Why: Direct HTTP and surface command dispatch could mutate RDM project facts without an analyzed committed-message manifest.
Evidence: Command-bus, server, and app suites pass with a classification regression for formal writes and read/proof exceptions.
Impact: Formal HTTP writes require a conversation anchor and committed proceed decision; surface writes fail closed until they can carry the same proof.
Refs: TT-N03 TT-R01