From 04ecff80484ac7e59981485e0d300b3bf1d0623e Mon Sep 17 00:00:00 2001
From: Amplifier <240397093+microsoft-amplifier@users.noreply.github.com>
Date: Fri, 4 Sep 2026 23:17:43 -0700
Subject: [PATCH] =?UTF-8?q?contract(operator-surface):=20owner-ratified=20?=
 =?UTF-8?q?DRAFT=20true-up=20#1=20=E2=80=94=20Core=204=20reaches=20<style>?=
 =?UTF-8?q?=20blocks,=20Core=2010=20check=20wording,=20Freeze-7=20quote=20?=
 =?UTF-8?q?verbatim;=20OSV1=20SYNC=20rehash=20+=20full=20re-review?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Owner ratification, literal: "yep, do it all." (2026-09-04). Status stays DRAFT.

PART A -- contracts/operator-surface.v1.md, three parts:
  1. Core 4 widened from "an inline `style=` attribute" to also reach "a
     `<style>` block outside the token module (`webtheme.py`'s token block)";
     the visual.single_source machine check gained the matching conjunct.
     Evidence: webtrust.py:256-302 hardcodes the retired palette inside a
     `<style>` block that deliberately does not import the token CSS -- the
     exact defect the clause exists to prevent, which the SEED reconcile could
     only record-not-score.
  2. Core 10's antigoals.enforced check was stricter than its own clause and
     would have falsely condemned the localStorage density preference.
     Reworded to "no view holds state that does not survive a refresh (...)".
  3. Freeze 7's self-failure: the Changelog's webapp.py:38-39 quotation carried
     added `**` emphasis. Struck -- the span is now byte-exact. webapp.py was
     NOT touched.
  Plus a dated Changelog entry.

PART B -- mandatory full OSV1 re-review (never a silent hash bump):
  SYNC 7566c75c... -> f4098752...; custody hash re-verified byte-for-byte,
  unchanged. All 36 rows walked against both the old and new text.
  * 2 rows re-anchored, checked not assumed: OSV1-005 (Core 4) and OSV1-016
    (Core 10), both within the same clause. The other 33 verify identically in
    both texts. OSV1-015 re-read explicitly: different conjunct, no change.
  * 1 disposition changed: OSV1-033 (Freeze 7) GAP -> CONFORMS by
    VIOLATION-MOVEMENT; its pin was replaced by a real check in the same change.
    Tally 8/5/20/3 -> 9 CONFORMS / 5 VIOLATION / 19 GAP / 3 NOT-ASSERTABLE.
    Freeze 5's Core sub-tally unmoved (10 of 19 still red).
  * New `<style>`-block census engine in _support.py, sharing classify_style
    with the inline census so neither half can quietly become stricter. One
    block outside the token module, 40 literal declarations, webtrust.py.
    OSV1-005 and OSV1-032 now pin both halves separately.
  * OSV1-016 records the density ruling (CONFORMANT under the aligned wording)
    and asserts the persistence that makes it so.
  * Report §9's needs 2 and 4 closed; the palette itself is NOT fixed here
    (work_item_pipeline-np3).

Verified: pytest ledger/checks -q 60 passed; make ledger-mutate 53/53 proven
(52 -> 53: one added, one replaced when OSV1-033 changed groups); ruff check +
format clean. No src/ byte, no custody-contract byte, no docs/VISION.md byte
touched.
---
 contracts/operator-surface.v1.md    |   9 +-
 ledger/checks/_support.py           | 141 +++++++++++++-
 ledger/checks/mutation_harness.py   |  50 ++++-
 ledger/checks/test_operator_rows.py | 219 ++++++++++++++++++----
 ledger/reconcile-report.md          | 268 +++++++++++++++++++++++++++
 ledger/rows.yaml                    | 278 ++++++++++++++++++++++------
 6 files changed, 856 insertions(+), 109 deletions(-)

diff --git a/contracts/operator-surface.v1.md b/contracts/operator-surface.v1.md
index b018efd..401e8f8 100644
--- a/contracts/operator-surface.v1.md
+++ b/contracts/operator-surface.v1.md
@@ -52,9 +52,9 @@ Every element carrying a state carries it in text as well as hue — a status ch
 
 ### Core 4: One source of visual truth
 
-Literal colour, font, or size in an inline `style=` attribute is a violation; zero are tolerated. Computed geometry in an inline `style=` — a bar width, a chart offset — is permitted only for sites enumerated on the exemption register. The register lives in `ledger/`, not in this contract, so that shrinking it is a convergent change requiring no amendment.
+Literal colour, font, or size in an inline `style=` attribute, or in a `<style>` block outside the token module (`webtheme.py`'s token block), is a violation; zero are tolerated. Computed geometry in an inline `style=` — a bar width, a chart offset — is permitted only for sites enumerated on the exemption register. The register lives in `ledger/`, not in this contract, so that shrinking it is a convergent change requiring no amendment.
 
-**Machine check:** `visual.single_source` — zero inline `style=` attributes carrying a literal colour, font, or size anywhere in `src/`; every inline `style=` site carrying computed geometry appears on the ledger's exemption register.
+**Machine check:** `visual.single_source` — zero inline `style=` attributes carrying a literal colour, font, or size anywhere in `src/`; every inline `style=` site carrying computed geometry appears on the ledger's exemption register; and zero literal colour/font/size declarations in any `<style>` block outside the token module.
 
 **Tier:** A
 
@@ -126,7 +126,7 @@ The surface is server-rendered HTML composed in Python, with small inline script
 
 No kanban drag-board — its central gesture fights machine-owned custody. No client-side state that dies on refresh. No new chart library or JS dependency. No unbounded query behind a view.
 
-**Machine check:** `antigoals.enforced` — the dependency manifest declares no charting or drag-and-drop library; every adapter call reached from a view passes an explicit limit; no view stores state only in the browser.
+**Machine check:** `antigoals.enforced` — the dependency manifest declares no charting or drag-and-drop library; every adapter call reached from a view passes an explicit limit; no view holds state that does not survive a refresh (state persisted in `localStorage` or on the server survives; state held only in page memory does not).
 
 **Tier:** A
 
@@ -378,5 +378,6 @@ Before this contract moves from DRAFT to FROZEN, all of the following conditions
 
 ## Changelog
 
+- **2026-09-04 — DRAFT true-up #1,** owner-ratified ("yep, do it all."): Core 4 widened to reach per-page `<style>` blocks outside the token module (evidence: `webtrust.py`'s hardcoded retired palette); Core 10's machine-check wording aligned to the clause ("does not survive a refresh"); the Changelog's `webapp.py:38-39` quotation made byte-exact (Freeze 7). Status remains DRAFT.
 - **2026-09-04 — ENCODE gate:** owner reviewed the DRAFT text and ratified it (literal: "lgtm."). Status remains DRAFT.
-- **2026-09-04 — DRAFT.** First draft, authored at the ENCODE gate from Phase-0 evidence (Brief A, shipped surface; Brief B, prior decisions), nine owner-ratified decisions, and four conformance rulings. Owner ratification, literal: *"Let's make hero the velocity, along w/ other numbers that matter, such as the active/in-flight, blocked, need attention, open, etc. Focus is on observability, etc. The rest looks good to me."* That overrode a recorded invariant — *"the dashboard's hero is the AGE of the oldest unclaimed item, **never a count**"*, rationale *"a giant `0` trains a viewer to stop looking. An age reads as neglect"* (`webapp.py:37-44`). The owner weighed that alternative and chose observability, so Core 1 asserts velocity with the counts that matter; the concern behind the alternative survives in the form the owner accepted, as Core 8. Settled by ruling: a human-perception seam is admissible, so every clause admitting a machine check carries one and the two that cannot are named NOT-ASSERTABLE; no ceiling constant enters Core, the exemption register living in `ledger/` (Core 4, Backlogged 2); the custody boundary is a one-way citation, leaving `contracts/custody-coordination.v1.md` untouched; CLI `--json` is Reserved 1, a different seam being a different contract.
+- **2026-09-04 — DRAFT.** First draft, authored at the ENCODE gate from Phase-0 evidence (Brief A, shipped surface; Brief B, prior decisions), nine owner-ratified decisions, and four conformance rulings. Owner ratification, literal: *"Let's make hero the velocity, along w/ other numbers that matter, such as the active/in-flight, blocked, need attention, open, etc. Focus is on observability, etc. The rest looks good to me."* That overrode a recorded invariant — *"the dashboard's hero is the AGE of the oldest unclaimed item, never a count"*, rationale *"a giant `0` trains a viewer to stop looking. An age reads as neglect"* (`webapp.py:37-44`). The owner weighed that alternative and chose observability, so Core 1 asserts velocity with the counts that matter; the concern behind the alternative survives in the form the owner accepted, as Core 8. Settled by ruling: a human-perception seam is admissible, so every clause admitting a machine check carries one and the two that cannot are named NOT-ASSERTABLE; no ceiling constant enters Core, the exemption register living in `ledger/` (Core 4, Backlogged 2); the custody boundary is a one-way citation, leaving `contracts/custody-coordination.v1.md` untouched; CLI `--json` is Reserved 1, a different seam being a different contract.
diff --git a/ledger/checks/_support.py b/ledger/checks/_support.py
index c598495..eeec872 100644
--- a/ledger/checks/_support.py
+++ b/ledger/checks/_support.py
@@ -433,9 +433,148 @@ def style_sites_in(bucket: str) -> list[str]:
     return sorted(f"{f}:{n}" for f, n, b, _d in inline_style_sites() if b == bucket)
 
