diff --git a/decisions/d011_v14/D-011-LOCK-V15.json b/decisions/d011_v14/D-011-LOCK-V15.json
index 65c92885af..eba93d948c 100644
--- a/decisions/d011_v14/D-011-LOCK-V15.json
+++ b/decisions/d011_v14/D-011-LOCK-V15.json
@@ -1 +1 @@
-{"bindings":{"aggregate_sha256":"faa434301694f8e52327ac0a43a94b6a14a65dfd83165560181c34be2927efda","boundary_manifest":{"bytes":2659493,"path":"decisions/d011_v14/d011-boundary-manifest-v1.json","regenerated_from":"d011_manifest.manifest_spec()","sha256":"a97334f339ece0397a6dc41581154b2ece8e0d67596058676092b12f74bb02ea"},"candidate_digest":"da2ba64d2623e1202369206b2ba618a2dcfb87af4ebedc2a90e0bf2205c3967d","checkpoint_a_double_prime":{"commit":"edf85f3a0033c8bd747e5e3f3ce5d722a5cea7f7","tree":"ca232cfe6ea77e984b899814022e5d3bfb7ddde6"},"engine_pins":{"oracle":{"ast_sha256":"34a0775391546682c09971b77b76852359f794e74dbca5d1ccdeb13236279109","git_blob_oid":"8819391342e6749a131e5bf882960e82dfa7f2e3","sha256":"636611688946c7d9dff3722325bfc22a2be17153efba8c5324ebd48ec72d7739"},"primary":{"ast_sha256":"d75f76e51fd93d84140193bc22e0de29b6b64c2c5333734c9dc8dab627c21461","git_blob_oid":"952b9f5edb1f70391ea7324ee57b581a5f4e9a18","sha256":"89b1960b6036d5e33c434cd6eae9b677ba1ca15d49bcdb6240d9aabba1eda516"}},"execution_module":{"bytes":80189,"path":"decisions/d011_v14/d011_execution.py","review":"V15_COMPLETION_CHANGED","sha256":"5f4c32e75397f67c2021770ff251bf01341ed4d912c06dd76c8671d39a4c9bbf"},"governed_scope":["decisions/d011_v14/d011_protocol.py","decisions/d011_v14/d011_stage_c.py","decisions/d011_v14/d011_runtime.py","decisions/d011_v14/d011_authority.py","decisions/d011_v14/d011_producers.py","decisions/d011_v14/d011_stage_b.py"],"manifest_module":{"bytes":211887,"path":"decisions/d011_v14/d011_manifest.py","review":"V15_ADAPTER_CHANGED","sha256":"15b76cb984f34cfcb58d3c7758a97a8b76ff3f21382977ed0690abbec4fa3ae3"},"schema":"D011-LOCK-ROOT-BINDINGS-15","source_map_sha256":"2570987fe0281d1851ba3d06f0ebccfd48cd4eec97d47e26494375a9261638c7"},"candidate":"D-011-CANDIDATE-V15","context":"TEST_ONLY","decision":"D-011","id":"LOCK-V15","kind":"LOCK","schema":"D011-LOCK-15","stage":"STAGE_B"}
+{"bindings":{"aggregate_sha256":"963c1b374255ecd4a2d315e01419d1ac97d6355786bf9e1f139a83dddd1455bf","boundary_manifest":{"bytes":2659529,"path":"decisions/d011_v14/d011-boundary-manifest-v1.json","regenerated_from":"d011_manifest.manifest_spec()","sha256":"06b8a2112b962a7fcd6657cb548ea30b598008b9deb26e406d53f1241116c0cc"},"candidate_digest":"182de83dd7593c8b2af71d3a0e58604056850033fc34309eb08cf08ddd90ae78","checkpoint_a_triple_prime":{"commit":"0a22837e498614f0f90fac510fc8729b9527072c","tree":"2b7eb8135daa78f37961bf02e3ec25fb2278fbff"},"engine_pins":{"oracle":{"ast_sha256":"34d9a7773ef46a5d429205e3e7557c89ca52cfb73b9b1c336d8b5f1bd0f96d77","git_blob_oid":"92ce92ccfb875993ba1d9e45b0e0c34c3f08cd83","sha256":"3741805546997b6a84159c2cc869559508082c0015155ab28b35026678415d73"},"primary":{"ast_sha256":"d75f76e51fd93d84140193bc22e0de29b6b64c2c5333734c9dc8dab627c21461","git_blob_oid":"952b9f5edb1f70391ea7324ee57b581a5f4e9a18","sha256":"89b1960b6036d5e33c434cd6eae9b677ba1ca15d49bcdb6240d9aabba1eda516"}},"execution_module":{"bytes":80189,"path":"decisions/d011_v14/d011_execution.py","review":"V15_COMPLETION_CHANGED","sha256":"5f4c32e75397f67c2021770ff251bf01341ed4d912c06dd76c8671d39a4c9bbf"},"governed_scope":["decisions/d011_v14/d011_protocol.py","decisions/d011_v14/d011_stage_c.py","decisions/d011_v14/d011_runtime.py","decisions/d011_v14/d011_authority.py","decisions/d011_v14/d011_producers.py","decisions/d011_v14/d011_stage_b.py"],"manifest_module":{"bytes":211887,"path":"decisions/d011_v14/d011_manifest.py","review":"V15_ADAPTER_CHANGED","sha256":"6fac8eb03e3b4dc77646292d06beb72fb2a3af87edf24c73171e0582c8c2db34"},"oracle_module":{"bytes":33060,"path":"decisions/d011_v14/d011_oracle.py","review":"V15_ORACLE_FIX_CHANGED","sha256":"3741805546997b6a84159c2cc869559508082c0015155ab28b35026678415d73"},"schema":"D011-LOCK-ROOT-BINDINGS-15","source_map_sha256":"6f94fb6dd795d158aba0cfcf8c4d0489975225533d53dd9dff82f2adb522c6aa"},"candidate":"D-011-CANDIDATE-V15","context":"TEST_ONLY","decision":"D-011","id":"LOCK-V15","kind":"LOCK","schema":"D011-LOCK-15","stage":"STAGE_B"}
diff --git a/decisions/d011_v14/D-011-PREFREEZE-AGGREGATE-V15.json b/decisions/d011_v14/D-011-PREFREEZE-AGGREGATE-V15.json
index 6e0c44e5b0..22c4db57e5 100644
--- a/decisions/d011_v14/D-011-PREFREEZE-AGGREGATE-V15.json
+++ b/decisions/d011_v14/D-011-PREFREEZE-AGGREGATE-V15.json
@@ -1 +1 @@
-{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"da2ba64d2623e1202369206b2ba618a2dcfb87af4ebedc2a90e0bf2205c3967d","context":"TEST_ONLY","decision":"D-011","ordered_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":7291,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"27cc1162293adc9f054369ac5ee0c96d065c96e4b1bb548007367b825cccc00d"},{"id":"PREFREEZE-PROVENANCE","length":11514,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"aa548a576fc22278c36ee1ab22af9dad6c59677b3adfc7884bbb96357b2bf9f7"}],"schema":"D011-PREFREEZE-AGGREGATE-15","stage":"STAGE_B"}
+{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"182de83dd7593c8b2af71d3a0e58604056850033fc34309eb08cf08ddd90ae78","context":"TEST_ONLY","decision":"D-011","ordered_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":8677,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"945a0343a936ac307f9fe3026a55f521bf506adbdb142f63248ed7d84f6f04ca"},{"id":"PREFREEZE-PROVENANCE","length":13007,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"f0a3c39c28aaf1998b19e65c226e8b2fde2d9724e8c937f005393316c1204f44"}],"schema":"D011-PREFREEZE-AGGREGATE-15","stage":"STAGE_B"}
diff --git a/decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json b/decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json
index 7d4550d7e4..55976ce2cd 100644
--- a/decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json
+++ b/decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json
@@ -1 +1 @@
-{"adapter_change":{"admits":"PRODUCTION_EXTERNAL","commit":"90ab0b041","commit_full":"90ab0b041ba862ccc3ea58f63c0c1e979c642dbc","engines":"UNTOUCHED","kind":"PRODUCTION_EXECUTION_ADAPTER","ordinal":6,"summary":"v15 adapter: the boundary policy admits PRODUCTION_EXTERNAL via consulted adapter + owner-authorization records; invocation-binding emission/validation follows the boundary decision; mutation-pair/child lineage follows the context. TEST_ONLY discipline unchanged; engines untouched; the boundary manifest is regenerated through the pure generation path.","test_only_discipline":"UNCHANGED","tree":"0e40f9804b77bda5ec1a13dae17d019e10fcce11"},"anchor_preservation":{"engine_fix_commits":["cb026f703","cd9d2bf78","87a22622d","aa052d845","102fab4ba"],"expected":11,"family":"_AST_FAULTS","preserved":11,"proof":"IN_MEMORY"},"boundary_manifest":{"bytes":2659493,"path":"decisions/d011_v14/d011-boundary-manifest-v1.json","regenerated_from":"d011_manifest.manifest_spec()","sha256":"a97334f339ece0397a6dc41581154b2ece8e0d67596058676092b12f74bb02ea"},"candidate":"D-011-CANDIDATE-V15","checkpoint_a_double_prime":{"commit":"edf85f3a0033c8bd747e5e3f3ce5d722a5cea7f7","tree":"ca232cfe6ea77e984b899814022e5d3bfb7ddde6"},"completion_change":{"bfs_builder":{"reports":21,"validated_by":"_bfs_contract"},"commit":"edf85f3a0","engine_calls":"NONE","engines":"UNTOUCHED","kind":"PRODUCTION_CONTEXT_COMPLETION","ordinal":7,"placement_builder":{"cells":1392,"compromise":1296,"omission_restored":96,"validated_by":"_placement_contract"},"prediction":"STRICT_SUBSET_PROFILE_TRUSTED_RUNTIME","reconciliation_sub_protocol":"FOLLOWS_BOUNDARY_DECISION","summary":"v15 production-context completion: the reconciliation sub-protocol context follows the checked-execution boundary decision (d011_manifest emission/validation + d011_execution request builders gate-check lineage, default TEST_ONLY, accept PRODUCTION_EXTERNAL). New frozen deterministic placement-cell builders (1,392 = 1,296 COMPROMISE + 96 OMISSION/RESTORED) and BFS builders (families x profiles = 21) emit born-lineage records validated by the frozen _placement_contract / _bfs_contract with no engine or checker calls. TEST_ONLY discipline unchanged; engines and all other modules untouched; the boundary manifest is regenerated through the pure generation path. The unique strict-subset profile (TRUSTED_RUNTIME) placement discriminant is a source-derived PREDICTION from the declared law, not evidence.","test_only_discipline":"UNCHANGED"},"context":"TEST_ONLY","decision":"D-011","engine_pins":{"oracle":{"ast_sha256":"34a0775391546682c09971b77b76852359f794e74dbca5d1ccdeb13236279109","git_blob_oid":"8819391342e6749a131e5bf882960e82dfa7f2e3","sha256":"636611688946c7d9dff3722325bfc22a2be17153efba8c5324ebd48ec72d7739"},"primary":{"ast_sha256":"d75f76e51fd93d84140193bc22e0de29b6b64c2c5333734c9dc8dab627c21461","git_blob_oid":"952b9f5edb1f70391ea7324ee57b581a5f4e9a18","sha256":"89b1960b6036d5e33c434cd6eae9b677ba1ca15d49bcdb6240d9aabba1eda516"}},"execution_module":{"bytes":80189,"path":"decisions/d011_v14/d011_execution.py","review":"V15_COMPLETION_CHANGED","sha256":"5f4c32e75397f67c2021770ff251bf01341ed4d912c06dd76c8671d39a4c9bbf"},"findings":["All 11 _AST_FAULTS anchors are preserved across the five engine fixes (in-memory proof); the v15 adapter and the production-context completion touch no engine.","The expanded reconciliation closure (12 sources) hashes to the bound source_map_sha256; the six reviewed modules are unchanged and d011_manifest.py and d011_execution.py are the two changed modules.","The regenerated boundary manifest is bound by identity (bytes + sha256) through the pure generation path; it was regenerated by the completion commit.","The production-context completion adds frozen deterministic placement/BFS builders validated by the frozen contracts with no engine or checker calls.","The unique strict-subset placement profile (TRUSTED_RUNTIME) is a source-derived PREDICTION from the declared law, not evidence; no winner is claimed at freeze.","The rehearsal reconciles exactly with the Basis B ledger: 3880 preregistered jobs across 15 segments."],"input_index":2,"kind":"PREFREEZE_REVIEW","manifest_module":{"bytes":211887,"path":"decisions/d011_v14/d011_manifest.py","review":"V15_ADAPTER_CHANGED","sha256":"15b76cb984f34cfcb58d3c7758a97a8b76ff3f21382977ed0690abbec4fa3ae3"},"nonclaims":["NO_PRODUCTION_AUTHORITY","NO_QUALIFICATION","NO_STAGE_C_AUTHORIZATION","NO_SELECTION","NO_PRODUCTION_EVIDENCE"],"owner_role":"PROVENANCE_REVIEWER","prediction":{"basis":"DECLARED_LAW","claim":"STRICT_SUBSET_PLACEMENT_DISCRIMINANT_TRUSTED_RUNTIME","kind":"SOURCE_DERIVED_PREDICTION_NOT_EVIDENCE","winner_claimed_at_freeze":0},"production_authority_available":0,"rehearsal_evidence_chain":{"preregistration":"prereg.json and prereg.pin.json content-hash pinned","reconciliation":"reconciles exactly with the Basis B ledger","segment_isolation":"one store per segment and per round"},"review_id":"PREFREEZE-PROVENANCE","reviewed_modules":[{"bytes":35945,"path":"decisions/d011_v14/d011_protocol.py","review":"CROSS_MODEL_REVIEWED","sha256":"be15c609093124d4c5e562d115584db8a0416d116a3ae6fe91361a3cdb0dac17"},{"bytes":28612,"path":"decisions/d011_v14/d011_stage_c.py","review":"CROSS_MODEL_REVIEWED","sha256":"a6c6167761693b3212763bdddbc3e6cf9875f6345f87c350316446b35419f296"},{"bytes":40096,"path":"decisions/d011_v14/d011_runtime.py","review":"CROSS_MODEL_REVIEWED","sha256":"b82073aa08daf0f069592e4ec01f83318aef6334b7ba7c57b8910eae013539ad"},{"bytes":52455,"path":"decisions/d011_v14/d011_authority.py","review":"CROSS_MODEL_REVIEWED","sha256":"6c1e35c20011a0db778a3a1c9222b79e333572c0be1ca1874a0d49bef66be9b9"},{"bytes":50028,"path":"decisions/d011_v14/d011_producers.py","review":"CROSS_MODEL_REVIEWED","sha256":"7e63471020fcb2817cca55d5927108c9dbb3053f66a483b5372fc6cfdaf8204e"},{"bytes":39074,"path":"decisions/d011_v14/d011_stage_b.py","review":"CROSS_MODEL_REVIEWED","sha256":"04eb155b4bb0016fc174fd27de784a316b8f383836602cc481782e11df888f11"}],"schema":"D011-PREFREEZE-REVIEW-15","source_changes":[{"commit":"cb026f703","engine":"PRIMARY","ordinal":1,"summary":"PRIMARY totalization: schema_scenario rejects non-dict events with clean DENY_SCHEMA (was AttributeError)."},{"commit":"cd9d2bf78","engine":"ORACLE","ordinal":2,"summary":"ORACLE totality: observe() family dispatch and the event-identity prelude are total on malformed events."},{"commit":"87a22622d","engine":"PRIMARY+ORACLE","ordinal":3,"summary":"FINAL fuzz-guided engine-totality batch: 12 fuzz sites + 21 same-shape siblings; 7398-run fuzz gate non-vacuous."},{"commit":"aa052d845","engine":"ORACLE","ordinal":4,"summary":"ORACLE state-key type fix: keys written into typed engine state are strings; non-str identifiers resolve DENY_SCHEMA before any state write."},{"commit":"102fab4ba","engine":"PRIMARY+ORACLE","ordinal":5,"summary":"Placement-attack state-key law: attack_schema_deny prelude requires non-empty string payload-key fields, else DENY_SCHEMA with unmutated state."},{"admits":"PRODUCTION_EXTERNAL","commit":"90ab0b041","commit_full":"90ab0b041ba862ccc3ea58f63c0c1e979c642dbc","engines":"UNTOUCHED","kind":"PRODUCTION_EXECUTION_ADAPTER","ordinal":6,"summary":"v15 adapter: the boundary policy admits PRODUCTION_EXTERNAL via consulted adapter + owner-authorization records; invocation-binding emission/validation follows the boundary decision; mutation-pair/child lineage follows the context. TEST_ONLY discipline unchanged; engines untouched; the boundary manifest is regenerated through the pure generation path.","test_only_discipline":"UNCHANGED","tree":"0e40f9804b77bda5ec1a13dae17d019e10fcce11"},{"bfs_builder":{"reports":21,"validated_by":"_bfs_contract"},"commit":"edf85f3a0","engine_calls":"NONE","engines":"UNTOUCHED","kind":"PRODUCTION_CONTEXT_COMPLETION","ordinal":7,"placement_builder":{"cells":1392,"compromise":1296,"omission_restored":96,"validated_by":"_placement_contract"},"prediction":"STRICT_SUBSET_PROFILE_TRUSTED_RUNTIME","reconciliation_sub_protocol":"FOLLOWS_BOUNDARY_DECISION","summary":"v15 production-context completion: the reconciliation sub-protocol context follows the checked-execution boundary decision (d011_manifest emission/validation + d011_execution request builders gate-check lineage, default TEST_ONLY, accept PRODUCTION_EXTERNAL). New frozen deterministic placement-cell builders (1,392 = 1,296 COMPROMISE + 96 OMISSION/RESTORED) and BFS builders (families x profiles = 21) emit born-lineage records validated by the frozen _placement_contract / _bfs_contract with no engine or checker calls. TEST_ONLY discipline unchanged; engines and all other modules untouched; the boundary manifest is regenerated through the pure generation path. The unique strict-subset profile (TRUSTED_RUNTIME) placement discriminant is a source-derived PREDICTION from the declared law, not evidence.","test_only_discipline":"UNCHANGED"}],"source_map":{"decisions/d011_v14/D-011-PACKET.md":{"byte_length":51080,"git_blob_oid":"56cb6c5ff460acbb90529f1249e4fb73cae1b588","sha256":"7c95f8be7ae88f0cda32650fc22962b409023b8f8df6c9f4f047d58bf22e3b2e"},"decisions/d011_v14/d011-boundary-manifest-v1.json":{"byte_length":2659493,"git_blob_oid":"8f0bbf2dcff7e17e6b43f062c7490a1461d3e016","sha256":"a97334f339ece0397a6dc41581154b2ece8e0d67596058676092b12f74bb02ea"},"decisions/d011_v14/d011_assurance.py":{"byte_length":45720,"git_blob_oid":"bf057df7d446ee8d7dd3e20ffa31158e3b7fc77b","sha256":"48f5fa2b05a0d31e2e9288e3ecf8fae062516b83bdf70549a80c48c740750763"},"decisions/d011_v14/d011_domain.py":{"byte_length":42913,"git_blob_oid":"53ba26ec323ad194b67d4c9c751c4f3d47909396","sha256":"aa4344b2a18910061cec293cf2acbb3285108b634b0c04a75e0e2dcbb791d168"},"decisions/d011_v14/d011_execution.py":{"byte_length":80189,"git_blob_oid":"77a8399ec641bff6554be3f063fd2a7a38cc92fd","sha256":"5f4c32e75397f67c2021770ff251bf01341ed4d912c06dd76c8671d39a4c9bbf"},"decisions/d011_v14/d011_manifest.py":{"byte_length":211887,"git_blob_oid":"2b52ce0111034fc0f4d1de3bce432d4b17d5f60e","sha256":"15b76cb984f34cfcb58d3c7758a97a8b76ff3f21382977ed0690abbec4fa3ae3"},"decisions/d011_v14/d011_oracle.py":{"byte_length":32564,"git_blob_oid":"8819391342e6749a131e5bf882960e82dfa7f2e3","sha256":"636611688946c7d9dff3722325bfc22a2be17153efba8c5324ebd48ec72d7739"},"decisions/d011_v14/d011_primary.py":{"byte_length":39632,"git_blob_oid":"952b9f5edb1f70391ea7324ee57b581a5f4e9a18","sha256":"89b1960b6036d5e33c434cd6eae9b677ba1ca15d49bcdb6240d9aabba1eda516"},"decisions/d011_v14/test_d011_domain.py":{"byte_length":65183,"git_blob_oid":"3bf653a42a5438d165ed7b0a4757526f1881e395","sha256":"2511070031d8919bc2241986ae1ef4356936171382e2af106dfe89544acc99e9"},"decisions/d011_v14/test_d011_execution.py":{"byte_length":49547,"git_blob_oid":"ad411b1c0d544c5760e782f90233cd5fc0bab643","sha256":"24e7327aeebb8546d19f846dee05dc43c7fcaeb3693494b70f0180b91a530097"},"decisions/d011_v14/test_d011_integration.py":{"byte_length":141455,"git_blob_oid":"3f9637fdbeedb183233332bd632e8338ed0420a6","sha256":"9b07f6ee0e134b523ec67a952316938895ef07e19f43d685fda433cd7c28f899"},"decisions/d011_v14/test_d011_manifest.py":{"byte_length":379107,"git_blob_oid":"90db7e6746f1731689d58912cefc1e0cb7157865","sha256":"153f12bf952884b5e30a75a7c4112429dbabaf512f5f145b225554e827a40f2b"}},"source_map_sha256":"2570987fe0281d1851ba3d06f0ebccfd48cd4eec97d47e26494375a9261638c7","stage":"STAGE_B","subject":"M4_STAGE_B_PROVENANCE_V15","test_only":1,"verdict":"REVIEWED_PASS_WITH_FINDINGS"}
+{"adapter_change":{"admits":"PRODUCTION_EXTERNAL","commit":"90ab0b041","commit_full":"90ab0b041ba862ccc3ea58f63c0c1e979c642dbc","engines":"UNTOUCHED","kind":"PRODUCTION_EXECUTION_ADAPTER","ordinal":6,"summary":"v15 adapter: the boundary policy admits PRODUCTION_EXTERNAL via consulted adapter + owner-authorization records; invocation-binding emission/validation follows the boundary decision; mutation-pair/child lineage follows the context. TEST_ONLY discipline unchanged; engines untouched; the boundary manifest is regenerated through the pure generation path.","test_only_discipline":"UNCHANGED","tree":"0e40f9804b77bda5ec1a13dae17d019e10fcce11"},"anchor_preservation":{"engine_fix_commits":["cb026f703","cd9d2bf78","87a22622d","aa052d845","102fab4ba"],"expected":11,"family":"_AST_FAULTS","preserved":11,"proof":"IN_MEMORY"},"boundary_manifest":{"bytes":2659529,"path":"decisions/d011_v14/d011-boundary-manifest-v1.json","regenerated_from":"d011_manifest.manifest_spec()","sha256":"06b8a2112b962a7fcd6657cb548ea30b598008b9deb26e406d53f1241116c0cc"},"candidate":"D-011-CANDIDATE-V15","checkpoint_a_triple_prime":{"commit":"0a22837e498614f0f90fac510fc8729b9527072c","tree":"2b7eb8135daa78f37961bf02e3ec25fb2278fbff"},"completion_change":{"bfs_builder":{"reports":21,"validated_by":"_bfs_contract"},"commit":"edf85f3a0","commit_full":"edf85f3a0033c8bd747e5e3f3ce5d722a5cea7f7","engine_calls":"NONE","engines":"UNTOUCHED","kind":"PRODUCTION_CONTEXT_COMPLETION","ordinal":7,"placement_builder":{"cells":1392,"compromise":1296,"omission_restored":96,"validated_by":"_placement_contract"},"prediction":"STRICT_SUBSET_PROFILE_TRUSTED_RUNTIME","reconciliation_sub_protocol":"FOLLOWS_BOUNDARY_DECISION","summary":"v15 production-context completion: the reconciliation sub-protocol context follows the checked-execution boundary decision (d011_manifest emission/validation + d011_execution request builders gate-check lineage, default TEST_ONLY, accept PRODUCTION_EXTERNAL). New frozen deterministic placement-cell builders (1,392 = 1,296 COMPROMISE + 96 OMISSION/RESTORED) and BFS builders (families x profiles = 21) emit born-lineage records validated by the frozen _placement_contract / _bfs_contract with no engine or checker calls. TEST_ONLY discipline unchanged; engines and all other modules untouched; the boundary manifest is regenerated through the pure generation path. The unique strict-subset profile (TRUSTED_RUNTIME) placement discriminant is a source-derived PREDICTION from the declared law, not evidence.","test_only_discipline":"UNCHANGED","tree":"ca232cfe6ea77e984b899814022e5d3bfb7ddde6"},"context":"TEST_ONLY","decision":"D-011","engine_pins":{"oracle":{"ast_sha256":"34d9a7773ef46a5d429205e3e7557c89ca52cfb73b9b1c336d8b5f1bd0f96d77","git_blob_oid":"92ce92ccfb875993ba1d9e45b0e0c34c3f08cd83","sha256":"3741805546997b6a84159c2cc869559508082c0015155ab28b35026678415d73"},"primary":{"ast_sha256":"d75f76e51fd93d84140193bc22e0de29b6b64c2c5333734c9dc8dab627c21461","git_blob_oid":"952b9f5edb1f70391ea7324ee57b581a5f4e9a18","sha256":"89b1960b6036d5e33c434cd6eae9b677ba1ca15d49bcdb6240d9aabba1eda516"}},"execution_module":{"bytes":80189,"path":"decisions/d011_v14/d011_execution.py","review":"V15_COMPLETION_CHANGED","sha256":"5f4c32e75397f67c2021770ff251bf01341ed4d912c06dd76c8671d39a4c9bbf"},"findings":["All 11 _AST_FAULTS anchors are preserved across the five engine fixes (in-memory proof); the v15 adapter and the production-context completion touch no engine.","The expanded reconciliation closure (12 sources) hashes to the bound source_map_sha256; the six reviewed modules are unchanged and d011_manifest.py and d011_execution.py are the two changed modules.","The regenerated boundary manifest is bound by identity (bytes + sha256) through the pure generation path; it was regenerated by the completion commit.","The production-context completion adds frozen deterministic placement/BFS builders validated by the frozen contracts with no engine or checker calls.","The unique strict-subset placement profile (TRUSTED_RUNTIME) is a source-derived PREDICTION from the declared law, not evidence; no winner is claimed at freeze.","The rehearsal reconciles exactly with the Basis B ledger: 3880 preregistered jobs across 15 segments."],"input_index":2,"kind":"PREFREEZE_REVIEW","manifest_module":{"bytes":211887,"path":"decisions/d011_v14/d011_manifest.py","review":"V15_ADAPTER_CHANGED","sha256":"6fac8eb03e3b4dc77646292d06beb72fb2a3af87edf24c73171e0582c8c2db34"},"nonclaims":["NO_PRODUCTION_AUTHORITY","NO_QUALIFICATION","NO_STAGE_C_AUTHORIZATION","NO_SELECTION","NO_PRODUCTION_EVIDENCE"],"oracle_module":{"bytes":33060,"path":"decisions/d011_v14/d011_oracle.py","review":"V15_ORACLE_FIX_CHANGED","sha256":"3741805546997b6a84159c2cc869559508082c0015155ab28b35026678415d73"},"owner_role":"PROVENANCE_REVIEWER","prediction":{"basis":"DECLARED_LAW","claim":"STRICT_SUBSET_PLACEMENT_DISCRIMINANT_TRUSTED_RUNTIME","kind":"SOURCE_DERIVED_PREDICTION_NOT_EVIDENCE","winner_claimed_at_freeze":0},"production_authority_available":0,"rehearsal_evidence_chain":{"preregistration":"prereg.json and prereg.pin.json content-hash pinned","reconciliation":"reconciles exactly with the Basis B ledger","segment_isolation":"one store per segment and per round"},"review_id":"PREFREEZE-PROVENANCE","reviewed_modules":[{"bytes":35945,"path":"decisions/d011_v14/d011_protocol.py","review":"CROSS_MODEL_REVIEWED","sha256":"be15c609093124d4c5e562d115584db8a0416d116a3ae6fe91361a3cdb0dac17"},{"bytes":28612,"path":"decisions/d011_v14/d011_stage_c.py","review":"CROSS_MODEL_REVIEWED","sha256":"a6c6167761693b3212763bdddbc3e6cf9875f6345f87c350316446b35419f296"},{"bytes":40096,"path":"decisions/d011_v14/d011_runtime.py","review":"CROSS_MODEL_REVIEWED","sha256":"b82073aa08daf0f069592e4ec01f83318aef6334b7ba7c57b8910eae013539ad"},{"bytes":52455,"path":"decisions/d011_v14/d011_authority.py","review":"CROSS_MODEL_REVIEWED","sha256":"6c1e35c20011a0db778a3a1c9222b79e333572c0be1ca1874a0d49bef66be9b9"},{"bytes":50028,"path":"decisions/d011_v14/d011_producers.py","review":"CROSS_MODEL_REVIEWED","sha256":"7e63471020fcb2817cca55d5927108c9dbb3053f66a483b5372fc6cfdaf8204e"},{"bytes":39074,"path":"decisions/d011_v14/d011_stage_b.py","review":"CROSS_MODEL_REVIEWED","sha256":"04eb155b4bb0016fc174fd27de784a316b8f383836602cc481782e11df888f11"}],"schema":"D011-PREFREEZE-REVIEW-15","source_changes":[{"commit":"cb026f703","engine":"PRIMARY","ordinal":1,"summary":"PRIMARY totalization: schema_scenario rejects non-dict events with clean DENY_SCHEMA (was AttributeError)."