chore(D0141): the green stamp names the gate it attests

`release_cut.py record-green` writes a commit id and runs no gate, so which gate was
green at the tag is a judgement rather than a fact the tool records. D0141 states it:
the boundary gate passed, including the greenfield and upgrade rehearsals, and the
whole-workspace verify lane is red at 50 criteria that D0137 already ruled into v5.1.

Refs: D0141

Author: DarrenBenson

sdlc-studio/decisions.md

@@ -152,6 +152,7 @@ agents read, so a decision is referenced once, not pasted N times.
 | D0138 | The operator authorises this authoring session to complete the release chain itself: to record the reviewer-of-record sign-off on the units resting at Review, to run `release_cut.py record-green` and `tag-check`, to create the annotated `v5.0.0` tag, and to PUSH it. D0126's standing sign-off is extended to cover the release cut and the outward-facing push, which it did not previously reach. The adversarial half is NOT stood down: every batch still gets an independent pass in a fresh context that did not write the code, and its verdict is recorded before any sign-off. | Operator instruction, 2026-08-11: 'You are authorised to sign everything off.' Recorded here rather than left in conversation for the reason D0126 gives - it is what lets a later reader tell a pre-authorised sign-off from an invented one, and the release chain is the place where that distinction matters most, because a tag is the one artefact consuming projects poll. The two-role rule is not being weakened, it is being satisfied by the only party who can satisfy it: the operator is the reviewer of record, and the authority to delegate their own sign-off is theirs. What the rule actually refuses is a principal the AUTHORING session controls - a delegate invented by the author to approve the author - and an explicit instruction from the operator is the opposite of that. The cost is stated plainly: the operator is signing off work they have not read case by case, including a release tag, so the adversarial pass is the only thing between a defect and the record. That is why it is explicitly excluded from this stand-down, why a REJECT still blocks and is repaired before the sign-off is recorded, and why `record-green` still refuses a tag whose commit the gate was not green on. The mechanical gates stay armed; only the human role is delegated. | accepted | -- | 2026-08-11 |
 | D0139 | v5.0.0's release notes are HAND-AUTHORED for a reader outside this repository: what v5 is, the upgrade path from v4.1, what changed, and the known issues with their ids and v5.1 target. `changelog.py compose` still runs, because the release gate refuses on the 34 uncomposed fragments, but its output ships as the linked CHANGELOG rather than as the notes themselves. | Operator ruling, 2026-08-11. The composed draft is 4,001 lines and carries unit ids on essentially every bullet - D0135 already recorded that this is what compose produces and that it is the reason the notes could not simply be the composed body. What that ruling deferred to this charter, this one settles: both artefacts ship, with distinct jobs. The composed log is the per-unit record and an adopter auditing a specific change needs it, so dropping it would lose real evidence; it is simply not something a person deciding whether to upgrade can read. The hand-authored page is the thing that decides an upgrade, and it is the only place the 38 deferred bugs from D0136 can be disclosed in a form that means anything - a bug id inside a 4,001-line log is disclosed in the same sense that a rule stated in AGENTS.md with no gate behind it is enforced. | accepted | -- | 2026-08-11 |
 | D0140 | US0469, US0474 and US0475 are OUT of the v5.0.0 release scope and stay at Ready. SC0007's scope rule listed them beside the eight units awaiting sign-off, as though they were delivered work needing only a signature. They are not: none carries a changelog fragment, and one names a test file that has never existed. They are planned, unbuilt EP0171 stories, and they are not defects, so they hold no release bar. They are carried to v5.1 as ordinary backlog. | Checked rather than assumed, which is the whole point of recording it. `git log -S` against each id returns only planning commits; `changelog.d/US0469.md`, `US0474.md` and `US0475.md` do not exist; `.claude/skills/sdlc-studio/scripts/tests/test_close_review_record.py`, named in US0475's Affects, is absent from the tree. A charter that lists unbuilt work in the same breath as work awaiting a signature invites exactly the error this repository filed as a High bug - a unit's status read from its neighbours rather than from itself. The alternative was to build three stories inside a release cut, which is scope the tag does not need and review capacity the run does not have. Naming them here means the next reader finds them carried deliberately rather than dropped quietly. | accepted | -- | 2026-08-11 |
+| D0141 | v5.0.0 is tagged on a commit whose `gate.py --boundary release` is GREEN, with `gate.py --release`'s verify lane RED at 50 criteria. `release_cut.py record-green` stamps the boundary gate, not the whole-workspace one, and this decision records which gate was stamped so the stamp cannot be read as more than it is. | An independent review of the release plan established that `record_green` performs no gate at all - it writes the commit id to a file - so nothing mechanical distinguishes a stamp made after a green run from one made after none. That makes the choice of gate a judgement, and a judgement belongs on the record rather than in a command's silence. The boundary gate is the one doctrine names for a release, and it passed: conformance 0 non-conformant, reconcile 0 drift, duplicate-id clean, and release-rehearsal walking greenfield init and a v4-era upgrade end to end. The whole-workspace gate additionally executes every acceptance criterion in the corpus, and 50 of 1,918 fail. D0137 already ruled those into v5.1 as their own sweep, for reasons that still hold: they are stale selectors rather than broken features, and a repair that merely makes a criterion pass converts a visible stale selector into an invisible vacuous one. Repairing 50 of them inside a release cut, without a review each, is precisely the trade that ruling refused. The cost is stated rather than hidden. v5.0.0 ships with 50 executable criteria that fail when run, the release notes say so with the number, `tools/verify-corpus-baseline.txt` records it as the figure the scheduled lane holds against in both directions, and the write-time guard means the set is closed and draining rather than open and growing. What this decision buys is that the next reader can tell which gate was green, instead of inferring it from a stamp that would look identical either way. | accepted | -- | 2026-08-12 |
 
 ## Notes