@codyswann/lisa 4.53.1 → 4.53.2

package/package.json

@@ -181,7 +181,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.53.1",
+  "version": "4.53.2",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -329,7 +329,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "dee3add9611fa904bc483cfaf181c327af45a899",
-  "gitHead": "dee3add9611fa904bc483cfaf181c327af45a899",
-  "lisaReleaseTag": "v4.53.1"
+  "lisaReleaseCommit": "62bbaf063f9fcea7a9b443c4b8beddf4a9d5db18",
+  "gitHead": "62bbaf063f9fcea7a9b443c4b8beddf4a9d5db18",
+  "lisaReleaseTag": "v4.53.2"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.53.1",
+  "version": "4.53.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.53.1",
+  "version": "4.53.2",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/withdrawn-rulings.mjs

@@ -62,9 +62,35 @@
  * chore produced mid-task, after being corrected, when attention has moved on.
  * A rule of the form "always record retractions durably" is a discipline, and
  * this repository's own measurement is that prose rules land at roughly zero
- * adoption. `--withdraw` is therefore one command with three required fields,
+ * adoption. `--withdraw` is therefore one command with four required fields,
  * and it refuses without the verbatim claim: a tombstone the holder of the
  * claim cannot recognise reaches them without reaching them.
+ *
+ * ## Why the re-audit is a required FIELD and not a reminder
+ *
+ * Correcting a premise removes the belief and leaves every inference standing
+ * (CodySwannGT/lisa#3489). The observed instance: a session disproved a false
+ * claim that a credential CLI was unavailable, updated the fact, and two hours
+ * later still relayed to its human that a work item was blocked for a reason
+ * that rested on the retracted claim. Three facts sat in one context and were
+ * never joined. The retraction was recorded; the artifacts it invalidated were
+ * not revisited.
+ *
+ * This file already carried the obligation as prose — "if you already relayed
+ * or recorded one, correct it on the same surface" — which is the discipline
+ * shape this module exists to distrust. So `--derived` is required, and
+ * `--derived none` is the explicit empty answer. The obligation is to PRODUCE
+ * the list, not to find something wrong in it: an empty answer is fine, an
+ * absent one is not, and the difference between them is the whole control.
+ *
+ * It has to bind here because there is nowhere else it could. A scanner that
+ * went looking for artifacts resting on a retracted premise would find nothing
+ * to read: outside the learnings ledger's `provenance` refs, no artifact Lisa
+ * writes records the premise it rests on. A tracker item marked blocked, a
+ * statement relayed to a human, a message to a peer session — none carry a
+ * back-pointer. The retracting session is the only party that still holds the
+ * derivation, and the moment it runs this command is the only moment that
+ * knowledge is both present and being written down.
  * @module withdrawn-rulings
  */
 import * as fs from "node:fs";
@@ -220,6 +246,15 @@ export function formatNotice(entries, headline) {
       lines.push(`  superseded by: ${entry.supersededBy}`);
     if (Array.isArray(entry.reached) && entry.reached.length > 0)
       lines.push(`  originally reached: ${entry.reached.join(", ")}`);
+    // Printed even when empty, and that is the useful case: it tells a reader
+    // the withdrawer looked, so nobody repeats the audit and nobody assumes it
+    // happened. An entry with no `derived` key at all says neither.
+    if (Array.isArray(entry.derived))
+      lines.push(
+        entry.derived.length > 0
+          ? `  still standing on it: ${entry.derived.join(", ")}`
+          : `  still standing on it: nothing (audited by the withdrawer)`
+      );
     return lines.join("\n");
   });
   return [
@@ -362,6 +397,24 @@ export function normalizeSuperseded(value) {
   return trimmed === "" || trimmed.toLowerCase() === "none" ? null : trimmed;
 }
 
