=== RELEASE-INDEX > RELEASE sub-index — split out of MEMORY.md 2026-08-04 against the read-limit cliff (index was > 23926B against a 24986B limit, ~1KB margin; the tail drops SILENTLY, and this file's own record > shows that recurring once already when sessions kept appending). Entries below are VERBATIM from > the index, ZERO pointers dropped — this is a move, not a compaction. The 17.1KB nag stays refused > per the ⛔ ruling in [two-memory-roots-diverged](two-memory-roots-diverged.md); splitting a > consult-class section is the FOURTH lever that ruling names, and Release was the candidate it > named next. Read this when working a release, a tag window, or a milestone close. ## Release - [milestones skip WIP: GREENLIT goes straight to ACCEPTANCE](milestones-skip-wip-greenlit-goes-straight-to-acceptance.md) doyle 2026-09-09 from LABEL TIMELINES (#272, #23): a milestone reading `state: greenlit` late in its build is CORRECT; `type:` stays unset (request-level); prose saying "this comment is the flag" made no label. AGENTS.md's WIP chain is the REQUEST chain. - [a step that STRADDLES an irreversible action reads as done AT the action](a-step-that-straddles-an-irreversible-action-reads-as-done-at-the-action.md) x2 v0.67.0: drove step 6's pre-publish cascade, published, verified publish, STOPPED — the post-publish `release` verb (DONE promotion + roundup) never ran, #23 + 8 members sat CLOSED-but-ACCEPTANCE ~50min, card empty, OPERATOR caught it. Every check I had passes with the board unfinished (they measure the ARTIFACT; the miss is on the BOARD) and I reported the arc closed. The verb WAS documented — measuring the file refuted the "doc gap" framing I was handed, so the fix was SHAPE not addition. Split straddling steps into two ticks; re-read from the top after the big event. - [release-verb grace vs hub-card strict window](release-verb-grace-vs-hub-card-window.md) ⭐ post-publish cascade = board card off-by-one (GitHub right, display wrong; never repair states); fix = spt-progress-tool#78 - [greenlit form = the DELTA SEQUENCE](greenlit-form-is-the-delta-sequence-not-its-head.md) ⭐⭐ STANDING intake rule (doyle 2026-08-21): fold ALL deltas in order before comparing head to greenlit form — #212 delta 1 said "no member added/dropped/relocated" (true when written), delta 2 CUT #153 and minted #213 into its slot. First-alone refuses a good head; latest-alone loses the baseline. Cite the pair you folded. - [ledger](v0121-published.md) — latest **v0.68.0 c104 @`a2f335f8`** (2026-09-09T09:36:41Z, WEBSERVE #272 + 4 merge-closed riders #276/#277/#279/#280, 13 DONE; tag==main==golden-tested sha; golden 34322232036 9/9 att1 at r4 after r1/r2 reds closed at mechanism, r3 att1 ledgered teardown-LEAK + att2 killed by the 50-min job WALL (rider 6 = CI-only 50->80/25->40 on parent f6110c2a); Windows test 54m35s, docs-drift step EARNED first time after six skips; measured: a green Windows job costs MORE wall than a red one, so every earlier drift skip flattered the budget; record GATE-W2-272-CHECKLIST.md at repo root). Prior **v0.67.1 c103 @`04e32c8c`** (2026-09-06, docs PATCH #274, [arc](v0671-arc-service-docs.md)); **v0.67.0 c102 @`da71b785`** (2026-08-30, NOW-SIGNAL #23, [arc](v0670-arc-in-flight.md)); **v0.66.0 c101 @`d931dd63`** (2026-08-30, SEMAPHORE #242, [arc](v0660-arc-in-flight.md)); **v0.65.0 c100 @`4d6007ac`** (2026-08-29, CONDUIT #236, [arc](v0650-arc-in-flight.md)) -- these four were MISSING from this ledger line until 2026-09-09 (measured: zero v0.65-v0.67 mentions in the file). Prior **v0.64.0 c99 @`ba36f221`** (2026-08-28 ~09:20Z, IO-PARSER #22, [note](v0640-arc-io-parser.md); members #12/#226/#233, zero dropped/added, board DONE all four. tag==main==golden-tested sha `ba36f221` (deployah's shape commit was the tip — the head arrived a version behind and was shaped BEFORE the golden, so no provability-bar route needed; respins would have rebased onto the shape commit). Golden 33149474948 GREEN at attempt 2: attempt-1's two Windows reds were DISK-FLOOR refusals with checkout SKIPPED (diff never on box; 7.1 GB vs 32 GiB floor, cleared by two classified target reaps totalling ~101 GB), same-sha partial rerun both green end-to-end, twohost passing the identical floor step = positive control. Six lanes (W1-W5 + docs, PRs #162-#167) + two hertz riders (#161 IR-66, #168 reap-carrier) rode ONE assembly merge — the wave stack was linear, all six gated individually pre-assembly, zero golden respins. POST-PUBLISH CONTRADICTION referred by deployah and ruled test-side: thin ci.yml Windows unit red at the SAME sha (servicehost orphan-reap cell, KillFailed(pid) at the 2s awaits_death budget, 3.649s at-budget vs golden's 0.106s, ran in the release build's tail) — product treats KillFailed as RETRYABLE (record kept for next sweep) while the test demands first-sweep Killed, so the cell binds tighter than its contract; hertz rider dispatched. main advanced ONE docs commit past the tag (91638eda register sweep) — expected post-tag gap, ancestry green.) Prior **v0.63.0 c98 @`dbe3daad`** (2026-08-26T01:35:09Z, FIELD-SEAL #225, [note](v0630-arc-in-flight.md); 8 members, zero dropped/added. **THREE respins, all the SAME Linux/kitsubito Phase B leg, THREE DIFFERENT victims, each run’s prior victim recovering — the RANDOM-VICTIM family (IR-30’s signature, Linux face). r2 and r3 were the SAME SHA, which is the arithmetic that exonerates the tree: a tree defect does not migrate between cells across re-runs of one commit.** All three victims were TEST defects, product never implicated: r1 `input_ack_deadlock` (real, latent since v0.61.0 `53be5270` — see [[a-tests-banner-can-go-stale-against-its-own-assert]]), r2 `er_brief` (declared PRECONDITION, proves nothing when it trips), r3 `resume` spawn-first-chunk needle (0.824s cell dying at 62.7s). ESCALATED to the operator after r3 on doyle’s own pre-commitment (option A, root-side audit); mechanism = kernel audit backlog bursts from 14:00Z with default `audit_backlog_wait_time` **60s**, matching the 59.4/62.7s deaths — a WINDOW-STRETCHER that made an existing spawn-race reachable, NOT the fault. Discriminating evidence was a same-box same-window pair 5 min apart: light `unit` leg GREEN vs heavy SERIALIZED Phase B RED — see [[presence-under-both-outcomes-refutes-the-argument-not-the-cause]]. **tag==main==golden-tested sha**, shape-on-top surviving THREE respins (fixups landed ON TOP of the version material, so zero re-shape and no provability bar ever applied). ⭐⭐ **THE PUBLISH FAILED WHILE THE HARNESS REPORTED SUCCESS**: the background-task notification said "exit code 0", the leg’s own exit FILE said **101**. Writing the leg exit to a file is what stood between me and announcing a release that was still a draft — read the FILE, never the wrapper/notification. ⚠ The failure was `SPT_POOL_FOREIGN`: main `target/` still carried POOL-OWNER.json naming the VANISHED `.worktrees/assembly-signet-218` (the v0.62.0 lane). Nothing was signed/flipped — draft verified intact first. Takeover justified on all THREE arms the rule names (worktree vanished + branch `feb4049a` an ancestor of origin/main + no lane claimed), claimed with the hatch the build script itself prescribes, released after. ⚠ **A CACHED BUILD SCRIPT REPLAYS ITS STORED WARNING**: the SUCCESSFUL publish build still printed the `SPT_POOL_UNCHECKED` override text naming the old worktree, in an 0.85s run where build.rs never re-ran and the flag was NOT set — a future reader grepping that log will see an override warning on the shipped commit and be wrong about it. Post-publish board close is DRIVEN not swept: `state acceptance` before publish, then `release v0.X.Y`; the state verb needs the **`#N`** ref form — bare `225` errors, and the SHELL_SPOOLED receipt returns exit 0 REGARDLESS, so verify the BOARD, never the spool. RE-HIT deployah 2026-09-09 #272 v0.68.0: bare `272` spooled exit 0, async 'bad ref' seconds later; rule was in this line and was repeated anyway -- it belongs in the cascade's command text, not here.) Prior **v0.62.0 c97 @`12ab4a7a`** (2026-08-25T02:24:31Z, SIGNET #218, [note](v0620-arc-in-flight.md); ONE respin over a Linux-only clippy dead-const; **tag==main==golden-tested sha**, the second cut running the shape-on-top form and the first where it survived a RESPIN — the fix landed on top of the version material, so no re-shape. ⭐⭐ **HOLD A RED GOLDEN RUN TO COMPLETION**: twohost is `needs: test` + `!cancelled()`, so the pre-declared never-executed S1e rung climbed and PASSED at the RED sha and that evidence transferred to the respin. Respin fired on a **FRESH ref** `golden/signet-218-r2` — golden's concurrency keys on `github.ref` with `cancel-in-progress: false`, so reusing the old ref queues behind the dead run's group and misattributes the respin later. Uncovered-by-name: Dormancy steps 38/39/40 ran in NEITHER run on EITHER OS, proven condition-derived by the r1 Windows leg being green and skipping them anyway.) Prior **v0.61.0 c96 @`618a35dc`** ([note](v0610-arc-in-flight.md) — WAX-SEAL #21). Prior **v0.60.0 c95 @`517c9f6f`** ([note](v0600-published.md) — TURNKEY #212, 2 respins, both reds ruled test-side; acceptance cascade verified on all 12 members). Prior **v0.59.0 c94 @`c62904e7`** (2026-08-21 13:44:01Z, PORTER #205, eight BUILT members + #187 fulfilled pre-milestone by `e8a35829`; riders IR-53 + IR-50-close; #199 shipped INSTRUMENT-ONLY, accepted-with-number, closed at `state: ACCEPTANCE` by the ADR-0004 cascade and gets NO DONE at roundup). ✅ **THE UNSHAPED-HEAD RECURRENCE IS CLOSED — BY CONSTRUCTION, NOT DISCIPLINE:** I authored the version material ON TOP of doyle's head `e702d4b7` and pushed THAT as the golden ref, so **ruled sha == main tip == golden ref == tag**, one object with four names, and nothing had to be argued inert. See [shape-the-head-before-golden](shape-the-head-before-golden.md) — doyle adopted the matching assembly-intake question the same day, so the role seam is covered from both sides. Golden 32482048369 GREEN first attempt, nine jobs, both twohost legs. Evidence standard held: new cells cited by per-HOST occurrence (2x = two hosts, NOT the nextest live/summary duplicate — check which before reading it as coverage), armed verifier by DURATION (2.78s vs v0.59.0 post-publish). ⚠ **THE THIRD-PARTY VERSION COLLISION IS LIVE AGAIN**: `windows-sys` sits at 0.59.0, so counting `version = "0.59.0"` in Cargo.lock returns 15 against a first-party 14 and the extra row is REAL — the third instance after quick-xml@v0.39.4 and aws-lc-sys@v0.41.0. Verify by DIFF; it cost nothing here. Also measured: `xtask gen` rewrote `docs-site/src/cli/reference.md` and git called it modified while the `--ignore-cr-at-eol` diff was EMPTY (autocrlf) — reverted, not committed. Lockfile refreshed with `cargo update --workspace --offline` where step 1 names `cargo metadata --offline`; doyle RULED the property (workspace members only, third-party untouched, proven by diff) is the rule and the command a vehicle, and is amending the runbook. Prior **v0.58.0 c93 @`b88fab2a`** (2026-08-20 19:22:01Z, CONCIERGE #183, ten members + #171 CUT; board 11 DONE incl. the #203 rider). **tag sha ≠ golden sha AGAIN** — golden tested `4661bc9d` carrying 0.57.0 and a `## [0.57.0]` section (the ALREADY-SHIPPED cut), so the bump rode the tested head via the PROVABILITY-BAR route; that is now **4 of the last 5 cuts**, so treat the unshaped head as the norm and the two-command check as mandatory. Intake REFUSED TWO HEADS before running: `c0878cbd` (greenlit member #177 had no build AND no disposition record, and the head PINNED the behaviour #177 asks to change; declared rider 4 absent from the chain) and `24edc166` (golden RED, one cell). Respin `4661bc9d` green, nine jobs, first attempt. The red exposed **releases#203**, a LATENT defect (ticket matched before the seated-controller re-serve exemption) proven