# KEYSTONE-182-JIT — milestone intake (releases#182, GREENLIT)

Intake 2026-08-18, doyle. Base: main @`8248bc3` (50cbc23 + deployah's IR-46 docs ff, landed
mid-intake; lanes branch from 8248bc3 or later). Members read live off
sub_issues API: #166, #57, #85, #84, #161, #185, #165, #179 (all GREENLIT). #182 body is a bare
milestone shell — content lives in the members; greenlit-form check at golden-head intake runs
against THIS member list.

## Composition rulings executed at this intake (register header @50cbc23 mandated all four)

1. **IR-9 pin lane → hertz (dispatched).** `rust-toolchain.toml`, `channel = "1.96.0"` + confirm
   nothing in CI or pool machinery keys on the box-default toolchain path. Interim stands:
   kitsubito clippy leg authoritative until the pin lands.
2. **IR-21 remedy(2) + IR-39 helper vs `f24e732` — DISPOSITION: f24e732 is a beachhead, not the
   class close.** It delivers the golden.yml prebuild step (the "explicit documented prebuild made
   a rule" arm of remedy 2), ONE fail-fast site (engine_room_bringup_e2e names missing
   mock-session), and a FLAKE-LEDGER row. Land it in hertz's lane — **after rebasing off its
   parent `b483699`**: that parent is deployah's freeze-held docs commit carrying the id-colliding
   IR-42 row (ruled today: deployah renumbers to IR-46 and lands fresh on main; hertz's branch
   must not re-introduce the stale body). Remainder of the class — IR-39's SHARED precondition
   helper (fixture_bin.rs shape, names exe + recipe; sweep the 24 sibling_bin copies) and the 33
   cross-package build-edge expressions — folds into the test-hygiene lane below.
3. **Test-hygiene family lane — DECIDED: activated as a dedicated hertz lane inside the KEYSTONE
   window,** sequenced after IR-9 pin + f24e732 + #84/#85. Members: IR-13 (mutation-proof loop),
   IR-23, IR-36 (output_bounded hoist), IR-37, IR-38, IR-21 clarity half (11-site CARGO_BIN_EXE
   conversion — clarity, NOT a build fix), IR-39 shared helper, twohost.rs:394 misleading doc
   comment repair.
4. **First-execution-cells discipline is BINDING at golden-head intake** (amended RELEASE-RUNBOOK):
   before the golden run, name every never-executed cell (denominator-one discipline). Written
   into the gate step below so it is not re-derived at assembly time.

## Wave map (JIT: W1 concrete, later waves sketched, re-planned at each gate)

### W0 — hertz parallel lane (no W-dependency; dispatch split rules test/CI work here)
Sequenced inside the lane:
1. **IR-9 pin** (above).
2. **f24e732 rebase + land** (above; thin lane).
3. **#84** — dead `knock_exempt` seam: remove the unreachable parameter; repin the vacuous
   offline-refuses-knock arm to pin knock-traffic-never-consults-the-lock AS design; amend
   ADR-0052 §3 wording (knocks ride the daemon-owned knock family). No behavior change — any
   behavior question stops and refers.
4. **#85** — `seam_agrees_with` pins acceptance not content: single-source cmd_knock_approve's
   rule builder (behavior-neutral extraction, cli.rs no longer DOORBELL-hot), assert rules LANDED
   IN THE STORE against the form's prescription, correct the docstring. Both halves required.
Then: **test-hygiene family lane** (ruling 3 above) as its own dispatch once 1–4 land.

### W1 — todlando, access-gate correctness triple (CONCRETE — dispatched)
REQ mints ride the W1 build PR (registry-mints-ride-build-PRs).
- **T1 #166 reply exemption inert.** Wire `note_outbound` (access.rs:413) into the daemon's
  outbound WAN send leg — the one seam all sends cross. Int test = REAL cross-node send, reply
  passes a CLOSED gate with `PassReason::ReplyExemption` (the join, not the parts). Kin sweep:
  audit other exemption/correlation producers for callers before trusting their tests.
- **T2 #57 RMW husk rewrite.** Mutation paths (cli.rs 11030/11040/11062/9590,
  api/engineroom.rs 371/389 at the filing sha — re-locate at tip) adopt the NotFound-vs-corrupt
  split: corrupt REFUSES mutation loudly naming the store path (ADR-0053); only genuine NotFound
  mints-on-first-load. Decision-table units incl. husk-refuses-mutation +
  RMW-preserves-existing-rules. Correct the stale module-doc caller census (~26 → 51).
- **T3 #185 positional drops --surfaces.** FIRST STEP IS THE RUNTIME REPRO — the finding is
  read-derived at @27d40b9, not yet runtime-measured. Then: refuse positional+--surfaces
  coexistence loudly OR honor the list — never drop silently. Lane confirms which.
- **Gate (doyle):** standing shape — isolated worktree under `.worktrees/`, pool-claim from the
  lane's own worktree, targeted suites + consumers of changed predicates, clippy preflight,
  `traceable-reqs check`, kitsubito leg inside golden per ADR-0050. Open GATE-TEST-INDEX.md at
  first rig touch.

### W2 — todlando, #161 multi-subnet sealed-code mint (GROUNDED 2026-08-18, rulings issued)
Ratified design (cross-node redemption grill 2026-08-01 + operator restatement 2026-08-04):
`--subnet` takes a LIST; omitted ⇒ seal for ALL memberships (multi-envelope, ADR-0054 sketch
line 17, ~+22B per extra envelope = exactly ENVELOPE_LEN, concatenation in one string).
`KNOCK_WHICH_SUBNET` refusal dies with its copy (filed :15278 STALE; chooser is
knock_code_subnet_choice ~15690-15719 at c45f4b0). CONTEXT.md sealed-code entry gains the
mint-side UX (doc stage rides the build PR).
GROUNDING (todlando, at c45f4b0, population stated — five prod sites: codeseal.rs 1-263 codec,
cli.rs chooser + :17253 seal call + ~1146 arg decl, wansend.rs :1521 redeem_route open_among;
four test sites incl. cli.rs 26591 assertion that dies). Structural: secret drawn ONCE, record
keys on it ⇒ multi-envelope seals SAME secret under N keys, store shape unmoved, SIV freshness
holds (differing keys).
RULINGS (doyle 2026-08-18, recorded on #161): (A) operator ALL-default STANDS (supersedes
ADR-0054 clause 3; premise stated: restatement was a considered supersession — falsifier is the
2026-08-04 record showing N-1 never in view, then it goes to operator); remedy = mint-side
N>1 print naming the N-1 consequence; ADR amendment in marked-not-struck voice states the N-1
silent arm; NO fleet version floor pre-ship. (B) envelope-count disclosure ACCEPTED AND STATED —
CONTEXT.md qualifier: reveals how MANY memberships, never which; padding rejected (length
budget). (C) open_among exit condition becomes ROUTED not opened — prefer first opening that
resolves a route; tie broken by PINNED subnet-name lexicographic order, written into the REQ;
safe: short key = minter's node key, every routed opening reaches the same node.
FIVE never-executed cells NAMED for golden hand-off: (1) N>1 open path (denominator one),
(2) two-subnet simultaneous opening (needs two-seed fixture; SEED_A/B anti-cross-open stays as
negative pair), (3) prev-seed × multi-envelope (2N combinations), (4) cli.rs:26591 assertion
REMOVAL (suite shrinks by one, stays green — declared so the delta is accounted), (5) length pin
codeseal.rs:291 needs a multi-envelope sibling. BUILD DISPATCH FOLLOWS W1 VERDICT.

### W3 — todlando, engine-room education (#179 + #165; sketch, re-plan at W2 gate)
Skeleton RATIFIED (operator-approved 2026-08-17, two amendments applied) — `ER-SKELETON-DRAFT.md`
in repo root is the doc artifact; it rides this lane's build PR. Pre-ruling on the #179/#165
split: the skeleton is the FIRST-OUTPUT contract; its static sections (seat, rule tiers, control
surfaces, discipline) source from #179's immutable in-core default `live-role`; dynamic sections
(posture, empowerments, current rules, pending deltas) stay composed at admit (briefing spool,
posture-passed-in ruling survives). #165's clarifying-question discipline is skeleton §Discipline
— a lane test should pin the role text serves from the static value (immutable: no role-editor
write path reaches it).

## Golden-head intake (when waves land)
Assemble golden head off main, compile-gate + traceable-reqs check, NAME THE NEVER-EXECUTED CELLS
(ruling 4), verify greenlit form vs this member list (drops relocated-or-back-to-eval, never
dangling), hand to deployah.
ASSEMBLY CHECK (added 2026-08-19): run `xtask binedge-check` on the ASSEMBLED head — expect 0.
At W2/W3 lane tips it exits 1 with 12 RED cross-package fixture-bin sites (todlando measured
@e99633f) = W0's predeclared remainder; the fix rides the hygiene lane @6b484c5, so green is an
ASSEMBLY property. A count other than 12-before/0-after is a finding, not noise.

## Queued behind intake (not KEYSTONE scope — do not fold in)
Four-arm refusal eprintln lane (hertz-class, after W0); #194 operator brief (NEEDS-OPERATOR);
:1198 ledger row; hygiene — gate-b05fea8 orphan dir retry, stale-lane .worktrees audit
(nameplate-* classify ownership first). pump-188 diag retirement word DELIVERED to todlando
2026-08-18 (retire heartbeat/honest-er-session/w7-courtesy-barrier/w8-redeem-dup; HOLD
w9-redeem-echo @4828ad0 = #181 gate-record convergence witness).
Deployah lands IR-46 (id-collision renumber, ruled today) independently. #195/#194/#191/#192/
#189/#190 stay on their own board tracks. CONCIERGE #183 is a separate greenlit milestone —
not this intake.

## Wave status (live record)
- 2026-08-18 W0 GATED: PASS @728e1e2 (doyle). Pin proven in-rig (1.96.0); f24e732 cherry-pick
  fidelity = one declared delta (:1150 row retirement, the fix's own subject), b483699 dropped;
  #84 behavior-preserving by visibility, decision table + dispatch classifier repinned, ADR-0052
  §3 aligned; #85 single-source knock_approval_rules + landed-store content assertions, builder
  equivalence case-analyzed. Mechanical (doyle's own runs, agent-env-scrubbed isolated rig):
  daemon focused 44/44, spt knock 19/19, workspace clippy -D warnings clean, treqs exit 0,
  binedge remainder 12/12 untruncated == predeclared, mock-session declared. Pool released,
  rig removed. hertz briefed on the test-hygiene family lane (IR-13/21-clarity/23/36/37/38/39
  + twohost.rs:394) — his sequencing.
- 2026-08-18 W1 T1 (#166) LANDED ON LANE @535a273 (todlando report, not yet gated — wave gates
  at W1 close). Seam wan::request_wan chokepoint; three provable fields (sender_proven,
  conn.remote_id_hex via NetDialed signature, custody-confirmed set wildcard-free); kin sweep
  note_outbound-only-inert; 3 negative controls, #3 caught+fixed a lockstep tautology
  (independent CUSTODY_TABLE now asserted against predicate AND write); twohost int rung
  AUTHORED-NOT-RIG-PROVEN (NAMEPLATE precedent) — RIG-PROVE AT W1 GATE. Mint
  REQ-SEC-REPLY-EXEMPTION-SEND-LEG (impl/unit/int, no doc). T2 line numbers re-located at tip
  (filed ones all stale). T2 next, then T3 (#185 runtime repro first).
- 2026-08-18 W1 T2 (#57) LANDED ON LANE @`cc2b09b` (todlando report, not yet gated). Fix is a
  CHOKEPOINT, not a call-site audit: `StoreOrigin::{Fresh,Loaded,Degraded}` rides on the document
  (`#[serde(skip)]`), `load_from` marks a swallowed degrade, and **`save_to` refuses it** — so a
  read-modify-write path that does not exist yet is bound too. The nine production mutation sites
  convert to `load_checked` as well, for the earlier diagnostic rather than for the guarantee.
  POPULATION re-classified at tip: 76 `AccessStore::load*` refs; NINE prod mutation sites (cli.rs
  12112/18327/18345/18367/22238, engineroom.rs 438/456/517, pairhost.rs 724) — the filed list AND
  the carried-forward note were both wrong, cli.rs:24084 is inside `mod tests`; seven prod
  read-only sites remain on `load()`, none saves in its enclosing fn. Census corrected ~26 -> 51
  with its population stated (prod non-`cfg(test)` callers of the two non-durable atomic-write
  entry points, 33 files). Mint REQ-ACL-MUTATION-HUSK-REFUSAL (impl/unit, no doc).
  Mechanical: spt-store 486/486, spt --bins 628/628, spt-daemon access+pairhost 27/27,
  clippy --workspace --all-targets -D warnings exit 0, traceable-reqs exit 0. THREE negative
  controls, 3/3 RED on three different assertions (save-seam refusal removed; degrade left
  unmarked at `load_from`; save drops endpoint rules) — all reverted.
  ⚠ RIG NOTE for the gate: `cargo nextest run -p spt --bins` FAILS `adapter_translate_proof_
  gates_on_commit` unless the fixture bins are prebuilt (`cargo build -p spt --bin
  translate_proof_fixture -p mock-adapter --bin mock-session`). Not a lane red — the cell panics
  on the missing fixture before touching any product code.
- 2026-08-18 W1 T3 (#185) RUNTIME REPRO DONE @cc2b09b (todlando report, pre-fix). Defect REAL,
  direction OVER-GRANT: positional `allow <ep> <node> --surfaces MSG` exits 0, persists rule with
  NO surfaces key = every surface, no diagnostic. Polarity caution RETIRED as a misread (his,
  carried twice): `access.rs:1711` reads `acl.modes.is_empty()` — POSTURE table, not the surfaces
  arg; no silent-close arm exists. GATE-TEST-INDEX line corrected (doyle, source-verified).
  FINDING 2 (measured, bigger, rides this lane): legacy positional arm calls `s.allow()` direct,
  never reaches `apply_mutation` — bypasses `--admit-node` acknowledgment AND
  `may_grant_node_subject`. Three-arm differential under identical OwnerAgent authority (real
  perch record required; bare SPT_AGENT_ID classifies LocalUserCli — his first attempt refuted
  itself): E precise no-admit REFUSED/exit 1; G precise+admit accepted (control); F positional
  no-admit accepted with the WIDER rule. FINDING 3 (adjacent, NOT this lane, filed separately):
  spellings disagree on POSTURE — positional closes modes (v1 semantic), precise seam leaves
  modes empty = default-open, whitelist rule inert on an unrestricted endpoint. FILED as #196
  (BACKLOG, bugfix) with the lane boundary stated on it.
