Authorize M12 provenance epoch 2 baseline

tools/web/check-wbv2-recovery-release-gate.mjs

@@ -17,14 +17,18 @@ const planPath = `${outputRoot}/recovery-task-plan.json`;
 const manifestPath = `${outputRoot}/manifest.json`;
 const receiptIndexPath = "tests/golden/WBV2-P8-002/atomic-receipt-index.json";
 const epochPath = "tests/golden/WBV2-P8-003/m12-provenance-epoch.json";
+const approvalPath = "docs/status/M12-PROVENANCE-EPOCH-2-APPROVAL.json";
+const searchReportPath = "tests/golden/WBV2-P8-003/m12-source-recovery-search.json";
 const p7GatePath = "tests/golden/WBV2-P7-003/release-gate-report.json";
 
 const parent = readJson("tests/golden/WBV2-P8-003/manifest.json");
 assert.equal(parent.task, "WBV2-P8-003"); assert.equal(parent.status, "done"); assert.equal(parent.nextTask, "WBV2-P8-004");
 for (const artifact of Object.values(parent.artifacts ?? {})) assert.equal(sha256(artifact.path), artifact.sha256, artifact.path);
-const receipts = readJson(receiptIndexPath); const epoch = readJson(epochPath); const oldGate = readJson(p7GatePath);
+const receipts = readJson(receiptIndexPath); const epoch = readJson(epochPath); const approval = readJson(approvalPath); const searchReport = readJson(searchReportPath); const oldGate = readJson(p7GatePath);
 assert.equal(receipts.summary.total, 45); assert.equal(receipts.summary.manifestBound, 45); assert.equal(receipts.summary.remaining, 0); assert.equal(receipts.browser, "chromium"); assert.equal(receipts.queueMutation, false);
-assert.equal(epoch.policy.restoredOriginals, 22); assert.equal(epoch.policy.authorizedReplacements, 62); assert.equal(epoch.policy.replacementsAreNotHistoricalRestorations, true); assert.equal(epoch.entries.length, 84);
+assert.equal(epoch.epoch, 2); assert.equal(epoch.policy.restoredOriginals, 23); assert.equal(epoch.policy.authorizedReplacements, 61); assert.equal(epoch.policy.replacementsAreNotHistoricalRestorations, true); assert.equal(epoch.policy.fullHistoricalReproduction, false); assert.equal(epoch.entries.length, 84);
+assert.equal(searchReport.summary.supplementalExactRestorations, 1); assert.equal(searchReport.summary.unresolvedHistoricalEntries, 61); assert.equal(searchReport.policy, "exact_sha256_only");
+assert.equal(approval.decision, "APPROVED"); assert.equal(approval.epoch, 2); assert.equal(approval.authority, "project-owner"); assert.equal(approval.restoredOriginals, 23); assert.equal(approval.authorizedReplacements, 61); assert.equal(approval.limitations.fullHistoricalReproduction, false); assert.equal(approval.limitations.releaseLabel, "AUTHORIZED_REBASELINE_ONLY");
 for (const entry of epoch.entries) {
   if (entry.replacement) assert.equal(entry.sourceSha256, sha256(entry.sourcePath ?? entry.path), `${entry.task}:${entry.artifact}`);
   else {
@@ -34,14 +38,14 @@ for (const entry of epoch.entries) {
   }
 }
 assert.equal(oldGate.task, "WBV2-P7-003"); assert.equal(oldGate.desktop.decision, "BLOCKED");
-const decision = { status: "BLOCKED", code: "HISTORICAL_PROVENANCE_REBASELINE_REQUIRED", reason: "62 M12 entries use an authorized current-worktree replacement; original historical bytes are unavailable", featureParityClaims: 0, nextTask: null };
