D1 is confirmed, not assumed. The controls exist and are strong: all ten
mutation seams table-driven with byte-for-byte restoration of six artifacts,
new-seat rollback leaving no residue, and ROLLBACK_INTEGRITY escalation across
three parent-substitution attacks with recovery evidence written.
This corrects a wrong finding of mine. I reported that eleven injectFailure
seams existed in production and zero tests used any of them, and that D1's
rollback path had never executed. The grep behind that searched for the
identifier `injectFailure` in the specs; the specs pass the injector as an
inline lambda, so the controls were present and the search could not see them.
I was one step from writing a duplicate spec. Recorded with the method note --
grep the production seam names, not the parameter name.
One narrow gap left standing rather than papered over: nothing asserts the
in-memory restoration of plan.managedLinks.links to manifestLinksBefore. The
filesystem is checked, the plan object is not. It matters only if a caller
reuses a plan after catching a failure, which nothing does today, so it is
defence-in-depth and is noted for when D2/D4/D6 are confirmed.
Remaining amendment item is now D2/D4/D6 confirmation; D3 and D5 are closed.
Commit-only per scrappy's controlling packet (comms 20260813T212447Z dc43de):
not pushed, PR #1213 not updated, nothing re-authored.
fred
5cce40ff8b