diff --git a/docs/plans/graph-port-A-shadow-2026-09-03.md b/docs/plans/graph-port-A-shadow-2026-09-03.md
index a258db12..27d3281b 100644
--- a/docs/plans/graph-port-A-shadow-2026-09-03.md
+++ b/docs/plans/graph-port-A-shadow-2026-09-03.md
@@ -1,10 +1,10 @@
 # Graph port, Plan A: store, ingestion and the Q5 harvest subgraph in shadow
 
-Status: revision 4, 2026-09-04. Gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. This revision awaits Max's decision on how it is approved (a third gate, or his own approval for shadow-only work with the residual findings logged). Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact.
+Status: revision 11, 2026-09-05. Gate 20260905-164552-plan-b373bd2b round 1 accepted the revision-10 capacity amendment without finding and requested one A-2 topology change, folded here: at the pinned executor a failed string verdict does not by itself block downstream execution (`_blocked_by` blocks only consumers of unavailable typed artifacts and descendants of execution-unreached nodes), so every gate that must stop execution downstream now emits a typed artifact that its dependents consume, the expected-state vocabulary distinguishes EXECUTED-FAILED from UNREACHED, and fixtures cover both dependency types cold and warm. Revision 9 was AGREED by gate 20260905-162709-plan-c185a30c (round 2 approve, 16:34 EDT). Revision 10 amended ONE resource rule and nothing else, at the Microcosm US session's request under Max's steering to maximise parallel work: A5 and the matching §5 do-not now permit the isolated A-1/A-2 engineering lane to be routed upward to Astra on a Codex home when every Claude lane is capped (measured by return code, never by the status table), subject to CEREMONY PRECEDENCE on that home and a recorded window state at dispatch; the Claude path stays the default and is used whenever it is available first. It is submitted to a fresh gate. Earlier: gate 20260905-162709-plan-c185a30c on revision 8 requested three runtime-contract changes, all folded here against the pinned executor: (i) every owned output of a gate-role kernel is a STRING (executor.py:130 rejects any non-string owned output on the exception path, so a mixed string/boolean gate cannot persist failed-gate evidence), with a mixed-output exception fixture that must fail; (ii) RELEASE's `requires_decisions` names DECISIONS supplied at run time (executor.py:219–249), not ancestral gates, so the required decision tuple is frozen and validated independently of the ancestral gate set, with missing- and wrong-decision checks on warm replay; (iii) A-2's execute-cold / hit-warm assertions are scoped per fixture to the frozen expected state (executed, refused, unreached), because a missing required source is rejected before any kernel runs (executor.py:1922–1924) and a gate exception leaves dependents unexecuted. Revision 7 was AGREED by the third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer, round 5 approve, 16:12 EDT; proceed authorized). Revision 8 amends exactly one adopted decision and one rule, on the Microcosm US session's interface-confirmation memo (`~/architecture-reviews/microcosm-20260904/dynamics-q5-current-graph-interface-check.md`, SHA-256 485ea3d327b71d2aa9b7f654f0453cdf65c763821a060dc9415f7be951465d9c; companion receipt SHA-256 8d780c99c401536d52e522dd779e9493a66768a75d341130f2148a4663f7cbed): (A2) the gate-recorded TCB pin moves from microcosm `6022e4f5` to `b55a583f078b3d182c65980f24a4d5a119f169bc`, a NEW TCB, because the A-2 interfaces do not exist at `6022e4f5`; (§1/A-1) the store, codec registry and typed artifact facilities are CONSUMED from the core at that pin, not reimplemented; (§4) gate kernels own a string outcome column. It is submitted to a fresh gate; nothing else moves. Earlier: the third gate's rounds 2, 3 and 4 requested changes, all folded in revisions 5–7: (00, round 4) applicability is declared separately for report-derived and T-derived fields, so an attempt voided after its canonical report but before its T keeps the full report comparison and marks only the T-derived fields ABSENT-BY-DISPOSITION, with a report-bearing-void fixture (§4); (0, round 3) the legacy comparison now carries a per-event-type applicability map with explicit absence semantics — a voided attempt or supersession that never produced a canonical report or T bytes is compared on its disposition schema with those fields marked ABSENT-BY-DISPOSITION, which satisfies A-2 and counts toward EVIDENCE-COMPLETE, while an event whose class requires a payload and lacks one is MISSING REQUIRED EVIDENCE and fails; fixtures cover both (§4); (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact.
 
