v1.4.2: fail closed on optimizer evidence quality

[ipeterpetrus]

Patch-release candidate for the legacy optimizer's evidence integrity. Not 1.5, not a
schema-4 port, and nothing new is activated. v1.4.1 is not moved and its released runtime is
unaffected.

This PR has four heads, and every blocked one is still described below. Each repair closed
the defect it was aimed at and exposed the next one, so the history is the evidence: nothing here
has been rewritten to make the branch look like it arrived clean.

0. The head history, in order

1. fe78cbc   the original repair: six defects in the legacy optimizer's evidence integrity
             -> BLOCKED by an independent acceptance review
2.            blocker B1: container damage was PERMANENT. One torn line disabled promotion for
             every scope sharing the history file, forever, with no path back.
3. e6c1f4f   the epoch repair: a loss is a BOUNDARY at a physical position, not a verdict
             -> BLOCKED by an adversarial review of that head
4.            blocker B-UTF8: attribution was read off the line that had just FAILED validation.
             Invalid UTF-8 in `scope_id` survived `errors="replace"` as U+FFFD, passed for a
             readable label, and cut a scope that does not exist — while the real population kept
             crossing the loss and a candidate was written from both sides of it.
5. 71016ee   the trust repair: a rejected line is never an authority for its own scope, the
             history is decoded strictly, and a scope-local boundary has exactly one trusted
             source — a record that PASSED validation and whose own counters prove the loss.
             -> author-adversarial review found one MEDIUM
6.            two MATERIALLY DIFFERENT observations sharing one run_id were collapsed into a
             single retry, so the second loss never opened a boundary and a candidate rested on
             evidence from both sides of it.
7. this head  the identity repair: run_id is a claim, not proof. Same identity plus a different
             persisted observation is a RUN_ID_CONFLICT, not a retry, and it cuts where it
             appears.

0.0 What the adversarial review blocked (head 2 → head 3)

Reproduced before anything was designed for it: six clean rev records, one SameWrite-shaped line
holding invalid UTF-8 inside scope_id (and independently failing validation), six more clean rev
records. On e6c1f4f: CANDIDATE, exit 10, one candidate file, records_in_epoch=12,
damage.scope_local={"\ufffd\ufffd\ufffd": 1}, and the specification's evidence_run_ids naming
records from both sides of the loss.

The defect was never about Unicode. It was provenance, and the repair says so as a rule:

A record that failed validation is not a trustworthy authority for its own scope attribution.

• The history is read as BYTES, decoded strictly, one physical line at a time. errors="replace"
  destroyed the evidence that a decode had failed. A line that cannot decode is now a named
  rejection (line is not valid UTF-8) and a loss, and the reader continues at the next line rather
  than abandoning the file. The size cap measures the bytes it rejects.
• Every loss a rejected line represents is FILE-GLOBAL. No rejected line may name a scope,
  whatever its scope_id looks like — rev, agent-b, a path, a 64-character label, or bytes that
  never decoded. This over-blocks on purpose: one corrupt line cuts scopes that were never damaged.
  That is the chosen half of the trade, because epochs recover and a fail-open crossing of a real
  loss does not. It also closes the MEDIUM (history.quality semantics) and both LOWs (a rejected
  label echoed into a public map, and that map's unbounded cardinality) in one move instead of three
  separate patches: 2000 rejected lines carrying 2000 distinct labels now add zero public keys.
• A scope-local boundary keeps exactly one source, and it was arrived at by testing a hypothesis
  rather than assuming one. A record that PASSES valid_record() and whose own canonical loss
  counters report a loss was measured on the old head to keep history.quality DEGRADED at +2,
  +6 and +60 healthy records, while the identical populations without it promoted every time —
  the same fail-stuck shape the epoch model exists to remove, reached through the one door the epoch
  model did not watch. Such a record now opens a scope-local recovery boundary after itself and
  belongs to the epoch it closes, never to the one it opens. It is trusted where a rejected line is
  not: it passed structural validation, its scope_id is the field every accepted record already
  publishes through scope.known, and the damage fact comes from RECORD_LOSS_COUNTERS.
• Deduplication identity drops the scope-local half of the epoch stamp. Across a file-global
  loss the reader cannot tell whether a repeated run_id is the same run, so both copies stand.
  Across a trusted boundary the file is intact and the repeat is the same run retrying, so its
  cleaner copy cannot enter the recovered epoch and launder the loss its twin reported. Both
  physical orders are frozen cases (VD_10, VD_11).

