proof(stage-d): repair receipt chain; control arm made exact; council record for looks 1–2

Second-family seat (deepseek-3.2, 74685923) on look 2: VALID-WITH-NOTES, one
blocking finding — look 2's previous_receipt_sha256 hashed the look 1 file
AFTER it had been edited in place to add a VOIDED field, not as committed.
The orchestrator's error. Remedy: look 1 restored to its committed bytes
(sha ec9d6576…, identical to ca55c65), the void notice moved to a sidecar
(stage-d-look1-b1clean.VOIDED.md), look 2 re-run chained to the pristine
file. All four arms reproduce identically; chain verified against
`git show ca55c65:…`. Rule adopted: a receipt is never mutated after commit.

B1_planner now carries the shipped visibility predicate so "identical to B1
except the planner" is literally true (predicate excludes 0/5,879 sessions;
per-question hits unchanged).

council-stage-d-looks.md records both seats' findings with dispositions and
evidence. Standing: look 1 voided (numbers reproduced), look 2 valid;
planner +0.142 established, clean +0.184 established, clean-over-planner
+0.042 not established; stop rule 2 armed (one more flat look ends the G1
DEV looks). G1 not claimed. SEALED untouched. Council runs 13.

Author: NetDevAutomate

.secrets.baseline

@@ -0,0 +1,59 @@
+# Receipt council — Stage D DEV looks 1 and 2 (G1 family)
+
+Ruler: "A gate passes only when … a two-family council review of the receipt finds no blocking
+objection to its validity. The orchestrator may override a council objection only by citing
+artifact evidence that refutes it, recorded in the receipt. Council findings are otherwise leads:
+nothing is acted on until verified against the artifact."
+
+| seat | model | run | reviewed | verdict |
+|---|---|---|---|---|
+| A | gpt-5.6-terra | `4ed818c7` | look 1 (`ca55c653`) | **VOID** — 4 blocking |
+| B | deepseek-3.2 | `74685923` | look 2 (`543edf45`) + amendment-002 + r2 | **VALID-WITH-NOTES** — 1 blocking |
+
+Council runs after this record: 13 of 60.
+
+## Seat A (look 1) — dispositions
+
+Every statistic re-derived exactly by the seat (macro recalls, paired cluster bootstrap CI95
+[+0.091562, +0.281404] with the receipt's seed, per-stratum non-inferiority); arm conformance to
+fusion-spec v1 exact; 91/91 questions returned exactly five distinct ids; no gold-controlled
+ingestion or ranking path. The blocking findings were all provenance-record findings.
+
+| # | finding | verified | disposition |
+|---|---|---|---|
+| A1 | candidate commit equals the spec commit rather than postdating it | true | **not void** — the ruler requires declaration *before the look*; spec and arm were committed at `690a37d4` and the look ran from that HEAD 10 s later; receipt commit `ca55c653` postdates both. Receipts now record `fusion_spec.declared_commit` for a mechanical check. |
+| A2 | no fusion-spec field on the receipt | true | **accepted** — `score.py` records `fusion_spec.{path, sha256, declared_commit}`. |
+| A3 | gold receipt `dev.sha256` does not identify the DEV file | true, and `sealed.sha256` does not identify the SEALED file either | **accepted; void upheld** — Stage 2 record defect; see amendment-002. |
+| A4 | gold receipt `corpus_digest` ≠ result receipts'; ruler voids on mismatch | true; `a0df30bb…` reproduces from no item set | **accepted; void upheld** — cannot be overridden: the refuting evidence does not exist. |
+| A5 | B1-vs-B0 non-inferiority not recorded on the aggregate | true | **accepted** — `non_inferiority_macro` on every comparison. |
+| A6 | intervention bundles planner + index; scope filter differs | scope: `visibility_sql` excludes 0/5,879 — not a confound; bundling: true | **accepted as a measurement question** → `B1_planner` control, declared in spec v1.1 before look 2. |
+| A7 | the 42 errors are not the whole lift (49-question subset 0.494 vs 0.320 correct) | true | note; confirmed by look 2's control. |
+| A8–A9 | arm conformance exact; statistics re-derive exactly | — | notes. |
+| A10 | store not cryptographically bound; `KNOWLEDGE_PROOF_STORE` can redirect | true | **accepted** — `--store` records sha256 + size on the receipt. |
+| A11 | DEV evidence only; not a G1 pass | true | affirmed in every receipt's wording. |
+
+Outcome: **look 1 voided, still counted** (the number was seen). Remedy: ruler-amendment-002,
+`gold-v2-receipt-r2.json` via committed `recertify_gold.py`, harness provenance fields.
+
+## Seat B (look 2 + remedy) — dispositions
+
+| # | finding | verified | disposition |
+|---|---|---|---|
+| B1 | look 2's `previous_receipt_sha256` hashes the look 1 file **after** an in-place `VOIDED` edit, not as committed at `ca55c653` | true (`c4d52cea…` vs committed `ec9d6576…`) | **accepted (blocking)** — the orchestrator's error. Look 1 restored to its committed bytes; the void notice moved to a sidecar (`stage-d-look1-b1clean.VOIDED.md`); look 2 re-run chained to the pristine file; all four arms reproduced identically; chain verified `previous_receipt_sha256 == sha256(git show ca55c653:…)`. **Rule adopted: a receipt is never mutated after commit; annotations live in sidecars.** |
+| B2 | `B1_planner` omits `visibility_sql`, so "identical to B1 except the planner" was not literally true (0 sessions excluded, so no recall effect) | true | **accepted** — predicate added; per-question hits identical; spec claim now exact. |
+| B3 | `B1_planner` recovers 5 questions B1 threw on; supports planner attribution | true | note. |
+| B4 | r2 hashes reproduce from committed code + gold files + DB | reproduced by the seat | the remedy holds. |
+| B5 | clean-index increment Δ+0.042 CI95 [+0.009, +0.085] not established | true | recorded as such in the look 2 receipt commit. |
+| B6 | look 2 is not an "improvement" (lower bound unchanged at +0.092) | true | **stop rule 2 armed: one more flat DEV look ends Stage D's G1 looks.** |
+| B7 | amendment does not weaken SEALED protection (`corpus_digest.sealed` recorded; SEALED receipt must match it) | — | note. |
+
+## Standing of the measurements
+
+- **Look 1** — voided for provenance; numbers re-derived exactly by seat A and reproduced by look 2.
+- **Look 2** — valid after B1/B2 remedies: `B1_planner` 0.249 (+0.142 vs B1, CI95 [+0.060, +0.231],
+  established); `B1_clean` 0.291 (+0.184, CI95 [+0.092, +0.281], established); clean-index
+  increment +0.042 (CI95 [+0.009, +0.085], **not** established; never loses: 4/0/87).
+- **Attribution:** the planner is most of the effect. The shipped AND-first query form is too
+  strict independent of crashing (0.479 vs 0.320 on the 49 questions it answered). F-B0-1 is
+  thereby a *measured* defect in the shipped path worth +0.142 macro recall@5 on DEV.
+- **G1 is not claimed.** DEV looks used: 2 of 4. SEALED untouched.

docs/architecture/session-memory/receipts/council-stage-d-looks.md

@@ -0,0 +1,14 @@
+# stage-d-look1-b1clean.json — VOIDED
+
+Voided by the receipt council (seat gpt-5.6-terra, run `4ed818c7`) for provenance: the Stage 2
+gold receipt's hashes are non-reproducible (ruler-amendment-002, F3/F4). The seat re-derived the
+receipt's statistics exactly; they were superseded by `stage-d-look2-planner-control.json`, which
+reproduces B0/B1/B1_clean identically and adds the `B1_planner` control.
+
+The receipt file itself is **byte-identical to its commit `ca55c653`** (sha256
+`ec9d6576028140fa…`). It was briefly edited in place to carry this notice (commit `f5c1597d`),
+which the second council seat (deepseek-3.2, run `74685923`) correctly flagged as breaking the
+chain's intent; the edit was reverted and the notice moved here. Rule from here on: **a receipt is
+never mutated after commit — annotations live in a sidecar.**
+
+Counts as DEV look 1 of ≤ 4 for the G1 family.

docs/architecture/session-memory/receipts/stage-d-look1-b1clean.VOIDED.md

@@ -1879,10 +1879,5 @@
    }
   }
  },
- "previous_receipt_sha256": "c66058836c85140882c816dba392fe835a64b804c688285b8f37f4d1285f6b9b",
- "VOIDED": {
-  "by": "receipt council seat gpt-5.6-terra run 4ed818c7",
-  "reason": "gold receipt provenance hashes non-reproducible (ruler-amendment-002 F3/F4); numbers re-derived exactly by the seat and superseded by look 2",
-  "counts_as_dev_look": 1
- }
+ "previous_receipt_sha256": "c66058836c85140882c816dba392fe835a64b804c688285b8f37f4d1285f6b9b"
 }

