hyperguild#111: writeHallNote validates half_life/applies/claim_provenance
before a note is born; UpdateNote's supersede path didn't, so the fields
that need provenance most (a whole-note regenerate is more likely to carry
model-authored frontmatter than a fresh create) went unchecked.
Fixed by extracting any frontmatter fence the caller leads Content with,
validating it with the same claim.ValidateEnvelope, and merging its fields
into the restamped frontmatter instead of leaving it as a second, inert
`---`-fenced block in the body — that merge was a real gap independent of
validation: a caller's supersede-time frontmatter was previously silently
dropped, never taking effect at all.
Reject leaves the note byte-identical (fail-closed, nothing written).
Fence-less content (the common case today) is unchanged.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
mathiasandClaude Sonnet 5
c50c64f93b