PARTIAL (a bound the caller asked for), UNKNOWN (a schema that cannot attest completeness) and
INVALID/EMPTY (readable but not comparable) deliberately create no boundary: the repair
target is loss continuity, not every ineligible record.

Found while verifying privacy, not reported by anyone: valid_record() echoed a rejected line's
own schema_version VALUE into history.rejected, which reaches --json, the human report and any
log that keeps them. Truncating it is not a bound — thirty characters of a credential is still the
credential — so only a number is echoed and any other value is named by type.

The limit this repair does not close, stated rather than implied: a legacy flat record carries no
integrity tag, so a corruption that turns one valid record into a different valid record
(scope_id flipped from agent-a to agent-b, a share vector rewritten to another that still sums
to ~100) is indistinguishable from a record the producer meant to write. Nothing here detects that,
and nothing can — the information needed is absent from the format.
LEGACY_STRUCTURALLY_VALID_CORRUPTION_LIMITATION=YES.

Two frozen B1 expectations are superseded rather than quietly re-run, each with its reason and
its replacement recorded in docs/V142_COUNTEREXAMPLES.md §6.6: B1_13e (its middle copy carried a
loss counter, so under the trust model it now opens an epoch instead of sitting inside one) and
B1_15 (its two boundaries came from rejected lines, so the same shape is rebuilt from trusted
ones). The property each protected keeps a case.

New frozen cases: TUTF_01–TUTF_09, TSCOPE_01–TSCOPE_07 with seven label canaries and a
2000-label cardinality attack, VD_01–VD_11, MSG_01/MSG_02, and TPRIV. New mutants:
M_UTF8_REPLACEMENT_ATTRIBUTED, M_REJECTED_SCOPE_TRUSTED, M_REJECTED_SCOPE_GHOST_KEY,
M_REJECTED_SCOPE_CARDINALITY, M_REJECTED_VALUE_ECHOED, M_GLOBAL_DAMAGE_NOT_CUT,
M_GLOBAL_DAMAGE_POISONS_FOREVER, M_VALID_DEGRADED_POISONS_SCOPE_FOREVER,
M_VALID_DEGRADED_CUTS_ALL_SCOPES, M_DEGRADED_RECORD_INCLUDED_POST_BOUNDARY,
M_DEGRADED_RETRY_NO_RECOVERY.

0.0.1 And what an author review of the trust repair itself found

Two rounds of cross-family author review ran on this head. The first returned NEEDS-FIX with a
HIGH, reproduced before it was believed and fixed in 189db57:

The scope-local boundary was opened at READ time, before deduplication, so a copy that was
then discarded as duplicate run_id (retry) still moved the counter — while this reader's own
rule calls a deduplicated retry bookkeeping rather than a loss.

DEGRADED X  ·  6 healthy records  ·  DEGRADED X again
  before: INSUFFICIENT_DATA, records_in_epoch=0, scope_local={"a": 2}
   after: CANDIDATE, records_in_epoch=6, scope_local={"a": 1}, one counted retry

Six healthy records sat between the two copies and none survived, and repeating
6 healthy + one more copy of X held the scope down indefinitely — the fail-stuck shape this
repair exists to remove, rebuilt out of its own recovery mechanism. A boundary is now opened at
most once per (scope, file-global epoch, run_id). A record with no run_id cannot be shown to be
a retry and stays its own observation; a genuinely different second loss still cuts; across a
file-global loss the identity differs, because there the reader cannot tell whether a repeated id is
the same run at all. Frozen as VD_12, VD_12b, VD_13, VD_13b, VD_13c, with the mutant
M_DEGRADED_RETRY_CUTS_TWICE carrying its own positive control.

