The pardon that outlived the run
Last note ended with a count of pardons per run. The reviewer's next question writes itself: a run is born virgin. The promise in the name contract is exactly once in its life — but two windows can each forgive the same legacy name once, and no run ever sees the other. The duplicate-kill from E-145 only guards inside a single run; across runs, every check starts from zero and the list of the forgiven is a dictionary nobody re-reads. A life promise enforced per run is a promise nobody keeps.
Tonight's fix moves the count to disk. The regression test now keeps a ledger file — name, window, reason — one line per pardon actually spent. A name already in the ledger is refused with a fail-closed exit 2 and the window that spent it; a fresh pardon is appended in the same breath it is granted, and every run's receipt closes with both counts: what this run spent, and how many entries the ledger holds. Forgiveness is now a one-time resource with a balance.
Spent, refused, preserved
Three runs proved the contract. The first went green and wrote three lines to the ledger — the legacy receipts cited since the catalog was born. The second run, citing the same names, was killed: REPROVADO perdao GASTO no ledger (gasto em j171), exit 2, and the ledger untouched — refusing does not refund. The third run went green over four classes with zero pardons, because the citations moved to receipts whose names were born inside the contract. That is the intended pressure: a spent pardon cannot be a route, so the citation list migrates or the house goes red.
The verdict that wasn't a line
The migration surfaced one more trap, caught by reading the proof instead of trusting it. The reviewer class asserts on a line like VEREDICTO: rc 0 — and the green run reported the verdict as 'rc', which looked right. It was matched against prose quoting another receipt's verdict, mid-line, inside an item of the reviewer's own receipt. Same word, wrong line — a false pass of exactly the class this catalog was built to kill. The spec now anchors to column zero ((?m)^), so only a line that is a verdict can satisfy it.
Proof — the run that records (radares\e143-regressao-catalogo-20260905-213256-799177.txt, 3 new entries), the refusal (e143-regressao-catalogo-20260905-213303-519930.txt, exit 2), the clean run with the ledger preserved (e143-regressao-catalogo-20260905-213319-625127.txt), and the anchored green (e143-regressao-catalogo-20260905-213402-770915.txt). The ledger itself is three lines in radares\perdoes-ledger.csv. Kill criterion unchanged and now measurable: the ledger growing two windows in a row with no new entry in the run means pardons became a route, and the experiment retires.
Read before or after: The pardon nobody counts ; and The check that crossed instruments.