 
-# ------------------------------------------------------ token-pair luminance
+# ------------------------------------------------- `<style>`-block census
+#
+# Added by the owner-ratified DRAFT true-up #1 (2026-09-04). Core 4's frozen
+# text used to be scoped to inline `style=` attributes ONLY, so the retired
+# palette webtrust.py hardcodes inside a whole `<style>` BLOCK was recorded by
+# the SEED reconcile and deliberately NOT scored -- the same defect wearing a
+# different tag, unreachable by the clause. The amendment widened the clause to
+# reach "a `<style>` block outside the token module (`webtheme.py`'s token
+# block)", and this is the engine that measures it.
+#
+# The token module is the ONE exemption, and it is the clause's own point: the
+# token block IS the single source of visual truth, so literal values there are
+# not a violation but the definition.
+
+#: The module whose `<style>` block Core 4 exempts by name.
+TOKEN_MODULE = WEBTHEME
+
+_STYLE_TAG = re.compile(r"<style[^>]*>(.*?)</style>", re.DOTALL)
+#: An f-string placeholder naming a bare module-level constant -- the shape
+#: `webtrust.py:374` (`<style>{_CSS}</style>`) uses to embed its stylesheet.
+_NAME_PLACEHOLDER = re.compile(r"\{([A-Za-z_][A-Za-z_0-9]*)\}")
+
+
+def _module_str_constants(path: Path) -> dict[str, tuple[str, int]]:
+    """Module-level `NAME = "..."` string constants -> (value, line).
+
+    Read by PARSING, never importing -- the same rule the rest of this kit
+    follows, so the census stays in-process and side-effect free.
+    """
+    out: dict[str, tuple[str, int]] = {}
+    for node in ast.parse(read(path)).body:
+        if not isinstance(node, ast.Assign) or not isinstance(node.value, ast.Constant):
+            continue
+        if not isinstance(node.value.value, str):
+            continue
+        for target in node.targets:
+            if isinstance(target, ast.Name):
+                out[target.id] = (node.value.value, node.value.lineno)
+    return out
+
+
+def style_blocks_outside_token_module() -> list[tuple[str, int, str]]:
+    """Every `<style>` block embedded by a module OTHER than the token module.
+
+    Returns (file, line-of-the-CSS-text, css). A block's CSS may be written
+    straight into the tag, or interpolated from a module-level constant; both
+    are resolved, and the constant's OWN line is reported so a reader lands on
+    the stylesheet rather than on the tag that emits it.
+
+    Raises if a block interpolates something this census cannot resolve -- a
+    block it cannot read would UNDERSTATE the violation, which is the one
+    direction a census must never fail in (same rule as `inline_style_sites`).
+    """
+    out: list[tuple[str, int, str]] = []
+    for path in src_modules():
+        if path == TOKEN_MODULE:
+            continue  # the exemption Core 4 names by module
+        text = read(path)
+        if "<style" not in text:
+            continue
+        consts = _module_str_constants(path)
+        tags = list(_STYLE_TAG.finditer(text))
+        opened = text.count("<style")
+        if len(tags) != opened:
+            raise AssertionError(
+                f"`<style>`-block census cannot parse {path.name}: {opened} `<style` "
+                f"opening(s) but {len(tags)} closed block(s). A block whose `</style>` "
+                f"lives in a different string literal is INVISIBLE to this census, which "
+                f"would understate the violation -- fix the matcher, never the count."
+            )
+        for tag in tags:
+            body = tag.group(1)
+            tag_line = text.count("\n", 0, tag.start()) + 1
+            literal = _NAME_PLACEHOLDER.sub("", body)
+            if literal.strip():
+                out.append((path.name, tag_line, literal))
+            for name in _NAME_PLACEHOLDER.findall(body):
+                resolved = consts.get(name)
+                if resolved is None:
+                    raise AssertionError(
+                        f"`<style>`-block census cannot resolve {{{name}}} embedded at "
+                        f"{path.name}:{tag_line} -- it is not a module-level string "
+                        f"constant. The census is only honest while every block it finds "
+                        f"can be READ; extend the resolver, never drop the block."
+                    )
+                out.append((path.name, resolved[1], resolved[0]))
+    return out
+
 
+#: Shared with the token-pair luminance engine below -- both read real CSS, and
+#: both must strip comments FIRST or a commented-out declaration is scored.
 _CSS_COMMENT = re.compile(r"/\*.*?\*/", re.DOTALL)
+_CSS_DECL_SPLIT = re.compile(r"[;\n]")
+
+
+def _block_declarations(css: str) -> list[tuple[int, str]]:
+    """(offset-within-css, declaration) for every declaration inside a brace.
+
+    Selectors are skipped by a brace-depth walk rather than a regex, so a
+    pseudo-selector (`p.subtle`, `details summary`) is never mistaken for a
+    `property:value` pair.
+    """
+    stripped = _CSS_COMMENT.sub(lambda m: " " * len(m.group(0)), css)
+    out: list[tuple[int, str]] = []
+    depth, start = 0, 0
+    for i, ch in enumerate(stripped):
+        if ch == "{":
+            if depth == 0:
+                start = i + 1
+            depth += 1
+        elif ch == "}":
+            depth -= 1
+            if depth == 0:
+                chunk = stripped[start:i]
+                pos = start
+                for piece in _CSS_DECL_SPLIT.split(chunk):
+                    if ":" in piece.strip():
+                        out.append((pos, piece.strip()))
+                    pos += len(piece) + 1
+    return out
+
+
+def style_block_literal_sites() -> list[tuple[str, int, str, list[str]]]:
+    """(file, line, declaration, reasons) for every LITERAL colour/font/size
+    declaration inside a `<style>` block outside the token module.
+
+    Classified by `classify_style` -- the SAME rule the inline census uses, so
+    the two halves of Core 4 are measured identically and one cannot quietly
+    become stricter than the other.
+    """
+    out: list[tuple[str, int, str, list[str]]] = []
+    for name, css_line, css in style_blocks_outside_token_module():
+        for offset, decl in _block_declarations(css):
+            bucket, reasons = classify_style(decl)
+            if bucket != LITERAL:
+                continue
+            out.append((name, css_line + css.count("\n", 0, offset), decl, reasons))
+    return sorted(out, key=lambda e: (e[0], e[1], e[2]))
+
+
+# ------------------------------------------------------ token-pair luminance
+
 _CSS_DECL = re.compile(r"(--[a-z0-9-]+)\s*:\s*([^;]+);")
 _HEX_EXACT = re.compile(r"^#([0-9a-fA-F]{3}|[0-9a-fA-F]{6})$")
 _VAR_ONLY = re.compile(r"var\((--[a-z0-9-]+)\)")
diff --git a/ledger/checks/mutation_harness.py b/ledger/checks/mutation_harness.py
index 15f54b2..505c75f 100644
--- a/ledger/checks/mutation_harness.py
+++ b/ledger/checks/mutation_harness.py
@@ -72,6 +72,7 @@
     WEBBROWSE,
     WEBPWA,
     WEBTHEME,
+    WEBTRUST,
     WIDGETS,
     collapse,
     expected_flip_direction,
@@ -430,6 +431,24 @@ def _mo005_the_worst_literal_site_is_migrated(w: World) -> None:
     w.replace(WEBPWA, "font:16px -apple-system,sans-serif;padding:32px;", "")
 
 
+def _mo005b_the_page_local_palette_goes(w: World) -> None:
+    """FIXED (the OTHER half): webtrust.py's page-local `<style>` block stops
+    declaring its own retired palette -- the eight literal colour declarations
+    at webtrust.py:258-259 go, as they would if the module imported the token
+    CSS instead of copying it.
+
+    This is the half Core 4's frozen text could not reach until the 2026-09-04
+    DRAFT true-up widened it, so it gets its OWN mutation: `_mo005_...` proves
+    the INLINE bucket discriminates and says nothing about a `<style>` block.
+    """
+    w.replace(
+        WEBTRUST,
+        "  --ground:#0D0D0C; --raise:#151513; --ink:#F2EEE6; --mid:#A6A199;\n"
+        "  --quiet:#9C978F; --amber:#D9A253; --rule:#1F1F1D; --rule-hi:#333330;\n",
+        "",
+    )
+
+
 _UNREGISTERED_SITE = "\n_LEDGER_MUTATION = f'<div style=\"height:{0}px\"></div>'\n"
 
 
@@ -582,9 +601,20 @@ def _mo032_the_register_grows(w: World) -> None:
     w.append(WIDGETS, _UNREGISTERED_SITE)
 
