Statiker

Certify the design bears load before construction, construct
without designing. The loop is free — investigation refines,
confirms, or forces adjustment until the design stops moving AND
carries the implementation detail execution needs. Five forcing
points stand guard; everything else is judgment. Thin in ceremony,
never thin in forcing points: the failure prevented is
skim-and-build under momentum, and the forcing points ARE the
anti-skim mechanism — top-tier models exhibit it too
(dev-notes/OBSERVATIONS.md in the source repo,
github.com/Gunther-Schulz/statiker — home of all PLAN.md and
dev-notes references below).

Composition (declared dependencies)

Statiker cites instead of restating — a recorded design decision
overriding context-independence (PLAN.md, Ecosystem composition):

• dispatch skill (dispatch-guards:dispatch): the brief form and
  decision-completeness test (§1), report form + brief tails (§2,
  references/forms.md). Load it before the first dispatch (a hook
  enforces the load). Where the stack cannot load it — no skill
  system, so no hook and no enforcement either —
  references/dispatch-forms.md (under this skill's base directory)
  is the binding source: read it before the first dispatch, and the
  forcing points that cite the skill above cite it instead. Its
  absence is SILENT, which is why the substitute ships: nothing
  checks a brief against a form that is not there.
• executor skill (dispatch-guards:executor): conduct of briefed
  work — every EXECUTION brief cites it; verifier and attack briefs
  never do (a fresh context briefed with conduct-of-building material
  is being framed as a builder).
• The operator corpus, where the stack has one, carries the
  grounding and evidence ethics (bases, refutation probes,
  altitude), assumed not restated; without one,
  references/evidence.md (under this skill's base
  directory) is the binding source — read it before the run's first
  entry; on such a stack attack and verify briefs cite it in place
  of the corpus.

The tools

Two scripts under this skill's base directory (the Skill injection's
base-directory line names it; invoke with python3):
scripts/statiker_git.py = git transactions: run-start preflight,
LOCK commit, unit START and COMMIT; scripts/statiker_record.py =
record grammar: tracker lint, the [READY] sweep's computable slice,
the closure predicate, the pinned attack artifact, the append-only
check against the pin (pinned), the verify-leg copy-freeze check
(verify-gate), the never-sustain round-open gate (sustain), the
zero-landed progress tripwire (tripwire), defanged quote blocks.

The two scripts plus their red-first battery (the source repo's
tools/ suites) are the EXECUTABLE SPEC of the record grammar and the
transaction semantics: the contract lives there, this page keeps
principles and desk conduct, and a divergence is graded against the
battery, never against this page's wording.

Principles the desk relies on: a path is taken AS NAMED in every git
operation, never substituted; containment resolves toward SAFETY — a
must-be-inside path (lock-set, write-set) is decided on its REAL
resolution, a must-be-outside path (artifact, seals, attack
worktrees) is outside only when named and real form agree — any
realpath acceptance noted per path in the verdict as resolved_from;
a path problem halts at a CHECK, never a commit. Byte policy both
directions: git byte output decodes the way the OS decodes argv, and
verdict and quote output emit at byte level over the input's own
bytes (a tool re-spelling a byte mints the second spelling the input
rule prevents). The record tool anchors its repo at the TRACKER's own
directory, the git tool at its invocation cwd — briefs invoke it from
the repo root.

Every invocation — usage errors included (USAGE_ERROR); --help
alone excepted (argparse answers verdict-free) — ends in exactly one
final STATIKER-GIT VERDICT: {json} or STATIKER-RECORD VERDICT: {json} line, evidence lines before it; the desk books THAT LINE
verbatim as the basis of whatever entry the verdict obliges; an exit
code is routing convenience, never the result.

Happy paths route in their own sections; lint alone answers ad-hoc
grammar questions (LINT_CLEAN / LINT_VIOLATIONS; sweep includes
it); quote and filter return QUOTE_BLOCK and ARTIFACT_WRITTEN
with production counts; waves returns WAVES_COMPUTED — units
sharing a declared write-set path grouped, members of a group
SERIALIZE; scheduling across groups is the desk's, read from the
D-lines (Implementation, "Disjoint is a write-set answer"); a unit
whose record lines declare no live write-set comes back UNPLANNABLE,
never placed (a unit with no unit U<k>-bodied entry appears in
neither list); the partition is no dispatchability read — the
per-unit gate stays closure --unit.

trend returns TREND_COMPUTED / TREND_NO_ROUNDS: per-round F-LINE
counts (every F-line in a round's span, not attacker findings alone)
with an arithmetic trajectory verdict; sustain returns SUSTAIN_OK /
SUSTAIN_DENIED / SUSTAIN_NOT_APPLICABLE, the never-sustain round-open
gate (The attack, "That closes design"); tripwire returns
TRIPWIRE_FIRES / TRIPWIRE_SILENT, the zero-landed progress tripwire
(The record, Budget); all four halt WAVES_RECORD_MALFORMED /
TREND_RECORD_MALFORMED / SUSTAIN_RECORD_MALFORMED /
TRIPWIRE_RECORD_MALFORMED where an entry-shaped line broke the
grammar, repaired like any lint hold (corrects line <n> composed
from the verdict's violation lines).

