From e71f7c2504a6e045d48b87d2ca2d6125ab989fdd Mon Sep 17 00:00:00 2001
From: Amplifier <240397093+microsoft-amplifier@users.noreply.github.com>
Date: Sat, 5 Sep 2026 21:17:39 -0700
Subject: [PATCH] =?UTF-8?q?converge(FREEZE):=20operator-surface.v1=20FROZE?=
 =?UTF-8?q?N=20=E2=80=94=20owner-ratified=20true-up=20#2=20(RC-1/2/3),=20F?=
 =?UTF-8?q?reeze=208=20record,=20FROZEN=20stamp;=20OSV1=20SYNC=20rehash=20?=
 =?UTF-8?q?+=20full=20re-review?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 contracts/operator-surface.v1.md    |  21 +-
 ledger/checks/mutation_harness.py   |  31 ++-
 ledger/checks/test_operator_rows.py |  68 +++++-
 ledger/reconcile-report.md          | 361 ++++++++++++++++++++++++++--
 ledger/rows.yaml                    | 216 +++++++++++++++--
 5 files changed, 635 insertions(+), 62 deletions(-)

diff --git a/contracts/operator-surface.v1.md b/contracts/operator-surface.v1.md
index 401e8f8..9a931ba 100644
--- a/contracts/operator-surface.v1.md
+++ b/contracts/operator-surface.v1.md
@@ -1,6 +1,6 @@
 # Operator Surface Contract — v1
 
-**Status:** DRAFT
+**Status:** FROZEN
 
 **Scope:** This contract governs the operator surface of amplifier-work-tracker: the human web surface one operator watches — L0 Mission Control (`GET /`), L1 Project Observatory (`GET /projects/{name}`), L2 Item Detail (`GET /projects/{name}/items/{id}`), the login, `/setup` and `/trust` onboarding pages, and the PWA shell. Its consumer is a human outside this repo's own commits; a silent change breaks trained perception, and that dependence is what makes it a seam. *(Brief A §1, webapp.py:4551, webbrowse.py:287, webbrowse.py:611; Brief B §8)*
 
@@ -64,9 +64,9 @@ Literal colour, font, or size in an inline `style=` attribute, or in a `<style>`
 
 ### Core 5: Reads never write
 
-No `GET` route mutates state. The surface may poll itself aggressively; it writes only through explicit operator actions, which are `POST`.
+No `GET` handler reaches a mutating adapter call; the surface may poll itself aggressively and writes work-tracker state only through explicit operator actions, which are `POST`. The one named exception: `GET /auth/logout` clears the session cookie.
 
-**Machine check:** `reads.never_write` — a route audit over every registered handler: no `GET` handler reaches a mutating adapter call.
+**Machine check:** `reads.never_write` — a route audit over every registered handler, asserting the clause's first sentence against each read-only one.
 
 **Tier:** A
 
@@ -154,7 +154,7 @@ A page's leading content is what the operator came to see, not a form to fill in
 
 **Tier:** NOT-ASSERTABLE
 
-**Reviewed at cadence:** owner review of L0/L1/L2 at each ENCODE gate and before any Freeze stamp.
+**Reviewed at cadence:** owner review of L0/L1/L2 at each ENCODE gate and before any Freeze stamp, and at each `ledger/reconcile-report.md` re-check.
 
 *(Brief B §5, wt-v4-observatory/BRIEF.md:82-88)*
 
@@ -168,7 +168,7 @@ The surface exists so the time between an alarm appearing and the operator ackno
 
 **Tier:** NOT-ASSERTABLE
 
-**Reviewed at cadence:** owner review at each ENCODE gate; promoted by Backlogged 6.
+**Reviewed at cadence:** owner review at each ENCODE gate and at each `ledger/reconcile-report.md` re-check; promoted by Backlogged 6.
 
 *(Brief B §6, wt-v2-poa.md:242-244, wt-v4-observatory/BRIEF.md:109-118)*
 
@@ -254,7 +254,7 @@ Tier-A-checkable Core clauses: 1, 3, 4, 5, 8, 9, 10, 11, and the token half of 2
 
 **Good:** the sweep reports zero pixels matching `--alarm` or `--blocked`.
 
-**Bad:** the same page with the retired-palette region reinstated — a hardcoded amber outside the token set — is reported as alarm-coloured pixels on a calm page.
+**Bad:** the same page with the retired-palette region reinstated — a hardcoded amber outside the token set — is reported as pixels of a hue outside the token set on a calm page: `#D9A253` is far enough from `--alarm` that the sweep counts it in its own bucket rather than as alarm colour.
 
 **Test location:** `tests/conformance/operator_surface/browser/test_tier_b.py` (Core 2).
 
@@ -278,7 +278,7 @@ Tier-A-checkable Core clauses: 1, 3, 4, 5, 8, 9, 10, 11, and the token half of 2
 
 **Good:** the post-swap DOM snapshot preserves scroll offset, the open disclosure, and the pause flag, and the live region survives to announce.
 
-**Bad:** a whole-body innerHTML replacement that recreates the region loses all four; the snapshot shows offset zero, the disclosure closed, the pause flag cleared, and a fresh live region with nothing announced.
+**Bad:** a whole-body innerHTML replacement that recreates the region — the open disclosure closes and every tagged live region is replaced by a fresh node (chromium preserves scroll and the pause flag by itself; a reflowing replacement loses scroll too).
 
 **Test location:** `tests/conformance/operator_surface/browser/test_tier_b.py` (Core 6).
 
@@ -288,9 +288,9 @@ Tier-A-checkable Core clauses: 1, 3, 4, 5, 8, 9, 10, 11, and the token half of 2
 
 **Scenario:** L0, L1, and L2 loaded at each viewport in both themes.
 
-**Good:** `scrollWidth == clientWidth` at every viewport, every interactive target measures at least 44px, and computed text contrast is at least 4.5:1.
+**Good:** no element's border box extends past `clientWidth` at any viewport, every interactive target measures at least 44px, and computed text contrast is at least 4.5:1.
 
-**Bad:** a fixture with a fixed-width element wider than 430px emits `scrollWidth > clientWidth`; a fixture using the recorded 4.27:1 ink pair emits a contrast number below the floor.
+**Bad:** in a fixture with a fixed-width element wider than 430px, that element extends past `clientWidth`; a fixture using the recorded 4.27:1 ink pair emits a contrast number below the floor.
 
 **Test location:** `tests/conformance/operator_surface/browser/test_tier_b.py` (Core 7).
 
@@ -378,6 +378,9 @@ Before this contract moves from DRAFT to FROZEN, all of the following conditions
 
