# W2 GATE JIT — #161 multi-subnet sealed-code mint (doyle, authored 2026-08-19 in rerun wait window)

Subject: todlando's W2 build, lane branch `keystone-w1`, tip **@008d0c4 at authoring time — RE-DERIVE
the tip at gate start**; if golden 32225436027 rerun lands the #182 head, the lane rebases first and
the gate runs the REBASED sha (record both). Rulings + grounding: #161 comment 5338395046 +
KEYSTONE-182-JIT.md §W2. GATE-TEST-INDEX opened this session (2026-08-19) before authoring this plan.

## Preconditions (hard)
1. Rerun 32225436027 CONCLUDED (poll `gh run view --json jobs`, never `status` field alone) — quiet
   window on hfenduleam lifts only then. NO cargo before that.
2. Name the box before firing: these legs run on hfenduleam; confirm no golden/CI job is executing
   there at leg start (dispatch-window-legs-must-name-the-golden-box).
3. Disk floor: read C: free BEFORE the first build; reclaim past the SWING (~45GB/24min observed),
   not past one sample.

## Rig
- Worktree `.worktrees/gate-<sha>` (detached, under project root — binding). Fresh target in-rig.
- Pool-claim from the RIG's own cwd with the prebuilt main-pool xtask.exe (~30s, not a cold build);
  release at gate end. Predict refusals from BUILDS, never from pool-claim (IR-42).
- Env scrub in every leg: unset `OWL_SESSION_ID` / `SPT_AGENT_ID` / `SPT_ENDPOINT_ID` (perched gate
  strips agent env — else broker-stop rigs red falsely).
- Sweep orphan test exes before EVERY cargo (LNK1104 class). Teardown: classify the target dir
  outbound/inbound before removal; size before/after.

## Legs (pick by what the EDIT could falsify)
1. `cargo clippy --workspace --all-targets -D warnings` — compile gate only; it RUNS nothing.
2. nextest, owning crates targeted first: codeseal codec suite, cli chooser/seal tests,
   wansend redeem_route/open_among tests. Int tests via nextest, never bare cargo test.
3. Diagnostic-string check: `KNOCK_WHICH_SUBNET` refusal died WITH its copy — tree-wide grep of the
   old string with real exit codes; only emit sites (none expected) survive. Count first,
   list untruncated.
4. `traceable-reqs check` exit 0 — then READ the new/amended tag SITES (check verifies coverage,
   never placement).

## Ruling conformance (A/B/C from #161)
- A: mint-side N>1 print states the N-1 consequence (older nodes report unknown-or-expired);
  ADR-0054 amendment in marked-not-struck voice records the supersession + N-1 silent arm;
  NO fleet version floor shipped.
- B: CONTEXT.md sealed-code entry carries the qualifier "reveals how MANY memberships, never which".
- C: open_among exit condition is ROUTED not opened; tie broken by PINNED subnet-name lexicographic
  order WRITTEN INTO THE REQ text; verify at source, not from the lane's summary.

## Population / census
- Grounding named five prod sites at c45f4b0 (codeseal.rs 1-263, cli.rs chooser + :17253 +
  ~1146, wansend.rs :1521) + four test sites. Re-verify at the GATE sha with a cfg(test)-aware
  census (grep alone mixes prod/test; compute test-mod regions, classify every hit, ship count
  WITH definition). Line numbers from c45f4b0 are hints, not anchors.

## Never-executed cells (declaration set for golden hand-off — verify each is NAMED, not silently green)
1. N>1 open path (denominator one — say "N executions" out loud, no flake rates).
2. Two-subnet simultaneous opening (needs two-seed fixture; SEED_A/B anti-cross-open stays as the
   negative pair). If the new fixture asserts routing preference, check the control mutates EVERY
   encoding of the tie rule.
3. prev-seed × multi-envelope (2N combinations).
4. cli.rs:26591 assertion REMOVAL — suite count shrinks by one and stays green; account the delta
   explicitly (a disappearing assertion shows in no pass count).
5. codeseal.rs:291 length pin multi-envelope sibling (~+ENVELOPE_LEN per extra envelope).