The same commit carries a second finding, made while verifying that a migration must not read as
file damage rather than reported by anyone: a line holding another tool's record_type in a
shared history was classified unknown record_type and counted as a loss, so a foreign entry cut
the file for every scope. The distinction no shares already draws one check further down now
applies here too — a line that also carries our fields is a corrupted record of ours and stays a
loss; a line that carries none of them is another tool's entry and creates no boundary
(M_FOREIGN_RECORD_TYPE_IS_DAMAGE).

Round 2 returned NEEDS-FIX too, with a HIGH that goes to the root of the trust model's own
rationale. §0.0 justified the one trusted scope-local boundary by saying the record "passed
structural validation and its scope_id is the field every accepted record already publishes". The
first half was true; the second was an assumption. valid_record() never checked scope_id, and
scope_of() is str(r.get("scope_id") or "default") — so a record that passes validation carrying
scope_id = ["rev"] becomes the scope "['rev']":

6 clean rev · one valid DEGRADED record with scope_id = ["rev"] · 6 clean rev
  before: CANDIDATE, records_in_epoch=12, damage {"file_global": 0, "scope_local": {"['rev']": 1}}
          candidate names rid-rev-0..5 AND rid-rev-20..25 — both sides of the loss
   after: CANDIDATE, records_in_epoch=6,  damage {"file_global": 1, "scope_local": {}}
          scope.known == ["rev"], candidate names only rid-rev-20..25

The blocked B-UTF8 defect, rebuilt through the one door this repair opened. The fix is the
producer's own contract rather than a new invention: tools/carry.py writes exactly one shape,
str(scope_id or "default")[:64], so a value of another type or another length was not written by
it. Such a record is refused with a STATIC reason — its content must never be echoed — and is a
file-global loss like any other unattributable one. A control byte inside a label stays accepted
deliberately, because the producer's cap truncates length without stripping control characters, that
label already reaches scope.known on every head of this branch, and calling it corruption would
invent damage where the file is intact. Frozen as TSCOPE_08 with four forged shapes and five
producer-writable controls, plus M_SCOPE_LABEL_UNCHECKED; §6.11 of the counterexample document
states the residual.

This is author review, not acceptance. The verdict on this head belongs to a new independent
reviewer.

0.0.2 And what the author-adversarial review of 71016ee found (head 3 → head 4)

One MEDIUM, reproduced before it was believed and fixed in 6ef9988. It is the last collapse this
reader still made, and it is the same shape as the two blocked heads above, through the last door
left open: identity.

Two materially different valid observations carrying one run_id were treated as a single retry,
so the second loss never opened a boundary.

DEGRADED X1(ts 0,  share 30, unreadable 2, sessions 40, turns 1000, scanned 80)
6 healthy
DEGRADED X2(ts 40, share 66, unreadable 9, sessions 91, turns 2400, scanned 150)
6 healthy                                        [one scope, one file-global epoch]

  before: CANDIDATE, records_in_epoch 12, one scope-local boundary for TWO reported losses,
          "duplicate run_id (retry)" = 1, candidate evidence = 6 records from each side of X2
   after: CANDIDATE, records_in_epoch 6, two boundaries, run_id_conflicts = 1, zero retries,
          candidate evidence = the six records after X2 and nothing else

Nine persisted fields differ between the two records; both pass validation and are independently
DEGRADED. Controls on the old head: a different run_id already gave two boundaries and an epoch
of six, an identical duplicate gave one and twelve, and a file-global loss between the copies gave
two plus one.

run_id is an identity CLAIM, not proof of semantic equality. Two records are the same run only
when their identity and their persisted observation match. Equivalence is a digest of the whole
parsed record with keys sorted — a hand-picked subset would be the same mistake in a new spelling —
so key order and whitespace cannot make identical observations differ, a persisted field this reader
does not know still can, and the reader's own annotations (_history_epoch,
_evidence_quality_floor) are excluded, because reading a file must not change what a record is.

