---
name: milestone-a-golden-landed
description: "Milestone A ACCESS-CONTROL: r3 golden GREEN 9/9, two-host seam PROVEN, main ff'd to 8f3e10b, deployah GO'd at that sha; milestone A itself still WIP (W4/W5 unbuilt)"
metadata: 
  node_type: memory
  type: project
  originSessionId: 0ed6e725-1e95-40e9-9ab2-1d8ba3153a26
  modified: 2026-07-30T02:16:39.033Z
---

**State 2026-07-29 ~16:15 PDT. `main` = `af65ac0` (true ff `ffc7e9e..af65ac0`, tested sha == merged sha, no force). NOTHING HAS PUBLISHED — no tag, no release, deployah has no GO. The GO is mine and I am holding it.**

Golden run **30496546229 @af65ac0 = green** (changes, traceability, test+n1-gate on BOTH boxes, notify). ADR-0050's golden-CI pilot worked: milestone-batch golden run, thin-lane PRs, ff-only main. Contents = main(ffc7e9e) + #119 (W0 CI lanes + flake registry) + engine-room chain (#120 acl-core, #121 two-key, #123 sender stamp, #125 engine room) + bump `e2e564f` (v0.46.0, counter 81); tree byte-identical to battery-tested `2b08287`. Local battery all green (build 231s, clippy -D warnings, units 469+722+70+38+309, xtask check 113s no CLI-ref drift, traceable-reqs exit 0, int 66/66 over 15 suites clearing the declared_seen W2-seam debt); disposal ran BEFORE push, reclaimed 47.4GB vs golden's 32GB floor.

⭐⭐ **THE BLOCKER — `twohost-a`/`twohost-b` SKIPPED, so milestone A's cross-machine seam is UNPROVEN.** Both jobs are opt-in: `contains(head_commit.message,'[twohost]') || contains(pull_request.title,'[twohost]')`. todlando surveyed 40 recent ci.yml runs: **twohost has executed ZERO times** — skipped on every lane at our contents, on v0.45.0's release run, and on every main merge #113–#118. Milestone A *is* the cross-machine story (two-key subnet join, admin-code pairing, daemon-stamped proven sender, engine-room posture). Rule banked as [[opt-in-ci-legs-skip-silently]].

**RULED evidence path (todlando's design, approved — needs no empty commit and does NOT change the sha):** park `probe/twohost-base` at ffc7e9e, push `probe/twohost-head` at af65ac0, open PR titled `[twohost] two-host seam evidence at af65ac0`. ffc7e9e is an ancestor, so the merge ref is af65ac0's tree exactly — I gate the TREE, not the branch. ⭐ Amending the candidate message is now the WORSE option: it mints a new sha and breaks tested==merged on an already-advanced main.

**RED CONTINGENCY RULED: fix forward as a new golden batch, do NOT roll main back and never force-push main.** Nothing published ⇒ no user exposure; rollback would trade a fixable seam defect for rewritten public history other lanes build on.

**QUEUE (hfenduleam+kitsubito, doyle sole sequencer):** main thin run 30498436981 @af65ac0 settles → twohost probe (both boxes, ≤40min) → hertz's named window (he has an explicit HOLD on cargo, edits allowed; told not to infer his window from quiet).

⚠ **UPDATE (todlando, 2026-07-29 ~16:20): main's thin run 30498436981 came back RED and the probe was NOT fired — sequence stopped at the red per the protocol.** `unit (self-hosted, Linux, kitsubito)` job 90732528740, test `spt-daemon::servicehost::tests::the_spawn_environment_carries_the_cli_capability`, servicehost.rs:2370, 715 passed / 1 failed. **Not a product defect and not registry material** — mechanism named from source: the victim is a *bystander* comparing two independent live reads of process-global home, so `ENV_LOCK` cannot protect it. Full class writeup + fix shape (`service_env_at(home, …)` explicit-home seam) in [[bystander-test-reads-process-global]]; third instance of the SPT_HOME class, routed to hertz who was mid-edit in that exact seam. Load direction measured: `with_home` in `crates/spt-daemon/src` 167 → 188 (+13%) while `servicehost.rs` had an **empty diff** ⇒ pre-existing latent defect whose exposure the batch increased, seam-adjacent not seam-caused. Same sha passed it in golden's full-suite Linux job and in the local battery. So main currently sits at af65ac0 with a red thin run; deployah still held, nothing published.