 ## 1. Scope
 
-IN: (a) a content-addressed store outside e8-ops with a codec registry; (b) a trusted-computing-base (TCB) recomputed at preflight, covering the runtime and the whole evidence toolchain, bound into every node key, run and report; (c) read-only ingestion of the campaign's stable canonical staged bytes as NONAUTHORITY source caches; (d) the Q5 harvest/transport subgraph run in SHADOW beside the bespoke harvest; (e) a parity harness with frozen legacy schema, graph oracle, mutation manifest, recovery/failure matrix and named negative fixtures; (f) a shadow backfill of every event in a frozen cohort manifest; (g) a parity report per document and a closing census by multiset equality.
+IN: (a) a content-addressed store outside e8-ops, bound to the core's `ContentStore`, `SourceCodecRegistry` (`register_bytes` / `raw-bytes-v1`), `SourceRef`, typed `ArtifactType`/`ArtifactInput`/`ArtifactOutput` edges, `Owned` cells, gate roles and RELEASE `requires_decisions` at the A2 pin — Plan A reimplements none of those facilities and adds only the Q5 kernels, codec mappings, source declarations, the occurrence/document Frame (`EntitySchema(person_entity='occurrence', group_entities=('document',))` with unit weights) and the parity harness; (b) a trusted-computing-base (TCB) recomputed at preflight, covering the runtime and the whole evidence toolchain, bound into every node key, run and report; (c) read-only ingestion of the campaign's stable canonical staged bytes as NONAUTHORITY source caches; (d) the Q5 harvest/transport subgraph run in SHADOW beside the bespoke harvest; (e) a parity harness with frozen legacy schema, graph oracle, mutation manifest, recovery/failure matrix and named negative fixtures; (f) a shadow backfill of every event in a frozen cohort manifest; (g) a parity report per document and a closing census by multiset equality.
 
 OUT (Plan B, gated separately with Plan A's evidence): any harvest cutover or authority handoff; any board line, seal record or pointer index that cites a graph manifest; the campaign verifier's trust root and profile; the post-ratification successor DAG; the benefit-level gate; record retirement; any change to lane briefs, templates, harvest rules, ledger or library folds, `#405`, `e20-amend20`, `docs/design/` or the registry.
 
@@ -17,33 +17,34 @@ OUT (Plan B, gated separately with Plan A's evidence): any harvest cutover or au
 
 A1. Source model. Every declared, pinned source class is ingested: stable canonical staged report bytes (the only admissible form of a lane report — never raw lane `.out` or worktree outputs), briefs, ledger and library versions, rubric notes, PDFs, artifact JSONs and commit-pinned board ruling bytes, each hashed by name, bytes and size. The staged-bytes restriction applies to lane-report alternatives only; omitting any other declared source class fails A-1. No kernel calls an engine. Deterministic post-lane transformations are kernels; transport and seal checks are gate-role kernels that own at least one column read by the release. Determinism is a dynamics-side rule enforced by review and by the parity harness, not by the executor.
 