ANY verdict no section names is a halt for the seam that ran it —
booked as a record: F-line from the verdict line, the seam's halt
route applying (the catch-all: TRACKER_UNREADABLE, PIN_UNREADABLE,
NOT_A_REPO, PATH_OUTSIDE_REPO, PATH_INSIDE_REPO, USAGE_ERROR,
GIT_ERROR, INTERNAL_ERROR, and any future member); one override on
every route: a halt verdict carrying a shas or sha field has
LANDED commits — routed like HALT_RESIDUE_PERSISTS, never as
uncommitted.

Route vocabulary

A verdict's token is the FAIL-CLOSED member of its page
dispositions: the one that books and halts wherever this page's
own seams treat the same verdict name differently. A seam may be
more permissive than its token only through an explicit sentence
at that seam; the token itself never under-states the obligation,
so a desk reading only the token is never unsafe.

Every verdict line carries a route field — the tool's own stamp,
one lookup against a closed eight-token vocabulary; the desk reads
it rather than re-deriving a verdict's disposition from its name. A
route token names the desk's seam-invariant disposition class — the
(record obligation, resolver, continuation) triple — never the
seam- or mode-specific conduct, which stays this page's principle
per class:

• proceed — the asked act succeeded or the state answer permits
  the next act; the invoking seam's own conduct consumes the
  verdict's fields. No new booking obliged by the route (a seam's
  own duty — landing annotation, quote-in-brief, quote-at-round-
  open — stays that seam's principle, each with a mechanical
  backstop where one exists).
• book-and-continue — the act LANDED or the answer stands, AND
  the verdict carries a finding: booked as a record: F-line (or
  the drop supersede form) from the verdict line, work continuing.
• repair-from-verdict — the record needs a mechanical repair the
  verdict itself names (violation lines with class and repair form,
  an embedded gate verdict, an undispositioned set); compose the
  repair from the verdict, re-run the gate. Judgment residue the
  verdict names returns to the desk.
• barred — the tool worked and its answer is "not now / not
  this": the asked action is denied by run state already in the
  record. Nothing to book (the state IS the record), no transaction
  failed; resolution is the run's own machinery (the hold entry,
  the closure re-derivation, waiting on the gate).
• narrow — the verdict routes to the attack's NARROWING route,
  never another same-form round (The attack keeps narrowing as
  principle; the token carries the destination on the verdict line
  itself).
• halt — the seam stops; the verdict line is booked verbatim as a
  record: F-line; nothing landed UNLESS the verdict carries
  shas/sha — routed like HALT_RESIDUE_PERSISTS, kept above;
  attended, the operator's clearing reply re-enters; unattended,
  the seam's own close rule applies.
• surface — operator ground: no desk resolution exists (a
  tampered pin, an unpinnable tracker). It carries halt's booking
  obligation (the verdict line books verbatim as a record:
  F-line) AND routes the resolution to the operator rather than the
  desk. Attended it leads the next prompt; unattended the run takes
  the seam's terminal disposition (FAILED / rides the close).
  Distinct from halt by resolver: a halt's clearing can be desk
  work on provenance; surface never.
• triage — the verdict is complete evidence for a desk judgment
  between dispositions this page names (stale-copy harmless vs
  re-run; contention provenance; the residue check). Judgment stays
  prose; the token tells the desk it is AT a judgment seam and
  where its dispositions live.

The unrouted verdict: emission never fails on a registry gap — a
verdict name the registry lacks stamps route: "unrouted". A
verdict whose route field is absent, unknown, or unrouted is a
HALT for the seam that ran it, booked from the verdict line —
fail-closed, the same catch-all above.

The two-route rule: where a verdict line carries an embedded
verdict (the git tool's gate field), the OUTER verdict's route
governs the seam; an embedded verdict's own route is evidence about
the inner call, never a second instruction.

Unit briefs carry the git tool's ABSOLUTE path and its invocation
lines — the tool is the shared implementation, so no lock-procedure
text is ever expanded into a brief. The record tool is DESK-only: no
attack or verify brief ever cites it (those contexts' independence is
the point). Provenance and red-first suites: the source repo's
tools/test_statiker_git.py and tools/test_statiker_record.py.

At run start, before any design work: preflight --tracker <path>;
PREFLIGHT_OK proceeds (also reports any in-progress operation,
informational here). Preflight runs a DEDICATED index-reading
repo-health read — a corrupt index halts here, before any work rests
on it (mid-run corruption surfaces at whatever seam meets it);
strictness is the health read's alone — every other read keeps its
DOCUMENTED exit semantics: a non-error exit (the ignore check's
not-ignored) is an answer, an error exit of any read still halts.

