Accept ADR 0010; enforce the golden vector; decide R3, R4 and R15

Two strands from parallel work, landing together.

ADR 0010 accepted, closing D6 (D26). Of D6's three gates, two were
already met - C4's not-a-qualified-e-signature wording ships on both
signing pages, and required-role semantics are ADR 0018 section 9. The
third was not: D6 assumed the golden vector was a test, but it was a
console.log that printed one line to a typically-unread server console
and then kept sealing packages with hashes no independent verifier
could reproduce. verifyGoldenVector() now lives beside the serializer,
POST /api/turnover/build REFUSES on mismatch rather than sealing
unverifiable evidence, and smoke_test.sh asserts the algo, digest
shape, hash determinism across a rebuild, and supersession. The refusal
path was verified by deliberately drifting the vector. Deliberately not
a throw at load: a drifted turnover canonicalizer must not take down an
instance serving QR scans, LOTO status and field checks. The D12
contract bump is explicitly not a precondition and stays M3 work.

R3 -- a caveated pass is a derivation, not a state (section 4). No
pass_with_exception; five states stay five. A pass renders as pass with
exception when it carries a LINKED CONSEQUENCE - a punch item or a
section 13 restriction - not merely a non-empty note. Two changes from
the original recommendation: notes are common and mostly benign, so a
badge firing on all of them is one nobody reads; and "pass + note +
punch item" would have missed the clearest case in the source, where
there is no punch item and never will be because the workaround is
permanent and nobody owes work. Section 13 is what completes it.
Residual risk named and accepted: a caveat written as prose with
nothing linked stays invisible, and that is NOT mitigated by nudging on
every noted pass, because a warning that fires on benign notes is one
that gets clicked through.

R4 -- not_performed carries a reason from a closed vocabulary (section
4): conditions_unavailable, access_blocked, equipment_unavailable,
satisfied_by_other_evidence, out_of_scope, other. other requires free
text; satisfied_by_other_evidence takes an optional satisfied_by
relation, without which it is a nicer-sounding blank. out_of_scope
complements section 6's scope-gap punch item rather than replacing it -
the line says why the check was not done, the punch item says someone
still owes the work.

R15 absorbed into R4 and reclassified. It is not a third meaning of
N/A: the check applies, so na was never right. It is not_performed with
satisfied_by_other_evidence. That the source wrote N/A is the finding,
not a mistake to correct past - people reach for N/A when nothing
better exists, the same no-home-for-this-fact pattern as R9.

D25 reconciled with D26: the fold decision is unaffected, but its
precondition is now enforced by the build route rather than by a
reviewer remembering to check. Both new R4 fields join the section 15
fold; the R3 derivation adds no hashed field.

