[Aram164]

The runner could execute porcelain commands such as session-end --commit-message … --push past an uncertain write, then report a partially completed porcelain step as having no commit. Classification also depended on whether the plan contained a use step.

One executing registry now owns the classification. Every operation declares read, derived-write, canonical-write, or defaults to unknown; only explicit reads avoid the write barrier. This includes file output behind query/tool kinds, such as validation reports, analysis staging, backup export/verification, search indexing, and dossier caching. Both argv and use require a stable session for effectful steps; descriptions remain reads.

All dispatched writers begin uncertain. Receipt evidence establishes commitment and cannot be erased by a contradictory refusal field. Only a genuine gateway refusal can establish no commit; generic porcelain failures cannot prove that no files or Git state changed. Later writes are skipped under continue policy, while independent reads remain available.

Receipt verification now rejects paths outside operations/transactions/ before opening them, including escapes and symlinks.

Validation: 32 added regression cases, including a real fixture Git commit followed by push failure with no remote configured. A total of 491 focused/architecture/efficiency/catalogue/document-command tests pass, along with ruff, mypy, import boundaries, reachability, system-map checks, zero validation errors, and the unchanged warning baseline. The fixtures do not touch the live checkout or push to any remote.

Exact hosted Core/UI gate succeeded for Core 17ce3dba1fd05607e3c68634a20acc079124ecf4 and UI 5a6bbeebc0b8a4dbfa1977bb8d4c223541023348. Local checks are not a full acceptance claim. The unrelated scheduled URL audit failure was investigated and recorded in #62 without changing source identities or suppressing its checks.

Fixes #60. Fixes #63.