+/**
+ * Normalise `--derived` values into the re-audit list.
+ *
+ * `none` is a real answer and must survive as one. A withdrawer who checked and
+ * found nothing standing has discharged the obligation exactly as fully as one
+ * who lists five artifacts, and the record has to be able to say so — otherwise
+ * the only way to satisfy the field is to invent an entry, which is worse than
+ * the gap it closes. Absent is refused elsewhere; `none` resolves here to an
+ * empty list, which reads back as "audited, nothing survives".
+ * @param {readonly string[]} values Raw `--derived` values, in order given.
+ * @returns {string[]} The artifacts still standing, possibly none.
+ */
+export function normalizeDerived(values) {
+  return values
+    .map(value => value.trim())
+    .filter(value => value !== "" && value.toLowerCase() !== "none");
+}
+
 /**
  * Build the record `--withdraw` appends, refusing an unrecognisable tombstone.
  * @param {readonly string[]} argv Arguments.
@@ -380,12 +433,25 @@ export function buildWithdrawal(argv, now) {
     };
   if (because === "")
     return { error: "--because is required: say what disproved it" };
+  const derived = flagValues(argv, "--derived");
+  if (derived.length === 0)
+    return {
+      error:
+        "--derived is required: name what you asserted, filed or relayed while you " +
+        "believed this, so the retraction reaches those artifacts too. Correcting a " +
+        "premise leaves every inference standing. Pass `--derived none` if you checked " +
+        "and nothing survives — an empty answer is fine, an absent one is not.",
+    };
   return {
     record: {
       id,
       withdrawnAt: now,
       claim,
       because,
+      // Present even when empty: the difference between "audited, nothing
+      // survives" and "never audited" is the whole point of the field, and an
+      // omitted key cannot express the first.
+      derived: normalizeDerived(derived),
       // "none" is what a person types when nothing replaced the claim, and a
       // string "none" in the record would print as a superseding id that does
       // not exist. Normalised here rather than at every reader.
@@ -452,6 +518,15 @@ export function runCheck(root) {
   for (const entry of entries) {
     if (typeof entry.claim !== "string" || entry.claim === "")
       problems.push(`${entry.id}: no verbatim claim recorded`);
+    // An absent `derived` is a tombstone whose writer never said what rested on
+    // the claim. That is the CodySwannGT/lisa#3489 failure written into the
+    // ledger, and letting it through here would make the write-time refusal a
+    // formality anything could route around by editing the file.
+    if (!Array.isArray(entry.derived))
+      problems.push(
+        `${entry.id}: no re-audit recorded — say what was asserted, filed or relayed ` +
+          `while the claim was believed, or record an empty list to say nothing survives`
+      );
     if (
       typeof entry.withdrawnAt !== "string" ||
       Number.isNaN(Date.parse(entry.withdrawnAt))