Author: mds08011

docs/DECISIONS.md

@@ -312,10 +312,16 @@ gate is a check).
 **Decision.** ADR 0018's eight hash-affecting manifest additions land in **one
 pass, into `sha256-canon-v1`**, before any real package is signed — not behind a
 `sha256-canon-v2`. D6 is **amended, not reversed**: the canonical form and
-manifest allowlist are unfrozen for this fold, while ADR 0010's *acceptance*
-stays blocked on its own gates (the "not a qualified e-signature" wording C4,
-required-role semantics, and the D12 contract bump). ADR 0010 stays **Proposed**
-with a completed allowlist. Partial folds are forbidden — each addition alone
+manifest allowlist are unfrozen for this fold, while ADR 0010's *acceptance* is a
+separate act on separate gates (the "not a qualified e-signature" wording C4,
+required-role semantics, and the D12 contract bump). ~~ADR 0010 stays
+**Proposed** with a completed allowlist.~~ **Superseded the same day by
+[D26](#d26--adr-0010-accepted-the-golden-vector-was-not-a-test-until-it-was-made-one):
+ADR 0010 was accepted** — C4 and required-role semantics were already met, and
+D12 is explicitly not a precondition. **The fold decision is unaffected**; what
+changed is that D26 also made the golden vector enforceable at the build route,
+so this entry's precondition is now checked by code rather than by a reviewer
+remembering. Partial folds are forbidden — each addition alone
 changes the canonical bytes, so piecemeal shipping means several silent breaks
 instead of one deliberate one. The golden vector is regenerated as the
 acceptance test.
@@ -335,3 +341,67 @@ only one of them gets more expensive with delay.
 **Rejected.** Accepting ADR 0010 wholesale (its legal and contract gates are
 untouched by this work); minting `sha256-canon-v2` (no history to protect).
 **Cross-ref.** ADR 0018 §15 and open question 5; ADR 0010; D6, D12.
+
+### D26 — ADR 0010 accepted; the golden vector was not a test until it was made one
+**Decision.** **ADR 0010 (Signatures & the turnover package) is Accepted**
+(2026-08-04), closing [D6](#d6--adr-0010-signatures--turnover-stays-proposed-and-frozen)'s
+freeze and resolving open question #5. Acceptance covers the *design*: the
+frozen snapshot, the canonical hash, supersession, and the attestation model.
+It explicitly does **not** perform the D12 contract bump — `turnover_packages`
+and `signatures` stay `delta; ADR 0010` in `docs/API.md` until M3.
+**What the gates turned out to be.** D6 named three. Two were already met and
+merely unrecorded: the "not a qualified e-signature" wording ships on both
+`sign.html` and `turnover.html`, and required-role semantics are ADR 0018 §9.
+The third was **not met, and D6 assumed it was** — the golden vector was a
+`console.log` at hook load, not a test. On canonicalizer drift it printed one
+line to a server console (on a trailer Pi, an unread one) and kept sealing
+packages with hashes no independent verifier could reproduce. That is worse than
+having no seal: an unverifiable hash on a signed turnover package looks like
+evidence and is not.
+**Fixed as part of accepting, not deferred.** `verifyGoldenVector()` moved beside
+the serializer in `turnover_canon.js`; `POST /api/turnover/build` **refuses**
+with an explicit message on mismatch rather than sealing unverifiable evidence;
+`scripts/smoke_test.sh` asserts the pinned algo, the digest shape, **hash
+determinism across a rebuild of an unchanged scope**, and supersession (89 → 94
+assertions). The refusal path was verified by deliberately drifting the vector
+and confirming the build fails.
+**Deliberately not a throw at load.** A drifted *turnover* canonicalizer must
+never take down an instance whose first job is QR scans, LOTO status, and field
+checks. "Never cripple the field tier" outranks failing fast about an office
+deliverable, so the blast radius stays scoped to builds. This is the same
+asymmetry ADR 0007 applies to LOTO, pointed the other way.
+**Rationale.** This work is test hardening, not feature work, so it does not
+violate [D2](#d2--trust-before-features-m1-comes-first) — it is exactly M1's
+goal (prove the invariants) applied to the one invariant that had been asserted
+in prose and nowhere else.
+**Cross-ref.** ADR 0010; ADR 0018 §§9, 15; D6, D12, D25; open questions #5, #13.
+
+### D27 — The asset behind a position is an appended event, not a second identity
+**Decision.** Open question #12 (asset vs. position) is **resolved** by a small
+append-only **`equipment_events`** ledger on the tag — `kind` (replaced /
+rebuilt / reinstalled / relocated / nameplate_corrected), nullable
+`serial_before` / `serial_after`, occurred-at, who, note — plus a **derived**
+re-verify marker: any phase whose standing rests entirely on checks older than
+the tag's latest event renders as "passed before the {date} {kind} event." A
+marker, never a downgrade; the pass stays in the ledger. No `equipment_assets`
+collection, no second identity, no identity scheme. It is a scope item inside
+**M5.3**, not its own milestone or ADR (ADR 0018 §16).
+**What decided it.** The obvious design — an asset keyed on serial number —
+fails on contact with the source: **actuator serial number reads "N/A" on all
+six valve reports.** A whole equipment class has no identity to key on. The real
+requirement was never asset lifecycle; it is "a phase passed by a machine that
+was later pulled apart must not read as current," which is a derivation over
+dates. The source has the case live: a pump found with a frozen impeller,
+removed, rebuilt, and re-installed **between the clean-water and seeding
+phases**.
+**What this gives up, deliberately.** You cannot ask "where has serial X been
+installed over time," or follow one machine between positions. That is asset
+management and belongs in an ERP or a materials product, consistent with the
+standing refusal to become an ERP. Recorded as a conscious trade; if spares
+pools or rotating equipment ever matter, these events are the substrate the
+heavier model would be built on.
+**Rejected.** An `equipment_assets` collection with an install/remove ledger
+(holed on day one by unserialised assets, and it would touch the identity of
+every record pointing at a tag); a stored "needs re-verification" flag (status
+that drifts).
+**Cross-ref.** ADR 0018 §§11, 16; open question #12; ROADMAP M5.3.