✅ **UPDATE 2 (todlando, 2026-07-29 ~23:40Z) — BOTH DEFECTS HAVE A REPAIR; I AM RELEASED TO ASSEMBLE.** hertz pushed PR #124 @`6bf2bd9`, which lands the servicehost isolation AND the twohost mechanism (my assigned scope — he built into it; doyle accepted the overlap because the result is better). doyle verified the servicehost leg **structurally** at 6bf2bd9 himself (`service_env_at(home,…)` L417; sole `spt_home()` = production wrapper L438; test supplies a TempDir and asserts against it; no live global read in the assertion) — accepted, with focused gates as corroboration only.
**Assembly is FF-SHAPED, not a merge:** af65ac0 is already an ancestor of 6bf2bd9 (af65ac0..6bf2bd9 = 5 commits / 8 files), so main + repair + Path B **IS** 6bf2bd9. My branch: `golden/access-control-r2` @6bf2bd9 in `.worktrees/golden-b`, assembled and **NOT pushed** (a `golden/**` push fires the golden run — battery first).
⚠ **The tree is WIDER than the released scope** (disclosed to doyle): it also carries `input_ack_deadlock` timing, the MESH-6 probe-cap test rewritten from sleep/`Instant` to a 4-party `Barrier` + active-high-water (count-not-clock), `daemon_e2e` reap diagnostics, and `REQ-CI-LOCAL-GATE-DISPOSAL` registered at `required_stages=[]`. `cli.rs` +42 is entirely inside `mod tests`; `daemon_inhibit.rs` +94 is a behavior-preserving `*_at(home)` extraction, public signatures unchanged. No product behavior moves.
⭐⭐ **THE TOKEN IS RETIRED** — see [[name-the-file-and-sha-a-condition-came-from]] for the full lesson (doyle's own check was the victim). Gate at `golden.yml@6bf2bd9` L594/L673, both jobs: `if: ${{ !cancelled() && (github.event_name != 'workflow_dispatch' || inputs.twohost) }}`. `[twohost]` in the head commit is now DOCUMENTATION ONLY — never treat its presence as evidence the legs fire nor its absence as a reason to hold. **Amended dual verification:** (a) pre-push, confirm that condition at the assembled sha via `git show <sha>:.github/workflows/golden.yml` — ALREADY RUN AND PASSING; (b) post-start, twohost-a/twohost-b in the job list with a conclusion other than `skipped`, from the job-level query, NEVER the informant ping. Disagreement between doyle and me stops everything.
**MY OPEN FINDINGS:** F1 — `golden.yml@6bf2bd9` L354/361/371 (`[budget]` steps) still carry the dead `pull_request.title` disjunct (golden.yml has no `pull_request` trigger); hertz's "dead clauses removed" holds for twohost only. Awaiting doyle's ruling on whether the cleanup rides. F2 — hertz's commit body has **literal `\n`** so `Co-authored by: hertz` is not at line start, and `.github/ci/ci-notify.sh:143` parses `^`-anchored ⇒ #124's run notifications reach doyle only, silently. Not repaired by me: reminting 6bf2bd9 would break tested==assembled for a trailer.
⚠ **Battery HELD on a closed quiet window, both axes:** CI 30499638578 in flight (#124's thin lane, hfenduleam = gate box AND runner) **and** a live local `cargo` 40488 + `rustc` 21048/37052 that are not mine — the half `gh` cannot see. Asked hertz whose they are rather than assumed (they contradicted his BOX FREE by ~1min).

✅ **UPDATE 3 (todlando, ~23:55Z) — CANDIDATE TIP = `ce4386e`** on `golden/access-control-r2` (= hertz's 6bf2bd9 + my F1 commit), battery running, NOT pushed. doyle ruled F1 RIDES (dead `pull_request.title` disjunct removed at the three `[budget]` step gates), F2 fix-forward split by owner (hertz's thin lane makes ci-notify LOUD on an unparseable trailer; 6bf2bd9 never rewritten), F3 accepted with the wider tree logged as ruled scope.
⭐⭐ **doyle's SHARPENING of the dead-clause class — keep this wording:** the defect is **a trigger-impossible expression in a GATE position**, NOT "a `pull_request` reference in a push-only workflow." The same expression is defensive and correct behind a fallback (`pull_request.head.sha || github.sha`, L822) or a shell guard (`PR_NUMBER` + `[ -n … ]`, L833) — both deliberately UNTOUCHED. **A gate cannot express its own impossibility**: it returns false silently and is indistinguishable from a gate that merely did not match, whereas a fallback announces its own absence.
⭐ **doyle WITHDREW his own corroboration claim** (I pushed back, he took it): a green `unit (Linux)` at 6bf2bd9 is **ZERO information**, not weak evidence — the same test passed at af65ac0 in golden's full-suite Linux job *while the defect was live*, so it cannot distinguish repaired from lucky. Do not cite it in any handoff. hertz called it "empirical corroboration" in his summary and was corrected.
⭐ **Quiet-window predicate gained an ATTRIBUTION CLAUSE (binding):** a CI job on hfenduleam MANIFESTS as local `cargo`/`rustc`, so the two axes are NOT independent — **presence of local cargo does not imply a second occupant.** Walk the parent chain: roots at `Runner.Worker`/`RunnerService` ⇒ the CI axis already counted; roots at a user shell ⇒ genuine second occupant, hold. I reported a live cargo as *contradicting* hertz's BOX FREE without attributing it and manufactured a conflict between two correct observations; the walker now lives in the rig.
⚠ **RIG WAS PINNED TO THE WRONG TREE** — the inherited `golden-battery.ps1` hard-coded `.worktrees/golden-a` + a previous session's scratchpad; running it as-found would have gated the WRONG TREE (this morning's wrong-artifact class, in rig form). Retargeted copy lives in this session's scratchpad. Also **`racecheck` promoted into `all` and extended to `spt-daemon --lib` parallel+serialized** — the servicehost bystander lived in spt-daemon, so the leg that exists to catch that class was never touching the batch's headline repair. Verifications already done at the tip: check (a) re-read at `ce4386e` (conditions shifted 594/673→598/677 by my comment, text byte-identical — the shift is why re-reading beat predicting), PyYAML semantic parse (7 jobs, typed `twohost` boolean default True), and the trailer verified by RUNNING `ci-notify.sh:143`'s own extractor (`PARSED=[todlando]`), never by eyeballing.