 
-def _mo033_the_contract_quote_is_corrected(w: World) -> None:
-    """FIXED: the amendment strikes the markdown emphasis that broke Freeze 7."""
-    w.replace(OPERATOR_CONTRACT_PATH, "**never a count**", "never a count")
+def _mo033_the_emphasis_comes_back(w: World) -> None:
+    """REGRESSION (2026-09-04 true-up #1 retargeted this row's probe from a pin
+    to a genuine conformance check -- the seed pin `_mo033_the_contract_quote_
+    is_corrected` it replaced asserted the OPPOSITE direction, git-blame).
+
+    The corrected Changelog quotation re-acquires the markdown emphasis that
+    broke Freeze 7 at seed: markup is part of the exact match, so an emphasised
+    quote stops being a substring of the plain source sentence it cites.
+    """
+    w.replace(
+        OPERATOR_CONTRACT_PATH,
+        "unclaimed item, never a count",
+        "unclaimed item, **never a count**",
+    )
 
 
 def _mo034_the_changelog_records_a_look(w: World) -> None:
@@ -697,9 +727,16 @@ def _mo034_the_changelog_records_a_look(w: World) -> None:
     ),
     Mutation(
         "OSV1-005",
-        "the worst literal site is migrated (census 66 -> 65)",
+        "the worst literal INLINE site is migrated (census 66 -> 65)",
         _mo005_the_worst_literal_site_is_migrated,
     ),
+    Mutation(
+        "OSV1-005",
+        "webtrust.py's page-local `<style>` block stops declaring its own retired "
+        "palette (block census 40 -> 32) -- the half Core 4 could not reach before "
+        "the 2026-09-04 true-up",
+        _mo005b_the_page_local_palette_goes,
+    ),
     Mutation(
         "OSV1-006",
         "an inline computed-geometry site appears that nobody registered",
@@ -796,8 +833,9 @@ def _mo034_the_changelog_records_a_look(w: World) -> None:
     ),
     Mutation(
         "OSV1-033",
-        "an amendment strikes the markdown emphasis that broke the quote",
-        _mo033_the_contract_quote_is_corrected,
+        "the corrected Changelog quotation re-acquires the markdown emphasis that "
+        "broke Freeze 7 at seed",
+        _mo033_the_emphasis_comes_back,
     ),
     Mutation(
         "OSV1-034",
diff --git a/ledger/checks/test_operator_rows.py b/ledger/checks/test_operator_rows.py
index 11f82a4..b6fe543 100644
--- a/ledger/checks/test_operator_rows.py
+++ b/ledger/checks/test_operator_rows.py
@@ -69,6 +69,8 @@
     rows,
     sha256,
     src_modules,
+    style_block_literal_sites,
+    style_blocks_outside_token_module,
     style_sites_in,
     text_pairs,
     token_blocks,
@@ -280,12 +282,18 @@ def test_row_osv1_004() -> None:
 
 
 def test_row_osv1_005() -> None:
-    """Core 4 VIOLATION pin: the literal-inline-style census, RE-RUN here.
+    """Core 4 VIOLATION pin: the literal-style census, RE-RUN here.
 
     The count is computed, never transcribed, so this pin cannot drift away
     from the tree. Two named specimens are asserted individually as well, so
     that migrating the 44 easy `margin-top` sites while leaving the retired
     palette in place does not look like progress the row did not make.
+
+    TWO HALVES since the 2026-09-04 DRAFT true-up widened Core 4: the inline
+    `style=` attribute census, and the `<style>`-BLOCK census the widening
+    made reachable. They are pinned separately so that fixing one while
+    leaving the other is progress the row records rather than a flip it did
+    not earn.
     """
     literal = style_sites_in(LITERAL)
     assert len(literal) == 66, (
@@ -313,6 +321,47 @@ def test_row_osv1_005() -> None:
         f"both OSV1-005 and OSV1-006."
     )
 
+    # --- the `<style>`-block half, reachable since the 2026-09-04 true-up ---
+    blocks = [(f, ln) for f, ln, _css in style_blocks_outside_token_module()]
+    assert blocks == [("webtrust.py", 256)], (
+        f"OSV1-005 (Core 4): the population of `<style>` blocks OUTSIDE the token "
+        f"module moved -- pinned exactly one, `webtrust.py:256` (the `_CSS` constant "
+        f"embedded at webtrust.py:374), observed {blocks}.\n"
+        f"  If GONE: webtrust.py now imports the token CSS -- that is the fix landing "
+        f"(work_item_pipeline-np3). Flip the block half of this row and retarget IN "
+        f"THE SAME CHANGE.\n"
+        f"  If MORE: a second module started shipping its own stylesheet, which is "
+        f"the defect Core 4 was widened to reach."
+    )
+    block_literals = style_block_literal_sites()
+    assert len(block_literals) == 40, (
+        f"OSV1-005 (Core 4) `<style>`-BLOCK CENSUS MOVED: pinned 40 literal "
+        f"colour/font/size declarations inside a `<style>` block outside the token "
+        f"module; observed {len(block_literals)}.\n"
+        f"  If FEWER: the migration is under way -- update the pinned count (or flip "
+        f"the row to CONFORMS at zero on BOTH halves) and retarget this probe IN THE "
+        f"SAME CHANGE (work_item_pipeline-np3). A passing pin is not conformance.\n"
+        f"  If MORE: a new literal declaration landed in a page-local stylesheet.\n"
+        f"  observed: {[f'{f}:{n} {d}' for f, n, d, _r in block_literals]}"
+    )
+    palette = sorted(d for f, n, d, _r in block_literals if n in (258, 259))
+    assert palette == [
+        "--amber:#D9A253",
+        "--ground:#0D0D0C",
+        "--ink:#F2EEE6",
+        "--mid:#A6A199",
+        "--quiet:#9C978F",
+        "--raise:#151513",
+        "--rule-hi:#333330",
+        "--rule:#1F1F1D",
+    ], (
+        f"OSV1-005 (Core 4): the retired palette webtrust.py:258-259 hardcodes is no "
+        f"longer counted as literal -- observed {palette}. That block is the specimen "
+        f"the true-up widened Core 4 to reach, and the one Conformance 1's bad half "
+        f"reinstates. If it was tokenised, that is the fix landing: re-derive this row "
+        f"and OSV1-003 (work_item_pipeline-np3)."
+    )
+
 
 # --------------------------------------------------------------- OSV1-006
 
@@ -677,11 +726,18 @@ def test_row_osv1_015() -> None:
 def test_row_osv1_016() -> None:
     """Core 10 VIOLATION pin: the theme choice persists nowhere.
 
-    Pinned narrowly, on theme only. The density preference raises a genuine
-    reading question (localStorage survives a refresh but IS 'only in the
-    browser') that this reconcile returned to the root rather than deciding --
-    so a density decision taken later must not arrive to find this probe
-    already red about it.
+    Pinned narrowly, on theme only. At seed the density preference raised a
+    genuine reading question (localStorage survives a refresh but IS 'only in
+    the browser') that the reconcile returned to the root rather than deciding,
+    so this probe deliberately said nothing about it.
+
+    SETTLED 2026-09-04 by the owner-ratified DRAFT true-up #1: the machine
+    check now reads "no view holds state that does not survive a refresh
+    (state persisted in `localStorage` or on the server survives; ...)". Under
+    that wording density is CONFORMANT and theme is still a violation, so the
+    probe now asserts BOTH -- the pin on theme, and the persistence that makes
+    density conformant, since a row whose notes rule on density must notice if
+    density stops persisting.
     """
     app = read(WEBAPP)
     setter = app[app.index("function wtSetTheme(t){") :][:340]
@@ -701,6 +757,19 @@ def test_row_osv1_016() -> None:
         "every page. That hardcoding is the other half of why a chosen theme dies on "
         "refresh -- re-derive the row."
     )
+    # The OTHER preference on this surface, and the one the true-up's aligned
+    # wording rules CONFORMANT: density persists, so it survives a refresh. Not
+    # a pin -- a live check on the fact this row's notes rule on.
+    theme_src = read(WEBTHEME)
+    assert theme_src.count("wt-density") == 2 and contains(
+        WEBTHEME, "localStorage.setItem(KEY, next ? 'compact' : 'comfortable')"
+    ), (
+        "OSV1-016 (Core 10): the density preference no longer persists in "
+        "`localStorage`. Under the 2026-09-04 aligned wording that persistence is "
+        "exactly why density is CONFORMANT while theme is not -- if it stopped, "
+        "density became a second violation of this clause and this row's ruling note "
+        "is stale. Re-derive."
+    )
 
 
 # --------------------------------------------------------------- OSV1-017
@@ -949,54 +1018,124 @@ def test_row_osv1_031() -> None:
 
 
 def test_row_osv1_032() -> None:
-    """Freeze 6 pin: the register is enumerated, but literal sites remain."""
+    """Freeze 6 pin: the register is enumerated, but literal sites remain.
+
+    Freeze 6's "no literal colour, font, or size site remaining" reads through
+    Core 4, so the 2026-09-04 true-up widened what "site" means here too: an
+    inline `style=` attribute OR a declaration in a `<style>` block outside the
+    token module. Both halves are pinned separately -- migrating all 66 inline
+    sites while leaving webtrust.py's page-local stylesheet in place must NOT
+    read as this gate closing.
+    """
     literal = style_sites_in(LITERAL)
     assert literal, (
-        "OSV1-032 (Freeze 6) PIN BROKE THE RIGHT WAY: zero literal colour/font/size "
-        "inline sites remain. Both of Freeze 6's conjuncts now hold -- flip OSV1-032 "
-        "(and OSV1-005) to CONFORMS and retarget both probes IN THE SAME CHANGE "
+        "OSV1-032 (Freeze 6) PIN BROKE THE RIGHT WAY (inline half): zero literal "
+        "colour/font/size INLINE sites remain. If the `<style>`-block half below is "
+        "also at zero, both of Freeze 6's conjuncts now hold -- flip OSV1-032 (and "
+        "OSV1-005) to CONFORMS and retarget both probes IN THE SAME CHANGE "
         "(work_item_pipeline-np3). Note that a register at zero also fires Backlogged "
         "2's promotion trigger."
     )
+    assert style_block_literal_sites(), (
+        "OSV1-032 (Freeze 6) PIN BROKE THE RIGHT WAY (`<style>`-block half): zero "
+        "literal colour/font/size declarations remain in any `<style>` block outside "
+        "the token module. That is webtrust.py's retired palette closing -- the half "
+        "Core 4's frozen text could not reach until the 2026-09-04 true-up. Re-derive "
+        "this row and OSV1-005 in the same change (work_item_pipeline-np3)."
+    )
     assert len(style_sites_in("COMPUTED")) == 23, (
         "OSV1-032 (Freeze 6): the enumerated half moved -- see OSV1-006, which owns "
         "the register itself."
     )
 
