Add reopen edges and decision screen rendering

.ddd/claims/DDD-gates-02.yaml

@@ -0,0 +1,42 @@
+format: 2
+id: DDD-gates-02
+statement: >
+  A pipeline of sequentially-gated CI steps reports what broke first, not
+  what it did not check: when a step fails, every later independent gate is
+  skipped, its state for that revision is unknown, and the run still reads
+  as one red build. The masking is not hypothetical — main at 75b5472
+  carried two defects and showed one. `9df74c1` added `note` to `AddArgs`
+  and updated one of four call sites, so the test targets did not compile;
+  CI stopped there. Behind the compile error,
+  `ledger-core/src/author/tests.rs` sat at exactly the 400-line fitness
+  ceiling, and fixing the three call sites put it at 402 — a second,
+  independent gate failure that the first one hid, found only when someone
+  repaired the build by hand (7258af1). The repo already recognises this
+  failure mode one level down and fixed it there: `cargo t` is
+  `test --no-fail-fast` precisely so one failing test binary cannot hide
+  the rest (.cargo/config.toml, and CLAUDE.md says so in bold). The same
+  reasoning is not applied one level up, across the nine steps of
+  .github/workflows/product-ci.yml, each of which runs under the default
+  `if: success()`. Family: this is the shape of the M6 leakage prediction
+  and of L3's cross-file merge finding — a mechanism guarding the path it
+  can see, blind to what sits behind it.
+status: projected
+falsifier: >
+  Either of two negative results, both about whether the hazard is real
+  rather than about how the pipeline is currently wired. (a) A review of
+  this repository's red CI runs — or of local full-sequence runs
+  reproducing them — finds that in every case the steps skipped by an
+  earlier failure would themselves have passed, so the masking never
+  concealed a second defect and 75b5472 was a coincidence rather than an
+  instance. (b) The 75b5472 case is re-graded: the code-quality gate did
+  report on that run, and the second defect was visible after all, which
+  would show the observation was misread. Deliberately drafted so the
+  remedy cannot fire it: making independent gates run anyway changes what
+  *future* runs report, and says nothing about whether past masking hid
+  anything — a claim whose falsifier its own remedy satisfies is the
+  self-sealing defect DDD-method-07 names, and this is drafted to not
+  carry it.
+owner: none
+changed: 2026-08-13
+revalidate_by: 2027-02-13
+depends_on: []

.ddd/concordance.yaml

@@ -1,6 +1,10 @@
 format: 1
 note: 'Permanent id concordance for the M8 ledger migration (ruling 6: the aliases are permanent, not transitional). Historical ids — decisions, the risk record, seams, manifest entries — remain valid forever; `ddd why` resolves either spelling. Claim ids are not re-keyed: claims remain the ddd ontology''s own.'
 rows:
+- historical: dec/ddd/ci-gates-report-skipped
+  ledger: dec:hafeok.ddd/01KZX7HW7J4FET6H3JW8EQTK0R
+  kind: decision
+  disposition: 'filed 2026-08-13, after the M8 migration: the .ddd entry carries the rationale and the typed bases, the ledger entry is the record of the decision. Same pairing the migration produced, authored rather than migrated.'
 - historical: dec/bicep/linter-at-error
   ledger: dec:hafeok.ddd/01KZTGGGS14S17F2P5K6EZEZXH
   kind: decision