},{"commit":"cd9d2bf78","engine":"ORACLE","ordinal":2,"summary":"ORACLE totality: observe() family dispatch and the event-identity prelude are total on malformed events."},{"commit":"87a22622d","engine":"PRIMARY+ORACLE","ordinal":3,"summary":"FINAL fuzz-guided engine-totality batch: 12 fuzz sites + 21 same-shape siblings; 7398-run fuzz gate non-vacuous."},{"commit":"aa052d845","engine":"ORACLE","ordinal":4,"summary":"ORACLE state-key type fix: keys written into typed engine state are strings; non-str identifiers resolve DENY_SCHEMA before any state write."},{"commit":"102fab4ba","engine":"PRIMARY+ORACLE","ordinal":5,"summary":"Placement-attack state-key law: attack_schema_deny prelude requires non-empty string payload-key fields, else DENY_SCHEMA with unmutated state."},{"admits":"PRODUCTION_EXTERNAL","commit":"90ab0b041","commit_full":"90ab0b041ba862ccc3ea58f63c0c1e979c642dbc","engines":"UNTOUCHED","kind":"PRODUCTION_EXECUTION_ADAPTER","ordinal":6,"summary":"v15 adapter: the boundary policy admits PRODUCTION_EXTERNAL via consulted adapter + owner-authorization records; invocation-binding emission/validation follows the boundary decision; mutation-pair/child lineage follows the context. TEST_ONLY discipline unchanged; engines untouched; the boundary manifest is regenerated through the pure generation path.","test_only_discipline":"UNCHANGED","tree":"0e40f9804b77bda5ec1a13dae17d019e10fcce11"},{"bfs_builder":{"reports":21,"validated_by":"_bfs_contract"},"commit":"edf85f3a0","commit_full":"edf85f3a0033c8bd747e5e3f3ce5d722a5cea7f7","engine_calls":"NONE","engines":"UNTOUCHED","kind":"PRODUCTION_CONTEXT_COMPLETION","ordinal":7,"placement_builder":{"cells":1392,"compromise":1296,"omission_restored":96,"validated_by":"_placement_contract"},"prediction":"STRICT_SUBSET_PROFILE_TRUSTED_RUNTIME","reconciliation_sub_protocol":"FOLLOWS_BOUNDARY_DECISION","summary":"v15 production-context completion: the reconciliation sub-protocol context follows the checked-execution boundary decision (d011_manifest emission/validation + d011_execution request builders gate-check lineage, default TEST_ONLY, accept PRODUCTION_EXTERNAL). New frozen deterministic placement-cell builders (1,392 = 1,296 COMPROMISE + 96 OMISSION/RESTORED) and BFS builders (families x profiles = 21) emit born-lineage records validated by the frozen _placement_contract / _bfs_contract with no engine or checker calls. TEST_ONLY discipline unchanged; engines and all other modules untouched; the boundary manifest is regenerated through the pure generation path. The unique strict-subset profile (TRUSTED_RUNTIME) placement discriminant is a source-derived PREDICTION from the declared law, not evidence.","test_only_discipline":"UNCHANGED","tree":"ca232cfe6ea77e984b899814022e5d3bfb7ddde6"},{"commit":"0a22837e4","commit_full":"0a22837e498614f0f90fac510fc8729b9527072c","corpus_role_agreement":"114/114","engine":"ORACLE","engines":"ORACLE_CHANGED_PRIMARY_UNTOUCHED","kind":"ORACLE_EFFECT_FLOW_GATE_FIX","ordinal":8,"summary":"v15 oracle effect_flow gate fix (owner-authorized): the union-of-shapes key gate required all ten EFFECT+FLOW keys on every event, which denied every legitimate per-action effect_flow event and contradicted the oracle module's own flow_keys prelude (failing corpus case CASE-MINIMAL_MEDIATION_CORE-EFFECT_F). The new gate mirrors the primary's per-action type guards exactly, wrapped fail-closed for engine totality (M3.5 fuzz-gate law). Validated 114/114 corpus role agreement and 380/380 totality probes (raise-free, both engines). Pins updated (oracle sha 37418055..., oid 92ce92cc..., ast 34d9a777...); the boundary manifest is regenerated through the pure generation path. TEST_ONLY discipline unchanged; the primary engine is untouched.","test_only_discipline":"UNCHANGED","totality_probes":"380/380","tree":"2b7eb8135daa78f37961bf02e3ec25fb2278fbff"}],"source_map":{"decisions/d011_v14/D-011-PACKET.md":{"byte_length":51080,"git_blob_oid":"56cb6c5ff460acbb90529f1249e4fb73cae1b588","sha256":"7c95f8be7ae88f0cda32650fc22962b409023b8f8df6c9f4f047d58bf22e3b2e"},"decisions/d011_v14/d011-boundary-manifest-v1.json":{"byte_length":2659529,"git_blob_oid":"ef0ea9138c29df3917c341f6f87a5f45c2fa5c56","sha256":"06b8a2112b962a7fcd6657cb548ea30b598008b9deb26e406d53f1241116c0cc"},"decisions/d011_v14/d011_assurance.py":{"byte_length":45720,"git_blob_oid":"bf057df7d446ee8d7dd3e20ffa31158e3b7fc77b","sha256":"48f5fa2b05a0d31e2e9288e3ecf8fae062516b83bdf70549a80c48c740750763"},"decisions/d011_v14/d011_domain.py":{"byte_length":42913,"git_blob_oid":"53ba26ec323ad194b67d4c9c751c4f3d47909396","sha256":"aa4344b2a18910061cec293cf2acbb3285108b634b0c04a75e0e2dcbb791d168"},"decisions/d011_v14/d011_execution.py":{"byte_length":80189,"git_blob_oid":"77a8399ec641bff6554be3f063fd2a7a38cc92fd","sha256":"5f4c32e75397f67c2021770ff251bf01341ed4d912c06dd76c8671d39a4c9bbf"},"decisions/d011_v14/d011_manifest.py":{"byte_length":211887,"git_blob_oid":"c879053dd4c418f6f2c3dc7cf46482ac26472ec7","sha256":"6fac8eb03e3b4dc77646292d06beb72fb2a3af87edf24c73171e0582c8c2db34"},"decisions/d011_v14/d011_oracle.py":{"byte_length":33060,"git_blob_oid":"92ce92ccfb875993ba1d9e45b0e0c34c3f08cd83","sha256":"3741805546997b6a84159c2cc869559508082c0015155ab28b35026678415d73"},"decisions/d011_v14/d011_primary.py":{"byte_length":39632,"git_blob_oid":"952b9f5edb1f70391ea7324ee57b581a5f4e9a18","sha256":"89b1960b6036d5e33c434cd6eae9b677ba1ca15d49bcdb6240d9aabba1eda516"},"decisions/d011_v14/test_d011_domain.py":{"byte_length":65183,"git_blob_oid":"3bf653a42a5438d165ed7b0a4757526f1881e395","sha256":"2511070031d8919bc2241986ae1ef4356936171382e2af106dfe89544acc99e9"},"decisions/d011_v14/test_d011_execution.py":{"byte_length":49547,"git_blob_oid":"ad411b1c0d544c5760e782f90233cd5fc0bab643","sha256":"24e7327aeebb8546d19f846dee05dc43c7fcaeb3693494b70f0180b91a530097"},"decisions/d011_v14/test_d011_integration.py":{"byte_length":141455,"git_blob_oid":"3f9637fdbeedb183233332bd632e8338ed0420a6","sha256":"9b07f6ee0e134b523ec67a952316938895ef07e19f43d685fda433cd7c28f899"},"decisions/d011_v14/test_d011_manifest.py":{"byte_length":379107,"git_blob_oid":"90db7e6746f1731689d58912cefc1e0cb7157865","sha256":"153f12bf952884b5e30a75a7c4112429dbabaf512f5f145b225554e827a40f2b"}},"source_map_sha256":"6f94fb6dd795d158aba0cfcf8c4d0489975225533d53dd9dff82f2adb522c6aa","stage":"STAGE_B","subject":"M4_STAGE_B_PROVENANCE_V15","test_only":1,"verdict":"REVIEWED_PASS_WITH_FINDINGS"}
diff --git a/decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json b/decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json
index e2732ad128..0269997696 100644
--- a/decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json
+++ b/decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json
@@ -1 +1 @@
-{"adapter":{"boundary_policy":"ADMITS_PRODUCTION_EXTERNAL_VIA_CONSULTED_ADAPTER_AND_OWNER_AUTHORIZATION","engines":"UNTOUCHED","invocation_binding":"FOLLOWS_BOUNDARY_DECISION","mutation_pair_child_lineage":"FOLLOWS_CONTEXT","test_only_discipline":"UNCHANGED"},"candidate":"D-011-CANDIDATE-V15","checkpoint_a_double_prime":{"commit":"edf85f3a0033c8bd747e5e3f3ce5d722a5cea7f7","tree":"ca232cfe6ea77e984b899814022e5d3bfb7ddde6"},"completion":{"bfs_builder":"FROZEN_DETERMINISTIC_BFS_21","emits":"BORN_LINEAGE_RECORDS_VALIDATED_BY_FROZEN_CONTRACTS","engine_calls":"NONE","engines":"UNTOUCHED","placement_builder":"FROZEN_DETERMINISTIC_PLACEMENT_CELLS_1392","reconciliation_sub_protocol":"FOLLOWS_BOUNDARY_DECISION","test_only_discipline":"UNCHANGED"},"context":"TEST_ONLY","decision":"D-011","execution_module":{"bytes":80189,"path":"decisions/d011_v14/d011_execution.py","review":"V15_COMPLETION_CHANGED","sha256":"5f4c32e75397f67c2021770ff251bf01341ed4d912c06dd76c8671d39a4c9bbf"},"findings":["The v15 adapter admits PRODUCTION_EXTERNAL only through consulted adapter + owner-authorization records; the emission/validation of invocation bindings follows the boundary decision and mutation-pair/child lineage follows the context.","The production-context completion makes the reconciliation sub-protocol context follow the boundary decision and adds frozen deterministic placement-cell (1,392 = 1,296 COMPROMISE + 96 OMISSION/RESTORED) and BFS (21) builders emitting born-lineage records validated by the frozen _placement_contract / _bfs_contract with no engine or checker calls.","TEST_ONLY discipline is unchanged and both engines are untouched; the regenerated boundary manifest is bound by identity.","The six cross-model-reviewed modules are unchanged from v14; only d011_manifest.py and d011_execution.py changed with the v15 adapter and completion.","The unique strict-subset placement profile (TRUSTED_RUNTIME) is a source-derived PREDICTION from the declared law, not evidence; no winner is claimed at freeze.","Production evidence does not exist; the decision remains OPEN/UNQUALIFIED/INACTIVE with no winner at freeze."],"gates_green":{"basisb":10,"domain_fast":31,"execution":24,"pilot":39,"producers":12,"rehearsal":27},"implementation_closure_review":"PASS_WITH_FINDINGS","input_index":1,"kind":"PREFREEZE_REVIEW","manifest_module":{"bytes":211887,"path":"decisions/d011_v14/d011_manifest.py","review":"V15_ADAPTER_CHANGED","sha256":"15b76cb984f34cfcb58d3c7758a97a8b76ff3f21382977ed0690abbec4fa3ae3"},"nonclaims":["NO_PRODUCTION_AUTHORITY","NO_QUALIFICATION","NO_STAGE_C_AUTHORIZATION","NO_SELECTION","NO_PRODUCTION_EVIDENCE"],"owner_role":"SEMANTIC_REVIEWER","prediction":{"basis":"DECLARED_LAW","claim":"STRICT_SUBSET_PLACEMENT_DISCRIMINANT_TRUSTED_RUNTIME","kind":"SOURCE_DERIVED_PREDICTION_NOT_EVIDENCE","winner_claimed_at_freeze":0},"production_authority_available":0,"rehearsal":{"basis_b_reconciliation":"EXACT","domains":["valid","invalid","revoked","wrong_route","authority_and_route"],"gate_tests":27,"min_rounds":1097,"operations_per_store_max":10,"preregistered_jobs":3880,"runtime_families":["CAPABILITY_MICROKERNEL","MINIMAL_MEDIATION_CORE","TRUSTED_RUNTIME"],"segment_table_size":15},"review_id":"PREFREEZE-SEMANTIC","reviewed_modules":[{"bytes":35945,"path":"decisions/d011_v14/d011_protocol.py","review":"CROSS_MODEL_REVIEWED","sha256":"be15c609093124d4c5e562d115584db8a0416d116a3ae6fe91361a3cdb0dac17"},{"bytes":28612,"path":"decisions/d011_v14/d011_stage_c.py","review":"CROSS_MODEL_REVIEWED","sha256":"a6c6167761693b3212763bdddbc3e6cf9875f6345f87c350316446b35419f296"},{"bytes":40096,"path":"decisions/d011_v14/d011_runtime.py","review":"CROSS_MODEL_REVIEWED","sha256":"b82073aa08daf0f069592e4ec01f83318aef6334b7ba7c57b8910eae013539ad"},{"bytes":52455,"path":"decisions/d011_v14/d011_authority.py","review":"CROSS_MODEL_REVIEWED","sha256":"6c1e35c20011a0db778a3a1c9222b79e333572c0be1ca1874a0d49bef66be9b9"},{"bytes":50028,"path":"decisions/d011_v14/d011_producers.py","review":"CROSS_MODEL_REVIEWED","sha256":"7e63471020fcb2817cca55d5927108c9dbb3053f66a483b5372fc6cfdaf8204e"},{"bytes":39074,"path":"decisions/d011_v14/d011_stage_b.py","review":"CROSS_MODEL_REVIEWED","sha256":"04eb155b4bb0016fc174fd27de784a316b8f383836602cc481782e11df888f11"}],"schema":"D011-PREFREEZE-REVIEW-15","source_changes":[{"commit":"cb026f703","engine":"PRIMARY","ordinal":1,"summary":"PRIMARY totalization: schema_scenario rejects non-dict events with clean DENY_SCHEMA (was AttributeError)."},{"commit":"cd9d2bf78","engine":"ORACLE","ordinal":2,"summary":"ORACLE totality: observe() family dispatch and the event-identity prelude are total on malformed events."},{"commit":"87a22622d","engine":"PRIMARY+ORACLE","ordinal":3,"summary":"FINAL fuzz-guided engine-totality batch: 12 fuzz sites + 21 same-shape siblings; 7398-run fuzz gate non-vacuous."},{"commit":"aa052d845","engine":"ORACLE","ordinal":4,"summary":"ORACLE state-key type fix: keys written into typed engine state are strings; non-str identifiers resolve DENY_SCHEMA before any state write."},{"commit":"102fab4ba","engine":"PRIMARY+ORACLE","ordinal":5,"summary":"Placement-attack state-key law: attack_schema_deny prelude requires non-empty string payload-key fields, else DENY_SCHEMA with unmutated state."},{"admits":"PRODUCTION_EXTERNAL","commit":"90ab0b041","commit_full":"90ab0b041ba862ccc3ea58f63c0c1e979c642dbc","engines":"UNTOUCHED","kind":"PRODUCTION_EXECUTION_ADAPTER","ordinal":6,"summary":"v15 adapter: the boundary policy admits PRODUCTION_EXTERNAL via consulted adapter + owner-authorization records; invocation-binding emission/validation follows the boundary decision; mutation-pair/child lineage follows the context. TEST_ONLY discipline unchanged; engines untouched; the boundary manifest is regenerated through the pure generation path.","test_only_discipline":"UNCHANGED","tree":"0e40f9804b77bda5ec1a13dae17d019e10fcce11"},{"bfs_builder":{"reports":21,"validated_by":"_bfs_contract"},"commit":"edf85f3a0","engine_calls":"NONE","engines":"UNTOUCHED","kind":"PRODUCTION_CONTEXT_COMPLETION","ordinal":7,"placement_builder":{"cells":1392,"compromise":1296,"omission_restored":96,"validated_by":"_placement_contract"},"prediction":"STRICT_SUBSET_PROFILE_TRUSTED_RUNTIME","reconciliation_sub_protocol":"FOLLOWS_BOUNDARY_DECISION","summary":"v15 production-context completion: the reconciliation sub-protocol context follows the checked-execution boundary decision (d011_manifest emission/validation + d011_execution request builders gate-check lineage, default TEST_ONLY, accept PRODUCTION_EXTERNAL). New frozen deterministic placement-cell builders (1,392 = 1,296 COMPROMISE + 96 OMISSION/RESTORED) and BFS builders (families x profiles = 21) emit born-lineage records validated by the frozen _placement_contract / _bfs_contract with no engine or checker calls. TEST_ONLY discipline unchanged; engines and all other modules untouched; the boundary manifest is regenerated through the pure generation path. The unique strict-subset profile (TRUSTED_RUNTIME) placement discriminant is a source-derived PREDICTION from the declared law, not evidence.","test_only_discipline":"UNCHANGED"}],"stage":"STAGE_B","subject":"M4_STAGE_B_IMPLEMENTATION_V15","test_only":1,"verdict":"REVIEWED_PASS_WITH_FINDINGS"}
+{"adapter":{"boundary_policy":"ADMITS_PRODUCTION_EXTERNAL_VIA_CONSULTED_ADAPTER_AND_OWNER_AUTHORIZATION","engines":"UNTOUCHED","invocation_binding":"FOLLOWS_BOUNDARY_DECISION","mutation_pair_child_lineage":"FOLLOWS_CONTEXT","test_only_discipline":"UNCHANGED"},"candidate":"D-011-CANDIDATE-V15","checkpoint_a_triple_prime":{"commit":"0a22837e498614f0f90fac510fc8729b9527072c","tree":"2b7eb8135daa78f37961bf02e3ec25fb2278fbff"},"completion":{"bfs_builder":"FROZEN_DETERMINISTIC_BFS_21","emits":"BORN_LINEAGE_RECORDS_VALIDATED_BY_FROZEN_CONTRACTS","engine_calls":"NONE","engines":"UNTOUCHED","placement_builder":"FROZEN_DETERMINISTIC_PLACEMENT_CELLS_1392","reconciliation_sub_protocol":"FOLLOWS_BOUNDARY_DECISION","test_only_discipline":"UNCHANGED"},"context":"TEST_ONLY","decision":"D-011","execution_module":{"bytes":80189,"path":"decisions/d011_v14/d011_execution.py","review":"V15_COMPLETION_CHANGED","sha256":"5f4c32e75397f67c2021770ff251bf01341ed4d912c06dd76c8671d39a4c9bbf"},"findings":["The v15 adapter admits PRODUCTION_EXTERNAL only through consulted adapter + owner-authorization records; the emission/validation of invocation bindings follows the boundary decision and mutation-pair/child lineage follows the context.","The production-context completion makes the reconciliation sub-protocol context follow the boundary decision and adds frozen deterministic placement-cell (1,392 = 1,296 COMPROMISE + 96 OMISSION/RESTORED) and BFS (21) builders emitting born-lineage records validated by the frozen _placement_contract / _bfs_contract with no engine or checker calls.","TEST_ONLY discipline is unchanged and both engines are untouched; the regenerated boundary manifest is bound by identity.","The six cross-model-reviewed modules are unchanged from v14; only d011_manifest.py and d011_execution.py changed with the v15 adapter and completion.","The unique strict-subset placement profile (TRUSTED_RUNTIME) is a source-derived PREDICTION from the declared law, not evidence; no winner is claimed at freeze.","Production evidence does not exist; the decision remains OPEN/UNQUALIFIED/INACTIVE with no winner at freeze."],"gates_green":{"basisb":10,"domain_fast":31,"execution":24,"pilot":39,"producers":12,"rehearsal":27},"implementation_closure_review":"PASS_WITH_FINDINGS","input_index":1,"kind":"PREFREEZE_REVIEW","manifest_module":{"bytes":211887,"path":"decisions/d011_v14/d011_manifest.py","review":"V15_ADAPTER_CHANGED","sha256":"6fac8eb03e3b4dc77646292d06beb72fb2a3af87edf24c73171e0582c8c2db34"},"nonclaims":["NO_PRODUCTION_AUTHORITY","NO_QUALIFICATION","NO_STAGE_C_AUTHORIZATION","NO_SELECTION","NO_PRODUCTION_EVIDENCE"],"oracle_module":{"bytes":33060,"path":"decisions/d011_v14/d011_oracle.py","review":"V15_ORACLE_FIX_CHANGED","sha256":"3741805546997b6a84159c2cc869559508082c0015155ab28b35026678415d73"},"owner_role":"SEMANTIC_REVIEWER","prediction":{"basis":"DECLARED_LAW","claim":"STRICT_SUBSET_PLACEMENT_DISCRIMINANT_TRUSTED_RUNTIME","kind":"SOURCE_DERIVED_PREDICTION_NOT_EVIDENCE","winner_claimed_at_freeze":0},"production_authority_available":0,"rehearsal":{"basis_b_reconciliation":"EXACT","domains":["valid","invalid","revoked","wrong_route","authority_and_route"],"gate_tests":27,"min_rounds":1097,"operations_per_store_max":10,"preregistered_jobs":3880,"runtime_families":["CAPABILITY_MICROKERNEL","MINIMAL_MEDIATION_CORE","TRUSTED_RUNTIME"],"segment_table_size":15},"review_id":"PREFREEZE-SEMANTIC","reviewed_modules":[{"bytes":35945,"path":"decisions/d011_v14/d011_protocol.py","review":"CROSS_MODEL_REVIEWED","sha256":"be15c609093124d4c5e562d115584db8a0416d116a3ae6fe91361a3cdb0dac17"},{"bytes":28612,"path":"decisions/d011_v14/d011_stage_c.py","review":"CROSS_MODEL_REVIEWED","sha256":"a6c6167761693b3212763bdddbc3e6cf9875f6345f87c350316446b35419f296"},{"bytes":40096,"path":"decisions/d011_v14/d011_runtime.py","review":"CROSS_MODEL_REVIEWED","sha256":"b82073aa08daf0f069592e4ec01f83318aef6334b7ba7c57b8910eae013539ad"},{"bytes":52455,"path":"decisions/d011_v14/d011_authority.py","review":"CROSS_MODEL_REVIEWED","sha256":"6c1e35c20011a0db778a3a1c9222b79e333572c0be1ca1874a0d49bef66be9b9"},{"bytes":50028,"path":"decisions/d011_v14/d011_producers.py","review":"CROSS_MODEL_REVIEWED","sha256":"7e63471020fcb2817cca55d5927108c9dbb3053f66a483b5372fc6cfdaf8204e"},{"bytes":39074,"path":"decisions/d011_v14/d011_stage_b.py","review":"CROSS_MODEL_REVIEWED","sha256":"04eb155b4bb0016fc174fd27de784a316b8f383836602cc481782e11df888f11"}],"schema":"D011-PREFREEZE-REVIEW-15","source_changes":[{"commit":"cb026f703","engine":"PRIMARY","ordinal":1,"summary":"PRIMARY totalization: schema_scenario rejects non-dict events with clean DENY_SCHEMA (was AttributeError)."},{"commit":"cd9d2bf78","engine":"ORACLE","ordinal":2,"summary":"ORACLE totality: observe() family dispatch and the event-identity prelude are total on malformed events."},{"commit":"87a22622d","engine":"PRIMARY+ORACLE","ordinal":3,"summary":"FINAL fuzz-guided engine-totality batch: 12 fuzz sites + 21 same-shape siblings; 7398-run fuzz gate non-vacuous."},{"commit":"aa052d845","engine":"ORACLE","ordinal":4,"summary":"ORACLE state-key type fix: keys written into typed engine state are strings; non-str identifiers resolve DENY_SCHEMA before any state write."},{"commit":"102fab4ba","engine":"PRIMARY+ORACLE","ordinal":5,"summary":"Placement-attack state-key law: attack_schema_deny prelude requires non-empty string payload-key fields, else DENY_SCHEMA with unmutated state."},{"admits":"PRODUCTION_EXTERNAL","commit":"90ab0b041","commit_full":"90ab0b041ba862ccc3ea58f63c0c1e979c642dbc","engines":"UNTOUCHED","kind":"PRODUCTION_EXECUTION_ADAPTER","ordinal":6,"summary":"v15 adapter: the boundary policy admits PRODUCTION_EXTERNAL via consulted adapter + owner-authorization records; invocation-binding emission/validation follows the boundary decision; mutation-pair/child lineage follows the context. TEST_ONLY discipline unchanged; engines untouched; the boundary manifest is regenerated through the pure generation path.","test_only_discipline":"UNCHANGED","tree":"0e40f9804b77bda5ec1a13dae17d019e10fcce11"},{"bfs_builder":{"reports":21,"validated_by":"_bfs_contract"},"commit":"edf85f3a0","commit_full":"edf85f3a0033c8bd747e5e3f3ce5d722a5cea7f7","engine_calls":"NONE","engines":"UNTOUCHED","kind":"PRODUCTION_CONTEXT_COMPLETION","ordinal":7,"placement_builder":{"cells":1392,"compromise":1296,"omission_restored":96,"validated_by":"_placement_contract"},"prediction":"STRICT_SUBSET_PROFILE_TRUSTED_RUNTIME","reconciliation_sub_protocol":"FOLLOWS_BOUNDARY_DECISION","summary":"v15 production-context completion: the reconciliation sub-protocol context follows the checked-execution boundary decision (d011_manifest emission/validation + d011_execution request builders gate-check lineage, default TEST_ONLY, accept PRODUCTION_EXTERNAL). New frozen deterministic placement-cell builders (1,392 = 1,296 COMPROMISE + 96 OMISSION/RESTORED) and BFS builders (families x profiles = 21) emit born-lineage records validated by the frozen _placement_contract / _bfs_contract with no engine or checker calls. TEST_ONLY discipline unchanged; engines and all other modules untouched; the boundary manifest is regenerated through the pure generation path. The unique strict-subset profile (TRUSTED_RUNTIME) placement discriminant is a source-derived PREDICTION from the declared law, not evidence.","test_only_discipline":"UNCHANGED","tree":"ca232cfe6ea77e984b899814022e5d3bfb7ddde6"},{"commit":"0a22837e4","commit_full":"0a22837e498614f0f90fac510fc8729b9527072c","corpus_role_agreement":"114/114","engine":"ORACLE","engines":"ORACLE_CHANGED_PRIMARY_UNTOUCHED","kind":"ORACLE_EFFECT_FLOW_GATE_FIX","ordinal":8,"summary":"v15 oracle effect_flow gate fix (owner-authorized): the union-of-shapes key gate required all ten EFFECT+FLOW keys on every event, which denied every legitimate per-action effect_flow event and contradicted the oracle module's own flow_keys prelude (failing corpus case CASE-MINIMAL_MEDIATION_CORE-EFFECT_F). The new gate mirrors the primary's per-action type guards exactly, wrapped fail-closed for engine totality (M3.5 fuzz-gate law). Validated 114/114 corpus role agreement and 380/380 totality probes (raise-free, both engines). Pins updated (oracle sha 37418055..., oid 92ce92cc..., ast 34d9a777...); the boundary manifest is regenerated through the pure generation path. TEST_ONLY discipline unchanged; the primary engine is untouched.","test_only_discipline":"UNCHANGED","totality_probes":"380/380","tree":"2b7eb8135daa78f37961bf02e3ec25fb2278fbff"}],"stage":"STAGE_B","subject":"M4_STAGE_B_IMPLEMENTATION_V15","test_only":1,"verdict":"REVIEWED_PASS_WITH_FINDINGS"}