🔨 **UPDATE 4 (todlando, 2026-07-30 ~00:15Z) — PUSHED. TIP = `ce4386e`, golden run `30501468421` on `golden/access-control-r2`.** Battery: 12 legs, ALL EXIT=0, each verified to have MEASURED something (units 2015 passed/0 failed/1 ignored over 22 suites; int 67/67, 0 skipped, 16 suites; spt-store 310/310 ×3 par/par/serial; spt-daemon 722/722 par+serial; xtask 103s no CLI drift; reqs exit 0). Zero sweep kills at every boundary. No timing singleton ⇒ stop-condition never armed. **Disposal as the LAST leg:** scoped census 0 survivors → removed → `reclaimed=49,099,616,256`, free_after=145,752,031,232 (vs golden's 32 GiB floor).
⭐⭐ **TWO GREENS IN MY OWN BATTERY ARE NULL RESULTS — named, not banked:** (1) `race-daemon-par/serial` ran on **WINDOWS**, but the servicehost bystander is **LINUX-ONLY and passes on Windows UNREPAIRED** ⇒ 722/722 green is the identical reading the broken code gives; it CANNOT distinguish repaired from unrepaired, so the structural proof carries the repair, not my leg. The leg's real value is the spt-store daemon_inhibit parallel-vs-serial contrast + a "nothing else moved" signal. (2) `int` reported **`spt-daemon::twohost` PASS on 3 tests in 0.016–0.129s** — env-gated on `SPT_TWO_HOST=1` (unset locally) so they early-return: **face 1 of the silent-skip class appearing INSIDE my own battery.** A local twohost PASS is silence about the seam; only the golden run's twohost-a/b jobs carry it.
⭐⭐ **MY FILTER ATE ITS OWN DATA:** `grep -v "0 passed"` also removes `310 passed` / `70 passed` ("31**0 passed**" contains the string). I under-reported two suites and briefly read the spt-store race legs as having selected ZERO tests — [[verdict-from-probe-competence]] biting me inside the instrument I had just built. **A substring filter over numeric output is a competence bug; anchor it (`ok\. 0 passed`).**
⚠ **CHECK (b) HAS A BLINDNESS WINDOW — do not misread it:** twohost-a/b are `needs: test`, and GitHub does not create a dependent job's record until its dependency resolves, so a job-level filter returns **ZERO early in the run**. That zero is *the query being blind*, shape-identical to the defect we repaired. Only run (b) after `test` resolves on both boxes.
⚠ **LIVE REPRO ON THE BOX:** releases#30, a peer pump wedged at quic-connect ~7h old, deliberately preserved (deployah). My battery ran against it. Ruled: a red on any daemon/pump/broker/mesh leg must name the wedge as a **confound candidate** (no rerun into a verdict); a GREEN there is **not** a robustness claim — pump-adjacent legs passed alongside it and that distinguishes nothing. **Never restart it:** it destroys someone's evidence AND drops the box into post-restart daemon churn (a blind spot ruled 2026-07-27 with a mitigation: fleet-spt CPU-seconds delta sampled before/after). **Sweep safety is by CONSTRUCTION:** every live `spt` resolves to the installed `AppData\Local\spt-core\bin\spt.exe`, so a path-scoped `Path.StartsWith($TARGET)` sweep cannot reach it — a name-based sweep would have destroyed the repro while reporting success.
⚖ **doyle's finding, hertz's lane:** the **quiet-window predicate is written NOWHERE in the repo** — both axes, queued-is-not-idle, the churn blind spot, the new attribution clause: all oral tradition, which is why it was misapplied twice in one day. Being written into `docs/GOLDEN-CI.md` with the disposal rule. The ADR-0050 amendment is hertz's too (`docs/adr-0050-silent-skip`), folding his 4th face (literal-`\n` trailer) into MY draft; doyle ruled it must NOT ride a critical-path batch.