A same-identity pair whose observations differ is a RUN_ID_CONFLICT: the later record is kept,
it is never reported as a retry, and it opens a recoverable scope-local boundary at its own physical
position, belonging to the epoch it closes. Complete-versus-complete counts too, and §7.3 of the
counterexample document argues that row rather than inferring it. Across a file-global loss nothing
changes: the reader cannot establish continuity there, so the later copy is a fresh identity.

One classification now drives the boundary, the deduplication, the quality floor and the
diagnostics. The separate second pass is gone — a boundary layer and a dedup layer holding two
notions of identity is exactly how they came to disagree about one pair.

history.run_id_conflicts is a bounded integer, deliberately outside history.rejected (a
conflicting record is accepted, not a line that failed to become one) and deliberately not a map:
six hundred distinct conflicting ids produce the integer 600 and zero new keys.
output_schema_version stays 2.

Five earlier cases used one run_id for two different observations and asserted a retry. Each is
replaced rather than quietly re-run, with the reason recorded in §7.6 before the edit, and each
keeps the property it protected — now enforced by a boundary instead of by a quality floor, which is
strictly stronger. A consequence stated rather than hidden: a true retry now has the same quality by
construction, so QUALITY_FLOOR is a guard rather than a live path.

The limit this cannot close (§7.4): two physically distinct losses under one run_id with
identical persisted content stay indistinguishable from one identical retry. Line position is
deliberately not used as identity — that would make every true retry open a fresh boundary and
rebuild the fail-stuck behaviour the previous round removed.
IDENTICAL_REUSED_RUNID_LIMITATION=YES.

New frozen rows RID_01–RID_15; new mutants M_RUNID_CONFLICT_TREATED_AS_RETRY,
M_RUNID_CONFLICT_SECOND_LOSS_SUPPRESSED, M_EXACT_RETRY_OPENS_SECOND_BOUNDARY,
M_RUNID_CONFLICT_CROSSES_EPOCH, M_RUNID_CONFLICT_CROSS_SCOPE_COLLIDES,
M_RUNID_CONFLICT_GLOBAL_EPOCH_COLLIDES, M_CLEAN_RUNID_CONFLICT_IGNORED,
M_PRIVATE_ANNOTATION_IN_FINGERPRINT.

This is author work, not acceptance. The verdict on this head belongs to a fresh independent lane.

0.1 What the acceptance review blocked (head 1 → head 2)

The first head of this branch (fe78cbc) passed its own four adversarial rounds and CI. An
independent acceptance review then reproduced the six original defects on main, confirmed all six
were closed here, and blocked the PR on a defect this branch introduced:

container damage was permanent. One torn line — the crash fragment docs/MULTI_AGENT.md
§Concurrency calls an expected event, the one the reader is designed to "reject exactly that line
and count it" — set the whole file DEGRADED forever. Nothing in this product expires, rotates or
repairs a history ("The optimizer does not schedule, expire or rotate"), and --accept-partial
cannot adopt a loss by design, so one crash disabled promotion for every scope sharing
~/logs/carry_history.jsonl, permanently.

Measured on that head, every one of these stayed PARTIAL_EVIDENCE with zero candidates: 6 good + torn; + 2 more; + 6 more; + 60 more; a sibling scope's records; a loss before any record; and
a legitimate zero-carry record. The writer was confirmed to leave the fragment in place: after a
crash it appends a newline and its own record, and the fragment stays line 1 forever.

The replacement is a boundary, not a verdict. An unattributable loss cuts the promotion history
at that line's physical position in the file. Records before the cut never join records after
it, the newest epoch is damage-free by construction, and the loss stays reported.

• damage_boundary() is the one classifier every rejection passes through. A line that parses and
  carries a readable scope_id cuts that scope; a line that cannot say whose record it was —
  unparseable, oversized, a file that would not open — cuts every scope, because guessing would
  be the fail-open half. A foreign line, a schema-4 refusal by design and a deduplicated retry are
  not losses and cut nothing.
• Records are stamped at read time with the epoch they were written in. Physical order, never the
  clock: the clock is exactly what a damaged history cannot be trusted about.
• active_records() is chosen before anything is anchored, so a pre-loss record cannot pick the
  scope, the workload class, the corpus size or the trend for the population after it.
• Deduplication is per epoch: the same run_id after a loss is that population's own observation;
  inside one epoch the retry is still dropped, counted, and still cannot launder the survivor.
• The gap stays visible — history.rejected counts it, history.damage says how many boundaries
  the file holds, and the human report names them — while history.quality describes only the
  evidence eligible for the current analysis.

