[MaxGhenis]

This is the Chronicle half of the fix for resolver appends merging past a red required "Arch checks". The Thesis half is ThesisInstitute/thesis#377: the resolver writes provable curation into its own proposals and awaits Arch checks. Land this PR first; until it lands, #377 cannot move the anchor and reports it as curation still needed.

Why

The Thesis resolver's admin token merges on two checks, Append gate and Trusted base append gate. Branch protection on codex/thesis-ledger-facts also requires Arch checks, but enforce_admins is off, so nothing stops the merge. I went through all 28 resolver append PRs (07-10 to 10-19):

• 17 merged with Arch checks red on the proposal head.
• 8 turned a green branch red: Record 8 first-print observation(s) via resolve_pending.py #151, Record 3 first-print observation(s) via resolve_pending.py #156, Record 7 first-print observation(s) via resolve_pending.py #162 and Record 1 first-print observation(s) via resolve_pending.py #170 (a stale catalog, fixed since), Record 20 first-print observation(s) via resolve_pending.py #191, Record 8 first-print observation(s) via resolve_pending.py #303, Record 5 first-print observation(s) via resolve_pending.py #361 and Record 5 first-print observation(s) via resolve_pending.py #369.
• The branch was red about 30 of the last 72 days, including 12 days from 08-23 and 13.5 days from 09-29.

Since the August catalog fix, every one of these failures came from two curation tests:

• the period-strip audit;
• test_identity_uuid_map_matches_reviewed_anchor.

The anchor moves on every first observation that enriches a docket placeholder or mints an identity. It lived as a literal in the test, so only a hand-edited curation PR could move it (#363, #371). It also cannot move before the rows exist, because it pins the post-append digest.

What

• tests/fixtures/series_catalog/identity_anchor.json holds the pin, unchanged at d5b88530…, and a move field.
• move: null means a curator pinned it, as before, with a dated entry in the test's comment history.
• A machine move records by, run_url, from_sha256 and events. Each event is a mint or an enrich with its placeholder_geography.
• build_series_catalog.identity_anchor_problems re-derives from_sha256 from the current catalog and the recorded events. It accepts only:
  • mints of full identities under UUIDs the prior catalog does not hold;
  • enrichments of entity-free placeholders under the same UUID and concept, where the placeholder's geography admits the new one (the same rule as _plan_enrichment).
• Relative to from_sha256, anything else is reported: a remint, supersede, retire, entity change on a full identity, unrecorded change or unsorted events.
• from_sha256 itself is tied to the base. The test sees only the current catalog, so a self-consistent record with a false origin would pass it. A new Arch checks step, "Identity anchor move continues the base pin", runs identity_anchor_continuity_problems against the same comparison base as the registry append-only step. It requires a move that changes the pin to start from the base's pin, and refuses a mint whose UUID the base registry already holds (bringing a retired UUID back is a revive, a curator's call).

Invariants (property-tested)

• Completeness: any append made only of sanctioned events, recorded as a move, is accepted. The same append with no move recorded is refused.
• Soundness: each of 11 misstatements is reported, including a dropped event, a wrong origin, a mint that reuses a UUID, a remint, a placeholder mint and a stale pin. The statistics show every mutation exercised.
• Real data: I rebuilt both hand moves as machine moves. Catalog 8c4a0f8→dd929cba (Record 5 first-print observation(s) via resolve_pending.py #361) gives exactly 56bb47bc…→b06bf665… with the five DoD enrichments Fold the 2026-10-17 DoD first prints: review fy2026 strips, move the anchor #363 listed. Catalog 7adcc72→61475bf8 (Record 5 first-print observation(s) via resolve_pending.py #369) gives b06bf665…→d5b88530… with the five enrichments Fold the 2026-10-19 USAspending first prints: review fy2026 strips, move the anchor #371 listed. identity_anchor_problems accepts both.

Review round 1 (in-session Opus)

• Fixed: the forged-origin gap above (P2), and a non-string event kind now produces a problem instead of raising.
• New tests: the review's forged-origin case, a property that a move continues the base exactly when it starts from the base's pin, the CLI, and malformed kinds.

Review round 2 (hard tier, served by Opus 5.5)

• P3-1: a machine move over a catalog that repeats a row or a UUID is now reported. The digest covers the list with its duplicates, while the undo works on sets.
• P3-2: a mint that repeats an identity the prior catalog already binds is reported.
• P3-8:
  • The continuity step leaves a new branch's first push to its pull-request run. Such a push has no comparison base of its own, and a branch cut before the latest machine move would compare an older move with today's pin.
  • The CLI treats a missing anchor fixture as nothing to check.
  • thesis#377 now requires both Arch checks runs under its "refuse" policy, so a skipped push run can't stand in for the pull-request check.
• P3-11: the soundness property is parametrized over its 13 mutations, so a mutation Hypothesis can never exercise fails. The append generator binds each identity once, as a real catalog does.

Review round 3 (hard tier, Opus 5.5)

• P3-B: two mints of one identity in a single move, or a placeholder enriched onto an identity already bound, used to pass the mint-collision check. A machine move now requires every identity in the current catalog to be bound once. Real catalogs meet this: 221 rows and 221 identities at every commit checked. Two new parametrized mutations cover these cases, and each fails without the check.

Review rounds 4 and 5 (hard tier, Opus 5.5): APPROVE WITH NITS

The mint-reuse and mint-collision checks are marked defensive, since the uniqueness rule makes them unreachable. Round 5 confirmed this at ad7f54c, with no P1 or P2.

Verification

• Local, targeted (disk pause Add state IRS SOI source packages #9, so no full suite here): the new tests, test_doctests_pass, test_committed_catalog_is_current_and_valid and the fixture well-formedness test pass (7 passed). The full file runs in Arch checks on this PR.
• ruff: no new findings against the base.

No ledger bytes change.

🤖 Generated with Claude Code