package/plugins/lisa/rules/eager/withdrawn-rulings.md

@@ -29,12 +29,34 @@ The result is one-directional propagation. **New guidance travels; corrections d
   node "$CLAUDE_PLUGIN_ROOT/hooks/withdrawn-rulings.mjs" --withdraw <id> \
     --claim "<the withdrawn claim, verbatim>" \
     --because "<what disproved it>" \
+    --derived "<an artifact you left standing on it>" ... | --derived none \
     [--superseded-by <id>] [--reached <channel> ...]
   ```
 
   The verbatim claim is required and the command refuses without it: **a tombstone the holder of the
   claim cannot recognise reaches them without reaching them.**
 
+- **`--derived` is required too, because correcting a premise leaves every inference standing.**
+  Updating the fact is the easy half. The conclusions you already drew from it are the half that
+  reached other agents and the human, and they do not retract themselves. Before you can record the
+  withdrawal you must name what you asserted, filed, or relayed while you believed the claim —
+  tracker state you set, a statement you made to your operator, a message you sent a peer session.
+
+  **The obligation is to produce the list, not to find something wrong in it.** `--derived none` is
+  a complete answer when you checked and nothing survives, and the record keeps it as an empty list
+  so a later reader can tell "audited, nothing standing" from "never audited". An absent answer is
+  refused; an empty one is not.
+
+  Measured instance: a session disproved a false claim that a credential CLI was unavailable,
+  updated the fact, and **two hours later still relayed to its human that a work item was blocked**
+  for a reason resting on the retracted claim. Three facts sat in one context and were never joined.
+
+  It binds here because nowhere else can carry it. Outside the learnings ledger's `provenance` refs,
+  **no artifact Lisa writes records the premise it rests on** — a blocked label, a relayed sentence,
+  a peer message carry no back-pointer. Nothing can go looking afterwards for what rested on a
+  retracted claim. You are the only party still holding that, at the only moment it is being
+  written down.
+
 - **The ledger is the retraction path, precisely because it is cheap.** Writing a finding feels
   productive; writing a retraction is a chore produced mid-task, after being corrected, when
   attention has moved on. A rule saying "always record retractions durably" is a discipline, and

package/plugins/lisa/rules/reference/withdrawn-rulings.md

@@ -75,6 +75,40 @@ JSONL rather than prose: each line is independent, so concurrent appends from ma
 collide and `merge=union` reconstructs the union exactly. A prose ledger would need a bespoke merge
 driver to survive the same traffic.
 
+## The re-audit field, and why it is required (CodySwannGT/lisa#3489)
+
+A tombstone answers "this claim is dead". It does not answer **"what did I build while it was
+alive?"** — and that is the half that reached other agents and the human. Correcting a premise
+removes the belief and leaves every inference standing.
+
+The observed instance: a session spent part of a day believing a readiness preflight's false claim
+that a credential CLI was unavailable. A delegate probed the binary and disproved it, the session
+updated the fact, and carried on. It never asked what it had concluded while believing the false
+thing. Two hours later it relayed to its human that a work item was blocked because an SSO session
+had expired and a deployed template could not be read — relayed unexamined, while already knowing
+the vault worked, and while its own config had listed the relevant bootstrap secret the whole time.
+Three facts sat in one context and were never joined.
+
+So `--derived` is a required field on every withdrawal, and `--derived none` is the explicit empty
+answer. The record always carries the key: an empty list means *audited, nothing survives*, and an
+absent key means *never audited*. Distinguishing those two is the entire purpose, which is why the
+push gate refuses a ledger entry that omits it — otherwise the write-time refusal would be a
+formality anyone could route around by editing the file.
+
+**Why it cannot be a scanner instead.** Re-auditing after the fact would require asking "which
+artifacts rest on premise P". Nothing can answer that. Learnings-ledger entries carry `provenance`
+refs and are genuinely queryable that way, but they are the only artifact class that is: a tracker
+item marked blocked, a sentence relayed to an operator, a message to a peer session, an evidence
+file — none record the premise they rest on. **Re-auditing those is not merely unenforced; for
+anyone but the session still holding the context, it is impossible.** The obligation therefore has
+to bind at the one moment that knowledge is both present and being written down.
+
+Note the division of labour with `--reached`, which is a different question. `--reached` records the
+**audience** — who received the claim, which is #3752's problem of delivery. `--derived` records the
+**derivation** — what now stands on it, which is #3489's problem. A tombstone can reach every holder
+and still leave a wrong tracker state behind, and it can enumerate its inferences while reaching
+nobody. Both fields, or neither half is covered.
+
 ## How a running session is reached
 
 `--session-start` stamps a per-session mark recording the ids the session was born already knowing.

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.53.1",
+  "version": "4.53.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.53.1",
+  "version": "4.53.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.53.1",
+  "version": "4.53.2",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.53.1",
+  "version": "4.53.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.53.1",
+  "version": "4.53.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.53.1",
+  "version": "4.53.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.53.1",
+  "version": "4.53.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/withdrawn-rulings.mjs

@@ -62,9 +62,35 @@
  * chore produced mid-task, after being corrected, when attention has moved on.
  * A rule of the form "always record retractions durably" is a discipline, and
  * this repository's own measurement is that prose rules land at roughly zero
- * adoption. `--withdraw` is therefore one command with three required fields,