-A2. TCB attestation over the runtime and the evidence toolchain. The gate-recorded pin is `microcosm` `origin/main` at commit 6022e4f5c8af31d62fddd1c7dbd1ab9eea81b0f6 (pre-#847). After implementation and before any acceptance run, a reviewed evidence-toolchain bundle is frozen and its digests recorded: the attester itself, the ingestion and H/H2 enumeration code, the parity comparator and report generator, the campaign kernels and codecs, and the frozen mutation manifest, graph oracle, recovery/failure matrix and legacy schema bytes. Before any cache lookup, the attester recomputes the TCB from the actually loaded graph/frame/executor files, the registry name-to-loader mapping, kernel and codec files, the interpreter executable/ABI, installed distribution files and the toolchain bundle; it rejects any mismatch with the recorded commit and digests and uses the recomputed digest as the store namespace. The TCB manifest is a declared source of the CREATE node and of every descendant node, so it enters every key, and its digest is bound into every run and report. Any change to any TCB component invalidates all Plan-A evidence and requires a complete cohort rerun; A-5 rejects mixed-TCB results. Adopting #847 is a new TCB and a full rerun.
+A2. TCB attestation over the runtime and the evidence toolchain. The gate-recorded pin is PolicyEngine/microcosm commit `b55a583f078b3d182c65980f24a4d5a119f169bc` ("Authenticate candidate payload identities and bound local transport reads", 2026-09-05 15:22 EDT), which the Microcosm US session froze for its interface check. Publication state at pinning: that commit is a strict descendant of `origin/main` `c1b8324183819cf91511c002bf724a2676524e87` and was not yet on any remote branch, so build agents read it from the local object store and its first appearance on a remote is a recorded event, not a pin change. The previous pin, `6022e4f5c8af31d62fddd1c7dbd1ab9eea81b0f6` (pre-#847), lacked `SourceCodecRegistry.register_bytes`, the `raw-bytes-v1` reader, and the typed `ArtifactType`/`ArtifactInput`/`ArtifactOutput` edges (all present at `b55a583f` in `packages/microcosm-graph/src/microcosm/graph/codecs.py` and `decl.py`); moving to `b55a583f` is a new TCB under this same paragraph's rule, and no Plan-A result exists yet to rerun. The memo confirms the ENGINEERING interface only: it approves no attestation, hermeticity, or source/scientific authority, and the §5 do-not on declaring `Tolerance` or entrants (#847) is unchanged. After implementation and before any acceptance run, a reviewed evidence-toolchain bundle is frozen and its digests recorded: the attester itself, the ingestion and H/H2 enumeration code, the parity comparator and report generator, the campaign kernels and codecs, and the frozen mutation manifest, graph oracle, recovery/failure matrix and legacy schema bytes. Before any cache lookup, the attester recomputes the TCB from the actually loaded graph/frame/executor files, the registry name-to-loader mapping, kernel and codec files, the interpreter executable/ABI, installed distribution files and the toolchain bundle; it rejects any mismatch with the recorded commit and digests and uses the recomputed digest as the store namespace. When execution runs in a hermetic image (A2a(i), first alternative), the complete image identity (the image digest and the digests of every layer actually loaded) and the exact allowed semantic-environment values (the environment and input allowlist as resolved, including interpreter flags, locale, timezone and hash-seed settings) are TCB components: the attester records them, recomputes them before any cache lookup, and treats a change to any of them exactly as it treats a toolchain change — the populated old namespace is rejected before any cache read and a new namespace is derived. When the alternative closure approach is used instead, the hashed closure (standard library, transitive native libraries, import hooks and resolution, semantic environment) is the TCB component in the same way. In neither case may two images or two environment resolutions share a cache namespace. The TCB manifest is a declared source of the CREATE node and of every descendant node, so it enters every key, and its digest is bound into every run and report. Any change to any TCB component invalidates all Plan-A evidence and requires a complete cohort rerun; A-5 rejects mixed-TCB results. Adopting #847 is a new TCB and a full rerun.
 
-A2a. Evidence-grade closure (carried to Plan B; a Plan A prerequisite for the word "evidence"). No shadow result is certification evidence until: (i) execution runs in a read-only hermetic image with an environment and input allowlist, or the complete loaded closure (standard library, transitive native libraries, import hooks and resolution, semantic environment) is hashed and traced, undeclared filesystem, clock, randomness and network inputs are denied, and the closure is verified again after execution; (ii) an independently trusted, gate-owned recomputation of raw bundle, run and report bytes exists outside the attester, with tamper tests for every TCB component against a populated old namespace proving rejection before any cache read. Until then Plan A outputs are labelled SHADOW-ONLY, NOT EVIDENCE.
+A2a. Evidence-grade closure (carried to Plan B; a Plan A prerequisite for the word "evidence"). No shadow result is certification evidence until: (i) execution runs in a read-only hermetic image with an environment and input allowlist whose image identity (image and loaded-layer digests) and resolved allowlist values are bound into the TCB per A2, or the complete loaded closure (standard library, transitive native libraries, import hooks and resolution, semantic environment) is hashed and traced, undeclared filesystem, clock, randomness and network inputs are denied, and the closure is verified again after execution; (ii) an independently trusted, gate-owned recomputation of raw bundle, run and report bytes exists outside the attester, with tamper tests for every TCB component against a populated old namespace proving rejection before any cache read. Until then Plan A outputs are labelled SHADOW-ONLY, NOT EVIDENCE.
 
