- Bump controller_work to v9 so a checkpoint from before the
session_command_id derivation change refuses to open, and document why
no migration exists.
- Make a malformed GHOSTLIGHT_CONSUMER_CREDENTIALS file fail startup
instead of warning into an empty registry.
- Redact ConsumerPatchDocument's secret from its Debug impl.
- Route the elaboration lane's draft through the same check_patch_caps
the consumer ingress uses, closing the unenforced MAX_PATCH_EVIDENCE gap.
- Give the three item-cap refusals their own ConsumerRefusal variants
instead of flattening them into TooLarge.
- Delete journal_replay_refuses_a_forged_consumer_row, now covered by
soul_a_forged_decision_event_on_a_mirror_is_refused_at_replay.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
8173c9cb77