test(p13): the okf pin is MEASURED and deliberately NOT lifted -- the V1 stamp form disarms the forgery guard

The lift to llm-ingestion-okf v0.8.5 (which forces llm-ingestion-guard to
v1.4.0) was built and run in a worktree, never in the tracked tree. It is not
green, and the reason that decides it is not the red tests.

MEASURED. 27/27 imported names still resolve across five modules. Both demo
goldens stay byte-identical (ea8c534... / ede3e2f...), ruff check passes and
mypy clears 37 files. The suite goes 1579/3/5 (control) -> 1573/9/5. Eight of
the nine reds have ONE cause: the emitter moved from `generated: true` to the
V1 flow mapping `generated: { by: process:okf-ingest, at: ... }`, one line per
generated concept, seven files across four examples/ingest-golden-* bundles --
and 0 under shared/, so a future lift does not touch the pull-only subtree.

THE FINDING. okf._carries_complete_ingest_stamp reads the new form as NOT a
stamp (measured: True on the literal, False on the flow mapping), so
write_concept_file's IngestStampError refusal would land DISARMED -- and
test_ingest_stamp_fail_closed_loadbearing stayed GREEN through the whole bump
run. That is exactly the trap the _YAML_TRUE_LITERALS invariant row was written
for, arriving by a spelling it did not anticipate. A gate that stops gating is
not a row to name; it is a blocker.

TWO PREMISES FELLED before anything was built on them. Guard v1.2.0 -- the
lowest 1.x satisfying okf's declared >=1.2,<2.0 -- is NOT choosable: okf v0.8.5
pins the guard itself via [tool.uv.sources] tag = "v1.4.0" and uv refuses the
consumer's lower pin as conflicting URLs. And `rev = "v1.4.0"` is a DIFFERENT
url to uv than `tag = "v1.4.0"` even at the same value; only the tag= spelling
resolves.

DELIVERED. tests/test_okf_version_guard.py pins what is measured-green
(0.3.2 / 0.3.4) in two halves -- the installed distribution and pyproject --
with the refusal messages NAMING the eight-row cost of the lift, so the next
session cannot lift the pin without re-measuring. Iron Law: written red against
the v0.8.5/v1.2.0 target first (3 failed / 2 passed). Four mutations, each with
its own signature, all red: the okf assert never raises (1) / always raises (1)
/ the guard assert never raises (1) / the pin constant drifts to 0.3.3 (2 --
both halves, so the derivation is live and not two literals).

Also in the assessment: R761 navigated free for the first time (po had 0
references to it) -- 8.58/6.89/7.11 s, 131 MB max RSS, 5514 files -> 2756
concepts, 0 skipped links, against n100-2023's 0.21 s / 111 MB / 450 -> 446 /
0; and what the CLI can and cannot do with four bundles today.

Suite 1582 passed / 5 skipped (from 1577/5, strict superset, 0 removed).
Goldens byte-unchanged. Two coord messages closed; two STATE claims corrected
against measurement (upushed 3 -> 0, inbox "empty" -> 2).

Order: 20260912T190444Z-8080128610-from-.claude
Record: docs/2026-09-12-p13-okf-pin-r761.md

