Install the §5 closure ordering and replace what it falsifies (0.13.0)

.context/codex-reviews/gate-a-plan-CLOSURE.2026-08-12-ledger-supersession.md

@@ -0,0 +1,108 @@
+# Gate A — plan — CLOSURE RECORD
+
+**Cycle:** a supersession convention for the hardening ledger.
+**Plan:** `docs/superpowers/plans/2026-08-12-hardening-ledger-supersession.md`
+**Spec:** `docs/superpowers/specs/2026-08-05-hardening-ledger-supersession-design.md` (its own Gate A
+closed at pass 23 — `gate-a-spec-CLOSURE.md`).
+**Branch:** `ledger-supersession`. **Closed 2026-08-12 on plan pass 7.**
+
+**Gate A (plan) is CLOSED.** `superpowers:executing-plans` is open — sequential, mirror edits in the
+same commit. Passes 1–7 applied in full; nothing is held.
+
+Reviewer for all seven passes: `mcp-codex-dev@1.0.1`, `codex-cli 0.144.5`, model `gpt-5.6-sol`.
+Every pass satisfied the file-first protocol: terminator exact, count matching, no non-finding body
+lines. No pass was INCOMPLETE; the recovery budget was never spent.
+
+## Why it closed here
+
+Pass 7 returned **two findings, both Minor, zero Blocker and zero Major**. §5's loop is a
+Blocker/Major loop — Minor and Nit are collected, never iterated — so a pass with none is its exit
+condition, and both Minors were applied rather than collected because each was a one-line
+cross-reference fix.
+
+## Trend
+
+| Pass | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
+|---|---|---|---|---|---|---|---|
+| Findings | 18 | 11 | 9 | 8 | 6 | 2 | 2 |
+| Blocker | 2 | 1 | 4 | 3 | 1 | – | – |
+| Major | 12 | 8 | 2 | 4 | 3 | 2 | – |
+| Minor | 4 | 2 | 3 | 1 | 2 | – | 2 |
+
+Monotone in the count from pass 2. The Blocker spike at pass 3 was not a regression: those four had
+been latent since pass 1 and surfaced only once the surrounding defects cleared. Both severity
+columns reach zero together.
+
+## Two cuts applied before pass 1, by the sweep
+
+- **428 lines of shell** across 31 fences, against spec §6's own "the executable form is written at
+  execution time, carried in the plan with one label per check" → cut to labels, properties and
+  oracles. Zero lines of shell remain.
+- **Check 1's candidates were never bounded** to the label-to-`Columns:` interval, contradicting
+  §6's own 1d oracle — which is also §8 held item 4's trace.
+
+## What the passes actually caught
+
+**Two Blockers about the Gate-B mechanics** (pass 1): the consolidation reset to *the parent of the
+first WIP* and then reviewed an empty range, with the closing `--amend` set to rewrite `BASE`
+itself; and a Gate-B fix was to be "re-reviewed" without being amended into the WIP commit, so
+`mcp__codex__review` would have re-read the **stale** committed range and reported a clean pass on
+code it never saw.
+
+**Two Blockers where the validation violated the convention it validates** (pass 3): `C1b`'s
+counter-check mutated the real 2026-07-20 row and `C3`'s moved the real block and added and removed
+a complete entry — operations §2.1 and §2.2 forbid the moment the text exists, committed or not, in
+the very file the convention is being added to. Every such mutation now runs on a scratch copy, with
+the boundary stated: *prose* mutations are covered by neither rule and stay in place.
+
+**Two staging Blockers** (passes 2 and 4): `git add -A` would have swept the untracked
+`docs/research/` tree and the executor's fixtures into a commit or an amend; and `git reset --soft`
+cannot be repaired by adding paths, because an explicit `add` does not *unstage* an extra one — so
+the equality assertion would have halted execution with no route forward. Now `--mixed`, five named
+paths, and an asserted cached set.
+
+**One Blocker per pass, 3 through 5, of one shape: a fix that landed in one site and not in its
+mirror.** §8's held-not-fixed intro still said Gate B reviews the checks after §6 had been corrected
+to say the opposite; the plan promised the reviewer a paste of the check source that
+`additionalContext` did not carry; `BASE` contained the plan while §8 claimed the plan was inside the
+reviewed range. Naming that failure mode in the pass-5 and pass-6 prompts is what drove it to zero.
+
+## Settled decisions
+
+| Decision | Settled at |
+|---|---|
+| **The plan carries labels, properties and oracles; no executable form** | pre-pass sweep |
+| **Eight labels** — `C1a`–`C1d`, `C1f`, `C2a`, `C2b`, `C3`; **spec 1e is not implemented**, recorded in §8 | pass 1 |
+| **Gate B compares the implementation range only** — neither the plan nor the checks are inside it; both reach the reviewer as context | passes 3–5 |
+| **Spec §6 governs, except on the four §8 held-not-fixed items**, where the plan's remedies are authoritative | pass 1 |
+| **No counter-check may mutate a row or a complete entry in the real ledger**; prose mutations may stay in place | pass 3 |
+| **Never a pathspec broader than the step's file list**, with the staged set asserted before every commit and amend | passes 2, 4 |
+| **The evidence entry is one artifact**, composed before the first Gate-B call, carrying the story path inside it | passes 4, 6 |
+| **One baseline, one advertised mutation per fixture**; seventeen rows with expected outcomes, PASS rows as well as FAIL | passes 2, 6 |
+| **Five labels fail on the untouched tree** — `C1a`, `C1d`, `C2a`, `C2b`, `C3`; `C1b` and `C1c` are protective | pass 1 |
+
+## The four §8 held-not-fixed items, traced
+
+1. **row-date equality** → `C1d`.4 plus the `entry-wrong-rowdate` fixture — executable.
+2. **the pre-narrowing "prose-only" claim** → the Global Constraint stating §2.2 governs — wording,
+   which is all this one admits.
+3. **plural scope** → `C1d`.1 plus `entry-good`'s second inert entry — executable, as of pass 2.
+4. **the format-example guard** → `C3` plus Task 5's below-the-table counter-check — executable. Not
+   `C1d`.2, which *ignores* a line outside the interval rather than detecting one; that
+   mis-attribution was itself a pass-4 finding.
+
+## Spec edits made during the plan cycle
+
+Five, each from a plan-pass finding: §6's "reviewed by Gate B against the real diff" corrected to
+*supplied to the reviewer alongside* it; §8's held-not-fixed intro brought into line; a new §8
+residual recording that the checks are never fingerprinted and that `battery+check` evidence is
+produced by unfingerprinted code; the §8 record that check 1e is not implemented; and the §6 anchor
+oracle's false "two begin with `-`" corrected to one.
+
+## Where everything lives
+
+- **Uncommitted at closure:** the spec, the story and this plan. Task 1 of the plan commits all
+  three and pins `BASE`.
+- **On disk only, gitignored:** `.context/codex-reviews/` — seven plan pass files, their
+  dispositions, this record, and the spec cycle's twenty-three. `.gitignore:13` ignores `.context/*`;
+  a push does not back these up.

