Land the Gate 2 amendments

[MongLong0214]

Lands the Gate 2 amendments the owner made binding at dev a333e76f59493ec90e100d1d44c833d7d9e5f093. Planning documents only — no product code, nothing merged, nothing tagged.

Amendments

Expiry anchor. expires_at is null while a record is prepared or verified; stage success stamps staged_at and expires_at = staged_at + 5 minutes. Two audits had disagreed. The old "5 minutes from creation" would have expired a capture that was still being verified, and the staleness it guarded against is already caught by the staged-diff-hash gate. ADR-0021 §3 gate 3 and T-1004's Minimum GREEN both say so now.

Two conflated headings. T-1020 and T-1021 depend only on ADR-0020; T-1024 only on T-1020. The src/mcp/server.ts and README orderings are file contention and are labelled as such. Read literally, the old wording pushed T-1020 from wave 1 to wave 6, T-1021 to wave 3 and T-1024 to wave 7 — this is the throughput fix.

Write-path trust boundary. A caller-supplied nonce is validated against ^[0-9a-f]{32}$ before it reaches any path resolution (T-1001). commitlore capture forwards the nonce and nothing else (T-1006). Every binding a staged record carries — base_head, staged_diff_hash, policy_identity_hash, staged_at, expires_at — is recomputed server-side, never accepted from the caller (T-1009).

T-1015 section anchors. #167's five abstract labels are pinned to concrete headings, and See it work moves to sit after the install command and before evidence. The RED assertion is that the current order is wrong.

T-1016 recording mechanism. A Node-stdlib animated SVG, fixed environment, viewport and frame timing, --check comparing bytes exactly. No recorder dependency and no manifest fallback.

T-1024 verification_gaps. A closed, ordered set: history-unavailable, shallow-history, notes-unfetched. An empty array means all three were checked and none applied — never that the checks were skipped.

T-1030 scope. Diagnostic honesty only. It may not close #192 alone; the node-22 intermittency is now #221.

Verified

• git status — five planning documents changed, nothing under src/, test/, bench/, README*, package.json, CHANGELOG.md or .github/workflows/.
• Commit-msg hook validated the record: shape ok · references ok.
• No source file touched, so no dist/ rebuild was required and none occurred.

Requesting the merge gate: I cannot merge this myself, and the wave-1 tickets need these amendments on dev.

[github-actions]

CommitLore — record lint

Trailers: clean — 1 commit in origin/dev..a4bdc429ee27f1ce6d830668c5ac2389fea3bddb
Active constraints: 7 limits · 16 ruled-out · 4 warnings — from 10 records over 5 changed paths

Active constraints for the paths this PR touches

Limits (7)

• r-gate2amend a4bdc42 — nothing mechanically enforces that a future heading keeps prerequisites and ordering in separate fields; the separation is stated and reviewed, not checked
• r-m5align730b 6d98064 — nothing mechanically prevents the next editor writing "closes" again; the phrasing rule lives in the legend and in review, not in a check
• r-m5align730 ad59b5b — nothing enforces that a later editor re-derives a row from the review rather than from its citations, which is exactly how these four drifted
• r-fixdemofx fd5089b — this repairs the two tickets that referenced the broken shape (T-1010 directly, T-1011 needed no change); it does not add a general check that a future ticket cannot reintroduce a static .lifecycle assumption
• r-gateaacc 45a8f2b — nothing enforces the src/mcp/server.ts merge-sequencing rule automatically — it is a process constraint the next PR author has to read and follow
• r-c0f4e2 3d249cd — npm gitlore is held by an active same-domain CLI, so the owner's first-choice name was not available
• r-a8f3c1 ef48843 — Rename must land before any code exists -- after 27 tickets it would touch spec, fixtures, index, hooks and every doc

Ruled out (16)

• r-gate2amend a4bdc42 — keeping expiry anchored to creation with a longer window | a longer window hides the same defect and makes it rarer rather than absent
• r-gate2amend a4bdc42 — a frame manifest for T-1016 | a check that tolerates drift stops detecting the drift it exists to detect
• r-gate2amend a4bdc42 — leaving verification_gaps to be derived at implementation time | it was the second invented concept this milestone, and naming the closed ordered set now is what stops a third
• r-m5align730b 6d98064 — leaving it and noting the legend covers it | a legend that one line contradicts stops being a rule and becomes a preference
• r-m5align730 ad59b5b — keeping T-1019 and T-1023 attached to P0-7 and P0-4 with corrected wording | the rows they claimed do not mean what those tickets do, so the attachment was the defect rather than the phrasing
• r-m5align730 ad59b5b — leaving P0-8 unscheduled with the confidence-separation question open | the review asks for it in Gate A, and T-1024 answers the question structurally instead: guard_confidence qualifies possible_revival_matches and the context fields never inherit it, so no second label is invented
• r-pendpath 233a891 — leaving this to the implementer's judgment | the precedent already exists in this codebase and the failure mode (silently wrong location in a worktree) would not surface as a test failure unless someone specifically writes a worktree test -- worth pinning explicitly rather than hoping it's noticed
• r-fixdemofx fd5089b — adding a stale engine call inside T-1010 to compute lifecycle there | contradicts the ticket's own forbidden scope, and duplicates work T-1011 already does correctly
• r-gateaacc 45a8f2b — rewriting ADR-0020/0021/0022 or the existing T-1001 · Pending transaction store #193-213 issue bodies | they already meet or exceed the source review's own requirements (exact ownership, forbidden scope, RED/GREEN, AC-to-test, four-tier verification, evidence invalidation, stop conditions); rewriting working documents to match a stale review would be pure churn
• r-gateaacc 45a8f2b — inventing content for a hypothetical P0-7 original definition | none exists in history (verified); asserting one would be the exact failure this document exists to prevent
• r-3b57e2 30f2d5f — converting the three translated READMEs for consistency | they are the product, not the record, and two checks exist specifically to keep them
• r-c0f4e2 3d249cd — GitLore published as git-lore | the binary and search results still collide with the existing gitlore tool
• r-c0f4e2 3d249cd — keep Annals | the sound problem does not decay, and with code near zero this is the cheapest moment the project will ever have
• r-c0f4e2 3d249cd — rename code and spec first, documents later | the drift window makes every artifact written in it wrong
• r-a8f3c1 ef48843 — keep name, change vocabulary only | vocabulary is the protocol, so half the change leaves the substance untouched
• r-a8f3c1 ef48843 — drop Certainty as a dead field | a real route exists -- stale sweep prioritizes guess-level records for review

Warnings (4)

• r-3b57e2 30f2d5f (claim) — bench/PREREGISTRATION.md is append-only and was translated in place. Its section numbering and order are unchanged, but a translation is still an edit to a file whose whole discipline is that it is not edited. Recorded here rather than left to be noticed
• r-c0f4e2 3d249cd (claim) — ADR-0008 and ADR-0009 keep the literal string Annals on purpose -- mechanical substitution there destroys the decision trail
• r-c0f4e2 3d249cd (claim) — the residual grep for lore_query reports a false positive because commitlore_query contains it as a substring, so check the prefix
• r-a8f3c1 ef48843 (claim) — docs/adr/ADR-0008 is the canonical vocabulary -- do not reintroduce old terms from memory

git log --follow accepts exactly one pathspec, so renames are not followed for 5 paths; query one path at a time to follow its rename chain

_{Trailer violations fail this check. Active constraints are informational — they are what the repository already decided, not a verdict on this PR.}