  SHAPE RULED (doyle): HONOR THE LIST at the seam — positional arm builds via `build_access_rule`,
  routes `apply_mutation` (real authority + admit_node), preserves its own posture-close. One
  chokepoint, all three faces; refuse-coexistence would leave finding 2 standing and its remedy
  text would point at the bypassing spelling. ACCEPTED CONSEQUENCE (recorded pre-gate): OwnerAgent
  bare-positional now refused without `--admit-node` — the gate working as designed; SameNodeUser
  untouched. Scope addition + shape ruling recorded on #185 comment 5338147636. GATE ADDS at W1
  close (see T3 LANDED entry below): re-run the E/G/F differential, decision-table units with
  partition literals, posture-close non-regression on the positional arm.
- 2026-08-18 W1 T3 (#185) LANDED ON LANE @c45f4b0 on cc2b09b (todlando report, not gated by him).
  W1 COMPLETE ON LANE: T1 535a273 · T2 cc2b09b · T3 c45f4b0 — WAVE GATE DUE (doyle).
  Shape as ruled: positional arm builds via shared `build_access_rule`, applies via
  `apply_mutation` with real authority (admit-node + grant-nodes bind by construction);
  v1 posture-close re-applied via ONE shared body `AccessStore::restrict_if_unset` (iff-unset =
  the property; `allow_surfaces` now calls it too); #196 fork untouched. DECLARED EXTRAS (both
  small, stated not buried): `valid_node_hex` helper deleted (last caller gone;
  `build_access_rule` performs identical check, identical ACCESS_BAD_NODE wording, comment at old
  site); Allow clap docstring corrected ("unless --surfaces narrows it", both spellings same
  acknowledgment; embedded in no doc file — no bundle drift). Output ADDITIVE only: ACCESS_ALLOW
  byte-unchanged; new ACCESS_ALLOW_SCOPE prints ONLY when operator narrowed the rule.
  MINT REQ-ACL-POSITIONAL-ALLOW-HONORS-FLAGS impl/unit/INT (int deliberate: both halves covered
  in isolation, bug lived in the arm between — the join is where it was visible). Plus
  impl->REQ-ACL-GRANT-NODES-POLICY at apply_mutation route, unit-> on bypass cell.
  Mechanical (his, committed tree, env scrubbed): spt-store 487/487 (+1 posture cell), spt --bins
  630/630 (+2 cli cells), daemon access+pairhost 27/27, access_positional_allow_e2e 1/1 (1.5s),
  clippy -D warnings 0, treqs 0. Counts moved by exactly the added cells — repeatable check.
  FOUR negative controls 4/4 RED, different assertions, reverted+verified absent: (1) surfaces
  discarded at builder => unit table AND int arm1 RED (arm1 typed-Some([]) vs arm2
  untyped-Some([]) — both encodings caught); (2) admit_node forced true => int arm3 RED
  reproduces bypass verbatim, unit gate cell correctly GREEN (drives apply_mutation directly,
  structurally blind to arm flag — his declaration, so green ≠ coverage there); (3)
  restrict_if_unset call removed => int posture RED (None vs Some(Closed)); (4) made
  unconditional => store unit RED ("restating is no-op" arm). One self-caught red: clippy
  type_complexity on his unit table 4-tuple — restructured as named Arm struct, const ctor,
  literals kept; int rung re-run after the docstring edit (product text) rather than trusting
  earlier pass. GATE RIG NOTE: E/G/F differential needs REAL PERCH RECORD in temp home (not bare
  SPT_AGENT_ID) — seed_perch helper docstring carries the requirement + reason.
- 2026-08-18 W1 GATED: **PASS** @c45f4b0 (doyle). Chain verified 8248bc3→535a273→cc2b09b→c45f4b0
  linear, exactly three commits, merge-base with main(80ab77a)=8248bc3 (main +2 docs, doyle's).
  DIFF REVIEW: all ten files match the builders' declarations — T1 chokepoint write at
  request_wan tail taking whole NetDialed (proven node compile-enforced), CUSTODY_TABLE
  independent-literal with predicate AND write asserted (lockstep tautology fix STANDS); T2
  StoreOrigin serde(skip) on the document, save_to refuses via single-voice husk_write_refusal,
  exactly 9 load_checked conversions counted in diff, atomic.rs census corrected WITH stated
  population; T3 positional arm through shared build_access_rule + apply_mutation with real
  authority + restrict_if_unset one body, unit tables with literal expectations, refusal paired
  with store-untouched, valid_node_hex one-body replacement, ACCESS_ALLOW byte-unchanged +
  ACCESS_ALLOW_SCOPE additive-only. Negative-control residue: absent from committed diff.
  MECHANICAL (doyle's isolated rig: worktree gate-c45f4b0, main pool claimed from rig, agent env
  scrubbed, fixture prebuild applied): spt-store 487/487 · spt --bins 630/630 · spt-daemon
  access+pairhost 27/27 (1045 skipped = filter positively matched) · access_positional_allow_e2e
  1/1 (the E/G/F differential re-run, real perch record via seed_perch) · clippy --workspace
  --all-targets -D warnings 0 · traceable-reqs 0 · prebuild 0. Counts reproduce todlando's
  exactly.
  DECLARED at golden hand-off (first-execution cells, denominator-one discipline): the twohost
  reply-exemption rung ([int->REQ-SEC-REPLY-EXEMPTION-SEND-LEG], AUTHORED-NOT-RIG-PROVEN,
  construction verified at this gate — discriminator pair, identical closed postures,
  control-first, positive wire observation; single-box vacuous by construction, so deployah's
  golden twohost jobs are its FIRST climb; a red there hands back to doyle, not a rerun).
  W2 build DISPATCHED on this verdict.
- 2026-08-18 W2 tension-A premise check (todlando, unprompted — the ruling named its falsifier):
  both 2026-08-04 restatement records are doyle's own summaries; NEITHER carries the N-1 arm; the
  corpus is elsewhere conspicuously N-1-conscious (sampled grep, labelled as sample); at the
  2026-08-01 grill N-1 had no referent (nothing shipped), so 2026-08-04 was the first moment the
  consequence COULD be in view and has no note of it. VERDICT: LABELLED HOLE, not a refutation
  (summaries, not transcripts). RECOMMENDATION ACCEPTED (doyle): NO escalation — the mint-side
  print + ADR amendment cover both readings; the default is the only thing escalation could move
  and the fleet upgrades as a unit. RE-OPEN CONDITION (his, standing): if the mint print cannot
  reach EVERY minting path (engine-room --for-node mint, unread stdout), the remedy stops
  covering the not-in-view reading and the default question goes to the operator.
- 2026-08-18 GOLDEN HEAD ASSEMBLED + HANDED (doyle): stage/keystone-182-golden @f2d215a =
  main 80ab77a + W0 chain (4 picks) + W1 chain (3 picks), zero conflicts, PUSHED to origin.
  Fidelity blob-asserted: 16/18 files byte-identical vs lane tips; cli.rs (W0∩W1) +
  traceable-reqs.toml (main∩W1) content-identical patches, index/@@ only. Compile-gate at
  f2d215a: workspace clippy --all-targets -D warnings 0 (3m06s, warm main pool claimed by
  lane stage-182 from stage worktree) · traceable-reqs 0. Suites not re-run (waves gated;
  golden is the execution). Greenlit-form: LIVE sub_issues = 8 greenlit members exactly, all
  WIP, zero drops/adds — mid-milestone batch (#166 #57 #84 #85 #185 in head; #161 W2 +
  #165/#179 W3 later-wave), recorded #182 comment 5338478575. Never-executed cells named in
  hand-off: twohost reply-exemption rung (first execution = deployah's golden twohost jobs) +
  golden.yml prebuild step/fail-fast arm (first CI execution). HANDED to deployah (SENT) with
  rig note (fixture prebuild) + red-hands-back-to-doyle-RCA-first. Awaiting his greenlit-form
  re-read + golden fire. Stage worktree .worktrees/stage-182 STANDING for triage; gate-c45f4b0
  rig now removable.
- 2026-08-18 late: hygiene lane PUBLISHED @97121b1 (one commit on 728e1e2) then population
  CORRECTED by hertz on my scope question: IN = IR-23 (ENV_LOCK, 2-thread proof), IR-36 (51
  local output_bounded defs -> owning shared helper, 158 calls), IR-21-clarity/IR-39 (29
  sibling_bin resolvers -> package-aware precondition + CI prebuild extension), IR-37
  record-only (checker remedy upstream). MISSED, no destination declared (his named
  scope-accounting error): IR-13, IR-38, twohost former-:394 doc repair. IR-8 = unruled
  expansion (reap-census scripts + selftest). RULED (doyle): IR-8 ACCEPTED in-lane — ripe
  register entry, already inside the scripts, selftest = construction evidence; condition:
  changed reap scripts are a never-executed surface named at HIS lane hand-off. Missed three
  ride a CORRECTIVE COMMIT on the same lane; gate population = 97121b1 + corrective tip, one
  rig when published. DISK (todlando measured, flagged before the fire): 17GB free < 32GiB
  golden preflight floor; 158GB durable in five .worktrees targets. deployah told HOLD;
  reclaim dispatched to hertz (finished W0 45.3GB + fixture-prebuild 7.1GB targets, teardown
  discipline, before/after numbers); hertz sequences reclaim ahead of corrective. RESOLVED
  same night: hertz reaped both (classified real dirs, 0 inbound reparse, subtrees only) —
  C: 9.40 -> 59.91 GiB free (+50.51). deployah's own read had confirmed C: 10.7 GiB + IR-46
  run-headroom arithmetic; his intake independently re-derived fidelity (reconstruction,
  CRLF-normalized, 15/18-row count = same 17 uniques) + treqs 776/776 + cells confirmed
  (REQ-FIXTURE-BIN-BUILD-EDGE no-int = precondition pin, intended). CORRECTED his
  worktree-sha-as-lane-state read: hygiene (tip 97121b1) + keystone-w1 (live W2 branch) are
  ACTIVE lanes, their targets stay; main pool 89.7GB stays (warm shared). Fires on his own
  timestamped floor read.
- 2026-08-19 GOLDEN FIRED (deployah): run 32225436027, ref golden/keystone-182-w0w1 (new, no
  force), sha f2d215a pinned --commit/--event push, queued 06:54:53Z. Intake comment 5338606995
  at 06:54:38Z — 15s BEFORE run creation, API-provable. His floor read 62.7 GiB at 06:54:04Z
  (5.1 under my relay, attributed: his xtask check into shared main pool). treqs 776/776 exit 0
  + xtask check OK exit 0, both unpiped at the handed sha. Never-executed cells pre-registered
  in the intake comment as named holes; red there = doyle RCA-first, no same-sha rerun.
- 2026-08-19 W3 PRE-CODE RULINGS ISSUED (doyle, on todlando's grounding @008d0c4; recorded
  #179 comment): (a) skeleton = CONTENT INVENTORY not rendering contract — decided by #179's
  requester text ("replace the educational brief with a durable role … static value within
  spt-core, immutable"): education rides the in-core role const (Seat, Rule tiers, Control
  surfaces, Discipline; skeleton-internal order), briefing keeps per-session facts (header,
  Empowered-for + omit-when-empty amendment, Posture+deltas, Current rules); education
  REMOVAL from briefing composer in-scope this lane; rendering-order inversion accepted.
  Operator veto hook = the #179 comment. (b) role CARRIES verbs ⇒ const must be reachable by
  the grammar walk, new whole-span walk cell (remedy-cell shape) — also discharges (c) at
  build sha; vocabulary stale at build ⇒ stop-and-refer, never silently rewrite the ratified
  artifact. (d) briefing.rs rationale corrected BY REPLACEMENT (ER = degenerate case: in-core
  static, no writer at all); bring_up_spools_one_briefing_and_writes_no_role_text unchanged =
  compatibility pin. IMMUTABILITY BAR: both readers (resume.rs:130, cli.rs:5240) serve const
  for engine-room, on-disk ER role file dead; --overwrite refuses ER loudly + non-ER
  discriminator arm; sole-writer/RoleExcluded/ingest pins untouched. PLACEMENT approved:
  const+walk and refusal as cli.rs units (doyle-executable), serve-at-bringup = one
  heavy-broker-pty leg DECLARED first-execution at lane hand-off. Grounding facts accepted:
  NO in-core default at tip (population stated), single carrier census. His cli.rs cites ~400
  low (pre-W2 numbering); names verified at 008d0c4 (:33290/:33228/:25914). BUILD GO,
  parallel to W2-gate queue.
- 2026-08-19 W3 REFERRAL + STOP-AND-REFER RULED (doyle; #179 comment 5338760465 + #165
  comment 5338770831): (1) REQ amendments-by-replacement APPROVED (REQ-ER-SESSION-BRIEFING
  re-scoped to session facts + retentions; REQ-ER-BRIEFING-SURFACE-VOCAB single-source
  preserved across carrier move). (2) CARRIER CONCEDED: const cannot call control_surfaces()
  — role body = pure composer `fn engine_room_role() -> String` in spt-store (no store read,
  no writer, zero-input = #179's "static value"); walk runs over OUTPUT. (3) Homeless items
  (empower verb, access-refresh verb, answerable-for bullets) ALL BRIEFING-side — NOT
  tier-table rows (would amend ratified table semantics); retention folded into amended REQ
  text; operator-exhaustive-reading caveat recorded. (4) Mint APPROVED
  REQ-ER-ROLE-STATIC-IMMUTABLE doc/impl/unit/int. SKELETON AMENDMENT approved shape-only
  (extractor faults CONFIRMED at my own source read :33234-:33272): ellipsis → <subject>
  placeholder (artifact's own convention), row 4 one-verb-per-line; amendment diff posts on
  #165 before write; control correction issued — fault 2 is a silent hole, needs
  presence-based arm (walked set contains api access-node-surface-mode), panic-expectation
  covers fault 1 only. Control-surfaces section = composer output, fall-through sentence
  stays as tier semantics. todlando building immutability half; content half unblocked on
  #165 record.
