Activate nesting per GH-DEC-2026-015: view_hash carries binding.digest

approval-engine met the condition. Verified here rather than taken on report:
their docs/approval-claim.md carries "Presentation exclusion — GH-DEC-2026-015
§4" in normative language, and I ran
tests/test_claim_contract.py::test_presentation_changes_cannot_change_the_approved_act
myself — 1 passed. That test pins the digest input set from BOTH sides, and the
narrowing half is what makes it real: without it a digest over four fields, or
over a constant, would pass the widening half perfectly.

view_hash now carries binding.digest and the act-scope is no longer
independently canonicalized here, so the act has exactly one canonicalization
computed by the layer that owns it. approval_binding_digest is validated for
shape and refused without its approval id — it is carried, never computed.

The three published vectors are unchanged: they do not carry the new key, so
pick omits it. Asserted, not assumed.

The cycle condition did not disappear, its protection moved — from refusing
nesting to approval-engine's normative exclusion. layer.yaml carries it as
cycle_condition with a test, so a future widening meets a rule rather than
silence.

One thing not assumed. Both gate-house and approval-engine said our binding
slice canonicalizes principal and target, two of their five fields. target
plainly is act material and is now dropped. But their principal is the party ON
WHOSE BEHALF the approval was issued, while ours is the person being BOUND — the
approver. Different roles, and dropping ours would remove who was shown this
from view_hash and gut the promise. Kept it, declared principal_role_overlap
open in layer.yaml, tested that changing the approver still moves view_hash, and
raised it rather than silently resolving it either way.

L0/L2 are unaffected: with no approval there is no digest to defer to, and
test_act_scope_still_binds_when_there_is_no_carried_digest pins that.

100 tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1565372@bnt-lap001
Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568

tests/test_skeleton.py

@@ -454,3 +454,93 @@ def test_heartbeat_is_an_ordinary_event_with_the_same_envelope():
         "class": "informed-decision.disposition",
         "assertion": "nothing-to-report",
     }
+
+
+# -------------------------------------------------------------------------
+# GH-DEC-2026-015 — nesting, activated 2026-09-10
+#
+# approval-engine stated the presentation exclusion as normative and tested
+# (docs/approval-claim.md "Presentation exclusion", and
+# tests/test_claim_contract.py::test_presentation_changes_cannot_change_the_approved_act,
+# which pins the input set from BOTH sides — widening and narrowing).
+# -------------------------------------------------------------------------
+
+DIGEST = "sha256:" + "b" * 64
+OTHER_DIGEST = "sha256:" + "c" * 64
+
+
+def test_carried_digest_enters_view_hash():
+    plain = make_memo()
+    nested = make_memo(approval_binding_digest=DIGEST)
+    assert render(nested, principal_sub="b").view_hash != render(plain, principal_sub="b").view_hash
+
+
+def test_a_different_act_digest_changes_view_hash():
+    a = render(make_memo(approval_binding_digest=DIGEST), principal_sub="b")
+    b = render(make_memo(approval_binding_digest=OTHER_DIGEST), principal_sub="b")
+    assert a.view_hash != b.view_hash
+
+
+def test_act_scope_is_no_longer_independently_canonicalized_when_nested():
+    """The act has exactly one canonicalization, computed by its owner.
+
+    Two memos differing only in act-scope must now hash alike, because the
+    scope is act material already covered by the carried digest. Canonicalizing
+    it again here is the partial recomputation GH-DEC-2026-015 removed.
+    """
+    acme = make_memo(approval_binding_digest=DIGEST)
+    beta = make_memo(
+        approval_binding_digest=DIGEST,
+        binding=BindingSlice(
+            principal=acme.binding.principal,
+            target=Scope(kind="tenant", id="tenant:beta", label="Beta GmbH"),
+        ),
+    )
+    assert render(acme, principal_sub="b").view_hash == render(beta, principal_sub="b").view_hash
+
+
+def test_act_scope_still_binds_when_there_is_no_carried_digest():
+    """L0/L2 are unchanged: with no approval there is no digest to defer to."""
+    acme = make_memo(approval_id=None)
+    beta = make_memo(
+        approval_id=None,
+        binding=BindingSlice(
+            principal=acme.binding.principal,
+            target=Scope(kind="tenant", id="tenant:beta", label="Beta GmbH"),
+        ),
+    )
+    assert render(acme, principal_sub="b").view_hash != render(beta, principal_sub="b").view_hash
+
+
+def test_the_approver_still_binds_when_nested():
+    """`this person was shown this presentation of this act` — the person half.
+
+    approval-engine's `principal` is the party on whose behalf; ours is the
+    approver being bound. Dropping ours would remove who was shown this.
+    """
+    a = make_memo(approval_binding_digest=DIGEST)
+    b = make_memo(
+        approval_binding_digest=DIGEST,
+        binding=BindingSlice(
+            principal=Principal(id="p-2", kind="person", display_name="Someone Else"),
+            target=a.binding.target,
+        ),
+    )
+    assert render(a, principal_sub="x").view_hash != render(b, principal_sub="x").view_hash
+
+
+def test_presentation_material_still_moves_view_hash_when_nested():
+    base = make_memo(approval_binding_digest=DIGEST)
+    relocalized = make_memo(approval_binding_digest=DIGEST, locale="de")
+    assert render(base, principal_sub="b").view_hash != render(relocalized, principal_sub="b").view_hash
+
+
+@pytest.mark.parametrize("bad", ["deadbeef", "sha256:zz", "sha1:" + "a" * 40, "sha256:" + "A" * 64])
+def test_a_malformed_carried_digest_is_refused(bad):
+    with pytest.raises(ValueError, match="carried, never computed"):
+        make_memo(approval_binding_digest=bad)
+
+
+def test_a_carried_digest_without_its_approval_is_refused():
+    with pytest.raises(ValueError, match="approval it belongs to"):
+        make_memo(approval_binding_digest=DIGEST, approval_id=None)