 
-def test_row_osv1_033() -> None:
-    """Freeze 7 pin: the `**never a count**` Changelog quote does not verify.
+#: A quotation the contract ATTRIBUTES -- its own `*"..."*` convention, used
+#: for exactly the three attributed quotations in the Changelog and nowhere
+#: else. A new one appearing that this probe cannot classify goes red.
+_ATTRIBUTED_QUOTE = re.compile(r'\*"(.+?)"\*', re.DOTALL)
+#: An in-repo source citation: `file.py:LINE` or `file.py:LINE-LINE`.
+_SOURCE_CITE = re.compile(r"`([A-Za-z_][A-Za-z_0-9]*\.py):(\d+(?:-\d+)?)`")
+#: The attribution that marks a quotation as a PERSON's words rather than a
+#: file's. Such a quote cites no file, so Freeze 7's substring rule cannot
+#: reach it -- it is REPORTED as unverifiable, never silently passed.
+_SPEAKER_MARKER = "literal:"
+
+#: The two spans the Changelog attributes to `webapp.py:37-44`, enumerated so
+#: that deleting one is caught rather than trivially satisfying the loop below.
+_CHANGELOG_SOURCE_QUOTES = (
+    "the dashboard's hero is the AGE of the oldest unclaimed item, never a count",
+    "a giant `0` trains a viewer to stop looking. An age reads as neglect",
+)
+
 
-    Both halves are asserted: the decorated form FAILS and the undecorated
-    form PASSES. Together they prove the failure is the added markdown
-    emphasis and nothing else -- so a fix that changed webapp.py instead of
-    the contract would be caught too.
+def test_row_osv1_033() -> None:
+    """Freeze 7 CONFORMS: every quotation the contract attributes to an in-repo
+    file verifies verbatim against that file.
+
+    RETARGETED 2026-09-04 by the owner-ratified DRAFT true-up #1. At seed this
+    row was a GAP and this probe PINNED the failure: the Changelog's
+    `**never a count**` carried markdown emphasis the cited source does not,
+    and markup is part of the exact match. The true-up struck the emphasis, the
+    pin went red the way a pin is meant to, and this is the real check that
+    replaced it IN THE SAME CHANGE.
+
+    WHAT IT PROVES, AND WHAT IT DOES NOT. It proves that every attributed
+    quotation is either verbatim in the file it cites, or is a speaker's words
+    citing no file at all. It CANNOT verify the contract's quotations of Brief
+    A and Brief B (Backlogged 2 quotes one): those documents live outside this
+    repository, so an in-repo check must report them as out-of-repo rather than
+    silently pass them -- see the row's notes.
     """
+    contract = read(OPERATOR_CONTRACT_PATH)
     source = collapse(read(WEBAPP))
-    decorated = collapse(
-        "the dashboard's hero is the AGE of the oldest unclaimed item, **never a count**"
-    )
-    plain = collapse("the dashboard's hero is the AGE of the oldest unclaimed item, never a count")
-    assert plain in source, (
-        "OSV1-033 (Freeze 7): the invariant sentence at webapp.py:37-44 moved. The "
-        "contract's Changelog quotes it; if the SOURCE changed, the quote's failure "
-        "means something different now. Re-review the row."
-    )
-    assert decorated not in source, (
-        "OSV1-033 (Freeze 7): webapp.py now carries the markdown-emphasised form. "
-        "That would fix the quote from the wrong end -- source prose should not "
-        "acquire markup to satisfy a contract quote. Re-derive."
-    )
-    assert contains(OPERATOR_CONTRACT_PATH, "**never a count**"), (
-        "OSV1-033 (Freeze 7) PIN BROKE THE RIGHT WAY: the contract no longer carries "
-        "the `**`-decorated quote. If an owner-ratified amendment corrected it, flip "
-        "OSV1-033 to CONFORMS and retarget this probe IN THE SAME CHANGE "
-        "(work_item_pipeline-5r1) -- and remember the contract's bytes moved, so "
-        "OSV1-000 demands a full-family re-review, never a silent hash bump."
-    )
-    assert contains(WEBAPP, "a giant `0` trains a viewer to stop looking"), (
-        "OSV1-033 (Freeze 7): the contract's OTHER cited quote no longer verifies "
-        "against webapp.py. That one passed at seed -- this is a new failure."
+    changelog = contract[contract.index("## Changelog") :]
+
+    cited = {m.group(1) for m in _SOURCE_CITE.finditer(changelog)}
+    assert cited == {"webapp.py"}, (
+        f"OSV1-033 (Freeze 7): the Changelog's in-repo source citations moved -- this "
+        f"probe verifies against `webapp.py` because that was the only file cited; "
+        f"observed {sorted(cited)}. Extend this probe to the new file rather than "
+        f"leaving it silently narrow."
+    )
+
+    for m in _ATTRIBUTED_QUOTE.finditer(contract):
+        quote = collapse(m.group(1))
+        if collapse(quote) in source:
+            continue
+        window = contract[max(0, m.start() - 40) : m.start()]
+        assert _SPEAKER_MARKER in window, (
+            f"OSV1-033 (Freeze 7) REGRESSION: an attributed quotation neither verifies "
+            f"against `webapp.py` nor is marked as a speaker's words "
+            f"({_SPEAKER_MARKER!r} in the 40 characters before it):\n"
+            f"  {quote[:160]}\n"
+            f"Freeze 7 requires every quote to be a contiguous, whitespace-collapsed "
+            f"substring of the file it cites -- markdown markup included. Either make "
+            f"it byte-exact, or attribute it to its speaker."
+        )
+
+    for quote in _CHANGELOG_SOURCE_QUOTES:
+        assert collapse(quote) in collapse(changelog), (
+            f"OSV1-033 (Freeze 7): the Changelog no longer carries the quotation "
+            f"{quote[:60]!r}... This probe verifies the quotations that ARE there; "
+            f"deleting one must not be how this row stays green. Re-review."
+        )
+        assert collapse(quote) in source, (
+            f"OSV1-033 (Freeze 7) REGRESSION: the Changelog quotation {quote[:60]!r}... "
+            f"no longer verifies against webapp.py. Either the contract's quote "
+            f"drifted, or webapp.py:37-44's prose moved under it -- both are Freeze 7 "
+            f"failures and both need the quote re-derived from the source."
+        )
+
+    assert "**never a count**" not in contract, (
+        "OSV1-033 (Freeze 7) REGRESSION: the `**`-emphasised form of the "
+        "`webapp.py:38-39` quotation is back in the contract. That is the exact defect "
+        "the 2026-09-04 true-up corrected -- markup is part of the exact match, so an "
+        "emphasised quote is not a substring of the plain source sentence."
+    )
+    assert "**never a count**" not in source, (
+        "OSV1-033 (Freeze 7): webapp.py now carries the markdown-emphasised form. That "
+        "would satisfy the quote from the wrong end -- source prose should not acquire "
+        "markup to make a contract quotation verify. Re-derive."
     )
 
 
diff --git a/ledger/reconcile-report.md b/ledger/reconcile-report.md
index fa6ef16..90a91b7 100644
--- a/ledger/reconcile-report.md
+++ b/ledger/reconcile-report.md
@@ -599,8 +599,240 @@ this run confirmed it, that is said, and where it did not, that is said too.
 