diff --git a/decisions/d011_v14/D-011-ROLE-V15-ASSURANCE_EXECUTOR.json b/decisions/d011_v14/D-011-ROLE-V15-ASSURANCE_EXECUTOR.json
index 8e498275a8..b135da0a38 100644
--- a/decisions/d011_v14/D-011-ROLE-V15-ASSURANCE_EXECUTOR.json
+++ b/decisions/d011_v14/D-011-ROLE-V15-ASSURANCE_EXECUTOR.json
@@ -1 +1 @@
-{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"da2ba64d2623e1202369206b2ba618a2dcfb87af4ebedc2a90e0bf2205c3967d","context":"TEST_ONLY","decision":"D-011","disclaimer":"Distinct HMAC keys establish cryptographic role separation and non-forgeability under secret-key assumptions; they do not establish human or organizational independence, separate physical custody, or natural-person identity.","function":"EXECUTES_ASSURANCE_CHECKER","kind":"ROLE_ATTESTATION","lock_root":"7f94c5cbe5f32f190056829f8ea713beeff818a507db59454e2abda37a1fec06","ordered_prefreeze_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":7291,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"27cc1162293adc9f054369ac5ee0c96d065c96e4b1bb548007367b825cccc00d"},{"id":"PREFREEZE-PROVENANCE","length":11514,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"aa548a576fc22278c36ee1ab22af9dad6c59677b3adfc7884bbb96357b2bf9f7"}],"role":"ASSURANCE_EXECUTOR","schema":"D011-ROLE-TECHNICAL-ATTESTATION-15","signature_sha256":"9b78ac72948e1dc634d1dbc00fca5394edefe94483c2a1994898fe36ec26b1bc","signer":{"context":"TEST_ONLY","domain":"TEST_ONLY_LOCAL_SIGNER","schema":"D011-AUTHORITY-SIGNER-14","signer_id":"TEST-ONLY-SIGNER"},"stage":"STAGE_B","stage_b_freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","subject":"D-011-CANDIDATE-V15","technical_attestation":"ROLE_KEY_AUTHENTICATES_EXACT_RETAINED_BODIES_FOR_DECLARED_ROLE"}
+{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"182de83dd7593c8b2af71d3a0e58604056850033fc34309eb08cf08ddd90ae78","context":"TEST_ONLY","decision":"D-011","disclaimer":"Distinct HMAC keys establish cryptographic role separation and non-forgeability under secret-key assumptions; they do not establish human or organizational independence, separate physical custody, or natural-person identity.","function":"EXECUTES_ASSURANCE_CHECKER","kind":"ROLE_ATTESTATION","lock_root":"442734ca27ac96c2e4a6477097e3bca7e6eaa01fa4e052d4e5c333811d20cd85","ordered_prefreeze_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":8677,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"945a0343a936ac307f9fe3026a55f521bf506adbdb142f63248ed7d84f6f04ca"},{"id":"PREFREEZE-PROVENANCE","length":13007,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"f0a3c39c28aaf1998b19e65c226e8b2fde2d9724e8c937f005393316c1204f44"}],"role":"ASSURANCE_EXECUTOR","schema":"D011-ROLE-TECHNICAL-ATTESTATION-15","signature_sha256":"9b091c95c26b70d798723fea1ee34bd2d85c3c245f48022884e437ab1a99e5bf","signer":{"context":"TEST_ONLY","domain":"TEST_ONLY_LOCAL_SIGNER","schema":"D011-AUTHORITY-SIGNER-14","signer_id":"TEST-ONLY-SIGNER"},"stage":"STAGE_B","stage_b_freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","subject":"D-011-CANDIDATE-V15","technical_attestation":"ROLE_KEY_AUTHENTICATES_EXACT_RETAINED_BODIES_FOR_DECLARED_ROLE"}
diff --git a/decisions/d011_v14/D-011-ROLE-V15-COORDINATOR.json b/decisions/d011_v14/D-011-ROLE-V15-COORDINATOR.json
index 88e2fd888e..ed973020ac 100644
--- a/decisions/d011_v14/D-011-ROLE-V15-COORDINATOR.json
+++ b/decisions/d011_v14/D-011-ROLE-V15-COORDINATOR.json
@@ -1 +1 @@
-{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"da2ba64d2623e1202369206b2ba618a2dcfb87af4ebedc2a90e0bf2205c3967d","context":"TEST_ONLY","decision":"D-011","disclaimer":"Distinct HMAC keys establish cryptographic role separation and non-forgeability under secret-key assumptions; they do not establish human or organizational independence, separate physical custody, or natural-person identity.","function":"COORDINATES_SEAL_AND_AUTHORS_LOCK","kind":"ROLE_ATTESTATION","lock_root":"7f94c5cbe5f32f190056829f8ea713beeff818a507db59454e2abda37a1fec06","ordered_prefreeze_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":7291,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"27cc1162293adc9f054369ac5ee0c96d065c96e4b1bb548007367b825cccc00d"},{"id":"PREFREEZE-PROVENANCE","length":11514,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"aa548a576fc22278c36ee1ab22af9dad6c59677b3adfc7884bbb96357b2bf9f7"}],"role":"COORDINATOR","schema":"D011-ROLE-TECHNICAL-ATTESTATION-15","signature_sha256":"9fdba9da2ab85d1d73b5b53b22cf9dff2716bdb2504042adcc0f4cd4ee0d272d","signer":{"context":"TEST_ONLY","domain":"TEST_ONLY_LOCAL_SIGNER","schema":"D011-AUTHORITY-SIGNER-14","signer_id":"TEST-ONLY-SIGNER"},"stage":"STAGE_B","stage_b_freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","subject":"D-011-CANDIDATE-V15","technical_attestation":"ROLE_KEY_AUTHENTICATES_EXACT_RETAINED_BODIES_FOR_DECLARED_ROLE"}
+{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"182de83dd7593c8b2af71d3a0e58604056850033fc34309eb08cf08ddd90ae78","context":"TEST_ONLY","decision":"D-011","disclaimer":"Distinct HMAC keys establish cryptographic role separation and non-forgeability under secret-key assumptions; they do not establish human or organizational independence, separate physical custody, or natural-person identity.","function":"COORDINATES_SEAL_AND_AUTHORS_LOCK","kind":"ROLE_ATTESTATION","lock_root":"442734ca27ac96c2e4a6477097e3bca7e6eaa01fa4e052d4e5c333811d20cd85","ordered_prefreeze_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":8677,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"945a0343a936ac307f9fe3026a55f521bf506adbdb142f63248ed7d84f6f04ca"},{"id":"PREFREEZE-PROVENANCE","length":13007,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"f0a3c39c28aaf1998b19e65c226e8b2fde2d9724e8c937f005393316c1204f44"}],"role":"COORDINATOR","schema":"D011-ROLE-TECHNICAL-ATTESTATION-15","signature_sha256":"b0818a48793eeb673e371ed8225d90165805cff3bdabf531cbb44ecf422e24d6","signer":{"context":"TEST_ONLY","domain":"TEST_ONLY_LOCAL_SIGNER","schema":"D011-AUTHORITY-SIGNER-14","signer_id":"TEST-ONLY-SIGNER"},"stage":"STAGE_B","stage_b_freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","subject":"D-011-CANDIDATE-V15","technical_attestation":"ROLE_KEY_AUTHENTICATES_EXACT_RETAINED_BODIES_FOR_DECLARED_ROLE"}
diff --git a/decisions/d011_v14/D-011-ROLE-V15-FREEZER.json b/decisions/d011_v14/D-011-ROLE-V15-FREEZER.json
index 36e6b00674..a6f8e36009 100644
--- a/decisions/d011_v14/D-011-ROLE-V15-FREEZER.json
+++ b/decisions/d011_v14/D-011-ROLE-V15-FREEZER.json
@@ -1 +1 @@
-{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"da2ba64d2623e1202369206b2ba618a2dcfb87af4ebedc2a90e0bf2205c3967d","context":"TEST_ONLY","decision":"D-011","disclaimer":"Distinct HMAC keys establish cryptographic role separation and non-forgeability under secret-key assumptions; they do not establish human or organizational independence, separate physical custody, or natural-person identity.","function":"AUTHORS_STAGE_B_FREEZE","kind":"ROLE_ATTESTATION","lock_root":"7f94c5cbe5f32f190056829f8ea713beeff818a507db59454e2abda37a1fec06","ordered_prefreeze_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":7291,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"27cc1162293adc9f054369ac5ee0c96d065c96e4b1bb548007367b825cccc00d"},{"id":"PREFREEZE-PROVENANCE","length":11514,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"aa548a576fc22278c36ee1ab22af9dad6c59677b3adfc7884bbb96357b2bf9f7"}],"role":"FREEZER","schema":"D011-ROLE-TECHNICAL-ATTESTATION-15","signature_sha256":"aab5bc820cfd1a30075a2103a25cfb19d7b95496328630f7de82060262118047","signer":{"context":"TEST_ONLY","domain":"TEST_ONLY_LOCAL_SIGNER","schema":"D011-AUTHORITY-SIGNER-14","signer_id":"TEST-ONLY-SIGNER"},"stage":"STAGE_B","stage_b_freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","subject":"D-011-CANDIDATE-V15","technical_attestation":"ROLE_KEY_AUTHENTICATES_EXACT_RETAINED_BODIES_FOR_DECLARED_ROLE"}
+{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"182de83dd7593c8b2af71d3a0e58604056850033fc34309eb08cf08ddd90ae78","context":"TEST_ONLY","decision":"D-011","disclaimer":"Distinct HMAC keys establish cryptographic role separation and non-forgeability under secret-key assumptions; they do not establish human or organizational independence, separate physical custody, or natural-person identity.","function":"AUTHORS_STAGE_B_FREEZE","kind":"ROLE_ATTESTATION","lock_root":"442734ca27ac96c2e4a6477097e3bca7e6eaa01fa4e052d4e5c333811d20cd85","ordered_prefreeze_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":8677,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"945a0343a936ac307f9fe3026a55f521bf506adbdb142f63248ed7d84f6f04ca"},{"id":"PREFREEZE-PROVENANCE","length":13007,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"f0a3c39c28aaf1998b19e65c226e8b2fde2d9724e8c937f005393316c1204f44"}],"role":"FREEZER","schema":"D011-ROLE-TECHNICAL-ATTESTATION-15","signature_sha256":"0eb8a9b4f0fa49a7041890a1ed5ee5a7b5cc7ab8c39f144b78e64ac5f6128119","signer":{"context":"TEST_ONLY","domain":"TEST_ONLY_LOCAL_SIGNER","schema":"D011-AUTHORITY-SIGNER-14","signer_id":"TEST-ONLY-SIGNER"},"stage":"STAGE_B","stage_b_freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","subject":"D-011-CANDIDATE-V15","technical_attestation":"ROLE_KEY_AUTHENTICATES_EXACT_RETAINED_BODIES_FOR_DECLARED_ROLE"}
diff --git a/decisions/d011_v14/D-011-ROLE-V15-ORACLE_EXECUTOR.json b/decisions/d011_v14/D-011-ROLE-V15-ORACLE_EXECUTOR.json
index cefbb382bb..d3b35b32a1 100644
--- a/decisions/d011_v14/D-011-ROLE-V15-ORACLE_EXECUTOR.json
+++ b/decisions/d011_v14/D-011-ROLE-V15-ORACLE_EXECUTOR.json
@@ -1 +1 @@
-{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"da2ba64d2623e1202369206b2ba618a2dcfb87af4ebedc2a90e0bf2205c3967d","context":"TEST_ONLY","decision":"D-011","disclaimer":"Distinct HMAC keys establish cryptographic role separation and non-forgeability under secret-key assumptions; they do not establish human or organizational independence, separate physical custody, or natural-person identity.","function":"EXECUTES_ORACLE_ENGINE","kind":"ROLE_ATTESTATION","lock_root":"7f94c5cbe5f32f190056829f8ea713beeff818a507db59454e2abda37a1fec06","ordered_prefreeze_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":7291,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"27cc1162293adc9f054369ac5ee0c96d065c96e4b1bb548007367b825cccc00d"},{"id":"PREFREEZE-PROVENANCE","length":11514,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"aa548a576fc22278c36ee1ab22af9dad6c59677b3adfc7884bbb96357b2bf9f7"}],"role":"ORACLE_EXECUTOR","schema":"D011-ROLE-TECHNICAL-ATTESTATION-15","signature_sha256":"790dfb1779769e6f25a6fea8b55f392cbbd8ca600d22b738f0c7c15db9ebfda2","signer":{"context":"TEST_ONLY","domain":"TEST_ONLY_LOCAL_SIGNER","schema":"D011-AUTHORITY-SIGNER-14","signer_id":"TEST-ONLY-SIGNER"},"stage":"STAGE_B","stage_b_freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","subject":"D-011-CANDIDATE-V15","technical_attestation":"ROLE_KEY_AUTHENTICATES_EXACT_RETAINED_BODIES_FOR_DECLARED_ROLE"}
+{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"182de83dd7593c8b2af71d3a0e58604056850033fc34309eb08cf08ddd90ae78","context":"TEST_ONLY","decision":"D-011","disclaimer":"Distinct HMAC keys establish cryptographic role separation and non-forgeability under secret-key assumptions; they do not establish human or organizational independence, separate physical custody, or natural-person identity.","function":"EXECUTES_ORACLE_ENGINE","kind":"ROLE_ATTESTATION","lock_root":"442734ca27ac96c2e4a6477097e3bca7e6eaa01fa4e052d4e5c333811d20cd85","ordered_prefreeze_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":8677,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"945a0343a936ac307f9fe3026a55f521bf506adbdb142f63248ed7d84f6f04ca"},{"id":"PREFREEZE-PROVENANCE","length":13007,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"f0a3c39c28aaf1998b19e65c226e8b2fde2d9724e8c937f005393316c1204f44"}],"role":"ORACLE_EXECUTOR","schema":"D011-ROLE-TECHNICAL-ATTESTATION-15","signature_sha256":"ab7303ffde94f2260f91bc10c9a5cfb4f223f9f72dd04a88e22c09500171a119","signer":{"context":"TEST_ONLY","domain":"TEST_ONLY_LOCAL_SIGNER","schema":"D011-AUTHORITY-SIGNER-14","signer_id":"TEST-ONLY-SIGNER"},"stage":"STAGE_B","stage_b_freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","subject":"D-011-CANDIDATE-V15","technical_attestation":"ROLE_KEY_AUTHENTICATES_EXACT_RETAINED_BODIES_FOR_DECLARED_ROLE"}
diff --git a/decisions/d011_v14/D-011-ROLE-V15-PRIMARY_EXECUTOR.json b/decisions/d011_v14/D-011-ROLE-V15-PRIMARY_EXECUTOR.json
index b8ab80ae22..d0413071c2 100644
--- a/decisions/d011_v14/D-011-ROLE-V15-PRIMARY_EXECUTOR.json
+++ b/decisions/d011_v14/D-011-ROLE-V15-PRIMARY_EXECUTOR.json
@@ -1 +1 @@
-{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"da2ba64d2623e1202369206b2ba618a2dcfb87af4ebedc2a90e0bf2205c3967d","context":"TEST_ONLY","decision":"D-011","disclaimer":"Distinct HMAC keys establish cryptographic role separation and non-forgeability under secret-key assumptions; they do not establish human or organizational independence, separate physical custody, or natural-person identity.","function":"EXECUTES_PRIMARY_ENGINE","kind":"ROLE_ATTESTATION","lock_root":"7f94c5cbe5f32f190056829f8ea713beeff818a507db59454e2abda37a1fec06","ordered_prefreeze_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":7291,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"27cc1162293adc9f054369ac5ee0c96d065c96e4b1bb548007367b825cccc00d"},{"id":"PREFREEZE-PROVENANCE","length":11514,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"aa548a576fc22278c36ee1ab22af9dad6c59677b3adfc7884bbb96357b2bf9f7"}],"role":"PRIMARY_EXECUTOR","schema":"D011-ROLE-TECHNICAL-ATTESTATION-15","signature_sha256":"b729e8e6f1ed87dcd097afe9b2bfe3d88e536d12fc161e9026068c150e28998d","signer":{"context":"TEST_ONLY","domain":"TEST_ONLY_LOCAL_SIGNER","schema":"D011-AUTHORITY-SIGNER-14","signer_id":"TEST-ONLY-SIGNER"},"stage":"STAGE_B","stage_b_freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","subject":"D-011-CANDIDATE-V15","technical_attestation":"ROLE_KEY_AUTHENTICATES_EXACT_RETAINED_BODIES_FOR_DECLARED_ROLE"}
+{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"182de83dd7593c8b2af71d3a0e58604056850033fc34309eb08cf08ddd90ae78","context":"TEST_ONLY","decision":"D-011","disclaimer":"Distinct HMAC keys establish cryptographic role separation and non-forgeability under secret-key assumptions; they do not establish human or organizational independence, separate physical custody, or natural-person identity.","function":"EXECUTES_PRIMARY_ENGINE","kind":"ROLE_ATTESTATION","lock_root":"442734ca27ac96c2e4a6477097e3bca7e6eaa01fa4e052d4e5c333811d20cd85","ordered_prefreeze_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":8677,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"945a0343a936ac307f9fe3026a55f521bf506adbdb142f63248ed7d84f6f04ca"},{"id":"PREFREEZE-PROVENANCE","length":13007,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"f0a3c39c28aaf1998b19e65c226e8b2fde2d9724e8c937f005393316c1204f44"}],"role":"PRIMARY_EXECUTOR","schema":"D011-ROLE-TECHNICAL-ATTESTATION-15","signature_sha256":"8aa2906e146e96c7709f068381a32363122ae80111e05de92c2057fc4451eedc","signer":{"context":"TEST_ONLY","domain":"TEST_ONLY_LOCAL_SIGNER","schema":"D011-AUTHORITY-SIGNER-14","signer_id":"TEST-ONLY-SIGNER"},"stage":"STAGE_B","stage_b_freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","subject":"D-011-CANDIDATE-V15","technical_attestation":"ROLE_KEY_AUTHENTICATES_EXACT_RETAINED_BODIES_FOR_DECLARED_ROLE"}
diff --git a/decisions/d011_v14/D-011-ROLE-V15-PROVENANCE_REVIEWER.json b/decisions/d011_v14/D-011-ROLE-V15-PROVENANCE_REVIEWER.json
index 5046418dea..9dd7eca138 100644
--- a/decisions/d011_v14/D-011-ROLE-V15-PROVENANCE_REVIEWER.json
+++ b/decisions/d011_v14/D-011-ROLE-V15-PROVENANCE_REVIEWER.json
@@ -1 +1 @@
-{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"da2ba64d2623e1202369206b2ba618a2dcfb87af4ebedc2a90e0bf2205c3967d","context":"TEST_ONLY","decision":"D-011","disclaimer":"Distinct HMAC keys establish cryptographic role separation and non-forgeability under secret-key assumptions; they do not establish human or organizational independence, separate physical custody, or natural-person identity.","function":"AUTHORS_PREFREEZE_PROVENANCE_REVIEW","kind":"ROLE_ATTESTATION","lock_root":"7f94c5cbe5f32f190056829f8ea713beeff818a507db59454e2abda37a1fec06","ordered_prefreeze_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":7291,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"27cc1162293adc9f054369ac5ee0c96d065c96e4b1bb548007367b825cccc00d"},{"id":"PREFREEZE-PROVENANCE","length":11514,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"aa548a576fc22278c36ee1ab22af9dad6c59677b3adfc7884bbb96357b2bf9f7"}],"role":"PROVENANCE_REVIEWER","schema":"D011-ROLE-TECHNICAL-ATTESTATION-15","signature_sha256":"8f20b4b653ac678a693386d9487bed9f7b84ec3b179a3ac3c898a61194beea0b","signer":{"context":"TEST_ONLY","domain":"TEST_ONLY_LOCAL_SIGNER","schema":"D011-AUTHORITY-SIGNER-14","signer_id":"TEST-ONLY-SIGNER"},"stage":"STAGE_B","stage_b_freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","subject":"D-011-CANDIDATE-V15","technical_attestation":"ROLE_KEY_AUTHENTICATES_EXACT_RETAINED_BODIES_FOR_DECLARED_ROLE"}
+{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"182de83dd7593c8b2af71d3a0e58604056850033fc34309eb08cf08ddd90ae78","context":"TEST_ONLY","decision":"D-011","disclaimer":"Distinct HMAC keys establish cryptographic role separation and non-forgeability under secret-key assumptions; they do not establish human or organizational independence, separate physical custody, or natural-person identity.","function":"AUTHORS_PREFREEZE_PROVENANCE_REVIEW","kind":"ROLE_ATTESTATION","lock_root":"442734ca27ac96c2e4a6477097e3bca7e6eaa01fa4e052d4e5c333811d20cd85","ordered_prefreeze_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":8677,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"945a0343a936ac307f9fe3026a55f521bf506adbdb142f63248ed7d84f6f04ca"},{"id":"PREFREEZE-PROVENANCE","length":13007,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"f0a3c39c28aaf1998b19e65c226e8b2fde2d9724e8c937f005393316c1204f44"}],"role":"PROVENANCE_REVIEWER","schema":"D011-ROLE-TECHNICAL-ATTESTATION-15","signature_sha256":"a40e94744ceeb3d9bad0324a69cbda33d87701ac3b1be776aceec1f9f8fd1482","signer":{"context":"TEST_ONLY","domain":"TEST_ONLY_LOCAL_SIGNER","schema":"D011-AUTHORITY-SIGNER-14","signer_id":"TEST-ONLY-SIGNER"},"stage":"STAGE_B","stage_b_freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","subject":"D-011-CANDIDATE-V15","technical_attestation":"ROLE_KEY_AUTHENTICATES_EXACT_RETAINED_BODIES_FOR_DECLARED_ROLE"}
diff --git a/decisions/d011_v14/D-011-ROLE-V15-REVIEWER_C.json b/decisions/d011_v14/D-011-ROLE-V15-REVIEWER_C.json
index a1291b68ee..a34a55aea0 100644
--- a/decisions/d011_v14/D-011-ROLE-V15-REVIEWER_C.json
+++ b/decisions/d011_v14/D-011-ROLE-V15-REVIEWER_C.json
@@ -1 +1 @@
-{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"da2ba64d2623e1202369206b2ba618a2dcfb87af4ebedc2a90e0bf2205c3967d","context":"TEST_ONLY","decision":"D-011","disclaimer":"Distinct HMAC keys establish cryptographic role separation and non-forgeability under secret-key assumptions; they do not establish human or organizational independence, separate physical custody, or natural-person identity.","function":"CROSS_MODEL_SOURCE_REVIEW","kind":"ROLE_ATTESTATION","lock_root":"7f94c5cbe5f32f190056829f8ea713beeff818a507db59454e2abda37a1fec06","ordered_prefreeze_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":7291,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"27cc1162293adc9f054369ac5ee0c96d065c96e4b1bb548007367b825cccc00d"},{"id":"PREFREEZE-PROVENANCE","length":11514,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"aa548a576fc22278c36ee1ab22af9dad6c59677b3adfc7884bbb96357b2bf9f7"}],"role":"REVIEWER_C","schema":"D011-ROLE-TECHNICAL-ATTESTATION-15","signature_sha256":"549930f4dc42d38d81b3fbb42a8ee51dc216b78b81bc717d0257277e71798044","signer":{"context":"TEST_ONLY","domain":"TEST_ONLY_LOCAL_SIGNER","schema":"D011-AUTHORITY-SIGNER-14","signer_id":"TEST-ONLY-SIGNER"},"stage":"STAGE_B","stage_b_freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","subject":"D-011-CANDIDATE-V15","technical_attestation":"ROLE_KEY_AUTHENTICATES_EXACT_RETAINED_BODIES_FOR_DECLARED_ROLE"}
+{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"182de83dd7593c8b2af71d3a0e58604056850033fc34309eb08cf08ddd90ae78","context":"TEST_ONLY","decision":"D-011","disclaimer":"Distinct HMAC keys establish cryptographic role separation and non-forgeability under secret-key assumptions; they do not establish human or organizational independence, separate physical custody, or natural-person identity.","function":"CROSS_MODEL_SOURCE_REVIEW","kind":"ROLE_ATTESTATION","lock_root":"442734ca27ac96c2e4a6477097e3bca7e6eaa01fa4e052d4e5c333811d20cd85","ordered_prefreeze_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":8677,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"945a0343a936ac307f9fe3026a55f521bf506adbdb142f63248ed7d84f6f04ca"},{"id":"PREFREEZE-PROVENANCE","length":13007,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"f0a3c39c28aaf1998b19e65c226e8b2fde2d9724e8c937f005393316c1204f44"}],"role":"REVIEWER_C","schema":"D011-ROLE-TECHNICAL-ATTESTATION-15","signature_sha256":"20ef95db113b5c4971854aed60af93b352ef4d3eb5107c7cd6c33bf03a17f619","signer":{"context":"TEST_ONLY","domain":"TEST_ONLY_LOCAL_SIGNER","schema":"D011-AUTHORITY-SIGNER-14","signer_id":"TEST-ONLY-SIGNER"},"stage":"STAGE_B","stage_b_freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","subject":"D-011-CANDIDATE-V15","technical_attestation":"ROLE_KEY_AUTHENTICATES_EXACT_RETAINED_BODIES_FOR_DECLARED_ROLE"}
diff --git a/decisions/d011_v14/D-011-ROLE-V15-REVIEWER_H.json b/decisions/d011_v14/D-011-ROLE-V15-REVIEWER_H.json
index 975e2f842e..66837f2ae0 100644
--- a/decisions/d011_v14/D-011-ROLE-V15-REVIEWER_H.json
+++ b/decisions/d011_v14/D-011-ROLE-V15-REVIEWER_H.json
@@ -1 +1 @@
