 적용되며, 건너뛴 항목은 skip count와 warning으로 표시됩니다. JSON summary/feasibility 출력의 `cache_friendliness`는 제한된 정제 segment hash로 안정적인 prefix와 volatile prefix/tail 신호를 비교하는 휴리스틱입니다. `cache_layout_advice`는 그 신호를 긴 세션 분리, prefix 안정화, diet 점검 같은 순위화된 확인/실험으로 연결하지만, 관측 issue와 가설/입증 cause를 분리합니다. `--feasibility-json`은 macOS-visible prototype 같은 consumer가 안정적인 top-level field에만 바인딩하도록 `mac_visibility` 계약도 함께 제공합니다. 원문 prompt text는 출력하지 않고, provider cache token field와 historical token total은 ContextGuard가 만든 토큰 절감 또는 live headroom 증거가 아니라 별도 진단 텔레메트리로 해석하세요.
diff --git a/context-guard-kit/experimental_registry.py b/context-guard-kit/experimental_registry.py
index eb5880b..a190849 100755
--- a/context-guard-kit/experimental_registry.py
+++ b/context-guard-kit/experimental_registry.py
@@ -67,8 +67,9 @@
 LOCAL_PROXY_READY_SCHEMA_VERSION = "contextguard.experiments.local-proxy-ready.v1"
 LOCAL_PROXY_EXTERNAL_DESIGN_SCHEMA_VERSION = "contextguard.experiments.local-proxy-external-forwarding-design.v1"
 LOCAL_PROXY_RESPONSE_SANDBOX_SCHEMA_VERSION = "contextguard.experiments.local-proxy-response-sandbox.v1"
-IMAGE_CONTEXT_PACK_PLAN_SCHEMA_VERSION = "contextguard.experiments.image-context-pack-plan.v1"
+IMAGE_CONTEXT_PACK_SCHEMA_VERSION = "contextguard.experiments.image-context-pack-plan.v1"
 IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY = "provider-measured-matched-tasks-required"
+IMAGE_CONTEXT_PACK_PROTECTED_POLICY = "deny"
 LOCAL_PROXY_DEFAULT_BIND_HOST = "127.0.0.1"
 LOCAL_PROXY_DEFAULT_BIND_PORT = 0
 LOCAL_PROXY_DEFAULT_TARGET_HOST = "127.0.0.1"
@@ -263,49 +264,44 @@ def to_json(self, *, enabled: bool = False) -> dict[str, Any]:
     ),
     Experiment(
         id="image-context-pack",
-        name="Pxpipe-inspired image context pack planning gate",
-        summary=(
-            "Plan-only evaluation gate for pxpipe-inspired image/context packing without rendering images, "
-            "emitting visual artifacts, or changing runtime behavior."
-        ),
+        name="Plan-only image context pack evaluation gate",
+        summary="Pxpipe-inspired, explicit-only planning gate for future image/context packing experiments; emits no images or replacements.",
         stability="experimental",
         default_enabled=False,
         risk_level="high",
         claim_boundary=(
-            "Image/request byte reductions are proxy evidence only; hosted token/cost savings require "
-            "provider-measured matched successful tasks."
+            "Image/request byte reductions are proxy evidence only until provider-measured matched successful "
+            "tasks prove token/cost deltas."
         ),
         gate_requirements=(
             "explicit opt-in",
-            "verified exact text artifact fallback before omitted text is used",
+            "verified exact text artifact fallback before relying on omitted text",
             "protected-zone denial",
             "provider/model measurement boundary",
             "missed-context guardrails",
-            "relation to visual-crop-ocr",
+            "relation_to_visual_crop_ocr: visual-crop-ocr remains caller-supplied visual evidence, not an exact binary fallback",
         ),
         runtime_status="available-plan-only",
         commands=("context-guard experiments plan image-context-pack",),
         opt_in_flags=(
             "plan image-context-pack",
-            "--exact-text-fallback-receipt",
+            "--explicit-opt-in",
+            "--exact-text-receipt",
             "--reexpand-command",
-            "--provider-boundary-ack",
             "--protected-zone-policy deny",
+            "--provider-measurement-boundary provider-measured-matched-tasks-required",
             "--missed-context-note",
-            "--image-size",
-            "--packed-image-size",
         ),
         config_effect=(
-            "Registry enablement records project-local intent only; image-context-pack exposes only a deterministic "
-            "plan command. It does not add an emit/record/serve runtime, render images, run OCR, call models, proxy "
-            "traffic, write binary artifacts, or duplicate the caller-supplied visual-crop-ocr evidence-pack emitter."
+            "Registry enablement records project-local intent only; image-context-pack is plan-only and never "
+            "renders images, runs OCR, emits replacements, stores binary image artifacts, calls providers, or proxies traffic."
         ),
         evidence_contract=(
-            "Plans require explicit opt-in, exact text fallback receipt/re-expand metadata before omitted exact text "
-            "is used, protected-zone denial for code/diffs/identifiers/hashes/paths/numeric constants/JSON keys/"
-            "stack frames/secrets/prompt-like instructions, provider/model measured matched-task boundaries, "
-            "missed-context guardrails, and an explicit relation_to_visual_crop_ocr statement: visual-crop-ocr "
-            "remains caller-supplied visual evidence only and is not a verified exact binary/image fallback."
+            "Plan output requires explicit opt-in, an exact text fallback receipt/re-expand handle that must be "
+            "verified before omitted text is relied on, protected-zone denial, provider/model measurement boundaries, "
+            "and missed-context notes. relation_to_visual_crop_ocr: existing visual-crop-ocr packs are caller-supplied "
+            "visual evidence and are not verified exact binary/image fallback; image-context-pack is an inspired "
+            "evaluation planning gate, not a duplicate emitter."
         ),
     ),
     Experiment(
@@ -1784,99 +1780,77 @@ def command_plan_visual_crop_ocr(args: argparse.Namespace) -> int:
     return 0
 
 
-def image_context_pack_size_payload(raw: str | None) -> tuple[dict[str, Any] | None, bool]:
-    size = parse_int_tuple(raw, count=2)
-    if raw is None or not str(raw).strip():
-        return None, True
-    if size is None:
-        return None, False
-    width, height = size
-    if width <= 0 or height <= 0:
-        return {"width": width, "height": height}, False
-    return {"width": width, "height": height}, True
-
-
 def image_context_pack_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
-    receipt_id = args.exact_text_fallback_receipt.strip() if args.exact_text_fallback_receipt else None
+    exact_text_receipt = args.exact_text_receipt.strip() if args.exact_text_receipt else None
     reexpand_command = args.reexpand_command.strip() if args.reexpand_command else None
-    reexpand_valid, fallback_blocker = valid_learned_reexpand_command(receipt_id, reexpand_command)
-    fallback_blocker_map = {
-        "missing_exact_fallback": "missing_exact_text_fallback",
-        "invalid_reexpand_command": "invalid_exact_text_reexpand_command",
-    }
-    source_size, source_size_valid = image_context_pack_size_payload(args.image_size)
-    packed_size, packed_size_valid = image_context_pack_size_payload(args.packed_image_size)
+    provider_boundary = args.provider_measurement_boundary.strip() if args.provider_measurement_boundary else None
+    protected_policy = args.protected_zone_policy.strip().lower() if args.protected_zone_policy else None
     missed_context_notes = clean_values(args.missed_context_note)
-    protected_policy = (args.protected_zone_policy or "deny").strip().lower()
+    pack_label = args.pack_label.strip() if args.pack_label else None
+
+    image_size = parse_int_tuple(args.image_size, count=2) if args.image_size else None
+    image_size_valid = True
+    image_payload = None
+    if args.image_size:
+        if image_size is None:
+            image_size_valid = False
+        else:
+            width, height = image_size
+            image_size_valid = width > 0 and height > 0
+            image_payload = {"width": width, "height": height}
 
     blockers: list[str] = []
-    if fallback_blocker:
-        blockers.append(fallback_blocker_map.get(fallback_blocker, fallback_blocker))
-    if not args.provider_boundary_ack:
+    if not args.explicit_opt_in:
+        blockers.append("missing_explicit_opt_in")
+    if not (exact_text_receipt and reexpand_command):
+        blockers.append("missing_exact_text_fallback")
+    if protected_policy != IMAGE_CONTEXT_PACK_PROTECTED_POLICY:
+        blockers.append("protected_zone_policy_not_deny")
+    if provider_boundary != IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY:
         blockers.append("missing_provider_measurement_boundary")
     if not missed_context_notes:
         blockers.append("missing_missed_context_note")
-    if protected_policy != "deny":
-        blockers.append("protected_zone_denial_required")
-    if not source_size_valid:
+    if not image_size_valid:
         blockers.append("invalid_image_size")
-    if not packed_size_valid:
-        blockers.append("invalid_packed_image_size")
-    blockers = list(dict.fromkeys(blockers))
-
-    source_area = source_size["width"] * source_size["height"] if source_size and source_size_valid else None
-    packed_area = packed_size["width"] * packed_size["height"] if packed_size and packed_size_valid else None
-    area_delta = source_area - packed_area if source_area is not None and packed_area is not None else None
-    ready = not blockers
 
+    blockers = list(dict.fromkeys(blockers))
+    status = "ready_for_design_review" if not blockers else "blocked_until_image_context_pack_gate_ready"
     return {
         "tool": TOOL_NAME,
-        "schema_version": CONFIG_SCHEMA_VERSION,
-        "plan_schema_version": IMAGE_CONTEXT_PACK_PLAN_SCHEMA_VERSION,
+        "schema_version": IMAGE_CONTEXT_PACK_SCHEMA_VERSION,
         "experiment_id": "image-context-pack",
         "mode": "dry_run",
-        "status": "ready_for_plan_review" if ready else "blocked_until_image_context_pack_gate_ready",
-        "plan_only": {
-            "command_advertised": True,
-            "emit_command_available": False,
-            "record_command_available": False,
-            "serve_command_available": False,
-            "runtime_behavior_changed": False,
-            "replacement_or_visual_evidence_emitted": False,
-        },
-        "external_services": {
-            "called": False,
-            "network": False,
-            "model_calls": False,
-            "ocr_service": None,
-            "image_service": None,
-            "proxy_forwarding": False,
-        },
-        "runtime_side_effects": {
-            "files_written": False,
+        "status": status,
+        "pack_label": pack_label,
+        "explicit_opt_in": bool(args.explicit_opt_in),
+        "side_effects": {
+            "stable_runtime_behavior_changed": False,
             "image_rendering": False,
-            "ocr_execution": False,
             "image_parsing": False,
-            "binary_artifacts_written": False,
+            "ocr_execution": False,
+            "model_calls": False,
+            "provider_calls": False,
             "proxy_forwarding": False,
-            "stable_runtime_behavior_changed": False,
+            "binary_artifact_storage": False,
+            "replacement_emitted": False,
+            "files_written": False,
         },
-        "text_fallback": {
+        "exact_text_fallback": {
             "required": True,
-            "available": bool(reexpand_valid),
-            "receipt_id": receipt_id,
-            "reexpand_command": reexpand_command,
+            "available": bool(exact_text_receipt and reexpand_command),
+            "receipt_id": exact_text_receipt,
+            "cli": reexpand_command,
             "verified": False,
-            "must_be_verified_before_omitted_text_is_used": True,
+            "verification_required_before_use": True,
             "note": (
-                "This dry-run validates only local receipt/re-expand shape. A future runtime must verify exact "
-                "text artifact content before relying on omitted exact text."
+                "This plan records the exact text fallback handle only. A future runtime must verify the local "
+                "text artifact before relying on any omitted exact text."
             ),
         },
         "protected_zones": {
             "policy": protected_policy,
-            "override_allowed": False,
-            "denied_classes": [
+            "deny_required": True,
+            "protected_classes": [
                 "code",
                 "diffs",
                 "identifiers",
@@ -1889,43 +1863,36 @@ def image_context_pack_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
                 "prompt_like_instructions",
             ],
         },
-        "image_pack_plan": {
-            "source_label": sanitize_self_hosted_text(args.source_label) if args.source_label else "manual-plan",
-            "source_image_size": source_size,
-            "packed_image_size": packed_size,
-            "source_area": source_area,
-            "packed_area": packed_area,
-            "area_delta": area_delta,
-            "area_reduction_is_proxy_only": area_delta is not None,
-            "image_or_request_byte_reductions_are_proxy_evidence_only": True,
-        },
         "measurement_boundary": {
-            "provider_boundary_acknowledged": bool(args.provider_boundary_ack),
-            "provider_boundary_policy": IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY,
-            "provider_measured_matched_tasks_required_for_hosted_claims": True,
-            "provider_model_specific": True,
-            "hosted_api_token_savings_claim_allowed": False,
-            "hosted_api_cost_savings_claim_allowed": False,
+            "provider_model_measurement_required": True,
+            "required_value": IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY,
+            "provided_value": provider_boundary,
+            "image_request_byte_reductions_proxy_only": True,
+            "hosted_token_or_cost_savings_claim_allowed": False,
         },
-        "relation_to_visual_crop_ocr": {
-            "visual_crop_ocr_is_existing_surface": True,
-            "visual_crop_ocr_remains_caller_supplied_visual_evidence_pack": True,
-            "image_context_pack_is_planning_gate_not_duplicate_emitter": True,
-            "verified_exact_binary_or_image_fallback_claimed": False,
+        "image_context_plan": {
+            "image_size": image_payload,
+            "image_size_valid": image_size_valid,
+            "rendering_planned": False,
+            "target_artifact": None,
         },
+        "relation_to_visual_crop_ocr": (
+            "visual-crop-ocr remains the caller-supplied visual evidence pack surface and is not a verified "
+            "exact binary/image fallback; image-context-pack is a pxpipe-inspired planning gate, not an emitter."
+        ),
         "review_plan": {
             "readiness_blockers": blockers,
             "missed_context_notes": missed_context_notes,
             "next_steps": [
-                "Keep exact text artifact fallback verified before any future image/context packing omits source text.",
-                "Deny protected evidence zones before any future lossy visual packing is considered.",
-                "Measure provider/model token and cost fields on matched successful tasks before any hosted savings claim.",
-                "Use visual-crop-ocr only for caller-supplied visual evidence packs; this gate emits no images or evidence.",
+                "Verify exact text fallback artifact content before any future omitted text is relied on.",
+                "Deny protected zones before evaluating image-context packing.",
+                "Collect provider/model measured matched-task token and cost fields before any hosted savings claim.",
+                "Use visual-crop-ocr only for caller-supplied visual evidence packs; do not duplicate it as an emitter.",
             ],
         },
         "claim_boundary": (
-            "Dry-run image-context-pack planning only; image/request byte reductions are proxy evidence and no hosted "
-            "token/cost savings claim is allowed without provider-measured matched successful tasks."
+            "Plan-only image-context-pack evaluation; image/request byte reductions are proxy evidence only and "
+            "are not hosted API token or cost savings evidence without provider-measured matched successful tasks."
         ),
         "candidate_replacement": None,
     }
@@ -1937,8 +1904,9 @@ def command_plan_image_context_pack(args: argparse.Namespace) -> int:
         emit_json(payload)
     else:
         print("ContextGuard image-context-pack plan (dry-run only)")
-        print("No image rendering, OCR/image service, model call, proxy forwarding, binary artifact, or replacement was emitted.")
+        print("No image was rendered, parsed, stored, emitted, or sent to a provider/proxy.")
         print(f"Status: {payload['status']}")
+        print(f"Exact text fallback available: {payload['exact_text_fallback']['available']} verified=false")
         if payload["review_plan"]["readiness_blockers"]:
             print(f"Readiness blockers: {', '.join(payload['review_plan']['readiness_blockers'])}")
         print(payload["claim_boundary"])
@@ -4679,25 +4647,19 @@ def build_parser() -> argparse.ArgumentParser:
 
     image_context_pack = plan_sub.add_parser(
         "image-context-pack",
-        help="Dry-run a plan-only pxpipe-inspired image/context packing gate without rendering images.",
-    )
-    image_context_pack.add_argument("--source-label", help="Safe label for this image/context packing plan.")
-    image_context_pack.add_argument("--image-size", help="Optional source image/context canvas size as width,height integers.")
-    image_context_pack.add_argument("--packed-image-size", help="Optional planned packed image size as width,height integers.")
-    image_context_pack.add_argument("--exact-text-fallback-receipt", help="Local exact text artifact receipt id for omitted source text.")
-    image_context_pack.add_argument("--reexpand-command", help="Local exact text re-expand command bound to the receipt id.")
-    image_context_pack.add_argument(
-        "--provider-boundary-ack",
-        action="store_true",
-        help="Acknowledge hosted claims require provider-measured matched successful tasks for the target model.",
+        help="Dry-run a plan-only image/context packing evaluation gate without rendering images or emitting replacements.",
     )
+    image_context_pack.add_argument("--explicit-opt-in", action="store_true", help="Acknowledge this is an explicit plan-only experimental gate.")
+    image_context_pack.add_argument("--exact-text-receipt", help="Local exact text artifact receipt/id required before omitted text can be relied on.")
+    image_context_pack.add_argument("--reexpand-command", help="Local command that re-expands the exact text artifact.")
+    image_context_pack.add_argument("--protected-zone-policy", help="Must be 'deny'; protected exact evidence cannot be image-packed.")
     image_context_pack.add_argument(
-        "--protected-zone-policy",
-        default="deny",
-        choices=("deny", "allow"),
-        help="Protected evidence handling; only deny can pass the plan gate.",
+        "--provider-measurement-boundary",
+        help=f"Must be '{IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY}' before any hosted token/cost claim.",
     )
-    image_context_pack.add_argument("--missed-context-note", action="append", help="Potential context omitted by a future pack. Repeatable.")
+    image_context_pack.add_argument("--missed-context-note", action="append", help="Potential missed-context guardrail note. Repeatable.")
+    image_context_pack.add_argument("--image-size", help="Optional planned image size as width,height positive integers; metadata only.")
+    image_context_pack.add_argument("--pack-label", help="Safe label for this planning gate.")
     image_context_pack.add_argument("--json", action="store_true", help="Emit JSON output.")
     image_context_pack.set_defaults(func=command_plan_image_context_pack)
 
@@ -4991,7 +4953,7 @@ def normalize_negative_csv_option_values(argv: list[str] | None) -> list[str] |
         argv = sys.argv[1:]
     normalized: list[str] = []
     pending_csv_option: str | None = None
-    csv_options = {"--crop-bounds", "--image-size", "--packed-image-size"}
+    csv_options = {"--crop-bounds", "--image-size"}
     for token in argv:
         if pending_csv_option is not None:
             normalized.append(f"{pending_csv_option}={token}")
diff --git a/plugins/context-guard/README.md b/plugins/context-guard/README.md
index a94b416..6965a1f 100644
--- a/plugins/context-guard/README.md
+++ b/plugins/context-guard/README.md
@@ -128,7 +128,7 @@ These helpers reduce common sources of context bloat, but they do not guarantee
 
 ContextGuard also does not send work to external AI providers to save model tokens. All helper commands run locally. Local RAM/disk receipts can reduce what you choose to send, but they do not replace a provider prompt cache. Before release or billing claims for Anthropic, recheck the official prompt-caching and pricing docs: https://docs.anthropic.com/en/build-with-claude/prompt-caching and https://platform.claude.com/docs/en/about-claude/pricing.
 
-Future learned, multimodal, and self-hosted optimization ideas are tracked in [`research/experimental-token-reduction-radar.md`](https://github.com/ictechgy/context-guard/blob/main/research/experimental-token-reduction-radar.md), with fixture-only starters in [`docs/experimental-benchmark-fixtures.md`](https://github.com/ictechgy/context-guard/blob/main/docs/experimental-benchmark-fixtures.md). ContextGuard ships dry-run planners/checkers for local-proxy advisory plans and design-only external-forwarding gates, plus narrow explicit local runtimes for caller-supplied context-diff replacement payloads, caller-supplied visual crop/OCR evidence packs, caller-supplied learned-compression prose candidates, self-hosted metrics JSONL sidecar records, local-proxy runtime-gate JSONL records, one-shot `serve local-proxy` loopback forwarding with a private ready-file nonce, optional `--response-sandbox` compact artifact envelopes for safe UTF-8 responses, and optional shifted-cost diagnostic JSONL rows for successful forwarded requests. Learned/synthetic compressor execution beyond the caller-supplied candidate emitter, embeddings, rerankers, model calls, generated replacement text, screenshot capture, image cropping, OCR execution, image parsing, external OCR/image services, output-file evidence writes, self-hosted KV/latent runtime optimization beyond explicit local metrics recording, and external/daemon/hostname-DNS, credential-bearing, or external proxy forwarding beyond literal-loopback one-request HTTP forwarding are not shipped. That radar and the fixtures do not claim hosted API savings without provider-measured matched-task evidence. The radar's later-roadmap gates also keep neural/semantic compression, trust-tiered injection-aware compression, generated visual-token reduction, and broader local proxy forwarding constraints experimental/non-shipped until a separate future PR satisfies those gates.
+Future learned, multimodal, and self-hosted optimization ideas are tracked in [`research/experimental-token-reduction-radar.md`](https://github.com/ictechgy/context-guard/blob/main/research/experimental-token-reduction-radar.md), with fixture-only starters in [`docs/experimental-benchmark-fixtures.md`](https://github.com/ictechgy/context-guard/blob/main/docs/experimental-benchmark-fixtures.md). ContextGuard ships a pxpipe-inspired plan-only `image-context-pack` dry-run planning gate, dry-run planners/checkers for local-proxy advisory plans and design-only external-forwarding gates, plus narrow explicit local runtimes for caller-supplied context-diff replacement payloads, caller-supplied visual crop/OCR evidence packs, caller-supplied learned-compression prose candidates, self-hosted metrics JSONL sidecar records, local-proxy runtime-gate JSONL records, one-shot `serve local-proxy` loopback forwarding with a private ready-file nonce, optional `--response-sandbox` compact artifact envelopes for safe UTF-8 responses, and optional shifted-cost diagnostic JSONL rows for successful forwarded requests. `image-context-pack` does not render images, run OCR, emit replacements, store binary image artifacts, call providers, or proxy traffic; exact text fallback must be verified before omitted text is relied on and hosted savings need provider-measured matched-task evidence. Learned/synthetic compressor execution beyond the caller-supplied candidate emitter, embeddings, rerankers, model calls, generated replacement text, screenshot capture, image rendering, image cropping, OCR execution, image parsing, external OCR/image services, output-file evidence writes, self-hosted KV/latent runtime optimization beyond explicit local metrics recording, and external/daemon/hostname-DNS, credential-bearing, or external proxy forwarding beyond literal-loopback one-request HTTP forwarding are not shipped. That radar and the fixtures do not claim hosted API savings without provider-measured matched-task evidence. The radar's later-roadmap gates also keep neural/semantic compression, trust-tiered injection-aware compression, generated visual-token reduction, and broader local proxy forwarding constraints experimental/non-shipped until a separate future PR satisfies those gates.
 
 ## Experimental opt-ins
 
@@ -139,6 +139,7 @@ context-guard experiments list
 context-guard experiments status --json
 context-guard experiments plan context-diff-compaction --json < change.diff
 context-guard experiments emit context-diff-compaction --receipt-id <artifact-id> --reexpand-command "context-guard-artifact get <artifact-id> --full" --replacement-file compact-diff.txt --json < change.diff
+context-guard experiments plan image-context-pack --json --explicit-opt-in --exact-text-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --protected-zone-policy deny --provider-measurement-boundary provider-measured-matched-tasks-required --missed-context-note "omitted text remains exactly retrievable" --image-size 800,600
 context-guard experiments plan visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --missed-context-note "outside crop omitted"
 context-guard experiments emit visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --ocr-text "visible text" --ocr-confidence 0.9 --ocr-error-note "glyph may be uncertain" --missed-context-note "outside crop omitted"
 context-guard experiments plan learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" < sanitized-prose.txt
@@ -153,6 +154,8 @@ context-guard experiments enable output-receipt-trim --root .
 context-guard experiments disable output-receipt-trim --root .
 ```
 
+`plan image-context-pack` is plan-only and dry-run: it does not render or parse images, run OCR, emit replacements, write files, store binary image artifacts, call providers, or proxy traffic. It records explicit opt-in, protected-zone denial, missed-context notes, exact text fallback requirements, provider-measured boundaries, and its relation to `visual-crop-ocr`, which remains caller-supplied visual evidence rather than verified exact binary fallback.
+
 Use `--config <path>` only for an explicit project-local override. Registry entries include risk, gate requirements, explicit command/flag surfaces, and claim boundaries; hosted API token/cost savings still require provider-measured matched-task evidence. The registry can discover existing explicit-flag experiments such as `context-guard-trim-output --digest ... --artifact-receipt` and `context-guard-compress --protected-policy`, run dry-run advisory planners such as `context-guard experiments plan context-diff-compaction`, `context-guard experiments plan visual-crop-ocr`, `context-guard experiments plan learned-compression`, `context-guard experiments plan self-hosted-metrics-ledger`, `context-guard experiments plan local-proxy`, and design-only `context-guard experiments plan local-proxy-external-forwarding`, and run explicit local runtimes such as `context-guard experiments emit context-diff-compaction ...`, `context-guard experiments emit visual-crop-ocr ...`, `context-guard experiments emit learned-compression ...`, `context-guard experiments record self-hosted-metrics-ledger ...`, `context-guard experiments record local-proxy-runtime-gate ...`, `context-guard experiments serve local-proxy ...`, and successful-forward `context-guard experiments serve local-proxy --diagnostic-ledger-jsonl ...` diagnostics. The context-diff emit runtime only emits caller-supplied compact replacements when reviewable hunks, exact local artifact re-expand metadata whose stored content matches the input diff, and a smaller replacement are present; it does not generate semantic compression or permit hosted savings claims. The visual lane ships a dry-run planner plus an explicit local evidence-pack emitter: both use only caller-supplied full-evidence receipts, crop metadata, OCR text, confidence/error notes, and missed-context notes; screenshot capture, image cropping, OCR execution, image parsing, external OCR/image services, output-file writes, and hosted savings claims are not shipped. The learned-compression lane ships a deny-by-default dry-run policy check plus an explicit local candidate emitter for caller-supplied compact prose with verified exact fallback content: learned/synthetic compressor execution, embeddings, rerankers, model calls, subprocesses, external services, generated replacement text, and hosted savings claims are not shipped. The self-hosted metrics planner emits a dry-run ledger-compatible preview for explicit local/model-server latency, memory, quality, energy, throughput, and local-cost metrics; the dry-run preview does not write a ledger, while `context-guard experiments record self-hosted-metrics-ledger --ledger-jsonl ...` writes only local JSONL sidecars and still does not permit hosted API token/cost savings claims. The local-proxy planner emits localhost-only advisory metadata only, while `context-guard experiments record local-proxy-runtime-gate --ledger-jsonl ...` appends one local gate row only after localhost-only metadata and `--runtime-gate-ack`: it starts no listener, forwards no traffic, and performs no DNS lookup. `context-guard experiments serve local-proxy ...` is the separate forwarding MVP: it requires `--forwarding-gate-ack --once`, a private `--ready-file` nonce handoff, literal loopback bind/target IPs, no hostname DNS targets, nonzero ports, byte/time limits, and credential-free requests; it performs no external forwarding, no CONNECT/TLS proxying, no API-key persistence, and no hosted-savings claim. `--response-sandbox` can store safe UTF-8 response text as a sanitized local artifact receipt and return a compact envelope with redacted rehydration command templates; it does not claim hosted token/cost savings. `--diagnostic-ledger-jsonl` writes one shifted-cost diagnostic row only after a successful forwarded request, with no raw headers/bodies and no hosted-savings evidence. `plan local-proxy-external-forwarding` emits threat-model/allowlist/redaction/provider-evidence design metadata only and still starts no listener, performs no DNS lookup, calls no external service, forwards no traffic, persists no credentials, and does not ship an external proxy forwarding runtime. `experiments enable` records intent only; it does not run those helpers, remove the need for their explicit flags, or permit replacing content without exact receipt/re-expand evidence.
 
 Cross-agent rule snippets are advisory: the target agent may ignore them, so measure actual before/after behavior when you need a savings claim.
diff --git a/research/experimental-token-reduction-radar.md b/research/experimental-token-reduction-radar.md
index eb7146c..dba7e06 100644
--- a/research/experimental-token-reduction-radar.md
+++ b/research/experimental-token-reduction-radar.md
@@ -99,6 +99,12 @@ Broader context-diff compaction remains gated if it would automatically generate
 
 Broader visual-token reduction remains gated if it would generate crops, invoke OCR/image models, prune visual tokens inside model architectures, replace full evidence without review, or claim provider savings.
 
+## Graduated plan-only experiment — pxpipe-inspired image-context-pack gate
+
+`context-guard experiments plan image-context-pack --explicit-opt-in ...` is a pxpipe-inspired dry-run planning gate for future image/context packing evaluation. It emits deterministic JSON metadata only: no image rendering, screenshot capture, image parsing, OCR execution, binary image artifact storage, replacement text, provider/model call, proxy forwarding, or hosted savings claim.
+
+The gate requires explicit opt-in, protected-zone denial for code/diffs/identifiers/hashes/paths/numeric constants/JSON keys/stack frames/secrets/prompt-like instructions, missed-context guardrails, a provider/model measurement boundary, and an exact text fallback receipt/re-expand handle that must be verified before omitted exact text is relied on. Image/request byte reductions are proxy evidence only until matched successful tasks include provider-measured token/cost fields. `visual-crop-ocr` remains the caller-supplied visual evidence-pack surface and is not a verified exact binary/image fallback; `image-context-pack` is not a duplicate emitter.
+
 ## Graduated local experiment — learned-compression candidate emitter
 
 `context-guard experiments emit learned-compression --exact-fallback-receipt ... --reexpand-command ...` is the explicit local runtime promoted from the learned-compression gate. It does not run learned compressors, embeddings, rerankers, model calls, subprocesses, or external services; the compact prose candidate must be supplied by the caller, both original and candidate text must pass the deny-by-default protected-signal scan, and the exact local fallback artifact content must match the input. The emitted byte reduction is proxy evidence only and cannot support hosted API token/cost savings claims without the shared promotion gate.
@@ -131,17 +137,17 @@ Recommended first experiment: run a learned compressor only on already-sanitized
 
 ## Lane 2 — Multimodal crop, OCR, and visual-token reduction
 
-Candidate methods include screenshot cropping before upload, local OCR to replace screenshots with text when fidelity is sufficient, image tiling policies, visual-token pruning methods such as diversity or language-guided pruning, and task-specific region selection.
+Candidate methods include screenshot cropping before upload, local OCR to replace screenshots with text when fidelity is sufficient, pxpipe-inspired image/context packing plans, image tiling policies, visual-token pruning methods such as diversity or language-guided pruning, and task-specific region selection.
 
 | Question | Gate |
 | --- | --- |
 | Why it could help | Many UI/debugging tasks need one region, one error message, or OCR text rather than a full high-resolution screenshot. |
-| What it does not prove | Cropping/OCR can lose visual context; visual-token pruning usually applies inside specific multimodal model architectures. |
+| What it does not prove | Cropping/OCR/image-context packing can lose visual or exact text context; visual-token pruning usually applies inside specific multimodal model architectures. |
 | Hosted API claim boundary | Claim hosted API savings only with provider-measured image/text token or cost evidence for matched successful tasks. |
-| Minimum telemetry | image dimensions, crop area, OCR confidence/error notes, provider image/text token fields when available, success, corrections. |
+| Minimum telemetry | image dimensions, crop area or planned pack dimensions, OCR confidence/error notes when applicable, exact text fallback receipt verification, provider image/text token fields when available, success, corrections. |
 | Promotion path | Start with local crop/OCR advice and benchmark fixtures; promote only when missed-visual-context regressions are bounded. |
 
-Recommended first experiment: add a benchmark fixture comparing full screenshot review versus cropped/OCR evidence on tasks with known visual answers.
+Recommended first experiments: keep `image-context-pack` as plan-only metadata until exact text fallback verification and provider-measured matched-task fields exist; separately add benchmark fixtures comparing full screenshot review versus cropped/OCR evidence on tasks with known visual answers.
 
 ## Lane 3 — Self-hosted KV-cache, attention, and latent inference optimizations
 
@@ -168,5 +174,5 @@ First local runtime experiment: `context-guard experiments record self-hosted-me
 
 ## Current status
 
-This radar is intentionally conservative. The shipped ContextGuard tools remain local context hygiene, artifact receipts, context packing, tool-schema pruning, transcript audit, statusline visibility, benchmark evidence, plus the explicitly gated local context-diff emitter, visual crop/OCR evidence-pack emitter, learned-compression candidate emitter, and self-hosted metrics sidecar recorder described above. Package-visible starter scaffolds live in [`../docs/experimental-benchmark-fixtures.md`](../docs/experimental-benchmark-fixtures.md). They are fixture-only synthetic task/variant examples and dry-run-only starters until prompts and success checks are replaced for a real experiment; they are not shipped runtime helpers, benchmark results, or hosted API savings evidence.
+This radar is intentionally conservative. The shipped ContextGuard tools remain local context hygiene, artifact receipts, context packing, tool-schema pruning, transcript audit, statusline visibility, benchmark evidence, plus the explicitly gated plan-only image-context-pack planner, local context-diff emitter, visual crop/OCR evidence-pack emitter, learned-compression candidate emitter, and self-hosted metrics sidecar recorder described above. Package-visible starter scaffolds live in [`../docs/experimental-benchmark-fixtures.md`](../docs/experimental-benchmark-fixtures.md). They are fixture-only synthetic task/variant examples and dry-run-only starters until prompts and success checks are replaced for a real experiment; they are not shipped runtime helpers, benchmark results, or hosted API savings evidence.
 Future experiments must pass the gates above before becoming product features.
diff --git a/tests/test_context_guard_kit.py b/tests/test_context_guard_kit.py
index 5ca34a1..bbc2324 100644
--- a/tests/test_context_guard_kit.py
+++ b/tests/test_context_guard_kit.py
@@ -1669,24 +1669,23 @@ def test_experimental_registry_describes_safe_explicit_flag_surfaces(self):
                         self.assertIn("full visual evidence receipt", visual_ocr["evidence_contract"])
                         self.assertIn("missed-context", visual_ocr["evidence_contract"].lower())
 
-                        image_context_pack = experiments["image-context-pack"]
-                        self.assertFalse(image_context_pack["default_enabled"])
-                        self.assertEqual(image_context_pack["runtime_status"], "available-plan-only")
-                        self.assertEqual(image_context_pack["commands"], ["context-guard experiments plan image-context-pack"])
-                        self.assertIn("plan image-context-pack", image_context_pack["opt_in_flags"])
-                        self.assertIn("--exact-text-fallback-receipt", image_context_pack["opt_in_flags"])
-                        self.assertIn("--provider-boundary-ack", image_context_pack["opt_in_flags"])
-                        self.assertIn("--protected-zone-policy deny", image_context_pack["opt_in_flags"])
-                        self.assertIn("deterministic plan command", image_context_pack["config_effect"])
-                        self.assertIn("does not add an emit/record/serve runtime", image_context_pack["config_effect"])
-                        self.assertIn("render images", image_context_pack["config_effect"])
-                        self.assertIn("proxy traffic", image_context_pack["config_effect"])
-                        self.assertIn("visual-crop-ocr", image_context_pack["evidence_contract"])
-                        self.assertIn("verified exact text artifact fallback", image_context_pack["evidence_contract"])
-                        self.assertIn("provider/model measured matched-task", image_context_pack["evidence_contract"])
-                        self.assertNotIn("emit image-context-pack", " ".join(image_context_pack["commands"]))
-                        self.assertNotIn("record image-context-pack", " ".join(image_context_pack["commands"]))
-                        self.assertNotIn("serve image-context-pack", " ".join(image_context_pack["commands"]))
+                        image_context = experiments["image-context-pack"]
+                        self.assertEqual(image_context["runtime_status"], "available-plan-only")
+                        self.assertFalse(image_context["default_enabled"])
+                        self.assertEqual(image_context["commands"], ["context-guard experiments plan image-context-pack"])
+                        self.assertIn("plan image-context-pack", image_context["opt_in_flags"])
+                        self.assertIn("--explicit-opt-in", image_context["opt_in_flags"])
+                        self.assertIn("--exact-text-receipt", image_context["opt_in_flags"])
+                        self.assertIn("--protected-zone-policy deny", image_context["opt_in_flags"])
+                        self.assertIn("--provider-measurement-boundary provider-measured-matched-tasks-required", image_context["opt_in_flags"])
+                        self.assertNotIn("emit image-context-pack", image_context["opt_in_flags"])
+                        self.assertNotIn("context-guard experiments emit image-context-pack", image_context["commands"])
+                        self.assertIn("plan-only", image_context["config_effect"])
+                        self.assertIn("never renders images", image_context["config_effect"])
+                        self.assertIn("verified exact text fallback", image_context["evidence_contract"])
+                        self.assertIn("protected-zone denial", image_context["evidence_contract"])
+                        self.assertIn("provider/model measurement", image_context["evidence_contract"])
+                        self.assertIn("relation_to_visual_crop_ocr", image_context["evidence_contract"])
 
                         learned = experiments["learned-compression"]
                         self.assertEqual(learned["runtime_status"], "available-explicit-runtime")
@@ -2830,162 +2829,164 @@ def test_experimental_visual_crop_ocr_dispatcher_and_no_service_surface(self):
             self.assertNotIn(forbidden, source)
         self.assertIn("LOCAL_PROXY_FORWARD_SCHEMA_VERSION", source)
 
-    def test_experimental_image_context_pack_plan_only_contract(self):
-        receipt = "0123456789abcdef"
+    def test_experimental_image_context_pack_plan_only_gate(self):
+        valid_args = [
+            "plan",
+            "image-context-pack",
+            "--explicit-opt-in",
+            "--exact-text-receipt",
+            "text-receipt-123",
+            "--reexpand-command",
+            "context-guard-artifact get text-receipt-123 --full",
+            "--protected-zone-policy",
+            "deny",
+            "--provider-measurement-boundary",
+            "provider-measured-matched-tasks-required",
+            "--missed-context-note",
+            "layout and color relationships omitted from text fallback",
+            "--image-size",
+            "800,600",
+            "--json",
+        ]
         for script in EXPERIMENT_SCRIPTS:
             with self.subTest(script=script):
                 proc = subprocess.run(
+                    [sys.executable, str(script), *valid_args],
+                    text=True,
+                    capture_output=True,
+                    check=True,
+                    cwd=ROOT,
+                )
+                payload = json.loads(proc.stdout)
+                self.assertEqual(payload["schema_version"], "contextguard.experiments.image-context-pack-plan.v1")
+                self.assertEqual(payload["experiment_id"], "image-context-pack")
+                self.assertEqual(payload["status"], "ready_for_design_review")
+                self.assertEqual(payload["mode"], "dry_run")
+                self.assertIsNone(payload["candidate_replacement"])
+                self.assertEqual(payload["review_plan"]["readiness_blockers"], [])
+                self.assertTrue(payload["explicit_opt_in"])
+                self.assertTrue(payload["exact_text_fallback"]["available"])
+                self.assertFalse(payload["exact_text_fallback"]["verified"])
+                self.assertTrue(payload["exact_text_fallback"]["verification_required_before_use"])
+                self.assertEqual(payload["protected_zones"]["policy"], "deny")
+                self.assertIn("prompt_like_instructions", payload["protected_zones"]["protected_classes"])
+                self.assertEqual(
+                    payload["measurement_boundary"]["provided_value"],
+                    "provider-measured-matched-tasks-required",
+                )
+                self.assertFalse(payload["measurement_boundary"]["hosted_token_or_cost_savings_claim_allowed"])
+                self.assertTrue(payload["measurement_boundary"]["image_request_byte_reductions_proxy_only"])
+                self.assertFalse(payload["image_context_plan"]["rendering_planned"])
+                self.assertEqual(payload["image_context_plan"]["image_size"], {"width": 800, "height": 600})
+                for key in (
+                    "image_rendering",
+                    "image_parsing",
+                    "ocr_execution",
+                    "model_calls",
+                    "provider_calls",
+                    "proxy_forwarding",
+                    "binary_artifact_storage",
+                    "replacement_emitted",
+                    "files_written",
+                ):
+                    self.assertFalse(payload["side_effects"][key])
+                self.assertIn("visual-crop-ocr remains", payload["relation_to_visual_crop_ocr"])
+                self.assertIn("not a verified exact binary/image fallback", payload["relation_to_visual_crop_ocr"])
+                self.assertIn("provider-measured matched successful tasks", payload["claim_boundary"])
+
+                missing_boundary = subprocess.run(
                     [
                         sys.executable,
                         str(script),
                         "plan",
                         "image-context-pack",
-                        "--exact-text-fallback-receipt",
-                        receipt,
+                        "--explicit-opt-in",
+                        "--exact-text-receipt",
+                        "text-receipt-123",
                         "--reexpand-command",
-                        f"context-guard-artifact get {receipt} --full",
-                        "--provider-boundary-ack",
+                        "context-guard-artifact get text-receipt-123 --full",
+                        "--protected-zone-policy",
+                        "deny",
                         "--missed-context-note",
-                        "summary table footer remains available through exact text fallback",
-                        "--image-size",
-                        "800,600",
-                        "--packed-image-size",
-                        "400,300",
+                        "note",
                         "--json",
                     ],
                     text=True,
                     capture_output=True,
                     check=True,
+                    cwd=ROOT,
+                )
+                self.assertIn(
+                    "missing_provider_measurement_boundary",
+                    json.loads(missing_boundary.stdout)["review_plan"]["readiness_blockers"],
                 )
-                payload = json.loads(proc.stdout)
-                self.assertEqual(payload["tool"], "context-guard-experiments")
-                self.assertEqual(payload["schema_version"], "contextguard.experiments.v1")
-                self.assertEqual(payload["plan_schema_version"], "contextguard.experiments.image-context-pack-plan.v1")
-                self.assertEqual(payload["experiment_id"], "image-context-pack")
-                self.assertEqual(payload["mode"], "dry_run")
-                self.assertEqual(payload["status"], "ready_for_plan_review")
-                self.assertEqual(payload["review_plan"]["readiness_blockers"], [])
-                self.assertTrue(payload["plan_only"]["command_advertised"])
-                self.assertFalse(payload["plan_only"]["emit_command_available"])
-                self.assertFalse(payload["plan_only"]["record_command_available"])
-                self.assertFalse(payload["plan_only"]["serve_command_available"])
-                self.assertFalse(payload["plan_only"]["replacement_or_visual_evidence_emitted"])
-                self.assertFalse(payload["external_services"]["called"])
-                self.assertFalse(payload["external_services"]["network"])
-                self.assertFalse(payload["external_services"]["model_calls"])
-                self.assertFalse(payload["external_services"]["proxy_forwarding"])
-                self.assertFalse(payload["runtime_side_effects"]["files_written"])
-                self.assertFalse(payload["runtime_side_effects"]["image_rendering"])
-                self.assertFalse(payload["runtime_side_effects"]["ocr_execution"])
-                self.assertFalse(payload["runtime_side_effects"]["image_parsing"])
-                self.assertFalse(payload["runtime_side_effects"]["binary_artifacts_written"])
-                self.assertFalse(payload["runtime_side_effects"]["proxy_forwarding"])
-                self.assertTrue(payload["text_fallback"]["required"])
-                self.assertTrue(payload["text_fallback"]["available"])
-                self.assertFalse(payload["text_fallback"]["verified"])
-                self.assertTrue(payload["text_fallback"]["must_be_verified_before_omitted_text_is_used"])
-                self.assertEqual(payload["protected_zones"]["policy"], "deny")
-                self.assertFalse(payload["protected_zones"]["override_allowed"])
-                for protected_class in ("code", "diffs", "identifiers", "hashes", "paths", "numeric_constants", "json_keys", "stack_frames", "secrets", "prompt_like_instructions"):
-                    self.assertIn(protected_class, payload["protected_zones"]["denied_classes"])
-                self.assertTrue(payload["measurement_boundary"]["provider_boundary_acknowledged"])
-                self.assertTrue(payload["measurement_boundary"]["provider_measured_matched_tasks_required_for_hosted_claims"])
-                self.assertFalse(payload["measurement_boundary"]["hosted_api_token_savings_claim_allowed"])
-                self.assertFalse(payload["measurement_boundary"]["hosted_api_cost_savings_claim_allowed"])
-                self.assertTrue(payload["image_pack_plan"]["image_or_request_byte_reductions_are_proxy_evidence_only"])
-                self.assertEqual(payload["image_pack_plan"]["source_area"], 480000)
-                self.assertEqual(payload["image_pack_plan"]["packed_area"], 120000)
-                self.assertEqual(payload["image_pack_plan"]["area_delta"], 360000)
-                relation = payload["relation_to_visual_crop_ocr"]
-                self.assertTrue(relation["visual_crop_ocr_is_existing_surface"])
-                self.assertTrue(relation["visual_crop_ocr_remains_caller_supplied_visual_evidence_pack"])
-                self.assertTrue(relation["image_context_pack_is_planning_gate_not_duplicate_emitter"])
-                self.assertFalse(relation["verified_exact_binary_or_image_fallback_claimed"])
-                self.assertIn("proxy evidence", payload["claim_boundary"])
-                self.assertIsNone(payload["candidate_replacement"])
 
-    def test_experimental_image_context_pack_blocks_missing_or_unsafe_gates(self):
-        receipt = "0123456789abcdef"
-        cases = [
-            (
-                "missing-provider-boundary",
-                [
-                    "--exact-text-fallback-receipt",
-                    receipt,
-                    "--reexpand-command",
-                    f"context-guard-artifact get {receipt} --full",
-                    "--missed-context-note",
-                    "footer omitted",
-                ],
-                "missing_provider_measurement_boundary",
-            ),
-            (
-                "protected-zone-override",
-                [
-                    "--exact-text-fallback-receipt",
-                    receipt,
-                    "--reexpand-command",
-                    f"context-guard-artifact get {receipt} --full",
-                    "--provider-boundary-ack",
-                    "--missed-context-note",
-                    "footer omitted",
-                    "--protected-zone-policy",
-                    "allow",
-                ],
-                "protected_zone_denial_required",
-            ),
-            (
-                "malformed-image-size",
-                [
-                    "--exact-text-fallback-receipt",
-                    receipt,
-                    "--reexpand-command",
-                    f"context-guard-artifact get {receipt} --full",
-                    "--provider-boundary-ack",
-                    "--missed-context-note",
-                    "footer omitted",
-                    "--image-size",
-                    "-1,600",
-                ],
-                "invalid_image_size",
-            ),
-            (
-                "missing-exact-text-fallback",
-                [
-                    "--provider-boundary-ack",
-                    "--missed-context-note",
-                    "footer omitted",
-                ],
-                "missing_exact_text_fallback",
-            ),
-        ]
-        for script in EXPERIMENT_SCRIPTS:
-            for name, args, expected_blocker in cases:
-                with self.subTest(script=script, case=name):
-                    proc = subprocess.run(
-                        [sys.executable, str(script), "plan", "image-context-pack", *args, "--json"],
-                        text=True,
-                        capture_output=True,
-                        check=True,
-                    )
-                    payload = json.loads(proc.stdout)
-                    self.assertEqual(payload["experiment_id"], "image-context-pack")
-                    self.assertEqual(payload["status"], "blocked_until_image_context_pack_gate_ready")
-                    self.assertIn(expected_blocker, payload["review_plan"]["readiness_blockers"])
-                    self.assertFalse(payload["external_services"]["called"])
-                    self.assertFalse(payload["runtime_side_effects"]["files_written"])
+                override = subprocess.run(
+                    [
+                        sys.executable,
+                        str(script),
+                        "plan",
+                        "image-context-pack",
+                        "--explicit-opt-in",
+                        "--exact-text-receipt",
+                        "text-receipt-123",
+                        "--reexpand-command",
+                        "context-guard-artifact get text-receipt-123 --full",
+                        "--protected-zone-policy",
+                        "allow",
+                        "--provider-measurement-boundary",
+                        "provider-measured-matched-tasks-required",
+                        "--missed-context-note",
+                        "note",
+                        "--json",
+                    ],
+                    text=True,
+                    capture_output=True,
+                    check=True,
+                    cwd=ROOT,
+                )
+                self.assertIn(
+                    "protected_zone_policy_not_deny",
+                    json.loads(override.stdout)["review_plan"]["readiness_blockers"],
+                )
 
-    def test_experimental_image_context_pack_emit_is_unavailable(self):
-        for script in EXPERIMENT_SCRIPTS:
-            with self.subTest(script=script):
-                proc = subprocess.run(
+                malformed_image = subprocess.run(
+                    [sys.executable, str(script), *valid_args[:-2], "0,600", "--json"],
+                    text=True,
+                    capture_output=True,
+                    check=True,
+                    cwd=ROOT,
+                )
+                self.assertIn(
+                    "invalid_image_size",
+                    json.loads(malformed_image.stdout)["review_plan"]["readiness_blockers"],
+                )
+
+                emit_proc = subprocess.run(
                     [sys.executable, str(script), "emit", "image-context-pack", "--json"],
                     text=True,
                     capture_output=True,
+                    cwd=ROOT,
                 )
-                self.assertEqual(proc.returncode, 2)
-                self.assertIn("invalid choice", proc.stderr)
-                self.assertNotIn("Traceback", proc.stderr + proc.stdout)
+                self.assertNotEqual(emit_proc.returncode, 0)
+                self.assertIn("invalid choice", emit_proc.stderr)
+
+        package = json.loads((ROOT / "package.json").read_text(encoding="utf-8"))
+        for name in (
+            "context-guard-image-context-pack",
+            "context-guard-image-pack",
+            "context-guard-render",
+            "context-guard-image-parser",
+            "context-guard-ocr",
+            "context-guard-crop",
+            "context-guard-visual-token",
+        ):
+            self.assertNotIn(name, package["bin"])
+            self.assertFalse((PLUGIN_BIN / name).exists())
+        source = (KIT_DIR / "experimental_registry.py").read_text(encoding="utf-8")
+        self.assertNotIn("def command_emit_image_context_pack", source)
+        for forbidden in ("import requests", "urllib.request", "import subprocess"):
+            self.assertNotIn(forbidden, source)
 
     def test_experimental_visual_crop_ocr_emit_runtime(self):
         for script in EXPERIMENT_SCRIPTS:
@@ -6873,6 +6874,29 @@ def test_experimental_self_hosted_metrics_docs_surface_boundary(self):
                 self.assertNotIn("self-hosted kv/latent runtime optimization is shipped", text)
                 self.assertNotIn("hosted api token/cost savings claim is allowed", text)
 
+    def test_experimental_image_context_pack_docs_surface_boundary(self):
+        docs = (
+            ROOT / "README.md",
+            PLUGIN_DIR / "README.md",
+            KIT_DIR / "README.md",
+            ROOT / "research" / "experimental-token-reduction-radar.md",
+        )
+        for doc in docs:
+            with self.subTest(doc=doc):
+                text = doc.read_text(encoding="utf-8").lower()
+                self.assertIn("image-context-pack", text)
+                self.assertRegex(text, r"plan[- ]only|planning gate|dry-run")
+                self.assertRegex(text, r"pxpipe[- ]inspired|pxpipe")
+                self.assertRegex(text, r"exact text fallback|verified exact text|exact fallback")
+                self.assertRegex(text, r"provider-measured|provider measured")
+                self.assertRegex(text, r"visual-crop-ocr")
+                self.assertRegex(text, r"no image|does not render|does not capture|no screenshot|이미지")
+                self.assertRegex(text, r"no hosted|hosted .*savings|hosted api")
+                self.assertNotIn("image-context-pack emit", text)
+                self.assertNotIn("emit image-context-pack", text)
+                self.assertNotIn("image-context-pack runtime is shipped", text)
+                self.assertNotIn("guaranteed hosted", text)
+
     def test_experimental_local_proxy_docs_surface_boundary(self):
         docs = (
             ROOT / "README.md",
@@ -8871,6 +8895,8 @@ def test_experimental_token_reduction_radar_claim_discipline(self):
             "learned prompt/context compression",
             "multimodal crop, ocr",
             "visual-token",
+            "image-context-pack",
+            "pxpipe-inspired",
             "self-hosted kv-cache",
             "latent inference",
         ]:
@@ -25102,6 +25128,38 @@ def test_token_diet_scan_sanitizes_os_error_paths(self):
             self.assertEqual(diet.format_os_error(error), "Permission denied (errno 13)")
             self.assertNotIn(str(root), diet.format_os_error(error))
 
+    def test_project_settings_denies_context_guard_state(self):
+        settings_path = ROOT / ".claude" / "settings.json"
+        self.assertTrue(settings_path.is_file())
+        settings = json.loads(settings_path.read_text(encoding="utf-8"))
+        denies = settings["permissions"]["deny"]
+        self.assertIn("Read(./.context-guard/**)", denies)
+        for existing in (
+            "Read(./node_modules/**)",
+            "Read(./dist/**)",
+            "Read(./build/**)",
+            "Read(./coverage/**)",
+            "Read(./logs/**)",
+            "Read(./tmp/**)",
+            "Read(./target/**)",
+            "Read(./.next/**)",
+            "Read(./.venv/**)",
+            "Read(./vendor/**)",
+            "Read(./.claude-token-optimizer/**)",
+            "Read(./.env)",
+            "Read(./.env.*)",
+            "Read(./.npmrc)",
+            "Read(./.pypirc)",
+            "Read(./.netrc)",
+            "Read(~/.ssh/**)",
+            "Read(~/.aws/**)",
+            "Read(~/.gnupg/**)",
+            "Read(~/.kube/**)",
+            "Read(~/.docker/**)",
+        ):
+            with self.subTest(existing=existing):
+                self.assertIn(existing, denies)
+
     def test_settings_examples_deny_private_optimizer_state(self):
         for example_path in [
             ROOT / "context-guard-kit" / "settings.example.json",

From 3a79964901ce2213f221d43e866e33d174ab00bc Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 11:58:24 +0900
Subject: [PATCH 03/29] omx(team): auto-checkpoint worker-3 [3]

---
 context-guard-kit/experimental_registry.py | 287 +++++++++++++--------
 1 file changed, 176 insertions(+), 111 deletions(-)

diff --git a/context-guard-kit/experimental_registry.py b/context-guard-kit/experimental_registry.py
index a190849..0d8475e 100755
--- a/context-guard-kit/experimental_registry.py
+++ b/context-guard-kit/experimental_registry.py
@@ -46,6 +46,7 @@
 MAX_LEARNED_COMPRESSION_INPUT_BYTES = 128_000
 MAX_LEARNED_COMPRESSION_REPLACEMENT_BYTES = 64_000
 MAX_LEARNED_COMPRESSION_ARTIFACT_METADATA_BYTES = 64_000
+IMAGE_CONTEXT_PACK_MAX_DIMENSION = 16_384
 MAX_SELF_HOSTED_METRICS_INPUT_BYTES = 64_000
 SELF_HOSTED_METRICS_SCHEMA_VERSION = "contextguard.bench.self-hosted-metrics.v1"
 SELF_HOSTED_METRICS_KEY = "self_hosted_metrics"
@@ -264,44 +265,49 @@ def to_json(self, *, enabled: bool = False) -> dict[str, Any]:
     ),
     Experiment(
         id="image-context-pack",
-        name="Plan-only image context pack evaluation gate",
-        summary="Pxpipe-inspired, explicit-only planning gate for future image/context packing experiments; emits no images or replacements.",
+        name="Image context pack planning gate",
+        summary=(
+            "Plan-only pxpipe-inspired evaluation gate for future image/context packing; it never renders images, "
+            "runs OCR, stores binaries, calls models/providers, or emits replacement evidence."
+        ),
         stability="experimental",
         default_enabled=False,
         risk_level="high",
         claim_boundary=(
-            "Image/request byte reductions are proxy evidence only until provider-measured matched successful "
-            "tasks prove token/cost deltas."
+            "Image/request byte reductions are proxy evidence only; hosted token/cost savings require "
+            "provider-measured matched successful tasks."
         ),
         gate_requirements=(
             "explicit opt-in",
-            "verified exact text artifact fallback before relying on omitted text",
+            "verified exact text artifact fallback before omitted text is relied on",
             "protected-zone denial",
             "provider/model measurement boundary",
             "missed-context guardrails",
-            "relation_to_visual_crop_ocr: visual-crop-ocr remains caller-supplied visual evidence, not an exact binary fallback",
+            "relation to visual-crop-ocr documented",
         ),
         runtime_status="available-plan-only",
         commands=("context-guard experiments plan image-context-pack",),
         opt_in_flags=(
             "plan image-context-pack",
-            "--explicit-opt-in",
-            "--exact-text-receipt",
+            "--evaluation-intent-ack",
+            "--exact-text-fallback-ack",
+            "--text-fallback-receipt",
             "--reexpand-command",
-            "--protected-zone-policy deny",
-            "--provider-measurement-boundary provider-measured-matched-tasks-required",
-            "--missed-context-note",
+            "--protected-zone-deny-ack",
+            "--provider-measurement-boundary-ack",
+            "--missed-context-guardrail-ack",
+            "--visual-crop-ocr-relation-ack",
+            "--proposed-image-size",
         ),
         config_effect=(
-            "Registry enablement records project-local intent only; image-context-pack is plan-only and never "
-            "renders images, runs OCR, emits replacements, stores binary image artifacts, calls providers, or proxies traffic."
+            "Registry enablement records project-local intent only; image-context-pack remains a deterministic "
+            "plan-only dry-run gate with no emit/record/serve runtime and no stable behavior change."
         ),
         evidence_contract=(
-            "Plan output requires explicit opt-in, an exact text fallback receipt/re-expand handle that must be "
-            "verified before omitted text is relied on, protected-zone denial, provider/model measurement boundaries, "
-            "and missed-context notes. relation_to_visual_crop_ocr: existing visual-crop-ocr packs are caller-supplied "
-            "visual evidence and are not verified exact binary/image fallback; image-context-pack is an inspired "
-            "evaluation planning gate, not a duplicate emitter."
+            "The planner requires acknowledgements for explicit evaluation intent, exact text artifact fallback, "
+            "protected-zone denial, provider/model measurement boundaries, missed-context review, and the fact that "
+            "visual-crop-ocr is the existing caller-supplied visual evidence-pack surface rather than a verified "
+            "exact binary/image fallback."
         ),
     ),
     Experiment(
@@ -1781,118 +1787,156 @@ def command_plan_visual_crop_ocr(args: argparse.Namespace) -> int:
 
 
 def image_context_pack_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
-    exact_text_receipt = args.exact_text_receipt.strip() if args.exact_text_receipt else None
+    receipt_id = args.text_fallback_receipt.strip() if args.text_fallback_receipt else None
     reexpand_command = args.reexpand_command.strip() if args.reexpand_command else None
-    provider_boundary = args.provider_measurement_boundary.strip() if args.provider_measurement_boundary else None
-    protected_policy = args.protected_zone_policy.strip().lower() if args.protected_zone_policy else None
-    missed_context_notes = clean_values(args.missed_context_note)
-    pack_label = args.pack_label.strip() if args.pack_label else None
-
-    image_size = parse_int_tuple(args.image_size, count=2) if args.image_size else None
-    image_size_valid = True
+    reexpand_valid, fallback_blocker = valid_learned_reexpand_command(receipt_id, reexpand_command)
+    proposed_image_size = parse_int_tuple(args.proposed_image_size, count=2)
     image_payload = None
-    if args.image_size:
-        if image_size is None:
-            image_size_valid = False
-        else:
-            width, height = image_size
-            image_size_valid = width > 0 and height > 0
-            image_payload = {"width": width, "height": height}
+    image_size_valid = args.proposed_image_size is None
+    if proposed_image_size is not None:
+        width, height = proposed_image_size
+        image_size_valid = (
+            0 < width <= IMAGE_CONTEXT_PACK_MAX_DIMENSION
+            and 0 < height <= IMAGE_CONTEXT_PACK_MAX_DIMENSION
+        )
+        image_payload = {"width": width, "height": height}
+    elif args.proposed_image_size is not None:
+        image_size_valid = False
 
     blockers: list[str] = []
-    if not args.explicit_opt_in:
-        blockers.append("missing_explicit_opt_in")
-    if not (exact_text_receipt and reexpand_command):
-        blockers.append("missing_exact_text_fallback")
-    if protected_policy != IMAGE_CONTEXT_PACK_PROTECTED_POLICY:
-        blockers.append("protected_zone_policy_not_deny")
-    if provider_boundary != IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY:
-        blockers.append("missing_provider_measurement_boundary")
-    if not missed_context_notes:
-        blockers.append("missing_missed_context_note")
+    if not args.evaluation_intent_ack:
+        blockers.append("missing_evaluation_intent_ack")
+    if not args.exact_text_fallback_ack:
+        blockers.append("missing_exact_text_fallback_ack")
+    if fallback_blocker:
+        blockers.append(fallback_blocker)
+    if not args.protected_zone_deny_ack:
+        blockers.append("missing_protected_zone_deny_ack")
+    if not args.provider_measurement_boundary_ack:
+        blockers.append("missing_provider_measurement_boundary_ack")
+    if not args.missed_context_guardrail_ack:
+        blockers.append("missing_missed_context_guardrail_ack")
+    if not args.visual_crop_ocr_relation_ack:
+        blockers.append("missing_visual_crop_ocr_relation_ack")
     if not image_size_valid:
-        blockers.append("invalid_image_size")
-
+        blockers.append("invalid_proposed_image_size")
     blockers = list(dict.fromkeys(blockers))
-    status = "ready_for_design_review" if not blockers else "blocked_until_image_context_pack_gate_ready"
+    ready = not blockers
+
+    protected_classes = [
+        "code",
+        "diffs",
+        "identifiers",
+        "hashes",
+        "paths",
+        "numeric constants",
+        "JSON keys",
+        "stack frames",
+        "secrets",
+        "prompt-like instructions",
+    ]
     return {
         "tool": TOOL_NAME,
-        "schema_version": IMAGE_CONTEXT_PACK_SCHEMA_VERSION,
+        "schema_version": CONFIG_SCHEMA_VERSION,
         "experiment_id": "image-context-pack",
         "mode": "dry_run",
-        "status": status,
-        "pack_label": pack_label,
-        "explicit_opt_in": bool(args.explicit_opt_in),
-        "side_effects": {
-            "stable_runtime_behavior_changed": False,
-            "image_rendering": False,
-            "image_parsing": False,
-            "ocr_execution": False,
-            "model_calls": False,
-            "provider_calls": False,
-            "proxy_forwarding": False,
-            "binary_artifact_storage": False,
+        "status": "ready_for_experiment_design_review" if ready else "blocked_until_plan_constraints",
+        "policy": {
+            "default_off": True,
+            "plan_only": True,
+            "explicit_opt_in_required": True,
+            "emit_runtime_implemented": False,
+            "record_runtime_implemented": False,
+            "serve_runtime_implemented": False,
+            "image_rendering_allowed": False,
+            "ocr_allowed": False,
+            "image_parsing_allowed": False,
+            "model_call_allowed": False,
+            "provider_call_allowed": False,
+            "proxy_forwarding_allowed": False,
+            "binary_artifact_storage_allowed": False,
             "replacement_emitted": False,
+            "stable_runtime_behavior_changed": False,
+            "hosted_api_token_savings_claim_allowed": False,
+            "hosted_api_cost_savings_claim_allowed": False,
+        },
+        "external_services": {
+            "called": False,
+            "network": False,
+            "ocr_service": None,
+            "image_service": None,
+            "model_provider": None,
+        },
+        "network_actions": {
+            "listener_started": False,
+            "traffic_forwarded": False,
+            "dns_lookup_attempted": False,
+            "external_services_called": False,
+        },
+        "file_system_actions": {
             "files_written": False,
+            "binary_artifacts_written": False,
+            "image_artifacts_written": False,
         },
         "exact_text_fallback": {
             "required": True,
-            "available": bool(exact_text_receipt and reexpand_command),
-            "receipt_id": exact_text_receipt,
+            "caller_acknowledged": bool(args.exact_text_fallback_ack),
+            "available": bool(receipt_id and reexpand_command and reexpand_valid),
+            "receipt_id": receipt_id,
             "cli": reexpand_command,
             "verified": False,
-            "verification_required_before_use": True,
-            "note": (
-                "This plan records the exact text fallback handle only. A future runtime must verify the local "
-                "text artifact before relying on any omitted exact text."
-            ),
+            "verified_before_use_required": True,
+            "note": "Only exact sanitized text artifact fallback may support omitted text; binary/image handles are not verified exact fallback.",
         },
-        "protected_zones": {
-            "policy": protected_policy,
+        "protected_zone_policy": {
             "deny_required": True,
-            "protected_classes": [
-                "code",
-                "diffs",
-                "identifiers",
-                "hashes",
-                "paths",
-                "numeric_constants",
-                "json_keys",
-                "stack_frames",
-                "secrets",
-                "prompt_like_instructions",
-            ],
+            "caller_acknowledged": bool(args.protected_zone_deny_ack),
+            "override_allowed": False,
+            "denied_classes": protected_classes,
         },
-        "measurement_boundary": {
-            "provider_model_measurement_required": True,
-            "required_value": IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY,
-            "provided_value": provider_boundary,
+        "provider_measurement_boundary": {
+            "caller_acknowledged": bool(args.provider_measurement_boundary_ack),
             "image_request_byte_reductions_proxy_only": True,
-            "hosted_token_or_cost_savings_claim_allowed": False,
+            "provider_model_measurement_required_for_claims": True,
+            "matched_successful_tasks_required": True,
+            "hosted_api_token_savings_claim_allowed": False,
+            "hosted_api_cost_savings_claim_allowed": False,
+        },
+        "missed_context_guardrail": {
+            "caller_acknowledged": bool(args.missed_context_guardrail_ack),
+            "required_before_promotion": True,
+            "human_review_required": True,
         },
-        "image_context_plan": {
+        "relation_to_visual_crop_ocr": {
+            "visual_crop_ocr_surface": "existing caller-supplied visual evidence-pack emitter",
+            "image_context_pack_surface": "pxpipe-inspired plan-only evaluation gate",
+            "duplicate_emitter": False,
+            "visual_handles_verified_exact_binary_fallback": False,
+            "note": (
+                "visual-crop-ocr remains the explicit caller-supplied visual evidence-pack runtime; "
+                "image-context-pack does not emit images, OCR, replacement evidence, or verified binary fallback."
+            ),
+        },
+        "proposed_image_context_pack": {
             "image_size": image_payload,
             "image_size_valid": image_size_valid,
-            "rendering_planned": False,
-            "target_artifact": None,
+            "max_dimension": IMAGE_CONTEXT_PACK_MAX_DIMENSION,
+            "render_performed": False,
+            "image_bytes_computed": False,
+            "binary_receipt_created": False,
         },
-        "relation_to_visual_crop_ocr": (
-            "visual-crop-ocr remains the caller-supplied visual evidence pack surface and is not a verified "
-            "exact binary/image fallback; image-context-pack is a pxpipe-inspired planning gate, not an emitter."
-        ),
         "review_plan": {
             "readiness_blockers": blockers,
-            "missed_context_notes": missed_context_notes,
             "next_steps": [
-                "Verify exact text fallback artifact content before any future omitted text is relied on.",
-                "Deny protected zones before evaluating image-context packing.",
-                "Collect provider/model measured matched-task token and cost fields before any hosted savings claim.",
-                "Use visual-crop-ocr only for caller-supplied visual evidence packs; do not duplicate it as an emitter.",
+                "Keep this lane plan-only until a future PR supplies benchmark evidence and a separate runtime threat model.",
+                "Require verified exact sanitized text artifact fallback before relying on any omitted text.",
+                "Deny protected zones and prompt-like instructions before considering any future image/context packing.",
+                "Use provider-measured matched successful tasks before any hosted token/cost savings claim.",
             ],
         },
         "claim_boundary": (
-            "Plan-only image-context-pack evaluation; image/request byte reductions are proxy evidence only and "
-            "are not hosted API token or cost savings evidence without provider-measured matched successful tasks."
+            "Dry-run image-context-pack planning gate only; no image rendering, OCR, image parsing, model/provider call, "
+            "proxy forwarding, binary artifact storage, replacement emission, or hosted token/cost savings claim is performed."
         ),
         "candidate_replacement": None,
     }
@@ -1903,10 +1947,9 @@ def command_plan_image_context_pack(args: argparse.Namespace) -> int:
     if args.json:
         emit_json(payload)
     else:
-        print("ContextGuard image-context-pack plan (dry-run only)")
-        print("No image was rendered, parsed, stored, emitted, or sent to a provider/proxy.")
+        print("ContextGuard image-context-pack planning gate (dry-run only)")
+        print("No image rendering, OCR, model/provider call, proxy forwarding, file write, or replacement emission was performed.")
         print(f"Status: {payload['status']}")
-        print(f"Exact text fallback available: {payload['exact_text_fallback']['available']} verified=false")
         if payload["review_plan"]["readiness_blockers"]:
             print(f"Readiness blockers: {', '.join(payload['review_plan']['readiness_blockers'])}")
         print(payload["claim_boundary"])
@@ -4649,17 +4692,39 @@ def build_parser() -> argparse.ArgumentParser:
         "image-context-pack",
         help="Dry-run a plan-only image/context packing evaluation gate without rendering images or emitting replacements.",
     )
-    image_context_pack.add_argument("--explicit-opt-in", action="store_true", help="Acknowledge this is an explicit plan-only experimental gate.")
-    image_context_pack.add_argument("--exact-text-receipt", help="Local exact text artifact receipt/id required before omitted text can be relied on.")
-    image_context_pack.add_argument("--reexpand-command", help="Local command that re-expands the exact text artifact.")
-    image_context_pack.add_argument("--protected-zone-policy", help="Must be 'deny'; protected exact evidence cannot be image-packed.")
     image_context_pack.add_argument(
-        "--provider-measurement-boundary",
-        help=f"Must be '{IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY}' before any hosted token/cost claim.",
+        "--evaluation-intent-ack",
+        action="store_true",
+        help="Acknowledge this is explicit future-evaluation planning only, not a runtime feature.",
+    )
+    image_context_pack.add_argument(
+        "--exact-text-fallback-ack",
+        action="store_true",
+        help="Acknowledge verified exact text artifact fallback is required before omitted text is relied on.",
+    )
+    image_context_pack.add_argument("--text-fallback-receipt", help="Local exact text artifact receipt id for future fallback review.")
+    image_context_pack.add_argument("--reexpand-command", help="Local exact text artifact re-expand command bound to the receipt id.")
+    image_context_pack.add_argument(
+        "--protected-zone-deny-ack",
+        action="store_true",
+        help="Acknowledge protected code/diff/path/hash/identifier/JSON/numeric/prompt-like zones must be denied.",
+    )
+    image_context_pack.add_argument(
+        "--provider-measurement-boundary-ack",
+        action="store_true",
+        help="Acknowledge hosted claims require provider-measured matched successful tasks.",
+    )
+    image_context_pack.add_argument(
+        "--missed-context-guardrail-ack",
+        action="store_true",
+        help="Acknowledge missed-context guardrails and human review are required before promotion.",
+    )
+    image_context_pack.add_argument(
+        "--visual-crop-ocr-relation-ack",
+        action="store_true",
+        help="Acknowledge visual-crop-ocr is the existing caller-supplied visual evidence-pack runtime, not a verified binary fallback.",
     )
-    image_context_pack.add_argument("--missed-context-note", action="append", help="Potential missed-context guardrail note. Repeatable.")
-    image_context_pack.add_argument("--image-size", help="Optional planned image size as width,height positive integers; metadata only.")
-    image_context_pack.add_argument("--pack-label", help="Safe label for this planning gate.")
+    image_context_pack.add_argument("--proposed-image-size", help="Optional future image size as width,height; dry-run validation only.")
     image_context_pack.add_argument("--json", action="store_true", help="Emit JSON output.")
     image_context_pack.set_defaults(func=command_plan_image_context_pack)
 

From 3e3ddd0086b6bd5b78cbb3f8ae93106aac8fd9d7 Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 11:58:50 +0900
Subject: [PATCH 04/29] omx(team): auto-checkpoint worker-1 [1]

---
 context-guard-kit/README.md     | 4 ++--
 plugins/context-guard/README.md | 7 +++----
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/context-guard-kit/README.md b/context-guard-kit/README.md
index 63957e0..5d6a003 100644
--- a/context-guard-kit/README.md
+++ b/context-guard-kit/README.md
@@ -74,7 +74,7 @@ python3 context-guard-kit/sanitize_output.py -- git diff
 
 `experimental_registry.py plan visual-crop-ocr`은 전체 visual evidence 요약 기록과 crop/OCR fixture note를 점검하는 dry-run metadata planner이고, `experimental_registry.py emit visual-crop-ocr`은 caller-supplied crop/OCR 근거를 위한 명시적 로컬 evidence-pack runtime입니다. visual lane은 screenshot 캡처, image crop, screenshot parsing, OCR 실행, OCR/image service 호출, evidence file 쓰기, replacement evidence 생성, hosted savings 주장을 하지 않습니다.
 
-`experimental_registry.py plan image-context-pack`은 pxpipe-inspired plan-only dry-run planning gate입니다. explicit opt-in, verified exact text fallback, protected-zone denial, provider-measured boundary, missed-context guardrail을 기록하지만 image rendering/parsing, OCR execution, model/provider call, proxy traffic, binary image artifact storage, replacement emit은 하지 않습니다. `visual-crop-ocr`은 계속 caller-supplied visual evidence pack surface이며 verified exact binary/image fallback이 아닙니다.
+`experimental_registry.py plan image-context-pack`은 pxpipe-inspired image/context packing을 위한 plan-only dry-run gate입니다. image rendering, OCR/image service, model call, proxy forwarding, binary artifact, replacement evidence를 만들지 않으며, omitted text를 쓰기 전에 exact text fallback receipt/re-expand metadata, protected-zone denial, missed-context note, provider/model 측정 matched-task boundary가 필요하다는 계획 metadata만 출력합니다. `visual-crop-ocr`은 caller-supplied visual evidence-pack surface로 남고, `image-context-pack`은 duplicate emitter나 verified exact binary/image fallback이 아닙니다.
 
 `experimental_registry.py plan learned-compression`은 정제된 trusted prose와 exact fallback handle을 위한 deny-by-default dry-run safety checker이고, `experimental_registry.py emit learned-compression`은 검증된 exact fallback 내용이 있을 때 caller-supplied compact prose를 내보내는 명시적 로컬 candidate emitter입니다. learned lane은 learned/synthetic compressor 실행, embedding, model call, reranker, subprocess, external service, generated replacement text를 실행하지 않으며 hosted savings도 주장하지 않습니다.
 
@@ -84,7 +84,7 @@ python3 context-guard-kit/sanitize_output.py -- git diff
 
 `benchmark_runner.py`는 `research/benchmark-plan.md`의 고정 task/variant 실험을 실행합니다. `variant_prompt_files`는 선택된 task/variant를 필터링한 뒤 필요한 file-backed prompt만 읽으므로 선택하지 않은 fixture의 누락 파일이 선택된 실행을 깨지 않습니다. `--ledger-jsonl`은 subagent·artifact 등 외부 실행 표면으로 옮겨간 token/cost와 run별 측정 가능 여부를 남기고, 선택적 `self_hosted_metrics` provider payload는 run별 sidecar로만 기록합니다. `--report-json`은 baseline 대비 실제 token/cost 절감과 proxy byte 감소를 분리한 A/B report를 생성하며, `--dashboard-md`는 같은 report에서 Markdown dashboard를 렌더링합니다. `--evidence-jsonl` replay는 provider와 `success_command`를 실행하지 않는 deterministic import mode이고, synthetic/manual evidence는 public hosted-savings claim 불가로 강제됩니다. `self_hosted_metrics`는 CSV/report 요약에 접지 않습니다. Report의 `matched_pair_evidence`는 성공한 baseline/variant task bucket을 transform, quality gate, 측정 가능 여부, claim boundary와 연결하므로 절감 주장을 쓰기 전에 이 항목을 확인하세요. Report의 `default_matrix`는 같은 evidence에서 trimming, artifact escrow, tool pruning, cache advice, adaptive-k, optional compression을 `default-on`/`advisory`/`experimental`/`reject/rework`로 분류하지만, report-only metadata이며 runtime default나 hosted savings claim을 바꾸지 않습니다. Report의 `public_claim_readiness`는 public hosted-savings claim의 최종 release gate로, matched successful task, provider-measured primary token/cost, quality non-inferiority, shifted-cost accounting, 명시적 confidence/failure note, complete provider-export provenance가 모두 통과하지 않으면 `claim_allowed=false`로 unsupported claim을 금지합니다.
 
-`../research/experimental-token-reduction-radar.md`는 learned compression, generated crop/OCR/visual-token pruning, self-hosted KV/latent inference optimization 같은 선택적 미래 실험을 문서화한 gate입니다. `../docs/experimental-benchmark-fixtures.md`에는 fixture-only task/variant 시작 예시가 있습니다. 이 radar와 fixture는 hosted API token/cost 절감을 보장하지 않습니다. 현재 제공되는 helper surface는 plan-only image-context-pack dry-run gate, 명시적 local context-diff emit, visual evidence-pack emit, learned candidate emit, self-hosted metrics record, local proxy gate record, one-shot literal-loopback local proxy serve with optional response artifact envelope, design-only external-forwarding plan 같은 좁은 local surface뿐이며, hosted API token/cost 절감 주장은 provider가 측정한 matched-task 근거가 있을 때만 허용합니다. Radar의 later-roadmap gate는 neural/semantic compression, trust-tiered injection-aware compression, generated visual-token reduction, broader external/daemon/hostname-DNS/credential-bearing local proxy forwarding constraints를 별도 미래 PR이 gate를 통과하기 전까지 experimental/non-shipped로 유지합니다.
+`../research/experimental-token-reduction-radar.md`는 learned compression, generated crop/OCR/visual-token pruning, self-hosted KV/latent inference optimization 같은 선택적 미래 실험을 문서화한 gate입니다. `../docs/experimental-benchmark-fixtures.md`에는 fixture-only task/variant 시작 예시가 있습니다. 이 radar와 fixture는 hosted API token/cost 절감을 보장하지 않습니다. 현재 제공되는 helper surface는 plan-only image-context-pack gate, 명시적 local context-diff emit, visual evidence-pack emit, learned candidate emit, self-hosted metrics record, local proxy gate record, one-shot literal-loopback local proxy serve with optional response artifact envelope, design-only external-forwarding plan 같은 좁은 local surface뿐이며, hosted API token/cost 절감 주장은 provider가 측정한 matched-task 근거가 있을 때만 허용합니다. Radar의 later-roadmap gate는 neural/semantic compression, trust-tiered injection-aware compression, generated visual-token reduction, broader external/daemon/hostname-DNS/credential-bearing local proxy forwarding constraints를 별도 미래 PR이 gate를 통과하기 전까지 experimental/non-shipped로 유지합니다.
 
 `claude_transcript_cost_audit.py --recommend`의 기본 출력은 공유 시 안전하도록 transcript 경로를 `basename#hash`, 명령을 `command#hash` 형태로 익명화합니다. 로컬 원문 식별자가 꼭 필요할 때만 `--show-paths` 또는 `--show-commands`를 추가하세요.
 대용량/손상 transcript 방어를 위해 파일 단위 `--max-file-bytes`, JSONL record 단위 `--max-line-bytes` 제한도 기본 적용되며, 건너뛴 항목은 skip count와 warning으로 표시됩니다. JSON summary/feasibility 출력의 `cache_friendliness`는 제한된 정제 segment hash로 안정적인 prefix와 volatile prefix/tail 신호를 비교하는 휴리스틱입니다. `cache_layout_advice`는 그 신호를 긴 세션 분리, prefix 안정화, diet 점검 같은 순위화된 확인/실험으로 연결하지만, 관측 issue와 가설/입증 cause를 분리합니다. `--feasibility-json`은 macOS-visible prototype 같은 consumer가 안정적인 top-level field에만 바인딩하도록 `mac_visibility` 계약도 함께 제공합니다. 원문 prompt text는 출력하지 않고, provider cache token field와 historical token total은 ContextGuard가 만든 토큰 절감 또는 live headroom 증거가 아니라 별도 진단 텔레메트리로 해석하세요.
diff --git a/plugins/context-guard/README.md b/plugins/context-guard/README.md
index 6965a1f..0238e1d 100644
--- a/plugins/context-guard/README.md
+++ b/plugins/context-guard/README.md
@@ -128,7 +128,7 @@ These helpers reduce common sources of context bloat, but they do not guarantee
 
 ContextGuard also does not send work to external AI providers to save model tokens. All helper commands run locally. Local RAM/disk receipts can reduce what you choose to send, but they do not replace a provider prompt cache. Before release or billing claims for Anthropic, recheck the official prompt-caching and pricing docs: https://docs.anthropic.com/en/build-with-claude/prompt-caching and https://platform.claude.com/docs/en/about-claude/pricing.
 
-Future learned, multimodal, and self-hosted optimization ideas are tracked in [`research/experimental-token-reduction-radar.md`](https://github.com/ictechgy/context-guard/blob/main/research/experimental-token-reduction-radar.md), with fixture-only starters in [`docs/experimental-benchmark-fixtures.md`](https://github.com/ictechgy/context-guard/blob/main/docs/experimental-benchmark-fixtures.md). ContextGuard ships a pxpipe-inspired plan-only `image-context-pack` dry-run planning gate, dry-run planners/checkers for local-proxy advisory plans and design-only external-forwarding gates, plus narrow explicit local runtimes for caller-supplied context-diff replacement payloads, caller-supplied visual crop/OCR evidence packs, caller-supplied learned-compression prose candidates, self-hosted metrics JSONL sidecar records, local-proxy runtime-gate JSONL records, one-shot `serve local-proxy` loopback forwarding with a private ready-file nonce, optional `--response-sandbox` compact artifact envelopes for safe UTF-8 responses, and optional shifted-cost diagnostic JSONL rows for successful forwarded requests. `image-context-pack` does not render images, run OCR, emit replacements, store binary image artifacts, call providers, or proxy traffic; exact text fallback must be verified before omitted text is relied on and hosted savings need provider-measured matched-task evidence. Learned/synthetic compressor execution beyond the caller-supplied candidate emitter, embeddings, rerankers, model calls, generated replacement text, screenshot capture, image rendering, image cropping, OCR execution, image parsing, external OCR/image services, output-file evidence writes, self-hosted KV/latent runtime optimization beyond explicit local metrics recording, and external/daemon/hostname-DNS, credential-bearing, or external proxy forwarding beyond literal-loopback one-request HTTP forwarding are not shipped. That radar and the fixtures do not claim hosted API savings without provider-measured matched-task evidence. The radar's later-roadmap gates also keep neural/semantic compression, trust-tiered injection-aware compression, generated visual-token reduction, and broader local proxy forwarding constraints experimental/non-shipped until a separate future PR satisfies those gates.
+Future learned, multimodal, and self-hosted optimization ideas are tracked in [`research/experimental-token-reduction-radar.md`](https://github.com/ictechgy/context-guard/blob/main/research/experimental-token-reduction-radar.md), with fixture-only starters in [`docs/experimental-benchmark-fixtures.md`](https://github.com/ictechgy/context-guard/blob/main/docs/experimental-benchmark-fixtures.md). ContextGuard ships dry-run planners/checkers for a plan-only `image-context-pack` evaluation gate, local-proxy advisory plans, and design-only external-forwarding gates, plus narrow explicit local runtimes for caller-supplied context-diff replacement payloads, caller-supplied visual crop/OCR evidence packs, caller-supplied learned-compression prose candidates, self-hosted metrics JSONL sidecar records, local-proxy runtime-gate JSONL records, one-shot `serve local-proxy` loopback forwarding with a private ready-file nonce, optional `--response-sandbox` compact artifact envelopes for safe UTF-8 responses, and optional shifted-cost diagnostic JSONL rows for successful forwarded requests. Learned/synthetic compressor execution beyond the caller-supplied candidate emitter, embeddings, rerankers, model calls, generated replacement text, screenshot capture, image cropping, OCR execution, image parsing, external OCR/image services, output-file evidence writes, generated image-context-pack renderers, binary/image artifact fallback, pxpipe-style proxy/runtime, self-hosted KV/latent runtime optimization beyond explicit local metrics recording, and external/daemon/hostname-DNS, credential-bearing, or external proxy forwarding beyond literal-loopback one-request HTTP forwarding are not shipped. That radar and the fixtures do not claim hosted API savings without provider-measured matched-task evidence. The radar's later-roadmap gates also keep neural/semantic compression, trust-tiered injection-aware compression, generated visual-token reduction, and broader local proxy forwarding constraints experimental/non-shipped until a separate future PR satisfies those gates.
 
 ## Experimental opt-ins
 
@@ -142,6 +142,7 @@ context-guard experiments emit context-diff-compaction --receipt-id <artifact-id
 context-guard experiments plan image-context-pack --json --explicit-opt-in --exact-text-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --protected-zone-policy deny --provider-measurement-boundary provider-measured-matched-tasks-required --missed-context-note "omitted text remains exactly retrievable" --image-size 800,600
 context-guard experiments plan visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --missed-context-note "outside crop omitted"
 context-guard experiments emit visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --ocr-text "visible text" --ocr-confidence 0.9 --ocr-error-note "glyph may be uncertain" --missed-context-note "outside crop omitted"
+context-guard experiments plan image-context-pack --json --exact-text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --provider-boundary-ack --missed-context-note "omitted text remains retrievable before any future image pack is used"
 context-guard experiments plan learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" < sanitized-prose.txt
 context-guard experiments emit learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --replacement-file compact-prose.txt < sanitized-prose.txt
 context-guard experiments plan self-hosted-metrics-ledger --json --latency-ms 123.5 --peak-memory-mb 2048 --quality-score 0.98
@@ -154,9 +155,7 @@ context-guard experiments enable output-receipt-trim --root .
 context-guard experiments disable output-receipt-trim --root .
 ```
 
