backend-skeleton 1.6.0 → 1.7.0

package/bin/bskel.mjs

@@ -30,8 +30,9 @@ import { ADAPTERS, LOAD_ERRORS, adapterById } from '../scanners/registry.mjs';
 import { COMMAND_CAPABILITIES, CAPABILITY_SATISFIERS, explainMissingCapability } from '../scanners/capabilities.mjs';
 import { buildContract, selectModule, CONTRACT_SCHEMA_VERSION } from '../contracts/emit.mjs';
 import { validateEnvelope, operationPayloadSchema } from '../contracts/validate.mjs';
-import { evaluateResolution, loadResolution, saveResolution, requireWarningCode, warningKey, countByCode } from '../contracts/completeness.mjs';
+import { evaluateResolution, loadResolution, saveResolution, requireWarningCode, warningKey, countByCode, isWaiverExpired } from '../contracts/completeness.mjs';
 import { loadPatchApprovals, savePatchApprovals, approvalKey } from '../lib/patch-approvals.mjs';
+import { appendDecisionEvent, readDecisionLog } from '../lib/decision-log.mjs';
 import { proposeTransaction, approveTransaction, applyTransaction, rollbackTransaction, loadTransaction, listTransactions } from '../lib/patch-transactions.mjs';
 import { getPatchKind, replanTransaction, PATCH_KIND_NAMES } from '../lib/patch-kinds.mjs';
 import { generateKeypair, signPayload, verifyPayload, publicKeyIdFromPrivate, publicKeyIdFromPublic } from '../lib/attest.mjs';
@@ -42,7 +43,7 @@ import {
 	declareDependency, removeDependency, buildDependencyListReport,
 } from '../lib/field-dependencies.mjs';
 import {
-	ImpactOperationError, checkImpact, acceptImpact, recordDisposition, acknowledgeInbound,
+	ImpactOperationError, checkImpact, acceptImpact, recordDisposition, acknowledgeInbound, withdrawDisposition,
 } from '../lib/impact.mjs';
 import { buildImpactGraph } from '../lib/impact-graph.mjs';
 import { toGraphifyExtraction, toMermaid } from '../lib/impact-export-graphify.mjs';
@@ -103,6 +104,7 @@ function usage() {
   bskel scan repair --feature <id> [--json]
   bskel scan cross-feature-check --feature <id> [--db [--database-url-env <NAME>] [--schema public]] [--json]
   bskel scan cross-feature-waive --feature <id> --signal resource_type|table|operation_id|db_foreign_key --identifier <name> --other-feature <id> --reason "..."
+  bskel scan cross-feature-unwaive --feature <id> --signal resource_type|table|operation_id|db_foreign_key --identifier <name> --other-feature <id> --reason "..." [--json]
   bskel feature init --slug <name>
   bskel feature list [--all] [--json]
   bskel feature show <id> [--json]
@@ -117,12 +119,13 @@ function usage() {
   bskel contract validate --feature <id> --file <envelope.json>
   bskel contract tool-schema --feature <id> --operation <operationId>
   bskel contract waive --feature <id> --code <CODE> (--subject "VERB /path"|--all) --reason "..." [--expires <Nd>]
+  bskel contract unwaive --feature <id> --code <CODE> --subject "VERB /path" --reason "..." [--json]
   bskel dependency declare --feature <id> --resource <Type> --field <name> --source-feature <id> --source-resource <Type> --source-field <name> --reason "..." [--memo "..."]
   bskel dependency remove --feature <id> --resource <Type> --field <name> --source-feature <id> --source-resource <Type> --source-field <name> --reason "..."
   bskel dependency list --feature <id> [--json]
   bskel impact check --feature <id> [--all] [--json]
   bskel impact accept --feature <id> [--json]
-  bskel impact disposition --feature <id> --change <change_key> --downstream <id> --mode <compatible|migrate|waive> --reason "..." [--tracked-by "..."] [--expires-days <N>] [--json]
+  bskel impact disposition --feature <id> --change <change_key> --downstream <id> (--mode <compatible|migrate|waive> [--tracked-by "..."] [--expires-days <N>] | --withdraw) --reason "..." [--json]
   bskel impact ack --feature <id> --from <id> --change <change_key> --reason "..." [--json]
   bskel impact export --format <graphify|json|mermaid> [--out <path>] [--focus <id>] [--rings <N>]
   bskel rules check --feature <id> [--init] [--json]
@@ -134,6 +137,7 @@ function usage() {
   bskel handles plan --feature <id> [--module <name>] [--resource type1,type2] [--diff] [--ast]
   bskel handles emit --feature <id> [--module <name>] [--resource type1,type2] [--force --reason "..."] [--check] [--diff] [--enforce-registry on|off --reason "..."]
   bskel handles patch approve --feature <id> [--module <name>] --resource <Type> --field <name> --strategy patch-wrapper|null-means-unchanged --reason "..." [--json]
+  bskel handles patch unapprove --feature <id> --resource <Type> --field <name> --reason "..." [--json]
   bskel handles audit --feature <id> --database-url-env <NAME> [--resource type1,type2] [--module <name>] [--check-registry-coverage] [--json]
   bskel patch propose --feature <id> [--kind config-apply|ddl-apply|java-source-splice] --choice <stackChoiceId> --target <config_check target path> --database-url-env <NAME> --schema <name> --sql-file <path> --splice-file <path> [--json]
   bskel patch approve --feature <id> --transaction <id> --reason "..." [--json]
@@ -1025,6 +1029,10 @@ function cmdScanCrossFeatureWaive(args) {
 			waivers: [...resolution.waivers.filter((w) => waiverKey(w) !== key), entry],
 		};
 		saveCrossFeatureResolution(root, flags.feature, next);
+		appendDecisionEvent(root, flags.feature, {
+			kind: 'cross_feature_waiver', action: 'record', at: entry.at, reason: entry.reason, feature_id: flags.feature,
+			subject: { signal: entry.signal, identifier: entry.identifier, other_feature: entry.other_feature },
+		});
 		return next;
 	});
 
@@ -1048,6 +1056,64 @@ function cmdScanCrossFeatureWaive(args) {
 	process.exit(evaluation.blocking ? EXIT.AWAITING_DISPOSITION : EXIT.PASS);
 }
 
