v4.7.4 — the harvest population, and instruments that can be performed

Summary

Makes the HANDOFF harvest population immune to a dispatch that names tasks, and removes several instructions that could not be carried out with the tools they named.

What landed

The harvest population is defined by the receiver, not the sender. The harvest defined its population by a task-file census and a processed-task ledger, and said nothing about what authority a task list named in a dispatch carries. A secretary handed a range could reasonably scope to it. In the session that prompted this, a named range was short by nine tasks and roughly 75 KB of reviewer output; the secretary refused the scoping on its own judgement, which is the only reason nothing was dropped. The rule now sits ahead of all three workflow entry points, so the two sweeping end-of-session passes meet it rather than routing past it.

A dispatch's own difficulty rationales leaked its hypothesis. A teammate must read them before starting, so a lead who writes their expectation there has handed it over before the teammate opens a file. Where a dispatch's value depends on the teammate not knowing something, the rationales are now stamped withheld rather than written — nothing is disclosed because nothing exists to read — and the lead-facing surfaces no longer instruct a re-stamp that would put the prose back.

Three instructions that named an instrument which could not perform them. A split-read rule that said to read the scores before the rationales, and gave one command printing both. An aggregation that counted a structurally-mandatory acknowledgment as a scoring objection, corrupting a signal that persists across sessions. And the fix for that aggregation, which excluded records by a field the computation had already discarded.

Why it took fourteen commits

Each guard pinned the position of the attack that produced it, so the next attack needed no new vocabulary — only a new position. Replacing positional coverage with a count over a region closed three holes at once, including one previously accepted as permanent.

A positional check is immune to substitution and blind to a move; a count is the reverse. Neither supersedes the other, and the guard now says which failure each owns. What the count cannot see is declared rather than guarded, because guarding a count against substitution needs an instrument a count is not.

Verification

Full suite on a frozen tree: 15344 passed, 85 skipped, exit 0, predicted before the run and matched. Protocol extract verifier 19/0. Nine reddening claims independently reproduced over 17 mutations, all via the assertion each names.

That null shows each check fails when broken — which is not the same as each check testing the right thing. Several are word-presence checks whose own docstrings now say so.