WriteSubject grows the three inputs a stateless predicate may reference beyond diff and identity: SubjectAttributes (kind, handle, harness, agent_type -- all four kind-dependent and populated from the account, never the request, with absence left ordinary rather than faked), and DeploymentAttributes (this PDS's own DID and hostname). `now` is pinned once per write from the write path rather than left for an evaluator to read its own clock, for the same reason evaluators get no store handle: two policies judging one write must see the same instant. WriteQueue::submit now calls PolicyGate::observe unconditionally after judge, on every outcome -- the observation channel does not short-circuit even though admit does. Freeze calls PolicyGate::froze; Provisioner's freeze, unfreeze and delete_as now drive froze/unfroze/deleted so a stateful evaluator's per-agent state cannot outlive or outlast what actually happened to the account. Change-Id: I7a52115d617410394c547721a21bda8a41d1dbc3