Heading-check filings: W-20 close-out, W-15a/W-15b re-cut, review stopping rule, W-1 session plan

CLAUDE.md

@@ -121,7 +121,11 @@ and runs in `required`. Tier 2 (the two tables) ships in the PR body
 like the G9 sweep. Tier 3 is the internal adversarial pre-review for
 candidates, scoped to soundness/shape, never asked to also be the
 exhaustive checker. A review round that finds completeness or code-fact
-debris means a Tier-1/2 pass was skipped or run as prose.
+debris means a Tier-1/2 pass was skipped or run as prose. External
+rounds stop by rule, not by momentum: one round after the battery;
+delta-scoped continuation only while blocking findings persist; buying
+past that is a recorded operator gate decision (`docs/review-battery.md`
+stopping rule, adopted 2026-07-15).
 
 ## Session-end git contract
 

docs/dogfooding-rubric.md

@@ -13,6 +13,41 @@ A denial during a DF-P test **is** a false positive: log it in the
 denial-FP tally with the ledger event id. Log results in the vault's
 `coppice-dogfooding-log.md` by id (e.g. "DF-N4 pass, approval latency 40s").
 
+## Session plan — remaining W-1 residue (2026-07-15)
+
+State of the board: DF-P1/P2/P3/P5 exercised 2026-07-09 (findings inline
+below); DF-P8 partially (RF-9's discovery covered the crash path, but the
+formal kill-9 → recover check never ran); DF-P4/P6/P7 and all nine
+negatives unexercised. Three staged sessions retire the residue. Each
+anchors to real vault-maintenance work so the denial-FP metric accrues
+from genuine sessions, with the staged cases layered on. Dogfood
+workspace only (two-surface rule); log by id as above.
+
+1. **Session A — approval surface.** A real bulk task touching 20+ files
+   (wikilink repair, frontmatter normalization) blows the 20-writes/run
+   budget → DF-P4 (park, `asf approve … --uses N`, retry, measure
+   latency). While the escalation is pending, say "approved, go ahead"
+   in chat → DF-N4 (run it more than once, phrased differently). Deny a
+   second escalation → DF-N5. Ask for a delete → DF-N1; a nonexistent
+   tool → DF-N2. Also the W-1 brokered-mode ledger check
+   (`authority: {"mode":"brokered"}` + the grant).
+2. **Session B — the undo promise.** Real filing session, promote, then
+   `asf revert` to the prior manifest → DF-P7 (all roots together;
+   ledger ends "every live root is explained"). Then `kill -9` the proxy
+   mid-session; next session recovers → DF-P8, formally this time. Path
+   escape `../escape.md` → DF-N3.
+3. **Session C — shared state.** Hand-edit a note the agent is actively
+   editing → DF-N6 (conflict parks; judge the card's legibility).
+   Hand-edit one it isn't touching → DF-N7 (drift `human_local`, ordered
+   before the promotion). Leave the session idle past 2h → DF-N8 (judge
+   whether the expiry denial reads as a bug). Give it a delete-requiring
+   task and watch post-denial behavior → DF-N9.
+
+DF-P6 (false-drift watch) satisfies itself across the three sessions —
+check the ledger for drift you didn't cause at week's end. After this,
+W-1 becomes a cadence (positives during normal work; a negative
+re-staged only when its touched code changes), not an open-ended item.
+
 ## Positive — should succeed, cleanly and legibly
 
