feat(coverage): T032-i4 — flame refreshed through the single command: bar held (9/9, count 0, proven), pinned fields verbatim, and every session honesty field now MEASURED (installScripts ran 2-of-3 lockfile-marked under npm-12 gate; journeys 1-of-12 routes; runtime blocks host v24.15.0). Witness record only under the per-app key; slot.json honestly superseded. Totals {23,11,2,5,5}, composite 140ce86e. Plus .fable-opus harness bookkeeping

Author: thejackshelton

.fable-opus/runs/bank-demo-fleet-pipeline-p1b/prompt-T013a-react-coverage-batch-attempt-1.md

@@ -8,13 +8,15 @@ The coverage grind, React batch: acquire **6–8 React applications the pipeline
 Why this shape. The owner will run this on a bank's repo live. The runbook needs to say honestly: "N of 8 admitted with nothing declared; M of 8 with one fleet-wide declaration; the rest refused, by these codes." Two summaries give exactly that sentence.
 
 Everything you need exists; you are operating it, not building it:
+
 - `versionless acquire <owner/repo> --ref <tag> --id <id> --consent VL-LEGACY-CORPUS-2026-08-10 --json` (T016) — the ONLY fetch path; writes `.versionless/work/<id>/baseline` and `evidence/ingests/<id>/source.json`.
 - `versionless batch --apps <manifest.json|roots…> --out <lane-root> --publish --json` (T021) — serial per app, harness per app, files `evidence/runs/<id>/run-record.json` + `.interventions.json`, writes `evidence/runs/fleet-batch/<name>/fleet-summary.{json,md}`, and `--publish` runs pack-if-stale → trust:generate → trust:verify → report:coverage. Read `packages/cli/src/operator/batch.ts` for how `--name` (or equivalent) sets the summary dir and how per-stage flags (`--node`, `--allow-peer-conflicts`, `--allow-remote-tarballs`, `--allow-install-scripts`, `--journeys`) are forwarded uniformly.
 - Prior scouts left verified candidate menus: read the FULL JSON of `.fable-opus/state/outcome-u2-react-candidate-scout.json` and `outcome-t007-s1-holdout-scout.json`; if the outcome files carry only summaries, the shortlists are in the corresponding transcripts under `.fable-opus/runs/*/` — grep for the unit ids. You may also pick well-known public CRA-era React apps yourself if the menus are exhausted; the bar is: `react-scripts` declared in package.json (the frozen adapter admits CRA→Vite; ejected/umi/webpack trees refuse at plan), an OSI licence file at the pin, a pinned tag, small enough to install and build in budget, and ideally a single-major Node declaration (`.nvmrc` or `engines.node: "16.x"`) so era-cell reads it.
 
 **EXCLUSION LIST — none of these**: any id under `evidence/ingests/` (56 today: `ls evidence/ingests`), any dir under `.versionless/work/`, any module under `packages/cli/src/fixture/` or `packages/cli/src/witness/`, anything in `legacy-candidate-ingest.ts`. Show the check for each chosen app in the receipt.
 
 Do, in order:
+
 1. Choose 6–8 candidates; for each record repo, tag, why chosen, and the exclusion check.
 2. `acquire` each. A candidate whose acquisition refuses (licence absent, parity fail, ref unresolvable) is recorded with its code and replaced if you have spares; do not fight it.
 3. Write a manifest of the acquired baselines; run `batch --publish` with the name `t013a-undeclared` and NO per-app flags. Read the summary: totals, per-app terminal classification and refusal code, `interventionCount` (must be 0 across the batch).
@@ -64,4 +66,4 @@ git diff --quiet HEAD -- packages/frameworks/react packages/frameworks/angular p
 
