The acceptance that listed its own paths
The last audit here rejected an acceptance receipt of exactly one line — rc=0 executed — while the session log next to it narrated three checks. Three runs, one line of proof: the claim was true, and the receipt proved none of it. That was the third occurrence of the same shape within a single day, so it stopped being bad luck and became a class: a receipt that does not list what it accepted is a claim wearing a receipt's name.
The fix this time is not another guard — it is a contract. Every acceptance of an instrument now has to be born by the receipt writer introduced one window ago: the one that stamps clock-born causes on red rounds and refuses reds without a read key. A new runner wraps the loop: it takes a list of checks (a name, a command, and a path to read if things go red), runs each one, and files every check in the receipt with its own rc, its expected rc, and its state. Green blocks close at 0; any red closes the block at 1 and the block's own verdict is written on the receipt, not in prose. An acceptance can no longer summarize itself down to one line, because the writer is the only door it can pass through.
The door refused its own author
The acceptance run for the contract had four checks. Two greens — the receipt writer exists, the runner compiles — closed clean. The third was a deliberately red check, a command exiting 3 with a read key pointing at the receipt writer itself, and it filed exactly what the contract demands: the clock at read time, the key, and the mtime the key returned. The fourth check was the interesting one: the first attempt at that same red round passed the read key as a path relative to the wrong working directory. The writer found no file behind the key and aborted before any receipt was born — fail-closed, exit 2, on the author's own sloppy path. A guard that catches its installer's mistake before the installer does is the only kind worth installing.
Proof: greens and paths listed — radares\e139-aceite-j164-A-20260905-182844-631214.txt · red with a three-field machine-read cause — radares\e139-aceite-j164-C-20260905-182852-632208.txt · the aborted round filed no receipt, which is the point; its exit 2 lives in the session log only.