PREFLIGHT_UNPINNABLE_TRACKER = the repo ignores the tracker path and
can never pin this run's record — surfaced to a present operator
before further work; unattended the run closes FAILED at minimal
cost (Close, Status written FAILED); any other preflight verdict
surfaces the same way. The state-gate subcommand (STATE_CLEAN /
STATE_IN_PROGRESS) is the re-entry instrument: an attended halt's
clearing reply is verified by it before the halted procedure
re-runs.

Containment is DECLARED, never inferred: --containment <path>,
repeatable, names the run's authorized filesystem scope. Undeclared,
preflight REPORTS and gates nothing — the effective pre-commit hooks
path as git itself resolves it (never the config string, which leaves
tilde expansion to the reader) with whether it lands inside the
working copy, and the seal and artifact namespace roots this run will
require. A global hooks path pointing outside every working copy is
an ordinary machine configuration, so a hold that fired on it
unconditionally would fire on non-defects and train the override
reflex every guard dies of.

Declared, those same facts GATE. Three axes are checked together, so
one verdict carries every failure. The resolved hooks path lands
inside the working copy or inside a declared path. Each required
namespace root lands inside a declared path. At least one declared
path lies outside every repo: the attack worktree is mandated
outside every repo, so a scope of only in-repo paths is
unsatisfiable before a single cycle spends.
PREFLIGHT_CONTAINMENT_HOLD names each failing axis and routes
surface. Widening a containment scope is the operator's.

What the gate does not reach is stated on every verdict the gate
itself returns — PREFLIGHT_OK under a declared scope, and the hold —
rather than left implied. An earlier refusal returns before the gate
runs and carries none of it. The attack worktree's actual PATH
is desk-chosen at attack preparation, so the gate establishes that a
legal parent EXISTS in scope and never that the desk will choose one;
worktree-add halts on the path itself.

The record (forcing point 1)

Append-only tracker at .clippy/runs/<yyyy-mm-dd>-<slug>.md —
clippy's ledger convention. Of the stats reader's contract, the
ADMISSION half (Status/Phase enums in the header window) is
maintained and pinned; its per-metric
greps are NOT maintained against this grammar — SERIES metrics come
from the record tool's trend verdict (unit parallelism from
waves), never from the stats reader's counting literals. The
disclaimer is scoped to the counting metrics alone: the defang duty,
bare tags, tag-first counting, and the landing indent stand on the
record tool's own parsing and the closure gate. Never overwrite
another run's tracker; resume
an in-progress run from its tracker, not from memory. That resume
compares the header's Skill: version against the version this desk
is SERVED (the Skill injection's base-directory line): a release
reaches a running desk only as a RESTART, never as an upgrade — the
pin resolves at session start and the already-loaded skill text owns
a live desk's conduct, so a delta means desk and record run
under different rules — in either direction: an OLDER desk over
a newer record proceeds no further than the record gate and
WRITES NO CLOSE — a desk under the wrong rules appends nothing;
the run stays in-progress for a correctly-versioned successor,
and the surfacing is the desk's reply, not a record write. On a
mismatch the desk names
the VERSION PAIR before the next forcing point — and what the
delta invalidates only where the older text is at hand (the
source repo's git); a desk without it surfaces the pair at the
run's next operator touchpoint rather than reconstructing the
delta from memory — and
records — on the MISMATCH only, carrying the SERVED version (the
header keeps the version that wrote it) — the BARE label line
SKILL: statiker <version> in the body region — after the head
region ends (below, the head-region boundary and its
## Requirement head exception), standing alone, never inside a
tag-first entry line — surfaced
with the header's version as skill_versions in sweep and closure
verdicts (attribution, never a gate): the Skill: line is pinned
surface — Status and Phase are the only mutable fields — so a header
rewritten to the new version reads as tampering, not as an update.
A resume opens with the RECORD GATE before any design work: sweep
and closure first, whatever the cause. Verdicts route by KIND —
closure's state verdicts CLOSURE_ABSENT, CLOSURE_LIVE (the
mid-design normal) are information, never halts; CLOSURE_VOID bars
units, not the design work this gate runs ahead of; only FORM holds
gate. The repair route covers FORM holds only (grammar, lint,
dead-basis classes — the ones a stated repair form can close),
repaired through a DISPATCHED mechanical leg on the cheapest capable
tier (the routing table's execution default); the verdict names each
violation's class and repair form, so the brief is decision-complete
by construction, and judgment residue the verdict NAMES returns to
the desk, never decided in the leg. The leg is the tracker's ONE
WRITER for its duration (the desk's own appends wait — the attack
freeze's shape) — a tracker that moved under the leg is the leg's
halt: report, never repair over a moved file.

Latest-line [PENDING]s from open legs are LIVE WORK, not repair
material — they resolve by the ordinary body-read of their returns;
clearing one to [AUTO-ACCEPTED] to satisfy a gate destroys the
evidence the tag holds open. The desk grades the leg's return by
re-running sweep, closure, AND pinned against the standing lock
itself, never by the leg's claim — the positional pair reads an
in-place rewrite as clean and the pin diff is the one check it cannot
fool, whether or not the leg committed. A record with no pin yet is
young and its holds few — there the repair is desk work; a hold set
small enough that the brief would rival the repair stays desk work;
the desk's context carries verdicts, not the repair work.