 ## Blocked permission
 
-If evidence is missing, the contract conflicts with reality, or you need a file outside the contract, return status "blocked" with the question in open_questions instead of improvising. Specifically block, do not improvise, if: fewer than 6 unseen CRA-era candidates can be found (name how many and which); the network or consent path refuses; any row shows `interventionCount > 0` (Phase 1 regression — stop and report exactly which app and stage); publish moves a sealed number or the freeze composite; or a verify command fails for a cause outside your contract.
+If evidence is missing, the contract conflicts with reality, or you need a file outside the contract, return status "blocked" with the question in open_questions instead of improvising. Specifically block, do not improvise, if: fewer than 6 unseen CRA-era candidates can be found (name how many and which); the network or consent path refuses; any row shows `interventionCount > 0` (Phase 1 regression — stop and report exactly which app and stage); publish moves a sealed number or the freeze composite; or a verify command fails for a cause outside your contract.

.fable-opus/runs/bank-demo-fleet-pipeline-p1b/prompt-T016-acquire-unseen-app-attempt-1.md

@@ -65,4 +65,4 @@ git diff --quiet HEAD -- packages/frameworks/react packages/frameworks/angular p
 
 ## Blocked permission
 
-If evidence is missing, the contract conflicts with reality, or you need a file outside the contract, return status "blocked" with the question in open_questions instead of improvising. Specifically block, do not improvise, if: no consent mechanism can be exercised without an owner-supplied consent id (name exactly what is needed); every candidate on the menus is on an exclusion list; the network refuses; or a verify command fails for a cause outside your contract.
+If evidence is missing, the contract conflicts with reality, or you need a file outside the contract, return status "blocked" with the question in open_questions instead of improvising. Specifically block, do not improvise, if: no consent mechanism can be exercised without an owner-supplied consent id (name exactly what is needed); every candidate on the menus is on an exclusion list; the network refuses; or a verify command fails for a cause outside your contract.

.fable-opus/runs/bank-demo-fleet-pipeline-p1b/prompt-T021a-batch-runner-ordering-attempt-1.md

@@ -5,9 +5,10 @@ Fable-Opus-Timeout-Minutes: 30
 
 Fleet operation on top of `run`: (1) a `batch` operator command that takes a list of application roots (argument or manifest file — **never from source**), invokes the intervention-count harness on each **serially**, files each result where the coverage report reads it, and emits an honesty-guarded fleet summary; and (2) the **ordering** that makes the coverage report readable on every run — build → `trust:generate` → verify → report — as an explicit `--publish` step, so a batch ends in a fresh, verified `coverage-report.{json,md}`.
 
-Why. Phase 1 built the pieces: `run` (T007), the coverage report (T015), the out-of-band harness (T014), generic admission (T004/T005/T018/T016/T023), and the count ceiling opened (T022). Nothing yet runs many apps and folds them into the report. Spike B measured ~0.8 ms/app of machine time — the fleet is cheap; what's missing is the loop, the filing, and the ordering. The committed prototype `packages/cli/src/fixture/fleet-batch-spike-run.ts` is the named misfire in two ways: it hardcodes a 12-app `FLEET` at :81 (a batch that lists its fleet in source is not a fleet tool), and it detects refusals by *catching* (`:275,306,342`) — refusals are now returned outcomes with `exitCode 2`. Do not carry either forward.
+Why. Phase 1 built the pieces: `run` (T007), the coverage report (T015), the out-of-band harness (T014), generic admission (T004/T005/T018/T016/T023), and the count ceiling opened (T022). Nothing yet runs many apps and folds them into the report. Spike B measured ~0.8 ms/app of machine time — the fleet is cheap; what's missing is the loop, the filing, and the ordering. The committed prototype `packages/cli/src/fixture/fleet-batch-spike-run.ts` is the named misfire in two ways: it hardcodes a 12-app `FLEET` at :81 (a batch that lists its fleet in source is not a fleet tool), and it detects refusals by _catching_ (`:275,306,342`) — refusals are now returned outcomes with `exitCode 2`. Do not carry either forward.
 