-`plan image-context-pack` is plan-only and dry-run: it does not render or parse images, run OCR, emit replacements, write files, store binary image artifacts, call providers, or proxy traffic. It records explicit opt-in, protected-zone denial, missed-context notes, exact text fallback requirements, provider-measured boundaries, and its relation to `visual-crop-ocr`, which remains caller-supplied visual evidence rather than verified exact binary fallback.
-
-Use `--config <path>` only for an explicit project-local override. Registry entries include risk, gate requirements, explicit command/flag surfaces, and claim boundaries; hosted API token/cost savings still require provider-measured matched-task evidence. The registry can discover existing explicit-flag experiments such as `context-guard-trim-output --digest ... --artifact-receipt` and `context-guard-compress --protected-policy`, run dry-run advisory planners such as `context-guard experiments plan context-diff-compaction`, `context-guard experiments plan visual-crop-ocr`, `context-guard experiments plan learned-compression`, `context-guard experiments plan self-hosted-metrics-ledger`, `context-guard experiments plan local-proxy`, and design-only `context-guard experiments plan local-proxy-external-forwarding`, and run explicit local runtimes such as `context-guard experiments emit context-diff-compaction ...`, `context-guard experiments emit visual-crop-ocr ...`, `context-guard experiments emit learned-compression ...`, `context-guard experiments record self-hosted-metrics-ledger ...`, `context-guard experiments record local-proxy-runtime-gate ...`, `context-guard experiments serve local-proxy ...`, and successful-forward `context-guard experiments serve local-proxy --diagnostic-ledger-jsonl ...` diagnostics. The context-diff emit runtime only emits caller-supplied compact replacements when reviewable hunks, exact local artifact re-expand metadata whose stored content matches the input diff, and a smaller replacement are present; it does not generate semantic compression or permit hosted savings claims. The visual lane ships a dry-run planner plus an explicit local evidence-pack emitter: both use only caller-supplied full-evidence receipts, crop metadata, OCR text, confidence/error notes, and missed-context notes; screenshot capture, image cropping, OCR execution, image parsing, external OCR/image services, output-file writes, and hosted savings claims are not shipped. The learned-compression lane ships a deny-by-default dry-run policy check plus an explicit local candidate emitter for caller-supplied compact prose with verified exact fallback content: learned/synthetic compressor execution, embeddings, rerankers, model calls, subprocesses, external services, generated replacement text, and hosted savings claims are not shipped. The self-hosted metrics planner emits a dry-run ledger-compatible preview for explicit local/model-server latency, memory, quality, energy, throughput, and local-cost metrics; the dry-run preview does not write a ledger, while `context-guard experiments record self-hosted-metrics-ledger --ledger-jsonl ...` writes only local JSONL sidecars and still does not permit hosted API token/cost savings claims. The local-proxy planner emits localhost-only advisory metadata only, while `context-guard experiments record local-proxy-runtime-gate --ledger-jsonl ...` appends one local gate row only after localhost-only metadata and `--runtime-gate-ack`: it starts no listener, forwards no traffic, and performs no DNS lookup. `context-guard experiments serve local-proxy ...` is the separate forwarding MVP: it requires `--forwarding-gate-ack --once`, a private `--ready-file` nonce handoff, literal loopback bind/target IPs, no hostname DNS targets, nonzero ports, byte/time limits, and credential-free requests; it performs no external forwarding, no CONNECT/TLS proxying, no API-key persistence, and no hosted-savings claim. `--response-sandbox` can store safe UTF-8 response text as a sanitized local artifact receipt and return a compact envelope with redacted rehydration command templates; it does not claim hosted token/cost savings. `--diagnostic-ledger-jsonl` writes one shifted-cost diagnostic row only after a successful forwarded request, with no raw headers/bodies and no hosted-savings evidence. `plan local-proxy-external-forwarding` emits threat-model/allowlist/redaction/provider-evidence design metadata only and still starts no listener, performs no DNS lookup, calls no external service, forwards no traffic, persists no credentials, and does not ship an external proxy forwarding runtime. `experiments enable` records intent only; it does not run those helpers, remove the need for their explicit flags, or permit replacing content without exact receipt/re-expand evidence.
+Use `--config <path>` only for an explicit project-local override. Registry entries include risk, gate requirements, explicit command/flag surfaces, and claim boundaries; hosted API token/cost savings still require provider-measured matched-task evidence. The registry can discover existing explicit-flag experiments such as `context-guard-trim-output --digest ... --artifact-receipt` and `context-guard-compress --protected-policy`, run dry-run advisory planners such as `context-guard experiments plan context-diff-compaction`, `context-guard experiments plan visual-crop-ocr`, `context-guard experiments plan image-context-pack`, `context-guard experiments plan learned-compression`, `context-guard experiments plan self-hosted-metrics-ledger`, `context-guard experiments plan local-proxy`, and design-only `context-guard experiments plan local-proxy-external-forwarding`, and run explicit local runtimes such as `context-guard experiments emit context-diff-compaction ...`, `context-guard experiments emit visual-crop-ocr ...`, `context-guard experiments emit learned-compression ...`, `context-guard experiments record self-hosted-metrics-ledger ...`, `context-guard experiments record local-proxy-runtime-gate ...`, `context-guard experiments serve local-proxy ...`, and successful-forward `context-guard experiments serve local-proxy --diagnostic-ledger-jsonl ...` diagnostics. The context-diff emit runtime only emits caller-supplied compact replacements when reviewable hunks, exact local artifact re-expand metadata whose stored content matches the input diff, and a smaller replacement are present; it does not generate semantic compression or permit hosted savings claims. The visual lane ships a dry-run planner plus an explicit local evidence-pack emitter: both use only caller-supplied full-evidence receipts, crop metadata, OCR text, confidence/error notes, and missed-context notes; screenshot capture, image cropping, OCR execution, image parsing, external OCR/image services, output-file writes, and hosted savings claims are not shipped. The `image-context-pack` lane is plan-only pxpipe-inspired evaluation metadata: it emits no image, replacement, evidence pack, binary artifact, ledger, listener, or proxy, requires exact text fallback receipt/re-expand metadata before omitted text is used, denies protected zones, records missed-context notes, and keeps provider/model measured matched-task evidence as the boundary for any hosted claim. `visual-crop-ocr` remains the caller-supplied visual evidence-pack surface; `image-context-pack` is not a duplicate emitter or verified exact binary/image fallback. The learned-compression lane ships a deny-by-default dry-run policy check plus an explicit local candidate emitter for caller-supplied compact prose with verified exact fallback content: learned/synthetic compressor execution, embeddings, rerankers, model calls, subprocesses, external services, generated replacement text, and hosted savings claims are not shipped. The self-hosted metrics planner emits a dry-run ledger-compatible preview for explicit local/model-server latency, memory, quality, energy, throughput, and local-cost metrics; the dry-run preview does not write a ledger, while `context-guard experiments record self-hosted-metrics-ledger --ledger-jsonl ...` writes only local JSONL sidecars and still does not permit hosted API token/cost savings claims. The local-proxy planner emits localhost-only advisory metadata only, while `context-guard experiments record local-proxy-runtime-gate --ledger-jsonl ...` appends one local gate row only after localhost-only metadata and `--runtime-gate-ack`: it starts no listener, forwards no traffic, and performs no DNS lookup. `context-guard experiments serve local-proxy ...` is the separate forwarding MVP: it requires `--forwarding-gate-ack --once`, a private `--ready-file` nonce handoff, literal loopback bind/target IPs, no hostname DNS targets, nonzero ports, byte/time limits, and credential-free requests; it performs no external forwarding, no CONNECT/TLS proxying, no API-key persistence, and no hosted-savings claim. `--response-sandbox` can store safe UTF-8 response text as a sanitized local artifact receipt and return a compact envelope with redacted rehydration command templates; it does not claim hosted token/cost savings. `--diagnostic-ledger-jsonl` writes one shifted-cost diagnostic row only after a successful forwarded request, with no raw headers/bodies and no hosted-savings evidence. `plan local-proxy-external-forwarding` emits threat-model/allowlist/redaction/provider-evidence design metadata only and still starts no listener, performs no DNS lookup, calls no external service, forwards no traffic, persists no credentials, and does not ship an external proxy forwarding runtime. `experiments enable` records intent only; it does not run those helpers, remove the need for their explicit flags, or permit replacing content without exact receipt/re-expand evidence.
 
 Cross-agent rule snippets are advisory: the target agent may ignore them, so measure actual before/after behavior when you need a savings claim.
 

From 7f130f8fc3cfdadc40d42db84cadf4b7ef8f1e39 Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 11:58:50 +0900
Subject: [PATCH 05/29] omx(team): auto-checkpoint worker-2 [2]

---
 .../bin/context-guard-experiments             | 198 +++++++++++++++++-
 tests/test_context_guard_kit.py               |   2 +-
 2 files changed, 198 insertions(+), 2 deletions(-)

diff --git a/plugins/context-guard/bin/context-guard-experiments b/plugins/context-guard/bin/context-guard-experiments
index fd44d5c..a190849 100755
--- a/plugins/context-guard/bin/context-guard-experiments
+++ b/plugins/context-guard/bin/context-guard-experiments
@@ -67,6 +67,9 @@ LOCAL_PROXY_DIAGNOSTIC_SCHEMA_VERSION = "contextguard.experiments.local-proxy-fo
 LOCAL_PROXY_READY_SCHEMA_VERSION = "contextguard.experiments.local-proxy-ready.v1"
 LOCAL_PROXY_EXTERNAL_DESIGN_SCHEMA_VERSION = "contextguard.experiments.local-proxy-external-forwarding-design.v1"
 LOCAL_PROXY_RESPONSE_SANDBOX_SCHEMA_VERSION = "contextguard.experiments.local-proxy-response-sandbox.v1"
+IMAGE_CONTEXT_PACK_SCHEMA_VERSION = "contextguard.experiments.image-context-pack-plan.v1"
+IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY = "provider-measured-matched-tasks-required"
+IMAGE_CONTEXT_PACK_PROTECTED_POLICY = "deny"
 LOCAL_PROXY_DEFAULT_BIND_HOST = "127.0.0.1"
 LOCAL_PROXY_DEFAULT_BIND_PORT = 0
 LOCAL_PROXY_DEFAULT_TARGET_HOST = "127.0.0.1"
@@ -259,6 +262,48 @@ EXPERIMENTS: tuple[Experiment, ...] = (
             "OCR confidence/error notes when OCR is present, and missed-context guardrails before human review."
         ),
     ),
+    Experiment(
+        id="image-context-pack",
+        name="Plan-only image context pack evaluation gate",
+        summary="Pxpipe-inspired, explicit-only planning gate for future image/context packing experiments; emits no images or replacements.",
+        stability="experimental",
+        default_enabled=False,
+        risk_level="high",
+        claim_boundary=(
+            "Image/request byte reductions are proxy evidence only until provider-measured matched successful "
+            "tasks prove token/cost deltas."
+        ),
+        gate_requirements=(
+            "explicit opt-in",
+            "verified exact text artifact fallback before relying on omitted text",
+            "protected-zone denial",
+            "provider/model measurement boundary",
+            "missed-context guardrails",
+            "relation_to_visual_crop_ocr: visual-crop-ocr remains caller-supplied visual evidence, not an exact binary fallback",
+        ),
+        runtime_status="available-plan-only",
+        commands=("context-guard experiments plan image-context-pack",),
+        opt_in_flags=(
+            "plan image-context-pack",
+            "--explicit-opt-in",
+            "--exact-text-receipt",
+            "--reexpand-command",
+            "--protected-zone-policy deny",
+            "--provider-measurement-boundary provider-measured-matched-tasks-required",
+            "--missed-context-note",
+        ),
+        config_effect=(
+            "Registry enablement records project-local intent only; image-context-pack is plan-only and never "
+            "renders images, runs OCR, emits replacements, stores binary image artifacts, calls providers, or proxies traffic."
+        ),
+        evidence_contract=(
+            "Plan output requires explicit opt-in, an exact text fallback receipt/re-expand handle that must be "
+            "verified before omitted text is relied on, protected-zone denial, provider/model measurement boundaries, "
+            "and missed-context notes. relation_to_visual_crop_ocr: existing visual-crop-ocr packs are caller-supplied "
+            "visual evidence and are not verified exact binary/image fallback; image-context-pack is an inspired "
+            "evaluation planning gate, not a duplicate emitter."
+        ),
+    ),
     Experiment(
         id="learned-compression",
         name="Learned/synthetic compression candidate gate",
@@ -1735,6 +1780,139 @@ def command_plan_visual_crop_ocr(args: argparse.Namespace) -> int:
     return 0
 
 
+def image_context_pack_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
+    exact_text_receipt = args.exact_text_receipt.strip() if args.exact_text_receipt else None
+    reexpand_command = args.reexpand_command.strip() if args.reexpand_command else None
+    provider_boundary = args.provider_measurement_boundary.strip() if args.provider_measurement_boundary else None
+    protected_policy = args.protected_zone_policy.strip().lower() if args.protected_zone_policy else None
+    missed_context_notes = clean_values(args.missed_context_note)
+    pack_label = args.pack_label.strip() if args.pack_label else None
+
+    image_size = parse_int_tuple(args.image_size, count=2) if args.image_size else None
+    image_size_valid = True
+    image_payload = None
+    if args.image_size:
+        if image_size is None:
+            image_size_valid = False
+        else:
+            width, height = image_size
+            image_size_valid = width > 0 and height > 0
+            image_payload = {"width": width, "height": height}
+
+    blockers: list[str] = []
+    if not args.explicit_opt_in:
+        blockers.append("missing_explicit_opt_in")
+    if not (exact_text_receipt and reexpand_command):
+        blockers.append("missing_exact_text_fallback")
+    if protected_policy != IMAGE_CONTEXT_PACK_PROTECTED_POLICY:
+        blockers.append("protected_zone_policy_not_deny")
+    if provider_boundary != IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY:
+        blockers.append("missing_provider_measurement_boundary")
+    if not missed_context_notes:
+        blockers.append("missing_missed_context_note")
+    if not image_size_valid:
+        blockers.append("invalid_image_size")
+
+    blockers = list(dict.fromkeys(blockers))
+    status = "ready_for_design_review" if not blockers else "blocked_until_image_context_pack_gate_ready"
+    return {
+        "tool": TOOL_NAME,
+        "schema_version": IMAGE_CONTEXT_PACK_SCHEMA_VERSION,
+        "experiment_id": "image-context-pack",
+        "mode": "dry_run",
+        "status": status,
+        "pack_label": pack_label,
+        "explicit_opt_in": bool(args.explicit_opt_in),
+        "side_effects": {
+            "stable_runtime_behavior_changed": False,
+            "image_rendering": False,
+            "image_parsing": False,
+            "ocr_execution": False,
+            "model_calls": False,
+            "provider_calls": False,
+            "proxy_forwarding": False,
+            "binary_artifact_storage": False,
+            "replacement_emitted": False,
+            "files_written": False,
+        },
+        "exact_text_fallback": {
+            "required": True,
+            "available": bool(exact_text_receipt and reexpand_command),
+            "receipt_id": exact_text_receipt,
+            "cli": reexpand_command,
+            "verified": False,
+            "verification_required_before_use": True,
+            "note": (
+                "This plan records the exact text fallback handle only. A future runtime must verify the local "
+                "text artifact before relying on any omitted exact text."
+            ),
+        },
+        "protected_zones": {
+            "policy": protected_policy,
+            "deny_required": True,
+            "protected_classes": [
+                "code",
+                "diffs",
+                "identifiers",
+                "hashes",
+                "paths",
+                "numeric_constants",
+                "json_keys",
+                "stack_frames",
+                "secrets",
+                "prompt_like_instructions",
+            ],
+        },
+        "measurement_boundary": {
+            "provider_model_measurement_required": True,
+            "required_value": IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY,
+            "provided_value": provider_boundary,
+            "image_request_byte_reductions_proxy_only": True,
+            "hosted_token_or_cost_savings_claim_allowed": False,
+        },
+        "image_context_plan": {
+            "image_size": image_payload,
+            "image_size_valid": image_size_valid,
+            "rendering_planned": False,
+            "target_artifact": None,
+        },
+        "relation_to_visual_crop_ocr": (
+            "visual-crop-ocr remains the caller-supplied visual evidence pack surface and is not a verified "
+            "exact binary/image fallback; image-context-pack is a pxpipe-inspired planning gate, not an emitter."
+        ),
+        "review_plan": {
+            "readiness_blockers": blockers,
+            "missed_context_notes": missed_context_notes,
+            "next_steps": [
+                "Verify exact text fallback artifact content before any future omitted text is relied on.",
+                "Deny protected zones before evaluating image-context packing.",
+                "Collect provider/model measured matched-task token and cost fields before any hosted savings claim.",
+                "Use visual-crop-ocr only for caller-supplied visual evidence packs; do not duplicate it as an emitter.",
+            ],
+        },
+        "claim_boundary": (
+            "Plan-only image-context-pack evaluation; image/request byte reductions are proxy evidence only and "
+            "are not hosted API token or cost savings evidence without provider-measured matched successful tasks."
+        ),
+        "candidate_replacement": None,
+    }
+
+
+def command_plan_image_context_pack(args: argparse.Namespace) -> int:
+    payload = image_context_pack_plan_payload(args)
+    if args.json:
+        emit_json(payload)
+    else:
+        print("ContextGuard image-context-pack plan (dry-run only)")
+        print("No image was rendered, parsed, stored, emitted, or sent to a provider/proxy.")
+        print(f"Status: {payload['status']}")
+        print(f"Exact text fallback available: {payload['exact_text_fallback']['available']} verified=false")
+        if payload["review_plan"]["readiness_blockers"]:
+            print(f"Readiness blockers: {', '.join(payload['review_plan']['readiness_blockers'])}")
+        print(payload["claim_boundary"])
+    return 0
+
+
 def visual_crop_ocr_evidence_pack_payload(args: argparse.Namespace) -> dict[str, Any]:
     payload = visual_crop_ocr_plan_payload(args)
     blockers = list(payload["review_plan"]["readiness_blockers"])
@@ -4467,6 +4645,24 @@ def build_parser() -> argparse.ArgumentParser:
     visual_ocr.add_argument("--json", action="store_true", help="Emit JSON output.")
     visual_ocr.set_defaults(func=command_plan_visual_crop_ocr)
 
+    image_context_pack = plan_sub.add_parser(
+        "image-context-pack",
+        help="Dry-run a plan-only image/context packing evaluation gate without rendering images or emitting replacements.",
+    )
+    image_context_pack.add_argument("--explicit-opt-in", action="store_true", help="Acknowledge this is an explicit plan-only experimental gate.")
+    image_context_pack.add_argument("--exact-text-receipt", help="Local exact text artifact receipt/id required before omitted text can be relied on.")
+    image_context_pack.add_argument("--reexpand-command", help="Local command that re-expands the exact text artifact.")
+    image_context_pack.add_argument("--protected-zone-policy", help="Must be 'deny'; protected exact evidence cannot be image-packed.")
+    image_context_pack.add_argument(
+        "--provider-measurement-boundary",
+        help=f"Must be '{IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY}' before any hosted token/cost claim.",
+    )
+    image_context_pack.add_argument("--missed-context-note", action="append", help="Potential missed-context guardrail note. Repeatable.")
+    image_context_pack.add_argument("--image-size", help="Optional planned image size as width,height positive integers; metadata only.")
+    image_context_pack.add_argument("--pack-label", help="Safe label for this planning gate.")
+    image_context_pack.add_argument("--json", action="store_true", help="Emit JSON output.")
+    image_context_pack.set_defaults(func=command_plan_image_context_pack)
+
     self_hosted = plan_sub.add_parser(
         "self-hosted-metrics-ledger",
         help="Dry-run self-hosted/local metrics ledger sidecar evidence without writing a ledger.",
@@ -4757,7 +4953,7 @@ def normalize_negative_csv_option_values(argv: list[str] | None) -> list[str] |
         argv = sys.argv[1:]
     normalized: list[str] = []
     pending_csv_option: str | None = None
-    csv_options = {"--crop-bounds"}
+    csv_options = {"--crop-bounds", "--image-size"}
     for token in argv:
         if pending_csv_option is not None:
             normalized.append(f"{pending_csv_option}={token}")
diff --git a/tests/test_context_guard_kit.py b/tests/test_context_guard_kit.py
index bbc2324..d61767f 100644
--- a/tests/test_context_guard_kit.py
+++ b/tests/test_context_guard_kit.py
@@ -6890,7 +6890,7 @@ def test_experimental_image_context_pack_docs_surface_boundary(self):
                 self.assertRegex(text, r"exact text fallback|verified exact text|exact fallback")
                 self.assertRegex(text, r"provider-measured|provider measured")
                 self.assertRegex(text, r"visual-crop-ocr")
-                self.assertRegex(text, r"no image|does not render|does not capture|no screenshot|이미지")
+                self.assertRegex(text, r"no image|does not render|image rendering|does not capture|no screenshot|이미지")
                 self.assertRegex(text, r"no hosted|hosted .*savings|hosted api")
                 self.assertNotIn("image-context-pack emit", text)
                 self.assertNotIn("emit image-context-pack", text)

From 8bb5532688decc639c0685406e27e690bb0ee1bc Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 11:58:50 +0900
Subject: [PATCH 06/29] omx(team): auto-checkpoint worker-3 [3]

---
 tests/test_context_guard_kit.py | 38 ++++++++++++++++++---------------
 1 file changed, 21 insertions(+), 17 deletions(-)

diff --git a/tests/test_context_guard_kit.py b/tests/test_context_guard_kit.py
index d61767f..1560091 100644
--- a/tests/test_context_guard_kit.py
+++ b/tests/test_context_guard_kit.py
@@ -1669,23 +1669,24 @@ def test_experimental_registry_describes_safe_explicit_flag_surfaces(self):
                         self.assertIn("full visual evidence receipt", visual_ocr["evidence_contract"])
                         self.assertIn("missed-context", visual_ocr["evidence_contract"].lower())
 
-                        image_context = experiments["image-context-pack"]
-                        self.assertEqual(image_context["runtime_status"], "available-plan-only")
-                        self.assertFalse(image_context["default_enabled"])
-                        self.assertEqual(image_context["commands"], ["context-guard experiments plan image-context-pack"])
-                        self.assertIn("plan image-context-pack", image_context["opt_in_flags"])
-                        self.assertIn("--explicit-opt-in", image_context["opt_in_flags"])
-                        self.assertIn("--exact-text-receipt", image_context["opt_in_flags"])
-                        self.assertIn("--protected-zone-policy deny", image_context["opt_in_flags"])
-                        self.assertIn("--provider-measurement-boundary provider-measured-matched-tasks-required", image_context["opt_in_flags"])
-                        self.assertNotIn("emit image-context-pack", image_context["opt_in_flags"])
-                        self.assertNotIn("context-guard experiments emit image-context-pack", image_context["commands"])
-                        self.assertIn("plan-only", image_context["config_effect"])
-                        self.assertIn("never renders images", image_context["config_effect"])
-                        self.assertIn("verified exact text fallback", image_context["evidence_contract"])
-                        self.assertIn("protected-zone denial", image_context["evidence_contract"])
-                        self.assertIn("provider/model measurement", image_context["evidence_contract"])
-                        self.assertIn("relation_to_visual_crop_ocr", image_context["evidence_contract"])
+                        image_pack = experiments["image-context-pack"]
+                        self.assertEqual(image_pack["runtime_status"], "available-plan-only")
+                        self.assertFalse(image_pack["default_enabled"])
+                        self.assertIn("context-guard experiments plan image-context-pack", image_pack["commands"])
+                        self.assertNotIn("context-guard experiments emit image-context-pack", image_pack["commands"])
+                        self.assertIn("plan image-context-pack", image_pack["opt_in_flags"])
+                        self.assertIn("--evaluation-intent-ack", image_pack["opt_in_flags"])
+                        self.assertIn("--exact-text-fallback-ack", image_pack["opt_in_flags"])
+                        self.assertIn("--protected-zone-deny-ack", image_pack["opt_in_flags"])
+                        self.assertIn("--provider-measurement-boundary-ack", image_pack["opt_in_flags"])
+                        self.assertIn("--missed-context-guardrail-ack", image_pack["opt_in_flags"])
+                        self.assertIn("--visual-crop-ocr-relation-ack", image_pack["opt_in_flags"])
+                        self.assertIn("plan-only dry-run gate", image_pack["config_effect"])
+                        self.assertIn("no emit/record/serve runtime", image_pack["config_effect"])
+                        self.assertIn("protected-zone denial", image_pack["evidence_contract"])
+                        self.assertIn("visual-crop-ocr", image_pack["evidence_contract"])
+                        self.assertIn("not a verified exact binary/image fallback", image_pack["evidence_contract"])
+                        self.assertIn("provider-measured matched successful tasks", image_pack["claim_boundary"])
 
                         learned = experiments["learned-compression"]
                         self.assertEqual(learned["runtime_status"], "available-explicit-runtime")
@@ -17224,6 +17225,7 @@ def test_setup_wizard_apply_recommended_writes_project_settings_for_kit_and_plug
                     self.assertIn("context-guard-statusline-merged", settings["statusLine"]["command"])
                     deny = settings["permissions"]["deny"]
                     self.assertIn("Read(./node_modules/**)", deny)
+                    self.assertIn("Read(./.context-guard/**)", deny)
                     self.assertIn("Read(./.claude-token-optimizer/**)", deny)
                     self.assertIn("Read(./.env)", deny)
                     commands = json.dumps(settings["hooks"])
@@ -24402,6 +24404,8 @@ def test_token_diet_scan_reports_cross_agent_rule_bloat_and_context_exclusions(s
                     self.assertEqual(recommendations[".env.*"]["recommended_deny"], "Read(./.env.*)")
                     self.assertEqual(recommendations[".env.*"]["status"], "missing")
                     self.assertEqual(recommendations[".context-guard"]["generic_pattern"], ".context-guard/**")
+                    self.assertEqual(recommendations[".context-guard"]["recommended_deny"], "Read(./.context-guard/**)")
+                    self.assertEqual(recommendations[".context-guard"]["status"], "missing")
                     self.assertIn("claude-permissions.deny", recommendations[".env"]["applies_to"])
                     self.assertNotIn(str(root), proc.stdout)
 

From 6e1b6c2bd178d90663a9738f8aa89c92a8b3503d Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 11:59:27 +0900
Subject: [PATCH 07/29] omx(team): auto-checkpoint worker-1 [1]

---
 .../experimental-token-reduction-radar.md     | 22 +++++++++++++++----
 tests/test_context_guard_kit.py               |  4 ++++
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/research/experimental-token-reduction-radar.md b/research/experimental-token-reduction-radar.md
index dba7e06..c81baca 100644
--- a/research/experimental-token-reduction-radar.md
+++ b/research/experimental-token-reduction-radar.md
@@ -64,6 +64,20 @@ Future PR checklist:
 - [ ] Show bounded-loss disclosure whenever lossy replacement is allowed.
 - [ ] Make no hosted token/cost savings claim from a smaller local diff alone.
 
