One export, one review.

P5 review ok -- surface grew by exactly one export: window/3 -- the review Chapter 2.1's decision required, performed
PASS 5/5

The review procedure, now precedent: the diff that adds a function carries the gate update that admits it — one export, one gate update, one sentence in the record. And no fourth read has earned an export yet, which is the review bar working.

Evidence outputs are frozen snapshots of their day; scripts evolve with the surface, committed records do not. The amended bcs_rung_2_1_check.exs re-runs green under the grown surface, while its committed output stays exactly as it was — the historical proof of what the surface used to be:

boot: two stores under one_for_one; native codec self-check passed at each init
R1 surface ok -- exports: six domain functions plus OTP callbacks, nothing else -- no table, no pid, no internals
R2 existence ok -- existence restored, data not: fresh table after kill -- durability is a different chapter's job
R4 radius ok -- sibling untouched (one_for_one): ord_store pid stable, row intact through prt_store's crash
R3 checkpoint ok -- recovered through the boundary, not the heap: re-put from a read-back row
R5 gate ok -- prt_store refuses an ORD name with {:error, :namespace} -- admitted kinds are per-boundary
PASS 5/5

R1's "six domain functions plus OTP callbacks, nothing else" is the line the amendment was measured against. A record is what was true on its day, and the day is in the file — the freeze policy the agent guides stated for benchmarks, generalized to every rung in the series.

Window bounds are ingress — synthetic or not, a cursor is an id arriving at a boundary, and it meets the gate like any other.