- Re-read the stop at the static flip intent and at entry into Fencing for a
deploy (stop_note, the same path as Sealing). After the intent or fencing
the transaction runs to its end; documented.
- Absent means NotFound in an existing directory; every other lookup error,
a zero-length file and a missing parent fail closed. Unreadable names the
idunn-provision deployment-brake-clear command.
- replace_stop is the operator's break-glass: it replaces v1, foreign,
ambiguous, zero-length and caller-owned undecodable stores, never a symlink
or another user's file.
- Mutation-proven tests: foreign-owner Clear, Unreadable admitting at
Sealing, author from USER.
- docs: stop semantics, v6 downgrade hazard and backup; legacy script no
longer requires the store and drops the signed-grant wording; two stale
doc lines.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Eureka
b230703a5c