 ## Changelog
 
+- **2026-09-05 — FROZEN.** Owner ratification and signature (Freeze 10): owner's literal words "Ok, do the freeze" and "looked, ratify." Status moves DRAFT → FROZEN. From this entry on, this file changes only by a sibling proposal (`operator-surface.v2-candidate.md`) carrying the target line, the exact change, real evidence, and what does not change; `hooks-candidate-guard` refuses in-place edits.
+- **2026-09-05 — Freeze 8 record (ratification input, never a machine check):** the owner looked at the rendered L0 (Mission Control), L1 (Project Observatory) and L2 (Item Detail) at 430, 900 and 1280px in both themes — the eighteen captures from the pinned-browser run (chromium 148.0.7778.0 / playwright 1.60.0) on main @ d039b32 — and said "looked".
+- **2026-09-05 — DRAFT true-up #2, owner-ratified ("ratify."):** the three pre-lock fixes from the Freeze 9 external review (independent reviewer, not the author; verdict REQUEST CHANGES → approve once landed): RC-1 Core 5 reworded to what `reads.never_write` asserts, naming `GET /auth/logout`'s cookie clear as the one exception; RC-2 Conformance 1/3/4 halves reworded to the measured defects (hue outside the token set; disclosure + live-region node identity; element-level overflow past `clientWidth`); RC-3 Core 12/13 cadences gain a standing trigger at each reconcile re-check. Six lower findings deferred to post-lock proposals.
 - **2026-09-04 — DRAFT true-up #1,** owner-ratified ("yep, do it all."): Core 4 widened to reach per-page `<style>` blocks outside the token module (evidence: `webtrust.py`'s hardcoded retired palette); Core 10's machine-check wording aligned to the clause ("does not survive a refresh"); the Changelog's `webapp.py:38-39` quotation made byte-exact (Freeze 7). Status remains DRAFT.
 - **2026-09-04 — ENCODE gate:** owner reviewed the DRAFT text and ratified it (literal: "lgtm."). Status remains DRAFT.
 - **2026-09-04 — DRAFT.** First draft, authored at the ENCODE gate from Phase-0 evidence (Brief A, shipped surface; Brief B, prior decisions), nine owner-ratified decisions, and four conformance rulings. Owner ratification, literal: *"Let's make hero the velocity, along w/ other numbers that matter, such as the active/in-flight, blocked, need attention, open, etc. Focus is on observability, etc. The rest looks good to me."* That overrode a recorded invariant — *"the dashboard's hero is the AGE of the oldest unclaimed item, never a count"*, rationale *"a giant `0` trains a viewer to stop looking. An age reads as neglect"* (`webapp.py:37-44`). The owner weighed that alternative and chose observability, so Core 1 asserts velocity with the counts that matter; the concern behind the alternative survives in the form the owner accepted, as Core 8. Settled by ruling: a human-perception seam is admissible, so every clause admitting a machine check carries one and the two that cannot are named NOT-ASSERTABLE; no ceiling constant enters Core, the exemption register living in `ledger/` (Core 4, Backlogged 2); the custody boundary is a one-way citation, leaving `contracts/custody-coordination.v1.md` untouched; CLI `--json` is Reserved 1, a different seam being a different contract.
diff --git a/ledger/checks/mutation_harness.py b/ledger/checks/mutation_harness.py
index bfaa5cf..269003f 100644
--- a/ledger/checks/mutation_harness.py
+++ b/ledger/checks/mutation_harness.py
@@ -1083,13 +1083,27 @@ def _mo033_the_emphasis_comes_back(w: World) -> None:
     )
 
 
-def _mo034_the_changelog_records_a_look(w: World) -> None:
-    """FIXED: a Changelog entry records the owner's rendered-page look."""
-    w.append(
-        OPERATOR_CONTRACT_PATH,
-        "\n- **2026-09-05 — owner looked at the rendered L0, L1 and L2 at 430, 900 and "
-        "1280px in both themes.**\n",
+def _mo034_the_changelog_record_is_removed(w: World) -> None:
+    """REGRESSION (2026-09-05: the owner looked and the FROZEN stamp recorded
+    it, so this row flipped GAP -> CONFORMS and its probe was retargeted from
+    the pin; the mutation it replaces, `_mo034_the_changelog_records_a_look`,
+    pushed the OPPOSITE direction -- git-blame).
+
+    The Freeze 8 record is deleted from a locked Changelog. It is the only
+    trace of the one act that can satisfy Freeze 8, and no agent may write it
+    back (Phase-1 ruling 6), so a probe that did not notice its removal would
+    leave a Freeze condition silently un-met.
+    """
+    line = next(
+        (ln for ln in w.raw(OPERATOR_CONTRACT_PATH).splitlines() if "Freeze 8 record" in ln),
+        None,
     )
+    if line is None:
+        raise HarnessOutOfDate(
+            "no 'Freeze 8 record' entry in contracts/operator-surface.v1.md, so OSV1-034's "
+            "mutation has nothing to remove -- the row and this mutation are out of step"
+        )
+    w.replace(OPERATOR_CONTRACT_PATH, line + "\n", "")
 
 
 #: One entry per counterfactual. Rows with several separable halves get one
@@ -1455,8 +1469,9 @@ def _mo034_the_changelog_records_a_look(w: World) -> None:
     ),
     Mutation(
         "OSV1-034",
-        "a Changelog entry records the owner's rendered-page look",
-        _mo034_the_changelog_records_a_look,
+        "the Freeze 8 record -- the owner's rendered-page look -- is deleted from the "
+        "locked Changelog",
+        _mo034_the_changelog_record_is_removed,
     ),
 )
 
diff --git a/ledger/checks/test_operator_rows.py b/ledger/checks/test_operator_rows.py
index ca2573a..c1b1a42 100644
--- a/ledger/checks/test_operator_rows.py
+++ b/ledger/checks/test_operator_rows.py
@@ -2278,23 +2278,65 @@ def test_row_osv1_033() -> None:
     )
 
 
-def test_row_osv1_034() -> None:
-    """Freeze 8 pin: the Changelog records no look at the rendered pages.
+#: The Changelog's Freeze 8 entry, located by its own label rather than by
+#: position -- a record that moved up or down the list is still the record.
+_FREEZE_8_RECORD = "Freeze 8 record"
+#: A dated Changelog bullet: `- **YYYY-MM-DD — ...`. Freeze 8 asks for the look
+#: to be "recorded in the Changelog", and this file's Changelog is dated
+#: entries; an undated one could not be placed against a tree.
+_DATED_ENTRY = re.compile(r"^- \*\*\d{4}-\d{2}-\d{2} ")
+
 
-    HONEST LIMIT, and it is irreducible: this can only ever assert that a
-    RECORD exists, never that the owner looked. Freeze 8 says "never a machine
-    check" for exactly that reason.
+def test_row_osv1_034() -> None:
+    """Freeze 8 CONFORMS: the Changelog carries a dated record of the owner's
+    look at the rendered pages.
+
+    RETARGETED 2026-09-05, in the same change that flipped this row. The pin
+    asserted the ABSENCE of the record -- "the Changelog mentions none of 430,
+    900, 1280". The owner looked, the owner-ratified FROZEN stamp recorded it,
+    the pin went red the way a pin is meant to, and this is the real check that
+    replaced it. Flip direction is now REGRESSION: this going red means the
+    record was removed from a locked contract.
+
+    Each named element is asserted SEPARATELY -- three levels, three viewports,
+    both themes -- because a record that quietly drops one of them describes a
+    partial look, and Freeze 8 names all of them.
+
+    HONEST LIMIT, and it is irreducible -- UNCHANGED BY THE FLIP: this can only
+    ever assert that a RECORD exists, never that the owner looked. Freeze 8
+    says "never a machine check" for exactly that reason, and no retargeting
+    can turn a byte fact into an attestation.
     """
     contract = read(OPERATOR_CONTRACT_PATH)
     changelog = contract[contract.index("## Changelog") :]
+    entry = next(
+        (line.strip() for line in changelog.splitlines() if _FREEZE_8_RECORD in line), None
+    )
+    assert entry, (
+        f"OSV1-034 (Freeze 8) REGRESSION: the Changelog no longer carries a "
+        f"{_FREEZE_8_RECORD!r} entry. The owner's look is the only thing that can "
+        f"satisfy Freeze 8, and that record is its only trace -- deleting it un-meets "
+        f"a Freeze condition on a FROZEN contract. It is not re-creatable by an agent: "
+        f"writing it back would be a fabricated attestation (Phase-1 ruling 6)."
+    )
+    assert _DATED_ENTRY.match(entry), (
+        f"OSV1-034 (Freeze 8): the Freeze 8 record lost its date. Freeze 8 asks for the "
+        f"look to be recorded in the Changelog, and an undated record cannot be placed "
+        f"against the tree that was looked at:\n  {entry[:160]}"
+    )
+    for level in ("L0", "L1", "L2"):
+        assert level in entry, (
+            f"OSV1-034 (Freeze 8): the Freeze 8 record no longer names {level}. The "
+            f"clause requires the look to have covered L0, L1 AND L2 -- a record naming "
+            f"fewer describes a partial look."
+        )
     for viewport in ("430", "900", "1280"):
-        assert viewport not in changelog, (
-            f"OSV1-034 (Freeze 8) PIN BROKE THE RIGHT WAY: the Changelog now mentions "
-            f"{viewport}px. If the OWNER looked and an owner-ratified amendment "
-            f"recorded it, flip this row. If an agent wrote that entry, revert it -- "
-            f"it is a fabricated attestation (work_item_pipeline-eah)."
+        assert viewport in entry, (
+            f"OSV1-034 (Freeze 8): the Freeze 8 record no longer names {viewport}px. The "
+            f"clause names all three viewports; dropping one narrows the recorded look "
+            f"without narrowing the condition."
         )
-    assert "looked at the rendered" not in changelog, (
-        "OSV1-034 (Freeze 8): the Changelog now records a look at the rendered pages. "
-        "Confirm it was the OWNER's, then flip the row."
+    assert "both themes" in entry, (
+        "OSV1-034 (Freeze 8): the Freeze 8 record no longer says the look covered BOTH "
+        "themes. A look at one theme is half of what the clause asks for."
     )
diff --git a/ledger/reconcile-report.md b/ledger/reconcile-report.md
index 25d7a3f..d41a9f4 100644
--- a/ledger/reconcile-report.md
+++ b/ledger/reconcile-report.md
@@ -1147,32 +1147,44 @@ Other edges written at creation: `qgo → c1a`, `ujy → c1a`, `np3 → c1a, qgo
 