 ---
 
+## Re-review 2026-09-04 (operator-surface true-up #1)
+
+**Trigger:** `contracts/operator-surface.v1.md` changed, so `OSV1-000`'s pin
+failed. Under `LEDGER-FORMAT.md` sec.4 that mandates a **full ledger re-review,
+never a silent hash bump** — this section is that re-review's record.
+**Run:** 2026-09-04, branch `amend/operator-surface-trueup-1` (branched from
+`main` @ `65f0e91`). Owner ratification of the amendment, literal:
+*"yep, do it all."* Status stays **DRAFT** — nothing here stamps FROZEN.
+
+### What changed in the contract — three parts, all owner-ratified
+
+1. **Core 4's reach.** The clause was scoped to *"an inline `style=` attribute"*
+   and now also reads *"or in a `<style>` block outside the token module
+   (`webtheme.py`'s token block)"*; the `visual.single_source` machine check
+   gained *"and zero literal colour/font/size declarations in any `<style>`
+   block outside the token module"*. **Why:** `webtrust.py:256-302` hardcodes
+   the retired palette (`--ground:#0D0D0C; --ink:#F2EEE6; --amber:#D9A253`)
+   inside a `<style>` block that deliberately does not import the token CSS
+   (`webtrust.py:249-253` says so in its own comment) — the exact defect the
+   clause exists to prevent, and one the SEED reconcile could only
+   **record-not-score** because the frozen text could not reach it (§6d, and
+   `OSV1-005`'s seed notes, which returned the reading to the root).
+2. **Core 10's machine check.** *"no view stores state only in the browser"*
+   was **stricter than its own clause** (*"No client-side state that dies on
+   refresh"*) and would have falsely condemned the density preference, which
+   survives a refresh. Reworded to *"no view holds state that does not survive
+   a refresh (state persisted in `localStorage` or on the server survives;
+   state held only in page memory does not)"*. The clause body did not move.
+3. **Freeze 7's self-failure.** The Changelog's quotation of `webapp.py:38-39`
+   carried added `**` emphasis, so the contract failed **its own**
+   contiguous-substring rule. The emphasis is struck; the quoted span is now
+   byte-exact and is still a quotation (the `*"…"*` attribution markers sit
+   outside the span). **`webapp.py` was not touched** — fixing a quote by
+   editing the prose it cites is the wrong end, and the retargeted probe now
+   asserts the source did not acquire the emphasis either.
+
+Plus a dated Changelog entry recording all three.
+
+### Hash, old → new
+
+`sha256`, whole-file bytes, computed exactly as `ledger/checks/_support.py::sha256`
+does:
+
+```
+contracts/operator-surface.v1.md      7566c75c0b013e6d11946cc7c6a3781b6d70a9a92f945ea988aac238c73103ab
+                                   -> f40987524fb47351023700fbad97c9c43d9ddd46aeb2cefd0d3ec08cd71c3edb
+
+contracts/custody-coordination.v1.md  ec4b736f8d6dca4ee3c29b6df8397a9d7b51d2eadd76965854e898924f529e1a
+                                      (unchanged — re-verified byte-for-byte on this run, not assumed)
+```
+
+The custody contract was never opened: the boundary between the two contracts is
+a one-way citation, and this amendment touched neither of the two clauses cited
+across it.
+
+### Rows re-anchored: 2 — checked, not assumed
+
+Every one of the 35 quote-carrying `OSV1` rows was tested against **both** the
+old text (`git show origin/main:contracts/operator-surface.v1.md`) and the new
+one, whitespace-collapsed. Exactly two rows quoted text that moved; the other 33
+verify byte-identically in both.
+
+| Row | Clause | Old anchor | New anchor | Same clause? |
+|---|---|---|---|---|
+| `OSV1-005` | Core 4 | *"Literal colour, font, or size in an inline `style=` attribute is a violation; zero are tolerated."* | the widened first sentence, *"…, or in a `<style>` block outside the token module (`webtheme.py`'s token block), is a violation; zero are tolerated."* | yes — same sentence, widened |
+| `OSV1-016` | Core 10 | *"no view stores state only in the browser"* | *"no view holds state that does not survive a refresh"* | yes — same machine check, same conjunct |
+
+`OSV1-015` also cites Core 10 and was re-read explicitly: its quote (*"every
+adapter call reached from a view passes an explicit limit"*) is a **different
+conjunct** of the same check and is byte-identical before and after. No change.
+
+### Disposition changed: 1
+
+`OSV1-033` (Freeze 7) **GAP → CONFORMS**, direction `VIOLATION-MOVEMENT`. This is
+the worked example of the flip direction this repo defines locally (§11.1): the
+seed probe *pinned* the failing quote, part 3 above corrected it, the pin went
+red — and the row moved and the pin was replaced by a real check **in the same
+change**. A passing pin would not have been conformance; only the retargeted
+probe is.
+
+The retargeted `test_row_osv1_033` asserts, every run: (1) every `*"…"*`
+attributed quotation anywhere in the contract either verifies verbatim against
+`webapp.py` or is marked as a **speaker's** words by a `literal:` attribution
+within the 40 characters before it; (2) the two `webapp.py:37-44` quotations are
+still **present** and still verify — enumerated by name, so deleting one cannot
+be how the row stays green; (3) `webapp.py` is the only in-repo file the
+Changelog cites, so a new `file.py:LINE` citation fails loudly rather than
+leaving the probe silently narrow; (4) the `**`-emphasised form is absent from
+**both** the contract and `webapp.py`.
+
+**Honest limit, unchanged by the flip:** the contract also quotes Brief A and
+Brief B, which live outside this repo (Backlogged 2 quotes *"137 `style=`
+occurrences, 134 of them outside `webtheme.py`"*). An in-repo check cannot
+verify those and **reports** them as out-of-repo rather than silently passing
+them. `CONFORMS` here means *every quotation citing an in-repo file verifies*,
+not *every string in this contract has been checked*.
+
+**Work item:** `work_item_pipeline-5r1` was filed at seed for exactly this
+correction and is discharged by this change. It is **not** resolved from this
+branch — the branch may not write to the live tracker — so it needs closing by
+hand.
+
+### The `<style>`-block census — new measurement engine
+
+Part 1 made a defect scoreable, so the ledger had to acquire the instrument that
+scores it. `_support.style_blocks_outside_token_module()` finds every `<style>`
+block a `src/` module other than **the token module** embeds — resolving CSS
+written straight into the tag *and* CSS interpolated from a module-level string
+constant, by parsing (never importing). A block it cannot resolve **raises**
+rather than being skipped: a census that silently loses a block would understate
+the violation, which is the one direction a census must never fail in — the same
+rule `inline_style_sites()` already carries.
+
+`style_block_literal_sites()` then classifies each declaration with
+**`classify_style` — the same function the inline census uses**, on purpose, so
+the two halves of Core 4 are measured identically and one cannot quietly become
+stricter than the other.
+
+**Measured on this branch:** exactly **one** `<style>` block outside the token
+module — `webtrust.py:256-302` (the `_CSS` constant, embedded at
+`webtrust.py:374`) — carrying **40** literal colour/font/size declarations:
+
+```
+webtrust.py:258   --ground:#0D0D0C  --raise:#151513  --ink:#F2EEE6  --mid:#A6A199
+webtrust.py:259   --quiet:#9C978F   --amber:#D9A253  --rule:#1F1F1D  --rule-hi:#333330
+   ...the 8 retired-palette declarations the seed recorded but could not score
+webtrust.py:263-300   32 further literal fonts and sizes in the same sheet
+   (Georgia / 'Helvetica Neue' stacks, font-size:32px, padding:52px 24px 80px, …)
+```
+
+**Honest limit, shared with the inline census:** `classify_style` skips a size
+declaration whose value mentions `var(`, so `border:1px solid var(--rule-hi)` is
+**not** counted. That under-counts rather than over-counts — the safe direction
+for a pin — and the rule is shared between both halves deliberately.
+
+Two rows now measure both halves, **pinned separately** so fixing one is progress
+recorded rather than a flip unearned:
+
+* `OSV1-005` (Core 4, **VIOLATION**, unchanged) — 66 inline literal sites **and**
+  40 `<style>`-block declarations, with the 8 retired-palette declarations
+  asserted by name.
+* `OSV1-032` (Freeze 6, **GAP**, unchanged) — Freeze 6's own text did not move
+  and its quote still verifies, but the word *"site"* in its second half reads
+  through Core 4. The probe now pins both halves, because the plausible failure
+  is exactly: migrate all 66 inline sites, see a green inline census, and stamp
+  a Freeze gate while a whole page-local stylesheet still hardcodes the retired
+  palette.
+
+**The palette itself was not fixed here** — that is `work_item_pipeline-np3`,
+and this branch amends the contract and `ledger/` only.
+
+### The density ruling — an open need closed
+
+`OSV1-016`'s seed notes returned a reading to the root: the density toggle
+persists `wt-density` in `localStorage`, which **satisfies** Core 10's prose
+(*"no client-side state that dies on refresh"* — it survives) while being,
+literally, state *"stored only in the browser"* — the machine check's words as
+they then stood. Part 2 settles it by aligning the check to its own clause:
+
+| Preference | Under the aligned wording | Evidence |
+|---|---|---|
+| **density** | **CONFORMANT** | `wt-density` persisted in `localStorage` — `webtheme.py:3859` declares the key, `:3866` reads it, `:3873` writes it. It survives a refresh |
+| **theme** | **still a VIOLATION** | `wtSetTheme` (`webapp.py:3503-3508`) persists nothing — no cookie, no `localStorage`, no server round-trip — so it is held only in page memory and dies on the next load |
+
+`OSV1-016` stays **VIOLATION**, pinned on theme only — exactly as the seed probe
+was written, *deliberately*, so that a density decision taken later would not
+arrive to find the probe already red about it. It now **also** asserts that
+density still persists: a row whose notes rule on density must notice if density
+stops persisting, rather than leaving a stale ruling in its notes.
+
+### Tallies, before → after
+
+| | Before (SEED) | After (this re-review) |
+|---|---:|---:|
+| `CONFORMS` | 8 | **9** |
+| `VIOLATION` | 5 | 5 |
+| `GAP` | 20 | **19** |
+| `NOT-ASSERTABLE` | 3 | 3 |
+| **Total rows** | 36 | 36 |
+| Red rows carrying a work item | 25 | **24** |
+
+**Core-clause sub-tally is unchanged: ten of nineteen Core-carrying rows are
+still red** — `OSV1-033` carries Freeze 7, not a Core clause, so Freeze 5's gate
+(`OSV1-031`, which asserts exactly 19 Core rows and exactly 10 red) did not move.
+
+### Every other disposition re-verified — checked, not assumed
+
+This branch touches the contract and `ledger/` only (`git diff origin/main
+--stat`: `contracts/operator-surface.v1.md`, `ledger/rows.yaml`,
+`ledger/reconcile-report.md`, `ledger/checks/_support.py`,
+`ledger/checks/test_operator_rows.py`, `ledger/checks/mutation_harness.py`), so
+**no row's subject code moved**. Both families' probes were re-run and both
+halves of the ledger's honesty re-established:
+
+```
+pytest ledger/checks -q      60 passed
+make ledger-mutate           proven 53 / 53   (pinning 29/29 · pinning probes covered 24/24 · conformance 24/24)
+```
+
+**The mutation denominator moved honestly, 52 → 53, and is not a rounding:**
+`OSV1-005` gained a **second** mutation (webtrust.py's page-local `<style>`
+block stops declaring its own retired palette — block census 40 → 32), because
+the existing one proves the *inline* bucket discriminates and says nothing about
+a block; and `OSV1-033`'s mutation was **replaced**, not deleted — the row left
+the pinning group, so its `FIXED`-direction counterfactual (*strike the
+emphasis*) became meaningless and a `REGRESSION`-direction one (*the emphasis
+comes back*) took its place. Pinning-probe coverage therefore falls 25 → 24 and
+conformance mutations rise 23 → 24, which is the same row moving between groups.
+
+### Files written by this re-review
+
+| File | Change |
+|---|---|
+| `contracts/operator-surface.v1.md` | the three owner-ratified parts + a Changelog entry. **Status stays DRAFT** |
+| `ledger/rows.yaml` | `OSV1-000` rehashed + re-review notes; `OSV1-005`/`-016` re-anchored; `OSV1-033` flipped GAP → CONFORMS and its `work` ref dropped; notes updated on `-003`, `-005`, `-015`, `-016`, `-032`, `-033` |
+| `ledger/checks/_support.py` | the `<style>`-block census engine (block resolution + per-declaration classification), `_CSS_COMMENT` hoisted to be shared |
+| `ledger/checks/test_operator_rows.py` | `OSV1-005`/`-032` extended to the block half; `OSV1-016` asserts density persistence; `OSV1-033` retargeted from a pin to a real check |
+| `ledger/checks/mutation_harness.py` | one mutation added (`OSV1-005` block half), one replaced (`OSV1-033`, pin → regression direction) |
+| `ledger/reconcile-report.md` | this section |
+
+**Not touched, by instruction and by protocol:** `src/`,
+`contracts/custody-coordination.v1.md`, `docs/VISION.md`. No PR opened, nothing
+merged, and the live service was never contacted.
+
+---
+
 ## 1. Rows by disposition
 