+### Pxpipe-inspired image context pack gate
+
+`image-context-pack` is a plan-only pxpipe-inspired evaluation gate, not a shipped renderer, proxy, image artifact store, OCR pipeline, image parser, or replacement emitter. Any future image/context packing must keep exact text retrievable through a verified local text artifact receipt before omitted text is used, deny protected zones (code, diffs, identifiers, hashes, paths, numeric constants, JSON keys, stack frames, secrets, and prompt-like instructions), record missed-context guardrails, and treat image/request byte reductions as proxy evidence only.
+
+`context-guard experiments plan image-context-pack --json` emits deterministic planning metadata for that future work and no images, binary artifacts, evidence packs, replacement text, ledgers, listeners, proxy forwarding, model calls, OCR calls, or file writes. `visual-crop-ocr` remains the existing caller-supplied visual evidence-pack surface; `image-context-pack` is not a duplicate emitter and does not claim verified exact binary/image fallback. Provider/model-specific token or cost savings require matched successful tasks with provider-measured image/text token and cost fields before any hosted claim.
+
+Future PR checklist:
+- [ ] Keep `image-context-pack` plan-only unless a separate PR adds a verified runtime gate.
+- [ ] Verify exact text artifact fallback before any omitted text is used.
+- [ ] Deny protected zones, code, diffs, identifiers, paths, stack frames, numeric constants, hashes, JSON keys, secrets, and prompt-like instructions.
+- [ ] Record missed-context notes and human-review requirements.
+- [ ] Keep `visual-crop-ocr` as caller-supplied visual evidence only; do not duplicate it as an image-context-pack emitter.
+- [ ] Make no hosted token/cost savings claim from image/request byte reductions without provider-measured matched successful tasks.
+
 ### Opt-in local proxy constraints gate
 
 Local proxy constraints are opt-in and local-only. The shipped gate recorder is record-only, and the shipped forwarding MVP is one-shot literal-loopback HTTP forwarding only; any broader proxy behavior must require explicit user enablement, document the local service boundary, state **no hidden external forwarding**, and record shifted-cost accounting for local services, subagents, model servers, or proxy infrastructure. Proxy byte reductions, cache hits, or local latency changes are diagnostic evidence only.
@@ -99,11 +113,11 @@ Broader context-diff compaction remains gated if it would automatically generate
 
 Broader visual-token reduction remains gated if it would generate crops, invoke OCR/image models, prune visual tokens inside model architectures, replace full evidence without review, or claim provider savings.
 
-## Graduated plan-only experiment — pxpipe-inspired image-context-pack gate
+## Plan-only local experiment — image-context-pack gate
 
-`context-guard experiments plan image-context-pack --explicit-opt-in ...` is a pxpipe-inspired dry-run planning gate for future image/context packing evaluation. It emits deterministic JSON metadata only: no image rendering, screenshot capture, image parsing, OCR execution, binary image artifact storage, replacement text, provider/model call, proxy forwarding, or hosted savings claim.
+`context-guard experiments plan image-context-pack --json` is the plan-only control-plane marker for pxpipe-inspired image/context packing evaluation. It requires explicit provider-boundary acknowledgement, exact text fallback receipt/re-expand metadata, missed-context notes, and protected-zone denial before it can report `ready_for_plan_review`. It does not emit images, pack context, render PNGs, store binary/image artifacts, run OCR/image parsing/model calls, proxy traffic, write files, or change stable runtime behavior. Area or byte reductions in the plan are proxy-only diagnostics, not hosted token/cost savings evidence.
 
-The gate requires explicit opt-in, protected-zone denial for code/diffs/identifiers/hashes/paths/numeric constants/JSON keys/stack frames/secrets/prompt-like instructions, missed-context guardrails, a provider/model measurement boundary, and an exact text fallback receipt/re-expand handle that must be verified before omitted exact text is relied on. Image/request byte reductions are proxy evidence only until matched successful tasks include provider-measured token/cost fields. `visual-crop-ocr` remains the caller-supplied visual evidence-pack surface and is not a verified exact binary/image fallback; `image-context-pack` is not a duplicate emitter.
+Future runtime work remains gated by verified exact text fallback, protected-zone denial, missed-context review, and provider-measured matched successful tasks. The existing `visual-crop-ocr` lane remains the caller-supplied visual evidence-pack surface and is not a verified exact binary/image fallback.
 
 ## Graduated local experiment — learned-compression candidate emitter
 
@@ -174,5 +188,5 @@ First local runtime experiment: `context-guard experiments record self-hosted-me
 
 ## Current status
 
-This radar is intentionally conservative. The shipped ContextGuard tools remain local context hygiene, artifact receipts, context packing, tool-schema pruning, transcript audit, statusline visibility, benchmark evidence, plus the explicitly gated plan-only image-context-pack planner, local context-diff emitter, visual crop/OCR evidence-pack emitter, learned-compression candidate emitter, and self-hosted metrics sidecar recorder described above. Package-visible starter scaffolds live in [`../docs/experimental-benchmark-fixtures.md`](../docs/experimental-benchmark-fixtures.md). They are fixture-only synthetic task/variant examples and dry-run-only starters until prompts and success checks are replaced for a real experiment; they are not shipped runtime helpers, benchmark results, or hosted API savings evidence.
+This radar is intentionally conservative. The shipped ContextGuard tools remain local context hygiene, artifact receipts, context packing, tool-schema pruning, transcript audit, statusline visibility, benchmark evidence, plus the explicitly gated local context-diff emitter, visual crop/OCR evidence-pack emitter, plan-only image-context-pack gate, learned-compression candidate emitter, and self-hosted metrics sidecar recorder described above. Package-visible starter scaffolds live in [`../docs/experimental-benchmark-fixtures.md`](../docs/experimental-benchmark-fixtures.md). They are fixture-only synthetic task/variant examples and dry-run-only starters until prompts and success checks are replaced for a real experiment; they are not shipped runtime helpers, benchmark results, or hosted API savings evidence.
 Future experiments must pass the gates above before becoming product features.
diff --git a/tests/test_context_guard_kit.py b/tests/test_context_guard_kit.py
index 1560091..00fabcb 100644
--- a/tests/test_context_guard_kit.py
+++ b/tests/test_context_guard_kit.py
@@ -8895,6 +8895,8 @@ def test_experimental_token_reduction_radar_claim_discipline(self):
         for phrase in [
             "learned prompt/context compression",
             "multimodal crop, ocr",
+            "image-context-pack",
+            "pxpipe-inspired",
             "visual-token",
             "image-context-pack",
             "pxpipe-inspired",
@@ -8912,6 +8914,8 @@ def test_experimental_token_reduction_radar_claim_discipline(self):
             "failure-rate guardrail",
             "human-correction tracking",
             "shifted-cost accounting",
+            "verified exact text fallback",
+            "provider-measured matched successful tasks",
         ]:
             with self.subTest(claim_gate=claim_gate):
                 self.assertIn(claim_gate, plain_text)

From 23bd1dd15010bfb52980a74dcbf0afba153f4062 Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 11:59:42 +0900
Subject: [PATCH 08/29] omx(team): auto-checkpoint worker-1 [1]

---
 .../bin/context-guard-experiments             | 232 ++++++++++--------
 1 file changed, 135 insertions(+), 97 deletions(-)

diff --git a/plugins/context-guard/bin/context-guard-experiments b/plugins/context-guard/bin/context-guard-experiments
index a190849..eb5880b 100755
--- a/plugins/context-guard/bin/context-guard-experiments
+++ b/plugins/context-guard/bin/context-guard-experiments
@@ -67,9 +67,8 @@ LOCAL_PROXY_DIAGNOSTIC_SCHEMA_VERSION = "contextguard.experiments.local-proxy-fo
 LOCAL_PROXY_READY_SCHEMA_VERSION = "contextguard.experiments.local-proxy-ready.v1"
 LOCAL_PROXY_EXTERNAL_DESIGN_SCHEMA_VERSION = "contextguard.experiments.local-proxy-external-forwarding-design.v1"
 LOCAL_PROXY_RESPONSE_SANDBOX_SCHEMA_VERSION = "contextguard.experiments.local-proxy-response-sandbox.v1"
-IMAGE_CONTEXT_PACK_SCHEMA_VERSION = "contextguard.experiments.image-context-pack-plan.v1"
+IMAGE_CONTEXT_PACK_PLAN_SCHEMA_VERSION = "contextguard.experiments.image-context-pack-plan.v1"
 IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY = "provider-measured-matched-tasks-required"
-IMAGE_CONTEXT_PACK_PROTECTED_POLICY = "deny"
 LOCAL_PROXY_DEFAULT_BIND_HOST = "127.0.0.1"
 LOCAL_PROXY_DEFAULT_BIND_PORT = 0
 LOCAL_PROXY_DEFAULT_TARGET_HOST = "127.0.0.1"
@@ -264,44 +263,49 @@ EXPERIMENTS: tuple[Experiment, ...] = (
     ),
     Experiment(
         id="image-context-pack",
-        name="Plan-only image context pack evaluation gate",
-        summary="Pxpipe-inspired, explicit-only planning gate for future image/context packing experiments; emits no images or replacements.",
+        name="Pxpipe-inspired image context pack planning gate",
+        summary=(
+            "Plan-only evaluation gate for pxpipe-inspired image/context packing without rendering images, "
+            "emitting visual artifacts, or changing runtime behavior."
+        ),
         stability="experimental",
         default_enabled=False,
         risk_level="high",
         claim_boundary=(
-            "Image/request byte reductions are proxy evidence only until provider-measured matched successful "
-            "tasks prove token/cost deltas."
+            "Image/request byte reductions are proxy evidence only; hosted token/cost savings require "
+            "provider-measured matched successful tasks."
         ),
         gate_requirements=(
             "explicit opt-in",
-            "verified exact text artifact fallback before relying on omitted text",
+            "verified exact text artifact fallback before omitted text is used",
             "protected-zone denial",
             "provider/model measurement boundary",
             "missed-context guardrails",
-            "relation_to_visual_crop_ocr: visual-crop-ocr remains caller-supplied visual evidence, not an exact binary fallback",
+            "relation to visual-crop-ocr",
         ),
         runtime_status="available-plan-only",
         commands=("context-guard experiments plan image-context-pack",),
         opt_in_flags=(
             "plan image-context-pack",
-            "--explicit-opt-in",
-            "--exact-text-receipt",
+            "--exact-text-fallback-receipt",
             "--reexpand-command",
+            "--provider-boundary-ack",
             "--protected-zone-policy deny",
-            "--provider-measurement-boundary provider-measured-matched-tasks-required",
             "--missed-context-note",
+            "--image-size",
+            "--packed-image-size",
         ),
         config_effect=(
-            "Registry enablement records project-local intent only; image-context-pack is plan-only and never "
-            "renders images, runs OCR, emits replacements, stores binary image artifacts, calls providers, or proxies traffic."
+            "Registry enablement records project-local intent only; image-context-pack exposes only a deterministic "
+            "plan command. It does not add an emit/record/serve runtime, render images, run OCR, call models, proxy "
+            "traffic, write binary artifacts, or duplicate the caller-supplied visual-crop-ocr evidence-pack emitter."
         ),
         evidence_contract=(
-            "Plan output requires explicit opt-in, an exact text fallback receipt/re-expand handle that must be "
-            "verified before omitted text is relied on, protected-zone denial, provider/model measurement boundaries, "
-            "and missed-context notes. relation_to_visual_crop_ocr: existing visual-crop-ocr packs are caller-supplied "
-            "visual evidence and are not verified exact binary/image fallback; image-context-pack is an inspired "
-            "evaluation planning gate, not a duplicate emitter."
+            "Plans require explicit opt-in, exact text fallback receipt/re-expand metadata before omitted exact text "
+            "is used, protected-zone denial for code/diffs/identifiers/hashes/paths/numeric constants/JSON keys/"
+            "stack frames/secrets/prompt-like instructions, provider/model measured matched-task boundaries, "
+            "missed-context guardrails, and an explicit relation_to_visual_crop_ocr statement: visual-crop-ocr "
+            "remains caller-supplied visual evidence only and is not a verified exact binary/image fallback."
         ),
     ),
     Experiment(
@@ -1780,77 +1784,99 @@ def command_plan_visual_crop_ocr(args: argparse.Namespace) -> int:
     return 0
 
 
+def image_context_pack_size_payload(raw: str | None) -> tuple[dict[str, Any] | None, bool]:
+    size = parse_int_tuple(raw, count=2)
+    if raw is None or not str(raw).strip():
+        return None, True
+    if size is None:
+        return None, False
+    width, height = size
+    if width <= 0 or height <= 0:
+        return {"width": width, "height": height}, False
+    return {"width": width, "height": height}, True
+
+
 def image_context_pack_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
-    exact_text_receipt = args.exact_text_receipt.strip() if args.exact_text_receipt else None
+    receipt_id = args.exact_text_fallback_receipt.strip() if args.exact_text_fallback_receipt else None
     reexpand_command = args.reexpand_command.strip() if args.reexpand_command else None
-    provider_boundary = args.provider_measurement_boundary.strip() if args.provider_measurement_boundary else None
-    protected_policy = args.protected_zone_policy.strip().lower() if args.protected_zone_policy else None
+    reexpand_valid, fallback_blocker = valid_learned_reexpand_command(receipt_id, reexpand_command)
+    fallback_blocker_map = {
+        "missing_exact_fallback": "missing_exact_text_fallback",
+        "invalid_reexpand_command": "invalid_exact_text_reexpand_command",
+    }
+    source_size, source_size_valid = image_context_pack_size_payload(args.image_size)
+    packed_size, packed_size_valid = image_context_pack_size_payload(args.packed_image_size)
     missed_context_notes = clean_values(args.missed_context_note)
-    pack_label = args.pack_label.strip() if args.pack_label else None
-
-    image_size = parse_int_tuple(args.image_size, count=2) if args.image_size else None
-    image_size_valid = True
-    image_payload = None
-    if args.image_size:
-        if image_size is None:
-            image_size_valid = False
-        else:
-            width, height = image_size
-            image_size_valid = width > 0 and height > 0
-            image_payload = {"width": width, "height": height}
+    protected_policy = (args.protected_zone_policy or "deny").strip().lower()
 
     blockers: list[str] = []
-    if not args.explicit_opt_in:
-        blockers.append("missing_explicit_opt_in")
-    if not (exact_text_receipt and reexpand_command):
-        blockers.append("missing_exact_text_fallback")
-    if protected_policy != IMAGE_CONTEXT_PACK_PROTECTED_POLICY:
-        blockers.append("protected_zone_policy_not_deny")
-    if provider_boundary != IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY:
+    if fallback_blocker:
+        blockers.append(fallback_blocker_map.get(fallback_blocker, fallback_blocker))
+    if not args.provider_boundary_ack:
         blockers.append("missing_provider_measurement_boundary")
     if not missed_context_notes:
         blockers.append("missing_missed_context_note")
-    if not image_size_valid:
+    if protected_policy != "deny":
+        blockers.append("protected_zone_denial_required")
+    if not source_size_valid:
         blockers.append("invalid_image_size")
-
+    if not packed_size_valid:
+        blockers.append("invalid_packed_image_size")
     blockers = list(dict.fromkeys(blockers))
-    status = "ready_for_design_review" if not blockers else "blocked_until_image_context_pack_gate_ready"
+
+    source_area = source_size["width"] * source_size["height"] if source_size and source_size_valid else None
+    packed_area = packed_size["width"] * packed_size["height"] if packed_size and packed_size_valid else None
+    area_delta = source_area - packed_area if source_area is not None and packed_area is not None else None
+    ready = not blockers
+
     return {
         "tool": TOOL_NAME,
-        "schema_version": IMAGE_CONTEXT_PACK_SCHEMA_VERSION,
+        "schema_version": CONFIG_SCHEMA_VERSION,
+        "plan_schema_version": IMAGE_CONTEXT_PACK_PLAN_SCHEMA_VERSION,
         "experiment_id": "image-context-pack",
         "mode": "dry_run",
-        "status": status,
-        "pack_label": pack_label,
-        "explicit_opt_in": bool(args.explicit_opt_in),
-        "side_effects": {
-            "stable_runtime_behavior_changed": False,
-            "image_rendering": False,
-            "image_parsing": False,
-            "ocr_execution": False,
+        "status": "ready_for_plan_review" if ready else "blocked_until_image_context_pack_gate_ready",
+        "plan_only": {
+            "command_advertised": True,
+            "emit_command_available": False,
+            "record_command_available": False,
+            "serve_command_available": False,
+            "runtime_behavior_changed": False,
+            "replacement_or_visual_evidence_emitted": False,
+        },
+        "external_services": {
+            "called": False,
+            "network": False,
             "model_calls": False,
-            "provider_calls": False,
+            "ocr_service": None,
+            "image_service": None,
             "proxy_forwarding": False,
-            "binary_artifact_storage": False,
-            "replacement_emitted": False,
+        },
+        "runtime_side_effects": {
             "files_written": False,
+            "image_rendering": False,
+            "ocr_execution": False,
+            "image_parsing": False,
+            "binary_artifacts_written": False,
+            "proxy_forwarding": False,
+            "stable_runtime_behavior_changed": False,
         },
-        "exact_text_fallback": {
+        "text_fallback": {
             "required": True,
-            "available": bool(exact_text_receipt and reexpand_command),
-            "receipt_id": exact_text_receipt,
-            "cli": reexpand_command,
+            "available": bool(reexpand_valid),
+            "receipt_id": receipt_id,
+            "reexpand_command": reexpand_command,
             "verified": False,
-            "verification_required_before_use": True,
+            "must_be_verified_before_omitted_text_is_used": True,
             "note": (
-                "This plan records the exact text fallback handle only. A future runtime must verify the local "
-                "text artifact before relying on any omitted exact text."
+                "This dry-run validates only local receipt/re-expand shape. A future runtime must verify exact "
+                "text artifact content before relying on omitted exact text."
             ),
         },
         "protected_zones": {
             "policy": protected_policy,
-            "deny_required": True,
-            "protected_classes": [
+            "override_allowed": False,
+            "denied_classes": [
                 "code",
                 "diffs",
                 "identifiers",
@@ -1863,36 +1889,43 @@ def image_context_pack_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
                 "prompt_like_instructions",
             ],
         },
+        "image_pack_plan": {
+            "source_label": sanitize_self_hosted_text(args.source_label) if args.source_label else "manual-plan",
+            "source_image_size": source_size,
+            "packed_image_size": packed_size,
+            "source_area": source_area,
+            "packed_area": packed_area,
+            "area_delta": area_delta,
+            "area_reduction_is_proxy_only": area_delta is not None,
+            "image_or_request_byte_reductions_are_proxy_evidence_only": True,
+        },
         "measurement_boundary": {
-            "provider_model_measurement_required": True,
-            "required_value": IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY,
-            "provided_value": provider_boundary,
-            "image_request_byte_reductions_proxy_only": True,
-            "hosted_token_or_cost_savings_claim_allowed": False,
+            "provider_boundary_acknowledged": bool(args.provider_boundary_ack),
+            "provider_boundary_policy": IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY,
+            "provider_measured_matched_tasks_required_for_hosted_claims": True,
+            "provider_model_specific": True,
+            "hosted_api_token_savings_claim_allowed": False,
+            "hosted_api_cost_savings_claim_allowed": False,
         },
-        "image_context_plan": {
-            "image_size": image_payload,
-            "image_size_valid": image_size_valid,
-            "rendering_planned": False,
-            "target_artifact": None,
+        "relation_to_visual_crop_ocr": {
+            "visual_crop_ocr_is_existing_surface": True,
+            "visual_crop_ocr_remains_caller_supplied_visual_evidence_pack": True,
+            "image_context_pack_is_planning_gate_not_duplicate_emitter": True,
+            "verified_exact_binary_or_image_fallback_claimed": False,
         },
-        "relation_to_visual_crop_ocr": (
-            "visual-crop-ocr remains the caller-supplied visual evidence pack surface and is not a verified "
-            "exact binary/image fallback; image-context-pack is a pxpipe-inspired planning gate, not an emitter."
-        ),
         "review_plan": {
             "readiness_blockers": blockers,
             "missed_context_notes": missed_context_notes,
             "next_steps": [
-                "Verify exact text fallback artifact content before any future omitted text is relied on.",
-                "Deny protected zones before evaluating image-context packing.",
-                "Collect provider/model measured matched-task token and cost fields before any hosted savings claim.",
-                "Use visual-crop-ocr only for caller-supplied visual evidence packs; do not duplicate it as an emitter.",
+                "Keep exact text artifact fallback verified before any future image/context packing omits source text.",
+                "Deny protected evidence zones before any future lossy visual packing is considered.",
+                "Measure provider/model token and cost fields on matched successful tasks before any hosted savings claim.",
+                "Use visual-crop-ocr only for caller-supplied visual evidence packs; this gate emits no images or evidence.",
             ],
         },
         "claim_boundary": (
-            "Plan-only image-context-pack evaluation; image/request byte reductions are proxy evidence only and "
-            "are not hosted API token or cost savings evidence without provider-measured matched successful tasks."
+            "Dry-run image-context-pack planning only; image/request byte reductions are proxy evidence and no hosted "
+            "token/cost savings claim is allowed without provider-measured matched successful tasks."
         ),
         "candidate_replacement": None,
     }
@@ -1904,9 +1937,8 @@ def command_plan_image_context_pack(args: argparse.Namespace) -> int:
         emit_json(payload)
     else:
         print("ContextGuard image-context-pack plan (dry-run only)")
-        print("No image was rendered, parsed, stored, emitted, or sent to a provider/proxy.")
+        print("No image rendering, OCR/image service, model call, proxy forwarding, binary artifact, or replacement was emitted.")
         print(f"Status: {payload['status']}")
-        print(f"Exact text fallback available: {payload['exact_text_fallback']['available']} verified=false")
         if payload["review_plan"]["readiness_blockers"]:
             print(f"Readiness blockers: {', '.join(payload['review_plan']['readiness_blockers'])}")
         print(payload["claim_boundary"])
@@ -4647,19 +4679,25 @@ def build_parser() -> argparse.ArgumentParser:
 
     image_context_pack = plan_sub.add_parser(
         "image-context-pack",
-        help="Dry-run a plan-only image/context packing evaluation gate without rendering images or emitting replacements.",
+        help="Dry-run a plan-only pxpipe-inspired image/context packing gate without rendering images.",
+    )
+    image_context_pack.add_argument("--source-label", help="Safe label for this image/context packing plan.")
+    image_context_pack.add_argument("--image-size", help="Optional source image/context canvas size as width,height integers.")
+    image_context_pack.add_argument("--packed-image-size", help="Optional planned packed image size as width,height integers.")
+    image_context_pack.add_argument("--exact-text-fallback-receipt", help="Local exact text artifact receipt id for omitted source text.")
+    image_context_pack.add_argument("--reexpand-command", help="Local exact text re-expand command bound to the receipt id.")
+    image_context_pack.add_argument(
+        "--provider-boundary-ack",
+        action="store_true",
+        help="Acknowledge hosted claims require provider-measured matched successful tasks for the target model.",
     )
-    image_context_pack.add_argument("--explicit-opt-in", action="store_true", help="Acknowledge this is an explicit plan-only experimental gate.")
-    image_context_pack.add_argument("--exact-text-receipt", help="Local exact text artifact receipt/id required before omitted text can be relied on.")
-    image_context_pack.add_argument("--reexpand-command", help="Local command that re-expands the exact text artifact.")
-    image_context_pack.add_argument("--protected-zone-policy", help="Must be 'deny'; protected exact evidence cannot be image-packed.")
     image_context_pack.add_argument(
-        "--provider-measurement-boundary",
-        help=f"Must be '{IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY}' before any hosted token/cost claim.",
+        "--protected-zone-policy",
+        default="deny",
+        choices=("deny", "allow"),
+        help="Protected evidence handling; only deny can pass the plan gate.",
     )
-    image_context_pack.add_argument("--missed-context-note", action="append", help="Potential missed-context guardrail note. Repeatable.")
-    image_context_pack.add_argument("--image-size", help="Optional planned image size as width,height positive integers; metadata only.")
-    image_context_pack.add_argument("--pack-label", help="Safe label for this planning gate.")
+    image_context_pack.add_argument("--missed-context-note", action="append", help="Potential context omitted by a future pack. Repeatable.")
     image_context_pack.add_argument("--json", action="store_true", help="Emit JSON output.")
     image_context_pack.set_defaults(func=command_plan_image_context_pack)
 
@@ -4953,7 +4991,7 @@ def normalize_negative_csv_option_values(argv: list[str] | None) -> list[str] |
         argv = sys.argv[1:]
     normalized: list[str] = []
     pending_csv_option: str | None = None
-    csv_options = {"--crop-bounds", "--image-size"}
+    csv_options = {"--crop-bounds", "--image-size", "--packed-image-size"}
     for token in argv:
         if pending_csv_option is not None:
             normalized.append(f"{pending_csv_option}={token}")

From 6bbeb609899e75b6d0663cc9754ffd2e031ab587 Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 11:59:42 +0900
Subject: [PATCH 09/29] omx(team): auto-checkpoint worker-3 [3]

---
 tests/test_context_guard_kit.py | 238 +++++++++++++++++---------------
 1 file changed, 128 insertions(+), 110 deletions(-)

diff --git a/tests/test_context_guard_kit.py b/tests/test_context_guard_kit.py
index 00fabcb..eaef53b 100644
--- a/tests/test_context_guard_kit.py
+++ b/tests/test_context_guard_kit.py
@@ -2830,115 +2830,152 @@ def test_experimental_visual_crop_ocr_dispatcher_and_no_service_surface(self):
             self.assertNotIn(forbidden, source)
         self.assertIn("LOCAL_PROXY_FORWARD_SCHEMA_VERSION", source)
 
-    def test_experimental_image_context_pack_plan_only_gate(self):
-        valid_args = [
+    def test_experimental_image_context_pack_plan_only_gate_json_contract(self):
+        receipt_id = "abcdef1234567890"
+        ready_args = [
             "plan",
             "image-context-pack",
-            "--explicit-opt-in",
-            "--exact-text-receipt",
-            "text-receipt-123",
+            "--evaluation-intent-ack",
+            "--exact-text-fallback-ack",
+            "--text-fallback-receipt",
+            receipt_id,
             "--reexpand-command",
-            "context-guard-artifact get text-receipt-123 --full",
-            "--protected-zone-policy",
-            "deny",
-            "--provider-measurement-boundary",
-            "provider-measured-matched-tasks-required",
-            "--missed-context-note",
-            "layout and color relationships omitted from text fallback",
-            "--image-size",
-            "800,600",
+            f"context-guard-artifact get {receipt_id} --full",
+            "--protected-zone-deny-ack",
+            "--provider-measurement-boundary-ack",
+            "--missed-context-guardrail-ack",
+            "--visual-crop-ocr-relation-ack",
+            "--proposed-image-size",
+            "640,480",
             "--json",
         ]
         for script in EXPERIMENT_SCRIPTS:
             with self.subTest(script=script):
-                proc = subprocess.run(
-                    [sys.executable, str(script), *valid_args],
+                blocked = subprocess.run(
+                    [sys.executable, str(script), "plan", "image-context-pack", "--json"],
                     text=True,
                     capture_output=True,
                     check=True,
-                    cwd=ROOT,
                 )
-                payload = json.loads(proc.stdout)
-                self.assertEqual(payload["schema_version"], "contextguard.experiments.image-context-pack-plan.v1")
-                self.assertEqual(payload["experiment_id"], "image-context-pack")
-                self.assertEqual(payload["status"], "ready_for_design_review")
-                self.assertEqual(payload["mode"], "dry_run")
-                self.assertIsNone(payload["candidate_replacement"])
-                self.assertEqual(payload["review_plan"]["readiness_blockers"], [])
-                self.assertTrue(payload["explicit_opt_in"])
-                self.assertTrue(payload["exact_text_fallback"]["available"])
-                self.assertFalse(payload["exact_text_fallback"]["verified"])
-                self.assertTrue(payload["exact_text_fallback"]["verification_required_before_use"])
-                self.assertEqual(payload["protected_zones"]["policy"], "deny")
-                self.assertIn("prompt_like_instructions", payload["protected_zones"]["protected_classes"])
-                self.assertEqual(
-                    payload["measurement_boundary"]["provided_value"],
-                    "provider-measured-matched-tasks-required",
-                )
-                self.assertFalse(payload["measurement_boundary"]["hosted_token_or_cost_savings_claim_allowed"])
-                self.assertTrue(payload["measurement_boundary"]["image_request_byte_reductions_proxy_only"])
-                self.assertFalse(payload["image_context_plan"]["rendering_planned"])
-                self.assertEqual(payload["image_context_plan"]["image_size"], {"width": 800, "height": 600})
-                for key in (
-                    "image_rendering",
-                    "image_parsing",
-                    "ocr_execution",
-                    "model_calls",
-                    "provider_calls",
-                    "proxy_forwarding",
-                    "binary_artifact_storage",
-                    "replacement_emitted",
-                    "files_written",
-                ):
-                    self.assertFalse(payload["side_effects"][key])
-                self.assertIn("visual-crop-ocr remains", payload["relation_to_visual_crop_ocr"])
-                self.assertIn("not a verified exact binary/image fallback", payload["relation_to_visual_crop_ocr"])
-                self.assertIn("provider-measured matched successful tasks", payload["claim_boundary"])
+                blocked_payload = json.loads(blocked.stdout)
+                self.assertEqual(blocked_payload["tool"], "context-guard-experiments")
+                self.assertEqual(blocked_payload["schema_version"], "contextguard.experiments.v1")
+                self.assertEqual(blocked_payload["experiment_id"], "image-context-pack")
+                self.assertEqual(blocked_payload["mode"], "dry_run")
+                self.assertEqual(blocked_payload["status"], "blocked_until_plan_constraints")
+                self.assertIn("missing_evaluation_intent_ack", blocked_payload["review_plan"]["readiness_blockers"])
+                self.assertIn("missing_exact_text_fallback_ack", blocked_payload["review_plan"]["readiness_blockers"])
+                self.assertIn("missing_exact_fallback", blocked_payload["review_plan"]["readiness_blockers"])
+                self.assertIn("missing_protected_zone_deny_ack", blocked_payload["review_plan"]["readiness_blockers"])
+                self.assertIn("missing_provider_measurement_boundary_ack", blocked_payload["review_plan"]["readiness_blockers"])
+                self.assertIn("missing_missed_context_guardrail_ack", blocked_payload["review_plan"]["readiness_blockers"])
+                self.assertIn("missing_visual_crop_ocr_relation_ack", blocked_payload["review_plan"]["readiness_blockers"])
+                self.assertFalse(blocked_payload["policy"]["emit_runtime_implemented"])
+                self.assertFalse(blocked_payload["policy"]["image_rendering_allowed"])
+                self.assertFalse(blocked_payload["policy"]["ocr_allowed"])
+                self.assertFalse(blocked_payload["policy"]["model_call_allowed"])
+                self.assertFalse(blocked_payload["policy"]["provider_call_allowed"])
+                self.assertFalse(blocked_payload["policy"]["proxy_forwarding_allowed"])
+                self.assertFalse(blocked_payload["policy"]["binary_artifact_storage_allowed"])
+                self.assertFalse(blocked_payload["external_services"]["called"])
+                self.assertFalse(blocked_payload["network_actions"]["traffic_forwarded"])
+                self.assertFalse(blocked_payload["file_system_actions"]["files_written"])
+                self.assertFalse(blocked_payload["file_system_actions"]["binary_artifacts_written"])
+                self.assertIsNone(blocked_payload["candidate_replacement"])
+                self.assertNotIn("evidence_pack", blocked_payload)
+                self.assertNotIn("artifact_path", json.dumps(blocked_payload))
+                self.assertIn("visual-crop-ocr", blocked_payload["relation_to_visual_crop_ocr"]["note"])
+                self.assertFalse(blocked_payload["relation_to_visual_crop_ocr"]["duplicate_emitter"])
+                self.assertFalse(blocked_payload["relation_to_visual_crop_ocr"]["visual_handles_verified_exact_binary_fallback"])
+                self.assertIn("no image rendering", blocked_payload["claim_boundary"].lower())
+                self.assertIn("hosted token/cost savings", blocked_payload["claim_boundary"].lower())
+
+                with tempfile.TemporaryDirectory() as tmp:
+                    root = Path(tmp)
+                    before = sorted(path.relative_to(root).as_posix() for path in root.rglob("*"))
+                    first = subprocess.run(
+                        [sys.executable, str(script), *ready_args],
+                        cwd=root,
+                        text=True,
+                        capture_output=True,
+                        check=True,
+                    )
+                    second = subprocess.run(
+                        [sys.executable, str(script), *ready_args],
+                        cwd=root,
+                        text=True,
+                        capture_output=True,
+                        check=True,
+                    )
+                    self.assertEqual(json.loads(first.stdout), json.loads(second.stdout))
+                    ready_payload = json.loads(first.stdout)
+                    self.assertEqual(ready_payload["status"], "ready_for_experiment_design_review")
+                    self.assertEqual(ready_payload["review_plan"]["readiness_blockers"], [])
+                    self.assertTrue(ready_payload["exact_text_fallback"]["available"])
+                    self.assertFalse(ready_payload["exact_text_fallback"]["verified"])
+                    self.assertTrue(ready_payload["exact_text_fallback"]["verified_before_use_required"])
+                    self.assertEqual(ready_payload["proposed_image_context_pack"]["image_size"]["width"], 640)
+                    self.assertFalse(ready_payload["proposed_image_context_pack"]["render_performed"])
+                    self.assertFalse(ready_payload["proposed_image_context_pack"]["binary_receipt_created"])
+                    after = sorted(path.relative_to(root).as_posix() for path in root.rglob("*"))
+                    self.assertEqual(after, before)
 
-                missing_boundary = subprocess.run(
+                invalid_size = subprocess.run(
                     [
                         sys.executable,
                         str(script),
                         "plan",
                         "image-context-pack",
-                        "--explicit-opt-in",
-                        "--exact-text-receipt",
-                        "text-receipt-123",
+                        "--evaluation-intent-ack",
+                        "--exact-text-fallback-ack",
+                        "--text-fallback-receipt",
+                        receipt_id,
                         "--reexpand-command",
-                        "context-guard-artifact get text-receipt-123 --full",
-                        "--protected-zone-policy",
-                        "deny",
-                        "--missed-context-note",
-                        "note",
+                        f"context-guard-artifact get {receipt_id} --full",
+                        "--protected-zone-deny-ack",
+                        "--provider-measurement-boundary-ack",
+                        "--missed-context-guardrail-ack",
+                        "--visual-crop-ocr-relation-ack",
+                        "--proposed-image-size",
+                        "20000,10",
                         "--json",
                     ],
                     text=True,
                     capture_output=True,
                     check=True,
-                    cwd=ROOT,
                 )
-                self.assertIn(
-                    "missing_provider_measurement_boundary",
-                    json.loads(missing_boundary.stdout)["review_plan"]["readiness_blockers"],
+                self.assertIn("invalid_proposed_image_size", json.loads(invalid_size.stdout)["review_plan"]["readiness_blockers"])
+
+                emit = subprocess.run(
+                    [sys.executable, str(script), "emit", "image-context-pack", "--json"],
+                    text=True,
+                    capture_output=True,
                 )
+                self.assertNotEqual(emit.returncode, 0)
+                self.assertIn("invalid choice", emit.stderr)
+                self.assertNotIn("Traceback", emit.stderr + emit.stdout)
 
-                override = subprocess.run(
+    def test_experimental_image_context_pack_dispatcher_and_no_runtime_surface(self):
+        receipt_id = "abcdef1234567890"
+        for dispatcher in (KIT_DIR / "context_guard_cli.py", PLUGIN_BIN / "context-guard"):
+            with self.subTest(dispatcher=dispatcher):
+                proc = subprocess.run(
                     [
                         sys.executable,
-                        str(script),
+                        str(dispatcher),
+                        "experiments",
                         "plan",
                         "image-context-pack",
-                        "--explicit-opt-in",
-                        "--exact-text-receipt",
-                        "text-receipt-123",
+                        "--evaluation-intent-ack",
+                        "--exact-text-fallback-ack",
+                        "--text-fallback-receipt",
+                        receipt_id,
                         "--reexpand-command",
-                        "context-guard-artifact get text-receipt-123 --full",
-                        "--protected-zone-policy",
-                        "allow",
-                        "--provider-measurement-boundary",
-                        "provider-measured-matched-tasks-required",
-                        "--missed-context-note",
-                        "note",
+                        f"context-guard-artifact get {receipt_id} --full",
+                        "--protected-zone-deny-ack",
+                        "--provider-measurement-boundary-ack",
+                        "--missed-context-guardrail-ack",
+                        "--visual-crop-ocr-relation-ack",
                         "--json",
                     ],
                     text=True,
@@ -2946,48 +2983,29 @@ def test_experimental_image_context_pack_plan_only_gate(self):
                     check=True,
                     cwd=ROOT,
                 )
-                self.assertIn(
-                    "protected_zone_policy_not_deny",
-                    json.loads(override.stdout)["review_plan"]["readiness_blockers"],
-                )
-
-                malformed_image = subprocess.run(
-                    [sys.executable, str(script), *valid_args[:-2], "0,600", "--json"],
-                    text=True,
-                    capture_output=True,
-                    check=True,
-                    cwd=ROOT,
-                )
-                self.assertIn(
-                    "invalid_image_size",
-                    json.loads(malformed_image.stdout)["review_plan"]["readiness_blockers"],
-                )
-
-                emit_proc = subprocess.run(
-                    [sys.executable, str(script), "emit", "image-context-pack", "--json"],
-                    text=True,
-                    capture_output=True,
-                    cwd=ROOT,
-                )
-                self.assertNotEqual(emit_proc.returncode, 0)
-                self.assertIn("invalid choice", emit_proc.stderr)
+                payload = json.loads(proc.stdout)
+                self.assertEqual(payload["experiment_id"], "image-context-pack")
+                self.assertEqual(payload["status"], "ready_for_experiment_design_review")
+                self.assertFalse(payload["policy"]["emit_runtime_implemented"])
+                self.assertFalse(payload["policy"]["image_rendering_allowed"])
+                self.assertFalse(payload["policy"]["ocr_allowed"])
+                self.assertFalse(payload["external_services"]["called"])
 
         package = json.loads((ROOT / "package.json").read_text(encoding="utf-8"))
+        command_manifest_text = (KIT_DIR / "context_guard_commands.py").read_text(encoding="utf-8")
         for name in (
             "context-guard-image-context-pack",
-            "context-guard-image-pack",
-            "context-guard-render",
-            "context-guard-image-parser",
+            "context-guard-image-context-pack-emit",
             "context-guard-ocr",
             "context-guard-crop",
             "context-guard-visual-token",
+            "context-guard-image-render",
+            "context-guard-renderer",
+            "context-guard-proxy-image",
         ):
             self.assertNotIn(name, package["bin"])
+            self.assertNotIn(name, command_manifest_text)
             self.assertFalse((PLUGIN_BIN / name).exists())
-        source = (KIT_DIR / "experimental_registry.py").read_text(encoding="utf-8")
-        self.assertNotIn("def command_emit_image_context_pack", source)
-        for forbidden in ("import requests", "urllib.request", "import subprocess"):
-            self.assertNotIn(forbidden, source)
 
     def test_experimental_visual_crop_ocr_emit_runtime(self):
         for script in EXPERIMENT_SCRIPTS:

From 385aa5b5c57df55b5d643faa4873cc4ca4214eb5 Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 12:00:13 +0900
Subject: [PATCH 10/29] omx(team): auto-checkpoint worker-2 [2]

---
 .claude/settings.json | 67 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 .claude/settings.json

diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 0000000..ac9d840
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,67 @@
+{
+  "model": "sonnet",
+  "effortLevel": "medium",
+  "statusLine": {
+    "type": "command",
+    "command": "bash context-guard-kit/statusline_merged.sh"
+  },
+  "permissions": {
+    "deny": [
+      "Read(./node_modules/**)",
+      "Read(./dist/**)",
+      "Read(./build/**)",
+      "Read(./coverage/**)",
+      "Read(./logs/**)",
+      "Read(./tmp/**)",
+      "Read(./target/**)",
+      "Read(./.next/**)",
+      "Read(./.venv/**)",
+      "Read(./vendor/**)",
+      "Read(./.npmrc)",
+      "Read(./.pypirc)",
+      "Read(./.netrc)",
+      "Read(./.context-guard/**)",
+      "Read(./.claude-token-optimizer/**)",
+      "Read(./.env)",
+      "Read(./.env.*)",
+      "Read(~/.ssh/**)",
+      "Read(~/.aws/**)",
+      "Read(~/.gnupg/**)",
+      "Read(~/.kube/**)",
+      "Read(~/.docker/**)"
+    ]
+  },
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 context-guard-kit/rewrite_bash_for_token_budget.py"
+          }
+        ]
+      },
+      {
+        "matcher": "Read",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 context-guard-kit/guard_large_read.py"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 context-guard-kit/failed_attempt_nudge.py"
+          }
+        ]
+      }
+    ]
+  }
+}

From 5eebbb0ff24f2eb63b4f070511dbc745f631780f Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 12:00:13 +0900
Subject: [PATCH 11/29] omx(team): auto-checkpoint worker-3 [3]

---
 tests/test_context_guard_kit.py | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/tests/test_context_guard_kit.py b/tests/test_context_guard_kit.py
index eaef53b..ba94716 100644
--- a/tests/test_context_guard_kit.py
+++ b/tests/test_context_guard_kit.py
@@ -6959,6 +6959,30 @@ def test_experimental_local_proxy_docs_surface_boundary(self):
                 self.assertRegex(text, r"raw headers?|raw bodies|raw header/body|request bodies|response bodies|원문 header|원문 body")
                 self.assertRegex(text, r"hosted.*savings|hosted api 절감")
 
+    def test_experimental_image_context_pack_docs_surface_boundary(self):
+        docs = (
+            ROOT / "README.md",
+            ROOT / "README.ko.md",
+            PLUGIN_DIR / "README.md",
+            PLUGIN_DIR / "README.ko.md",
+            KIT_DIR / "README.md",
+            ROOT / "research" / "experimental-token-reduction-radar.md",
+        )
+        for doc in docs:
+            with self.subTest(doc=doc):
+                text = doc.read_text(encoding="utf-8").lower()
+                self.assertIn("image-context-pack", text)
+                self.assertIn("visual-crop-ocr", text)
+                self.assertRegex(text, r"plan-only|plan only|dry-run|드라이런|plan 전용")
+                self.assertRegex(text, r"caller-supplied|호출자|사용자")
+                self.assertRegex(text, r"exact text|exact .*text|정확한 text|정확한 텍스트")
+                self.assertRegex(text, r"protected-zone|protected zone|보호")
+                self.assertRegex(text, r"provider-measured|provider.*measured|provider가 측정")
+                self.assertRegex(text, r"hosted.*savings|hosted api 절감|token/cost savings")
+                self.assertRegex(text, r"does not (?:render|run ocr|call|proxy|store binary)|no image rendering|ocr.*하지|proxy.*하지|binary")
+                self.assertNotIn("emit image-context-pack", text)
+                self.assertNotIn("context-guard-image-context-pack", text)
+
     def test_experimental_registry_dispatcher_help_routes_to_helper(self):
         diff_text = "diff --git a/app.py b/app.py\n@@ -1 +1 @@\n-old\n+new\n"
         for dispatcher in (KIT_DIR / "context_guard_cli.py", PLUGIN_BIN / "context-guard"):

From f638a11fc76dd2d149189128fbaf9f446f3ee993 Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 12:00:49 +0900
Subject: [PATCH 12/29] omx(team): auto-checkpoint worker-2 [2]

---
 context-guard-kit/experimental_registry.py          |  9 +++++----
 plugins/context-guard/bin/context-guard-experiments | 10 +++++-----
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/context-guard-kit/experimental_registry.py b/context-guard-kit/experimental_registry.py
index 0d8475e..7b5d0c1 100755
--- a/context-guard-kit/experimental_registry.py
+++ b/context-guard-kit/experimental_registry.py
@@ -304,10 +304,11 @@ def to_json(self, *, enabled: bool = False) -> dict[str, Any]:
             "plan-only dry-run gate with no emit/record/serve runtime and no stable behavior change."
         ),
         evidence_contract=(
-            "The planner requires acknowledgements for explicit evaluation intent, exact text artifact fallback, "
-            "protected-zone denial, provider/model measurement boundaries, missed-context review, and the fact that "
-            "visual-crop-ocr is the existing caller-supplied visual evidence-pack surface rather than a verified "
-            "exact binary/image fallback."
+            "Plan output requires explicit opt-in, a verified exact text fallback receipt/re-expand handle before "
+            "omitted text is relied on, protected-zone denial, provider/model measurement boundaries, "
+            "and missed-context notes. relation_to_visual_crop_ocr: existing visual-crop-ocr packs are caller-supplied "
+            "visual evidence and are not verified exact binary/image fallback; image-context-pack is an inspired "
+            "evaluation planning gate, not a duplicate emitter."
         ),
     ),
     Experiment(
diff --git a/plugins/context-guard/bin/context-guard-experiments b/plugins/context-guard/bin/context-guard-experiments
index eb5880b..40e53c9 100755
--- a/plugins/context-guard/bin/context-guard-experiments
+++ b/plugins/context-guard/bin/context-guard-experiments
@@ -301,11 +301,11 @@ EXPERIMENTS: tuple[Experiment, ...] = (
             "traffic, write binary artifacts, or duplicate the caller-supplied visual-crop-ocr evidence-pack emitter."
         ),
         evidence_contract=(
-            "Plans require explicit opt-in, exact text fallback receipt/re-expand metadata before omitted exact text "
-            "is used, protected-zone denial for code/diffs/identifiers/hashes/paths/numeric constants/JSON keys/"
-            "stack frames/secrets/prompt-like instructions, provider/model measured matched-task boundaries, "
-            "missed-context guardrails, and an explicit relation_to_visual_crop_ocr statement: visual-crop-ocr "
-            "remains caller-supplied visual evidence only and is not a verified exact binary/image fallback."
+            "Plan output requires explicit opt-in, a verified exact text fallback receipt/re-expand handle before "
+            "omitted text is relied on, protected-zone denial, provider/model measurement boundaries, "
+            "and missed-context notes. relation_to_visual_crop_ocr: existing visual-crop-ocr packs are caller-supplied "
+            "visual evidence and are not verified exact binary/image fallback; image-context-pack is an inspired "
+            "evaluation planning gate, not a duplicate emitter."
         ),
     ),
     Experiment(

From c3b18a9aeedd35e4a6f826dd6ee71acaf719d8dd Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 12:01:16 +0900
Subject: [PATCH 13/29] task: implement image context pack plan gate


From 49de834f58fb9b20b3097b7d8f3bd33357faabd4 Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 12:02:04 +0900
Subject: [PATCH 14/29] omx(team): auto-checkpoint worker-3 [3]

---
 README.ko.md                                  |   4 +-
 README.md                                     |   9 +-
 context-guard-kit/README.md                   |   2 +-
 plugins/context-guard/README.ko.md            |   2 +-
 plugins/context-guard/README.md               |   6 +-
 .../bin/context-guard-experiments             | 296 ++++++++++--------
 .../experimental-token-reduction-radar.md     |  22 +-
 7 files changed, 185 insertions(+), 156 deletions(-)

diff --git a/README.ko.md b/README.ko.md
index b22ce68..5028bee 100644
--- a/README.ko.md
+++ b/README.ko.md
@@ -394,6 +394,7 @@ context-guard experiments plan context-diff-compaction --json < change.diff
 context-guard experiments emit context-diff-compaction --receipt-id <artifact-id> --reexpand-command "context-guard-artifact get <artifact-id> --full" --replacement-file compact-diff.txt --json < change.diff
 context-guard experiments plan visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --missed-context-note "outside crop omitted"
 context-guard experiments emit visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --ocr-text "visible text" --ocr-confidence 0.9 --ocr-error-note "glyph may be uncertain" --missed-context-note "outside crop omitted"
+context-guard experiments plan image-context-pack --json --evaluation-intent-ack --exact-text-fallback-ack --text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --protected-zone-deny-ack --provider-measurement-boundary-ack --missed-context-guardrail-ack --visual-crop-ocr-relation-ack
 context-guard experiments plan learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" < sanitized-prose.txt
 context-guard experiments emit learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --replacement-file compact-prose.txt < sanitized-prose.txt
 context-guard experiments plan self-hosted-metrics-ledger --json --latency-ms 123.5 --peak-memory-mb 2048 --quality-score 0.98
@@ -420,6 +421,7 @@ local-proxy 예시는 side effect 기준으로 나뉩니다.
 | --- | --- | --- |
 | `context-diff-compaction` | dry-run diff 조언과 명시적 `emit ... --receipt-id ... --reexpand-command ...` 런타임으로 caller-supplied compact replacement를 출력합니다. | `plan`은 replacement를 emit하지 않습니다. `emit`은 reviewable hunk, input diff와 일치하는 exact local artifact content/re-expand metadata와 더 작은 caller-supplied replacement가 모두 있을 때만 동작하며, ContextGuard가 semantic compression을 생성하거나 hosted token/cost 절감 주장 근거로 쓰지 않습니다. |
 | `visual-crop-ocr` | dry-run visual evidence 조언과 명시적 `emit visual-crop-ocr` 런타임으로 caller-supplied evidence pack을 출력합니다. | `emit`은 full visual evidence receipt, missed-context note, 완전한 user-supplied crop 및/또는 OCR evidence가 필요합니다. ContextGuard는 screenshot 캡처, image crop, OCR 실행, image parsing, 외부 service 호출, 파일 쓰기, hosted token/cost 절감 주장을 하지 않습니다. |
+| `image-context-pack` | pxpipe-inspired image/context packing 평가를 위한 plan-only dry-run gate입니다. | 명시적 평가 의도, exact text artifact fallback, protected-zone denial, provider-measured matched-task boundary, missed-context guardrail, 그리고 `visual-crop-ocr`이 기존 caller-supplied visual evidence-pack surface라는 확인이 필요합니다. ContextGuard는 image rendering, OCR 실행, image parsing, model/provider call, proxy traffic, binary artifact 저장, replacement evidence 출력, hosted token/cost savings claim을 하지 않습니다. |
 | `learned-compression` | deny-by-default 정책 검사와 명시적 `emit learned-compression` 런타임으로 verified exact fallback content가 있는 caller-supplied compact prose candidate를 출력합니다. | `emit`은 sanitized trusted prose, protected-signal denial, input과 일치하는 verified local fallback artifact, 더 작은 caller-supplied prose candidate가 필요합니다. ContextGuard는 compressor, embedding, reranker, model call, subprocess, external service, 생성형 replacement, hosted savings claim을 실행/생성하지 않습니다. |
 | `self-hosted-metrics-ledger` | dry-run preview와 명시적 `record ... --ledger-jsonl` 런타임으로 local/model-server latency, memory, quality, energy, throughput, local-cost metric을 기록합니다. | dry-run preview는 ledger 파일을 쓰지 않습니다. 명시적 record 명령만 로컬 JSONL sidecar를 쓰며, hosted API token/cost 절감 주장 근거로는 쓰지 않습니다. |
 | `local-proxy` | 미래 local proxy 후보에 대한 localhost-only advisory metadata, future external forwarding용 design-only `plan local-proxy-external-forwarding` review, 명시적 `record local-proxy-runtime-gate --ledger-jsonl` gate row runtime, 명시적 one-shot `serve local-proxy` loopback forwarding MVP, safe UTF-8 응답을 compact artifact envelope로 바꾸는 optional `--response-sandbox`, successful forwarded request용 optional `--diagnostic-ledger-jsonl` shifted-cost diagnostics. | `plan`은 ledger를 쓰지 않습니다. `record`는 localhost-only metadata와 `--runtime-gate-ack`가 있을 때만 로컬 JSONL row를 쓰며 listener 시작이나 traffic forwarding, DNS lookup을 하지 않습니다. `serve`는 `--forwarding-gate-ack --once`, private `--ready-file` nonce handoff, literal loopback bind/target IP, nonzero port, byte/time limit, credential-free request가 필요하며 external forwarding, CONNECT/TLS proxying, API-key persistence, hosted API 절감 주장을 하지 않습니다. `--response-sandbox`는 safe UTF-8 response text만 sanitized local artifact receipt로 저장하고 raw body 대신 redacted rehydration command template가 담긴 compact envelope를 반환하며 hosted token/cost savings claim은 아닙니다. `--diagnostic-ledger-jsonl`은 successful-forward 진단 row만 쓰며 raw header/body와 hosted-savings claim을 저장하지 않습니다. `plan local-proxy-external-forwarding`은 threat model/allowlist/redaction/provider-evidence design metadata만 출력하고 DNS lookup, external service call, traffic forwarding, credential persistence, hosted savings claim을 하지 않습니다. |
@@ -431,7 +433,7 @@ local-proxy 예시는 side effect 기준으로 나뉩니다.
 ContextGuard는 아직 다음 기능을 제공하지 않습니다.
 