 Read first, briefly:
+
 1. `packages/cli/src/operator/intervention-count.ts` — the harness you invoke per app; its record shape `versionless.intervention-count.v1`; how `--record` names the run record and where `<record>.interventions.json` lands.
 2. `packages/trust/src/coverage-report.ts:48-70` and `readRunRecords` at :580 — `RUN_RECORD_ROOT = 'evidence/runs'`, `RUN_RECORD_FILE = 'run-record.json'`, and the `.interventions.json` sibling: **this is where the batch must file each app's records** (`evidence/runs/<app-id>/run-record.json` + `.interventions.json`) for the report to see them.
 3. `packages/cli/src/operator/matrix.ts:42-51` and `packages/trust/src/enterprise.ts:935-975` — `assertEnterpriseSurfaceHonesty`, which the fleet summary must terminate in.
@@ -72,4 +73,4 @@ git diff --quiet HEAD -- packages/frameworks/react packages/frameworks/angular p
 
 ## Blocked permission
 
-If evidence is missing, the contract conflicts with reality, or you need a file outside the contract, return status "blocked" with the question in open_questions instead of improvising. Specifically block, do not improvise, if: filing under `evidence/runs/<id>/` would collide with sealed receipts you cannot read around; the coverage report cannot list a refused run-record app without a change outside your contract; publish moves a sealed number or the freeze composite; or a verify command fails for a cause outside your contract.
+If evidence is missing, the contract conflicts with reality, or you need a file outside the contract, return status "blocked" with the question in open_questions instead of improvising. Specifically block, do not improvise, if: filing under `evidence/runs/<id>/` would collide with sealed receipts you cannot read around; the coverage report cannot list a refused run-record app without a change outside your contract; publish moves a sealed number or the freeze composite; or a verify command fails for a cause outside your contract.

.fable-opus/runs/bank-demo-fleet-pipeline-p1b/prompt-T022a-conformance-ceiling-attempt-1.md

@@ -57,4 +57,4 @@ git diff --quiet HEAD -- packages/frameworks/react packages/frameworks/angular p
 
 ## Blocked permission
 
-If evidence is missing, the contract conflicts with reality, or you need a file outside the contract, return status "blocked" with the question in open_questions instead of improvising. Specifically block, do not improvise, if: opening the types requires touching a frozen subtree; the derivation cannot reproduce the sealed `corpus-conformance.json` byte-identically for the current corpus; a sealed matrix number or the freeze composite moves on regeneration; or a verify command fails for a cause outside your contract.
+If evidence is missing, the contract conflicts with reality, or you need a file outside the contract, return status "blocked" with the question in open_questions instead of improvising. Specifically block, do not improvise, if: opening the types requires touching a frozen subtree; the derivation cannot reproduce the sealed `corpus-conformance.json` byte-identically for the current corpus; a sealed matrix number or the freeze composite moves on regeneration; or a verify command fails for a cause outside your contract.

.fable-opus/runs/bank-demo-fleet-pipeline-p1b/prompt-T023-ingest-seam-era-sources-attempt-1.md

@@ -58,4 +58,4 @@ node --experimental-strip-types packages/cli/src/cli.ts supported-matrix --offli
 
 ## Blocked permission
 
-If evidence is missing, the contract conflicts with reality, or you need a file outside the contract, return status "blocked" with the question in open_questions instead of improvising. Specifically block, do not improvise, if: reading the journal would require ingest to trust an unconsented or non-parity-gated record; closing the ingest seam would require `acquire` in `RUN_STAGES` or a fetch inside `run`; any inference would need a pick-from-several or a floor; trust cannot be regenerated inside the contract; the re-gate shows `interventionCount > 0` or a `defect:*` classification (Phase 1 regression); or a verify command fails for a cause outside your contract.
+If evidence is missing, the contract conflicts with reality, or you need a file outside the contract, return status "blocked" with the question in open_questions instead of improvising. Specifically block, do not improvise, if: reading the journal would require ingest to trust an unconsented or non-parity-gated record; closing the ingest seam would require `acquire` in `RUN_STAGES` or a fetch inside `run`; any inference would need a pick-from-several or a floor; trust cannot be regenerated inside the contract; the re-gate shows `interventionCount > 0` or a `defect:*` classification (Phase 1 regression); or a verify command fails for a cause outside your contract.