latent by a byte-identical call site at main — respin anyway, because Q1 classifies by where the defect LIVES, never by who introduced it. ⚠ **A RIDER IS STRUCTURALLY INVISIBLE TO THE `release` VERB** — see [rider-open-at-publish-is-invisible-to-release-verb](rider-open-at-publish-is-invisible-to-release-verb.md). Evidence standard set this cut: cite the armed anchor row **by DURATION at both ends** (1.48s vs v0.57.0 for the bar, 1.11s vs v0.58.0 after publish). Prior **v0.57.0 c92 @`a0f9ecd`** (2026-08-19 20:22Z, KEYSTONE #182, ten members; roundup credited 11 incl. #182). ⚠ **tag sha ≠ golden sha, by ruling:** golden tested `901a9f5`, which was NOT release-shaped (version 0.56.0, no `## [0.57.0]`) — the bump `a0f9ecd` rode the tested head via the PROVABILITY-BAR route and the record is #182 comment `5347277294`. **Measured: the bump rode inside the golden candidate in only 1 of the last 4 cuts**, so expect an unshaped head and check it with two commands (`git show :Cargo.toml`, `git show :CHANGELOG.md`) — no other intake leg implies it. OPEN from this cut: thin-red specimen `rc::attach_viewport_reconnects_across_a_broker_bounce` assertion@33.65s @`9ea595c` (one failing obs, golden-green sha, hertz RCA + FLAKE-LEDGER extension on its own NEW signature — the ledgered 240s-starvation entry does NOT cover it). Also this cut: a post-golden bump makes any HELD sibling stack un-ff-able — when peer lanes base on the held shas, NEVER rebase; the stack rides the NEXT golden chain verbatim (register stack, this cut; how-to arm in [ff-only-absorbs-one-sibling-lane](ff-only-absorbs-one-sibling-lane.md)). Prior **v0.56.0 c91 @`60d74ea`** (2026-08-19 04:06Z, NAMEPLATE #181, six members; tag == golden-tested sha, run 32209922535, main ff'd 27d40b9..60d74ea; one respin — first golden red on two first-ever-executed TEST cells, both ruled rig defects, product clean; respin head = hertz's 62b16af+eb95634 gated by doyle). ⚠ next cutter: under golden CI **alchemy sweep finds NOTHING to reconcile** (no per-request merge-closes to key on) — close-cascade MUST come from `state acceptance` BEFORE publish (release verb gates closedAt < publishedAt); sweep-only drivers publish past open requests (deployah, this cut). Prior: v0.55.0 c90 (sha not carried here — re-derive), then v0.54.0 c89 @`86f0d84` (2026-08-04, USHER pulled forward, PROVABILITY-BAR route; the `SPT_RELEASE_E2E` vacuous-green and disk-guard labelled-hole caveats live in that entry's file), then v0.53.0 c88 @`b7b00c3`. Re-derive via `gh release list --repo BigscreenVR/spt-bs-releases`. - [v0.52.0](v0520-published.md) five uncancelled reds, tagged≠tested · [v0.51.0](v0510-published.md) `acceptance` cascades, `done` never · [v0.50.0](v0500-published.md) cross-repo never auto-close · [v0.49.0](v0490-published.md) bump-in-PR refusal · [v0.47.0](v0470-published.md) thin-red vs golden-green = stop-and-refer · [v0.46.0](v0460-published.md). - [hold pushes in the tag window](hold-pushes-during-the-tag-window.md) ⭐⭐ runbook tags BARE HEAD; a docs commit is enough to point the tag at an untested sha. Gater holds the whole merge queue golden-green → tag. - [a rider is INVISIBLE to the release verb](rider-open-at-publish-is-invisible-to-release-verb.md) ⭐⭐ `release ` gates on closedAt < publishedAt, and a rider is OPEN at publish BY DESIGN, so the verb silently under-credits: v0.58.0 promoted 11 and missed #203, the fix its own respin was built to carry. Nothing errors; the roundup looks complete. Reconcile the promoted count against **members + riders**, and close each rider on its own record with the ship-fact — never by re-dating or toggling the draft. Inverse face of the entry below (board credited a rider the NOTES dropped; here the notes were right and the BOARD dropped it). - [board credits a rider the notes drop](board-credits-a-rider-the-notes-drop.md) ⭐⭐ notes read from the MILESTONE miss wave-gap riders the release verb still credits publicly — two published surfaces disagree; repair is docs-only POST-publish (append to the published body verbatim), never a retag, never a draft toggle. - [standard](release-standard-bump-in-pr.md) ⚖ tested==shipped OUTRANKS bump-in-PR · [counter](release-counter-from-published.md) · [changelog scope](changelog-scope-vs-commit-range.md) · [end-user voice](release-notes-enduser-voice.md) · [--repo required](release-queries-need-repo-flag.md) empty at EXIT 0 on the wrong repo. - [parity has LEVELS; membership goes blind on SHARED files](parity-membership-level-goes-blind-on-shared-files.md) ⭐⭐ membership-level parity (right lanes ride, none dropped) CANNOT see a lane whose content was mangled in the merge or shaped out after. The blind spot is the files more than one WRITER touches, and THE RELEASE DRIVER IS A WRITER: a lane's own files arrive intact or loudly not at all ONLY while the shaping delta is measured to stay off them — shaping edits the head after sign-off, with no merge and no conflict to make noise. Compute the multi-writer list from the DIFF AT THE SHA, never from what lanes were supposed to touch (deployah's correction of my overstated first draft). CONDUIT 2026-08-28, shaped head `110d1751`: 11/13 W3 files byte-identical, the 2 that differed were CONTEXT.md + traceable-reqs.toml, read verbatim and intact — and that number was evidence about the SHAPER's delta too (measured: CHANGELOG.md + Cargo.lock + Cargo.toml, ZERO .rs), so measure the shape before reading the number. Check the LAST-LANDED change by name first — shortest life in the tree, most chances to be lost. Run the content leg on your OWN lane and report it as an independent confirmation naming the level, never a restatement of the peer's. - [partial milestone = REJECTED alternative](partial-milestone-golden-is-rejected-alternative.md) ⭐⭐ "tranche" renames eject-and-proceed; parity from `sub_issues`, FULFILMENT not presence. - [co-author trailer loss](co-author-trailer-attribution-loss.md) ⚠ escaped-vs-real BYTES; fix the BUILDER · [golden respin](golden-respin-test.md) · [wave-gap riders](wave-gap-fixes-in-milestone.md) · [scope-strip](milestone-scope-strip-protocol.md) · [seed machine-env](release-seed-machine-env-ruling.md) · [roundup ordering](release-roundup-ordering.md) · [branch off current main](branch-fixes-off-current-main.md) · [updateset stale window](release-updateset-stale-window.md) · [update-apply message](update-apply-confident-message.md). - [docs-drift gate](cli-command-docs-drift.md) · [version not milestone](public-docs-version-not-milestone.md) · [docs surface = installed vintage](docs-surface-is-installed-daemon-vintage.md) ⭐ :5474 is the DAEMON; zero-match there claims a VERSION, check before ruling a gap · [ff-only absorbs ONE lane](ff-only-absorbs-one-sibling-lane.md) ⭐ 4th face 2026-09-06: two GREEN sibling PRs — land the EXPENSIVE-rerun one first, hold the 30s docs one; run `--is-ancestor origin/main ` before ever saying "no rebase needed" · [resolve toward SHARED body](resolve-wrapper-conflict-toward-shared-body.md) · [pin stable asset](pin-a-stable-asset-not-a-rolling-tag.md) · [real cross-platform verify is POST-publish](v032-platform-safe-update.md) · [golden CI strategy](golden-ci-strategy.md) ADR-0050. - [v0.67.1 / SERVICE-DOCS patch](v0671-arc-service-docs.md) ⭐ **LATEST PUBLISHED: v0.67.1, counter 103, 2026-09-06T11:30:58Z, tag==main==tested `04e32c8c`, 11 assets verified at source.** Docs-only patch, operator-directed batch of one (no milestone), #274 DONE via release verb. Six golden attempts across two shas — r1 Linux light-pool starvation of an un-swept HEAVY flood rig (reclass respin, discriminator confirmed by prediction both OS), then three DIFFERENT Windows Phase A victims one per attempt (:473 structural barrier, wtlock at-budget under a peer’s unheld workspace nextest, :664 ledger row 42 third hit); gater overrode his own stop-arm on the record with a hard stop for att4; att4 9/9. twohost green 6/6. ~5.5h push→publish. - [v0.66.0 / SEMAPHORE arc](v0660-arc-in-flight.md) ⭐⭐ **LATEST PUBLISHED: v0.66.0, counter 101, 2026-08-30T01:42Z, tag==main==tested `d931dd63`, publish verified at source (Latest flipped, 11 assets, counter re-decoded live).** Four golden attempts, every red closed at NAMED mechanism, zero by rerun: r2/r3 floor red = deterministic adjacency (reclaim is checkout's own `git clean -ffdx`; floor moved AFTER checkout, ac7d2609); Linux 4-cell red = `current_exe_hash()` ~10.1s/boot ON the ready path (debug sha2 × 440MB binary; BRAIN_PHASE breadcrumbs + tempdir harvest-loop repro named it in one grep; budgets 30→120s field-validated — all four cells passed ABOVE the old budget); r4 LNK1318 = disk low-water at the job's LAST heavy step, confirmed PREDICTIVELY by reclaim (65.1GiB→died / 85.85GB→success, only variable the reclaim; incremental candidate retired by its own preservation snapshot). 9/9 at ONE sha across two attempts, stated plainly. ir57 near-miss: reap identity = the checked-out REF, never the directory name (203GB live lane saved). Follow-ons ride RCA-242-R2-LINUX.md riders + sweep draft; 24-site ready-wait population → hertz. - [v0.65.0 / CONDUIT arc](v0650-arc-in-flight.md) ⭐⭐ **v0.65.0, counter 100, 2026-08-29, tag==main==tested `4d6007ac`.** **A full golden GREEN was discarded on purpose** (`110d1751`, run 33223968222 a3) — `io-events` could never return COMMUNE/COMMUNE_FAIL while four landed surfaces said all six kinds were visible; the no-ship ruling was written on the board WHILE that run was still in flight and its verdict unknown, throw-away-a-green clause included. ⭐⭐ **There is no cheap middle: the docs-drift gate reads the gated docs, so a docs-only softening is Q1-YES under the respin test exactly as a code fix is** — identical window cost, so keep the promise rather than narrow it. CHECK THIS before assuming a docs-only escape hatch exists. ⭐⭐ **Pool ratio: reaped 140.51 GB, a fresh full rebuild of the same tree is 7.78 GB ⇒ ~18× accumulation across a milestone's sequential lane-sharing** — that ratio is what predicts the next box's free-space floor red; "the disk filled up" does not. Respin intake gained a leg: prove the DISCARDED head is not an ancestor (it would carry the bump forward and pass every other leg, shape leg included). - [a release-note baseline is the LAST RELEASE, not the lane's previous commit](a-release-note-baseline-is-the-last-release-not-the-lanes-previous-commit.md) ⭐⭐ 2026-09-09 v0.69.0 #287: diffed a respin against the lane's PREVIOUS COMMIT and proposed "Previously the close could fail..." for an abort that was INTRODUCED AND FIXED INSIDE THE UNRELEASED LANE — a phantom regression the product never had. Every other gate check is sha-to-sha, which is the habit that misfires here. ⚠ MY OWN PROOF RULE WAS WRONG TWICE (hertz, minutes later): symbol-absent does NOT prove behaviour-absent (it can live under another name or inline), and I grepped de5a44bc — the LANE BASE — not the last released object a2f335f8. Compare BEHAVIOUR at the released sha; a grep miss raises a question, never settles one. What settled it was the BUILDER's provenance. === GATE-TEST-INDEX > GATE & TEST CRAFT sub-index — split out of MEMORY.md 2026-08-04 against the read-limit cliff > (MEMORY.md was 23.3KB against a 24.4KB limit; past it the TAIL IS SILENTLY DROPPED). Entries > below are VERBATIM, in original order, ZERO dropped — this was a move, not a compaction. > Read this BEFORE authoring, changing, or running any gate/test/rig: rig construction, gate > population, filters that read as absent, nextest/cargo traps, shell-pipe verdict traps, > two-daemon rigs, gh/CI polling. MEMORY.md = rules you obey; this = craft you apply. ## Gate & test craft - [telemetry that fires only on FAILURE cannot witness a success](telemetry-that-fires-only-on-failure-cannot-witness-a-success.md) ⭐ 2026-09-09 #272 a4 double-serve triage: DISPATCH_EV fires only on