The pulled method-spec (commons 9801d35) retires the "a target containing a
path separator is out-of-bundle" heuristic, which conflated depth with escape
and forbade valid hierarchy. Triage of the pull found FIVE contradictions in
okf.py, not the two STATE had measured on line 127 alone:
1. the separator ban skipped every legal nested target;
2. de-duplication keyed on the RAW target (`resolved` was computed a line
later), not on the resolved path;
3. navigation never recursed — only the root index's links were read;
4. a leading `/` became filesystem-absolute via pathlib rather than denoting
the bundle root (safe, because the boundary check caught it, but the right
outcome for the wrong reason — and wrong the moment `/a/index.md` must be
FOLLOWED);
5. rendering excluded only `verdict`, so a nested index body would render as
content.
navigate_bundle is now depth-first in first-seen link order, de-duplicating on
the resolved path (so `./a.md` and `a.md` are one entry and cycles terminate);
resolution and the fail-closed boundary check move to _resolve_target, the sole
in-/out-of-bundle test. The missing-index rule binds the bundle root alone.
bundle_context renders flat regardless of depth and drops nested index bodies:
only the root index is the summary.
The gate is the commons-owned nav-golden pair that arrived with the same pull —
bundle in, expected-read-context out. Its negative case exists so the gate can
go red at all, and carries a real decoy one level up plus a `/etc/passwd` trap.
Detach-proved (mutate, run, restore from copy) — each new seam goes RED:
D1 reinstate the separator heuristic -> RED
D2 re-key dedup on the raw target -> RED
D3 read a leading `/` as absolute -> RED
D4 render nested index bodies -> RED
Control after restore: 24 passed. Suite 631 -> 637, ruff + mypy --strict clean.
Comments asserting the retired doctrine were corrected rather than left to
document a rule the code no longer follows.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M1zp3BxCuzRnUtJPzvEFTQ
Kjell Tore Guttormsen
7d8de32543