.fable-opus/runs/bank-demo-fleet-pipeline-p1b/prompt-T026-report-test-sealed-subset-attempt-1.md

@@ -35,4 +35,4 @@ node --experimental-strip-types packages/cli/src/cli.ts report:coverage --offlin
 
 ## Blocked permission
 
-If evidence is missing, the contract conflicts with reality, or you need a file outside the contract, return status "blocked" with the question in open_questions instead of improvising.
+If evidence is missing, the contract conflicts with reality, or you need a file outside the contract, return status "blocked" with the question in open_questions instead of improvising.

.fable-opus/runs/bank-demo-fleet-pipeline-p1b/prompt-T028-ruling-code-half-attempt-1.md

@@ -7,11 +7,11 @@ Land the T027 Judge ruling, code half, in this order — **(0) first, and prove
 
 **(0) ANTI-LAUNDERING.** `packages/trust/src/coverage-report.ts` `applyInterventionRule` (:183-219) reaches `proven` on `outcome === 'proceeded'` + harness count 0 and **never reads the stages** — weaker than `intervention-count.ts:324-336` (`defect:stages-not-all-run` unless every stage `ran`) and `conformance.ts:749-753` (same). Tighten it: `proven` ONLY when the run record's stages ALL read `ran` AND the harness count is 0; a proceeded run with not-run stages becomes `not-admitted` with a named `statusReason` (e.g. `stages-not-all-ran`). This is a tightening — it cannot create a proven row — and all current run-record rows are refused, so the regenerated report totals must stay exactly `{applications 21, proven 10, bounded 2, refused 8, 'not-admitted' 1}`. Add a test that a synthetic proceeded-but-partial run is not proven. Prove totals unchanged before continuing.
 
-**(1) era-cell — the over-reach.** The stage conflates two questions: *which era were the authors on* (unanswerable when nothing is declared) and *which runtime will the lane this pipeline composes be installed and built in* (determinate — this process's runtime; precedented by `evidence/runs/operator-flows/lane-install-build.json`: papercups lane, 428 packages, 11 outputs, host `v24.15.0`, zero hand-authored files — the sealed React cells were proven with the migrated lane at host Node). Split `RequiredCell` into `runtime { major, version, source, readFrom, basis, claim }` and `era { outcome: 'read' | 'not-read', declared, readFrom, consultedSources, claim }`. When the lineage publishes no target-cell registry and no era is read, **proceed** on the runtime the install/build stages will use, `runtime.basis` quoting `lane-install-build.json`, `era.outcome: 'not-read'`, `era.claim` stating that nothing establishes the authored era. `readNodeMajorSources` must report **every** consulted source including absent ones as `{ source, text: null, majors: null, present: false }` — today "nothing declared" is indistinguishable from "did not look". Add the `notEstablished` lines from `docs/goals/bank-demo-fleet-pipeline/notes/T027-react-batch-ruling.md` §1 verbatim. Keep `era-cell.cell-not-declared-for-framework` with its string **verbatim**, narrowed to lineages with no lane runtime either.
+**(1) era-cell — the over-reach.** The stage conflates two questions: _which era were the authors on_ (unanswerable when nothing is declared) and _which runtime will the lane this pipeline composes be installed and built in_ (determinate — this process's runtime; precedented by `evidence/runs/operator-flows/lane-install-build.json`: papercups lane, 428 packages, 11 outputs, host `v24.15.0`, zero hand-authored files — the sealed React cells were proven with the migrated lane at host Node). Split `RequiredCell` into `runtime { major, version, source, readFrom, basis, claim }` and `era { outcome: 'read' | 'not-read', declared, readFrom, consultedSources, claim }`. When the lineage publishes no target-cell registry and no era is read, **proceed** on the runtime the install/build stages will use, `runtime.basis` quoting `lane-install-build.json`, `era.outcome: 'not-read'`, `era.claim` stating that nothing establishes the authored era. `readNodeMajorSources` must report **every** consulted source including absent ones as `{ source, text: null, majors: null, present: false }` — today "nothing declared" is indistinguishable from "did not look". Add the `notEstablished` lines from `docs/goals/bank-demo-fleet-pipeline/notes/T027-react-batch-ruling.md` §1 verbatim. Keep `era-cell.cell-not-declared-for-framework` with its string **verbatim**, narrowed to lineages with no lane runtime either.
 