non-Served outcomes, so B’s log had grep -c = 0 and the dispatcher generation was unrecorded on the exact path that ran. Second half: a claim mutex is ONE map per PROCESS (spawn-once-per-process), so “impossible within the loop” is not “impossible” — name the lock’s scope (thread/process/node) and ask what a second instance of it does. Say the gap as its own point. - [a widened wall-clock margin is a longer COIN](a-widened-wall-clock-margin-is-a-longer-coin.md) 2026-09-08 golden r2 a2, the only red in 234: an arm mints --ttl 5s and asserts presence against a reaper ticking every 5s; the send SUCCEEDED (ATTACHED ... ttl 5000ms in its own stderr), the entry was reaped before the read. Its own comment narrates the SAME red at 1s and bumps to 5s on "five seconds cannot expire" — a comment that narrates an earlier flake and a bumped constant is a STANDING BUG REPORT. Widening changes the ODDS, not the SHAPE: take the value from the op's own output, or force the sweep (backdate registered_at_ms). - [editing a script under a RUNNING bash mangles the live run into vacuous greens](editing-a-script-under-a-running-bash-mangles-the-live-run-into-vacuous-greens.md) ⭐⭐ todlando 2026-09-07 F17: bash reads by byte OFFSET; my arm-D rewrite of twohost-web-xbox.sh landed 2 min into HIS run out of MY gate tree → env prefix read mid-line → nextest launched without SPT_TWO_HOST → five 0.0x s PASSes, zero WEB_SERVE_FOR; invisible (no syntax error), and the editor has no signal anyone executes from the tree. Launcher FREEZES driver + every called script to `.spt/frozen//` and runs the copy; check script mtime vs the run window before bisecting env. - [uniform 0.00 s PASS incl. the must-skip cell = env never reached the child](uniform-zero-second-pass-including-the-must-skip-cell-is-env-that-never-reached-the-child.md) ⭐⭐ todlando 2026-09-07 F17: all FIVE role-A cells PASS in 0.00 s, role_b (must skip on A) indistinguishable from the rest = SPT_TWO_HOST never reached the child; Summary==1 necessary, never sufficient. Read the must-skip cell, the elapsed of the must-run cells, and the OWNER-side breadcrumb count (`WEB_SERVE_FOR`=0 in b.raw was decisive); put all three in the driver's pair readout. - [a source read cannot WITNESS an integration cell](a-source-read-cannot-witness-an-integration-cell.md) ⭐⭐ 2026-09-07 F17: the W2 helper cell had NEVER executed green (owner's dispatcher dropped its opening line) while checklist rows read "F1 PASS" from SOURCE READS. An INT cell's source is ONE side of a two-sided contract, so the method is blind by construction to exactly the class INT coverage exists for. Every INT row carries `witness: #`; no witness = UNWITNESSED, never PASS. - [compare at ONE layer — the CRLF meter class](compare-at-one-layer-crlf-meter-class.md) ⭐⭐ multi-instance, 4 agents (count UNSTATED — it went stale at 4, then at 5): a byte comparison whose two sides come from different layers — WORKING TREE (CRLF checkout) vs git's normalized LF blobs, or one meter's output form vs another's — lies, and the mixed comparison is the natural one to write. Instances 1-4 fail toward DAMAGE (false MISMATCH on restore assertions, doyle x4 + todlando x1; phantom gen diffs, deployah x2; sha256sum escaping a backslash path, hertz). ⚠ One (hertz 2026-09-09, rider 6) fails the OTHER way — toward a confident quantified FALSE ASSURANCE ("CRLF-preserving, 1431 -> 1437") about a store that was LF all along, which nobody reopens; and `cat -A` under Git Bash HID the CR on a fully-CRLF file, i.e. measured wrong and landed on the right answer. So a SINGLE-SIDED claim has a layer too: measure the BLOB (`git cat-file blob $(git rev-parse :)`), never the disk file, and name the layer in the same sentence as the number. Both raw, both normalized, or both content-addressed — never one of each; a meter that cries damage gets disabled as fast as one that never fires. ⚠ SECOND AXIS (deployah 2026-09-10): two sides from the SAME READ is a tautology — it cannot fail, so it lies toward false ASSURANCE (silent, never reopened). Make the sides SOURCE-INDEPENDENT (pre-write measurement vs post-write read); ask what would make the assert FAIL, and if nothing would it is decoration. - [a SUCCESSFUL child swallows its own instrument](a-successful-child-swallows-its-own-instrument.md) ⭐⭐ a harness that PIPES a child's stderr renders it only inside a failure assert, so a probe on the PASSING path returns EMPTY — and three empty sites read as 'those sites never fired', a wrong finding about the mechanism rather than an obviously broken meter. CONDUIT #236 RCA 2026-08-29: 1 of 4 probe sites survived, and the survivor only escaped because an unrelated reap helper eprintln's its child's captured stderr. Write probes to a FILE (append, path from an env var), one composed write_all per line; read the file, not the transcript. - [mutation proof does not validate a green](mutation-proof-does-not-validate-a-green.md) ⭐⭐ able-to-fail (mutation) and green-is-meaningful (forced, not incidental) are INDEPENDENT properties; both burned in one arc (2026-08-29) — vacuous arms cost the v0.65.0 respin, then the respun leg's Windows green was read_dir enumeration order landing heads over an ambiguity IDENTICAL on both platforms (leg (c) tie: two perches, one pid; NTFS alice-first = lucky pass, ext4 bob-first = red). Every Windows pass of those cells incl. my own gate green was void as evidence. Ask of every mutation-proven cell: could an incidental mechanism (enumeration order, timing, defaults, pool history) green it with the subject broken? Fix = remove the incidental mechanism from the loop, not just the failing side. - [bare cargo test WEDGES — use nextest](cargo-test-bins-wedges-use-nextest.md) ⭐⭐ IR-55: `cargo test -p spt --bins` hung 24min at 13.5s CPU (BLOCKED — a leaked `findstr .` child reads stdin forever under headless conhost; serial harness stalls every test after it); nextest ran the same 653 in 22.2s. GOLDEN IS NOT EXPOSED (already nextest) — the exposure is ad-hoc triage. Also 652-vs-653 = `adapter_translate_proof_gates_on_commit` refusing without its fixture; prebuild `cargo build -p spt --bin translate_proof_fixture`. See [[a-frontier-names-where-progress-stopped-not-the-cause]]. - [live-agent env reds broker-stop rigs](live-agent-env-reds-broker-stop-rigs.md) ⭐ the runner's identity vars (OWL_SESSION_ID/SPT_AGENT_ID/SPT_ENDPOINT_ID) make the shipped guard refuse a test's daemon-stop — scrub the three in the rig; env-differential on ONE tree beats a base-sha comparison for environment-vs-diff. - [generous bound is FREE on an early-exit poll](generous-bound-is-free-when-the-poll-exits-early.md) ⭐⭐ tight bound buys no speed, only load flakes; ask per ARM (kill bound ≠ success bound); elapsed wait MUST ride the red — at-budget vs under-budget is the only discriminator between never-happened and still-in-flight. - [a STRUCTURAL exclusion cannot be mutation-proved](structural-exclusion-cannot-be-mutation-proved.md) ⭐⭐ my per-arm mutation table read as "exactly these reddened, the others held" — but one held green because the path NEVER REACHES the mutated body (redeem writes a level below), so no mutation could ever redden it. Greens in a mutation table come in two kinds and the output cannot tell them apart: could-have-reddened (evidence) vs excluded-by-construction (none). Name which, beside the green; the structural arm guards a future MOVE of the code, not today's predicate. - [a FRESH pool's missing fixture bin reads as a CODE red](fresh-pool-missing-fixture-bin-reads-as-a-code-red.md) ⭐⭐ `cargo test -p spt --bins` compiles bin targets as TEST HARNESSES into deps/ and never emits `target/debug/translate_proof_fixture.exe`, so `adapter_translate_proof_gates_on_commit` panics in any pool that never ran a full `cargo test -p spt`. Green in my #196 lane, red in my brand-new #172 lane — same command, different POOL HISTORY. Build the fixtures once (`--bin translate_proof_fixture --bin post_step_fixture`); read the panic TEXT, which names the right invocation itself. - [two background jobs, ONE output path](two-background-jobs-one-output-path.md) ⭐⭐ reused `> $S/172-spt.txt` across two overlapping runs; the later grep read the earlier run's file and printed `EXIT=0` beside `test result: FAILED` — impossible for one cargo, and exactly the shape of a fascinating anomaly worth inventing a mechanism for. Contradictory arithmetic ⇒ suspect the PLUMBING first; one path per invocation. - [mutate the DEFECT not the trigger](mutate-the-defect-not-the-trigger.md) ⭐⭐ trigger-only mutation vs standing defense measures nothing; only defense-removing survival indicts the test. - [include_str! does NOT normalize CRLF, a string literal DOES](include-str-does-not-normalize-crlf.md) ⭐⭐ cell compared an `include_str!` artifact against a literal const: green in the AUTHORING tree forever (git normalizes at commit, never re-smudges a working-tree file), red in every fresh checkout on an autocrlf=true box — the golden's own. Windows-only red, Linux green. Prove it with `od` in a fresh worktree (no build). Fix at the FIXTURE EDGE, not `.gitattributes` — an eol pin is the same environmental dependency one layer away. Census `include_str!`; a newline-free needle is immune, `\n\n` parses are not, and `str::lines()` hides the class. - [expectation derived from the code under test](expectation-derived-from-code-under-test.md) ⭐⭐ table test branched on `took_custody()`, the fn under test ⇒ widening it to admit `Refused` (a real security widening) passed 3/3 GREEN; expectation moved with the predicate. Hard-code the partition as a LITERAL and assert predicate AND write against it. Exhaustive-over-variants and self-referential-in-the-verdict are INDEPENDENT — only the second decides if the test can fail. Compile/coverage/traceable-reqs all exit 0 throughout. - [a control must mutate EVERY encoding](negative-control-must-mutate-every-encoding.md) ⭐⭐ one-site mutation of a doubly-encoded rule stays GREEN and reads as "guard defended" when it means "this control cannot see the guard"; count the sites first, and tell the gater it took N. - [a cmdline-scoped builder census is INTERMITTENTLY blind](a-cmdline-scoped-builder-census-is-intermittently-blind.md) ⭐ todlando + hertz 2026-09-08, same hour, both boxes: filtering cargo/rustc by worktree path in CommandLine matched 0 of 3 of MY OWN live builds — one cargo.exe had a BLANK CommandLine, another only the toolchain path. rustc carries the target path, cargo does not, so it fires mid-compile and reads empty seconds later: a guard with a track record is the persuasive kind. Census BOX-WIDE over cargo/rustc/clippy-driver, LABEL it box-wide, refuse on non-empty (which makes a load-window hold mechanical). Every prior "procs-before: []" = "no path match", never "I was alone". - [pool sweep is BLIND to a System32 victim leak](pool-scoped-sweep-blind-to-system32-leak.md) ⭐⭐ pool 0/0 while `cmd`+`ping` leaked from a withheld kill; reap the victim by COMMAND LINE, never by image name, and report BOTH predicates' counts — either alone is a clean zero on the other's population. - [rig mechanisms not memory](gate-rig-mechanisms-not-remembered-steps.md) leg 0 = throwaway target; sweep exes before EVERY cargo · [disposal is a rig STEP](gate-target-disposal-is-a-rig-step.md) · [isolated worktree](gate-clean-target-not-incremental.md) · [int via nextest](gate-int-tests-with-nextest-not-bare-cargo-test.md) · [clippy --workspace](ci-clippy-preflight-workspace.md) · [gate vs documented design](gate-against-documented-design.md) · [cross-platform leg](gate-cross-platform-leg.md) ⭐⭐ 3rd hit 2026-08-24: cfg-asymmetric const = dead-code lint on the OTHER OS — a cfg-touching wave's gate needs a cross-OS CLIPPY arm, tests catch nothing (SIGNET golden red). - [a lost continuation backslash COMPILES and PASSES](a-lost-continuation-backslash-compiles-and-passes.md) ⭐⭐ a Rust literal that loses its trailing `\` bakes source indentation into the RENDERED text; W3: `xtask check` flagged a 14-space run in a diagnostic while clippy BOTH OS, three nextest legs and treqs were green at that same sha. No test asserts a diagnostic's exact rendering, so the class lives in the gap tests deliberately do not cover — an `xtask check` red beside eight greens is the ONE instrument looking at it. Writing tools eat the backslash; verify with `cat -A`, never by trusting the write. ⚠ 2nd face 2026-08-29 (todlando W1): the REPAIR minted `\`+literal-`r`+LF — Rust reads a `\r` ESCAPE + raw newline, compiles, renders broken; verify a repair by BYTE-DIFF against a known-good continuation in the same file, not by re-reading source. Exemption is `spacerun-ok: — `; a bare marker exempts nothing. - [a long foreground `sleep` becomes a SHORT background one](a-long-foreground-sleep-becomes-a-short-background-one.md) ⭐⭐ Bash moves any command past its ~120s timeout to the background, so `sleep 590` waits ~2min and you poll 5x more than you intend. Measured 2026-08-28: box clock advanced ~15min across 8+ believed-ten-minute waits. The cost is not wasted turns — it is the FALSE INFERENCE: I called a healthy 13-minute build "compiling over an hour" and went hunting a wedge. Read `date` before calling anything stuck; use Monitor with an until-loop, or just wait for the background task's own completion notification. - [clippy COMPILES, it never RUNS a test](clippy-compiles-it-does-not-run-tests.md) ⭐⭐ `--all-targets` builds test targets, which is why it feels like coverage; it cannot tell you a test PINNED the string you changed. A DIAGNOSTIC-STRING lane needs the owning crates' nextest leg (or a tree-wide grep of the OLD string, real exits, confirming only emit sites survive). My owlery lane shipped 3 green legs blind to this; doyle closed it at gate. Pick legs by what the EDIT could falsify, never by what a lane of that shape usually runs. - [behavior → grep tests](behavior-change-grep-tests-not-comments.md) · [shared seam → ALL seam tests](shared-seam-change-run-all-seam-tests.md) · [seam red needs repeat-proof](seam-touched-red-needs-repeat-proof.md) · [main baseline](main-baseline-procedure.md) · [twohost window](twohost-run-window-discipline.md) · [unmergeable PR blocks CI](unmergeable-pr-blocks-ci.md). - [rebase fidelity = LANE'S own diff](rebase-fidelity-blob-compare-limit.md) ⭐⭐ LIMIT: byte-identity only if main misses your files; else strip `index`/`@@`. - [textual merge hides semantic composition break](assembly-textual-merge-hides-semantic-composition-break.md) ⭐⭐ 11 picks zero conflicts, fidelity proven, head did NOT compile — refactor lane's helper hoist vs feature lane's pre-hoist cell (E0425×4, #182 v2 assembly); lanes-green + no-conflicts proves nothing about the assembled head — clippy the head before EVERY hand-off, fix = minimal declared stage-only commit in the landed idiom. - [a census must be cfg(test)-AWARE](population-census-must-be-cfg-test-aware.md) ⭐⭐ grep cannot see `#[cfg(test)]`, so a call-site list mixes prod and test and still reads as an enumeration. releases#57: the filed issue, the JIT plan AND my own carried-forward wake note all named `cli.rs:24084` as a prod mutation site — it is inside `mod tests` (22522..35192), and the real population held a site none of the three listed. A list someone ALREADY re-located feels more verified than a fresh grep and was derived by the same blind method. Compute the cfg(test) regions, classify every hit, and ship the count WITH its definition. - [truncated grep = wrong POPULATION](truncated-grep-read-as-the-population.md) ⭐⭐ `| head -N` on a sweep SILENTLY sets scope; count first, list untruncated, classify every survivor — cost me a missed rename site. - [census pattern encodes an assumption](string-census-pattern-encodes-an-assumption.md) ⭐⭐ two faces measured (w1t3): line-continuation split the token across lines (rg -U is the population check), and a `token+subcommand` pattern was blind to rendered BARE-form sites; run a looser sibling probe — the count DELTA is what the census missed. Only surfaced because negative assertions were repinned too. - [count the string you REPLACE](scripted-edit-zero-match-refusal.md) ⭐⭐ ASCII-only anchors · [restore presumes a baseline](restore-step-presumes-committed-baseline.md) `git checkout --` DELETES uncommitted work · [correct fix deletes mitigation](correct-fix-deletes-accidental-mitigation.md). - Real-harness escapes — [mock-gating escape](v0121-realharness-reopen.md) ⭐⭐ green on mocks + in-proc reconcile, broken in the real harness · [source-read PASS refuted](v013-forkpty-groundtruth.md) code-gate PASS ≠ integration; Linux forkpty RED. - [consumer tally needs a PRODUCER control](consumer-tally-needs-a-producer-side-control.md) ⭐⭐ frozen counter = theft ONLY IF the producer kept producing; three-way verdict, PRECONDITION is not evidence · [probe before TEARDOWN](probe-before-teardown-not-at-assert.md) ⭐⭐ teardown-then-assert makes an assert-time probe read the rig's own cleanup · [instrument OUTPUT must outlive its subject](instrument-output-must-outlive-its-subject.md) ⭐⭐ sibling face: sink derived from the root the subject resolves sat INSIDE the rig's TempDir; the drop ate record+sink 29ms before the dump step, and the emptiness reads "no child wrote" when the truth is "reaped before read". A surviving ONE-line file is evidence of DELETION, not a small population. · [lane check via main pool](lane-check-via-main-pool-prebuilt-xtask.md) ~30s not a cold build; claim with the BUILT xtask.exe from the lane's cwd. - [non-vacuity can fail for the DEFECT's reason](non-vacuity-check-can-fail-for-the-defects-reason.md) ⭐⭐ collect it into the verdict; asserted up front a defect reads as a broken rig · [local IPC subscribe: by=None](local-ipc-subscribe-carries-no-origin.md) invented origin refused structurally, looks like seat contention. - [discriminator question](discriminator-question.md) ⭐⭐ 9 instances; newest = auditing a PEER’s one-command discriminator: if ONLY the failing path emits the string you grep, its absence from a green run is a TAUTOLOGY, not a measurement — ask which code path EMITS it before running the test, and settle at SOURCE (the fixture) instead of in logs · [external observable](outcome-discriminates-what-instrument-cannot.md) · [refuse mechanism first](refuse-mechanism-until-something-discriminates.md) · [instrument soundness](instrument-soundness-guards.md). - [a louder red hides a quieter one](a-louder-red-hides-a-quieter-one.md) ⭐ todlando 2026-09-08: four golden cells were red for TWO reasons — my new doubled-`type` defect AND a literal envelope expectation predating W2 msg-id; fixing the loud one left them red, and only the FAILURE TEXT changing proved the fix (BEFORE `type="msg" type="msg"` vs AFTER single, same cell/invocation, peer-measured on another box at the pre-fix sha). State acceptance as the text changing, never as the cell passing. An exact-equality assert over a CONTENT-DERIVED value (digest id) is unmaintainable by construction: repin the SHAPE, not the value. - [is this red MINE](is-this-red-mine-delta-test.md) ⭐⭐ 2nd face: THE RED THAT CONFIRMS YOUR HYPOTHESIS needs the delta test most and gets it least. My rig died reproducing the frozen HFENDULEAM signature EXACTLY (spool.db + untaken briefing + no info.json) on a tree lacking the #199 fix — every element corroborating; I was drafting "candidate (a) confirmed". Running the DONOR rig unchanged on the same tree took 4s and passed 1/1: the red was MINE (my manifest declared a translation binary, widening a race the donor never runs). A contradicting red gets audited automatically; a flattering one gets REPORTED — the tell is excitement, not doubt. Control on the SAME tree BEFORE reporting. - [failed JOB ≠ test victim](failed-job-is-not-a-test-victim.md) ⭐⭐ 12 failed jobs = 3 real victims; all-pass nextest summary ⇒ read the STEPS api, cross-platform repeat ⇒ code red not victim; rerun behaviour PER SHA; compare SIGNATURES not counts. - [assert string ≠ signature identity](assert-string-identity-must-include-the-predicate-subject.md) ⭐⭐ two "exact repeats" were pre-fix + post-fix mechanisms; the "respelling" WAS the fix — diff the predicate's SUBJECT chain, not the message · [empty TaskList ≠ dead task](empty-tasklist-is-not-a-dead-background-task.md) ⭐⭐ still-running poller invisible after /clear; re-arming doubled a MUTATING holder — near attempt-4 double-fire. - [carried jobs inflate attempt rows](rerun-carried-jobs-dedupe-executions.md) ⭐⭐ partial rerun COPIES untouched jobs into the new attempt with ORIGINAL started_at; a carried failure = the SAME observation. Rate math dedupes on (run, box, started_at). ⚠ 2026-09-09 #293 a2 (doyle, deployah caught it): a carried job's `run_attempt` is RELABELLED to the new attempt, so all-attempt=2 reads fresh on a fully-carried run; the discriminator is started_at vs the attempt's own run_started_at, and provenance is reported per job (N executed in a, M carried from a, same sha). ⚠ THE TELL (2026-09-09 #293 a2): a carried job's `run_attempt` is RELABELLED to the new attempt, so ALL jobs read attempt=N and the field discriminates NOTHING — doyle called 3 carried jobs “fresh” off it. Compare `started_at` against the ATTEMPT's own `run_started_at` (from /attempts/); started-before-its-attempt = carried. A carried success IS true evidence for the SHA, just not evidence the rerun re-tested it. - [census COUNT is noise](process-census-count-is-noise.md) ⭐⭐ 23/17/15 in 90s (digest polls); trend the PATH classification. - [dispatch-window legs must name the GOLDEN BOX](dispatch-window-legs-must-name-the-golden-box.md) ⭐⭐ filled a golden's wait with my own gate legs ON the golden's Windows box; a TOTP cell stretched 17x, its gate's 1s backoff refused a valid code — the run's only red, manufactured by me. Ask WHERE the awaited run executes before firing anything heavy; the "now-quiet box" step name was the contract. - [pre-fire check reads the DISK FLOOR](prefire-check-reads-the-disk-floor.md) ⭐⭐ process census is blind to a FINISHED build's dir; golden died at the 32 GiB preflight, zero test signal. ⚠ one floor reading = SNAPSHOT: C: swung 45 GB in 24min untouched — reclaim past the SWING, not past one sample. ⚠ 4th face 2026-08-24: budget in POOLS not GB — a full-sweep pool WEIGHS ~90-112GB steady state (3 specimens), cleaning a live pool buys one window at rebuild price; LNK1180/LNK1318 at the floor = the disk's red, never the diff's (IR-59). - [pre-register the STATISTIC, not just the prediction](pre-register-the-statistic-not-just-the-prediction.md) ⭐⭐ even-N median is a CONVENTION wearing a statistic's authority: ten 1s + ten 3s gives lower=1 FALSIFIED, upper=3 SURVIVES, avg=2 SURVIVES — same data, three verdicts. Register the conservative arm before the capture; file the RAW VECTOR + histogram so the convention is not load-bearing. Sibling: negative-control the extractor on a KNOWN truth vector (a plural-only regex dropped every singular `1 ppid match`, 5 of 20, and would have CONFIRMED the prediction). - [a battery is SILENT about arms no cell drives](a-battery-is-silent-about-arms-no-cell-drives.md) ⭐⭐ a claim that ENUMERATES is a test plan: "all six kinds", "every surface", "both directions". My own W3 asserted all six IO kinds visible in the REQ title + 3 published docs; COMMUNE/COMMUNE_FAIL were STRUCTURALLY impossible (their only publisher hand-builds IoBus::new() with one sink instead of default_bus). The e2e drove 2 kinds and was VACUOUS on exactly the 2 broken ones; the units synthesized rows and never traversed the publish path where the defect lives; TREQS WAS GREEN ON TAGS, NOT TRUTH. Four green legs + a gate PASS + my own parity check, all blind — a census for an UNRELATED lane found it. Count