-{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"da2ba64d2623e1202369206b2ba618a2dcfb87af4ebedc2a90e0bf2205c3967d","context":"TEST_ONLY","decision":"D-011","disclaimer":"Distinct HMAC keys establish cryptographic role separation and non-forgeability under secret-key assumptions; they do not establish human or organizational independence, separate physical custody, or natural-person identity.","function":"CROSS_MODEL_SOURCE_REVIEW","kind":"ROLE_ATTESTATION","lock_root":"7f94c5cbe5f32f190056829f8ea713beeff818a507db59454e2abda37a1fec06","ordered_prefreeze_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":7291,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"27cc1162293adc9f054369ac5ee0c96d065c96e4b1bb548007367b825cccc00d"},{"id":"PREFREEZE-PROVENANCE","length":11514,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"aa548a576fc22278c36ee1ab22af9dad6c59677b3adfc7884bbb96357b2bf9f7"}],"role":"REVIEWER_H","schema":"D011-ROLE-TECHNICAL-ATTESTATION-15","signature_sha256":"f81f7421896cff1842ffccb9366b179194278ce3a47a9773de0dcc51d67161f1","signer":{"context":"TEST_ONLY","domain":"TEST_ONLY_LOCAL_SIGNER","schema":"D011-AUTHORITY-SIGNER-14","signer_id":"TEST-ONLY-SIGNER"},"stage":"STAGE_B","stage_b_freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","subject":"D-011-CANDIDATE-V15","technical_attestation":"ROLE_KEY_AUTHENTICATES_EXACT_RETAINED_BODIES_FOR_DECLARED_ROLE"}
+{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"182de83dd7593c8b2af71d3a0e58604056850033fc34309eb08cf08ddd90ae78","context":"TEST_ONLY","decision":"D-011","disclaimer":"Distinct HMAC keys establish cryptographic role separation and non-forgeability under secret-key assumptions; they do not establish human or organizational independence, separate physical custody, or natural-person identity.","function":"CROSS_MODEL_SOURCE_REVIEW","kind":"ROLE_ATTESTATION","lock_root":"442734ca27ac96c2e4a6477097e3bca7e6eaa01fa4e052d4e5c333811d20cd85","ordered_prefreeze_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":8677,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"945a0343a936ac307f9fe3026a55f521bf506adbdb142f63248ed7d84f6f04ca"},{"id":"PREFREEZE-PROVENANCE","length":13007,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"f0a3c39c28aaf1998b19e65c226e8b2fde2d9724e8c937f005393316c1204f44"}],"role":"REVIEWER_H","schema":"D011-ROLE-TECHNICAL-ATTESTATION-15","signature_sha256":"62c90ffc78f320c8a94f249cd4cbef87d9e235680aac8874a59287b84e907774","signer":{"context":"TEST_ONLY","domain":"TEST_ONLY_LOCAL_SIGNER","schema":"D011-AUTHORITY-SIGNER-14","signer_id":"TEST-ONLY-SIGNER"},"stage":"STAGE_B","stage_b_freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","subject":"D-011-CANDIDATE-V15","technical_attestation":"ROLE_KEY_AUTHENTICATES_EXACT_RETAINED_BODIES_FOR_DECLARED_ROLE"}
diff --git a/decisions/d011_v14/D-011-ROLE-V15-SEMANTIC_REVIEWER.json b/decisions/d011_v14/D-011-ROLE-V15-SEMANTIC_REVIEWER.json
index 773d57f227..6fc174b6b2 100644
--- a/decisions/d011_v14/D-011-ROLE-V15-SEMANTIC_REVIEWER.json
+++ b/decisions/d011_v14/D-011-ROLE-V15-SEMANTIC_REVIEWER.json
@@ -1 +1 @@
-{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"da2ba64d2623e1202369206b2ba618a2dcfb87af4ebedc2a90e0bf2205c3967d","context":"TEST_ONLY","decision":"D-011","disclaimer":"Distinct HMAC keys establish cryptographic role separation and non-forgeability under secret-key assumptions; they do not establish human or organizational independence, separate physical custody, or natural-person identity.","function":"AUTHORS_PREFREEZE_SEMANTIC_REVIEW_AND_QUALIFIES_SEAL","kind":"ROLE_ATTESTATION","lock_root":"7f94c5cbe5f32f190056829f8ea713beeff818a507db59454e2abda37a1fec06","ordered_prefreeze_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":7291,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"27cc1162293adc9f054369ac5ee0c96d065c96e4b1bb548007367b825cccc00d"},{"id":"PREFREEZE-PROVENANCE","length":11514,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"aa548a576fc22278c36ee1ab22af9dad6c59677b3adfc7884bbb96357b2bf9f7"}],"role":"SEMANTIC_REVIEWER","schema":"D011-ROLE-TECHNICAL-ATTESTATION-15","signature_sha256":"61a65b0b736b52106db266fa35e924a696ec5cd00fcb309594b8c2b97fd94227","signer":{"context":"TEST_ONLY","domain":"TEST_ONLY_LOCAL_SIGNER","schema":"D011-AUTHORITY-SIGNER-14","signer_id":"TEST-ONLY-SIGNER"},"stage":"STAGE_B","stage_b_freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","subject":"D-011-CANDIDATE-V15","technical_attestation":"ROLE_KEY_AUTHENTICATES_EXACT_RETAINED_BODIES_FOR_DECLARED_ROLE"}
+{"candidate":"D-011-CANDIDATE-V15","candidate_digest":"182de83dd7593c8b2af71d3a0e58604056850033fc34309eb08cf08ddd90ae78","context":"TEST_ONLY","decision":"D-011","disclaimer":"Distinct HMAC keys establish cryptographic role separation and non-forgeability under secret-key assumptions; they do not establish human or organizational independence, separate physical custody, or natural-person identity.","function":"AUTHORS_PREFREEZE_SEMANTIC_REVIEW_AND_QUALIFIES_SEAL","kind":"ROLE_ATTESTATION","lock_root":"442734ca27ac96c2e4a6477097e3bca7e6eaa01fa4e052d4e5c333811d20cd85","ordered_prefreeze_review_refs":[{"id":"PREFREEZE-SEMANTIC","length":8677,"path":"decisions/d011_v14/D-011-PREFREEZE-SEMANTIC-V15.json","sha256":"945a0343a936ac307f9fe3026a55f521bf506adbdb142f63248ed7d84f6f04ca"},{"id":"PREFREEZE-PROVENANCE","length":13007,"path":"decisions/d011_v14/D-011-PREFREEZE-PROVENANCE-V15.json","sha256":"f0a3c39c28aaf1998b19e65c226e8b2fde2d9724e8c937f005393316c1204f44"}],"role":"SEMANTIC_REVIEWER","schema":"D011-ROLE-TECHNICAL-ATTESTATION-15","signature_sha256":"96ed34b77977f4d06b626d2bc8f85f218a741b61180495b2ce7fb767d1744958","signer":{"context":"TEST_ONLY","domain":"TEST_ONLY_LOCAL_SIGNER","schema":"D011-AUTHORITY-SIGNER-14","signer_id":"TEST-ONLY-SIGNER"},"stage":"STAGE_B","stage_b_freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","subject":"D-011-CANDIDATE-V15","technical_attestation":"ROLE_KEY_AUTHENTICATES_EXACT_RETAINED_BODIES_FOR_DECLARED_ROLE"}
diff --git a/decisions/d011_v14/D-011-STAGE-B-FREEZE-V15.json b/decisions/d011_v14/D-011-STAGE-B-FREEZE-V15.json
index 66bef23930..81ea292202 100644
--- a/decisions/d011_v14/D-011-STAGE-B-FREEZE-V15.json
+++ b/decisions/d011_v14/D-011-STAGE-B-FREEZE-V15.json
@@ -1 +1 @@
-{"active":0,"aggregate":{"id":"PREFREEZE-AGGREGATE","length":609,"path":"decisions/d011_v14/D-011-PREFREEZE-AGGREGATE-V15.json","sha256":"faa434301694f8e52327ac0a43a94b6a14a65dfd83165560181c34be2927efda"},"authorization":"C0_H0_ONLY","boundary_manifest":{"bytes":2659493,"path":"decisions/d011_v14/d011-boundary-manifest-v1.json","regenerated_from":"d011_manifest.manifest_spec()","sha256":"a97334f339ece0397a6dc41581154b2ece8e0d67596058676092b12f74bb02ea"},"candidate":"D-011-CANDIDATE-V15","candidate_digest":"da2ba64d2623e1202369206b2ba618a2dcfb87af4ebedc2a90e0bf2205c3967d","ceremony_context_sha256":"2b409da54cbb33ce02cabd2ffad7da955fe78fae577ca5aef1bc20530d31da04","checkpoint_a_double_prime":{"commit":"edf85f3a0033c8bd747e5e3f3ce5d722a5cea7f7","tree":"ca232cfe6ea77e984b899814022e5d3bfb7ddde6"},"context":"TEST_ONLY","contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","contract_schema":"D011-STAGE-B-FREEZE-CONTRACT-15","decision":"D-011","decision_status":"OPEN","declared_id":"D011-V15-STAGE-B-FREEZE","declared_kind":"STAGE_B_FREEZE","declared_path":"decisions/d011_v14/D-011-STAGE-B-FREEZE-V15.json","engine_pins":{"oracle":{"ast_sha256":"34a0775391546682c09971b77b76852359f794e74dbca5d1ccdeb13236279109","git_blob_oid":"8819391342e6749a131e5bf882960e82dfa7f2e3","sha256":"636611688946c7d9dff3722325bfc22a2be17153efba8c5324ebd48ec72d7739"},"primary":{"ast_sha256":"d75f76e51fd93d84140193bc22e0de29b6b64c2c5333734c9dc8dab627c21461","git_blob_oid":"952b9f5edb1f70391ea7324ee57b581a5f4e9a18","sha256":"89b1960b6036d5e33c434cd6eae9b677ba1ca15d49bcdb6240d9aabba1eda516"}},"execution_module":{"bytes":80189,"path":"decisions/d011_v14/d011_execution.py","review":"V15_COMPLETION_CHANGED","sha256":"5f4c32e75397f67c2021770ff251bf01341ed4d912c06dd76c8671d39a4c9bbf"},"freeze_status":"FROZEN_FOR_EVIDENCE","lock":{"id":"LOCK-V15","length":1906,"path":"decisions/d011_v14/D-011-LOCK-V15.json","sha256":"7f94c5cbe5f32f190056829f8ea713beeff818a507db59454e2abda37a1fec06"},"manifest_module":{"bytes":211887,"path":"decisions/d011_v14/d011_manifest.py","review":"V15_ADAPTER_CHANGED","sha256":"15b76cb984f34cfcb58d3c7758a97a8b76ff3f21382977ed0690abbec4fa3ae3"},"qualification":"UNQUALIFIED","role_refs":[{"length":1473,"path":"decisions/d011_v14/D-011-ROLE-V15-PRIMARY_EXECUTOR.json","role":"PRIMARY_EXECUTOR","sha256":"ea6db47df1f81129f4e0cb3db964553642ad53f875e13ad0cfa9039eb38db0f2"},{"length":1471,"path":"decisions/d011_v14/D-011-ROLE-V15-ORACLE_EXECUTOR.json","role":"ORACLE_EXECUTOR","sha256":"fe4d040a9110d1b0cb46eadf3b3ca574b5138e29dee5f5039cd0d615f18654b8"},{"length":1478,"path":"decisions/d011_v14/D-011-ROLE-V15-ASSURANCE_EXECUTOR.json","role":"ASSURANCE_EXECUTOR","sha256":"9bc93f835395c49771308e27e580100d8b0bd2dd335840e2dfd3724fdc295208"},{"length":1469,"path":"decisions/d011_v14/D-011-ROLE-V15-REVIEWER_C.json","role":"REVIEWER_C","sha256":"fa94c3734484196653112a8853003a8ea746bdf46358bbe3f259f78c02d262b9"},{"length":1469,"path":"decisions/d011_v14/D-011-ROLE-V15-REVIEWER_H.json","role":"REVIEWER_H","sha256":"d90ea94c2ff02d2b56f39e13327497813553dce10563cad7415b879dd3a4e4ac"},{"length":1463,"path":"decisions/d011_v14/D-011-ROLE-V15-FREEZER.json","role":"FREEZER","sha256":"c19a9a905dd6a8da646899fa085fba34b87ec0022d4eca9a9ba370cc73335708"},{"length":1478,"path":"decisions/d011_v14/D-011-ROLE-V15-COORDINATOR.json","role":"COORDINATOR","sha256":"6561f1f6d55f98a44b6ee7ad4f0e0770a8caa23382b6fecb088436e8fdf1985f"},{"length":1503,"path":"decisions/d011_v14/D-011-ROLE-V15-SEMANTIC_REVIEWER.json","role":"SEMANTIC_REVIEWER","sha256":"424a990775b9ebafb879a830ef3e7782e4bda18bdbaffc0ffb4be902e9ad98a4"},{"length":1488,"path":"decisions/d011_v14/D-011-ROLE-V15-PROVENANCE_REVIEWER.json","role":"PROVENANCE_REVIEWER","sha256":"2c0a67725d73b87c83ae65d56b73978cf6ddb081beb042dfb3b25f19687cd65f"}],"schema":"D011-STAGE-B-FREEZE-PAYLOAD-15","source_map_sha256":"2570987fe0281d1851ba3d06f0ebccfd48cd4eec97d47e26494375a9261638c7"}
+{"active":0,"aggregate":{"id":"PREFREEZE-AGGREGATE","length":609,"path":"decisions/d011_v14/D-011-PREFREEZE-AGGREGATE-V15.json","sha256":"963c1b374255ecd4a2d315e01419d1ac97d6355786bf9e1f139a83dddd1455bf"},"authorization":"C0_H0_ONLY","boundary_manifest":{"bytes":2659529,"path":"decisions/d011_v14/d011-boundary-manifest-v1.json","regenerated_from":"d011_manifest.manifest_spec()","sha256":"06b8a2112b962a7fcd6657cb548ea30b598008b9deb26e406d53f1241116c0cc"},"candidate":"D-011-CANDIDATE-V15","candidate_digest":"182de83dd7593c8b2af71d3a0e58604056850033fc34309eb08cf08ddd90ae78","ceremony_context_sha256":"8a071729ed4683edc4e8dc3b41d493b6879257ec8f321907f639fad753ac33f1","checkpoint_a_triple_prime":{"commit":"0a22837e498614f0f90fac510fc8729b9527072c","tree":"2b7eb8135daa78f37961bf02e3ec25fb2278fbff"},"context":"TEST_ONLY","contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","contract_schema":"D011-STAGE-B-FREEZE-CONTRACT-15","decision":"D-011","decision_status":"OPEN","declared_id":"D011-V15-STAGE-B-FREEZE","declared_kind":"STAGE_B_FREEZE","declared_path":"decisions/d011_v14/D-011-STAGE-B-FREEZE-V15.json","engine_pins":{"oracle":{"ast_sha256":"34d9a7773ef46a5d429205e3e7557c89ca52cfb73b9b1c336d8b5f1bd0f96d77","git_blob_oid":"92ce92ccfb875993ba1d9e45b0e0c34c3f08cd83","sha256":"3741805546997b6a84159c2cc869559508082c0015155ab28b35026678415d73"},"primary":{"ast_sha256":"d75f76e51fd93d84140193bc22e0de29b6b64c2c5333734c9dc8dab627c21461","git_blob_oid":"952b9f5edb1f70391ea7324ee57b581a5f4e9a18","sha256":"89b1960b6036d5e33c434cd6eae9b677ba1ca15d49bcdb6240d9aabba1eda516"}},"execution_module":{"bytes":80189,"path":"decisions/d011_v14/d011_execution.py","review":"V15_COMPLETION_CHANGED","sha256":"5f4c32e75397f67c2021770ff251bf01341ed4d912c06dd76c8671d39a4c9bbf"},"freeze_status":"FROZEN_FOR_EVIDENCE","lock":{"id":"LOCK-V15","length":2091,"path":"decisions/d011_v14/D-011-LOCK-V15.json","sha256":"442734ca27ac96c2e4a6477097e3bca7e6eaa01fa4e052d4e5c333811d20cd85"},"manifest_module":{"bytes":211887,"path":"decisions/d011_v14/d011_manifest.py","review":"V15_ADAPTER_CHANGED","sha256":"6fac8eb03e3b4dc77646292d06beb72fb2a3af87edf24c73171e0582c8c2db34"},"oracle_module":{"bytes":33060,"path":"decisions/d011_v14/d011_oracle.py","review":"V15_ORACLE_FIX_CHANGED","sha256":"3741805546997b6a84159c2cc869559508082c0015155ab28b35026678415d73"},"qualification":"UNQUALIFIED","role_refs":[{"length":1473,"path":"decisions/d011_v14/D-011-ROLE-V15-PRIMARY_EXECUTOR.json","role":"PRIMARY_EXECUTOR","sha256":"bd6d2f284f2014a3d8c39a1cc50cdd059fa4c4bbd3492fa0db7d29f3eb60f52c"},{"length":1471,"path":"decisions/d011_v14/D-011-ROLE-V15-ORACLE_EXECUTOR.json","role":"ORACLE_EXECUTOR","sha256":"ba6e68eb0cef992036e9378dda782e7a865e0d9f52232bc83076c6cd6d5d7c78"},{"length":1478,"path":"decisions/d011_v14/D-011-ROLE-V15-ASSURANCE_EXECUTOR.json","role":"ASSURANCE_EXECUTOR","sha256":"f227a4a6b98815693be90a8d7b9819b3086446fa74152f202418f1cdccb770e4"},{"length":1469,"path":"decisions/d011_v14/D-011-ROLE-V15-REVIEWER_C.json","role":"REVIEWER_C","sha256":"2100794e110cd206ad21feded6ec54cacfa102d61613ed1c6359688a3f38fee5"},{"length":1469,"path":"decisions/d011_v14/D-011-ROLE-V15-REVIEWER_H.json","role":"REVIEWER_H","sha256":"6eeb9dd467ae656816d2808d2ccc4e54d03d6f1e9483b8975f070fe7a42cd023"},{"length":1463,"path":"decisions/d011_v14/D-011-ROLE-V15-FREEZER.json","role":"FREEZER","sha256":"17eba5efb5bdb5fb3b9362426d3fee6efe4935cc9f00d2677d25be05dab6cbb2"},{"length":1478,"path":"decisions/d011_v14/D-011-ROLE-V15-COORDINATOR.json","role":"COORDINATOR","sha256":"01bab0586b8726e1e35cf804b1ac2cb398c6f2e65ab707ca55cfe1a29d90e99c"},{"length":1503,"path":"decisions/d011_v14/D-011-ROLE-V15-SEMANTIC_REVIEWER.json","role":"SEMANTIC_REVIEWER","sha256":"94dfc197a727dcc75364ad9491cf3ab4305eb59c9e8a2efe25016a6599a089f1"},{"length":1488,"path":"decisions/d011_v14/D-011-ROLE-V15-PROVENANCE_REVIEWER.json","role":"PROVENANCE_REVIEWER","sha256":"3b4047db6a1119a9abb833d9ac4b320abc4e6a30af3a8f80b00345f1abcc63bf"}],"schema":"D011-STAGE-B-FREEZE-PAYLOAD-15","source_map_sha256":"6f94fb6dd795d158aba0cfcf8c4d0489975225533d53dd9dff82f2adb522c6aa"}
diff --git a/decisions/d011_v14/D-011-SUPERSESSION-V15.json b/decisions/d011_v14/D-011-SUPERSESSION-V15.json
index da7722217f..51ff297e46 100644
--- a/decisions/d011_v14/D-011-SUPERSESSION-V15.json
+++ b/decisions/d011_v14/D-011-SUPERSESSION-V15.json
@@ -1 +1 @@
-{"decision":{"active":0,"id":"D-011","qualification":"UNQUALIFIED","status":"OPEN"},"no_legacy_fallback":1,"nonclaims":["NO_PRODUCTION_AUTHORITY","NO_PRODUCTION_EVIDENCE","NO_QUALIFICATION","NO_SELECTION","NO_STAGE_C_AUTHORIZATION","NO_RELABEL_OR_REHASH_PROMOTION","NO_ADMISSION_COMPLETENESS","NO_TOTAL_CONFORMANCE"],"schema":"D011-SUPERSESSION-V15-1","status_note":"This supersession record documents the v15 Stage B ceremony as structurally complete (TEST_ONLY) against the completed v15 source (checkpoint A'' = edf85f3a0). D-011 remains OPEN/UNQUALIFIED/INACTIVE. No production evidence, qualification, selection, key custody, or natural-person identity is claimed. The v15 production checked-execution adapter admits PRODUCTION_EXTERNAL only via consulted adapter + owner-authorization records; the production-context completion makes the reconciliation sub-protocol follow the boundary decision and adds frozen deterministic placement/BFS builders. A source-derived placement discriminant (unique strict-subset profile TRUSTED_RUNTIME from the declared law) is a PREDICTION, not evidence; no winner is claimed. The production ceremony with real external keys is the G6/G7 owner gate (M5).","supersedes":{"v12":{"note":"v12 is historically retained and blocked, not a fallback qualification route."},"v13":{"freeze":"c17a6a2f4040729f4ea9d58b31aa04fd2651c9f7","note":"v13 Stage B ceremony was frozen and independently validated under the superseded v13 lineage; v14 supersedes the contract, not the history."},"v14":{"freeze_sha256":"a698840dd3b51af7b6f024b3a3db9a0946c628f2f28c5cc801a3a82219f0af1b","lock_sha256":"7e1e4a446511fffc4e33cf9ee100cdcc01aa0600369cc5f36acb39657d167107","note":"v14 Stage B ceremony was frozen and independently validated under the superseded v14 lineage; v15 supersedes the contract, not the history."}},"v15_stage_b":{"activated_context_sha256":"cb1c55eadb8da193bdb8ce2907b4bebeb5ee164bc166503e66d4534039b9b6c2","aggregate_sha256":"faa434301694f8e52327ac0a43a94b6a14a65dfd83165560181c34be2927efda","boundary_manifest":{"bytes":2659493,"path":"decisions/d011_v14/d011-boundary-manifest-v1.json","sha256":"a97334f339ece0397a6dc41581154b2ece8e0d67596058676092b12f74bb02ea"},"checkpoint_a_double_prime_commit":"edf85f3a0033c8bd747e5e3f3ce5d722a5cea7f7","checkpoint_a_double_prime_tree":"ca232cfe6ea77e984b899814022e5d3bfb7ddde6","checkpoint_b_commit":null,"decision_status":"OPEN","engine_pins":{"oracle_sha256":"636611688946c7d9dff3722325bfc22a2be17153efba8c5324ebd48ec72d7739","primary_sha256":"89b1960b6036d5e33c434cd6eae9b677ba1ca15d49bcdb6240d9aabba1eda516"},"freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","freeze_sha256":"a0ceec082eece46761d7b982297f605cc2b3efb902b11864f30b6333febb942a","freeze_status":"FROZEN_FOR_EVIDENCE","lock_sha256":"7f94c5cbe5f32f190056829f8ea713beeff818a507db59454e2abda37a1fec06","module_identities":{"execution_module":{"bytes":80189,"path":"decisions/d011_v14/d011_execution.py","sha256":"5f4c32e75397f67c2021770ff251bf01341ed4d912c06dd76c8671d39a4c9bbf"},"manifest_module":{"bytes":211887,"path":"decisions/d011_v14/d011_manifest.py","sha256":"15b76cb984f34cfcb58d3c7758a97a8b76ff3f21382977ed0690abbec4fa3ae3"},"reviewed_sha256":{"decisions/d011_v14/d011_authority.py":"6c1e35c20011a0db778a3a1c9222b79e333572c0be1ca1874a0d49bef66be9b9","decisions/d011_v14/d011_producers.py":"7e63471020fcb2817cca55d5927108c9dbb3053f66a483b5372fc6cfdaf8204e","decisions/d011_v14/d011_protocol.py":"be15c609093124d4c5e562d115584db8a0416d116a3ae6fe91361a3cdb0dac17","decisions/d011_v14/d011_runtime.py":"b82073aa08daf0f069592e4ec01f83318aef6334b7ba7c57b8910eae013539ad","decisions/d011_v14/d011_stage_b.py":"04eb155b4bb0016fc174fd27de784a316b8f383836602cc481782e11df888f11","decisions/d011_v14/d011_stage_c.py":"a6c6167761693b3212763bdddbc3e6cf9875f6345f87c350316446b35419f296"}},"prefreeze_context_sha256":"93b3278faa24341a4a8d2559caae503333117fd732f88145e02f00d4a7069cd0","production_authority_available":0,"provenance_sha256":"aa548a576fc22278c36ee1ab22af9dad6c59677b3adfc7884bbb96357b2bf9f7","qualification":"UNQUALIFIED","semantic_sha256":"27cc1162293adc9f054369ac5ee0c96d065c96e4b1bb548007367b825cccc00d","source_map_sha256":"2570987fe0281d1851ba3d06f0ebccfd48cd4eec97d47e26494375a9261638c7","test_only":1}}
+{"decision":{"active":0,"id":"D-011","qualification":"UNQUALIFIED","status":"OPEN"},"no_legacy_fallback":1,"nonclaims":["NO_PRODUCTION_AUTHORITY","NO_PRODUCTION_EVIDENCE","NO_QUALIFICATION","NO_SELECTION","NO_STAGE_C_AUTHORIZATION","NO_RELABEL_OR_REHASH_PROMOTION","NO_ADMISSION_COMPLETENESS","NO_TOTAL_CONFORMANCE"],"schema":"D011-SUPERSESSION-V15-1","status_note":"This supersession record documents the v15 Stage B ceremony as structurally complete (TEST_ONLY) against the post-oracle-fix v15 source (checkpoint A''' = 0a22837e4, the owner-authorized oracle effect_flow gate fix). D-011 remains OPEN/UNQUALIFIED/INACTIVE. No production evidence, qualification, selection, key custody, or natural-person identity is claimed. The v15 production checked-execution adapter admits PRODUCTION_EXTERNAL only via consulted adapter + owner-authorization records; the production-context completion makes the reconciliation sub-protocol follow the boundary decision and adds frozen deterministic placement/BFS builders. The oracle effect_flow gate fix mirrors the primary's per-action type guards, wrapped fail-closed for engine totality. A source-derived placement discriminant (unique strict-subset profile TRUSTED_RUNTIME from the declared law) is a PREDICTION, not evidence; no winner is claimed. The production ceremony with real external keys is the G6/G7 owner gate (M5).","supersedes":{"v12":{"note":"v12 is historically retained and blocked, not a fallback qualification route."},"v13":{"freeze":"c17a6a2f4040729f4ea9d58b31aa04fd2651c9f7","note":"v13 Stage B ceremony was frozen and independently validated under the superseded v13 lineage; v14 supersedes the contract, not the history."},"v14":{"freeze_sha256":"a698840dd3b51af7b6f024b3a3db9a0946c628f2f28c5cc801a3a82219f0af1b","lock_sha256":"7e1e4a446511fffc4e33cf9ee100cdcc01aa0600369cc5f36acb39657d167107","note":"v14 Stage B ceremony was frozen and independently validated under the superseded v14 lineage; v15 supersedes the contract, not the history."}},"v15_stage_b":{"activated_context_sha256":"7982e6999745b618666ab167f126ffeec6b62beaf044bfba56f5b1b9b53405c1","aggregate_sha256":"963c1b374255ecd4a2d315e01419d1ac97d6355786bf9e1f139a83dddd1455bf","boundary_manifest":{"bytes":2659529,"path":"decisions/d011_v14/d011-boundary-manifest-v1.json","sha256":"06b8a2112b962a7fcd6657cb548ea30b598008b9deb26e406d53f1241116c0cc"},"checkpoint_a_triple_prime_commit":"0a22837e498614f0f90fac510fc8729b9527072c","checkpoint_a_triple_prime_tree":"2b7eb8135daa78f37961bf02e3ec25fb2278fbff","checkpoint_b_commit":null,"decision_status":"OPEN","engine_pins":{"oracle_sha256":"3741805546997b6a84159c2cc869559508082c0015155ab28b35026678415d73","primary_sha256":"89b1960b6036d5e33c434cd6eae9b677ba1ca15d49bcdb6240d9aabba1eda516"},"freeze_contract_root":"be2baa2aabd85427d9dabc6ba6b970efe85beab0ca419ba5c655d4447be55753","freeze_sha256":"46c0549a854bb39144dc50e0c9200051f17cebf3f78495b68fa18fd43c7fcf31","freeze_status":"FROZEN_FOR_EVIDENCE","lock_sha256":"442734ca27ac96c2e4a6477097e3bca7e6eaa01fa4e052d4e5c333811d20cd85","module_identities":{"execution_module":{"bytes":80189,"path":"decisions/d011_v14/d011_execution.py","sha256":"5f4c32e75397f67c2021770ff251bf01341ed4d912c06dd76c8671d39a4c9bbf"},"manifest_module":{"bytes":211887,"path":"decisions/d011_v14/d011_manifest.py","sha256":"6fac8eb03e3b4dc77646292d06beb72fb2a3af87edf24c73171e0582c8c2db34"},"oracle_module":{"bytes":33060,"path":"decisions/d011_v14/d011_oracle.py","sha256":"3741805546997b6a84159c2cc869559508082c0015155ab28b35026678415d73"},"reviewed_sha256":{"decisions/d011_v14/d011_authority.py":"6c1e35c20011a0db778a3a1c9222b79e333572c0be1ca1874a0d49bef66be9b9","decisions/d011_v14/d011_producers.py":"7e63471020fcb2817cca55d5927108c9dbb3053f66a483b5372fc6cfdaf8204e","decisions/d011_v14/d011_protocol.py":"be15c609093124d4c5e562d115584db8a0416d116a3ae6fe91361a3cdb0dac17","decisions/d011_v14/d011_runtime.py":"b82073aa08daf0f069592e4ec01f83318aef6334b7ba7c57b8910eae013539ad","decisions/d011_v14/d011_stage_b.py":"04eb155b4bb0016fc174fd27de784a316b8f383836602cc481782e11df888f11","decisions/d011_v14/d011_stage_c.py":"a6c6167761693b3212763bdddbc3e6cf9875f6345f87c350316446b35419f296"}},"prefreeze_context_sha256":"a1793bee8f0b659d401c8eb13de336c98cab2e41336574dd47393cf62c7e5daf","production_authority_available":0,"provenance_sha256":"f0a3c39c28aaf1998b19e65c226e8b2fde2d9724e8c937f005393316c1204f44","qualification":"UNQUALIFIED","semantic_sha256":"945a0343a936ac307f9fe3026a55f521bf506adbdb142f63248ed7d84f6f04ca","source_map_sha256":"6f94fb6dd795d158aba0cfcf8c4d0489975225533d53dd9dff82f2adb522c6aa","test_only":1}}
diff --git a/decisions/d011_v14/test_d011_stage_b_v15.py b/decisions/d011_v14/test_d011_stage_b_v15.py
index 85409ffc26..10e96d30e2 100644
--- a/decisions/d011_v14/test_d011_stage_b_v15.py
+++ b/decisions/d011_v14/test_d011_stage_b_v15.py
@@ -19,31 +19,36 @@ Real-key production signing is out of scope.
 