No time window, no expiry, no ratio, no override flag, no new status, and --accept-partial is
unchanged: it adopts a caller's chosen bound and never a loss.

A cross-family lane then attacked the epoch model itself and found two more places where the repair
still consulted the population it had just cut — both reproduced before being believed, both fixed
here, both pinned by a case and a mutant: a ledger-only finding was still filed under the scope of
the pre-loss records (and the scope travels into the candidate id), and the epoch stamp being a
pair of counts meant two scopes could share one stamp, so deduplication treated one scope's record
as another's retry and pushed its quality onto it. The long-run simulator was also discarding the
epoch it was handed. §5.3 of the counterexample document has both cases.

This is author review, not acceptance: the verdict on this head belongs to a new independent
reviewer.

The same review's two MEDIUMs are repaired with it: history.quality is EMPTY (never COMPLETE)
when nothing is comparable, and a zero-carry sweep is readable evidence, not corruption —
tools/carry.py says so in its own report ("A session whose every item lands on its final turn
carries nothing"), the 1.3 writer emits shares: {} for it, the current writer guards if C else {}, and running accumulate() on such a transcript here returns sessions=1 turns=6 carry=0. The
contradictions stay INVALID: carry with no shares, shares with no carry, sessions without turns,
sessions beyond what was scanned.

docs/V142_COUNTEREXAMPLES.md §5 freezes thirteen B1 rows (status, exit, candidate files,
comparable count, active-epoch size, quality, boundary count) written before the repair existed, §5.1
records zero deviations from them, and §5.2 lists the three earlier expectations the epoch model
supersedes — each replaced together with a companion case proving the protection it carried is still
there.

1. Why PR #7 is not merged directly

PR #7 identified real defects, and an
independent audit against 77e3677 confirmed that most of them are still live. It is not
merged here for two reasons, neither of them about the quality of its analysis:

• it was written against the pre-v1.4 architecture and now conflicts with main (17 files,
  CONFLICTING), and
• main has since grown a typed evidence kernel (tools/evidence/*) that did not exist then, so
  some of PR SameWrite 1.3.1 — fail closed on partial history evidence #7's own additions are either unnecessary here or would duplicate a stronger design.

Its invariants, counterexamples and test matrices are treated as evidence; its implementation
is not copied. PR #7 stays open until this repair is reviewed and released, and the mapping in §7
is what would justify closing it as superseded.

2. The defects, reproduced on current main first

docs/V142_COUNTEREXAMPLES.md freezes thirteen cases — expected status, strict exit code,
candidate-file count, comparable count and evidence quality — written before the repair existed
and then run against 77e3677:

R142_01    CANDIDATE            exit 10  files 1  comparable 6   bounded history promotes
R142_01P   CANDIDATE            exit 10  files 1  comparable 6   --accept-partial changed nothing
R142_02    INSUFFICIENT_DATA    exit 20  files 0  comparable 0   INVALID record anchored, 6 stranded
R142_03    HOST_BEHAVIOR_SHIFT  exit 30  files 1  comparable 6   refusing status still wrote the file
R142_04    CANDIDATE            exit 10  files 1  comparable 6   sessions=turns=carry_bytes=0 promoted
R142_05    carry quality=COMPLETE, malformed=1 / run reports NO_ACTION, exit 0
R142_06    the listing scan read the OLDEST transcript under --max-files 1
U1         CANDIDATE            exit 10  files 1  comparable 6   schema-1 record read as COMPLETE

The four "already correct" controls (P1, P4, S_NOACTION, S_LOCK) behaved correctly before and
still do.