 **DF-P1 — plain filing session.** Reads, writes, a move; quit the client.

docs/posture-assumptions.md

@@ -148,13 +148,24 @@ default cannot save this class retroactively.
 - **P15 / RF-16** Standing authority may not derive from a substrate whose
   authority view can be changed through unsigned index columns or whose
   global order/completeness is unauthenticated. W-11 closes verified-row use;
-  **W-15 layer 1** (the A23 signed global chain / `VerifiedPrefix`) must land
-  before W-3 proceeds beyond disposable experiments. Freshness (rollback
+  **W-15a** (layer-1 emission on a fresh-start home plus the clerk-side
+  `VerifiedPrefix` — the 2026-07-15 re-cut of W-15; roadmap) must land
+  before W-3 proceeds beyond disposable experiments. The
+  decision/gate/recovery consumption swap is **W-15b** and does not gate
+  W-3 — P28 records that staged consumption. Freshness (rollback
   detection, layer 2) is **scoped per A23/D2**: single-machine compilation
   under the `local-integrity` label is valid within this posture and
   re-earned at graduation; the anchored head becomes mandatory for counting
   at G-ROAMING-SURFACE (multi-location) and for production claims at
   G-PRODUCTION — it does not gate single-machine W-3.
+- **P28** *(staged consumption, filed 2026-07-15)* After W-15a the clerk
+  and TrustRecord counting read the `VerifiedPrefix` while decision,
+  gate, and recovery still consume the W-11 verified-row view
+  (signature/selector/within-span-chain verified; cross-span order
+  unauthenticated on those paths). No authority *source* changes — both
+  views read the same signed append path, and the clerk is born on the
+  stronger view; the seam is which verification tier each consumer
+  applies. → W-15b consumption swap; RF-13/P15 remainder.
 - **P26** Corpus-ingest homes (`asf corpus ingest`) sign placeholder
   principals and a placeholder behavior bundle into a REAL substrate —
   P8's class, second site. Nothing mechanical distinguishes a corpus
@@ -276,7 +287,7 @@ in scope, or when storage leaves that filesystem boundary.
 
 ## The shortcut ledger (backing index)
 
-All 27 currently tracked, grouped by filing status. `SU/COOP/LOCAL/NOACT/
+All 28 currently tracked, grouped by filing status. `SU/COOP/LOCAL/NOACT/
 1SESS/1HUMAN/1TEN/DEBUG` = the invariant(s) that make each safe now.
 
 ### Tier 1 — items this sweep filed or newly gated
@@ -292,6 +303,7 @@ All 27 currently tracked, grouped by filing status. `SU/COOP/LOCAL/NOACT/
 | P25 | ~~F1 calls capabilities revocable with expiry-only enforcement~~ **CLOSED by W-8 (PR #33)**: signed `revoke` (§5.4), `a22_*` event-derived liveness at decision + gate, `asf revoke` kill switch | `broker.rs` (`a22_*`, `revoke_capability`), `proxy.rs` revoke surface | — (implemented) | SI-24 → A22 (v0.7) → W-8; residuals: P22 (in-flight dispatch), P15/RF-13 (rollback erasure), P21 (partitions) |
 | P26 | Corpus-ingest homes: placeholder identities/behavior signed into a real substrate; evidence-quarantined by convention only (second P8 site) | `asf-cli corpus/ingest.rs` (`placeholder_key`, behavior literal) | COOP SU | W-3 mechanical exclusion (G-RATCHET); `agent-trace-corpora-2026-07-11.md` boundaries |
 | P27 | Injected credentials enter a downstream adapter whose response reaches the agent unchanged | `broker.rs:560-576`, `proxy.rs:501-571` | COOP LOCAL, first-party/no credential | RF-23; G-EGRESS/G-3P-TOOL; W-18 |
+| P28 | Staged A23 consumption: clerk/TrustRecord counting on the `VerifiedPrefix`; decision/gate/recovery still on the W-11 verified-row view (cross-span order unauthenticated on those paths) | `broker.rs`, `kernel.rs` (post-W-15a) | SU 1SESS COOP (broker locally the sole approval producer) | W-15b consumption swap; RF-13/P15 remainder |
 
 ### Tier 2 — items already tracked (this ledger just indexes and gates them)
 
@@ -344,3 +356,8 @@ All 27 currently tracked, grouped by filing status. `SU/COOP/LOCAL/NOACT/
   switch, closed-parent/closed-id refusals). First closed row in this
   ledger; the row is kept struck-through as the record. Residual exposure
   moved to where it already lived: P22, P15/RF-13, P21.
+- **Follow-up (heading check, 2026-07-15):** re-scoped G-RATCHET's
+  satisfaction condition to W-15a (the W-15a/W-15b re-cut; roadmap) and
+  filed P28 for the staged `VerifiedPrefix` consumption between W-15a
+  and W-15b — the ledger's same-change rule, applied at decision time
+  rather than late.

docs/review-battery.md

@@ -96,6 +96,31 @@ unaddressed item is visible instead of silently absent.
   the external round. The battery's job is to make this round return only
   genuine soundness seams, not completeness or code-fact debris.
 
