check_thesis_facts_append: three confinement gaps found in the receipt port review

The receipt package's append_gate is a near-verbatim port of scripts/check_thesis_facts_append.py (pinned at 9dafe81), differential-gated against it. A 2026-09-01 review of the port reproduced three gaps that are upstream semantics, so the fixes should land here as well (receipt tracks its side in TheAxiomFoundation/receipt#32):

1. Gate-only proposals ignore unclassified paths. Surface separation derives the DATA and GATE subsets but never checks that their union is the whole changed set; any GATE match with no DATA match returns "gate-only proposal … OK" before the ledger, prefix, and release-history checks. A proposal that adds the gate script and rewrites releases/README.md (a base release file) passed on the pinned fixture.
2. A symlinked ledger/ parent escapes the candidate tree. State and prefix paths are joined lexically under the resolved root and only the final component is checked for a symlink; replacing ledger/ with a symlink to an external or in-tree target returned "append check OK".
3. base_ref is resolved by name at three points (surface diff, git show for the ledger and prefix, release history). A branch that moves during verification is read at different commits within one verdict; resolve once and thread the OID.

Smaller: mode-only changes to the ledger or prefix are accepted while release files compare modes; post-cutover binding values (retrievedAt, sourceVintage, ledgerRepoSha, responseArchive.sha256) are checked for truthiness only, and targetContentHash/sourceBindingProjection are outside the assertionVersion projection, so changing them keeps the same id. The last is a coordinated schema decision rather than a local fix.

🤖 Generated with Claude Code

Start with the receipt package's append_gate and compare it with scripts/check_thesis_facts_append.py at pinned revision 9dafe81; run the existing differential gate against its pinned fixture. Done means the three reported gaps are covered: unclassified paths are rejected, symlinked parents cannot escape the candidate tree, and one resolved base_ref OID is used throughout verification.