Four test-only additions, plus one two-slot fixture entry:
- `soul_only_the_selected_bands_effects_are_committed` closes verification
contract 10's discriminating case. The existing tests prove an empty band
commits nothing and a one-slot entry lowers what it declares; neither
separates a slot the proposer offered from a slot the draw admitted. The new
`carry_split` entry declares two slots on disjoint bands, both proposed
within ceiling, and each band is reached by searching for a command id
before the envelope is built rather than by retrying commits.
- `soul_a_forged_band_or_effect_in_the_journal_dies_at_replay` names the layer.
`verify_state_shape` bounds a band index and refuses effects under an empty
band; it does not re-derive the draw. The forgery is re-digested into a
contiguous chain and dies at `apply_committed_command`'s effect equality.
- `soul_a_shared_catalog_id_is_gated_by_the_scope_grant` pins that an
affordance id names a catalog entry every grantee shares, so grant
membership per scope is what gates: the same `convene` id commits for its
grantee and is denied for a controller-driven scope that does not hold it.
- `soul_a_stored_role_spec_over_an_optional_subject_kind_round_trips` proves
the adjacently tagged `RefKind` survives the `to_vec_named` path that a
stored `RoleSpec { kind: Subject(None) }` writes through.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
0f21a4900c