+// D-decision-event-log (D6): forward-only retraction, mirroring `gate revoke` -- removes the
+// waiver entry and appends a `withdraw` decision event. Never a snapshot restore.
+function cmdScanCrossFeatureUnwaive(args) {
+	const flags = parseCommand('scan cross-feature-unwaive', args);
+	if (flags.help) { console.log(renderCommandHelp('scan cross-feature-unwaive')); process.exit(0); }
+	setContext('scan cross-feature-unwaive', flags);
+	const root = requireRepoRoot();
+	requireValidFeatureId(flags.feature);
+	requireValidFeatureId(flags['other-feature']);
+	if (!flags.reason || !flags.reason.trim()) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', 'bskel scan cross-feature-unwaive requires --reason "..." -- every withdrawal must be auditable');
+	}
+	const report = loadCrossFeatureReport(root, flags.feature);
+	if (!report) {
+		fail(EXIT_CODES.NOT_PASSED, 'MISSING_ARTIFACT', `no cross-feature-report.json for feature "${flags.feature}"`);
+	}
+	const key = waiverKey({ signal: flags.signal, identifier: flags.identifier, other_feature: flags['other-feature'] });
+
+	const updated = withLockSync(root, 'state', () => {
+		const resolution = loadCrossFeatureResolution(root, flags.feature);
+		const match = resolution.waivers.find((w) => waiverKey(w) === key);
+		if (!match) {
+			fail(EXIT_CODES.NOT_PASSED, 'MISSING_ARTIFACT', `no waiver recorded for --signal ${flags.signal} --identifier "${flags.identifier}" --other-feature ${flags['other-feature']} -- nothing to unwaive`);
+		}
+		const at = new Date().toISOString();
+		const next = {
+			schema: 'sbf.cross-feature-resolution/1',
+			feature_id: flags.feature,
+			waivers: resolution.waivers.filter((w) => waiverKey(w) !== key),
+		};
+		saveCrossFeatureResolution(root, flags.feature, next);
+		appendDecisionEvent(root, flags.feature, {
+			kind: 'cross_feature_waiver', action: 'withdraw', at, reason: flags.reason, feature_id: flags.feature,
+			subject: { signal: match.signal, identifier: match.identifier, other_feature: match.other_feature },
+		});
+		return next;
+	});
+
+	const evaluation = evaluateCrossFeatureFindings(report.findings, updated);
+	const evidence = {
+		finding_count: report.findings.length,
+		high_confidence_count: report.findings.filter((f) => f.confidence === 'high').length,
+		waived_count: evaluation.waived.length,
+		stale_waivers: evaluation.staleWaivers.length,
+	};
+	const gateState = evaluation.blocking
+		? awaitNamedGateDisposition(root, 'cross_feature', flags.feature, { ...evidence, unwaived: evaluation.unwaived })
+		: passNamedGate(root, 'cross_feature', flags.feature, evidence);
+
+	if (flags.json) {
+		console.log(JSON.stringify({ withdrawn: true, gate: gateState.gates.cross_feature }, null, 2));
+	} else if (!flags.quiet) {
+		console.log(`unwaived: ${flags.signal} "${flags.identifier}" (${flags['other-feature']})`);
+		console.log(`gate: cross_feature -> ${gateState.gates.cross_feature.status}`);
+	}
+	process.exit(evaluation.blocking ? EXIT.AWAITING_DISPOSITION : EXIT.PASS);
+}
+
 // D6 (D-feature-lifecycle): the whole read-specs/->compute-NNN->write-feature.json->
 // load-modify-save-feature-index.json sequence runs under one exclusive lock -- confirmed live
 // during this item's own grounding, the same lost-update shape S5 already fixed for setGate():
@@ -1913,20 +1979,38 @@ function cmdContractWaive(args) {
 	// entries). Locking only the final write (inside saveResolution()) would NOT close this race --
 	// the window is between this function's own loadResolution() read and its save, not inside the
 	// write call itself.
-	const { resolution: updatedResolution, newEntries } = withLockSync(root, 'state', () => {
+	// D-waiver-renewal: `existingKeys` -- the "already waived, do nothing" set -- must only contain
+	// keys of waivers that are still LIVE. Before this fix it was built from every stored waiver
+	// regardless of expires_at, so an expired waiver's key permanently "existed" and every renewal
+	// attempt matched it and produced zero new entries (see contracts/completeness.mjs's
+	// isWaiverExpired() for the shared predicate this now shares with evaluateResolution() -- the
+	// two were previously two unsynchronized inline checks). A renewal replaces the expired entry
+	// (same key never appears twice) rather than appending alongside it, which would otherwise leave
+	// evaluateResolution()'s expiredKeys/waivedKeys sets computing over two same-key entries.
+	const { resolution: updatedResolution, newEntries, renewedEntries } = withLockSync(root, 'state', () => {
 		const resolution = loadResolution(root, flags.feature);
-		const existingKeys = new Set((resolution.waivers ?? []).map(warningKey));
+		const now = Date.now();
+		const liveWaivers = (resolution.waivers ?? []).filter((w) => !isWaiverExpired(w, now));
+		const expiredKeys = new Set((resolution.waivers ?? []).filter((w) => isWaiverExpired(w, now)).map(warningKey));
+		const liveKeys = new Set(liveWaivers.map(warningKey));
 		const at = new Date().toISOString();
-		const entries = toWaive
-			.filter((w) => !existingKeys.has(warningKey(w)))
-			.map((w) => ({ code: w.code, subject: w.subject, reason: flags.reason, at, ...(expiresAt ? { expires_at: expiresAt } : {}) }));
+		const toRecord = toWaive.filter((w) => !liveKeys.has(warningKey(w)));
+		const entries = toRecord.map((w) => ({ code: w.code, subject: w.subject, reason: flags.reason, at, ...(expiresAt ? { expires_at: expiresAt } : {}) }));
+		const newEntriesOut = entries.filter((e) => !expiredKeys.has(warningKey(e)));
+		const renewedEntriesOut = entries.filter((e) => expiredKeys.has(warningKey(e)));
 		const next = {
 			schema: 'sbf.contract-resolution/1',
 			feature_id: flags.feature,
-			waivers: [...(resolution.waivers ?? []), ...entries],
+			waivers: [...liveWaivers, ...entries],
 		};
 		saveResolution(root, flags.feature, next);
-		return { resolution: next, newEntries: entries };
+		for (const e of newEntriesOut) {
+			appendDecisionEvent(root, flags.feature, { kind: 'contract_waiver', action: 'record', at: e.at, reason: e.reason, feature_id: flags.feature, subject: { code: e.code, subject: e.subject ?? null }, expires_at: e.expires_at ?? null });
+		}
+		for (const e of renewedEntriesOut) {
+			appendDecisionEvent(root, flags.feature, { kind: 'contract_waiver', action: 'renew', at: e.at, reason: e.reason, feature_id: flags.feature, subject: { code: e.code, subject: e.subject ?? null }, expires_at: e.expires_at ?? null });
+		}
+		return { resolution: next, newEntries: newEntriesOut, renewedEntries: renewedEntriesOut };
 	});
 
 	const evaluation = evaluateResolution(contract, updatedResolution);
@@ -1944,10 +2028,14 @@ function cmdContractWaive(args) {
 		: passNamedGate(root, 'contract', flags.feature, evidence);
 
 	if (flags.json) {
-		console.log(JSON.stringify({ waived: newEntries, gate: gateState.gates.contract }, null, 2));
+		console.log(JSON.stringify({ waived: newEntries, renewed: renewedEntries, gate: gateState.gates.contract }, null, 2));
 	} else {
 		if (!flags.quiet) {
-			console.log(`waived ${newEntries.length} new warning(s)${newEntries.length < toWaive.length ? ` (${toWaive.length - newEntries.length} already waived)` : ''}${expiresAt ? `, expiring ${expiresAt}` : ''}`);
+			const alreadyWaived = toWaive.length - newEntries.length - renewedEntries.length;
+			console.log(`waived ${newEntries.length} new warning(s)${alreadyWaived > 0 ? ` (${alreadyWaived} already waived)` : ''}${expiresAt ? `, expiring ${expiresAt}` : ''}`);
+			if (renewedEntries.length > 0) {
+				console.log(`renewed ${renewedEntries.length} expired waiver(s)${expiresAt ? `, expiring ${expiresAt}` : ''}`);
+			}
 			console.log(`gate: contract -> ${gateState.gates.contract.status}`);
 		}
 		if (evaluation.expiredWaivers.length > 0) {
@@ -1962,6 +2050,65 @@ function cmdContractWaive(args) {
 	process.exit(evaluation.blocking ? EXIT.AWAITING_DISPOSITION : EXIT.PASS);
 }
 