docs/ROADMAP.md

@@ -73,14 +73,16 @@ this is the index.
   append-only apply/release, derived lockout, staleness asymmetry, no green
   state. A visibility layer, never part of the energy-control decision. Free
   permanently — safety visibility is never paywalled.
-- **Signatures & Turnover** ([ADR 0010](adr/0010-signatures-and-turnover-package.md), **Proposed/frozen** — [DECISIONS.md D6](DECISIONS.md#d6--adr-0010-signatures--turnover-stays-proposed-and-frozen)) —
+- **Signatures & Turnover** ([ADR 0010](adr/0010-signatures-and-turnover-package.md), **Accepted 2026-08-04** — [DECISIONS.md D26](DECISIONS.md#d26--adr-0010-accepted-the-golden-vector-was-not-a-test-until-it-was-made-one)) —
   server-built frozen turnover snapshot + content hash, `sign.html`,
-  `turnover.html`, shared `lc-auth.js`/`login.html`. Implemented but not
-  formally accepted; no further work this cycle.
+  `turnover.html`, shared `lc-auth.js`/`login.html`. The golden vector is now
+  **enforced at the build route and asserted by the smoke test** (it was a
+  `console.log` until acceptance). The API v1 contract bump is **not** included
+  and remains M3 work ([D12](DECISIONS.md#d12--api-v1-reconciliation--version-bump-sequenced-to-m3-v10)).
 - **Selective auth + PII split** ([ADR 0011](adr/0011-auth-lockdown.md), **Accepted**) —
   public scan/reads and the deliberate accountless flag/check/LOTO/calibration
   creates survive; office writes and PII reads require an account; the
-  89-assertion smoke test asserts the matrix across guest/user/superuser.
+  94-assertion smoke test asserts the matrix across guest/user/superuser.
 
 **Shipped schema without UI (deliberately parked, not roadmap items):** segment
 acceptance (owned by MainLine — [D10](DECISIONS.md#d10--segment-acceptance-is-owned-by-mainline-correction-of-record)),
@@ -121,8 +123,9 @@ validated — all gated by CI. No new features
   all wait for M2+.
 - The formal API v1 version bump (that is M3 — [D12](DECISIONS.md#d12--api-v1-reconciliation--version-bump-sequenced-to-m3-v10)).
   M1 only makes the *documentation* of the current collection set truthful.
-- Accepting ADR 0010, building any parked schema's UI, or a general offline
-  layer.
+- ~~Accepting ADR 0010~~ (**done 2026-08-04, D26** — the code half was
+  golden-vector test hardening, which *is* M1's goal; the decision half cost no
+  build work), building any parked schema's UI, or a general offline layer.
 
 **Definition of done (testable)**
 - [x] `grep -ri "linecheck" docs/ *.md` returns only historical/superseded
@@ -568,8 +571,23 @@ One tag number appeared for two different valves in a vendor report —
 undetectable on paper. Equipment also got pulled, rebuilt, and reinstalled
 mid-startup with nothing prompting re-verification.
 
-- **Data model (this milestone).** None. All three checks below are
-  derivations over data that already exists.
+- **Data model.** One small append-only collection, **`equipment_events`**
+  (ADR 0018 §16, resolving open question #12): `project` · `tag` · `occurred_at`
+  · `kind` (`replaced` / `rebuilt` / `reinstalled` / `relocated` /
+  `nameplate_corrected`) · `serial_before` / `serial_after` (**both nullable**)
+  · `performed_by` · `vendor_company` · `note` · `client_token`.
+  `updateRule: null`, `deleteRule: null`, public create. The four validation
+  checks below need no schema at all.
+- **The re-verify marker is derived.** Any phase whose standing rests entirely
+  on checks **older than the tag's latest event** renders as "passed before the
+  {date} {kind} event." A marker, never a downgrade — the pass stays in the
+  ledger, and nothing is stored. The frozen turnover package carries the same
+  marker. **No `equipment_assets` collection and no second identity:** the
+  source's actuators carry no serial number at all, so a serial-keyed asset
+  model is holed on day one, and the real requirement ("a phase passed by a
+  machine later pulled apart must not read as current") is a derivation over
+  dates. Asset-history tracking — "where has serial X been installed" — is a
+  **conscious loss**, recorded in [D27](DECISIONS.md#d27--the-asset-behind-a-position-is-an-appended-event-not-a-second-identity).
 - **UI — four checks, not three.** (a) **Unknown-tag warning** wherever a tag
   number is *typed* rather than picked — vendor visit capture, vendor tag-list
   import, open-items text — resolved against the project's tag register,
@@ -590,13 +608,11 @@ mid-startup with nothing prompting re-verification.
 - **Validation.** Deliberately **no unique index on `serial_number`**: blanks
   are the norm and a duplicate is a finding to investigate, not a write to
   reject.
-- **Deferred to its own ADR.** The true **asset-vs-position split** — `tag` as
-  a P&ID position, the serial-numbered machine as an asset with an append-only
-  install/remove ledger, and the re-verification prompt ("this position's asset
-  changed on {date}; phases passed before that date were passed by a different
-  machine"). It changes the identity of every record pointing at a tag and must
-  not be improvised inside a validation task. See
-  [open-questions #12](open-questions.md#12-does-loopcheck-model-the-asset-separately-from-the-position).
+- ~~**Deferred to its own ADR.** The true asset-vs-position split…~~
+  **Resolved 2026-08-04** — see the `equipment_events` bullets above. The heavy
+  `equipment_assets` model was rejected, not postponed:
+  [open-questions #12](open-questions.md#12-does-loopcheck-model-the-asset-separately-from-the-position),
+  [D27](DECISIONS.md#d27--the-asset-behind-a-position-is-an-appended-event-not-a-second-identity).
 