 A3. No authority. Every shadow manifest is NONAUTHORITY. Decision records are nonselecting provenance; nothing in Plan A selects an active record, cites a manifest on the board, or retires or rewrites any record. The bespoke harvest remains the sole authority throughout.
 
 A4. Storage. Outside e8-ops in a dedicated private location. For every source, before any copy or replica: record access classification, license/replication permission, approved destination and backup owner, repository/binary limits, retention, access controls, and required encryption; do not copy or replicate a source until those checks pass. Copied source payloads are NONAUTHORITY caches preserving canonical paths and storage identities. Inventory source bytes, columns, node-key duplicates, attempts and metadata before choosing Git, Git LFS or private object storage; name the backup owner and off-host replica; clean-store restore-and-rehash drill before acceptance; no capacity ceiling asserted until measured.
 
-A5. Capacity. Build agents run on Claude capacity separate from the campaign's lanes and from the orchestrator's lane, and pause if harvest, A4/C20 or referee capacity is threatened. No codex lane-hours are consumed by Plan A except the gate peer's own review.
+A5. Capacity. Build agents run on Claude capacity separate from the campaign's lanes and from the orchestrator's lane, and pause if harvest, A4/C20 or referee capacity is threatened. Codex lane-hours are consumed by Plan A only for (i) the gate peer's own review and (ii) the isolated A-1/A-2 engineering lane when it is routed upward to Astra because every Claude lane is capped — established by a fresh return code from each candidate lane, never by the status table — and then only under CEREMONY PRECEDENCE: no build dispatch on a Codex home while an Amendment-20 ceremony step (A4 freeze or re-freeze, scratch transition, receipt, referee verdict, closure, repin, or the PR #405 gate peer) is running on it, the dispatch records the home, its measured five-hour and weekly window state and the routing decision in the run's ledger entry, and the lane pauses or is not started if a ceremony step needs the home. The Claude path remains the default and is used whenever a Claude lane frees first. The served model and lane are reported in the parity report; a build that ran on Astra is labelled as such and confers nothing.
 
 ## 4. Sequence and acceptance
 
-States. Two acceptance states are distinct: EVIDENCE-COMPLETE (every cohort document and event has a shadow result under the A-2 contract) and PARITY-PASS (zero governing discrepancies). Any governing residue makes the parity verdict FAIL for the cohort; A-5 labels such a cohort as failed parity, never as positive evidence. H2 stopping rule (frozen before A-3 starts): A-3 runs for at least 7 calendar days and until at least 12 live events spanning every event class that occurs in that window (harvest, seal, void/repair, supersession or replication if any occur) have been shadowed; H2 may not be chosen retroactively; the latency population is every live event's harvest-to-shadow-complete interval, with failures, retries, residues and censored runs reported separately and never dropped.
+States. Two acceptance states are distinct: EVIDENCE-COMPLETE (every cohort document and event has a shadow result under the A-2 contract, where a result for an event whose class carries no canonical report or T bytes is complete when its disposition schema declares those fields ABSENT-BY-DISPOSITION) and PARITY-PASS (zero governing discrepancies). Any governing residue makes the parity verdict FAIL for the cohort; A-5 labels such a cohort as failed parity, never as positive evidence. H2 stopping rule (frozen before A-3 starts): A-3 runs for at least 7 calendar days and until at least 12 live events spanning every event class that occurs in that window (harvest, seal, void/repair, supersession or replication if any occur) have been shadowed; H2 may not be chosen retroactively; the latency population is defined per event class: for harvest events, harvest-to-shadow-complete (start = the canonical staged report's commit-pinned board timestamp); for seal, void, repair, supersession and replication events, event-to-shadow-complete (start = the commit-pinned timestamp of the board ruling or event line that creates the event, never a harvest timestamp of the document concerned, which may predate the event or, for a voided attempt, not exist); shadow-complete is the timestamp of the shadow run's report write. Each class is reported as its own population; harvest-to-shadow-complete is retained separately for harvest events and is never pooled with the other classes; failures, retries, residues and censored runs are reported separately and never dropped.
 