+// D-decision-event-log (D6): forward-only retraction of exactly one {code, subject} waiver --
+// mirrors `gate revoke`'s own precedent (the entry's absence IS the state, not a snapshot restore
+// of its prior reason/expiry, which stays recoverable only from the decision log). Re-evaluates
+// and re-sets the gate the same way `cmdContractWaive` does, since removing a waiver can turn a
+// passing gate back into an awaiting_disposition one.
+function cmdContractUnwaive(args) {
+	const flags = parseCommand('contract unwaive', args);
+	if (flags.help) { console.log(renderCommandHelp('contract unwaive')); process.exit(0); }
+	setContext('contract unwaive', flags);
+	const root = requireRepoRoot();
+	if (!flags.reason || !flags.reason.trim()) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', 'bskel contract unwaive requires --reason "..." -- every withdrawal must be auditable');
+	}
+	const contract = loadContract(root, flags.feature);
+	const key = warningKey({ code: flags.code, subject: flags.subject });
+
+	const updatedResolution = withLockSync(root, 'state', () => {
+		const resolution = loadResolution(root, flags.feature);
+		const match = (resolution.waivers ?? []).find((w) => warningKey(w) === key);
+		if (!match) {
+			fail(EXIT_CODES.NOT_PASSED, 'MISSING_ARTIFACT', `no waiver recorded for "${flags.code}" (${flags.subject}) on "${flags.feature}" -- nothing to unwaive`);
+		}
+		const at = new Date().toISOString();
+		const next = {
+			schema: 'sbf.contract-resolution/1',
+			feature_id: flags.feature,
+			waivers: (resolution.waivers ?? []).filter((w) => warningKey(w) !== key),
+		};
+		saveResolution(root, flags.feature, next);
+		appendDecisionEvent(root, flags.feature, {
+			kind: 'contract_waiver', action: 'withdraw', at, reason: flags.reason, feature_id: flags.feature,
+			subject: { code: match.code, subject: match.subject ?? null }, expires_at: match.expires_at ?? null,
+		});
+		return next;
+	});
+
+	const evaluation = evaluateResolution(contract, updatedResolution);
+	const evidence = {
+		operation_count: contract.completeness.operation_count,
+		endpoint_count: contract.completeness.endpoint_count,
+		completeness: evaluation.status,
+		warning_codes: countByCode(contract.warnings),
+		waived_count: evaluation.waived.length,
+		stale_waivers: evaluation.staleWaivers.length,
+		expired_waivers: evaluation.expiredWaivers.length,
+	};
+	const gateState = evaluation.blocking
+		? awaitNamedGateDisposition(root, 'contract', flags.feature, { ...evidence, unwaived: evaluation.unwaived.map(({ code, subject }) => ({ code, subject })) })
+		: passNamedGate(root, 'contract', flags.feature, evidence);
+
+	if (flags.json) {
+		console.log(JSON.stringify({ withdrawn: { code: flags.code, subject: flags.subject }, gate: gateState.gates.contract }, null, 2));
+	} else {
+		console.log(`unwaived: ${flags.code} (${flags.subject})`);
+		console.log(`gate: contract -> ${gateState.gates.contract.status}`);
+	}
+	process.exit(evaluation.blocking ? EXIT.AWAITING_DISPOSITION : EXIT.PASS);
+}
+
 // D-dependency-propagation-notice: called from cmdContractEmit/cmdHandlesEmit to warn a SOURCE
 // feature, at the moment its own generated artifacts are refreshed, that other features declared a
 // dependency on one of its fields. Only surfaces a note when the dependent's OWN `dependencies` gate
@@ -2142,11 +2289,30 @@ function cmdImpactAccept(args) {
 	process.exit(EXIT.PASS);
 }
 
+// D-decision-event-log (D6): --withdraw is a flag variant of this same command, not a separate
+// subcommand -- withdrawal needs no --mode (there is nothing left to mode-classify once the
+// disposition is gone), so branching inside cmdImpactDisposition keeps the option set honest
+// rather than requiring --mode on a withdrawal that doesn't use it.
 function cmdImpactDisposition(args) {
 	const flags = parseCommand('impact disposition', args);
 	if (flags.help) { console.log(renderCommandHelp('impact disposition')); process.exit(0); }
 	setContext('impact disposition', flags);
 	const root = requireRepoRoot();
+	if (flags.withdraw) {
+		let result;
+		try {
+			result = withdrawDisposition(root, { feature: flags.feature, changeKey: flags.change, downstreamFeature: flags.downstream, reason: flags.reason });
+		} catch (err) {
+			if (err instanceof ImpactOperationError) fail(err.exitCode, err.reasonCode, err.message);
+			throw err;
+		}
+		if (flags.json) {
+			console.log(JSON.stringify(result, null, 2));
+		} else {
+			console.log(`disposition withdrawn: ${flags.change} -> ${flags.downstream}`);
+		}
+		process.exit(EXIT.PASS);
+	}
 	let result;
 	try {
 		result = recordDisposition(root, {
@@ -3346,6 +3512,10 @@ function cmdHandlesPatchApprove(args) {
 		const withoutExisting = (current.approvals ?? []).filter((a) => approvalKey(a.resource, a.field) !== key);
 		const next = { schema: 'sbf.patch-approvals/1', feature_id: flags.feature, approvals: [...withoutExisting, entry] };
 		savePatchApprovals(root, flags.feature, next);
+		appendDecisionEvent(root, flags.feature, {
+			kind: 'patch_approval', action: 'record', at, reason: flags.reason, feature_id: flags.feature,
+			subject: { resource: flags.resource, field: flags.field }, strategy: flags.strategy,
+		});
 		return next;
 	});
 
@@ -3353,6 +3523,41 @@ function cmdHandlesPatchApprove(args) {
 	process.exit(0);
 }
 
