R04

The defect is incomplete resume projection, not a missing predecessor link. Repair the context delivered from the existing lineage; preserve selection and advisory semantics.

Evidence and impact account. In snapshot H, .gzkit/handoffs/20260823T151017Z-ghi-867-residual-planned-verified-synced-unemitted.md is an authored CHECKPOINT linked to 20260823T145108Z-iron-law-only-operator-initiates-obpi-work.md. Its stated “ONE job” is preserving GHI #867’s residual. Step 3 explicitly delegates everything else to that predecessor. Reading the predecessor reveals the OBPI-0.35.0-08 residuals, insights work, and operator-initiation constraint. Those facts are historical claims, not verified current status.

The producer, handoff_api.create_handoff, stores seven narrative sections and scalar/list continues_from links in handoff Markdown. Settled rulings have a separate transport into rulings.jsonl; that does not transport pending work or context. load_handoff_chain follows predecessor links with a visited set and _MAX_CHAIN_DEPTH, returning paths. In resume_handoff, only the selected file’s content supplies _build_steps and parse_decisions; ResumeResult.chain contains paths, not predecessor content.

Two consumers then narrow delivery further: commands/handoff.py::_render_resume displays selected steps, decisions, and settled rulings but no chain; session_start._render displays selected identity, freshness, advisory language, and selected steps, again without lineage. build_advisement applies ADVISEMENT_CHAR_BUDGET. The installed .claude/hooks/session-start-advisement.py forwards that text into both context channels; .claude/settings.json registers it. scripts/session_orientation.collect_handoff likewise extracts only the selected first action; its account concerns events since that anchor, not broader predecessor work.

The changed guarantee should be: selecting a narrow checkpoint cannot silently hide its declared predecessor context. It must not become “all ancestor tasks are live instructions.” handoff_selection.selection_rank deliberately preserves authored CHECKPOINTs and deprioritizes only the machine writer; replacing CHECKPOINT selection would regress that contract. The handoff skill requires reading the chain, verification of claims, and advisory—not authorizing—resume behavior. Trust doctrine T1/T2 requires evidence across producer/consumer boundaries; state doctrine reserves runtime status to the ledger. These bound the repair to read-side continuity.

Smallest complete repair. Add an explicitly historical, source-labelled lineage-context projection alongside existing ResumeResult fields. Use the existing resolver/normalizer and bounded traversal; expose each reachable document’s summary, important context, pending work, and advised steps, with attribution retained for decisions. Keep selected steps, next_steps, and first_next_step semantics unchanged. Do not infer which inherited tasks remain open, copy them into successor canon, or manufacture missing lineage.

Render that projection in human resume output and JSON. Session-start should put a compact predecessor-context notice and recoverable source paths before the potentially long step list; show useful inherited context within the existing budget and explicitly identify omitted content. Add visible diagnostics for unreadable, missing, cyclic, or depth-truncated lineage instead of implying complete recovery. Have orientation expose the same lineage signal through the shared projection, without rewriting its separate post-anchor account. Update the resume manpage and canonical handoff skill, then regenerate delivered mirrors. No new store, ranking policy, workflow gate, or historical handoff rewrite is needed.

Proposed verification, not executed. Start with a parent containing distinct broader context/open loops and a newer narrow authored checkpoint. Assert exact parent text and provenance arrive through API, JSON, human CLI, and session-start; assert inherited steps remain separate from selected next steps. Include multiple parents, shared ancestors, no-parent, dangling/unreadable links, cycles, and traversal limits. Force output truncation and assert the lineage notice and recovery path survive. Retain authored-checkpoint/floor-bookmark selection tests and no-authorizing/no-network behavior. Mutating away predecessor extraction or its rendering must fail tests. Existing API tests cover paths, selected steps, and ruling inheritance; those are insufficient witnesses of delivered predecessor context.

Uncertainty and read audit. I did not execute resume, tests, or governance workflows. No Git history or incident transcript establishes what the original agent actually received. Older chaining documentation conflicts with current resolver shapes and the retired gate; reconcile only the touched contract, not unrelated historical doctrine.

Body reads (some excerpts/truncated), all relative to H: src/gzkit/{personas/main-session.md,skills/gz-session-handoff/SKILL.md,handoff_api.py,handoff_selection.py,session_start.py,commands/handoff.py}; scripts/session_orientation.py; .claude/hooks/session-start-advisement.py; the three handoffs dated 20260823T145108Z, 20260823T151017Z, 20260826T114419Z; docs/governance/{trust-doctrine.md,state-doctrine.md,advisory-rules-audit.md,GovZero/handoff-chaining.md,GovZero/session-handoff-obligations.md}; docs/user/manpages/handoff-resume.md; ADR-0.0.65’s OBPI-0.0.65-02-programmatic-api-implementation.md; tests/governance/{test_handoff_api.py,test_session_start.py,test_handoff_multi_parent_lineage.py}; tests/test_handoff_cli.py. Searches additionally inspected matching lines in handoffs, hook sources, and configuration. Task file read: /tmp/gzkit-three-pillars-inputs/R04.md.

15 shell/read calls including this output write. Scope deviation: the initial setup also listed the current repository’s .gzkit/personas directory; no file contents there were read. All subsequent investigation stayed within H; no evaluation material was read.