-const report = { schemaVersion: 1, task: "WBV2-P8-004", operation: "RECOMPUTE_RECOVERY_RELEASE_GATE", status: "PASS", inputs: { atomicReceipts: { path: receiptIndexPath, sha256: sha256(receiptIndexPath), total: receipts.summary.total, manifestBound: receipts.summary.manifestBound }, provenanceEpoch: { path: epochPath, sha256: sha256(epochPath), entries: epoch.entries.length, restoredOriginals: epoch.policy.restoredOriginals, authorizedReplacements: epoch.policy.authorizedReplacements }, previousGate: { path: p7GatePath, sha256: sha256(p7GatePath), decision: oldGate.desktop.decision } }, closure: { atomicReceiptStatus: "CLOSED", chromiumFamilyCount: receipts.summary.families, atomicBehaviorCount: receipts.summary.total, provenanceStatus: "AUTHORIZED_REBASELINE", historicalOriginalStatus: "PARTIAL" }, decision, negative: { missingReceipt: "REJECTED", receiptHashDrift: "REJECTED", provenanceHashDrift: "REJECTED", falseHistoricalRestoration: "REJECTED", unsupportedBrowser: "REJECTED", queueAdvance: "BLOCKED" }, nextTask: null };
-if (!write) { process.stdout.write(`wbv2-recovery-release-gate-ok receipts=45 provenance=22-restored+62-rebaseline decision=BLOCKED next=NONE\n`); process.exit(0); }
+const decision = { status: "READY_WITH_AUTHORIZED_REBASELINE", code: "AUTHORIZED_REBASELINE_ACCEPTED", reason: "Project owner approved provenance epoch 2; 61 replacements are accepted only as a new current baseline", featureParityClaims: 0, fullHistoricalReproduction: false, releaseScope: "AUTHORIZED_REBASELINE_ONLY", nextTask: null };
+const report = { schemaVersion: 1, task: "WBV2-P8-004", operation: "RECOMPUTE_RECOVERY_RELEASE_GATE", status: "PASS", inputs: { atomicReceipts: { path: receiptIndexPath, sha256: sha256(receiptIndexPath), total: receipts.summary.total, manifestBound: receipts.summary.manifestBound }, provenanceEpoch: { path: epochPath, sha256: sha256(epochPath), entries: epoch.entries.length, restoredOriginals: epoch.policy.restoredOriginals, authorizedReplacements: epoch.policy.authorizedReplacements }, approval: { path: approvalPath, sha256: sha256(approvalPath), decision: approval.decision, approvedBy: approval.approvedBy }, searchReport: { path: searchReportPath, sha256: sha256(searchReportPath), exactAdditional: searchReport.summary.supplementalExactRestorations, unresolvedHistorical: searchReport.summary.unresolvedHistoricalEntries }, previousGate: { path: p7GatePath, sha256: sha256(p7GatePath), decision: oldGate.desktop.decision } }, closure: { atomicReceiptStatus: "CLOSED", chromiumFamilyCount: receipts.summary.families, atomicBehaviorCount: receipts.summary.total, provenanceStatus: "AUTHORIZED_REBASELINE_APPROVED", historicalOriginalStatus: "PARTIAL", fullHistoricalReproduction: false }, decision, negative: { missingReceipt: "REJECTED", receiptHashDrift: "REJECTED", provenanceHashDrift: "REJECTED", falseHistoricalRestoration: "REJECTED", missingApproval: "REJECTED", unsupportedBrowser: "REJECTED", queueAdvance: "CLOSED" }, nextTask: null };
+if (!write) { process.stdout.write(`wbv2-recovery-release-gate-ok receipts=45 provenance=23-restored+61-authorized-rebaseline decision=READY_WITH_AUTHORIZED_REBASELINE next=NONE\n`); process.exit(0); }
 fs.mkdirSync(absolute(outputRoot), { recursive: true }); fs.writeFileSync(absolute(reportPath), `${JSON.stringify(report, null, 2)}\n`);
-const status = `# WBV2-P8-004 status\n\n- task: \`WBV2-P8-004\`; parent: \`WBV2-P8-003\`; status: \`blocked\`\n- atomic Chromium receipts: \`45/45\`\n- M12 provenance: \`22 restored + 62 authorized replacements\`\n- release decision: \`BLOCKED\`\n- nextTask: \`NONE\`\n\nThe recovery gate is internally consistent and fail-closed. The 62 authorized replacements are current-worktree baselines, not historical restoration, so full release parity cannot be claimed until authoritative M12 source bytes are supplied or a separately approved provenance epoch supersedes that requirement.\n`;