+// D-decision-event-log (D6): forward-only retraction, mirroring `gate revoke` -- removes the
+// approval entry and appends a `withdraw` decision event. patch-approvals.json is not itself a
+// gate input (F3's fix is binding it into signed attestations, not making it a gate -- see
+// D-decision-event-log's own EXIT), so unlike the other three withdraw commands there is no gate
+// to re-evaluate here.
+function cmdHandlesPatchUnapprove(args) {
+	const flags = parseCommand('handles patch unapprove', args);
+	if (flags.help) { console.log(renderCommandHelp('handles patch unapprove')); process.exit(0); }
+	setContext('handles patch unapprove', flags);
+	const root = requireRepoRoot();
+	if (!flags.reason || !flags.reason.trim()) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', 'bskel handles patch unapprove requires --reason "..." -- every withdrawal must be auditable');
+	}
+	const key = approvalKey(flags.resource, flags.field);
+
+	const updated = withLockSync(root, 'state', () => {
+		const current = loadPatchApprovals(root, flags.feature);
+		const match = (current.approvals ?? []).find((a) => approvalKey(a.resource, a.field) === key);
+		if (!match) {
+			fail(EXIT_CODES.NOT_PASSED, 'MISSING_ARTIFACT', `no approval recorded for "${flags.resource}.${flags.field}" on "${flags.feature}" -- nothing to unapprove`);
+		}
+		const at = new Date().toISOString();
+		const next = { schema: 'sbf.patch-approvals/1', feature_id: flags.feature, approvals: (current.approvals ?? []).filter((a) => approvalKey(a.resource, a.field) !== key) };
+		savePatchApprovals(root, flags.feature, next);
+		appendDecisionEvent(root, flags.feature, {
+			kind: 'patch_approval', action: 'withdraw', at, reason: flags.reason, feature_id: flags.feature,
+			subject: { resource: flags.resource, field: flags.field }, strategy: match.strategy,
+		});
+		return next;
+	});
+
+	console.log(flags.json ? JSON.stringify(updated, null, 2) : `unapproved: ${flags.resource}.${flags.field}`);
+	process.exit(0);
+}
+
 // D-patch-transactions: Slice 1 (config_check -> config_apply). All four commands only touch
 // specs/<featureId>/patch-transactions/ except `apply`/`rollback`, which write to the real target
 // file too -- matching D4's own "propose/approve are specs/-only, apply/rollback touch the repo"
@@ -4681,6 +4886,7 @@ async function dispatchCommand(cmd, rest) {
 			if (rest[0] === 'repair') return cmdScanRepair(rest.slice(1));
 			if (rest[0] === 'cross-feature-check') return cmdScanCrossFeatureCheck(rest.slice(1));
 			if (rest[0] === 'cross-feature-waive') return cmdScanCrossFeatureWaive(rest.slice(1));
+			if (rest[0] === 'cross-feature-unwaive') return cmdScanCrossFeatureUnwaive(rest.slice(1));
 			await cmdScan(rest);
 			break;
 		}
@@ -4705,6 +4911,7 @@ async function dispatchCommand(cmd, rest) {
 			if (sub === 'validate') return cmdContractValidate(subArgs);
 			if (sub === 'tool-schema') return cmdContractToolSchema(subArgs);
 			if (sub === 'waive') return cmdContractWaive(subArgs);
+			if (sub === 'unwaive') return cmdContractUnwaive(subArgs);
 			usage();
 			process.exit(14);
 			break;
@@ -4768,6 +4975,7 @@ async function dispatchCommand(cmd, rest) {
 			if (rest[0] === 'plan') return cmdHandlesPlan(rest.slice(1));
 			if (rest[0] === 'emit') return cmdHandlesEmit(rest.slice(1));
 			if (rest[0] === 'patch' && rest[1] === 'approve') return cmdHandlesPatchApprove(rest.slice(2));
+			if (rest[0] === 'patch' && rest[1] === 'unapprove') return cmdHandlesPatchUnapprove(rest.slice(2));
 			if (rest[0] === 'audit') return await cmdHandlesAudit(rest.slice(1));
 			usage();
 			process.exit(14);

package/contracts/completeness.mjs

@@ -225,11 +225,22 @@ export function saveResolution(root, featureId, resolution) {
 // its warning, so `unwaived`/`blocking` treat it exactly as if it had never been recorded. A
 // waiver can be BOTH stale and expired at once (nothing prevents that combination); the two
 // lists are independent, not mutually exclusive.
+// D-waiver-renewal: the single shared expiry predicate. Previously inlined once here and NOT
+// consulted by `cmdContractWaive`'s own "is this already waived" check (bin/bskel.mjs) -- that
+// second, unsynchronized check meant an expired waiver was `waived` for evaluateResolution's
+// purposes (correctly stops blocking) but simultaneously "already exists" for the CLI's own
+// existingKeys set, so re-waiving it silently matched zero new entries and never updated the
+// stored expires_at. Exporting one function closes that gap at the source instead of requiring
+// two call sites to independently reimplement `Date.parse(w.expires_at) <= now` in sync forever.
+export function isWaiverExpired(waiver, now = Date.now()) {
+	return typeof waiver.expires_at === 'string' && Date.parse(waiver.expires_at) <= now;
+}
+
 export function evaluateResolution(contract, resolution) {
 	const status = classifyContract(contract);
 	const waivers = resolution.waivers ?? [];
 	const now = Date.now();
-	const expiredWaivers = waivers.filter((w) => typeof w.expires_at === 'string' && Date.parse(w.expires_at) <= now);
+	const expiredWaivers = waivers.filter((w) => isWaiverExpired(w, now));
 	const expiredKeys = new Set(expiredWaivers.map(warningKey));
 	const waivedKeys = new Set(waivers.filter((w) => !expiredKeys.has(warningKey(w))).map(warningKey));
 

