The free-text instruction box (constraint 4): ONE structured LLM call revises the stage per the OPERATOR's directive (trusted — unlike the transcript), the result passes back through the SAME stage validator (quote gates, book whitelists, recipient whitelist), and downstream stages are marked stale. Package-local in both modes.

SLOW: the LLM turn runs 30-120s — the handler is async and holds no DB session across it (package_apply's load → close → LLM → fresh-session persist); callers should use a generous client timeout.