[githubscum]

WO: WO-COVERAGE-RESYNC. Source tier: docs and legibility debt, which turned up a new limit.

Addresses: KNOWN-LIMITS 74 (the half it names in docs/receipt-coverage.md) and new limit 87. The v3 spec's "Lotor records, never infers" split is untouched: this PR changes what the project says about its record, not the record.

The one to read first: limit 87

Re-deriving the doc turned up a field it had never listed as readable text. sent.items[].target on every session receipt holds, in plaintext:

• the full WebFetch URL
• the full WebSearch query
• the first 100 characters of a Bash command, when the lowercased command contains a network verb as a bare substring (cat mapping.txt qualifies through ping)

So a curl with an auth header puts the credential on an append-only, hash-linked chain, where removing it breaks verification, and npm run export carries it off the machine. KNOWN-LIMITS had no entry for this. Limit 18 covers a different writer (grant rows).

Not fixed, on purpose. Digesting the target removes the only readable account of where a session reached out. That is a trade for the owner. The new test pins today's behaviour so a change is visible.

Not measured on the real chain, on purpose. Finding out how often this has happened means searching the record for secrets. That is the owner's call to make, and the owner may want to make it.

What changed

• docs/receipt-coverage.md re-derived from every append site in src/ and bin/ at 22ae903. It was written 2026-07-26 and had gone stale: it said six shapes (there are nine), gated-action had no sessionId or request digest (it has both, since 09-07 and later), toolIo was staged (it is on the chain), and cost was one blended total (cost.byModel exists). Citations are now file plus function or type: literal, because line numbers are part of how it drifted.
• test/docs-receipt-coverage.test.js: tripwire. Every kebab-case type: literal under src/ and bin/, plus the GRANT_TYPE constant, must be named in the doc.
• test/known-limits-87-sent-plaintext.test.js: pins limit 87 with fake values.
• KNOWN-LIMITS.md: entry 87, a dated amendment on 74, pin re-stamped as its own commit.

No file under src/ or bin/ changed.

How it was checked

• Executor: glm-5.3-flash, three passes, model stamps read from the transcripts, not from its report.
• Verifier: my own read against source, no second model. That read rejected the first draft: it said five policy-warn sites in the pre hook (six), said only two places hold plaintext paths, omitted sent altogether, said the post hook's fast path writes nothing (a reasoning-step row is already on the chain by then), and credited sessions_since with attributing gate rows (src/views/since.js still does not, per limit 74). It also passed a test that threw on its own destructuring. All corrected and re-read.
• Probe: ran parseSession over a synthetic transcript before writing limit 87; the output is what the entry says.
• Tripwire checked both ways: removing grant-use from the doc fails the first check, naming the literal; removing delegation-grant fails the second; restored file byte-identical, both pass.
• npm test on the committed tree at 133ee74: 1402 tests, 1396 pass, 0 fail, 6 skipped (the 6 are the existing rehearsals of landed patches). limits-pin --check reads current. The pin is its own commit after the content commit, the lesson from KNOWN-LIMITS 76: three readers stop reporting a refused write as touched #98.

Eval

Serves none of E1-E6 directly. It serves R1 honesty: a coverage statement a stranger can check.

What a reviewer should doubt

1. The fields I did not re-read line by line. I checked gated-action, egress-event, grant-use, delegation-grant, the warn shapes and sent against source. The session-open field list (toolPins, observer, harness, reach) and the reasoning-step recorded-path list are the executor's reading, spot-checked by grep for the named fields, not read end to end. The doc's own audit section lists what nobody chased.
2. The tripwire is shallow. It catches a new type, not a new field on an existing type, and not a type passed through some other constant. The doc says so.
3. The tripwire scans comments too, so a type: 'foo-bar' in a comment demands a doc mention. Noisy in the safe direction.
4. Number collision. KNOWN-LIMITS: amend 29, 65, 66, 70, 77 to match the code; add 87 (tool-form scheduling) #97 also adds a limit 87. Contiguity is tested, so whichever lands second renumbers and re-stamps. Not resolved here, on the same reasoning as run 130: renumbering now only collides again.
5. Is 100 characters the right description of the exposure? A long command's credential can sit past the cut. The entry states the cut and does not claim every secret is caught or missed.

🤖 Generated with Claude Code