package/lib/cli.mjs

@@ -187,6 +187,20 @@ export const COMMANDS = {
 			json: { type: 'boolean', default: false },
 		},
 	},
+	// D-decision-event-log (D6): forward-only retraction, mirroring `gate revoke` -- removes the
+	// waiver entry (its absence is the state) and appends a `withdraw` decision event. Never a
+	// snapshot restore.
+	'scan cross-feature-unwaive': {
+		usage: 'bskel scan cross-feature-unwaive --feature <id> --signal resource_type|table|operation_id|db_foreign_key --identifier <name> --other-feature <id> --reason "..." [--json]',
+		options: {
+			feature: { type: 'string', default: null, required: true },
+			signal: { type: 'string', default: null, required: true },
+			identifier: { type: 'string', default: null, required: true },
+			'other-feature': { type: 'string', default: null, required: true },
+			reason: { type: 'string', default: '' },
+			json: { type: 'boolean', default: false },
+		},
+	},
 	'feature init': {
 		usage: 'bskel feature init --slug <name>',
 		options: { slug: { type: 'string', default: null, required: true } },
@@ -299,6 +313,20 @@ export const COMMANDS = {
 			json: { type: 'boolean', default: false },
 		},
 	},
+	// D-decision-event-log (D6): forward-only retraction, mirroring `gate revoke` -- removes the
+	// waiver entry (its absence is the state) and appends a `withdraw` decision event. Never a
+	// snapshot restore (the entry's prior reason/expiry is preserved only in the decision log, not
+	// restorable through this command).
+	'contract unwaive': {
+		usage: 'bskel contract unwaive --feature <id> --code <CODE> --subject "VERB /path" --reason "..." [--json]',
+		options: {
+			feature: { type: 'string', default: null, required: true },
+			code: { type: 'string', default: null, required: true },
+			subject: { type: 'string', default: null, required: true },
+			reason: { type: 'string', default: '' },
+			json: { type: 'boolean', default: false },
+		},
+	},
 	'contract validate': {
 		usage: 'bskel contract validate --feature <id> --file <envelope.json>',
 		options: {
@@ -370,16 +398,21 @@ export const COMMANDS = {
 	},
 	// D-cross-feature-impact-graph (D6): three modes, three mechanically different consequences --
 	// `migrate` requires --tracked-by, `waive` requires --expires-days. `compatible` needs neither.
+	// D-decision-event-log (D6): --withdraw is a flag variant of this same command, not a separate
+	// subcommand -- a withdrawal needs no --mode, so `mode` is NOT `required: true` at the parse
+	// layer (recordDisposition() itself still refuses a missing/invalid mode on the record path --
+	// see cmdImpactDisposition's own comment for why this split is deliberate).
 	'impact disposition': {
-		usage: 'bskel impact disposition --feature <id> --change <change_key> --downstream <id> --mode compatible|migrate|waive --reason "..." [--tracked-by "<ref>"] [--expires-days <N>] [--json]',
+		usage: 'bskel impact disposition --feature <id> --change <change_key> --downstream <id> (--mode compatible|migrate|waive [--tracked-by "<ref>"] [--expires-days <N>] | --withdraw) --reason "..." [--json]',
 		options: {
 			feature: { type: 'string', default: null, required: true },
 			change: { type: 'string', default: null, required: true },
 			downstream: { type: 'string', default: null, required: true },
-			mode: { type: 'string', default: null, required: true },
+			mode: { type: 'string', default: null },
 			reason: { type: 'string', default: '' },
 			'tracked-by': { type: 'string', default: null },
 			'expires-days': { type: 'string', default: null, numeric: { min: 1 } },
+			withdraw: { type: 'boolean', default: false },
 			json: { type: 'boolean', default: false },
 		},
 	},
@@ -645,6 +678,19 @@ export const COMMANDS = {
 			json: { type: 'boolean', default: false },
 		},
 	},
+	// D-decision-event-log (D6): forward-only retraction, mirroring `gate revoke` -- removes the
+	// approval entry (its absence is the state) and appends a `withdraw` decision event. Never a
+	// snapshot restore.
+	'handles patch unapprove': {
+		usage: 'bskel handles patch unapprove --feature <id> --resource <Type> --field <name> --reason "..." [--json]',
+		options: {
+			feature: { type: 'string', default: null, required: true },
+			resource: { type: 'string', default: null, required: true },
+			field: { type: 'string', default: null, required: true },
+			reason: { type: 'string', default: '' },
+			json: { type: 'boolean', default: false },
+		},
+	},
 	// D-patch-transactions: content-addressed patch transactions, Slice 1 (config_check ->
 	// config_apply). `propose`/`approve` only touch specs/, so no --force escape exists on either --
 	// re-propose is the only remediation for a stale target. `rollback` alone gets --force (reverting

package/lib/decision-log.mjs

@@ -0,0 +1,58 @@
+// D-decision-event-log: an append-only audit trail for the four spec-side decision files
+// (contract waivers, cross-feature waivers, impact dispositions, patch approvals) -- mirrors
+// lib/state.mjs's appendGateEvent()/readGateHistory() shape exactly (same file family, same
+// schema-validated-JSONL contract, same corrupt-line-is-skipped-not-fatal resilience). A sibling
+// to .sbf/<featureId>.history.jsonl, not a replacement for it -- gates keep their own log.
+//   WHY: F2 (found during this item's own grounding) -- all four decision files silently
+//   OVERWRITE the prior decision (reason/actor/timestamp) on re-decision, and none of the four had
+//   any retraction command. `gate revoke` is the only retraction primitive in the whole tool.
+//   COST: one more .sbf/ file per feature. Machine-local, gitignored-by-convention -- this log is
+//   NOT tamper-evident on its own (see schemas/decision-event.schema.json's own description);
+//   its evidentiary value comes from being rolled into a SIGNED gate-export attestation.
+//   EXIT: no cross-feature aggregate view; per-feature only, matching gate history's own scoping.
+import fs from 'node:fs';
+import { sbfDir } from './state.mjs';
+import { validateAgainstSchema, formatSchemaErrors } from './schema-validate.mjs';
+
+export function decisionLogPath(repoRoot, featureId) {
+	return `${sbfDir(repoRoot)}/${featureId}.decisions.jsonl`;
+}
+
+// Called from inside the SAME withLockSync(root, 'state', ...) each of the four write paths
+// already holds -- never opens its own lock, so the decision write and the log append can never
+// observe each other out of order (same discipline setGate() already applies to gate writes).
+export function appendDecisionEvent(repoRoot, featureId, event) {
+	const line = { schema: 'sbf.decision-event/1', ...event };
+	const { ok, errors } = validateAgainstSchema('decision-event.schema.json', line);
+	if (!ok) {
+		throw new Error(`refusing to append an invalid decision event for "${featureId}":\n${formatSchemaErrors(errors).join('\n')}`);
+	}
+	fs.mkdirSync(sbfDir(repoRoot), { recursive: true });
+	fs.appendFileSync(decisionLogPath(repoRoot, featureId), `${JSON.stringify(line)}\n`);
+}
+
+// Mirrors lib/gate-export.mjs's readGateHistory() resilience contract exactly: a corrupt/invalid
+// line is skipped with a warning, never a hard failure.
+export function readDecisionLog(repoRoot, featureId, { kind = null, onWarning } = {}) {
+	const file = decisionLogPath(repoRoot, featureId);
+	if (!fs.existsSync(file)) return [];
+	const lines = fs.readFileSync(file, 'utf8').split('\n').filter(Boolean);
+	const events = [];
+	for (const [i, line] of lines.entries()) {
+		let parsed;
+		try {
+			parsed = JSON.parse(line);
+		} catch {
+			onWarning?.(`${file}:${i + 1}: not valid JSON, skipped`);
+			continue;
+		}
+		const { ok, errors } = validateAgainstSchema('decision-event.schema.json', parsed);
+		if (!ok) {
+			onWarning?.(`${file}:${i + 1}: does not match schemas/decision-event.schema.json, skipped`, errors);
+			continue;
+		}
+		if (kind && parsed.kind !== kind) continue;
+		events.push(parsed);
+	}
+	return events;
+}

package/lib/gate-export.mjs

@@ -13,13 +13,17 @@ import { specPath, sbfPath } from './paths.mjs';
 import { crossFeatureReportPath, crossFeatureResolutionPath } from './cross-feature-collisions.mjs';
 import { dependenciesPath } from './field-dependencies.mjs';
 import { impactBaselinePath } from './impact-surface.mjs';
-import { impactReportPath, impactResolutionPath } from './impact.mjs';
+import { impactReportPath, impactResolutionPath, loadImpactResolution } from './impact.mjs';
 import { manifestPath } from './handles-manifest.mjs';
+import { patchApprovalsPath, loadPatchApprovals } from './patch-approvals.mjs';
+import { loadResolution } from '../contracts/completeness.mjs';
+import { loadCrossFeatureResolution } from './cross-feature-collisions.mjs';
+import { decisionLogPath, readDecisionLog } from './decision-log.mjs';
 import { currentBranch, headSha, headTreeSha, worktreeStatus } from './repo.mjs';
 import { validateAgainstSchema } from './schema-validate.mjs';
 import { CANONICALIZATION_ID } from './attest.mjs';
 
