# TURNKEY W5 — #211 intra-node governance — JIT plan (todlando)

Design: `W5-211-DESIGN.md` **v2** (doyle), which SUPERSEDES v1 in full. Read it before this file.
Measured against the ASSEMBLED HEAD **2b855595** — not `origin/main` (still c62904e7) and not the
root tree (`fix/w3-comms-text` @ 6d399391). #209 rides the head as `54eee0a0` + `205c3440`, which
are ABSORBED picks: the lane shas `562599df` / `3421ebba` are NOT ancestors of the head. A brief
naming a sha is naming a tree — every figure below is a `git show` at 2b855595, never a working tree.

## STATUS

Measure-first pass 1 DONE, reported, **all six points RULED by doyle**. No pool, no claim, no build,
nothing committed. The box is doyle's for the composition gate on 2b855595. **Every cell is OWED.**

## doyle's sharpened question: IS THE DESIGN'S PREMISE STILL TRUE AT THE HEAD?

### Premise 1 — S3's stamping reaches the path the design assumes: TRUE

`gate.rs:587` `admit_local_delivery` passes `local_node_hex().unwrap_or_default()` as `origin_node`;
`access.rs:535` matches `Subject::Node{node} => node == req.origin_node`, a plain compare. An
own-node-subject rule matches local traffic through the EXISTING `first_match` path. The matching
half of the design needs no new machinery.

### Premise 2 — "dead, so it collides with nothing": deadness TRUE pre-S3, conclusion WRONG at the head

**(a) The spelling is LIVE, not dead.** Trace: `admit_local_delivery` → `access_check_with_sender`
step 4 → `store.decide` with `origin_node = me` and empty subnets → a `Node{me}` rule matches at
endpoint scope (tiers 1-3) or node scope (tiers 4-5) → `verdict.tier` is not `ImplicitOpen`, so
step 5's same-node bottom is skipped and the deny stands.
**The #74 shape:** effects (1) and (2) of the operator's ruling look DELIVERED ALREADY by #209's
code, with no W5 code at all. NOT ASSERTED — this is a read; the cell is what W5 owes.
doyle's addition, and it is the reason the cell matters either way: if they are already delivered,
they are delivered **WITH NO PIN AT ALL**. An undelivered feature and a delivered-but-unpinned one
look identical from the issue tracker, and only the cell tells them apart.

**(b) The collision is real and it is in the TEXT.** v1 is withdrawn in full, but v1's shape is
written into landed material at SIX sites, one of them a RATIFIED REQUIREMENT TITLE:

| site | text |
|---|---|
| `access.rs:1650` | `SLOT 3.5 — the intra-node surface tier (releases#211, NOT BUILT)`, tagged `impl->REQ-ACL-LOCAL-ORIGIN-TIERS` |
| `access.rs:1135` | Origin doc: the tier "must sit between the per-endpoint entries and the node tier INSIDE this function" |
| `access.rs:1157` | `Origin::LocalNode.sender`: "Nothing reads it yet: releases#211's intra-node tier discriminates by same-node SENDER" |
| `access.rs:4699` | unit-test comment, same forward reference |
| `gate.rs:243` | "makes releases#211's intra-node tier insertable at all" |
| `traceable-reqs.toml:7101` | `REQ-ACL-LOCAL-ORIGIN-TIERS` title: "slot 3.5 (rules) and its mode twin 6.5 are marked in `decide`", **and** "the mode twin will NOT abstain for local origin — refusing local traffic is that tier's entire purpose" |

The last clause decides the wording: **v2 keeps modes-only-abstain exactly as S3 built it, so there
is no mode twin at all** — that sentence is not merely stale, it PRESCRIBES BEHAVIOUR THE CURRENT
DESIGN FORBIDS, as doc-stage evidence for a LIVE requirement.
This is the enforcers-and-staters split: the ENFORCERS need nothing (v2 changes no mechanism), the
STATERS are wrong.

