[abrichr]

Design only. No code changes.

packages/flow/docs/VERIFICATION_COVERAGE.md proposes one rule for what verified means, and three checks behind it:

The declared delta happened, nothing else in the declared slice changed, and the inputs match their source.

• Frame conditions: the contract declares the slice and the target fields. A single judge compares the slice before and after the save, through the same read-only read. It attributes each change outside the declared records by using the app's audit log or a modified-by/version field. A change by another named user counts as concurrent. A change by the bot, or one nobody can explain, is collateral. This generalizes verify-run: a changed non-target record is collateral, not only a vanished one (#1373) #1375's forbid_collateral_change.
• Mutation-qualified checks: before a check is admitted, seven fault classes are applied to a test copy's store, and the check reads them through its own read: wrong value per field, look-alike record, unrelated edit, partial, duplicate, missing, delayed. Coverage (killed / applicable) goes into a coverage record bound to the check's digest and into the receipt. scaffold-verifier's fault test becomes this gate.
• Provenance: intake keeps each value's source line and the document digest. A second extraction by a different method must agree before the save; a disagreement goes to a person. After the save, a round trip compares the record as read back with the source document.
• Receipt: one optional signed field, checked, says for each part held, refuted, not_checked (or instruction for the source part).

The section "What changes for existing runs" lists the behavior changes that need the safety review before any implementation PR merges. The first implementation applies the rule to verify-run and the guarded save. Flow replay follows in a separate PR.

🤖 Generated with Claude Code