⚖ **MY RULINGS 2026-07-30 ~00:20Z, not in the updates above:**
- **RELEASE PRECEDENCE (doctrine, deployah surfaced the conflict):** ADR-0050's ff-only lane needs tested-sha == shipped-sha ⇒ the bump RIDES the batch, but `docs/RELEASE-RUNBOOK.md` demands a dedicated release PR and explicitly retires the ride-along form. Both cannot hold. **RULED: tested==shipped OUTRANKS bump-in-PR.** A thin release PR on the ruled tip would put the TAG on a commit no golden run tested — the runbook's own stated fear through the other door. The release-driver gate is satisfied by a **RECORDED out-of-band audit at the ruled tip** (counter decoded from the last published signed metadata, changelog vs the ACTUAL commit range, update-set compat constants proven unchanged at the sha, bump level justified). Form retired, substance kept. **COROLLARY, binding: there are NO post-golden edits** — not a changelog date, not a rider line. Any delta rides the batch or the tree ships as tested. Amendment routed to hertz (ADR-0050 + the runbook, because a driver reads the RUNBOOK).
- **deployah's audit at ce4386e:** repair delta owes NO changelog entry (verified per-file, not per-commit-label — three of eight touched files are under `src/`, which is where a user-facing change hides under a `test:` prefix). Riders are comms-only, no tree edits, so the freeze does not touch them. Counter 81 confirmed by decoding v0.45.0's published `update-set.json` metadata. `BROKER_RESOURCE_ABI=1` + `IPC_PROTOCOL_VERSION=1` proven absent from the diff ⇒ no compat bump owed.
- ⭐⭐ **deployah CORRECTED MY characterization of `daemon_inhibit`:** I called it behavior-preserving. It is more — the OLD `set_stop_inhibit` resolved `spt_home()` and then called `inhibit_path()`, **which resolved it AGAIN: two live reads of the process-global in one PRODUCTION operation, able to disagree.** The bystander defect's own shape in shipping code; `servicehost` (`service_env` → env assembly) had it too. Ruled: no changelog entry (needs mid-process `SPT_HOME` mutation, not user-observable) but RECORDED, because an incidental fix nobody writes down is a defect that returns. General form: **resolve a process-global ONCE per operation and thread the value; a second read inside a callee is a latent disagreement.** Both instances were invisible until a TEST became the victim. Seeded INACTIVE as `REQ-HAZARD-PROCESS-GLOBAL-ONE-RESOLUTION` + KNOWN-HAZARDS 7.57; the eventual test must pin **single resolution per operation** (count `spt_home()` = exactly one per public boundary), NOT merely that a home is threaded somewhere — an `_at(home)` inner can exist while a callee still reaches for the global, passing a shape check and failing the invariant.
- **BOARD, ruled and prepared (`scratchpad/board-moves-milestone-a.md`):** releases#20's attached set is #15(closed) #9 #10 #13 #24. Verified AT af65ac0: #15 delivered (W1 ACL core), #9 delivered (`REQ-ACL-MODE-ADVISORY-GOSSIP` + `-SUBNET-MODE-CAPTURE`, doc/impl/unit active). **#10/#13/#24 NOT delivered — no `MONIC`/`MNEMONIC`/`KNOCK` requirement exists at af65ac0 at all.** Since `state <milestone> acceptance` CASCADES to live sub-issues, a blind cascade would stamp ACCEPTANCE on three partial Requests ⇒ **detach #10, #13, #24 first** (`milestone remove`), then `sweep` (reconciles #15: closed-as-completed but still labelled WIP), then `state #20 acceptance`, then GO, then `release v0.46.0` (promotes only CLOSED acceptance Requests to DONE). A Request's state must describe ITS delivery, not its milestone's.
- **WORKTREE DISPOSAL (hertz's audit: 35 registered + 3 strays, 8.49 GiB; DISPOSE 19 / HOLD 8 / ORPHAN 11).** BLOCKED until the golden run concludes — a multi-GB delete under a live CI job is forbidden and would make any flake in that run unattributable. ⭐⭐ **hertz classified `g6-curve.ps1`/`g6-postbounce.ps1` as disposable strays; they are the ONLY implementation of the post-restart-churn mitigation he is documenting in that same lane** (duration-vs-daemon-age with CPU-delta as the confounder probe, plus deliberate safety: throwaway `SPT_HOME`, home-hashed socket, bounce BY PID because `daemon start/stop` are service-aware and could reach the FLEET daemon). RULED: **promote both to `.github/ci/`** (established rig-script home: `reap-census.*`, `test-temp-sandbox.*`), cite them BY PATH from the churn clause, and parameterize their dead hardcoded scratchpad path in the same commit — promoting an unrunnable script enshrines a mitigation that isn't one. **A stray file is not automatically junk; read it before classifying — accumulation is where unowned instruments end up.** Also: `pilot-rebase` is SAFE to dispose (`fdb4b42` IS PR #122's head sha, preserved on origin under another name) ⇒ the at-risk test is **whether the SHA is reachable from ANY origin ref** (`git branch -r --contains`), NOT whether a branch name exists. `ft-w1c`/`g6-head` held only for dirtiness: capture both diffs to patches, then dispose — holding unclaimed uncommitted work forever is deferral dressed as caution. `probe-cap-count-not-clock` becomes disposable the moment ce4386e ff's to main.

**MINE, open:** alchemy-0 board moves for releases#20 + W1–W3 requests — **holding ACCEPTANCE behind the evidence**; close stranded PRs #121/#123/#125 referencing af65ac0 (ff didn't auto-close them — stacked bases, not main; #119/#120 closed MERGED). deployah GO draft sits ready in todlando's scratchpad (FINAL_SHA=af65ac0, REL_SHA=e2e564f, counter 81, #117 riders) — unsent by my order.

⭐ **Third dead-gate defect this milestone**, integration-seam class: W2b split `access_check` into a thin wrapper + `access_check_with_sender`; W3's inbound lock had to go in the WITH-SENDER body ahead of the same-node allow, because `wan.rs` is the only caller passing a proven sender and MSG is the family the lock refuses — wrapper placement would have been DEAD on the one family T4 targets with every existing test green. Pinned by unit `the_inbound_lock_is_reached_through_the_sender_stamped_entry_point` @47dc012. See [[resolve-wrapper-conflict-toward-shared-body]].

⚠ Excluded from the batch: **#122** (parks on operator's `TRACEABLE_REQS_TOKEN`; its traceability red would red the batch) and **#124** (hertz's lane). ⭐ **daemon_e2e reap = SECOND SIGHTING** (#124 @e85ee66 job 90717855207, `daemon_e2e.rs:334`, branch carrying none of our code) ⇒ recurrence protocol FIRED, hertz dispatched with assert-level instrumentation, NOT registry-eligible; it passed inside golden.

🔨 **UPDATE 5 (todlando, 2026-07-30 ~00:55Z) — r2 RED CLASSIFIED-AS-UNREPRODUCED, r3 ASSEMBLED AND PUSHED. TIP = `8f3e10b`, golden run `30504054460`.**

⭐⭐ **THE CROSS-MACHINE SEAM IS PROVEN.** Run 30501468421 @ce4386e: `twohost-a` job 90745166351 **success**, `twohost-b` 90745166395 **success** — first execution in project history, read from the job-level query. doyle verified NON-VACUITY from the logs and the discriminator is better than a duration: **per-box role asymmetry** — on each box the role that box was ASSIGNED ran 60+s while the role it was not assigned returned instantly, and the peer IPs point at each other. A vacuous harness would be fast on both roles on both boxes; misconfigured boxes would be slow on the SAME role on both. ⭐ **The informant ping named only `test(failure)` and never mentioned twohost at all** — first live proof that the informant is strictly weaker than the job query.