- 2026-08-19 HYGIENE GATE IN PROGRESS (doyle): diff review of 728e1e2..4884fba done, FIVE
  findings sent (F1 sibling_bin wrong package map ×2 — the wrong-diagnostic class inside
  IR-39's own remedy, control was default-arm-blind; F2 xtask llms refactor undeclared;
  F3 comment overclaims on wildcard-equivalent prod matches, clear_to_swap = UNSAFE
  inheritance direction; F4 orphan doc-comment residue; F5 tag home). CORRECTIVE 6b484c5
  verified: map factored + real-name control with eyes, clear_to_swap → wildcard-free
  exhaustive PROD match (behavior-identical, verified in diff), comments honest, 7 residue
  sites swept, tag re-homed to bounded_output timeout cell, F2 declared in register as
  validation extra (second scope miss, named in lane report). Population 728e1e2..6b484c5
  diff-review CLEAN. Mechanical legs re-running at 6b484c5 (first 4884fba run's per-leg
  exits lost to my own tail-pipe truncation — moot, population moved). IR-8 never-executed
  hand-off recorded: reap-census scripts' first execution = this lane's own golden.
- 2026-08-19 IR-37 UPSTREAM CLOSED THROUGH RELEASE (doyle): traceable-reqs PR #19
  squash-merged @82d8b14 after targeted re-review PASS (defect A item-tables + 9 red-first
  regression cells + sighted control; defect B enclosing-item fallback DECLARED in SPEC
  with cost; unjudged-file count in human output; 267/267, blind repros exit-0). v0.4.0
  cut: bump @c9a8eb5, tag pushed, 3 platform assets published, notes authored. Refs sent
  to hertz. REMAINING: spt-core consumes v0.4.0 (CI version + placement config,
  enforce-on + module_banner=accept, banner cleanup lane later) + IR-37 register append —
  BOTH HELD for the golden freeze on main.
- 2026-08-19 HYGIENE GATE **PASS** @6b484c5 (doyle). Population 728e1e2..6b484c5 (97121b1
  + 4884fba + 6b484c5), all files mapped to declared scope + one declared validation extra.
  Mechanical (isolated rig gate-4884fba advanced to 6b484c5, main pool claimed from rig,
  agent env scrubbed): clippy --workspace --all-targets -D warnings 0 · spt-daemon lib
  848/848 (6 leaky) · xtask 52/52 · bounded_output+endpoint_teardown 5/5 (14.3s, real
  durations) · IR-38 pair 2/2 (~1.7s each, real) · build-after-live-pair 0 (the IR-38
  proof) · census-selftest all arms incl. new UNPROVEN-verdict rows · treqs 0. Pool
  RELEASED, rig removable. Lane hands DEPENDENT on W0 (based 728e1e2) — rides next golden
  assembly with W2. IR-8 hand-off recorded: reap-census scripts first-execute in that
  golden.
- 2026-08-19 GOLDEN 32225436027 RED TRIAGED (doyle, verdict to deployah): Windows test job
  red, ONE victim (engine_room_bringup_e2e::a_cleanly_offline..., Phase B). Signature = ER
  gate's own 1s backoff refusing a valid code ("too many wrong bring-up codes", broker.rs
  :1789 Throttled) — TOTP minted once at test :492, load-stretched span crosses the step,
  wrong-code failure shuts gate, valid presentation lands in the shut window. Victim 52.7s
  vs sibling 3.1s (~17x, same log). CAUSE = MY OWN gate legs fired on hfenduleam inside the
  golden's Phase B "now-quiet box" window (pre-flight discipline violation — asked what
  runs in parallel, not where golden runs; lesson to file). NOT the head — corrected attribution (deployah re-derivation 2026-08-19): the
  throttle string has TWO emit sites at f2d215a — spt-daemon broker.rs:1790 (this failure's)
  and crates/spt/src/api/engineroom.rs:253; the head DOES touch the latter FILE, but its
  three hunks land at 438/461/530 (AccessStore::load->load_checked, #57) — the :253 emit
  site and attempt accounting untouched. spt-store/src/engineroom.rs + spt-daemon/src/
  broker.rs genuinely untouched. STRONGER discriminator (deployah): the head's new arm
  PRINTS when it executes (ACCESS_DEGRADED / ACCESS_UNCHANGED); both tokens count ZERO in
  the whole failed job log — the new refusal path never ran, so it cannot be the mechanism.
  Only test-file touch = W0 fixture fail-fast (different arm); cell predates head
  (a1b9947); Linux green on same cell. LOAD-MEASURE CAVEAT (deployah, accepted): the ~17x
  compares two DIFFERENT cells (unlike baselines) — not a stretch measurement; the passing
  38.2s neighbour supports load better; the 3.1s sibling ran INSIDE the burst and was NOT
  slow. Load half is softer than first stated; rerun is the test. Prebuild
  pre-registered cell GREEN. RULING: rerun --failed at same sha AFTER twohost concludes,
  quiet-window committed (no local builds until run + rerun conclude); second red on quiet
  box refutes load verdict, pre-registered, comes back to me. RUN CONCLUDED: twohost-a and
  twohost-b BOTH GREEN — the pre-registered first-execution reply-exemption rung climbed
  and passed. Only red in the whole run = the triaged ER cell. RERUN-GO sent to deployah
  (QUEUED) with quiet-box confirmation; hertz also confirmed no build load.
- 2026-08-19 RERUN RED — LOAD VERDICT REFUTED (pre-registered arm fired; RCA = doyle, ACTIVE):
  job 95994181430 attempt 2, same cell FAIL 53.663s on the QUIET box (neighbourhood stable ±2%
  vs loaded attempt: 38.160→38.980 PASS, 52.712→53.663 FAIL, 3.110→2.592 PASS — there was never
  a 17x stretch; 14/192 is a 38s test beside a 53s one). Cell = 2 executions / 2 failures at
  f2d215a, stated as the number. Deployah cross-checks: prior golden 32209922535 @60d74ea SAME
  box PASS 6.840s; Linux both runs ~21.5s (unchanged) — Windows-only regime change BETWEEN
  GOLDEN OBSERVATIONS. PRIOR-HISTORY RULING (settled doyle+deployah 2026-08-19, each refuting
  one half): deployah's "appeared in this delta" FALSIFIED (cell has prior failures on this box
  pre-head, FLAKE-LEDGER :1212 row) — AND doyle's "mechanism predates the head" EQUALLY
  unsupported: it rested on a duration match (53.9s≈53.6s) right after the same row proved
  duration carries no outcome signal here (row logs a 6.85s FAILURE beside deployah's 6.840s
  PASS, opposite outcomes 10ms apart). The classified prior occurrence (:1212 sid-identity,
  spawned=TRUE) is signature-INCOMPATIBLE with ours (throttle, spawned=FALSE); the 53.9s one is
  tail-eaten (no signature); :1150 is affirmatively excluded (its fixture hardening rode this
  head and its fail-fast arm stayed silent). PRE-EXISTING vs NEW = LABELLED HOLE, UNPINNED.
  What stands: 2 executions / 2 failures at f2d215a, same throttle signature. Any probe repro
  classifies by SIGNATURE (counted-refusal shape: throttle + spawned=false + ~8.6s work + 45s
  budget), never by duration. HEAD NOT LANDED, main stays 80ab77a, lanes do NOT rebase.
  Doyle triage so far: 53.6s = ~8.6s work + full 45s wait_for_broker_session burn ⇒ measured rc
  presented a ~7-9s-old code (inside ±1 step) and got THROTTLED ⇒ ≥1 counted failure existed
  in the home's ledger before the measured attempt — COUNT AND TIMING NOT DERIVABLE from the
  string (todlando correction 2026-08-19: "1s" = retry_in_ms.div_ceil(1000), the REMAINING
  window, not backoff_ms(failures) — a 16s window with 900ms left prints identically; my
  failures==1 read was an over-claim). Warm-phase-era counted failures are back in play.
  W3 GATE RIDER: todlando's int cell bringups through this same gate in this same file/group —
  named confounder for his denominator-one pre-registration; any red there answers
  is-this-red-mine against THIS mechanism first. The COUNTED refusal prints
  ENGINE_ROOM_BRINGUP_REFUSED to
  broker stderr which NOTHING captures. evaluate_bringup(None) COUNTS (codeless seat-gate
  presentation is a candidate); verify-false-negative (SubnetStore no-record ⇒ Cred::None on a
  correct code) is the other. NTP-clock-divergence arm REFUTED BY MEASUREMENT (hfenduleam
  offset <1ms vs time.windows.com). Deployah's zero-token discriminator stands (head's #57 arm
  never executed). Instrumented rig .worktrees/rca-182-gate @f2d215a (SPT_GATE_PROBE: eval
  entry/verdict/ledger, seat-vs-verb caller tags, verify internals incl. expected window codes,
  mint side) — building, then cell x20. W2/W3 gates queue behind RCA on this box.
- 2026-08-19 ATTRIBUTION CLOSED (baseline final, #197 comment 5339741972): 60d74ea = 15 FAIL/
  5 PASS (family A 10/20 by :invariant panic line, family B 5/20 by :sid line); f2d215a = 10/20
  (A 6, B 4). Both families PRE-EXIST at comparable-or-worse rates; head raised nothing; every
  historical green on this cell was a draw. No third signature in 25 failures. Exposure numbers
  for the landing gate must be re-measured ON the assembled head (deployah rider, accepted).
  Family-B routing: hertz H1 (assert-side sampling race, test reads sid before self-bind stamps
  it) LEADS from source; H1-confirm ⇒ test-side fix = the deterministic control, discharges the
  landing-gate leg. RCA pools RELEASED, box FREE (builders notified, cargo theirs on ask); rigs
  rca-182-gate + rca-182-base STANDING as reference until both lanes conclude, then teardown by
  doyle (classify before delete). Deployah idle, diffs next intake against NINE members.
- 2026-08-19 #197 MINTED + PATH RULED (doyle): family-A defect board-real — releases#197
  (BUGFIX, alchemy-minted, detail comment 5339670250), attached to #182 as NINTH member (synced
  WIP), formally dispatched todlando (design BEFORE build, he sends design to doyle first).
  PATH (a) RULED: fix enters #182, head changes, deployah runs FULL fresh intake (new
  parentage/blob fidelity/membership diff vs 8-member snapshot 5337576488 expecting NINE, new
  intake comment + golden ref). NO same-sha re-fire — a green draw from a measured 10/20 cell
  carries no information (deployah stance, doyle adopted, recorded). Greenlit-form ADDITION
  reason comment 5339675605 on #182 BEFORE next golden, operator veto hook stated. BASELINE
  INTERIM @60d74ea: 7 FAIL/2 PASS, BOTH families present at the prior green golden's own sha —
  mechanism PRE-EXISTS the head (final count lands on #197). RESIDUAL FLAGGED to deployah:
  family B (~1-in-4, hertz's) survives #197 — next-golden exposure on this cell needs an
  assembly-time ruling with hertz unless his lane lands too.
- 2026-08-19 RCA CONCLUDED-MECHANISM / ATTRIBUTION-PENDING (doyle instrumented repro,
  .worktrees/rca-182-gate @f2d215a + SPT_GATE_PROBE, 20 isolated runs quiet box): 10 FAIL/10
  PASS, TWO families. FAMILY A = golden signature (6/20, ~52-53s): warm admit → rc seats on
  ticket (conn=11) → SECOND local conn (16) attaches intent=Control CODELESS with seated=None →
  evaluate_bringup(None) COUNTS failures=1 shuts gate 1s → measured CORRECT code (probe-verified
  member=true, in-window) lands in backoff → Throttled → rc exits → 45s burn → :1205. PRODUCT
  DEFECT RULED: gate counts ABSENT code as a wrong guess (denial-of-governance ratcheting its
  own doc forbids; NoAdapter arm already refuses unspent). FIX DISPATCHED todlando (product
  lane; incl. conn=16 identity census — his single-actor hypothesis: the post-consumption
  forced re-attach is codeless BY CONSTRUCTION). FAMILY B (4/20, ~8s) = FLAKE-LEDGER :1212
  MINTED-NOT-RESUMED (sid does not rotate, gate probe-clean) — rate data to hertz, stays his.
  Baseline arm RUNNING (.worktrees/rca-182-base @60d74ea, same probe, x20 quiet) — its rate vs
  10/20 closes pre-existing-vs-head by measurement. ORDERING RULED: W2/W3 mechanical gates
  proceed (never execute the int cell); todlando's W3 int cell FIRST-FIRES only in a golden
  carrying the family-A fix. Operator checked doyle mid-RCA for authoring drift — probe rig
  kept (measurement), fix design + identity chase handed to builders per role lines.
- 2026-08-19 W3 BUILT @9193d40 (todlando, build/keystone-182-w2-sealed-multi, STACKED on W2 base
  008d0c4; #165 order held — amendment diff comment 5338815273 posted BEFORE the write; doyle
  gate-ack 5339039045). REQ-ER-ROLE-STATIC-IMMUTABLE minted; REQ-ER-SESSION-BRIEFING +
  REQ-ER-BRIEFING-SURFACE-VOCAB replaced in-lane; carrier = erole::role_text composer fn in new
  spt-store/src/erole.rs, surfaces from control_surface_rows_in. Doyle ruled his three asks
  (2026-08-19, sent direct): tier-table-SCOPED presence control APPROVED (doc-wide arm is green
  over the fault — preamble prescribes the same verb); table-derived default-on ACCEPTED over the
  literal DISCOVER sentence (drift-pair prevention; todlando owes a short #165 rendering note —
  gate checks for it); both falsified-cell corrections (carrier-following vocab cell + briefing-
  absence arm; count floor re-derived occurrences==walked && >0) approved as described, source-read
  at gate. Int cell authored NEVER-EXECUTED, pre-registered: red = structural, no rerun. His
  claimed legs: spt-store 483/483, spt-live resume 8/8, spt bin 637/637, int --no-run, clippy 0,
  treqs 0, reference.md byte-identical. GATE QUEUED behind quiet window — stacked gate plan in
  W2-GATE-JIT.md (W2 @008d0c4 first, forward to 9193d40).
- 2026-08-19 RERUN FIRED (deployah, `gh run rerun 32225436027 --failed`): Windows test job
  re-executing at f2d215a, startedAt 07:39:39Z, in_progress (doyle polled via `gh run view
  --json jobs`). Attempt 2's job list = traceability, changes, both n1-gates, Linux test,
  Windows test ONLY — the twohost jobs exist ONLY under ATTEMPT 1 (deployah flag, confirmed
  by doyle's own poll: 6 jobs, zero twohost). CITE the twohost green (pre-registered
  reply-exemption rung) to attempt 1 with its job ids, never to the bare run — the run's
  latest attempt cannot show it. Carried jobs keep ORIGINAL start times (deployah dedupes
  on run/box/started_at — a carried failure is the same observation, not a second one).
