05 - No-Superseded-Consumption Re-bound to the Envelope

What T1 patched (doc 06 + doc 07)

G-NO-SUPERSEDED-CONSUMPTION input changed to reference the SUPERSEDED_NON_AUTHORITY set as fixed by the SEALED approval envelope (the doc 00 registry + superseded_boundary_sha256 pinned by the envelope; depends on G-ACTIVE-AUTHORITY-APPROVAL-ENVELOPE + G-ACTIVE-AUTHORITY-SCOPE). Its failure now also triggers when "the active/superseded partition is taken from mutable markers instead of the sealed envelope."

In doc 07 (packages):

• the recheck-4 header note: packages consume only the ACTIVE_AUTHORITY corpus as pinned by the sealed envelope — not by mutable markers;
• a new sequencing bullet (content-addressed authoring authority): PKG-A is gated on the envelope being SEALED and every active doc's live revision + content hash matching it; any drift → ACTIVE_AUTHORITY_ENVELOPE_MISMATCH → authoring BLOCKED until a fresh Codex recheck re-seals — never "continue authoring";
• PKG-A precondition updated: the envelope must be SEALED and verified green (G-ACTIVE-AUTHORITY-APPROVAL-ENVELOPE / -HASH-MATCH / -REVISION-MATCH; no ACTIVE_AUTHORITY_ENVELOPE_MISMATCH) before authoring is authorized.

Why this matters

Without the envelope binding, a future package could consume a post-review edit (or a flipped fence) while still seeing valid-looking ACTIVE markers — exactly the bypass Codex flagged in Check J. Binding the superseded set + the package inputs to the sealed envelope makes "consume only current authority" provable against the exact reviewed corpus, not against mutable text.

Promotion of history requires re-enveloping

A SUPERSEDED_NON_AUTHORITY block can be annotated as history, but it can never become authority by a silent marker/fence flip: promoting it to ACTIVE changes content/marker/fence/membership → the envelope mismatches → a new sealed envelope + a fresh Codex recheck is required. There is no path from history to authority that bypasses Codex.