 ---
 
-## 8. Freeze Bar status — READY FOR THE OWNER'S LOOK AND EXTERNAL REVIEW
+## 8. Freeze Bar status — FROZEN
 
-**Current reading, 2026-09-05, measured on `main` @ `7e43e73`.** The full
-condition-by-condition evidence is in the re-check section below
-(*Re-check 2026-09-05 … §R8*); this is the summary that supersedes the seed
-reading kept as history in §8a.
+**Current reading, 2026-09-05, at the lock**, measured on the branch
+`converge/freeze-operator-surface-v1` off `main` @ `d039b32`. The full
+condition-by-condition evidence is in the lock section below
+(*Lock 2026-09-05 … §L4*); this supersedes the pre-lock reading kept as history
+in §8b and the seed reading in §8a.
 
 | Condition | Status |
 |---|---|
 | Freeze 1 — Tier-A kit exists and runs on every PR | **MET** (OSV1-027) — CI Tier 6; ran here, 41 passed / 1 named xfail |
-| Freeze 2 — Tier-B kit, pinned chromium, isolated data, own CI tier | **MET** (OSV1-028) — CI Tier 7; `playwright==1.60.0` / chromium 148.0.7778.0; ran here ×2, 89 passed |
-| Freeze 3 — every Tier-B check emits re-checkable artifacts | **MET** (OSV1-029) — recording regenerated here and re-read by the ledger |
+| Freeze 2 — Tier-B kit, pinned chromium, isolated data, own CI tier | **MET** (OSV1-028) — CI Tier 7; `playwright==1.60.0` / chromium 148.0.7778.0 |
+| Freeze 3 — every Tier-B check emits re-checkable artifacts | **MET** (OSV1-029) — the committed recording is re-read by the ledger, not trusted |
 | Freeze 4 — every fixture discriminates, demonstrated by running it | **MET** (OSV1-030) — 14 arms, every bad half still biting |
-| Freeze 5 — every Core CONFORMS or NOT-ASSERTABLE-with-cadence | **MET** (OSV1-031) — 19 Core rows: 17 CONFORMS + 2 NOT-ASSERTABLE, **0 red** |
+| Freeze 5 — every Core CONFORMS or NOT-ASSERTABLE-with-cadence | **MET** (OSV1-031) — 19 Core rows: 17 CONFORMS + 2 NOT-ASSERTABLE, **0 red**; both cadences now carry a trigger that outlives this stamp (RC-3) |
 | Freeze 6 — exemption register complete, no literal sites left | **MET** (OSV1-032) — 8 enumerated, set-equal to the live census; 0 literal, inline and `<style>`-block |
 | Freeze 7 — every contract quote verifies against its cited file | **MET** (OSV1-033), with the recorded limit: in-repo quotes proven, out-of-repo brief citations reported unverifiable |
-| Freeze 8 — owner's rendered-page look recorded in the Changelog | **NOT MET — human only** (OSV1-034, `work_item_pipeline-eah` open). The contract says *"never a machine check"* |
-| Freeze 9 — external PR review | **NOT MET — human only**; no row, no machine reading exists |
-| Freeze 10 — owner FROZEN stamp | **NOT MET — human only**; no row |
-
-**Everything a machine can check is green.** The three conditions outstanding
-are, by the contract's own construction, acts of people: the owner's look, an
-external reviewer's read, and the owner's stamp.
-
-The contract stays **DRAFT**. Nothing in this ledger moves it, and nothing in
-this ledger can.
+| Freeze 8 — owner's rendered-page look recorded in the Changelog | **MET — owner act, recorded** (OSV1-034, GAP → **CONFORMS**). The owner looked at the three contact sheets and said *"looked"*; the dated Changelog record is the trace. The contract says *"never a machine check"*, and the retargeted probe still only asserts the RECORD |
+| Freeze 9 — external PR review | **MET — human act, out-of-repo record**; `.amplifier/converge/operator-surface-freeze9-review.md`, an independent reviewer (not the author), verdict REQUEST CHANGES → approve once RC-1/2/3 land. **No row**: the file lives outside this repository, exactly as Brief A and Brief B do, so no in-repo check can read it |
+| Freeze 10 — owner FROZEN stamp | **MET — owner act, recorded**; the dated `2026-09-05 — FROZEN.` Changelog entry carrying the owner's literal words *"Ok, do the freeze"* and *"looked, ratify."* **No row**: a signature has no machine reading, and rowing one would be a fabricated attestation |
+
+**Freeze 1–7 are met by measurement; 8 and 10 are owner acts, recorded; 9 is an
+external reviewer's read, recorded.** The three that no check could ever close
+were closed the only way they can be — by people — and each left a trace a
+later reader can find.
+
+The contract is **FROZEN**. Nothing in this ledger moved it there: the owner
+did, in the Changelog. What this ledger did was refuse to let it be stamped
+until the conditions actually held, and then re-review every row against the
+bytes the stamp changed.
+
+**From here, this contract changes only by a sibling proposal**
+(`operator-surface.v2-candidate.md`), never by an in-place edit. Six lower
+findings from the Freeze 9 review are deferred to exactly that route: Core 1's
+"leads" sentence, Core 4's silence on register GROWTH, Core 5's audit being
+narrower than "reaches", the `_oldest_ready_item` dead-function xfail, the
+drifted `file:line` citations, and Backlogged triggers 4 and 6 being
+unobservable.
 
 ### 8a. Seed reading, 2026-09-04 (history — superseded)
 
@@ -1194,6 +1206,32 @@ reading stays readable beside the later one.
 
 The contract stays **DRAFT**. Nothing in this seed moves it.
 
+### 8b. Pre-lock reading, 2026-09-05 on `main` @ `7e43e73` (history — superseded)
+
+Kept verbatim rather than deleted, for the same reason §8a is: this is what the
+bar read on the last tree before the owner acted, and the difference between
+this table and §8's is exactly the three human acts.
+
+| Condition | Status |
+|---|---|
+| Freeze 1 — Tier-A kit exists and runs on every PR | **MET** (OSV1-027) — CI Tier 6; ran here, 41 passed / 1 named xfail |
+| Freeze 2 — Tier-B kit, pinned chromium, isolated data, own CI tier | **MET** (OSV1-028) — CI Tier 7; `playwright==1.60.0` / chromium 148.0.7778.0; ran here ×2, 89 passed |
+| Freeze 3 — every Tier-B check emits re-checkable artifacts | **MET** (OSV1-029) — recording regenerated here and re-read by the ledger |
+| Freeze 4 — every fixture discriminates, demonstrated by running it | **MET** (OSV1-030) — 14 arms, every bad half still biting |
+| Freeze 5 — every Core CONFORMS or NOT-ASSERTABLE-with-cadence | **MET** (OSV1-031) — 19 Core rows: 17 CONFORMS + 2 NOT-ASSERTABLE, **0 red** |
+| Freeze 6 — exemption register complete, no literal sites left | **MET** (OSV1-032) — 8 enumerated, set-equal to the live census; 0 literal, inline and `<style>`-block |
+| Freeze 7 — every contract quote verifies against its cited file | **MET** (OSV1-033), with the recorded limit: in-repo quotes proven, out-of-repo brief citations reported unverifiable |
+| Freeze 8 — owner's rendered-page look recorded in the Changelog | **NOT MET — human only** (OSV1-034, `work_item_pipeline-eah` open). The contract says *"never a machine check"* |
+| Freeze 9 — external PR review | **NOT MET — human only**; no row, no machine reading exists |
+| Freeze 10 — owner FROZEN stamp | **NOT MET — human only**; no row |
+
+**Everything a machine can check is green.** The three conditions outstanding
+are, by the contract's own construction, acts of people: the owner's look, an
+external reviewer's read, and the owner's stamp.
+
+The contract stays **DRAFT**. Nothing in this ledger moves it, and nothing in
+this ledger can.
+
 ---
 