  Deployah independently CONFIRMED the RCA off job log 95984156138 (2776/2776 Phase A,
  191/192 Phase B, throttle string appears exactly once) with the attribution correction
  + token discriminator folded into the triage entry above. QUIET WINDOW HOLDS until this
  job concludes. Deployah will record a repeat red as 2 executions / 2 failures, never a
  flake rate.
- 2026-08-18 hertz STARTED the test-hygiene family lane: test/keystone-182-hygiene, deliberately
  based on gated W0 tip 728e1e2 (sequences on the f60adf3 beachhead) — hands as a DEPENDENT lane
  unless W0 reaches main first. Account for this at golden-head assembly (W0 rides the #182 head;
  if the head lands, his lane rebases clean).
- 2026-08-19 W2 GATED: **PASS** @008d0c4 (doyle). Rig .worktrees/gate-008d0c4 (fresh worktree,
  detached), MAIN warm pool claimed from rig — DECLARED DEVIATION from W2-GATE-JIT's fresh-target
  line: disk floor 70.08GB vs ~45GB swing, builders sequenced off the box on perch (todlando
  authoring, hertz holding), W1+hygiene gates ran this same shape. Env scrubbed every leg; quiet
  window confirmed (golden 32225436027 CONCLUDED before first cargo; box asks answered by both
  builders). DIFF REVIEW 7/7 files match declarations. Rulings at source: (A) ADR-0054 clauses
  6-9 marked-not-struck, N-1 answered at mint (mint_reach_lines + discriminator unit), no version
  floor; (B) CONTEXT.md count-disclosure qualifier verbatim; (C) REQ text carries ROUTED-not-
  opened + subnet-name lexicographic tie-break; select_routed_opening pure, 4-arm unit with
  literal expectations, openings sorted+deduped before selection. REQ-KNOCK-CODE-MULTI-ENVELOPE
  minted doc/impl/unit, tags read at evidence sites. MECHANICAL (true exits, full logs in session
  scratchpad): clippy --workspace --all-targets -D warnings 0 · prebuild 0 · spt-net 201/201
  (1 skip = pre-existing endpoint.rs:746 LAN-multicast ignore, named) · spt --bins 632/632 =
  W1-gate 630 + exactly the 2 added cells (chooser test replaced 1-for-1; :26591 assertion
  removal accounted in the replacement's own comment) · KNOCK_WHICH_SUBNET sweep 6 hits ALL
  historical/marked-voice, ZERO emit sites · treqs 0 · xtask check OK (at 9193d40, covers W2's
  reference.md edit). CENSUS cfg(test)-aware: prod callers seal_to_all = seal wrapper +
  cli.rs:17253-area seal call; open_all_among = wansend redeem_route only; open_among zero
  residue; codeseal::open prod callers none outside tests. NEVER-EXECUTED RE-DERIVED at gate
  (supersedes the planned five): cells 2/3/5 DELIVERED as executed units (two-seed opening,
  rotation-grace×multi one combination, 71-char length pin), cell 4 accounted in counts; the
  remaining named hole = LIVE multi-envelope redemption through real daemons — no cell exists,
  REQ pins by unit, declare as uncovered-runtime surface at golden hand-off, not a pending cell.
  W2 hands DEPENDENT into next golden assembly with hygiene @6b484c5.
- 2026-08-19 W3 GATE **RED** @9193d40 (doyle; findings SENT todlando, corrective rides his lane).
  F1 STRUCTURAL: both new include_str!(ER-SKELETON.md) cells depend on checkout EOL
  normalization — core.autocrlf=true on this box (no .gitattributes text/eol attr on the file)
  materializes a FRESH checkout with CRLF; skeleton_tier_table's split_once("\n\n") cannot match
  \r\n\r\n and panics cli.rs:33600 "the tier table ends at a blank line"; the_role_carries_ +
  the_skeleton_walks_ cells both FAIL. Builder tree green (637/637) only because as-authored LF
  bytes are never re-smudged; the golden's checkout on hfenduleam (same box) REDS — a Windows-
  only golden red on the wave that just closed an RCA on that exact job. Fix shape his to
  declare (ingestion-normalize vs .gitattributes pin). F2: his report figures 483 (store) and
  8/8 (resume) do not reproduce — measured 489/489 = W1-gate 487 + his 2 erole cells; resume
  filter 9 passed/65 skipped = 8 + his reader-A cell; deltas exact, his figures asked-or-retired.
  F3: red run cancelled 372/637 (fail-fast), 265 cells unexecuted — full --bins at re-gate.
  EVERYTHING ELSE GREEN at 9193d40: clippy 0 · spt-store 489/489 · spt-live resume 9 (filter
  positively matched) · int cell COMPILED --no-run, never executed, stays declared
  first-execution · treqs 0 · xtask check OK (reference.md 139971 drift-clean). REVIEW SIDE
  CLEAN: #165 amendment diff 5338815273 matches landed skeleton byte-for-byte; rendering note
  5339125846 reads as ruled (tier-semantics literal / default-on composed; DISCOVER in
  RULE_TIERS = ratified tier-semantics literal, covered by the note); reader census closed
  (TWO prod readers, both through erole::role_text; ingest/sync/daemon hits all cfg(test);
  sole writer refuses ER BEFORE file read); REQ-ER-ROLE-STATIC-IMMUTABLE minted
  doc/impl/unit/int with first-execution declaration; both REQ amendments by replacement
  verified; bring_up_spools compatibility pin UNCHANGED (absent from diff, present at
  briefing.rs:702); >= 3 floor residue swept (only unrelated poll mock + the explaining
  comment). Note for report: new [impl->REQ-ACL-ACCESS-REFRESH-ER-ONLY] tag on the briefing's
  teaching line is additive. RE-GATE on corrective tip: clippy + full spt --bins + diff-scope
  review. RIG gate-008d0c4 STANDING at 9193d40 for the re-gate; main-pool claim RELEASED; box
  handed todlando (#197 + corrective), hertz queued behind by direct coordination.
- 2026-08-19 W3 RE-GATED: **PASS** @e99633f (doyle; corrective on the same lane branch, parent
  9193d40). todlando's corrective = shape (a) fixture-edge normalize, HIS independent repro
  first (bytes via od zero-cargo, then runtime negative control: revert+CRLF ⇒ both cells red
  with the exact panic, corrective+CRLF ⇒ pass, restored-LF ⇒ pass — filter positively matched
  2/0/635). Diff-review: cli.rs only, ER_SKELETON_RAW + er_skeleton() normalize with mechanism
  + declined-.gitattributes rationale in-code (an eol pin = same environmental dependency one
  layer away), residue = const def + one normalize use, negative-arm consts untouched, artifact
  byte-unchanged. F2 figures WITHDRAWN by him (no provenance + 483 internally impossible below
  the 487 baseline); my arithmetic adopted. MECHANICAL (my rig forwarded to e99633f, main pool
  reclaimed as gate-e99633f, env scrubbed, fresh CRLF checkout = the redding environment):
  clippy 0 · prebuild 0 · spt --bins 637/637 FULL RUN, all five skeleton/role cells PASS ·
  treqs 0. W3 rides build/keystone-182-w2-sealed-multi @e99633f into next golden assembly.
  NEVER-EXECUTED at hand-off: W3 int cell (bring-up serves in-core role) — compiled --no-run at
  gate, denominator zero, first execution = the golden; its red answers is-this-red-mine
  against the #182 throttle mechanism FIRST (named confounder, same file/group). Sibling
  routings closed: binedge 12-RED = W0 predeclared remainder (assembly check filed above);
  xtask nextest.toml CRLF class = IR-48 (hertz verdict, preventive fixture-pair). CRLF
  mechanism filed to gate craft memory. Rig gate-008d0c4 stays at e99633f until assembly;
  pool claim gate-e99633f HELD for the #197 gate legs next; rig gate-5eb6a3b created for
  the #197 gate (diff review already CLEAN, mechanical legs after hertz's focused cell).
- 2026-08-19 #197 GATED: **PASS** @5eb6a3b (doyle; fix/197-absent-code-uncounted, base f2d215a,
  main an ancestor, engineroom.rs+broker.rs blobs identical across main/f2d215a/9193d40 so
  rebase-to-assembly-head is mechanically neutral). BUILT AS RULED, verified at source:
  Presented enum (not Option) with rationale; GateOutcome::Uncounted sibling sharing apply's
  no-op arm; BringUp::NoCode own sentence + engine-room-no-code label + "No attempt was
  counted"; throttle-first pinned BY CELL (all three presentations answer Throttled
  identically at a shut gate); write-skip = one mechanism !matches!(NoAdapter|NoCode) with
  failed-write rationale; whole-STRUCT ledger asserts (last_failure_ms silent-extension
  guard); ADR-0051 §1a cleared in impl comment (absent carries zero which-key bits).
  DOCTRINE SWEEP verified: the asserted-defect cell MOVED with its REQ (old arm asserted
  "no code costs the same" as [unit->REQ-ER-BRINGUP-ATTEMPT-BOUND] evidence — strongest
  MOVES evidence, priced); msg.rs wire doc + rc.rs comments corrected; rc.rs:1150 checked
  and left (claim still true). Moved cell closes the earlier write-skip evidence hole:
  ledger FILE NONEXISTENCE asserted (the only write-skip vs write-back-unchanged
  discriminator) + 5x codeless ratchet arm. cmd_empower: always Presented::Code (empty
  string = counted presentation), Uncounted arm wildcard-free fail-closed — C4's stated
  2-of-3 compile-control limit discharged by my source read of the third site. REQ pair:
  REQ-ER-BRINGUP-ATTEMPT-BOUND amended by replacement naming BOTH uncounted classes;
  REQ-ER-BRINGUP-ABSENT-CODE-UNCOUNTED minted doc/impl/unit (int at gate note), added to
  activation list; ADR-0052 §2a bullet with doc tag. His six negative controls reviewed
  (residue absent from committed diff), C6 re-created the original defect and redded at the
  refusal-DETAIL assert first. MECHANICAL (rig gate-5eb6a3b, main pool claimed from rig,
  env scrubbed, fixtures prebuilt): clippy -D warnings 0 · spt-store 489/489 (both new gate
  cells PASS) · spt-daemon --lib 849/849 (5 leaky) · spt --bins 630/630 · treqs 0 — counts
  reproduce his exactly. #197 rides next golden assembly as NINTH member; its new cells'
  int-side first executions get named in the hand-off declaration set. NEXT: seam-(ii)
  capture (doyle, rca-182-gate, probe site-tags at attach.rs:298/:397 + shellchan.rs:301,
  broker-stderr capture, cell x20 exclusive-box) → identity pin → seam-(ii) ruling.
- 2026-08-19 SEAM-(ii) RULED: **CLOSED, no second product change** (#197 comment 5340617852).
  Capture: rca-182-gate probe extended with ATTACH_SITE mirrors (3 candidate sites → probe
  file, dodging the uncaptured broker stderr), cell x20 exclusive quiet box. 10F/10P —
  A 8/20 (throttle, :1223 probe-shifted) + B 2/20 (sid, :1237), compatible with RCA's 6/4.
  IDENTITY: all 9-10 codeless attaches across 20 runs = serve_dispatch, fresh gen,
  ~130-360ms after the coded attach; shell_channel + gap_resume fired ZERO times in the
  whole capture ⇒ operator-referral condition NOT triggered; todlando's single-actor
  hypothesis CONFIRMED (post-consumption dispatcher re-attach, codeless by construction).
  Live trace shows the #197 arm covers it exactly (None⇒Absent⇒Uncounted⇒NoCode, no
  write; operator's code then admits). Residual why-does-the-dispatcher-re-dial = benign
  mechanism curiosity, new-request-if-wanted, not a milestone rider. Family-B lane
  (hertz @541e56f = a58a559 fix + ledger row): review CLEAN both commits (fix shape as
  approved with structural non-masking; :1212 row amendment faithful incl. pre-registered
  x20 expectation); x20 characterization RUNNING on his tip (expect B 0/20, A persisting
  ~6-8/20 on pre-#197 base) — verdict on its result.
- 2026-08-19 FAMILY-B LANE GATED: **PASS** @541e56f (doyle). x20 exact cell on his tip
  (rig gate-541e56f, warm rca pool claimed sequentially, env scrubbed, exclusive box):
  16/20 pass; ALL 4 fails = family A throttle (:1226 = offline.spawned landing assert on
  his shifted tree, 61-63s = 45s burn + his 10s rotation bound on an unrotated perch);
  family B sid-identity = **0/20** vs 4-5/20 hot baseline — the pre-registered expectation
  met exactly, fix effective, non-masking structural. Lane = a58a559 (fix) + 541e56f
  (ledger row), both diff-reviewed clean. Rides next golden assembly as TEST LANE (no
  board member), per the standing plan. RCA rigs now teardown-due (both lanes concluded);
  capture artifacts preserved in doyle session scratchpad.
- 2026-08-19 ASSEMBLY-READY (doyle). W3 post-gate doc-only commit @ba2d998 LANDED and
  verified: diff read (preamble split exactly as ruled, fenced skeleton byte-untouched),
  five skeleton/role cells 5/5 PASS at ba2d998 in my rig (filter positively matched,
  632 skipped), treqs 0. Family-B final doc tip @5c1a130 verified (ledger row closes
  with my x20 evidence verbatim, CLOSED — GATE PASS). **ASSEMBLY LANE TIPS (final):**
  hygiene @6b484c5 (3 commits on 728e1e2) · W2+W3 @ba2d998 (008d0c4, 9193d40, e99633f,
  ba2d998 on W1 tip c45f4b0) · #197 @5eb6a3b (1 commit, base f2d215a) · family-B
  @5c1a130 (a58a559, 541e56f, 5c1a130, base f2d215a). Members = NINE (#166 #57 #85 #84
  #161 #185 #165 #179 #197), addition comment 5339675605 standing. Assembly recipe:
  stage worktree off main 80ab77a, cherry-pick W0 chain + W1 chain (same as f2d215a) +
  hygiene + W2/W3 + #197 + family-B; blob-fidelity vs lane tips (content-stripped for
  shared files); compile-gate clippy + treqs + BINEDGE-CHECK expect 0 (12-before/0-after
  else finding); name never-executed cells (W3 int + #197 int-side + reap-census IR-8 +
  W2 uncovered-runtime surface; twohost rung CLIMBED at 32225436027 att1 — cite, not
  re-declare); greenlit-form vs LIVE sub_issues expecting NINE; hand deployah for FULL
  fresh intake. Builders' pool claims (keystone-w1, fix-197) stay until landing.