 What v15 changes relative to v14 (all bound, none hard-coded without checking):
 
-  * Checkpoint A'' is the commit that carries the *completed* v15 source (the
-    production-context completion); it is recomputed from git at build time and
-    asserted against the recorded identity.  The earlier adapter checkpoint A'
-    is retained only inside the source-change history (ordinal 6).
+  * Checkpoint A''' is the commit that carries the *post-oracle-fix* v15 source
+    (the owner-authorized oracle effect_flow gate fix); it is recomputed from git
+    at build time and asserted against the recorded identity.  The earlier
+    completion checkpoint A'' and adapter checkpoint A' are retained only inside
+    the source-change history (ordinals 7 and 6).
   * ``source_map_sha256`` is the *expanded reconciliation closure* hash
     (``test_d011_manifest.reconciliation_source_map()`` canonicalized), not the
     historical six-file map.
-  * The six cross-model-reviewed modules are recorded unchanged; the two changed
-    candidate modules -- the v15 adapter ``d011_manifest.py`` and the checked
-    execution request builders ``d011_execution.py`` -- are recorded separately
-    and bound alongside the reviewed set.
-  * The regenerated boundary manifest identity is bound (it was regenerated a
-    second time by the completion commit through the pure generation path).
+  * The six cross-model-reviewed modules are recorded unchanged; the three changed
+    candidate modules -- the v15 adapter ``d011_manifest.py``, the checked
+    execution request builders ``d011_execution.py`` and the oracle engine
+    ``d011_oracle.py`` (effect_flow gate fix) -- are recorded separately and bound
+    alongside the reviewed set.
+  * The regenerated boundary manifest identity is bound (regenerated by the
+    completion and the oracle-fix commits through the pure generation path).
   * Engine pins are read from the frozen manifest constants and recorded
-    identically (unchanged).
+    identically; the oracle pin now records the effect_flow gate fix (37418055...).
   * Source-change history is the five operator-authorized engine fixes, the v15
-    adapter (ordinal 6) and the v15 production-context completion (ordinal 7).
+    adapter (ordinal 6), the v15 production-context completion (ordinal 7) and the
+    oracle effect_flow gate fix (ordinal 8).
 