.ddd/decisions/ci-gates-report-skipped.yaml

@@ -0,0 +1,65 @@
+format: 7
+id: dec/ddd/ci-gates-report-skipped
+title: A CI run reports which gates did not execute; independent gates run anyway
+rationale: >
+  A red build must say what it did not check, not only what broke first.
+  Two forms, and the weaker one is the floor rather than the fallback.
+
+
+  The full form: a step that does not depend on a failed step runs anyway.
+  Clippy, the ledger gate, the ddd gate, the convention check and the
+  supply-chain check are independent of each other; today a failure in any
+  of them silently cancels the rest. They run under `if: ${{ !cancelled() }}`
+  (or equivalent) so one revision produces one complete verdict.
+
+
+  The minimum viable form, which holds even where the full form cannot: the
+  run reports which gates did not execute. Some steps genuinely depend on
+  an earlier one — a gate that needs a compiled workspace cannot run
+  without one — so "run everything" is not universally available, and a
+  build that cannot run a check must say so rather than leave the reader to
+  infer a pass from a silence. Unknown and passing are different states and
+  the report must distinguish them.
+
+
+  Scope note, stated so it is not mistaken for done: this entry rules the
+  arrangement; it does not implement it. The follow-up is a workflow edit
+  plus a summary step. Its cost is that a red build stops failing fast —
+  every independent gate's own runtime is then paid on every red run, the
+  benchmark step most of all — and that cost is the point rather than a
+  regression: the run buys a complete verdict with it. The minimum-viable
+  form costs a summary step and nothing else, which is why it is the floor.
+principal: Emil (Context&)
+based_on:
+  - type: preference
+    statement: >-
+      A gate's report should distinguish "checked and passed" from "not
+      checked", because a reader who cannot tell them apart will read
+      silence as a pass — and the arrangement that produces the silence is
+      an accident of step ordering, not a judgment about what mattered.
+  - type: claim
+    claim: DDD-gates-02
+    status: projected
+    changed: 2026-08-13
+    content: sha256:65bfeff0770e7de976127d54d87c3428a6e4458d0f6b6088fc0b452a4c6cb89e
+date: 2026-08-13
+notes: >
+  Filed 2026-08-13 for the principal's acceptance; not implemented in the
+  session that filed it, by that session's own scope.
+
+
+  Allocated as a judgment rather than a criterion on purpose. Nothing
+  currently checks this arrangement, so holding to it rests on a person,
+  and a criterion would name a discharge pointer that resolves to no
+  checker — the manufactured-basis shape the 2026-08 basis-quality audit
+  found and this store now refuses. When the workflow edit lands, the
+  honest move is to re-allocate this decision to a criterion whose
+  discharge names the check that then exists; that is a new version, not an
+  edit.
+
+
+  The claim edge is genuine ground here, not a citation: DDD-gates-02 is an
+  observation of an instance that actually occurred in this repository, and
+  if that instance is re-graded away this decision loses its reason. It is
+  therefore filed in `based_on`, not `revisit_if` — the distinction the
+  2026-08-13 ruling draws, applied on its first new use.

.ddd/decisions/internal-not-surface.yaml

@@ -1,4 +1,4 @@
-format: 5
+format: 7
 id: dec/ddd/internal-not-surface
 title: internal is not C# contract surface by default; library repos flip per-repo
 rationale: >
@@ -16,10 +16,11 @@ based_on:
       repositories are application repositories, so the app-repo posture is
       the required default and the library posture is an explicit per-repo
       config flip.
-  - type: claim
-    claim: DDD-adapter-02
+revisit_if:
+  - claim: DDD-adapter-02
     status: projected
     changed: 2026-08-06
+    content: sha256:b333063d5058614855329b2dd8a1d1c5f8732ab243a2d2f9ebfa3bf95f2f5fda
 date: 2026-08-06
 notes: >
   Basis re-typed 2026-08-12, following the 2026-08 basis-quality audit: a
@@ -36,3 +37,16 @@ notes: >
   ruling, not its ground; its fate as a claim is the F-batch's. Format
   2 -> 5 per docs/ddd-format-migrations.md.
   Ratified 2026-08-12 (Emil): accepted as filed (8b7a410).
+
+  Edge re-typed 2026-08-13, following the principal's ruling that a
+  watched-not-grounding edge is a distinct edge type: a re-decision of
+  this edge per format 7, not an edit. DDD-adapter-02 moves out of
+  `based_on` and into `revisit_if` — the pin is carried across unchanged
+  (projected@2026-08-06, content recovered at that state by the M8
+  migration), so nothing about what is recorded changes; what changes is
+  what the record *means* and how it reports. It never grounded this
+  decision, and the note above already said so in prose; it now says so in
+  a field. Its falsifier — a boundary defect traced to an internal member
+  consumed across a boundary — is the tripwire, and firing it reopens the
+  mandate rather than undermining it. Format 5 -> 7 per
+  docs/ddd-format-migrations.md. Awaiting the principal's acceptance.