 ## 9. Returned to the root — interpretive needs this reconcile did not decide
@@ -1756,7 +1794,294 @@ were never opened for writing; `LAST_RUN.json` was regenerated by the two Tier-B
 runs and then restored to its committed bytes. One item filed
 (`work_item_pipeline-lvn`); no item closed; the live service was never contacted.
 
+---
+
+## Lock 2026-09-05 — operator-surface.v1 FROZEN
+
+The mandatory full re-review that a SYNC-hash change triggers, run because the
+contract moved: three owner-ratified pre-lock text fixes, the Freeze 8 record,
+and the `**Status:** DRAFT` → `**Status:** FROZEN` stamp.
+
+**Run:** 2026-09-05, branch `converge/freeze-operator-surface-v1`, branched from
+`main` @ **`d039b32`**.
+**Trigger:** `contracts/operator-surface.v1.md` changed, so `OSV1-000`'s pin
+failed. Under `LEDGER-FORMAT.md` sec.4 that mandates a **full ledger re-review,
+never a silent hash bump** — this section is that re-review's record.
+**Owner's acts, in his own words:** *"looked, ratify."* (Freeze 8, and
+ratification of the external reviewer's RC-1/RC-2/RC-3) and *"Ok, do the
+freeze"* (Freeze 10).
+
+**Outcome in one line:** **one row re-anchored, one disposition changed, zero
+drift in either direction** — and the operator-surface family now carries **no
+red row at all**.
+
+---
+
+### L1. What was actually run (a self-report is not proof)
+
+| Command | Result | What it proves |
+|---|---|---|
+| `.venv/bin/python -m pytest ledger/checks -q` | **60 passed** | every row's quote verifies against the NEW bytes, every assertion ref resolves, the tripwires hold |
+| `make ledger-mutate` | **ALL mutations proven 69 / 69**; `UNPROVEN … (none)` | every probe was watched going red against a counterfactual — including `OSV1-034`'s retargeted one |
+| `make test-conformance-a` | **41 passed, 89 deselected, 1 xfailed** | the Tier-A kit still runs green on this tree; the one xfail is the named `OSV1-015` residual, unchanged |
+| `.venv/bin/ruff check ledger` / `ruff format --check ledger` | `All checks passed!` / `7 files already formatted` | — |
+
+**Tier-B was deliberately NOT re-run, and that is stated rather than glossed.**
+`git diff origin/main --name-only -- src tests` is **empty** on this branch: no
+product byte and no kit byte moved, so the committed recording
+(`browser/LAST_RUN.json`, chromium 148.0.7778.0 / playwright 1.60.0) is still a
+recording *of this tree*, and every Tier-B-derived row re-reads exactly the
+numbers it read at `d039b32`. Re-running the browser tier would have produced
+the same numbers against the same code; it would not have made any row's
+reading more true. What DID change is text a browser cannot see.
+
+### L2. What changed in the contract — three fixes, one record, one stamp
+
+The three fixes are the external reviewer's RC-1, RC-2 and RC-3 (Freeze 9,
+`.amplifier/converge/operator-surface-freeze9-review.md`, verdict **REQUEST
+CHANGES → approve once landed**), each ratified by the owner before the stamp.
+All three are text; none required re-running a kit.
+
+**RC-1 — Core 5 said something false, and a lock would have made it expensive.**
+
+```
+was:  No `GET` route mutates state. The surface may poll itself aggressively;
+      it writes only through explicit operator actions, which are `POST`.
+now:  No `GET` handler reaches a mutating adapter call; the surface may poll
+      itself aggressively and writes work-tracker state only through explicit
+      operator actions, which are `POST`. The one named exception:
+      `GET /auth/logout` clears the session cookie.
+```
+
+`GET /auth/logout` issues `resp.delete_cookie(...)`. That is a state change on a
+GET, so the clause promised strictly more than `reads.never_write` tests — and
+the gap was recorded only in `OSV1-007`'s notes, which do not travel with a
+locked clause. The clause now states what the check asserts, scopes the write
+claim to *work-tracker* state, and names the exception. The machine-check
+sentence was tightened so it no longer restates the clause verbatim; **what
+`reads.never_write` asserts did not move** (the route audit is byte-identical,
+and its measurement — 30 routes, 22 read-only, 0 reaching a mutating adapter
+call — re-ran unchanged).
+
+**RC-2 — two Conformance bad halves did not fail for the reason they named.**
+Freeze 4 requires a bad half that "fails against the defect it names,
+demonstrated by running it". Three halves named a defect the kit does not
+measure:
+
+| | was | now | why |
+|---|---|---|---|
+| **C1 Bad** | "reported as alarm-coloured pixels" | "reported as pixels of a hue outside the token set" (+ the reason) | measured `retired_amber: 16681`, `alarm: 0`. `#D9A253` is too far from `--alarm` to classify as one; the sweep counts it in a third bucket the contract never named |
+| **C3 Bad** | "loses all four … offset zero, the disclosure closed, the pause flag cleared, and a fresh live region" | "the open disclosure closes and every tagged live region is replaced by a fresh node (chromium preserves scroll and the pause flag by itself; a reflowing replacement loses scroll too)" | measured `scroll_preserved: true`, `pause_flag_preserved: true`. Only the disclosure and live-region *node identity* actually move; the kit needed a second arm (`bad-naive-replacement-reflow`) to discriminate scroll at all |
+| **C4 Good/Bad** | `scrollWidth == clientWidth` / "emits `scrollWidth > clientWidth`" | "no element's border box extends past `clientWidth`" / "that element extends past `clientWidth`" | `html`/`body` carry `overflow-x: clip`, so a 900px element at 430px moves `scrollWidth` not at all (`scroll_width_moved: false`) and the kit asserts `elements_beyond_viewport_moved`. The reviewer added the half the ledger had missed: the **Good** half inherited the same defect, since `scrollWidth == clientWidth` is satisfiable by *clipping* the overflow rather than preventing it |
+
+**RC-3 — the two NOT-ASSERTABLE cadences expired at the stamp.** Freeze 5
+admits a clause without a check only "with its review cadence named here", and
+both named one — but both named *authoring-phase* events. Core 12: "at each
+ENCODE gate and before any Freeze stamp". Core 13: "at each ENCODE gate". After
+this stamp there is no further ENCODE gate and no further Freeze stamp, so the
+only two Core clauses carried by a human would have had **no recurring
+trigger**. Each now appends one that outlives the lock: *"and at each
+`ledger/reconcile-report.md` re-check."*
+
+**The Freeze 8 record and the FROZEN stamp.** Three dated Changelog entries were
+added, newest first: the FROZEN stamp (Freeze 10, carrying the owner's literal
+words and the proposal-only rule that now governs the file), the Freeze 8 record
+(the owner's look, marked in the entry itself as *"ratification input, never a
+machine check"*), and true-up #2 (the three fixes above). `**Status:** DRAFT`
+became `**Status:** FROZEN`.
+
+**Six lower findings were deliberately NOT taken here.** Core 1's "leads"
+sentence, Core 4's silence on register *growth*, Core 5's audit being narrower
+than "reaches", the `_oldest_ready_item` dead-function xfail, the drifted
+`file:line` citations, and Backlogged triggers 4 and 6 being unobservable. Each
+is a post-lock proposal against `operator-surface.v2-candidate.md`. The
+reviewer explicitly did not block on them, and taking them at the stamp would
+have meant landing unratified edits under an owner ratification that named
+three.
+
+### L3. Hash, rows re-anchored, disposition changed
+
+**Hash, old → new** (`sha256`, whole-file bytes, computed exactly as
+`ledger/checks/_support.py::sha256` does):
+
+```
+contracts/operator-surface.v1.md      f40987524fb47351023700fbad97c9c43d9ddd46aeb2cefd0d3ec08cd71c3edb
+                                   -> a467be2adca763734fdfb5aace44108ebb21a3d7f5c1663bf82d5eb95ee54c52
+
+contracts/custody-coordination.v1.md  ec4b736f8d6dca4ee3c29b6df8397a9d7b51d2eadd76965854e898924f529e1a
+                                      (unchanged — re-verified byte-for-byte on this run, not assumed)
+```
+
+**Rows re-anchored: 1 — checked, not assumed.** All 36 `OSV1-###` rows were
+walked; each of the 35 quote-carrying ones had its quote collapsed and tested
+against BOTH the old (`origin/main`) and the new contract text.
+
+| Row | Clause | Was | Now |
+|---|---|---|---|
+| `OSV1-007` | Core 5 | *"No GET route mutates state."* — the sentence RC-1 replaced | the clause's new normative sentences, ending *"GET /auth/logout clears the session cookie"*; same clause |
+
+**The other 34 verify byte-identically in both texts** — and the three groups a
+reader would expect to have broken are worth naming, because they did not:
+
+* `OSV1-020` / `OSV1-022` / `OSV1-023` quote Conformance 1/3/4's
+  `**Test location:**` lines, which RC-2 never touched; the probes anchoring on
+  contract prose (`OSV1-020`'s good half, `OSV1-021`'s bad half) anchor on text
+  RC-2 also left alone.
+* `OSV1-018` / `OSV1-019` quote the Core 12/13 **machine-check** sentences, not
+  the `**Reviewed at cadence:**` lines RC-3 edited.
+* `OSV1-033` (Freeze 7) re-ran green against the three NEW Changelog entries:
+  no new `file.py:LINE` citation was introduced, the two `webapp.py:37-44`
+  quotations are still present and still verify, and no new `*"…"*` attributed
+  quotation was added — the owner's words are recorded as plain quotations
+  citing no file, which is what they are.
+
