The frozen test suite is the compiler's intermediate representation: generated from the spec before any implementation exists, then frozen. Because no implementation exists yet, the tests cannot rationalize one — that input isolation is what makes them a contract rather than a mirror.
Encode. The prompt is feature-coded into a tree of nodes: dependencies, owned files, an exports contract, edge cases. The spec gate validates structure — mechanical problems are fixed deterministically (zero tokens); residual issues get bounded per-feature repair, never whole-spec regeneration, under a collapse guard that refuses to accept fewer features than were enumerated.
Stubs. Interface header files are emitted and must typecheck alone. The diagnostic oracle routes each compiler error to where it is actually fixed — a missing member belongs to the contract, not the caller.
Suites. One frozen vitest suite per feature; the harness owns file structure (imports, describe blocks), the model fills bounded holes (case bodies). Suites are validated per-case, and the cross-suite gate typechecks all suites + stubs together so a suite calling beyond a declared interface fails at gate 1, not as an unhealable integration failure after build.
Freeze. Approval assigns the contract: each suite's sha256 goes into the manifest and is verified byte-identical before build, before every RHA episode, and in the final report. From then on, code conforms to tests — never the reverse.
Every gate here is a bounded loop under the doctrine: deterministic fixes first, fresh decorrelated draws on stall, per-feature escalation so one stuck feature never kills the run.