the claim's arms, count the cells driving them, name uncovered arms BY NAME. A test that cannot fail is worse than a missing one, because a missing one is visibly missing. - [env-gated row returns a VACUOUS 0.00s green](env-gated-test-returns-vacuous-green.md) ⭐⭐ `published_release_verifies_against_embedded_anchor` gated on `SPT_RELEASE_E2E`; unset ⇒ body never runs, PASS in ~0.00s, run summary identical to a real one. READ THE DURATION, NOT THE COLOR — a green too fast to have done the work is a skip. ⚠ testimony (deployah via doyle, v0.54.0 cut), unreproduced by me. - [cargo test --tests STOPS at the first failing binary](cargo-test-tests-stops-at-first-failing-binary.md) ⭐⭐ every suite after the failure silently never runs — a "clean" rerun is evidence about the PREFIX; --no-fail-fast for any sweep claiming suite-wide coverage — on cargo AND on nextest; CORRECTED 2026-09-06: nextest is NOT exempt (defaults to max-fail=1); this line used to say it was and I acted on it — 165 unrun, one of them a test binary that never COMPILED. Read the RUN COUNT (1074/1239), never the pass count. Rider: xtask-gen regen drift must be measured by `git diff`, never porcelain — autocrlf leaves regenerated files M on EOL alone (measured both, 2026-08-19 W3). Also that day: the "never run daemon --lib on this box" rule REFUTED 3/3 — see the updated entry, mechanism kept. - Filters reading as absent — [positive control](zero-match-filter-reads-as-absent.md) · [nextest matches names](nextest-zero-match-filter-trap.md) · ["1 test run"](nextest-singular-summary-parse.md) · [absence proxy](absence-proxy-breaks-when-success-writes.md). - [a positive control must CROSS the boundary the guard faces](a-positive-control-must-cross-the-boundary-the-guard-faces.md) ⭐⭐ hertz 2026-09-08: 15/15 green controls shipped a holders guard blind to the one process class it existed to catch — WMI blanks `ExecutablePath`/`CommandLine` for a process you cannot open (219/632 box-wide, all session 0, where the runner's builds live), so EMPTY read as "no holders". Every control had been injected in MY OWN session, proving the predicate can MATCH, never that it can SEE. "Every guard needs a positive control" is necessary and NOT sufficient: name the boundary (security context, machine, user, process tree, encoding) and check whether any control instance was born on the FAR side; if none was, the suite proves firing, not seeing. Far side uncheap to construct ⇒ env seam + injected far-side data + a THREE-VALUED guard so the unreadable case has its own name. Scope it before reporting: this bit an agent census, NOT core. - [hand-built walk ≠ enum pin](hand-built-walk-is-not-an-enum-pin.md) ⭐⭐ array + `len` assert stay trivially true when a variant is added; only a wildcard-free match at the PROD sites compiles red. Kin: a predicate parsing half an address re-opens the ruling the other half carries. - [panic MESSAGE is pre-authored](panic-message-is-preauthored-not-a-finding.md) ⭐⭐ names ONE mechanism whatever fired; read the gate line's numbers — a deficit PREDATING the window can't be caused inside it; immunity that's only a comment can't discriminate. - [assert GATES on status, PRINTS stderr](assert-gates-exit-status-but-prints-stderr.md) ⭐⭐ condition and message read different channels ⇒ log is MUTE on cause; `status.code()` 101-vs-1 lost, stdout invisible; a warn-only line above the panic is not thereby causal. - [test NAME asserts what the FIXTURE never creates](test-name-asserts-what-fixture-never-creates.md) ⭐⭐ gate not fooled, READER is; `std::process::id()` can never build an identity mismatch — read the fixture, never the name. 2nd face: the seeding HELPER decides it and the comment cannot show you — `allow_surfaces` sets modes CLOSED when the MODES table is empty (`access.rs:1711` reads `acl.modes.is_empty()` — the posture table, NOT the surfaces arg; that unnamed "empty" seeded a twice-carried misread, 2026-08-18), so two arms of one rung ran the same verb and diverged; state an arm's requirements TOGETHER to catch a structurally impossible one (needs Closed and Open at once ⇒ green nowhere ⇒ 1/1 is honest, rerun buys nothing); subject-matter adjacency ≠ causal proximity. - Coverage gaps — [uniform-table](uniform-table-blindness-sweep.md) · [every return arm](every-return-arm-is-a-copy.md) · [setup suppresses the arm](setup-suppresses-failing-arm.md) · [wrong population](gate-population-excludes-consumers.md) · [miss the CALLERS](gate-population-covers-consumers.md). - [a PRESENCE control needs the FAULT's population](presence-control-scoped-to-the-faults-population.md) ⭐⭐ walked the whole doc asserting the set CONTAINS the verb — the artifact's own PREAMBLE prescribes it too, so the arm was green over the exact silent defect it was written for. Count the token's occurrences in what you feed the walk; >1 ⇒ narrow to the slice where the fault can live. Negative arm must ALSO yield a healthy sibling token, proving the walk ran. - [a literal count floor is a FOSSIL](literal-count-floor-is-a-fossil-of-the-old-subject.md) ⭐⭐ `checked.len() >= 3` encoded how BIG the subject was, not that the instrument saw anything; a ruled partition shrank the briefing to one command and the cell reddened a correct change. Re-derive the count by a route the instrument does not take (count its own split token) and assert `==` plus `> 0`. - [pipefail masks/fabricates](render-not-read-pipefail.md) · [exit after a pipe is TAIL's](exit-code-after-a-pipe-is-the-tails.md) ⭐⭐ tail also hid a test section; both print GREEN · [SIGPIPE 141](shell-bash-adds-pipefail-sigpipe.md) · [seed descent from dead parent](seed-descent-from-dead-parent.md) · [torn window reachability](torn-window-needs-reachability.md) · [reap duration ≠ window](reap-step-duration-is-not-the-window.md) · [husk reads as default](husk-reads-as-default-defeats-durability.md) · [stale-snapshot proxy](stale-snapshot-equality-proxy.md) · [tick granularity](pair-test-tick-granularity.md) · [fixture ripple](liveness-aware-derivation-fixture-ripple.md) · [a2 r2 specimens](a2-golden-r2-specimens.md). - [two-daemon one-box](two-daemon-one-box-rig.md) · [isolated home/socket](isolated-home-isolates-broker-socket.md) · [perched gate strips agent env](perched-gate-run-strips-agent-env.md) OWL_SESSION_ID → DAEMON_STOP_REFUSED · [resident-broker repro](isolated-resident-broker-field-repro.md) · [daemon lib CAN wedge — prohibition REFUTED, race stands](daemon-lib-tests-deadlock-on-live-host.md) ⭐ 857/857 clean 2026-08-19; keep the cdb recipe · [--tests fail-fast HIDES THE TAIL](cargo-tests-failfast-hides-the-tail.md) ⭐⭐ sweep halts at the first failing BINARY, later suites never run and the log just ends; a precondition red reads like a product red · [verification gates](spt-verification-gates.md) · [alarm every run](alarm-every-test-run.md) · [delegate to spt-test-engineer](delegate-tests-to-spt-test-engineer.md) · [subagent stalls](test-subagent-stalls-on-hanging-test.md). - [include_str! fixture inherits checkout EOL](include-str-fixture-inherits-checkout-eol.md) ⭐⭐ autocrlf=true smudges FRESH checkouts CRLF while the author's never-re-smudged tree stays LF — builder green 637/637, every fresh rig/golden checkout red (split_once("\n\n") vs \r\n\r\n, W3 gate 2026-08-19); normalize at the fixture edge or pin eol in .gitattributes; the gate running from a fresh checkout is what catches the class at all. - [cargo builds pkg bins for int tests](cargo-builds-package-bins-for-integration-tests.md) ⭐⭐ same-package fixtures ALREADY guaranteed; env! adds NO edge — gap is cross-package + UNIT tests; bindeps needs nightly, nextest needs the config form. - [cargo test --bins never EMITS fixture exes](cargo-test-bins-never-emits-fixture-exes.md) ⭐⭐⭐ RECURRED 2026-08-29 on the entry's own author, WITH the entry written: prebuilt `-p spt --bins` from RECALL and ate three fixture reds in a row (mock-session, capture-player, mock-shell), each a ~0.01s panic that reads as a test failure. TWO NEW FACES: the fixture may live in ANOTHER PACKAGE (`-p mock-adapter --bins` — build the whole package, never a hand-list), and ENUMERATING FIXTURES BY GREPPING their pre-build strings is structurally incomplete because `sibling_bin`/`fixture_package(name)` COMPOSES the command at runtime, so no literal exists to grep. Original entry: --bins compiles [[bin]]s as test harnesses into deps/, no target/debug/.exe — cell shelling to the exe reds in a FRESH pool, green wherever a normal build ever ran (pool HISTORY, not the tree); prebuild fixture bins before any bins/filtered leg in a cold pool (todlando #172 lane + doyle #199 gate, 2026-08-21). ⚠ 3rd recurrence same day as the 2nd, on the GATER with the entry re-read that morning (W1 #235): a FULL `-p spt-daemon` nextest in a cold pool hits it too — reading the entry does not apply it; the prebuild leg lives IN the driver template now. - [check verifies COVERAGE, never PLACEMENT](traceable-check-cannot-verify-tag-placement.md) ⭐⭐ 57 unit tags on one REQ ⇒ your site cannot turn it red; EXIT=0 both with the tag separated from its evidence and after the fix. Green means coverage satisfied, NOT tags correct — read the site. Inserting a const/helper near a tagged item is the recurring way adjacency breaks. - [grep REQ tags](grep-req-tags-to-find-impl.md) · [per-wave activation](traceable-per-wave-activation.md) · [seed leaks](experimplate-traceable-seed-leaks.md) · [CI install cache](traceable-reqs-ci-install-cache.md) ⭐⭐ `TRACEABLE_REQS_TOKEN` is DEAD CODE · [spt is binary-only](spt-crate-is-binary-only-no-lib.md) use `--bins` · [never cargo fmt](no-cargo-fmt-in-spt-core.md). - [empty TaskList ≠ dead task](empty-tasklist-is-not-a-dead-background-task.md) ⭐⭐ poller SURVIVED a clear invisibly; re-arming put two `rerun --failed` holders on one run — only the API's green-contingent refusal stopped a 4th attempt. Read the prior `.output` before re-arming anything that MUTATES. - [check branch](check-branch-before-commit-shared-checkout.md) · [no add -A](no-git-add-a-shared-checkout.md) · [no reset --hard](no-reset-hard-with-uncommitted-work.md) · [worktrees under root](worktrees-under-project-root.md) · [audit watchers](audit-live-watchers-before-rearming.md) survive /clear · [quiet window](quiet-window-predicate.md) gh-only is blind to local builds. - [two FAIL lines are ONE observation](nextest-duplicate-fail-line-is-one-observation.md) ⭐⭐ nextest prints a failure in the live stream AND the final summary; identical elapsed + identical ordinal reads as a deterministic RETRY confirming the diagnosis. Count `panicked at`, never FAIL lines, and grep `retr` in the nextest config AND the workflow at the measured sha before calling anything deterministic. Handed to me as a peer supporting-fact, 2026-08-20 golden; the flattering read is the one nobody audits. - [gh run status freezes](gh-run-status-field-freezes.md) + [poll --json jobs](gh-run-poll-jobs-not-status.md) ⭐⭐ VIEW: `--json jobs` never `status`; ⚠ LIST REJECTS `jobs` · ⚠ NO TELL, TRAP 1 RETIRED (deployah 2026-09-10, golden 34445961595 @a9e786b2): `updatedAt` MOVED and the field still lied at every read, running BACKWARDS queued→in_progress→queued while a leg had been RED 16 min — a FAILURE is INVISIBLE at run level, so score from attempts//jobs · [gh refuses RUN-SCOPED mid-run](gh-job-log-refuses-while-run-in-progress.md) ⭐⭐ 2 faces. `--log`: exit 1 even for a COMPLETED job; `2>/dev/null` turns it into a clean zero reading as "no failures" — use `gh api repos/O/R/actions/jobs//logs`. 