# W3 / #239 design gate — VERDICT (doyle, 2026-08-29) Gated: `W3-239-BOUNDARY-DESIGN.md` (lane worktree, measured at `7926fb5a`). Cites spot-verified by me at that sha: seeding path (ioevents.rs seed-silent + `--after ` caller-carried cursor at api/mod.rs:434-451), trim contiguity doctrine (iolog.rs:288-289), render/allowlist, forward-compat pins. §0's ruled/open split is correct and the withdrawn-B1 record is exactly how a dead argument should be buried. §1-3, §5, §7 (minus one cell), §8 gate clean. ## The three asks 1. **§4 carrier: C1 GATED, not C2** — taking the separability you declared yourself ("shipping C1 first and pulling C2 in on a measured need costs no consumer-visible change"). Grounds, in order of weight: - **C2-as-proposed breaks the trim's own deciding arithmetic.** iolog.rs:288-289: seqs are contiguous BECAUSE trimming is front-only, and `last - first + 1` is exact BECAUSE of that. Skip-boundaries eviction leaves retained boundary rows below the contiguous tail; `first_seq_at` then returns a boundary's seq, the row-count overcounts by every hole, and the trigger fires on EVERY append past that point — a whole-file rewrite per append, the exact cost `IO_LOG_TRIM_SLACK` exists to amortize (:85-91). Fixing it needs a scan-per-trigger or second bookkeeping — "a second place to be wrong" in the refusal's own spirit. This is the attack §10.2 invited: your kind-vs-degree distinction SURVIVES (an ordering is not a cap), but the ordering's PRICE was unmeasured, and it lands in the same module the no-knob argument was defending. - **The default consumer never reads the rows C2 protects.** The poll's first contact seeds SILENTLY at head ("history is not replayed" — measured, seed path + the e2e that pins it). Only an explicit `--after` reader ever reaches an old boundary row. A live poller (seconds-scale loop vs a ≥~1.85h window) sees every boundary under plain C1. The residual loss is exactly: an `--after` historical reader asking for a boundary more than ~2h of peak busy work later — which sits beside the module's own dead-cursor philosophy ("an adapter that stops polling for a day has a dead cursor anyway"). - C2 stays AVAILABLE on a measured need — but its next proposal must price the trigger arithmetic (boundary-aware count, or a scan it costs out) as a first-class section, not inherit this gate's pass. - C3 stays refused on your own grounds (second cursor, split ordered stream). 2. **§4.1: answered above** — distinction of kind CONFIRMED, pricing REFUTED. The section was right to want attacking. 3. **§5 no new poll verb: GATED** — follows from C1 the same as from C2. ## Two riders (binding on the build) - **Stale strings from the withdrawn floor:** §6 says the REQ owns "the C2 trim priority plus floor" and §9 step 4 says "C2 trim priority + floor" — both refer to the floor §4.1 itself withdrew, and now to a C2 this gate removed. Sweep both before building (retraction sweeps strings). The REQ owns: category + three variants, both emitter sites, coerced-token rider, empty-payload exception, and the boot-observation contract below. §7's C2 trim-ordering unit drops with C2. - **The boot-observation contract goes in the doc sweep, stated not implied:** a shell attached live receives the pushed `boundary` frame; a session-cursor poller sees every boundary from seed forward; history before first contact is reachable only by explicit `--after` and only within the retention window — `boot` in particular is observable live and by early `--after`, and is NOT replayed to a silently-seeded consumer. That sentence is what keeps #239 from re-filing itself the way #224 did (an undiscoverable shipped surface reads as missing). ## Consequences §2 wire shape, §3 emitters + riders, §5 surface, §6 REQ (as amended), §7 tests (minus the C2 cell), §8 sweep + the contract sentence, §9 order (minus step 4) approved. Build GREENLIT on C1. Hand the sha to the gate with both arms per the W2 shape.