ADR 0294: The merge-base governs checkpoint policy

Status: accepted; extends the trunk authority the standards limits already hold to the checkpoint tables of ADR 0293

A branch edits its own discern.toml. If the working tree's [checkpoints] tables governed the branch's own gate, deleting or weakening a checkpoint would be a one-line self-exemption — the same hole the standards never-loosen check closes for numeric limits. Unlike a limit, a question is prose: no order exists between two versions of judgment text, so no "never loosen" comparison can exist for checkpoints. Reading the live trunk tip instead would make gate outcomes change under an effort's feet whenever the trunk moved.

The policy that governs an effort is the [checkpoints] configuration at the effort's merge-base with the trunk — never the branch's own edits, never the live trunk tip.

• The merge-base commit is the policy identity, recorded in the proof separately from declaration subjects. discern update advances the merge-base and with it the policy, so policy changes only together with a tree change and outcomes stay reproducible; an unrelated advance moves the identity without staling any declaration.
• Removing, weakening, or adding a checkpoint on a branch has no effect on that branch's own gate; the edit takes effect for other efforts only after it lands. discern.toml sits outside every configured scope, so such an edit already requires owner review at acceptance.
• No prose-strength comparison is attempted. Trunk authority makes it unnecessary: the governed definition is whatever the trunk last accepted.
• Governing resolution is deliberately LENIENT where the live loader is strict: the governing copy is history, so an entry that cannot be resolved (missing question, unknown scope, both selectors), a config that does not load, or a merge-base that cannot be resolved becomes a structured evidence drop rather than a fabricated checkpoint verdict. The machine Gate may proceed, but the drop is retained in Proof, prevents reusable Proof where stop enforcement was indeterminate, and remains visible to acceptance. Unreadable current declaration evidence blocks acceptance outright.
• The definition hash of ADR 0293 covers the RESOLVED definition rather than the merge-base commit, so the policy identity and the subjects move independently by construction.

• An agent cannot relax its own checkpoint obligations from inside an effort, and an owner reviewing a landing sees any policy edit in the diff of a file no standing grant covers.
• The governed question can lag the trunk tip until the next update — accepted: reproducibility of a running effort outranks freshness, and update is cheap and routine.
• The one soft edge is executable: the v1 when boundary lets a branch change files a governed command references. The policy identity proves the command text's source, not a dependency closure; that record keeps the gap explicit instead of implied closed.
• Proof binds the policy identity and declaration evidence to the candidate HEAD; it does not record the moving trunk tip. Reuse separately requires the configured local trunk to be readable and the branch not to be behind it.

• Govern from the live working tree. Rejected: self-exemption in one edit, invisible until review.
• Govern from the live trunk tip. Rejected: a landing elsewhere would change an unrelated effort's gate mid-flight, breaking reproducibility and the rerun guard's premises.
• A never-loosen comparison for questions. Rejected: prose is not ordered; any mechanical "strength" metric would be a fiction agents could satisfy textually.