+ * adoption. `--withdraw` is therefore one command with four required fields,
  * and it refuses without the verbatim claim: a tombstone the holder of the
  * claim cannot recognise reaches them without reaching them.
+ *
+ * ## Why the re-audit is a required FIELD and not a reminder
+ *
+ * Correcting a premise removes the belief and leaves every inference standing
+ * (CodySwannGT/lisa#3489). The observed instance: a session disproved a false
+ * claim that a credential CLI was unavailable, updated the fact, and two hours
+ * later still relayed to its human that a work item was blocked for a reason
+ * that rested on the retracted claim. Three facts sat in one context and were
+ * never joined. The retraction was recorded; the artifacts it invalidated were
+ * not revisited.
+ *
+ * This file already carried the obligation as prose — "if you already relayed
+ * or recorded one, correct it on the same surface" — which is the discipline
+ * shape this module exists to distrust. So `--derived` is required, and
+ * `--derived none` is the explicit empty answer. The obligation is to PRODUCE
+ * the list, not to find something wrong in it: an empty answer is fine, an
+ * absent one is not, and the difference between them is the whole control.
+ *
+ * It has to bind here because there is nowhere else it could. A scanner that
+ * went looking for artifacts resting on a retracted premise would find nothing
+ * to read: outside the learnings ledger's `provenance` refs, no artifact Lisa
+ * writes records the premise it rests on. A tracker item marked blocked, a
+ * statement relayed to a human, a message to a peer session — none carry a
+ * back-pointer. The retracting session is the only party that still holds the
+ * derivation, and the moment it runs this command is the only moment that
+ * knowledge is both present and being written down.
  * @module withdrawn-rulings
  */
 import * as fs from "node:fs";
@@ -220,6 +246,15 @@ export function formatNotice(entries, headline) {
       lines.push(`  superseded by: ${entry.supersededBy}`);
     if (Array.isArray(entry.reached) && entry.reached.length > 0)
       lines.push(`  originally reached: ${entry.reached.join(", ")}`);
+    // Printed even when empty, and that is the useful case: it tells a reader
+    // the withdrawer looked, so nobody repeats the audit and nobody assumes it
+    // happened. An entry with no `derived` key at all says neither.
+    if (Array.isArray(entry.derived))
+      lines.push(
+        entry.derived.length > 0
+          ? `  still standing on it: ${entry.derived.join(", ")}`
+          : `  still standing on it: nothing (audited by the withdrawer)`
+      );
     return lines.join("\n");
   });
   return [
@@ -362,6 +397,24 @@ export function normalizeSuperseded(value) {
   return trimmed === "" || trimmed.toLowerCase() === "none" ? null : trimmed;
 }
 
+/**
+ * Normalise `--derived` values into the re-audit list.
+ *
+ * `none` is a real answer and must survive as one. A withdrawer who checked and
+ * found nothing standing has discharged the obligation exactly as fully as one
+ * who lists five artifacts, and the record has to be able to say so — otherwise
+ * the only way to satisfy the field is to invent an entry, which is worse than
+ * the gap it closes. Absent is refused elsewhere; `none` resolves here to an
+ * empty list, which reads back as "audited, nothing survives".
+ * @param {readonly string[]} values Raw `--derived` values, in order given.
+ * @returns {string[]} The artifacts still standing, possibly none.
+ */
+export function normalizeDerived(values) {
+  return values
+    .map(value => value.trim())
+    .filter(value => value !== "" && value.toLowerCase() !== "none");
+}
+
 /**
  * Build the record `--withdraw` appends, refusing an unrecognisable tombstone.
  * @param {readonly string[]} argv Arguments.
@@ -380,12 +433,25 @@ export function buildWithdrawal(argv, now) {
     };
   if (because === "")
     return { error: "--because is required: say what disproved it" };
+  const derived = flagValues(argv, "--derived");
+  if (derived.length === 0)
+    return {
+      error:
+        "--derived is required: name what you asserted, filed or relayed while you " +
+        "believed this, so the retraction reaches those artifacts too. Correcting a " +
+        "premise leaves every inference standing. Pass `--derived none` if you checked " +
+        "and nothing survives — an empty answer is fine, an absent one is not.",
+    };
   return {
     record: {
       id,
       withdrawnAt: now,
       claim,
       because,
+      // Present even when empty: the difference between "audited, nothing
+      // survives" and "never audited" is the whole point of the field, and an
+      // omitted key cannot express the first.
+      derived: normalizeDerived(derived),
       // "none" is what a person types when nothing replaced the claim, and a
       // string "none" in the record would print as a superseding id that does
       // not exist. Normalised here rather than at every reader.
@@ -452,6 +518,15 @@ export function runCheck(root) {
   for (const entry of entries) {
     if (typeof entry.claim !== "string" || entry.claim === "")
       problems.push(`${entry.id}: no verbatim claim recorded`);
+    // An absent `derived` is a tombstone whose writer never said what rested on
+    // the claim. That is the CodySwannGT/lisa#3489 failure written into the
+    // ledger, and letting it through here would make the write-time refusal a
+    // formality anything could route around by editing the file.
+    if (!Array.isArray(entry.derived))
+      problems.push(
+        `${entry.id}: no re-audit recorded — say what was asserted, filed or relayed ` +
+          `while the claim was believed, or record an empty list to say nothing survives`
+      );
     if (
       typeof entry.withdrawnAt !== "string" ||
       Number.isNaN(Date.parse(entry.withdrawnAt))

package/plugins/lisa-copilot/rules/eager/withdrawn-rulings.md

@@ -29,12 +29,34 @@ The result is one-directional propagation. **New guidance travels; corrections d
   node "$CLAUDE_PLUGIN_ROOT/hooks/withdrawn-rulings.mjs" --withdraw <id> \
     --claim "<the withdrawn claim, verbatim>" \
     --because "<what disproved it>" \
+    --derived "<an artifact you left standing on it>" ... | --derived none \
     [--superseded-by <id>] [--reached <channel> ...]
   ```
 