 Cohort definition and closing census. At an exact immutable board commit/event H, freeze a content-hashed occurrence manifest listing every document, attempt, canonical staged report, repair, full source digest/path/storage identity, and disposition, each with an immutable coordinate and identity. A-4 covers every event at or before H; A-3 covers every canonical harvest, seal, void, repair, supersession, and replication event after H through a closing coordinate H2, each assigned the same immutable coordinate/identity scheme. At H2, produce a second occurrence manifest in the same schema, re-enumerate the authoritative record, and require multiset equality with explicit missing/duplicate detection. Every post-H source delta passes the same A-1/A4 ingestion checks as the initial cohort. Boundary, duplicate, outage and omitted-event cases are tested against the census.
 
 Frozen oracles (recorded in the toolchain bundle before any acceptance run):
-- Legacy schema: for every cohort document and event, the closed set of legacy fields compared exactly against the pinned canonical report and T bytes: ordered decoded rows, row counts, per-frame and stream digests, transport outcome and its complete evidence, seal outcome and its complete evidence, reconstructed T bytes, T row count and T digest. Missing or extra fields fail.
+- Legacy schema: for every cohort document and event, the closed set of legacy fields compared exactly against the pinned canonical report and T bytes: ordered decoded rows, row counts, per-frame and stream digests, transport outcome and its complete evidence, seal outcome and its complete evidence, reconstructed T bytes, T row count and T digest. Missing or extra fields fail. APPLICABILITY MAP (frozen with the schema): the legacy fields are partitioned into two axes — REPORT-DERIVED (ordered decoded rows, row counts, per-frame and stream digests, transport outcome and its evidence, seal outcome and its evidence) and T-DERIVED (reconstructed T bytes, T row count, T digest) — and each event class declares applicability for each axis separately, from the authoritative disposition of the event, never from what happens to be on disk. Harvest, seal, repair and replication events with both payloads apply both axes. An attempt voided, superseded or otherwise closed AFTER its canonical report exists but BEFORE its T was produced applies the report axis in full and marks every T-derived field ABSENT-BY-DISPOSITION; an event whose canonical record never produced a report applies neither axis and marks both. Each inapplicable field is present with the single marker ABSENT-BY-DISPOSITION and the disposition identity that explains it; the comparison for the inapplicable axis is over the per-event-type disposition schema. EXPECTED ABSENCE (the marker exactly where the map permits it, per axis) satisfies A-2; MISSING REQUIRED EVIDENCE (a field an applicable axis requires that is absent or unchecked, or a marker on an axis the map declares applicable) fails, so a report-bearing void can never be declared evidence-complete with its report-derived evidence unchecked. Fixtures: a voided attempt with neither payload passes with both axes marked; a voided attempt with a canonical report and no T passes only if every report-derived field is compared and only the T fields carry the marker, and fails if any report-derived field is absent or marked; a harvest event lacking its pinned report fails.
 - Graph oracle: a separately frozen schema for graph-only fields: node keys, exact gate IDs and order, ancestry, tier/outcome mapping and required evidence fields. Missing or extra evidence fields fail.
 - Mutation manifest: each source digest, exact semantic mutation or omission, and expected row/field/verdict or typed-refusal code. Key changes alone never count. A governing mutant with unchanged semantics fails; a decoy mutation changes identities but leaves semantic rows, verdicts and evidence unchanged apart from provenance. Mutant kernels that ignore a governing source or consume a decoy must make the harness fail.
-- Per-event-type schemas (carried to Plan B; required before any void, repair, supersession or replication shadow result is called evidence): for each event type, an exact identity, disposition, ruling digest, supersedes edge and replica source/destination with a derivation projection, plus wrong-disposition, wrong-ruling, wrong-supersedes and wrong-replica fixtures that must fail.
+- Per-event-type schemas (carried to Plan B; required before any void, repair, supersession or replication shadow result is called evidence): for each event type, an exact identity, disposition, ruling digest, supersedes edge and replica source/destination with a derivation projection, its entry in the applicability map above for each of the two axes, plus wrong-disposition, wrong-ruling, wrong-supersedes, wrong-replica and wrong-absence (a marker on an applicable axis, a payload on an axis the map declares absent, or a report-bearing void whose report axis is marked instead of compared) fixtures that must fail.
+- Gate outcome rule (from the interface check, corrected against the pinned executor): EVERY owned output of a gate-role kernel is a STRING column — the outcome and any check cell alike — because the pinned executor's exception path (executor.py:130) validates every owned output and raises NodeRejected on any non-string one, so a gate that mixes a string outcome with a boolean or numeric cell aborts on an exception without persisting failed-gate evidence. Boolean or numeric owned cells are permitted only on non-gate kernels. Fixture: a gate kernel with a mixed string/boolean output set raising an exception must FAIL the harness (no failed-gate evidence persisted); a gate with all-string outputs raising the same exception must persist the failed-gate outcome. RELEASE owns exactly one string `tier` column whose value must agree with the executor's ancestral gate derivation. `requires_decisions` names DECISIONS supplied at run time (matched by decision name, executor.py:219–249), which is a separate contract from gate ancestry: the plan freezes the required decision tuple (exact names, non-empty) and the expected ancestral gate set independently, and the harness validates both — the tuple against the supplied decisions on cold and on warm replay (a missing or wrongly named decision must leave RELEASE `unreached`, and the fixture decision must yield `pass`), and the gate set against the RELEASE receipt's ancestry; because the runtime permits an empty default tuple and derives ancestry separately, an empty tuple, a tuple of gate IDs, or a wrong gate set each fails the harness explicitly.
 - Recovery/failure matrix: recovery passes only when commit-pinned ruling bytes and redundant serialization/cross-receipts uniquely authenticate the reconstruction; raw bytes, reconstructed bytes, proof and ruling are persisted. Every historical positive recovery is tested, and for each, removal or substitution of every individual proof element must persist a gate failure. Named negative fixtures with stable typed refusal codes cover malformed, truncated, noncanonical, wrong-sentinel, wrong-count, wrong-digest, stale, swapped, conflicting and ambiguous evidence; none may certify or pass.
 