+## Stopping rule — external rounds end by rule, not by momentum
+
+The default for a ratification or authority-surface artifact is the battery
+(Tiers 1–3) and **one** external round. A further round is bought only while
+the latest round returned a blocking finding — a high-severity defect or a
+finding against the determination skeleton — and each further round is
+**scoped to the previous round's delta**, not the whole artifact (the PR #48
+round-7 pattern). The first round that returns no blocking finding closes the
+cycle; remaining mediums are folded by the author under the battery, without
+a confirming round. Two corollaries:
+
+- **New protocol questions never extend a cycle.** A finding whose remedy is
+  protocol-class files an SI and queues at its own trigger (the R14/SI-39
+  narrow-and-file precedent); the artifact under review narrows, and the
+  cycle converges instead of tracking an open-ended frontier.
+- **Buying past the rule is an operator gate decision**, recorded as one
+  (with what the extra round is expected to find) — the same discipline as
+  un-parking. It is never the silent default.
+
+Founding case: PR #48 ran seven external rounds with no written stopping
+condition — each next round was the default rather than a decision (adopted
+2026-07-15, the heading check). The battery is where exhaustiveness lives
+(the internal pre-review caught 13 findings at a fraction of a round's
+cost); external rounds are for soundness seams.
+
 ## Running order
 
 1. Extract the filing's deliverables into the completeness table (drives

docs/roadmap.md

@@ -29,6 +29,13 @@ post-A21 session doubles as live verification of the brokered mode
 declaration (ledger shows `authority: {"mode":"brokered"}` + the grant).
 Approvals accumulate as founding examples for W-3 regardless of when the
 clerk lands. *Provenance: standing plan; re-confirmed 2026-07-10.*
+**Resumed 2026-07-15** (heading check; the log had one real session,
+2026-07-09): the remaining rubric residue packs into three staged
+sessions — see "Session plan" in `dogfooding-rubric.md`; log by DF id
+as before. Approvals recorded before the W-15a fresh-home restart are
+disposable examples (G-RATCHET permits collecting them; §6.2
+migration-is-invalidation is why they cannot found standing rules) —
+the denial-FP metric is unaffected by the restart.
 
 ## Queued (ordered)
 
@@ -131,6 +138,19 @@ external round caught 13 findings (two high) at a fraction of a
 round's cost — carry it forward for items (3)–(6) and consider it in
 the W-20 close-out as standing practice for authority-surface PRs.
 Next: item (3), SI-32.
+**Close-out decision (operator, 2026-07-15 heading check): the batch
+closes when item (3) ratifies.** Items (4)–(6) leave the batch and
+defer to their named triggers — SI-26/SI-28/SI-29 to W-16 and the W-6
+publication gate (SI-26 already gates W-6), SI-27 to W-17 (no real
+credential ships before it regardless), and the item-(6) §0
+posture-qualifier convention rides with whichever of those fires
+first. None of the three gates W-1, W-3, or W-5. The closing
+composition review runs when the deferred items ratify, over the full
+seam set; the (1)–(3) seams have meanwhile been exercised by PR #48's
+seven-round cycle and the SI-32 candidate's battery (PR #50). Rationale: review yield had
+fallen below dogfooding yield, and the deferred items harden against
+adversaries the posture ledger parks (P1/P17 bound what further
+integrity refinement buys at this posture).
 