   The verbatim claim is required and the command refuses without it: **a tombstone the holder of the
   claim cannot recognise reaches them without reaching them.**
 
+- **`--derived` is required too, because correcting a premise leaves every inference standing.**
+  Updating the fact is the easy half. The conclusions you already drew from it are the half that
+  reached other agents and the human, and they do not retract themselves. Before you can record the
+  withdrawal you must name what you asserted, filed, or relayed while you believed the claim —
+  tracker state you set, a statement you made to your operator, a message you sent a peer session.
+
+  **The obligation is to produce the list, not to find something wrong in it.** `--derived none` is
+  a complete answer when you checked and nothing survives, and the record keeps it as an empty list
+  so a later reader can tell "audited, nothing standing" from "never audited". An absent answer is
+  refused; an empty one is not.
+
+  Measured instance: a session disproved a false claim that a credential CLI was unavailable,
+  updated the fact, and **two hours later still relayed to its human that a work item was blocked**
+  for a reason resting on the retracted claim. Three facts sat in one context and were never joined.
+
+  It binds here because nowhere else can carry it. Outside the learnings ledger's `provenance` refs,
+  **no artifact Lisa writes records the premise it rests on** — a blocked label, a relayed sentence,
+  a peer message carry no back-pointer. Nothing can go looking afterwards for what rested on a
+  retracted claim. You are the only party still holding that, at the only moment it is being
+  written down.
+
 - **The ledger is the retraction path, precisely because it is cheap.** Writing a finding feels
   productive; writing a retraction is a chore produced mid-task, after being corrected, when
   attention has moved on. A rule saying "always record retractions durably" is a discipline, and

package/plugins/lisa-copilot/rules/reference/withdrawn-rulings.md

@@ -75,6 +75,40 @@ JSONL rather than prose: each line is independent, so concurrent appends from ma
 collide and `merge=union` reconstructs the union exactly. A prose ledger would need a bespoke merge
 driver to survive the same traffic.
 