## doyle's rulings (2026-08-22) — all six

1. **Red-first commit APPROVED exactly as proposed.** W5's first commit is a witnessed red proving
   2(a) either way: an own-node DENY refusing a local MSG that passes without it. Green at base ⇒
   W5 is a pinning-and-teaching lane and the commit says so IN ITS OWN VOICE, the way Lane 3 did.
   **Do not manufacture mechanism to match the ticket.**
2. **Premise 2's split ACCEPTED as a correction to doyle.** His sentence was true when written and
   false by the time it mattered. **He rewrites v2's premise himself** — his text, his correction.
3. **v1 residue: correct by REPLACEMENT, not annotation. The REQ title is doyle's to author** — he
   will read the current title at the blob rather than word a ratified title from a quotation of it.
   **The five code/comment sites are mine, in W5's lane, only AFTER his wording lands, so all six
   move together and no commit leaves the tree half-corrected.** HOLDING.
4. **The ring/notify feeder does NOT ride W5.** Its own request, `alchemy create`, **BACKLOG**,
   operator triages it into a milestone. #212 is GREENLIT — adding surface needs a membership delta
   before anything is built. Lead with the SHAPE arm; the "forged subject" framing is overclaiming.
   ⚠ **CONSEQUENCE FOR W5, ruled:** v2's ladder rung 1 is a tier-1 SenderEndpoint rule — the exact
   rung that silently does not fire on notify. **W5's teaching states the coverage HONESTLY as it
   stands at the head, names notify as uncovered, points at the filed request, and DOES NOT WAIT
   for it.** Fix lands first ⇒ caveat drops, cell gained. Otherwise W5 ships a true sentence rather
   than an aspirational one. A milestone does not block on a request that is not in it.
5. **`widens()` acknowledgment: KEEP IT, TEACH IT.** A per-endpoint own-node ALLOW does admit every
   same-node sender to that endpoint, so "a grant admits the whole machine" is TRUE of the subject's
   breadth. But an operator writing a self-referential rule will read it as a warning about
   something else, so W5's docs teach that it fires here and WHY it is honest. Rendering and
   teaching only — **no change to `widens()`**.
6. **The empty-`origin_node` edge: WRITE IT DOWN, and it WANTS A CELL.** `unwrap_or_default` means
   an unprovisioned node hands in an empty `origin_node`; it still classifies `LocalNode`, but no
   own-node rule can name a hex that does not exist. **LOCAL GOVERNANCE IS IMPOSSIBLE BY
   CONSTRUCTION ON A NODE WITH NO `node.key`.** A design property, not a hole — and an unprovisioned
   node is exactly the state a first-run operator is in, so "the feature silently does not exist
   here" is a three-months-later bug report.

## The defect found BY W5's measurement but not OF W5's subject

ONE gate site, THREE feeders, disagreeing on **shape**, **provenance** and by **drift**:

| feeder | passes | provenance | shape |
|---|---|---|---|
| `cli.rs:10886` `spt send` | `session_proven_sender(...)` | session-proven; comment cites KNOWN-HAZARDS 7.5 by name | bare id, or `None` |
| `ring.rs:191` `spt ring` | `resolve_from(from)` (`cli.rs:10678`) | **explicit `--from` beats session detection** | bare id |
| `notif.rs:232` notify | `row.from_id` | `cmd_notify` RE-SPELLS `resolve_from`'s body inline; `--from` wins | **`{issuer}@{node_hex}` composite** |

**SHAPE LEADS (ruled).** `Subject::SenderEndpoint{id}` matches by equality (`access.rs:534`) and
bare is the ratified shape. So **a tier-1 rule for `ling` matches on send, matches on ring, and CAN
NEVER MATCH ON NOTIFY.** Accepted by the CLI, renders correctly, covers two of three verbs, fails
SILENTLY — the direction that never gets reported. No adversary required.

**WHERE THE DEFECT IS NOT:** `from_id` legitimately carries the composite FOR RENDERING (the
existing fixture at `notif.rs:1461` spells it `ling@nodea`). The bug is a **DISPLAY VALUE handed to
a parameter that is a SUBJECT**. A fix blaming `from_id` would break the rendering.

**DRIFT is the mechanism:** `cmd_notify` re-spells `resolve_from` inline, so the two diverge with
neither site looking wrong on its face. Remedy is "one spelling, one caller", not just "use the
proven sender". The tree already has it: `session_proven_sender`, `cli.rs:10731`.

**OPEN, and it stays OPEN in the filing:** `admit_local_delivery` also calls
`note_outbound(from, &me, now)` with the same string on an admitted send, so a reply window may be
recorded under a caller-chosen endpoint id. `note_outbound`'s consumers were READ, NOT MEASURED.

**BLOCKED ON FILING — routed, not worked around.** `spt shell cmd alchemy-0 create --help` returns
`NO_SHELL:alchemy-0: no such instance for todlando`; `spt shell list` shows one instance, PACER-0,
offline. alchemy-0 nests under deployah's perch. Filing it myself means reaching for another
holder's surface, so the complete filing body went to doyle verbatim for him to file or to route to
deployah. **Never bare `gh`.**

## Next, in order

1. **HOLD** for doyle's head-gate verdict on 2b855595 and for the box. My pool
   `.worktrees/w4-lane3/target` STAYS UP by his instruction until that verdict — he wants lane trees
   rather than a rebuild if the head reds.
2. **HOLD** for doyle's authored REQ title wording before touching any of the six residue sites.
3. **Then** W5 lane: worktree off the head, pool claimed from inside it, red-first commit
   (own-node DENY refusing a local MSG), then the pins, CLI sugar (`self` + node name → own hex at
   write time), rendering, degrade loudness, the unprovisioned-node cell, and the CONTEXT/docs
   amendment with the honest notify caveat.
4. New REQ minted registry-first — design suggests `REQ-ACL-INTRA-NODE-SELF`, stages
   impl+unit+int+doc. `REQ-ACL-LOCAL-ORIGIN-TIERS` keeps its existing scope.

## LANE OPEN — `fix/211-intra-node-self`, worktree `.worktrees/w5-lane`, base 2b855595

Head gate **PASSED** at 2b855595 with ONE named, characterised, non-lane red:
`daemon_e2e::daemon_hosts_lifecycle_and_survives_brain_restart` — in-sweep FAILED at position 1709
of 1825, **ALONE at the same tree 1/1 PASSED in 2.696s**. Six observations across two rigs, never
once failed alone; hertz's load-sensitive class; nothing on the head touches the daemon lifecycle
path. Not 1824/1825 dressed as green. If it appears in my sweeps, report it BY NAME with the
alone-run beside it.

`POOL_CLAIM_EXIT=0` — record reads lane `w5-lane`, branch `fix/211-intra-node-self`, base
`2b855595da36`, claimed from inside the lane worktree so the identity is the lane's.

**Lane 3 pool REAPED first** (its condition — "if the head reds I will want your lane trees" — was
discharged by the PASS): real directory not a reparse point, NO inbound reparse points anywhere in
the project tree, `CARGO_TARGET_DIR` empty, target SUBTREE only, worktree intact and verified after.
15,623 files / 12.84 GB measured; free **126.36 → 137.43 GB = 11.07 GB reclaimed**. Both figures
reported; the **1.77 GB gap is unexplained rather than smoothed**. Three pools standing, not four.

## ⚠ A CORRECTION OF MY OWN CLAIM — "delivered with NO PIN AT ALL" was WRONG

Found by READING the cells rather than reasoning about them. What is already pinned:

```rust
// access.rs, [unit->REQ-ACL-LOCAL-ORIGIN-TIERS]
s.node.rules.push(node_rule("beef", RuleDecision::Deny, &[surface::MSG]));
let v = s.decide(&req_local("ling", surface::MSG, "beef", &subnets, Some("doyle")));
assert!(!v.allow);
assert!(matches!(v.tier, MatchedTier::NodeScopeRule(_)));
```

So effect (1) is delivered **AND pinned at the `decide()` level**. "No pin at all" was a third state
I invented.

**What is NOT pinned is the half #211 is about, and the reason is in the helper itself.** `req_local`
(access.rs:2334) constructs `Origin::LocalNode` DIRECTLY with an ARBITRARY origin string — `"beef"` —
never `local_node_hex()`. It proves the chain governs a request *already* classified local whose
origin string a rule *happens* to name. The self-referential claim is a JOIN of two facts on opposite
sides of that helper: **(i)** the local path SUPPLIES THIS NODE'S OWN HEX as `origin_node`, and
**(ii)** therefore the string an operator WRITES is the one that matches.

**Measured across unit AND integration before claiming absence a second time: NO cell anywhere
constructs `Subject::Node { node: <own hex> }`.** `er_inbound_local.rs` writes a `SubnetWildcard`
DENY (the hole-punch negative — a different claim); `er_inbound_local_notify.rs` reads `node_hex`
only to address the delivery. **Effect (2) — per-endpoint own-node scope — has NO cell at any level.**

General form, second time today: **"unpinned" is a claim about a POPULATION**, and the first time I
asserted it from the population I happened to have read. An absence is worth only as much as the
sweep behind it.

## doyle's AUTHORED SPANS — all four + s19, to travel in ONE commit with the five code sites

- **s02** — replace the clause; **s03 KEPT VERBATIM** (under v2 it is the argument for why local
  traffic must reach `decide` AT ALL, since the existing rule tiers now govern it).
- **s05** — replaced, and the field's reason to exist SURVIVES and strengthens: v2 reaches the
  same-node sender through tier-1 + the S3 stamp, which needs the id AT the chain as part of the
  origin. The new text cites **#215** as the measurement that re-deriving per call site has already
  gone wrong three ways in the live tree.
- **s19** — "THE TIER'S SEMANTICS" → **"THESE SEMANTICS ARE NOT DECIDED HERE."** (one word; loses the
  dangling referent).
- **s20/s21** — as originally sent.
- **s22 GATE LINE** — the slot markers are removed from the impl evidence list, with the reason
  stated: *a marker describing an unbuilt tier certifies a design, not an implementation.*

**doyle's ruling on the orphaned tag:** `// [impl->REQ-ACL-LOCAL-ORIGIN-TIERS]` at access.rs:1660 is
the LAST LINE of the SLOT block, has NO evidence under it (blank line, then an unrelated comment),
and **goes WITH the block — a repair, not a loss.** A tag anchored to a withdrawn design makes
coverage read as satisfied by something that does not exist, and `traceable-reqs check` counts tags
and cannot see what they point at. Coverage survives: impl at 1124, 1138, 1691; unit at 4636, 4694.
**Report the treqs count after the edit, never predict it — 804 at the head is the number to move
from.**

## ✅ COMMITS 1 AND 2 LANDED — box handed back to doyle for gate-212-ee90ec00

Lane `fix/211-intra-node-self`, worktree `.worktrees/w5-lane`, base 2b855595, **tree clean**:

| sha | commit |
|---|---|
| `ecd1dc94` | test(access): a rule naming this node's own id governs traffic authored here |
| `1c8abcbc` | docs(access): the tier that was never built stops being promised in six places |

Both trailers verified **BY RAW BODY READ** and `--grep`, never `%(trailers:)`.

**THE CELL WENT GREEN AT BASE** — `Starting 1 test across 1 binary`, 1 passed, 0 skipped. So #211's
two ruled effects were already satisfied by #209's code. W5 is a **pinning-and-teaching lane** and
the commit says so in its own voice.

**BOTH REDS WITNESSED FIRING, two assertions each** (mutation landed + read back OUT OF THE FILE,
then the cell refused); both reverted **byte-identical**:
- **RED A — the join.** `gate.rs:588`, `local_node_hex().unwrap_or_default()` → literal hex.
  MATCH_COUNT=1, exit **100** at arm (b), message carrying the real subject and
  `stderr: QUEUED:governed-target` — the send was ADMITTED because the path no longer stamps the hex
  the rule names.
- **RED B — DISCRIMINATING, not blunt.** `decide`'s per-endpoint tier starved with an empty slice,
  `NODE_TIER_INTACT=True` asserted **in the same script**. Exit **100** at arm (c) line 305, having
  **PASSED arm (b) at line 278**. That is what separates "the cell notices damage" from "these are
  two independent claims". doyle banked the general rule as
  `a-mutation-that-reds-every-arm-proves-only-damage`. ⭐ **The thing that made it work was asserting
  the UNMUTATED half in the same script** — without that line the discrimination has to be argued
  rather than shown.

**Commit 2 legs:** APPLY 0 (10 anchors, each required to match EXACTLY ONCE, all read back) · TREQS 0
(805/805, `REQ-ACL-LOCAL-ORIGIN-TIERS` still `+impl +unit`) · STORE 0 (Starting **525** across 4
binaries, unfiltered, 525 passed) · CELL 0 · CLIPPY 0 (0 lines matching `^(warning|error)`).
Diff 3 files / 38 insertions / 23 deletions — checked, so the CRLF warning did NOT land as churn.
Tag count in access.rs **4 → 3**; treqs count did NOT move, as doyle predicted from the other side.

**THE REFUSAL ARM EARNED ITS KEEP TWICE.** First run REFUSED with 3 of 10 anchors at zero:
an anchor **retyped from memory** ("what to put there" for the source's "what to put **here**"), and
a **dash glyph** that had not survived plain-text transport (the toml uses U+2014; doyle's message
carried `--`). Normalised the glyph — transport, not wording — and flagged the moved byte to him.
On a partial match the tree would have been **half-corrected and green**.

## ⚠ RETRACTED BEFORE IT WAS FILED — the "harness reported exit 0" near-finding

doyle held it rather than confirming it, and he was right. Measured, minimal:

```
( exit 100 ); echo $? > probe.exit; FINAL=$?
leg status captured to file : 100
wrapper's own final status  : 0
```

My wrapper is `( cd <lane> && cargo … > leg.raw 2>&1 ); echo $? > leg.exit` — the **last command is
the capture**, which succeeds, so the wrapper genuinely exits 0. **The harness told the truth about
the wrapper.** Not a harness defect; nothing to file against it, and I would have filed it.
Third shape in one family, all with the same trigger — *am I about to quote this?*: a truncation
pipe, a flattened `$?`, and now **a wrapper whose last command is the capture itself**.

## Commit plan

1. **Commit 1 (in flight):** `crates/spt/tests/intra_node_self.rs` — the JOIN, four arms (control
   admitted → node-scope own-node DENY refuses → per-endpoint own-node DENY refuses with the
   node-scope rule CLEARED → the subject asserted EQUAL to the minted identity). Each rule read back
   OUT OF THE STORE by match count; each refusal asserted to have spooled NO row. REQ
   `REQ-ACL-INTRA-NODE-SELF` minted registry-first, `required_stages = ["int"]` — **only the stage
   this commit delivers**, widened by the commits that deliver the rest (rule 5: activate, don't
   pre-fail).
2. **Commit 2:** the four title spans + s19 + the five code/comment sites, together.
3. **Then:** CLI sugar (`self` / node name → own hex at write time), rendering, degrade loudness,
   the unprovisioned-node cell, CONTEXT/docs with the **honest notify caveat** naming #215.

## COMMIT 3 (CLI SUGAR) — AUTHORED, NOTHING COMPILED

Head moved to **19fb90b7** (doyle filed IR-60 as a docs rider); W5 picks onto that, not ee90ec00.
Box is doyle's for the composition gate, so none of the below has been run. **Authored ≠ working.**

**Seam census first (#185's rule).** SIX `--node` flags declared → FOUR `tuple_mutation` callers →
ONE composer `build_access_rule`. Sugar resolves in `tuple_mutation`, **not** in the composer, because
the composer's doc is a CONTRACT — "Pure — no store, no terminal — so every refusal below is
unit-testable" — and resolving `self` is I/O. doyle approved: same class as the tag anchored to
nothing.

**⚠ THE POSITIONAL SPELLING IS A SECOND SEAM, and it nearly shipped a lying message.**
`spt endpoint access allow <endpoint> <node>` and its revoke twin reach `build_access_rule` via
`positional_allow_mutation` / `s.revoke(..)` — they **never cross `tuple_mutation`**. The refusal text
is SHARED, so the positional spelling would have refused `self` **using the message that recommends
`self`**. Found by grepping `ACCESS_BAD_NODE` while checking my new wording wouldn't break an
assertion — not by assuming one seam. Fixed by censusing: three occurrences of
`let node = node.to_lowercase();`, **two** are positional arms, the **third is inside the pure
composer and must stay a fold with no I/O**. Rewrite targeted exactly two and asserted the third
survived (`call sites: 2`, `pure fold present: 1`, both read back out of the file).

**Shape:** one PURE resolver `resolve_node_subject` (input, own_hex, by_name) · one I/O supplier
`resolve_node_spelling` (`load_existing`, **never** `load_or_create`) · two call shapes because the
product has two verb shapes · composer still pure.

**Spelling order is ruled and pinned:** 64-hex **first** (a directory entry can never shadow a
spelled-out identity) → reserved `self` (a node *labelled* `self` must not shadow it) → node name.

**The inverse directory is NOT a map inversion.** A label is a LEASE — two machines can hold one — so
`roster_node_hex_resolver` returns a **SET** and an ambiguous name **refuses with the candidates in
hand** (`ACCESS_AMBIGUOUS_NODE`). Built from the SAME `node_label_map()` the renderer uses, split out
so the two directions cannot drift. doyle's framing for the commit body: gossip labels are
stale-tolerant *by contract*, so a name is a convenience over an identity, and a convenience that
silently resolves to the wrong subject fails in the direction nobody reports.

**`--node self` on an unprovisioned node REFUSES, never mints.** doyle's third reason makes it
precedent: #210's resolver already reads `load_existing` so that *rendering* cannot mint — a lane
that minted on write while its sibling refused on read would leave two halves of one feature
disagreeing about what a node identity is.

**Refusal texts teach the DO, with verbs read off the clap declaration, not memory** — my draft said
"joining or creating a subnet" with no verb; the declaration gives `spt subnet create <name>`,
`spt subnet join`, `spt subnet status --nodes`. `ACCESS_BAD_NODE` now names all three spellings.

**Unit cells:** eight arms, literals written out, every arm runs with no identity on disk and no
roster (the resolver is pure by construction).

**REQ widened** to `["impl","unit","int"]`. ⚠ The widening created a stale sentence in its own
activation comment (still said impl/unit "are activated by the commits that deliver them" *after*
they were) — caught and rewritten; doc is the one stage still owed.

**OWED, and stated so neither of us finds it at the gate:** nothing is compiled; and six clap doc
comments changed, so **`xtask gen` is owed** and the docs-drift gate reds until it runs.

## ✅ LANE-3 FIXUP — the spacerun test-module latch. COMMITTED `21b5c5d4`

Ruled to run BEFORE W5's legs, on a measurement not a preference: **W5's four new refusals sit at
cli.rs 15134–15213 and the latch was at 2934**, so W5-first would not have made the census over W5's
text late — it would have made it **never happen**.

Ran in doyle's rig `.worktrees/gate-w4l1-1c0d435c` (granted; warm 90.87 GB pool, claim built in
11.59s). He named the property he gave up — a gate run in the author's tree — and holds it down by
re-gating at the committed sha after `git checkout --detach` with porcelain asserted empty.

**The defect:** the first repair fixed the INSTANCE (an indented marker tripping the latch) and left
the PREMISE — a comment I wrote saying "a column-0 marker opens the test module that runs to the end
of the file." A structural claim about the codebase, never measured, false in cli.rs (EIGHT column-0
modules, first at 2934). **Fix:** skip the module by brace depth, string-aware, and resume.

### ⚠ THE FIGURE, and the correction runs AGAINST my own repair

| | |
|---|---|
| 88,042 | lines after the first latch — **the number not to quote alone** |
| 66,637 | trailing test-module bodies, out of scope under BOTH rules |
| **21,405** | **production lines the latch actually hid**, in SIX files |

cli.rs 19,918 · pump/mod.rs 1,184 · main.rs 159 · lib.rs 100 · conn.rs 43 · seedproofx.rs 1.
`broker.rs`'s "5,110" is exactly 13,357 − 8,247 — its own trailing test module. **The latch cost it
zero**, which is why all seven findings are in cli.rs and why no daemon mutation was worth running.
doyle's ⚠ was aimed at a population that does not exist; he withdrew it.