2nd face 2026-08-28 (deployah, CONDUIT 33223968222): `rerun --failed` ALSO refuses in flight, and fails toward a FALSE DIAGNOSIS not a false green — it reads as a rerun/permissions problem when it is purely timing. The red is visible long before the run is rerunnable; that gap IS the trap. Confirm terminal via `--json status` first · [gh --jq works with NO jq on the box](gh-builtin-jq-masks-missing-shell-jq.md) ⭐⭐ built-in engine masks a missing jq.exe — a bare `| jq` monitor dies silently on every poll while every gh sanity-check succeeds; instruments must emit a first-cycle ARMED line before their silence means anything (deployah testimony 2026-08-24, 84 dead polls) · [gh api leading slash](gh-api-leading-slash-msys-rewrite.md) · [bg cd-relative](background-cd-relative-trap.md). - [pool refusal's TAIL reads as a release confirmation](pool-refusal-tail-reads-as-release-confirmation.md) ⭐ `tail -2` on a pool verb returns the releases#103 rationale blurb — the LAST line of the REFUSAL — which reads like success; 4/4 failed releases looked like confirmations (todlando testimony 2026-08-21). Judge pool verbs by the verdict token up top, never the tail. - [the FIRST claim on a foreign pool must refuse](the-first-claim-on-a-foreign-pool-must-refuse.md) todlando 2026-09-08 W3: `cargo run -p xtask -- pool-claim` builds THROUGH the pool it is claiming, so a released foreign pool refuses SPT_POOL_FOREIGN on the first leg by construction — hatch that ONE leg (the refusal says so), never the battery; release leaves ownership recorded as YOUR tree, so the next agent hits it too. Second half: a clean guard pass is SILENT, and only `build/-/invoked.timestamp` + `output` separate ran-and-passed from never-ran — last invocation per UNIT, overwritten, so it time-excludes an agent but cannot reconstruct a past run. - [pool-claim WRITES a record, the BUILD enforces it](pool-claim-writes-a-record-the-BUILD-enforces.md) ⭐⭐ `pool_claim` never reads the incumbent (main.rs:2232-2294, unconditional `write_owner`, base only RECORDED) — last-writer-wins, no notice either side. Refuse/Takeover/Unproven/HatchOpen all live in `spt-store/build.rs:31-113`. I predicted a REFUSAL to a gater mid-run from AGENTS.md prose; the file refuted me in one read. Never predict a tool's refusal from prose — read the record AND the code path. - [the CONDITION reproduced, the RACE did not](condition-reproduced-race-did-not.md) ⭐⭐ an end-to-end green after a race fix can be VACUOUS — the fixed path never ran, so the green is evidence about the LADDER, not the fix. Register the non-reproduction arm BEFORE the run so the vacuous case has a name to land in, and report which ARM fired, not the color. Instrument split the two: condition 2/2 runs, collision 1/2. Offer a DETERMINISTIC rig, never a re-fire against a 1-of-2 rate. - [duplicate work's population is PROCESSES, not code paths](duplicate-work-population-is-PROCESSES-not-code-paths.md) ⭐⭐ a per-process claim cannot exclude a SIBLING process; count distinct pids emitting the event before theorizing re-entrancy. Measured: one stream served by a livehost `spt` and the test-hosted daemon 21 ms apart, loser's refusal beat the winner's grant by 88 ms. Riders: score your predicted ARM honestly (I named consume-time, the claim-time one fired), and report the SILENT families beside the loud one — they took the same doubling and said nothing. - [read the OTHER leg's GREENS, not just its red](read-the-other-legs-GREENS-not-just-its-red.md) ⭐⭐ the peer job's PASSING rungs refuted my failing rung's whole premise — a green whose predicate has ONE producer in the product proves what already happened above that call site. Cost me nothing only because I checked where the peer died before writing a probe there; I was one command from instrumenting an answered question. When new evidence retires a DISPATCHED instrument, say so and hand the choice back. - [an ANTI-ORACLE refusal is opaque to the TEST too](anti-oracle-refusal-is-opaque-to-the-test-too.md) ⭐⭐ one token for unknown/expired/consumed/rate-limited ⇒ the red names nothing; enumerate the refusal's AUTHORING SITES and refute preconditions against fixture facts instead of theorizing. Second face: a cell must control or PROBE every precondition — the survivor here was a rate bucket SHARED with arrivals earlier rungs spend, charged per DELIVERY not per unique record. Check `required_stages`: no `int` stage ⇒ the cell pins a PRECONDITION, not the contract. - [the BARRIER must be the fact you ASSERT](barrier-must-be-the-fact-you-assert.md) ⭐⭐ wait on EXISTENCE + assert a LATER-written field = a snapshot taken 3 steps upstream of the write; deadline cannot help, green is luck, and the "OK: converged" line prints right before the failure. 2nd face: the panic exited the process mid-handler and killed the peer's in-flight ack — the other job's red was this cell's own kill, carrying zero information. Check the producer's step ORDER before proposing a product mechanism. 3rd face: barrier and subject can share a LOCK and still race — `converge(rows())` goes true when the merge block DROPS the lock, the counter ticks after (`registryhost.rs:881`), window microseconds, green for a month then one Windows red. Read the DIRECTION first: a cell guarding write amplification reads 2+ when the product breaks, so `left: 0` refutes the product before any source read, and the zero itself certified one transaction. 4th face: A BARRIER CAN EXPIRE WITH THE DEFECT — faces 1-3 are "upstream in TIME", this is "a predicate over state THE FIX DELETES". My #164 rig waited on the briefing row being PENDING; the fix takes it in ms, so post-fix the barrier never goes true and the instrument REDS on the tree its subject works on, reading as "never spooled" when the truth is "delivered before I looked". Ask of every measurement barrier: does this state still exist once the thing I am measuring is repaired? Prefer an EXISTENCE read (audit row, sees both states) over a STATE read (pending, loses it to any taker). - [background task output ≠ evidence until completion](background-task-output-not-evidence-until-completion.md) ⭐⭐ in-flight output file reads EMPTY = fake clean zero; 3 measured in one session (deployah), tool falsely blamed then exonerated by negative control; read ONLY on the completion notification, never on a timer. - [in-flight run logs: CLI refuses, raw jobs endpoint SERVES](in-flight-run-logs-are-gated-read-steps-and-annotations.md) ⭐⭐ `gh run view --log-failed` refuses mid-run even for a CONCLUDED job — that is the CLI, not availability; `gh api .../actions/jobs//logs` served 511KB live. Also: post-failure `skipped` ≠ passed (cfg-derived vs run-derived), and a same-FILE red is not a same-CELL red — map panic line to enclosing fn, diff vs the suspect commit hunks, clear fixes by WRITE-SET. - [worktree-remove partial failure reads total](worktree-remove-partial-failure-reads-total.md) content already gone, only the dir ENTRY pinned — ls FIRST, then rmdir+prune, never a blind retry (deployah testimony 2026-08-19). - [branch -d names the CURRENT HEAD](branch-d-merged-question-names-current-head.md) shared checkout on another lane ⇒ 'not fully merged' is an artifact; merged-ness question must NAME its ref (merge-base --is-ancestor vs origin/main) (deployah testimony 2026-08-19). - [a blank panel is not a silent product](blank-diagnostic-panel-is-not-a-silent-product.md) ⭐⭐ my miss-arm barrier read the INHERITED stderr file, but `daemon run` calls `stderrlog::install` a few statements in and repoints std-error at `SPT_HOME/logs/daemon.stderr.log` — inherited file = PRE-REDIRECT window only. Panel read EMPTY, which is indistinguishable from "the product fails silently", the exact defect the arm hunted, so the red CONFIRMED my hypothesis: one inference from reporting a product defect that did not exist. Tell I missed: the panel had been blank on the PASSING arms too — a diagnostic no assertion depends on is UNTESTED BY CONSTRUCTION, and its first real use is always a red you are trying to explain. Prove a panel non-empty on a GREEN run before trusting it to report silence. Sibling `engine_room_bringup_e2e.rs` documents the identical trap on the same family (IR-50 class). - [fixture project under SPT_HOME stops deriving](fixture-project-under-spt-home-stops-deriving.md) ⭐⭐ #178 widened the exclusion to the whole home; two projindex e2e fixtures parked projects inside it — red only at the ASSEMBLED head (no lane gate ran them), fallback value not garbage is the tell; leaked rig daemons then lock spt.exe and fabricate a second red. - [grep -l census counts name collisions](grep-l-census-counts-name-collisions.md) an identifier grep over-counts adoption (locals/doc-comments wear the helper's name); census = TWO greps, qualified call vs legacy spelling, diff the populations. IR-50 close gate 2026-08-20: my own concession fell to it before hertz's closure did. - [two-arm rig confounds the valve with arm ORDER](two-arm-rig-confounds-the-valve-with-arm-order.md) ⭐⭐ control + injected differ in TWO ways (the valve, and being second) — a rig that could only witness its FIRST case reads byte-identical to the defect. Add a SECOND CLEAN arm in the injected arm's position (cost 349ms); assert per-arm DURATIONS, and after the fix the burn must VANISH not shrink (20.4s -> 355ms, matching the clean arms). doyle ruled the shape and made keeping all three arms part of the #201 fix ruling. - [an UNAPPLIED mutation is a green that reads as a passing guard](unapplied-mutation-green-reads-as-a-passing-guard.md) ⭐⭐ a scratch that fails to APPLY runs the cell on the clean tree and prints a pass — byte-identical to a guard that really defended (todlando, W4 Lane 1: `1 test run: 1 passed` / `SCRATCH_B_EXIT=0`, read for the verdict instead of for the mutation = "cell B is a real guard" on evidence it was never tested). A purposeful red needs TWO assertions: the mutation LANDED (print the mutated fn body) and the cell then FAILED; assert MATCH_COUNT==1 and REFUSE rather than replacing a first hit. Cause was environmental and recurs: a heredoc collapses one backslash level, so ` ` in an inline script becomes a real linebreak — write old/new to delimiter files with a QUOTED heredoc and READ them. - [a coverage fix is measured over the POPULATION it claims](a-coverage-fix-is-measured-over-the-population-it-claims.md) ⭐⭐ #212 head gate: xtask spacerun had ALREADY been caught by an indented `#[cfg(test)]` latch (4 files / 6,375 lines blind); the fix keyed on COLUMN-0 markers, premise "a column-0 module runs to EOF" — false in the biggest file, `in_tests` never resets, cli.rs has EIGHT of them (first at 2934 of 37,903). ⚠ MY HEADLINE FIGURE WAS THE SAME ERROR: "88,030 lines / 54.4% / 102 files" measured LINES AFTER THE LATCH, not coverage loss — a trailing test module is out of scope under BOTH rules. True split: 88,042 = 66,637 never-in-scope + **21,405 production lines actually hidden, SIX files, 19,918 in cli.rs**. Fourth instance in one day of naming the wrong property, and the corrected number also settled a question I had queued a mutation for. The lane's `A=0` census was taken under the blind zone. A green scanner and a scanner that never looked are the same output. State the STRUCTURAL PREMISE and COUNT it; re-census the newly-opened region; correct the scope sentence by replacement. Proof shape: treatment (in the suspect region) exit 0 + CONTROL (where it is known to look) exit 1, same class, same run length, same binary — either alone is an argument. - [an exemption must be witnessed SUBTRACTING](an-exemption-must-be-witnessed-subtracting.md) ⭐⭐ a marker/waiver can be present, greppable, correctly spelled and suppress NOTHING — and it fails in the direction that reads as "still broken", so you keep adding more, all untested. #212: marked one site, re-ran, DIFFED THE SET — count stayed 7, site merely shifted 11986→11988; `opted_out` returned on the first non-blank walking upward, so a marker anywhere but the LAST line of a multi-line comment was inert. Post-fix 7→6 (one removal, nothing ADDED), then 6→0. A total is two cancelling changes away from lying, because suppression decides what gets PARSED not just REPORTED. Apply