fix: receipt freshness binds to tree content instead of commit reachability

[levifig]

Change

docs/changes/20260728-receipt-tree-binding/ — target_release: 2.0.0

What & Why

Shapes the receipt freshness rebinding: validity moves from commit reachability to content digests. Today receipts/verify.json records a verified_commit and the gate walks verified_commit..HEAD — after a squash or rebase merge plus branch deletion that commit is unreachable on every machine but the author's, so the same repo content blocks with a clean reason locally and crashes with a bare exit status 128 on CI. The council also proved two deeper defects: cohorts of N≥2 are unsatisfiable under the current rule (each member's receipt commit stales the others, in every ordering), and verify attests worktree results under a HEAD label. The fix: a masked root-tree digest over a declared exclusion set (receipts repo-wide ∪ report boards ∪ the exported releaseMetadataAllowlist), making designation-legal ⟺ receipt-neutral; schema v2 receipts; a pure freshness predicate with typed reasoned verdicts; reachability retired from the verdict entirely.

Review focus

The gating-scope decision (masked root tree over folder scope — 3:2 council split, owner-settled; board committed in reports/), the exact digest serialization (Decision 8 — quotePath/sort/mode/case pinned), the deliberate drop of touch-then-revert detection (Decision 4), and the dirty-worktree refusal at verify.

Verification

All four V-entries green via loaf change verify with the schema-v2 receipt committed at HEAD — this change's own receipt is the first v2 receipt, and it survived a post-verify amend intact (verified_commit no longer exists; the content-bound verdict did not change). loaf change check: zero violations, derives verified. Five review rounds are recorded as boards in reports/: initial review (six findings), Codex gpt-5.6-sol xhigh continued-thread (three findings, incl. the mid-verify mutation and re-verify sweep defects), and Codex fresh-thread (four findings, incl. the submodule-ignore and HEAD-move bypasses) — thirteen findings total, all dispositioned, fixed, and re-verified. The council board (five lenses, decision recorded) is at reports/20260728-222942-council-receipt-freshness.html.

Migration / breaking changes

Schema v2 is a clean break: v1 receipts are refused with a named re-verify remedy (zero receipts exist anywhere today, so nothing is grandfathered). The cannot inspect receipt error path is deleted, not just avoided.

Deferred

CI-green-at-HEAD assertion, rc-cut gating, and the designation diff check — the release-promotion-model Change consumes this change's exported boundary for them (PR #143); per-change evidence_paths (only if a real case appears); rc-sweep command dedup (only when a cohort is big enough to feel it).