openDox root: pin both carved legs and record carved_from (split-opendox § 3.3, RULED OQ-I)

contracts/code-pin.yaml

@@ -21,7 +21,7 @@ leg_role: code
 source_repository: opensoft/openDox-code
 submodule_path: code
 
-commit: "580f61dff7e6c0235ba1f5681432d10cf2e85fa1"
+commit: "ce53b489f8007c37f70da19c90c95ba89156feed"
 revision_kind: commit
 
 digest_algorithm: sha256
@@ -36,7 +36,7 @@ digest_algorithm: sha256
 # <oid>`, so a leg's own pin moving is drift too.
 digest_definition: sorted-ls-tree-r-v1
 digests:
-  tree_sha256: "0200b00eba62958b272b6d3af08ca3be3aff34ab5e95eb5afaef23b4b2d06688"
+  tree_sha256: "49a0da5b44843fd33da89b88ce9eec4ce077445ff241324aa578830b0fc0f5a4"
 
 verify_pin: scripts/validate-pins.py
 resync_runbook: "README.md#the-lockstep-invariant"

contracts/manifest.yaml

@@ -13,39 +13,61 @@ contract_bundle_version: none
 entries: []
 
 # ===========================================================================
-# CARVE PROVENANCE — the slot, declared before the carve fills it.
+# CARVE PROVENANCE — the slot was declared before the carve, and the carve has
+# FILLED it: `carved_from:` below is the record.
 #
 # RULED OQ-I (Brett Heap, `opensoft/openxFactory#656`, 2026-09-09): the
 # MACHINE-READ record of the openDox carve lands HERE, in each assembly root's
 # hand-authored `contracts/manifest.yaml` — the object whose single commit
 # names both legs — as a top-level `carved_from:` mapping. It is one of three
-# records: `carve_commit:` in the pin files is the referent that survives into
-# the tree the gate reads, and `docs/opendox-cutover-runbook.md` is the
-# procedure. There is deliberately NO bare `CARVE_COMMIT` file: the
+# records. Record 2 is `carve_commit:` in the pin files that pin this WHOLE
+# carved assembly root from downstream — openXdox's
+# `contracts/opendox-pin.yaml` (runbook § 4.2) and openxFactory's
+# `contracts/openxdox-pin.yaml` (§ 5.1) — the referent that survives into the
+# tree the gate reads. It is NOT in this project's own leg pins: neither
+# `contracts/code-pin.yaml` nor `contracts/spec-pin.yaml` defines
+# `carve_commit:`, because a leg pin is an ordinary submodule pin that exists
+# independent of any carve, and § 6's Phase-3 checklist moves only their
+# `commit:` and `digests.tree_sha256:`. Record 3 is
+# `docs/opendox-cutover-runbook.md`, the procedure. There is deliberately NO
+# bare `CARVE_COMMIT` file: the
 # openXwallet carve rejected that by name, and `opensoft/openXwallet`'s own
 # `contracts/manifest.yaml` carries `carved_from: {repository, commit}` as the
 # precedent this widens. "MACHINE-READ" is that precedent's own word, not a
 # truncation of "machine-readable": openXwallet's manifest introduces the key
 # as "The machine-read one of THREE provenance records for the carve."
 #
-# NOTHING IS WRITTEN HERE YET. This file is levelled, not filled: the OQ-O
-# scaffold-levelling pass moves no carved byte. The carve PR adds, at the top
-# level of this file, a mapping of the shape:
+# WRITTEN AT PHASE 3 (runbook § 6), by the one commit that also advanced both
+# leg gitlinks and both `contracts/<role>-pin.yaml` files — `code` to the
+# merge of `opensoft/openDox-code#6` and `spec` to the merge of
+# `opensoft/openDox-spec#4`, the arrivals of the 123 and 56 rows the carve
+# manifest declares for this project's two legs. Until that commit this file
+# was levelled, not filled: the OQ-O scaffold-levelling pass moved no carved
+# byte, and the shape the carve would write was set down here in advance
+# rather than invented under time pressure at the carve. The mapping below is
+# that shape with its two placeholders resolved.
 #
-#   carved_from:
-#     repository: opensoft/openxFactory
-#     commit: <the carve commit>
-#     carve_tag: opendox-carve-0
-#     manifest: docs/opendox-carve-manifest.yaml
-#     legs:
-#       code: <row count>
-#       spec: <row count>
+# Read `scripts/validate-manifest.py` before assuming something in this
+# repository checks it: that validator reads `project.yaml`
+# (`kind: project-manifest`), NOT this file, and it is digest-pinned by
+# `contracts/shape-pin.yaml`, so it must not be edited to make it. This file
+# is hand-authored and validated by nothing in this tree — adding a key costs
+# nothing and is checked by nothing here. The one piece of running code that
+# reads the record lives in openxFactory, whose
+# `scripts/verify-carve-arrival.py` refuses `arrival-carved-from-mismatch`
+# unless the VALUES at `carved_from.repository` and `carved_from.commit`
+# below equal the carve manifest's own `source_repository` and `carve_commit`
+# values; run from an openxFactory checkout:
 #
-# Read `scripts/validate-manifest.py` before assuming something checks this:
-# it validates `project.yaml` (`kind: project-manifest`), NOT this file, and
-# it is digest-pinned by `contracts/shape-pin.yaml`, so it must not be edited
-# to make it. This file is hand-authored and validated by nothing — adding a
-# key costs nothing and is checked by nothing, which is exactly why the shape
-# it will take is written down here in advance rather than invented under
-# time pressure at the carve.
+#   python3 scripts/verify-carve-arrival.py --destination opendox_root \
+#       --dest-root <this checkout> --source-repo . --phase A
 # ===========================================================================
+
+carved_from:
+  repository: opensoft/openxFactory
+  commit: "b075fd91dc8fced8e1373825ba80220c33536bae"
+  carve_tag: opendox-carve-0
+  manifest: docs/opendox-carve-manifest.yaml
+  legs:
+    code: 123
+    spec: 56

contracts/spec-pin.yaml

@@ -21,7 +21,7 @@ leg_role: spec
 source_repository: opensoft/openDox-spec
 submodule_path: spec
 
-commit: "60e546c69963f9fe8a5071975f7c657ed95d0832"
+commit: "fc67332d5ef203624d5c557f7c53d1f134d6d2ea"
 revision_kind: commit
 
 digest_algorithm: sha256
@@ -36,7 +36,7 @@ digest_algorithm: sha256
 # <oid>`, so a leg's own pin moving is drift too.
 digest_definition: sorted-ls-tree-r-v1
 digests:
-  tree_sha256: "a1218f8e96868f62be32dd064032ea66eef3689b2a40aa3c9e9f8d882abadec6"
+  tree_sha256: "93c4ed4287815b67eb12087eed1df912365dc8c6f7b158e139755574453e4c95"
 
 verify_pin: scripts/validate-pins.py
 resync_runbook: "README.md#the-lockstep-invariant"