**The Windows red is UNREPRODUCED, not explained.** Battery on a quiet box at ce4386e, every leg exit=0: leg A alone ×5 + a libtest contrast (all non-vacuous — `1 test run: 1 passed, 0 skipped`), leg C instrumented, and **leg B2 = CI's own Phase A, 2170 tests across 108 binaries, 220s, `2170 passed (8 leaky)`, target PASS at 4.966s, zero FAIL/TIMEOUT/ABORT.** Content is exonerated (libtest is in-process, so an assertion MUST print; it never fired), leaving external termination as the only account consistent with CI's exit **1** (libtest panics exit 101). ⚠ **Leg D was DELIBERATELY NOT RUN**: a green D against a green B2 validates nothing, so **hertz's guard `b3a545c` is UNTESTED against the condition it was written for** — this golden run is the guard's FIRST REAL TEST, never its confirmation.
⚠ **Fidelity gap named, not papered over:** B2 reproduced CI's COMMAND + PROFILE (`NEXTEST_PROFILE=ci-windows`, threads=8), NOT its JOB ENVIRONMENT — golden.yml creates a run-scoped TMP/TEMP on Windows (moving where `tempdir()` and thus `daemon.pid` live), and CI runs Phase A→Phase B→doctests→extra e2e in one job on a box warmed by n1-gate. 220s vs the job's 8m16s is consistent with that.
⭐ **Leg C's probe substantiated doyle's guard-hole ruling from a MEASURED path:** the true daemon is `<target>\debug\spt.exe`; a sibling nextest binary is `<target>\debug\deps\<name>-<hash>.exe`. **Both pass `starts_with(<target>/debug)`; only the first passes exact-executable equality** — which is why hertz's amended guard requires exact equality. Also: the failing test reads ONLY `daemon.pid` (never `brain.ready`), one call site, so any result bounds to the 6-file `/F /T` tier and says nothing about the 26-file `brain.ready` class.
⭐ **Disposal reclaimed 39.78 GB and the scoped sweep killed 5 survivors** under my own target after the suite completed — an independent reproduction of the leaked-child shape `REQ-CI-LOCAL-GATE-DISPOSAL` was registered for. Ran BEFORE the push, because a 40 GB delete must not overlap the run it would confound.

⚠⚠ **THE ASSEMBLY DEFECT — deployah caught it and it was MINE to make.** hertz's fix line (`fef38be → b3a545c → aa487b9`) was a **SIBLING** of `ce4386e`, not a descendant: `merge-base ce4386e aa487b9` = `af65ac0` = main. Pushing r3 at his tip would have shipped a tree **missing all six repair commits**, including `6bf2bd9` — the twohost-independence change that produced tonight's seam evidence — while every green looked healthy. Full lesson in [[assemble-onto-the-repair-tip-not-a-sibling]].
Assembled correctly by cherry-picking `af65ac0..aa487b9` ONTO ce4386e (ff-shaped, no merge), then **fast-forwarding** to hertz's later `672d706` + `8f3e10b` because their parents were already my tips — an ff preserves his authorship shas AND bytes, where a cherry-pick would mint new shas for identical content. Sole conflict: `traceable-reqs.toml`, both lines APPENDING a `[[requirements]]` block ⇒ **union**, keeping both.
⭐⭐ **The union was proved ARITHMETICALLY, not by re-reading the file:** hertz's line measures 630 requirements, the reconciled tree measures **631** — 630 plus exactly the one registration his line lacked. **Taking either side of that conflict would have left 630 and looked perfectly healthy.** doyle's positive control agrees: literal `spt_home()` counts read servicehost=1 / daemon_inhibit=5 at the tip (the repaired shape), the same probe whose 1-and-3 reading exposed the topology.
⚖ **DATE LEG is now a NAMED PRE-PUSH LEG on every assembly** (doyle's ruling) — see [[release-standard-bump-in-pr]]. Re-measured at the push moment: local `2026-07-29 17:53:28 -0700` vs `## [0.46.0] - 2026-07-29`, MATCH.

⚖ **doyle's decision rule, PRE-COMMITTED before the legs reported: main advances ONLY to a sha whose golden run is GREEN.** An explained red is not golden evidence — accepting one establishes that a narrative can substitute for a green, which is flake-laundering committed on one's own milestone. ⭐ deployah's addition, better than any of doyle's own reasons: **the update-set is SIGNED**, so shipping on an explained red puts a signature over an artifact whose provenance rests on a narrative, and that signature is what every node's `spt update` verifies thereafter. ⭐ And keep verbatim: **"v0.45.0 having shipped carrying the same hazard is not precedent for repeating it — it is how the hazard became known."**
⭐ **Eight predicate failures in one day, all the same species — the predicate omitted its TOOL or its SCOPE.** Tonight's: my case-INSENSITIVE `FAIL` grep returned a dozen "casualties" that were PASS lines for tests with `fail` in their names; and the `grep -c 'spt_home()'` dispute where hertz measured 10 and doyle measured 5 — **both real**, because `()` is LITERAL in POSIX BRE and an empty GROUP in ERE/PCRE/rg/.NET. doyle ruled: adopt `-F` (dialect-independent) but do NOT write "grep -c is regex not literal" into the ADR, because it teaches something false about the tool most agents run.

**r3 = 11 commits off af65ac0** (`git rev-list --count` = 11: the 6 repair commits + b4d5653, 0443613, dfdcab2, 672d706, 8f3e10b). ⚠ I stated **10** twice; doyle and deployah each measured 11 independently and both raised it. My figure came from ARITHMETIC — I ff'd twice and counted once — not from a command. Ninth predicate/figure failure of the day and the cheapest to have avoided: `rev-list --count` was one command away. [[measure-what-costs-one-command]]. deployah's audit range `af65ac0..8f3e10b`, REL_SHA candidate `8f3e10b` unstamped. All seven invariants re-asserted at the tip; `traceability` and `changes` already green on the new run (traceability was doyle's named watch item, since `fef38be` moves `traceable-reqs.toml`). chert HOLDING on box work (W-SPEC rebase local at `200d5b4`, not unwound).

✅ **UPDATE 6 (todlando, 2026-07-30 ~01:55Z) — RUN GREEN, RULED, MAIN ADVANCED TO `8f3e10b`. deployah has his GO.**

Run **30504054460 @8f3e10b: `conclusion=success`, 9/9** (changes, traceability, n1-gate ×2, test ×2, twohost-a, twohost-b, notify). `twohost-b` succeeded 01:43:56Z. doyle ruled GREEN / SEAM PROVEN at 01:50Z and **advanced main himself** (`merge --ff-only` + push, 01:48:37Z, from the shared checkout).
⭐⭐ **THE CROSS-MACHINE SEAM IS PROVEN ON BOTH BOXES** — and the load-bearing fact is **not** the role-timing mirror but the **node-id cross-reference** (doyle's, the only check nobody duplicated): b's node `989b0db…` is the target of a's `WOKE:ling-gated-c2@…`, and a's node `cc45247c…` is the target of b's `SENT(WAN):ling-gated-tgt@…`. Two boxes each naming the other ⇒ **self-loop ruled out**, which the timing axis could never catch. chert narrowed his own "the mirror prediction holds" for exactly this reason — one word, two properties.
b's non-vacuity (branch 1 discharged, my enumeration, no head): 2 `test result:` both `0 filtered out` (twohost 3/165.63s, twohost_cli 2/1023.00s), 5 named tests all ok, `ROLE: b` echoed at runtime in both step env blocks, and role asymmetry MIRRORED (role_b slow on box b, role_a instant) ⇒ **the misconfiguration signature doyle named in advance — role_a slow on BOTH boxes — is ABSENT.**

⚖ **`SPT_TWO_HOST_WAIT_SECS` IS A PER-RUNG CONVERGENCE DEADLINE, NEVER A STEP BUDGET** (`twohost.rs@8f3e10b:49`/`:176` the single construction site, `twohost_cli.rs:57`). doyle, deployah, chert and I had all been reading it as a wall-clock bound on the leg, so the whole ~01:41:08Z "deadline" watch was **a well-formed number answering the wrong question**. ⭐⭐ Keep the phrasing doyle banked: **a number read from the correct source can still be the wrong measurement** — deployah's correction had fixed the *provenance* (b's own 900, from `golden.yml:663`) and still bounded the wrong quantity. Boundary deployah drew and doyle ruled: for the bye hold specifically `rig.wait` IS consumed as one deadline on one interval (L724), so 01:28:40.8→01:43:41.1 = 900.3s **is** well-formed about *that* interval.
Step 10 decomposes: **122.65s of real rung work** (all `GATED OK` by 01:28:40.8Z, incl. a real `DAEMON_STOP_REFUSED rc=3` honest-stop + clean restart) **+ 900.3s of one tolerated tail wait**. Duration was non-discriminating exactly as doyle pre-committed; **the log content discriminated instantly.** chert's transferable form: *when a duration claim stalls, DECOMPOSE THE INTERVAL instead of collecting more duration.*

⚖ **THE "FOURTH PROPOSITION" WAS RAISED, ENDORSED BY ME, BANKED BY chert — AND IS VACATED/REJECTED, NOT REWORDED. GUARD COUNT STAYS AT THREE.** Full lesson in [[hedging-classification-is-not-grounding-the-observation]]. My specific error: I verified A's half and concluded the tolerance substituted a claim for a measurement **without reading what B was actually waiting on**.
⭐ **doyle's sizing, which nobody else reached:** A's dismissal is best-effort *and* short-lived — L919-921 `let _ = store.dismiss(…)` (return DISCARDED), L927 `sleep(3s)`, then A's daemon dies with the fn. So B's up-to-900s wait depends on a flush A allows 3 seconds. **The tolerated timeout is the EXPECTED path by construction** ⇒ ~15m of dead CI wall **every** golden run, not an occasional stall.

⚖ **doyle's ASSERT-3 is the post-push check I did not have and now carry: TREE equality.** `gh api commits/main .commit.tree.sha` = `209744ba339f33bd23c6232098b35311524da2b3` against `git rev-parse 8f3e10b^{tree}` captured **before** the merge. **Sha equality alone passes over a re-minted commit**; tree equality is the only one answering *which tree did I publish*. Closes the gap [[verify-the-subject-not-just-the-measurement]] complains about. My own independent post-push leg (run before reading his ruling) passed too: fresh-fetch is-ancestor, exact `rev-parse origin/main`, and `git ls-remote refs/heads/main` (server read, bypasses local refs).
⭐ **`git reflog show origin/main` distinguishes `update by push` from `fetch`** — one command that localises a push to THIS checkout. That is how I established doyle (not I) had advanced main, on a shared checkout, before his ruling arrived.

⚠ **THE NEXT-BATCH REGISTER DID NOT EXIST** despite my commune AND doyle's §9 both asserting its contents — two disagreeing "confirmed contents" for a file neither had opened. Created for real now (session scratchpad, group A marked reconstructed/UNVERIFIED). Full lesson: [[commune-is-testimony-not-an-artifact]].

⛔ **THE BOARD PLAN RECORDED ABOVE (detach #10/#13/#24 → sweep → `state #20 acceptance` → GO → release) IS OVERRULED — doyle Ruling 2 §4, 2026-07-30. DO NOT EXECUTE IT AND DO NOT RECONSTRUCT IT.** Three separate grounds: **(a)** `state 20 acceptance` REFUSED — milestone A is NOT complete, W4 (knocking) and W5 (trust warning + monic store) are unbuilt, v0.46.0 ships W0–W3 only; **(b)** `milestone remove 10/13/24` REFUSED and **not doyle's call** — detaching shrinks milestone A to what happened to ship, and the A-B-C-D cut was operator-ratified WITH those children attached, so a scope cut is the OPERATOR's decision, never a hygiene step taken to make a cascade safe; **(c)** **"#9 delivered" is FALSE** — measured at 8f3e10b over all **631** requirement ids, ZERO match `MONIC|MNEMONIC|KNOCK|CAUTION` and exactly two match `TRUST|WARN` (`REQ-DAEMON-STOP-LIVE-SESSION-WARN`, `REQ-SELF-ID-TRUST-INJECTED-ENV`, both unrelated), re-run independently at the shipped tip by chert AND deployah. Advisory gossip notifies a **MEMBER NODE** on subnet-mode change with **no apply path**; #9 asks that a closed subnet **caution an AGENT** — the delivery-edge trust-warning composer, which is W5 and does not exist. ⭐⭐ **The two are joined by the word "advisory" and by nothing else** — doyle's own "a shared noun is not a shared claim", caught one command before he executed it onto the board.
⚖ **RULED BOARD STATE, and board work is DONE: #20 WIP · #15 CLOSED+ACCEPTANCE · #9 #10 #13 #24 WIP.** `sweep` already ran (1 reconciled, #15 wip→acceptance). **The ONLY post-publish board action is `spt shell cmd alchemy-0 release v0.46.0`**, which promotes #15 → DONE and nothing else.
⭐⭐ **HOW I RE-BROKE THIS, and it is a NEW face of the commune class:** the original `scratchpad/board-moves-milestone-a.md` was a session-scoped path and was GONE, so I rebuilt it from this memory — **faithfully reproducing doyle's prepared plan including its false #9 premise, because the one thing a reconstruction cannot carry is that the plan was KILLED.** A decision NOT to do something leaves no trace in the artifact it was about. I then re-sent it after Ruling 2 had already overruled it, because I acted on a partial read of the ruling stream (I had a summary of §1 and unread spills). hertz and chert each caught it independently. **When rebuilding from a commune, search for RULINGS AGAINST the thing, not only the thing's contents** — and the file is now TOMBSTONED rather than deleted, because a deleted file gets rebuilt from the same bad memory. Also banked: naming an unrun check does not discharge it — I wrote "this leg needs re-verifying at the new tip, I have not run it" and shipped the conclusion past my own flag.

✅✅ **UPDATE 7 (todlando, 2026-07-30 ~02:15Z) — v0.46.0 IS PUBLISHED. MILESTONE A CUT TO WHAT SHIPPED. A FAST-FOLLOW v0.46.1 IS COMING — NOBODY STANDS DOWN.**
Published **2026-07-30T02:07:18Z**, counter 81, at `8f3e10b`, on **`BigscreenVR/spt-bs-releases`** — full note [[v0460-published]]. Verified by me from the server independently of the driver.
⚖ **OPERATOR RULED (relayed by doyle):** *"cut A to what shipped, but we must do a fast-follow x.x.1 release after publish… afterward comes the new #9 + #10 + #13 + #24 milestone."* So the detach doyle had refused **on the correct grounds that it was the operator's call** was then authorized and executed through alchemy: `milestone remove #20 #9,#10,#13,#24`, then `state #20 acceptance` (cascaded to #15). **Board: #20 ACCEPTANCE closed · #15 ACCEPTANCE · #9/#10/#13/#24 detached at WIP pending their own new milestone.**
⭐⭐ **doyle's aside is the best statement of the thing I was corrected on tonight: "refusing to take an authority and being handed it two minutes later is the cheap outcome; taking it and being right is indistinguishable from taking it and being wrong."** See [[report-measurement-never-issue-direction]].
🔨 **FAST-FOLLOW v0.46.1 — MY POSTURE: do NOT build, bank candidates, propose nothing until the operator's grill sets scope.** My NEXT-BATCH register is the fast-follow's candidate pool (11 items + instrument notes), and **group A stays marked reconstructed/UNVERIFIED — nothing from it reaches the grill without being re-derived from source.** deployah drives v0.46.1 and will re-decode the counter (82) from the published v0.46.0 artifact at signing rather than incrementing.
⚠ **ADMIN-SEED ROTATION IS OFF PREP-ONLY** — operator authorized it into the fast-follow, veto window CLOSED. The defect: eviction rotates only the member seed (`SubnetStore::rotate_seed`), so **an evicted node keeps the admin seed forever — and an admin key IS a membership key (`REQ-SUBNET-ADMIN-CODE-JOIN`), so it can rejoin.** A security hole in code shipped tonight. It is a wire/security change ⇒ **its own gate, never rides another diff**, and it is scoped at the grill as part of one ADR-0050 batch, never a hotfix outside the golden lane.
⚠ **PSYCHE-HOST INGEST CAN FAIL CLOSED AND QUIET** — deployah's went FAILED at 02:05:14Z (3× `claude-spt echo-commune` killed at a 30s bound, under release load) and **recovered on its own by 02:13Z with nothing restarted**. Mine was clean throughout. ⭐⭐ The `psyche-host` field renders **only on the failing agent's own SELF line** — measured from both sides (deployah grepped his full 14-endpoint roster: zero occurrences on peers) — so **no peer can catch this for you and its absence proves nothing unless you have separately seen the field render.** A fresh memory index is **zero evidence** of psyche health: memory is ordinary file writes, ingest is a bounded daemon spawn. Standing item — everyone reads their own SELF line.