+**Their NOTES were re-reviewed and corrected anyway.** A surviving quote is not
+a re-review: `OSV1-020`, `OSV1-022` and `OSV1-023` all carried notes describing
+clause text that moved, and `OSV1-018`/`OSV1-019` carried cadences that RC-3
+extended. All five now say what the clause says.
+
+**Two "honest limit" paragraphs are now IN the contract**, and their rows say so
+rather than continuing to report a gap that no longer exists:
+
+* `OSV1-007` honest limit 1 — the `GET /auth/logout` cookie clear. The clause
+  now names it; **clause text and check agree as of true-up #2**. Honest limit
+  2 (the static, module-local, depth-4 audit) is unchanged and still a limit.
+* `OSV1-023` "A FUTURE AMENDMENT MAY WANT THIS" — the `scrollWidth` wording.
+  The amendment was taken; **clause text and check agree as of true-up #2**.
+  Both paragraphs are kept, not deleted: they are the measurement that earned
+  the amendment.
+
+**Disposition changed: 1.**
+
+| Row | Was | Now | Direction |
+|---|---|---|---|
+| `OSV1-034` (Freeze 8) | **GAP** | **CONFORMS** | `VIOLATION-MOVEMENT` |
+
+The pin asserted the ABSENCE of the record — "the Changelog mentions none of
+430, 900, 1280". The owner looked at the eighteen captures from the pinned
+browser run, presented as three per-level contact sheets, and said *"looked"*;
+the owner-ratified stamp recorded it. **The pin went red the way a pin is meant
+to, and the probe was retargeted in the same change**: it now asserts that the
+Changelog carries a **dated** Freeze 8 record naming L0, L1, L2, 430, 900, 1280
+and both themes, each element enumerated separately so a record that quietly
+drops one fails rather than passing on a partial look. Its mutation flipped
+direction with it — from the FIXED counterfactual ("a Changelog entry records
+the look") to the REGRESSION one ("that record is deleted from a locked
+Changelog") — so the denominator stayed 69/69 honestly rather than by rounding.
+
+**The docstring's honest limit is kept verbatim, because the flip does not
+soften it:** the probe asserts that a RECORD EXISTS, never that the owner
+looked. Freeze 8 says *"never a machine check"* for exactly that reason.
+
+**Tally, before → after:** 32 CONFORMS / 3 NOT-ASSERTABLE / 1 GAP / 0 VIOLATION
+→ **33 / 3 / 0 / 0**. Freeze 5's Core sub-tally is unmoved (19 Core rows: 17
+CONFORMS + 2 NOT-ASSERTABLE, 0 red) — `OSV1-034` is a Freeze row, not a Core
+one. The `CCV1-###` family is untouched at 22 CONFORMS / 2 NOT-ASSERTABLE.
+
+**No row was created for the FROZEN status, for Freeze 9, or for Freeze 10.**
+FROZEN is a fact about the contract's lifecycle, not a clause. Freeze 9's record
+lives outside this repository (`.amplifier/converge/`, where Brief A and Brief B
+also live), so no in-repo check can read it. Freeze 10 is a signature, which has
+no machine reading at all. Rowing any of the three would have meant inventing an
+assertion — and `OSV1-035` was checked rather than assumed: it is **Reserved 1**
+(`--json` shapes), not a Freeze row, and `OSV1-036` does not exist.
+
+**Every other disposition re-verified against the tree, not assumed.** This
+branch changes the contract and `ledger/` only, so no row's subject code moved;
+every probe re-ran green and every probe's discriminating power was re-confirmed
+(§L1).
+
+### L4. Freeze Bar reading at the lock — Freeze 1–10 as written in the contract
+
+Read condition by condition against `contracts/operator-surface.v1.md`'s own
+Freeze Bar. The condition-by-condition table lives at **§8**; this lock is what
+put it there, and the pre-lock reading it replaced is kept as §8b. In summary:
+**1–7 met by measurement, 8 and 10 owner acts recorded in the Changelog, 9 an
+external reviewer's read recorded in a file.** All ten are met.
+
+The distinction §8 keeps and this section restates, because it is the whole
+reason the bar has ten conditions and not seven: 8, 9 and 10 are **not** things
+this ledger closed. It could not, and it says so. What it did was hold them open
+— visibly, on a row and in a table — until people closed them.
+
+### L5. Honest limits of this lock
+
+1. **Freeze 9's record is out-of-repo.** `.amplifier/converge/operator-surface-freeze9-review.md`
+   is not committed here, so no probe can verify it exists, that its author was
+   independent, or that its verdict says what §8 reports. This is the same limit
+   `OSV1-033` already reports for Brief A and Brief B, and it is reported rather
+   than papered over with a row that would assert a path and call it a review.
+2. **Freeze 8 remains a record, not an attestation.** Retargeting `OSV1-034`
+   changed which byte fact is true, not what a byte fact can prove.
+3. **Tier-B was not re-run on this branch** (§L1). Justified by an empty
+   `src`/`tests` diff, not by convenience — but "the numbers would be the same"
+   is an inference from that diff, not a fresh measurement.
+4. **The six deferred findings are real defects in a now-locked text.** They are
+   cheap to fix as proposals and were not blocked on by the reviewer, but the
+   text is locked with them in it, and that cost was accepted knowingly rather
+   than discovered later.
+5. **`work_item_pipeline-eah` is discharged but not closed.** This branch may not
+   write to the live tracker, so the item stays open in the queue and needs
+   closing by hand; the row keeps its `work` ref rather than dropping it, so the
+   open item is visible rather than orphaned. `work_item_pipeline-lvn` and
+   `work_item_pipeline-umm` remain open from the previous re-check, untouched
+   here.
+
+### L6. Files written by this lock
+
+| File | Change |
+|---|---|
+| `contracts/operator-surface.v1.md` | RC-1/RC-2/RC-3 text fixes, three Changelog entries, `**Status:** DRAFT` → `**Status:** FROZEN` |
+| `ledger/rows.yaml` | `OSV1-000` rehashed + full-re-review notes; `OSV1-007` re-anchored; `OSV1-034` GAP → CONFORMS with a retargeted probe ref; notes trued up on `OSV1-007`, `-018`, `-019`, `-020`, `-022`, `-023`, `-034` |
+| `ledger/checks/test_operator_rows.py` | `test_row_osv1_034` retargeted from the absence-pin to the record check, honest-limit docstring kept |
+| `ledger/checks/mutation_harness.py` | `OSV1-034`'s mutation flipped from FIXED to REGRESSION direction |
+| `ledger/reconcile-report.md` | this section (`L1`–`L6`), the new §8 FROZEN reading with the pre-lock reading kept as §8b, and a Changelog entry |
+
+**No other file was written.** No `src/` byte, no `tests/` byte, no
+`docs/VISION.md` byte and no `contracts/custody-coordination.v1.md` byte was
+touched; `LAST_RUN.json` was neither regenerated nor edited; the live service
+was never contacted. No item was filed and none closed.
+
 ## Changelog
+- **2026-09-05 — LOCK, `contracts/operator-surface.v1.md` FROZEN, mandatory
+  full re-review.** Owner ratification and signature (Freeze 10), literal words
+  *"Ok, do the freeze"* and *"looked, ratify."* Three owner-ratified pre-lock
+  fixes from the Freeze 9 external review (independent reviewer, verdict
+  REQUEST CHANGES → approve once landed): **RC-1** Core 5 reworded to what
+  `reads.never_write` asserts, naming `GET /auth/logout`'s cookie clear as the
+  one exception — the old sentence was literally false on this tree; **RC-2**
+  Conformance 1/3/4 halves reworded to the defects the kit MEASURES (a hue
+  outside the token set, not "alarm-coloured"; the disclosure plus live-region
+  node identity, not "all four"; the element-level border box past
+  `clientWidth`, not `scrollWidth`, which `overflow-x: clip` makes satisfiable
+  by hiding overflow rather than preventing it — the Good half inherited that
+  defect too); **RC-3** Core 12/13 cadences gain a standing trigger, "at each
+  `ledger/reconcile-report.md` re-check", because both existing triggers expire
+  at this stamp. Plus the **Freeze 8 record** (the owner looked at L0/L1/L2 at
+  430/900/1280 in both themes — the eighteen pinned-browser captures as three
+  contact sheets — and said *"looked"*) and the FROZEN stamp. SYNC (`OSV1-000`)
+  rehashed for the operator contract only (`f4098752…` → `a467be2adc…`); the
+  custody contract's bytes are unchanged and were re-verified, not assumed.
+  Full re-review performed (never a silent bump): 36 rows walked, **1
+  re-anchored** (`OSV1-007`, within the same clause), **1 disposition changed**
+  — `OSV1-034` (Freeze 8) GAP → **CONFORMS** by `VIOLATION-MOVEMENT`, its pin
+  replaced by a real record check and its mutation flipped to the regression
+  direction in the same change. Tally 32/3/1/0 → **33 CONFORMS / 3
+  NOT-ASSERTABLE / 0 GAP / 0 VIOLATION**; the family now carries **no red row**.
+  Five more rows' notes trued up where the clause text they describe moved
+  (`OSV1-018`, `-019`, `-020`, `-022`, `-023`), and two "honest limit"
+  paragraphs (`OSV1-007`'s `GET /auth/logout`, `OSV1-023`'s `scrollWidth`) now
+  record that the clause and the check AGREE. **Freeze Bar: all ten met** — 1–7
+  by measurement, 8 and 10 as owner acts recorded in the Changelog, 9 as the
+  external review file (out-of-repo, and reported as such; no row) — §8, with
+  the pre-lock reading kept as §8b. Measured here, not transcribed: `pytest
+  ledger/checks -q` **60 passed**; `make ledger-mutate` **69/69, none
+  unproven**; `make test-conformance-a` **41 passed / 1 named xfail**; ruff
+  clean. Tier-B deliberately not re-run and the reason stated (§L1): `git diff
+  origin/main -- src tests` is empty, so the committed recording is still a