 | Step | What | Owner | Accepted when |
 |---|---|---|---|
 | A-1 | Store, codec registry, TCB attester and toolchain bundle, ingestion of the cohort manifest's sources and of every post-H delta | build agents; this session reviews | every ingested source re-hashes to the SHA cited in the campaign record; canonical paths and storage identities preserved; no Plan-A write to e8-ops, verified by attribution audit; only stable canonical staged bytes ingested; the attester passes against the recorded commit and toolchain digests and its recomputed digest namespaces the store and appears as a source in every node key and in every run and report; restore-and-rehash drill passed from a clean store |
-| A-2 | Q5 harvest/transport subgraph (CREATE occurrence universe with `document` as the group entity and unit weights; `q5.decode_lane@1`; `q5.transport_gate@1`; `q5.reconstruct_T@1` owning digest columns; `q5.seal_gate@1`; `q5.harvest_seal@1` RELEASE with real gate ancestry and nonempty `requires_decisions`) against the frozen oracles | build agents; this session reviews | for every cohort document and every mutation and recovery case: cold-A and cold-B executions in fresh interpreters on distinct physical, verified-empty stores execute every kernel with hit=false for every node and agree on canonical stored payload bytes and independently recomputed payload hashes; the unchanged warm run in a fresh interpreter executes zero kernels with hit=true for every node; legacy-schema comparison exact for every document and event; graph-oracle comparison exact; every mutation-manifest entry and every recovery/failure-matrix entry and negative fixture behaves as frozen; `q5.decode_lane@1` and `q5.reconstruct_T@1` are total over declared bytes or all fallible parsing lives inside gate kernels |
+| A-2 | Q5 harvest/transport subgraph (CREATE occurrence universe with `document` as the group entity and unit weights; `q5.decode_lane@1`; `q5.transport_gate@1`; `q5.reconstruct_T@1` owning digest columns; `q5.seal_gate@1`; `q5.harvest_seal@1` RELEASE with real gate ancestry and nonempty `requires_decisions`) against the frozen oracles. BLOCKING TOPOLOGY (pinned executor): a failed string verdict does not block downstream execution by itself — `_blocked_by` blocks only consumers of an unavailable typed artifact and descendants of an execution-unreached node — so wherever execution MUST stop after a gate fails, that gate emits a typed `ArtifactOutput` that every kernel required to stop consumes as an `ArtifactInput` (transport gate → reconstruct_T and seal gate; seal gate → RELEASE), in addition to its owned string columns; owned-column dependencies alone never carry a stop. The frozen expected-state vocabulary distinguishes EXECUTED-FAILED (the gate ran and persisted its failed string outcome; its typed artifact is unavailable) from UNREACHED (a node blocked by an unavailable artifact or by an unreached ancestor); RELEASE must be UNREACHED, never executed with an evidence-tier failure, whenever the seal gate failed, even when its required decision is supplied | build agents; this session reviews | for every cohort document and every mutation and recovery case, the frozen fixture declares its EXPECTED STATE per node — executed, refused (typed refusal before any kernel runs, as when a required source is missing: executor.py:1922–1924), or unreached (a dependent of a failed gate) — and the assertions are scoped to it: for fixtures whose expected state is executed, cold-A and cold-B executions in fresh interpreters on distinct physical, verified-empty stores execute every kernel with hit=false for every node and agree on canonical stored payload bytes and independently recomputed payload hashes, and the unchanged warm run in a fresh interpreter executes zero kernels with hit=true for every