 - caller-supplied learned candidate emitter를 넘어서는 learned/synthetic compressor 실행 또는 생성형 replacement
-- caller-supplied visual evidence-pack emitter를 넘어서는 생성형 crop/OCR 또는 visual-token pruning runtime
+- caller-supplied visual evidence-pack emitter와 plan-only image-context-pack dry-run gate를 넘어서는 생성형 crop/OCR, visual-token pruning runtime, image-context-pack rendering/runtime
 - 명시적 local metrics 기록을 넘어서는 self-hosted KV/latent optimization
 - one-shot literal-loopback local proxy MVP를 넘어서는 external/daemon/credential-bearing proxy forwarding runtime
 
diff --git a/README.md b/README.md
index 922696e..8efa6b2 100644
--- a/README.md
+++ b/README.md
@@ -442,7 +442,7 @@ context-guard experiments emit context-diff-compaction --receipt-id <artifact-id
 context-guard experiments plan image-context-pack --json --explicit-opt-in --exact-text-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --protected-zone-policy deny --provider-measurement-boundary provider-measured-matched-tasks-required --missed-context-note "omitted text remains exactly retrievable" --image-size 800,600
 context-guard experiments plan visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --missed-context-note "outside crop omitted"
 context-guard experiments emit visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --ocr-text "visible text" --ocr-confidence 0.9 --ocr-error-note "glyph may be uncertain" --missed-context-note "outside crop omitted"
-context-guard experiments plan image-context-pack --json --exact-text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --provider-boundary-ack --missed-context-note "omitted text remains retrievable before any future image pack is used"
+context-guard experiments plan image-context-pack --json --evaluation-intent-ack --exact-text-fallback-ack --text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --protected-zone-deny-ack --provider-measurement-boundary-ack --missed-context-guardrail-ack --visual-crop-ocr-relation-ack
 context-guard experiments plan learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" < sanitized-prose.txt
 context-guard experiments emit learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --replacement-file compact-prose.txt < sanitized-prose.txt
 context-guard experiments plan self-hosted-metrics-ledger --json --latency-ms 123.5 --peak-memory-mb 2048 --quality-score 0.98
@@ -467,13 +467,13 @@ The local-proxy examples are intentionally split by side effect:
 
 By default, project settings are stored in `.context-guard/experiments.json`. Use `--config <path>` only for an explicit project-local override. Experiment metadata includes risk level, gate requirements, explicit command/flag surfaces, and claim boundaries so hosted API token/cost savings are not claimed without provider-measured matched-task evidence. `experiments enable` records intent only; it does not run helpers, remove the need for their explicit flags, or permit replacing content without exact receipt/re-expand evidence.
 
-Shipped experimental checker/planner surfaces, plus explicit local context-diff, visual evidence, learned-candidate, metrics, and proxy-gate record runtimes, are intentionally narrow:
+Shipped experimental checker/planner surfaces, plus explicit local context-diff, visual evidence, learned-candidate, metrics, proxy-gate record runtimes, and the plan-only image-context-pack gate, are intentionally narrow:
 
 | Planner/checker/runtime | What it emits | Hard boundary |
 | --- | --- | --- |
 | `context-diff-compaction` | Dry-run diff advice plus an explicit `emit ... --receipt-id ... --reexpand-command ...` runtime for caller-supplied compact replacements. | `plan` emits no replacement. `emit` requires reviewable hunks, exact local artifact re-expand metadata whose stored content matches the input diff, and a smaller caller-supplied replacement; ContextGuard does not generate semantic compression or support hosted token/cost savings claims. |
 | `visual-crop-ocr` | Dry-run visual evidence advice plus an explicit `emit visual-crop-ocr` runtime for caller-supplied evidence packs. | `emit` requires a full visual evidence receipt, missed-context note, and complete user-supplied crop and/or OCR evidence; ContextGuard does not capture screenshots, crop images, run OCR, parse images, call external services, write files, or support hosted token/cost savings claims. |
-| `image-context-pack` | Pxpipe-inspired dry-run planning gate for future image/context packing evaluation. | Plan-only: it emits JSON metadata but no image, replacement, file, binary artifact, OCR, model call, provider call, or proxy traffic. It requires explicit opt-in, protected-zone denial, missed-context notes, exact text fallback that must be verified before omitted text is relied on, and provider-measured matched successful tasks before hosted token/cost savings claims. `visual-crop-ocr` remains the caller-supplied visual evidence-pack surface, not a verified exact binary/image fallback. |
+| `image-context-pack` | Plan-only dry-run gate for pxpipe-inspired image/context packing evaluation. | It requires explicit evaluation intent, exact text artifact fallback, protected-zone denial, provider-measured matched-task boundaries, missed-context guardrails, and acknowledgement that `visual-crop-ocr` is the existing caller-supplied visual evidence-pack surface. ContextGuard does not render images, run OCR, parse images, call models/providers, proxy traffic, store binary artifacts, emit replacement evidence, or support hosted token/cost savings claims. |
 | `learned-compression` | Deny-by-default policy checks plus an explicit `emit learned-compression` runtime for caller-supplied compact prose candidates with verified exact fallback content. | `emit` requires sanitized trusted prose, protected-signal denial, a verified local fallback artifact matching the input, and a smaller caller-supplied prose candidate; ContextGuard does not run compressors, embeddings, rerankers, model calls, subprocesses, external services, generated replacement text, or hosted savings claims. |
 | `self-hosted-metrics-ledger` | Dry-run preview plus an explicit `record ... --ledger-jsonl` runtime for local/model-server latency, memory, quality, energy, throughput, and local-cost metrics. | The dry-run preview does not write a ledger; the explicit record command writes only local JSONL sidecars and still does not support hosted API token/cost savings claims. |
 | `local-proxy` | Localhost-only advisory metadata, design-only `plan local-proxy-external-forwarding` review for future external forwarding, an explicit `record local-proxy-runtime-gate --ledger-jsonl` runtime for one local gate row, an explicit one-shot `serve local-proxy` loopback forwarding MVP, optional `--response-sandbox` compact artifact envelopes, and optional `--diagnostic-ledger-jsonl` shifted-cost diagnostics for successful forwarded requests. | `plan` writes no ledger. `record` writes only after localhost-only metadata and `--runtime-gate-ack`; it starts no listener, forwards no traffic, and performs no DNS lookup. `serve` additionally requires `--forwarding-gate-ack --once`, a private `--ready-file` nonce handoff, literal loopback bind/target IPs, nonzero ports, bounded bytes/timeouts, and credential-free requests; it performs no external forwarding, no CONNECT/TLS proxying, no API-key persistence, and no hosted-savings claim. `--response-sandbox` can store safe UTF-8 response text as a sanitized local artifact receipt and return a compact envelope with redacted rehydration command templates; it does not claim hosted token/cost savings. `--diagnostic-ledger-jsonl` writes only successful-forward diagnostics with no raw headers/bodies and no hosted-savings claim. `plan local-proxy-external-forwarding` emits threat-model/allowlist/redaction/provider-evidence design metadata only and still performs no DNS lookup, external service call, traffic forwarding, credential persistence, or hosted-savings claim. |
@@ -485,8 +485,7 @@ These are tracked directions, not committed features. Nothing here ships unless
 ContextGuard does not yet ship:
 
 - learned/synthetic compressor execution or generated replacement text beyond the caller-supplied learned candidate emitter
-- generated crop/OCR or visual-token pruning runtime beyond the caller-supplied visual evidence-pack emitter
-- generated image-context-pack renderers, binary/image artifact fallback, or pxpipe-style proxy/runtime beyond the plan-only evaluation gate
+- generated crop/OCR, visual-token pruning runtime, or image-context-pack rendering/runtime beyond the caller-supplied visual evidence-pack emitter and plan-only image-context-pack dry-run gate
 - self-hosted KV/latent optimization beyond explicit local metrics recording
 - external, daemon, or credential-bearing proxy forwarding beyond the one-shot literal-loopback local proxy MVP
 
diff --git a/context-guard-kit/README.md b/context-guard-kit/README.md
index 5d6a003..d212195 100644
--- a/context-guard-kit/README.md
+++ b/context-guard-kit/README.md
@@ -74,7 +74,7 @@ python3 context-guard-kit/sanitize_output.py -- git diff
 
 `experimental_registry.py plan visual-crop-ocr`은 전체 visual evidence 요약 기록과 crop/OCR fixture note를 점검하는 dry-run metadata planner이고, `experimental_registry.py emit visual-crop-ocr`은 caller-supplied crop/OCR 근거를 위한 명시적 로컬 evidence-pack runtime입니다. visual lane은 screenshot 캡처, image crop, screenshot parsing, OCR 실행, OCR/image service 호출, evidence file 쓰기, replacement evidence 생성, hosted savings 주장을 하지 않습니다.
 
-`experimental_registry.py plan image-context-pack`은 pxpipe-inspired image/context packing을 위한 plan-only dry-run gate입니다. image rendering, OCR/image service, model call, proxy forwarding, binary artifact, replacement evidence를 만들지 않으며, omitted text를 쓰기 전에 exact text fallback receipt/re-expand metadata, protected-zone denial, missed-context note, provider/model 측정 matched-task boundary가 필요하다는 계획 metadata만 출력합니다. `visual-crop-ocr`은 caller-supplied visual evidence-pack surface로 남고, `image-context-pack`은 duplicate emitter나 verified exact binary/image fallback이 아닙니다.
+`experimental_registry.py plan image-context-pack`은 pxpipe-inspired image/context packing 평가를 위한 plan-only dry-run gate입니다. 명시적 평가 의도, exact text artifact fallback, protected-zone denial, provider-measured matched-task boundary, missed-context guardrail, 그리고 `visual-crop-ocr`이 기존 caller-supplied visual evidence-pack surface라는 확인이 필요합니다. 이 gate는 image rendering, OCR 실행, image parsing, model/provider call, proxy traffic, binary artifact 저장, replacement evidence 출력, hosted token/cost savings claim을 하지 않습니다.
 
 `experimental_registry.py plan learned-compression`은 정제된 trusted prose와 exact fallback handle을 위한 deny-by-default dry-run safety checker이고, `experimental_registry.py emit learned-compression`은 검증된 exact fallback 내용이 있을 때 caller-supplied compact prose를 내보내는 명시적 로컬 candidate emitter입니다. learned lane은 learned/synthetic compressor 실행, embedding, model call, reranker, subprocess, external service, generated replacement text를 실행하지 않으며 hosted savings도 주장하지 않습니다.
 
diff --git a/plugins/context-guard/README.ko.md b/plugins/context-guard/README.ko.md
index 1f97e97..cbe9caa 100644
--- a/plugins/context-guard/README.ko.md
+++ b/plugins/context-guard/README.ko.md
@@ -119,7 +119,7 @@ brief 모드는 코딩 에이전트가 군더더기를 줄이도록 요청하되
 
 ContextGuard는 모델 토큰을 줄이기 위해 작업을 외부 AI 서비스로 전송하지 않습니다. 모든 헬퍼 명령은 로컬에서 동작합니다. 로컬 RAM/디스크 보관본은 다음에 보낼 컨텍스트를 줄이는 데 도움될 수 있지만 provider prompt cache를 대체하지 않습니다. Anthropic 배포나 청구 설명 전에는 공식 prompt caching/pricing 문서를 다시 확인하세요: https://docs.anthropic.com/en/build-with-claude/prompt-caching 및 https://platform.claude.com/docs/en/about-claude/pricing.
 
-미래 learned, self-hosted 최적화 아이디어는 [`research/experimental-token-reduction-radar.md`](https://github.com/ictechgy/context-guard/blob/main/research/experimental-token-reduction-radar.md)에 gated experiment로 기록하며, fixture-only 시작 예시는 [`docs/experimental-benchmark-fixtures.md`](https://github.com/ictechgy/context-guard/blob/main/docs/experimental-benchmark-fixtures.md)에 둡니다. learned compression은 `context-guard experiments plan learned-compression` dry-run checker와 명시적 `context-guard experiments emit learned-compression` caller-supplied candidate emitter만 shipped 상태이고, self-hosted-metrics-ledger는 dry-run preview와 명시적 `context-guard experiments record self-hosted-metrics-ledger` local JSONL record를 제공하며, dry-run preview는 ledger 파일을 쓰지 않습니다. visual crop/OCR은 caller-supplied evidence-pack emit, context-diff는 verified-receipt caller-supplied replacement emit만 제공합니다. local proxy는 `context-guard experiments plan local-proxy` localhost-only dry-run advisory plan, design-only `context-guard experiments plan local-proxy-external-forwarding` gate, 명시적 `context-guard experiments record local-proxy-runtime-gate --ledger-jsonl ...` gate row record, private ready-file nonce가 필요한 one-shot `context-guard experiments serve local-proxy` loopback forwarding MVP와 successful forwarded request용 optional shifted-cost diagnostic JSONL row만 shipped 상태입니다. record는 no listener/no traffic forwarding/no DNS lookup/no external service/no API-key persistence boundary를 유지하고, serve는 private ready-file nonce, literal loopback IP, `--once`, credential-free request만 허용하고 CONNECT/TLS proxying도 지원하지 않습니다. `--response-sandbox`는 safe UTF-8 response text만 local artifact receipt로 저장하고 raw body 대신 redacted rehydration command template가 담긴 compact envelope를 돌려주며 hosted token/cost savings claim은 아닙니다. `--diagnostic-ledger-jsonl`은 successful forwarded request 뒤에만 진단 row를 쓰며 raw header/body나 hosted-savings evidence를 저장하지 않습니다. `plan local-proxy-external-forwarding`은 threat model, HTTPS allowlist, credential redaction, provider-evidence boundary를 점검하는 dry-run design gate이고 listener, DNS lookup, external service call, traffic forwarding, credential persistence, external proxy forwarding runtime, hosted savings claim을 제공하지 않습니다. learned/synthetic compressor 실행·embedding·reranker·model call·생성형 replacement, generated OCR/crop 또는 visual-token pruning, self-hosted KV/latent runtime 최적화, one-shot literal-loopback local proxy MVP를 넘어선 external/daemon/credential-bearing proxy forwarding runtime은 shipped가 아닙니다. 이 radar와 fixture는 provider가 측정한 matched-task 근거 없이 hosted API 절감을 주장하지 않습니다. Radar의 later-roadmap gate는 neural/semantic compression, trust-tiered injection-aware compression, generated visual-token reduction, broader local proxy forwarding constraint도 별도 미래 PR이 gate를 통과하기 전까지 experimental/non-shipped로 묶습니다.
+미래 learned, self-hosted 최적화 아이디어는 [`research/experimental-token-reduction-radar.md`](https://github.com/ictechgy/context-guard/blob/main/research/experimental-token-reduction-radar.md)에 gated experiment로 기록하며, fixture-only 시작 예시는 [`docs/experimental-benchmark-fixtures.md`](https://github.com/ictechgy/context-guard/blob/main/docs/experimental-benchmark-fixtures.md)에 둡니다. learned compression은 `context-guard experiments plan learned-compression` dry-run checker와 명시적 `context-guard experiments emit learned-compression` caller-supplied candidate emitter만 shipped 상태이고, self-hosted-metrics-ledger는 dry-run preview와 명시적 `context-guard experiments record self-hosted-metrics-ledger` local JSONL record를 제공하며, dry-run preview는 ledger 파일을 쓰지 않습니다. visual crop/OCR은 caller-supplied evidence-pack emit, image-context-pack은 pxpipe-inspired image/context packing 평가를 위한 plan-only dry-run gate, context-diff는 verified-receipt caller-supplied replacement emit만 제공합니다. image-context-pack은 명시적 평가 의도, exact text artifact fallback, protected-zone denial, provider-measured matched-task boundary, missed-context guardrail, 그리고 visual-crop-ocr이 기존 caller-supplied visual evidence-pack surface라는 확인이 필요하며, image rendering, OCR 실행, image parsing, model/provider call, proxy traffic, binary artifact 저장, replacement evidence 출력, hosted token/cost savings claim을 하지 않습니다. local proxy는 `context-guard experiments plan local-proxy` localhost-only dry-run advisory plan, design-only `context-guard experiments plan local-proxy-external-forwarding` gate, 명시적 `context-guard experiments record local-proxy-runtime-gate --ledger-jsonl ...` gate row record, private ready-file nonce가 필요한 one-shot `context-guard experiments serve local-proxy` loopback forwarding MVP와 successful forwarded request용 optional shifted-cost diagnostic JSONL row만 shipped 상태입니다. record는 no listener/no traffic forwarding/no DNS lookup/no external service/no API-key persistence boundary를 유지하고, serve는 private ready-file nonce, literal loopback IP, `--once`, credential-free request만 허용하고 CONNECT/TLS proxying도 지원하지 않습니다. `--response-sandbox`는 safe UTF-8 response text만 local artifact receipt로 저장하고 raw body 대신 redacted rehydration command template가 담긴 compact envelope를 돌려주며 hosted token/cost savings claim은 아닙니다. `--diagnostic-ledger-jsonl`은 successful forwarded request 뒤에만 진단 row를 쓰며 raw header/body나 hosted-savings evidence를 저장하지 않습니다. `plan local-proxy-external-forwarding`은 threat model, HTTPS allowlist, credential redaction, provider-evidence boundary를 점검하는 dry-run design gate이고 listener, DNS lookup, external service call, traffic forwarding, credential persistence, external proxy forwarding runtime, hosted savings claim을 제공하지 않습니다. learned/synthetic compressor 실행·embedding·reranker·model call·생성형 replacement, generated OCR/crop, visual-token pruning, plan-only image-context-pack dry-run gate를 넘어선 image-context-pack rendering/runtime, self-hosted KV/latent runtime 최적화, one-shot literal-loopback local proxy MVP를 넘어선 external/daemon/credential-bearing proxy forwarding runtime은 shipped가 아닙니다. 이 radar와 fixture는 provider가 측정한 matched-task 근거 없이 hosted API 절감을 주장하지 않습니다. Radar의 later-roadmap gate는 neural/semantic compression, trust-tiered injection-aware compression, generated visual-token reduction, broader local proxy forwarding constraint도 별도 미래 PR이 gate를 통과하기 전까지 experimental/non-shipped로 묶습니다.
 
 교차 에이전트 규칙 스니펫은 안내용입니다. 대상 에이전트가 반드시 따른다고 보장할 수 없으므로, 절감 주장이 필요하면 실제 전후 동작을 직접 측정하세요.
 