one at a time, diff the SET, exercise the awkward placement FIRST. - [a mutation that reds EVERY arm proves only damage](a-mutation-that-reds-every-arm-proves-only-damage.md) ⭐⭐ aim the purposeful red at ONE arm and assert the siblings INTACT in the same script. todlando, W5 #211 commit 1: starved `decide`'s PER-ENDPOINT tier with an empty slice while asserting `NODE_TIER_INTACT=True` — the cell PASSED arm (b) on the node tier at :278, then refused at arm (c) :305, exit 100. That ordering is what proves arm (c) is about tiers 1-3 and is NOT a second spelling of arm (b); a mutation reddening both would have proven only that the cell notices breakage. Report WHICH ARM refused and which it passed through first, never "the cell went red". - [a test’s BANNER can go stale against its own ASSERT](a-tests-banner-can-go-stale-against-its-own-assert.md) ⭐⭐ golden r1 2026-08-25: the failure block printed "the loopback leg is a captured diagnostic, not asserted" while dying ON that leg — `53be5270` (v0.61.0) promoted arm 4 to a hard assert and updated NEITHER the banner NOR the oracle’s soundness, so it asserted a property the cold-attach contract never guaranteed (a `from_seq=0` attach is served a GRID REPAINT; flood lines scrolled the needle off-screen). Passed 2 releases on the winning side of a race. Tell: same-sha PLATFORM SPLIT (Win PASS 2.175s / Linux FAIL 9.880s). A red’s own text disagreeing with what asserted is a FINDING — `git show` the promoting commit; "it used to pass" dates the MARGIN, not the oracle. - [a prebuilt xtask BAKES its build tree's root](prebuilt-xtask-bakes-its-build-trees-root.md) ⭐ its inner cargo runs AS the tree that BUILT the exe, not your cwd — main-built xtask from a gate worktree redded SPT_POOL_FOREIGN against my OWN claim, naming a tree the command line never mentioned; confirmed by fix (gate-tree rebuild, same pool/claim/cwd = clean). Build xtask FROM the invoking worktree before any building verb (check/gen); prebuilt is safe only for non-building verbs (pool-claim/release). - [an absence is data only if the thing has a way to appear](an-absence-is-data-only-if-it-has-a-way-to-appear.md) ⭐ missing emitter = missing read verb: "no pid observed" / "no breadcrumb" carries zero information when no code path writes it and no verb surfaces it — the absence is structural on healthy and broken runs alike. Name the emitter AND the read verb before citing an absence; either missing ⇒ file the observability gap, don't report the absence as a finding (CONDUIT #236 arc, 2026-08-29). - [a drain-side instrument SUPPRESSES the race it hunts](drain-side-instrument-suppresses-the-race-it-hunts.md) ⭐⭐ #225 RCA 2026-08-25: `SPT_OBS_BYTE_TAP` per-chunk fs work on the drain thread = 21/21 GREEN, unset = 3/3 RED — the probe's latency spans the ~2ms first-chunk-vs-Spawned-reply window; a probe on the LOSING side (brain's discard arm, off the racing thread) caught `SPAWNWAIT_DISCARD seq=0 SXMARK01` without flipping the outcome. A 100%-flip discriminator localizes the race — report it as a FINDING. Rider: an environment SLOWDOWN is an accidental mitigation (the kitsubito audit storm hid this race for releases; the box FIX exposed it), and one window whose WIDTH varies with load explains a whole "random victim family" — check that before positing several mechanisms. - [a test can be green on a SIDE EFFECT of the defect you are removing](a-test-can-be-green-on-a-side-effect-of-the-defect-you-are-removing.md) ⭐⭐ W4/#229: making an undeclared psyche role SKIP redded a re-host assertion that read the nested psyche perch as proof — that perch was minted INSIDE the turn BEFORE the spawn, so a role-less fixture grew one from a turn that then failed UnknownRole and struck. The old green was a leftover of the exact defect being deleted, and the red is the fix working. Trace WHAT PRODUCED the asserted artifact before classifying a red in a test your lane never touched; fix the FIXTURE (a real adapter declares the role), and pin the negative polarity PAIRED with the positive or the negative assert is vacuous. - [nextest DEFAULT fail-fasts: --no-fail-fast is the other half of the rule](nextest-default-fail-fast-hides-not-run-cells.md) ⭐⭐ todlando 2026-09-06 #276 gate: max-fail=1 stopped with 165 TESTS NOT RUN incl. a NEW int binary that had NOT COMPILED (private fn called from an int test) — a green-looking partial run over an uncompiled cell is the vacuity trap; put --no-fail-fast in every driver template. - [the RUN is the census; a grep is a guess at one](the-run-is-the-census-a-grep-is-a-guess.md) ⭐ todlando 2026-09-06 #276: string sweep for 'wrote its commune'/'echo wrote' MISSED a live assertion spelled 'wrote its drop'; the full nextest run found it. A retraction sweep's grep list seeds the population, the suite run measures it. - [git-bash `tasklist /FI` mangles to a PATH](git-bash-tasklist-fi-mangles-to-a-path.md) ⭐ 2026-09-07: MSYS rewrote /FI to C:/Program Files/Git/FI, tasklist errored, grep saw nothing, my Monitor reported a LIVE driver DEAD (twice, two sessions). Use //FI or MSYS_NO_PATHCONV=1; prove the arm on a known-live pid; fail closed (unknown ≠ gone). - [a leg that ends in a grep exits with the grep](a-leg-that-ends-in-a-grep-exits-with-the-grep.md) ⭐ 2026-09-07 W1: pair wrapper's status = its summary pipeline's, driver read EXIT 0 beside a.exit=100/b.exit=100 and started MUTATING on a red baseline; killed wrapper = revert undone. Gate the next leg on the role exit FILES; one-box rigs space port bases past the cell count (7460/7461 put A cell 1 on B's broker). - [a population floor proves the filter selected SOMETHING, not the right something](a-population-floor-proves-the-filter-selected-something-not-the-right-something.md) ⭐ 2026-09-07 W2: kind(lib)+kind(bin) never selects crates/*/tests (kind(test) enters only by binary()); the lane's own e2e rig with the finding-closing cells sat outside a battery whose 200-test floor passed. Run nextest list with the filter and assert the wanted cell NAMES are in it; name every touched test binary with binary() in the driver filter, same lane commit. - [a two-arm completion poll fails OPEN](a-two-arm-completion-poll-fails-open.md) ⭐ 2026-09-07: `[ "$r" != "0" ]` stopped on a dropped ssh and printed BATTERY DONE while clippy was mid-leg; a harness "task completed" notification is the WATCHER finishing, never the work. Three arms (DONE/RUNNING/METER BROKEN), the third never stops the poll; confirm on the exit FILE. - [a FIXED rig port is answered by the PREVIOUS run's leaked daemon](e2e-leaked-daemons-shared-box.md) 2026-09-07 W2: fetch 404 while the rig daemon's own `serve list` HOLDS the entry = registry right, surface wrong = another process on the port (netstat: last run's autostarted daemon, different SPT_HOME; the default port hands you the FLEET). URL-minting rigs need per-run bind-:0 port fed to daemon + CLI (flag OFF, IR-78) AND a Drop-guard reaper; gate greps DOCS_SERVER_UP port == URL port + no spt.exe from the rig home after the leg. - [tightening a predicate is an edit to the METER](a-stricter-meter-answers-a-confident-empty.md) x4 (deployah 2026-09-09: Git Bash pgrep blind to detached pwsh = confident empty used as a GUARD, failed toward PERMIT, manifest overwritten mid-watch; fix = guard on the RUN-TERMINAL invariant via gh, not a better process query) ⭐ 2026-09-07 instance appended: killing 2 false positives silently dropped `start_serving` and with it a true positive my own LOOSE pass had already found (3 vs doyle's 4). Diff the before/after result sets and name why every row left. - [a nextest TIMEOUT does not kill the cell's children](a-nextest-timeout-does-not-kill-the-cells-children.md) ⭐ 2026-09-07 W2: a timed-out twohost_web cell left a broker-holding child alive; nextest blocked 14 min at 0.61 CPU-s, no .exit written, verdicts already in .raw. A "hung" pair lane = CPU time + orphan census FIRST, read the .raw, kill only the path-verified orphan; parent then writes its exit at once. - [a driver edited MID-RUN mangles the live run into vacuous greens](a-driver-edited-midrun-mangles-into-vacuous-green.md) ⭐⭐ 2026-09-07 W2 F17: doyle rewrote the xbox twohost script 2 min INTO my run; bash reads by byte OFFSET, resumed mid-line, dropped role A's env prefix → all 5 cells no-opped and "passed" in ~0.013s, role_b (the must-skip) indistinguishable from the four that should work. Detector = uniform 0.0x s PASS incl. the must-skip cell + owner WEB_SERVE_FOR == 0; Summary==1 was necessary NOT sufficient (single and EMPTY). Read script mtime vs run window BEFORE bisecting env. Run drivers from a FROZEN copy. - [a double backslash COLLAPSES inside a quoted heredoc](a-double-backslash-collapses-inside-a-quoted-heredoc.md) ⭐ doyle 2026-09-07: `\\n` in a `<<'PY'` heredoc reached python as `\n`; anchor matched 0 twice, third try WROTE real linebreaks into mutate.py (SyntaxError). Build backslashes with chr(92) or read from a printf-written file; py_compile + diff the region after every scripted edit. - [a rig that seeds ONE direction fails when a cell needs the REVERSE judgement](a-rig-that-seeds-one-direction-fails-when-a-cell-needs-the-reverse-judgement.md) ⭐ hertz 2026-09-07 F19: B's roster/registry never had A (requester() seeds B->A only), so B's first reverse judgement refused UntrustedOrigin wearing the dispatcher's 120 s red; census seeds for BOTH directions, precondition-assert with the arm's own read verb (failed in 0.5 s with the verdict word). - [LNK1104 on the exe you are PRODUCING = the previous run's cell still holding it](lnk1104-on-the-exe-you-are-producing-is-the-previous-runs-cell-holding-it.md) ⭐ hertz 2026-09-07 F19 run 2: role A ran its full 240 s WAIT after B died at a precondition; relaunch 90 s later hit LNK1104 on twohost_web-*.exe — reads as a link fault in the edited code, is a file lock; chain launches on an EMPTY ExecutablePath census, VOID not red. - [a rig WAIT equal to nextest's terminate-after makes the cell's own red UNREADABLE](a-rig-wait-equal-to-nextests-terminate-after-makes-the-cells-own-red-unreadable.md) ⭐ doyle 2026-09-07 W2: WAIT=240 == 60 s x 4 terminate → helper cell killed as TIMEOUT [240.1s] with no deadline text, and equal WAITs on both roles left A's range cell dialing a B dead 74 ms earlier; WAIT under the bound with margin (120), serving role outlives the requester's tail. - [a barrier published by the party that EXITS is a dial to a corpse](a-barrier-published-by-the-party-that-exits-is-a-dial-to-a-corpse.md) ⭐ todlando 2026-09-08 W3: XFER side-channel moved onto replicated rows; the two signals whose publisher STAYS worked, the completion barrier published by A-then-exit left B dialling a dead endpoint all window (PUMP_PEER_FAIL submit-dial 10 s). Ask who is up when the other side reads it; an exiter signals synchronously with took_custody, the waiter reads its spool. Found on run 1 of a leg ruled in over "accept the risk". - [a `FAIL [` grep DROPS `FAIL + LEAK` rows](a-fail-prefixed-grep-drops-fail-plus-leak-rows.md) 2026-09-08 v0.68.0 golden r1 Windows: harvested 3 reds, Summary said 4 failed — the missing row read `FAIL + LEAK [`, and the under-count invented a false cross-OS difference. Enumerate failure CLASSES with a suffix allowed, then RECONCILE against the Summary's `N failed`; that reconciliation is the check. LEAK-only rows are not failures; per-OS denominators differ (3323 vs 3344). - [a watcher's exit 0 with an ABSENT exit file is a NON-RESULT](a-watchers-exit-0-with-an-absent-exit-file-is-a-non-result.md) hertz 2026-09-08: watcher reported exit 0 + empty diagnostics (reads as a clean pass); clippy.exit ABSENT, clippy.raw truncated 11,081 B in mid `Checking anstyle-wincon` — died in DEPENDENCY compile, never linted a workspace crate. Empty diagnostics means "nothing ran", not "no problems". Check: exit file EXISTS, raw reached a workspace crate, and