node; for refusal fixtures, both cold runs and the warm run produce the identical typed refusal code before any kernel executes and store nothing; for executed-failed/unreached fixtures, the gate's failed string outcome is persisted identically on both cold runs, its typed artifact is unavailable, every artifact consumer and every descendant of an unreached node is UNREACHED on both (a RELEASE that executes after a seal-gate failure is a topology defect and fails the harness), and the warm run reproduces the same outcome and unreached set from cache without executing the failed gate's dependents; fixtures cover BOTH dependency types — an artifact-consumer blocked by an unavailable artifact, and a descendant blocked by an unreached ancestor — on cold and warm; any fixture whose observed states differ from its frozen expected states fails; legacy-schema comparison exact for every document and event under that event class's applicability map, with expected absences carried as ABSENT-BY-DISPOSITION markers and never as missing fields; graph-oracle comparison exact; every mutation-manifest entry and every recovery/failure-matrix entry and negative fixture behaves as frozen; `q5.decode_lane@1` and `q5.reconstruct_T@1` are total over declared bytes or all fallible parsing lives inside gate kernels |
 | A-3 | Shadow every canonical harvest, seal, void, repair, supersession and replication event after H through H2, beside the bespoke harvest, with no effect on it | orchestrator dispatch unchanged; build agents run the shadow | every post-H event is shadowed under the A-2 contract; shadow latency recorded; zero governing discrepancies, or the document is listed as a residue with its discrepancy class; no typed exceptions exist in Plan A |
 | A-4 | Shadow backfill of every event at or before H, including every void, supersession and replication disposition, each derived from the commit-pinned ruling bytes as a source and reported, not selected | build agents | per-document parity report under the A-2 contract; residue list; for doc_058 the report shows both 38eea5db57118df598e2f2ea1d68466df58d9e1ff1615de38d36c4609da2fef3 (board-ratified) and b3a36967ffdc934521c5459f7bf71b46cb5741f2a089a4a89b5d8d750de89fc8 (preserved superseded) with their board rulings, without choosing |
 | A-5 | Closing census, parity report and Plan B proposal | this session | evidence-complete and parity states reported separately; A-1 through A-4 accepted under one TCB; the H2 census shows multiset equality with the authoritative record; the report records both occurrence-manifest digests (H and H2), the TCB and toolchain digests, per-document comparison results, residue classes, measured shadow latency and the store inventory; mixed-TCB results are rejected; Plan B is proposed only with that evidence attached |
@@ -59,7 +60,7 @@ Frozen oracles (recorded in the toolchain bundle before any acceptance run):
 - Do not copy or replicate any source before its access, license, destination, backup, retention, access-control and encryption checks pass.
 - Do not put the store in e8-ops or rely on `/tmp`.
 - Do not declare `Tolerance` or entrants (#847) in Plan A.
-- Do not consume codex lane-hours for build work; do not run build agents on the orchestrator's lane.
+- Do not consume codex lane-hours for build work except the single upward-routed A-1/A-2 lane that A5 permits, and never while a ceremony step is running on that home; do not run build agents on the orchestrator's lane.
 - Do not widen any Opus role beyond Max's cited authorization without a completed digest-bound calibration report.
 - Do not call any shadow result evidence, or use it in any Plan B argument, before A2a and the per-event-type schemas are met.
 - Do not choose H2 retroactively or shorten the live window below the frozen rule.