+const status = `# WBV2-P8-004 status\n\n- task: \`WBV2-P8-004\`; parent: \`WBV2-P8-003\`; status: \`blocked\`\n- atomic Chromium receipts: \`45/45\`\n- M12 provenance epoch: \`2\`\n- M12 provenance: \`23 restored + 61 authorized replacements\`\n- release decision: \`READY_WITH_AUTHORIZED_REBASELINE\`\n- nextTask: \`NONE\`\n\nThe project owner approved the new provenance baseline. The 61 replacement bindings are explicitly not historical restoration, and full historical reproduction remains false. This release label is limited to AUTHORIZED_REBASELINE_ONLY; complete Blender/Web feature parity remains blocked because no feature parity claim is emitted.\n`;
 fs.mkdirSync(absolute("docs/status"), { recursive: true }); fs.writeFileSync(absolute(statusPath), status);
 const previousPlan = readJson("tests/golden/WBV2-P8-003/recovery-task-plan.json"); const finalPlan = structuredClone(previousPlan); finalPlan.parentRecoveryPlan = { path: "tests/golden/WBV2-P8-003/recovery-task-plan.json", sha256: sha256("tests/golden/WBV2-P8-003/recovery-task-plan.json") }; finalPlan.tasks = finalPlan.tasks.map((task) => task.id === "WBV2-P8-004" ? { ...task, status: "in_progress", ready: true } : { ...task, ready: false }); fs.writeFileSync(absolute(planPath), `${JSON.stringify(finalPlan, null, 2)}\n`);
 execFileSync(process.execPath, [absolute("tools/web/check-task-context.mjs"), "--task", "WBV2-P8-004", "--write"], { cwd: root, stdio: "pipe" });
-const artifactPaths = { parentManifest: "tests/golden/WBV2-P8-003/manifest.json", receipts: receiptIndexPath, provenanceEpoch: epochPath, previousGate: p7GatePath, generator: "tools/web/generate-m12-provenance-epoch.mjs", checker: "tools/web/check-wbv2-recovery-release-gate.mjs", report: reportPath, status: statusPath, recoveryPlan: planPath, taskContext: `${outputRoot}/task-context.json` }; const artifacts = Object.fromEntries(Object.entries(artifactPaths).map(([name, file]) => [name, { path: file, sha256: sha256(file) }]));
-const manifest = { schemaVersion: 1, task: "WBV2-P8-004", parentTask: "WBV2-P8-003", operation: "RECOMPUTE_RECOVERY_RELEASE_GATE", status: "blocked", enablingTask: true, parityStateChange: false, artifacts, assertions: { atomicReceipts: 45, restoredOriginals: 22, authorizedReplacements: 62, historicalProvenanceClosed: false, featureParityClaims: 0 }, nextTask: null }; fs.writeFileSync(absolute(manifestPath), `${JSON.stringify(manifest, null, 2)}\n`);
-process.stdout.write(`wbv2-recovery-release-gate-written task=WBV2-P8-004 receipts=45 restored=22 replacements=62 decision=BLOCKED next=NONE\n`);
+const artifactPaths = { parentManifest: "tests/golden/WBV2-P8-003/manifest.json", receipts: receiptIndexPath, provenanceEpoch: epochPath, approval: approvalPath, searchReport: searchReportPath, previousGate: p7GatePath, generator: "tools/web/generate-m12-provenance-epoch.mjs", checker: "tools/web/check-wbv2-recovery-release-gate.mjs", report: reportPath, status: statusPath, recoveryPlan: planPath, taskContext: `${outputRoot}/task-context.json` }; const artifacts = Object.fromEntries(Object.entries(artifactPaths).map(([name, file]) => [name, { path: file, sha256: sha256(file) }]));
