---
name: declare-site-is-not-enforce-site
description: "a policy declared at one ceremony but enforced from a capture written at a DIFFERENT ceremony leaves the declaring node unenforced — enumerate the writers of the enforced field, not the readers"
metadata: 
  node_type: memory
  type: feedback
  originSessionId: 0241438f-ee37-4144-979e-b5499de58a8e
  modified: 2026-08-02T03:26:39.525Z
---

When a posture is DECLARED in one store and ENFORCED from a *captured copy* in another, sweep every
production **writer** of the captured field before believing the posture is live anywhere. spt's
`subnet create --closed` writes `mode` into `subnet.json` and never captures it into `access.json`;
`capture_subnet_mode` had exactly two writers, the JOIN arm and the ER `access-refresh`. Result: every
joiner enforces closed, the MINTER enforces nothing (tier 8 absent ⇒ chain bottoms out implicit open,
all surfaces), and the human view still reads "mode declared by subnet: closed".

**Why:** the reader side (gate, chain, rules) was all correct and honest — staring at it finds nothing.
The asymmetry only appears when you ask "which ceremonies call the writer?" A capture-on-consent design
silently assumes the declaring party is never also an enforcing party.

**How to apply:** grep the writer fn, list its call sites, and map each to a ceremony a real operator
runs. Any ceremony that *declares* the value and isn't in that list is an unenforced node. Also check
whether the record carries provenance for who declared it — without a `minted_here`-style field a
retro-heal cannot distinguish "my own declaration" from "someone else's, captured before the feature
existed", so the backfill question is unanswerable rather than merely unbuilt. Two-arm control:
a minter node beside a joiner node, same declaration, opposite behavior. See
[[discriminator-question]], [[every-return-arm-is-a-copy]], [[stale-snapshot-equality-proxy]].

Filed as **releases#100** (bugfix, NEEDS-OPERATOR) 2026-08-01, doyle's fix-shape ruling embedded:
capture-at-mint sound, both `resolve` persist sites swept, NO silent backfill, existing minters heal
via `access-refresh` and the create output must say so, unit seam owed, bare-status render gap rides.
DO NOT BUILD until the operator's v0.51.0 ride-vs-defer call lands.