-export const EXPORT_SCHEMA_VERSION = 'sbf.gate-export/3';
+export const EXPORT_SCHEMA_VERSION = 'sbf.gate-export/4';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const SKILL_ROOT = path.resolve(__dirname, '..');
@@ -88,6 +92,11 @@ export const ARTIFACT_SOURCES = Object.freeze({
 	impact_baseline_hash: (root, featureId) => impactBaselinePath(root, featureId),
 	impact_report_hash: (root, featureId) => impactReportPath(root, featureId),
 	impact_resolution_hash: (root, featureId) => impactResolutionPath(root, featureId),
+	// D-decision-event-log (F3): patch-approvals.json was bound by NOTHING before this -- not a
+	// gate input, not an attestation artifact -- the exact same class of gap
+	// D-attestation-payload-completeness's finding #3 closed for .sbf/handles-manifest.json.
+	// sbf.gate-export/3 -> /4, additive (a /3 attestation still verifies, K7's own promise).
+	patch_approvals_hash: (root, featureId) => patchApprovalsPath(root, featureId),
 });
 
 export function collectArtifactHashes(root, featureId) {
@@ -103,7 +112,15 @@ export function collectArtifactHashes(root, featureId) {
 // cross_feature_resolution) are represented by presence+hash only, never embedded content: the
 // content is already bound via `artifacts` above, and embedding it again would duplicate that
 // binding while ballooning the payload for no new guarantee.
-export function collectDecisions(gatesById, artifacts) {
+// D-decision-event-log (D7): extended to cover all four spec-side decision files -- previously
+// only 2 of 4 appeared in waiver_files, and NONE of the four's live entries were represented at
+// all (only a hash). `records` mirrors gates.*.live's own "current vs live" distinction (K2):
+// each kind's entries here are LIVE-evaluated (expired contract/impact entries excluded), never
+// the raw stored array, so an expired-but-not-yet-renewed waiver never reads as still covering
+// its warning inside a signed attestation. `event_counts` rolls up the decision log -- present
+// even when a decision file itself is absent (an all-zero count is still informative: "no
+// decisions of this kind were ever made here", distinct from "the file doesn't exist").
+export function collectDecisions(root, featureId, gatesById, artifacts) {
 	const forced = [];
 	const revoked = [];
 	for (const [gate, entry] of Object.entries(gatesById)) {
@@ -112,13 +129,47 @@ export function collectDecisions(gatesById, artifacts) {
 		if (record.forced) forced.push({ gate, scope: entry.scope, reason: record.reason ?? null, at: record.at ?? null });
 		if (record.status === 'revoked') revoked.push({ gate, scope: entry.scope, reason: record.reason ?? null, at: record.at ?? null });
 	}
+
+	const now = Date.now();
+	const contractResolution = loadResolution(root, featureId);
+	const liveContractWaivers = (contractResolution.waivers ?? [])
+		.filter((w) => !(typeof w.expires_at === 'string' && Date.parse(w.expires_at) <= now))
+		.map((w) => ({ code: w.code, subject: w.subject ?? null, reason: w.reason, at: w.at, expires_at: w.expires_at ?? null }));
+
+	const crossFeatureResolution = loadCrossFeatureResolution(root, featureId);
+	const liveCrossFeatureWaivers = (crossFeatureResolution.waivers ?? [])
+		.map((w) => ({ signal: w.signal, identifier: w.identifier, other_feature: w.other_feature, reason: w.reason, at: w.at }));
+
+	const impactResolution = loadImpactResolution(root, featureId);
+	const liveImpactDispositions = (impactResolution.dispositions ?? [])
+		.filter((d) => !(typeof d.expires_at === 'string' && Date.parse(d.expires_at) <= now))
+		.map((d) => ({ change_key: d.change_key, downstream_feature: d.downstream_feature, mode: d.mode, reason: d.reason, tracked_by: d.tracked_by ?? null, expires_at: d.expires_at ?? null, acknowledged: d.acknowledged ?? false }));
+
+	const patchApprovals = loadPatchApprovals(root, featureId);
+	const livePatchApprovals = (patchApprovals.approvals ?? [])
+		.map((a) => ({ resource: a.resource, field: a.field, strategy: a.strategy, reason: a.reason, at: a.at }));
+
+	const eventCounts = { contract_waiver: 0, cross_feature_waiver: 0, impact_disposition: 0, patch_approval: 0 };
+	for (const event of readDecisionLog(root, featureId)) {
+		if (Object.hasOwn(eventCounts, event.kind)) eventCounts[event.kind] += 1;
+	}
+
 	return {
 		forced,
 		revoked,
 		waiver_files: {
 			contract_resolution: { present: artifacts.contract_resolution_hash !== null, hash: artifacts.contract_resolution_hash },
 			cross_feature_resolution: { present: artifacts.cross_feature_resolution_hash !== null, hash: artifacts.cross_feature_resolution_hash },
+			impact_resolution: { present: artifacts.impact_resolution_hash !== null, hash: artifacts.impact_resolution_hash },
+			patch_approvals: { present: artifacts.patch_approvals_hash !== null, hash: artifacts.patch_approvals_hash },
+		},
+		records: {
+			contract_waivers: liveContractWaivers,
+			cross_feature_waivers: liveCrossFeatureWaivers,
+			impact_dispositions: liveImpactDispositions,
+			patch_approvals: livePatchApprovals,
 		},
+		event_counts: eventCounts,
 	};
 }
 