**I quoted his 88,030/54.4% into a source comment without measuring it — an hour after correcting my
own "80% of broker.rs" for the identical conflation.** A figure arriving with someone else's
authority gets TYPED, not checked. Both copies corrected in the commit.

### Census: A = 0 · B = 7 · C = 0

Verified against SOURCE, not the rendered line — **a rendered run is the symptom, the join is the
defect**. cli.rs:11986 discriminates: continuations all present, run after an explicit `\n`, nothing
mid-sentence. 6 markers, 4 tokens (`aligned-field-column` 3 · `command-annotation` 1, reusing Lane
3's token · `remedy-column` 1 · `table-header-column` 1).

### ⭐ MARK-ONE-THEN-DIFF found the SIXTH instrument defect

Marking 11986 first left the count at **SEVEN**, site shifted 11986 → 11988. **The marker exempted
NOTHING.** `opted_out` returned on the first non-blank line, so a marker on any but the LAST line of
a multi-line comment was inert — present, greppable, correctly spelled, doing nothing, arriving
through the *placement* rule rather than the token rule. Fixed to walk the contiguous comment block.
Then 7 → 6 (one removal, **nothing added**), 6 → 0 (six removals, nothing added).
A re-run comparing **totals** would have read "still 7" and marked five more sites into an inert
hatch. doyle banked it as `an-exemption-must-be-witnessed-subtracting`.

### Three witnessed reds, each two assertions, each reverted byte-identical

- **doyle's treatment** — eaten continuation into #206's ACCESS_LOCKED composer, located **BY
  CONTENT** (my markers moved it 18950 → 18958): exit **1**, site named, run 10. *The site measured
  blind is no longer blind* — the control that actually proves the repair.
- **literal-blind** (`match lit` → `match Lit::None`): brace cell fails ⇒ the skip consults a tracker.
- **raw-arm only**, `NORMAL_ARM_UNTOUCHED=True` asserted: brace cell fails ⇒ the two trackers must
  AGREE about a form. Both cell reds cancelled at first failure (70 of 75 ran) — **nothing claimed
  about the 5 that didn't run.**

**Two trackers now live in the module and the doc says so**; unification filed as **IR-61** (doyle's,
not mine). Legs: CELLS 0 (75/75 unfiltered, 71→75) · XTASK CHECK 0 · CLIPPY 0 · TREQS 0 (806/806).
Rig handed back porcelain-clean, **pool unreaped**.

**Head moved again to `f62693bf`** (35 commits; IR-61 as a docs rider). Lane base 19fb90b7 is one
behind, docs-only, no overlap.

## ✅ AMENDMENT `7e208529` — the FIFTH stater, and a sixth found in doyle's ledger

doyle's re-gate PASSED 21b5c5d4 on every leg (75/75 unfiltered · xtask check 0 · clippy 0 · treqs 806
· **STALE_FIGURE_HITS 0** tree-wide) and he re-ran **his own treatment probe with his own instrument
in my tree** rather than accepting my report of it — exit 1, site named, revert byte-identical. He
spot-checked three of seven markers against source, 11986 first.

**He held the pick on a fifth stater I missed:** `REQ-DOCS-NO-INTERIOR-SPACE-RUNS`'s activation note
still carried the pre-repair census (A=0 · B=11 · C=0 · 10 markers) *and* the reach sentence, and
`traceable-reqs.toml` was not in the lane diff. **Doc-stage evidence for a live requirement stating a
census the same lane disproves** — #213's discriminant: a sentence a lane's change falsifies at the
instant it lands rides that lane.

**Why my sweep missed it:** I greped for sentences stating a **REACH**. This one states a **COUNT**.
*Different sentences go stale on different triggers* — and the same trigger-split turned up a sixth:
spacerun's token doc read "seven markers as seven instances of ONE decision" where `remedy-column` is
now eight.

**The amendment keeps BOTH passes** rather than overwriting the first: the first census was not wrong
about what it measured, it was measured under a defective reach, and deleting it erases the reason the
second exists. First A=0 B=11 C=0 (10 markers, under the latch) · second A=0 B=7 C=0 (6 markers, 7
runs) · **totals A=0 B=18 C=0, 16 markers over 5 tokens**. Arithmetic **re-derived from the tree**,
not taken from doyle — it agreed.

### ⭐ doyle's ledger finding — the mechanism, his words

He corrected his 88,030 figure **where it was STATED** and left it standing **unqualified at both
places it was USED**, inside the ruling text. *A figure gets corrected where it was stated, because
that is where the correction feels owed, and survives everywhere it was used, because a use does not
look like a claim.* **The used copies are the dangerous ones — they are the instructions somebody
executes.** Correcting a number is a SWEEP, not an edit. He also noted he wrote the tree-wide grep
into his gate script and never pointed it at his own ledger.
A figure appearing as the **subject of its own correction** is the one legitimate survivor — which is
why his line 1541 and my JIT's line 354 both stay.