 The production-context completion makes the reconciliation sub-protocol follow
 the checked-execution boundary decision and adds frozen, deterministic
 placement-cell (1,392 = 1,296 COMPROMISE + 96 OMISSION/RESTORED) and BFS (21)
 production builders that emit born-lineage records validated by the frozen
 ``_placement_contract`` / ``_bfs_contract`` with no engine or checker calls.
-The engines themselves remain untouched and the TEST_ONLY discipline is
-unchanged.
+The owner-authorized oracle effect_flow gate fix (ordinal 8) replaces the
+union-of-shapes key gate with the primary's per-action type guards wrapped
+fail-closed for engine totality; the primary engine and the TEST_ONLY discipline
+are unchanged.
 
 Decision status at freeze stays OPEN / UNQUALIFIED / INACTIVE
 (``decision_status`` OPEN, ``qualification`` UNQUALIFIED, ``freeze_status``
@@ -80,9 +85,14 @@ CANDIDATE_V15 = "D-011-CANDIDATE-V15"
 # builder; nothing is trusted verbatim.
 # --------------------------------------------------------------------------- #
 
-#: Checkpoint A'' -- the commit that carries the *completed* v15 source: the
-#: v15 production-context completion (recomputed from git and asserted).  The
-#: earlier adapter checkpoint A' is recorded only in the source-change history.
+#: Checkpoint A''' -- the commit that carries the *post-oracle-fix* v15 source:
+#: the owner-authorized oracle effect_flow gate fix (recomputed from git and
+#: asserted).  The earlier completion checkpoint A'' and adapter checkpoint A'
+#: are recorded only in the source-change history (ordinals 7 and 6).
+CHECKPOINT_A_TRIPLE_PRIME_COMMIT = "0a22837e498614f0f90fac510fc8729b9527072c"
+CHECKPOINT_A_TRIPLE_PRIME_TREE = "2b7eb8135daa78f37961bf02e3ec25fb2278fbff"
+
+#: The completion checkpoint A'' -- retained as the ordinal-7 source-change commit.
 CHECKPOINT_A_DOUBLE_PRIME_COMMIT = "edf85f3a0033c8bd747e5e3f3ce5d722a5cea7f7"
 CHECKPOINT_A_DOUBLE_PRIME_TREE = "ca232cfe6ea77e984b899814022e5d3bfb7ddde6"
 