.ddd/decisions/m6-proceeds-no-flip.yaml

@@ -1,4 +1,4 @@
-format: 5
+format: 7
 id: dec/ddd/m6-proceeds-no-flip
 title: M6 proceeds as the Rust adapter; the M6/M7 flip condition does not fire
 rationale: >
@@ -32,10 +32,11 @@ based_on:
       The stated default the principal set for the M6/M7 sequencing: with
       the flip condition unfiled and therefore unevaluable against filed
       evidence, the evaluation resolves by that default and M6 proceeds.
-  - type: claim
-    claim: DDD-adapter-01
+revisit_if:
+  - claim: DDD-adapter-01
     status: projected
     changed: 2026-08-02
+    content: sha256:922a0a70f69509bfcd73325fbdc1cd5ac281b1b52281b14f56a8f519afd99f52
 date: 2026-08-10
 notes: >
   M6's content is the third language adapter, which is the experiment that
@@ -81,3 +82,17 @@ notes: >
   Ratified 2026-08-12 (Emil): accepted as filed (8531938) — the retained
   edge is a claim being watched, with the content mismatch explicit so it
   is not later read as ground.
+
+  Edge re-typed 2026-08-13, following the principal's ruling that a
+  watched-not-grounding edge is a distinct edge type: a re-decision of
+  this edge per format 7, not an edit. DDD-adapter-01 moves out of
+  `based_on` and into `revisit_if`, pin carried across unchanged
+  (projected@2026-08-02, content recovered at that state by the M8
+  migration). This is the one of the three whose pin has drifted, and the
+  drift is deliberate: the claim moved projected -> reported ->
+  established, and the two paragraphs above are the record that the
+  movement was looked at each time. That drift now reports as a **reopen**
+  finding rather than a basis-loss one, which is the correction the ruling
+  makes — the ground of this decision is the principal's stated default and
+  has never moved; what moved is the stake being tracked. Format 5 -> 7 per
+  docs/ddd-format-migrations.md. Awaiting the principal's acceptance.

.ddd/decisions/no-unwrap-gate.yaml

@@ -1,4 +1,4 @@
-format: 5
+format: 7
 id: dec/rust/no-unwrap
 title: Deny clippy::unwrap_used workspace-wide
 rationale: >
@@ -16,10 +16,11 @@ based_on:
       to a defined exit code; an unwrap is a panic path that structurally
       bypasses that contract, so denying the lint is what keeps the error
       model total.
-  - type: claim
-    claim: DDD-gates-01
+revisit_if:
+  - claim: DDD-gates-01
     status: reported
     changed: 2026-08-06
+    content: sha256:6f500ee8ef3bcbef7ce1a1d6ce2c093d61858f7a01bb3685b1c0f56aa32b4395
 date: 2026-08-06
 notes: >
   Basis re-typed 2026-08-12, following the 2026-08 basis-quality audit: a
@@ -36,3 +37,15 @@ notes: >
   fate as a claim is the F-batch's. Format 2 -> 5 per
   docs/ddd-format-migrations.md.
   Ratified 2026-08-12 (Emil): accepted as filed (8b7a410).
+
+  Edge re-typed 2026-08-13, following the principal's ruling that a
+  watched-not-grounding edge is a distinct edge type: a re-decision of
+  this edge per format 7, not an edit. DDD-gates-01 moves out of
+  `based_on` and into `revisit_if`, pin carried across unchanged
+  (reported@2026-08-06, content recovered at that state by the M8
+  migration). The constraint is the ground and stays the ground; the claim
+  is the cost check, and the note above already called it that. Its
+  falsifier — waiver pressure, or a class of code where the lint produces
+  worse handling than the unwrap it replaced — is the tripwire, and firing
+  it reopens the gate rather than removing its ground. Format 5 -> 7 per
+  docs/ddd-format-migrations.md. Awaiting the principal's acceptance.

.ddd/seams/seam-rust-ddd-cli-src-commands-content-hash-rs.yaml

@@ -0,0 +1,14 @@
+format: 2
+id: seam/rust/ddd-cli-src-commands-content-hash-rs
+boundary: contract surface of ddd-cli/src/commands/content_hash.rs
+verdict_knowledge: "A caller learns that the content hash a ledger entry pins can be asked for rather than recomputed by hand — the number the M8 migration hard-coded — and that it covers the three families that carry one: decisions, claims and seams. Read-only: it computes and prints, and writes nothing."
+contract_location: ddd-cli/src/commands/content_hash.rs
+obligations: []
+metadata: {}
+bindings:
+- symbol: run
+  file: ddd-cli/src/commands/content_hash.rs
+  before: absent
+  after: sha256:a97bf8115fb7697aadda9e75ad15c02644a610ae031e248e2c21a8dd4d89a515
+  base_revision: 15c635210dca8246aae371460e167ad7d293c2e6
+  hash: sha256:f81e2ed756531debccecd62893dbed2c2246eb4b617594f3533965bcdc91b33a