+## The re-audit field, and why it is required (CodySwannGT/lisa#3489)
+
+A tombstone answers "this claim is dead". It does not answer **"what did I build while it was
+alive?"** — and that is the half that reached other agents and the human. Correcting a premise
+removes the belief and leaves every inference standing.
+
+The observed instance: a session spent part of a day believing a readiness preflight's false claim
+that a credential CLI was unavailable. A delegate probed the binary and disproved it, the session
+updated the fact, and carried on. It never asked what it had concluded while believing the false
+thing. Two hours later it relayed to its human that a work item was blocked because an SSO session
+had expired and a deployed template could not be read — relayed unexamined, while already knowing
+the vault worked, and while its own config had listed the relevant bootstrap secret the whole time.
+Three facts sat in one context and were never joined.
+
+So `--derived` is a required field on every withdrawal, and `--derived none` is the explicit empty
+answer. The record always carries the key: an empty list means *audited, nothing survives*, and an
+absent key means *never audited*. Distinguishing those two is the entire purpose, which is why the
+push gate refuses a ledger entry that omits it — otherwise the write-time refusal would be a
+formality anyone could route around by editing the file.
+
+**Why it cannot be a scanner instead.** Re-auditing after the fact would require asking "which
+artifacts rest on premise P". Nothing can answer that. Learnings-ledger entries carry `provenance`
+refs and are genuinely queryable that way, but they are the only artifact class that is: a tracker
+item marked blocked, a sentence relayed to an operator, a message to a peer session, an evidence
+file — none record the premise they rest on. **Re-auditing those is not merely unenforced; for
+anyone but the session still holding the context, it is impossible.** The obligation therefore has
+to bind at the one moment that knowledge is both present and being written down.
+
+Note the division of labour with `--reached`, which is a different question. `--reached` records the
+**audience** — who received the claim, which is #3752's problem of delivery. `--derived` records the
+**derivation** — what now stands on it, which is #3489's problem. A tombstone can reach every holder
+and still leave a wrong tracker state behind, and it can enumerate its inferences while reaching
+nobody. Both fields, or neither half is covered.
+
 ## How a running session is reached
 
 `--session-start` stamps a per-session mark recording the ids the session was born already knowing.

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.53.1",
+  "version": "4.53.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/withdrawn-rulings.mjs

@@ -62,9 +62,35 @@
  * chore produced mid-task, after being corrected, when attention has moved on.
  * A rule of the form "always record retractions durably" is a discipline, and
  * this repository's own measurement is that prose rules land at roughly zero
- * adoption. `--withdraw` is therefore one command with three required fields,
+ * adoption. `--withdraw` is therefore one command with four required fields,
  * and it refuses without the verbatim claim: a tombstone the holder of the
  * claim cannot recognise reaches them without reaching them.
+ *
+ * ## Why the re-audit is a required FIELD and not a reminder
+ *
+ * Correcting a premise removes the belief and leaves every inference standing
+ * (CodySwannGT/lisa#3489). The observed instance: a session disproved a false
+ * claim that a credential CLI was unavailable, updated the fact, and two hours
+ * later still relayed to its human that a work item was blocked for a reason
+ * that rested on the retracted claim. Three facts sat in one context and were
+ * never joined. The retraction was recorded; the artifacts it invalidated were
+ * not revisited.
+ *
+ * This file already carried the obligation as prose — "if you already relayed
+ * or recorded one, correct it on the same surface" — which is the discipline
+ * shape this module exists to distrust. So `--derived` is required, and
+ * `--derived none` is the explicit empty answer. The obligation is to PRODUCE
+ * the list, not to find something wrong in it: an empty answer is fine, an
+ * absent one is not, and the difference between them is the whole control.
+ *
+ * It has to bind here because there is nowhere else it could. A scanner that
+ * went looking for artifacts resting on a retracted premise would find nothing
+ * to read: outside the learnings ledger's `provenance` refs, no artifact Lisa
+ * writes records the premise it rests on. A tracker item marked blocked, a
+ * statement relayed to a human, a message to a peer session — none carry a
+ * back-pointer. The retracting session is the only party that still holds the
+ * derivation, and the moment it runs this command is the only moment that
+ * knowledge is both present and being written down.
  * @module withdrawn-rulings
  */
 import * as fs from "node:fs";
@@ -220,6 +246,15 @@ export function formatNotice(entries, headline) {
       lines.push(`  superseded by: ${entry.supersededBy}`);
     if (Array.isArray(entry.reached) && entry.reached.length > 0)
       lines.push(`  originally reached: ${entry.reached.join(", ")}`);
+    // Printed even when empty, and that is the useful case: it tells a reader
+    // the withdrawer looked, so nobody repeats the audit and nobody assumes it
+    // happened. An entry with no `derived` key at all says neither.
+    if (Array.isArray(entry.derived))
+      lines.push(
+        entry.derived.length > 0
+          ? `  still standing on it: ${entry.derived.join(", ")}`
+          : `  still standing on it: nothing (audited by the withdrawer)`
+      );
     return lines.join("\n");
   });
   return [
@@ -362,6 +397,24 @@ export function normalizeSuperseded(value) {
   return trimmed === "" || trimmed.toLowerCase() === "none" ? null : trimmed;
 }
 