Scope of the exposure, stated plainly: the current writer produces schema-4 envelope records, which
this optimizer refuses by name, so these defects bite a history file written by 1.2/1.3 (or one
authored by hand), not a fresh one. The gate was still absent.

3. The semantic repair

One law, asked of the evidence each finding actually rests on, and one gate on the side effect.

• record_quality() / sweep_quality() — the worst of what evidence claims and what its own
  numbers can show, over the counters the producer has written since schema 2
  (unreadable, oversize, skipped_by_limit). Nothing is invented for an older schema: schema
  0/1 predates evidence_quality entirely, so a schema-1 record carrying COMPLETE is UNKNOWN,
  and a schema-2 record without the counters cannot attest completeness either.
• PARTIAL and DEGRADED are different things. A bound the caller asked for is PARTIAL and
  is exactly what --accept-partial adopts. Evidence that was selected and then lost — unreadable,
  oversize, malformed, identity-changed, conflicting — is DEGRADED, and no flag accepts it.
  carry.LOSS_FIELDS / carry.BOUND_FIELDS is the single vocabulary both sides read.
• Malformed records are a loss. carry.sweep_label() no longer reports COMPLETE for a sweep
  whose transcript lost records to torn JSON.
• eligible_anchor() chooses the comparison anchor — and the analysed scope — from records
  that survive the eligibility filter, so the newest INVALID record can no longer decide the
  corpus size for everyone else and then remove itself.
• The history trend is gated. It was if True:. It is now a CANDIDATE on eligible history
  and an OBSERVED finding carrying the reason otherwise.
• Per-finding evidence. Live findings gate on the sweep, the trend on the eligible history, the
  guard on its own ledger sample. A partial history no longer blocks a live finding it never
  supported, and a clean live sweep no longer waves a bounded history through.
• emit_candidates(findings, outdir, status) writes nothing unless the status is CANDIDATE.
  The gate is inside the emitter, not at its one caller, so the CLI, the long-run simulator and any
  future scheduler all route through it.
• carry.bounded_paths() is the one definition of "the newest N", used by both the carry sweep
  and the skill-listing scan.

CANDIDATE now precedes PARTIAL_EVIDENCE in overall_status(). That is not a loosening: a
finding only reaches CANDIDATE after its own evidence passed the gate, and the old order refused
a valid history-only finding because today's live sweep happened to be bounded.

4. Counterexamples and positive controls

tests/test_evidence_integrity.py — 232 assertions: one case per frozen matrix row, the law's own
unit cases, and the cases the review rounds added (R142_07 … R142_13). A fail-closed patch can look
excellent by refusing everything, so the controls are part of the gate:

• P1 a clean COMPLETE population still promotes (CANDIDATE, exit 10, one file).
• P2 an explicitly accepted bounded population still promotes (--accept-partial).
• P3 an INVALID record in another scope does not poison this one.
• P4 schema-4 evidence stays refused by name; history_schema_supported is still [0, 1, 2].
• S_NOACTION / S_LOCK the strict-exit contract, with the filesystem checked, not the wording.

5. Mutation coverage

Twenty-three new mutants, each restoring exactly one repaired defect, each RED on the mutant and
GREEN on the real source (tests/test_mutation.py, 55/55) — the last eight are the epoch model's:

M_PARTIAL_PROMOTES · M_INVALID_ANCHOR · M_HOST_SHIFT_WRITES · M_MALFORMED_COMPLETE
M_BOUND_SAMPLE_DIVERGES · M_TREND_QUALITY_BYPASS · M_DEDUP_LAUNDERS
M_IMPOSSIBLE_COUNTERS · M_CONTAINER_DAMAGE_IGNORED · M_LEDGER_TORN_PROMOTES
M_EMIT_FAILURE_SILENT · M_BARE_PARTIAL_CLAIM · M_RECORD_LOSS_IGNORED
M_STRUCTURAL_REJECT_NOT_DAMAGE · M_LEDGER_UNKNOWN_EVENT
M_DAMAGE_POISONS_FOREVER · M_DAMAGE_IGNORED_COMPLETELY · M_EPOCH_MERGES_ACROSS_GAP
M_SCOPE_DAMAGE_GLOBALIZED · M_UNATTRIBUTABLE_DAMAGE_SCOPED · M_EMPTY_COMPARABLE_REPORTS_COMPLETE
M_ZERO_CARRY_BECOMES_DAMAGE · M_PRE_DAMAGE_RECORD_ANCHORS

None is a string mutant: every oracle observes a status, a comparable count, a file on disk, a
sweep's quality or a JSON field through a real run.