+const manifest = { schemaVersion: 1, task: "WBV2-P8-004", parentTask: "WBV2-P8-003", operation: "RECOMPUTE_RECOVERY_RELEASE_GATE", status: "blocked", enablingTask: true, parityStateChange: false, artifacts, assertions: { atomicReceipts: 45, restoredOriginals: 23, authorizedReplacements: 61, historicalProvenanceClosed: false, authorizedRebaselineApproved: true, fullHistoricalReproduction: false, featureParityClaims: 0, releaseScope: "AUTHORIZED_REBASELINE_ONLY" }, nextTask: null }; fs.writeFileSync(absolute(manifestPath), `${JSON.stringify(manifest, null, 2)}\n`);
+process.stdout.write(`wbv2-recovery-release-gate-written task=WBV2-P8-004 receipts=45 restored=23 replacements=61 decision=READY_WITH_AUTHORIZED_REBASELINE next=NONE\n`);

tools/web/generate-m12-provenance-epoch.mjs

@@ -20,6 +20,8 @@ const manifestPath = `${outputRoot}/manifest.json`;
 const driftPath = "tests/golden/corrective/rehydration/M12-manifest-sha-drift.json";
 const intakePath = "tests/golden/corrective/rehydration/M12-provenance-intake.json";
 const snapshotPath = "tests/golden/corrective/rehydration/M12-git-history-snapshot/snapshot-manifest.json";
+const supplementalPath = "tests/golden/corrective/rehydration/M12-supplemental-exact-recovery.json";
+const searchReportPath = "tests/golden/WBV2-P8-003/m12-source-recovery-search.json";
 
 const parent = readJson("tests/golden/WBV2-P8-002/manifest.json");
 assert.equal(parent.task, "WBV2-P8-002"); assert.equal(parent.status, "done"); assert.equal(parent.nextTask, "WBV2-P8-003");
@@ -27,30 +29,44 @@ for (const artifact of Object.values(parent.artifacts ?? {})) assert.equal(sha25
 const drift = readJson(driftPath); const intake = readJson(intakePath); const snapshot = readJson(snapshotPath);
 assert.equal(drift.entries.length, 84); assert.equal(intake.driftEntries, 84); assert.equal(intake.restoredEntries, 22); assert.equal(intake.remainingEntries, 62); assert.equal(intake.immutableSourceSnapshotAvailable, true);
 assert.equal(snapshot.schemaVersion, 1); assert.equal(snapshot.mode, "IMMUTABLE_REPOSITORY");
+const supplemental = readJson(supplementalPath);
+const searchReport = readJson(searchReportPath);
+assert.equal(searchReport.schemaVersion, 1); assert.equal(searchReport.summary.unresolvedHistoricalEntries, 61);
+assert.equal(supplemental.schemaVersion, 1); assert.equal(supplemental.entries.length, 1);
+for (const entry of supplemental.entries) {
+  assert.equal(fs.existsSync(absolute(entry.snapshotPath)), true, entry.snapshotPath);
+  assert.equal(sha256(entry.snapshotPath), entry.snapshotSha256, entry.snapshotPath);
+  assert.equal(entry.snapshotSha256, entry.originalSha256, entry.path);
+}
+const supplementalByKey = new Map(supplemental.entries.map((entry) => [`${entry.task}:${entry.artifact}:${entry.path}:${entry.originalSha256}`, entry]));
 const restored = new Set(intake.entries.filter((entry) => entry.provenanceState === "PROVENANCE_RESTORED").map((entry) => `${entry.task}:${entry.artifact}:${entry.path}:${entry.originalSha256}`));
 const entries = intake.entries.map((entry) => {
   const key = `${entry.task}:${entry.artifact}:${entry.path}:${entry.originalSha256}`;
+  const exactSupplement = supplementalByKey.get(key);
+  if (exactSupplement) {
+    return { ...entry, epoch: 2, provenanceState: "PROVENANCE_RESTORED", binding: "SUPPLEMENTAL_EXACT_SOURCE_ARCHIVE", sourceSha256: entry.originalSha256, replacement: false, snapshotPath: exactSupplement.snapshotPath, sourceArchive: supplemental.sourceArchive, sourceArchiveSha256: supplemental.sourceArchiveSha256 };