diff --git a/plugins/context-guard/README.md b/plugins/context-guard/README.md
index 0238e1d..57fd023 100644
--- a/plugins/context-guard/README.md
+++ b/plugins/context-guard/README.md
@@ -142,7 +142,7 @@ context-guard experiments emit context-diff-compaction --receipt-id <artifact-id
 context-guard experiments plan image-context-pack --json --explicit-opt-in --exact-text-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --protected-zone-policy deny --provider-measurement-boundary provider-measured-matched-tasks-required --missed-context-note "omitted text remains exactly retrievable" --image-size 800,600
 context-guard experiments plan visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --missed-context-note "outside crop omitted"
 context-guard experiments emit visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --ocr-text "visible text" --ocr-confidence 0.9 --ocr-error-note "glyph may be uncertain" --missed-context-note "outside crop omitted"
-context-guard experiments plan image-context-pack --json --exact-text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --provider-boundary-ack --missed-context-note "omitted text remains retrievable before any future image pack is used"
+context-guard experiments plan image-context-pack --json --evaluation-intent-ack --exact-text-fallback-ack --text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --protected-zone-deny-ack --provider-measurement-boundary-ack --missed-context-guardrail-ack --visual-crop-ocr-relation-ack
 context-guard experiments plan learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" < sanitized-prose.txt
 context-guard experiments emit learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --replacement-file compact-prose.txt < sanitized-prose.txt
 context-guard experiments plan self-hosted-metrics-ledger --json --latency-ms 123.5 --peak-memory-mb 2048 --quality-score 0.98
@@ -155,7 +155,9 @@ context-guard experiments enable output-receipt-trim --root .
 context-guard experiments disable output-receipt-trim --root .
 ```
 
-Use `--config <path>` only for an explicit project-local override. Registry entries include risk, gate requirements, explicit command/flag surfaces, and claim boundaries; hosted API token/cost savings still require provider-measured matched-task evidence. The registry can discover existing explicit-flag experiments such as `context-guard-trim-output --digest ... --artifact-receipt` and `context-guard-compress --protected-policy`, run dry-run advisory planners such as `context-guard experiments plan context-diff-compaction`, `context-guard experiments plan visual-crop-ocr`, `context-guard experiments plan image-context-pack`, `context-guard experiments plan learned-compression`, `context-guard experiments plan self-hosted-metrics-ledger`, `context-guard experiments plan local-proxy`, and design-only `context-guard experiments plan local-proxy-external-forwarding`, and run explicit local runtimes such as `context-guard experiments emit context-diff-compaction ...`, `context-guard experiments emit visual-crop-ocr ...`, `context-guard experiments emit learned-compression ...`, `context-guard experiments record self-hosted-metrics-ledger ...`, `context-guard experiments record local-proxy-runtime-gate ...`, `context-guard experiments serve local-proxy ...`, and successful-forward `context-guard experiments serve local-proxy --diagnostic-ledger-jsonl ...` diagnostics. The context-diff emit runtime only emits caller-supplied compact replacements when reviewable hunks, exact local artifact re-expand metadata whose stored content matches the input diff, and a smaller replacement are present; it does not generate semantic compression or permit hosted savings claims. The visual lane ships a dry-run planner plus an explicit local evidence-pack emitter: both use only caller-supplied full-evidence receipts, crop metadata, OCR text, confidence/error notes, and missed-context notes; screenshot capture, image cropping, OCR execution, image parsing, external OCR/image services, output-file writes, and hosted savings claims are not shipped. The `image-context-pack` lane is plan-only pxpipe-inspired evaluation metadata: it emits no image, replacement, evidence pack, binary artifact, ledger, listener, or proxy, requires exact text fallback receipt/re-expand metadata before omitted text is used, denies protected zones, records missed-context notes, and keeps provider/model measured matched-task evidence as the boundary for any hosted claim. `visual-crop-ocr` remains the caller-supplied visual evidence-pack surface; `image-context-pack` is not a duplicate emitter or verified exact binary/image fallback. The learned-compression lane ships a deny-by-default dry-run policy check plus an explicit local candidate emitter for caller-supplied compact prose with verified exact fallback content: learned/synthetic compressor execution, embeddings, rerankers, model calls, subprocesses, external services, generated replacement text, and hosted savings claims are not shipped. The self-hosted metrics planner emits a dry-run ledger-compatible preview for explicit local/model-server latency, memory, quality, energy, throughput, and local-cost metrics; the dry-run preview does not write a ledger, while `context-guard experiments record self-hosted-metrics-ledger --ledger-jsonl ...` writes only local JSONL sidecars and still does not permit hosted API token/cost savings claims. The local-proxy planner emits localhost-only advisory metadata only, while `context-guard experiments record local-proxy-runtime-gate --ledger-jsonl ...` appends one local gate row only after localhost-only metadata and `--runtime-gate-ack`: it starts no listener, forwards no traffic, and performs no DNS lookup. `context-guard experiments serve local-proxy ...` is the separate forwarding MVP: it requires `--forwarding-gate-ack --once`, a private `--ready-file` nonce handoff, literal loopback bind/target IPs, no hostname DNS targets, nonzero ports, byte/time limits, and credential-free requests; it performs no external forwarding, no CONNECT/TLS proxying, no API-key persistence, and no hosted-savings claim. `--response-sandbox` can store safe UTF-8 response text as a sanitized local artifact receipt and return a compact envelope with redacted rehydration command templates; it does not claim hosted token/cost savings. `--diagnostic-ledger-jsonl` writes one shifted-cost diagnostic row only after a successful forwarded request, with no raw headers/bodies and no hosted-savings evidence. `plan local-proxy-external-forwarding` emits threat-model/allowlist/redaction/provider-evidence design metadata only and still starts no listener, performs no DNS lookup, calls no external service, forwards no traffic, persists no credentials, and does not ship an external proxy forwarding runtime. `experiments enable` records intent only; it does not run those helpers, remove the need for their explicit flags, or permit replacing content without exact receipt/re-expand evidence.
+`image-context-pack` is a plan-only/dry-run gate for pxpipe-inspired image/context packing evaluation. It requires explicit evaluation intent, exact text artifact fallback, protected-zone denial, provider-measured matched-task boundaries, missed-context guardrails, and acknowledgement that `visual-crop-ocr` is the existing caller-supplied visual evidence-pack surface. It does not render images, run OCR, call models/providers, proxy traffic, store binary artifacts, emit replacement evidence, or support hosted token/cost savings.
+
+Use `--config <path>` only for an explicit project-local override. Registry entries include risk, gate requirements, explicit command/flag surfaces, and claim boundaries; hosted API token/cost savings still require provider-measured matched-task evidence. The registry can discover existing explicit-flag experiments such as `context-guard-trim-output --digest ... --artifact-receipt` and `context-guard-compress --protected-policy`, run dry-run advisory planners such as `context-guard experiments plan context-diff-compaction`, `context-guard experiments plan visual-crop-ocr`, `context-guard experiments plan learned-compression`, `context-guard experiments plan self-hosted-metrics-ledger`, `context-guard experiments plan local-proxy`, and design-only `context-guard experiments plan local-proxy-external-forwarding`, and run explicit local runtimes such as `context-guard experiments emit context-diff-compaction ...`, `context-guard experiments emit visual-crop-ocr ...`, `context-guard experiments emit learned-compression ...`, `context-guard experiments record self-hosted-metrics-ledger ...`, `context-guard experiments record local-proxy-runtime-gate ...`, `context-guard experiments serve local-proxy ...`, and successful-forward `context-guard experiments serve local-proxy --diagnostic-ledger-jsonl ...` diagnostics. The context-diff emit runtime only emits caller-supplied compact replacements when reviewable hunks, exact local artifact re-expand metadata whose stored content matches the input diff, and a smaller replacement are present; it does not generate semantic compression or permit hosted savings claims. The visual lane ships a dry-run planner plus an explicit local evidence-pack emitter: both use only caller-supplied full-evidence receipts, crop metadata, OCR text, confidence/error notes, and missed-context notes; screenshot capture, image cropping, OCR execution, image parsing, external OCR/image services, output-file writes, and hosted savings claims are not shipped. The learned-compression lane ships a deny-by-default dry-run policy check plus an explicit local candidate emitter for caller-supplied compact prose with verified exact fallback content: learned/synthetic compressor execution, embeddings, rerankers, model calls, subprocesses, external services, generated replacement text, and hosted savings claims are not shipped. The self-hosted metrics planner emits a dry-run ledger-compatible preview for explicit local/model-server latency, memory, quality, energy, throughput, and local-cost metrics; the dry-run preview does not write a ledger, while `context-guard experiments record self-hosted-metrics-ledger --ledger-jsonl ...` writes only local JSONL sidecars and still does not permit hosted API token/cost savings claims. The local-proxy planner emits localhost-only advisory metadata only, while `context-guard experiments record local-proxy-runtime-gate --ledger-jsonl ...` appends one local gate row only after localhost-only metadata and `--runtime-gate-ack`: it starts no listener, forwards no traffic, and performs no DNS lookup. `context-guard experiments serve local-proxy ...` is the separate forwarding MVP: it requires `--forwarding-gate-ack --once`, a private `--ready-file` nonce handoff, literal loopback bind/target IPs, no hostname DNS targets, nonzero ports, byte/time limits, and credential-free requests; it performs no external forwarding, no CONNECT/TLS proxying, no API-key persistence, and no hosted-savings claim. `--response-sandbox` can store safe UTF-8 response text as a sanitized local artifact receipt and return a compact envelope with redacted rehydration command templates; it does not claim hosted token/cost savings. `--diagnostic-ledger-jsonl` writes one shifted-cost diagnostic row only after a successful forwarded request, with no raw headers/bodies and no hosted-savings evidence. `plan local-proxy-external-forwarding` emits threat-model/allowlist/redaction/provider-evidence design metadata only and still starts no listener, performs no DNS lookup, calls no external service, forwards no traffic, persists no credentials, and does not ship an external proxy forwarding runtime. `experiments enable` records intent only; it does not run those helpers, remove the need for their explicit flags, or permit replacing content without exact receipt/re-expand evidence.
 
 Cross-agent rule snippets are advisory: the target agent may ignore them, so measure actual before/after behavior when you need a savings claim.
 
diff --git a/plugins/context-guard/bin/context-guard-experiments b/plugins/context-guard/bin/context-guard-experiments
index 40e53c9..103ad73 100755
--- a/plugins/context-guard/bin/context-guard-experiments
+++ b/plugins/context-guard/bin/context-guard-experiments
@@ -46,6 +46,7 @@ MAX_VISUAL_OCR_TEXT_BYTES = 64_000
 MAX_LEARNED_COMPRESSION_INPUT_BYTES = 128_000
 MAX_LEARNED_COMPRESSION_REPLACEMENT_BYTES = 64_000
 MAX_LEARNED_COMPRESSION_ARTIFACT_METADATA_BYTES = 64_000
+IMAGE_CONTEXT_PACK_MAX_DIMENSION = 16_384
 MAX_SELF_HOSTED_METRICS_INPUT_BYTES = 64_000
 SELF_HOSTED_METRICS_SCHEMA_VERSION = "contextguard.bench.self-hosted-metrics.v1"
 SELF_HOSTED_METRICS_KEY = "self_hosted_metrics"
@@ -263,10 +264,10 @@ EXPERIMENTS: tuple[Experiment, ...] = (
     ),
     Experiment(
         id="image-context-pack",
-        name="Pxpipe-inspired image context pack planning gate",
+        name="Image context pack planning gate",
         summary=(
-            "Plan-only evaluation gate for pxpipe-inspired image/context packing without rendering images, "
-            "emitting visual artifacts, or changing runtime behavior."
+            "Plan-only pxpipe-inspired evaluation gate for future image/context packing; it never renders images, "
+            "runs OCR, stores binaries, calls models/providers, or emits replacement evidence."
         ),
         stability="experimental",
         default_enabled=False,
@@ -277,35 +278,35 @@ EXPERIMENTS: tuple[Experiment, ...] = (
         ),
         gate_requirements=(
             "explicit opt-in",
-            "verified exact text artifact fallback before omitted text is used",
+            "verified exact text artifact fallback before omitted text is relied on",
             "protected-zone denial",
             "provider/model measurement boundary",
             "missed-context guardrails",
-            "relation to visual-crop-ocr",
+            "relation to visual-crop-ocr documented",
         ),
         runtime_status="available-plan-only",
         commands=("context-guard experiments plan image-context-pack",),
         opt_in_flags=(
             "plan image-context-pack",
-            "--exact-text-fallback-receipt",
+            "--evaluation-intent-ack",
+            "--exact-text-fallback-ack",
+            "--text-fallback-receipt",
             "--reexpand-command",
-            "--provider-boundary-ack",
-            "--protected-zone-policy deny",
-            "--missed-context-note",
-            "--image-size",
-            "--packed-image-size",
+            "--protected-zone-deny-ack",
+            "--provider-measurement-boundary-ack",
+            "--missed-context-guardrail-ack",
+            "--visual-crop-ocr-relation-ack",
+            "--proposed-image-size",
         ),
         config_effect=(
-            "Registry enablement records project-local intent only; image-context-pack exposes only a deterministic "
-            "plan command. It does not add an emit/record/serve runtime, render images, run OCR, call models, proxy "
-            "traffic, write binary artifacts, or duplicate the caller-supplied visual-crop-ocr evidence-pack emitter."
+            "Registry enablement records project-local intent only; image-context-pack remains a deterministic "
+            "plan-only dry-run gate with no emit/record/serve runtime and no stable behavior change."
         ),
         evidence_contract=(
-            "Plan output requires explicit opt-in, a verified exact text fallback receipt/re-expand handle before "
-            "omitted text is relied on, protected-zone denial, provider/model measurement boundaries, "
-            "and missed-context notes. relation_to_visual_crop_ocr: existing visual-crop-ocr packs are caller-supplied "
-            "visual evidence and are not verified exact binary/image fallback; image-context-pack is an inspired "
-            "evaluation planning gate, not a duplicate emitter."
+            "The planner requires acknowledgements for explicit evaluation intent, exact text artifact fallback, "
+            "protected-zone denial, provider/model measurement boundaries, missed-context review, and the fact that "
+            "visual-crop-ocr is the existing caller-supplied visual evidence-pack surface rather than a verified "
+            "exact binary/image fallback."
         ),
     ),
     Experiment(
@@ -1784,148 +1785,157 @@ def command_plan_visual_crop_ocr(args: argparse.Namespace) -> int:
     return 0
 
 
-def image_context_pack_size_payload(raw: str | None) -> tuple[dict[str, Any] | None, bool]:
-    size = parse_int_tuple(raw, count=2)
-    if raw is None or not str(raw).strip():
-        return None, True
-    if size is None:
-        return None, False
-    width, height = size
-    if width <= 0 or height <= 0:
-        return {"width": width, "height": height}, False
-    return {"width": width, "height": height}, True
-
-
 def image_context_pack_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
-    receipt_id = args.exact_text_fallback_receipt.strip() if args.exact_text_fallback_receipt else None
+    receipt_id = args.text_fallback_receipt.strip() if args.text_fallback_receipt else None
     reexpand_command = args.reexpand_command.strip() if args.reexpand_command else None
     reexpand_valid, fallback_blocker = valid_learned_reexpand_command(receipt_id, reexpand_command)
-    fallback_blocker_map = {
-        "missing_exact_fallback": "missing_exact_text_fallback",
-        "invalid_reexpand_command": "invalid_exact_text_reexpand_command",
-    }
-    source_size, source_size_valid = image_context_pack_size_payload(args.image_size)
-    packed_size, packed_size_valid = image_context_pack_size_payload(args.packed_image_size)
-    missed_context_notes = clean_values(args.missed_context_note)
-    protected_policy = (args.protected_zone_policy or "deny").strip().lower()
+    proposed_image_size = parse_int_tuple(args.proposed_image_size, count=2)
+    image_payload = None
+    image_size_valid = args.proposed_image_size is None
+    if proposed_image_size is not None:
+        width, height = proposed_image_size
+        image_size_valid = (
+            0 < width <= IMAGE_CONTEXT_PACK_MAX_DIMENSION
+            and 0 < height <= IMAGE_CONTEXT_PACK_MAX_DIMENSION
+        )
+        image_payload = {"width": width, "height": height}
+    elif args.proposed_image_size is not None:
+        image_size_valid = False
 
     blockers: list[str] = []
+    if not args.evaluation_intent_ack:
+        blockers.append("missing_evaluation_intent_ack")
+    if not args.exact_text_fallback_ack:
+        blockers.append("missing_exact_text_fallback_ack")
     if fallback_blocker:
-        blockers.append(fallback_blocker_map.get(fallback_blocker, fallback_blocker))
-    if not args.provider_boundary_ack:
-        blockers.append("missing_provider_measurement_boundary")
-    if not missed_context_notes:
-        blockers.append("missing_missed_context_note")
-    if protected_policy != "deny":
-        blockers.append("protected_zone_denial_required")
-    if not source_size_valid:
-        blockers.append("invalid_image_size")
-    if not packed_size_valid:
-        blockers.append("invalid_packed_image_size")
+        blockers.append(fallback_blocker)
+    if not args.protected_zone_deny_ack:
+        blockers.append("missing_protected_zone_deny_ack")
+    if not args.provider_measurement_boundary_ack:
+        blockers.append("missing_provider_measurement_boundary_ack")
+    if not args.missed_context_guardrail_ack:
+        blockers.append("missing_missed_context_guardrail_ack")
+    if not args.visual_crop_ocr_relation_ack:
+        blockers.append("missing_visual_crop_ocr_relation_ack")
+    if not image_size_valid:
+        blockers.append("invalid_proposed_image_size")
     blockers = list(dict.fromkeys(blockers))
-
-    source_area = source_size["width"] * source_size["height"] if source_size and source_size_valid else None
-    packed_area = packed_size["width"] * packed_size["height"] if packed_size and packed_size_valid else None
-    area_delta = source_area - packed_area if source_area is not None and packed_area is not None else None
     ready = not blockers
 
+    protected_classes = [
+        "code",
+        "diffs",
+        "identifiers",
+        "hashes",
+        "paths",
+        "numeric constants",
+        "JSON keys",
+        "stack frames",
+        "secrets",
+        "prompt-like instructions",
+    ]
     return {
         "tool": TOOL_NAME,
         "schema_version": CONFIG_SCHEMA_VERSION,
-        "plan_schema_version": IMAGE_CONTEXT_PACK_PLAN_SCHEMA_VERSION,
         "experiment_id": "image-context-pack",
         "mode": "dry_run",
-        "status": "ready_for_plan_review" if ready else "blocked_until_image_context_pack_gate_ready",
-        "plan_only": {
-            "command_advertised": True,
-            "emit_command_available": False,
-            "record_command_available": False,
-            "serve_command_available": False,
-            "runtime_behavior_changed": False,
-            "replacement_or_visual_evidence_emitted": False,
+        "status": "ready_for_experiment_design_review" if ready else "blocked_until_plan_constraints",
+        "policy": {
+            "default_off": True,
+            "plan_only": True,
+            "explicit_opt_in_required": True,
+            "emit_runtime_implemented": False,
+            "record_runtime_implemented": False,
+            "serve_runtime_implemented": False,
+            "image_rendering_allowed": False,
+            "ocr_allowed": False,
+            "image_parsing_allowed": False,
+            "model_call_allowed": False,
+            "provider_call_allowed": False,
+            "proxy_forwarding_allowed": False,
+            "binary_artifact_storage_allowed": False,
+            "replacement_emitted": False,
+            "stable_runtime_behavior_changed": False,
+            "hosted_api_token_savings_claim_allowed": False,
+            "hosted_api_cost_savings_claim_allowed": False,
         },
         "external_services": {
             "called": False,
             "network": False,
-            "model_calls": False,
             "ocr_service": None,
             "image_service": None,
-            "proxy_forwarding": False,
+            "model_provider": None,
         },
-        "runtime_side_effects": {
+        "network_actions": {
+            "listener_started": False,
+            "traffic_forwarded": False,
+            "dns_lookup_attempted": False,
+            "external_services_called": False,
+        },
+        "file_system_actions": {
             "files_written": False,
-            "image_rendering": False,
-            "ocr_execution": False,
-            "image_parsing": False,
             "binary_artifacts_written": False,
-            "proxy_forwarding": False,
-            "stable_runtime_behavior_changed": False,
+            "image_artifacts_written": False,
         },
-        "text_fallback": {
+        "exact_text_fallback": {
             "required": True,
-            "available": bool(reexpand_valid),
+            "caller_acknowledged": bool(args.exact_text_fallback_ack),
+            "available": bool(receipt_id and reexpand_command and reexpand_valid),
             "receipt_id": receipt_id,
-            "reexpand_command": reexpand_command,
+            "cli": reexpand_command,
             "verified": False,
-            "must_be_verified_before_omitted_text_is_used": True,
-            "note": (
-                "This dry-run validates only local receipt/re-expand shape. A future runtime must verify exact "
-                "text artifact content before relying on omitted exact text."
-            ),
+            "verified_before_use_required": True,
+            "note": "Only exact sanitized text artifact fallback may support omitted text; binary/image handles are not verified exact fallback.",
         },
-        "protected_zones": {
-            "policy": protected_policy,
+        "protected_zone_policy": {
+            "deny_required": True,
+            "caller_acknowledged": bool(args.protected_zone_deny_ack),
             "override_allowed": False,
-            "denied_classes": [
-                "code",
-                "diffs",
-                "identifiers",
-                "hashes",
-                "paths",
-                "numeric_constants",
-                "json_keys",
-                "stack_frames",
-                "secrets",
-                "prompt_like_instructions",
-            ],
-        },
-        "image_pack_plan": {
-            "source_label": sanitize_self_hosted_text(args.source_label) if args.source_label else "manual-plan",
-            "source_image_size": source_size,
-            "packed_image_size": packed_size,
-            "source_area": source_area,
-            "packed_area": packed_area,
-            "area_delta": area_delta,
-            "area_reduction_is_proxy_only": area_delta is not None,
-            "image_or_request_byte_reductions_are_proxy_evidence_only": True,
+            "denied_classes": protected_classes,
         },
-        "measurement_boundary": {
-            "provider_boundary_acknowledged": bool(args.provider_boundary_ack),
-            "provider_boundary_policy": IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY,
-            "provider_measured_matched_tasks_required_for_hosted_claims": True,
-            "provider_model_specific": True,
+        "provider_measurement_boundary": {
+            "caller_acknowledged": bool(args.provider_measurement_boundary_ack),
+            "image_request_byte_reductions_proxy_only": True,
+            "provider_model_measurement_required_for_claims": True,
+            "matched_successful_tasks_required": True,
             "hosted_api_token_savings_claim_allowed": False,
             "hosted_api_cost_savings_claim_allowed": False,
         },
+        "missed_context_guardrail": {
+            "caller_acknowledged": bool(args.missed_context_guardrail_ack),
+            "required_before_promotion": True,
+            "human_review_required": True,
+        },
         "relation_to_visual_crop_ocr": {
-            "visual_crop_ocr_is_existing_surface": True,
-            "visual_crop_ocr_remains_caller_supplied_visual_evidence_pack": True,
-            "image_context_pack_is_planning_gate_not_duplicate_emitter": True,
-            "verified_exact_binary_or_image_fallback_claimed": False,
+            "visual_crop_ocr_surface": "existing caller-supplied visual evidence-pack emitter",
+            "image_context_pack_surface": "pxpipe-inspired plan-only evaluation gate",
+            "duplicate_emitter": False,
+            "visual_handles_verified_exact_binary_fallback": False,
+            "note": (
+                "visual-crop-ocr remains the explicit caller-supplied visual evidence-pack runtime; "
+                "image-context-pack does not emit images, OCR, replacement evidence, or verified binary fallback."
+            ),
+        },
+        "proposed_image_context_pack": {
+            "image_size": image_payload,
+            "image_size_valid": image_size_valid,
+            "max_dimension": IMAGE_CONTEXT_PACK_MAX_DIMENSION,
+            "render_performed": False,
+            "image_bytes_computed": False,
+            "binary_receipt_created": False,
         },
         "review_plan": {
             "readiness_blockers": blockers,
-            "missed_context_notes": missed_context_notes,
             "next_steps": [
-                "Keep exact text artifact fallback verified before any future image/context packing omits source text.",
-                "Deny protected evidence zones before any future lossy visual packing is considered.",
-                "Measure provider/model token and cost fields on matched successful tasks before any hosted savings claim.",
-                "Use visual-crop-ocr only for caller-supplied visual evidence packs; this gate emits no images or evidence.",
+                "Keep this lane plan-only until a future PR supplies benchmark evidence and a separate runtime threat model.",
+                "Require verified exact sanitized text artifact fallback before relying on any omitted text.",
+                "Deny protected zones and prompt-like instructions before considering any future image/context packing.",
+                "Use provider-measured matched successful tasks before any hosted token/cost savings claim.",
             ],
         },
         "claim_boundary": (
-            "Dry-run image-context-pack planning only; image/request byte reductions are proxy evidence and no hosted "
-            "token/cost savings claim is allowed without provider-measured matched successful tasks."
+            "Dry-run image-context-pack planning gate only; no image rendering, OCR, image parsing, model/provider call, "
+            "proxy forwarding, binary artifact storage, replacement emission, or hosted token/cost savings claim is performed."
         ),
         "candidate_replacement": None,
     }
@@ -1936,8 +1946,8 @@ def command_plan_image_context_pack(args: argparse.Namespace) -> int:
     if args.json:
         emit_json(payload)
     else:
-        print("ContextGuard image-context-pack plan (dry-run only)")
-        print("No image rendering, OCR/image service, model call, proxy forwarding, binary artifact, or replacement was emitted.")
+        print("ContextGuard image-context-pack planning gate (dry-run only)")
+        print("No image rendering, OCR, model/provider call, proxy forwarding, file write, or replacement emission was performed.")
         print(f"Status: {payload['status']}")
         if payload["review_plan"]["readiness_blockers"]:
             print(f"Readiness blockers: {', '.join(payload['review_plan']['readiness_blockers'])}")
@@ -4679,25 +4689,41 @@ def build_parser() -> argparse.ArgumentParser:
 
     image_context_pack = plan_sub.add_parser(
         "image-context-pack",
-        help="Dry-run a plan-only pxpipe-inspired image/context packing gate without rendering images.",
+        help="Dry-run a plan-only image/context packing evaluation gate without rendering images or emitting replacements.",
     )
-    image_context_pack.add_argument("--source-label", help="Safe label for this image/context packing plan.")
-    image_context_pack.add_argument("--image-size", help="Optional source image/context canvas size as width,height integers.")
-    image_context_pack.add_argument("--packed-image-size", help="Optional planned packed image size as width,height integers.")
-    image_context_pack.add_argument("--exact-text-fallback-receipt", help="Local exact text artifact receipt id for omitted source text.")
-    image_context_pack.add_argument("--reexpand-command", help="Local exact text re-expand command bound to the receipt id.")
     image_context_pack.add_argument(
-        "--provider-boundary-ack",
+        "--evaluation-intent-ack",
         action="store_true",
-        help="Acknowledge hosted claims require provider-measured matched successful tasks for the target model.",
+        help="Acknowledge this is explicit future-evaluation planning only, not a runtime feature.",
     )
     image_context_pack.add_argument(
-        "--protected-zone-policy",
-        default="deny",
-        choices=("deny", "allow"),
-        help="Protected evidence handling; only deny can pass the plan gate.",
+        "--exact-text-fallback-ack",
+        action="store_true",
+        help="Acknowledge verified exact text artifact fallback is required before omitted text is relied on.",
+    )
+    image_context_pack.add_argument("--text-fallback-receipt", help="Local exact text artifact receipt id for future fallback review.")
+    image_context_pack.add_argument("--reexpand-command", help="Local exact text artifact re-expand command bound to the receipt id.")
+    image_context_pack.add_argument(
+        "--protected-zone-deny-ack",
+        action="store_true",
+        help="Acknowledge protected code/diff/path/hash/identifier/JSON/numeric/prompt-like zones must be denied.",
+    )
+    image_context_pack.add_argument(
+        "--provider-measurement-boundary-ack",
+        action="store_true",
+        help="Acknowledge hosted claims require provider-measured matched successful tasks.",
+    )
+    image_context_pack.add_argument(
+        "--missed-context-guardrail-ack",
+        action="store_true",
+        help="Acknowledge missed-context guardrails and human review are required before promotion.",
+    )
+    image_context_pack.add_argument(
+        "--visual-crop-ocr-relation-ack",
+        action="store_true",
+        help="Acknowledge visual-crop-ocr is the existing caller-supplied visual evidence-pack runtime, not a verified binary fallback.",
     )
-    image_context_pack.add_argument("--missed-context-note", action="append", help="Potential context omitted by a future pack. Repeatable.")
+    image_context_pack.add_argument("--proposed-image-size", help="Optional future image size as width,height; dry-run validation only.")
     image_context_pack.add_argument("--json", action="store_true", help="Emit JSON output.")
     image_context_pack.set_defaults(func=command_plan_image_context_pack)
 
diff --git a/research/experimental-token-reduction-radar.md b/research/experimental-token-reduction-radar.md
index c81baca..297f517 100644
--- a/research/experimental-token-reduction-radar.md
+++ b/research/experimental-token-reduction-radar.md
@@ -1,6 +1,6 @@
 # Experimental Token-Reduction Radar
 
-ContextGuard's shipped helpers reduce avoidable local context bloat before an AI coding agent sees it. This radar tracks **optional future experiments** plus narrow **graduated local experiments** such as the explicit context-diff, visual evidence-pack, learned-candidate, self-hosted metrics, local proxy gate-record, and one-shot loopback local proxy forwarding runtimes. Later-roadmap lanes are not shipped runtime features, and nothing here is a hosted API savings claim.
+ContextGuard's shipped helpers reduce avoidable local context bloat before an AI coding agent sees it. This radar tracks **optional future experiments** plus narrow **graduated local experiments** such as the explicit context-diff, visual evidence-pack, plan-only image-context-pack gate, learned-candidate, self-hosted metrics, local proxy gate-record, and one-shot loopback local proxy forwarding runtimes. Later-roadmap lanes are not shipped runtime features, and nothing here is a hosted API savings claim.
 
 ## Non-claims
 
@@ -64,19 +64,19 @@ Future PR checklist:
 - [ ] Show bounded-loss disclosure whenever lossy replacement is allowed.
 - [ ] Make no hosted token/cost savings claim from a smaller local diff alone.
 
-### Pxpipe-inspired image context pack gate
 
-`image-context-pack` is a plan-only pxpipe-inspired evaluation gate, not a shipped renderer, proxy, image artifact store, OCR pipeline, image parser, or replacement emitter. Any future image/context packing must keep exact text retrievable through a verified local text artifact receipt before omitted text is used, deny protected zones (code, diffs, identifiers, hashes, paths, numeric constants, JSON keys, stack frames, secrets, and prompt-like instructions), record missed-context guardrails, and treat image/request byte reductions as proxy evidence only.
+### Image-context-pack plan-only gate
 
-`context-guard experiments plan image-context-pack --json` emits deterministic planning metadata for that future work and no images, binary artifacts, evidence packs, replacement text, ledgers, listeners, proxy forwarding, model calls, OCR calls, or file writes. `visual-crop-ocr` remains the existing caller-supplied visual evidence-pack surface; `image-context-pack` is not a duplicate emitter and does not claim verified exact binary/image fallback. Provider/model-specific token or cost savings require matched successful tasks with provider-measured image/text token and cost fields before any hosted claim.
+`context-guard experiments plan image-context-pack` is a pxpipe-inspired, plan-only dry-run gate for evaluating whether future image/context packing is even safe to study. It is not a runtime feature: ContextGuard does not render images, run OCR, parse images, call models or providers, proxy traffic, store binary artifacts, write replacement evidence, or make hosted token/cost savings claims from this gate.
+
+The gate requires explicit evaluation intent, exact text artifact fallback before any omitted text is relied on, protected-zone denial for code, diffs, identifiers, hashes, paths, numeric constants, JSON keys, stack frames, secrets, and prompt-like instructions, missed-context guardrails, and provider-measured matched successful tasks before any hosted savings claim. `visual-crop-ocr` remains the existing caller-supplied visual evidence-pack surface; its visual handles are not a verified exact binary/image fallback, and `image-context-pack` is not a duplicate visual evidence emitter.
 
 Future PR checklist:
-- [ ] Keep `image-context-pack` plan-only unless a separate PR adds a verified runtime gate.
-- [ ] Verify exact text artifact fallback before any omitted text is used.
-- [ ] Deny protected zones, code, diffs, identifiers, paths, stack frames, numeric constants, hashes, JSON keys, secrets, and prompt-like instructions.
-- [ ] Record missed-context notes and human-review requirements.
-- [ ] Keep `visual-crop-ocr` as caller-supplied visual evidence only; do not duplicate it as an image-context-pack emitter.
-- [ ] Make no hosted token/cost savings claim from image/request byte reductions without provider-measured matched successful tasks.
+- [ ] Keep the lane plan-only and default off until a separate future runtime plan is approved.
+- [ ] Require verified exact text fallback before any future image/context pack can replace omitted text.
+- [ ] Deny protected-zone and prompt-like content rather than rendering or transforming it.
+- [ ] Track missed-context review and human-correction evidence before promotion.
+- [ ] Treat image/request byte reductions as proxy evidence until provider-measured matched tasks prove token/cost deltas.
 
 ### Opt-in local proxy constraints gate
 
@@ -188,5 +188,5 @@ First local runtime experiment: `context-guard experiments record self-hosted-me
 
 ## Current status
 
-This radar is intentionally conservative. The shipped ContextGuard tools remain local context hygiene, artifact receipts, context packing, tool-schema pruning, transcript audit, statusline visibility, benchmark evidence, plus the explicitly gated local context-diff emitter, visual crop/OCR evidence-pack emitter, plan-only image-context-pack gate, learned-compression candidate emitter, and self-hosted metrics sidecar recorder described above. Package-visible starter scaffolds live in [`../docs/experimental-benchmark-fixtures.md`](../docs/experimental-benchmark-fixtures.md). They are fixture-only synthetic task/variant examples and dry-run-only starters until prompts and success checks are replaced for a real experiment; they are not shipped runtime helpers, benchmark results, or hosted API savings evidence.
+This radar is intentionally conservative. The shipped ContextGuard tools remain local context hygiene, artifact receipts, context packing, tool-schema pruning, transcript audit, statusline visibility, benchmark evidence, plus the explicitly gated local context-diff emitter, visual crop/OCR evidence-pack emitter, plan-only image-context-pack dry-run gate, learned-compression candidate emitter, and self-hosted metrics sidecar recorder described above. Package-visible starter scaffolds live in [`../docs/experimental-benchmark-fixtures.md`](../docs/experimental-benchmark-fixtures.md). They are fixture-only synthetic task/variant examples and dry-run-only starters until prompts and success checks are replaced for a real experiment; they are not shipped runtime helpers, benchmark results, or hosted API savings evidence.
 Future experiments must pass the gates above before becoming product features.

From 9b80fd7d60dbef7d33cede0ea3cf41e7240de501 Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 12:02:18 +0900
Subject: [PATCH 15/29] omx(team): auto-checkpoint worker-1 [1]

---
 context-guard-kit/experimental_registry.py | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/context-guard-kit/experimental_registry.py b/context-guard-kit/experimental_registry.py
index 7b5d0c1..76059e2 100755
--- a/context-guard-kit/experimental_registry.py
+++ b/context-guard-kit/experimental_registry.py
@@ -304,11 +304,11 @@ def to_json(self, *, enabled: bool = False) -> dict[str, Any]:
             "plan-only dry-run gate with no emit/record/serve runtime and no stable behavior change."
         ),
         evidence_contract=(
-            "Plan output requires explicit opt-in, a verified exact text fallback receipt/re-expand handle before "
-            "omitted text is relied on, protected-zone denial, provider/model measurement boundaries, "
-            "and missed-context notes. relation_to_visual_crop_ocr: existing visual-crop-ocr packs are caller-supplied "
-            "visual evidence and are not verified exact binary/image fallback; image-context-pack is an inspired "
-            "evaluation planning gate, not a duplicate emitter."
+            "Plans require explicit opt-in, verified exact text artifact fallback receipt/re-expand metadata before "
+            "omitted exact text is used, protected-zone denial for code/diffs/identifiers/hashes/paths/numeric "
+            "constants/JSON keys/stack frames/secrets/prompt-like instructions, provider/model measured matched-task boundaries, "
+            "missed-context guardrails, and an explicit relation_to_visual_crop_ocr statement: visual-crop-ocr "
+            "remains caller-supplied visual evidence only and is not a verified exact binary/image fallback."
         ),
     ),
     Experiment(

From 2cad54c83cb6acd85f2fadf4c697829585136641 Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 11:58:23 +0900
Subject: [PATCH 16/29] omx(team): auto-checkpoint worker-1 [1]

---
 README.md                                  |  11 +-
 context-guard-kit/experimental_registry.py | 297 +++++++++----------
 tests/test_context_guard_kit.py            | 328 ++++++++++-----------
 3 files changed, 295 insertions(+), 341 deletions(-)

diff --git a/README.md b/README.md
index 8efa6b2..7461178 100644
--- a/README.md
+++ b/README.md
@@ -119,8 +119,8 @@ If you need a savings claim, measure it on your own tasks:
 - It does not execute command manifests as code or trust arbitrary `PATH`/current-working-directory helpers during setup or packaged smoke checks.
 - It does not replace real before/after measurement when you need a savings claim.
 - Local RAM/disk receipts can help reduce what you send next, but they do **not** replace Anthropic's provider prompt cache or guarantee cache hits. Recheck Anthropic prompt-caching and pricing docs before release or billing claims: https://docs.anthropic.com/en/build-with-claude/prompt-caching and https://platform.claude.com/docs/en/about-claude/pricing.
-- Experimental helpers are mostly dry-run checker/planner surfaces, including the plan-only pxpipe-inspired `image-context-pack` gate and a design-only external-forwarding opt-in gate. Explicit local runtimes exist only for caller-supplied context-diff replacement payloads, caller-supplied visual crop/OCR evidence packs, caller-supplied learned-compression prose candidates, self-hosted metrics JSONL sidecar records, local-proxy runtime-gate JSONL records, and one-shot `serve local-proxy` loopback forwarding with a private ready-file nonce, optional `--response-sandbox` compact artifact envelopes for safe UTF-8 responses, plus optional shifted-cost diagnostic JSONL rows for successful forwarded requests.
-- ContextGuard does not ship learned/synthetic compressor execution, embeddings, rerankers, model calls, generated replacement text, screenshot capture, image rendering, image cropping, OCR execution, image parsing, external OCR/image services, binary image fallback claims, self-hosted KV/latent inference optimization beyond explicit local metrics recording, or broader proxy forwarding beyond literal-loopback, one-request HTTP forwarding with credential material blocked.
+- Experimental helpers are mostly dry-run checker/planner surfaces, including a plan-only `image-context-pack` evaluation gate and a design-only external-forwarding opt-in gate. Explicit local runtimes exist only for caller-supplied context-diff replacement payloads, caller-supplied visual crop/OCR evidence packs, caller-supplied learned-compression prose candidates, self-hosted metrics JSONL sidecar records, local-proxy runtime-gate JSONL records, and one-shot `serve local-proxy` loopback forwarding with a private ready-file nonce, optional `--response-sandbox` compact artifact envelopes for safe UTF-8 responses, plus optional shifted-cost diagnostic JSONL rows for successful forwarded requests.
+- ContextGuard does not ship learned/synthetic compressor execution, embeddings, rerankers, model calls, generated replacement text, screenshot capture, image cropping, OCR execution, image parsing, external OCR/image services, self-hosted KV/latent inference optimization beyond explicit local metrics recording, or broader proxy forwarding beyond literal-loopback, one-request HTTP forwarding with credential material blocked.
 - It does not alias the old `/claude-token-optimizer:*` Claude Code slash-command namespace. Use `/context-guard:*` after installing this plugin.
 
 Legacy local CLI wrappers (`claude-token-*`, `claude-read-symbol`, `claude-trim-output`, and `claude-sanitize-output`) still ship as package files under `plugins/context-guard/bin/` so existing plugin-path automation can migrate gradually. npm global/`npx` bin links intentionally expose only the canonical `context-guard`/`context-guard-*` commands; call the legacy wrappers by package/plugin path if you still need them.
@@ -442,7 +442,7 @@ context-guard experiments emit context-diff-compaction --receipt-id <artifact-id
 context-guard experiments plan image-context-pack --json --explicit-opt-in --exact-text-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --protected-zone-policy deny --provider-measurement-boundary provider-measured-matched-tasks-required --missed-context-note "omitted text remains exactly retrievable" --image-size 800,600
 context-guard experiments plan visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --missed-context-note "outside crop omitted"
 context-guard experiments emit visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --ocr-text "visible text" --ocr-confidence 0.9 --ocr-error-note "glyph may be uncertain" --missed-context-note "outside crop omitted"
-context-guard experiments plan image-context-pack --json --evaluation-intent-ack --exact-text-fallback-ack --text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --protected-zone-deny-ack --provider-measurement-boundary-ack --missed-context-guardrail-ack --visual-crop-ocr-relation-ack
+context-guard experiments plan image-context-pack --json --exact-text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --provider-boundary-ack --missed-context-note "omitted text remains retrievable before any future image pack is used"
 context-guard experiments plan learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" < sanitized-prose.txt
 context-guard experiments emit learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --replacement-file compact-prose.txt < sanitized-prose.txt
 context-guard experiments plan self-hosted-metrics-ledger --json --latency-ms 123.5 --peak-memory-mb 2048 --quality-score 0.98
@@ -473,7 +473,7 @@ Shipped experimental checker/planner surfaces, plus explicit local context-diff,
 | --- | --- | --- |
 | `context-diff-compaction` | Dry-run diff advice plus an explicit `emit ... --receipt-id ... --reexpand-command ...` runtime for caller-supplied compact replacements. | `plan` emits no replacement. `emit` requires reviewable hunks, exact local artifact re-expand metadata whose stored content matches the input diff, and a smaller caller-supplied replacement; ContextGuard does not generate semantic compression or support hosted token/cost savings claims. |
 | `visual-crop-ocr` | Dry-run visual evidence advice plus an explicit `emit visual-crop-ocr` runtime for caller-supplied evidence packs. | `emit` requires a full visual evidence receipt, missed-context note, and complete user-supplied crop and/or OCR evidence; ContextGuard does not capture screenshots, crop images, run OCR, parse images, call external services, write files, or support hosted token/cost savings claims. |
-| `image-context-pack` | Plan-only dry-run gate for pxpipe-inspired image/context packing evaluation. | It requires explicit evaluation intent, exact text artifact fallback, protected-zone denial, provider-measured matched-task boundaries, missed-context guardrails, and acknowledgement that `visual-crop-ocr` is the existing caller-supplied visual evidence-pack surface. ContextGuard does not render images, run OCR, parse images, call models/providers, proxy traffic, store binary artifacts, emit replacement evidence, or support hosted token/cost savings claims. |
+| `image-context-pack` | Pxpipe-inspired dry-run plan metadata only for future image/context packing evaluation. | `plan` emits no image, replacement, evidence pack, binary artifact, ledger, listener, or proxy. It requires explicit opt-in, exact text fallback receipt/re-expand metadata before omitted text is used, protected-zone denial, missed-context notes, and provider/model measured matched-task boundaries. `visual-crop-ocr` remains the caller-supplied visual evidence-pack surface; `image-context-pack` is not a duplicate emitter or verified exact binary/image fallback. |
 | `learned-compression` | Deny-by-default policy checks plus an explicit `emit learned-compression` runtime for caller-supplied compact prose candidates with verified exact fallback content. | `emit` requires sanitized trusted prose, protected-signal denial, a verified local fallback artifact matching the input, and a smaller caller-supplied prose candidate; ContextGuard does not run compressors, embeddings, rerankers, model calls, subprocesses, external services, generated replacement text, or hosted savings claims. |
 | `self-hosted-metrics-ledger` | Dry-run preview plus an explicit `record ... --ledger-jsonl` runtime for local/model-server latency, memory, quality, energy, throughput, and local-cost metrics. | The dry-run preview does not write a ledger; the explicit record command writes only local JSONL sidecars and still does not support hosted API token/cost savings claims. |
 | `local-proxy` | Localhost-only advisory metadata, design-only `plan local-proxy-external-forwarding` review for future external forwarding, an explicit `record local-proxy-runtime-gate --ledger-jsonl` runtime for one local gate row, an explicit one-shot `serve local-proxy` loopback forwarding MVP, optional `--response-sandbox` compact artifact envelopes, and optional `--diagnostic-ledger-jsonl` shifted-cost diagnostics for successful forwarded requests. | `plan` writes no ledger. `record` writes only after localhost-only metadata and `--runtime-gate-ack`; it starts no listener, forwards no traffic, and performs no DNS lookup. `serve` additionally requires `--forwarding-gate-ack --once`, a private `--ready-file` nonce handoff, literal loopback bind/target IPs, nonzero ports, bounded bytes/timeouts, and credential-free requests; it performs no external forwarding, no CONNECT/TLS proxying, no API-key persistence, and no hosted-savings claim. `--response-sandbox` can store safe UTF-8 response text as a sanitized local artifact receipt and return a compact envelope with redacted rehydration command templates; it does not claim hosted token/cost savings. `--diagnostic-ledger-jsonl` writes only successful-forward diagnostics with no raw headers/bodies and no hosted-savings claim. `plan local-proxy-external-forwarding` emits threat-model/allowlist/redaction/provider-evidence design metadata only and still performs no DNS lookup, external service call, traffic forwarding, credential persistence, or hosted-savings claim. |
@@ -485,7 +485,8 @@ These are tracked directions, not committed features. Nothing here ships unless
 ContextGuard does not yet ship:
 
 - learned/synthetic compressor execution or generated replacement text beyond the caller-supplied learned candidate emitter
-- generated crop/OCR, visual-token pruning runtime, or image-context-pack rendering/runtime beyond the caller-supplied visual evidence-pack emitter and plan-only image-context-pack dry-run gate
+- generated crop/OCR or visual-token pruning runtime beyond the caller-supplied visual evidence-pack emitter
+- generated image-context-pack renderers, binary/image artifact fallback, or pxpipe-style proxy/runtime beyond the plan-only evaluation gate
 - self-hosted KV/latent optimization beyond explicit local metrics recording
 - external, daemon, or credential-bearing proxy forwarding beyond the one-shot literal-loopback local proxy MVP
 
diff --git a/context-guard-kit/experimental_registry.py b/context-guard-kit/experimental_registry.py
index 76059e2..fbc0d09 100755
--- a/context-guard-kit/experimental_registry.py
+++ b/context-guard-kit/experimental_registry.py
@@ -68,9 +68,8 @@
 LOCAL_PROXY_READY_SCHEMA_VERSION = "contextguard.experiments.local-proxy-ready.v1"
 LOCAL_PROXY_EXTERNAL_DESIGN_SCHEMA_VERSION = "contextguard.experiments.local-proxy-external-forwarding-design.v1"
 LOCAL_PROXY_RESPONSE_SANDBOX_SCHEMA_VERSION = "contextguard.experiments.local-proxy-response-sandbox.v1"
-IMAGE_CONTEXT_PACK_SCHEMA_VERSION = "contextguard.experiments.image-context-pack-plan.v1"
+IMAGE_CONTEXT_PACK_PLAN_SCHEMA_VERSION = "contextguard.experiments.image-context-pack-plan.v1"
 IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY = "provider-measured-matched-tasks-required"
-IMAGE_CONTEXT_PACK_PROTECTED_POLICY = "deny"
 LOCAL_PROXY_DEFAULT_BIND_HOST = "127.0.0.1"
 LOCAL_PROXY_DEFAULT_BIND_PORT = 0
 LOCAL_PROXY_DEFAULT_TARGET_HOST = "127.0.0.1"
@@ -265,10 +264,10 @@ def to_json(self, *, enabled: bool = False) -> dict[str, Any]:
     ),
     Experiment(
         id="image-context-pack",
-        name="Image context pack planning gate",
+        name="Pxpipe-inspired image context pack planning gate",
         summary=(
-            "Plan-only pxpipe-inspired evaluation gate for future image/context packing; it never renders images, "
-            "runs OCR, stores binaries, calls models/providers, or emits replacement evidence."
+            "Plan-only evaluation gate for pxpipe-inspired image/context packing without rendering images, "
+            "emitting visual artifacts, or changing runtime behavior."
         ),
         stability="experimental",
         default_enabled=False,
@@ -279,34 +278,33 @@ def to_json(self, *, enabled: bool = False) -> dict[str, Any]:
         ),
         gate_requirements=(
             "explicit opt-in",
-            "verified exact text artifact fallback before omitted text is relied on",
+            "verified exact text artifact fallback before omitted text is used",
             "protected-zone denial",
             "provider/model measurement boundary",
             "missed-context guardrails",
-            "relation to visual-crop-ocr documented",
+            "relation to visual-crop-ocr",
         ),
         runtime_status="available-plan-only",
         commands=("context-guard experiments plan image-context-pack",),
         opt_in_flags=(
             "plan image-context-pack",
-            "--evaluation-intent-ack",
-            "--exact-text-fallback-ack",
-            "--text-fallback-receipt",
+            "--exact-text-fallback-receipt",
             "--reexpand-command",
-            "--protected-zone-deny-ack",
-            "--provider-measurement-boundary-ack",
-            "--missed-context-guardrail-ack",
-            "--visual-crop-ocr-relation-ack",
-            "--proposed-image-size",
+            "--provider-boundary-ack",
+            "--protected-zone-policy deny",
+            "--missed-context-note",
+            "--image-size",
+            "--packed-image-size",
         ),
         config_effect=(
-            "Registry enablement records project-local intent only; image-context-pack remains a deterministic "
-            "plan-only dry-run gate with no emit/record/serve runtime and no stable behavior change."
+            "Registry enablement records project-local intent only; image-context-pack exposes only a deterministic "
+            "plan command. It does not add an emit/record/serve runtime, render images, run OCR, call models, proxy "
+            "traffic, write binary artifacts, or duplicate the caller-supplied visual-crop-ocr evidence-pack emitter."
         ),
         evidence_contract=(
-            "Plans require explicit opt-in, verified exact text artifact fallback receipt/re-expand metadata before "
-            "omitted exact text is used, protected-zone denial for code/diffs/identifiers/hashes/paths/numeric "
-            "constants/JSON keys/stack frames/secrets/prompt-like instructions, provider/model measured matched-task boundaries, "
+            "Plans require explicit opt-in, exact text fallback receipt/re-expand metadata before omitted exact text "
+            "is used, protected-zone denial for code/diffs/identifiers/hashes/paths/numeric constants/JSON keys/"
+            "stack frames/secrets/prompt-like instructions, provider/model measured matched-task boundaries, "
             "missed-context guardrails, and an explicit relation_to_visual_crop_ocr statement: visual-crop-ocr "
             "remains caller-supplied visual evidence only and is not a verified exact binary/image fallback."
         ),
@@ -1787,157 +1785,148 @@ def command_plan_visual_crop_ocr(args: argparse.Namespace) -> int:
     return 0
 
 
+def image_context_pack_size_payload(raw: str | None) -> tuple[dict[str, Any] | None, bool]:
+    size = parse_int_tuple(raw, count=2)
+    if raw is None or not str(raw).strip():
+        return None, True
+    if size is None:
+        return None, False
+    width, height = size
+    if width <= 0 or height <= 0:
+        return {"width": width, "height": height}, False
+    return {"width": width, "height": height}, True
+
+
 def image_context_pack_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
-    receipt_id = args.text_fallback_receipt.strip() if args.text_fallback_receipt else None
+    receipt_id = args.exact_text_fallback_receipt.strip() if args.exact_text_fallback_receipt else None
     reexpand_command = args.reexpand_command.strip() if args.reexpand_command else None
     reexpand_valid, fallback_blocker = valid_learned_reexpand_command(receipt_id, reexpand_command)
-    proposed_image_size = parse_int_tuple(args.proposed_image_size, count=2)
-    image_payload = None
-    image_size_valid = args.proposed_image_size is None
-    if proposed_image_size is not None:
-        width, height = proposed_image_size
-        image_size_valid = (
-            0 < width <= IMAGE_CONTEXT_PACK_MAX_DIMENSION
-            and 0 < height <= IMAGE_CONTEXT_PACK_MAX_DIMENSION
-        )
-        image_payload = {"width": width, "height": height}
-    elif args.proposed_image_size is not None:
-        image_size_valid = False
+    fallback_blocker_map = {
+        "missing_exact_fallback": "missing_exact_text_fallback",
+        "invalid_reexpand_command": "invalid_exact_text_reexpand_command",
+    }
+    source_size, source_size_valid = image_context_pack_size_payload(args.image_size)
+    packed_size, packed_size_valid = image_context_pack_size_payload(args.packed_image_size)
+    missed_context_notes = clean_values(args.missed_context_note)
+    protected_policy = (args.protected_zone_policy or "deny").strip().lower()
 
     blockers: list[str] = []
-    if not args.evaluation_intent_ack:
-        blockers.append("missing_evaluation_intent_ack")
-    if not args.exact_text_fallback_ack:
-        blockers.append("missing_exact_text_fallback_ack")
     if fallback_blocker:
-        blockers.append(fallback_blocker)
-    if not args.protected_zone_deny_ack:
-        blockers.append("missing_protected_zone_deny_ack")
-    if not args.provider_measurement_boundary_ack:
-        blockers.append("missing_provider_measurement_boundary_ack")
-    if not args.missed_context_guardrail_ack:
-        blockers.append("missing_missed_context_guardrail_ack")
-    if not args.visual_crop_ocr_relation_ack:
-        blockers.append("missing_visual_crop_ocr_relation_ack")
-    if not image_size_valid:
-        blockers.append("invalid_proposed_image_size")
+        blockers.append(fallback_blocker_map.get(fallback_blocker, fallback_blocker))
+    if not args.provider_boundary_ack:
+        blockers.append("missing_provider_measurement_boundary")
+    if not missed_context_notes:
+        blockers.append("missing_missed_context_note")
+    if protected_policy != "deny":
+        blockers.append("protected_zone_denial_required")
+    if not source_size_valid:
+        blockers.append("invalid_image_size")
+    if not packed_size_valid:
+        blockers.append("invalid_packed_image_size")
     blockers = list(dict.fromkeys(blockers))
+
+    source_area = source_size["width"] * source_size["height"] if source_size and source_size_valid else None
+    packed_area = packed_size["width"] * packed_size["height"] if packed_size and packed_size_valid else None
+    area_delta = source_area - packed_area if source_area is not None and packed_area is not None else None
     ready = not blockers
 
-    protected_classes = [
-        "code",
-        "diffs",
-        "identifiers",
-        "hashes",
-        "paths",
-        "numeric constants",
-        "JSON keys",
-        "stack frames",
-        "secrets",
-        "prompt-like instructions",
-    ]
     return {
         "tool": TOOL_NAME,
         "schema_version": CONFIG_SCHEMA_VERSION,
+        "plan_schema_version": IMAGE_CONTEXT_PACK_PLAN_SCHEMA_VERSION,
         "experiment_id": "image-context-pack",
         "mode": "dry_run",
-        "status": "ready_for_experiment_design_review" if ready else "blocked_until_plan_constraints",
-        "policy": {
-            "default_off": True,
-            "plan_only": True,
-            "explicit_opt_in_required": True,
-            "emit_runtime_implemented": False,
-            "record_runtime_implemented": False,
-            "serve_runtime_implemented": False,
-            "image_rendering_allowed": False,
-            "ocr_allowed": False,
-            "image_parsing_allowed": False,
-            "model_call_allowed": False,
-            "provider_call_allowed": False,
-            "proxy_forwarding_allowed": False,
-            "binary_artifact_storage_allowed": False,
-            "replacement_emitted": False,
-            "stable_runtime_behavior_changed": False,
-            "hosted_api_token_savings_claim_allowed": False,
-            "hosted_api_cost_savings_claim_allowed": False,
+        "status": "ready_for_plan_review" if ready else "blocked_until_image_context_pack_gate_ready",
+        "plan_only": {
+            "command_advertised": True,
+            "emit_command_available": False,
+            "record_command_available": False,
+            "serve_command_available": False,
+            "runtime_behavior_changed": False,
+            "replacement_or_visual_evidence_emitted": False,
         },
         "external_services": {
             "called": False,
             "network": False,
+            "model_calls": False,
             "ocr_service": None,
             "image_service": None,
-            "model_provider": None,
+            "proxy_forwarding": False,
         },
-        "network_actions": {
-            "listener_started": False,
-            "traffic_forwarded": False,
-            "dns_lookup_attempted": False,
-            "external_services_called": False,
-        },
-        "file_system_actions": {
+        "runtime_side_effects": {
             "files_written": False,
+            "image_rendering": False,
+            "ocr_execution": False,
+            "image_parsing": False,
             "binary_artifacts_written": False,
-            "image_artifacts_written": False,
+            "proxy_forwarding": False,
+            "stable_runtime_behavior_changed": False,
         },
-        "exact_text_fallback": {
+        "text_fallback": {
             "required": True,
-            "caller_acknowledged": bool(args.exact_text_fallback_ack),
-            "available": bool(receipt_id and reexpand_command and reexpand_valid),
+            "available": bool(reexpand_valid),
             "receipt_id": receipt_id,
-            "cli": reexpand_command,
+            "reexpand_command": reexpand_command,
             "verified": False,
-            "verified_before_use_required": True,
-            "note": "Only exact sanitized text artifact fallback may support omitted text; binary/image handles are not verified exact fallback.",
+            "must_be_verified_before_omitted_text_is_used": True,
+            "note": (
+                "This dry-run validates only local receipt/re-expand shape. A future runtime must verify exact "
+                "text artifact content before relying on omitted exact text."
+            ),
         },
-        "protected_zone_policy": {
-            "deny_required": True,
-            "caller_acknowledged": bool(args.protected_zone_deny_ack),
+        "protected_zones": {
+            "policy": protected_policy,
             "override_allowed": False,
-            "denied_classes": protected_classes,
+            "denied_classes": [
+                "code",
+                "diffs",
+                "identifiers",
+                "hashes",
+                "paths",
+                "numeric_constants",
+                "json_keys",
+                "stack_frames",
+                "secrets",
+                "prompt_like_instructions",
+            ],
+        },
+        "image_pack_plan": {
+            "source_label": sanitize_self_hosted_text(args.source_label) if args.source_label else "manual-plan",
+            "source_image_size": source_size,
+            "packed_image_size": packed_size,
+            "source_area": source_area,
+            "packed_area": packed_area,
+            "area_delta": area_delta,
+            "area_reduction_is_proxy_only": area_delta is not None,
+            "image_or_request_byte_reductions_are_proxy_evidence_only": True,
         },
-        "provider_measurement_boundary": {
-            "caller_acknowledged": bool(args.provider_measurement_boundary_ack),
-            "image_request_byte_reductions_proxy_only": True,
-            "provider_model_measurement_required_for_claims": True,
-            "matched_successful_tasks_required": True,
+        "measurement_boundary": {
+            "provider_boundary_acknowledged": bool(args.provider_boundary_ack),
+            "provider_boundary_policy": IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY,
+            "provider_measured_matched_tasks_required_for_hosted_claims": True,
+            "provider_model_specific": True,
             "hosted_api_token_savings_claim_allowed": False,
             "hosted_api_cost_savings_claim_allowed": False,
         },
-        "missed_context_guardrail": {
-            "caller_acknowledged": bool(args.missed_context_guardrail_ack),
-            "required_before_promotion": True,
-            "human_review_required": True,
-        },
         "relation_to_visual_crop_ocr": {
-            "visual_crop_ocr_surface": "existing caller-supplied visual evidence-pack emitter",
-            "image_context_pack_surface": "pxpipe-inspired plan-only evaluation gate",
-            "duplicate_emitter": False,
-            "visual_handles_verified_exact_binary_fallback": False,
-            "note": (
-                "visual-crop-ocr remains the explicit caller-supplied visual evidence-pack runtime; "
-                "image-context-pack does not emit images, OCR, replacement evidence, or verified binary fallback."
-            ),
-        },
-        "proposed_image_context_pack": {
-            "image_size": image_payload,
-            "image_size_valid": image_size_valid,
-            "max_dimension": IMAGE_CONTEXT_PACK_MAX_DIMENSION,
-            "render_performed": False,
-            "image_bytes_computed": False,
-            "binary_receipt_created": False,
+            "visual_crop_ocr_is_existing_surface": True,
+            "visual_crop_ocr_remains_caller_supplied_visual_evidence_pack": True,
+            "image_context_pack_is_planning_gate_not_duplicate_emitter": True,
+            "verified_exact_binary_or_image_fallback_claimed": False,
         },
         "review_plan": {
             "readiness_blockers": blockers,
+            "missed_context_notes": missed_context_notes,
             "next_steps": [
-                "Keep this lane plan-only until a future PR supplies benchmark evidence and a separate runtime threat model.",
-                "Require verified exact sanitized text artifact fallback before relying on any omitted text.",
-                "Deny protected zones and prompt-like instructions before considering any future image/context packing.",
-                "Use provider-measured matched successful tasks before any hosted token/cost savings claim.",
+                "Keep exact text artifact fallback verified before any future image/context packing omits source text.",
+                "Deny protected evidence zones before any future lossy visual packing is considered.",
+                "Measure provider/model token and cost fields on matched successful tasks before any hosted savings claim.",
+                "Use visual-crop-ocr only for caller-supplied visual evidence packs; this gate emits no images or evidence.",
             ],
         },
         "claim_boundary": (
-            "Dry-run image-context-pack planning gate only; no image rendering, OCR, image parsing, model/provider call, "
-            "proxy forwarding, binary artifact storage, replacement emission, or hosted token/cost savings claim is performed."
+            "Dry-run image-context-pack planning only; image/request byte reductions are proxy evidence and no hosted "
+            "token/cost savings claim is allowed without provider-measured matched successful tasks."
         ),
         "candidate_replacement": None,
     }
@@ -1948,8 +1937,8 @@ def command_plan_image_context_pack(args: argparse.Namespace) -> int:
     if args.json:
         emit_json(payload)
     else:
-        print("ContextGuard image-context-pack planning gate (dry-run only)")
-        print("No image rendering, OCR, model/provider call, proxy forwarding, file write, or replacement emission was performed.")
+        print("ContextGuard image-context-pack plan (dry-run only)")
+        print("No image rendering, OCR/image service, model call, proxy forwarding, binary artifact, or replacement was emitted.")
         print(f"Status: {payload['status']}")
         if payload["review_plan"]["readiness_blockers"]:
             print(f"Readiness blockers: {', '.join(payload['review_plan']['readiness_blockers'])}")
@@ -4691,41 +4680,25 @@ def build_parser() -> argparse.ArgumentParser:
 
     image_context_pack = plan_sub.add_parser(
         "image-context-pack",
-        help="Dry-run a plan-only image/context packing evaluation gate without rendering images or emitting replacements.",
+        help="Dry-run a plan-only pxpipe-inspired image/context packing gate without rendering images.",
     )
+    image_context_pack.add_argument("--source-label", help="Safe label for this image/context packing plan.")
+    image_context_pack.add_argument("--image-size", help="Optional source image/context canvas size as width,height integers.")
+    image_context_pack.add_argument("--packed-image-size", help="Optional planned packed image size as width,height integers.")
+    image_context_pack.add_argument("--exact-text-fallback-receipt", help="Local exact text artifact receipt id for omitted source text.")
+    image_context_pack.add_argument("--reexpand-command", help="Local exact text re-expand command bound to the receipt id.")
     image_context_pack.add_argument(
-        "--evaluation-intent-ack",
+        "--provider-boundary-ack",
         action="store_true",
-        help="Acknowledge this is explicit future-evaluation planning only, not a runtime feature.",
+        help="Acknowledge hosted claims require provider-measured matched successful tasks for the target model.",
     )
     image_context_pack.add_argument(
-        "--exact-text-fallback-ack",
-        action="store_true",
-        help="Acknowledge verified exact text artifact fallback is required before omitted text is relied on.",
-    )
-    image_context_pack.add_argument("--text-fallback-receipt", help="Local exact text artifact receipt id for future fallback review.")
-    image_context_pack.add_argument("--reexpand-command", help="Local exact text artifact re-expand command bound to the receipt id.")
-    image_context_pack.add_argument(
-        "--protected-zone-deny-ack",
-        action="store_true",
-        help="Acknowledge protected code/diff/path/hash/identifier/JSON/numeric/prompt-like zones must be denied.",
-    )
-    image_context_pack.add_argument(
-        "--provider-measurement-boundary-ack",
-        action="store_true",
-        help="Acknowledge hosted claims require provider-measured matched successful tasks.",
-    )
-    image_context_pack.add_argument(
-        "--missed-context-guardrail-ack",
-        action="store_true",
-        help="Acknowledge missed-context guardrails and human review are required before promotion.",
-    )
-    image_context_pack.add_argument(
-        "--visual-crop-ocr-relation-ack",
-        action="store_true",
-        help="Acknowledge visual-crop-ocr is the existing caller-supplied visual evidence-pack runtime, not a verified binary fallback.",
+        "--protected-zone-policy",
+        default="deny",
+        choices=("deny", "allow"),
+        help="Protected evidence handling; only deny can pass the plan gate.",
     )
-    image_context_pack.add_argument("--proposed-image-size", help="Optional future image size as width,height; dry-run validation only.")
+    image_context_pack.add_argument("--missed-context-note", action="append", help="Potential context omitted by a future pack. Repeatable.")
     image_context_pack.add_argument("--json", action="store_true", help="Emit JSON output.")
     image_context_pack.set_defaults(func=command_plan_image_context_pack)
 
@@ -5019,7 +4992,7 @@ def normalize_negative_csv_option_values(argv: list[str] | None) -> list[str] |
         argv = sys.argv[1:]
     normalized: list[str] = []
     pending_csv_option: str | None = None
-    csv_options = {"--crop-bounds", "--image-size"}
+    csv_options = {"--crop-bounds", "--image-size", "--packed-image-size"}
     for token in argv:
         if pending_csv_option is not None:
             normalized.append(f"{pending_csv_option}={token}")
diff --git a/tests/test_context_guard_kit.py b/tests/test_context_guard_kit.py
index ba94716..88266c2 100644
--- a/tests/test_context_guard_kit.py
+++ b/tests/test_context_guard_kit.py
@@ -1669,24 +1669,24 @@ def test_experimental_registry_describes_safe_explicit_flag_surfaces(self):
                         self.assertIn("full visual evidence receipt", visual_ocr["evidence_contract"])
                         self.assertIn("missed-context", visual_ocr["evidence_contract"].lower())
 
-                        image_pack = experiments["image-context-pack"]
-                        self.assertEqual(image_pack["runtime_status"], "available-plan-only")
-                        self.assertFalse(image_pack["default_enabled"])
-                        self.assertIn("context-guard experiments plan image-context-pack", image_pack["commands"])
-                        self.assertNotIn("context-guard experiments emit image-context-pack", image_pack["commands"])
-                        self.assertIn("plan image-context-pack", image_pack["opt_in_flags"])
-                        self.assertIn("--evaluation-intent-ack", image_pack["opt_in_flags"])
-                        self.assertIn("--exact-text-fallback-ack", image_pack["opt_in_flags"])
-                        self.assertIn("--protected-zone-deny-ack", image_pack["opt_in_flags"])
-                        self.assertIn("--provider-measurement-boundary-ack", image_pack["opt_in_flags"])
-                        self.assertIn("--missed-context-guardrail-ack", image_pack["opt_in_flags"])
-                        self.assertIn("--visual-crop-ocr-relation-ack", image_pack["opt_in_flags"])
-                        self.assertIn("plan-only dry-run gate", image_pack["config_effect"])
-                        self.assertIn("no emit/record/serve runtime", image_pack["config_effect"])
-                        self.assertIn("protected-zone denial", image_pack["evidence_contract"])
-                        self.assertIn("visual-crop-ocr", image_pack["evidence_contract"])
-                        self.assertIn("not a verified exact binary/image fallback", image_pack["evidence_contract"])
-                        self.assertIn("provider-measured matched successful tasks", image_pack["claim_boundary"])
+                        image_context_pack = experiments["image-context-pack"]
+                        self.assertFalse(image_context_pack["default_enabled"])
+                        self.assertEqual(image_context_pack["runtime_status"], "available-plan-only")
+                        self.assertEqual(image_context_pack["commands"], ["context-guard experiments plan image-context-pack"])
+                        self.assertIn("plan image-context-pack", image_context_pack["opt_in_flags"])
+                        self.assertIn("--exact-text-fallback-receipt", image_context_pack["opt_in_flags"])
+                        self.assertIn("--provider-boundary-ack", image_context_pack["opt_in_flags"])
+                        self.assertIn("--protected-zone-policy deny", image_context_pack["opt_in_flags"])
+                        self.assertIn("deterministic plan command", image_context_pack["config_effect"])
+                        self.assertIn("does not add an emit/record/serve runtime", image_context_pack["config_effect"])
+                        self.assertIn("render images", image_context_pack["config_effect"])
+                        self.assertIn("proxy traffic", image_context_pack["config_effect"])
+                        self.assertIn("visual-crop-ocr", image_context_pack["evidence_contract"])
+                        self.assertIn("verified exact text artifact fallback", image_context_pack["evidence_contract"])
+                        self.assertIn("provider/model measured matched-task", image_context_pack["evidence_contract"])
+                        self.assertNotIn("emit image-context-pack", " ".join(image_context_pack["commands"]))
+                        self.assertNotIn("record image-context-pack", " ".join(image_context_pack["commands"]))
+                        self.assertNotIn("serve image-context-pack", " ".join(image_context_pack["commands"]))
 
                         learned = experiments["learned-compression"]
                         self.assertEqual(learned["runtime_status"], "available-explicit-runtime")
@@ -2830,182 +2830,162 @@ def test_experimental_visual_crop_ocr_dispatcher_and_no_service_surface(self):
             self.assertNotIn(forbidden, source)
         self.assertIn("LOCAL_PROXY_FORWARD_SCHEMA_VERSION", source)
 
-    def test_experimental_image_context_pack_plan_only_gate_json_contract(self):
-        receipt_id = "abcdef1234567890"
-        ready_args = [
-            "plan",
-            "image-context-pack",
-            "--evaluation-intent-ack",
-            "--exact-text-fallback-ack",
-            "--text-fallback-receipt",
-            receipt_id,
-            "--reexpand-command",
-            f"context-guard-artifact get {receipt_id} --full",
-            "--protected-zone-deny-ack",
-            "--provider-measurement-boundary-ack",
-            "--missed-context-guardrail-ack",
-            "--visual-crop-ocr-relation-ack",
-            "--proposed-image-size",
-            "640,480",
-            "--json",
-        ]
+    def test_experimental_image_context_pack_plan_only_contract(self):
+        receipt = "0123456789abcdef"
         for script in EXPERIMENT_SCRIPTS:
             with self.subTest(script=script):
-                blocked = subprocess.run(
-                    [sys.executable, str(script), "plan", "image-context-pack", "--json"],
-                    text=True,
-                    capture_output=True,
-                    check=True,
-                )
-                blocked_payload = json.loads(blocked.stdout)
-                self.assertEqual(blocked_payload["tool"], "context-guard-experiments")
-                self.assertEqual(blocked_payload["schema_version"], "contextguard.experiments.v1")
-                self.assertEqual(blocked_payload["experiment_id"], "image-context-pack")
-                self.assertEqual(blocked_payload["mode"], "dry_run")
-                self.assertEqual(blocked_payload["status"], "blocked_until_plan_constraints")
-                self.assertIn("missing_evaluation_intent_ack", blocked_payload["review_plan"]["readiness_blockers"])
-                self.assertIn("missing_exact_text_fallback_ack", blocked_payload["review_plan"]["readiness_blockers"])
-                self.assertIn("missing_exact_fallback", blocked_payload["review_plan"]["readiness_blockers"])
-                self.assertIn("missing_protected_zone_deny_ack", blocked_payload["review_plan"]["readiness_blockers"])
-                self.assertIn("missing_provider_measurement_boundary_ack", blocked_payload["review_plan"]["readiness_blockers"])
-                self.assertIn("missing_missed_context_guardrail_ack", blocked_payload["review_plan"]["readiness_blockers"])
-                self.assertIn("missing_visual_crop_ocr_relation_ack", blocked_payload["review_plan"]["readiness_blockers"])
-                self.assertFalse(blocked_payload["policy"]["emit_runtime_implemented"])
-                self.assertFalse(blocked_payload["policy"]["image_rendering_allowed"])
-                self.assertFalse(blocked_payload["policy"]["ocr_allowed"])
-                self.assertFalse(blocked_payload["policy"]["model_call_allowed"])
-                self.assertFalse(blocked_payload["policy"]["provider_call_allowed"])
-                self.assertFalse(blocked_payload["policy"]["proxy_forwarding_allowed"])
-                self.assertFalse(blocked_payload["policy"]["binary_artifact_storage_allowed"])
-                self.assertFalse(blocked_payload["external_services"]["called"])
-                self.assertFalse(blocked_payload["network_actions"]["traffic_forwarded"])
-                self.assertFalse(blocked_payload["file_system_actions"]["files_written"])
-                self.assertFalse(blocked_payload["file_system_actions"]["binary_artifacts_written"])
-                self.assertIsNone(blocked_payload["candidate_replacement"])
-                self.assertNotIn("evidence_pack", blocked_payload)
-                self.assertNotIn("artifact_path", json.dumps(blocked_payload))
-                self.assertIn("visual-crop-ocr", blocked_payload["relation_to_visual_crop_ocr"]["note"])
-                self.assertFalse(blocked_payload["relation_to_visual_crop_ocr"]["duplicate_emitter"])
-                self.assertFalse(blocked_payload["relation_to_visual_crop_ocr"]["visual_handles_verified_exact_binary_fallback"])
-                self.assertIn("no image rendering", blocked_payload["claim_boundary"].lower())
-                self.assertIn("hosted token/cost savings", blocked_payload["claim_boundary"].lower())
-
-                with tempfile.TemporaryDirectory() as tmp:
-                    root = Path(tmp)
-                    before = sorted(path.relative_to(root).as_posix() for path in root.rglob("*"))
-                    first = subprocess.run(
-                        [sys.executable, str(script), *ready_args],
-                        cwd=root,
-                        text=True,
-                        capture_output=True,
-                        check=True,
-                    )
-                    second = subprocess.run(
-                        [sys.executable, str(script), *ready_args],
-                        cwd=root,
-                        text=True,
-                        capture_output=True,
-                        check=True,
-                    )
-                    self.assertEqual(json.loads(first.stdout), json.loads(second.stdout))
-                    ready_payload = json.loads(first.stdout)
-                    self.assertEqual(ready_payload["status"], "ready_for_experiment_design_review")
-                    self.assertEqual(ready_payload["review_plan"]["readiness_blockers"], [])
-                    self.assertTrue(ready_payload["exact_text_fallback"]["available"])
-                    self.assertFalse(ready_payload["exact_text_fallback"]["verified"])
-                    self.assertTrue(ready_payload["exact_text_fallback"]["verified_before_use_required"])
-                    self.assertEqual(ready_payload["proposed_image_context_pack"]["image_size"]["width"], 640)
-                    self.assertFalse(ready_payload["proposed_image_context_pack"]["render_performed"])
-                    self.assertFalse(ready_payload["proposed_image_context_pack"]["binary_receipt_created"])
-                    after = sorted(path.relative_to(root).as_posix() for path in root.rglob("*"))
-                    self.assertEqual(after, before)
-
-                invalid_size = subprocess.run(
+                proc = subprocess.run(
                     [
                         sys.executable,
                         str(script),
                         "plan",
                         "image-context-pack",
-                        "--evaluation-intent-ack",
-                        "--exact-text-fallback-ack",
-                        "--text-fallback-receipt",
-                        receipt_id,
+                        "--exact-text-fallback-receipt",
+                        receipt,
                         "--reexpand-command",
-                        f"context-guard-artifact get {receipt_id} --full",
-                        "--protected-zone-deny-ack",
-                        "--provider-measurement-boundary-ack",
-                        "--missed-context-guardrail-ack",
-                        "--visual-crop-ocr-relation-ack",
-                        "--proposed-image-size",
-                        "20000,10",
+                        f"context-guard-artifact get {receipt} --full",
+                        "--provider-boundary-ack",
+                        "--missed-context-note",
+                        "summary table footer remains available through exact text fallback",
+                        "--image-size",
+                        "800,600",
+                        "--packed-image-size",
+                        "400,300",
                         "--json",
                     ],
                     text=True,
                     capture_output=True,
                     check=True,
                 )
-                self.assertIn("invalid_proposed_image_size", json.loads(invalid_size.stdout)["review_plan"]["readiness_blockers"])
+                payload = json.loads(proc.stdout)
+                self.assertEqual(payload["tool"], "context-guard-experiments")
+                self.assertEqual(payload["schema_version"], "contextguard.experiments.v1")
+                self.assertEqual(payload["plan_schema_version"], "contextguard.experiments.image-context-pack-plan.v1")
+                self.assertEqual(payload["experiment_id"], "image-context-pack")
+                self.assertEqual(payload["mode"], "dry_run")
+                self.assertEqual(payload["status"], "ready_for_plan_review")
+                self.assertEqual(payload["review_plan"]["readiness_blockers"], [])
+                self.assertTrue(payload["plan_only"]["command_advertised"])
+                self.assertFalse(payload["plan_only"]["emit_command_available"])
+                self.assertFalse(payload["plan_only"]["record_command_available"])
+                self.assertFalse(payload["plan_only"]["serve_command_available"])
+                self.assertFalse(payload["plan_only"]["replacement_or_visual_evidence_emitted"])
+                self.assertFalse(payload["external_services"]["called"])
+                self.assertFalse(payload["external_services"]["network"])
+                self.assertFalse(payload["external_services"]["model_calls"])
+                self.assertFalse(payload["external_services"]["proxy_forwarding"])
+                self.assertFalse(payload["runtime_side_effects"]["files_written"])
+                self.assertFalse(payload["runtime_side_effects"]["image_rendering"])
+                self.assertFalse(payload["runtime_side_effects"]["ocr_execution"])
+                self.assertFalse(payload["runtime_side_effects"]["image_parsing"])
+                self.assertFalse(payload["runtime_side_effects"]["binary_artifacts_written"])
+                self.assertFalse(payload["runtime_side_effects"]["proxy_forwarding"])
+                self.assertTrue(payload["text_fallback"]["required"])
+                self.assertTrue(payload["text_fallback"]["available"])
+                self.assertFalse(payload["text_fallback"]["verified"])
+                self.assertTrue(payload["text_fallback"]["must_be_verified_before_omitted_text_is_used"])
+                self.assertEqual(payload["protected_zones"]["policy"], "deny")
+                self.assertFalse(payload["protected_zones"]["override_allowed"])
+                for protected_class in ("code", "diffs", "identifiers", "hashes", "paths", "numeric_constants", "json_keys", "stack_frames", "secrets", "prompt_like_instructions"):
+                    self.assertIn(protected_class, payload["protected_zones"]["denied_classes"])
+                self.assertTrue(payload["measurement_boundary"]["provider_boundary_acknowledged"])
+                self.assertTrue(payload["measurement_boundary"]["provider_measured_matched_tasks_required_for_hosted_claims"])
+                self.assertFalse(payload["measurement_boundary"]["hosted_api_token_savings_claim_allowed"])
+                self.assertFalse(payload["measurement_boundary"]["hosted_api_cost_savings_claim_allowed"])
+                self.assertTrue(payload["image_pack_plan"]["image_or_request_byte_reductions_are_proxy_evidence_only"])
+                self.assertEqual(payload["image_pack_plan"]["source_area"], 480000)
+                self.assertEqual(payload["image_pack_plan"]["packed_area"], 120000)
+                self.assertEqual(payload["image_pack_plan"]["area_delta"], 360000)
+                relation = payload["relation_to_visual_crop_ocr"]
+                self.assertTrue(relation["visual_crop_ocr_is_existing_surface"])
+                self.assertTrue(relation["visual_crop_ocr_remains_caller_supplied_visual_evidence_pack"])
+                self.assertTrue(relation["image_context_pack_is_planning_gate_not_duplicate_emitter"])
+                self.assertFalse(relation["verified_exact_binary_or_image_fallback_claimed"])
+                self.assertIn("proxy evidence", payload["claim_boundary"])
+                self.assertIsNone(payload["candidate_replacement"])
 
-                emit = subprocess.run(
-                    [sys.executable, str(script), "emit", "image-context-pack", "--json"],
-                    text=True,
-                    capture_output=True,
-                )
-                self.assertNotEqual(emit.returncode, 0)
-                self.assertIn("invalid choice", emit.stderr)
-                self.assertNotIn("Traceback", emit.stderr + emit.stdout)
+    def test_experimental_image_context_pack_blocks_missing_or_unsafe_gates(self):
+        receipt = "0123456789abcdef"
+        cases = [
+            (
+                "missing-provider-boundary",
+                [
+                    "--exact-text-fallback-receipt",
+                    receipt,
+                    "--reexpand-command",
+                    f"context-guard-artifact get {receipt} --full",
+                    "--missed-context-note",
+                    "footer omitted",
+                ],
+                "missing_provider_measurement_boundary",
+            ),
+            (
+                "protected-zone-override",
+                [
+                    "--exact-text-fallback-receipt",
+                    receipt,
+                    "--reexpand-command",
+                    f"context-guard-artifact get {receipt} --full",
+                    "--provider-boundary-ack",
+                    "--missed-context-note",
+                    "footer omitted",
+                    "--protected-zone-policy",
+                    "allow",
+                ],
+                "protected_zone_denial_required",
+            ),
+            (
+                "malformed-image-size",
+                [
+                    "--exact-text-fallback-receipt",
+                    receipt,
+                    "--reexpand-command",
+                    f"context-guard-artifact get {receipt} --full",
+                    "--provider-boundary-ack",
+                    "--missed-context-note",
+                    "footer omitted",
+                    "--image-size",
+                    "-1,600",
+                ],
+                "invalid_image_size",
+            ),
+            (
+                "missing-exact-text-fallback",
+                [
+                    "--provider-boundary-ack",
+                    "--missed-context-note",
+                    "footer omitted",
+                ],
+                "missing_exact_text_fallback",
+            ),
+        ]
+        for script in EXPERIMENT_SCRIPTS:
+            for name, args, expected_blocker in cases:
+                with self.subTest(script=script, case=name):
+                    proc = subprocess.run(
+                        [sys.executable, str(script), "plan", "image-context-pack", *args, "--json"],
+                        text=True,
+                        capture_output=True,
+                        check=True,
+                    )
+                    payload = json.loads(proc.stdout)
+                    self.assertEqual(payload["experiment_id"], "image-context-pack")
+                    self.assertEqual(payload["status"], "blocked_until_image_context_pack_gate_ready")
+                    self.assertIn(expected_blocker, payload["review_plan"]["readiness_blockers"])
+                    self.assertFalse(payload["external_services"]["called"])
+                    self.assertFalse(payload["runtime_side_effects"]["files_written"])
 
-    def test_experimental_image_context_pack_dispatcher_and_no_runtime_surface(self):
-        receipt_id = "abcdef1234567890"
-        for dispatcher in (KIT_DIR / "context_guard_cli.py", PLUGIN_BIN / "context-guard"):
-            with self.subTest(dispatcher=dispatcher):
+    def test_experimental_image_context_pack_emit_is_unavailable(self):
+        for script in EXPERIMENT_SCRIPTS:
+            with self.subTest(script=script):
                 proc = subprocess.run(
-                    [
-                        sys.executable,
-                        str(dispatcher),
-                        "experiments",
-                        "plan",
-                        "image-context-pack",
-                        "--evaluation-intent-ack",
-                        "--exact-text-fallback-ack",
-                        "--text-fallback-receipt",
-                        receipt_id,
-                        "--reexpand-command",
-                        f"context-guard-artifact get {receipt_id} --full",
-                        "--protected-zone-deny-ack",
-                        "--provider-measurement-boundary-ack",
-                        "--missed-context-guardrail-ack",
-                        "--visual-crop-ocr-relation-ack",
-                        "--json",
-                    ],
+                    [sys.executable, str(script), "emit", "image-context-pack", "--json"],
                     text=True,
                     capture_output=True,
-                    check=True,
-                    cwd=ROOT,
                 )
-                payload = json.loads(proc.stdout)
-                self.assertEqual(payload["experiment_id"], "image-context-pack")
-                self.assertEqual(payload["status"], "ready_for_experiment_design_review")
-                self.assertFalse(payload["policy"]["emit_runtime_implemented"])
-                self.assertFalse(payload["policy"]["image_rendering_allowed"])
-                self.assertFalse(payload["policy"]["ocr_allowed"])
-                self.assertFalse(payload["external_services"]["called"])
-
-        package = json.loads((ROOT / "package.json").read_text(encoding="utf-8"))
-        command_manifest_text = (KIT_DIR / "context_guard_commands.py").read_text(encoding="utf-8")
-        for name in (
-            "context-guard-image-context-pack",
-            "context-guard-image-context-pack-emit",
-            "context-guard-ocr",
-            "context-guard-crop",
-            "context-guard-visual-token",
-            "context-guard-image-render",
-            "context-guard-renderer",
-            "context-guard-proxy-image",
-        ):
-            self.assertNotIn(name, package["bin"])
-            self.assertNotIn(name, command_manifest_text)
-            self.assertFalse((PLUGIN_BIN / name).exists())
+                self.assertEqual(proc.returncode, 2)
+                self.assertIn("invalid choice", proc.stderr)
+                self.assertNotIn("Traceback", proc.stderr + proc.stdout)
 
     def test_experimental_visual_crop_ocr_emit_runtime(self):
         for script in EXPERIMENT_SCRIPTS:

From d056a9c1ed9f0a273ba3ffdef5d83422a9e3162a Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 12:02:26 +0900
Subject: [PATCH 17/29] omx(team): auto-checkpoint worker-1 [1]

---
 plugins/context-guard/bin/context-guard-experiments | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/plugins/context-guard/bin/context-guard-experiments b/plugins/context-guard/bin/context-guard-experiments
index 103ad73..d60ab53 100755
--- a/plugins/context-guard/bin/context-guard-experiments
+++ b/plugins/context-guard/bin/context-guard-experiments
@@ -303,10 +303,11 @@ EXPERIMENTS: tuple[Experiment, ...] = (
             "plan-only dry-run gate with no emit/record/serve runtime and no stable behavior change."
         ),
         evidence_contract=(
-            "The planner requires acknowledgements for explicit evaluation intent, exact text artifact fallback, "
-            "protected-zone denial, provider/model measurement boundaries, missed-context review, and the fact that "
-            "visual-crop-ocr is the existing caller-supplied visual evidence-pack surface rather than a verified "
-            "exact binary/image fallback."
+            "Plans require explicit opt-in, verified exact text artifact fallback receipt/re-expand metadata before "
+            "omitted exact text is used, protected-zone denial for code/diffs/identifiers/hashes/paths/numeric "
+            "constants/JSON keys/stack frames/secrets/prompt-like instructions, provider/model measured matched-task boundaries, "
+            "missed-context guardrails, and an explicit relation_to_visual_crop_ocr statement: visual-crop-ocr "
+            "remains caller-supplied visual evidence only and is not a verified exact binary/image fallback."
         ),
     ),
     Experiment(

From b78521aa14503931c5a8504a7adaf0ccaf8e544a Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 12:01:16 +0900
Subject: [PATCH 18/29] task: implement image context pack plan gate


From 3d4a137028a737c2414db8c5c94be6c8b43eef58 Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 12:03:24 +0900
Subject: [PATCH 19/29] omx(team): auto-checkpoint worker-3 [3]

---
 context-guard-kit/experimental_registry.py          | 9 ++++-----
 plugins/context-guard/bin/context-guard-experiments | 9 ++++-----
 2 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/context-guard-kit/experimental_registry.py b/context-guard-kit/experimental_registry.py
index fbc0d09..e8816ef 100755
--- a/context-guard-kit/experimental_registry.py
+++ b/context-guard-kit/experimental_registry.py
@@ -302,11 +302,10 @@ def to_json(self, *, enabled: bool = False) -> dict[str, Any]:
             "traffic, write binary artifacts, or duplicate the caller-supplied visual-crop-ocr evidence-pack emitter."
         ),
         evidence_contract=(
-            "Plans require explicit opt-in, exact text fallback receipt/re-expand metadata before omitted exact text "
-            "is used, protected-zone denial for code/diffs/identifiers/hashes/paths/numeric constants/JSON keys/"
-            "stack frames/secrets/prompt-like instructions, provider/model measured matched-task boundaries, "
-            "missed-context guardrails, and an explicit relation_to_visual_crop_ocr statement: visual-crop-ocr "
-            "remains caller-supplied visual evidence only and is not a verified exact binary/image fallback."
+            "The planner requires acknowledgements for explicit evaluation intent, exact text artifact fallback, "
+            "protected-zone denial, provider/model measurement boundaries, missed-context review, and the fact that "
+            "visual-crop-ocr is the existing caller-supplied visual evidence-pack surface, not a verified "
+            "exact binary/image fallback."
         ),
     ),
     Experiment(
diff --git a/plugins/context-guard/bin/context-guard-experiments b/plugins/context-guard/bin/context-guard-experiments
index d60ab53..4f53412 100755
--- a/plugins/context-guard/bin/context-guard-experiments
+++ b/plugins/context-guard/bin/context-guard-experiments
@@ -303,11 +303,10 @@ EXPERIMENTS: tuple[Experiment, ...] = (
             "plan-only dry-run gate with no emit/record/serve runtime and no stable behavior change."
         ),
         evidence_contract=(
-            "Plans require explicit opt-in, verified exact text artifact fallback receipt/re-expand metadata before "
-            "omitted exact text is used, protected-zone denial for code/diffs/identifiers/hashes/paths/numeric "
-            "constants/JSON keys/stack frames/secrets/prompt-like instructions, provider/model measured matched-task boundaries, "
-            "missed-context guardrails, and an explicit relation_to_visual_crop_ocr statement: visual-crop-ocr "
-            "remains caller-supplied visual evidence only and is not a verified exact binary/image fallback."
+            "The planner requires acknowledgements for explicit evaluation intent, exact text artifact fallback, "
+            "protected-zone denial, provider/model measurement boundaries, missed-context review, and the fact that "
+            "visual-crop-ocr is the existing caller-supplied visual evidence-pack surface, not a verified "
+            "exact binary/image fallback."
         ),
     ),
     Experiment(

From dbea92ca887f2fde6120c5eb0fee0f739b00318f Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 12:07:18 +0900
Subject: [PATCH 20/29] task: implement image-context-pack plan gate


From 0be0d8c96c95792e6eff93ddc7cf73b7079dba9a Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 12:16:05 +0900
Subject: [PATCH 21/29] task: review and document pxpipe context gate


From 35175eb64a02004cdbf822524c0413a1251a8172 Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 12:17:15 +0900
Subject: [PATCH 22/29] omx(team): auto-checkpoint worker-2 [2]

---
 README.ko.md                       |  2 +-
 README.md                          |  5 +-
 docs/index.html                    |  2 +-
 plugins/context-guard/README.ko.md |  2 +-
 plugins/context-guard/README.md    |  5 +-
 tests/test_context_guard_kit.py    | 78 ++++++++++++++++++++++++++++++
 6 files changed, 85 insertions(+), 9 deletions(-)

diff --git a/README.ko.md b/README.ko.md
index 5028bee..dca8633 100644
--- a/README.ko.md
+++ b/README.ko.md
@@ -394,7 +394,7 @@ context-guard experiments plan context-diff-compaction --json < change.diff
 context-guard experiments emit context-diff-compaction --receipt-id <artifact-id> --reexpand-command "context-guard-artifact get <artifact-id> --full" --replacement-file compact-diff.txt --json < change.diff
 context-guard experiments plan visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --missed-context-note "outside crop omitted"
 context-guard experiments emit visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --ocr-text "visible text" --ocr-confidence 0.9 --ocr-error-note "glyph may be uncertain" --missed-context-note "outside crop omitted"
-context-guard experiments plan image-context-pack --json --evaluation-intent-ack --exact-text-fallback-ack --text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --protected-zone-deny-ack --provider-measurement-boundary-ack --missed-context-guardrail-ack --visual-crop-ocr-relation-ack
+context-guard experiments plan image-context-pack --json --exact-text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --provider-boundary-ack --protected-zone-policy deny --missed-context-note "omitted text remains retrievable before any future image pack is used" --image-size 800,600 --packed-image-size 400,300
 context-guard experiments plan learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" < sanitized-prose.txt
 context-guard experiments emit learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --replacement-file compact-prose.txt < sanitized-prose.txt
 context-guard experiments plan self-hosted-metrics-ledger --json --latency-ms 123.5 --peak-memory-mb 2048 --quality-score 0.98
diff --git a/README.md b/README.md
index 7461178..5e9de4c 100644
--- a/README.md
+++ b/README.md
@@ -439,10 +439,9 @@ context-guard experiments list
 context-guard experiments status --json
 context-guard experiments plan context-diff-compaction --json < change.diff
 context-guard experiments emit context-diff-compaction --receipt-id <artifact-id> --reexpand-command "context-guard-artifact get <artifact-id> --full" --replacement-file compact-diff.txt --json < change.diff
-context-guard experiments plan image-context-pack --json --explicit-opt-in --exact-text-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --protected-zone-policy deny --provider-measurement-boundary provider-measured-matched-tasks-required --missed-context-note "omitted text remains exactly retrievable" --image-size 800,600
 context-guard experiments plan visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --missed-context-note "outside crop omitted"
 context-guard experiments emit visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --ocr-text "visible text" --ocr-confidence 0.9 --ocr-error-note "glyph may be uncertain" --missed-context-note "outside crop omitted"
-context-guard experiments plan image-context-pack --json --exact-text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --provider-boundary-ack --missed-context-note "omitted text remains retrievable before any future image pack is used"
+context-guard experiments plan image-context-pack --json --exact-text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --provider-boundary-ack --protected-zone-policy deny --missed-context-note "omitted text remains retrievable before any future image pack is used" --image-size 800,600 --packed-image-size 400,300
 context-guard experiments plan learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" < sanitized-prose.txt
 context-guard experiments emit learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --replacement-file compact-prose.txt < sanitized-prose.txt
 context-guard experiments plan self-hosted-metrics-ledger --json --latency-ms 123.5 --peak-memory-mb 2048 --quality-score 0.98
@@ -473,7 +472,7 @@ Shipped experimental checker/planner surfaces, plus explicit local context-diff,
 | --- | --- | --- |
 | `context-diff-compaction` | Dry-run diff advice plus an explicit `emit ... --receipt-id ... --reexpand-command ...` runtime for caller-supplied compact replacements. | `plan` emits no replacement. `emit` requires reviewable hunks, exact local artifact re-expand metadata whose stored content matches the input diff, and a smaller caller-supplied replacement; ContextGuard does not generate semantic compression or support hosted token/cost savings claims. |
 | `visual-crop-ocr` | Dry-run visual evidence advice plus an explicit `emit visual-crop-ocr` runtime for caller-supplied evidence packs. | `emit` requires a full visual evidence receipt, missed-context note, and complete user-supplied crop and/or OCR evidence; ContextGuard does not capture screenshots, crop images, run OCR, parse images, call external services, write files, or support hosted token/cost savings claims. |
-| `image-context-pack` | Pxpipe-inspired dry-run plan metadata only for future image/context packing evaluation. | `plan` emits no image, replacement, evidence pack, binary artifact, ledger, listener, or proxy. It requires explicit opt-in, exact text fallback receipt/re-expand metadata before omitted text is used, protected-zone denial, missed-context notes, and provider/model measured matched-task boundaries. `visual-crop-ocr` remains the caller-supplied visual evidence-pack surface; `image-context-pack` is not a duplicate emitter or verified exact binary/image fallback. |
+| `image-context-pack` | Pxpipe-inspired dry-run plan metadata only for future image/context packing evaluation. | `plan` emits no image, replacement, evidence pack, binary artifact, ledger, listener, or proxy. It requires exact text fallback receipt/re-expand metadata before omitted text is used, protected-zone denial, missed-context notes, and an explicit provider boundary acknowledgement for provider/model measured matched-task evidence. `visual-crop-ocr` remains the caller-supplied visual evidence-pack surface; `image-context-pack` is not a duplicate emitter or verified exact binary/image fallback. |
 | `learned-compression` | Deny-by-default policy checks plus an explicit `emit learned-compression` runtime for caller-supplied compact prose candidates with verified exact fallback content. | `emit` requires sanitized trusted prose, protected-signal denial, a verified local fallback artifact matching the input, and a smaller caller-supplied prose candidate; ContextGuard does not run compressors, embeddings, rerankers, model calls, subprocesses, external services, generated replacement text, or hosted savings claims. |
 | `self-hosted-metrics-ledger` | Dry-run preview plus an explicit `record ... --ledger-jsonl` runtime for local/model-server latency, memory, quality, energy, throughput, and local-cost metrics. | The dry-run preview does not write a ledger; the explicit record command writes only local JSONL sidecars and still does not support hosted API token/cost savings claims. |
 | `local-proxy` | Localhost-only advisory metadata, design-only `plan local-proxy-external-forwarding` review for future external forwarding, an explicit `record local-proxy-runtime-gate --ledger-jsonl` runtime for one local gate row, an explicit one-shot `serve local-proxy` loopback forwarding MVP, optional `--response-sandbox` compact artifact envelopes, and optional `--diagnostic-ledger-jsonl` shifted-cost diagnostics for successful forwarded requests. | `plan` writes no ledger. `record` writes only after localhost-only metadata and `--runtime-gate-ack`; it starts no listener, forwards no traffic, and performs no DNS lookup. `serve` additionally requires `--forwarding-gate-ack --once`, a private `--ready-file` nonce handoff, literal loopback bind/target IPs, nonzero ports, bounded bytes/timeouts, and credential-free requests; it performs no external forwarding, no CONNECT/TLS proxying, no API-key persistence, and no hosted-savings claim. `--response-sandbox` can store safe UTF-8 response text as a sanitized local artifact receipt and return a compact envelope with redacted rehydration command templates; it does not claim hosted token/cost savings. `--diagnostic-ledger-jsonl` writes only successful-forward diagnostics with no raw headers/bodies and no hosted-savings claim. `plan local-proxy-external-forwarding` emits threat-model/allowlist/redaction/provider-evidence design metadata only and still performs no DNS lookup, external service call, traffic forwarding, credential persistence, or hosted-savings claim. |
diff --git a/docs/index.html b/docs/index.html
index 1e0ef90..269e57e 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -485,7 +485,7 @@ <h2>과장하지 않는 도구</h2>
         <article class="card"><span class="icon">✓</span><h3>측정 근거를 직접 남깁니다</h3><p>벤치마크·감사·상태표시줄 신호로 실제 전후 변화를 측정하고, 절감 효과가 없으면 그대로 보고합니다.</p></article>
         <article class="card warning-card"><span class="icon">!</span><h3>고정 절감률을 보장하지 않습니다</h3><p>저장소와 작업 방식에 따라 효과가 달라집니다. 벤치마크 도구로 직접 측정하세요.</p></article>
         <article class="card warning-card"><span class="icon">↯</span><h3>외부 AI로 작업을 보내지 않습니다</h3><p>토큰을 줄이기 위해 작업을 다른 AI 서비스로 보내거나 대신 실행하지 않습니다. 헬퍼는 로컬에서 동작합니다.</p></article>
-        <article class="card warning-card"><span class="icon">?</span><h3>실험 레이더는 제공 기능이 아닙니다</h3><p><a href="https://github.com/ictechgy/context-guard/blob/main/research/experimental-token-reduction-radar.md">Experimental token-reduction radar</a>는 앞으로 검증할 후보와 later-roadmap gate를 기록합니다. 현재 제공되는 것은 대부분 dry-run checker/planner이며, 예외도 context-diff emit, visual evidence-pack emit, learned candidate emit, self-hosted metrics JSONL sidecar record, local proxy gate record, one-shot literal-loopback local proxy serve 같은 좁은 명시적 로컬 runtime뿐입니다. learned compressor runtime, 생성형 replacement, screenshot capture, image crop, OCR execution, self-hosted KV/latent runtime, external/daemon/hostname-DNS/credential-bearing proxy forwarding runtime은 provider-measured matched-task 근거와 별도 future PR gate 없이는 제공 기능이나 hosted API 절감으로 주장하지 않습니다.</p></article>
+        <article class="card warning-card"><span class="icon">?</span><h3>실험 레이더는 제공 기능이 아닙니다</h3><p><a href="https://github.com/ictechgy/context-guard/blob/main/research/experimental-token-reduction-radar.md">Experimental token-reduction radar</a>는 앞으로 검증할 후보와 later-roadmap gate를 기록합니다. 현재 제공되는 것은 대부분 dry-run checker/planner이며, 예외도 plan-only image-context-pack dry-run gate, context-diff emit, visual evidence-pack emit, learned candidate emit, self-hosted metrics JSONL sidecar record, local proxy gate record, one-shot literal-loopback local proxy serve 같은 좁은 명시적 로컬 surface뿐입니다. learned compressor runtime, 생성형 replacement, screenshot capture, image crop, OCR execution, generated image-context-pack renderers/runtime, self-hosted KV/latent runtime, external/daemon/hostname-DNS/credential-bearing proxy forwarding runtime은 provider-measured matched-task 근거와 별도 future PR gate 없이는 제공 기능이나 hosted API 절감으로 주장하지 않습니다.</p></article>
         <article class="card warning-card"><span class="icon">⌂</span><h3>전역 설정을 자동 변경하지 않습니다</h3><p>설정은 프로젝트 단위로, 사용자가 명시적으로 적용할 때만 반영됩니다.</p></article>
         <article class="card"><span class="icon">⇥</span><h3>헬퍼 실행 경로를 좁힙니다</h3><p>setup은 bundled/checkout-local helper를 우선 사용하고, macOS visibility helper는 bundle/resource/executable-relative 경로나 absolute explicit override만 허용합니다. 상대 override, launch CWD, symlink helper, 임의 <code>PATH</code>, 불필요한 상위 환경은 기본 신뢰하지 않습니다.</p></article>
         <article class="card warning-card"><span class="icon">↺</span><h3>리브랜딩 호환성을 남겼습니다</h3><p>예전 슬래시 명령은 별칭으로 제공하지 않지만, 기존 자동화를 위한 CLI 래퍼 파일은 계속 제공합니다. npm global/<code>npx</code> bin 링크는 canonical <code>context-guard</code>/<code>context-guard-*</code> 명령만 노출합니다.</p></article>
diff --git a/plugins/context-guard/README.ko.md b/plugins/context-guard/README.ko.md
index cbe9caa..e3ff350 100644
--- a/plugins/context-guard/README.ko.md
+++ b/plugins/context-guard/README.ko.md
@@ -119,7 +119,7 @@ brief 모드는 코딩 에이전트가 군더더기를 줄이도록 요청하되
 
 ContextGuard는 모델 토큰을 줄이기 위해 작업을 외부 AI 서비스로 전송하지 않습니다. 모든 헬퍼 명령은 로컬에서 동작합니다. 로컬 RAM/디스크 보관본은 다음에 보낼 컨텍스트를 줄이는 데 도움될 수 있지만 provider prompt cache를 대체하지 않습니다. Anthropic 배포나 청구 설명 전에는 공식 prompt caching/pricing 문서를 다시 확인하세요: https://docs.anthropic.com/en/build-with-claude/prompt-caching 및 https://platform.claude.com/docs/en/about-claude/pricing.
 
-미래 learned, self-hosted 최적화 아이디어는 [`research/experimental-token-reduction-radar.md`](https://github.com/ictechgy/context-guard/blob/main/research/experimental-token-reduction-radar.md)에 gated experiment로 기록하며, fixture-only 시작 예시는 [`docs/experimental-benchmark-fixtures.md`](https://github.com/ictechgy/context-guard/blob/main/docs/experimental-benchmark-fixtures.md)에 둡니다. learned compression은 `context-guard experiments plan learned-compression` dry-run checker와 명시적 `context-guard experiments emit learned-compression` caller-supplied candidate emitter만 shipped 상태이고, self-hosted-metrics-ledger는 dry-run preview와 명시적 `context-guard experiments record self-hosted-metrics-ledger` local JSONL record를 제공하며, dry-run preview는 ledger 파일을 쓰지 않습니다. visual crop/OCR은 caller-supplied evidence-pack emit, image-context-pack은 pxpipe-inspired image/context packing 평가를 위한 plan-only dry-run gate, context-diff는 verified-receipt caller-supplied replacement emit만 제공합니다. image-context-pack은 명시적 평가 의도, exact text artifact fallback, protected-zone denial, provider-measured matched-task boundary, missed-context guardrail, 그리고 visual-crop-ocr이 기존 caller-supplied visual evidence-pack surface라는 확인이 필요하며, image rendering, OCR 실행, image parsing, model/provider call, proxy traffic, binary artifact 저장, replacement evidence 출력, hosted token/cost savings claim을 하지 않습니다. local proxy는 `context-guard experiments plan local-proxy` localhost-only dry-run advisory plan, design-only `context-guard experiments plan local-proxy-external-forwarding` gate, 명시적 `context-guard experiments record local-proxy-runtime-gate --ledger-jsonl ...` gate row record, private ready-file nonce가 필요한 one-shot `context-guard experiments serve local-proxy` loopback forwarding MVP와 successful forwarded request용 optional shifted-cost diagnostic JSONL row만 shipped 상태입니다. record는 no listener/no traffic forwarding/no DNS lookup/no external service/no API-key persistence boundary를 유지하고, serve는 private ready-file nonce, literal loopback IP, `--once`, credential-free request만 허용하고 CONNECT/TLS proxying도 지원하지 않습니다. `--response-sandbox`는 safe UTF-8 response text만 local artifact receipt로 저장하고 raw body 대신 redacted rehydration command template가 담긴 compact envelope를 돌려주며 hosted token/cost savings claim은 아닙니다. `--diagnostic-ledger-jsonl`은 successful forwarded request 뒤에만 진단 row를 쓰며 raw header/body나 hosted-savings evidence를 저장하지 않습니다. `plan local-proxy-external-forwarding`은 threat model, HTTPS allowlist, credential redaction, provider-evidence boundary를 점검하는 dry-run design gate이고 listener, DNS lookup, external service call, traffic forwarding, credential persistence, external proxy forwarding runtime, hosted savings claim을 제공하지 않습니다. learned/synthetic compressor 실행·embedding·reranker·model call·생성형 replacement, generated OCR/crop, visual-token pruning, plan-only image-context-pack dry-run gate를 넘어선 image-context-pack rendering/runtime, self-hosted KV/latent runtime 최적화, one-shot literal-loopback local proxy MVP를 넘어선 external/daemon/credential-bearing proxy forwarding runtime은 shipped가 아닙니다. 이 radar와 fixture는 provider가 측정한 matched-task 근거 없이 hosted API 절감을 주장하지 않습니다. Radar의 later-roadmap gate는 neural/semantic compression, trust-tiered injection-aware compression, generated visual-token reduction, broader local proxy forwarding constraint도 별도 미래 PR이 gate를 통과하기 전까지 experimental/non-shipped로 묶습니다.
+미래 learned, self-hosted 최적화 아이디어는 [`research/experimental-token-reduction-radar.md`](https://github.com/ictechgy/context-guard/blob/main/research/experimental-token-reduction-radar.md)에 gated experiment로 기록하며, fixture-only 시작 예시는 [`docs/experimental-benchmark-fixtures.md`](https://github.com/ictechgy/context-guard/blob/main/docs/experimental-benchmark-fixtures.md)에 둡니다. learned compression은 `context-guard experiments plan learned-compression` dry-run checker와 명시적 `context-guard experiments emit learned-compression` caller-supplied candidate emitter만 shipped 상태이고, self-hosted-metrics-ledger는 dry-run preview와 명시적 `context-guard experiments record self-hosted-metrics-ledger` local JSONL record를 제공하며, dry-run preview는 ledger 파일을 쓰지 않습니다. visual crop/OCR은 caller-supplied evidence-pack emit, image-context-pack은 pxpipe-inspired image/context packing 평가를 위한 plan-only dry-run gate, context-diff는 verified-receipt caller-supplied replacement emit만 제공합니다. image-context-pack은 exact text artifact fallback, protected-zone denial, provider-boundary acknowledgement for provider-measured matched tasks, missed-context guardrail, 그리고 visual-crop-ocr이 기존 caller-supplied visual evidence-pack surface라는 plan output 확인이 필요하며, image rendering, OCR 실행, image parsing, model/provider call, proxy traffic, binary artifact 저장, replacement evidence 출력, hosted token/cost savings claim을 하지 않습니다. local proxy는 `context-guard experiments plan local-proxy` localhost-only dry-run advisory plan, design-only `context-guard experiments plan local-proxy-external-forwarding` gate, 명시적 `context-guard experiments record local-proxy-runtime-gate --ledger-jsonl ...` gate row record, private ready-file nonce가 필요한 one-shot `context-guard experiments serve local-proxy` loopback forwarding MVP와 successful forwarded request용 optional shifted-cost diagnostic JSONL row만 shipped 상태입니다. record는 no listener/no traffic forwarding/no DNS lookup/no external service/no API-key persistence boundary를 유지하고, serve는 private ready-file nonce, literal loopback IP, `--once`, credential-free request만 허용하고 CONNECT/TLS proxying도 지원하지 않습니다. `--response-sandbox`는 safe UTF-8 response text만 local artifact receipt로 저장하고 raw body 대신 redacted rehydration command template가 담긴 compact envelope를 돌려주며 hosted token/cost savings claim은 아닙니다. `--diagnostic-ledger-jsonl`은 successful forwarded request 뒤에만 진단 row를 쓰며 raw header/body나 hosted-savings evidence를 저장하지 않습니다. `plan local-proxy-external-forwarding`은 threat model, HTTPS allowlist, credential redaction, provider-evidence boundary를 점검하는 dry-run design gate이고 listener, DNS lookup, external service call, traffic forwarding, credential persistence, external proxy forwarding runtime, hosted savings claim을 제공하지 않습니다. learned/synthetic compressor 실행·embedding·reranker·model call·생성형 replacement, generated OCR/crop, visual-token pruning, plan-only image-context-pack dry-run gate를 넘어선 image-context-pack rendering/runtime, self-hosted KV/latent runtime 최적화, one-shot literal-loopback local proxy MVP를 넘어선 external/daemon/credential-bearing proxy forwarding runtime은 shipped가 아닙니다. 이 radar와 fixture는 provider가 측정한 matched-task 근거 없이 hosted API 절감을 주장하지 않습니다. Radar의 later-roadmap gate는 neural/semantic compression, trust-tiered injection-aware compression, generated visual-token reduction, broader local proxy forwarding constraint도 별도 미래 PR이 gate를 통과하기 전까지 experimental/non-shipped로 묶습니다.
 
 교차 에이전트 규칙 스니펫은 안내용입니다. 대상 에이전트가 반드시 따른다고 보장할 수 없으므로, 절감 주장이 필요하면 실제 전후 동작을 직접 측정하세요.
 
diff --git a/plugins/context-guard/README.md b/plugins/context-guard/README.md
index 57fd023..68a9d1f 100644
--- a/plugins/context-guard/README.md
+++ b/plugins/context-guard/README.md
@@ -139,10 +139,9 @@ context-guard experiments list
 context-guard experiments status --json
 context-guard experiments plan context-diff-compaction --json < change.diff
 context-guard experiments emit context-diff-compaction --receipt-id <artifact-id> --reexpand-command "context-guard-artifact get <artifact-id> --full" --replacement-file compact-diff.txt --json < change.diff
-context-guard experiments plan image-context-pack --json --explicit-opt-in --exact-text-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --protected-zone-policy deny --provider-measurement-boundary provider-measured-matched-tasks-required --missed-context-note "omitted text remains exactly retrievable" --image-size 800,600
 context-guard experiments plan visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --missed-context-note "outside crop omitted"
 context-guard experiments emit visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --ocr-text "visible text" --ocr-confidence 0.9 --ocr-error-note "glyph may be uncertain" --missed-context-note "outside crop omitted"
-context-guard experiments plan image-context-pack --json --evaluation-intent-ack --exact-text-fallback-ack --text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --protected-zone-deny-ack --provider-measurement-boundary-ack --missed-context-guardrail-ack --visual-crop-ocr-relation-ack
+context-guard experiments plan image-context-pack --json --exact-text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --provider-boundary-ack --protected-zone-policy deny --missed-context-note "omitted text remains retrievable before any future image pack is used" --image-size 800,600 --packed-image-size 400,300
 context-guard experiments plan learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" < sanitized-prose.txt
 context-guard experiments emit learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --replacement-file compact-prose.txt < sanitized-prose.txt
 context-guard experiments plan self-hosted-metrics-ledger --json --latency-ms 123.5 --peak-memory-mb 2048 --quality-score 0.98
@@ -155,7 +154,7 @@ context-guard experiments enable output-receipt-trim --root .
 context-guard experiments disable output-receipt-trim --root .
 ```
 
