GAM 7.48.00 (automated bump)

CLAUDE.md

@@ -18,8 +18,8 @@ Each of these exists because something went wrong. Several have tests guarding t
 2. **Every mutation goes through the chokepoint**: `GAMCommands` builder → `ChangePreview` →
    `guard.evaluate()` → connector `_run_write(...)`, which is serialized and appended to the audit
    log. There is no second write path. Don't add one.
-3. **Only read-only commands may become runnable automatically.** Of 1070 catalog entries, 535 run:
-   26 hand-curated (the only ones that can *change* anything) plus 509 grammar-derived commands
+3. **Only read-only commands may become runnable automatically.** Of 1075 catalog entries, 538 run:
+   26 hand-curated (the only ones that can *change* anything) plus 512 grammar-derived commands
    auto-promoted by `core/catalog/readbuilder.py` **because they are confidently `READ_ONLY` and not
    flagged uncertain**. Everything else is inert, syntax display only. Adding write coverage is a
    deliberate act of curation. (Two agent-facing docs once claimed only the 26 curated commands run —
@@ -106,7 +106,7 @@ make gam TAG=vX.Y.Z                 # re-vendor GAM (fails closed on an unpinned
 make app                            # build dist/GamGUI.app
 ```
 
-GAM is pinned at `EXPECTED_GAM_VERSION` in `core/gam/commands.py` (currently 7.47.02); three drift
+GAM is pinned at `EXPECTED_GAM_VERSION` in `core/gam/commands.py` (currently 7.48.00); three drift
 guards (`test_command_contract`, `test_catalog_matches_grammar`, `test_pinned_version_consistent`)
 fail if a bump breaks a command we use. The bump runbook is in the README — step 1 **fails by
 design**.

gamgui/core/gam/commands.py

@@ -21,7 +21,7 @@
 # `scripts/fetch_gam.sh` (TAG), the mock, and the version tests must all match this; that's enforced by
 # tests/test_command_contract.py so they can't drift. Bump deliberately via the "Updating GAM" runbook.
 # Compared (as a substring) against the running `gam version` for the fail-soft runtime self-check.
-EXPECTED_GAM_VERSION = "7.47.02"
+EXPECTED_GAM_VERSION = "7.48.00"
 
 # Roles accepted by Google Directory for group membership.
 GROUP_ROLES = ("member", "manager", "owner")

gamgui/resources/gam7/VERSION

@@ -1 +1 @@
-v7.47.02
+v7.48.00

scripts/fetch_gam.sh

@@ -13,7 +13,7 @@ REPO="GAM-team/GAM"
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 DEST="$ROOT/gamgui/resources/gam7"
 # Pinned for reproducible builds. Override with `--tag latest` to grab the newest release.
-TAG="v7.47.02"
+TAG="v7.48.00"
 # Installing an asset we have no pinned hash for is opt-in: see the checksum gate below.
 ALLOW_UNPINNED=0
 

scripts/gam_checksums.txt

@@ -3,4 +3,4 @@
 # install on mismatch (catches a tampered / MITM'd / unexpected binary). Tracked in git so the pin
 # is reviewable. Update DELIBERATELY when bumping EXPECTED_GAM_VERSION (record the new asset's hash).
 # Format: <sha256>  <asset-filename>
-9313e0a66a0a54bafd2c1b0b76298c7e546271c088c50157ca8b1fedc5fb1d4f  gam-7.47.02-macos26.5-arm64.tar.xz
+9ec8778579675400e5892285580cc683f9eff606100524d5046f719d45075ef9  gam-7.48.00-macos26.5-arm64.tar.xz

tests/fixtures/mock_gam.sh

@@ -11,7 +11,7 @@ set -eu
 
 case "${1:-}" in
   version)
-    echo "GAM 7.47.02 - mock"
+    echo "GAM 7.48.00 - mock"
     exit 0
     ;;
   MOCKFAIL)