# TURNKEY W4 — JIT plan (todlando) Brief: `TURNKEY-W4-BRIEF.md` (doyle). Base for lanes 2/3: **`origin/main` = c62904e7**. NEVER bare `main` — local `main` is 8d4c224b, 67 behind, does NOT contain c62904e7. ## Lane 1 — w3 line-safety attr-codec — **GATED, CLOSED** Branch `fix/w3-line-safety-attr`, base dc1c7532. **`8f4d975c` + `6d399391`.** Gated PASS twice (full, then a scoped re-gate for one doc reword that NAMED its skips). Blind tree-grep at doyle's rig: "line-safe by construction" — **NO MATCHES** anywhere. doyle ffs `fix/w3-comms-text` onto it himself (ruling (a)); root is under HIS pool claim. **Pool REAPED** (47.28 GB). Worktree `.worktrees/w4-linesafe` still exists, source intact. ## Lane 2 — #168 taught monic command — **GATED PASS, CLOSED** Branch `fix/168-taught-monic-command`, worktree `.worktrees/w4-lane2`, base c62904e7. **`550a78f3` (red) + `79462367` (fix).** Earlier `3afd66a7`/`5524ec7f` are DEAD — never gated. TWO instances, both ruled in scope (scope note on #212; membership unchanged): - `trustwarn.rs:250` — `monic add {id} ""` (the filed one) - `cli.rs:17122` — `monic update {peer} ""` (NOT filed, STRICTLY WORSE: `update` REPLACES the trigger set, so a careless `--triggers` silently DE-CLASSIFIES a peer the agent already judged, and reports success) Fix shape: ONE composer in `spt-store::monic` beside `Trigger::sender`; each call site keeps its OWN prose. **Trigger JSON DERIVED, never spelled** — `serde_json::to_string(&vec![Trigger::sender(peer)])` IS the constructor's output through the same serde `--triggers` parses back through. Expect `"regex":false` (3 fields). **DO NOT add skip_serializing to `Trigger`** — stored record shape. Red: Starting **4**, 4 run, 0 passed, 4 FAILED, exit 100. Green: Starting **4**, 4/4 pass, exit 0. `git diff` between them = ZERO `assert`/`fn` lines. **VERDICT PASS at `79462367`** (doyle, rig `.worktrees/gate-w4l1-1c0d435c`). Every leg's exit from its own file, set size read before every verdict: POOL 0, PREBUILD 0, RED 100 (Starting 4 across 98 binaries, 1281 skipped), GREEN 0 (Starting 4, 4 passed), NEG_RED 0 and NEG_GREEN 0 (Starting 1 each), BINS 0 (651 across 5), CLIPPY 0, TREQS 0 (795/795), XTASK 0. **The negative arm is a CONTROL, not a bystander:** `an_unnamed_sender_is_warned_about_...` passes at the RED sha *and* the fix sha, which is what makes "the UnnamedOn arm is untouched" measured. Figures that MOVED and why: 651 bins vs my 642, and 795 treqs vs 787 — his rig carries my lane on top of c62904e7, so the deltas are my 9 new cells and my 2 mints. Not regressions. ## Lane 3 — #74 space runs + bin names — **COMMITTED @ `cd115d4d`, GATING NOW** Branch `fix/74-interior-space-runs`, worktree `.worktrees/w4-lane3`, base c62904e7. UNCOMMITTED. No pool claimed yet. **#74's own instance is CLOSED AT BASE** — rendered clean at c62904e7 (literal extracted programmatically, compiled with rustc, debug-formatted: one space, no run). **The class check is the deliverable**, and the commit must say so in its own voice. Authored: - `crates/xtask/src/spacerun.rs` — renders literals (rustc escape rules incl. line-continuation eating newline + next-line indent), refuses interior runs of 3+ spaces in RENDERED bytes. Corpus asserts SEPARATION directly (healthy vs eaten differ by ONE backslash), plus leading/trailing not interior, 2 spaces = prose / 3 = alignment, `spacerun-ok` marker exempts and the SAME BYTES without it are refused, assert-family + post-`#[cfg(test)]` + raw strings skipped. - `crates/xtask/src/binnames.rs` — duplicate bin names over **`cargo metadata --no-deps`**, NEVER manifest stanzas (a stanza grep cannot see autodiscovered `src/bin/*.rs` and would certify an absence it cannot observe — that is how a live bin got recorded as gone). Cells feed an INVENTED collision; one names BOTH real counterparts; the real-workspace cell is asserted LAST and marked in-file as the weakest. Gate refuses an EMPTY target list rather than passing. - Wired into `xtask check`; two REQs minted (`REQ-DOCS-NO-INTERIOR-SPACE-RUNS`, `REQ-BUILD-UNIQUE-BIN-NAMES`), toml parses, 797 requirements, sorted-list placement fixed. ### Census — MEASURED 2026-08-22, without the pool Box was doyle's throughout: no pool claimed, no cargo run, nothing committed. `spacerun.rs` depends only on `std`, so it was compiled with plain `rustc` — `--test` for the corpus, and a 20-line driver calling the REAL `check_operator_text_space_runs` over the real crate dirs. An independent Python model of `scan_source` PRE-REGISTERED the census first; both returned the same 11 rows (same files, lines, run lengths). **Buckets before the total: A = 0 · B = 11 · C = 0.** A = 0 is a statement about the GATE'S REACH — no eaten continuation inside `crates/spt/src` + `crates/spt-daemon/src`, outside cfg(test)/assert-family/raw, rendering as an INTERIOR run. It is NOT a claim that the class is absent from the repo. **Pattern with the count:** 7 of 11 are ONE house idiom (rc.rs ` `), 3 are aligned comment blocks in the GENERATED .cmd/.sh that `picker/shortcut.rs` emits, 1 is firewall.rs separating a copy-paste netsh command from its `(run elevated)` annotation. **Markers: 10** (one shortcut.rs literal carries two runs). Post-marking census: **0 findings**. Corpus: 13 tests, unfiltered, set size asserted before the verdict, 13 passed, exit 0. TREQS at the lane tree, no build needed: 797 requirements, 797 complete, 0 incomplete, 0 findings. ### Three defects the census found IN THE INSTRUMENT (all fixed + pinned, all pre-build) 1. **A `"` inside a CHAR literal opened a string.** Ten `'"'` sites in the scanned crates; the scanner collected a body running to the next quote anywhere later in the file. 2. **The escape hatch was unusable on the population the gate exists for.** `opted_out` read only the literal's OPENING line, which for a continued literal MUST end in the backslash and can carry no trailing comment — 5 of the 11 sites. The marker is now accepted on the opening line OR the comment line directly above it (blanks walked; only a COMMENT line counts). 3. **Suppression was deciding what gets PARSED, not just what gets REPORTED — and only marking revealed it.** A skipped line advanced ONE line, so a suppressed multi-line literal left the scan resuming inside its own body, where an escaped `\"` reads as an opening quote. Marking firewall.rs silenced its run and manufactured a SECOND finding two lines below, out of the literal just exempted. The same hole sat under the assert-family skip. A literal is now always walked to its close. **A lane that marked and shipped would have shipped phantom line numbers.** **Validated against the HISTORICAL defect, not an invented one:** the pre-fix bytes of the fork-arm sentence were extracted from `3416ffd3` (never retyped) and made a cell; measured run = **18**. That commit's own body confirms the mechanism is a JOIN — "joined badly, so the source indentation ended up inside the sentence the operator reads". **LIMIT, raised to doyle, NOT yet written into the module doc (his ruling to make):** the gate refuses INTERIOR runs, so a backslash deleted WITHOUT the lines being joined leaves the newline in place and the indent arrives as LEADING whitespace — not refused, by design. Covers the join variant (what #208 measurably was); does not cover bare deletion. ### doyle's four rulings on the partition — APPLIED (2026-08-22) 1. **The caveat IS the ruling.** A=0's "statement about the GATE'S REACH, not about the tree" goes in the commit body in those words, and is already in the REQ's activation note. 2. **Markers stay PER-SITE and each carries a REASON TOKEN.** Ruled against an idiom-aware exemption: it would have to DETECT alignment, alignment is fuzzy, and any rule recognising "this looks aligned" eventually exempts an eaten continuation that looks aligned — a silent false negative in the one direction the check exists to prevent. Token census: **7 `remedy-column` · 2 `generated-script-comment` · 1 `command-annotation`.