@@ -91,30 +101,38 @@ CHECKPOINT_A_PRIME_COMMIT = "90ab0b041ba862ccc3ea58f63c0c1e979c642dbc"
 CHECKPOINT_A_PRIME_TREE = "0e40f9804b77bda5ec1a13dae17d019e10fcce11"
 
 #: Expanded reconciliation-closure source map (``d011_manifest.canonical`` + sha256).
-SOURCE_MAP_SHA256_V15 = "2570987fe0281d1851ba3d06f0ebccfd48cd4eec97d47e26494375a9261638c7"
+SOURCE_MAP_SHA256_V15 = "6f94fb6dd795d158aba0cfcf8c4d0489975225533d53dd9dff82f2adb522c6aa"
 
-#: The v15 adapter module (``d011_manifest.py``), changed by the adapter commit
-#: and again by the production-context completion.
+#: The v15 adapter module (``d011_manifest.py``), changed by the adapter commit,
+#: the production-context completion and the oracle effect_flow gate fix (which
+#: updates its engine pins + boundary-manifest spec).
 MANIFEST_MODULE_PATH = "decisions/d011_v14/d011_manifest.py"
-MANIFEST_MODULE_SHA256 = "15b76cb984f34cfcb58d3c7758a97a8b76ff3f21382977ed0690abbec4fa3ae3"
+MANIFEST_MODULE_SHA256 = "6fac8eb03e3b4dc77646292d06beb72fb2a3af87edf24c73171e0582c8c2db34"
 MANIFEST_MODULE_BYTES = 211887
 
 #: The checked-execution request builders (``d011_execution.py``), changed by the
 #: production-context completion (reconciliation sub-protocol context follows the
-#: boundary decision); bound alongside the adapter module.
+#: boundary decision); bound alongside the adapter module (unchanged since A'').
 EXECUTION_MODULE_PATH = "decisions/d011_v14/d011_execution.py"
 EXECUTION_MODULE_SHA256 = "5f4c32e75397f67c2021770ff251bf01341ed4d912c06dd76c8671d39a4c9bbf"
 EXECUTION_MODULE_BYTES = 80189
 
+#: The oracle engine module (``d011_oracle.py``), changed by the owner-authorized
+#: oracle effect_flow gate fix (ordinal 8); bound alongside the other changed
+#: candidate modules and identical to the frozen ORACLE_ENGINE_SHA256 engine pin.
+ORACLE_MODULE_PATH = "decisions/d011_v14/d011_oracle.py"
+ORACLE_MODULE_SHA256 = "3741805546997b6a84159c2cc869559508082c0015155ab28b35026678415d73"
+ORACLE_MODULE_BYTES = 33060
+
 #: The regenerated boundary manifest, bound by the v15 ceremony (regenerated by
-#: the completion commit through the pure generation path).
+#: the completion and the oracle-fix commits through the pure generation path).
 BOUNDARY_MANIFEST_PATH = "decisions/d011_v14/d011-boundary-manifest-v1.json"
-BOUNDARY_MANIFEST_SHA256 = "a97334f339ece0397a6dc41581154b2ece8e0d67596058676092b12f74bb02ea"
-BOUNDARY_MANIFEST_BYTES = 2659493
+BOUNDARY_MANIFEST_SHA256 = "06b8a2112b962a7fcd6657cb548ea30b598008b9deb26e406d53f1241116c0cc"
+BOUNDARY_MANIFEST_BYTES = 2659529
 
 #: Frozen engine pins (read from the manifest constants; recorded identically).
 PRIMARY_ENGINE_SHA256 = "89b1960b6036d5e33c434cd6eae9b677ba1ca15d49bcdb6240d9aabba1eda516"
-ORACLE_ENGINE_SHA256 = "636611688946c7d9dff3722325bfc22a2be17153efba8c5324ebd48ec72d7739"
+ORACLE_ENGINE_SHA256 = "3741805546997b6a84159c2cc869559508082c0015155ab28b35026678415d73"
 
 #: The six cross-model-reviewed v14 modules (D-011-PACKET.md line 256).  These
 #: are all UNCHANGED from v14; ``d011_manifest.py`` is deliberately NOT one of
@@ -204,7 +222,8 @@ V15_ADAPTER_CHANGE = {
 
 #: The seventh source change: the v15 production-context completion.
 V15_COMPLETION_CHANGE = {
-    "ordinal": 7, "commit": "edf85f3a0", "kind": "PRODUCTION_CONTEXT_COMPLETION",
+    "ordinal": 7, "commit": "edf85f3a0", "commit_full": CHECKPOINT_A_DOUBLE_PRIME_COMMIT,
+    "tree": CHECKPOINT_A_DOUBLE_PRIME_TREE, "kind": "PRODUCTION_CONTEXT_COMPLETION",
     "summary": ("v15 production-context completion: the reconciliation sub-protocol context follows the "
                 "checked-execution boundary decision (d011_manifest emission/validation + d011_execution "
                 "request builders gate-check lineage, default TEST_ONLY, accept PRODUCTION_EXTERNAL). New "
@@ -225,11 +244,33 @@ V15_COMPLETION_CHANGE = {
     "engines": "UNTOUCHED",
 }
 
-#: The full source-change history: five fixes, the adapter (sixth) and the
-#: production-context completion (seventh).
-SOURCE_CHANGES = tuple(ENGINE_FIXES) + (V15_ADAPTER_CHANGE, V15_COMPLETION_CHANGE)
+#: The eighth source change: the owner-authorized oracle effect_flow engine fix.
+V15_ORACLE_FIX_CHANGE = {
+    "ordinal": 8, "commit": "0a22837e4", "commit_full": CHECKPOINT_A_TRIPLE_PRIME_COMMIT,
+    "tree": CHECKPOINT_A_TRIPLE_PRIME_TREE, "kind": "ORACLE_EFFECT_FLOW_GATE_FIX",
+    "engine": "ORACLE",
+    "summary": ("v15 oracle effect_flow gate fix (owner-authorized): the union-of-shapes key gate "
+                "required all ten EFFECT+FLOW keys on every event, which denied every legitimate "
+                "per-action effect_flow event and contradicted the oracle module's own flow_keys "
+                "prelude (failing corpus case CASE-MINIMAL_MEDIATION_CORE-EFFECT_F). The new gate "
+                "mirrors the primary's per-action type guards exactly, wrapped fail-closed for engine "
+                "totality (M3.5 fuzz-gate law). Validated 114/114 corpus role agreement and 380/380 "
+                "totality probes (raise-free, both engines). Pins updated (oracle sha 37418055..., "
+                "oid 92ce92cc..., ast 34d9a777...); the boundary manifest is regenerated through the "
+                "pure generation path. TEST_ONLY discipline unchanged; the primary engine is untouched."),
+    "corpus_role_agreement": "114/114",
+    "totality_probes": "380/380",
+    "test_only_discipline": "UNCHANGED",
+    "engines": "ORACLE_CHANGED_PRIMARY_UNTOUCHED",
+}
+
+#: The full source-change history: five fixes, the adapter (sixth), the
+#: production-context completion (seventh) and the oracle effect_flow gate fix
+#: (eighth).
+SOURCE_CHANGES = tuple(ENGINE_FIXES) + (V15_ADAPTER_CHANGE, V15_COMPLETION_CHANGE,
+                                        V15_ORACLE_FIX_CHANGE)
 
-#: Test gates green at checkpoint A' (recorded; carried from the v14 freeze).
+#: Test gates green at checkpoint A''' (recorded; carried from the v14 freeze).
 GATES_GREEN = {"rehearsal": 27, "pilot": 39, "basisb": 10, "producers": 12,
                "execution": 24, "domain_fast": 31}
 
@@ -274,14 +315,15 @@ def _ceremony_owned_paths():
         SUPERSESSION_DOC_PATH, CEREMONY_DIR + "/test_d011_stage_b_v15.py"}
 
 
-def checkpoint_a_double_prime():
-    """Recompute checkpoint A'' from git and assert the recorded identity.
+def checkpoint_a_triple_prime():
+    """Recompute checkpoint A''' from git and assert the recorded identity.
 
-    A'' is the *completed v15 source* commit: ``git rev-parse HEAD`` at build
-    time (edf85f3a0 / ca232cfe).  The earlier adapter checkpoint A' lives only
-    inside the source-change history (ordinal 6).
+    A''' is the *post-oracle-fix v15 source* commit: ``git rev-parse HEAD`` at
+    build time (0a22837e4 / 2b7eb813).  The earlier completion checkpoint A''
+    and adapter checkpoint A' live only inside the source-change history
+    (ordinals 7 and 6).
 