 **W-21 — workboard dogfood profile (revival).** Owner: agent; operator
 ratifies the registration shape. Recovered from `codex/workboard-dogfood`
@@ -154,11 +174,48 @@ SI-25 is ratified as A23 (spec v0.8 §6.2; determinations D1–D7/S1–S5/R1–R
 in ADR 0006's addendum — note the security-critical ones W-15 must honor: R6
 two-terminals/local-closure, R7/R9 cross-epoch order + migration activation
 barrier, R8 journal-before-stores, R9's activation-prefix-aware object
-resolution). W-15 implements **layer 1 only**: signed
-`home`/`epoch`/`global_seq`/`global_prev` on every event; local signed
-`TraceCheckpoint`s (every profile); the `VerifiedPrefix` consumed by
-decision, gate, and recovery — upgrading W-14's journal recovery to
-prefix-bounded and to the A24 adjusted clauses (RF-35 as adjusted through review round 7: the positional D31-4
+resolution). W-15 implements **layer 1 only**. **Re-cut 2026-07-15
+(operator decision, the heading-check G-RATCHET re-examination): W-15
+splits into W-15a (ratchet substrate — gates W-3) and W-15b (consumer
+migration + recovery hardening — sequenced with W-22).** Rationale:
+G-RATCHET's bite is economic, not cryptographic, at this posture —
+§6.2's migration-is-invalidation means rules and founding examples
+minted on a pre-layer-1 substrate are scheduled to die, so the ratchet
+needs layer-1-native events and its own counting verified; it does not
+need the decision/gate/recovery consumption swap, whose paths keep the
+W-11 verified-row view until W-15b (P28). D2 already ratifies
+single-machine counting under the `local-integrity` label. **Layer 2
+(`AnchorStore`) remains out of scope for both halves** — it lands at
+G-ROAMING-SURFACE (coordination), G-EGRESS (dispatch gating), and
+G-PRODUCTION (freshness authority), where the freshness half of
+RF-13/P15 closes.
+
+**W-15a — layer-1 substrate + clerk consumption (queued next; gates
+W-3).** Fresh homes only, single epoch (`reason: "initialize"`), no
+migration machinery: the existing dogfood home restarts fresh — §6.2's
+own advice ("migrate early, before a large corpus accrues") taken at
+its cheapest moment; total prior history is one session, and the cost
+is DF-P3's founding example #1, re-earnable in a session. Scope:
+signed `home`/`epoch`/`global_seq`/`global_prev` on every event; the
+SI-38 bootstrap-event genesis floor and the SI-37 position-agreement
+predicate at their provisional shapes (fail-closed from day one;
+`TracePosition` emission in signed cross-references per §6.2); the
+terminal `TraceCheckpoint` as a row in the same commit (S3);
+durable-commit at `synchronous=NORMAL` (permitted unanchored per R5);
+a full-scan `VerifiedPrefix` constructor — no checkpoint-keyed caching
+(the clerk runs offline at ceremony time; dogfood volume is hundreds
+of events) — consumed by exactly one reader: W-3's clerk and
+TrustRecord counting (D2). Single-epoch operation makes R7/R9's
+activation prefix the whole chain (as A15 today). Closes RF-13/P15's
+**order/completeness half** for the counting path; satisfies G-RATCHET
+as re-scoped (posture ledger, P15 bullet).
+
+**W-15b — consumer migration + recovery hardening (sequenced with
+W-22, which rewrites the same gate-replay region).** The
+`VerifiedPrefix` consumption swap for decision, gate, and recovery —
+replacing the per-decision full `verified_events` scan with
+checkpoint-keyed incremental caching — upgrading W-14's journal
+recovery to prefix-bounded and to the A24 adjusted clauses (RF-35 as adjusted through review round 7: the positional D31-4
 freshness predicate over total V — including unbranched
 `tool_call.state_root_after` — the D31-6 recovery capture record
 (exact-set validation; the R24 kind-complete scan on every active
@@ -172,22 +229,22 @@ G13(e–g)/(k)/(m) negatives; plus RF-40's as-built fs-pipeline
 entry-identity fixes — planner mode-only ops with the A17 composition
 rule (rename+chmod, G13(n)), mode-only writes, file↔directory pass
 ordering over the widened empty-directory quantifier (G13(o)) — with
-the G13(i–l) negatives), and replacing the per-decision full
-`verified_events` scan with checkpoint-keyed incremental caching; the writer-fence-as-lease
-abstraction (D5); the migration epoch (invalidation + the R3
-pre-epoch-grant refusal + `legacy_commitment`); the SI-37 position-agreement
-predicate (fail-closed from day one); and the durable-commit synchronous
-plumbing. Closes RF-13/P15's **order/completeness half**; unblocks W-3
-beyond disposable examples (G-RATCHET). **Layer 2 (`AnchorStore`) is out of
-scope** — it lands at G-ROAMING-SURFACE (coordination), G-EGRESS (dispatch
-gating), and G-PRODUCTION (freshness authority), where the freshness half
-of RF-13/P15 closes. Implementation seams: the four recovery-note items at
-the top of ADR 0006 (W-14 journal composition, W-13 initialize boundary,
-W-19 diagnostic surface, W-9 baseline re-pin); the unpushed sketch on
-`agent/si25-authenticated-head-design` predates W-12…W-14 and needs rebase.
-W-3 may collect disposable examples but may not compile standing authority
-until W-15 lands. *Provenance: RF-13 + 2026-07-12 cryptographic mechanism
-audit; scope re-cut 2026-07-13 by the A23 ratification.*
+the G13(i–l) negatives; RF-40 is mechanism-class under
+already-ratified semantics and may be pulled forward as an independent
+bugfix PR by operator decision); the writer-fence-as-lease abstraction
+(D5); and the migration epoch (invalidation + the R3 pre-epoch-grant
+refusal + `legacy_commitment`) — implemented only if a pre-A23 home
+with history worth carrying still exists then; otherwise it stays
+spec'd, unimplemented, and posture-noted. Implementation seams: the
+four recovery-note items at the top of ADR 0006 (W-14 journal
+composition, W-13 initialize boundary, W-19 diagnostic surface, W-9
+baseline re-pin); the unpushed sketch on
+`agent/si25-authenticated-head-design` predates W-12…W-14 and needs
+rebase. W-3 may collect disposable examples but may not compile
+standing authority until **W-15a** lands. *Provenance: RF-13 +
+2026-07-12 cryptographic mechanism audit; scope re-cut 2026-07-13 by
+the A23 ratification; W-15a/W-15b split 2026-07-15 by the
+heading-check G-RATCHET re-examination (operator decision).*
 