+  recording of this tree. Six lower review findings deferred to post-lock
+  proposals. No `src/`, no `tests/`, no `docs/VISION.md` and no custody-contract
+  byte touched; the live service was never contacted.
 - **2026-09-05 — RE-CHECK, `contracts/operator-surface.v1.md` (`OSV1-###`),
   after highway `hw-operator-surface` waves 1–4** (PRs #82 `aec9991`, #83
   `6c2e9fa`, #84 `065da04`, #85 `7e43e73`). Standing ratchet run against `main`
diff --git a/ledger/rows.yaml b/ledger/rows.yaml
index cf48d95..1152f65 100644
--- a/ledger/rows.yaml
+++ b/ledger/rows.yaml
@@ -834,7 +834,7 @@
   contract:
     files:
       - file: contracts/operator-surface.v1.md
-        sha256: f40987524fb47351023700fbad97c9c43d9ddd46aeb2cefd0d3ec08cd71c3edb
+        sha256: a467be2adca763734fdfb5aace44108ebb21a3d7f5c1663bf82d5eb95ee54c52
       - file: contracts/custody-coordination.v1.md
         sha256: ec4b736f8d6dca4ee3c29b6df8397a9d7b51d2eadd76965854e898924f529e1a
   disposition: CONFORMS
@@ -842,6 +842,81 @@
     kind: probe
     ref: test_row_osv1_000
   notes: >
+    REHASHED 2026-09-05: the FROZEN stamp + true-up #2; full OSV1 re-review.
+    Owner ratification and signature (Freeze 10), literal words "Ok, do the
+    freeze" and "looked, ratify." Status moves DRAFT -> FROZEN. Operator hash
+    `f4098752...` -> `a467be2adc...`; `contracts/custody-coordination.v1.md`
+    re-hashed BYTE-FOR-BYTE on this run and still `ec4b736f...` -- the boundary
+    is a one-way citation, so the custody text was never opened.
+
+    WHAT MOVED IN THE CONTRACT: the three pre-lock fixes the Freeze 9 external
+    reviewer required (verdict REQUEST CHANGES -> approve once landed), the
+    Freeze 8 record, the FROZEN stamp and the Status line.
+      (1) RC-1, Core 5. "No `GET` route mutates state." was FALSE as written --
+          `GET /auth/logout` clears a session cookie -- so the clause promised
+          strictly more than `reads.never_write` tests, and a ledger note does
+          not travel with a locked clause. The clause now states what the check
+          asserts ("No `GET` handler reaches a mutating adapter call"), scopes
+          the write claim to work-tracker state, and NAMES the cookie clear as
+          the one exception. The machine-check sentence was tightened so it no
+          longer restates the clause verbatim; what `reads.never_write`
+          asserts did not move.
+      (2) RC-2, Conformance 1, 3 and 4. Three halves reworded to the defect
+          each fixture MEASURES rather than the one it named: C1's bad half to
+          "pixels of a hue outside the token set" (`#D9A253` is too far from
+          `--alarm` for the sweep to classify it as one, so it is counted in
+          its own bucket); C3's bad half to the open disclosure closing and
+          every tagged live region being replaced by a fresh node, with
+          chromium's own scroll/pause preservation and the reflow arm stated
+          in the clause; C4's good AND bad halves to the element-level reading
+          (a border box past `clientWidth`), because `overflow-x: clip` makes
+          `scrollWidth == clientWidth` satisfiable by hiding the overflow
+          instead of preventing it.
+      (3) RC-3, Core 12 and Core 13. Both NOT-ASSERTABLE cadences were
+          authoring-phase only ("at each ENCODE gate", "before any Freeze
+          stamp") and would have expired at this very stamp, leaving the two
+          Core clauses carried by a human with no recurring trigger. Each
+          gains a standing one: "and at each `ledger/reconcile-report.md`
+          re-check".
+      Plus three dated Changelog entries (the FROZEN stamp, the Freeze 8
+      record, true-up #2) and `**Status:** DRAFT` -> `**Status:** FROZEN`.
+
+    FULL RE-REVIEW PERFORMED (mandatory on any hash change, never a silent
+    bump). All 36 OSV1 rows walked against the new bytes:
+      * ROWS RE-ANCHORED: 1, and only 1 -- checked, not assumed, by collapsing
+        both the old (`origin/main`) and the new contract text and testing
+        every one of the 35 quote-carrying rows against each. OSV1-007 (Core
+        5) re-anchored to the clause's new normative sentences, staying in the
+        SAME clause. The other 34 verify byte-identically in BOTH texts --
+        including OSV1-020/-022/-023, whose quotes are Conformance
+        `**Test location:**` lines RC-2 never touched, and OSV1-018/-019,
+        whose quotes are the Core 12/13 machine-check sentences RC-3 never
+        touched. Their NOTES were re-reviewed and corrected anyway, because
+        the clause text those notes describe DID move; a surviving quote is
+        not a re-review.
+      * DISPOSITION CHANGED: 1. OSV1-034 (Freeze 8) GAP -> CONFORMS, direction
+        VIOLATION-MOVEMENT -- the owner's look is now recorded in the
+        Changelog, so the pin went red the way a pin is meant to and was
+        replaced by a real check in the same change. Tally 32 CONFORMS / 3
+        NOT-ASSERTABLE / 1 GAP / 0 VIOLATION -> 33 / 3 / 0 / 0. The
+        operator-surface family now carries NO red row.
+      * NO ROW MOVED BECAUSE OF THE STATUS LINE. FROZEN is a fact about the
+        contract's lifecycle, not a clause; no row asserts it, and none was
+        invented for it. Freeze 9 and Freeze 10 likewise get no row -- there
+        is no machine reading of an external review or of an owner's
+        signature, and rowing one would be a fabricated attestation.
+      * EVERY OTHER DISPOSITION RE-VERIFIED AGAINST THE TREE, not assumed:
+        this branch changes the contract and `ledger/` only (`git diff
+        origin/main --stat` touches `contracts/operator-surface.v1.md` and
+        three files under `ledger/`), so no row's subject code moved and no
+        Tier-B number was re-measured -- every browser-derived row still reads
+        the same committed recording it read at `d039b32`. `pytest
+        ledger/checks -q` 60 passed; `make ledger-mutate` 69/69 proven, zero
+        unproven -- the denominator did not move because OSV1-034's mutation
+        changed DIRECTION rather than count when the row flipped (the FIXED
+        counterfactual "a Changelog entry records the look" is now the
+        REGRESSION counterfactual "that record is removed").
+
     REHASHED 2026-09-04: owner-ratified DRAFT true-up #1 ("yep, do it all."),
     a three-part amendment to `contracts/operator-surface.v1.md`. Status stays
     DRAFT. Operator hash `7566c75c...` -> `f40987524f...`;
@@ -1555,12 +1630,31 @@
     file: contracts/operator-surface.v1.md
     clause: Core 5
     quote: |
-      No `GET` route mutates state.
+      No `GET` handler reaches a mutating adapter call; the surface may poll itself aggressively
+      and writes work-tracker state only through explicit operator actions, which are `POST`. The
+      one named exception: `GET /auth/logout` clears the session cookie.
   disposition: CONFORMS
   assertion:
     kind: probe
     ref: test_row_osv1_007
   notes: >
+    RE-ANCHORED 2026-09-05 at the FROZEN stamp (true-up #2, RC-1). This row's
+    quote was "No `GET` route mutates state." -- a sentence the Freeze 9
+    external reviewer showed to be FALSE on this tree, and one that would have
+    been locked. The clause was reworded to what `reads.never_write` actually
+    asserts and this quote re-anchored to the surviving/new normative text of
+    the SAME clause. HONEST LIMIT 1 BELOW IS NOW IN THE CONTRACT: the
+    `GET /auth/logout` cookie clear is named by the clause itself as the one
+    exception, so the clause text and the check AGREE as of true-up #2 -- the
+    limit is no longer a gap between what the contract promises and what this
+    row can show. The paragraph is kept, not deleted: it is the history of why
+    the clause reads the way it now does. HONEST LIMIT 2 (the static,
+    module-local, depth-4 audit) is UNCHANGED and still a limit -- the
+    reviewer named it separately as a lower finding, and closing it is a
+    post-lock proposal, not part of this stamp. Disposition unchanged
+    (CONFORMS): the measurement below was re-run on this branch and did not
+    move.
+
     MEASURED 2026-09-04 against 4aaee50 by the route audit Core 5's machine
     check names (`reads.never_write`), re-run by the probe on every ledger run:
     every route decorator in webapp.py, webbrowse.py and webtrust.py is parsed
@@ -2421,9 +2515,14 @@
     promise, which PROTOCOL.md sec.7 resists ("unlabeled judgment where it is
     not [possible]" -- NOT-ASSERTABLE exists so judgment is named, never
     smuggled). REVIEWED AT CADENCE, per the clause: owner review of L0/L1/L2 at
-    each ENCODE gate and before any Freeze stamp. Note the cadence is
-    discharged by the same owner look Freeze 8 requires (OSV1-034), so the two
-    travel together.
+    each ENCODE gate and before any Freeze stamp, AND -- added by true-up #2
+    (RC-3, owner-ratified "ratify.", 2026-09-05) -- at each
+    `ledger/reconcile-report.md` re-check. The added trigger is the whole point
+    of the fix: the two authoring-phase triggers both expire at the FROZEN
+    stamp, which would have left this clause carried by a human with no
+    recurring occasion to carry it. Note the cadence is discharged by the same
+    owner look Freeze 8 requires (OSV1-034, CONFORMS as of 2026-09-05), so the
+    two travel together.
   assertion:
     kind: none
 