-    The completed-source identity is verified through git (no unverified
+    The post-oracle-fix source identity is verified through git (no unverified
     hardcoding): the recorded commit is resolved and its tree asserted.  Committing
     this ceremony advances HEAD; that is tolerated only when HEAD is a descendant
     of the checkpoint whose entire change set since the checkpoint is the
@@ -291,21 +333,21 @@ def checkpoint_a_double_prime():
     head_commit = _git("rev-parse", "HEAD")
     head_tree = _git("rev-parse", "HEAD^{tree}")
     # the recorded checkpoint resolves through git to the recorded commit + tree
-    assert _git("rev-parse", CHECKPOINT_A_DOUBLE_PRIME_COMMIT) == \
-        CHECKPOINT_A_DOUBLE_PRIME_COMMIT
-    assert _git("rev-parse", CHECKPOINT_A_DOUBLE_PRIME_COMMIT + "^{tree}") == \
-        CHECKPOINT_A_DOUBLE_PRIME_TREE
-    if (head_commit, head_tree) != (CHECKPOINT_A_DOUBLE_PRIME_COMMIT,
-                                    CHECKPOINT_A_DOUBLE_PRIME_TREE):
+    assert _git("rev-parse", CHECKPOINT_A_TRIPLE_PRIME_COMMIT) == \
+        CHECKPOINT_A_TRIPLE_PRIME_COMMIT
+    assert _git("rev-parse", CHECKPOINT_A_TRIPLE_PRIME_COMMIT + "^{tree}") == \
+        CHECKPOINT_A_TRIPLE_PRIME_TREE
+    if (head_commit, head_tree) != (CHECKPOINT_A_TRIPLE_PRIME_COMMIT,
+                                    CHECKPOINT_A_TRIPLE_PRIME_TREE):
         # HEAD moved past the checkpoint: only this ceremony's own commit is allowed.
-        _git("merge-base", "--is-ancestor", CHECKPOINT_A_DOUBLE_PRIME_COMMIT, head_commit)
-        changed = set(_git("diff", "--name-only", CHECKPOINT_A_DOUBLE_PRIME_COMMIT,
+        _git("merge-base", "--is-ancestor", CHECKPOINT_A_TRIPLE_PRIME_COMMIT, head_commit)
+        changed = set(_git("diff", "--name-only", CHECKPOINT_A_TRIPLE_PRIME_COMMIT,
                            head_commit).splitlines())
         owned = _ceremony_owned_paths()
-        assert changed <= owned, ("source advanced past checkpoint A'': "
+        assert changed <= owned, ("source advanced past checkpoint A''': "
                                   + repr(sorted(changed - owned)))
-    return {"commit": CHECKPOINT_A_DOUBLE_PRIME_COMMIT,
-            "tree": CHECKPOINT_A_DOUBLE_PRIME_TREE}
+    return {"commit": CHECKPOINT_A_TRIPLE_PRIME_COMMIT,
+            "tree": CHECKPOINT_A_TRIPLE_PRIME_TREE}
 
 
 def _read_source_map():
@@ -356,6 +398,16 @@ def _execution_module_identity(root):
     return row
 
 
+def _oracle_module_identity(root):
+    """The oracle engine module (``d011_oracle.py``), changed by the gate fix."""
+    raw = (pathlib.Path(root) / ORACLE_MODULE_PATH).read_bytes()
+    row = {"path": ORACLE_MODULE_PATH, "bytes": len(raw),
+           "sha256": hashlib.sha256(raw).hexdigest(), "review": "V15_ORACLE_FIX_CHANGED"}
+    assert row["sha256"] == ORACLE_MODULE_SHA256, row["sha256"]
+    assert row["bytes"] == ORACLE_MODULE_BYTES, row["bytes"]
+    return row
+
+
 def _boundary_manifest_identity(root):
     raw = (pathlib.Path(root) / BOUNDARY_MANIFEST_PATH).read_bytes()
     row = {"path": BOUNDARY_MANIFEST_PATH, "bytes": len(raw),
@@ -379,9 +431,10 @@ def _engine_pins():
 
 
 def _module_identities(root):
-    """Eight rows: the six reviewed modules (unchanged) + the two changed v15 modules."""
+    """Nine rows: the six reviewed modules (unchanged) + the three changed v15 modules."""
     return (_reviewed_module_identities(root)
-            + [_manifest_module_identity(root), _execution_module_identity(root)])
+            + [_manifest_module_identity(root), _execution_module_identity(root),
+               _oracle_module_identity(root)])
 
 
 # --------------------------------------------------------------------------- #
@@ -394,11 +447,12 @@ def _candidate_declarations(root):
             "modules": _reviewed_module_identities(root),
             "manifest_module": _manifest_module_identity(root),
             "execution_module": _execution_module_identity(root),
+            "oracle_module": _oracle_module_identity(root),
             "source_map_sha256": _read_source_map_sha256(),
             "boundary_manifest": _boundary_manifest_identity(root),
             "engine_pins": _engine_pins(),
             "source_changes": list(SOURCE_CHANGES),
-            "checkpoint_a_double_prime": checkpoint_a_double_prime()}
+            "checkpoint_a_triple_prime": checkpoint_a_triple_prime()}
 
 
 def _role_record(role, candidate_digest, lock_root, freeze_contract_root, review_refs):
@@ -449,12 +503,15 @@ def _supersession_document(root, prefreeze, activated, *, aggregate_sha256, lock
         "schema": "D011-SUPERSESSION-V15-1",
         "status_note": (
             "This supersession record documents the v15 Stage B ceremony as structurally complete "
-            "(TEST_ONLY) against the completed v15 source (checkpoint A'' = edf85f3a0). D-011 remains "
+            "(TEST_ONLY) against the post-oracle-fix v15 source (checkpoint A''' = 0a22837e4, the "
+            "owner-authorized oracle effect_flow gate fix). D-011 remains "
             "OPEN/UNQUALIFIED/INACTIVE. No production evidence, qualification, selection, key custody, "
             "or natural-person identity is claimed. The v15 production checked-execution adapter admits "
             "PRODUCTION_EXTERNAL only via consulted adapter + owner-authorization records; the "
             "production-context completion makes the reconciliation sub-protocol follow the boundary "
-            "decision and adds frozen deterministic placement/BFS builders. A source-derived placement "
+            "decision and adds frozen deterministic placement/BFS builders. The oracle effect_flow gate "
+            "fix mirrors the primary's per-action type guards, wrapped fail-closed for engine totality. "
+            "A source-derived placement "
             "discriminant (unique strict-subset profile TRUSTED_RUNTIME from the declared law) is a "
             "PREDICTION, not evidence; no winner is claimed. The production ceremony with real external "
             "keys is the G6/G7 owner gate (M5)."),
@@ -479,8 +536,8 @@ def _supersession_document(root, prefreeze, activated, *, aggregate_sha256, lock
                             "superseded v14 lineage; v15 supersedes the contract, not the history."},
         },
         "v15_stage_b": {
-            "checkpoint_a_double_prime_commit": CHECKPOINT_A_DOUBLE_PRIME_COMMIT,
-            "checkpoint_a_double_prime_tree": CHECKPOINT_A_DOUBLE_PRIME_TREE,
+            "checkpoint_a_triple_prime_commit": CHECKPOINT_A_TRIPLE_PRIME_COMMIT,
+            "checkpoint_a_triple_prime_tree": CHECKPOINT_A_TRIPLE_PRIME_TREE,
             "checkpoint_b_commit": None,
             "source_map_sha256": SOURCE_MAP_SHA256_V15,
             "module_identities": {
@@ -490,6 +547,8 @@ def _supersession_document(root, prefreeze, activated, *, aggregate_sha256, lock
                                     "sha256": MANIFEST_MODULE_SHA256},
                 "execution_module": {"path": EXECUTION_MODULE_PATH, "bytes": EXECUTION_MODULE_BYTES,
                                      "sha256": EXECUTION_MODULE_SHA256},
+                "oracle_module": {"path": ORACLE_MODULE_PATH, "bytes": ORACLE_MODULE_BYTES,
+                                  "sha256": ORACLE_MODULE_SHA256},
             },
             "boundary_manifest": {"path": BOUNDARY_MANIFEST_PATH, "bytes": BOUNDARY_MANIFEST_BYTES,
                                   "sha256": BOUNDARY_MANIFEST_SHA256},
@@ -518,10 +577,11 @@ def build_stage_b_ceremony_v15(root, objects_root):
     declarations = _candidate_declarations(root)
     candidate_digest = m.sha_obj(declarations)
     source_map_sha256 = SOURCE_MAP_SHA256_V15  # asserted inside declarations
-    checkpoint = checkpoint_a_double_prime()
+    checkpoint = checkpoint_a_triple_prime()
     boundary_manifest = _boundary_manifest_identity(root)
     manifest_module = _manifest_module_identity(root)
     execution_module = _execution_module_identity(root)
+    oracle_module = _oracle_module_identity(root)
 
     # --- the two PREFREEZE reviews ---------------------------------------- #
     semantic = {
@@ -531,7 +591,7 @@ def build_stage_b_ceremony_v15(root, objects_root):
         "input_index": 1, "subject": "M4_STAGE_B_IMPLEMENTATION_V15",
         "verdict": "REVIEWED_PASS_WITH_FINDINGS",
         "reviewed_modules": declarations["modules"], "manifest_module": manifest_module,
-        "execution_module": execution_module,
+        "execution_module": execution_module, "oracle_module": oracle_module,
         "source_changes": list(SOURCE_CHANGES),
         "rehearsal": {"segment_table_size": 15,
                       "runtime_families": ["CAPABILITY_MICROKERNEL", "MINIMAL_MEDIATION_CORE",
@@ -542,7 +602,7 @@ def build_stage_b_ceremony_v15(root, objects_root):
                       "basis_b_reconciliation": "EXACT"},
         "gates_green": dict(GATES_GREEN),
         "implementation_closure_review": "PASS_WITH_FINDINGS",
-        "checkpoint_a_double_prime": checkpoint,
+        "checkpoint_a_triple_prime": checkpoint,
         "adapter": {"boundary_policy": "ADMITS_PRODUCTION_EXTERNAL_VIA_CONSULTED_ADAPTER_AND_OWNER_AUTHORIZATION",
                     "invocation_binding": "FOLLOWS_BOUNDARY_DECISION",
                     "mutation_pair_child_lineage": "FOLLOWS_CONTEXT",
@@ -578,7 +638,7 @@ def build_stage_b_ceremony_v15(root, objects_root):
         "verdict": "REVIEWED_PASS_WITH_FINDINGS",
         "source_map": _read_source_map(), "source_map_sha256": source_map_sha256,
         "reviewed_modules": declarations["modules"], "manifest_module": manifest_module,
-        "execution_module": execution_module,
+        "execution_module": execution_module, "oracle_module": oracle_module,
         "source_changes": list(SOURCE_CHANGES),
         "engine_pins": _engine_pins(),
         "anchor_preservation": {"family": "_AST_FAULTS", "expected": 11, "preserved": 11,
@@ -592,7 +652,7 @@ def build_stage_b_ceremony_v15(root, objects_root):
         "boundary_manifest": boundary_manifest,
         "adapter_change": V15_ADAPTER_CHANGE,
         "completion_change": V15_COMPLETION_CHANGE,
-        "checkpoint_a_double_prime": checkpoint,
+        "checkpoint_a_triple_prime": checkpoint,
         "prediction": {"kind": "SOURCE_DERIVED_PREDICTION_NOT_EVIDENCE",
                        "claim": "STRICT_SUBSET_PLACEMENT_DISCRIMINANT_TRUSTED_RUNTIME",
                        "basis": "DECLARED_LAW", "winner_claimed_at_freeze": 0},
@@ -632,8 +692,9 @@ def build_stage_b_ceremony_v15(root, objects_root):
                          "candidate_digest": candidate_digest, "aggregate_sha256": aggregate_sha256,
                          "source_map_sha256": source_map_sha256, "engine_pins": _engine_pins(),
                          "manifest_module": manifest_module, "execution_module": execution_module,
+                         "oracle_module": oracle_module,
                          "boundary_manifest": boundary_manifest,
-                         "checkpoint_a_double_prime": checkpoint,
+                         "checkpoint_a_triple_prime": checkpoint,
                          "governed_scope": list(SIX_MODULE_PATHS)}}
     lock_bytes = m.canonical(lock)
     lock_root = m.sha_bytes(lock_bytes)
@@ -672,9 +733,10 @@ def build_stage_b_ceremony_v15(root, objects_root):
                             "sha256": aggregate_sha256, "length": len(aggregate_bytes)},
               "lock": {"id": "LOCK-V15", "path": LOCK_PATH, "sha256": lock_root,
                        "length": len(lock_bytes)},
-              "role_refs": role_refs, "checkpoint_a_double_prime": checkpoint,
+              "role_refs": role_refs, "checkpoint_a_triple_prime": checkpoint,
               "engine_pins": _engine_pins(), "source_map_sha256": source_map_sha256,
               "manifest_module": manifest_module, "execution_module": execution_module,
+              "oracle_module": oracle_module,
               "boundary_manifest": boundary_manifest,
               "authorization": "C0_H0_ONLY",
               "decision_status": "OPEN", "qualification": "UNQUALIFIED", "active": 0,
@@ -724,8 +786,8 @@ def build_stage_b_ceremony_v15(root, objects_root):
     bundle = A.make_raw_bundle(seal, ordered_raw_refs)
     state = A.to_raw_bundle(state, bundle)
     seal_chain["RAW_BUNDLE"] = state.bundle_sha256
-    gates = A.make_raw_signature_gates(bundle, signer, CHECKPOINT_A_DOUBLE_PRIME_COMMIT,
-                                       CHECKPOINT_A_DOUBLE_PRIME_TREE)
+    gates = A.make_raw_signature_gates(bundle, signer, CHECKPOINT_A_TRIPLE_PRIME_COMMIT,
+                                       CHECKPOINT_A_TRIPLE_PRIME_TREE)
     state = A.to_raw_signature_gates(state, gates)
     seal_chain["RAW_SIGNATURE_GIT_GATES"] = state.signature_sha256
     qualification = A.make_semantic_qualification(gates, "SEMANTIC_REVIEWER")
@@ -784,7 +846,7 @@ def build_stage_b_ceremony_v15(root, objects_root):
         "activated": activated, "activated_objects": str(activated_objects),
         "supersession_document": supersession_document,
         "supersession_document_bytes": supersession_document_bytes,
-        "checkpoint_a_double_prime": checkpoint,
+        "checkpoint_a_triple_prime": checkpoint,
     }
 
 
@@ -844,6 +906,10 @@ class StageBFCeremonyV15Tests(unittest.TestCase):
                              EXECUTION_MODULE_SHA256)
             self.assertEqual(built["declarations"]["execution_module"]["bytes"],
                              EXECUTION_MODULE_BYTES)
+            self.assertEqual(built["declarations"]["oracle_module"]["sha256"],
+                             ORACLE_MODULE_SHA256)
+            self.assertEqual(built["declarations"]["oracle_module"]["bytes"],
+                             ORACLE_MODULE_BYTES)
 
             # (3a) PREFREEZE validates (absence)
             pre = B.validate_phase(built["prefreeze"], built["prefreeze_objects"])
@@ -865,10 +931,10 @@ class StageBFCeremonyV15Tests(unittest.TestCase):
                              (B.PHASE_PREFREEZE, B.PHASE_ACTIVATED))
             self.assertEqual(transition["prior_phase_context_sha256"], built["prefreeze"].sha256())
 
-            # checkpoint A'' binds the completed v15 source
-            self.assertEqual(built["checkpoint_a_double_prime"],
-                             {"commit": CHECKPOINT_A_DOUBLE_PRIME_COMMIT,
-                              "tree": CHECKPOINT_A_DOUBLE_PRIME_TREE})
+            # checkpoint A''' binds the post-oracle-fix v15 source
+            self.assertEqual(built["checkpoint_a_triple_prime"],
+                             {"commit": CHECKPOINT_A_TRIPLE_PRIME_COMMIT,
+                              "tree": CHECKPOINT_A_TRIPLE_PRIME_TREE})
 
             # decision status stays OPEN / UNQUALIFIED / INACTIVE at freeze
             freeze_payload = m.parse_bytes(materialized[FREEZE_PATH])
@@ -924,8 +990,9 @@ class StageBFCeremonyV15Tests(unittest.TestCase):
         self.assertEqual(built["declarations"]["boundary_manifest"]["bytes"],
                          BOUNDARY_MANIFEST_BYTES)
         # source-change history: five engine fixes + adapter (6th) + completion (7th)
+        #   + oracle effect_flow gate fix (8th)
         changes = built["declarations"]["source_changes"]
-        self.assertEqual(len(changes), 7)
+        self.assertEqual(len(changes), 8)
         self.assertEqual(changes[5]["commit"], "90ab0b041")
         self.assertEqual(changes[5]["kind"], "PRODUCTION_EXECUTION_ADAPTER")
         self.assertEqual(changes[5]["admits"], "PRODUCTION_EXTERNAL")
@@ -934,10 +1001,18 @@ class StageBFCeremonyV15Tests(unittest.TestCase):
         self.assertEqual(changes[6]["reconciliation_sub_protocol"], "FOLLOWS_BOUNDARY_DECISION")
         self.assertEqual(changes[6]["placement_builder"]["cells"], 1392)
         self.assertEqual(changes[6]["bfs_builder"]["reports"], 21)
-        # checkpoint A'' is the completed v15 source (HEAD), recomputed from git
-        self.assertEqual(built["checkpoint_a_double_prime"],
-                         {"commit": CHECKPOINT_A_DOUBLE_PRIME_COMMIT,
-                          "tree": CHECKPOINT_A_DOUBLE_PRIME_TREE})
+        self.assertEqual(changes[7]["commit"], "0a22837e4")
+        self.assertEqual(changes[7]["kind"], "ORACLE_EFFECT_FLOW_GATE_FIX")
+        self.assertEqual(changes[7]["engine"], "ORACLE")
+        self.assertEqual(changes[7]["corpus_role_agreement"], "114/114")
+        self.assertEqual(changes[7]["totality_probes"], "380/380")
+        # the oracle module is bound as a changed candidate module, identical to the pin
+        self.assertEqual(built["declarations"]["oracle_module"]["sha256"],
+                         ORACLE_ENGINE_SHA256)
+        # checkpoint A''' is the post-oracle-fix v15 source (HEAD), recomputed from git
+        self.assertEqual(built["checkpoint_a_triple_prime"],
+                         {"commit": CHECKPOINT_A_TRIPLE_PRIME_COMMIT,
+                          "tree": CHECKPOINT_A_TRIPLE_PRIME_TREE})
 
 
 if __name__ == "__main__":