+  }
   const actual = sha256(entry.path);
   if (entry.provenanceState === "PROVENANCE_RESTORED") {
     assert.equal(actual, entry.observedSha256, entry.path);
-    return { ...entry, epoch: 1, binding: "IMMUTABLE_SOURCE_SNAPSHOT", sourceSha256: entry.originalSha256, replacement: false, snapshotPath: entry.snapshotPath };
+    return { ...entry, epoch: 2, binding: "IMMUTABLE_SOURCE_SNAPSHOT", sourceSha256: entry.originalSha256, replacement: false, snapshotPath: entry.snapshotPath };
   }
   assert.equal(fs.existsSync(absolute(entry.path)), true, entry.path);
-  return { ...entry, epoch: 1, provenanceState: "AUTHORIZED_REBASELINE", binding: "CURRENT_WORKTREE_REPLACEMENT", sourceSha256: actual, replacement: true, sourcePath: entry.path, originalPreserved: entry.originalSha256 };
+  return { ...entry, epoch: 2, provenanceState: "AUTHORIZED_REBASELINE", binding: "CURRENT_WORKTREE_REPLACEMENT", sourceSha256: actual, replacement: true, sourcePath: entry.path, originalPreserved: entry.originalSha256 };
 });
-assert.equal(entries.filter((entry) => entry.provenanceState === "PROVENANCE_RESTORED").length, 22);
-assert.equal(entries.filter((entry) => entry.provenanceState === "AUTHORIZED_REBASELINE").length, 62);
-const epoch = { schemaVersion: 1, epoch: 1, task: "WBV2-P8-003", operation: "M12_AUTHORIZED_PROVENANCE_REBASELINE", historicalEvidencePreserved: true, sourceSnapshot: snapshotPath, sourceSnapshotSha256: sha256(snapshotPath), originalDriftReport: driftPath, originalDriftReportSha256: sha256(driftPath), originalIntake: intakePath, originalIntakeSha256: sha256(intakePath), policy: { restoredOriginals: 22, authorizedReplacements: 62, replacementsAreNotHistoricalRestorations: true, historicalManifestsRewritten: false }, entries };
-const report = { schemaVersion: 1, task: "WBV2-P8-003", operation: "AUTHORIZE_M12_PROVENANCE_EPOCH", status: "PASS", epoch: 1, counts: { total: entries.length, restoredOriginals: 22, authorizedReplacements: 62, unresolvedHistoricalOriginals: 62 }, sourceSnapshot: { path: snapshotPath, sha256: sha256(snapshotPath), mode: snapshot.mode }, invariants: { historicalEvidencePreserved: true, falseRestoredClaims: 0, historicalManifestsRewritten: false, allCurrentBindingsHashVerified: entries.every((entry) => entry.sourceSha256 === sha256(entry.sourcePath ?? entry.path)) }, nextTask: "WBV2-P8-004" };
-if (!write) { process.stdout.write(`m12-provenance-epoch-ok restored=22 replacements=62 total=84 historical=preserved next=WBV2-P8-004\n`); process.exit(0); }
+assert.equal(entries.filter((entry) => entry.provenanceState === "PROVENANCE_RESTORED").length, 23);
+assert.equal(entries.filter((entry) => entry.provenanceState === "AUTHORIZED_REBASELINE").length, 61);
+const epoch = { schemaVersion: 1, epoch: 2, task: "WBV2-P8-003", operation: "M12_AUTHORIZED_PROVENANCE_REBASELINE", historicalEvidencePreserved: true, sourceSnapshot: snapshotPath, sourceSnapshotSha256: sha256(snapshotPath), supplementalExactRecovery: supplementalPath, supplementalExactRecoverySha256: sha256(supplementalPath), searchReport: searchReportPath, searchReportSha256: sha256(searchReportPath), originalDriftReport: driftPath, originalDriftReportSha256: sha256(driftPath), originalIntake: intakePath, originalIntakeSha256: sha256(intakePath), policy: { restoredOriginals: 23, authorizedReplacements: 61, replacementsAreNotHistoricalRestorations: true, historicalManifestsRewritten: false, fullHistoricalReproduction: false }, entries };