 **M5 definition of done (testable)**
 - [ ] No `check_item` can be created with `result = "na"` and no reason; the
@@ -844,15 +860,15 @@ Status of each, per the 2026-07-21 planning session:
 | 2 | Continue Phase 6 segments? | **Decided** — no; MainLine owns ([D10](DECISIONS.md#d10--segment-acceptance-is-owned-by-mainline-correction-of-record)) |
 | 3 | Preservation ownership | **Open** — resolve boundary vs TrenchNote before any preservation UI ([D7](DECISIONS.md#d7--preservation-adr-0015-and-vendor-visits-adr-0017-uis-are-parked)) |
 | 4 | Portable identity scheme | **Deferred** — gate before first handoff ([D11](DECISIONS.md#d11--portable-identity-scheme-deferred)) |
-| 5 | Accept ADR 0010? | **Deferred** — stays Proposed/frozen ([D6](DECISIONS.md#d6--adr-0010-signatures--turnover-stays-proposed-and-frozen)) |
+| 5 | Accept ADR 0010? | **Resolved** (2026-08-04) — **Accepted**; the golden vector was a `console.log` and is now enforced + tested ([D26](DECISIONS.md#d26--adr-0010-accepted-the-golden-vector-was-not-a-test-until-it-was-made-one)) |
 | 6 | Auth access matrix | **Resolved** — ADR 0011 Accepted |
 | 7 | API v1 reconciliation | **Scheduled** — M3 ([D12](DECISIONS.md#d12--api-v1-reconciliation--version-bump-sequenced-to-m3-v10)) |
 | 8 | Offline guarantee | **Doc now, code deferred** ([D13](DECISIONS.md#d13--offline-document-guarantees-now-build-no-second-queue)) |
-| 9 | Min free turnover artifact | **Deferred** with #5; principle recorded (B5) |
+| 9 | Min free turnover artifact | **Open** — no longer *blocked* by #5 (now resolved), but not decided by it either; principle recorded (B5) |
 | 10 | Deployment topology | **Doc now** (label honestly), Pi validation M3 ([D14](DECISIONS.md#d14--deployment-topology-labeling)) |
 | 11 | Startup phase vocabulary | **Open, likely closeable** — ADR 0018 §1's two additive phases match the source sequence exactly; the dry-check and I/O-check reports map cleanly onto the existing four |
-| 12 | Asset vs. position identity | **Open, and live** — the source has a pump removed, rebuilt with new seals, and re-installed *between* the clean-water and seeding phases. Not hypothetical; needs its own ADR |
-| 13 | Turnover hash versioning | **Open** (2026-08-04) — fold ADR 0018's manifest additions into `sha256-canon-v1` before the first signed package, or plan a v2. Decide **with** #5 |
+| 12 | Asset vs. position identity | **Resolved** (2026-08-04) — an appended `equipment_events` fact + derived re-verify marker; no second identity. Asset-history tracking is a conscious loss ([D27](DECISIONS.md#d27--the-asset-behind-a-position-is-an-appended-event-not-a-second-identity)) |
+| 13 | Turnover hash versioning | **Resolved** (2026-08-04) — one fold inside `sha256-canon-v1`, no v2; partial folds forbidden ([D25](DECISIONS.md#d25--d6-amended--the-turnover-manifest-folds-into-sha256-canon-v1-now)). Precondition still live: no signed package may exist when it ships |
 