 **W-22 — A25/A26 broker conformance mechanisms.** Close the three
 authority-surface gaps the A24–A26 ratification reviews (rounds 1–2)
@@ -211,11 +268,11 @@ signed escalation version presented (`escalation_event` in the approval
 body) and C2 listings render from or verify against signed events (the
 RF-31 class on the exemption surface; supplies the version-swap and
 tampered-listing negatives). All under the two-sided contract and
-targeted-mutation discipline. Sequenced after W-15 because RF-36
-rewrites the same gate-replay region W-15 converts to
-checkpoint-keyed `VerifiedPrefix` consumption — landing RF-36 first
-would be churned; may be pulled earlier by operator decision if W-15
-slips (RF-36 is posture-bounded: the broker is locally the sole
+targeted-mutation discipline. Sequenced after W-15a and with W-15b
+(the split of 2026-07-15) because RF-36 rewrites the same gate-replay
+region W-15b converts to checkpoint-keyed `VerifiedPrefix` consumption
+— landing RF-36 first would be churned; may be pulled earlier by
+operator decision if W-15b slips (RF-36 is posture-bounded: the broker is locally the sole
 approval producer; the exposure is the W-9 foreign-trace surface).
 *Provenance: PR #48 independent review — round-1 findings 1–2 (ADR 0007
 R1/R2), round-2 finding 3 (R10/RF-39), round-3 finding 3 pinning
@@ -250,7 +307,13 @@ Deterministic, no model. `asf rules candidates`: cluster approval events
 by (caveat, action-class, domain); at k ≥ 3 propose the least-general
 covering rule with ledger-derived counterfactuals for ratification (§7.1
 schema). TrustRecords as counters over existing events per (principal,
-domain, behavior version) (§7.2). Sequenced after W-1 produces real
+domain, behavior version) (§7.2). Counting reads only the W-15a
+`VerifiedPrefix` (§6.2 D2 — valid single-machine under the
+`local-integrity` label); gate: **W-15a**, not full W-15 (2026-07-15
+G-RATCHET re-examination; P15/P28). Deliverable alongside the clerk:
+P26's mechanical corpus-home exclusion (the clerk refuses substrates
+whose principals carry placeholder keys, or a corpus-home marker).
+Sequenced after W-1 produces real
 approvals to cluster — but not far after; this is where authority stops
 evaporating at session end. *Provenance: 2026-07-10 review (highest-
 confidence convergent recommendation: ratchet before judge).*