## Verdict discipline
- Any red: is-this-red-mine delta test before attribution; elapsed wait rides the red; read
  durations not colors (a ~0.00s green is a skip).
- PASS hands W2 DEPENDENT into next golden assembly with hygiene @6b484c5; record pool release +
  rig removable in KEYSTONE-182-JIT.

---

# W3 GATE (stacked) — engine-room education, 9193d40 on build/keystone-182-w2-sealed-multi (base 008d0c4)

Stacked ON W2's tip: one rig, W2 legs at 008d0c4 FIRST, then forward-checkout to 9193d40 for W3
legs. Sequential pool use in one rig is fine; verdicts SEPARATE. todlando's report 2026-08-19;
long form in his scratchpad w3-build-report.md. My rulings on his three asks sent 2026-08-19
(presence control table-scoped APPROVED; table-derived default-on ACCEPTED, #165 rendering note
owed by todlando; both cell corrections approved as described, read at source anyway).

## W3-specific legs (his claimed greens to reproduce: spt-store 483/483, spt-live resume 8/8,
## spt bin 637/637, int --no-run, clippy 0, treqs 0, xtask reference.md byte-identical 139971)
1. erole carrier at source: new crates/spt-store/src/erole.rs — composer FN not const; surfaces
   from control_surface_rows_in, NEVER hardcoded (grep for hardcoded surface ids/descriptions in
   erole.rs — zero expected); BOTH readers resolve through ONE erole::role_text (find ALL readers,
   cfg(test)-aware — visibility argument beats audit if the fn is module-scoped).
2. --overwrite refuses engine-room BEFORE opening the file — verify order at source (refusal
   ladder position), and the refusal has a test with a negative control.
3. REQ checks: REQ-ER-ROLE-STATIC-IMMUTABLE minted doc/impl/unit/int + tags AT evidence sites
   (placement read, not just treqs exit 0); REQ-ER-SESSION-BRIEFING + REQ-ER-BRIEFING-SURFACE-VOCAB
   replaced in-lane (amendment-by-replacement approved shape); REQ-ENGINEROOM-ADMIN-BRINGUP-EMPOWERS
   untouched — diff its text to confirm.
4. Skeleton amendment in-lane: matches the #165 posted diff EXACTLY (rows 1/2 <subject>, row-4
   reflow one verb per line, column 31->37, preamble composer-rendering sentence). Walk controls:
   fault-1 panic arm + fault-2 presence arm SCOPED to the tier-table slice, negative arm yields
   healthy sibling token. Positive arm walks the LANDED artifact via include_str!, not a fixture.
5. Falsified-cell corrections at source: vocabulary identity cell follows carrier to role +
   briefing-ABSENCE arm (absence paired with role-presence sibling); briefing walk floor now
   occurrences == walked && > 0 (no literal count floor survives — grep for `>= 3`).
6. bring_up_spools_one_briefing_and_writes_no_role_text passes UNCHANGED — verify the test text
   is actually unchanged vs 008d0c4 (git diff), not just green.
7. Default-on rendering: role reads default-on set FROM the table (REQ-ACL-DISCOVER-DEFAULT-ON);
   no prose sentence naming DISCOVER in role text; absence stated positively.
8. Int cell: authored, NEVER EXECUTED — denominator one, pre-registered: a red is STRUCTURAL
   (comes to me), rerun is the wrong response. Say "N executions" in the verdict.

## W3 verdict discipline
- Rendering-divergence note DISCHARGED (#165 comment 5339125846, 2026-08-19) — verify it reads as
  described (tier-semantics half literal, default-on half composed from surface::TABLE; fenced
  amendment byte-untouched).
- POST-GATE FOLLOW-UP RULED (doyle 2026-08-19): the parallel preamble sentence (authored, unlanded)
  lands AFTER the gate as a DOC-ONLY commit — doyle reads its diff — and BEFORE golden-head
  assembly, so the assembled head's walk cells execute against the final artifact. Gate reads
  9193d40 exactly. Do not treat the post-gate commit as ungated drift; it is accounted here.
- PASS: W3 rides the same branch as W2 into next golden assembly; never-executed cells (W2's five
  + W3's int cell) all NAMED in the golden hand-off declaration set.