Validate that a changed page only gained a decision log entry

[sameera]

As a maintainer of the concept store, I want a validator mode that proves a page changed in no way except gaining one decision log entry, so that the razor is enforced mechanically instead of by asking a human to judge which kind of change they made.

Acceptance Criteria

• Given a page whose only change against the base is one appended decision log entry, when the validator runs --append-only-log --base <ref> <page paths...>, then it exits 0 and reports no finding.
• Given a changed path whose git status against the base is added, deleted, or renamed, when the validator runs in append-only-log mode, then it exits non-zero and the finding names the status that failed.
• Given a page path that does not resolve at the base reference, when the validator runs in append-only-log mode, then it exits non-zero.
• Given a page that gains one decision log entry and also changes a Key Invariant, a Summary sentence, a touches value, an aliases value, a domain value, a status value, an Integration Points bullet, or any earlier log entry, when the validator runs in append-only-log mode, then it exits non-zero and the finding describes the change as altering what the page asserts rather than adding to its history.
• Given a page that gains zero decision log entries, or more than one, when the validator runs in append-only-log mode, then it exits non-zero.
• Given a page whose only difference outside the appended entry is the last_updated_by: frontmatter line or trailing whitespace, when the validator runs in append-only-log mode, then it exits 0.
• Given the validator is run without --append-only-log, when it validates the same pages, then every existing check and its exit behavior are unchanged.

Notes

The byte-identity check needs no list of forbidden fields, which is why it is stated as a comparison rather than as an enumeration. Truncate the page at the line where the gained heading starts, remove the last_updated_by: line, normalize trailing whitespace, and compare the result byte for byte against the base content. Every forbidden edit lands inside the compared region, so nothing has to be enumerated and nothing can be forgotten.

The mode reuses the helpers the validator already has for reading a file at a git reference, counting decision log headings, and parsing frontmatter.

This story ships the check. Wiring it into the drain is a separate story.

story_type: system · size: M