### And a false sentence of mine, measured rather than conceded

I claimed W5's refusals were "judgeable for the first time" and proposed running W5's legs next.
Measured: `.worktrees/w5-lane/crates/xtask/src/` holds bench/binedge/main/perjob — **`spacerun.rs` is
ABSENT.** Not a weaker instrument: a tree where the instrument does not exist, and nothing in the
output would have said so. Right claim, wrong moment. Sequence is: re-gate → pick → move W5 onto a
head carrying the fix → *then* its legs measure something.

## THE REUSABLE RULE FROM THIS PASS — named here on doyle's instruction, not left as a footnote

**A measure-first pass tests the DESIGN's premises, not the TICKET's claims.** The ticket does not
know what the design assumed, so a pass that only checks the filed instance finds none of this.

Two things make it a rule rather than an anecdote:

1. **Split every premise into MECHANISM and CONCLUSION, and measure them separately.** Premise 2's
   mechanism (the spelling was dead pre-S3) was TRUE; the CONCLUSION drawn from it ("so assigning it
   meaning collides with nothing") was FALSE at the head. Reporting "premise 2 holds" would have been
   true of the half nobody needed.
2. **When a premise says "collides with nothing," ask WITH WHAT POPULATION.** That was a claim about
   BEHAVIOUR; the collision was in the **RECORD** — six landed sites, one a ratified REQ title that
   prescribes the purpose of a tier the operator deleted. Census the STATERS, not just the enforcers.

A design premise is true when written and goes false against a moving head, while the design document
does not move with it — the [[stale-carried-forward-sentence]] shape, sitting in the document that
AUTHORISES the work. doyle's v2 premise was his own text and he corrected it himself; the ratified REQ
title is likewise his to word. Filed to memory as
`measure-first-tests-the-design-premise-not-the-ticket`.

## Discipline carried in (do not re-derive)

- **Read source at the MEASURED sha.** The root tree is a DIFFERENT tree from the head.
- **A grep pattern built from the STRING and not the PROPERTY lies:** `6.5` collided with
  KNOWN-HAZARDS 6.5 across ~25 unrelated rows before I re-scoped to the REQ id.
- **An inconclusive verdict is a WORK ITEM discharged PER ITEM.** `row.from_id` was filed OPEN and
  then discharged, and discharging it turned a finding that needed a boundary argument into one
  that needs none. `note_outbound`'s consumers stay OPEN and say so.
- **Refuse the flattering version.** "Forged subject" was available and is overclaiming against a
  boundary we published ourselves; a filing that overclaims gets triaged on its overclaim.
- **A filtered run reports its SET SIZE, asserted before the verdict.** A purposeful red needs TWO
  assertions: the mutation LANDED (match count == 1, body read back OUT OF THE FILE) and the gate
  then refused; revert byte-identical from a pre-write backup.
- **No literal backslash in a mutation script** (doyle's remedy, stronger than my delimiter-file
  one): this shell collapses one backslash level through a heredoc EVEN WHEN QUOTED. Assemble from
  `chr(92)` / `chr(10)` / `chr(0x2014)`.
- **`EXIT=$?` after a truncation pipe measures the TRUNCATOR.** Capture-first for anything that
  becomes evidence.
- **Free space goes in the FIRST LINE of any build-failure report.** Never two builds on this box.

## ✅ COMMITS 4 AND 5 LANDED — lane @ 46aa46f7, gate report sent to doyle

Resumed 2026-08-22 21:00 after ~17h idle (account-profile swap; commune brief held, memory index
stale — ground state re-derived from TURNKEY-212-JIT tail: W5 UNBLOCKED at base c492c7a6, lane
already rebased with commits 1-3 re-picked as a5ff53f5/e8e41ee3/27e5330d).

| sha | commit |
|---|---|
| `d7d02677` | docs(access): intra-node governance is taught, and the taught spelling is held |
| `46aa46f7` | test(access): the chain semantics the ruling names — order, specificity, twin, reply |

**Commit 4** = doc stage (CONTEXT vocab · access-viewing with the #215 notify caveat · toml doc
activation, went-false stater rewritten in the same commit) + the row-34 help pin over all SIX
`--node` sites via `rendered_help_at`. Pin hardened before first fire: `contains("self")` was
vacuous against "itself" — anchored to the exact taught phrase. Red witnessed 7→6 (7th occurrence
= ACCESS_BAD_NODE's own teaching, deliberate), exit 100, byte-identical restore. Legs: bins
663/663 · store 519/519 · int 1/1 · clippy 0 · treqs 807 · xtask check OK · `xtask gen` ZERO
generated drift.