  Teardown after hand-off: rca-182-gate + rca-182-base + gate-5eb6a3b + gate-541e56f +
  gate-008d0c4 (+ pinned gate-4884fba retry), disk numbers before/after.

- 2026-08-19 GOLDEN HEAD v2 ASSEMBLED + HANDED (doyle): stage/keystone-182-golden @`bd942f6`
  PUSHED (ff from f2d215a; 12 commits = hygiene 3 + W2/W3 4 + #197 1 + family-B 3 + 1 declared
  assembly fix; zero pick conflicts). Fidelity: 80/83 solely-owned blobs byte-identical vs lane
  tips; 3 shared + 3 upstream-delta files covered by 11/11 per-commit content-stripped patch
  identity (index/@@ only). ASSEMBLY FINDING (the class the compile-gate exists for): hygiene's
  IR-36/IR-39 helper hoist deleted file-local output_bounded/sibling_bin while W3's int cell was
  authored pre-hoist — textual merge clean, E0425 x4 at the head; declared stage-only fix
  bd942f6 qualifies 4 call sites to common:: (file's own idiom), ALL inside the never-executed
  W3 int cell (engine_room_bringup_e2e.rs:1264) so it is compile-proven and first-execution
  status is unchanged; no lane tip carries it. Compile-gate at bd942f6 (stage worktree, main
  pool claimed stage-182 from rig, env scrubbed): clippy --workspace --all-targets -D warnings
  0 · treqs 779/779 exit 0 (= 776 + exactly the 3 new mints) · binedge-check RED 0 exit 0
  (before-arm = todlando's recorded 12 @e99633f, W0 remainder discharged). Greenlit form: LIVE
  sub_issues = NINE exactly, all WIP, addition comment 5339675605 standing. HANDED deployah
  (SENT) for FULL fresh intake — never-executed set (W3 int cell w/ throttle-confounder note,
  #197 int-side, IR-8 reap-census first CI run, W2 uncovered-runtime surface; twohost rung
  CITED to 32225436027 att1 jobs 95989664702/95989664741) + exposure rider (re-measure ER cell
  on head; f2d215a baseline 10/20) + no-same-sha-refire + red-hands-back-RCA-first. TEARDOWN
  DONE: 5 rigs removed (rca-182-gate, rca-182-base, gate-5eb6a3b, gate-541e56f, gate-008d0c4),
  C: 32.67 -> 45.17 GiB (+12.50), zero inbound reparse, all real dirs classified;
  gate-4884fba STILL handle-pinned (crates/spt-daemon busy), retry queued. Stage worktree +
  stage-182 pool claim STANDING until landing. Builders' pools untouched.
- 2026-08-19 GOLDEN v2 FIRED (deployah): run 32243884768, ref golden/keystone-182-full,
  pinned --commit bd942f6 --event push, queued 10:41:12Z; intake comment 5340977303 at
  10:40:52Z (20s pre-run, API-provable). INTAKE PASS, all re-derived not relayed: ancestry
  12 ahead/0 behind true ff, 12 commits match declared parentage in order; greenlit form NINE
  live sub_issues all WIP (+#197 only vs 8-member snapshot, zero drops, all nine mapped to
  carrying commits — nothing rides unbuilt); fidelity 80/83 solely-owned blobs byte-identical
  + 11/11 patch-id --stable (EOL-sensitive, covers the 6 remainder); assembly commit bd942f6
  read (4 sites, all inside W3 cell fn 1264-1420, zero unqualified survivors, compile-only,
  first-execution intact); treqs 779/779 = set-diff exactly +3; xtask check OK unpiped
  (his addition — my hand-off omitted the docs-drift gate; four doc-touching commits made it
  material). DISK his own reads: hfenduleam 44.34 GiB (floor +12.34) after he reaped his own
  intake pool pre-fire (7.53 GiB classified real dir, zero inbound reparse, +6.75 actual).
  FAMILY-B LEG DISCHARGED on mechanism (fa583a2 polls observable rotation under bound,
  returns prior on timeout — genuine non-rotation stays RED; deterministic control, cannot
  manufacture green); exposure rider stands for any RULED-not-fixed rate. Red comes back to
  doyle RCA-first, no same-sha re-fire. QUIET WINDOW HOLDS until run concludes.
- 2026-08-19 GOLDEN v2 RED ×2 — TRIAGE (doyle, ACTIVE; run 32243884768 still in progress at
  triage start, twohost pending; logs pulled via jobs API, quiet window held, zero local builds).
  RED 1 — LINUX, job 96040220242: NOT a test victim — both nextest phases GREEN (2776/2776 +
  178/178); failing step = "Clippy (deny warnings) — linux" exit 101, ONE deterministic error:
  unused import `common::CommandNoWindowExt` at crates/spt/tests/bounded_output_e2e.rs:10.
  Source-verified in stage worktree: both `.no_window()` call sites sit inside #[cfg(windows)]
  blocks; the trait's non-Windows no-op arm exists precisely so chaining stays unconditional —
  this file diverged from that design. Hygiene-lane content (IR-36 hoist). WHY UNCAUGHT: every
  clippy leg (lane, gates, my compile-gate, deployah intake) ran on WINDOWS where the import is
  used; this step was the first Linux clippy over the assembled content. GATE-CRAFT LESSON to
  file: hand-off compile-gate needs a kitsubito clippy leg (ssh available) — platform-cfg'd
  test code makes clippy verdicts platform-local. FIX ROUTE: hertz (test-only, his lane
  content); shape his to declare — chain .no_window() in the non-windows arm (trait's design)
  or cfg-gate the import.
  RED 2 — WINDOWS, job 96040220254: same ER cell (engine_room_bringup_e2e::a_cleanly_offline…)
  FAIL 61.4s, 192/193 others green (2798/2798 phase A). SIGNATURE IS NEW — THIRD distinct:
  panic :1213 invariant line, but rc stdout = "the code was accepted, but the engine room's
  harness (erhost) did not come up within 30s — nothing is attached." NOT family A (throttle
  string absent — the #197 gate arm evidently worked: code ACCEPTED), NOT family B's :sid
  sampling face (hertz's deterministic control rides this head, 0/20 on his tip). Failure moved
  DOWNSTREAM: gate passes, session/erhost non-spawn within 30s. 1 execution / 1 failure at
  bd942f6 — stated as the number, no rate claim. Candidate mechanisms (unpinned, for the rig):
  (a) post-#197 face — dispatcher's codeless re-attach now refused-uncounted; if that attach
  was load-bearing for bring-up, refusal is politer but erhost still never comes up = REAL
  regression surfaced by the fix; (b) family-B's UNDERLYING minted-not-resumed mechanism
  (genuine non-spawn — exactly what hertz's non-masking control refuses to paint green).
  Classification needs instrumented repro at bd942f6 (SPT_GATE_PROBE + ATTACH_SITE mirrors,
  x20, exclusive box) — MINE, after run concludes. No same-sha refire stands regardless.
  DEPLOYAH RE-DERIVATION (mid-run, via raw jobs endpoint; both logs pulled, my reads confirmed
  verbatim incl. throttle-string ZERO + ACCESS_* zero-token): (1) W3 FIRST-EXECUTION CELL
  GREEN BOTH PLATFORMS — a_brought_up_engine_room_is_served_the_in_core_role… :1264 PASSED
  Windows 2.883s + Linux 10.693s; its never-executed flag + throttle-confounder note RETIRE.
  Assembly commit bd942f6's four lines (1270/1289/1331/1353) all inside that green cell —
  unimplicated by line range AND by outcome. (2) Failing cell a_cleanly_offline… (:1152, panic
  :1213 offline.spawned invariant) PRE-EXISTS main (a1b9947 ancestor) — regression-or-flake
  question, not first-execution structural. (3) SAME CELL PASSED LINUX this run (21.468s) —
  Windows-only signature; x20 scope must be stated as a WINDOWS rate. FAMILY B CLEARED BY
  WRITE-SET (stronger than signature): fa583a2's only edit replaces the sid_after read;
  `spawned` computes one line above via wait_for_broker_session(45s), untouched — failing
  predicate and fix write-set disjoint. RIG FACTS: genuine non-spawn (product's own 30s erhost
  budget expired, test's 45s poll also empty, 61.4s total); control arm :1194 PASSED in the
  SAME execution = in-run rig-soundness proof; CI-REAP warning "could not stop pid=54552 spt"
  (already-dead spt process, same job) named for pricing, not dropped. Windows clippy verdict
  is cfg-DERIVED not run-derived (steps after a fail all skip). Cheap tripwire noted: the
  unused import printed as WARNING during Linux fixture builds ~17min before deny-warnings
  turned it fatal. `ba2d998` on build/keystone-182-w2-sealed-multi,
  on top of e99633f. docs/ER-SKELETON.md preamble only (+13/-2), fenced skeleton byte-untouched,
  treqs 0, no cargo. Text was NOT re-composed — it was found already STAGED in .worktrees/keystone-w1
  (that staged diff is what doyle read). Sha sent to doyle. Nothing further owed by me on #182;
  assembly waits on doyle (family-B x20 verdict + golden-head assembly).
  Doc-tip legs at ba2d998 (doyle asked, box released): 28/28 pass, 609 skipped (filter listed first,
  28 names read — positively matched), compile 27.51s, treqs 0, tree clean. Full 637 NOT run; offered.
  2026-08-19 CLOSED by doyle: ba2d998 accounted (his own 5-cell run at same sha green, treqs 0 both
  sides; full 637 NOT needed, ran at e99633f). Family-B x20 PASS @541e56f, sid 0/20, ledger closed
  @5c1a130. Nothing further owed by todlando on #182. ASSEMBLY IS DOYLE`S, started 2026-08-19:
  nine members, lane tips 6b484c5 / ba2d998 / 5eb6a3b / 5c1a130. Pools stay claimed until lanes land.
  2026-08-19 worktree teardown (doyle audit note): removed .worktrees/nameplate-honest-er-session
  + .worktrees/nameplate-w7-diag and branches diag/pump-188-honest-er-session (b604e60) /
  diag/pump-188-w7-courtesy-barrier (c3ac672). Neither held a target/ — no pool release needed.
  w9-redeem-echo @4828ad0 HOLD stands (branch only). STALE TRAP CORRECTED: .worktrees/rca-182-gate
  no longer exists — the "never touch doyle`s rig" line in my brief is dead. Stray husks left in
  .worktrees, NOT mine: gate-4884fba, gate-b05fea8 (empty dir skeletons), _patches — doyle to rule.
- 2026-08-19 GOLDEN v2 FORMAL CONCLUDE (deployah): **RED**, run 32243884768 @bd942f6 concluded
  11:38:03Z (56m51s). Nine jobs: 7 green (both twohost legs GREEN — his structurally-red-prone
  flag not where this head failed; notify green), 2 red = the two already in triage (Linux
  clippy unused-import 496c3df; Windows ER a_cleanly_offline :1213 offline.spawned, code
  accepted, throttle absent, Linux-pass same run, family B write-set-cleared). Handed back
  doyle RCA-first, NO same-sha re-fire, main untouched @80ab77a, nothing landed/tagged. Box
  released (his pool long reaped, C: 49.01 GiB his timestamped read); the live cargo he named
  (pid 28576, fixture prebuild 04:38:32) = doyle's own rca-182-v2 x20 rig — attribution
  closed. NEXT: hertz corrective 3fe7717 (kitsubito clippy leg then push) → doyle re-gate →
  assemble head v3 → deployah FULL fresh intake, new golden ref; keystone-182-full stays
  pinned dead at bd942f6 beside keystone-182-w0w1 at f2d215a. Doyle x20 (Windows rate,
  pre-registered statistic) running to price the ER red before the v3 assembly decision.
- 2026-08-19 x20 CONCLUDED (doyle, rig rca-182-v2 @bd942f6, isolated single-cell, env scrubbed,
  exclusive box): **4/20 FAIL** (raw vector: F at runs 4,7,16,19; passes 5.8-10.0s; fails
  60.9-65.5s). WINDOWS RATE at bd942f6, as pre-registered. SIGNATURE SPLIT inside the failures —
  run 4 = the golden's face (code accepted, erhost not up in 30s); runs 7/16/19 = NEW THIRD FACE:
  rc stdout "'engine-room' is controlled by another window on this machine" (--view/--take copy),
  same :1213 offline.spawned invariant, throttle string ZERO in all 20, sid face ZERO. READING:
  (1) red is REAL and reproduces in an isolated single-cell rig — box-load and shared-state
  candidates cannot explain it; todlando's paired arm trigger (0/20) UNMET, arm stands down per
  its own registration. (2) Rate context: f2d215a 10/20 (throttle 6 + sid 4), 60d74ea 15/20 —
  bd942f6 4/20 with BOTH old faces absent = #197 killed the throttle face and hertz's control
  killed the sid face; the residual is a DIFFERENT mechanism: seat contention / non-spawn at the
  measured rc's attach, consistent with the dispatcher's codeless re-attach (serve_dispatch,
  todlando's confirmed single actor) now surviving uncounted where it used to shut the gate.
  Two sub-faces plausibly one mechanism at different race phases. (3) #197's e2e join is NOT
  fully delivered — gate arm works (code accepted), but the seat/spawn consequence downstream
  reds the cell 1-in-5. DISPATCH: mechanism capture + fix design round 2 to todlando (product,
  his #197, his serve_dispatch census); box released to him; my rig + 20 logs standing as
  reference (scratchpad rca-v2-runs). v3 ASSEMBLY HELD until the residual is fixed-or-ruled —
  a known 4/20 cell cannot ride a golden knowingly. Hertz clippy corrective proceeds in
  parallel (kitsubito leg + push); v3 takes both.