 **Unresolved for the maintainer to answer eventually** (not blocking M1): #3
 (preservation ownership) and #4 (identity scheme) both need a maintainer/domain

docs/adr/0010-signatures-and-turnover-package.md

@@ -1,6 +1,39 @@
 # ADR 0010 — Signatures & the turnover package: a signed, frozen snapshot over the append-only ledger
 
-**Status:** proposed · **Date:** 2026-07-10
+**Status:** **accepted** (2026-08-04) · **Date:** 2026-07-10
+
+> **Accepted 2026-08-04** by maintainer decision, resolving
+> [open-questions #5](../open-questions.md) and closing
+> [D6](../DECISIONS.md#d6--adr-0010-signatures--turnover-stays-proposed-and-frozen)'s
+> freeze. D6 named three gates; here is where each landed:
+>
+> 1. **Golden-vector / canonicalization test — NOW MET, and it was not before.**
+>    D6 assumed the fixture was a test. It was a `console.log`: on drift it
+>    printed one line to a server console (a trailer Pi's, typically unread) and
+>    kept sealing packages with hashes no independent verifier could reproduce.
+>    Fixed as part of this acceptance — `verifyGoldenVector()` moved beside the
+>    serializer, `POST /api/turnover/build` **refuses** on mismatch rather than
+>    sealing unverifiable evidence, and `scripts/smoke_test.sh` asserts the algo,
+>    the digest shape, **hash determinism across a rebuild**, and supersession.
+>    The refusal path was verified by deliberately drifting the vector and
+>    confirming the build fails. Deliberately *not* a throw at load: a turnover
+>    canonicalizer must never take down an instance serving QR scans, LOTO
+>    status, and field checks — the blast radius stays scoped to builds.
+> 2. **Required-role semantics — MET by design.**
+>    [ADR 0018 §9](0018-multi-vendor-startup-evidence-model.md) defines them:
+>    `required_signature_roles` is template data frozen onto the check, the
+>    missing-countersignature list is derived, and the roles come from the GC's
+>    template **never** from whatever the vendor's paper happened to provide.
+> 3. **Legal wording (C4) — MET in shipped code.** Both `sign.html` and
+>    `turnover.html` carry the "records an attestation, not a qualified
+>    electronic signature" caveat on the page, not only in this ADR.
+>
+> **What acceptance does NOT do.** It does not perform the D12 contract bump —
+> `turnover_packages` and `signatures` stay marked `delta; ADR 0010` in
+> [docs/API.md](../API.md) until M3 reconciles the whole collection set. An
+> accepted ADR is a settled *design*; the published *contract version* is a
+> separate act with its own sequencing. Do not read this Status line as a
+> contract guarantee.
 
 > **The manifest allowlist and canonical form are unfrozen for one fold**
 > (2026-08-04, DECISIONS **D25** amending D6). ADR 0018 adds eight
@@ -16,13 +49,18 @@
 > regenerated as the acceptance test; **partial folds are forbidden**, since
 > each addition alone changes the canonical bytes.
 >
-> **This does not accept ADR 0010.** C4's on-page wording, required-role
-> semantics, and the D12 contract bump still gate acceptance.
+> ~~**This does not accept ADR 0010.** C4's on-page wording, required-role
+> semantics, and the D12 contract bump still gate acceptance.~~
+> **Superseded 2026-08-04** — see the acceptance block at the top of this file.
+> C4 and required-role semantics are met; the D12 contract bump is explicitly
+> *not* a precondition of acceptance and remains M3 work.
 
 **Implementation status (committed + review-hardened, 2026-07-12):** the
 migration (`turnover_packages` + `signatures`, `1789000026`), the server
 builder/canonicalizer (`pb_hooks/turnover.pb.js` + `turnover_canon.js`, with a
-golden-vector self-check on load), the auth helper (`lc-auth.js` +
+golden-vector check enforced at build time and asserted by the smoke test —
+see the acceptance block; it was load-time-log-only until 2026-08-04), the auth
+helper (`lc-auth.js` +
 `login.html`), and the signing/turnover pages (`sign.html`, `turnover.html`)
 are in the committed baseline and were hardened by a code-review pass
 (single scoped `check_items` query, `//`+`/\` open-redirect guard,