-`image-context-pack` is a plan-only/dry-run gate for pxpipe-inspired image/context packing evaluation. It requires explicit evaluation intent, exact text artifact fallback, protected-zone denial, provider-measured matched-task boundaries, missed-context guardrails, and acknowledgement that `visual-crop-ocr` is the existing caller-supplied visual evidence-pack surface. It does not render images, run OCR, call models/providers, proxy traffic, store binary artifacts, emit replacement evidence, or support hosted token/cost savings.
+`image-context-pack` is a plan-only/dry-run gate for pxpipe-inspired image/context packing evaluation. It requires exact text artifact fallback, protected-zone denial, provider-boundary acknowledgement for provider-measured matched tasks, missed-context guardrails, and acknowledgement in the plan output that `visual-crop-ocr` is the existing caller-supplied visual evidence-pack surface. It does not render images, run OCR, call models/providers, proxy traffic, store binary artifacts, emit replacement evidence, or support hosted token/cost savings.
 
 Use `--config <path>` only for an explicit project-local override. Registry entries include risk, gate requirements, explicit command/flag surfaces, and claim boundaries; hosted API token/cost savings still require provider-measured matched-task evidence. The registry can discover existing explicit-flag experiments such as `context-guard-trim-output --digest ... --artifact-receipt` and `context-guard-compress --protected-policy`, run dry-run advisory planners such as `context-guard experiments plan context-diff-compaction`, `context-guard experiments plan visual-crop-ocr`, `context-guard experiments plan learned-compression`, `context-guard experiments plan self-hosted-metrics-ledger`, `context-guard experiments plan local-proxy`, and design-only `context-guard experiments plan local-proxy-external-forwarding`, and run explicit local runtimes such as `context-guard experiments emit context-diff-compaction ...`, `context-guard experiments emit visual-crop-ocr ...`, `context-guard experiments emit learned-compression ...`, `context-guard experiments record self-hosted-metrics-ledger ...`, `context-guard experiments record local-proxy-runtime-gate ...`, `context-guard experiments serve local-proxy ...`, and successful-forward `context-guard experiments serve local-proxy --diagnostic-ledger-jsonl ...` diagnostics. The context-diff emit runtime only emits caller-supplied compact replacements when reviewable hunks, exact local artifact re-expand metadata whose stored content matches the input diff, and a smaller replacement are present; it does not generate semantic compression or permit hosted savings claims. The visual lane ships a dry-run planner plus an explicit local evidence-pack emitter: both use only caller-supplied full-evidence receipts, crop metadata, OCR text, confidence/error notes, and missed-context notes; screenshot capture, image cropping, OCR execution, image parsing, external OCR/image services, output-file writes, and hosted savings claims are not shipped. The learned-compression lane ships a deny-by-default dry-run policy check plus an explicit local candidate emitter for caller-supplied compact prose with verified exact fallback content: learned/synthetic compressor execution, embeddings, rerankers, model calls, subprocesses, external services, generated replacement text, and hosted savings claims are not shipped. The self-hosted metrics planner emits a dry-run ledger-compatible preview for explicit local/model-server latency, memory, quality, energy, throughput, and local-cost metrics; the dry-run preview does not write a ledger, while `context-guard experiments record self-hosted-metrics-ledger --ledger-jsonl ...` writes only local JSONL sidecars and still does not permit hosted API token/cost savings claims. The local-proxy planner emits localhost-only advisory metadata only, while `context-guard experiments record local-proxy-runtime-gate --ledger-jsonl ...` appends one local gate row only after localhost-only metadata and `--runtime-gate-ack`: it starts no listener, forwards no traffic, and performs no DNS lookup. `context-guard experiments serve local-proxy ...` is the separate forwarding MVP: it requires `--forwarding-gate-ack --once`, a private `--ready-file` nonce handoff, literal loopback bind/target IPs, no hostname DNS targets, nonzero ports, byte/time limits, and credential-free requests; it performs no external forwarding, no CONNECT/TLS proxying, no API-key persistence, and no hosted-savings claim. `--response-sandbox` can store safe UTF-8 response text as a sanitized local artifact receipt and return a compact envelope with redacted rehydration command templates; it does not claim hosted token/cost savings. `--diagnostic-ledger-jsonl` writes one shifted-cost diagnostic row only after a successful forwarded request, with no raw headers/bodies and no hosted-savings evidence. `plan local-proxy-external-forwarding` emits threat-model/allowlist/redaction/provider-evidence design metadata only and still starts no listener, performs no DNS lookup, calls no external service, forwards no traffic, persists no credentials, and does not ship an external proxy forwarding runtime. `experiments enable` records intent only; it does not run those helpers, remove the need for their explicit flags, or permit replacing content without exact receipt/re-expand evidence.
 
diff --git a/tests/test_context_guard_kit.py b/tests/test_context_guard_kit.py
index 88266c2..49dc268 100644
--- a/tests/test_context_guard_kit.py
+++ b/tests/test_context_guard_kit.py
@@ -6873,6 +6873,45 @@ def test_experimental_self_hosted_metrics_docs_surface_boundary(self):
                 self.assertNotIn("self-hosted kv/latent runtime optimization is shipped", text)
                 self.assertNotIn("hosted api token/cost savings claim is allowed", text)
 
+    def test_experimental_image_context_pack_docs_examples_match_cli(self):
+        docs = (
+            ROOT / "README.md",
+            ROOT / "README.ko.md",
+            PLUGIN_DIR / "README.md",
+        )
+        canonical_flags = (
+            "--exact-text-fallback-receipt",
+            "--provider-boundary-ack",
+            "--protected-zone-policy deny",
+            "--missed-context-note",
+        )
+        forbidden_flags = (
+            "--explicit-opt-in",
+            "--exact-text-receipt",
+            "--provider-measurement-boundary",
+            "--evaluation-intent-ack",
+            "--exact-text-fallback-ack",
+            "--text-fallback-receipt",
+            "--protected-zone-deny-ack",
+            "--provider-measurement-boundary-ack",
+            "--missed-context-guardrail-ack",
+            "--visual-crop-ocr-relation-ack",
+        )
+        for doc in docs:
+            with self.subTest(doc=doc):
+                text = doc.read_text(encoding="utf-8")
+                example_lines = [
+                    line.strip()
+                    for line in text.splitlines()
+                    if "context-guard experiments plan image-context-pack" in line
+                ]
+                self.assertEqual(len(example_lines), 1)
+                example = example_lines[0]
+                for flag in canonical_flags:
+                    self.assertIn(flag, example)
+                for flag in forbidden_flags:
+                    self.assertNotIn(flag, example)
+
     def test_experimental_image_context_pack_docs_surface_boundary(self):
         docs = (
             ROOT / "README.md",
@@ -6939,6 +6978,45 @@ def test_experimental_local_proxy_docs_surface_boundary(self):
                 self.assertRegex(text, r"raw headers?|raw bodies|raw header/body|request bodies|response bodies|원문 header|원문 body")
                 self.assertRegex(text, r"hosted.*savings|hosted api 절감")
 
+    def test_experimental_image_context_pack_docs_examples_match_cli(self):
+        docs = (
+            ROOT / "README.md",
+            ROOT / "README.ko.md",
+            PLUGIN_DIR / "README.md",
+        )
+        canonical_flags = (
+            "--exact-text-fallback-receipt",
+            "--provider-boundary-ack",
+            "--protected-zone-policy deny",
+            "--missed-context-note",
+        )
+        forbidden_flags = (
+            "--explicit-opt-in",
+            "--exact-text-receipt",
+            "--provider-measurement-boundary",
+            "--evaluation-intent-ack",
+            "--exact-text-fallback-ack",
+            "--text-fallback-receipt",
+            "--protected-zone-deny-ack",
+            "--provider-measurement-boundary-ack",
+            "--missed-context-guardrail-ack",
+            "--visual-crop-ocr-relation-ack",
+        )
+        for doc in docs:
+            with self.subTest(doc=doc):
+                text = doc.read_text(encoding="utf-8")
+                example_lines = [
+                    line.strip()
+                    for line in text.splitlines()
+                    if "context-guard experiments plan image-context-pack" in line
+                ]
+                self.assertEqual(len(example_lines), 1)
+                example = example_lines[0]
+                for flag in canonical_flags:
+                    self.assertIn(flag, example)
+                for flag in forbidden_flags:
+                    self.assertNotIn(flag, example)
+
     def test_experimental_image_context_pack_docs_surface_boundary(self):
         docs = (
             ROOT / "README.md",

From 7780b12028a92b8add2b2c1f7c5cdefbb844ed75 Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 12:19:34 +0900
Subject: [PATCH 23/29] omx(team): auto-checkpoint worker-2 [2]

---
 .../bin/context-guard-experiments             | 286 ++++++++----------
 1 file changed, 130 insertions(+), 156 deletions(-)

diff --git a/plugins/context-guard/bin/context-guard-experiments b/plugins/context-guard/bin/context-guard-experiments
index 4f53412..e8816ef 100755
--- a/plugins/context-guard/bin/context-guard-experiments
+++ b/plugins/context-guard/bin/context-guard-experiments
@@ -264,10 +264,10 @@ EXPERIMENTS: tuple[Experiment, ...] = (
     ),
     Experiment(
         id="image-context-pack",
-        name="Image context pack planning gate",
+        name="Pxpipe-inspired image context pack planning gate",
         summary=(
-            "Plan-only pxpipe-inspired evaluation gate for future image/context packing; it never renders images, "
-            "runs OCR, stores binaries, calls models/providers, or emits replacement evidence."
+            "Plan-only evaluation gate for pxpipe-inspired image/context packing without rendering images, "
+            "emitting visual artifacts, or changing runtime behavior."
         ),
         stability="experimental",
         default_enabled=False,
@@ -278,29 +278,28 @@ EXPERIMENTS: tuple[Experiment, ...] = (
         ),
         gate_requirements=(
             "explicit opt-in",
-            "verified exact text artifact fallback before omitted text is relied on",
+            "verified exact text artifact fallback before omitted text is used",
             "protected-zone denial",
             "provider/model measurement boundary",
             "missed-context guardrails",
-            "relation to visual-crop-ocr documented",
+            "relation to visual-crop-ocr",
         ),
         runtime_status="available-plan-only",
         commands=("context-guard experiments plan image-context-pack",),
         opt_in_flags=(
             "plan image-context-pack",
-            "--evaluation-intent-ack",
-            "--exact-text-fallback-ack",
-            "--text-fallback-receipt",
+            "--exact-text-fallback-receipt",
             "--reexpand-command",
-            "--protected-zone-deny-ack",
-            "--provider-measurement-boundary-ack",
-            "--missed-context-guardrail-ack",
-            "--visual-crop-ocr-relation-ack",
-            "--proposed-image-size",
+            "--provider-boundary-ack",
+            "--protected-zone-policy deny",
+            "--missed-context-note",
+            "--image-size",
+            "--packed-image-size",
         ),
         config_effect=(
-            "Registry enablement records project-local intent only; image-context-pack remains a deterministic "
-            "plan-only dry-run gate with no emit/record/serve runtime and no stable behavior change."
+            "Registry enablement records project-local intent only; image-context-pack exposes only a deterministic "
+            "plan command. It does not add an emit/record/serve runtime, render images, run OCR, call models, proxy "
+            "traffic, write binary artifacts, or duplicate the caller-supplied visual-crop-ocr evidence-pack emitter."
         ),
         evidence_contract=(
             "The planner requires acknowledgements for explicit evaluation intent, exact text artifact fallback, "
@@ -1785,157 +1784,148 @@ def command_plan_visual_crop_ocr(args: argparse.Namespace) -> int:
     return 0
 
 
+def image_context_pack_size_payload(raw: str | None) -> tuple[dict[str, Any] | None, bool]:
+    size = parse_int_tuple(raw, count=2)
+    if raw is None or not str(raw).strip():
+        return None, True
+    if size is None:
+        return None, False
+    width, height = size
+    if width <= 0 or height <= 0:
+        return {"width": width, "height": height}, False
+    return {"width": width, "height": height}, True
+
+
 def image_context_pack_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
-    receipt_id = args.text_fallback_receipt.strip() if args.text_fallback_receipt else None
+    receipt_id = args.exact_text_fallback_receipt.strip() if args.exact_text_fallback_receipt else None
     reexpand_command = args.reexpand_command.strip() if args.reexpand_command else None
     reexpand_valid, fallback_blocker = valid_learned_reexpand_command(receipt_id, reexpand_command)
-    proposed_image_size = parse_int_tuple(args.proposed_image_size, count=2)
-    image_payload = None
-    image_size_valid = args.proposed_image_size is None
-    if proposed_image_size is not None:
-        width, height = proposed_image_size
-        image_size_valid = (
-            0 < width <= IMAGE_CONTEXT_PACK_MAX_DIMENSION
-            and 0 < height <= IMAGE_CONTEXT_PACK_MAX_DIMENSION
-        )
-        image_payload = {"width": width, "height": height}
-    elif args.proposed_image_size is not None:
-        image_size_valid = False
+    fallback_blocker_map = {
+        "missing_exact_fallback": "missing_exact_text_fallback",
+        "invalid_reexpand_command": "invalid_exact_text_reexpand_command",
+    }
+    source_size, source_size_valid = image_context_pack_size_payload(args.image_size)
+    packed_size, packed_size_valid = image_context_pack_size_payload(args.packed_image_size)
+    missed_context_notes = clean_values(args.missed_context_note)
+    protected_policy = (args.protected_zone_policy or "deny").strip().lower()
 
     blockers: list[str] = []
-    if not args.evaluation_intent_ack:
-        blockers.append("missing_evaluation_intent_ack")
-    if not args.exact_text_fallback_ack:
-        blockers.append("missing_exact_text_fallback_ack")
     if fallback_blocker:
-        blockers.append(fallback_blocker)
-    if not args.protected_zone_deny_ack:
-        blockers.append("missing_protected_zone_deny_ack")
-    if not args.provider_measurement_boundary_ack:
-        blockers.append("missing_provider_measurement_boundary_ack")
-    if not args.missed_context_guardrail_ack:
-        blockers.append("missing_missed_context_guardrail_ack")
-    if not args.visual_crop_ocr_relation_ack:
-        blockers.append("missing_visual_crop_ocr_relation_ack")
-    if not image_size_valid:
-        blockers.append("invalid_proposed_image_size")
+        blockers.append(fallback_blocker_map.get(fallback_blocker, fallback_blocker))
+    if not args.provider_boundary_ack:
+        blockers.append("missing_provider_measurement_boundary")
+    if not missed_context_notes:
+        blockers.append("missing_missed_context_note")
+    if protected_policy != "deny":
+        blockers.append("protected_zone_denial_required")
+    if not source_size_valid:
+        blockers.append("invalid_image_size")
+    if not packed_size_valid:
+        blockers.append("invalid_packed_image_size")
     blockers = list(dict.fromkeys(blockers))
+
+    source_area = source_size["width"] * source_size["height"] if source_size and source_size_valid else None
+    packed_area = packed_size["width"] * packed_size["height"] if packed_size and packed_size_valid else None
+    area_delta = source_area - packed_area if source_area is not None and packed_area is not None else None
     ready = not blockers
 
-    protected_classes = [
-        "code",
-        "diffs",
-        "identifiers",
-        "hashes",
-        "paths",
-        "numeric constants",
-        "JSON keys",
-        "stack frames",
-        "secrets",
-        "prompt-like instructions",
-    ]
     return {
         "tool": TOOL_NAME,
         "schema_version": CONFIG_SCHEMA_VERSION,
+        "plan_schema_version": IMAGE_CONTEXT_PACK_PLAN_SCHEMA_VERSION,
         "experiment_id": "image-context-pack",
         "mode": "dry_run",
-        "status": "ready_for_experiment_design_review" if ready else "blocked_until_plan_constraints",
-        "policy": {
-            "default_off": True,
-            "plan_only": True,
-            "explicit_opt_in_required": True,
-            "emit_runtime_implemented": False,
-            "record_runtime_implemented": False,
-            "serve_runtime_implemented": False,
-            "image_rendering_allowed": False,
-            "ocr_allowed": False,
-            "image_parsing_allowed": False,
-            "model_call_allowed": False,
-            "provider_call_allowed": False,
-            "proxy_forwarding_allowed": False,
-            "binary_artifact_storage_allowed": False,
-            "replacement_emitted": False,
-            "stable_runtime_behavior_changed": False,
-            "hosted_api_token_savings_claim_allowed": False,
-            "hosted_api_cost_savings_claim_allowed": False,
+        "status": "ready_for_plan_review" if ready else "blocked_until_image_context_pack_gate_ready",
+        "plan_only": {
+            "command_advertised": True,
+            "emit_command_available": False,
+            "record_command_available": False,
+            "serve_command_available": False,
+            "runtime_behavior_changed": False,
+            "replacement_or_visual_evidence_emitted": False,
         },
         "external_services": {
             "called": False,
             "network": False,
+            "model_calls": False,
             "ocr_service": None,
             "image_service": None,
-            "model_provider": None,
+            "proxy_forwarding": False,
         },
-        "network_actions": {
-            "listener_started": False,
-            "traffic_forwarded": False,
-            "dns_lookup_attempted": False,
-            "external_services_called": False,
-        },
-        "file_system_actions": {
+        "runtime_side_effects": {
             "files_written": False,
+            "image_rendering": False,
+            "ocr_execution": False,
+            "image_parsing": False,
             "binary_artifacts_written": False,
-            "image_artifacts_written": False,
+            "proxy_forwarding": False,
+            "stable_runtime_behavior_changed": False,
         },
-        "exact_text_fallback": {
+        "text_fallback": {
             "required": True,
-            "caller_acknowledged": bool(args.exact_text_fallback_ack),
-            "available": bool(receipt_id and reexpand_command and reexpand_valid),
+            "available": bool(reexpand_valid),
             "receipt_id": receipt_id,
-            "cli": reexpand_command,
+            "reexpand_command": reexpand_command,
             "verified": False,
-            "verified_before_use_required": True,
-            "note": "Only exact sanitized text artifact fallback may support omitted text; binary/image handles are not verified exact fallback.",
+            "must_be_verified_before_omitted_text_is_used": True,
+            "note": (
+                "This dry-run validates only local receipt/re-expand shape. A future runtime must verify exact "
+                "text artifact content before relying on omitted exact text."
+            ),
         },
-        "protected_zone_policy": {
-            "deny_required": True,
-            "caller_acknowledged": bool(args.protected_zone_deny_ack),
+        "protected_zones": {
+            "policy": protected_policy,
             "override_allowed": False,
-            "denied_classes": protected_classes,
+            "denied_classes": [
+                "code",
+                "diffs",
+                "identifiers",
+                "hashes",
+                "paths",
+                "numeric_constants",
+                "json_keys",
+                "stack_frames",
+                "secrets",
+                "prompt_like_instructions",
+            ],
+        },
+        "image_pack_plan": {
+            "source_label": sanitize_self_hosted_text(args.source_label) if args.source_label else "manual-plan",
+            "source_image_size": source_size,
+            "packed_image_size": packed_size,
+            "source_area": source_area,
+            "packed_area": packed_area,
+            "area_delta": area_delta,
+            "area_reduction_is_proxy_only": area_delta is not None,
+            "image_or_request_byte_reductions_are_proxy_evidence_only": True,
         },
-        "provider_measurement_boundary": {
-            "caller_acknowledged": bool(args.provider_measurement_boundary_ack),
-            "image_request_byte_reductions_proxy_only": True,
-            "provider_model_measurement_required_for_claims": True,
-            "matched_successful_tasks_required": True,
+        "measurement_boundary": {
+            "provider_boundary_acknowledged": bool(args.provider_boundary_ack),
+            "provider_boundary_policy": IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY,
+            "provider_measured_matched_tasks_required_for_hosted_claims": True,
+            "provider_model_specific": True,
             "hosted_api_token_savings_claim_allowed": False,
             "hosted_api_cost_savings_claim_allowed": False,
         },
-        "missed_context_guardrail": {
-            "caller_acknowledged": bool(args.missed_context_guardrail_ack),
-            "required_before_promotion": True,
-            "human_review_required": True,
-        },
         "relation_to_visual_crop_ocr": {
-            "visual_crop_ocr_surface": "existing caller-supplied visual evidence-pack emitter",
-            "image_context_pack_surface": "pxpipe-inspired plan-only evaluation gate",
-            "duplicate_emitter": False,
-            "visual_handles_verified_exact_binary_fallback": False,
-            "note": (
-                "visual-crop-ocr remains the explicit caller-supplied visual evidence-pack runtime; "
-                "image-context-pack does not emit images, OCR, replacement evidence, or verified binary fallback."
-            ),
-        },
-        "proposed_image_context_pack": {
-            "image_size": image_payload,
-            "image_size_valid": image_size_valid,
-            "max_dimension": IMAGE_CONTEXT_PACK_MAX_DIMENSION,
-            "render_performed": False,
-            "image_bytes_computed": False,
-            "binary_receipt_created": False,
+            "visual_crop_ocr_is_existing_surface": True,
+            "visual_crop_ocr_remains_caller_supplied_visual_evidence_pack": True,
+            "image_context_pack_is_planning_gate_not_duplicate_emitter": True,
+            "verified_exact_binary_or_image_fallback_claimed": False,
         },
         "review_plan": {
             "readiness_blockers": blockers,
+            "missed_context_notes": missed_context_notes,
             "next_steps": [
-                "Keep this lane plan-only until a future PR supplies benchmark evidence and a separate runtime threat model.",
-                "Require verified exact sanitized text artifact fallback before relying on any omitted text.",
-                "Deny protected zones and prompt-like instructions before considering any future image/context packing.",
-                "Use provider-measured matched successful tasks before any hosted token/cost savings claim.",
+                "Keep exact text artifact fallback verified before any future image/context packing omits source text.",
+                "Deny protected evidence zones before any future lossy visual packing is considered.",
+                "Measure provider/model token and cost fields on matched successful tasks before any hosted savings claim.",
+                "Use visual-crop-ocr only for caller-supplied visual evidence packs; this gate emits no images or evidence.",
             ],
         },
         "claim_boundary": (
-            "Dry-run image-context-pack planning gate only; no image rendering, OCR, image parsing, model/provider call, "
-            "proxy forwarding, binary artifact storage, replacement emission, or hosted token/cost savings claim is performed."
+            "Dry-run image-context-pack planning only; image/request byte reductions are proxy evidence and no hosted "
+            "token/cost savings claim is allowed without provider-measured matched successful tasks."
         ),
         "candidate_replacement": None,
     }
@@ -1946,8 +1936,8 @@ def command_plan_image_context_pack(args: argparse.Namespace) -> int:
     if args.json:
         emit_json(payload)
     else:
-        print("ContextGuard image-context-pack planning gate (dry-run only)")
-        print("No image rendering, OCR, model/provider call, proxy forwarding, file write, or replacement emission was performed.")
+        print("ContextGuard image-context-pack plan (dry-run only)")
+        print("No image rendering, OCR/image service, model call, proxy forwarding, binary artifact, or replacement was emitted.")
         print(f"Status: {payload['status']}")
         if payload["review_plan"]["readiness_blockers"]:
             print(f"Readiness blockers: {', '.join(payload['review_plan']['readiness_blockers'])}")
@@ -4689,41 +4679,25 @@ def build_parser() -> argparse.ArgumentParser:
 
     image_context_pack = plan_sub.add_parser(
         "image-context-pack",
-        help="Dry-run a plan-only image/context packing evaluation gate without rendering images or emitting replacements.",
+        help="Dry-run a plan-only pxpipe-inspired image/context packing gate without rendering images.",
     )
+    image_context_pack.add_argument("--source-label", help="Safe label for this image/context packing plan.")
+    image_context_pack.add_argument("--image-size", help="Optional source image/context canvas size as width,height integers.")
+    image_context_pack.add_argument("--packed-image-size", help="Optional planned packed image size as width,height integers.")
+    image_context_pack.add_argument("--exact-text-fallback-receipt", help="Local exact text artifact receipt id for omitted source text.")
+    image_context_pack.add_argument("--reexpand-command", help="Local exact text re-expand command bound to the receipt id.")
     image_context_pack.add_argument(
-        "--evaluation-intent-ack",
+        "--provider-boundary-ack",
         action="store_true",
-        help="Acknowledge this is explicit future-evaluation planning only, not a runtime feature.",
+        help="Acknowledge hosted claims require provider-measured matched successful tasks for the target model.",
     )
     image_context_pack.add_argument(
-        "--exact-text-fallback-ack",
-        action="store_true",
-        help="Acknowledge verified exact text artifact fallback is required before omitted text is relied on.",
-    )
-    image_context_pack.add_argument("--text-fallback-receipt", help="Local exact text artifact receipt id for future fallback review.")
-    image_context_pack.add_argument("--reexpand-command", help="Local exact text artifact re-expand command bound to the receipt id.")
-    image_context_pack.add_argument(
-        "--protected-zone-deny-ack",
-        action="store_true",
-        help="Acknowledge protected code/diff/path/hash/identifier/JSON/numeric/prompt-like zones must be denied.",
-    )
-    image_context_pack.add_argument(
-        "--provider-measurement-boundary-ack",
-        action="store_true",
-        help="Acknowledge hosted claims require provider-measured matched successful tasks.",
-    )
-    image_context_pack.add_argument(
-        "--missed-context-guardrail-ack",
-        action="store_true",
-        help="Acknowledge missed-context guardrails and human review are required before promotion.",
-    )
-    image_context_pack.add_argument(
-        "--visual-crop-ocr-relation-ack",
-        action="store_true",
-        help="Acknowledge visual-crop-ocr is the existing caller-supplied visual evidence-pack runtime, not a verified binary fallback.",
+        "--protected-zone-policy",
+        default="deny",
+        choices=("deny", "allow"),
+        help="Protected evidence handling; only deny can pass the plan gate.",
     )
-    image_context_pack.add_argument("--proposed-image-size", help="Optional future image size as width,height; dry-run validation only.")
+    image_context_pack.add_argument("--missed-context-note", action="append", help="Potential context omitted by a future pack. Repeatable.")
     image_context_pack.add_argument("--json", action="store_true", help="Emit JSON output.")
     image_context_pack.set_defaults(func=command_plan_image_context_pack)
 

From 7e436b94064016ec9f6ba6abf203d79543844b1d Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 12:21:51 +0900
Subject: [PATCH 24/29] omx(team): auto-checkpoint worker-2 [2]

---
 context-guard-kit/experimental_registry.py    |   4 +-
 .../bin/context-guard-experiments             |   4 +-
 tests/test_context_guard_kit.py               | 126 +++++++++---------
 3 files changed, 69 insertions(+), 65 deletions(-)

diff --git a/context-guard-kit/experimental_registry.py b/context-guard-kit/experimental_registry.py
index e8816ef..7440464 100755
--- a/context-guard-kit/experimental_registry.py
+++ b/context-guard-kit/experimental_registry.py
@@ -302,8 +302,8 @@ def to_json(self, *, enabled: bool = False) -> dict[str, Any]:
             "traffic, write binary artifacts, or duplicate the caller-supplied visual-crop-ocr evidence-pack emitter."
         ),
         evidence_contract=(
-            "The planner requires acknowledgements for explicit evaluation intent, exact text artifact fallback, "
-            "protected-zone denial, provider/model measurement boundaries, missed-context review, and the fact that "
+            "The planner requires acknowledgements for explicit evaluation intent, verified exact text artifact fallback, "
+            "protected-zone denial, provider/model measured matched-task boundaries, missed-context review, and the fact that "
             "visual-crop-ocr is the existing caller-supplied visual evidence-pack surface, not a verified "
             "exact binary/image fallback."
         ),
diff --git a/plugins/context-guard/bin/context-guard-experiments b/plugins/context-guard/bin/context-guard-experiments
index e8816ef..7440464 100755
--- a/plugins/context-guard/bin/context-guard-experiments
+++ b/plugins/context-guard/bin/context-guard-experiments
@@ -302,8 +302,8 @@ EXPERIMENTS: tuple[Experiment, ...] = (
             "traffic, write binary artifacts, or duplicate the caller-supplied visual-crop-ocr evidence-pack emitter."
         ),
         evidence_contract=(
-            "The planner requires acknowledgements for explicit evaluation intent, exact text artifact fallback, "
-            "protected-zone denial, provider/model measurement boundaries, missed-context review, and the fact that "
+            "The planner requires acknowledgements for explicit evaluation intent, verified exact text artifact fallback, "
+            "protected-zone denial, provider/model measured matched-task boundaries, missed-context review, and the fact that "
             "visual-crop-ocr is the existing caller-supplied visual evidence-pack surface, not a verified "
             "exact binary/image fallback."
         ),
diff --git a/tests/test_context_guard_kit.py b/tests/test_context_guard_kit.py
index 49dc268..68380ec 100644
--- a/tests/test_context_guard_kit.py
+++ b/tests/test_context_guard_kit.py
@@ -2904,6 +2904,56 @@ def test_experimental_image_context_pack_plan_only_contract(self):
                 self.assertIn("proxy evidence", payload["claim_boundary"])
                 self.assertIsNone(payload["candidate_replacement"])
 
+    def test_experimental_image_context_pack_plan_is_deterministic_and_side_effect_free(self):
+        receipt = "0123456789abcdef"
+        args = [
+            "plan",
+            "image-context-pack",
+            "--exact-text-fallback-receipt",
+            receipt,
+            "--reexpand-command",
+            f"context-guard-artifact get {receipt} --full",
+            "--provider-boundary-ack",
+            "--protected-zone-policy",
+            "deny",
+            "--missed-context-note",
+            "summary table footer remains available through exact text fallback",
+            "--image-size",
+            "800,600",
+            "--packed-image-size",
+            "400,300",
+            "--json",
+        ]
+        for script in EXPERIMENT_SCRIPTS:
+            with self.subTest(script=script):
+                with tempfile.TemporaryDirectory() as tmp:
+                    root = Path(tmp)
+                    before = sorted(path.relative_to(root).as_posix() for path in root.rglob("*"))
+                    first = subprocess.run(
+                        [sys.executable, str(script), *args],
+                        text=True,
+                        capture_output=True,
+                        check=True,
+                        cwd=root,
+                    )
+                    second = subprocess.run(
+                        [sys.executable, str(script), *args],
+                        text=True,
+                        capture_output=True,
+                        check=True,
+                        cwd=root,
+                    )
+                    after = sorted(path.relative_to(root).as_posix() for path in root.rglob("*"))
+                first_payload = json.loads(first.stdout)
+                second_payload = json.loads(second.stdout)
+                self.assertEqual(first_payload, second_payload)
+                self.assertEqual(after, before)
+                self.assertEqual(first_payload["status"], "ready_for_plan_review")
+                self.assertFalse(first_payload["runtime_side_effects"]["files_written"])
+                self.assertFalse(first_payload["runtime_side_effects"]["image_rendering"])
+                self.assertFalse(first_payload["runtime_side_effects"]["binary_artifacts_written"])
+                self.assertFalse(first_payload["external_services"]["called"])
+
     def test_experimental_image_context_pack_blocks_missing_or_unsafe_gates(self):
         receipt = "0123456789abcdef"
         cases = [
@@ -6897,6 +6947,7 @@ def test_experimental_image_context_pack_docs_examples_match_cli(self):
             "--missed-context-guardrail-ack",
             "--visual-crop-ocr-relation-ack",
         )
+        receipt = "0123456789abcdef"
         for doc in docs:
             with self.subTest(doc=doc):
                 text = doc.read_text(encoding="utf-8")
@@ -6912,28 +6963,20 @@ def test_experimental_image_context_pack_docs_examples_match_cli(self):
                 for flag in forbidden_flags:
                     self.assertNotIn(flag, example)
 
-    def test_experimental_image_context_pack_docs_surface_boundary(self):
-        docs = (
-            ROOT / "README.md",
-            PLUGIN_DIR / "README.md",
-            KIT_DIR / "README.md",
-            ROOT / "research" / "experimental-token-reduction-radar.md",
-        )
-        for doc in docs:
-            with self.subTest(doc=doc):
-                text = doc.read_text(encoding="utf-8").lower()
-                self.assertIn("image-context-pack", text)
-                self.assertRegex(text, r"plan[- ]only|planning gate|dry-run")
-                self.assertRegex(text, r"pxpipe[- ]inspired|pxpipe")
-                self.assertRegex(text, r"exact text fallback|verified exact text|exact fallback")
-                self.assertRegex(text, r"provider-measured|provider measured")
-                self.assertRegex(text, r"visual-crop-ocr")
-                self.assertRegex(text, r"no image|does not render|image rendering|does not capture|no screenshot|이미지")
-                self.assertRegex(text, r"no hosted|hosted .*savings|hosted api")
-                self.assertNotIn("image-context-pack emit", text)
-                self.assertNotIn("emit image-context-pack", text)
-                self.assertNotIn("image-context-pack runtime is shipped", text)
-                self.assertNotIn("guaranteed hosted", text)
+                argv = [token.replace("<id>", receipt) for token in shlex.split(example)]
+                self.assertEqual(argv[:3], ["context-guard", "experiments", "plan"])
+                with tempfile.TemporaryDirectory() as tmp:
+                    proc = subprocess.run(
+                        [sys.executable, str(PLUGIN_BIN / "context-guard-experiments"), *argv[2:]],
+                        text=True,
+                        capture_output=True,
+                        check=True,
+                        cwd=tmp,
+                    )
+                payload = json.loads(proc.stdout)
+                self.assertEqual(payload["experiment_id"], "image-context-pack")
+                self.assertEqual(payload["status"], "ready_for_plan_review")
+                self.assertEqual(payload["review_plan"]["readiness_blockers"], [])
 
     def test_experimental_local_proxy_docs_surface_boundary(self):
         docs = (
@@ -6978,45 +7021,6 @@ def test_experimental_local_proxy_docs_surface_boundary(self):
                 self.assertRegex(text, r"raw headers?|raw bodies|raw header/body|request bodies|response bodies|원문 header|원문 body")
                 self.assertRegex(text, r"hosted.*savings|hosted api 절감")
 
-    def test_experimental_image_context_pack_docs_examples_match_cli(self):
-        docs = (
-            ROOT / "README.md",
-            ROOT / "README.ko.md",
-            PLUGIN_DIR / "README.md",
-        )
-        canonical_flags = (
-            "--exact-text-fallback-receipt",
-            "--provider-boundary-ack",
-            "--protected-zone-policy deny",
-            "--missed-context-note",
-        )
-        forbidden_flags = (
-            "--explicit-opt-in",
-            "--exact-text-receipt",
-            "--provider-measurement-boundary",
-            "--evaluation-intent-ack",
-            "--exact-text-fallback-ack",
-            "--text-fallback-receipt",
-            "--protected-zone-deny-ack",
-            "--provider-measurement-boundary-ack",
-            "--missed-context-guardrail-ack",
-            "--visual-crop-ocr-relation-ack",
-        )
-        for doc in docs:
-            with self.subTest(doc=doc):
-                text = doc.read_text(encoding="utf-8")
-                example_lines = [
-                    line.strip()
-                    for line in text.splitlines()
-                    if "context-guard experiments plan image-context-pack" in line
-                ]
-                self.assertEqual(len(example_lines), 1)
-                example = example_lines[0]
-                for flag in canonical_flags:
-                    self.assertIn(flag, example)
-                for flag in forbidden_flags:
-                    self.assertNotIn(flag, example)
-
     def test_experimental_image_context_pack_docs_surface_boundary(self):
         docs = (
             ROOT / "README.md",

From abcd57cc7f8b3fbc52e3819a93b2d7c1e401bca7 Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 12:07:18 +0900
Subject: [PATCH 25/29] task: implement image-context-pack plan gate


From 4bb4908260b82448ba3c9283f10a3c4baf873866 Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 12:22:19 +0900
Subject: [PATCH 26/29] task: review image context pack docs


From 5bafe4a7792089833962d44f80f87331fb81bf42 Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 12:22:19 +0900
Subject: [PATCH 27/29] task: review image context pack docs


From 680cf70eab76695b6422135342195d51498b2fed Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Thu, 9 Jul 2026 12:25:15 +0900
Subject: [PATCH 28/29] chore: keep Claude settings local ignored

