# Changelog 2026-07-19 -- GA Phase-5 sweep session (one changelog for the whole
# session per GA-R2 amendment D1; batches append here as they close)

Executing session for the Phase-5 repair sweep (`docs/audit/phase5-sweep-plan.md`,
reviewed PASS + S1-S5). Every batch is operator-gated at its stated gate point;
every commit names its GA-F/GA-R trace and carries its own revert note. Status
lives in `docs/CURRENT-STATE.md` (GA-R1) -- this file records what CHANGED.

## Batch 0 -- tooling first (OPENED by operator 2026-07-19; repo-only, no cloud contact)

1. **0.1 repo-lint L10 status-coupling check (GA-R1 rule 8 / C1)** -- commit `0b991a5`.
   - WHAT: `repo_lint.py` gains L10: a change set modifying a state-bearing surface
     (anything under `docs/audit/`; a `**Status:` line in design-decisions.md; a
     gate row `| G<n> |` in session-ledger.md) without touching CURRENT-STATE.md is
     flagged. Pending working-tree set when dirty, HEAD commit when clean. WARN this
     batch (`L10_FAIL = False`); the flip to FAIL is a one-constant change due at
     Batch 1 open (sweep plan: "WARN for one batch").
   - WHY: amendment C1's Phase-5 implementation clause, verbatim. DIVERGENCE NOTED:
     the sweep plan's item 0.1 paraphrase said "CURRENT-STATE gate rows", which is
     vacuous (editing a CURRENT-STATE row touches CURRENT-STATE by construction);
     the ratified utterance says "ledger gate rows" and the ruling wins. The ledger
     carries no gate rows today; the pattern guards their reappearance.
   - Harness: tests/repo-lint T34-T41 (git fixtures), 42/42 PASS.
   - REVERT: `git revert 0b991a5`.

2. **0.2 ledger-scan SEC reporting repointed at security-ledger.md (GA-R4/F3)** --
   commit `b504cb6`.
   - WHAT: scan emits open COUNT + ID list + register-of-record pointer; row-level
     disposition text dropped from scan output. Session-ledger machine-derived SEC
     bullet re-seeded to pointer + count form. G14 evidence cell repointed at
     `docs/security-ledger.md` same commit.
   - WHY: F3 verbatim ("pointer and a scan-derived count, never row-level
     dispositions"). MEASUREMENT CORRECTION (GA-R1/C2): G14's count said 9; its own
     enumeration and the scan both measure 8 OPEN rows -- corrected to 8, divergence
     noted in the cell.
   - Harness: tests/ledger-scan +4 checks, 41/41 PASS.
   - REVERT: `git revert b504cb6` (restores the 2026-07-18 cell incl. its count error).

3. **0.3 ledger-scan wrap-aware next-free exclusion (GA-F15)** -- commit `527f1fd`.
   - WHAT: the "next-free"/"reproduc*" exclusion now suppresses the matching line
     AND the immediately following line (window exactly one line, reset per file),
     so a quoted next-free value whose hyphenated token wraps no longer counts as an
     assignment. Chose this over assignment-site counting: DOCFIX/BUNDLEFIX have no
     single register file to key assignment sites on (unlike D headers).
   - WHY: GA-F15 -- the wrap class fired twice live inside the audit itself
     (CURRENT-STATE section 9, now marked FIXED). Live counters re-verified
     UNCHANGED post-fix: D=130, DOCFIX=197, BUNDLEFIX=052.
   - Harness: tests/ledger-scan +3 checks, 44/44 PASS.
   - REVERT: `git revert 527f1fd`.

4. **0.4 record-audit status scan keyed to the legal token set (GA-F10 / vocab H1)**
   -- commit `f7580fd`.
   - WHAT: extractor knows Option A: legal OPEN/BLOCKED/HELD/CLOSED (OPEN was
     previously UNSCANNED -- post-migration OPEN-vs-CLOSED contradictions would have
     been invisible); DONE/TO RUN/RUNNING added; new report section 6 classifies
     every distinct token and flags illegal tokens + event words (VOID/REOPENED/
     SUPERSEDED) minted in status position. Prose event words stay legitimate
     row-history vocabulary. Report-only: 0/1/2 exit contract unchanged.
   - WHY: H1 requires the scan before any token migration (Batch 2.5 dependency).
     Live sanity run (scratch --out; the committed Phase-1 capture untouched):
     12 distinct tokens, 163 flagged counted occurrences = Batch 2.5's work-list.
     Contradiction groups 12 -> 13 on the scratch run: the OPEN-token detection
     gain, not drift.
   - Harness: tests/record-audit +9 checks, 33/33 PASS.
   - REVERT: `git revert f7580fd`.

Batch 0 verification: all three touched harnesses green (42/42, 44/44, 33/33),
full gauntlet + repo-lint results recorded in the batch completion report and the
ledger entry for this session.

## Out-of-batch: permission posture extension (operator-directed 2026-07-19)

- WHAT: `.claude/settings.json` `ask` list extended -- `Bash(git merge*)`,
  `Bash(git revert*)`, `Bash(git reset*)`, `Bash(git rebase*)`,
  `Bash(git branch -D *)`, `Bash(bash scripts/* apply*)`,
  `Bash(bash scripts/* install*)`, `Bash(ssh * sudo *)`, `Skill(*)`.
  Nothing added to `allow`; `deny` + the PreToolUse guard hook unchanged.
- WHY: operator drives sessions via Remote Control without a second terminal;
  remaining auto-mode classifier HARD-DENIALS (walls) on mutation surfaces
  matching no ask rule blocked the approve flow entirely (hit live: a Skill
  invocation hard-denied 2026-07-19). Extends the 2026-07-18 "ask preempts
  classifier" posture; targeted ask rules chosen over a catch-all `Bash(*)`
  per doc-cited guidance (ask appears to preempt allow -- a catch-all would
  destroy frictionless reads). `Skill(*)` syntax is undocumented; verified
  EMPIRICALLY (post-change Skill invocation prompted + ran; pre-change
  identical call hard-denied). Remaining walls get their own ask rule when
  hit -- the settings edit itself now prompts instead of denying.
- REVERT: `git revert` this commit, or `cp .claude/settings.json.bak` per the
  operator backup if the bak is refreshed first.