The gate covers FORM; a resume also re-runs the record's dated
WORLD-FACING discharges: a staleness check measured at its date
expires with every commit since — re-run the bounded diff git diff <the discharge's read sha>..HEAD -- <the design-cited paths> before
any work rests on the record's citations; the discharge line carries
the sha it read at, which IS its expiry anchor (one without a sha
looks unexpired forever and re-runs unbounded); a discharge NAMES ITS
OWN EXPIRY, so the next resume inherits an obligation, never a
reassurance.

A resume also reads the newest round's QUEUE (seal-path
prints it): an unspent queue is inherited work — land and spend
it before new appends — the resume's order: version pair →
record gate (its leg, if one, returning first) → world-facing
discharges → queue land+spend, then re-run sweep if the queue
landed lines — except where the newest A-line is
[DISPATCHED] (a desk died mid-round): the append freeze still
holds, the round re-enters as its own round, and the inherited
queue lands and spends at that round's terminal A-line. A resuming
desk's first reply enumerates the run's standing operator state
read from the record — the Mode line, every live operator-imposed
hold, any mid-run INTENT line — shown as INFORMATION, never
re-asked: frozen operator ground only its owner lifts, and a lift
arrives as an operator line, not as an answer to a desk question.
An entry ADOPTED — content re-entering from outside the record's
live entries: a prior or superseded run's tracker, session memory of
work no live entry records, or a clause restated out of an
invalidated entry (citing a LIVE entry as basis is not adoption) — is
recorded [PENDING] under this run's own next id at adoption. That
SAME id carries the resolution once a current-check scoped to the
claim runs (re-read the cited lines; staleness-check against commits
since the basis read — an earlier item's own implementation
invalidates reads of the files it touched): pass → the entry class's
live tag citing source AND check; fail → [INVALIDATED] with the
failure as basis. Unrecorded memory of prior work is never a basis.

Header: # Run: <title>; Status: from
{in-progress, [READY], PASSED, FAILED, COMPLETE}; Phase: from
{investigate-design, implement, verify}; Skill: statiker <version> (version read from the Skill injection's
base-directory line — the plugin cache path carries it); optional
Mode: attended (Stop rule; absent = unattended, the default);
Budget: cycles <n> / rounds <n> / verify <n> — the run's declared bound over every repeating seam,
defaults 7 / 4 / 3, declared at run start where a successor reads
it (an unattended loop without a declared bound terminates on
context death, the one ending that produces no readable verdict).
The line takes an optional trailing / tripwire <n> field — the
zero-landed tripwire's own arming carrier, written at seed. Arming a
LIVE run, or tightening an already-armed one, LANDS as an appended
record: -scoped entry (the header is pinned surface, never
rewritten): - F<n> [VERIFIED] record: tripwire armed at <n>[ — "<the operator's line verbatim>"] — basis: <operator|desk>; the
tool resolves the threshold as --threshold (always overriding) >
the LATEST such entry > the header Budget line's / tripwire <n>
field > unarmed, so an appended arm REPAIRS a record seeded with a
bad or absent header value — the header is never consulted once an
arming entry exists. The entry supersedes like any other — a later
line under the SAME id wins, and RETRACTION (that id re-tagged
[INVALIDATED]) is the disarm form, so the tool falls back through
the order as if the arm were never written. Arming, or tightening
an armed tripwire, is the desk's; RAISING the threshold or
disarming is an operator decision, the same split the budget bound
below carries (basis: operator on that entry). A Budget line with
no tripwire field and no live appended arming entry leaves the
breaker unarmed (below).
Exhaustion never continues silently: attended it forces the operator
prompt; unattended the cap is a SAFETY ESCAPE only — hitting it
STOPS-AND-REPORTS for the operator, never grades FAILED by itself.
The DRIVING stop signals are progress-shaped and record-computable,
checked well before the cap: the ZERO-LANDED tripwire (tripwire --tracker <path> [--threshold <n>]; TRIPWIRE_FIRES when at least
<n> resolved attack rounds exist yet neither a landing annotation
nor a V-line does anywhere; <n> comes from the arming carrier
above — named at arming time, never hardcoded, never guessed; a
header field naming tripwire with no usable value refuses
(USAGE_ERROR), and only a Budget line carrying no tripwire field
at all is TRIPWIRE_SILENT with reason "unarmed")
and the NON-CONTRACTING trend grade (The attack) — BOTH route to the
NARROWING route (The attack), never to another same-form round.