docs/architecture/session-memory/receipts/stage-d-look1-b1clean.json

@@ -1,8 +1,8 @@
 {
  "receipt": "stage-d-look2-planner-control",
- "created_utc": "2026-09-10T03:19:55+00:00",
+ "created_utc": "2026-09-10T03:32:48+00:00",
  "ruler_commit": "a98331afd2bb0c864e416c943b4a51962fe659e2",
- "candidate_commit": "f5c1597df4c6862cc555882b8efce2f0a600b520",
+ "candidate_commit": "543edf45847a66a385c0aca9839dc4edd4f193ef",
  "b0_pin": "031dbab9f72fcc4077da2963d6e60163f4517438",
  "fusion_spec": {
   "path": "docs/architecture/session-memory/receipts/fusion-spec-v1.md",
@@ -41,8 +41,8 @@
     "macro": 0.08365261813537674
    },
    "latency_ms": {
-    "p50": 3.164708847180009,
-    "p95": 33.22508395649493
+    "p50": 3.3488329499959946,
+    "p95": 38.47483289428055
    },
    "errors": 42
   },
@@ -64,8 +64,8 @@
     "macro": 0.08365261813537674
    },
    "latency_ms": {
-    "p50": 3.077833214774728,
-    "p95": 33.17750012502074
+    "p50": 3.4829580690711737,
+    "p95": 36.87191708013415
    },
    "errors": 42
   },
@@ -87,8 +87,8 @@
     "macro": 0.2012771392081737
    },
    "latency_ms": {
-    "p50": 30.75541602447629,
-    "p95": 40.985000086948276
+    "p50": 31.848042039200664,
+    "p95": 41.24587494879961
    },
    "errors": 0
   },
@@ -110,8 +110,8 @@
     "macro": 0.1741727621037966
    },
    "latency_ms": {
-    "p50": 53.07779205031693,
-    "p95": 66.05166709050536
+    "p50": 70.3739591408521,
+    "p95": 86.80554083548486
    },
    "errors": 0
   }
@@ -2510,5 +2510,5 @@
    }
   }
  },
- "previous_receipt_sha256": "c4d52cea52bdf9a794e1659f87930149264ffaae9a938da81db108899263a37b"
+ "previous_receipt_sha256": "ec9d6576028140fad744946adf1df1cbf2781ee8e2027994b5692e21292a50c4"
 }

docs/architecture/session-memory/receipts/stage-d-look2-planner-control.json

@@ -77,25 +77,31 @@ def B1_planner() -> Arm:  # noqa: N802 - arm names are receipt labels, matched t
     Control arm that separates two effects bundled in ``B1_clean``: (i) a planner that
     never throws, and (ii) an index that holds prose only. This arm keeps the shipped
     ``messages_fts`` over every archive row (tool echo, duplicates and all), the shipped
-    ``bm25(messages_fts)`` ranking, the shipped 200-row candidate budget and first-seen
-    session dedup, and swaps *only* the query text for ``plan_prose_query(question)``.
+    ``bm25(messages_fts)`` ranking, the shipped scope-visibility predicate, the shipped
+    200-row candidate budget and first-seen session dedup, and swaps *only* the query text
+    for ``plan_prose_query(question)``.
 
     If ``B1_planner`` ≈ ``B1_clean``, the lift is the planner. If ``B1_planner`` ≈ ``B1``
     on the questions ``B1`` answered, the lift is the clean index.
     """
+    import importlib
+
     from learning_memory.store import plan_prose_query
 
+    visibility_sql = importlib.import_module("agent_session_tools.context.public").visibility_sql
+
     def arm(archive: sqlite3.Connection, question: str) -> list[str]:
         planned = plan_prose_query(question)
         if not planned:
             return []
+        visible, scope_params = visibility_sql(archive, "s.id")
         rows = archive.execute(
-            "SELECT m.session_id FROM messages m "
+            "SELECT s.id FROM messages m JOIN sessions s ON m.session_id = s.id "
             "JOIN messages_fts ON messages_fts.rowid = m.rowid "
-            "WHERE messages_fts MATCH ? "
+            f"WHERE messages_fts MATCH ? AND {visible} "
             "ORDER BY bm25(messages_fts), m.timestamp DESC "
             f"LIMIT {CANDIDATE_ROWS}",
-            (planned,),
+            [planned, *scope_params],
         ).fetchall()
         seen: list[str] = []
         for (sid,) in rows: