The diff touches no content, no citations and not AGENTS.md. It answers review note #434 with a fix on the record, which is the process §3.15 prescribes for a lone objection. In `engagedChecks` the only behavioural change is for edition-verb drafts that carry `shownChecks`: before, the stamp alone decided what was in hand, so `shownChecks: []` let every earlier check vouch (the removed test asserted exactly that). Now every check not provably made after the draft is always engaged and stamps only add to that set, which strictly narrows the checks that can ratify a draft; this strengthens the independence check rather than weakening it. The rewritten tests match this: empty or short stamps now give 'unratified' with all five earlier checks engaged, and the 'one fresh check' case now needs a check actually dated after the draft, not an earlier one merely left out of the stamp. `stampErrors`, wired into `checkIntegrity`, throws a ContentError on any `reconciles`/`shownChecks` id that names no run or a non-check, and a test runs it over the real ledger, so fail-closed dangling-ID validation grows. The DECISIONS entry is appended, not rewritten, and it says outright that the founder has not reviewed these changes, so its 'Supervised-by' stamp does not present AI work as human-reviewed. A minor note, not a violation: for non-edition reconsiderations the pre-existing rule that any stamp switches off the clock is kept, so the docstring's general 'a stamp can never take from the set' holds strictly only for edition-verb drafts and could be tightened later.

The change closes a fail-open path: `engagedChecks` now treats stamps as additive and continues to count checks made before an edition draft, so an empty or incomplete `shownChecks` list cannot erase prior scrutiny. `stampErrors` also fails loading when `reconciles` or `shownChecks` names a missing run or a non-check run in the case, strengthening exact provenance and dangling-ID validation. Tests cover empty and partial stamps, later named checks, non-edition drafts, invalid IDs, and the existing ledger. The decisions entry records the rationale and distinguishes the founder’s dated direction from review of this particular change; nothing shown edits the constitution, introduces citations, or weakens a §3.15 check.

The change closes a governance loophole identified in review note #434 where an empty or malformed `shownChecks` list could allow a draft to bypass checks made before it. In `src/domain/standing.ts`, `engagedChecks` now ensures that checks in hand prior to the draft are always engaged regardless of stamps, with stamps only able to add to engaged checks rather than subtract. Furthermore, `stampErrors` in `src/domain/load.ts` enforces referential integrity by requiring that all IDs in `reconciles` and `shownChecks` resolve to actual check runs of the same case, upholding §3.8, §3.15, §4, and §8 without weakening any epistemic safeguards.

The diff tightens ratification under §3.15: engagedChecks now fails down so shownChecks/reconciles can only add checks in hand and never clear earlier ones, and stampErrors refuses dangling or non-check stamp ids at load. That closes the fail-open path the prior empty-stamp behavior allowed, rather than weakening any check. No AGENTS.md edit, no content/ citations, no confidence material, and the DECISIONS entry honestly stamps the founder direction date and that the founder has not reviewed these changes. Tests and schema comments match the new rule.

This change strengthens, not weakens, the §3.15 checks: the previous `shownChecks` logic failed open (an empty or wrong stamp let a verb-drafted draft clear checks made before it, as the old test asserted), and the new `engagedChecks` fails down — the clock establishes what was in hand and stamps can only add, never subtract — while the loader now refuses dangling or non-check stamp ids, fail-closed, with a test that walks the real ledger. No AGENTS.md edit occurs; only docs/DECISIONS.md is appended, which is the operating record the workflow requires. The DECISIONS entry is candid about provenance: it answers the Anthropic seat's date question directly, distinguishing the 2026-09-29 direction date from the 2026-09-30 work, and states explicitly that the founder has not reviewed these changes and the panel has — so no AI record is presented as a human one. No content/ changes, no citations added, no omitted files, and no run records to audit. The decision not to require stamps to list every earlier check is argued on the record (a cross-branch check would make a true record unloadable) and errs strict, since the standing counts such a check as in hand anyway.