 **(2) Range satisfaction — a reading, not a floor.** Add a declared-range SATISFACTION check populating ONLY `runtime.satisfiedByDeclaredRange: boolean` (`24 ∈ [10,∞)` → true). No number ever leaves a range into an era field; `nodeMajorsOfDeclaration` (`era-cell.ts:339-366`) is **untouched**. New refusal `era-cell.declared-range-excludes-the-lane-runtime` when the range does not contain the runtime major. Add §2's `notEstablished` lines verbatim.
 
-**(3) ingest — walk up, read by lineage.** `acquisitionLaneOf` (`ingest.ts:220-229`) exact-matches `.versionless/work/<id>/baseline`; make it walk UP to the nearest enclosing acquisition root, gated by walking THAT tree and matching the journalled `archiveParity` digest (the four existing gates unchanged). Read the frontend root **by lineage** across the root and its immediate subdirectories (`ingest.ts:405-426` reads by manifest presence today): exactly one manifest declaring react/next/angular is read; zero or several refuse naming all candidates and each manifest's reading; record `frontendRootBasis`. Read the identifier from the journal under the same five gates when `package.json` has no `name`, with `idReadFrom` naming it *an operator declaration made at acquire time* (never a directory name). Propagate the frontend root from ingest to analyze, era-cell, plan, apply in `run.ts` and print both roots in the run record.
+**(3) ingest — walk up, read by lineage.** `acquisitionLaneOf` (`ingest.ts:220-229`) exact-matches `.versionless/work/<id>/baseline`; make it walk UP to the nearest enclosing acquisition root, gated by walking THAT tree and matching the journalled `archiveParity` digest (the four existing gates unchanged). Read the frontend root **by lineage** across the root and its immediate subdirectories (`ingest.ts:405-426` reads by manifest presence today): exactly one manifest declaring react/next/angular is read; zero or several refuse naming all candidates and each manifest's reading; record `frontendRootBasis`. Read the identifier from the journal under the same five gates when `package.json` has no `name`, with `idReadFrom` naming it _an operator declaration made at acquire time_ (never a directory name). Propagate the frontend root from ingest to analyze, era-cell, plan, apply in `run.ts` and print both roots in the run record.
 
 Then regenerate census and trust in-unit (declared dist rebuild first ONLY if stale by mtime; T017 shape). Freeze composite `27741d9c` stable; sealed matrix verbatim (`react: 6 counted of 6`, `angular: 4 counted of 4`, `8 cross-proven of 58`). No re-batch here — that is T029.
 
@@ -67,4 +67,4 @@ R="$(mktemp -d)"; VERSIONLESS_NETWORK_MODE=offline node --experimental-strip-typ
 
 ## Blocked permission
 
-If evidence is missing, the contract conflicts with reality, or you need a file outside the contract, return status "blocked" with the question in open_questions instead of improvising. Specifically block, do not improvise, if: (0) cannot be tightened without moving a current total; any of the rulings would require an inference T027 forbade; the freeze composite or a sealed matrix number moves; a harness run shows `interventionCount > 0`; or a verify command fails for a cause outside your contract.
+If evidence is missing, the contract conflicts with reality, or you need a file outside the contract, return status "blocked" with the question in open_questions instead of improvising. Specifically block, do not improvise, if: (0) cannot be tightened without moving a current total; any of the rulings would require an inference T027 forbade; the freeze composite or a sealed matrix number moves; a harness run shows `interventionCount > 0`; or a verify command fails for a cause outside your contract.