- 2026-08-19 ER RESIDUAL DESIGN ROUND 2 RULED (doyle on todlando's ER-BRINGUP-RESIDUAL-DESIGN.md;
  his claims source-verified in rig first). MECHANISM (his, verified coherent): warm controller's
  driven_by=Some(own hex) latch is TRUTHFUL (v3 ruling); `spt endpoint stop` satisfies the arm's
  precondition via terminal_normalize which writes ONLY status/rest_state/dormant_since_ms
  (info.rs:494-497) and structurally cannot clear driven_by; measured rc's current_driver
  (rc.rs:1312) is a raw disk read with no liveness check feeding pre_broker_busy_guidance which
  prints the controlled-by-another-window copy and exits Ok BEFORE broker traffic — races three
  daemon-side clears on tick schedules => 4/20. Cell's own vectors: truth_before==None 4/4
  (broker clean, disk dirty — asymmetry measured), control arm 4/4, offline arm only failer =
  only arm with a prior controller; 60-65s band = rig's own 45s+10s bounds, zero product signal
  (Q4 retired). RULINGS: (1) instrument first YES as pre-registered (info.json + elapsed at
  3 capture points, both-ways refutation arms). (2) Primary fix APPROVED reader-side, NARROWED:
  None exactly when status==STATUS_OFFLINE (the product's own livehost:983 staleness predicate,
  not a wider !=online invention); no new writer. (3) Belt (CLI clears control triple) OUT —
  second writer on broker-owned field re-opens the single-source class; the real defect there is
  terminal_normalize's DOC overclaim — amend by replacement stating the rest/control ownership
  split, same lane. (4) erhost-not-up face: instrument decides merge; if separate at 1/20, files
  as own alchemy BUGFIX with lane boundary (the #196 pattern), not this dispatch. REQ: no new
  mint — reader = second enforce site of REQ-HAZARD-DRIVEN-BY-SELFHEAL, impl/unit tags there.
  GATE SHAPE pre-registered: his unit + doyle x20 on fix tip expecting 0/20 (any red = finding),
  clippy/treqs. His flag adopted: main@80ab77a does NOT carry this work — design/fix reads at
  bd942f6-class trees only.
- 2026-08-19 ER RESIDUAL ADDENDUM RULED (crossed with the four rulings): (1) REQ ruling REVERSED
  to todlando's registry read — REQ-HAZARD-DRIVEN-BY-SELFHEAL (:1488) is daemon-scope by its own
  note, int leg would lie over a client claim; NEW REQ minted kin to KH 7.15 (impl/unit, rides
  build PR). (2) His find: the RETRACTED remote-only driven_by model survives in THREE encodings
  (info.rs:141-147 doc — the one that seeded his wrong premise; REQ-GOSSIP-CONTROLLED-ANY :1740
  TITLE; same REQ's stage note) while broker.rs:3038-3050 alone carries the v3 correction —
  retraction-sweeps-strings class, live cost measured (a design nearly shipped on the dead
  model). RULED: sweep IN his lane, census-first (grep all phrasings untruncated, classify every
  hit), all sites one commit by replacement, ids/coverage unmoved, declared extras; a PROD
  behavior site still encoding remote-only = stop-and-refer. Instrument-first + reader fix +
  belt-OUT + face-4 rulings unchanged.
- 2026-08-19 STALE-ENCODING CENSUS + REFER RULED (todlando census at bd942f6, untruncated, every
  hit classified; NO prod behavior site encodes the retracted remote-only model — display_status's
  defensive driven_by||controlled keying is why the stale premise never shipped a bug). EIGHT
  stale sites: info.rs:145-146 (set_driven_by doc, the premise-seeder), picker/model.rs:527
  (contradicts its OWN struct's :515 corrected claim twelve lines up), toml:1740/:1741
  (REQ-GOSSIP-CONTROLLED-ANY title+note), toml:1803 note, two triage docs, PLUS
  inject_control_wedge.rs:2347-2353 A1 = the retracted model as an ENFORCED GREEN ASSERTION.
  KEY FIND (his): the sweep is NOT new debt — REQ-DRIVEN-BY-OWN-NODE-NORMALIZE (toml:2834,
  v0.38.1, his own) stage-note item (d) NAMES info.rs's set_driven_by comment as a target and
  the REQ closed green with it unexecuted (coverage satisfied ≠ tags/claims correct). RULED:
  sites 1-7 sweep = OWN COMMIT on his fix lane branch, subject names the incomplete prior
  stage; toml:2835 note itself amended by replacement; gate reads sibling items (a)-(c)/(e)
  against source (amendment-falsifies-more-than-named). A1 assertion = HERTZ-CLASS, NOT #182
  scope, queued behind milestone with the eprintln lane; measurement question (legacy-path-true
  vs fixture-held-green) travels verbatim. Instrument rig er-instrument @bd942f6 proceeding,
  own pool from own cwd.
- 2026-08-19 ER INSTRUMENT x20 SCORED + BUILD GO (todlando rig er-instrument @bd942f6, 20/20
  runs, pre-registered table honoured verbatim): run-3 = seat-contention fail with
  (i)+2431ms driven_by=Some(own hex)+controlled=true+status=offline, (ii) same + rc EXIT 0 on
  the busy copy (print-and-Ok measured), (iii)+58421ms None — CONFIRMS LATCH, CONFIRMS LATE
  (his stated caveat adopted: (iii) post-reap, tick-vs-reap attribution unproven, fix
  reader-side under either). 19/19 passes (i)=None — race reading unrefuted. WHOLE control
  pair (driven_by+controlled) outlives terminal_normalize, as census predicted. Instrument
  rate 1/20 NOT comparable to gate 4/20 (capture bound phase-shifts the race; not an
  improvement claim). Erhost face 0/20 = arm UNEXERCISED, faces stay separate, own BUGFIX
  filed after fix lands. RULINGS: build GO; info.rs:135-139 field-doc widening JOINS sweep
  (declared before fixed); observation-3 (3/20 status-ABSENT mid-write reads at (ii)) ruled
  NARROWING STANDS, residual accepted with its number, re-opens only on a measured
  gate-instant absent-status refusal; his (a)/(b)/(c)/(e) DONE pre-check accepted subject to
  gate source read. Gate: unit + doyle uninstrumented x20 on fix tip expecting 0/20 (any red
  = finding) + clippy/treqs + sweep diff + stage-note sibling read. Unregistered observations
  (runs 8/13 post-reap Some on own new sid; run 16 (ii) Some = rc's own stamp) recorded
  as reported, no action.
- 2026-08-19 CLIPPY CORRECTIVE GATED: **PASS** @3fe7717 (doyle; hertz, test/keystone-182-hygiene,
  parent 6b484c5). Diff review: exactly one file (bounded_output_e2e.rs +2/-1), both non-Windows
  Command arms chain .no_window() (trait's deliberate no-op — design-intent shape as ruled),
  import live on Linux, zero behavior delta. Mechanical: hertz's kitsubito exact-tip proof
  `cargo clippy -p spt --tests -- -D warnings` GREEN 41.79s (real duration), dedicated
  worktree+pool claimed/released/removed clean. HYGIENE LANE TIP for v3 assembly: 3fe7717
  (4 commits on 728e1e2). NEW MANDATORY v3 COMPILE-GATE LEG (lesson priced): kitsubito
  WORKSPACE clippy --all-targets -D warnings at the assembled head — the golden's Linux step
  died fail-fast at the first error, so Linux workspace clippy has only ever executed UP TO
  bounded_output_e2e; further platform-conditional lint sites could hide behind it. v3 now
  waits ONLY on todlando's ER fix lane (reader fix + sweep commits, building).
- 2026-08-19 ER FIX LANE GATED: **PASS** @4ba27d3 (doyle; fix/er-driven-by-stale-reader =
  a241e9b reader fix + 4ba27d3 retracted-model sweep, base bd942f6). Doyle uninstrumented x20
  on fix tip: seat-contention face **0/20** (was 3/20 at bd942f6) — fix effective; erhost face
  survives **1/20** = the pre-split SEPARATE defect, rides declared. Rate table: 60d74ea 15/20
  → f2d215a 10/20 → bd942f6 4/20 → 4ba27d3 1/20. (Recorded from the pre-clear commune; this
  ledger's earlier tail predated the gate.)
- 2026-08-19 BOTH FILINGS IN (todlando; doyle re-verified each on the board, not relayed):
  releases#198 (rc busy-refuse stale driven_by, WIP+BUGFIX) ATTACHED as #182 TENTH member,
  greenlit-form addition comment 5342305050 standing BEFORE next golden; releases#199 (erhost
  second face, 1/20, unmasked-or-introduced open) filed BACKLOG+BUGFIX, NOT attached — carries
  the three-arm rate table + cli.rs:4183 truthfulness note.
- 2026-08-19 GOLDEN HEAD v3 ASSEMBLED + HANDED (doyle): stage/keystone-182-golden @`901a9f5`
  PUSHED = bd942f6 + 3 picks zero conflicts (0ca17f6=3fe7717 hygiene corrective, e8a3582=
  a241e9b, 901a9f5=4ba27d3). Fidelity 7/7 touched blobs byte-identical vs lane tips (lanes
  based on stage base, disjoint files — no content-strip needed). Compile-gate at 901a9f5
  (stage rig, main pool re-claimed stage-182 — overwrites the concluded rca-182-v2-fix claim,
  last-writer-wins by construction — env scrubbed, true exits): Windows workspace clippy
  --all-targets -D warnings 0 · treqs 780/780 exit 0 (= 779 + exactly the 1 ER-fix mint) ·
  binedge-check RED 0 · xtask check OK (xtask rebuilt from v3 tree) · NEW MANDATORY kitsubito
  WORKSPACE clippy --all-targets -D warnings 0 at 901a9f5 (bundle 8248bc3..tip via
  ~/spt-core-deploy, dedicated worktree, full graph proven: 127 Compiling + 280 Checking,
  cold own target; rig torn down, checkout left as found). Greenlit form: LIVE sub_issues =
  TEN exactly, all WIP, zero drops. HANDED deployah (SENT) for FULL fresh intake, new golden
  ref, keystone-182-full stays dead @bd942f6 — declaration set: erhost 1/20 residual = #199
  with pre-registered signature triage rule (erhost signature = #199 not the head; no
  same-sha refire regardless; other signature = doyle RCA-first); never-executed = #197
  int-side + IR-8 reap-census first CI run + W2 uncovered-runtime surface; W3 int cell +
  twohost rung CLIMBED at 32243884768, cited not re-declared. STANDING: stage-182 worktree +
  stage-182 pool claim until landing; builders' pools (keystone-w1, fix-197, er-fix,
  er-instrument) until landing; rca-182-v2 rig standing as ER-cell triage reference until
  golden concludes. AWAITING: deployah intake + golden fire.
- 2026-08-19 DISK FLOOR EPISODE CLOSED pre-fire (doyle + todlando + deployah, each own reads):
  floor fell 25.65 -> 17.14 GiB under deployah's cold intake build, v3 fire blocked on the
  32 GiB preflight (IR-46 instant). RECLAIMED: (1) todlando reaped er-fix (22.13 gross) +
  er-instrument (4.87 gross) rig targets = +20.29 NET vs moving baseline — after killing SIX
  leaked spt.exe pinning er-fix target BY PATH (three daemon+brain pairs from the x20 window,
  parents dead; populations proven disjoint from the fleet's AppData\Local\spt-core\bin procs
  before any kill); lane branches + worktrees intact, and he blob-asserted er-fix content rides
  901a9f5 5/5 pre-reap. (2) doyle reaped the MAIN POOL (113.58 gross, 15 procs censused ZERO
  from main target\debug, no lane owner, stage-182 claim verb-released first): main `target/`
  is GONE — next main-tree build mints a fresh pool, expect cold. Deployah's "fifteen days
  cold" main-pool read was a measurement artifact (top-level dir mtime is blind to nested
  writes — corrected, he filed the hazard); his caution adopted: report NET deltas, never
  gross-as-reclaim. Floor after: 150.96 GiB (+133.82 across doyle's window, overlap with
  todlando's reap + deployah's build stated, no single-cause claim). Fire unblocked on
  deployah's own read; declaration set unchanged. Husks gate-4884fba/gate-b05fea8 STILL
  handle-pinned (crates/spt-daemon busy, 0 bytes, retry queued).
- 2026-08-19 GOLDEN v3 FIRED (deployah): run 32256464931, ref golden/keystone-182-v3 @901a9f5,
  event push, created 13:08:57Z; intake comment 5342577767 at 13:08:39Z (18s pre-run, API-
  provable). INTAKE PASS all re-derived: ancestry 0-behind/22-ahead containing main+bd942f6;
  3 picks patch-id 3/3 vs 3fe7717/a241e9b/4ba27d3; fidelity 7/7 byte-identical; form TEN all
  WIP +#198 only zero drops, both addition comments pre-hand-off; treqs 780/0/0 exit 0 set-diff
  exactly +1 (REQ-RC-DRIVER-READ-LIVENESS, tags on real evidence); xtask check OK; Windows
  workspace clippy 0 NON-VACUOUS (37 Compiling + 324 Checking); v2 Linux clippy red settled
  from the TREE (no_window cfg(not(windows)) no-op chained both platforms — structurally
  impossible at this head); doyle's kitsubito clippy + binedge cited as doyle's measurements.
  His pool reaped pre-fire (9.23 measured, 8.42 actual, 149.79->158.21); floor 158.21 @06:07:37
  local, clears 32 by 126. TWO RIDERS recorded in the intake comment on the #199 rule (pre-
  registered, cannot be read into a result afterwards): (1) attribution is not landing
  permission — an attributed red is still a red run, next step doyle+operator (ADR-0050 tested
  sha == merged sha); (2) a GREEN draw on the 1/20 cell carries almost no information — never
  reported as #199 improvement. Watcher armed; red -> doyle RCA-first no same-sha refire;
  green -> doyle with per-job table, lands on doyle's authority not deployah's. QUIET WINDOW
  HOLDS (no local builds) until run + any verdict conclude.
