AST-4 review round 1 negative-control receipt, ast-4-builder-fix, 2026-09-02 UTC

F1 — before the byte-driven walker was restored:
$ npx vitest run tests/publish.test.ts tests/verify.test.ts
Test Files  2 failed (2)
Tests       4 failed | 17 passed (21)
- octet-stream-labelled JSON record: publish moved instead of refusing
- malformed declared JSON: publish leaked SyntaxError instead of a problem
- octet-stream-labelled JSON record: verify returned ok=true after its child was removed
- malformed bytes served as application/json: verify returned ok=true

After the guard was implemented:
$ npx vitest run tests/publish.test.ts tests/verify.test.ts
Test Files  2 passed (2)
Tests       21 passed (21)

The declared-JSON control was then strengthened so the malformed member was
extra (not reachable from the pack), proving every supplied closure member is
checked. Before the all-member guard:
$ npx vitest run tests/publish.test.ts -t 'declared JSON whose bytes are not JSON'
Test Files  1 failed (1)
Tests       1 failed | 12 skipped (13)

The store-existing path was also broken independently: an octet-stream-labelled
JSON record was put in the store, omitted from the publish input, and named an
absent child. Before the existing-member byte walk:
$ npx vitest run tests/publish.test.ts -t 'walks JSON bytes already in the store'
Test Files  1 failed (1)
Tests       1 failed | 13 skipped (14)

After both guards:
$ npx vitest run tests/publish.test.ts tests/verify.test.ts
Test Files  2 passed (2)
Tests       22 passed (22)

F2 — before corrupt store pointers were reclassified:
$ npx vitest run tests/cli.test.ts
Test Files  1 failed (1)
Tests       1 failed | 7 passed (8)
Failure: malformed fs pointer expected exit 4, received exit 2.

After the guard was implemented:
$ npx vitest run tests/cli.test.ts tests/pointers.test.ts
Test Files  2 passed (2)
Tests       11 passed (11)

F3 — the URL selector and fourth credential guard were deliberately removed,
then the focused controls were run:
$ npx vitest run tests/cli.test.ts -t 'defaults to the prod read URL|requires all four scoped R2 variables'
Test Files  1 failed (1)
Tests       2 failed | 8 skipped (10)
- AA_ENV=dev expected https://store-dev.agentarmies.io, received https://store.agentarmies.io
- missing AA_R2_BUCKET expected credentialsPresent=false, received true

The two guards were restored. Final clean receipt:
$ just verify
Test Files  8 passed | 1 skipped (9)
Tests       58 passed | 1 skipped (59)
MISSING: r2 integration (credentials absent)