the exit belongs to the GATED command not a wrapper. - [a carried job count is a stale census of the workflow](a-carried-job-count-is-a-stale-census-of-the-workflow.md) deployah 2026-09-10 v0.69.0: my commune carried "SIX job keys" for golden.yml while WARNING not to assume ci.yml's five; at candidate a9e786b2 it is SEVEN keys (n1-gate missing from my list) and NINE ROWS (test + n1-gate are 2-runner matrices). Enumerate jobs from the workflow AT THE RUN SHA and expand every matrix before reading any run. ## Moved 2026-09-08 (VERBATIM from MEMORY.md Gate & test craft, 7 entries) - [leaked daemons from e2e batteries break the NEXT build as exit 101](leaked-daemons-from-e2e-batteries-break-the-next-build-as-exit-101.md) ⭐ 2026-09-08 x3: holder == compile red at the exit surface; kill own-tree spt.exe by verified path before cargo, refuse exit 5. - [a named line is a SAMPLE; census the whole file for the shape](a-named-line-is-a-sample-census-the-whole-file-for-that-shape.md) hertz 2026-09-08: third stale literal at quickstart:153; WMI daemon cells run single-threaded or they red at setup. - [PRE-SEED the exit file with a VOID sentinel before the leg starts](pre-seed-the-exit-file-with-a-void-sentinel-before-the-leg-starts.md) ⭐ hertz 2026-09-08: a kill runs no trap and leaves an absence that reads green; sentinel first, integer overwrites, reader refuses anything else; 15/15 positive controls. - [a job list read EARLY in a run is not the run's job set](a-job-list-read-early-in-a-run-is-not-the-runs-job-set.md) ⭐⭐ 2026-09-08: twohost jobs materialize late; I released a battery onto the box twohost-a was starting on; the release word is run.status==completed, never a job's state through a name filter. - [a needle in SOURCE form cannot match a raw with ESCAPED quotes](a-needle-in-source-form-cannot-match-a-raw-with-escaped-quotes.md) 2026-09-08 x3: reconcile per-cell greps against the Summary counts; 0 run = VOID; print text beside counts. - [a path-predicate builder census is INTERMITTENTLY blind](a-path-predicate-builder-census-is-intermittently-blind.md) ⭐ todlando 2026-09-08: cargo runs with a BLANK command line; census cargo/rustc/clippy-driver box-wide and refuse on any. - [a commit that says cells WILL RED names the cells to run](a-commit-that-says-cells-will-red-names-the-cells-to-run.md) ⭐⭐ 2026-09-08 golden red #272: 3 pre-existing spt e2e cells unrun since W1; run the changed seam's CONSUMER crates in full, not only the added cells. - [a run-level conclusion is NOT an attempt's verdict](a-run-level-conclusion-is-not-an-attempts-verdict.md) ⭐ 2026-09-09 (mine, golden #272 r2): `gh run list --json conclusion,createdAt` describes the RUN — conclusion = the LATEST attempt, createdAt = ATTEMPT 1 — so I named attempt 3's already-triaged red as "a4 HAS READ and it is RED" to the gater who set the hold, and called an 18:17Z CREATION a 7-hour-old terminal. Attempt 4 had not been fired. A stale red and a fresh red render IDENTICALLY at run level, so re-reading the same object harder never catches it: read `run_attempt` in the SAME command as the verdict, cite the job's own finish (`--json jobs` / `--attempt N`), and let the hold-setter release the hold. - [a mid-run job list OMITS unmaterialized dependents](a-midrun-job-list-omits-unmaterialized-dependents.md) ⭐ 2026-09-09 golden #272 r2 a4: `--json jobs` lists only STARTED jobs, so `needs:`-gated `twohost-a`/`twohost-b` were absent and the six-job read became "only hfenduleam is in this run" — kitsubito was in it all along (golden.yml :1029/:1176, both `needs: test`). Under a quiet-box hold that authorizes work on a box the run is about to take. Scope = the workflow's `needs:`/`runs-on:` edges at the sha, never the live list. OPPOSITE-DIRECTION trap in the same graph: both twohost jobs are `if: !cancelled()` (:1023-1026 — `needs: test` is only a rendezvous barrier), so a RED on test does NOT end the run or free the boxes. - [proved the CELL, never ran the LANE](proved-the-cell-never-ran-the-lane.md) ⭐ 2026-09-09 r3 assembly, mine, twice in one lane: reported a rider "GREEN BOTH PLATFORMS" off CELL timings, then clippy red it (`needless_late_init`, same file:line on BOTH OSes); a second rider whose SHAPE the gater had accepted red on `items_after_test_module`. Neither defect was reachable from the cell I ran. A cell result is evidence about a cell; a rider is admitted by the LANE. Run the gate's own legs with its own flags before saying green, and name which leg produced it. Check the toolchain before blaming drift (clippy 0.1.96 ac68faa20c matched the runner, pinned by rust-toolchain.toml). ## Moved 2026-09-09 (VERBATIM from MEMORY.md Gate & test craft, 4 entries) - [job scope comes from the WORKFLOW GRAPH, not the live job list](job-scope-comes-from-the-workflow-graph-not-the-live-job-list.md) 2026-09-09 (doyle made it too): `--json jobs` lists only MATERIALIZED jobs, so an unstarted `needs:` dependent reads as 'not in this attempt'; retained jobs DO appear with old timestamps, so the list looks complete. Also: twohost carries `!cancelled()`, so a test red neither ends the run nor frees the runners. - [probe the EVENT PATH, not a prerequisite of it](probe-the-event-path-not-a-prerequisite-of-it.md) 2026-09-09: Monitor probe exercised `gh`, event lines piped `jq` which is OFF PATH -> stderr only, 8 completions, ZERO events, and I had told doyle it could not go silent. Emit a REAL event first; use `gh -q` not `| jq`; read the output FILE before reading quiet as calm. - [`gh run list --commit` needs a FULL sha](gh-run-list-commit-needs-a-full-sha.md) - short sha returns a confident EMPTY on a run that EXISTS, reading as "golden never triggered"; measured by varying only sha length at one sha. Runbook pin idiom walks into it; false read invites a re-push/dispatch that runs SERIAL and costs a window. - [a run-level conclusion is NOT an attempt's verdict](a-run-level-conclusion-is-not-an-attempts-verdict.md) ⭐ 2026-09-09: told the gater who set the hold "a4 HAS READ and it is RED" off `gh run list` — that conclusion is the LATEST attempt (3, already his) and `createdAt` is attempt 1's, read as a 7 h old terminal. Read `run_attempt` in the same command as the verdict; the hold-setter releases the hold. Full entry in [[GATE-TEST-INDEX]]. - [a terminal-exit watcher is BLIND to a rerun of the same run](a-terminal-exit-watcher-is-blind-to-a-rerun-of-the-same-run.md) 2026-09-09 v0.68.0 golden r3: a rerun KEEPS the run id, so `status==completed` is already satisfied by the DEAD attempt — the watcher exits within seconds printing a plausible verdict about the WRONG attempt. Bind the exit to `run_attempt >= `, read jobs at /attempts//jobs, and verify the advance IN the dispatching script, not a later read. - [a FAILING step masks the job-budget wall behind it](a-failing-step-masks-the-job-budget-wall-behind-it.md) ⭐ 2026-09-09 v0.68.0 r3 a2: a `timeout-minutes` kill reports as **`cancelled`, never `failure`** (50 min budget, killed at 49m59s) — so compute duration vs budget BEFORE any cancellation story. And a red SHORTENS a job (short-circuit to cleanup), so fixing it makes the job LONGER: attempt 1 fit in 48m39s *while failing early*, attempt 2's green Phase B ran four steps further and died at the wall with the whole docs block unexecuted. A late gate can be STRUCTURALLY UNREACHABLE while every skip is correctly attributed to the failure above it — "has never passed" and "cannot pass at this budget" look identical from a skip. - [an exhaustive match pins PLACEMENT, not walk-list MEMBERSHIP](an-exhaustive-match-pins-placement-not-walk-list-membership.md) ⭐ 2026-09-09 releases#289 c2: added a variant; both renderers are `_`-free so PLACEMENT was forced, but the two walk TESTS iterate HAND-TYPED arrays and my variant was in neither - build, 5 unit, 4 int, treqs ALL GREEN, and the one it was missing from is the render guard that catches the exact lost-backslash collapsed literal I had just written. The `len` assert beside such a list passes because the LIST did not change. Grep the enum name across tests for array literals after adding any variant; a STALE COUNT in a doc comment is the thread to the walk that did not follow the change. - [censusing a VERB's callers is not censusing a REFUSAL's reach](censusing-a-verbs-callers-is-not-censusing-a-refusals-reach.md) ⭐⭐ 2026-09-09 releases#289: installed a guard in 6 verbs, censused their 14 call sites, gater checked the table - CI still red, because five EXISTING cells hand a blocking Brain to `wan_send_with`, which sits ABOVE the verb and passes the same `&mut Brain` down. Walk UP from the guard to the CONSTRUCTORS, count test callers, and run ci.yml's unit SET (`nextest --workspace -E 'kind(lib) + kind(bin)'`) not a name filter over it - a filter answers "did MY cells pass", never "did I break someone else's". - [a fixed probe window without a rendezvous mints a FALSE box red](a-fixed-probe-window-without-a-rendezvous-mints-a-false-box-red.md) ⭐ 2026-09-09 hertz dir 2 att1: A listened 10 s, B behind cargo on Windows sent late, INBOUND_BLOCKED at 10.24 s = the text the real 7509 drop prints; window = peer's proven presence (budget listen + ACK + beacon over the open direction), never a fixed span. - [a --no-run warm-up does not build the FIXTURES a test shells out to](no-run-warmup-does-not-build-the-fixtures-a-test-shells-out-to.md) ⭐ doyle 2026-09-10 releases#294 rig: `--no-run` exit 0 on both arms, then the smoke leg died in 0.025s on `required test fixture mock-session is missing` (sibling_bin, common/mod.rs:263; fixtures live in mock-adapter) — all six contract legs would have red-flashed as arms. Assert fixture files before the first measured leg; ALWAYS run one smoke leg before a multi-leg run. Also: `bash driver.sh | tail -N` in background hides ALL progress until exit. - [proving two CI arms' populations are comparable](proving-two-ci-arms-populations-are-comparable.md) ⭐ releases#294 2026-09-10: 5 checks each fail their own way — static counts, NET counts hiding 6 removals, a PASS|FAIL extractor blind to LEAK rows, a CIRCULAR name search, disjoint-commit reasoning from ONE pair of six. Validate the extractor against the Summary count FIRST; nextest partitions by BINARY, so diff binary-phase membership, then identities, then commit removal sets, then bodies. Logs carry it all — no build. - [a whole-run predicate stays silent through the part you watch](a-whole-run-predicate-stays-silent-through-the-part-you-watch.md) deployah 2026-09-10, golden 34481993681: test(Windows) concluded failure at 13:58:10Z and I reported "nothing terminal" for 12 more minutes -- the poll waited for ALL jobs terminal while !cancelled() twohost legs ran on, and its conclusion collector printed concl=[] even after a failure. Notify on JOB TRANSITIONS, emit every terminal state, selftest the collector against a known-bad job AND a known-good one, and stamp the OBSERVATION time not the send time. - [a budget INSIDE the measured tail is a coin flip, not an assertion](a-budget-inside-the-measured-tail-is-a-coin-flip.md) ⭐⭐ doyle 2026-09-10, how releases#294 Finding 1 finally classified: sync.rs:109 wait = 400x25ms "10s budget"; IR95-SYNC margins rep1 176/400 @4.448s PASS, rep2 392/400 @9.940s PASS (2% headroom), instrumented CI 400/400 CENSORED at 10.16-10.20s FAIL 2/2 (hertz: an expiry is RIGHT-CENSORED, never a sample — it cannot separate delayed from absent/filtered, so the tail has NO upper endpoint and 'widen past the tail' is unspecifiable), Linux same cell 1.523s. ipc<1% = the budget MEASURES product latency. A threshold inside the distribution makes pass/fail JITTER, so no single-variable pair ever closes (we hunted twohost+event; both measurably inert) and near-miss PASSES hide it. Instrument margin on SUCCESS; ask "is the threshold inside the distribution" BEFORE pairing arms; never bare-widen.