+> **SEED snapshot, 2026-09-04 @ `4aaee50`.** Superseded in one cell by the
+> re-review above: `OSV1-033` is now `CONFORMS`, so the live tally is 9 CONFORMS
+> / 5 VIOLATION / 19 GAP / 3 NOT-ASSERTABLE. Everything else below still stands
+> as measured. Kept as written rather than rewritten — it is the record of what
+> the seed actually found.
+
 36 rows: one SYNC, 19 carrying Core 1–13, 7 carrying Conformance 1–7, 8
 carrying Freeze 1–8, one carrying Reserved 1.
 
@@ -861,6 +1093,10 @@ inline `style=` at all") fires — a named contract event, never a silent win.
    Core 4 violation — the clause's frozen text is scoped to inline `style=`.
    It is the same defect wearing a different tag, and it is the specimen
    Conformance 1's bad half reinstates. **Returned to the root** (§9, need 2).
+   **SETTLED 2026-09-04** by the owner-ratified DRAFT true-up #1: Core 4 was
+   widened to reach it, and the block is now COUNTED — 40 literal declarations
+   in `webtrust.py:256-302`, of which these are 8. See the re-review section
+   above.
 
 ---
 
@@ -953,6 +1189,11 @@ how much work a row implies, or whether a row should exist.
    (webtrust.py:249-253). This run did **not** score it, and says so in
    OSV1-005's notes. If it should be scored, the census needs a second bucket
    and `np3` grows.
+   **SETTLED 2026-09-04 — YES, it reaches.** Owner-ratified DRAFT true-up #1
+   widened the clause to *"or in a `<style>` block outside the token module
+   (`webtheme.py`'s token block)"*. The census did acquire the second engine,
+   and `np3` did grow: 40 literal declarations in `webtrust.py:256-302` now
+   count. See the re-review section above.
 
 3. **Does a computed *colour* belong on a computed-*geometry* register?**
    (Core 4 / OSV1-006.) Six of the 23 registered sites interpolate a colour, not
@@ -964,6 +1205,11 @@ how much work a row implies, or whether a row should exist.
    survives a refresh) while being, literally, the thing the machine check's
    wording forbids. This run pinned **theme only** — red under both readings —
    precisely so a later density ruling is not pre-empted by an already-red probe.
+   **SETTLED 2026-09-04 — NO, density CONFORMS.** Owner-ratified DRAFT true-up
+   #1 aligned the machine check to its own clause (*"does not survive a
+   refresh"*), so persistence in `localStorage` is conformance. Theme is still a
+   violation and `OSV1-016` still pins it; the probe now also asserts density
+   still persists. See the re-review section above.
 
 5. **Do Freeze 9 and Freeze 10 want ledger rows?** This run rowed Freeze 1–8
    (each has an in-repo byte check) and rowed **no** row for Freeze 9 (external
@@ -1107,6 +1353,28 @@ their substantive half, so the weak one is never the only evidence.
 `src/`. No PR opened, nothing merged, and the live service was never contacted.
 
 ## Changelog
+- **2026-09-04 — operator-surface DRAFT true-up #1, mandatory full re-review.**
+  Owner-ratified (*"yep, do it all."*) three-part amendment: Core 4 widened to
+  reach `<style>` blocks outside the token module (evidence: `webtrust.py`'s
+  hardcoded retired palette, which the seed could only record-not-score), Core
+  10's machine check aligned to its own clause (*"does not survive a refresh"*),
+  and the Changelog's `webapp.py:38-39` quotation made byte-exact — the contract
+  had been failing its own Freeze 7. SYNC (`OSV1-000`) rehashed for the operator
+  contract only (`7566c75c…` -> `f4098752…`); the custody contract's bytes are
+  unchanged and were re-verified, not assumed. Full re-review performed (never a
+  silent bump): 36 rows walked, **2 re-anchored** (`OSV1-005`, `OSV1-016`, both
+  within the same clause), **1 disposition changed** — `OSV1-033` GAP →
+  **CONFORMS** by `VIOLATION-MOVEMENT`, its pin replaced by a real check in the
+  same change. Tally 8/5/20/3 -> **9 CONFORMS / 5 VIOLATION / 19 GAP / 3
+  NOT-ASSERTABLE**; Freeze 5's Core sub-tally unmoved (10 of 19 still red). New
+  `<style>`-block census engine in `_support.py` (one block, 40 literal
+  declarations, `webtrust.py:256-302`), pinned separately from the inline half
+  in `OSV1-005` and `OSV1-032`. Two of §9's five open needs closed (need 2:
+  yes, Core 4 reaches; need 4: no, density conforms). `pytest ledger/checks -q`
+  60 passed; `make ledger-mutate` **53/53** (52 -> 53: one mutation added, one
+  replaced when `OSV1-033` changed groups). Status stays DRAFT; no `src/` byte,
+  no custody-contract byte and no `docs/VISION.md` byte was touched.
+
 - **2026-09-04 — SEED, `contracts/operator-surface.v1.md` (`OSV1-###`).** First
   population of the second row family: 36 rows (8 CONFORMS / 5 VIOLATION / 20
   GAP / 3 NOT-ASSERTABLE) covering Core 1–13, Conformance 1–7, Freeze 1–8 and
diff --git a/ledger/rows.yaml b/ledger/rows.yaml
index 2ad7e1e..bd3fa2b 100644
--- a/ledger/rows.yaml
+++ b/ledger/rows.yaml
@@ -834,7 +834,7 @@
   contract:
     files:
       - file: contracts/operator-surface.v1.md
-        sha256: 7566c75c0b013e6d11946cc7c6a3781b6d70a9a92f945ea988aac238c73103ab
+        sha256: f40987524fb47351023700fbad97c9c43d9ddd46aeb2cefd0d3ec08cd71c3edb
       - file: contracts/custody-coordination.v1.md
         sha256: ec4b736f8d6dca4ee3c29b6df8397a9d7b51d2eadd76965854e898924f529e1a
   disposition: CONFORMS
@@ -842,6 +842,66 @@
     kind: probe
     ref: test_row_osv1_000
   notes: >
+    REHASHED 2026-09-04: owner-ratified DRAFT true-up #1 ("yep, do it all."),
+    a three-part amendment to `contracts/operator-surface.v1.md`. Status stays
+    DRAFT. Operator hash `7566c75c...` -> `f40987524f...`;
+    `contracts/custody-coordination.v1.md` re-hashed BYTE-FOR-BYTE on this run
+    and still `ec4b736f...` -- the boundary is a one-way citation, so the
+    custody text was never opened.
+
+    WHAT MOVED IN THE CONTRACT, all three parts:
+      (1) Core 4's reach. The clause was scoped to "an inline `style=`
+          attribute" and now also reads "or in a `<style>` block outside the
+          token module (`webtheme.py`'s token block)"; its `visual.single_source`
+          machine check gained "and zero literal colour/font/size declarations
+          in any `<style>` block outside the token module". Evidence for the
+          widening: webtrust.py:256-302 hardcodes the retired palette
+          (`--ground:#0D0D0C; --ink:#F2EEE6; --amber:#D9A253`) inside a
+          `<style>` block that deliberately does not import the token CSS --
+          the exact defect the clause exists to prevent, and one the SEED
+          reconcile could only record-not-score (see OSV1-005's seed notes).
+      (2) Core 10's machine check. "no view stores state only in the browser"
+          was STRICTER than its own clause ("No client-side state that dies on
+          refresh") and would have falsely condemned the localStorage density
+          preference. Reworded to "no view holds state that does not survive a
+          refresh (state persisted in `localStorage` or on the server survives;
+          state held only in page memory does not)". The clause text itself did
+          not move.
+      (3) Freeze 7's self-failure. The Changelog's quotation of `webapp.py:38-39`
+          carried added `**` emphasis, so the contract failed its own
+          contiguous-substring rule. The emphasis is struck; the span is now
+          byte-exact and still a quotation. `webapp.py` was NOT touched.
+      Plus a dated Changelog entry recording all three.
+
+    FULL RE-REVIEW PERFORMED (mandatory on any hash change, never a silent
+    bump). All 36 OSV1 rows walked against the new bytes:
+      * ROWS RE-ANCHORED: 2, and only 2 -- checked, not assumed, by collapsing
+        both the old (`origin/main`) and new contract text and testing every
+        row's quote against each. OSV1-005 (Core 4) re-anchored to the widened
+        first sentence; OSV1-016 (Core 10) re-anchored to the reworded
+        machine-check conjunct. Both stay in the SAME clause. The other 33
+        quote-carrying rows verify byte-identically in BOTH the old and the new
+        text.
+      * DISPOSITION CHANGED: 1. OSV1-033 (Freeze 7) GAP -> CONFORMS, direction
+        VIOLATION-MOVEMENT -- part (3) corrected the quote the seed probe
+        pinned, so the pin went red and was replaced by a real check in the
+        same change. Tally 8 CONFORMS / 5 VIOLATION / 20 GAP / 3 NOT-ASSERTABLE
+        -> 9 / 5 / 19 / 3.
+      * PROBES EXTENDED, no disposition change: OSV1-005 and OSV1-032 now
+        measure the `<style>`-block half as well as the inline half (40 literal
+        declarations, all webtrust.py); OSV1-016 additionally asserts the
+        density preference still persists, which is what makes it CONFORMANT
+        under the aligned wording.
+      * EVERY OTHER DISPOSITION RE-VERIFIED AGAINST THE TREE, not assumed: this
+        branch changes the contract and `ledger/` only (`git diff origin/main
+        --stat` touches `contracts/operator-surface.v1.md` and four files under
+        `ledger/`), so no row's subject code moved. `pytest ledger/checks -q`
+        60 passed; `make ledger-mutate` 53/53 proven, zero unproven (52/52 at
+        seed: OSV1-005 gained a second mutation for the `<style>`-block half,
+        and OSV1-033's pin-direction mutation was REPLACED by a
+        regression-direction one when the row flipped -- the denominator moved
+        honestly, never rounded).
+
     SEEDED 2026-09-04 at repo commit 4aaee50 (branch
     converge/seed-operator-surface), against the contract the owner ratified at
     the ENCODE gate that same day (Changelog, literal: "lgtm."). Status DRAFT.
@@ -991,6 +1051,13 @@
     That hardcoded amber outside the token set is exactly the Conformance 1 bad
     fixture the contract describes.
 