.ddd/seams/seam-rust-ddd-cli-src-commands-mod-rs.yaml

@@ -30,3 +30,9 @@ bindings:
   after: sha256:7dd38d1825a4292c74d18acc551fe5bf4e9e76a054eb0e6b3aed302ee530f657
   base_revision: 6d3dff57e80514b7b4665ef38b364730c53201a3
   hash: sha256:6d9388f03e9d613eb86e97b8413f83a199cacce9c9dc153dc9f38c74b2ae171f
+- symbol: ContentHash
+  file: ddd-cli/src/commands/mod.rs
+  before: sha256:7dd38d1825a4292c74d18acc551fe5bf4e9e76a054eb0e6b3aed302ee530f657
+  after: sha256:d12237b829fa1a61a9de7193cc0a4fd915b0b5a257d050fd3e3a6e37e2d0b1d8
+  base_revision: 15c635210dca8246aae371460e167ad7d293c2e6
+  hash: sha256:b681dcee1a585339bee219cdbaf0610d00df6a5bcb01e3a542d4a42684f79055

.ddd/seams/seam-rust-ddd-core-src-decision-rs.yaml

@@ -1,7 +1,7 @@
 format: 2
 id: seam/rust/ddd-core-src-decision-rs
 boundary: contract surface of ddd-core/src/decision.rs
-verdict_knowledge: 'Consumers learn a claim pin may carry the claim''s content hash at decision time (format 6), which is what turns basis loss from a status+date heuristic into an exact comparison.'
+verdict_knowledge: Consumers learn a claim pin may carry the claim's content hash at decision time (format 6), which is what turns basis loss from a status+date heuristic into an exact comparison.
 contract_location: ddd-core/src/decision.rs
 obligations: []
 metadata: {}
@@ -12,3 +12,9 @@ bindings:
   after: sha256:22e7901af1fe61a02f486b79b73cf19cc48379e1aa363a340df4ff052cb003c7
   base_revision: 6d3dff57e80514b7b4665ef38b364730c53201a3
   hash: sha256:09cfcbd0507c6ddb14c26b427f0a5b98d2539bbebe568cda1e259ce0cf81dbe9
+- symbol: revisit_if
+  file: ddd-core/src/decision.rs
+  before: sha256:22e7901af1fe61a02f486b79b73cf19cc48379e1aa363a340df4ff052cb003c7
+  after: sha256:991e0096baa0eb2a9299352ec0dc8b4f112095dae619a6d6f9d6e701352526bf
+  base_revision: 15c635210dca8246aae371460e167ad7d293c2e6
+  hash: sha256:2dd2a80522cca60bd06755184613ed031ba2edadca4019eace6d313e502941af