**Commit 5** = design cells (c)/(d)/(f) at `decide()` + (e) as the int cell's LAST arm (deny read
back standing; the send arm (c) refused admitted as a correlated reply and LANDING — row count,
not silence; window is node-granular and durable, hence last).
⭐ **FOUND BY THE FIRST RED — helper, not product:** `req_local` carried the proven sender only in
`Origin::LocalNode` while the chain hands it to `sender_endpoint` TOO (gate.rs:317), so cell (d)
refused a sender the real chain admits. A helper that mirrors the chain INCOMPLETELY makes a
tier-1 cell unmatchable for a reason the product does not have. Fixed at the helper with the why.
REDS both discriminating: RED C (endpoint tier starved, NODE_TIER_INTACT asserted in-script)
killed (c)+(d) and held (f)+the local-origin cell; RED D (note_outbound severed) passed arms
(a)-(c) and failed exactly at the reply arm. Dead-spelling sweep NEGATIVE with its population
named. Legs: store 522/522 · int 1/1 · er_inbound_local 1/1 + notify twin 1/1 (cell g) ·
clippy 0 · treqs 807.
⚠ First er-pins leg mis-addressed the notify twin's package (`-p spt` — it lives in spt-daemon);
nextest refused loudly, re-fired correctly. A refused leg is not a red.

**OPEN, doyle's to rule (sent in the gate report):**
1. **Cell (i) degrade loudness — design premise has no read.** "Own-node entries exist in the
   husk" cannot be read: a husk IS the empty substituted document. Local-degrade arm
   (gate.rs:286-288) allows silently today. Options offered (unconditional loud line / raw-byte
   search of the damaged file / once-per-process); NO code until ruled.
2. **Cell (j) render half** — nothing new to pin found (#210 machinery + commit-3 pins cover it);
   rendered text is his at gate; dedicated own-node render cell only if he wants it.

Field sample banked: unprovisioned `--node self` refuses in the real binary with the taught
remedy verbatim (ACCESS_NO_NODE_IDENTITY).

## ✅ COMMITS 6-8 LANDED — LANE COMPLETE @ 4eea8051, handed to doyle's gate

doyle's rulings on the two open items arrived and were built same session:

**(j) render half** — his measure-first question answered NO (no cell anywhere touches the real
supplier's own-hostname arm; every #210 cell injects a closure), so the ONE dedicated cell landed
as the int cell's last arm (`2f062b4f`): rule written via `--node self` (DENY deliberately — a
node-subject ALLOW is a widening and takes `--admit-node`), drill renders `node:<own name>`
through `roster_node_label_resolver` with the expectation read independently from `os_hostname`.
Render rule pinned both directions (no hex residue once resolved, never the word `self` in
output) + one clause in access-viewing. RED J discriminating: own-hostname insert severed,
ROSTER_ARM_INTACT asserted in-script, cell failed exactly at the node:<name> assert.

**(i) degrade loudness** — doyle RESTATED the condition first (his design sentence had no
referent — "entries in the husk" quantifies over a document empty by construction; third instance
of that class on his side, banked). Ruled option (a): the line fires on EVERY admitted local
delivery under degrade, churn deliberate, cadence named in the line. (b) rejected — the raw-byte
proxy fails toward quiet exactly when the unparseable region might hold the rule. (c) rejected —
once-then-silence reads as recovery. Built two-commit: `3f98b4a7` cell RED witnessed against the
silent arm (strongest shape: deny witnessed ENFORCING healthy → bytes corrupted → degrade READ
BACK from load_checked → send ADMITTED with row landed AND failed exactly at "must carry the loud
line"); `4eea8051` the product line green — ACCESS_STORE_DEGRADED_LOCAL with unreadable+path
(AccessDegraded Display, one voice), LOCAL TIER ENFORCEMENT SUSPENDED, own cadence, and
husk_write_refusal's remedy vocabulary.

Final legs at tip: degrade 1/1 · self 1/1 · store 522/522 · bins 663/663 · ER twins 1/1 + 1/1 ·
clippy 0 · treqs 807/807 · xtask check OK. Tree clean, pool held per doyle's instruction; he rigs
his own after df. Tip + branch report sent.

**Craft this stretch:** a leading `grep && cat-heredoc` chain silently skipped the script write
when the grep found nothing (exit 127 on a file that never existed) — split evidence-plumbing
from measurement; a chain's guard must never guard the WRITE of the instrument.

## ✅✅ W5 GATE-APPROVED @ 4eea8051 — ASSEMBLY HEAD FF'D, ALL TWELVE MEMBERS GATED

doyle's verdict 2026-08-22 ~22:03: all legs green (red-i history exit 100 at 3f98b4a7; tip cells
1/1 BY NAME; store 522/522; bins 663/663; clippy 0; treqs 807; xtask check OK — the repaired
reach judged W5's four refusals and passed them). Assembly head FAST-FORWARDED to 4eea8051,
45 commits off c62904e7 — tested sha == head sha by construction. His two slips, his record:
first notify leg ran -p spt (vacuous, re-ran in spt-daemon — same slip I made in my c5 legs) and
one EXIT read after a tail pipe.

Close-out is doyle's (fulfillments, composition record, deployah hand-off). MY DESK IS CLEAR this
milestone — standing by for golden-red triage only. w5-lane pool RELEASED and REAPED (classified
first: real dir, no inbound reparse points, CARGO_TARGET_DIR empty; 42G measured, subtree only,
worktree verified after).