+    RE-READ 2026-09-04 (DRAFT true-up #1): the webtrust.py specimen above is
+    now ALSO a scored Core 4 violation -- the true-up widened that clause to
+    reach `<style>` blocks outside the token module, and OSV1-005 counts it.
+    Nothing about THIS row moved: Core 2's calm-pixel half is still unmeasured
+    because no browser kit exists, and this row still pins the specimen's
+    presence so the sweep, when built, has a real target.
+
 - id: OSV1-004
   title: state is never colour-only -- unmeasured on a rendered page, no kit
   contract:
@@ -1031,13 +1098,15 @@
     chrome -- no route passes `sidebar_html`).
 
 - id: OSV1-005
-  title: 66 inline style= sites carry a literal colour, font, or size
+  title: >-
+    66 inline style= sites and 40 <style>-block declarations carry a literal
+    colour, font, or size
   contract:
     file: contracts/operator-surface.v1.md
     clause: Core 4
     quote: |
-      Literal colour, font, or size in an inline `style=` attribute is a violation; zero are
-      tolerated.
+      Literal colour, font, or size in an inline `style=` attribute, or in a `<style>` block
+      outside the token module (`webtheme.py`'s token block), is a violation; zero are tolerated.
   disposition: VIOLATION
   work: work_item_pipeline-np3
   assertion:
@@ -1086,14 +1155,39 @@
     webapp.py bulk is overwhelmingly `margin-top:Npx` spacing literals that
     belong on the `--space-*` scale.
 
-    MEASURED BUT DELIBERATELY NOT COUNTED, and returned to the root as an
-    interpretive need: webtrust.py:258-259 declares a whole retired palette
-    (`--ground:#0D0D0C; --ink:#F2EEE6; --amber:#D9A253`) inside a `<style>`
-    BLOCK, not an inline attribute. Core 4's frozen text is scoped to inline
-    `style=` attributes, so this reconcile did not score it as a Core 4
-    violation -- but it is the same defect wearing a different tag, and it is
-    the specimen the Conformance 1 bad fixture reinstates. Whether Core 4
-    reaches a `<style>`-block palette is a reading this reconcile does not own.
+    RE-READ 2026-09-04 against the owner-ratified DRAFT true-up #1 ("yep, do
+    it all."), which SETTLED the reading this row returned to the root at seed
+    and widened Core 4 to reach "a `<style>` block outside the token module
+    (`webtheme.py`'s token block)". Quote RE-ANCHORED to the widened sentence
+    -- same clause, and the sentence this row was always about. Disposition
+    unchanged (VIOLATION); the row now measures TWO halves, pinned separately
+    so that fixing one is progress it records rather than a flip it did not
+    earn.
+
+    THE `<style>`-BLOCK HALF, measured on this branch by the same probe: ONE
+    `<style>` block exists outside the token module -- webtrust.py:256-302
+    (the `_CSS` constant, embedded at webtrust.py:374) -- and it carries 40
+    literal colour/font/size declarations. Eight of them are the retired
+    pre-blend-3 palette this row recorded-but-did-not-score at seed:
+      webtrust.py:258  --ground:#0D0D0C  --raise:#151513  --ink:#F2EEE6  --mid:#A6A199
+      webtrust.py:259  --quiet:#9C978F   --amber:#D9A253  --rule:#1F1F1D  --rule-hi:#333330
+    The other 32 are literal fonts and sizes in the same sheet (Georgia/
+    Helvetica Neue font stacks, `font-size:32px`, `padding:52px 24px 80px`,
+    and so on). The block deliberately does not import `webtheme.CSS`
+    (webtrust.py:249-253 says so in its own comment) -- which is exactly why
+    it is a second source of visual truth, and exactly what the widened clause
+    forbids. It is also the specimen the Conformance 1 bad fixture reinstates.
+
+    HONEST LIMIT of the block census, the same one the inline census carries:
+    `classify_style` skips a size declaration whose value mentions `var(`, so
+    `border:1px solid var(--rule-hi)` is NOT counted as literal. That
+    under-counts rather than over-counts, which is the safe direction for a
+    pin; the rule is shared between both halves ON PURPOSE, so one cannot
+    quietly become stricter than the other.
+
+    NOT FIXED HERE, DELIBERATELY: the palette itself. That is
+    work_item_pipeline-np3's job, and this branch amends the contract and the
+    ledger only.
 
 - id: OSV1-006
   title: every computed-geometry inline site is on the ledger's exemption register
@@ -1512,13 +1606,21 @@
     written does not condemn it. The probe pins BOTH facts, so wiring it up
     without a limit fails just as loudly as the L1 call being fixed.
 
+    RE-READ 2026-09-04 against the DRAFT true-up #1's Core 10 wording. NO
+    CHANGE, and the reason is that the true-up touched a DIFFERENT conjunct of
+    the same machine check: this row quotes "every adapter call reached from a
+    view passes an explicit limit", which is byte-identical before and after
+    (only the client-side-state conjunct, OSV1-016's, was reworded). Quote
+    re-verified against the new bytes rather than assumed; disposition stays
+    VIOLATION; probe untouched.
+
 - id: OSV1-016
   title: the theme choice is client-side state that dies on refresh
   contract:
     file: contracts/operator-surface.v1.md
     clause: Core 10
     quote: |
-      no view stores state only in the browser
+      no view holds state that does not survive a refresh
   disposition: VIOLATION
   work: work_item_pipeline-dg3
   assertion:
@@ -1544,16 +1646,36 @@
     attribute sits on `<html>` and the swap replaces `<body>`, so it survives
     the poll and dies on reload.
 