- 2026-08-19 **GOLDEN v3 GREEN — #182 LANDED** (run 32256464931 SUCCESS 13:54:18Z, 45m21s, nine
  jobs nine green one attempt; both v2 reds closed at mechanism — Linux clippy import used both
  platforms at this head, ER cell PASS 6.864s with ZERO hits of either face's signature in the
  584818-byte Windows log, population 193 = v2's, cell EXECUTED not filtered; deployah's
  pre-registered rider honored: green draw ≠ #199 improvement, rate table stands 1/20 @4ba27d3).
  main FF 80ab77a -> 901a9f5 PUSHED, tested sha == merged sha (ADR-0050). Freeze-held register
  append re-applied (6 stash-pop conflicts resolved landed-text-wins; stash contributed IR-47 +
  IR-48 + built-evidence completions) + IR-37 upstream-closed-through-v0.4.0 recorded, landed
  @9ea595c. Board: #182 + all TEN members -> ACCEPTANCE via alchemy state cascade (GitHub
  closed-completed); landing comment 5343240049 records #199 as KNOWN-OPEN BACKLOG riding
  outside the close + the close-cascade/release-promotion reminders. Post-landing dispatches:
  todlando — keystone-w1 + fix-197 pool release/reap, #199 investigation GO at the landed head;
  hertz — hygiene + family-b pool release/reap, NEW treqs v0.4.0 consume lane (CI bump +
  placement config enforce-on, module_banner=accept; placement findings triage to doyle), then
  his standing queue. Teardown: rca-182-v2 + stage-182 worktrees removed, stage branch deleted
  local+origin (goldens stay pinned at their refs); husks gate-4884fba/gate-b05fea8 still
  handle-pinned, 0 bytes, retry queued. Floor 138.94 GiB. **AWAITING: operator acceptance of
  the milestone -> then deployah runs the release lane per RELEASE-INDEX** (his close reminders
  recorded on #182: close-cascade from milestone state verb, release promotes only
  closedAt < publishedAt). Queued after release: alchemy release verb roundup; #194 operator
  brief (NEEDS-OPERATOR); :1198 ledger row; erhost #199 falsifier arm (todlando's option).
- 2026-08-19 POST-LANDING CONFIRMATIONS + TWO IR FILINGS (doyle, post-clear session): (1)
  todlando reap CONFIRMED: keystone-w1 52.62 + fix-197 18.70 = 71.32 GiB gross, free
  140.92 -> 250.63 (net exceeded gross — my main-target delete was still landing; moving-
  baseline caveat honoured both directions). Discipline complete: real-dir classify, inbound
  reparse sweep clean, CARGO_TARGET_DIR empty x3 scopes, process census zero, subtrees only,
  POOL-OWNER rode each pool. (2) POOLGUARD DEFECT (todlando measured, doyle re-verified at
  lib.rs:424-436/:474-479): landed-lane predicate is ancestry-only; under ADR-0050 cherry-pick
  assembly LaneState::Settled is UNREACHABLE for member lanes (both lane tips NOT-ancestor at
  9ea595c while git cherry says all commits upstream) — takeover arm dead, contradicts AGENTS
  "merged branch is taken over". RULED infra not board: **IR-49** filed; patch-id fallback
  endorsed, conflict-adjusted-pick residual named (release via branch-deletion arm). (3) #199:
  todlando's arm-kill argument ACCEPTED — #197 touches only evaluate_bringup/classify_attempt
  (fires on Presented::Absent alone; rc.rs hunk comments-only, no cli.rs), spawn thread/poll
  loop/BRINGUP_READY_WAIT untouched, so the population reaching the 30s wait is IDENTICAL
  pre/post-#197; the 20-run pre-#197 arm is DEAD (no spend). Faces structurally separate
  (client-side disk read vs broker-internal session poll, opposite sign) — his own design-q3
  closed. (4) RIG STDERR BLINDNESS (his RCA): stderrlog::install repoints STD_ERROR_HANDLE at
  daemon start; panels hold only the pre-redirect window, real sink dies with temp home — 40
  runs zero daemon-side evidence either face, BROUGHT_UP absence proves channel dead not event
  absent. **IR-50** filed (class census = hertz-later); todlando GO on the four-panel
  instrument + mislabel fix in engine_room_bringup_e2e.rs, scoped THERE, rides #199 —
  investigation-instrument inside his GO'd lane, not the hertz test-rework class; sibling-rig
  sweep stays hertz. cli.rs:4183 ConfirmThenTake unguarded read stays CARRIED, unowned. (5)
  Register commit **4799031 LOCAL-ONLY** — push HELD for the tag window (hold-pushes rule);
  push after the v0.57.0-class tag. ⚠ RELEASE-GO FLAG: main sits at 9ea595c (docs-only) past
  tested 901a9f5; runbook tags bare HEAD — surface the delta to deployah at GO, tag must
  honour tested==tagged (ADR-0050). (6) HERTZ: treqs v0.4.0 first-enforce triage — 73
  missing_stage(doc) = UPSTREAM scanner regression (multi-tag-per-line drops all but first;
  doyle confirmed at CONTEXT.md:875, 7 tags one line), lane candidate 89526be stays blocked
  uncommitted, NO Markdown reflow (same-line multi-tag is core contract); the "8 expected
  misplaced_tag" — doyle read INFRA-REGISTER:1563/:1952: both are backtick-QUOTED tag mentions
  in prose, not evidence — second upstream class (code-span = quotation, must not scan) +
  audit rider whether v0.2 credits quoted tags with coverage (phantom-evidence hazard). His
  restore gap: NO earlier dispatch with four-arm anchors ever existed (full send-history
  searched — only queue mentions); authoritative dispatch ISSUED now from KNOCK-169-JIT
  :128-152 (per-arm eprintln at the MINTING node on the four redeem refusal arms, wire reply
  unchanged per REQ-KNOCK-REDEEM-WIRE anti-oracle; + survivor tokens per the pre-registered
  probe block; bar = "would have made this RCA a grep"). A1 verbatim RECOVERED from the ruling
  record and re-sent (two-readings: legacy-path-true-but-misworded vs fixture-held-green,
  site inject_control_wedge.rs:2347-2353, todlando authored the framing). bounded_output
  repro'd RED first run @9ea595c (helper timeout status=1, streams empty); his H1-first probe
  ladder acknowledged. STILL AWAITING: operator acceptance of #182 -> deployah release GO.
- 2026-08-19 #199 INSTRUMENT SCOPE RULED + TREQS CLOSED (doyle): (1) todlando's fence expansion
  ACCEPTED — measured shape (FIVE producers incl. :167 precondition panic, SEVEN print sites,
  seven relabels) supersedes the "four panels" estimate; load-bearing fence held (no product
  change / no sibling rigs / no 30s bound); partial-fix argument adopted (unrelabelled panel
  holding both streams = IR-50 defect re-created inside its own fix). "logs" literal accepted
  in-lane; exported stderrlog::sink_path(home) helper recorded in IR-50 as census-lane FIRST
  step (register amended @ecd640c LOCAL, push still held). UNTAGGED ruling upheld — instrument
  reads the sink, asserts nothing; tag would claim unmade evidence. His x40 @main with panel
  live IN FLIGHT, pre-registered in-file (erhost ~1-2/40; ANY seat-contention = regression
  finding post-#198; unsignatured red unfolded; no-BROUGHT_UP-no-SPAWN_FAIL red = instrument
  defect, stop-and-fix). (2) hertz treqs CLOSED: upstream BigscreenVR/traceable-reqs#20 filed
  (CONTEXT.md:875 reproducer, 73-delta, eight quotation sites — ALL 8 confirmed inline-code
  quotations — code-span rule); phantom-coverage rider answered: v0.2 credits all 8 as
  evidence but every affected stage holds real duplicate evidence (counts 2..59) — hazard is
  mechanism, not present coverage. 89526be committed-local-unpushed on ci/traceable-reqs-v0.4,
  blocked on upstream. AWAITING: operator acceptance of #182; todlando x40 report; hertz
  semantic-two rebases.
- 2026-08-19 #199 FIRST CATCH + IR-51 (doyle rulings on todlando x40 run-4): instrument WORKED
  — 97.4KB daemon sink where all 40 prior runs held zero bytes; control satisfied FIRST
  (BROUGHT_UP present -> absences are facts). STANDING FACTS: SPAWN_FAIL=0, launch Ok =
  spawn-defect arm DEAD; zero session events across the whole 30s offline window = never
  registered AT ALL, not late, no error anywhere. UNASKED-FOR FIND: rig daemon runs
  NET-ENABLED (peer pump + dispatcher up, real Tailscale/LAN addrs in erhome pair-meets,
  CI-runner-scoped firewall rule on the box; conn churn 327/324 @~150ms unattributed) ->
  **IR-51** filed own-id (local @8d4c224, held stack with 4799031/ecd640c). Pump-stall
  mechanism cited as candidate SHAPE only — discrimination open, and hermeticity must NOT be
  fixed into #199 pre-attribution (rule in the entry). RULED: harness witness (mock-session
  breadcrumb log, fixture-side only, panels dump beside sink) = todlando #199 lane, NOT
  census; broker-side instrumentation = stop-and-refer. Full sink parked in his lane records,
  path rides the x40 report. x40 continues (11 done, 1 red, on the ~1-2/40 pre-registration).
- 2026-08-19 #199 x40 CONCLUDED (todlando @4799031, code byte-identical to 901a9f5, docs-only
  delta; own pool, env scrubbed, panel live): **6/40 FAIL, one signature 6/6** (busy=0
  erhost30=1 throttle=0 spawnfail=0 broughtup=1 panel=1), reds 62.0-64.2s vs passes 5.6-11.6s
  — clean bimodality, no middle. Pre-registration scored item-by-item: seat-contention 0/40
  (#198 fix HOLDS across 40), throttle 0/40, unsignatured 0. Control held on EVERY red
  (BROUGHT_UP present 6/6 -> absences are facts); spawn arm dead 6/6 (launch Ok, SPAWN_FAIL=0,
  session never registered inside 30s). Rate 6/40 vs registered ~1-2/40: DEVIATION recorded
  WITH the ruled caveat — not head-attributed (different population, panel adds ~100KB read
  per red, IR-51 net-state nonstationarity); same-box same-window control is the
  discriminator, no regression filed. Evidence parked: scratchpad 3b45574d/x40-runs/
  run-{4,12,13,18,24,32}.log (~100KB each, sinks embedded, temp homes gone), loop script
  x40-instrumented.sh with pre-registration in header written before run 1. Cosmetic: run-25
  duration grep empty = HIS loop-script line-format miss, flagged so the column is not read as
  missing measurement. NEXT (unblocked, fenced): harness witness — mock-session breadcrumb
  (start/pid/args/each spt api shell-out with exit+stderr) into rig temp home, panels dump
  beside sink; `spt api bind` exit = the missing discriminator ("launch Ok, nothing
  registers"). Broker-side = stop-and-refer stands.
- 2026-08-19 ORPHAN QUEUE COMPLETE, ACCEPTANCE PROVISIONAL (hertz): semantic pair published —
  test/live-resolve-diag @53261a2 (dup output_bounded dropped, landed common:: retained,
  Output import restored; exact cell PASS) + test/teardown-bound-shape @681aee8+bec0523 (dup
  helper dropped, budgets/verdict/tag shape intact; grandchild unit 0.30s + resident e2e
  6.57s PASS). samepkg 6fbea74 RETIRED as ruled. READY SIX-LANE QUEUE ratified for next batch
  intake: census 5e7803b · owlery 0d1f3e4 · psyche 6da6e7e · IR21 instruments 061ddad+3 ·
  live-resolve 53261a2 · teardown 681aee8+bec0523 (fit re-verified at assembled base at
  intake). ⚠ BLOCKING FULL ACCEPTANCE: his proofs say treqs 776/776 TWICE where every
  KEYSTONE measurement at this head reads 780/780 (779 + ER mint; his own baseline said 780
  earlier today) — classification queried (tree sha / command / binary version per 776; if
  genuine, set-diff of the four missing ids required). His WORKTREES-AUDIT-JIT updated
  locally with disposition.
- 2026-08-19 776 CLASSIFIED + ORPHAN ACCEPTANCE COMPLETE (hertz): transcription error — stale
  Family-B 776 carried while the real summary sat past the displayed tail of a >50KB report
  (truncated-verdict class, self-named); fresh remeasure BOTH tips = 780/780, 0/0, treqs
  v0.2.0, exact command + full shas given. No set-diff; no evidence moved. Corrected bases:
  live-resolve merge-base ecd640c, teardown merge-base 8d4c224 — HIS LANES NOW DEPEND ON MY
  HELD LOCAL REGISTER STACK. Commitment recorded: 4799031/ecd640c/8d4c224 push VERBATIM after
  the tag (no amend/no rebase). Six-lane ready queue FULLY ACCEPTED.
- 2026-08-19 #199 WITNESS x20 + FORK (B) (todlando; doyle source-verified): 2/20 reds, both
  controls held; breadcrumb carried TWO harness spawns per red — first binds Ok (906-1240ms)
  and heartbeats, second returns Ok(ExitStatus(1)) in 19-24ms reason=bind-failed, its session
  id NOWHERE in the daemon sink (client-side refusal pre-daemon-write). Fork (A) refuted
  (harness ran), (C) refuted (honest exit 1, no broker contradiction — no refer), (B) fired =
  his RCA. Hypothesis (his, unclaimed): reserved-id bootstrap gate — doyle SOURCE-VERIFIED
  the cites at api/startup.rs:1090-1100 + api/engineroom.rs:160-178: refusal spelling
  RESERVED_ID:{id} on child stderr (= B1 grep target); completion path REQUIRES ER row
  pre-existing at bind ("daemon up by construction" premise); engine_room_hosted() has two
  indistinguishable false-arms (unreachable vs no-row; single-source-discriminant class) —
  B1's product-diagnostic refer PRE-APPROVED. x30 RUNNING (4th population, bind child
  stdout/stderr captured not inherited; B1 reserved-id / B2 other-sentence-not-folded /
  B3 capture-blind pre-registered in script header; n=30 for ~96% red chance at ~10%).
  Everything uncommitted on main working tree; fences held.
- 2026-08-19 #199 MECHANISM ESTABLISHED (todlando x30; doyle source-verified ordering): B1
  FIRED 2/2 — verbatim RESERVED_ID:engine-room refusal on the offline arm (20/18ms vs
  594/268ms successful control binds); B2 refuted (no other sentence), B3 refuted (capture
  carries BOUND: success sentence). CHAIN ADOPTED: spawn (broker.rs:5975) precedes session-row
  insert (:6174) by construction (InputWriter/OutputLog/translation between) -> harness bind
  races the row, ~7% loses... wins -> reserved-id gate false -> refusal -> exit 1 -> no
  registration -> 30s burn -> erhost-not-up. OPEN LINK: engine_room_hosted() false-arm
  ((i) unreachable vs (ii) no-row) — unmeasurable without product diagnostic. RULED:
  (1) fifth-population post-hoc re-query probe GO (strengthens-not-settles, pre-registered);
  (2) product diagnostic SHAPED: ER_HOSTED_PROBE:unreachable / ER_HOSTED_PROBE:no-row
  sessions=<n> eprintln at the site, answer unchanged — first commit of the #199 fix lane,
  NOT the rig work; (3) FIX FORK declared not ruled: (a) row-before-spawn / (b) admit-ticket
  rides spawn (key-rides-crossing-artifact; BROUGHT_UP mints one, consumer unknown) /
  (c) harness bounded retry — security gate, design ruling MINE after arm named + his
  one-paragraph invariant note per option; refusal sentence's circular advice rides the fix
  lane too. #199 board comment (chain + evidence) after arm named. Evidence:
  x30-refusal-runs/run-{4,20}.log ~107KB each, sinks embedded, pre-registration in header.