+const report = { schemaVersion: 1, task: "WBV2-P8-003", operation: "AUTHORIZE_M12_PROVENANCE_EPOCH", status: "PASS", epoch: 2, counts: { total: entries.length, restoredOriginals: 23, authorizedReplacements: 61, unresolvedHistoricalOriginals: 61 }, sourceSnapshot: { path: snapshotPath, sha256: sha256(snapshotPath), mode: snapshot.mode }, invariants: { historicalEvidencePreserved: true, falseRestoredClaims: 0, historicalManifestsRewritten: false, fullHistoricalReproduction: false, allCurrentBindingsHashVerified: entries.every((entry) => entry.sourceSha256 === (entry.replacement ? sha256(entry.sourcePath ?? entry.path) : entry.originalSha256)) }, nextTask: "WBV2-P8-004" };
+if (!write) { process.stdout.write(`m12-provenance-epoch-ok epoch=2 restored=23 replacements=61 total=84 historical=partial next=WBV2-P8-004\n`); process.exit(0); }
 fs.mkdirSync(absolute(outputRoot), { recursive: true }); fs.writeFileSync(absolute(epochPath), `${JSON.stringify(epoch, null, 2)}\n`); fs.writeFileSync(absolute(reportPath), `${JSON.stringify(report, null, 2)}\n`);
-const status = `# WBV2-P8-003 status\n\n- task: \`WBV2-P8-003\`; parent: \`WBV2-P8-002\`; status: \`done\`\n- provenance epoch: \`1\`\n- historical originals restored: \`22/84\`\n- authorized replacements: \`62/84\`\n- nextTask: \`WBV2-P8-004\`\n\nThe 22 exact Git-history matches remain immutable restorations. The other 62 entries are explicitly authorized current-worktree replacements; they are not represented as recovery of the unavailable historical bytes.\n`;
+const status = `# WBV2-P8-003 status\n\n- task: \`WBV2-P8-003\`; parent: \`WBV2-P8-002\`; status: \`done\`\n- provenance epoch: \`2\`\n- historical originals restored: \`23/84\`\n- authorized replacements: \`61/84\`\n- nextTask: \`WBV2-P8-004\`\n\nThe 23 exact matches remain immutable restorations. The other 61 entries are explicitly authorized current-worktree replacements; they are not represented as recovery of unavailable historical bytes. Full historical reproduction remains false.\n`;
 fs.mkdirSync(absolute("docs/status"), { recursive: true }); fs.writeFileSync(absolute(statusPath), status);
 const previousPlan = readJson("tests/golden/WBV2-P8-002/recovery-task-plan.json"); const nextPlan = structuredClone(previousPlan); nextPlan.parentRecoveryPlan = { path: "tests/golden/WBV2-P8-002/recovery-task-plan.json", sha256: sha256("tests/golden/WBV2-P8-002/recovery-task-plan.json") }; nextPlan.tasks = nextPlan.tasks.map((task) => task.id === "WBV2-P8-003" ? { ...task, status: "done", ready: false } : task.id === "WBV2-P8-004" ? { ...task, status: "in_progress", ready: true } : { ...task, ready: false }); fs.writeFileSync(absolute(planPath), `${JSON.stringify(nextPlan, null, 2)}\n`);
 execFileSync(process.execPath, [absolute("tools/web/check-task-context.mjs"), "--task", "WBV2-P8-003", "--write"], { cwd: root, stdio: "pipe" });
-const artifactPaths = { parentManifest: "tests/golden/WBV2-P8-002/manifest.json", drift: driftPath, intake: intakePath, snapshot: snapshotPath, epoch: epochPath, report: reportPath, generator: "tools/web/generate-m12-provenance-epoch.mjs", status: statusPath, recoveryPlan: planPath, taskContext: `${outputRoot}/task-context.json` }; const artifacts = Object.fromEntries(Object.entries(artifactPaths).map(([name, file]) => [name, { path: file, sha256: sha256(file) }]));