Housekeeping never bills the budget (record-repair legs — The
record, the resume's mechanical leg — and sweep/closure passes are
meta-owned, outside cycle accounting); excess iteration is a
SYMPTOM, never a verdict; a stop-and-report fires as a MINT SOURCE,
and the ROUNDS BOUND is a CANARY — its firing always points at
structure (tripwire arming and thresholds keep their own split,
above). The exhaustion's cause lands where the stop lands:
attended, in the operator prompt the stop forces; unattended, in
the close beside the open reconciliations. A raise entry carries
the cause in its own body (the template's cause slot, below),
filled by the desk from the discriminating evidence; the
operator's raise LANDS regardless — the bound is theirs — and a
raise entry missing its cause is a gap the desk repairs on sight
by appending the cause under the same id, never a refusal of the
grant. A proactive raise granted before any exhaustion takes
cause: operator discretion. The cause is a READ, not a
composition, from the DISCRIMINATING EVIDENCE pre-registered at
arming (the trend verdict for arithmetic, named locus body-reads
for repair-versus-account, each terminal entry's class split);
the generalization — which change makes the class not recur — is
the MINT-SOURCE duty's half, owed at the close, never composed
into the stop's cause line. A computable cause becomes a named
tripwire; a breaker tripping twice for one cause indicts the
missing tripwire. THREE ENDINGS, all
operator-owned: FAILED (operator refuses the run); EXPORT (operator
re-scopes; displaced scope exits per The loop's exit machinery to a
backlog entry); CONTINUE (a disposition GRANTING the closing round
as an ordinary budget-raise entry, so the route back to the gate is
machinery, never improvisation).

The bound is operator-owned from the moment it is recorded: the desk
SPENDS the budget and never raises it; a mid-run amendment is an
operator decision whatever provenance class the bound's text
carries. An operator raise LANDS as an ordinary entry quoting the
operator's line (the header is pinned surface, never rewritten), and
every later exhaustion check reads the LATEST such entry over the
header's default. The raise line's template: - F<n> [VERIFIED] record: budget raised to cycles <n> / rounds <n> / verify <n> — "<the operator's line verbatim>" — cause: <the named structural cause, or: operator discretion> — basis: operator (the record:
opener is what voids no closure and re-opens no unit;
machine-findable surfacing in the verdicts is parked tool
work — until it ships, the exhaustion check's read is a
body-read for this template).
Status and Phase within the first ~20 lines (the stats reader's
admission window); after the header the requirement head in two
grades declared apart: INTENT — the operator's request VERBATIM as
PLAIN text, never a > blockquote (the grammar reserves > lines
for Superseded blocks: a blockquoted INTENT lints illegal, and the
one lint-legal quote form is exactly what the attack filter
drops); verbatim binds the words, not tag literals or layout — a
bracketed tag literal inside the operator's text is defanged
exactly as report quotes are, the mutation noted beside the line
(undefanged it holds every later sweep, correctly, until a
correcting entry defangs it — an INTENT line parses no entry, so
it clears the owner-less way, below); derived requirements as long
as needed, numbered R<n>. —
never dash-led - R<n> (the amendment form);
verify reads this head plus its R-lines, not the conversation.

At requirement-head composition the desk gauges the item's WRITE-SET
SPAN, bidirectional and entry-boundary-skeptical: find-time entry
boundaries are claims the seed RE-DERIVES, never adopted unit
boundaries; intake re-derives the unit set from the entries' write
boundaries and the current world — slicing an oversized entry AND
batching under-sized siblings whose write-sets overlap: each
candidate unit names the files realizing it, and units naming an
overlapping file merge or serialize (a mechanical join over each
candidate's declared write-set, the instrument); a migration-bearing,
multi-consumer, or architecture-wide item seeds as a DECOMPOSITION
run whose done-criterion is exported unit-sized backlog entries —
implementation runs seed per unit, never the architecture-scale item
whole.

Distinct from The attack's narrowing route (the in-run early
decomposition round): this gate fires AT SEED, before any cycle
spends.

(hypothesis) The head derives from INTENT + the PROFESSIONAL
STANDARD, never INTENT alone; an underspecified INTENT derives the
quality requirements a competent shop would — a size and complexity
budget, no unjustified abstractions, a threat model where inputs
cross trust boundaries — as R-lines gradeable by judgment, never
lint; the derivation is the run's first and largest design act and
iterates with the loop. Where the INTENT supports one, an R-line
carries a success metric (a real number the work moves); R-lines
state the PROBLEM at its own altitude — a solution choice inside an
R-line locks design prematurely and dodges the attack; solutions are
D-lines. An underspecified INTENT also derives a CUSTOMER-LEGIBLE
mirror: a 3–6 sentence announcement-form restatement of what ships
(mockups for UI work), recorded as an R-line the customer could
grade, which reconciliations reference; a full-spec INTENT derives a
near-empty complement, and a deviation from the spec's letter
escalates as reconciliation, never a silent derivation.