Four fixtures claimed COMPLETE without the acquisition counters a real sweep always writes
(multi-agent, mutation, long-run, readiness). Each now states them, and each edit is locked by an
added assertion that the same record without them refuses to promote, so the fixture change
cannot hide the gate it was making room for.

6. What did NOT change

• SCHEMA4_OPTIMIZER_SUPPORT=NO — SCHEMA_SUPPORTED is still (0, 1, 2) and a v1.4 envelope is
  still refused by name, with the refusal counted.
• Typed promotion stays shadow-only: tests/test_release_shadow_only.py passes, no promotion
  or candidate-persistence entry point is added, and nothing branches on the product version.
• The schema-4 contract is untouched — proved, not asserted: the encoded v1.4 record for a clean,
  a torn and a bounded sweep has a byte-identical sha256 before and after this branch, and the
  typed reader's loss_observed verdict is unchanged. Only the legacy quality label moved, for
  the torn sweep, which is the defect being repaired.
• SKILL_BODY_DELTA=0, SKILL_DESCRIPTION_DELTA=0, HOOK_BEHAVIOR_DELTA=0 — zero files under
  skills/ or hooks/; CANONICAL_BODY_SHA256=7edec9f21e0bd50583e388e0bdc177f92ba8f0db6ce2bb61acd52b39d81e7767.
  No model-facing byte changes, so no benchmark is required.
• Product version stays 1.4.1 in all three manifests. Packaging, tagging and release are a
  separate gate after review, as they were for 1.4.1.

7. PR #7 property → v1.4.2 replacement

PR #7	status on main	replaced by
H1 impossible/unattested COMPLETE promoted	APPLIES	record_quality() + _derived_record_quality(); cases R142_04, U1, law units
H2 torn JSON leaves the sweep COMPLETE	APPLIES	carry.LOSS_FIELDS + sweep_label(); case R142_05, mutant M_MALFORMED_COMPLETE
H3 candidate stamped effective_evidence_quality: COMPLETE	DOES NOT APPLY (introduced inside PR #7; main never writes that field)	not reintroduced — the quality travels in the finding's evidence line instead
H4 refusing status still writes a candidate	APPLIES	status gate inside emit_candidates(); case R142_03, mutant M_HOST_SHIFT_WRITES
H5 substring artifact check, unreadable = current, invalid UTF-8 crashes	DOES NOT APPLY (introduced inside PR #7; main only tests existence and derives no trust from contents — nothing reads a candidate file back)	ARTIFACT_VALIDATION=DEFERRED_NOT_REQUIRED_FOR_THIS_REPAIR; the typed kernel's classifier already supersedes it for v1.4
M1 candidates_existing turned into prose	DOES NOT APPLY (main reports bare ids)	unchanged, now covered by the JSON assertions
M2 newest INVALID becomes the anchor	APPLIES	eligible_anchor(); case R142_02, mutant M_INVALID_ANCHOR
M3 two definitions of a bounded sample	APPLIES	carry.bounded_paths(); case R142_06, mutant M_BOUND_SAMPLE_DIVERGES

