Ten test-only additions, no production source touched.
- mailbox: the end-to-end proof the kernel-level test does not give — a
controller turn bound at revision N commits through the mailbox after an
unrelated commit at N+1, and a stamped body still fails closed on a
foreign scope.
- world: the scope preimage excludes revision, phase, a place declared
elsewhere, a non-incident route, and another subject's Position, across
real commits; a forged affordance list cannot widen authority.
- patch: RouteSelfLoop, UnplacedSubject, and NoOperationEffect are each
reachable; a forged relocate effect dies at apply time on all three
preconditions; RefKind is not a serializable shape.
- journal: forged store rows carrying a self-loop, an out-of-range cost, a
non-place endpoint, or a stray position are refused by recover, and a
pre-topology row type is refused outright.
- controllers: the typed view carries only the actor's own place and the
routes incident to it.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
e99af63f9a