A derived
requirement is inherited text (a backlog item, a prior session's
plan, intake derivation), not operator ground: when the run's own
investigation contradicts its letter, the desk amends it by
R-line — - R<n> [AMENDED] <new letter> — basis: <…>, an
ordinary entry the attack grades like any decision. A
contradiction reaching the INTENT is a reconciliation for the
operator: evidence and recommendation surfaced when found, the
recorded recommendation advancing an unattended run (the [READY]
prompt's pattern); one advanced unattended stays OPEN —
re-surfaced at each operator prompt and at the run's close —
until the operator answers. An ask on OPERATOR-AUTHORITY ground —
one only an operator line satisfies: an exemption grant, a bound
raise — cannot advance on a recommendation; it lands as an ordinary
[PENDING] entry under its own id, its body naming the gate where it
bites (gate names written defanged — the tag-literal rule), and
holds exactly what a live [PENDING] holds: work outside those gates
continues, and the entry is what a resume read and the close find.
The mandated stops keep their own rules — budget exhaustion,
preflight surfacing, an attended halt's clearing, the
non-contracting prompt, the irreversible-unit hold; this class is
none of them. Attended, the ask leads the next prompt as a labeled
decision line; unattended it rides the close with the open
reconciliations. An advance prompt's "y" answers loop advance only —
a grant enters as the operator's line quoted in the clearing entry
(— basis: operator), never inferred from an advance. An authority
ask contests no text and skips the provenance trace.

Escalation is PROVENANCE-GATED:
before a question routes to the operator, trace the contested
text to its origin. Operator words escalate as reconciliation;
derived text — R-lines, inherited constraints, a run
instrument's policy — is desk work: amend or carry
[AUTO-ACCEPTED] with basis, presented as INFORMATION at the next
seam, never as a question. An operator-imposed hold is always
theirs. Attended mode moves WHERE decisions are presented — the
seams — never WHO makes them; a question the record can answer,
asked anyway, spends the operator's one seat.

A mid-run operator instruction that changes what the run is FOR
appends at the record's END opening with the literal label
INTENT: , its authority the operator's words; never inserted under
the head (append-only is positional: an insertion shifts every line
number under a live corrects reference); not an R-line (R-lines
are derived text, operator words are not); the desk states which
live decisions it kills — a killed one takes the scopeless
[INVALIDATED] route, the closure voids and the design re-enters;
every sweep and closure verdict LISTS the late INTENT lines it found
(late_intent), and verify grades against the head plus every
listed line — the tool, never memory or conversation, finds them;
conversation is the one channel verify never reads.

(hypothesis) The record's one mutable surface is
the header's Status and Phase fields, updated at each transition
and at the verify verdict; everything below them is append-only.
Status writes its enum member verbatim — [READY] keeps its
brackets (the header parse and the stats reader both admit only
the bracketed form).
Run lint once header and head are written — a form defect found
then costs re-creating a one-screen file, found at the [READY] sweep
it holds a full record whose head append-only cannot rewrite. The
append-only claim is checked mechanically once a pin exists: pinned --tracker P --sha S — the two mutable field lines exempt, every
other line binds byte-exact against the pin; PINNED_APPEND_ONLY
proceeds; PINNED_REWRITTEN halts the seam that ran it, first
divergent line in the verdict (an in-place TAG rewrite reads clean
to every positional gate; the pin diff is the one thing it cannot
fool); run it at resume and before any re-lock; S is the standing
lock, recoverable as the newest commit touching the tracker (every
lock's pathspec carries the tracker, and nothing else legitimately
commits it).

Entries are one line each, status tag first, appended never
rewritten (the templates below wrap only on this page). A status
change is a NEW tag-first line for the same id
(- D<n> [INVALIDATED] <why> — basis: <…>) — never an edit of the
old line; the record tool parses entry state from tag-first
lines alone.
The record's machine tokens are CASE-SENSITIVE LITERALS, not
phrasing: the entry head - <C><n> , the scope openers
unit U<k> and record: , the hold form unit U<k> held:
(that exact prefix as the body's opening — a hold written any
other way holds nothing), the write-set declarator
write-set: after its unit scope opener (Implementation), the
corrects line <n> repair token, the tripwire arming form
record: tripwire armed at <n> (an entry's own appended arming
route, The record tool; class F, tag VERIFIED — near-miss lint
class tripwire-arm-near-miss, since an arming entry's whole
purpose is to be load-bearing at a seam nobody re-reads),
the late-instruction label INTENT: , and three bare label
lines: SKILL: statiker <version>, SWEEP_EXEMPT: <code> lines<=<n> — basis: <citation> / SWEEP_EXEMPT: <code> line <n> — basis: <citation>, and
unit U<k> irreversible: <effect>. The two attribution labels
(SKILL:, unit U<k> irreversible:) carry NO near-miss class by
recorded decision (a bare-word scan false-fires; attribution
fields fail soft).

The PRECEDENT LINE (one clause of the unit's design D-line; forms at
Stop rule, "Each unit design also carries the PRECEDENT LINE")
carries no lint class yet — unread by any mechanized check, the
design record and the brief are its only enforcement.

