`RatificationReceipt.pending_stages` has named `ledger_reseal` since the
ratification ceremony was written and nothing performed it, so a sealed ledger
went stale the moment curriculum changed. This is that stage, plus the CLI
verb a human runs, and it is deliberately NOT reachable from `ratify_chain`
(doctrine forbids ratification automation, and a per-row reseal would churn
the ledger's content_sha256).
The load-bearing property is not "the ledger can be rewritten" — it is that
rewriting it cannot grant a serving license by accident. Reliability is
commitment precision, so a curriculum band clears theta_SERVE on correct
NON-COMMITMENTS alone (Phase C, PR #121). A plain regenerate verb would flip
four bands from disclosed to authoritative as a side effect of housekeeping,
on evidence that is ~99% non-entailed, which ADR-0262 §5.1 rules
unacceptable. So:
- `plan_reseal` computes the license DELTA before writing anything, reading
the current ledger through `load_capability_ledger` — the production entry
point — so a tampered ledger refuses here instead of being overwritten and
losing the evidence, and the stage inherits the capability's DECLARED
absence policy rather than choosing its own (bridge rule 5).
- `apply_reseal` REFUSES by default when any band would become newly
licensed, naming the bands and their `entailed` counts. `--allow-new-
licenses` is the ratification. Revocations are never gated: losing a
license is the gate becoming more conservative and needs no authorization.
- `deduction_serve` is deliberately absent from `_RESEALABLE`. Its ledger is
SHA-sealed, ratified, and gating a live flag, and 21 of its 25 bands do not
clear theta_SERVE on distinct evidence. A verb that regenerated it would
erase a measured exposure as housekeeping.
- `ratify`'s output now names the command that performs its pending stage.
Naming a stage without naming its command is how this one stayed unperformed.
Exit codes: 0 dry-run/applied, 1 refused, 2 unknown capability.
[Verification]: in-worktree on canonical CPython 3.12.13 with `uv sync
--locked`: smoke 571 (unchanged), deductive 327 (310 + 17).
`chat/data/curriculum_serve_ledger.json` still absent after the full suite —
no test writes it. Caught and fixed one real gate failure:
`test_no_production_adapter_passes_missing_ok` correctly rejected an explicit
`missing_ok=True`; the fix routes through the manifest instead.
