fix(conformance): the dirty-tree assertion must judge HONOURED evidence

One historical `-dirty` row reddened this gate permanently, even after a clean
re-run of the same test. status.py already resolves duplicates latest-wins
(latest_by_test), so a superseded row is not evidence of anything — but this check
iterated every row, so the poisoned row from the git_sha bug (fixed in the parent
commit) would have failed the audit forever.

The dirty-tree assertion is now scoped to rows status.py would actually honour, by
importing latest_by_test rather than reimplementing the rule, so the two cannot
disagree about which rows are live claims. Structural assertions — provenance keys,
sentinel, test-still-exists — still apply to EVERY row.

Nothing is erased: the row stays in the ledger and runs/20260913T014437Z-19fc8bc/
run.log stays committed. It simply stops being read as a live claim. Verified the
guard is intact afterwards — the check still REFUSES both forgeries it is built to
catch (a self-skip presented as a pass, and a proven row from the root commit).

A dirty-then-clean sequence is also the normal shape of noticing a dirty tree,
fixing it, and re-running; that should not permanently fail an audit.

Co-Authored-By: Claude Opus 5 <[email protected]>

conformance/tests/l0-static/auditability-proofs-producible/check.sh

@@ -250,6 +250,11 @@ try:
     sys.dont_write_bytecode = True
     import record_run as rr                                   # noqa: E402
 
+    # status.py owns the latest-wins rule; import it rather than reimplementing it, so the two
+    # cannot disagree about which rows are live evidence.
+    import status as _st                                        # noqa: E402
+    rr_latest_by_test = _st.latest_by_test
+
     smap = rr.sentinel_map(CONF / "tests")
     check(len(smap) >= 10,
           f"record_run.py's sentinel map contains {len(smap)} test(s) — the parser lost its "
@@ -386,6 +391,15 @@ try:
         check(not bad,
               f"conformance/runs/ledger.jsonl has unparsable line(s) {bad} — the audit record "
               "is not machine-readable, so no proof can be derived from it")
+        # Which rows are HONOURED: status.py resolves duplicates latest-wins (latest_by_test),
+        # so a superseded row is not evidence of anything. The dirty-tree assertion below is
+        # therefore scoped to honoured rows. Without that scoping, ONE historical dirty row reds
+        # this gate permanently even after a clean re-run of the same test — and a dirty-then-
+        # clean sequence is the normal shape of "noticed the tree was dirty, fixed it, re-ran".
+        # The row is still kept in the ledger and its run.log stays committed: nothing is erased,
+        # it simply stops being treated as a live claim. Structural assertions (provenance keys,
+        # sentinel, test-still-exists) still apply to EVERY row.
+        honoured_ids = {id(v) for v in rr_latest_by_test(rows).values()}
         for r in rows:
             for key in ("ts_utc", "git_sha", "test", "requirements", "junit_result", "proof",
                         "run_id"):
@@ -408,7 +422,7 @@ try:
                 check(r.get("test") in smap,
                       f"a ledger row claims `proven` for {r.get('test')!r}, which is not a "
                       "test in the suite any more — a proof of something that no longer exists")
-                check("-dirty" not in str(r.get("git_sha", "")),
+                check(id(r) not in honoured_ids or "-dirty" not in str(r.get("git_sha", "")),
                       f"a ledger row claims `proven` for {r.get('test')!r} from a DIRTY tree "
                       f"({r.get('git_sha')}) — what ran is not what is committed")
     else: