{'text': '[.worktrees/202-mnemonics-forgery-unit/traceable-reqs.toml#9C06]\n3786:[[requirements]]\n3787:id = "REQ-MONIC-DELIVERY-TRIGGER"\n3788:title = "The monics a receiving agent holds that MATCH an arriving message RIDE THAT MESSAGE\'S ENVELOPE as a `mnemonics-json` attribute carrying a JSON array of the matched records, so the agent reads its own standing judgement about the sender in the same breath as the message rather than having to go and look it up. THE MATCH IS EVALUATED AT THE ENVELOPE RENDERERS, NOT AT THE WAN EDGE (ruled 2026-07-31): a classification that fires only when the peer happens to be REMOTE is one the agent cannot rely on, and the trust warning\'s edge is the wrong home for it because that edge exists to consume the ACCESS GATE\'s verdict — the two are different concerns that happen to read the same register. THERE IS EXACTLY ONE EVALUATION PRIMITIVE and every delivery surface calls it: a match rule copied per surface is a classification that fires on one channel and not another, which is worse than none because the agent cannot tell which it is looking at. The renderers therefore take the RECIPIENT\'s id as well as the structural sender/body pair, and NO OWNER-LESS RENDERER REMAINS — a renderer that did not need the recipient is the shape a future delivery surface reaches for by habit, arriving attr-less with nothing failing. THE ATTR IS PRESENT IF AND ONLY IF SOMETHING MATCHED: an empty array would say \'evaluated, no match\' where absence says \'not evaluated\', a distinction no consumer has a use for and a second shape every consumer would have to handle. THE TRIGGER VOCABULARY IS RATIFIED (operator ruling 2026-08-03, superseding W5\'s sender-match-only limit) AND IT BINDS BOTH CONSUMERS — this edge and the now-signal MONICS surface — precisely so that the second consumer adds a CONSUMER and never a record migration. Triggers are a JSON array of matchers over five kinds: `sender` (identity match on the PROVEN sender id, which is the trust warning\'s classification question and the only kind that answers it), `content` (the incoming message body), `json` (a custom payload), `user_input` and `agent_output`. MATCHING COPIES THE KEYWORD-HINTS RULE VERBATIM — a literal CASE-INSENSITIVE SUBSTRING by default, a REGEX when `regex` is set, and an INVALID REGEX NEVER MATCHES (a bad pattern silences its own trigger and never panics) — and it copies it BY CALLING IT: the rule lives in one place with two consumers, because a rule copied verbatim into a second place is two rules that merely agree today. Literal-by-default is what lets a trigger carry arbitrary symbols with no escaping burden. WHICH KINDS HAVE A LIVE CONSUMER IS A SEPARATE QUESTION FROM WHICH ARE RATIFIED: `sender`, `content` and `json` evaluate at this edge, which exists; `user_input` and `agent_output` are RATIFIED BUT INERT until the now-signal / IO-parser funnel is built, and a record carrying one is not malformed — it is waiting for its consumer. Reading \'ratified\' as \'has a live consumer\' is the error this clause exists to prevent, and any surface that lists a trigger must say which it is looking at. THE TWO EDGE QUESTIONS ARE DELIBERATELY ASYMMETRIC AFTER THE RE-KEY: a content-triggered monic rides a message it matched WITHOUT classifying its sender, because classification is a `sender` question — so the delivery attr can be present where the trust warning still treats the peer as a stranger. The direction that must hold is the one that protects the agent: anything that classifies the sender ALSO matches the delivery, so an agent is never warned about a stranger whose monic it was handed in the same envelope. The ARRAY shape is not premature generality but the ratified envelope contract, and it is what lets a trigger kind matching several records ride with no envelope change. THE READ IS STORE-FREE AND PURE-PATH, off the tracked root, for the reason the trust warning\'s is: it happens on the inbound message path, where the store\'s ensure-worktree spawns git per message. A RECIPIENT WITH NO MIND — a shell link, an agent that has classified nobody — READS NOTHING AND GETS NO ATTR, and that is the primitive telling the truth rather than a case to special-case; it costs one sentence in the module doc, not a branch. An UNREADABLE record rides nothing, the same fail-safe reading the trust warning takes, and the two consumers are asserted to agree over every state a record can be in — an agent must never be warned about a stranger whose monic it was handed in the same envelope. The attr KEY is a compile-time constant and its VALUE is attr-escaped by the one composer, so monic text carrying quotes or angle brackets cannot forge an attribute or terminate the envelope. STATED LIMIT, NAMING ITS ONE PEER-TRAFFIC CASE: a body that is ALREADY a typed envelope passes through verbatim and carries no attr — splicing an attribute into a finished envelope means re-hand-rolling the grammar this codebase consolidated into one composer, and typed envelopes are otherwise machinery (notify, file-drop, echo-commune) that is not peer chatter. THE ONE CASE WHERE IT BITES PEER TRAFFIC IS `restamp_wan_user_msg` IN THE WAN EDGE, named here exactly so a later wave can lift it without re-deriving which path is meant: a FORGED `user-msg` — one whose sender the daemon could not prove — is re-stamped into a typed plain-`msg` envelope, which then rides as a typed body and gets no attr. What is lost there is the MONIC RIDE, never the caution: the trust warning is composed at that same edge from the gate\'s verdict and is untouched by this leg, and an unprovable sender is warned about unsuppressibly in any case. Lifting the limit means re-composing the restamp through the owner-aware renderer, which requires threading the RECIPIENT into `restamp_*` — real work on adversarial-path code, deliberately not taken in this wave, and to be requested through the board rather than bled into a neighbouring change. A SENDER-SUPPLIED TYPED ENVELOPE CANNOT CLAIM THE RECEIVER\'S JUDGEMENT: every inbound `mnemonics-json` attribute is stripped at `receive_wan` before delivery, while the peer\'s body remains unchanged; the forged value is inert. Gate: impl — the one match primitive over the tracked root, the msg composer\'s extra-attribute form, the owner-aware renderers on both delivery edges, and every production render site converted to hand over its recipient; unit — a sender-matched monic rides as a JSON array carrying the record verbatim with `from` still first and BOTH edges composing identically, an unclassified sender and a mindless recipient get no attr at all, a husk rides nothing AND reads identically to the warning predicate over every state, a typed body carries no attr even when a monic matches, monic text full of envelope metacharacters cannot break out of the attr, and the attr survives the listener\'s chunk/reassemble round trip."\n3789:required_stages = ["doc", "impl", "unit"]  # impl+unit ACTIVATED milestone A W5 T8 (todlando build 2026-07-31). Both doyle rulings at the T8 design: Q1 sender-match-only for W5 (with the committed-additive trigger field folded into REQ-MONIC-STORE by replacement), Q2 evaluate at the emit renderers with ONE primitive and an authoritative call-site census before building. doc ACTIVATED at W5 T9 and RESTATED at LOCKSMITH tranche 1 (releases#70, 2026-08-03): the monics guide states the envelope attr, the present-iff-matched rule and the renderer-edge containment. The SENDER-MATCH LIMIT it previously stated as shipped behaviour is GONE, not merely amended — the trigger vocabulary was ratified at the LOCKSMITH grill, so what was the DESTINATION sentence in CONTEXT §mnemonics is now shipped: sender, content and json evaluate at this edge, while user_input and agent_output are ratified-INERT until milestone D. That inert/live split is now the thing a doc must state honestly, for exactly the reason the old limit had to be: a vocabulary entry read as working behaviour is the pasted-activation-claim class wearing the other face. The typed-envelope limit\'s restamp case is named in the requirement text itself (`restamp_wan_user_msg`) rather than in a guide, since a public guide is the wrong home for an internal symbol a future wave needs by name.\n3790:', 'details': {'diff': ' 3786|[[requirements]]\n 3787|id = "REQ-MONIC-DELIVERY-TRIGGER"\n-3788|title = "The monics a receiving agent holds that MATCH an arriving message RIDE THAT MESSAGE\'S ENVELOPE as a `mnemonics-json` attribute carrying a JSON array of the matched records, so the agent reads its own standing judgement about the sender in the same breath as the message rather than having to go and look it up. THE MATCH IS EVALUATED AT THE ENVELOPE RENDERERS, NOT AT THE WAN EDGE (ruled 2026-07-31): a classification that fires only when the peer happens to be REMOTE is one the agent cannot rely on, and the trust warning\'s edge is the wrong home for it because that edge exists to consume the ACCESS GATE\'s verdict — the two are different concerns that happen to read the same register. THERE IS EXACTLY ONE EVALUATION PRIMITIVE and every delivery surface calls it: a match rule copied per surface is a classification that fires on one channel and not another, which is worse than none because the agent cannot tell which it is looking at. The renderers therefore take the RECIPIENT\'s id as well as the structural sender/body pair, and NO OWNER-LESS RENDERER REMAINS — a renderer that did not need the recipient is the shape a future delivery surface reaches for by habit, arriving attr-less with nothing failing. THE ATTR IS PRESENT IF AND ONLY IF SOMETHING MATCHED: an empty array would say \'evaluated, no match\' where absence says \'not evaluated\', a distinction no consumer has a use for and a second shape every consumer would have to handle. THE TRIGGER VOCABULARY IS RATIFIED (operator ruling 2026-08-03, superseding W5\'s sender-match-only limit) AND IT BINDS BOTH CONSUMERS — this edge and the now-signal MONICS surface — precisely so that the second consumer adds a CONSUMER and never a record migration. Triggers are a JSON array of matchers over five kinds: `sender` (identity match on the PROVEN sender id, which is the trust warning\'s classification question and the only kind that answers it), `content` (the incoming message body), `json` (a custom payload), `user_input` and `agent_output`. MATCHING COPIES THE KEYWORD-HINTS RULE VERBATIM — a literal CASE-INSENSITIVE SUBSTRING by default, a REGEX when `regex` is set, and an INVALID REGEX NEVER MATCHES (a bad pattern silences its own trigger and never panics) — and it copies it BY CALLING IT: the rule lives in one place with two consumers, because a rule copied verbatim into a second place is two rules that merely agree today. Literal-by-default is what lets a trigger carry arbitrary symbols with no escaping burden. WHICH KINDS HAVE A LIVE CONSUMER IS A SEPARATE QUESTION FROM WHICH ARE RATIFIED: `sender`, `content` and `json` evaluate at this edge, which exists; `user_input` and `agent_output` are RATIFIED BUT INERT until the now-signal / IO-parser funnel is built, and a record carrying one is not malformed — it is waiting for its consumer. Reading \'ratified\' as \'has a live consumer\' is the error this clause exists to prevent, and any surface that lists a trigger must say which it is looking at. THE TWO EDGE QUESTIONS ARE DELIBERATELY ASYMMETRIC AFTER THE RE-KEY: a content-triggered monic rides a message it matched WITHOUT classifying its sender, because classification is a `sender` question — so the delivery attr can be present where the trust warning still treats the peer as a stranger. The direction that must hold is the one that protects the agent: anything that classifies the sender ALSO matches the delivery, so an agent is never warned about a stranger whose monic it was handed in the same envelope. The ARRAY shape is not premature generality but the ratified envelope contract, and it is what lets a trigger kind matching several records ride with no envelope change. THE READ IS STORE-FREE AND PURE-PATH, off the tracked root, for the reason the trust warning\'s is: it happens on the inbound message path, where the store\'s ensure-worktree spawns git per message. A RECIPIENT WITH NO MIND — a shell link, an agent that has classified nobody — READS NOTHING AND GETS NO ATTR, and that is the primitive telling the truth rather than a case to special-case; it costs one sentence in the module doc, not a branch. An UNREADABLE record rides nothing, the same fail-safe reading the trust warning takes, and the two consumers are asserted to agree over every state a record can be in — an agent must never be warned about a stranger whose monic it was handed in the same envelope. The attr KEY is a compile-time constant and its VALUE is attr-escaped by the one composer, so monic text carrying quotes or angle brackets cannot forge an attribute or terminate the envelope. STATED LIMIT, NAMING ITS ONE PEER-TRAFFIC CASE: a body that is ALREADY a typed envelope passes through verbatim and carries no attr — splicing an attribute into a finished envelope means re-hand-rolling the grammar this codebase consolidated into one composer, and typed envelopes are otherwise machinery (notify, file-drop, echo-commune) that is not peer chatter. THE ONE CASE WHERE IT BITES PEER TRAFFIC IS `restamp_wan_user_msg` IN THE WAN EDGE, named here exactly so a later wave can lift it without re-deriving which path is meant: a FORGED `user-msg` — one whose sender the daemon could not prove — is re-stamped into a typed plain-`msg` envelope, which then rides as a typed body and gets no attr. What is lost there is the MONIC RIDE, never the caution: the trust warning is composed at that same edge from the gate\'s verdict and is untouched by this leg, and an unprovable sender is warned about unsuppressibly in any case. Lifting the limit means re-composing the restamp through the owner-aware renderer, which requires threading the RECIPIENT into `restamp_*` — real work on adversarial-path code, deliberately not taken in this wave, and to be requested through the board rather than bled into a neighbouring change. Gate: impl — the one match primitive over the tracked root, the msg composer\'s extra-attribute form, the owner-aware renderers on both delivery edges, and every production render site converted to hand over its recipient; unit — a sender-matched monic rides as a JSON array carrying the record verbatim with `from` still first and BOTH edges composing identically, an unclassified sender and a mindless recipient get no attr at all, a husk rides nothing AND reads identically to the warning predicate over every state, a typed body carries no attr even when a monic matches, monic text full of envelope metacharacters cannot break out of the attr, and the attr survives the listener\'s chunk/reassemble round trip."\n+3788|title = "The monics a receiving agent holds that MATCH an arriving message RIDE THAT MESSAGE\'S ENVELOPE as a `mnemonics-json` attribute carrying a JSON array of the matched records, so the agent reads its own standing judgement about the sender in the same breath as the message rather than having to go and look it up. THE MATCH IS EVALUATED AT THE ENVELOPE RENDERERS, NOT AT THE WAN EDGE (ruled 2026-07-31): a classification that fires only when the peer happens to be REMOTE is one the agent cannot rely on, and the trust warning\'s edge is the wrong home for it because that edge exists to consume the ACCESS GATE\'s verdict — the two are different concerns that happen to read the same register. THERE IS EXACTLY ONE EVALUATION PRIMITIVE and every delivery surface calls it: a match rule copied per surface is a classification that fires on one channel and not another, which is worse than none because the agent cannot tell which it is looking at. The renderers therefore take the RECIPIENT\'s id as well as the structural sender/body pair, and NO OWNER-LESS RENDERER REMAINS — a renderer that did not need the recipient is the shape a future delivery surface reaches for by habit, arriving attr-less with nothing failing. THE ATTR IS PRESENT IF AND ONLY IF SOMETHING MATCHED: an empty array would say \'evaluated, no match\' where absence says \'not evaluated\', a distinction no consumer has a use for and a second shape every consumer would have to handle. THE TRIGGER VOCABULARY IS RATIFIED (operator ruling 2026-08-03, superseding W5\'s sender-match-only limit) AND IT BINDS BOTH CONSUMERS — this edge and the now-signal MONICS surface — precisely so that the second consumer adds a CONSUMER and never a record migration. Triggers are a JSON array of matchers over five kinds: `sender` (identity match on the PROVEN sender id, which is the trust warning\'s classification question and the only kind that answers it), `content` (the incoming message body), `json` (a custom payload), `user_input` and `agent_output`. MATCHING COPIES THE KEYWORD-HINTS RULE VERBATIM — a literal CASE-INSENSITIVE SUBSTRING by default, a REGEX when `regex` is set, and an INVALID REGEX NEVER MATCHES (a bad pattern silences its own trigger and never panics) — and it copies it BY CALLING IT: the rule lives in one place with two consumers, because a rule copied verbatim into a second place is two rules that merely agree today. Literal-by-default is what lets a trigger carry arbitrary symbols with no escaping burden. WHICH KINDS HAVE A LIVE CONSUMER IS A SEPARATE QUESTION FROM WHICH ARE RATIFIED: `sender`, `content` and `json` evaluate at this edge, which exists; `user_input` and `agent_output` are RATIFIED BUT INERT until the now-signal / IO-parser funnel is built, and a record carrying one is not malformed — it is waiting for its consumer. Reading \'ratified\' as \'has a live consumer\' is the error this clause exists to prevent, and any surface that lists a trigger must say which it is looking at. THE TWO EDGE QUESTIONS ARE DELIBERATELY ASYMMETRIC AFTER THE RE-KEY: a content-triggered monic rides a message it matched WITHOUT classifying its sender, because classification is a `sender` question — so the delivery attr can be present where the trust warning still treats the peer as a stranger. The direction that must hold is the one that protects the agent: anything that classifies the sender ALSO matches the delivery, so an agent is never warned about a stranger whose monic it was handed in the same envelope. The ARRAY shape is not premature generality but the ratified envelope contract, and it is what lets a trigger kind