@@ -206,6 +206,10 @@ application. Reaching it may load Flask; `import tariff` still may not, as
 section 1 requires. Every route below exists with the method and path
 given.
 
+The key that signs the session cookie is the value of the environment
+variable `TARIFF_SECRET_KEY`, which is set and non-empty wherever the
+application runs.
+
 | Method | Path | Purpose |
 |---|---|---|
 | GET | `/` | dashboard linking to the pages below |
 
@@ -211,6 +211,10 @@ application. Reaching it may load Flask; `import tariff` still may not, as
 section 1 requires. Every route below exists with the method and path
 given.
 
+The key that signs the session cookie is the value of the environment
+variable `TARIFF_SECRET_KEY`, which is set and non-empty wherever the
+application runs.
+
 | Method | Path | Purpose |
 |---|---|---|
 | GET | `/` | dashboard linking to the pages below |
 
@@ -50,8 +50,19 @@
         "rounds 1 and 2",
     "c9e24a3850d1b7033ad8f2261f6e7a2b18c62d490020d1d2d8e5ad5b144da7b2":
         "the calibration trial",
+    "ed9f4352cbd4817edc0830d4b979a82542359bdf630e9a4e0b45cb18bae3edba":
+        "round 4, weaker",
+    "5347f551a4c8a351731a2e846bf90700ea84f066d6fa8a7126e4d1eba194798d":
+        "round 4, thin",
 }
 
+# The paragraph round 5 added to both specifications. Taking it out again
+# gives back the text round 4 ran, which the self-test proves is registered.
+SECRET_KEY_PARAGRAPH = (
+    b"\nThe key that signs the session cookie is the value of the environment\n"
+    b"variable `TARIFF_SECRET_KEY`, which is set and non-empty wherever the\n"
+    b"application runs.\n")
+
 # The model each CLI judges with. The rounds' judge is Claude: it shares a
 # vendor with the generator, which a judge from another vendor would not, but
 # that one's plan allows about thirty judgings a week and a round needs three
@@ -984,9 +995,12 @@ def spec_checks(scratch):
     current = spec_text(SPEC)
     earlier = b"# tariff, as an earlier round specified it\n"
     thin = spec_text(THIN_SPEC)
+    round4 = current.replace(SECRET_KEY_PARAGRAPH, b"")
+    round4_thin = thin.replace(SECRET_KEY_PARAGRAPH, b"")
     planted = {"current": current, "thin": thin,
                "crlf": current.replace(b"\n", b"\r\n"),
                "earlier": earlier,
+               "round4": round4, "round4-thin": round4_thin,
                "edited": current + b"\nAlso build a blog.\n",
                "missing": None}
     saved = dict(SPECS)
@@ -1036,6 +1050,15 @@ def refused(label):
          judged_against("earlier", earlier)
          and built["earlier"][0]["spec"]["round"] == "an earlier round"),
         ("a tree whose spec was edited is refused", refused("edited")),
+
+        # A replaced specification stays registered, or every tree built
+        # against it is refused as edited and can never be judged again.
+        ("round 4's trees are judged against the spec they ran",
+         round4 != current and round4_thin != thin
+         and judged_against("round4", round4)
+         and built["round4"][0]["spec"]["round"] == "round 4, weaker"
+         and judged_against("round4-thin", round4_thin)
+         and built["round4-thin"][0]["spec"]["round"] == "round 4, thin"),
         ("a tree carrying no spec is refused", refused("missing")),
     ]
 
 
@@ -26,6 +26,7 @@
 import json
 import os
 import re
+import secrets
 import subprocess
 import sys
 import tarfile
@@ -60,6 +61,13 @@
 ADMIN_PASSWORD_VARIABLE = "TARIFF_ADMIN_PASSWORD"
 ADMIN_PASSWORD = "scoring-admin-password"
 
+# Section 6 signs the session cookie with this variable's value, which is set
+# wherever the application runs. An application that refuses to start
+# without it is following its rules, so scoring always supplies one. It is
+# drawn per run rather than written down, so no fixed key reaches a trial.
+SECRET_KEY_VARIABLE = "TARIFF_SECRET_KEY"
+SECRET_KEY = secrets.token_hex(32)
+
 # Files nobody asked for. The prompt asks for an application; a trial that
 # also writes a decision record or a changelog spent budget on it, which is a
 # metric the design reports rather than a fault it punishes.
@@ -99,11 +107,13 @@ def run(argv, cwd=None, env=None, timeout=TOOL_TIMEOUT, stdin=None):
     produced a number. A command that does not exist or does not finish is an
     outcome, not an exception: the caller turns it into a missing metric.
     `stdin` is text written to the command's standard input. The command's
-    environment carries the administrator password unless it sets its own.
+    environment carries the administrator password and the secret key unless
+    it sets its own.
     """
     record = {"argv": list(argv), "cwd": cwd}
     env = dict(os.environ if env is None else env)
     env.setdefault(ADMIN_PASSWORD_VARIABLE, ADMIN_PASSWORD)
+    env.setdefault(SECRET_KEY_VARIABLE, SECRET_KEY)
     try:
         proc = subprocess.run(argv, cwd=cwd, env=env, input=stdin,
                               capture_output=True, text=True,
@@ -1513,6 +1523,8 @@ def get(self, path):
 def create_app(database):
     if not os.environ.get("TARIFF_ADMIN_PASSWORD"):
         raise RuntimeError("seeding refuses without TARIFF_ADMIN_PASSWORD")
+    if not os.environ.get("TARIFF_SECRET_KEY"):
+        raise RuntimeError("no default secret: TARIFF_SECRET_KEY is unset")
     return App()
 '''
 
@@ -1521,21 +1533,26 @@ def boot_checks(scratch, venv):
     """Prove the boot check reaches an application that seeds on start.
 
     The planted application refuses to build without the administrator
-    password, as the specification's seeding does. The launching process's
-    own value is taken away first, so only scoring can have supplied one.
+    password, as the specification's seeding does, or without the secret
+    key, as an application with no default secret does. The launching
+    process's own values are taken away first, so only scoring can have
+    supplied them.
     """
     planted = os.path.join(scratch, "seeding")
     os.makedirs(os.path.join(planted, PACKAGE))
     with io.open(os.path.join(planted, PACKAGE, "__init__.py"), "w",
                  encoding="utf-8") as handle:
         handle.write(PLANTED_SEEDING_APP)
-    inherited = os.environ.pop(ADMIN_PASSWORD_VARIABLE, None)
+    variables = (ADMIN_PASSWORD_VARIABLE, SECRET_KEY_VARIABLE)
+    inherited = {name: os.environ.pop(name, None) for name in variables}
     try:
         booted = boot_check(venv, planted)["value"] or {}
     finally:
-        if inherited is not None:
-            os.environ[ADMIN_PASSWORD_VARIABLE] = inherited
-    return [("an application that seeds on start boots under scoring",
+        for name, value in inherited.items():
+            if value is not None:
+                os.environ[name] = value
+    return [("an application that seeds on start, and has no default "
+             "secret, boots under scoring",
              booted.get("factory") is True
              and booted.get("index_status") == 200)]