---
 .claude/settings.json           | 67 ---------------------------------
 tests/test_context_guard_kit.py | 46 ++++++++--------------
 2 files changed, 16 insertions(+), 97 deletions(-)
 delete mode 100644 .claude/settings.json

diff --git a/.claude/settings.json b/.claude/settings.json
deleted file mode 100644
index ac9d840..0000000
--- a/.claude/settings.json
+++ /dev/null
@@ -1,67 +0,0 @@
-{
-  "model": "sonnet",
-  "effortLevel": "medium",
-  "statusLine": {
-    "type": "command",
-    "command": "bash context-guard-kit/statusline_merged.sh"
-  },
-  "permissions": {
-    "deny": [
-      "Read(./node_modules/**)",
-      "Read(./dist/**)",
-      "Read(./build/**)",
-      "Read(./coverage/**)",
-      "Read(./logs/**)",
-      "Read(./tmp/**)",
-      "Read(./target/**)",
-      "Read(./.next/**)",
-      "Read(./.venv/**)",
-      "Read(./vendor/**)",
-      "Read(./.npmrc)",
-      "Read(./.pypirc)",
-      "Read(./.netrc)",
-      "Read(./.context-guard/**)",
-      "Read(./.claude-token-optimizer/**)",
-      "Read(./.env)",
-      "Read(./.env.*)",
-      "Read(~/.ssh/**)",
-      "Read(~/.aws/**)",
-      "Read(~/.gnupg/**)",
-      "Read(~/.kube/**)",
-      "Read(~/.docker/**)"
-    ]
-  },
-  "hooks": {
-    "PreToolUse": [
-      {
-        "matcher": "Bash",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "python3 context-guard-kit/rewrite_bash_for_token_budget.py"
-          }
-        ]
-      },
-      {
-        "matcher": "Read",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "python3 context-guard-kit/guard_large_read.py"
-          }
-        ]
-      }
-    ],
-    "PostToolUse": [
-      {
-        "matcher": "Bash",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "python3 context-guard-kit/failed_attempt_nudge.py"
-          }
-        ]
-      }
-    ]
-  }
-}
diff --git a/tests/test_context_guard_kit.py b/tests/test_context_guard_kit.py
index 68380ec..dde90f3 100644
--- a/tests/test_context_guard_kit.py
+++ b/tests/test_context_guard_kit.py
@@ -25240,37 +25240,23 @@ def test_token_diet_scan_sanitizes_os_error_paths(self):
             self.assertEqual(diet.format_os_error(error), "Permission denied (errno 13)")
             self.assertNotIn(str(root), diet.format_os_error(error))
 
-    def test_project_settings_denies_context_guard_state(self):
+    def test_project_settings_stays_local_ignored_and_denies_context_guard_state(self):
         settings_path = ROOT / ".claude" / "settings.json"
-        self.assertTrue(settings_path.is_file())
-        settings = json.loads(settings_path.read_text(encoding="utf-8"))
-        denies = settings["permissions"]["deny"]
-        self.assertIn("Read(./.context-guard/**)", denies)
-        for existing in (
-            "Read(./node_modules/**)",
-            "Read(./dist/**)",
-            "Read(./build/**)",
-            "Read(./coverage/**)",
-            "Read(./logs/**)",
-            "Read(./tmp/**)",
-            "Read(./target/**)",
-            "Read(./.next/**)",
-            "Read(./.venv/**)",
-            "Read(./vendor/**)",
-            "Read(./.claude-token-optimizer/**)",
-            "Read(./.env)",
-            "Read(./.env.*)",
-            "Read(./.npmrc)",
-            "Read(./.pypirc)",
-            "Read(./.netrc)",
-            "Read(~/.ssh/**)",
-            "Read(~/.aws/**)",
-            "Read(~/.gnupg/**)",
-            "Read(~/.kube/**)",
-            "Read(~/.docker/**)",
-        ):
-            with self.subTest(existing=existing):
-                self.assertIn(existing, denies)
+        gitignore = (ROOT / ".gitignore").read_text(encoding="utf-8")
+        self.assertIn(".claude/", gitignore.splitlines())
+
+        tracked = subprocess.run(
+            ["git", "-C", str(ROOT), "ls-files", "--", ".claude/settings.json"],
+            text=True,
+            capture_output=True,
+        )
+        if tracked.returncode == 0:
+            self.assertEqual(tracked.stdout.strip(), "")
+
+        if settings_path.is_file():
+            settings = json.loads(settings_path.read_text(encoding="utf-8"))
+            denies = settings["permissions"]["deny"]
+            self.assertIn("Read(./.context-guard/**)", denies)
 
     def test_settings_examples_deny_private_optimizer_state(self):
         for example_path in [

From 5c6240872707934418007b51bd3a53b6f43c6513 Mon Sep 17 00:00:00 2001
From: Coden <ictechgy@gmail.com>
Date: Fri, 10 Jul 2026 01:25:00 +0900
Subject: [PATCH 29/29] task: add semantic-checkpoint plan gate

Adds a plan-only semantic-checkpoint experimental gate with stable readiness blockers, exact fallback validation, provenance review metadata, synced plugin copy, tests, and docs.\n\nTested: git diff --check; py_compile; sync_plugin_copies --check; targeted semantic unittest suite; full python3 -m unittest tests.test_context_guard_kit (611 tests).\nNot-tested: external provider review loop pending PR creation.
---
 README.ko.md                                  |   9 +-
 README.md                                     |  11 +-
 context-guard-kit/README.md                   |   8 +-
 context-guard-kit/experimental_registry.py    | 221 ++++++++++++
 plugins/context-guard/README.ko.md            |   6 +-
 plugins/context-guard/README.md               |   5 +-
 .../bin/context-guard-experiments             | 221 ++++++++++++
 .../experimental-token-reduction-radar.md     |  16 +-
 tests/test_context_guard_kit.py               | 318 ++++++++++++++++++
 9 files changed, 805 insertions(+), 10 deletions(-)

diff --git a/README.ko.md b/README.ko.md
index dca8633..2c09c8f 100644
--- a/README.ko.md
+++ b/README.ko.md
@@ -78,7 +78,7 @@ ContextGuard는 provider 캐시, semantic cache, 프롬프트 압축 도구를 
 | Provider prompt/context caching | 안정적인 프롬프트 앞부분을 재사용합니다. | 보완 관계입니다. ContextGuard는 자주 바뀌는 컨텍스트 뒷부분을 더 작고 깨끗하게 유지하도록 돕고, `context-guard-audit`로 프롬프트 배치를 점검하며, `context-guard cost`로 Anthropic 요청이 cache read 대신 cache write가 될 가능성을 미리 알릴 수 있습니다. |
 | Semantic response cache | 같거나 비슷한 요청의 이전 답변을 재사용합니다. | 보완 관계입니다. ContextGuard는 AI 답변 캐시를 제공하지 않습니다. |
 | 프롬프트/컨텍스트 압축 | 이미 선택된 텍스트를 더 짧게 만듭니다. | 인접한 역할입니다. ContextGuard는 로컬 출력 축약과 요약을 제공하지만, 무손실 의미 압축을 보장하지 않습니다. |
-| 실험 planner/runtime | local proxy는 dry-run plan, external-forwarding design plan, gate record, one-shot loopback forwarding MVP로만 검토합니다. context-diff, visual evidence-pack, learned-compression, self-hosted metrics도 명시적 로컬 런타임만 지원합니다. | 모두 기본 비활성이며 명시적 명령이 필요합니다. `record`는 listener·traffic forwarding·DNS lookup을 시작하지 않고, `serve local-proxy`는 literal loopback IP로 제한된 1회 요청만 bind/forward하며, `--response-sandbox`는 safe UTF-8 upstream body를 compact local artifact 재조회 envelope로 대체할 수 있습니다. 별도 근거 gate와 future PR gate 없이는 model/compressor 실행, OCR/crop service, external forwarding, credential persistence, hosted API 절감 주장으로 보지 않습니다. 자세한 내용은 “실험 기능 opt-in 관리” 섹션을 참고하세요. |
+| 실험 planner/runtime | `image-context-pack`과 `semantic-checkpoint`는 plan-only gate로만 검토합니다. local proxy는 dry-run plan, external-forwarding design plan, gate record, one-shot loopback forwarding MVP로만 검토합니다. context-diff, visual evidence-pack, learned-compression, self-hosted metrics도 명시적 로컬 런타임만 지원합니다. | 모두 기본 비활성이며 명시적 명령이 필요합니다. `semantic-checkpoint`는 exact context fallback/re-expand, provenance review ack, provider-boundary ack, protected-zone denial, missed-context note가 있어야 JSON payload가 ready 상태가 됩니다. `record`는 listener·traffic forwarding·DNS lookup을 시작하지 않고, `serve local-proxy`는 literal loopback IP로 제한된 1회 요청만 bind/forward하며, `--response-sandbox`는 safe UTF-8 upstream body를 compact local artifact 재조회 envelope로 대체할 수 있습니다. 별도 근거 gate와 future PR gate 없이는 model/compressor 실행, OCR/crop service, external forwarding, credential persistence, runtime checkpoint replacement, hosted API 절감 주장으로 보지 않습니다. 자세한 내용은 “실험 기능 opt-in 관리” 섹션을 참고하세요. |
 | ContextGuard | 불필요한 파일, 로그, 반복 실패, 과도한 출력이 에이전트 컨텍스트에 들어가기 전에 줄어들도록 돕습니다. | 로컬 가드레일, 되돌릴 수 있는 로컬 보관본, 측정 도구입니다. |
 
 설계에 참고한 관련 패턴은 다음과 같습니다.
@@ -117,7 +117,7 @@ brief 모드는 코딩 에이전트가 군더더기를 줄이도록 요청하되
 - setup이나 패키징 smoke check에서 명령 매니페스트를 코드로 실행하거나 임의 `PATH`/현재 작업 디렉터리 헬퍼를 신뢰하지 않습니다.
 - 절감 수치가 필요할 때 직접 전후 비교 측정을 대신하지 않습니다.
 - 로컬 RAM/디스크 보관본은 다음에 보낼 컨텍스트를 줄이는 데 도움이 될 수 있지만 Anthropic provider prompt cache를 대체하거나 cache hit를 보장하지 않습니다. 배포나 청구 설명 전에는 Anthropic prompt caching/pricing 문서를 다시 확인하세요: https://docs.anthropic.com/en/build-with-claude/prompt-caching 및 https://platform.claude.com/docs/en/about-claude/pricing.
-- 실험 헬퍼는 대부분 dry-run 안전성 checker/planner이며 design-only external-forwarding opt-in gate를 포함합니다. 명시적 로컬 runtime은 caller-supplied context-diff replacement payload, caller-supplied visual crop/OCR evidence pack, caller-supplied learned-compression prose candidate, self-hosted metrics JSONL sidecar 기록, local-proxy runtime-gate JSONL 기록, private ready-file nonce가 필요한 one-shot `serve local-proxy` loopback forwarding, safe UTF-8 응답을 compact artifact envelope로 바꾸는 optional `--response-sandbox`, successful forwarded request용 optional shifted-cost diagnostic JSONL row만 제공합니다.
+- 실험 헬퍼는 대부분 dry-run 안전성 checker/planner이며 plan-only `image-context-pack`/`semantic-checkpoint` 평가 gate와 design-only external-forwarding opt-in gate를 포함합니다. 명시적 로컬 runtime은 caller-supplied context-diff replacement payload, caller-supplied visual crop/OCR evidence pack, caller-supplied learned-compression prose candidate, self-hosted metrics JSONL sidecar 기록, local-proxy runtime-gate JSONL 기록, private ready-file nonce가 필요한 one-shot `serve local-proxy` loopback forwarding, safe UTF-8 응답을 compact artifact envelope로 바꾸는 optional `--response-sandbox`, successful forwarded request용 optional shifted-cost diagnostic JSONL row만 제공합니다.
 - ContextGuard는 learned/synthetic compressor 실행·embedding·reranker·model call·생성형 replacement, screenshot 캡처·image crop·OCR 실행·image parsing·외부 OCR/image service, 명시적 local metrics 기록을 넘어선 self-hosted KV/latent inference optimization runtime, literal-loopback 1회 HTTP forwarding과 credential 차단을 넘어선 proxy forwarding은 제공하지 않습니다.
 - 예전 `/claude-token-optimizer:*` Claude Code 슬래시 명령을 별칭으로 제공하지 않습니다. 설치 후에는 `/context-guard:*`를 사용하세요.
 