@@ -2442,7 +2541,11 @@
     threshold invented in place of a baseline would be a number the ledger
     could go green against while the outcome it names got worse -- the
     gameable-proxy failure PROTOCOL.md sec.7 resists. REVIEWED AT CADENCE, per
-    the clause: owner review at each ENCODE gate. PROMOTION IS ALREADY NAMED
+    the clause: owner review at each ENCODE gate, AND -- added by true-up #2
+    (RC-3, owner-ratified "ratify.", 2026-09-05) -- at each
+    `ledger/reconcile-report.md` re-check, because the ENCODE-gate trigger
+    stops firing at the FROZEN stamp and a cadence nothing triggers is not a
+    cadence. PROMOTION IS ALREADY NAMED
     AND HELD: Backlogged 6 ("a target number for alarm-to-acknowledgement")
     fires on "the first alarm-to-acknowledgement measurement exists" -- so this
     row's job is to keep the question standing until an instrument exists, not
@@ -2465,6 +2568,17 @@
     kind: probe
     ref: test_row_osv1_020
   notes: >
+    RE-REVIEWED 2026-09-05 at the FROZEN stamp (true-up #2, RC-2). The quote
+    did not move -- it is Conformance 1's `**Test location:**` line -- but the
+    fixture's BAD HALF did: the clause said the reinstated retired palette "is
+    reported as alarm-coloured pixels", and the sweep has never reported it
+    that way. It reports it in a THIRD bucket, because `#D9A253` is too far
+    from `--alarm` to classify as one at the tolerance that keeps the three
+    status hues mutually exclusive. The clause now says "pixels of a hue
+    outside the token set", which is what the kit measures and what the
+    measurement below has recorded since seed. Disposition unchanged
+    (CONFORMS); no number was re-measured on this branch.
+
     RE-DERIVED 2026-09-05, GAP -> CONFORMS. The named path exists and carries
     `calm.zero_alarm_pixels` under the contract's own check name. This row is
     about the FIXTURE, not about Core 2 conforming -- the calm render's actual
@@ -2553,6 +2667,19 @@
     kind: probe
     ref: test_row_osv1_022
   notes: >
+    RE-REVIEWED 2026-09-05 at the FROZEN stamp (true-up #2, RC-2). The quote
+    did not move -- it is Conformance 3's `**Test location:**` line -- but the
+    clause's BAD HALF did, and it moved to what the two arms below have always
+    measured. The clause said a naive whole-body replacement "loses all four";
+    the recording says it loses the open disclosure and every tagged live
+    region's NODE IDENTITY, while chromium preserves scroll and the pause flag
+    by itself, and only the reflow variant loses scroll. That is now the
+    clause's own wording, so the discrepancy this row's notes have carried
+    since the fixture was built -- the contract naming a defect its bad half
+    does not produce -- is closed in the contract rather than only in the
+    ledger. Disposition unchanged (CONFORMS); no number was re-measured on
+    this branch.
+
     RE-DERIVED 2026-09-05, GAP -> CONFORMS. The fixture exists, runs both
     halves, and discriminates. Core 6's own verdict is OSV1-008 (VIOLATION);
     this row is about the fixture.
@@ -2600,6 +2727,22 @@
     kind: probe
     ref: test_row_osv1_023
   notes: >
+    RE-REVIEWED 2026-09-05 at the FROZEN stamp (true-up #2, RC-2). The quote
+    did not move -- it is Conformance 4's `**Test location:**` line -- but both
+    of the clause's halves did, and they moved onto the metric this fixture
+    actually asserts. THE HONEST LIMIT RECORDED BELOW IS NOW IN THE CONTRACT:
+    the clause reads "no element's border box extends past `clientWidth`"
+    (good) and "that element extends past `clientWidth`" (bad), so the clause
+    text and the check AGREE as of true-up #2. The `scrollWidth` paragraphs
+    below are kept, not deleted -- they are the measurement that earned the
+    amendment, and the kit still emits BOTH readings so a future reader can
+    see why one of them was not enough. The Freeze 9 external reviewer added
+    the half this row had not named: the GOOD half inherited the same defect,
+    since `scrollWidth == clientWidth` is satisfiable by CLIPPING the overflow
+    rather than preventing it, which made the good half a hollow assertion as
+    written. Disposition unchanged (CONFORMS); no number was re-measured on
+    this branch.
+
     RE-DERIVED 2026-09-05, GAP -> CONFORMS. The fixture exists and sweeps what
     the clause names: L0, L1 and L2 at 430, 900 and 1280px in both themes --
     18 measured renders, each emitting computed contrast ratios, target
@@ -2636,10 +2779,13 @@
     are in the artifact so the clause's wording is shown to be
     non-discriminating here instead of being quietly rewritten.
 