** *My addition, doyle ACCEPTED it rather than cutting it:* the token is **required** — bare `spacerun-ok` (or a colon with nothing after) exempts NOTHING, so the audit trail cannot be silently opted out of. His reasoning on the obvious objection: a junk token is visible, greppable and re-auditable; a bare marker is none of those, so the mechanism degrades to "a bad reason someone can find" rather than "no reason at all". **Control:** the census still reads 0 findings AFTER the token became mandatory, which is what proves all ten real markers carry one — a bare marker would have REAPPEARED as a finding. 3. **The limit is written in, both places.** Module doc gains "WHAT THIS GATE DOES NOT COVER"; `REQ-DOCS-NO-INTERIOR-SPACE-RUNS` now claims INTERIOR RUNS rather than the class, and says so, so greping the id cannot be read as the class being closed. 4. **Instrument defect #3 goes in the commit body with its mechanism spelled out** — the phantom only appears once someone MARKS, so it would have surfaced in a later lane as "the check is broken" long after this one closed. ### binnames' central claim — MEASURED, also without the pool `cargo metadata --no-deps` compiles nothing, so it never touches a target dir. At c62904e7 + this lane, read from every manifest cargo names (NOT a glob): **14 bin targets, 12 stanza-declared, 0 duplicates, and 2 invisible to a stanza grep** — `spt-daemon`'s `xlate_choreo_fixture` (autodiscovered `src/bin/*.rs`) and `xtask` (autodiscovered `src/main.rs`). The invisible one is the bin the collision rule NAMES: the false IR-58 in one row — a census structurally unable to observe a target reported an ABSENCE where the honest answer was an INABILITY. ⚠ **A CORRECTION OF MINE, kept beside the figure.** My first pass printed SIX invisible targets; I had globbed `crates/*/Cargo.toml`, which does not match `adapters/mock/Cargo.toml`, so four mock-adapter bins that DO carry stanzas came back stanza-less. **The blind spot was in MY PATTERN, not in the mechanism I was measuring** — and it ran in the flattering direction, making my own argument look stronger than the truth does, which is exactly when nobody re-checks. 6 never existed outside that one command; **2** is the figure. ### BUILT AND COMMITTED — tip `cd115d4d`, base c62904e7, tree clean Trailer verified by RAW BODY READ (never `%(trailers:)`). Legs, each exit from its OWN file: `POOL_CLAIM 0` (claimed from inside the lane worktree — record reads lane w4-lane3, branch `fix/74-interior-space-runs`, base c62904e7cd0d) · `TIP_XTASK 0` · `TIP_CELLS 0` (Starting **71** across 2 binaries, 71 passed, 0 skipped, UNFILTERED, set size before the verdict; **19 of them mine, confirmed BY NAME**) · `TIP_TREQS 0` (797/797) · `CLIPPY 0` (0 lines matching `^(warning|error)`, counted separately) · corpus 15 cells standalone under rustc. **BOTH GATES WITNESSED FIRING, two assertions each** — mutation landed, then the gate refused: - **RED A** `broker.rs:6622` joined the 3416ffd3 way (backslash + newline deleted, 21 spaces kept). Match count 1, body read back OUT OF THE FILE, run 22. `xtask check` exits **1** naming the site. Reverted byte-identical. - **RED B** duplicate `gh_fixture` declared from spt-daemon. Exits **1**: "gh_fixture declared by: spt, spt-daemon". Reverted byte-identical. ### ⚠ THE FIRST RED A DID NOT FIRE — the lane's most important finding Same injected literal, mutation proven landed, `xtask check: OK`. The `#[cfg(test)]` latch was tripped by the FIRST marker at ANY indentation; broker.rs's first is INDENTED at 2660 on a production helper while the real module is at 8182, so the scan stopped at 2660. **Measured blind zone: 4 files, 6,375 lines of production code, 5,523 in broker.rs.