@@ -395,6 +395,7 @@ context-guard experiments emit context-diff-compaction --receipt-id <artifact-id
 context-guard experiments plan visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --missed-context-note "outside crop omitted"
 context-guard experiments emit visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --ocr-text "visible text" --ocr-confidence 0.9 --ocr-error-note "glyph may be uncertain" --missed-context-note "outside crop omitted"
 context-guard experiments plan image-context-pack --json --exact-text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --provider-boundary-ack --protected-zone-policy deny --missed-context-note "omitted text remains retrievable before any future image pack is used" --image-size 800,600 --packed-image-size 400,300
+context-guard experiments plan semantic-checkpoint --json --goal "preserve current task state for review" --constraint "do not rewrite protected evidence" --decision "ship plan-only semantic-checkpoint gate first" --open-task "verify exact fallback before any checkpoint is used" --evidence-handle "roadmap=contextguard-artifact:0123456789abcdef" --missing-provenance-note "none known after review" --unresolved-question "which provenance handle fields become mandatory later" --exact-context-fallback-receipt 0123456789abcdef --reexpand-command "context-guard-artifact get 0123456789abcdef --full" --provider-boundary-ack --protected-zone-policy deny --missed-context-note "raw transcript remains retrievable before checkpoint metadata is used"
 context-guard experiments plan learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" < sanitized-prose.txt
 context-guard experiments emit learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --replacement-file compact-prose.txt < sanitized-prose.txt
 context-guard experiments plan self-hosted-metrics-ledger --json --latency-ms 123.5 --peak-memory-mb 2048 --quality-score 0.98
@@ -407,6 +408,8 @@ context-guard experiments enable output-receipt-trim --root .
 context-guard experiments disable output-receipt-trim --root .
 ```
 
+`plan semantic-checkpoint`는 plan-only/eval-only gate입니다. CLI flag는 dry-run 검토를 위해 optional이지만, JSON payload에서는 goal, exact fallback receipt, local re-expand command, provider-boundary ack, protected-zone policy `deny`, missed-context note, provenance review note가 없으면 readiness blocker로 남습니다. re-expand command는 `context-guard-artifact get <id> --full` 또는 `context-guard artifact get <id> --full` 형태의 로컬 artifact 재조회만 허용합니다. `--missing-provenance-note`는 `none known after review` 같은 검토 확인 문구일 수 있습니다. 이 gate는 `emit`/`record`/`serve` runtime, 새 `context-guard-semantic-checkpoint` binary, file write, transcript/prompt edit, model/provider/network call, replacement context, hosted token/cost savings claim을 제공하지 않습니다.
+
 local-proxy 예시는 side effect 기준으로 나뉩니다.
 
 - `plan local-proxy`는 advisory metadata만 만들며 forwarding을 켜지 않습니다.
@@ -422,6 +425,7 @@ local-proxy 예시는 side effect 기준으로 나뉩니다.
 | `context-diff-compaction` | dry-run diff 조언과 명시적 `emit ... --receipt-id ... --reexpand-command ...` 런타임으로 caller-supplied compact replacement를 출력합니다. | `plan`은 replacement를 emit하지 않습니다. `emit`은 reviewable hunk, input diff와 일치하는 exact local artifact content/re-expand metadata와 더 작은 caller-supplied replacement가 모두 있을 때만 동작하며, ContextGuard가 semantic compression을 생성하거나 hosted token/cost 절감 주장 근거로 쓰지 않습니다. |
 | `visual-crop-ocr` | dry-run visual evidence 조언과 명시적 `emit visual-crop-ocr` 런타임으로 caller-supplied evidence pack을 출력합니다. | `emit`은 full visual evidence receipt, missed-context note, 완전한 user-supplied crop 및/또는 OCR evidence가 필요합니다. ContextGuard는 screenshot 캡처, image crop, OCR 실행, image parsing, 외부 service 호출, 파일 쓰기, hosted token/cost 절감 주장을 하지 않습니다. |
 | `image-context-pack` | pxpipe-inspired image/context packing 평가를 위한 plan-only dry-run gate입니다. | 명시적 평가 의도, exact text artifact fallback, protected-zone denial, provider-measured matched-task boundary, missed-context guardrail, 그리고 `visual-crop-ocr`이 기존 caller-supplied visual evidence-pack surface라는 확인이 필요합니다. ContextGuard는 image rendering, OCR 실행, image parsing, model/provider call, proxy traffic, binary artifact 저장, replacement evidence 출력, hosted token/cost savings claim을 하지 않습니다. |
+| `semantic-checkpoint` | 현재 작업 상태를 review용으로 보존할 준비가 되었는지 확인하는 plan-only/eval-only gate입니다. | CLI flag는 optional이지만 JSON readiness는 exact context fallback/re-expand, provider-boundary ack, protected-zone denial, missed-context note, provenance review note가 없으면 blocked입니다. `--missing-provenance-note`는 `none known after review` 같은 검토 확인 문구일 수 있습니다. ContextGuard는 file write, transcript/prompt edit, model/provider/network call, replacement context, `emit`/`record`/`serve` runtime, 새 binary, hosted token/cost savings claim을 하지 않습니다. |
 | `learned-compression` | deny-by-default 정책 검사와 명시적 `emit learned-compression` 런타임으로 verified exact fallback content가 있는 caller-supplied compact prose candidate를 출력합니다. | `emit`은 sanitized trusted prose, protected-signal denial, input과 일치하는 verified local fallback artifact, 더 작은 caller-supplied prose candidate가 필요합니다. ContextGuard는 compressor, embedding, reranker, model call, subprocess, external service, 생성형 replacement, hosted savings claim을 실행/생성하지 않습니다. |
 | `self-hosted-metrics-ledger` | dry-run preview와 명시적 `record ... --ledger-jsonl` 런타임으로 local/model-server latency, memory, quality, energy, throughput, local-cost metric을 기록합니다. | dry-run preview는 ledger 파일을 쓰지 않습니다. 명시적 record 명령만 로컬 JSONL sidecar를 쓰며, hosted API token/cost 절감 주장 근거로는 쓰지 않습니다. |
 | `local-proxy` | 미래 local proxy 후보에 대한 localhost-only advisory metadata, future external forwarding용 design-only `plan local-proxy-external-forwarding` review, 명시적 `record local-proxy-runtime-gate --ledger-jsonl` gate row runtime, 명시적 one-shot `serve local-proxy` loopback forwarding MVP, safe UTF-8 응답을 compact artifact envelope로 바꾸는 optional `--response-sandbox`, successful forwarded request용 optional `--diagnostic-ledger-jsonl` shifted-cost diagnostics. | `plan`은 ledger를 쓰지 않습니다. `record`는 localhost-only metadata와 `--runtime-gate-ack`가 있을 때만 로컬 JSONL row를 쓰며 listener 시작이나 traffic forwarding, DNS lookup을 하지 않습니다. `serve`는 `--forwarding-gate-ack --once`, private `--ready-file` nonce handoff, literal loopback bind/target IP, nonzero port, byte/time limit, credential-free request가 필요하며 external forwarding, CONNECT/TLS proxying, API-key persistence, hosted API 절감 주장을 하지 않습니다. `--response-sandbox`는 safe UTF-8 response text만 sanitized local artifact receipt로 저장하고 raw body 대신 redacted rehydration command template가 담긴 compact envelope를 반환하며 hosted token/cost savings claim은 아닙니다. `--diagnostic-ledger-jsonl`은 successful-forward 진단 row만 쓰며 raw header/body와 hosted-savings claim을 저장하지 않습니다. `plan local-proxy-external-forwarding`은 threat model/allowlist/redaction/provider-evidence design metadata만 출력하고 DNS lookup, external service call, traffic forwarding, credential persistence, hosted savings claim을 하지 않습니다. |
@@ -434,6 +438,7 @@ ContextGuard는 아직 다음 기능을 제공하지 않습니다.
 
 - caller-supplied learned candidate emitter를 넘어서는 learned/synthetic compressor 실행 또는 생성형 replacement
 - caller-supplied visual evidence-pack emitter와 plan-only image-context-pack dry-run gate를 넘어서는 생성형 crop/OCR, visual-token pruning runtime, image-context-pack rendering/runtime
+- plan-only semantic-checkpoint gate를 넘어서는 emit/record/serve runtime, replacement context, file-writing checkpoint store, transcript/prompt edit, provider/model/network-backed checkpointing, 새 `context-guard-semantic-checkpoint` binary
 - 명시적 local metrics 기록을 넘어서는 self-hosted KV/latent optimization
 - one-shot literal-loopback local proxy MVP를 넘어서는 external/daemon/credential-bearing proxy forwarding runtime
 
diff --git a/README.md b/README.md
index 5e9de4c..7b31942 100644
--- a/README.md
+++ b/README.md
@@ -80,7 +80,7 @@ ContextGuard complements provider and semantic caches, and works alongside promp
 | Provider prompt/context caching | Reusing stable prompt prefixes. | Complementary; ContextGuard helps keep the changing tail of context smaller and cleaner, `context-guard-audit` can flag likely volatile prefix layouts, and `context-guard cost` can warn when an Anthropic request is likely to cache-write instead of cache-read. |
 | Semantic response cache | Reusing answers to identical or similar requests. | Complementary; ContextGuard does not serve cached AI answers. |
 | Prompt/context compression | Shortening text that is already selected for the model. | Adjacent; ContextGuard trims and summarizes local output, but does not promise lossless semantic compression. |
-| Experimental planners and local runtimes | Default-off and explicit-command-only; covers plan-only `image-context-pack` plus local-proxy plans/gate records and narrow local runtimes for caller-supplied context-diff, visual evidence-pack, learned-compression, and self-hosted metrics evidence. | `image-context-pack` is a pxpipe-inspired dry-run planning gate only: it does not render images, run OCR, emit replacements, store binary image artifacts, call providers, or proxy traffic, and it requires exact text fallback plus provider-measured matched-task evidence before claims. The local proxy `record` command starts no listener and forwards no traffic; `serve local-proxy` binds and forwards only literal loopback IPs for one bounded request; `--response-sandbox` can replace a safe UTF-8 upstream body with a compact local artifact rehydration envelope. Compressor/model execution, OCR/crop services, external forwarding, credential persistence, and hosted-savings claims stay out of scope until a separate evidence gate and future PR allow them. |
+| Experimental planners and local runtimes | Default-off and explicit-command-only; covers plan-only `image-context-pack` and `semantic-checkpoint` gates plus local-proxy plans/gate records and narrow local runtimes for caller-supplied context-diff, visual evidence-pack, learned-compression, and self-hosted metrics evidence. | `image-context-pack` and `semantic-checkpoint` are dry-run planning gates only: they do not emit replacements, call models/providers, proxy traffic, write files, or make hosted token/cost savings claims. `semantic-checkpoint` additionally requires exact context fallback/re-expand metadata, provenance review acknowledgement, provider-boundary acknowledgement, protected-zone denial, and missed-context notes before the JSON payload reports readiness. The local proxy `record` command starts no listener and forwards no traffic; `serve local-proxy` binds and forwards only literal loopback IPs for one bounded request; `--response-sandbox` can replace a safe UTF-8 upstream body with a compact local artifact rehydration envelope. Compressor/model execution, OCR/crop services, external forwarding, credential persistence, runtime checkpoint replacement, and hosted-savings claims stay out of scope until a separate evidence gate and future PR allow them. |
 | ContextGuard | Avoiding unnecessary files, logs, repeated failures, and noisy output before they enter agent context. | Local guardrails, reversible artifacts, and measurement. |
 
 Related patterns that informed the design:
@@ -119,7 +119,7 @@ If you need a savings claim, measure it on your own tasks:
 - It does not execute command manifests as code or trust arbitrary `PATH`/current-working-directory helpers during setup or packaged smoke checks.
 - It does not replace real before/after measurement when you need a savings claim.
 - Local RAM/disk receipts can help reduce what you send next, but they do **not** replace Anthropic's provider prompt cache or guarantee cache hits. Recheck Anthropic prompt-caching and pricing docs before release or billing claims: https://docs.anthropic.com/en/build-with-claude/prompt-caching and https://platform.claude.com/docs/en/about-claude/pricing.
-- Experimental helpers are mostly dry-run checker/planner surfaces, including a plan-only `image-context-pack` evaluation gate and a design-only external-forwarding opt-in gate. Explicit local runtimes exist only for caller-supplied context-diff replacement payloads, caller-supplied visual crop/OCR evidence packs, caller-supplied learned-compression prose candidates, self-hosted metrics JSONL sidecar records, local-proxy runtime-gate JSONL records, and one-shot `serve local-proxy` loopback forwarding with a private ready-file nonce, optional `--response-sandbox` compact artifact envelopes for safe UTF-8 responses, plus optional shifted-cost diagnostic JSONL rows for successful forwarded requests.
+- Experimental helpers are mostly dry-run checker/planner surfaces, including plan-only `image-context-pack` and `semantic-checkpoint` evaluation gates and a design-only external-forwarding opt-in gate. Explicit local runtimes exist only for caller-supplied context-diff replacement payloads, caller-supplied visual crop/OCR evidence packs, caller-supplied learned-compression prose candidates, self-hosted metrics JSONL sidecar records, local-proxy runtime-gate JSONL records, and one-shot `serve local-proxy` loopback forwarding with a private ready-file nonce, optional `--response-sandbox` compact artifact envelopes for safe UTF-8 responses, plus optional shifted-cost diagnostic JSONL rows for successful forwarded requests.
 - ContextGuard does not ship learned/synthetic compressor execution, embeddings, rerankers, model calls, generated replacement text, screenshot capture, image cropping, OCR execution, image parsing, external OCR/image services, self-hosted KV/latent inference optimization beyond explicit local metrics recording, or broader proxy forwarding beyond literal-loopback, one-request HTTP forwarding with credential material blocked.
 - It does not alias the old `/claude-token-optimizer:*` Claude Code slash-command namespace. Use `/context-guard:*` after installing this plugin.
 
@@ -442,6 +442,7 @@ context-guard experiments emit context-diff-compaction --receipt-id <artifact-id
 context-guard experiments plan visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --missed-context-note "outside crop omitted"
 context-guard experiments emit visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --ocr-text "visible text" --ocr-confidence 0.9 --ocr-error-note "glyph may be uncertain" --missed-context-note "outside crop omitted"
 context-guard experiments plan image-context-pack --json --exact-text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --provider-boundary-ack --protected-zone-policy deny --missed-context-note "omitted text remains retrievable before any future image pack is used" --image-size 800,600 --packed-image-size 400,300
+context-guard experiments plan semantic-checkpoint --json --goal "preserve current task state for review" --constraint "do not rewrite protected evidence" --decision "ship plan-only semantic-checkpoint gate first" --open-task "verify exact fallback before any checkpoint is used" --evidence-handle "roadmap=contextguard-artifact:0123456789abcdef" --missing-provenance-note "none known after review" --unresolved-question "which provenance handle fields become mandatory later" --exact-context-fallback-receipt 0123456789abcdef --reexpand-command "context-guard-artifact get 0123456789abcdef --full" --provider-boundary-ack --protected-zone-policy deny --missed-context-note "raw transcript remains retrievable before checkpoint metadata is used"
 context-guard experiments plan learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" < sanitized-prose.txt
 context-guard experiments emit learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --replacement-file compact-prose.txt < sanitized-prose.txt
 context-guard experiments plan self-hosted-metrics-ledger --json --latency-ms 123.5 --peak-memory-mb 2048 --quality-score 0.98
@@ -456,6 +457,8 @@ context-guard experiments disable output-receipt-trim --root .
 
 `plan image-context-pack` is intentionally plan-only and side-effect free: it emits deterministic JSON metadata, does not render or parse images, does not run OCR, does not store binary image artifacts, does not call providers or proxy traffic, and does not duplicate `visual-crop-ocr`. Any future omission of exact text must keep a verified exact text fallback, deny protected zones, record missed-context guardrails, and treat image/request byte reductions as proxy evidence until provider-measured matched tasks prove token/cost deltas.
 
+`plan semantic-checkpoint` is also plan-only/eval-only. Its CLI flags are optional so incomplete plans can produce reviewer JSON, but missing readiness fields block the JSON payload until exact context fallback is present. Ready plans require a goal, exact fallback receipt, a local re-expand command shaped as `context-guard-artifact get <id> --full` or `context-guard artifact get <id> --full`, provider-boundary acknowledgement, protected-zone policy `deny`, missed-context notes, and provenance review notes. `--missing-provenance-note` may be a review acknowledgement such as `none known after review`. The gate has no `emit`, `record`, or `serve` runtime, no `context-guard-semantic-checkpoint` binary, no file writes, transcript or prompt edits, model/provider/network calls, replacement context, or hosted token/cost savings claim.
+
 The local-proxy examples are intentionally split by side effect:
 
 - `plan local-proxy` produces advisory metadata only; it does not enable forwarding.
@@ -466,13 +469,14 @@ The local-proxy examples are intentionally split by side effect:
 
 By default, project settings are stored in `.context-guard/experiments.json`. Use `--config <path>` only for an explicit project-local override. Experiment metadata includes risk level, gate requirements, explicit command/flag surfaces, and claim boundaries so hosted API token/cost savings are not claimed without provider-measured matched-task evidence. `experiments enable` records intent only; it does not run helpers, remove the need for their explicit flags, or permit replacing content without exact receipt/re-expand evidence.
 
-Shipped experimental checker/planner surfaces, plus explicit local context-diff, visual evidence, learned-candidate, metrics, proxy-gate record runtimes, and the plan-only image-context-pack gate, are intentionally narrow:
+Shipped experimental checker/planner surfaces, plus explicit local context-diff, visual evidence, learned-candidate, metrics, proxy-gate record runtimes, and the plan-only image-context-pack and semantic-checkpoint gates, are intentionally narrow:
 
 | Planner/checker/runtime | What it emits | Hard boundary |
 | --- | --- | --- |
 | `context-diff-compaction` | Dry-run diff advice plus an explicit `emit ... --receipt-id ... --reexpand-command ...` runtime for caller-supplied compact replacements. | `plan` emits no replacement. `emit` requires reviewable hunks, exact local artifact re-expand metadata whose stored content matches the input diff, and a smaller caller-supplied replacement; ContextGuard does not generate semantic compression or support hosted token/cost savings claims. |
 | `visual-crop-ocr` | Dry-run visual evidence advice plus an explicit `emit visual-crop-ocr` runtime for caller-supplied evidence packs. | `emit` requires a full visual evidence receipt, missed-context note, and complete user-supplied crop and/or OCR evidence; ContextGuard does not capture screenshots, crop images, run OCR, parse images, call external services, write files, or support hosted token/cost savings claims. |
 | `image-context-pack` | Pxpipe-inspired dry-run plan metadata only for future image/context packing evaluation. | `plan` emits no image, replacement, evidence pack, binary artifact, ledger, listener, or proxy. It requires exact text fallback receipt/re-expand metadata before omitted text is used, protected-zone denial, missed-context notes, and an explicit provider boundary acknowledgement for provider/model measured matched-task evidence. `visual-crop-ocr` remains the caller-supplied visual evidence-pack surface; `image-context-pack` is not a duplicate emitter or verified exact binary/image fallback. |
+| `semantic-checkpoint` | Plan-only/eval-only checkpoint readiness metadata for preserving task state during review. | `plan` emits deterministic JSON metadata only. CLI flags are optional, but readiness is blocked in JSON until exact context fallback, local re-expand metadata, provider-boundary acknowledgement, protected-zone denial, missed-context note, and provenance review note are present. `--missing-provenance-note` may be a review acknowledgement such as `none known after review`. It writes no files, edits no transcript or prompt, calls no model/provider/network, emits no replacement context, has no `emit`/`record`/`serve` runtime or new binary, and makes no hosted token/cost savings claim. |
 | `learned-compression` | Deny-by-default policy checks plus an explicit `emit learned-compression` runtime for caller-supplied compact prose candidates with verified exact fallback content. | `emit` requires sanitized trusted prose, protected-signal denial, a verified local fallback artifact matching the input, and a smaller caller-supplied prose candidate; ContextGuard does not run compressors, embeddings, rerankers, model calls, subprocesses, external services, generated replacement text, or hosted savings claims. |
 | `self-hosted-metrics-ledger` | Dry-run preview plus an explicit `record ... --ledger-jsonl` runtime for local/model-server latency, memory, quality, energy, throughput, and local-cost metrics. | The dry-run preview does not write a ledger; the explicit record command writes only local JSONL sidecars and still does not support hosted API token/cost savings claims. |
 | `local-proxy` | Localhost-only advisory metadata, design-only `plan local-proxy-external-forwarding` review for future external forwarding, an explicit `record local-proxy-runtime-gate --ledger-jsonl` runtime for one local gate row, an explicit one-shot `serve local-proxy` loopback forwarding MVP, optional `--response-sandbox` compact artifact envelopes, and optional `--diagnostic-ledger-jsonl` shifted-cost diagnostics for successful forwarded requests. | `plan` writes no ledger. `record` writes only after localhost-only metadata and `--runtime-gate-ack`; it starts no listener, forwards no traffic, and performs no DNS lookup. `serve` additionally requires `--forwarding-gate-ack --once`, a private `--ready-file` nonce handoff, literal loopback bind/target IPs, nonzero ports, bounded bytes/timeouts, and credential-free requests; it performs no external forwarding, no CONNECT/TLS proxying, no API-key persistence, and no hosted-savings claim. `--response-sandbox` can store safe UTF-8 response text as a sanitized local artifact receipt and return a compact envelope with redacted rehydration command templates; it does not claim hosted token/cost savings. `--diagnostic-ledger-jsonl` writes only successful-forward diagnostics with no raw headers/bodies and no hosted-savings claim. `plan local-proxy-external-forwarding` emits threat-model/allowlist/redaction/provider-evidence design metadata only and still performs no DNS lookup, external service call, traffic forwarding, credential persistence, or hosted-savings claim. |
@@ -486,6 +490,7 @@ ContextGuard does not yet ship:
 - learned/synthetic compressor execution or generated replacement text beyond the caller-supplied learned candidate emitter
 - generated crop/OCR or visual-token pruning runtime beyond the caller-supplied visual evidence-pack emitter
 - generated image-context-pack renderers, binary/image artifact fallback, or pxpipe-style proxy/runtime beyond the plan-only evaluation gate
+- semantic-checkpoint emit/record/serve runtime, replacement context, file-writing checkpoint store, transcript/prompt editing, provider/model/network-backed checkpointing, or a new `context-guard-semantic-checkpoint` binary
 - self-hosted KV/latent optimization beyond explicit local metrics recording
 - external, daemon, or credential-bearing proxy forwarding beyond the one-shot literal-loopback local proxy MVP
 
diff --git a/context-guard-kit/README.md b/context-guard-kit/README.md
index d212195..5e3feb0 100644
--- a/context-guard-kit/README.md
+++ b/context-guard-kit/README.md
@@ -76,6 +76,12 @@ python3 context-guard-kit/sanitize_output.py -- git diff
 
 `experimental_registry.py plan image-context-pack`은 pxpipe-inspired image/context packing 평가를 위한 plan-only dry-run gate입니다. 명시적 평가 의도, exact text artifact fallback, protected-zone denial, provider-measured matched-task boundary, missed-context guardrail, 그리고 `visual-crop-ocr`이 기존 caller-supplied visual evidence-pack surface라는 확인이 필요합니다. 이 gate는 image rendering, OCR 실행, image parsing, model/provider call, proxy traffic, binary artifact 저장, replacement evidence 출력, hosted token/cost savings claim을 하지 않습니다.
 
+`experimental_registry.py plan semantic-checkpoint`는 review용 task-state checkpoint 계획을 위한 plan-only/eval-only gate입니다. CLI flag는 optional이지만 JSON payload readiness는 goal, exact fallback receipt, local re-expand command, provider-boundary ack, protected-zone policy `deny`, missed-context note, provenance review note가 없으면 blocked입니다. `--missing-provenance-note`는 `none known after review` 같은 검토 확인 문구일 수 있고, 허용되는 re-expand command는 `context-guard-artifact get <id> --full` 또는 `context-guard artifact get <id> --full` 형태의 로컬 artifact 재조회입니다. 이 gate는 emit/record/serve runtime, 새 `context-guard-semantic-checkpoint` binary, file write, transcript/prompt edit, model/provider/network call, replacement context, hosted token/cost savings claim을 하지 않습니다.
+
+```bash
+context-guard experiments plan semantic-checkpoint --json --goal "preserve current task state for review" --constraint "do not rewrite protected evidence" --decision "ship plan-only semantic-checkpoint gate first" --open-task "verify exact fallback before any checkpoint is used" --evidence-handle "roadmap=contextguard-artifact:0123456789abcdef" --missing-provenance-note "none known after review" --unresolved-question "which provenance handle fields become mandatory later" --exact-context-fallback-receipt 0123456789abcdef --reexpand-command "context-guard-artifact get 0123456789abcdef --full" --provider-boundary-ack --protected-zone-policy deny --missed-context-note "raw transcript remains retrievable before checkpoint metadata is used"
+```
+
 `experimental_registry.py plan learned-compression`은 정제된 trusted prose와 exact fallback handle을 위한 deny-by-default dry-run safety checker이고, `experimental_registry.py emit learned-compression`은 검증된 exact fallback 내용이 있을 때 caller-supplied compact prose를 내보내는 명시적 로컬 candidate emitter입니다. learned lane은 learned/synthetic compressor 실행, embedding, model call, reranker, subprocess, external service, generated replacement text를 실행하지 않으며 hosted savings도 주장하지 않습니다.
 
 `experimental_registry.py plan self-hosted-metrics-ledger`는 명시적 local/model-server latency, memory, quality, energy, throughput, local-cost sidecar evidence를 미리 보는 dry-run preview이며 ledger 파일을 쓰지 않습니다. `experimental_registry.py record self-hosted-metrics-ledger --ledger-jsonl ...`은 로컬 JSONL sidecar row 하나를 명시적으로 쓰지만, self-hosted telemetry를 hosted API token/cost savings claim으로 바꾸지 않습니다.
@@ -84,7 +90,7 @@ python3 context-guard-kit/sanitize_output.py -- git diff
 
 `benchmark_runner.py`는 `research/benchmark-plan.md`의 고정 task/variant 실험을 실행합니다. `variant_prompt_files`는 선택된 task/variant를 필터링한 뒤 필요한 file-backed prompt만 읽으므로 선택하지 않은 fixture의 누락 파일이 선택된 실행을 깨지 않습니다. `--ledger-jsonl`은 subagent·artifact 등 외부 실행 표면으로 옮겨간 token/cost와 run별 측정 가능 여부를 남기고, 선택적 `self_hosted_metrics` provider payload는 run별 sidecar로만 기록합니다. `--report-json`은 baseline 대비 실제 token/cost 절감과 proxy byte 감소를 분리한 A/B report를 생성하며, `--dashboard-md`는 같은 report에서 Markdown dashboard를 렌더링합니다. `--evidence-jsonl` replay는 provider와 `success_command`를 실행하지 않는 deterministic import mode이고, synthetic/manual evidence는 public hosted-savings claim 불가로 강제됩니다. `self_hosted_metrics`는 CSV/report 요약에 접지 않습니다. Report의 `matched_pair_evidence`는 성공한 baseline/variant task bucket을 transform, quality gate, 측정 가능 여부, claim boundary와 연결하므로 절감 주장을 쓰기 전에 이 항목을 확인하세요. Report의 `default_matrix`는 같은 evidence에서 trimming, artifact escrow, tool pruning, cache advice, adaptive-k, optional compression을 `default-on`/`advisory`/`experimental`/`reject/rework`로 분류하지만, report-only metadata이며 runtime default나 hosted savings claim을 바꾸지 않습니다. Report의 `public_claim_readiness`는 public hosted-savings claim의 최종 release gate로, matched successful task, provider-measured primary token/cost, quality non-inferiority, shifted-cost accounting, 명시적 confidence/failure note, complete provider-export provenance가 모두 통과하지 않으면 `claim_allowed=false`로 unsupported claim을 금지합니다.
 
-`../research/experimental-token-reduction-radar.md`는 learned compression, generated crop/OCR/visual-token pruning, self-hosted KV/latent inference optimization 같은 선택적 미래 실험을 문서화한 gate입니다. `../docs/experimental-benchmark-fixtures.md`에는 fixture-only task/variant 시작 예시가 있습니다. 이 radar와 fixture는 hosted API token/cost 절감을 보장하지 않습니다. 현재 제공되는 helper surface는 plan-only image-context-pack gate, 명시적 local context-diff emit, visual evidence-pack emit, learned candidate emit, self-hosted metrics record, local proxy gate record, one-shot literal-loopback local proxy serve with optional response artifact envelope, design-only external-forwarding plan 같은 좁은 local surface뿐이며, hosted API token/cost 절감 주장은 provider가 측정한 matched-task 근거가 있을 때만 허용합니다. Radar의 later-roadmap gate는 neural/semantic compression, trust-tiered injection-aware compression, generated visual-token reduction, broader external/daemon/hostname-DNS/credential-bearing local proxy forwarding constraints를 별도 미래 PR이 gate를 통과하기 전까지 experimental/non-shipped로 유지합니다.
+`../research/experimental-token-reduction-radar.md`는 learned compression, generated crop/OCR/visual-token pruning, self-hosted KV/latent inference optimization 같은 선택적 미래 실험을 문서화한 gate입니다. `../docs/experimental-benchmark-fixtures.md`에는 fixture-only task/variant 시작 예시가 있습니다. 이 radar와 fixture는 hosted API token/cost 절감을 보장하지 않습니다. 현재 제공되는 helper surface는 plan-only image-context-pack gate, plan-only/eval-only semantic-checkpoint gate, 명시적 local context-diff emit, visual evidence-pack emit, learned candidate emit, self-hosted metrics record, local proxy gate record, one-shot literal-loopback local proxy serve with optional response artifact envelope, design-only external-forwarding plan 같은 좁은 local surface뿐이며, hosted API token/cost 절감 주장은 provider가 측정한 matched-task 근거가 있을 때만 허용합니다. Radar의 later-roadmap gate는 neural/semantic compression, trust-tiered injection-aware compression, generated visual-token reduction, broader external/daemon/hostname-DNS/credential-bearing local proxy forwarding constraints를 별도 미래 PR이 gate를 통과하기 전까지 experimental/non-shipped로 유지합니다.
 
 `claude_transcript_cost_audit.py --recommend`의 기본 출력은 공유 시 안전하도록 transcript 경로를 `basename#hash`, 명령을 `command#hash` 형태로 익명화합니다. 로컬 원문 식별자가 꼭 필요할 때만 `--show-paths` 또는 `--show-commands`를 추가하세요.
 대용량/손상 transcript 방어를 위해 파일 단위 `--max-file-bytes`, JSONL record 단위 `--max-line-bytes` 제한도 기본 적용되며, 건너뛴 항목은 skip count와 warning으로 표시됩니다. JSON summary/feasibility 출력의 `cache_friendliness`는 제한된 정제 segment hash로 안정적인 prefix와 volatile prefix/tail 신호를 비교하는 휴리스틱입니다. `cache_layout_advice`는 그 신호를 긴 세션 분리, prefix 안정화, diet 점검 같은 순위화된 확인/실험으로 연결하지만, 관측 issue와 가설/입증 cause를 분리합니다. `--feasibility-json`은 macOS-visible prototype 같은 consumer가 안정적인 top-level field에만 바인딩하도록 `mac_visibility` 계약도 함께 제공합니다. 원문 prompt text는 출력하지 않고, provider cache token field와 historical token total은 ContextGuard가 만든 토큰 절감 또는 live headroom 증거가 아니라 별도 진단 텔레메트리로 해석하세요.
diff --git a/context-guard-kit/experimental_registry.py b/context-guard-kit/experimental_registry.py
index 7440464..5d5a712 100755
--- a/context-guard-kit/experimental_registry.py
+++ b/context-guard-kit/experimental_registry.py
@@ -69,6 +69,7 @@
 LOCAL_PROXY_EXTERNAL_DESIGN_SCHEMA_VERSION = "contextguard.experiments.local-proxy-external-forwarding-design.v1"
 LOCAL_PROXY_RESPONSE_SANDBOX_SCHEMA_VERSION = "contextguard.experiments.local-proxy-response-sandbox.v1"
 IMAGE_CONTEXT_PACK_PLAN_SCHEMA_VERSION = "contextguard.experiments.image-context-pack-plan.v1"
+SEMANTIC_CHECKPOINT_PLAN_SCHEMA_VERSION = "contextguard.experiments.semantic-checkpoint-plan.v1"
 IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY = "provider-measured-matched-tasks-required"
 LOCAL_PROXY_DEFAULT_BIND_HOST = "127.0.0.1"
 LOCAL_PROXY_DEFAULT_BIND_PORT = 0
@@ -308,6 +309,57 @@ def to_json(self, *, enabled: bool = False) -> dict[str, Any]:
             "exact binary/image fallback."
         ),
     ),
+
+    Experiment(
+        id="semantic-checkpoint",
+        name="Semantic checkpoint planning gate",
+        summary=(
+            "Plan-only evaluation gate for semantic checkpoint metadata and provenance readiness without "
+            "emitting replacement context or changing runtime behavior."
+        ),
+        stability="experimental",
+        default_enabled=False,
+        risk_level="high",
+        claim_boundary=(
+            "Semantic checkpoint metadata is dry-run planning evidence only; it cannot replace raw context or "
+            "claim hosted token/cost savings without future provider-measured matched successful tasks."
+        ),
+        gate_requirements=(
+            "explicit planning goal",
+            "verified exact context fallback before checkpoint metadata is used",
+            "provider/model measurement boundary",
+            "protected-zone denial",
+            "missed-context guardrails",
+            "provenance review acknowledgement",
+        ),
+        runtime_status="available-plan-only",
+        commands=("context-guard experiments plan semantic-checkpoint",),
+        opt_in_flags=(
+            "plan semantic-checkpoint",
+            "--goal",
+            "--constraint",
+            "--decision",
+            "--open-task",
+            "--evidence-handle",
+            "--missing-provenance-note",
+            "--unresolved-question",
+            "--exact-context-fallback-receipt",
+            "--reexpand-command",
+            "--provider-boundary-ack",
+            "--protected-zone-policy deny",
+            "--missed-context-note",
+        ),
+        config_effect=(
+            "Registry enablement records project-local intent only; semantic-checkpoint exposes only a deterministic "
+            "plan command. It does not add an emit/record/serve runtime, call models/providers, proxy traffic, write "
+            "files, edit prompts/transcripts, replace context, or emit checkpoint candidates."
+        ),
+        evidence_contract=(
+            "The planner requires a goal, exact context artifact fallback, protected-zone denial, provider/model "
+            "measured matched-task boundary, missed-context notes, and provenance review notes before checkpoint metadata "
+            "is ready for plan review; raw context remains authoritative."
+        ),
+    ),
     Experiment(
         id="learned-compression",
         name="Learned/synthetic compression candidate gate",
@@ -1945,6 +1997,147 @@ def command_plan_image_context_pack(args: argparse.Namespace) -> int:
     return 0
 
 
+def semantic_checkpoint_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
+    goal = args.goal.strip() if args.goal else None
+    receipt_id = args.exact_context_fallback_receipt.strip() if args.exact_context_fallback_receipt else None
+    reexpand_command = args.reexpand_command.strip() if args.reexpand_command else None
+    reexpand_valid, fallback_blocker = valid_learned_reexpand_command(receipt_id, reexpand_command)
+    fallback_blocker_map = {
+        "missing_exact_fallback": "missing_exact_context_fallback",
+        "invalid_reexpand_command": "invalid_exact_context_reexpand_command",
+    }
+    protected_policy = (args.protected_zone_policy or "deny").strip().lower()
+    missed_context_notes = clean_values(args.missed_context_note)
+    missing_provenance_notes = clean_values(args.missing_provenance_note)
+
+    blockers: list[str] = []
+    if not goal:
+        blockers.append("missing_goal")
+    if fallback_blocker:
+        blockers.append(fallback_blocker_map.get(fallback_blocker, fallback_blocker))
+    if not args.provider_boundary_ack:
+        blockers.append("missing_provider_measurement_boundary")
+    if protected_policy != "deny":
+        blockers.append("protected_zone_denial_required")
+    if not missed_context_notes:
+        blockers.append("missing_missed_context_note")
+    if not missing_provenance_notes:
+        blockers.append("missing_provenance_review")
+    blockers = list(dict.fromkeys(blockers))
+    ready = not blockers
+
+    return {
+        "tool": TOOL_NAME,
+        "schema_version": CONFIG_SCHEMA_VERSION,
+        "plan_schema_version": SEMANTIC_CHECKPOINT_PLAN_SCHEMA_VERSION,
+        "experiment_id": "semantic-checkpoint",
+        "mode": "dry_run",
+        "status": "ready_for_plan_review" if ready else "blocked_until_semantic_checkpoint_gate_ready",
+        "plan_only": {
+            "command_advertised": True,
+            "emit_command_available": False,
+            "record_command_available": False,
+            "serve_command_available": False,
+            "runtime_behavior_changed": False,
+            "replacement_context_emitted": False,
+        },
+        "external_services": {
+            "called": False,
+            "network": False,
+            "model_calls": False,
+            "provider_calls": False,
+            "proxy_forwarding": False,
+        },
+        "runtime_side_effects": {
+            "files_written": False,
+            "transcript_edited": False,
+            "prompt_edited": False,
+            "context_replaced": False,
+            "stable_runtime_behavior_changed": False,
+        },
+        "checkpoint_metadata": {
+            "goal": goal,
+            "constraints": clean_values(args.constraint),
+            "decisions": clean_values(args.decision),
+            "open_tasks": clean_values(args.open_task),
+            "evidence_provenance_handles": clean_values(args.evidence_handle),
+            "unresolved_questions": clean_values(args.unresolved_question),
+        },
+        "exact_context_fallback": {
+            "required": True,
+            "available": bool(reexpand_valid),
+            "receipt_id": receipt_id,
+            "reexpand_command": reexpand_command,
+            "verified": False,
+            "must_be_verified_before_checkpoint_metadata_is_used": True,
+            "allowed_reexpand_shapes": [
+                "context-guard-artifact get RECEIPT --full",
+                "context-guard artifact get RECEIPT --full",
+            ],
+        },
+        "protected_zones": {
+            "policy": protected_policy,
+            "override_allowed": False,
+            "denied_classes": [
+                "code",
+                "diffs",
+                "identifiers",
+                "hashes",
+                "paths",
+                "numeric_constants",
+                "json_keys",
+                "stack_frames",
+                "secrets",
+                "prompt_like_instructions",
+            ],
+        },
+        "measurement_boundary": {
+            "provider_boundary_acknowledged": bool(args.provider_boundary_ack),
+            "provider_boundary_policy": IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY,
+            "provider_measured_matched_tasks_required_for_hosted_claims": True,
+            "provider_model_specific": True,
+            "hosted_api_token_savings_claim_allowed": False,
+            "hosted_api_cost_savings_claim_allowed": False,
+        },
+        "provenance_review": {
+            "required": True,
+            "reviewed": bool(missing_provenance_notes),
+            "missing_provenance_notes": missing_provenance_notes,
+            "missing_provenance_warnings": [] if missing_provenance_notes else ["missing_provenance_review"],
+            "checkpoint_cannot_replace_raw_context_without_complete_provenance": True,
+        },
+        "review_plan": {
+            "readiness_blockers": blockers,
+            "missed_context_notes": missed_context_notes,
+            "next_steps": [
+                "Keep exact raw context fallback verified before checkpoint metadata is used.",
+                "Deny protected evidence zones before any semantic checkpoint summary is considered.",
+                "Keep provenance handles and missing-provenance review notes attached to checkpoint metadata.",
+                "Measure provider/model token and cost fields on matched successful tasks before any hosted savings claim.",
+            ],
+        },
+        "claim_boundary": (
+            "Dry-run semantic-checkpoint planning only; checkpoint metadata is not replacement context and no hosted "
+            "token/cost savings claim is allowed without provider-measured matched successful tasks."
+        ),
+        "candidate_replacement": None,
+    }
+
+
+def command_plan_semantic_checkpoint(args: argparse.Namespace) -> int:
+    payload = semantic_checkpoint_plan_payload(args)
+    if args.json:
+        emit_json(payload)
+    else:
+        print("ContextGuard semantic-checkpoint plan (dry-run only)")
+        print("No files, prompts, transcripts, model/provider calls, proxy forwarding, or replacement context were emitted.")
+        print(f"Status: {payload['status']}")
+        if payload["review_plan"]["readiness_blockers"]:
+            print(f"Readiness blockers: {', '.join(payload['review_plan']['readiness_blockers'])}")
+        print(payload["claim_boundary"])
+    return 0
+
+
 def visual_crop_ocr_evidence_pack_payload(args: argparse.Namespace) -> dict[str, Any]:
     payload = visual_crop_ocr_plan_payload(args)
     blockers = list(payload["review_plan"]["readiness_blockers"])
@@ -4701,6 +4894,34 @@ def build_parser() -> argparse.ArgumentParser:
     image_context_pack.add_argument("--json", action="store_true", help="Emit JSON output.")
     image_context_pack.set_defaults(func=command_plan_image_context_pack)
 
+    semantic_checkpoint = plan_sub.add_parser(
+        "semantic-checkpoint",
+        help="Dry-run a plan-only semantic checkpoint metadata gate without replacing raw context.",
+    )
+    semantic_checkpoint.add_argument("--goal", help="Planning goal for the semantic checkpoint metadata.")
+    semantic_checkpoint.add_argument("--constraint", action="append", help="Constraint the checkpoint metadata must preserve. Repeatable.")
+    semantic_checkpoint.add_argument("--decision", action="append", help="Decision captured by the checkpoint metadata. Repeatable.")
+    semantic_checkpoint.add_argument("--open-task", action="append", help="Open task captured by the checkpoint metadata. Repeatable.")
+    semantic_checkpoint.add_argument("--evidence-handle", action="append", help="Evidence/provenance handle supporting the checkpoint. Repeatable.")
+    semantic_checkpoint.add_argument("--missing-provenance-note", action="append", help="Missing provenance review note or 'none known after review'. Repeatable.")
+    semantic_checkpoint.add_argument("--unresolved-question", action="append", help="Unresolved question for checkpoint review. Repeatable.")
+    semantic_checkpoint.add_argument("--exact-context-fallback-receipt", help="Local exact raw context artifact receipt id.")
+    semantic_checkpoint.add_argument("--reexpand-command", help="Local exact context re-expand command bound to the receipt id.")
+    semantic_checkpoint.add_argument(
+        "--provider-boundary-ack",
+        action="store_true",
+        help="Acknowledge hosted claims require provider-measured matched successful tasks for the target model.",
+    )
+    semantic_checkpoint.add_argument(
+        "--protected-zone-policy",
+        default="deny",
+        choices=("deny", "allow"),
+        help="Protected evidence handling; only deny can pass the plan gate.",
+    )
+    semantic_checkpoint.add_argument("--missed-context-note", action="append", help="Potential context missed by checkpoint metadata. Repeatable.")
+    semantic_checkpoint.add_argument("--json", action="store_true", help="Emit JSON output.")
+    semantic_checkpoint.set_defaults(func=command_plan_semantic_checkpoint)
+
     self_hosted = plan_sub.add_parser(
         "self-hosted-metrics-ledger",
         help="Dry-run self-hosted/local metrics ledger sidecar evidence without writing a ledger.",
diff --git a/plugins/context-guard/README.ko.md b/plugins/context-guard/README.ko.md
index e3ff350..9e6ff07 100644
--- a/plugins/context-guard/README.ko.md
+++ b/plugins/context-guard/README.ko.md
@@ -119,7 +119,11 @@ brief 모드는 코딩 에이전트가 군더더기를 줄이도록 요청하되
 
 ContextGuard는 모델 토큰을 줄이기 위해 작업을 외부 AI 서비스로 전송하지 않습니다. 모든 헬퍼 명령은 로컬에서 동작합니다. 로컬 RAM/디스크 보관본은 다음에 보낼 컨텍스트를 줄이는 데 도움될 수 있지만 provider prompt cache를 대체하지 않습니다. Anthropic 배포나 청구 설명 전에는 공식 prompt caching/pricing 문서를 다시 확인하세요: https://docs.anthropic.com/en/build-with-claude/prompt-caching 및 https://platform.claude.com/docs/en/about-claude/pricing.
 
-미래 learned, self-hosted 최적화 아이디어는 [`research/experimental-token-reduction-radar.md`](https://github.com/ictechgy/context-guard/blob/main/research/experimental-token-reduction-radar.md)에 gated experiment로 기록하며, fixture-only 시작 예시는 [`docs/experimental-benchmark-fixtures.md`](https://github.com/ictechgy/context-guard/blob/main/docs/experimental-benchmark-fixtures.md)에 둡니다. learned compression은 `context-guard experiments plan learned-compression` dry-run checker와 명시적 `context-guard experiments emit learned-compression` caller-supplied candidate emitter만 shipped 상태이고, self-hosted-metrics-ledger는 dry-run preview와 명시적 `context-guard experiments record self-hosted-metrics-ledger` local JSONL record를 제공하며, dry-run preview는 ledger 파일을 쓰지 않습니다. visual crop/OCR은 caller-supplied evidence-pack emit, image-context-pack은 pxpipe-inspired image/context packing 평가를 위한 plan-only dry-run gate, context-diff는 verified-receipt caller-supplied replacement emit만 제공합니다. image-context-pack은 exact text artifact fallback, protected-zone denial, provider-boundary acknowledgement for provider-measured matched tasks, missed-context guardrail, 그리고 visual-crop-ocr이 기존 caller-supplied visual evidence-pack surface라는 plan output 확인이 필요하며, image rendering, OCR 실행, image parsing, model/provider call, proxy traffic, binary artifact 저장, replacement evidence 출력, hosted token/cost savings claim을 하지 않습니다. local proxy는 `context-guard experiments plan local-proxy` localhost-only dry-run advisory plan, design-only `context-guard experiments plan local-proxy-external-forwarding` gate, 명시적 `context-guard experiments record local-proxy-runtime-gate --ledger-jsonl ...` gate row record, private ready-file nonce가 필요한 one-shot `context-guard experiments serve local-proxy` loopback forwarding MVP와 successful forwarded request용 optional shifted-cost diagnostic JSONL row만 shipped 상태입니다. record는 no listener/no traffic forwarding/no DNS lookup/no external service/no API-key persistence boundary를 유지하고, serve는 private ready-file nonce, literal loopback IP, `--once`, credential-free request만 허용하고 CONNECT/TLS proxying도 지원하지 않습니다. `--response-sandbox`는 safe UTF-8 response text만 local artifact receipt로 저장하고 raw body 대신 redacted rehydration command template가 담긴 compact envelope를 돌려주며 hosted token/cost savings claim은 아닙니다. `--diagnostic-ledger-jsonl`은 successful forwarded request 뒤에만 진단 row를 쓰며 raw header/body나 hosted-savings evidence를 저장하지 않습니다. `plan local-proxy-external-forwarding`은 threat model, HTTPS allowlist, credential redaction, provider-evidence boundary를 점검하는 dry-run design gate이고 listener, DNS lookup, external service call, traffic forwarding, credential persistence, external proxy forwarding runtime, hosted savings claim을 제공하지 않습니다. learned/synthetic compressor 실행·embedding·reranker·model call·생성형 replacement, generated OCR/crop, visual-token pruning, plan-only image-context-pack dry-run gate를 넘어선 image-context-pack rendering/runtime, self-hosted KV/latent runtime 최적화, one-shot literal-loopback local proxy MVP를 넘어선 external/daemon/credential-bearing proxy forwarding runtime은 shipped가 아닙니다. 이 radar와 fixture는 provider가 측정한 matched-task 근거 없이 hosted API 절감을 주장하지 않습니다. Radar의 later-roadmap gate는 neural/semantic compression, trust-tiered injection-aware compression, generated visual-token reduction, broader local proxy forwarding constraint도 별도 미래 PR이 gate를 통과하기 전까지 experimental/non-shipped로 묶습니다.
+미래 learned, self-hosted 최적화 아이디어는 [`research/experimental-token-reduction-radar.md`](https://github.com/ictechgy/context-guard/blob/main/research/experimental-token-reduction-radar.md)에 gated experiment로 기록하며, fixture-only 시작 예시는 [`docs/experimental-benchmark-fixtures.md`](https://github.com/ictechgy/context-guard/blob/main/docs/experimental-benchmark-fixtures.md)에 둡니다. learned compression은 `context-guard experiments plan learned-compression` dry-run checker와 명시적 `context-guard experiments emit learned-compression` caller-supplied candidate emitter만 shipped 상태이고, self-hosted-metrics-ledger는 dry-run preview와 명시적 `context-guard experiments record self-hosted-metrics-ledger` local JSONL record를 제공하며, dry-run preview는 ledger 파일을 쓰지 않습니다. visual crop/OCR은 caller-supplied evidence-pack emit, image-context-pack은 pxpipe-inspired image/context packing 평가를 위한 plan-only dry-run gate, semantic-checkpoint는 review용 task-state checkpoint 계획을 위한 plan-only/eval-only gate, context-diff는 verified-receipt caller-supplied replacement emit만 제공합니다. image-context-pack은 exact text artifact fallback, protected-zone denial, provider-boundary acknowledgement for provider-measured matched tasks, missed-context guardrail, 그리고 visual-crop-ocr이 기존 caller-supplied visual evidence-pack surface라는 plan output 확인이 필요하며, image rendering, OCR 실행, image parsing, model/provider call, proxy traffic, binary artifact 저장, replacement evidence 출력, hosted token/cost savings claim을 하지 않습니다. semantic-checkpoint는 CLI flag가 optional이지만 JSON readiness에서 exact context fallback/re-expand, provider-boundary ack, protected-zone policy `deny`, missed-context note, provenance review note가 없으면 blocked이며, `--missing-provenance-note`는 `none known after review` 같은 검토 확인 문구일 수 있습니다. 허용되는 re-expand command는 `context-guard-artifact get <id> --full` 또는 `context-guard artifact get <id> --full` 형태이고, emit/record/serve runtime, 새 `context-guard-semantic-checkpoint` binary, file write, transcript/prompt edit, model/provider/network call, replacement context, hosted token/cost savings claim은 없습니다. local proxy는 `context-guard experiments plan local-proxy` localhost-only dry-run advisory plan, design-only `context-guard experiments plan local-proxy-external-forwarding` gate, 명시적 `context-guard experiments record local-proxy-runtime-gate --ledger-jsonl ...` gate row record, private ready-file nonce가 필요한 one-shot `context-guard experiments serve local-proxy` loopback forwarding MVP와 successful forwarded request용 optional shifted-cost diagnostic JSONL row만 shipped 상태입니다. record는 no listener/no traffic forwarding/no DNS lookup/no external service/no API-key persistence boundary를 유지하고, serve는 private ready-file nonce, literal loopback IP, `--once`, credential-free request만 허용하고 CONNECT/TLS proxying도 지원하지 않습니다. `--response-sandbox`는 safe UTF-8 response text만 local artifact receipt로 저장하고 raw body 대신 redacted rehydration command template가 담긴 compact envelope를 돌려주며 hosted token/cost savings claim은 아닙니다. `--diagnostic-ledger-jsonl`은 successful forwarded request 뒤에만 진단 row를 쓰며 raw header/body나 hosted-savings evidence를 저장하지 않습니다. `plan local-proxy-external-forwarding`은 threat model, HTTPS allowlist, credential redaction, provider-evidence boundary를 점검하는 dry-run design gate이고 listener, DNS lookup, external service call, traffic forwarding, credential persistence, external proxy forwarding runtime, hosted savings claim을 제공하지 않습니다. learned/synthetic compressor 실행·embedding·reranker·model call·생성형 replacement, generated OCR/crop, visual-token pruning, plan-only image-context-pack dry-run gate를 넘어선 image-context-pack rendering/runtime, plan-only semantic-checkpoint gate를 넘어선 emit/record/serve runtime이나 replacement context/file-writing checkpoint store/transcript-prompt edit/provider-backed checkpointing, self-hosted KV/latent runtime 최적화, one-shot literal-loopback local proxy MVP를 넘어선 external/daemon/credential-bearing proxy forwarding runtime은 shipped가 아닙니다. 이 radar와 fixture는 provider가 측정한 matched-task 근거 없이 hosted API 절감을 주장하지 않습니다. Radar의 later-roadmap gate는 neural/semantic compression, trust-tiered injection-aware compression, generated visual-token reduction, broader local proxy forwarding constraint도 별도 미래 PR이 gate를 통과하기 전까지 experimental/non-shipped로 묶습니다.
+
+```bash
+context-guard experiments plan semantic-checkpoint --json --goal "preserve current task state for review" --constraint "do not rewrite protected evidence" --decision "ship plan-only semantic-checkpoint gate first" --open-task "verify exact fallback before any checkpoint is used" --evidence-handle "roadmap=contextguard-artifact:0123456789abcdef" --missing-provenance-note "none known after review" --unresolved-question "which provenance handle fields become mandatory later" --exact-context-fallback-receipt 0123456789abcdef --reexpand-command "context-guard-artifact get 0123456789abcdef --full" --provider-boundary-ack --protected-zone-policy deny --missed-context-note "raw transcript remains retrievable before checkpoint metadata is used"
+```
 
 교차 에이전트 규칙 스니펫은 안내용입니다. 대상 에이전트가 반드시 따른다고 보장할 수 없으므로, 절감 주장이 필요하면 실제 전후 동작을 직접 측정하세요.
 
diff --git a/plugins/context-guard/README.md b/plugins/context-guard/README.md
index 68a9d1f..922245f 100644
--- a/plugins/context-guard/README.md
+++ b/plugins/context-guard/README.md
@@ -142,6 +142,7 @@ context-guard experiments emit context-diff-compaction --receipt-id <artifact-id
 context-guard experiments plan visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --missed-context-note "outside crop omitted"
 context-guard experiments emit visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --ocr-text "visible text" --ocr-confidence 0.9 --ocr-error-note "glyph may be uncertain" --missed-context-note "outside crop omitted"
 context-guard experiments plan image-context-pack --json --exact-text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --provider-boundary-ack --protected-zone-policy deny --missed-context-note "omitted text remains retrievable before any future image pack is used" --image-size 800,600 --packed-image-size 400,300
+context-guard experiments plan semantic-checkpoint --json --goal "preserve current task state for review" --constraint "do not rewrite protected evidence" --decision "ship plan-only semantic-checkpoint gate first" --open-task "verify exact fallback before any checkpoint is used" --evidence-handle "roadmap=contextguard-artifact:0123456789abcdef" --missing-provenance-note "none known after review" --unresolved-question "which provenance handle fields become mandatory later" --exact-context-fallback-receipt 0123456789abcdef --reexpand-command "context-guard-artifact get 0123456789abcdef --full" --provider-boundary-ack --protected-zone-policy deny --missed-context-note "raw transcript remains retrievable before checkpoint metadata is used"
 context-guard experiments plan learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" < sanitized-prose.txt
 context-guard experiments emit learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --replacement-file compact-prose.txt < sanitized-prose.txt
 context-guard experiments plan self-hosted-metrics-ledger --json --latency-ms 123.5 --peak-memory-mb 2048 --quality-score 0.98
@@ -156,7 +157,9 @@ context-guard experiments disable output-receipt-trim --root .
 
 `image-context-pack` is a plan-only/dry-run gate for pxpipe-inspired image/context packing evaluation. It requires exact text artifact fallback, protected-zone denial, provider-boundary acknowledgement for provider-measured matched tasks, missed-context guardrails, and acknowledgement in the plan output that `visual-crop-ocr` is the existing caller-supplied visual evidence-pack surface. It does not render images, run OCR, call models/providers, proxy traffic, store binary artifacts, emit replacement evidence, or support hosted token/cost savings.
 
-Use `--config <path>` only for an explicit project-local override. Registry entries include risk, gate requirements, explicit command/flag surfaces, and claim boundaries; hosted API token/cost savings still require provider-measured matched-task evidence. The registry can discover existing explicit-flag experiments such as `context-guard-trim-output --digest ... --artifact-receipt` and `context-guard-compress --protected-policy`, run dry-run advisory planners such as `context-guard experiments plan context-diff-compaction`, `context-guard experiments plan visual-crop-ocr`, `context-guard experiments plan learned-compression`, `context-guard experiments plan self-hosted-metrics-ledger`, `context-guard experiments plan local-proxy`, and design-only `context-guard experiments plan local-proxy-external-forwarding`, and run explicit local runtimes such as `context-guard experiments emit context-diff-compaction ...`, `context-guard experiments emit visual-crop-ocr ...`, `context-guard experiments emit learned-compression ...`, `context-guard experiments record self-hosted-metrics-ledger ...`, `context-guard experiments record local-proxy-runtime-gate ...`, `context-guard experiments serve local-proxy ...`, and successful-forward `context-guard experiments serve local-proxy --diagnostic-ledger-jsonl ...` diagnostics. The context-diff emit runtime only emits caller-supplied compact replacements when reviewable hunks, exact local artifact re-expand metadata whose stored content matches the input diff, and a smaller replacement are present; it does not generate semantic compression or permit hosted savings claims. The visual lane ships a dry-run planner plus an explicit local evidence-pack emitter: both use only caller-supplied full-evidence receipts, crop metadata, OCR text, confidence/error notes, and missed-context notes; screenshot capture, image cropping, OCR execution, image parsing, external OCR/image services, output-file writes, and hosted savings claims are not shipped. The learned-compression lane ships a deny-by-default dry-run policy check plus an explicit local candidate emitter for caller-supplied compact prose with verified exact fallback content: learned/synthetic compressor execution, embeddings, rerankers, model calls, subprocesses, external services, generated replacement text, and hosted savings claims are not shipped. The self-hosted metrics planner emits a dry-run ledger-compatible preview for explicit local/model-server latency, memory, quality, energy, throughput, and local-cost metrics; the dry-run preview does not write a ledger, while `context-guard experiments record self-hosted-metrics-ledger --ledger-jsonl ...` writes only local JSONL sidecars and still does not permit hosted API token/cost savings claims. The local-proxy planner emits localhost-only advisory metadata only, while `context-guard experiments record local-proxy-runtime-gate --ledger-jsonl ...` appends one local gate row only after localhost-only metadata and `--runtime-gate-ack`: it starts no listener, forwards no traffic, and performs no DNS lookup. `context-guard experiments serve local-proxy ...` is the separate forwarding MVP: it requires `--forwarding-gate-ack --once`, a private `--ready-file` nonce handoff, literal loopback bind/target IPs, no hostname DNS targets, nonzero ports, byte/time limits, and credential-free requests; it performs no external forwarding, no CONNECT/TLS proxying, no API-key persistence, and no hosted-savings claim. `--response-sandbox` can store safe UTF-8 response text as a sanitized local artifact receipt and return a compact envelope with redacted rehydration command templates; it does not claim hosted token/cost savings. `--diagnostic-ledger-jsonl` writes one shifted-cost diagnostic row only after a successful forwarded request, with no raw headers/bodies and no hosted-savings evidence. `plan local-proxy-external-forwarding` emits threat-model/allowlist/redaction/provider-evidence design metadata only and still starts no listener, performs no DNS lookup, calls no external service, forwards no traffic, persists no credentials, and does not ship an external proxy forwarding runtime. `experiments enable` records intent only; it does not run those helpers, remove the need for their explicit flags, or permit replacing content without exact receipt/re-expand evidence.
+`semantic-checkpoint` is a plan-only/eval-only gate for reviewable task-state checkpoint planning. Its flags are optional at the CLI so incomplete dry runs can return JSON, but readiness remains blocked in the JSON payload until the plan includes a goal, exact fallback receipt, local re-expand command, provider-boundary acknowledgement, protected-zone policy `deny`, missed-context note, and provenance review note. `--missing-provenance-note` can be a review acknowledgement such as `none known after review`; allowed local re-expand shapes are `context-guard-artifact get <id> --full` and `context-guard artifact get <id> --full`. It has no `emit`, `record`, or `serve` runtime, no new `context-guard-semantic-checkpoint` binary, writes no files, edits no transcript or prompt, calls no model/provider/network, emits no replacement context, and makes no hosted token/cost savings claim.
+
+Use `--config <path>` only for an explicit project-local override. Registry entries include risk, gate requirements, explicit command/flag surfaces, and claim boundaries; hosted API token/cost savings still require provider-measured matched-task evidence. The registry can discover existing explicit-flag experiments such as `context-guard-trim-output --digest ... --artifact-receipt` and `context-guard-compress --protected-policy`, run dry-run advisory planners such as `context-guard experiments plan context-diff-compaction`, `context-guard experiments plan visual-crop-ocr`, `context-guard experiments plan learned-compression`, `context-guard experiments plan semantic-checkpoint`, `context-guard experiments plan self-hosted-metrics-ledger`, `context-guard experiments plan local-proxy`, and design-only `context-guard experiments plan local-proxy-external-forwarding`, and run explicit local runtimes such as `context-guard experiments emit context-diff-compaction ...`, `context-guard experiments emit visual-crop-ocr ...`, `context-guard experiments emit learned-compression ...`, `context-guard experiments record self-hosted-metrics-ledger ...`, `context-guard experiments record local-proxy-runtime-gate ...`, `context-guard experiments serve local-proxy ...`, and successful-forward `context-guard experiments serve local-proxy --diagnostic-ledger-jsonl ...` diagnostics. The context-diff emit runtime only emits caller-supplied compact replacements when reviewable hunks, exact local artifact re-expand metadata whose stored content matches the input diff, and a smaller replacement are present; it does not generate semantic compression or permit hosted savings claims. The visual lane ships a dry-run planner plus an explicit local evidence-pack emitter: both use only caller-supplied full-evidence receipts, crop metadata, OCR text, confidence/error notes, and missed-context notes; screenshot capture, image cropping, OCR execution, image parsing, external OCR/image services, output-file writes, and hosted savings claims are not shipped. The learned-compression lane ships a deny-by-default dry-run policy check plus an explicit local candidate emitter for caller-supplied compact prose with verified exact fallback content: learned/synthetic compressor execution, embeddings, rerankers, model calls, subprocesses, external services, generated replacement text, and hosted savings claims are not shipped. The semantic-checkpoint lane ships only the plan/eval gate above: no runtime emit/record/serve surface, file-writing checkpoint store, transcript/prompt edit, provider/model/network-backed checkpointing, replacement context, new binary, or hosted savings claim is shipped. The self-hosted metrics planner emits a dry-run ledger-compatible preview for explicit local/model-server latency, memory, quality, energy, throughput, and local-cost metrics; the dry-run preview does not write a ledger, while `context-guard experiments record self-hosted-metrics-ledger --ledger-jsonl ...` writes only local JSONL sidecars and still does not permit hosted API token/cost savings claims. The local-proxy planner emits localhost-only advisory metadata only, while `context-guard experiments record local-proxy-runtime-gate --ledger-jsonl ...` appends one local gate row only after localhost-only metadata and `--runtime-gate-ack`: it starts no listener, forwards no traffic, and performs no DNS lookup. `context-guard experiments serve local-proxy ...` is the separate forwarding MVP: it requires `--forwarding-gate-ack --once`, a private `--ready-file` nonce handoff, literal loopback bind/target IPs, no hostname DNS targets, nonzero ports, byte/time limits, and credential-free requests; it performs no external forwarding, no CONNECT/TLS proxying, no API-key persistence, and no hosted-savings claim. `--response-sandbox` can store safe UTF-8 response text as a sanitized local artifact receipt and return a compact envelope with redacted rehydration command templates; it does not claim hosted token/cost savings. `--diagnostic-ledger-jsonl` writes one shifted-cost diagnostic row only after a successful forwarded request, with no raw headers/bodies and no hosted-savings evidence. `plan local-proxy-external-forwarding` emits threat-model/allowlist/redaction/provider-evidence design metadata only and still starts no listener, performs no DNS lookup, calls no external service, forwards no traffic, persists no credentials, and does not ship an external proxy forwarding runtime. `experiments enable` records intent only; it does not run those helpers, remove the need for their explicit flags, or permit replacing content without exact receipt/re-expand evidence.
 
 Cross-agent rule snippets are advisory: the target agent may ignore them, so measure actual before/after behavior when you need a savings claim.
 
diff --git a/plugins/context-guard/bin/context-guard-experiments b/plugins/context-guard/bin/context-guard-experiments
index 7440464..5d5a712 100755
--- a/plugins/context-guard/bin/context-guard-experiments
+++ b/plugins/context-guard/bin/context-guard-experiments
@@ -69,6 +69,7 @@ LOCAL_PROXY_READY_SCHEMA_VERSION = "contextguard.experiments.local-proxy-ready.v
 LOCAL_PROXY_EXTERNAL_DESIGN_SCHEMA_VERSION = "contextguard.experiments.local-proxy-external-forwarding-design.v1"
 LOCAL_PROXY_RESPONSE_SANDBOX_SCHEMA_VERSION = "contextguard.experiments.local-proxy-response-sandbox.v1"
 IMAGE_CONTEXT_PACK_PLAN_SCHEMA_VERSION = "contextguard.experiments.image-context-pack-plan.v1"
+SEMANTIC_CHECKPOINT_PLAN_SCHEMA_VERSION = "contextguard.experiments.semantic-checkpoint-plan.v1"
 IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY = "provider-measured-matched-tasks-required"
 LOCAL_PROXY_DEFAULT_BIND_HOST = "127.0.0.1"
 LOCAL_PROXY_DEFAULT_BIND_PORT = 0
@@ -308,6 +309,57 @@ EXPERIMENTS: tuple[Experiment, ...] = (
             "exact binary/image fallback."
         ),
     ),
+
+    Experiment(
+        id="semantic-checkpoint",
+        name="Semantic checkpoint planning gate",
+        summary=(
+            "Plan-only evaluation gate for semantic checkpoint metadata and provenance readiness without "
+            "emitting replacement context or changing runtime behavior."
+        ),
+        stability="experimental",
+        default_enabled=False,
+        risk_level="high",
+        claim_boundary=(
+            "Semantic checkpoint metadata is dry-run planning evidence only; it cannot replace raw context or "
+            "claim hosted token/cost savings without future provider-measured matched successful tasks."
+        ),
+        gate_requirements=(
+            "explicit planning goal",
+            "verified exact context fallback before checkpoint metadata is used",
+            "provider/model measurement boundary",
+            "protected-zone denial",
+            "missed-context guardrails",
+            "provenance review acknowledgement",
+        ),
+        runtime_status="available-plan-only",
+        commands=("context-guard experiments plan semantic-checkpoint",),
+        opt_in_flags=(
+            "plan semantic-checkpoint",
+            "--goal",
+            "--constraint",
+            "--decision",
+            "--open-task",
+            "--evidence-handle",
+            "--missing-provenance-note",
+            "--unresolved-question",
+            "--exact-context-fallback-receipt",
+            "--reexpand-command",
+            "--provider-boundary-ack",
+            "--protected-zone-policy deny",
+            "--missed-context-note",
+        ),
+        config_effect=(
+            "Registry enablement records project-local intent only; semantic-checkpoint exposes only a deterministic "
+            "plan command. It does not add an emit/record/serve runtime, call models/providers, proxy traffic, write "
+            "files, edit prompts/transcripts, replace context, or emit checkpoint candidates."
+        ),
+        evidence_contract=(
+            "The planner requires a goal, exact context artifact fallback, protected-zone denial, provider/model "
+            "measured matched-task boundary, missed-context notes, and provenance review notes before checkpoint metadata "
+            "is ready for plan review; raw context remains authoritative."
+        ),
+    ),
     Experiment(
         id="learned-compression",
         name="Learned/synthetic compression candidate gate",
@@ -1945,6 +1997,147 @@ def command_plan_image_context_pack(args: argparse.Namespace) -> int:
     return 0
 
 
+def semantic_checkpoint_plan_payload(args: argparse.Namespace) -> dict[str, Any]:
+    goal = args.goal.strip() if args.goal else None
+    receipt_id = args.exact_context_fallback_receipt.strip() if args.exact_context_fallback_receipt else None
+    reexpand_command = args.reexpand_command.strip() if args.reexpand_command else None
+    reexpand_valid, fallback_blocker = valid_learned_reexpand_command(receipt_id, reexpand_command)
+    fallback_blocker_map = {
+        "missing_exact_fallback": "missing_exact_context_fallback",
+        "invalid_reexpand_command": "invalid_exact_context_reexpand_command",
+    }
+    protected_policy = (args.protected_zone_policy or "deny").strip().lower()
+    missed_context_notes = clean_values(args.missed_context_note)
+    missing_provenance_notes = clean_values(args.missing_provenance_note)
+
+    blockers: list[str] = []
+    if not goal:
+        blockers.append("missing_goal")
+    if fallback_blocker:
+        blockers.append(fallback_blocker_map.get(fallback_blocker, fallback_blocker))
+    if not args.provider_boundary_ack:
+        blockers.append("missing_provider_measurement_boundary")
+    if protected_policy != "deny":
+        blockers.append("protected_zone_denial_required")
+    if not missed_context_notes:
+        blockers.append("missing_missed_context_note")
+    if not missing_provenance_notes:
+        blockers.append("missing_provenance_review")
+    blockers = list(dict.fromkeys(blockers))
+    ready = not blockers
+
+    return {
+        "tool": TOOL_NAME,
+        "schema_version": CONFIG_SCHEMA_VERSION,
+        "plan_schema_version": SEMANTIC_CHECKPOINT_PLAN_SCHEMA_VERSION,
+        "experiment_id": "semantic-checkpoint",
+        "mode": "dry_run",
+        "status": "ready_for_plan_review" if ready else "blocked_until_semantic_checkpoint_gate_ready",
+        "plan_only": {
+            "command_advertised": True,
+            "emit_command_available": False,
+            "record_command_available": False,
+            "serve_command_available": False,
+            "runtime_behavior_changed": False,
+            "replacement_context_emitted": False,
+        },
+        "external_services": {
+            "called": False,
+            "network": False,
+            "model_calls": False,
+            "provider_calls": False,
+            "proxy_forwarding": False,
+        },
+        "runtime_side_effects": {
+            "files_written": False,
+            "transcript_edited": False,
+            "prompt_edited": False,
+            "context_replaced": False,
+            "stable_runtime_behavior_changed": False,
+        },
+        "checkpoint_metadata": {
+            "goal": goal,
+            "constraints": clean_values(args.constraint),
+            "decisions": clean_values(args.decision),
+            "open_tasks": clean_values(args.open_task),
+            "evidence_provenance_handles": clean_values(args.evidence_handle),
+            "unresolved_questions": clean_values(args.unresolved_question),
+        },
+        "exact_context_fallback": {
+            "required": True,
+            "available": bool(reexpand_valid),
+            "receipt_id": receipt_id,
+            "reexpand_command": reexpand_command,
+            "verified": False,
+            "must_be_verified_before_checkpoint_metadata_is_used": True,
+            "allowed_reexpand_shapes": [
+                "context-guard-artifact get RECEIPT --full",
+                "context-guard artifact get RECEIPT --full",
+            ],
+        },
+        "protected_zones": {
+            "policy": protected_policy,
+            "override_allowed": False,
+            "denied_classes": [
+                "code",
+                "diffs",
+                "identifiers",
+                "hashes",
+                "paths",
+                "numeric_constants",
+                "json_keys",
+                "stack_frames",
+                "secrets",
+                "prompt_like_instructions",
+            ],
+        },
+        "measurement_boundary": {
+            "provider_boundary_acknowledged": bool(args.provider_boundary_ack),
+            "provider_boundary_policy": IMAGE_CONTEXT_PACK_PROVIDER_BOUNDARY,
+            "provider_measured_matched_tasks_required_for_hosted_claims": True,
+            "provider_model_specific": True,
+            "hosted_api_token_savings_claim_allowed": False,
+            "hosted_api_cost_savings_claim_allowed": False,
+        },
+        "provenance_review": {
+            "required": True,
+            "reviewed": bool(missing_provenance_notes),
+            "missing_provenance_notes": missing_provenance_notes,
+            "missing_provenance_warnings": [] if missing_provenance_notes else ["missing_provenance_review"],
+            "checkpoint_cannot_replace_raw_context_without_complete_provenance": True,
+        },
+        "review_plan": {
+            "readiness_blockers": blockers,
+            "missed_context_notes": missed_context_notes,
+            "next_steps": [
+                "Keep exact raw context fallback verified before checkpoint metadata is used.",
+                "Deny protected evidence zones before any semantic checkpoint summary is considered.",
+                "Keep provenance handles and missing-provenance review notes attached to checkpoint metadata.",
+                "Measure provider/model token and cost fields on matched successful tasks before any hosted savings claim.",
+            ],
+        },
+        "claim_boundary": (
+            "Dry-run semantic-checkpoint planning only; checkpoint metadata is not replacement context and no hosted "
+            "token/cost savings claim is allowed without provider-measured matched successful tasks."
+        ),
+        "candidate_replacement": None,
+    }
+
+
+def command_plan_semantic_checkpoint(args: argparse.Namespace) -> int:
+    payload = semantic_checkpoint_plan_payload(args)
+    if args.json:
+        emit_json(payload)
+    else:
+        print("ContextGuard semantic-checkpoint plan (dry-run only)")
+        print("No files, prompts, transcripts, model/provider calls, proxy forwarding, or replacement context were emitted.")
+        print(f"Status: {payload['status']}")
+        if payload["review_plan"]["readiness_blockers"]:
+            print(f"Readiness blockers: {', '.join(payload['review_plan']['readiness_blockers'])}")
+        print(payload["claim_boundary"])
+    return 0
+
+
 def visual_crop_ocr_evidence_pack_payload(args: argparse.Namespace) -> dict[str, Any]:
     payload = visual_crop_ocr_plan_payload(args)
     blockers = list(payload["review_plan"]["readiness_blockers"])
@@ -4701,6 +4894,34 @@ def build_parser() -> argparse.ArgumentParser:
     image_context_pack.add_argument("--json", action="store_true", help="Emit JSON output.")
     image_context_pack.set_defaults(func=command_plan_image_context_pack)
 
+    semantic_checkpoint = plan_sub.add_parser(
+        "semantic-checkpoint",
+        help="Dry-run a plan-only semantic checkpoint metadata gate without replacing raw context.",
+    )
+    semantic_checkpoint.add_argument("--goal", help="Planning goal for the semantic checkpoint metadata.")
+    semantic_checkpoint.add_argument("--constraint", action="append", help="Constraint the checkpoint metadata must preserve. Repeatable.")
+    semantic_checkpoint.add_argument("--decision", action="append", help="Decision captured by the checkpoint metadata. Repeatable.")
+    semantic_checkpoint.add_argument("--open-task", action="append", help="Open task captured by the checkpoint metadata. Repeatable.")
+    semantic_checkpoint.add_argument("--evidence-handle", action="append", help="Evidence/provenance handle supporting the checkpoint. Repeatable.")
+    semantic_checkpoint.add_argument("--missing-provenance-note", action="append", help="Missing provenance review note or 'none known after review'. Repeatable.")
+    semantic_checkpoint.add_argument("--unresolved-question", action="append", help="Unresolved question for checkpoint review. Repeatable.")
+    semantic_checkpoint.add_argument("--exact-context-fallback-receipt", help="Local exact raw context artifact receipt id.")
+    semantic_checkpoint.add_argument("--reexpand-command", help="Local exact context re-expand command bound to the receipt id.")
+    semantic_checkpoint.add_argument(
+        "--provider-boundary-ack",
+        action="store_true",
+        help="Acknowledge hosted claims require provider-measured matched successful tasks for the target model.",
+    )
+    semantic_checkpoint.add_argument(
+        "--protected-zone-policy",
+        default="deny",
+        choices=("deny", "allow"),
+        help="Protected evidence handling; only deny can pass the plan gate.",
+    )
+    semantic_checkpoint.add_argument("--missed-context-note", action="append", help="Potential context missed by checkpoint metadata. Repeatable.")
+    semantic_checkpoint.add_argument("--json", action="store_true", help="Emit JSON output.")
+    semantic_checkpoint.set_defaults(func=command_plan_semantic_checkpoint)
+
     self_hosted = plan_sub.add_parser(
         "self-hosted-metrics-ledger",
         help="Dry-run self-hosted/local metrics ledger sidecar evidence without writing a ledger.",
diff --git a/research/experimental-token-reduction-radar.md b/research/experimental-token-reduction-radar.md
index 297f517..6584741 100644
--- a/research/experimental-token-reduction-radar.md
+++ b/research/experimental-token-reduction-radar.md
@@ -1,6 +1,6 @@
 # Experimental Token-Reduction Radar
 
-ContextGuard's shipped helpers reduce avoidable local context bloat before an AI coding agent sees it. This radar tracks **optional future experiments** plus narrow **graduated local experiments** such as the explicit context-diff, visual evidence-pack, plan-only image-context-pack gate, learned-candidate, self-hosted metrics, local proxy gate-record, and one-shot loopback local proxy forwarding runtimes. Later-roadmap lanes are not shipped runtime features, and nothing here is a hosted API savings claim.
+ContextGuard's shipped helpers reduce avoidable local context bloat before an AI coding agent sees it. This radar tracks **optional future experiments** plus narrow **graduated local experiments** such as the explicit context-diff, visual evidence-pack, plan-only image-context-pack and semantic-checkpoint gates, learned-candidate, self-hosted metrics, local proxy gate-record, and one-shot loopback local proxy forwarding runtimes. Later-roadmap lanes are not shipped runtime features, and nothing here is a hosted API savings claim.
 
 ## Non-claims
 
@@ -119,6 +119,18 @@ Broader visual-token reduction remains gated if it would generate crops, invoke
 
 Future runtime work remains gated by verified exact text fallback, protected-zone denial, missed-context review, and provider-measured matched successful tasks. The existing `visual-crop-ocr` lane remains the caller-supplied visual evidence-pack surface and is not a verified exact binary/image fallback.
 
+## Plan-only local experiment — semantic-checkpoint gate
+
+`context-guard experiments plan semantic-checkpoint --json` is the plan-only/eval-only control-plane marker for reviewable task-state checkpoint planning. The canonical ready-state example is:
+
+```bash
+context-guard experiments plan semantic-checkpoint --json --goal "preserve current task state for review" --constraint "do not rewrite protected evidence" --decision "ship plan-only semantic-checkpoint gate first" --open-task "verify exact fallback before any checkpoint is used" --evidence-handle "roadmap=contextguard-artifact:0123456789abcdef" --missing-provenance-note "none known after review" --unresolved-question "which provenance handle fields become mandatory later" --exact-context-fallback-receipt 0123456789abcdef --reexpand-command "context-guard-artifact get 0123456789abcdef --full" --provider-boundary-ack --protected-zone-policy deny --missed-context-note "raw transcript remains retrievable before checkpoint metadata is used"
+```
+
+The CLI accepts these fields as optional so incomplete dry runs can still return reviewer JSON, but the JSON payload blocks readiness until the plan includes a goal, exact context fallback receipt, local re-expand command, provider-boundary acknowledgement, protected-zone policy `deny`, missed-context note, and provenance review note. `--missing-provenance-note` can be a review acknowledgement such as `none known after review`. Exact context fallback is required before any checkpoint metadata is used; allowed local artifact retrieval shapes are `context-guard-artifact get <id> --full` and `context-guard artifact get <id> --full`.
+
+This gate has no `emit`, `record`, or `serve` runtime, no new `context-guard-semantic-checkpoint` binary, writes no files, edits no transcript or prompt, calls no model/provider/network, emits no replacement context, and makes no hosted token/cost savings claim. Future runtime work remains gated by complete provenance, exact fallback/re-expand verification, protected-zone denial, missed-context review, and provider-measured matched successful tasks.
+
 ## Graduated local experiment — learned-compression candidate emitter
 
 `context-guard experiments emit learned-compression --exact-fallback-receipt ... --reexpand-command ...` is the explicit local runtime promoted from the learned-compression gate. It does not run learned compressors, embeddings, rerankers, model calls, subprocesses, or external services; the compact prose candidate must be supplied by the caller, both original and candidate text must pass the deny-by-default protected-signal scan, and the exact local fallback artifact content must match the input. The emitted byte reduction is proxy evidence only and cannot support hosted API token/cost savings claims without the shared promotion gate.
@@ -188,5 +200,5 @@ First local runtime experiment: `context-guard experiments record self-hosted-me
 
 ## Current status
 
-This radar is intentionally conservative. The shipped ContextGuard tools remain local context hygiene, artifact receipts, context packing, tool-schema pruning, transcript audit, statusline visibility, benchmark evidence, plus the explicitly gated local context-diff emitter, visual crop/OCR evidence-pack emitter, plan-only image-context-pack dry-run gate, learned-compression candidate emitter, and self-hosted metrics sidecar recorder described above. Package-visible starter scaffolds live in [`../docs/experimental-benchmark-fixtures.md`](../docs/experimental-benchmark-fixtures.md). They are fixture-only synthetic task/variant examples and dry-run-only starters until prompts and success checks are replaced for a real experiment; they are not shipped runtime helpers, benchmark results, or hosted API savings evidence.
+This radar is intentionally conservative. The shipped ContextGuard tools remain local context hygiene, artifact receipts, context packing, tool-schema pruning, transcript audit, statusline visibility, benchmark evidence, plus the explicitly gated local context-diff emitter, visual crop/OCR evidence-pack emitter, plan-only image-context-pack dry-run gate, plan-only/eval-only semantic-checkpoint gate, learned-compression candidate emitter, and self-hosted metrics sidecar recorder described above. Package-visible starter scaffolds live in [`../docs/experimental-benchmark-fixtures.md`](../docs/experimental-benchmark-fixtures.md). They are fixture-only synthetic task/variant examples and dry-run-only starters until prompts and success checks are replaced for a real experiment; they are not shipped runtime helpers, benchmark results, or hosted API savings evidence.
 Future experiments must pass the gates above before becoming product features.
diff --git a/tests/test_context_guard_kit.py b/tests/test_context_guard_kit.py
index dde90f3..984ef8c 100644
--- a/tests/test_context_guard_kit.py
+++ b/tests/test_context_guard_kit.py
@@ -1688,6 +1688,25 @@ def test_experimental_registry_describes_safe_explicit_flag_surfaces(self):
                         self.assertNotIn("record image-context-pack", " ".join(image_context_pack["commands"]))
                         self.assertNotIn("serve image-context-pack", " ".join(image_context_pack["commands"]))
 
+                        semantic_checkpoint = experiments["semantic-checkpoint"]
+                        self.assertFalse(semantic_checkpoint["default_enabled"])
+                        self.assertEqual(semantic_checkpoint["runtime_status"], "available-plan-only")
+                        self.assertEqual(semantic_checkpoint["commands"], ["context-guard experiments plan semantic-checkpoint"])
+                        self.assertIn("plan semantic-checkpoint", semantic_checkpoint["opt_in_flags"])
+                        self.assertIn("--goal", semantic_checkpoint["opt_in_flags"])
+                        self.assertIn("--exact-context-fallback-receipt", semantic_checkpoint["opt_in_flags"])
+                        self.assertIn("--provider-boundary-ack", semantic_checkpoint["opt_in_flags"])
+                        self.assertIn("--protected-zone-policy deny", semantic_checkpoint["opt_in_flags"])
+                        self.assertIn("--missing-provenance-note", semantic_checkpoint["opt_in_flags"])
+                        self.assertIn("deterministic plan command", semantic_checkpoint["config_effect"])
+                        self.assertIn("does not add an emit/record/serve runtime", semantic_checkpoint["config_effect"])
+                        self.assertIn("replace context", semantic_checkpoint["config_effect"])
+                        self.assertIn("exact context artifact fallback", semantic_checkpoint["evidence_contract"])
+                        self.assertIn("provenance review", semantic_checkpoint["evidence_contract"])
+                        self.assertNotIn("emit semantic-checkpoint", " ".join(semantic_checkpoint["commands"]))
+                        self.assertNotIn("record semantic-checkpoint", " ".join(semantic_checkpoint["commands"]))
+                        self.assertNotIn("serve semantic-checkpoint", " ".join(semantic_checkpoint["commands"]))
+
                         learned = experiments["learned-compression"]
                         self.assertEqual(learned["runtime_status"], "available-explicit-runtime")
                         self.assertIn("context-guard experiments plan learned-compression", learned["commands"])
@@ -2822,6 +2841,7 @@ def test_experimental_visual_crop_ocr_dispatcher_and_no_service_surface(self):
             "context-guard-image-renderer",
             "context-guard-image-parser",
             "context-guard-proxy",
+            "context-guard-semantic-checkpoint",
         ):
             self.assertNotIn(name, package["bin"])
             self.assertFalse((PLUGIN_BIN / name).exists())
@@ -3037,6 +3057,242 @@ def test_experimental_image_context_pack_emit_is_unavailable(self):
                 self.assertIn("invalid choice", proc.stderr)
                 self.assertNotIn("Traceback", proc.stderr + proc.stdout)
 
+    def test_experimental_semantic_checkpoint_plan_only_contract(self):
+        receipt = "0123456789abcdef"
+        for script in EXPERIMENT_SCRIPTS:
+            with self.subTest(script=script):
+                proc = subprocess.run(
+                    [
+                        sys.executable,
+                        str(script),
+                        "plan",
+                        "semantic-checkpoint",
+                        "--json",
+                        "--goal",
+                        "preserve current task state for review",
+                        "--constraint",
+                        "do not rewrite protected evidence",
+                        "--decision",
+                        "ship plan-only semantic-checkpoint gate first",
+                        "--open-task",
+                        "verify exact fallback before any checkpoint is used",
+                        "--evidence-handle",
+                        "roadmap=contextguard-artifact:0123456789abcdef",
+                        "--missing-provenance-note",
+                        "none known after review",
+                        "--unresolved-question",
+                        "which provenance handle fields become mandatory later",
+                        "--exact-context-fallback-receipt",
+                        receipt,
+                        "--reexpand-command",
+                        f"context-guard-artifact get {receipt} --full",
+                        "--provider-boundary-ack",
+                        "--protected-zone-policy",
+                        "deny",
+                        "--missed-context-note",
+                        "raw transcript remains retrievable before checkpoint metadata is used",
+                    ],
+                    text=True,
+                    capture_output=True,
+                    check=True,
+                )
+                payload = json.loads(proc.stdout)
+                self.assertEqual(
+                    set(payload),
+                    {
+                        "tool",
+                        "schema_version",
+                        "plan_schema_version",
+                        "experiment_id",
+                        "mode",
+                        "status",
+                        "plan_only",
+                        "external_services",
+                        "runtime_side_effects",
+                        "checkpoint_metadata",
+                        "exact_context_fallback",
+                        "protected_zones",
+                        "measurement_boundary",
+                        "provenance_review",
+                        "review_plan",
+                        "claim_boundary",
+                        "candidate_replacement",
+                    },
+                )
+                self.assertEqual(payload["tool"], "context-guard-experiments")
+                self.assertEqual(payload["schema_version"], "contextguard.experiments.v1")
+                self.assertEqual(payload["plan_schema_version"], "contextguard.experiments.semantic-checkpoint-plan.v1")
+                self.assertEqual(payload["experiment_id"], "semantic-checkpoint")
+                self.assertEqual(payload["mode"], "dry_run")
+                self.assertEqual(payload["status"], "ready_for_plan_review")
+                self.assertEqual(payload["review_plan"]["readiness_blockers"], [])
+                self.assertEqual(
+                    payload["checkpoint_metadata"],
+                    {
+                        "goal": "preserve current task state for review",
+                        "constraints": ["do not rewrite protected evidence"],
+                        "decisions": ["ship plan-only semantic-checkpoint gate first"],
+                        "open_tasks": ["verify exact fallback before any checkpoint is used"],
+                        "evidence_provenance_handles": ["roadmap=contextguard-artifact:0123456789abcdef"],
+                        "unresolved_questions": ["which provenance handle fields become mandatory later"],
+                    },
+                )
+                self.assertTrue(payload["plan_only"]["command_advertised"])
+                self.assertFalse(payload["plan_only"]["emit_command_available"])
+                self.assertFalse(payload["plan_only"]["record_command_available"])
+                self.assertFalse(payload["plan_only"]["serve_command_available"])
+                self.assertFalse(payload["plan_only"]["runtime_behavior_changed"])
+                self.assertFalse(payload["plan_only"]["replacement_context_emitted"])
+                self.assertFalse(payload["external_services"]["called"])
+                self.assertFalse(payload["external_services"]["network"])
+                self.assertFalse(payload["external_services"]["model_calls"])
+                self.assertFalse(payload["external_services"]["provider_calls"])
+                self.assertFalse(payload["external_services"]["proxy_forwarding"])
+                self.assertFalse(payload["runtime_side_effects"]["files_written"])
+                self.assertFalse(payload["runtime_side_effects"]["transcript_edited"])
+                self.assertFalse(payload["runtime_side_effects"]["prompt_edited"])
+                self.assertFalse(payload["runtime_side_effects"]["context_replaced"])
+                self.assertFalse(payload["runtime_side_effects"]["stable_runtime_behavior_changed"])
+                self.assertTrue(payload["exact_context_fallback"]["required"])
+                self.assertTrue(payload["exact_context_fallback"]["available"])
+                self.assertEqual(payload["exact_context_fallback"]["receipt_id"], receipt)
+                self.assertEqual(payload["exact_context_fallback"]["reexpand_command"], f"context-guard-artifact get {receipt} --full")
+                self.assertFalse(payload["exact_context_fallback"]["verified"])
+                self.assertTrue(payload["exact_context_fallback"]["must_be_verified_before_checkpoint_metadata_is_used"])
+                self.assertEqual(payload["protected_zones"]["policy"], "deny")
+                self.assertFalse(payload["protected_zones"]["override_allowed"])
+                for protected_class in ("code", "diffs", "identifiers", "hashes", "paths", "numeric_constants", "json_keys", "stack_frames", "secrets", "prompt_like_instructions"):
+                    self.assertIn(protected_class, payload["protected_zones"]["denied_classes"])
+                self.assertTrue(payload["measurement_boundary"]["provider_boundary_acknowledged"])
+                self.assertTrue(payload["measurement_boundary"]["provider_measured_matched_tasks_required_for_hosted_claims"])
+                self.assertFalse(payload["measurement_boundary"]["hosted_api_token_savings_claim_allowed"])
+                self.assertFalse(payload["measurement_boundary"]["hosted_api_cost_savings_claim_allowed"])
+                self.assertTrue(payload["provenance_review"]["required"])
+                self.assertTrue(payload["provenance_review"]["reviewed"])
+                self.assertEqual(payload["provenance_review"]["missing_provenance_notes"], ["none known after review"])
+                self.assertEqual(payload["provenance_review"]["missing_provenance_warnings"], [])
+                self.assertTrue(payload["provenance_review"]["checkpoint_cannot_replace_raw_context_without_complete_provenance"])
+                self.assertIn("not replacement context", payload["claim_boundary"])
+                self.assertIsNone(payload["candidate_replacement"])
+
+    def test_experimental_semantic_checkpoint_plan_is_deterministic_and_side_effect_free(self):
+        receipt = "0123456789abcdef"
+        args = [
+            "plan",
+            "semantic-checkpoint",
+            "--json",
+            "--goal",
+            "preserve current task state for review",
+            "--missing-provenance-note",
+            "none known after review",
+            "--exact-context-fallback-receipt",
+            receipt,
+            "--reexpand-command",
+            f"context-guard artifact get {receipt} --full",
+            "--provider-boundary-ack",
+            "--protected-zone-policy",
+            "deny",
+            "--missed-context-note",
+            "raw transcript remains retrievable",
+        ]
+        for script in EXPERIMENT_SCRIPTS:
+            with self.subTest(script=script):
+                with tempfile.TemporaryDirectory() as tmp:
+                    root = Path(tmp)
+                    before = sorted(path.relative_to(root).as_posix() for path in root.rglob("*"))
+                    first = subprocess.run([sys.executable, str(script), *args], text=True, capture_output=True, check=True, cwd=root)
+                    second = subprocess.run([sys.executable, str(script), *args], text=True, capture_output=True, check=True, cwd=root)
+                    after = sorted(path.relative_to(root).as_posix() for path in root.rglob("*"))
+                self.assertEqual(json.loads(first.stdout), json.loads(second.stdout))
+                payload = json.loads(first.stdout)
+                self.assertEqual(after, before)
+                self.assertEqual(payload["status"], "ready_for_plan_review")
+                self.assertFalse(payload["runtime_side_effects"]["files_written"])
+                self.assertFalse(payload["runtime_side_effects"]["prompt_edited"])
+                self.assertFalse(payload["runtime_side_effects"]["transcript_edited"])
+                self.assertFalse(payload["external_services"]["called"])
+                self.assertIsNone(payload["candidate_replacement"])
+
+    def test_experimental_semantic_checkpoint_blocks_missing_or_unsafe_gates(self):
+        receipt = "0123456789abcdef"
+        base = [
+            "--goal",
+            "preserve current task state",
+            "--missing-provenance-note",
+            "none known after review",
+            "--exact-context-fallback-receipt",
+            receipt,
+            "--reexpand-command",
+            f"context-guard-artifact get {receipt} --full",
+            "--provider-boundary-ack",
+            "--protected-zone-policy",
+            "deny",
+            "--missed-context-note",
+            "raw transcript remains retrievable",
+        ]
+        cases = [
+            ("missing_goal", base[2:], "missing_goal"),
+            (
+                "missing_exact_context_fallback",
+                ["--goal", "preserve current task state", "--missing-provenance-note", "none known after review", "--provider-boundary-ack", "--missed-context-note", "raw transcript remains retrievable"],
+                "missing_exact_context_fallback",
+            ),
+            (
+                "invalid_exact_context_reexpand_command",
+                ["--goal", "preserve current task state", "--missing-provenance-note", "none known after review", "--exact-context-fallback-receipt", receipt, "--reexpand-command", f"context-guard-artifact get {receipt} --compact", "--provider-boundary-ack", "--missed-context-note", "raw transcript remains retrievable"],
+                "invalid_exact_context_reexpand_command",
+            ),
+            (
+                "missing_provider_measurement_boundary",
+                ["--goal", "preserve current task state", "--missing-provenance-note", "none known after review", "--exact-context-fallback-receipt", receipt, "--reexpand-command", f"context-guard-artifact get {receipt} --full", "--missed-context-note", "raw transcript remains retrievable"],
+                "missing_provider_measurement_boundary",
+            ),
+            (
+                "protected_zone_denial_required",
+                ["--goal", "preserve current task state", "--missing-provenance-note", "none known after review", "--exact-context-fallback-receipt", receipt, "--reexpand-command", f"context-guard-artifact get {receipt} --full", "--provider-boundary-ack", "--protected-zone-policy", "allow", "--missed-context-note", "raw transcript remains retrievable"],
+                "protected_zone_denial_required",
+            ),
+            (
+                "missing_missed_context_note",
+                base[:-2],
+                "missing_missed_context_note",
+            ),
+            (
+                "missing_provenance_review",
+                ["--goal", "preserve current task state", "--exact-context-fallback-receipt", receipt, "--reexpand-command", f"context-guard-artifact get {receipt} --full", "--provider-boundary-ack", "--missed-context-note", "raw transcript remains retrievable"],
+                "missing_provenance_review",
+            ),
+        ]
+        for script in EXPERIMENT_SCRIPTS:
+            for name, args, expected_blocker in cases:
+                with self.subTest(script=script, case=name):
+                    proc = subprocess.run(
+                        [sys.executable, str(script), "plan", "semantic-checkpoint", *args, "--json"],
+                        text=True,
+                        capture_output=True,
+                        check=True,
+                    )
+                    payload = json.loads(proc.stdout)
+                    self.assertEqual(payload["experiment_id"], "semantic-checkpoint")
+                    self.assertEqual(payload["status"], "blocked_until_semantic_checkpoint_gate_ready")
+                    self.assertIn(expected_blocker, payload["review_plan"]["readiness_blockers"])
+                    self.assertFalse(payload["external_services"]["called"])
+                    self.assertFalse(payload["runtime_side_effects"]["files_written"])
+                    self.assertIsNone(payload["candidate_replacement"])
+
+    def test_experimental_semantic_checkpoint_runtime_commands_are_unavailable(self):
+        for script in EXPERIMENT_SCRIPTS:
+            for runtime_command in ("emit", "record", "serve"):
+                with self.subTest(script=script, runtime_command=runtime_command):
+                    proc = subprocess.run(
+                        [sys.executable, str(script), runtime_command, "semantic-checkpoint", "--json"],
+                        text=True,
+                        capture_output=True,
+                    )
+                    self.assertEqual(proc.returncode, 2)
+                    self.assertIn("invalid choice", proc.stderr)
+                    self.assertNotIn("Traceback", proc.stderr + proc.stdout)
+
     def test_experimental_visual_crop_ocr_emit_runtime(self):
         for script in EXPERIMENT_SCRIPTS:
             with self.subTest(script=script):
@@ -6978,6 +7234,68 @@ def test_experimental_image_context_pack_docs_examples_match_cli(self):
                 self.assertEqual(payload["status"], "ready_for_plan_review")
                 self.assertEqual(payload["review_plan"]["readiness_blockers"], [])
 
+    def test_experimental_semantic_checkpoint_docs_examples_match_cli(self):
+        docs = (
+            ROOT / "README.md",
+            ROOT / "README.ko.md",
+            PLUGIN_DIR / "README.md",
+            PLUGIN_DIR / "README.ko.md",
+            KIT_DIR / "README.md",
+            ROOT / "research" / "experimental-token-reduction-radar.md",
+        )
+        canonical_flags = (
+            "--goal",
+            "--exact-context-fallback-receipt",
+            "--reexpand-command",
+            "--provider-boundary-ack",
+            "--protected-zone-policy deny",
+            "--missing-provenance-note",
+            "--missed-context-note",
+        )
+        forbidden_snippets = (
+            "emit semantic-checkpoint",
+            "record semantic-checkpoint",
+            "serve semantic-checkpoint",
+        )
+        receipt = "0123456789abcdef"
+        for doc in docs:
+            with self.subTest(doc=doc):
+                text = doc.read_text(encoding="utf-8")
+                lower_text = text.lower()
+                self.assertIn("semantic-checkpoint", lower_text)
+                self.assertRegex(lower_text, r"plan-only|plan only|dry-run|드라이런|plan 전용")
+                self.assertRegex(lower_text, r"provenance|프로비넌스|출처")
+                self.assertRegex(lower_text, r"exact context|exact .*context|정확한 context|정확한 컨텍스트")
+                self.assertRegex(lower_text, r"protected-zone|protected zone|보호")
+                self.assertRegex(lower_text, r"does not (?:replace|write|call|proxy)|no .*replacement|대체하지|호출하지|쓰지")
+                for snippet in forbidden_snippets:
+                    self.assertNotIn(snippet, lower_text)
+
+                example_lines = [
+                    line.strip()
+                    for line in text.splitlines()
+                    if line.strip().startswith("context-guard experiments plan semantic-checkpoint")
+                ]
+                self.assertEqual(len(example_lines), 1)
+                example = example_lines[0]
+                for flag in canonical_flags:
+                    self.assertIn(flag, example)
+
+                argv = [token.replace("<id>", receipt) for token in shlex.split(example)]
+                self.assertEqual(argv[:3], ["context-guard", "experiments", "plan"])
+                with tempfile.TemporaryDirectory() as tmp:
+                    proc = subprocess.run(
+                        [sys.executable, str(PLUGIN_BIN / "context-guard-experiments"), *argv[2:]],
+                        text=True,
+                        capture_output=True,
+                        check=True,
+                        cwd=tmp,
+                    )
+                payload = json.loads(proc.stdout)
+                self.assertEqual(payload["experiment_id"], "semantic-checkpoint")
+                self.assertEqual(payload["status"], "ready_for_plan_review")
+                self.assertEqual(payload["review_plan"]["readiness_blockers"], [])
+
     def test_experimental_local_proxy_docs_surface_boundary(self):
         docs = (
             ROOT / "README.md",