matching several records ride with no envelope change. THE READ IS STORE-FREE AND PURE-PATH, off the tracked root, for the reason the trust warning\'s is: it happens on the inbound message path, where the store\'s ensure-worktree spawns git per message. A RECIPIENT WITH NO MIND — a shell link, an agent that has classified nobody — READS NOTHING AND GETS NO ATTR, and that is the primitive telling the truth rather than a case to special-case; it costs one sentence in the module doc, not a branch. An UNREADABLE record rides nothing, the same fail-safe reading the trust warning takes, and the two consumers are asserted to agree over every state a record can be in — an agent must never be warned about a stranger whose monic it was handed in the same envelope. The attr KEY is a compile-time constant and its VALUE is attr-escaped by the one composer, so monic text carrying quotes or angle brackets cannot forge an attribute or terminate the envelope. STATED LIMIT, NAMING ITS ONE PEER-TRAFFIC CASE: a body that is ALREADY a typed envelope passes through verbatim and carries no attr — splicing an attribute into a finished envelope means re-hand-rolling the grammar this codebase consolidated into one composer, and typed envelopes are otherwise machinery (notify, file-drop, echo-commune) that is not peer chatter. THE ONE CASE WHERE IT BITES PEER TRAFFIC IS `restamp_wan_user_msg` IN THE WAN EDGE, named here exactly so a later wave can lift it without re-deriving which path is meant: a FORGED `user-msg` — one whose sender the daemon could not prove — is re-stamped into a typed plain-`msg` envelope, which then rides as a typed body and gets no attr. What is lost there is the MONIC RIDE, never the caution: the trust warning is composed at that same edge from the gate\'s verdict and is untouched by this leg, and an unprovable sender is warned about unsuppressibly in any case. Lifting the limit means re-composing the restamp through the owner-aware renderer, which requires threading the RECIPIENT into `restamp_*` — real work on adversarial-path code, deliberately not taken in this wave, and to be requested through the board rather than bled into a neighbouring change. A SENDER-SUPPLIED TYPED ENVELOPE CANNOT CLAIM THE RECEIVER\'S JUDGEMENT: every inbound `mnemonics-json` attribute is stripped at `receive_wan` before delivery, while the peer\'s body remains unchanged; the forged value is inert. Gate: impl — the one match primitive over the tracked root, the msg composer\'s extra-attribute form, the owner-aware renderers on both delivery edges, and every production render site converted to hand over its recipient; unit — a sender-matched monic rides as a JSON array carrying the record verbatim with `from` still first and BOTH edges composing identically, an unclassified sender and a mindless recipient get no attr at all, a husk rides nothing AND reads identically to the warning predicate over every state, a typed body carries no attr even when a monic matches, monic text full of envelope metacharacters cannot break out of the attr, and the attr survives the listener\'s chunk/reassemble round trip."\n 3789|required_stages = ["doc", "impl", "unit"]  # impl+unit ACTIVATED milestone A W5 T8 (todlando build 2026-07-31). Both doyle rulings at the T8 design: Q1 sender-match-only for W5 (with the committed-additive trigger field folded into REQ-MONIC-STORE by replacement), Q2 evaluate at the emit renderers with ONE primitive and an authoritative call-site census before building. doc ACTIVATED at W5 T9 and RESTATED at LOCKSMITH tranche 1 (releases#70, 2026-08-03): the monics guide states the envelope attr, the present-iff-matched rule and the renderer-edge containment. The SENDER-MATCH LIMIT it previously stated as shipped behaviour is GONE, not merely amended — the trigger vocabulary was ratified at the LOCKSMITH grill, so what was the DESTINATION sentence in CONTEXT §mnemonics is now shipped: sender, content and json evaluate at this edge, while user_input and agent_output are ratified-INERT until milestone D. That inert/live split is now the thing a doc must state honestly, for exactly the reason the old limit had to be: a vocabulary entry read as working behaviour is the pasted-activation-claim class wearing the other face. The typed-envelope limit\'s restamp case is named in the requirement text itself (`restamp_wan_user_msg`) rather than in a guide, since a public guide is the wrong home for an internal symbol a future wave needs by name.\n 3790|', 'firstChangedLine': 3788, 'op': 'update', 'path': '.worktrees/202-mnemonics-forgery-unit/traceable-reqs.toml', 'snapshotsPruned': True}}