SPF.23 - spice-validate does not enforce IDREF, only boot does
2026-09-22T18:06:41.4381851+00:00
System Account (SPICE.Web)
SPF.23
SPFIDELITY
Boot rejects a dangling IDREF; tools/spice-validate does not, so the guard is only felt after a 90s boot instead of before a commit. Measured by planting ContentType="Document" and running both.
(empty)
(empty)
3
Completed
CLOSED 2026-09-23 (claude-code, 075ddc4): spice-validate merges hive + onet ids and exits 1 on a dangling IDREF; allowlist needs a Reason (432ef6d, mutation-checked).