converge(FREEZE): operator-surface.v1 FROZEN — owner-ratified true-up #2 (RC-1/2/3), Freeze 8 record, FROZEN stamp; OSV1 re-review

[Brian Krabach (bkrabach)]

The lock. contracts/operator-surface.v1.md moves DRAFT → FROZEN. From this merge on it changes only by a sibling proposal (operator-surface.v2-candidate.md) with evidence; hooks-candidate-guard refuses in-place edits.

Owner's words (Changelog, verbatim): "Ok, do the freeze" (Freeze 10 intent) · "looked, ratify." (Freeze 8 — looked at L0/L1/L2 at 430/900/1280 in both themes, the 18 pinned-browser captures from main @ d039b32; and ratification of the external review's three pre-lock fixes).

Freeze 9 — external review (independent session, not the author): verdict REQUEST CHANGES → approve once landed. Record: .amplifier/converge/operator-surface-freeze9-review.md (workspace). The three fixes, now in:

• RC-1 Core 5 — "No GET route mutates state" was false (GET /auth/logout clears a cookie). Reworded to what reads.never_write asserts, naming the one exception. Measurement unchanged: 30 routes, 22 read-only, 0 reaching a mutating adapter call.
• RC-2 Conformance 1/3/4 — bad halves reworded to the defects actually measured (hue outside the token set; disclosure + live-region node identity; element-level overflow past clientWidth — the reading that catches what overflow-x: clip hides).
• RC-3 Core 12/13 — review cadences gain a standing trigger "at each ledger/reconcile-report.md re-check" (the old ones expired at this very stamp).

Six lower findings deferred to post-lock proposals.

Ledger re-review (SYNC hash changed): OSV1-000 f409…3edb → a467…4c52; custody hash unchanged. All 35 quote-carrying rows re-tested against old and new text: 1 re-anchored (OSV1-007); 5 notes trued up. OSV1-034 (Freeze 8) GAP → CONFORMS — probe now asserts a dated record naming L0/L1/L2, 430/900/1280, both themes (each enumerated; partial records fail), honest-limit docstring kept ("asserts a record, never that the owner looked"). No rows invented for Freeze 9/10. Tally → 33 CONFORMS / 3 NOT-ASSERTABLE / 0 GAP / 0 VIOLATION.

Gates: pytest ledger/checks 60 · make ledger-mutate 69/69 · Tier-A 41 passed / 1 xfailed · ruff clean · Status:** FROZEN ×1. No src/ change (Tier-B recording still describes this tree — stated as an inference from the empty diff, not a fresh run).

🤖 Generated with Amplifier