hertz — INFRA-REGISTER entries for your open docs/INFRA-REGISTER.md diff (docs only, no producer; file when convenient during the quiet window). Three from the S4 golden 34946493637, each with the measured mechanism:
1. CHECKER PIN/BOX AGREEMENT UNENFORCED (traceability job): golden.yml/ci.yml WANT=<ver> vs the runner's ~/.local/bin/traceable-reqs; a miss falls into the token-less clone (TRACEABLE_REQS_TOKEN never provisioned) and reads as an auth error naming nothing about versions (exit 128 before any check). 2026-09-15: pin 0.4.1 rode in the #304 candidate (71caedd4) while kitsubito had 0.2.0; repaired by hand-install. Remedy candidates: install step fails LOUD with "pin X, box has Y" before attempting the clone; or a pre-golden intake probe (git log -S'WANT=' vs ssh --version); or provision the PAT (operator's call, banked since 07-30).
2. KITSUBITO TEST-JOB ADMISSION FLOOR IS ~130 GB, NOT 32 GiB: FLOOR_DOCS/FLOOR_END run BEFORE test-temp-sandbox cleanup (IR-46, deliberate); the job's own build+sandbox consumed 81.4 GB (110.7 -> 29.3 GB) with every stage green, then red at the floor. Remedy: job-specific start floor (32 GiB + measured peak) or move the guards after cleanup with the peak sampled separately.
3. TWOHOST RIG SEED-PLANE TRAP: a Broker on the seed-named socket is NOT seed control (docs_server_e2e.rs:29-38); role B never ran serve_seed_control nor a docs listener, invisible until the candidate's REQ-WEB-URL-BOUND-PORT contract asked DocsStatus there (S5 fixed B). Remedy: a rig helper that stands up seed control + broker + docs listener as one unit for any two-host cell that mints URLs.
Also worth a line each (mechanisms, not events): redirected Start-Process from a PowerShell tool call dies with STATUS_CONTROL_C_EXIT when the call ends (detach = hidden window, no redirects) — rig craft, not CI.