**SUPERSEDED STANDING (kept for the chain):** deployah publishing v0.46.0 counter 81 at **REL_SHA=8f3e10b** (his draft's `e2e564f` was rejected by doyle — it is the bump commit inside the af65ac0 chain and would ship a tree missing all 11 repair commits). #119/#120/#124 MERGED, #121/#123/#125 CLOSED. chert released, correctly **sequencing on quiet** behind main's thin lane 30506688036 rather than racing it. Main's thin run is INFORMATIONAL under ADR-0050 and does not hold the release. ~~Mine still open: the alchemy-0 board sequence (detach releases#10/#13/#24 FIRST, then `sweep`, `state #20 acceptance`)~~ — **OVERRULED by doyle 2026-07-30 ~02:00Z; the ⛔ BOARD block two paragraphs ABOVE carries the three grounds and the ruled state. Mine on the board: NOTHING.**

## ⚖ BOARD — EXECUTED AND CUT DOWN (doyle, 2026-07-30 ~02:00Z)
**Only move made: `alchemy-0 sweep` → 1 reconciled, #15 wip → acceptance.** Board now: **#20 WIP · #15 ACCEPTANCE · #9/#10/#13/#24 WIP.** After publish, `alchemy-0 release v0.46.0` promotes #15 → DONE and nothing else (it only promotes CLOSED acceptance Requests).
doyle **overruled his own prepared `board-moves-milestone-a.md`** on all three of its other steps:
- **`state #20 acceptance` REFUSED — milestone A is NOT complete.** W4 (knocking) and W5 (trust warning + monic store) are unbuilt sketches; v0.46.0 ships W0–W3 only. ACCEPTANCE asserts delivery pending release and would be false.
- **`milestone remove 20 #10,#13,#24` REFUSED — a scope cut is the OPERATOR's call**, not a hygiene step taken to make a cascade safe. ⭐⭐ The prepared file reasoned "the cascade would stamp partials ⇒ detach the partials"; the correct inference from that premise is **don't cascade**, not *change the scope so cascading is safe*. Backwards, and it was one command from executing.
- ⭐⭐ **"#9 → DELIVERED" IN THE PREPARED FILE IS FALSE**, caught only by re-verifying instead of executing. Measured at 8f3e10b over all **631** requirements: **zero** match `TRUST|WARN|CAUTION|MONIC|MNEMONIC|KNOCK` (the two hits, `REQ-DAEMON-STOP-LIVE-SESSION-WARN` / `REQ-SELF-ID-TRUST-INJECTED-ENV`, are unrelated). `REQ-ACL-MODE-ADVISORY-GOSSIP` is *a notification to a MEMBER NODE on subnet-mode change, with no apply path*; **#9 asks that a closed subnet caution an AGENT** — the delivery-edge trust-warning composer (closed ∧ passed-gate ∧ no-monic), W5, nonexistent. **Joined by the word "advisory" and nothing else.** [[precise-claim-is-falsifiable-vague-is-useless]] · a shared noun is not a shared claim, this time inside doyle's own prepared plan.

## ⚖ BOX ORDER RULED (doyle, deployah surfaced the collision)
`30506688036` terminal → **deployah tags** → release.yml terminal → draft verified → quiet re-measured → **deployah publishes** → **THEN chert's `-workers auto` sweep.** chert must NOT start on the bare terminality of the thin lane — that same instant is deployah's tag trigger, and release.yml occupies BOTH runners. ⭐ General form: **when two jobs contend, the one whose failure poisons a SIGNATURE goes first** (a red at tag time contaminates the signed artifact's provenance; a red in a sweep costs a rerun).
Also ratified: deployah's stop-rule — **a thin RED at a golden-green sha neither auto-blocks nor gets waved through; STOP and bring it to doyle for one ruling.**
⚠ **doyle's §7 "e2e564f draft" was ALSO phantom** — deployah checked the releases API: the only draft is unrelated (`alchemy-attachments`), and `e2e564f` appears solely as a historical provenance note in the untracked `ACCESS-CONTROL-JIT.md`. The REL_SHA warning was right in substance, wrong about the artifact. Same species as §9. See [[audit-the-boring-claims]].

Related: [[assemble-onto-the-repair-tip-not-a-sibling]], [[golden-ci-strategy]], [[w3-engine-room-progress]], [[w2-two-key-subnet-progress]], [[main-baseline-procedure]] (no sacred baseline for this milestone — ratified, golden is the evidence, main's run is thin by design), [[verdict-from-probe-competence]], [[alchemy-formal-milestone-process]], [[commune-is-testimony-not-an-artifact]], [[hedging-classification-is-not-grounding-the-observation]].