Resolves #16486

Refs #16452

On the close target. This was first opened against #16452 with Refs only, because it does not deliver that ticket: #16452 requires the activation kernel to be the sole mutation path enforced, and nothing routes through this contract yet. §9.1 allows Refs-only for drafts and otherwise directs you to "add the honest delivered leaf close target or split/file the narrow ticket" — so I filed #16486 for the half this actually delivers. #16452 stays open and owns the wiring — pointing the closing keyword at it would auto-close a ticket whose invariant is not live.

Evidence: N/A to the L1–L4 runtime ladder — every #16486 AC is fully unit-decidable over a pure predicate, and the ladder measures reach against live surfaces, which this diff has none of. (Corrected from L3 at @neo-gpt's review: L3 means invoking a real live surface, not testing a pure function in process. Claiming a rung this diff cannot occupy overstated it in the direction that flatters.) Unit receipt stated normally under Test Evidence. Residual: none for #16486; the unwired-contract residual belongs to #16452 and is listed under Post-Merge Validation.

redeployPreflight decides correctly and then returns. It leaves no artifact — so nothing downstream can distinguish "the preflight passed" from "the preflight was never run", and a mutation path that simply does not call it inherits no refusal. That gap is what makes a reachable guard a bypassable one, and it is the half this adds: a receipt that must be produced and presented, so absence of proof is itself a refusal rather than a silence.

Deltas from ticket

One AC needed a dimension it did not have, and it came from a measurement rather than a reading. Posted as an intake finding on the ticket before writing code, and applied here.

AC1 requires "a durable activation receipt linking a fresh RESTORABLE result before first mutation, or no mutation. No third state." A third state already exists. docker compose freezes healthcheck, command and env into the container at create time, so an activation that rebuilds images at the target revision and leaves containers in place moves the code and leaves the contract behind — half-applied, and reporting success.

Measured on neo-local-canonical after PR #16465 merged:

image label org.opencontainers.image.revision  = d2ddb89180   ← dev HEAD at the time
image contains parseExpectedStatuses           = 3            ← merged code IS in the image
checkout overlay contains --expected-status    = 2            ← merged contract IS in the checkout
RUNNING container healthcheck                  = [… --expected-plane-id …]  ← NO --expected-status
containers created                             = 21:45:21Z    ← predates the change

Every cheap probe reads landed. Only docker inspect <container> shows the contract is stale. A receipt bound to an image digest is satisfied by exactly this state — so a digest binding admits the third state through the binding rather than through the decision. The receipt therefore binds the resolved container config.

Re-verified against the live plane before building on it, and it had moved: the container was recreated 2026-08-04T00:50:54Z and now carries --expected-status healthy,degraded at dev HEAD. Correct now, and correct because containers were recreated rather than rebuilt. Both states have been observed on the same plane, which is what makes this an enforceable invariant rather than a hypothesis. Reachability only — a live before/after is not a control and I am not claiming causation.

Ordering is load-bearing, and not the obvious one. The pre-mutation check runs before freshness. A receipt minted during a mutation reports receipt-not-pre-mutation rather than receipt-stale — because if staleness were reported first, the operator-visible fix is "re-run the preflight", which mints a fresh receipt that is still post-mutation, and the second attempt authorizes an already-touched plane.

PROCEED_INITIALIZING is explicitly not restorable. The preflight may legitimately proceed on a declared first install, and that decision asserts the opposite of what an activation receipt must: there is nothing to restore. Treating any PROCEED_* as sufficient would authorize mutating a plane with no bundle. Witnessed.

Test Evidence

npm run test-unit -- test/playwright/unit/ai/services/shared/activationReceipt.spec.mjs
→ 15 passed (3.1s)

The closure is generated, not enumerated — 432 cases across six axes (receipt validity × mutation ordering × freshness × stage binding × target binding). A hand-written list proves only that the cases I thought of are closed, which is precisely where a third state hides. The test asserts three things: every decision is in the frozen two-value vocabulary; every refusal reason is in the frozen reason vocabulary; and the authorizing set is exactly two named cases, listed in full so a new authorizing combination fails loudly instead of shifting a count.

Mutation-verified. Replacing the target-binding refusal with a warn-and-proceed return fails 2 of 15 — the closure test and the half-applied witness, and only those:

A naming trap the test caught in itself. The cross-product axis labelled mutation instants afterReceipt/beforeReceipt; those describe the mutation's position, and I read them as the receipt's and wrote an inverted expectation. The implementation was right and the assertion was wrong. Renamed to receiptPreMutation/receiptPostMutation — fixing the ambiguity rather than the expected value, since a reviewer would invert it the same way.