- 2026-08-19 #199 PROBE REFUSED-BY-BUILDER + ARM NARROWED (todlando; doyle verified cites):
  fifth-population re-query UNRUNNABLE as framed — every spt api call runs ensure_daemon()
  first (api/mod.rs:490, REQ-DAEMON-3) so the probe could start a daemon or LAND the session
  and delete reds; GO withdrawn, diagnostic supersedes. FREE NARROWING from existing x30
  capture: no DAEMON_START_WARN (:452, sole site) on either red with positive control in-
  channel -> ensure_daemon did not fail; "absent-but-started-fresh" excluded by rig
  construction (spawning broker alive mid-ready-wait, same SPT_HOME) -> arm (i) narrows to
  transient-dial-vs-live-daemon (pipe-busy class) at widest; recorded as narrowing NOT
  settlement, with the construction footnote. Fix lane opening: ER_HOSTED_PROBE diagnostic =
  first commit, then naming population; design note (a)/(b)/(c) after arm named. Rig work
  stays unmixed.
- 2026-08-19 #199 ARM NAMED + DESIGN RULED (doyle): arm (ii) ESTABLISHED — x40 on
  fix/199-er-hosted-probe @5db45f9, 3/40 reds, probe spoke 3/3: ER_HOSTED_PROBE:no-row
  sessions=0 (dial+query succeeded, table EMPTY at decision instant; beat broker to the
  table, not one entry). RCA filed by todlando as releases#199 comment 5344133768. RULING:
  (b) REFUSED on measured timing — mint_bringup_admit(:5747) keyed on session id, minted at
  ready-wait SUCCESS, ticket absent in race window, so reuse premise false and (b) = new
  credential + carrier costs; (c) REFUSED as primary (adapter obligation, window stays open),
  not mandated as belt. RULED (a-prime) = in-flight bring-up LEDGER outside the sessions
  table: endpoint->deadline map (TTL=ready_wait, swept like admits) written pre-spawn,
  removed at registration, expires on failed spawn; engine_room_hosted = sessions-row OR
  live-entry, carried via one field on brain sessions reply (internal IPC); sessions table
  untouched so (a)-PENDING blast radius vanishes by construction. Premise fixed at the fact:
  gate doc says "bring-up the broker STARTED", nothing recorded started-ness. RESIDUAL named:
  hand bind admitted during live window (same not-first-mover premise, TTL-bounded, CONFLICT
  arm downstream) — declared in lane design comment. CHECK ORDERED: reserved-id broker-side
  enforcement census — if client-gate-only, declare-vs-enforce-site finding filed SEPARATELY.
  REQ-ER-BRINGUP-INFLIGHT-LEDGER to mint on build PR. Probe extends to print inflight state;
  refusal sentence reword after ledger lands. todlando communing across, blocked-on-ruling
  now UNBLOCKED (ruling queued to his perch).
- 2026-08-19 HUSK RETRY (doyle, wake session): gate-4884fba/gate-b05fea8 re-classified (real
  dirs, zero files, only empty crates/spt-daemon skeletons, no git-worktree registration) and
  removal RETRIED — both still handle-pinned at crates/spt-daemon ("being used by another
  process"). Holder census: no process command line references either path; all spt/adapter
  processes run installed binaries (pin = a cwd handle from a live fleet process, started
  8/16-8/19; no handle.exe on box to name it). Killing fleet processes for hygiene refused.
  Harmless (0 bytes, gitignored) — retry queued for after next fleet restart. #182 checked
  same wake: CLOSED at 14:01:44Z was the landing flow itself (same actor+instant as the
  WIP->ACCEPTANCE label move, precedes the LANDED comment); label still state: ACCEPTANCE,
  zero comments past 5343240049 -> NO operator word, release GO stays held.
- 2026-08-19 #200 FILED+CONFIRMED+RULED (todlando check -> doyle ruling, comment 5344229135):
  reserved-id gate is client-only at the MINT seam, structurally — establish_perch
  (startup.rs:534) body verified zero Brain::/cold_start/spt_daemon:: refs at 5db45f9, no
  broker RPC exists to refuse at; daemon-side sites (registry.rs:782 incl. reconciliation,
  forkop.rs:79, autostart.rs:80) govern rename/fork/replay, never perch mint. engineroom.rs
  :136-141 premise quantifies over SEAMS, holds over seams, fails over PROCESSES. RULED:
  broker-mediated mint REFUSED — bind_engine_room_perch (broker.rs:10596) mints by raw
  write_info; perch store = unauthenticated same-user fs, so ANY gate above it (client or
  broker) misses the raw-writer population; real boundary already stated at :143-150
  (intrinsic bind auth + loud collision). REMEDY: doc-premise bound (quantifier limited to
  spt-authored seams in honest clients, #200 cited) RIDES the #199 lane's held post-ledger
  reword of the same comment block — one rewrite, cross-recorded on #200. (a-prime) build
  plan GO confirmed to todlando (QUEUED; he builds). No product behavior change under #200.
- 2026-08-19 #199 LEDGER BUILT + DIFF REVIEW PASS (todlando 8437b26 product + 0f8f483
  test-side; doyle read full diffs at tip): every (a-prime) constraint verified — ledger
  outside sessions table, pre-launch write on bring-up path (not shared choke), TTL=
  ready_wait, sweep-on-write w/ _at clock seam (admit precedent), clear under row insert,
  additive serde-default SessionsReply.bringing_up (internal IPC), hosted_in_reply pure
  decision seam both arms via is_engine_room, residual stated, REQ-ER-BRINGUP-INFLIGHT-
  LEDGER minted impl+unit tags-on-evidence, no-doc/no-int reasons sound. Probe now no-row
  sessions=<n> inflight=<n>; honest limit: inflight=1 unprintable (line prints only both-
  absent), red@inflight=0 = falsifier. His gates: clippy 0, treqs 0 via PIPESTATUS, units
  2+2 w/ nonzero filtered-out. NOTED not-blocking: mock .status()->.output() drops bind
  output from PTY on success path too. x40 field leg RUNNING (6th population, pre-registered
  0/N expected, new-population declared). MY LEGS (independent units/clippy/treqs) HOLD until
  x40 concludes — same box, reds load-sensitive, parallel build would manufacture reds
  (dispatch-window rule). Gate closes on his x40 verdict + my legs. Design comment w/
  residual = #199 comment 5344320868; #200 premise bound held for post-ledger reword commit.
- 2026-08-19 #199 GATE CLOSED — PASS @0f8f483 (doyle legs + todlando x40): x40 verdict 40/40
  PASS, pre-registered reading matched exactly (0 RESERVED_ID, 0 30s-sentence, 0 probe lines,
  6.1-8.4s all runs), sweep-verified on the 40 log FILES with test-name presence 40/40 as the
  sweep's own positive control; bounded negative as pre-registered (~95% chance of >=1 red at
  the measured ~7%), no rate claimed (6th population). Verdict-carried caveat adopted: panel
  prints on red only, greens inherit the naming population's control; green-printing panel
  REFUSED (7th population buys nothing). MY LEGS all green in lane tree (pool claimed
  gate-199-doyle, released): broker units 2/2 (1073 skipped), client units 2/2 (638 skipped),
  treqs exit 0 781/781 w/ mint [OK], clippy --workspace --all-targets -D warnings exit 0.
  .output() consumer census adopted (one consumer, direct-child stderr, mock-free; future-rig
  face on record). NEXT on lane: todlando reword commit (refusal sentence + #200 premise bound,
  one commit) -> my light re-gate (diff + touched-crate clippy + treqs; flagged: check whether
  REQ-ER-RESERVED-ID-SPAWN-REFUSAL title quotes the sentence). Lane = batch candidate next
  intake. STILL AWAITING: operator acceptance of #182 (re-checked this session, no word).
- 2026-08-19 #199 REWORD WITHDRAWN, #200 CARRIER AMENDED (todlando refusal -> doyle adoption):
  builder refused the sequenced refusal-sentence reword on post-fix reading — circular-advice
  reader (broker's own harness) DEAD by the ledger itself (passes gate, never reads sentence);
  survivors are genuine first movers for whom the advice is correct; sentence = shared
  single-source reserved_id_refusal across all reserved-id seams w/ equality unit, so naming
  bind-only in-flight state degrades the others (refusal-outranks-GO rule, 2nd application).
  Probe stderr already carries inflight=<n> at the one seam it means anything — no further
  surfacing. RULED: #200 doc-premise bound commits ALONE on the lane; commit message records
  withdrawal reason + surviving narrow face (TTL-expired entry -> first-mover advice, bounded,
  bring-up already gave up = try-again not circular). Pre-check: REQ-ER-RESERVED-ID-SPAWN-
  REFUSAL title quotes the COMMAND not the sentence -> no toml ride. #200 comment amended
  (carrier = bound commit, not reword; closes when lane lands). Light re-gate on bound commit:
  diff read + treqs + touched-crate clippy.
- 2026-08-19 #199 LANE COMPLETE + GATED @0c86b2d (doyle re-gate on bound commit): comment-only
  verified independently (-U0 non-doc-line filter EMPTY), bound text carries quantifier limit +
  measured-not-assumed + no-security-claim + over-read guard (daemon-side enforcement exists
  for rename/fork/autostart, in commit msg); withdrawal + surviving TTL-expired face + no-toml
  pre-check all in commit msg as ordered. Legs: clippy -p spt 0, treqs 0 781/781 both ER REQs
  [OK] — first treqs reading DISCARDED (Select-Object -First 1 closed pipe, treqs panicked os
  error 109, pipe-verdict class; clean re-run file-redirected). GATE RECORD posted #199
  comment 5344556706 (lane 5db45f9->8437b26->0f8f483->0c86b2d, all evidence + carried caveats).
  Lane = batch candidate next intake; #200 closes when lane lands. todlando DONE on lane.
  REMAINING WAITS: operator #182 acceptance (release GO); after tag: push held register stack.
- 2026-08-19 v0.57.0 TAGGED @a0f9ecd; REGISTER-STACK PUSH STEP SUPERSEDED (doyle): operator
  accepted #182 (recorded comment 5347108942); GO to deployah; deployah stop-and-refer — golden
  head 901a9f5 NOT release-shaped (no bump/changelog rode candidate; v0.56.0 already published).
  RULED Route A PROVABILITY-BAR (v0.51/v0.54 precedent) w/ 4 fences (exact-diff, armed-anchor-
  w/-duration, evidence-before-tag on #182 = comment 5347277294, tag-the-bump). deployah cut
  clean: bump a0f9ecd off 9ea595c, lock diff 14 first-party pairs, counter 92 decoded from
  signed metadata, derived set 151 rows green w/ nonzero N+durations, update-set labelled
  FILTERED subset. Tag v0.57.0 = a0f9ecd, true ff 9ea595c..a0f9ecd. PUSH STEP: the bump commit
  made my held stack (4799031->ecd640c->8d4c224, children of 9ea595c) a SIBLING of main —
  ff push impossible, rebase = rewrite REFUSED (hertz lanes live-resolve/teardown base on
  ecd640c/8d4c224 and are PUSHED to origin; fix/199 on origin CONTAINS the stack, so one-disk
  hazard already discharged). Stack rides the NEXT GOLDEN CHAIN verbatim (ff-only-absorbs-one-
  sibling-lane, how-to-apply arm). Origin/main lacks IR-49/50/51 rows until then — intake sweep
  reads local; do NOT read that absence as rows-not-filed. Remaining: deployah publish (assets,
  sign, counter 92) -> alchemy roundup + DONE transitions, ledger row, #194 brief.
- 2026-08-19 v0.57.0 PUBLISHED c92 @a0f9ecd (deployah, 20:22:17Z): 11 assets, verified-before-
  signed, latest-endpoint flip proven, round-trip decode (v92/0.57.0/stable/rel-primary-2026,
  ipc 1 + abi 1 matching pre-tag proof), closedAt<publishedAt by 6h. Release verb ran close-
  cascade: ten members + #182 all state: DONE (label-verified), roundup credits 11, notes
  parity HOLDS (#84/#85 collapsed to Internal line deliberately) — no append owed. Thin-red
  saga inside the window: 9ea595c thin Windows red (rc reconnect assert 33.65s) ruled NOT
  gating (golden executed cell green + byte-identical code + write-set clear + v0.47.0
  precedent); a0f9ecd leg green FULL population 2611; specimen OPEN at one failing obs,
  packet dispatched to hertz (rc-reconnect-assert-rca lane claimed hfenduleam 13:19:42);
  my #199 x40 sweep recorded as candidate load contributor to the 14:19Z red. deployah
  runbook release-shape commit 15abb52 push HELD for hertz's RCA window (quiet-window rule,
  ratified). #194 operator brief ALREADY POSTED (04:42Z comment) — pointer surfaced to
  operator; awaits their ruling, nothing to author. RELEASE-INDEX ledger line updated by a
  parallel maintainer (v0.57.0 + 1-of-4 release-shape stat) — I appended specimen + held-
  stack routing only. #164 THREAD: root MEASURED = timing (6/6 rig), lane STACKED on
  0c86b2d, discriminator proved rig flake = #199 defect (4/5 vs 6/6, anti-oracle sampler:
  unreachable refuted 0/225, er_first_in_table 201ms), field signature reproduced
  hermetically (promotes #199-refusal over hand-purge for HFENDULEAM unbound perch; hole
  stays labelled until post-ship re-probe). todlando minting REQ-ER-BRIEFING-PRESENTED +
  building (d). NEXT: milestone intake — sweep INFRA-REGISTER (IR-49/50/51 ripe; origin/main
  lacks the rows, LOCAL stack has them, absence ≠ not-filed), compose batch: #199 lane
  (0c86b2d, ordering: BEFORE #164), #164 lane (in build), hertz six-lane queue, bounded_output
  f570f95, engineroom.rs:145 misnomer rider (hertz), #177 cadence face (own item). #199 field
  re-probe on HFENDULEAM ER perch rides the NEXT release's fleet update, not v0.57.0.