…ial verify pass

Rewrites the doc-layer W4 spec against the as-built A2UI screen-addressing
wave (#204-#207) and the a2ui-rs consumer (#3/#4/#9/#11), then applies a
17-finding adversarial verify pass (3 refuter lenses: citations, canon,
layer boundaries). Substantive changes over v1:

- W4-0 (new): wave-namespace rule — a2ui owns its own W0-W5 (its W4 =
  P-REHOST); this wave is written doc-W4 in all board/PR text.
- Headline generalized per amendment A3: one ClassView x WideFieldMask
  template projection — re-issue as PDF (executor leg) or serve as a
  living addressed screen (a2ui session tier).
- reconstruct_document stays produces=pdf_bytes, deliberately scoped to
  artifact legs; the living screen is session-tier project_node ->
  NodeDelta frames, never an ActionDef output.
- C1.4 mask discipline inherited verbatim (RBAC by projection fail-closed
  on the re-issue path, retype-in-place, zero-extension, sentinel ban,
  permit-all identity consumed not re-decided).
- Ordinal-stability wire invariant for the three ActionDefs (T2).
- Four-leg renderer table with honest per-leg as-built status; DocRenderer
  trait = three impls (byte artifacts), a2ui = fourth family member at the
  session tier; deviation D-1 numbered (askama leg = compile-time callee,
  charter A5 runtime-bound annotation revised on stated factual basis).
- A1 dep list restored to ratified A5 (ogar-vocab + ogar-doc-ir; codebook
  membrane returned to the consumer side of the BBB).
- Page-register carving named (never-widen canon): number = one u8:u8
  typed pair; native w/h out-of-line provenance.
- Dependency ledger: value-slab render path, permit-all decision,
  HTML->PDF step — named so the council can't assume unbuilt legs whole.
- P-TEMPLATE-MASK falsifier (new), split cross-repo over one shared
  fixture (dependency-direction honest).

Mints NOTHING: 0x080A/0x080B stay operator-gated (D-OGAR-DOC-LAYER ledger;
charter section D3) and land WITH the council-verified build.

Co-Authored-By: Claude <noreply@anthropic.com>