.context/codex-reviews/gate-a-plan-CLOSURE.md

@@ -0,0 +1,69 @@
+# Gate A — plan — **CLOSED on dispositions, with four post-pass fixes**
+
+Closed 2026-08-16 by Daniel's decision, after pass 6.
+
+| Pass | 1 | 2 | 3 | 4 | 5 | 6 |
+|---|---|---|---|---|---|---|
+| Findings | 18 | 20 | 17 | 15 | 9 | 9 |
+| Blockers | 1 | 0 | 1 | 1 | 1 | 1 |
+
+**88 findings, none dismissed.** Six passes; the floor was met at pass 3 and the loop continued
+because no pass was clean.
+
+## Why this closes on dispositions rather than a clean pass
+
+**The checker's verification channel is execution, not review.** Every defect check 4c ever
+had was found by running it, and none by reading it:
+
+| Defect | Found by |
+|---|---|
+| Fence-mode parser returned `MULTIEND` on the real file — the check could never pass | running the `awk` against `workflow-init.md` |
+| `checklist parser failure fires` had stopped testing 4b (its grep matched 4c's diagnostic too) | the mutation run — 21 flips against a recorded 22 |
+| Whole-file counting silently dropped the placement guarantee | planting the line in the command file's prose and watching the battery stay green |
+| Placement failed open when its terminator moved | renaming `### 2.2` and planting a line in the widened gap |
+
+Four review passes read the first as prose without finding it. The last two were found in
+minutes by executing the thing.
+
+**So the remaining assurance comes from the tools and from Gate B, not from a seventh pass.**
+The scripts are in the reviewed range: `baseSha` = `c0a6ed2`, and the WIP snapshot carries
+`scripts/check-invariants.{sh,test.sh}` along with the spec and this plan. Gate B reads them
+**as code**, which is the review they should have had all along.
+
+## The four post-pass fixes
+
+1. **Terminator validation.** The placement range's end must be `### 2.2`; anything else fails
+   loudly, naming what it found. Three fixtures, including the verified exploit — rename the
+   terminator, plant the line in the widened gap. Confirmed rejected.
+2. **Mutation re-measured.** 4c flips **19** (18 rejects + the parser case), no accept case
+   moved. It read 13 before the placement fixtures and 16 before the terminator ones; each
+   superseded number was replaced by re-running, never extrapolated. The block now says so.
+3. **Task 0 deleted.** It committed the spec, plan and scripts immediately before the WIP —
+   making that commit the WIP *parent*, which `baseSha..HEAD` excludes, so Gate B would have
+   excluded exactly what it existed to include. It was also a non-WIP commit of executable
+   code with a red battery and no Gate-B loop. The one-line fix it should have been: the WIP
+   snapshot carries those four files, `baseSha` = `c0a6ed2`.
+4. **Self-review and inventory rewritten from the code as built** — `severity_rule_scan <file>`
+   returning four integers, not the withdrawn `severity_rule_count(file, mode)` sentinel API;
+   24 `sev_case` cases, not 15. And Task 4 Step 4 now follows §6's settled **TRIGGER FIRED**
+   rather than reopening it.
+
+## State at closure
+
+- **148 assertions** green under `sh` and `dash` (123 before), shellcheck clean on both scripts.
+- **The counterfactual is observed, not asserted:** with 4c present and the canonical line not
+  yet in either prompt copy, `sh scripts/check-invariants.sh` exits 1 naming only 4c on both
+  files. The battery is **red by design** until Task 1's prose edits land.
+- Uncommitted: the twice-amended spec, this plan, both scripts. `c0a6ed2` is the only commit.
+
+## What Gate A did not settle
+
+The plan's prose has been the slow part, not the design: passes 5 and 6 were dominated by
+descriptions going stale as the code changed under them. Gate B reviews the code and the
+shipped prompt text; it does **not** re-review this plan. A reader following the plan should
+treat the built scripts as authoritative where the two disagree.
+
+## Next
+
+Execution: test-first, battery green before the Gate-B loop, §5 cited rather than restated,
+evidence per `battery+check` with the observed counterfactual.