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_okf_version_guard.py

@@ -0,0 +1,114 @@
+"""P13 okf/guard version-guard — a TEST-TIME tripwire on the two Door A pins, + the install half.
+
+Door A depends on ``llm-ingestion-okf``'s PUBLIC surface (27 names across five modules, imported by
+``ingest.py``/``ingest_mcp.py``) and, through it, on ``llm-ingestion-guard``'s ``okf`` adapter.
+Neither is pinned by a version RANGE in ``pyproject.toml`` — both are git tag pins — so the tag IS
+the pin and EQUALITY is the right predicate here, not a floor: there is no declared range for a
+newer release to sit inside, so any movement is a decision, never maintenance. That is the one shape
+difference from ``test_maf_version_guard``, whose ``pyproject`` really does declare
+``>=1.18.0,<2``.
+
+A grep on ``pyproject.toml`` alone would be blind to an environment that drifted from the lock (a
+stale ``.venv``, a shadowing tool install), and a version assert alone would be blind to a lock that
+drifted from the declared pin. This guard is both halves.
+
+**Why the pins are still 0.3.2 / 0.3.4 after P13 measured 0.8.5 / 1.4.0.** The lift was built and
+run in a worktree on 2026-09-12 and it is NOT green: okf 0.8.5 emits the V1 provenance stamp
+``generated: { by: process:okf-ingest, at: <ingested_at> }`` where 0.3.2 emitted ``generated: true``.
+Eight tests go red on that ONE line, and — the finding that decides it — ``okf.
+_carries_complete_ingest_stamp`` returns ``False`` for the new form while the whole suite stays
+green on that seam, so the ``write_concept_file`` forgery refusal would land DISARMED. The refusal
+messages below name that, because a pin whose reason lives only in prose is a pin the next session
+lifts without re-measuring. Full numbers: ``docs/2026-09-12-p13-okf-pin-r761.md``.
+"""
+
+from __future__ import annotations
+
+import importlib.metadata
+from pathlib import Path
+
+import pytest
+
+_OKF_DIST = "llm-ingestion-okf"
+_GUARD_DIST = "llm-ingestion-guard"
+
+#: The measured-green pins. ONE place each; the ``pyproject`` asserts DERIVE their expected strings
+#: from these (the kø-(p) rule) — two literals for one fact drift, and a drifted pin is a guard that
+#: stops guarding without a local diff.
+_OKF_PINNED = "0.3.2"
+_GUARD_PINNED = "0.3.4"
+
+_OKF_LIFT_COST = (
+    "P13 measured the lift to 0.8.5 in a worktree: 27/27 imported names still resolve, both demo "
+    "goldens stay byte-identical and ruff/mypy pass, but the emitted stamp moves from "
+    "'generated: true' to the V1 flow mapping 'generated: { by: ..., at: ... }'. Eight tests go "
+    "red on that one line (four examples/ingest-golden-* byte goldens over seven concept files, "
+    "plus four 'generated == \"true\"' asserts), and okf._carries_complete_ingest_stamp reads the "
+    "new form as NOT a stamp — so write_concept_file's forgery refusal would ship disarmed with "
+    "the suite green. Close that first; see docs/2026-09-12-p13-okf-pin-r761.md."
+)
+
+_GUARD_LIFT_COST = (
+    "The guard's 1.0.0 freeze covers the exported SURFACE only: severities, thresholds and the "
+    "dispositions they produce are explicitly calibration and move within 1.x. "
+    "ingest._ACCEPTED_DISPOSITION reads 'warn' as the lowest tier a clean concept scores — "
+    "re-measure it before lifting. Note also that okf >=0.8.5 pins this library itself via "
+    "[tool.uv.sources] tag = 'v1.4.0', so a consumer cannot choose a lower 1.x, and must spell its "
+    "own pin with tag= rather than rev= or uv refuses the resolution as conflicting URLs."
+)
+
+
+def assert_pinned_okf_version(version_str: str) -> None:
+    """Raise ``ValueError`` unless ``version_str`` is the pinned okf tag, naming the measured cost
+    of the lift. Pure string compare — no import side effects, so a version can be passed directly
+    (the RED-proof) without touching the real install."""
+    if version_str != _OKF_PINNED:
+        raise ValueError(
+            f"{_OKF_DIST} {version_str} is not the pinned {_OKF_PINNED}. {_OKF_LIFT_COST}"
+        )
+
+
+def assert_pinned_guard_version(version_str: str) -> None:
+    """Raise ``ValueError`` unless ``version_str`` is the pinned guard tag, naming the premise the
+    surface freeze does NOT cover."""
+    if version_str != _GUARD_PINNED:
+        raise ValueError(
+            f"{_GUARD_DIST} {version_str} is not the pinned {_GUARD_PINNED}. {_GUARD_LIFT_COST}"
+        )
+
+
+def test_installed_okf_version_is_the_pinned_one() -> None:
+    """The control for both refusal arms below: the REAL installed distribution passes, read from
+    ``importlib.metadata`` — what is in the environment, not what the lock says should be."""
+    assert_pinned_okf_version(importlib.metadata.version(_OKF_DIST))
+
+
+def test_installed_guard_version_is_the_pinned_one() -> None:
+    """Same control, for the guard."""
+    assert_pinned_guard_version(importlib.metadata.version(_GUARD_DIST))
+
+
+def test_okf_guard_trips_on_the_measured_lift_and_on_its_neighbours() -> None:
+    """``0.8.5`` is the release P13 actually measured; ``0.4.0`` is where the guard first became a
+    hard runtime dependency of okf; ``0.8.4`` and ``0.9.0`` bracket the measured one, so a
+    neighbouring tag cannot slip in under a range this pin does not have."""
+    for other in ("0.4.0", "0.7.0", "0.8.4", "0.8.5", "0.9.0", "1.0.0"):
+        with pytest.raises(ValueError, match="write_concept_file"):
+            assert_pinned_okf_version(other)
+
+
+def test_guard_version_guard_trips_on_the_lift_okf_would_force() -> None:
+    """``1.4.0`` is the tag okf 0.8.5 forces (it pins this library itself); ``1.2.0`` is the lowest
+    1.x satisfying okf's declared ``>=1.2,<2.0`` and is NOT choosable for that reason; ``2.0.0`` is
+    where the surface freeze ends."""
+    for other in ("0.3.3", "1.2.0", "1.4.0", "2.0.0"):
+        with pytest.raises(ValueError, match="calibration"):
+            assert_pinned_guard_version(other)
+
+
+def test_pyproject_pins_both_tags() -> None:
+    """The install-time half. The expected strings are DERIVED from the pins above so the two halves
+    cannot drift apart."""
+    pyproject = (Path(__file__).resolve().parents[1] / "pyproject.toml").read_text(encoding="utf-8")
+    assert f'llm-ingestion-okf.git", rev = "v{_OKF_PINNED}" }}' in pyproject
+    assert f'llm-ingestion-pipeline-security.git", rev = "v{_GUARD_PINNED}" }}' in pyproject