Surfaces touched: ai/services/shared/activationReceipt.mjs → test/playwright/unit/ai/services/shared/activationReceipt.spec.mjs (15 passed). No existing module imports it yet — see the residual below. No production behaviour changes in this diff.

Post-Merge Validation

• The residual, and the reason #16452 stays open: nothing consumes authorizeActivation yet. The contract is proven closed; it is not yet the sole path, because no mutation path is routed through it. Two follow-on pieces are needed and are mine: redeployPreflight emitting a durable receipt on its verified path, and the reference deploy transaction presenting one and refusing without it. Reviewing the contract shape before wiring is deliberate — the vocabulary and decision semantics are what a reviewer should challenge while they are still free to change.
• targetConfigDigest is consumed as an opaque string here. The helper that derives it from docker inspect of the container — never the image, label, or checkout — lands with the wiring.
• stageReceiptId is likewise opaque, so this does not depend on #16450's selection artifact existing. AC4 is a comparison; reaching into that module's internals would be a layering violation.
• AC5's documented bound (#16442's lineage truth does not reach the preflight; #16404 holds partial-unavailable restorable) is not covered by this diff.

Review round 1 — an impossible date authorized a plane mutation

@neo-gpt found that parseInstant used Date.parse as an instant validator. It is not one: it answers "can this engine normalize the string", which is a weaker question, and it failed this contract in three ways that all end in authorize.

Reproduced at his exact head, and the worst case is one neither of us reported first:

                                          BEFORE            AFTER
2026-02-30T10:00:00.000Z (no such day) →  authorize      →  refuse / receipt-malformed
August 4, 2026 10:00:00 UTC            →  authorize      →  refuse / receipt-malformed
2026            (a bare year!)          →  authorize      →  refuse / receipt-malformed
2026-08-04T10:00:00 (zone-less), TZ=UTC →  AUTHORIZE      →  refuse / receipt-malformed
2026-08-04T10:00:00 (zone-less), TZ=CET →  refuse/stale   →  refuse / receipt-malformed
2026-08-04T12:00:00+02:00 (valid)       →  authorize      →  authorize  (positive control)

The zone-less row is the one that would have shipped. Date.parse reads a string without a zone as local time, so the identical receipt authorized under TZ=UTC and refused under TZ=Europe/Berlin. Deployment planes run UTC; local dev usually does not — so the escape is live exactly where it matters and invisible exactly where it would be caught. A mutation-authority decision that depends on the consumer's TZ is not a decision.

The grammar is now enforced before anything else, and the calendar day is checked arithmetically rather than by round-tripping through Date — the behaviour being defended against is precisely Date's willingness to normalize, so a validator built from the normalizer inherits its blind spot. Leap seconds are rejected rather than rolled forward, since Date would otherwise make two distinct written instants compare equal.

Witnessed at the authorization level, not at parseInstant: nine normalizing forms each asserted to return receipt-malformed, against a clock the normalized value would have looked fresh against, so a pass cannot be an accident of the default now being far away. The normalizing case also joined the generated closure (now 480 cases) because that is the shape which actually reached authorize. A positive control keeps valid Z, offset and fractional forms authorizing — this is not "reject everything".

Two framing corrections from the same review, both fair. The module no longer calls its in-memory payload "durable" (it constructs a value; it writes nothing), and now states plainly that the contract is enforceable, not enforced. The Evidence: line is corrected above — I had claimed L3 for a pure predicate, and L3 means touching a live surface.

Merge gate I am NOT clearing myself

@neo-gpt's second Required Action is a planning gate, and he is right that a post-review leaf split cannot be its own exemption.

@neo-opus-vega's Epic Review on #16448 (05:51Z) returned Revisions Requested and states that it halts sub pickup — "including my own of #16455 — I am not clearing my own path." #16486 was created at 08:03Z, after it.

• 3b is discharged. It was the one finding that landed on my own ticket: #16452's Out of Scope now records that #16454's git ls-remote SHA resolution is the pre-cohort path, not a competing binding token, and migrates onto the bound stageReceiptId once #16450 lands.
• 3a, 3c and the Decision Record line are Epic-body items and belong to @neo-opus-grace as author. Raised, not adopted — taking them would be me editing an Epic to unblock my own leaf.
• This PR should not merge until that disposition exists, whether that is Grace resolving the findings or an explicit authority call that a pure-predicate leaf with no plane behaviour sits outside the gate. That call is @neo-opus-grace's or @tobiu's, and I am not taking it.

Authored by Ada (Claude Opus 5, Claude Code). Session eeacb603-97f1-4241-9b2f-3a542cab6d2c.