.ddd/seams/seam-rust-ddd-core-src-ledger-gate-rs.yaml

@@ -1,7 +1,7 @@
 format: 2
 id: seam/rust/ddd-core-src-ledger-gate-rs
 boundary: contract surface of ddd-core/src/ledger_gate.rs
-verdict_knowledge: 'Callers learn that readiness and completeness are the ledger''s verdicts restated — ddd surfaces them without a second rulebook — and that migrated basis pins are checked exactly, marker by marker.'
+verdict_knowledge: Callers learn that readiness and completeness are the ledger's verdicts restated — ddd surfaces them without a second rulebook — and that migrated basis pins are checked exactly, marker by marker.
 contract_location: ddd-core/src/ledger_gate.rs
 obligations: []
 metadata: {}
@@ -102,3 +102,51 @@ bindings:
   after: sha256:c8a9e77a1bcdbe8b9719aa8c8f0bd8d01ce16b7315d81b2790f2cfbb15ed87fe
   base_revision: 6d3dff57e80514b7b4665ef38b364730c53201a3
   hash: sha256:4bd797f767f409c661c2fe586c15702e849ff4789b3fb683dfce047507dc9f90
+- symbol: Reopened
+  file: ddd-core/src/ledger_gate.rs
+  before: sha256:c8a9e77a1bcdbe8b9719aa8c8f0bd8d01ce16b7315d81b2790f2cfbb15ed87fe
+  after: sha256:aecd5dcdae830a72861a0eced2942216020f5f5dc7b6eb7e832be1af8be8be81
+  base_revision: 15c635210dca8246aae371460e167ad7d293c2e6
+  hash: sha256:4ccfd7cfbb5374f21c9c690b79a28cbe711f78dc07b60a720cd92717cb09a98d
+- symbol: reopen_checked
+  file: ddd-core/src/ledger_gate.rs
+  before: sha256:c8a9e77a1bcdbe8b9719aa8c8f0bd8d01ce16b7315d81b2790f2cfbb15ed87fe
+  after: sha256:aecd5dcdae830a72861a0eced2942216020f5f5dc7b6eb7e832be1af8be8be81
+  base_revision: 15c635210dca8246aae371460e167ad7d293c2e6
+  hash: sha256:564c5d4c7f2f030cb2718d31d00398be2dc05782460fa74370442d004e93cece
+- symbol: reopened
+  file: ddd-core/src/ledger_gate.rs
+  before: sha256:c8a9e77a1bcdbe8b9719aa8c8f0bd8d01ce16b7315d81b2790f2cfbb15ed87fe
+  after: sha256:aecd5dcdae830a72861a0eced2942216020f5f5dc7b6eb7e832be1af8be8be81
+  base_revision: 15c635210dca8246aae371460e167ad7d293c2e6
+  hash: sha256:8eec238568c173856c7df9da40617a2fd79ccd08c74e1579f23a01757a546843
+- symbol: claim
+  file: ddd-core/src/ledger_gate.rs
+  before: sha256:c8a9e77a1bcdbe8b9719aa8c8f0bd8d01ce16b7315d81b2790f2cfbb15ed87fe
+  after: sha256:aecd5dcdae830a72861a0eced2942216020f5f5dc7b6eb7e832be1af8be8be81
+  base_revision: 15c635210dca8246aae371460e167ad7d293c2e6
+  hash: sha256:e7e4513c8ce3b6f654e8fe320ff10f09ecade063e9deeffab4a5a701b584a77f
+- symbol: current
+  file: ddd-core/src/ledger_gate.rs
+  before: sha256:c8a9e77a1bcdbe8b9719aa8c8f0bd8d01ce16b7315d81b2790f2cfbb15ed87fe
+  after: sha256:aecd5dcdae830a72861a0eced2942216020f5f5dc7b6eb7e832be1af8be8be81
+  base_revision: 15c635210dca8246aae371460e167ad7d293c2e6
+  hash: sha256:c872e1428dacbf8f414170ab136b57e54fc7a34a005e906925b7619277659c4f
+- symbol: decision
+  file: ddd-core/src/ledger_gate.rs
+  before: sha256:c8a9e77a1bcdbe8b9719aa8c8f0bd8d01ce16b7315d81b2790f2cfbb15ed87fe
+  after: sha256:aecd5dcdae830a72861a0eced2942216020f5f5dc7b6eb7e832be1af8be8be81
+  base_revision: 15c635210dca8246aae371460e167ad7d293c2e6
+  hash: sha256:26f29a24437eb340f5f35d455a6350281f3586f117ccf7bce600a66d032c3b1e
+- symbol: historical
+  file: ddd-core/src/ledger_gate.rs
+  before: sha256:c8a9e77a1bcdbe8b9719aa8c8f0bd8d01ce16b7315d81b2790f2cfbb15ed87fe
+  after: sha256:aecd5dcdae830a72861a0eced2942216020f5f5dc7b6eb7e832be1af8be8be81
+  base_revision: 15c635210dca8246aae371460e167ad7d293c2e6
+  hash: sha256:4e4306ac34c340a8ffe9d359f3074c28bed4f4fceb1e4749447f092cee1d1d04
+- symbol: pinned
+  file: ddd-core/src/ledger_gate.rs
+  before: sha256:c8a9e77a1bcdbe8b9719aa8c8f0bd8d01ce16b7315d81b2790f2cfbb15ed87fe
+  after: sha256:aecd5dcdae830a72861a0eced2942216020f5f5dc7b6eb7e832be1af8be8be81
+  base_revision: 15c635210dca8246aae371460e167ad7d293c2e6
+  hash: sha256:bbdf7694e334de1843867a65951db0f301ca24a27308bb535b9889fdb6f8147f

.ddd/seams/seam-rust-ddd-core-src-lib-rs.yaml

@@ -42,3 +42,9 @@ bindings:
   after: sha256:6f1bb26354ff88cf862053010e16b0cc9b6e701e32528438fc2a7daf42a92d87
   base_revision: 6d3dff57e80514b7b4665ef38b364730c53201a3
   hash: sha256:cd2e510ca7451e4d78188735ed40d3a93e2017c4c3166f4b2db8bd4e259ec43b
+- symbol: revisit
+  file: ddd-core/src/lib.rs
+  before: sha256:6f1bb26354ff88cf862053010e16b0cc9b6e701e32528438fc2a7daf42a92d87
+  after: sha256:4471827b0883b97b6cb3618b6fe668ac569d586ac0773d2270a07ef4269db72b
+  base_revision: 15c635210dca8246aae371460e167ad7d293c2e6
+  hash: sha256:143456fd8c9a76a6bfd082f3eb92c59419bdf6d45df83f7cb1d61d2c82cec408