-    A FUTURE AMENDMENT MAY WANT THIS: the contract's `scrollWidth ==
-    clientWidth` wording is satisfiable by clipping the overflow rather than
-    preventing it. Naming it here rather than proposing a change from a test
-    file.
+    A FUTURE AMENDMENT MAY WANT THIS -- AND TOOK IT, 2026-09-05 (true-up #2,
+    RC-2): the contract's `scrollWidth == clientWidth` wording is satisfiable
+    by clipping the overflow rather than preventing it. Named here rather than
+    proposed from a test file; the external reviewer read it here, raised it as
+    RC-2, and the owner ratified the rewording before the lock. Both of
+    Conformance 4's halves now read on the element-level metric, which is the
+    one asserted above.
 
     The three swept breakpoints are still declared in the stylesheet, and this
     row's probe still pins that -- a viewport the stylesheet no longer knows
@@ -3459,7 +3605,7 @@
     carrying a live work ref would read as unfinished business.
 
 - id: OSV1-034
-  title: Freeze 8 -- the owner's rendered-page look is not recorded in the Changelog
+  title: Freeze 8 -- the owner's rendered-page look is recorded in the Changelog
   contract:
     file: contracts/operator-surface.v1.md
     clause: Freeze 8
@@ -3467,14 +3613,53 @@
       **Freeze 8:** the owner has looked at the rendered L0, L1, and L2 at 430, 900, and 1280px
       in both themes, and that look is recorded in the Changelog as a ratification input, never
       a machine check.
-  disposition: GAP
+  disposition: CONFORMS
   work: work_item_pipeline-eah
   assertion:
     kind: probe
     ref: test_row_osv1_034
   notes: >
-    PINNING ROW -- the probe pins the absence of the record; a passing probe
-    here is NOT conformance. Flip direction VIOLATION-MOVEMENT.
+    FLIPPED GAP -> CONFORMS 2026-09-05, direction VIOLATION-MOVEMENT, and the
+    probe RETARGETED in the same change. The pin asserted the ABSENCE of the
+    record; the owner looked, the owner-ratified FROZEN stamp recorded it, the
+    pin went red the way a pin is meant to, and a real check replaced it. Flip
+    direction is now REGRESSION: this row going red means the record was
+    removed from a locked contract.
+
+    WHAT THE OWNER DID, and the evidence for it. Presented with the eighteen
+    captures from the 2026-09-05 pinned-browser run (chromium 148.0.7778.0 /
+    playwright 1.60.0) on `main` @ d039b32 -- L0 Mission Control, L1 Project
+    Observatory and L2 Item Detail, each at 430, 900 and 1280px in both themes,
+    laid out as three per-level contact sheets -- the owner replied, literal:
+    "looked, ratify." The look is recorded in the contract's Changelog as a
+    dated entry (`2026-09-05 -- Freeze 8 record (ratification input, never a
+    machine check)`), which is the form Freeze 8 asks for.
+
+    WHAT THE RETARGETED PROBE ASSERTS, on every run: that the Changelog
+    carries a DATED Freeze 8 record naming all three levels (L0, L1, L2), all
+    three viewports (430, 900, 1280) and both themes. Enumerated rather than
+    pattern-matched, so a record that quietly drops a level or a breakpoint
+    fails instead of passing on a partial look.
+
+    THE IRREDUCIBLE HONEST LIMIT, UNCHANGED BY THE FLIP, and the reason the
+    clause ends "never a machine check": this probe can only ever assert that a
+    RECORD EXISTS. It cannot assert that the owner looked. Retargeting does not
+    soften that -- a byte fact cannot become an attestation. What changed is
+    which byte fact is true, and WHO made it true: the owner, in this session,
+    in his own words. Had an agent written that entry, or had the eighteen
+    captures an agent examined been allowed to stand in for the look, it would
+    be a fabricated attestation (Phase-1 ruling 6) and this row would still
+    read GAP.
+
+    WORK ITEM: work_item_pipeline-eah tracked exactly this condition and is
+    discharged by this change. The `work` ref is KEPT rather than dropped --
+    unlike OSV1-033's, whose item was closable by the change itself -- because
+    this branch may not write to the live tracker and the item is closed by the
+    owner's own act, not by a commit. It needs closing by hand.
+
+    HISTORY BELOW, kept rather than rewritten: this is what the row said while
+    the condition was open, and the point of a ratchet is that the earlier
+    reading stays readable beside the later one.
 
     MEASURED 2026-09-04 against 4aaee50: the contract's Changelog has exactly
     two entries, both dated 2026-09-04 (the ENCODE-gate "lgtm." ratification
@@ -3510,6 +3695,9 @@
     430/900/1280 in both themes stand in for the owner's look -- would be a
     fabricated attestation (Phase-1 ruling 6). The KIT has looked; the OWNER has
     not. Those are different facts, and this row records the second one.
+    (That reading stood until later the same day, when the owner did look and
+    said so in his own words -- see the flip at the head of this note. The
+    captures did not change; who looked at them did.)
 
 - id: OSV1-035
   title: Reserved 1 -- CLI --json shapes, ungoverned until an outside caller parses them