A mistyped SWEEP_EXEMPT: fails safe — the hold it meant to net
still blocks. DETECTION is wider than validity by design: the lint
detects would-be machine tokens positionally, never by word-search,
and anything detected that fails the exact literal lints as a
near-miss violation; validity never relaxes; the detection surfaces,
their exclusions (quoted lines and the head region — routinely the
file's own first ## heading — parse NO entries — operator words
and report quotes never register), and each violation's class and
repair form are settled in the executable spec (The tools) — the
verdict NAMES them and the desk composes repairs from the verdict,
never from memory; the lint is a tripwire over the observed slip
space, not the
guarantee — the contract is the literal, a slip beyond the patterns
is desk error. DEFANG lint is separate and scans the WHOLE file: an
undefanged bracketed tag literal holds the sweep wherever it sits,
in INTENT enforcing the hand-defang duty; write the literal or
expect the lint to say so.
Clearing splits on OWNERSHIP, the same split the repair classes
take (Implementation). On a line that parses NO entry — the header,
INTENT, bare prose, a quoted line — the hold clears one way: an
appended record: corrects line <n> whose body CARRIES the
defanged literal; a token that only names the line clears nothing.
On an entry-OWNED line the ordinary bookkeeping token sheds it,
carrying no defanged literal. So SWEEP_CLEAN says the holds are
discharged, never that every literal on the page was defanged.

Beside the write-set declarator: a correction appended under a
write-set declarator's own id, whose latest EARLIER line for that id
is a live unit U<k> write-set: <path> declaration, is refused
(hold: declarator-bookkeeping) UNLESS the correcting line is itself
a fresh unit U<k> write-set: <path> redeclaration BY THE SAME
UNIT; why: under latest-line-wins an ordinary bookkeeping correction
would become the id's resolved body and un-declare the path while a
live declaration stands, and a DIFFERENT unit's redeclaration under
the same id is that ordinary correction in the exempted shape's
clothing; the repair is the supersede-whole form: restate the full
write-set under the same id
AND THE SAME UNIT, with a trailing (corrects line <n>) naming the
ORIGINAL target, never this line's own number — the ONE legal slot
for the token on a write-set declarator line (the path-field
near-miss check exempts exactly this trailing form, nothing wider)
— the repair the grammar makes reachable there, and there alone.

• findings: - F<n> [VERIFIED|PENDING|INVALIDATED|AUTO-ACCEPTED] <claim> — basis: <file:line / executed command / entry id / "unverified">
• decisions: - D<n> [PENDING|COMMITTED|INVALIDATED|AUTO-ACCEPTED] <decision> — basis: <…>
• requirement amendments: - R<n> [AMENDED|PENDING|INVALIDATED|AUTO-ACCEPTED] <new letter> — basis: <…> (derived requirements only; the head above)
• attack outcomes: `- A [DISPATCHED|BIT|ZERO-DELTA|VOID]
  — basis: ` (VOID: The attack — an aborted or premise-broken round)
• verify verdicts: - V<n> [PASSED|ISSUES FOUND] <summary> — basis: <the checks' own output>
• a basis citing ANOTHER record's entries names the record (tracker
  path or run name) before its ids, never a bare id — a bare id
  always resolves in THIS run's namespace, so once this run mints
  its own same-numbered id a foreign citation silently rests on it;
  the live-basis scan ignores every id under an active
  record-name token — a token, quoting/bracketing punctuation
  (()[].,;:) stripped before the match, containing / AND ending
  .md or .md:, or the two-token label run <name>: — never a
  bare code pointer (tools/x.py:40) or an ordinary label:, which
  name nothing readable as a record and leave the id resolving in
  THIS run's namespace as usual; the exemption PERSISTS across a
  contiguous comma-separated id list following the record-name token
  and dies at the first non-id token, so a plural citation
  (tracker.md F20, F21) exempts every id it lists, not only the
  first. The scan flags a bare id whose number exceeds this run's own
  class max as foreign-id-suspect — the backstop for the
  id-below-max case, which count alone cannot catch. An id under a
  record-name token is not checked against this run's own
  invalidations.
• entry tags are BARE enum values; annotations
  live in the line body after the bracket, never inside it, and a
  bracketed tag literal never appears inside a body — the record
  tool's tag parsing and the closure gate match the bare
  bracketed enum, and an annotated tag breaks both
• a decision still resting on an unverified assumption at [READY]
  gets an appended [AUTO-ACCEPTED] line — surfaced to the operator
  by its tag, never silently carried; a reconciliation advanced on
  its recommendation is recorded this way, conflict and
  recommendation in the line body — the operator's answer appends
  the resolving line.

Each investigation/design round appends under a ## Cycle <n>
heading; it marks the round for the record's readers and is no
schedule (a round is whatever investigation the design needed); the
FIRST ## heading closes the head region — above it nothing parses
as an entry, and a tracker with no ## heading parses NO entries,
silently. One exception: a first heading titled ## Requirement head
(case-insensitive; the whole heading line, not a heading merely
beginning with the phrase) does not close the region — it runs
through to the NEXT ## heading, or EOF when none follows, parsing
no entries throughout exactly as the plain case does.

The loop

The desk is this session, intended consumer a top-tier session model
(prescription density calibrated to it); it orchestrates, forms and
records decisions, writes briefs, grades; investigation and
discovery legs go to cheaper-tier subagents on pointed
decision-complete briefs — brief-writing is where hunt-judgment
lives (Fire-born and hypothesis clauses, below); a leg's return is
evidence, recorded with its basis.