8. Regression

ALL_TESTS=PASS                     seventeen Python suites, 1460 assertions (CI enforces the number)
MUTATION_TESTS=PASS                55/55 mutants RED on the mutant, GREEN on the real source
SHELL_OFFLINE=PASS                 tests/test_oneliner_cleanup.sh; acceptance_public and
                                   acceptance_upgrade pass; acceptance_openclaw needs OPENCLAW_BIN
                                   and fails identically on main (verified in a worktree of main,
                                   byte-identical output) — environmental, not this branch
TYPED_EVIDENCE_REGRESSION=PASS     test_evidence_boundary (472) + test_evidence_phase2 (87)
MESSAGE_ACCOUNTING_REGRESSION=PASS test_multiblock (164) + test_mutation, issue #1 accounting intact
SHADOW_ONLY_REGRESSION=PASS        test_release_shadow_only
AI-VOS                             longrun LADDER=PASS, POLICY_MUTATION=NONE, CANDIDATE_SPAM=NO
                                   readiness 28 PASS / 1 FAIL — the same single pre-existing failure
                                   main has (26/1); this branch adds two passes and fixes none of it

TOTAL_SAVINGS=NOT_PROVEN and WORLD_BEST_CLAIM=NOT_TESTED are unchanged.

9. Adversarial review

Two reviewer families, asked for counterexamples rather than an opinion, on the diff itself.

Round 1 — eight defects, all in the repair, all closed here:

• a retry reusing a run_id could launder its own sweep's quality (found by re-attacking the law)
• schema_version as a string or a float was read as that schema
• zero counters with no sessions / turns / carry_bytes at all read COMPLETE — a share
  vector with no population behind it (both families found this one)
• one unreadable mtime sent the whole bounded selection back to a discovery-order slice
• sessions=40 out of scanned=1 — counters that cannot describe one sweep — read COMPLETE
• damage to the history container (a torn line in the file) never reached the evidence decision
• a ledger that lost a line still retired the guard
• a run could report CANDIDATE and exit 10 while every candidate write failed

Each has a case in the suite and, where it is a behaviour rather than a value, a mutant.

Round 3 — four more, every one of them a word taken for evidence: a PARTIAL claim no counter
could explain was adopted by --accept-partial; the record-level loss vocabulary was two counters
wide while the contract promises more (and the dedup floor inherited the same short list); container
damage was an allowlist, so a rejection reason added later would default to "not damage"; and a
ledger line that is neither checked nor denied counted as nothing at all.

Round 4 — no surviving HIGH. One was claimed (a missing isinstance guard in load_ledger)
and does not exist: the guard is there and a list-valued ledger line is counted as rejected,
verified by running it. Four MEDIUMs were real and are fixed: the live sweep now refuses the same
impossibility the record law refuses; the bounded selection is made ONCE per run and handed to both
consumers, so a transient getmtime failure between two calls cannot produce two samples; a line
that claims to be one of our records and carries no shares is damage rather than a foreign line;
and a candidate write that fails mid-way no longer leaves its .tmp file behind.

Two limits are stated rather than papered over: container damage is a property of the FILE, so a
torn line degrades every scope in it — an unparseable line has no scope to attribute it to — and
HOST_BEHAVIOR_SHIFT still closes the emitter for findings that do not rest on the shifted
population, which is the release contract's ordering, not this patch's.

On the anchor fallback, one reviewer read the eligible_anchor(recs) or newest fallback in
main() as a way for an ineligible record to choose the analysed scope. The observation reproduces — and stops there. The fallback is reached only when nothing
in the file is eligible, so there is no population to strand and nothing to promote: the reviewer's
exact input gives PARTIAL_EVIDENCE, exit 40, zero files. Both halves are now tests (R142_14),
including the same record added to a real population in another scope, where the eligible records
still choose the scope and still promote.

One deliberate narrowing came out of this: the first cut of container damage degraded the history
for any rejected line, so one stray hand-written line in a shared file would have blocked a real
population forever. Damage is now a torn line, an oversized line or an unreadable file; a foreign
line that parses, and a refusal by design, are counted and reported without degrading. A corrupted
carry record that still parses as JSON is reported and does not degrade — stated as a limit
rather than implied as coverage.

10. What a reviewer should attack

The law's calibration is the judgement call, not the plumbing: a schema-1 history can no longer
promote anything, because the generation that wrote it had no field to say how the sweep went. If
you think a record with no acquisition facts should still carry a promotion, this is the line to
argue with — it is one function, record_quality(), and every case that depends on it is in
docs/V142_COUNTEREXAMPLES.md.