** Only a column-0 marker ends the scan now; a cell pins both directions. **What it would have shipped:** a green check, a clean census, and the defect class still live in the largest file in scope. **THE CONTROL IS THE POINT (doyle put it on record):** an unchanged number after a coverage fix is equally consistent with the fix not having taken effect. A=0 before and A=0 after proves nothing; A=0 after **with a witnessed red in the newly-opened region** proves the region is reachable. The re-run was made falsifiable rather than merely repeated. ⚠ Self-correction inside that finding: I first wrote "80% of broker.rs was blind" — that counted the test module, out of scope under BOTH rules. Measured figure is **5,523 production lines**. The figure that supported my case was too flattering to it; second time that shape appeared today. ### Two further defects, both in the REPORT rather than the verdict - **UTF-8 through a Latin-1 cast** (`bytes[i] as char`): an em-dash printed as three mojibake chars — in a check whose subject is text rendering correctly. It could never manufacture or hide a run (no UTF-8 continuation byte is 0x20), so the verdict was always sound and only the printed line was wrong — **the defect class a green cannot show you**, visible only once something reds and a human reads the output. Walk runs on chars now. - **The remedy line was stale**: it named a bare marker on the opening line — the one placement impossible for a continued literal, and without the required token. A check about operator-facing text shipping a wrong operator-facing instruction. ### doyle's assembly question — ANSWERED BY CONTENT (not blocking, not mine to execute) Built a head corpus (168,506 lines ≥40 chars at 1e0a8c61) and tested every substantive line each commit ADDS against it. **All four ER commits absorbed** (5db45f9e superseded — head evolved past it). **All three of doyle's unsettled absorbed**: dc1c7532 382 added/0 absent; 19de6a0a 3/0; 43dc3943 211/1, and that one residue is the OLDER paragraph — the head's copy is **145 words longer**, carrying the rename PLUS a 2026-08-22 amendment, so picking it would REGRESS. c9544f71 confirmed genuinely **needed**: 6 of 81 added lines absent. **Assembly: 15 absorbed, 3 needed.** ⚠ **My instrument's asymmetry, the mirror of doyle's reverse-apply:** ZERO residue is trustworthy; residue > 0 is INCONCLUSIVE (genuinely needed OR head-evolved — only reading it tells you which). It also ignores lines <40 chars and **cannot see DELETIONS** — a removal-shaped commit reads "absorbed" by construction, which is why 0a513888 needed doyle's absent-token test instead. ⚠ `reached_the_agent` is ABSENT from `spt-msg/src/deliver.rs` (where the commit puts it) and PRESENT in `spt-daemon/src/wan.rs`. **A per-file check would call that a residue. It MOVED.** Tree-wide is the only honest scope. ### Box / pool doyle TOOK THE BOX to gate cd115d4d (confirmed fine — I am not building). My pool at `.worktrees/w4-lane3/target` STAYS STANDING for re-runs; reap only after the verdict. Earlier in the lane I reaped the gated Lane 2 pool: classified real-dir (not a reparse point), no inbound reparse points, `CARGO_TARGET_DIR` empty, target SUBTREE only, worktree intact. 74.42 GB / 48,044 files measured; free 81.97 → 150.70 GB = **68.73 GB reclaimed**. Both figures reported; the 5.7 GB gap is unexplained rather than smoothed. **Legs so far, each from its own file, no pool:** RUSTC 0 · CORPUS 0 (14 tests, UNFILTERED, set size read before the verdict, 14 passed) · CENSUS 0 (`REAL_FINDINGS=0` post-marking) · TREQS 0 (797/797, re-run after every toml edit). **THRESHOLD RULED (doyle) — PARTITION BY KIND FIRST, report buckets BEFORE any total:** - **A** = eaten continuation (the real #74 defect) · **B** = deliberate alignment · **C** = cannot classify. - A ≤ 5 → fix in lane, each verified against RENDERED output. - A > 5 → **STOP.** Ship the check, mark NOTHING in bucket A, let it red, file defects via `alchemy create`. A check that reds on real defects on day one is a working check; a green bought by marking real bugs exempt is worse than the bugs. - B → `spacerun-ok` markers in lane, but report HOW MANY and spot-check ≥3 against rendered output (a marker on a bucket-A site exempts a live defect permanently). - C → **STOP AND ASK.