-const manifest = { schemaVersion: 1, task: "WBV2-P8-003", parentTask: "WBV2-P8-002", operation: "AUTHORIZE_M12_PROVENANCE_EPOCH", status: "done", enablingTask: true, parityStateChange: false, artifacts, assertions: { total: 84, restoredOriginals: 22, authorizedReplacements: 62, falseRestoredClaims: 0, historicalManifestsRewritten: false }, nextTask: "WBV2-P8-004" }; fs.writeFileSync(absolute(manifestPath), `${JSON.stringify(manifest, null, 2)}\n`);
+const artifactPaths = { parentManifest: "tests/golden/WBV2-P8-002/manifest.json", drift: driftPath, intake: intakePath, snapshot: snapshotPath, supplemental: supplementalPath, supplementalSnapshot: supplemental.entries[0].snapshotPath, searchReport: searchReportPath, epoch: epochPath, report: reportPath, generator: "tools/web/generate-m12-provenance-epoch.mjs", status: statusPath, recoveryPlan: planPath, taskContext: `${outputRoot}/task-context.json` }; const artifacts = Object.fromEntries(Object.entries(artifactPaths).map(([name, file]) => [name, { path: file, sha256: sha256(file) }]));
+const manifest = { schemaVersion: 1, task: "WBV2-P8-003", parentTask: "WBV2-P8-002", operation: "AUTHORIZE_M12_PROVENANCE_EPOCH", status: "done", enablingTask: true, parityStateChange: false, artifacts, assertions: { total: 84, restoredOriginals: 23, authorizedReplacements: 61, falseRestoredClaims: 0, historicalManifestsRewritten: false, fullHistoricalReproduction: false }, nextTask: "WBV2-P8-004" }; fs.writeFileSync(absolute(manifestPath), `${JSON.stringify(manifest, null, 2)}\n`);
 const nextCard = `# WBV2-P8-004: recompute recovery release gate\n\n- task: WBV2-P8-004\n- parent: WBV2-P8-003\n- status: in_progress\n- gap: workflow:recompute_recovery_release_gate\n- ownerFamily: RELEASE\n- targetImplementationClass: LOCAL_BOUNDED\n\n## 目标\n\nRecompute the final release decision from 45 atomic Chromium receipts and the explicit M12 provenance epoch.\n\n## 输入与范围\n\n- Atomic receipts: \`tests/golden/WBV2-P8-002/atomic-receipt-index.json\`\n- M12 epoch: \`tests/golden/WBV2-P8-003/m12-provenance-epoch.json\`\n- Release gate: \`tools/web/check-wbv2-recovery-release-gate.mjs\`\n\n## 验收\n\nnode tools/web/check-wbv2-recovery-release-gate.mjs --write\nnode tools/web/check-task-context.mjs --task WBV2-P8-004 --write\n\nMissing receipt, provenance ambiguity, hash drift, unsupported release claim, or governance failure must keep in_progress and must not advance nextTask.\n\n## 交付与回滚\n\n- Reports: \`tests/golden/WBV2-P8-004/\`\n- Status: \`docs/status/WBV2-P8-004.md\`\n- Manifest: \`tests/golden/WBV2-P8-004/manifest.json\`\n- Rollback: restore P8-003 as queue parent and preserve all historical evidence.\n`;
 fs.writeFileSync(absolute("docs/tasks/WBV2-P8-004.md"), nextCard); execFileSync(process.execPath, [absolute("tools/web/generate-v2-task-index.mjs"), "--plan-path", planPath], { cwd: root, stdio: "inherit" });
 let queue = fs.readFileSync(absolute("docs/EXECUTION_QUEUE.md"), "utf8"); queue = queue.replace(/\| 当前任务 \| `[^`]+` \|/u, "| 当前任务 | `WBV2-P8-004` |").replace(/\| parent manifest \| `[^`]+` \|/u, "| parent manifest | `tests/golden/WBV2-P8-003/manifest.json` |").replace(/\| 任务卡 \| \[[^\]]+\]\([^\)]+\) \|/u, "| 任务卡 | [`tasks/WBV2-P8-004.md`](tasks/WBV2-P8-004.md) |"); fs.writeFileSync(absolute("docs/EXECUTION_QUEUE.md"), queue);
-process.stdout.write(`m12-provenance-epoch-written task=WBV2-P8-003 restored=22 replacements=62 next=WBV2-P8-004\n`);
+process.stdout.write(`m12-provenance-epoch-written task=WBV2-P8-003 restored=23 replacements=61 next=WBV2-P8-004\n`);