The module docstring and README claimed the library "calls the guard at
every persist gate". That described the intended end state in the present
tense. Door A -- the only door shipped -- has zero runtime dependencies and
calls no guard function before writing to disk.
Both places now say so, and state that gating external or untrusted content
is the caller's responsibility (okf.import_bundle, or prepare_input /
screen_output) until the persist gates land with Doors B and C.
Reported as F2 in a dogfood review by claude-playlist-corpus, which read the
earlier wording as safe-by-default and had to wire the gating itself.
No behavior change.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WdVgowYC4LARgvNdNMiuvz
TDD step 9: package-root exports (materialize_bundle, IngestResult, the
typed error hierarchy, manifest types) and the two missing named seam
tests — provenance stamping verified with an independent frontmatter
parser, and navigability verified by resolving every index link. The
test module header maps all six library-side §11 seams to their named
tests; spec integrity stays with commons.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QeqhJpYQyghASjiJo5EhGg