** Never resolve uncertainty by marking; marking fails silently. - Commit body carries the three bucket counts, the pattern, the tree/sha, and the marker count — never a bare total. ## Box / disk (LIVE CONSTRAINT) Volume 1863 GB, ~1.6 TB used by things that are NOT ours (doyle took that; operator's machine, directory-level only, not our business). **Our footprint is pools, not worktrees:** 45 worktrees = 0.79 GB total (~18 MB each); 3 pools = 130.45 GB. One cold pool ≈ 2,500 worktrees. **Ceiling as arithmetic:** ~50–75 GB per cold pool, 40 GB floor → TWO live pools comfortably, THREE only if one is small. The floor fired when we were at four plus the head. Rules that matter: reap a pool when its lane finishes; never two builds at once. **FREE SPACE GOES IN THE FIRST LINE OF ANY BUILD-FAILURE REPORT**, not in the controls. The LNK1318 is recorded UNEXPLAINED with two ranked candidates (1 disk exhaustion, 2 mspdbsrv contention) and the disk reading beside it. The contention experiment is OFF THE BOARD — at 134 GB free it cannot reproduce a condition that no longer exists. Reconstructible in principle (cold pool build under ~10 GB free); nobody manufactures that on a shared box. ## Standing discipline earned this milestone - **A filtered run must report its SET SIZE, asserted before the verdict.** Two empty-set filters caught this lane. `attach_resize_capture` is a BINARY id, not a module path — use `-E 'binary(x) and (test(=a) + test(=b))'`. The module-path idiom is right for lib tests and silently wrong for integration binaries. A test name typed from memory is an unresolved pointer aimed at the INSTRUMENT'S INPUT. - **A purposeful red needs TWO assertions:** the mutation LANDED (match count == 1 + print the mutated body) and the cell then failed. An unapplied scratch gives a green that looks like a guard. - **A pointer (name, line number) in a brief or ruling is never a measurement** — resolve against the blob before it enters a commit, doc, or REQ. Binds doyle's outbound too (ruled). Four moved this lane. **Mechanism beats recall: every figure I reported from RECALL was wrong; every prediction DERIVED from how the code fails was right.** - **Report the PATTERN with the count.** "Fifteen hits split four ways" was fifteen hits of ONE pattern, and a census inherits its pattern's blind spot into every decision built on it. My sweep pattern was built from the STRING being replaced rather than the PROPERTY being checked, so a cell asserting a SUBSTRING was invisible to it. - **A correction is a change and gets the same legs.** Fixing a wrong figure broke the TOML (treqs exit 2 = never evaluated, NOT 1 = incomplete). - **A false retraction costs more than the stale entry it fixes** — stale gets re-measured, a retraction gets believed. - **Prebuild fixture bins by cargo's enumeration** (`cargo build --workspace --bins`), never a list. - **A bare `cd` repoints every later read** — caught by a line number that moved (16004 vs 16300). Carry a known figure into a new context and see whether it survives. - Registry population, bin census, footprint and free space are all properties of an INSTANT or a TREE. Never stitch two instants into a trend. ## Venue split (operator-ruled) CI/test tooling debt → `docs/INFRA-REGISTER.md`, **doyle files it**, never alchemy. Product defects → the board via `alchemy create`, never bare `gh`. Test/CI rework (rig hardening, flake-proofing, repinning) → **hertz**, never the product builder. ## Open / next 1. **Lane 2 verdict** pending (red leg already confirmed at doyle's rig). 2. **Lane 3**: claim a pool, run the two checks, PARTITION findings by kind, report buckets first. 3. **hertz holds** the settle-assertion class: two victims found by sampling (`servicehost_supervision_e2e::the_published_stop_marker_...`, `daemon_e2e::daemon_hosts_lifecycle_and_survives_brain_restart`), each passing alone, the failing MEMBER VARYING between runs — that variance is what makes it a population, not a bad cell. At least two, discovered by sampling; do NOT extrapolate a count. 4. **W5 (#211)** after W4.