R01

The defect is at the context-delivery boundary: predecessor links are traversed, but predecessor work is not exposed by the normal resume presentation. A narrow authored checkpoint can therefore become the whole visible work frame even with intact lineage.

Evidence from snapshot H:

  • src/gzkit/handoff_api.py:1069, load_handoff_chain, follows every normalized continues_from reference with a visited set and bounded traversal. resume_handoff at line 1103 calls it, but returns only ancestor path strings in ResumeResult.chain. Its steps and decisions come exclusively from the selected document’s content; its settled-ruling union is not a pending-work inventory.
  • src/gzkit/commands/handoff.py::_render_resume renders the selected path, age, steps, decisions and settled rulings, but never renders chain. JSON exposes paths, not their context.
  • src/gzkit/session_start.py::_render reads only path, staleness and next steps. build_advisement truncates its body to ADVISEMENT_CHAR_BUDGET; adding ancestry at the tail would leave it vulnerable to another silent loss.
  • scripts/session_orientation.py::collect_handoff projects one selected document into path, freshness and first action. Its rendered “Most-recent handoff” likewise supplies no predecessor context.
  • The canonical handoff skill’s RESUME steps 5 and 9 explicitly require following and reporting the predecessor chain. The implementation provides a path traversal primitive without completing that presentation contract.

A concrete example of information left upstream is the 20260911T082702Z Stage-2 checkpoint. Its continues_from names 20260911T001043Z, whose Pending Work records GHI #983, unconfirmed native Windows execution and SPEC-REFRESH-01, alongside broader ADR sequencing. Those subjects are not the checkpoint’s local next-step list. This establishes the failure shape, but does not prove these were the particular session and missing work intended by the prompt.

The smallest complete repair should preserve selection and improve the shared resume projection:

  1. Keep the current checkpoint selected. In the handoff API, project bounded predecessor context from the existing resolver/walker: source path, timestamp, summary and Pending Work / Open Loops, preserving authored text and provenance. Include a clear indication when context is unreadable or traversal is incomplete. Preserve existing steps, first_next_step and chain semantics; do not merge ancestor actions into current executable advice or infer that historical open loops remain open.
  2. Render that context in the human resume, JSON, session-start advisement and orientation path through shared extraction rather than separately implemented lineage rules. Put a compact ancestry notice and direct predecessor references before potentially long steps. Under the output budget, preserve those references and explicitly disclose omitted context. The unabridged documents remain the reading destination. This is an advisory repair, not a new gate or automatic work authorization.
  3. Update the resume manpage and canonical skill’s reporting guidance, then regenerate affected mirrors during implementation. No ledger rewrite, historical handoff rewrite, selector redesign or new workflow is needed.

Proposed verification, not executed:

  • Seed a broad predecessor containing two distinct work fronts and a narrower linked checkpoint containing a third. Assert that the selected document and current steps remain the checkpoint’s, while API/JSON and all human presentation paths expose the predecessor’s two fronts with their source and historical status.
  • Negative control: remove predecessor projection or its renderer call; the visibility assertion must fail even though chain still contains the predecessor path.
  • Test absent lineage, scalar and multiple parents, a shared ancestor, cycles, unreadable/missing predecessors and traversal limits. Existing traversal tests verify path membership and termination, not inherited context delivery.
  • Force oversized steps and context: ancestry notice, usable source references, advisory language and explicit truncation survive within the configured budget. Mock reference and remote probes; assert no writes or network dependence.
  • Run the affected unittest modules, handoff BDD and documentation checks in an authorized implementation checkout. I ran no tests or governance commands here.

Remaining uncertainty: no transcript identifies the exact resumed checkpoint. Snapshot H has no Git history, and I did not verify historical ledger claims or current issue status. The chaining protocol document also describes older path restrictions inconsistent with the sibling-path resolver; reconcile that touched documentation against code rather than copying its examples.

Read list (whole files or excerpts; paths relative to H): .gzkit/personas/main-session.md; .gzkit/skills/gz-session-handoff/SKILL.md; src/gzkit/{handoff_api,handoff_selection,session_start}.py; src/gzkit/commands/handoff.py; scripts/session_orientation.py; docs/governance/{trust-doctrine,state-doctrine,advisory-rules-audit}.md; docs/governance/GovZero/handoff-chaining.md; docs/user/manpages/handoff-resume.md; tests/test_handoff_cli.py; tests/governance/test_{handoff_api,handoff_multi_parent_lineage,session_start}.py; five handoffs beginning 20260905T154223Z, 20260911T001043Z, 20260911T082702Z, 20260912T092705Z, plus matching excerpts from 20260905T125247Z. Additional search excerpts covered handoff Markdown and those test files; filename inventories were also inspected. Read /tmp/gzkit-three-pillars-inputs/R01.md first. Some batched output was truncated; I do not claim full-file coverage of those batches.

Shell/read tool-call count: 12, including the task read and this answer write. Only the response file was written.