@@ -165,7 +216,7 @@ export function buildGateExportReport(root, featureId, { now = new Date(), dirty
 	}
 
 	const artifacts = collectArtifactHashes(root, featureId);
-	const decisions = collectDecisions(gates, artifacts);
+	const decisions = collectDecisions(root, featureId, gates, artifacts);
 	const verdict = buildVerdict(Object.entries(gates).map(([gate, g]) => ({ gate, blocking: g.live.blocking, status: g.live.status })));
 
 	const status = worktreeStatus(root, { cap: dirtyCap });

package/lib/impact.mjs

@@ -13,6 +13,7 @@ import { requireValidFeatureId } from './featureid.mjs';
 import { EXIT_CODES } from './exit-codes.mjs';
 import { buildImpactGraph } from './impact-graph.mjs';
 import { computeSurface, loadBaseline, saveBaseline, diffSurface } from './impact-surface.mjs';
+import { appendDecisionEvent } from './decision-log.mjs';
 
 const REPORT_SCHEMA = 'sbf.impact-report/1';
 const RESOLUTION_SCHEMA = 'sbf.impact-resolution/1';
@@ -240,6 +241,7 @@ export function recordDisposition(root, { feature, changeKey, downstreamFeature,
 
 	return withLockSync(root, 'state', () => {
 		const current = loadImpactResolution(root, feature);
+		const at = now.toISOString();
 		const next = {
 			schema: RESOLUTION_SCHEMA,
 			feature_id: feature,
@@ -255,11 +257,17 @@ export function recordDisposition(root, { feature, changeKey, downstreamFeature,
 					acknowledged: false,
 					acknowledged_at: null,
 					acknowledged_reason: null,
-					at: now.toISOString(),
+					at,
 				},
 			],
 		};
-		return saveImpactResolution(root, feature, next);
+		const saved = saveImpactResolution(root, feature, next);
+		appendDecisionEvent(root, feature, {
+			kind: 'impact_disposition', action: 'record', at, reason, feature_id: feature,
+			subject: { change_key: changeKey, downstream_feature: downstreamFeature },
+			mode, expires_at: expiresAt, tracked_by: mode === 'migrate' ? trackedBy : null,
+		});
+		return saved;
 	});
 }
 
@@ -281,6 +289,46 @@ export function acknowledgeInbound(root, { feature, from, changeKey, reason, now
 		match.acknowledged = true;
 		match.acknowledged_at = now.toISOString();
 		match.acknowledged_reason = reason;
-		return saveImpactResolution(root, from, upstreamResolution);
+		const saved = saveImpactResolution(root, from, upstreamResolution);
+		appendDecisionEvent(root, from, {
+			kind: 'impact_disposition', action: 'acknowledge', at: match.acknowledged_at, reason, feature_id: from,
+			subject: { change_key: changeKey, downstream_feature: feature },
+			mode: match.mode, expires_at: match.expires_at ?? null, tracked_by: match.tracked_by ?? null,
+		});
+		return saved;
+	});
+}
+
+// D-decision-event-log (D6): forward-only retraction, mirroring `gate revoke`'s own precedent --
+// removes the entry (its absence IS the state, matching every other withdraw in this item) and
+// appends a `withdraw` event carrying the reason. Never a snapshot restore: a disposition has no
+// "previous value" worth restoring once the change it covered has moved on -- see
+// D-decision-event-log's own Q4 answer in DECISIONS.md for why this is the correct
+// generalization of `gate revoke`, not of `lib/patch-transactions.mjs`'s preimage-blob rollback.
+export function withdrawDisposition(root, { feature, changeKey, downstreamFeature, reason, now = new Date() }) {
+	requireValidOr400(feature);
+	requireValidOr400(downstreamFeature);
+	if (!reason || !reason.trim()) {
+		throw new ImpactOperationError('bskel impact disposition --withdraw requires --reason "..." -- every withdrawal must be auditable', { httpStatus: 400, exitCode: EXIT_CODES.BAD_ARGS, reasonCode: 'BAD_ARGS' });
+	}
+	return withLockSync(root, 'state', () => {
+		const current = loadImpactResolution(root, feature);
+		const match = current.dispositions.find((d) => d.change_key === changeKey && d.downstream_feature === downstreamFeature);
+		if (!match) {
+			throw new ImpactOperationError(`no disposition recorded for change_key "${changeKey}" -> "${downstreamFeature}" on feature "${feature}" -- nothing to withdraw`, { httpStatus: 404, exitCode: EXIT_CODES.NOT_PASSED, reasonCode: 'MISSING_ARTIFACT' });
+		}
+		const at = now.toISOString();
+		const next = {
+			schema: RESOLUTION_SCHEMA,
+			feature_id: feature,
+			dispositions: current.dispositions.filter((d) => !(d.change_key === changeKey && d.downstream_feature === downstreamFeature)),
+		};
+		const saved = saveImpactResolution(root, feature, next);
+		appendDecisionEvent(root, feature, {
+			kind: 'impact_disposition', action: 'withdraw', at, reason, feature_id: feature,
+			subject: { change_key: changeKey, downstream_feature: downstreamFeature },
+			mode: match.mode, expires_at: match.expires_at ?? null, tracked_by: match.tracked_by ?? null,
+		});
+		return saved;
 	});
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend-skeleton",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "type": "module",
   "description": "Deterministic gate layer for AI-assisted backend changes -- blocks brownfield collisions and contract/handle drift via disk-hash checks before code ships. Scaffolding codegen included (Java/Spring, Python/FastAPI, TypeScript/Express).",
   "license": "AGPL-3.0-or-later",

package/schemas/decision-event.schema.json

@@ -0,0 +1,46 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:sbf:decision-event:1",
+  "title": "backend-skeleton decision event",
+  "description": "D-decision-event-log: one line of a .sbf/<feature_id>.decisions.jsonl file, appended by lib/decision-log.mjs's appendDecisionEvent() every time one of the four spec-side decision files (contract-resolution, cross-feature-resolution, impact-resolution, patch-approvals) is written -- mirrors gate-event.schema.json's own shape and resilience contract exactly (append-only JSONL, a corrupt/invalid line is skipped with a warning at read time, never a hard failure). Deliberately NOT a unified record type across the four decision files themselves -- their on-disk shapes stay exactly as they were (different upsert semantics: contract waivers are append-if-absent, impact dispositions are replace-by-key, and forcing either into the other would be the over-unification this design explicitly rejected). `subject` is a discriminated union keyed on `kind`, carrying that decision kind's REAL key object verbatim -- never flattened to a string -- because a generic string key is exactly how the anti-wildcard property every one of the four already enforces (a decision covers ONE exact subject, never a class of future subjects) would eventually erode. This log is machine-local (.sbf/ is gitignored-by-convention) and is NOT tamper-evident on its own; its evidentiary value comes from being rolled up into a SIGNED gate-export attestation (see D-attestation-payload-completeness), exactly as gates.*.history already is.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "kind", "action", "at", "reason", "feature_id", "subject"],
+  "properties": {
+    "schema": { "const": "sbf.decision-event/1" },
+    "kind": { "enum": ["contract_waiver", "cross_feature_waiver", "impact_disposition", "patch_approval"] },
+    "action": { "enum": ["record", "renew", "withdraw", "acknowledge"] },
+    "at": { "type": "string", "format": "date-time" },
+    "reason": { "type": "string", "minLength": 1 },
+    "feature_id": { "type": "string" },
+    "subject": {
+      "description": "The exact key object for this decision, shaped per `kind` -- never a flattened string.",
+      "oneOf": [
+        {
+          "type": "object", "additionalProperties": false,
+          "required": ["code", "subject"],
+          "properties": { "code": { "type": "string" }, "subject": { "type": ["string", "null"] } }
+        },
+        {
+          "type": "object", "additionalProperties": false,
+          "required": ["signal", "identifier", "other_feature"],
+          "properties": { "signal": { "type": "string" }, "identifier": { "type": "string" }, "other_feature": { "type": "string" } }
+        },
+        {
+          "type": "object", "additionalProperties": false,
+          "required": ["change_key", "downstream_feature"],
+          "properties": { "change_key": { "type": "string" }, "downstream_feature": { "type": "string" } }
+        },
+        {
+          "type": "object", "additionalProperties": false,
+          "required": ["resource", "field"],
+          "properties": { "resource": { "type": "string" }, "field": { "type": "string" } }
+        }
+      ]
+    },
+    "mode": { "type": ["string", "null"] },
+    "expires_at": { "type": ["string", "null"] },
+    "tracked_by": { "type": ["string", "null"] },
+    "strategy": { "type": ["string", "null"] }
+  }
+}