-    OPEN READING, RETURNED TO THE ROOT AND NOT DECIDED HERE. The density
-    toggle persists `wt-density` in `localStorage`, which SATISFIES Core 10's
-    prose ("no client-side state that dies on refresh" -- it survives) while
-    being, literally, state "stored only in the browser" -- this row's quoted
-    check. `density_toggle_html`'s own docstring states the consequence: the
-    server "has no way to know a visitor's stored preference (no cookie is
-    involved, only `localStorage`)". This row is filed on the THEME fact, which
-    is red under both readings; whether density must also change waits on the
-    ruling. The probe pins theme only, deliberately, so a density decision
-    taken later is not pre-empted by a red probe.
+    THE OPEN READING THIS ROW RETURNED TO THE ROOT AT SEED IS NOW SETTLED, and
+    settled the way this row hoped. The seed note read: the density toggle
+    persists `wt-density` in `localStorage`, which SATISFIES Core 10's prose
+    ("no client-side state that dies on refresh" -- it survives) while being,
+    literally, state "stored only in the browser" -- the machine check's words
+    as they then stood, and this row's former quote. `density_toggle_html`'s
+    own docstring states the consequence: the server "has no way to know a
+    visitor's stored preference (no cookie is involved, only `localStorage`)".
+
+    RULING, owner-ratified 2026-09-04 in DRAFT true-up #1 ("yep, do it all."):
+    the machine check's wording was ALIGNED TO ITS OWN CLAUSE -- "no view holds
+    state that does not survive a refresh (state persisted in `localStorage` or
+    on the server survives; state held only in page memory does not)". Quote
+    RE-ANCHORED to that new sentence, same clause, same conjunct.
+
+    WHAT THE ALIGNED WORDING DECIDES:
+      DENSITY  CONFORMANT. `wt-density` is persisted in `localStorage`
+               (webtheme.py:3859 declares the key, :3866 reads it, :3873
+               writes it), so the preference survives a refresh. Under the old
+               phrasing it was a literal-but-unintended violation; under the
+               aligned phrasing it is simply conformant, and the row's probe
+               asserts that persistence so a regression re-opens the question
+               rather than passing silently.
+      THEME    STILL A VIOLATION, unchanged. `wtSetTheme` (webapp.py:3503-3508)
+               persists NOTHING -- no cookie, no localStorage, no server
+               round-trip -- so a chosen theme is held only in page memory and
+               dies on the next load. That is the disposition this row carries,
+               and the fact its pin is filed on (work_item_pipeline-dg3).
+    The probe was already pinned narrowly on theme, deliberately, so the
+    ruling arrived to a row that had not pre-empted it.
 
 - id: OSV1-017
   title: exactly one call site fires the push channel, and it is the reclaim path
@@ -1999,7 +2121,9 @@
     GAP precisely because they ARE assertable and simply are not asserted yet.
 
 - id: OSV1-032
-  title: Freeze 6 -- 66 literal sites remain, so the register is not complete
+  title: >-
+    Freeze 6 -- 66 literal inline sites and 40 <style>-block declarations
+    remain, so the register is not complete
   contract:
     file: contracts/operator-surface.v1.md
     clause: Freeze 6
@@ -2027,53 +2151,91 @@
     stronger statement than the census being CURRENT, and a future reader
     stamping FROZEN reads this row, not the census row.
 
+    RE-READ 2026-09-04 against the DRAFT true-up #1. Freeze 6's own text is
+    UNCHANGED by the true-up and this row's quote still verifies byte-for-byte
+    -- but the word "site" in its second half reads through Core 4, and Core 4
+    was widened. So what this gate now requires is zero literal sites in BOTH
+    senses: inline `style=` attributes (66 remain) AND declarations in a
+    `<style>` block outside the token module (40 remain, all in
+    webtrust.py:256-302). The probe was extended to pin both halves
+    SEPARATELY, because the failure mode this row exists to prevent is exactly
+    the plausible one: migrating all 66 inline sites, seeing a green inline
+    census, and stamping a Freeze gate while a whole page-local stylesheet
+    still hardcodes the retired palette. Disposition unchanged (GAP); the same
+    work item (work_item_pipeline-np3) closes both halves.
+
 - id: OSV1-033
-  title: Freeze 7 -- a Changelog quote fails the contiguous-substring rule it demands
+  title: Freeze 7 -- every quotation citing an in-repo file verifies against it
   contract:
     file: contracts/operator-surface.v1.md
     clause: Freeze 7
     quote: |
       **Freeze 7:** every quote in this contract is verified as a contiguous, whitespace-collapsed
       substring of the file it cites.
-  disposition: GAP
-  work: work_item_pipeline-5r1
+  disposition: CONFORMS
   assertion:
     kind: probe
     ref: test_row_osv1_033
   notes: >
-    PINNING ROW -- the probe pins the CURRENT failing quote; a passing probe
-    here is NOT conformance. Flip direction VIOLATION-MOVEMENT.
-
-    MEASURED 2026-09-04 against 4aaee50. The contract's Changelog carries two
-    quotes attributed to `webapp.py:37-44`. Under the matching semantics
+    FLIPPED GAP -> CONFORMS 2026-09-04, direction VIOLATION-MOVEMENT, and the
+    probe RETARGETED in the same change. This row is the worked example of the
+    flip direction this repo defines locally (reconcile-report.md sec.11.1):
+    the seed probe PINNED a failing quote; the owner-ratified DRAFT true-up #1
+    ("yep, do it all.") corrected it; the pin went red; the row moved and the
+    pin was replaced by a real check. A passing pin would not have been
+    conformance -- only the retargeted probe is.
+
+    WHAT WAS WRONG AT SEED, and is now fixed. The Changelog carried two quotes
+    attributed to `webapp.py:37-44`. Under the matching semantics
     LEDGER-FORMAT.md sec.2 defines -- collapse whitespace runs on both sides,
     then require a substring, with words, markdown markup and character order
-    EXACT -- one verifies and one does not:
-      FAILS   "the dashboard's hero is the AGE of the oldest unclaimed item,
-              **never a count**"
-              webapp.py:38-39 reads "...unclaimed item, never a count." with NO
-              markdown emphasis. The contract added the `**` pair; markup is
-              part of the exact match, so this is not a contiguous substring of
-              the file it cites.
-      PASSES  "a giant `0` trains a viewer to stop looking. An age reads as
-              neglect"
-              verifies verbatim against webapp.py:39-40, backticks included.
-    Nothing in the repo would have caught this: the ledger verifies ROW quotes
-    against CONTRACT bytes; Freeze 7 is the other direction -- CONTRACT quotes
-    against SOURCE bytes -- and is unimplemented.
-
-    HONEST LIMIT, AND WHY MECHANISATION ALONE CANNOT CLOSE THIS ROW: the
-    contract also cites Brief A and Brief B throughout, and Backlogged 2 quotes
-    "137 `style=` occurrences, 134 of them outside `webtheme.py`" from Brief A.
-    Those briefs live outside this repo, so an in-repo check cannot verify them
-    and must REPORT them as out-of-repo rather than silently passing them. (For
-    the record, this reconcile re-measured that claim against the tree: 137
-    total, 134 outside `webtheme.py` -- exactly right.)
-
-    THE FIX IS AN AMENDMENT, NOT AN EDIT. The contract is owner-ratified
-    (Changelog 2026-09-04, literal "lgtm."); correcting the quote is a CANDIDATE
-    the owner ratifies. It also moves the contract's bytes, which re-triggers
-    OSV1-000's MANDATORY full-family re-review -- never a silent hash bump.
+    EXACT -- one verified and one did not:
+      WAS FAILING  "the dashboard's hero is the AGE of the oldest unclaimed
+                   item, **never a count**" -- webapp.py:38-39 reads
+                   "...unclaimed item, never a count." with NO markdown
+                   emphasis. The contract had added the `**` pair; markup is
+                   part of the exact match.
+      WAS PASSING  "a giant `0` trains a viewer to stop looking. An age reads
+                   as neglect" -- verbatim against webapp.py:39-40, backticks
+                   included.
+    The true-up struck the `**` pair and nothing else: the quoted span is now
+    byte-exact, and it is still a quotation (the surrounding `*"..."*` markers
+    are the contract's own attribution convention and sit OUTSIDE the span).
+    The source was not touched -- fixing a quote by editing the prose it cites
+    is the wrong end, and the probe now asserts webapp.py did not acquire the
+    emphasised form either.
+
+    WHAT THE RETARGETED PROBE ASSERTS, on every run:
+      1. every `*"..."*` attributed quotation anywhere in the contract either
+         verifies verbatim against `webapp.py` or is marked as a SPEAKER's
+         words by a "literal:" attribution within the 40 characters before it
+         (the owner's ratification quotes cite no file, so Freeze 7's substring
+         rule cannot reach them);
+      2. the two `webapp.py:37-44` quotations are STILL PRESENT and still
+         verify -- enumerated by name, so deleting one cannot be how this row
+         stays green;
+      3. `webapp.py` is the only in-repo file the Changelog cites; a new
+         `file.py:LINE` citation fails loudly rather than leaving the probe
+         silently narrow;
+      4. the `**`-emphasised form is absent from the contract AND from
+         webapp.py.
+
+    HONEST LIMIT, UNCHANGED BY THE FLIP AND THE REASON THIS ROW IS NOT A
+    STRONGER CLAIM THAN IT MAKES: the contract also cites Brief A and Brief B
+    throughout, and Backlogged 2 quotes "137 `style=` occurrences, 134 of them
+    outside `webtheme.py`" from Brief A. Those briefs live OUTSIDE this repo,
+    so an in-repo check cannot verify them; they are REPORTED here as
+    out-of-repo rather than silently passed. CONFORMS on this row therefore
+    means "every quotation citing an in-repo file verifies", not "every string
+    in this contract has been checked". (For the record, the SEED reconcile
+    re-measured Brief A's claim against the tree: 137 total, 134 outside
+    `webtheme.py` -- exactly right.)
+
+    WORK ITEM: work_item_pipeline-5r1 was filed at seed for exactly this
+    correction and is discharged by this change. It is NOT resolved from this
+    branch -- the branch may not write to the live tracker -- so it needs
+    closing by hand; the `work` field is dropped here because a CONFORMS row
+    carrying a live work ref would read as unfinished business.
 
 - id: OSV1-034
   title: Freeze 8 -- the owner's rendered-page look is not recorded in the Changelog