Function refresh_for_stamp 

pub fn refresh_for_stamp(
    committed: &str,
    probes: &[Probe],
    acknowledged: &BTreeSet<String>,
) -> Result<String, String>

The stamp’s refreshed table: refresh_gated_rows, but only if every gated probe whose live reading differs from committed is named by one of the increments being stamped (acknowledged — the union of their probes).

Rewriting every gated row unconditionally would silently absorb a move that reached main with no acknowledgement (a bypass push, say): after the stamp the table would match by construction, and nothing downstream could notice. Refusing instead keeps the invariant the gate enforces on PRs — a gated probe never moves unacknowledged — true on main too. The stamp computes this before applying, so a refusal leaves nothing written and the pending files in place.