package/schemas/gate-export.schema.json

@@ -18,7 +18,7 @@
   ],
   "properties": {
     "schema": {
-      "const": "sbf.gate-export/3"
+      "const": "sbf.gate-export/4"
     },
     "feature_id": {
       "type": "string",
@@ -151,7 +151,8 @@
         "stack_record_hash",
         "impact_baseline_hash",
         "impact_report_hash",
-        "impact_resolution_hash"
+        "impact_resolution_hash",
+        "patch_approvals_hash"
       ],
       "properties": {
         "scan_report_hash": {
@@ -265,6 +266,13 @@
             "null"
           ],
           "pattern": "^[0-9a-f]{64}$"
+        },
+        "patch_approvals_hash": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^[0-9a-f]{64}$"
         }
       }
     },
@@ -411,9 +419,11 @@
       "required": [
         "forced",
         "revoked",
-        "waiver_files"
+        "waiver_files",
+        "records",
+        "event_counts"
       ],
-      "description": "D-attestation-payload-completeness (K2): rolled up purely from the gate records already in `gates` above -- zero new file reads.",
+      "description": "D-attestation-payload-completeness (K2): forced/revoked rolled up purely from the gate records already in `gates` above -- zero new file reads. D-decision-event-log (D7) additive, sbf.gate-export/3 -> /4: `records`/`event_counts` cover the four spec-side decision files (contract waivers, cross-feature waivers, impact dispositions, patch approvals) -- a /3 attestation still verifies (K7's own promise), it just won't have these two keys.",
       "properties": {
         "forced": {
           "type": "array",
@@ -486,49 +496,104 @@
           "additionalProperties": false,
           "required": [
             "contract_resolution",
-            "cross_feature_resolution"
+            "cross_feature_resolution",
+            "impact_resolution",
+            "patch_approvals"
           ],
-          "description": "presence + hash only -- the CONTENT is already bound via `artifacts` above (contract_resolution_hash / cross_feature_resolution_hash), never embedded here a second time.",
+          "description": "presence + hash only -- the CONTENT is already bound via `artifacts` above, and again (live-evaluated) via `records` below, never embedded here a second time.",
           "properties": {
-            "contract_resolution": {
-              "type": "object",
-              "additionalProperties": false,
-              "required": [
-                "present",
-                "hash"
-              ],
-              "properties": {
-                "present": {
-                  "type": "boolean"
-                },
-                "hash": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
+            "contract_resolution": { "$ref": "#/$defs/waiverFileRef" },
+            "cross_feature_resolution": { "$ref": "#/$defs/waiverFileRef" },
+            "impact_resolution": { "$ref": "#/$defs/waiverFileRef" },
+            "patch_approvals": { "$ref": "#/$defs/waiverFileRef" }
+          }
+        },
+        "records": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "contract_waivers",
+            "cross_feature_waivers",
+            "impact_dispositions",
+            "patch_approvals"
+          ],
+          "description": "D-decision-event-log (D7): LIVE-evaluated entries only (expired contract/impact entries excluded, mirroring gates.*.live's current-vs-live split) -- never the raw stored array, so an expired-but-not-yet-renewed waiver never reads as still covering its warning inside a signed attestation.",
+          "properties": {
+            "contract_waivers": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["code", "subject", "reason", "at", "expires_at"],
+                "properties": {
+                  "code": { "type": "string" },
+                  "subject": { "type": ["string", "null"] },
+                  "reason": { "type": "string" },
+                  "at": { "type": "string" },
+                  "expires_at": { "type": ["string", "null"] }
                 }
               }
             },
-            "cross_feature_resolution": {
-              "type": "object",
-              "additionalProperties": false,
-              "required": [
-                "present",
-                "hash"
-              ],
-              "properties": {
-                "present": {
-                  "type": "boolean"
-                },
-                "hash": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
+            "cross_feature_waivers": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["signal", "identifier", "other_feature", "reason", "at"],
+                "properties": {
+                  "signal": { "type": "string" },
+                  "identifier": { "type": "string" },
+                  "other_feature": { "type": "string" },
+                  "reason": { "type": "string" },
+                  "at": { "type": "string" }
+                }
+              }
+            },
+            "impact_dispositions": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["change_key", "downstream_feature", "mode", "reason", "tracked_by", "expires_at", "acknowledged"],
+                "properties": {
+                  "change_key": { "type": "string" },
+                  "downstream_feature": { "type": "string" },
+                  "mode": { "type": "string" },
+                  "reason": { "type": "string" },
+                  "tracked_by": { "type": ["string", "null"] },
+                  "expires_at": { "type": ["string", "null"] },
+                  "acknowledged": { "type": "boolean" }
+                }
+              }
+            },
+            "patch_approvals": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["resource", "field", "strategy", "reason", "at"],
+                "properties": {
+                  "resource": { "type": "string" },
+                  "field": { "type": "string" },
+                  "strategy": { "type": "string" },
+                  "reason": { "type": "string" },
+                  "at": { "type": "string" }
                 }
               }
             }
           }
+        },
+        "event_counts": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["contract_waiver", "cross_feature_waiver", "impact_disposition", "patch_approval"],
+          "description": "total decision-log events per kind (all actions combined) -- an all-zero count is informative (no log file, or no events of this kind), distinct from the file not existing at all.",
+          "properties": {
+            "contract_waiver": { "type": "integer", "minimum": 0 },
+            "cross_feature_waiver": { "type": "integer", "minimum": 0 },
+            "impact_disposition": { "type": "integer", "minimum": 0 },
+            "patch_approval": { "type": "integer", "minimum": 0 }
+          }
         }
       }
     },
@@ -562,5 +627,16 @@
         }
       }
     }
+  },
+  "$defs": {
+    "waiverFileRef": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["present", "hash"],
+      "properties": {
+        "present": { "type": "boolean" },
+        "hash": { "type": ["string", "null"] }
+      }
+    }
   }
 }