+/**
+ * Normalise `--derived` values into the re-audit list.
+ *
+ * `none` is a real answer and must survive as one. A withdrawer who checked and
+ * found nothing standing has discharged the obligation exactly as fully as one
+ * who lists five artifacts, and the record has to be able to say so — otherwise
+ * the only way to satisfy the field is to invent an entry, which is worse than
+ * the gap it closes. Absent is refused elsewhere; `none` resolves here to an
+ * empty list, which reads back as "audited, nothing survives".
+ * @param {readonly string[]} values Raw `--derived` values, in order given.
+ * @returns {string[]} The artifacts still standing, possibly none.
+ */
+export function normalizeDerived(values) {
+  return values
+    .map(value => value.trim())
+    .filter(value => value !== "" && value.toLowerCase() !== "none");
+}
+
 /**
  * Build the record `--withdraw` appends, refusing an unrecognisable tombstone.
  * @param {readonly string[]} argv Arguments.
@@ -380,12 +433,25 @@ export function buildWithdrawal(argv, now) {
     };
   if (because === "")
     return { error: "--because is required: say what disproved it" };
+  const derived = flagValues(argv, "--derived");
+  if (derived.length === 0)
+    return {
+      error:
+        "--derived is required: name what you asserted, filed or relayed while you " +
+        "believed this, so the retraction reaches those artifacts too. Correcting a " +
+        "premise leaves every inference standing. Pass `--derived none` if you checked " +
+        "and nothing survives — an empty answer is fine, an absent one is not.",
+    };
   return {
     record: {
       id,
       withdrawnAt: now,
       claim,
       because,
+      // Present even when empty: the difference between "audited, nothing
+      // survives" and "never audited" is the whole point of the field, and an
+      // omitted key cannot express the first.
+      derived: normalizeDerived(derived),
       // "none" is what a person types when nothing replaced the claim, and a
       // string "none" in the record would print as a superseding id that does
       // not exist. Normalised here rather than at every reader.
@@ -452,6 +518,15 @@ export function runCheck(root) {
   for (const entry of entries) {
     if (typeof entry.claim !== "string" || entry.claim === "")
       problems.push(`${entry.id}: no verbatim claim recorded`);
+    // An absent `derived` is a tombstone whose writer never said what rested on
+    // the claim. That is the CodySwannGT/lisa#3489 failure written into the
+    // ledger, and letting it through here would make the write-time refusal a
+    // formality anything could route around by editing the file.
+    if (!Array.isArray(entry.derived))
+      problems.push(
+        `${entry.id}: no re-audit recorded — say what was asserted, filed or relayed ` +
+          `while the claim was believed, or record an empty list to say nothing survives`
+      );
     if (
       typeof entry.withdrawnAt !== "string" ||
       Number.isNaN(Date.parse(entry.withdrawnAt))