A leg is recorded [PENDING] at dispatch and resolved only by a
body-read of its return — a stopped or past-horizon leg's output
included: a late report is evidence, not noise; "it never returned"
is a transcript claim checked in the transcript; the [READY] sweep's
no-[PENDING] gate holds unread legs open mechanically; an
unreturnable leg — stopped per the harness's task state or BY the
desk at its horizon (dispatch skill §4: inspect or stop, never more
waiting), with NO return to read (the transcript check, never
memory) or still [PENDING] after its return's body-read (a read that
resolves takes the evidence's tag) — gets ONE new [AUTO-ACCEPTED]
tag-first line as a deliberate carry with the loss stated; the sweep
and the closing [ZERO-DELTA]'s no-[PENDING] condition both read that
as resolved.

(hypothesis) A SPIKE — a throwaway build grounding a basis no
existing code can answer, greenfield's common case — is a discovery
leg: it builds in the leg's OWN scratchpad, never the repo, and
returns MEASUREMENTS; its findings land as F-lines with executed
bases; its code is evidence, never implementation — a unit rebuilds
from the locked design, so the no-design invariant is untouched.

A leg is dispatched TO A DECISION: its brief names the recorded
decision it unblocks and what each possible return would decide; a
leg whose returns cannot change any recorded decision or any entry's
tag is not dispatched — the record gate's mechanical repair leg is
the named carve-out (the decision its return settles is the gate's
own clear-or-hold); the same test closes investigation: when no
un-dispatched leg would move a decision, the design is done
investigating — [READY] then decides whether it is done designing.
(hypothesis)

An out-of-scope discovery — true, outside the requirement head: an
unrelated defect, an adjacent improvement, a region the run decides
not to carry — is recorded with its EXIT named in the body: CARRIED
(an R-amendment brings it into scope; the design re-enters for it)
or EXPORTED (a named carrier outside the run — backlog entry, ledger
line, issue — with the reference); fixing it inside a unit without
one of those exits is barred: the run's three certified surfaces are
the attacked design, the verified requirement, and the pinned
record, and an in-flight fix enters none of them. (hypothesis)

Design against the recorded requirement. A decision COMMITS with a
basis that reaches its premise — where the premise is a data shape
or code path, an executed measurement or a hop-trace reaching the
CONSUMING READ (a surface inventory stopping short of where the
value is read answers a narrower question; the attack's probe
obligation applied at the commit moment); a deliberate skip is
tagged [AUTO-ACCEPTED], never a read dressed as ground; new evidence
that kills a premise appends an [INVALIDATED] line for the entry and
for every decision resting on it — re-derive the dependents; a
premise and its dependent contradicting inside one record is the
escape shape.

Superseding cuts both ways: a new entry contradicting an old one
appends the old id's [INVALIDATED] line (two live contradictory
entries route the implementer to whichever it reads first);
invalidating an entry restates what survives in a live entry CLAUSE
BY CLAUSE — each clause of the dead entry dispositioned
restated-at- or dead; an entry-level summary is where the
load-bearing clause drops silently; a restated clause takes The
record's full adoption path ([PENDING] under a new id, cleared under
that same id) and the [READY] sweep holds unchecked restatements
open mechanically; a dead disposition is written dead (<what kills it>), and the sweep's dead-basis body-read holds a killer-less dead
clause open as [PENDING]; clause dispositions AGGREGATE across an
id's [INVALIDATED] lines — a later line re-dispositions only the
clauses it names; every reader takes the union, latest line per
CLAUSE, never the id's last line alone; a partial invalidation
orphans the surviving clauses.

Stop rule: [READY] = dispatchable (forcing point 2)

The design is done when a decision-complete brief could be written
from it — the dispatch skill §1 definition is the test, not a
feeling. If writing the impl briefs would require deciding anything,
the design is not done: design until it could be briefed.
(hypothesis) [READY] also asks DECOMPOSITION-COMPLETENESS — is the
head professionally complete, or is a requirement a competent shop
would have derived still missing; a cheap self-check before pricing
an attack round; the attack's decomposition mandate is the
load-bearing grader, so nothing rests on this question beyond the
easy catch.

[READY] is recordable only when the record sweeps clean: no entry's
latest line is [PENDING] (an assumption deliberately carried
unverified gets its [AUTO-ACCEPTED] line, never left [PENDING]); no
id appears as two live entries (found by body-read, not tag
grammar); no live entry rests on an invalidated entry's content —
the dead-basis read is a body-read covering the invalidation lines
themselves: a missing clause list, or a dead clause without its
named killer, holds the record from [READY]. sweep --tracker <path> runs FIRST at this seam: SWEEP_CLEAN clears the mechanical
half only; SWEEP_HOLDS blocks [READY] on the computable slice
(latest-line [PENDING]s, killer-less dead dispositions, live bases
citing invalidated ids, grammar and defang lint — a lint hold on an
appended line repairs by the corrects line <n> token,
Implementation's form, the verdict naming each violation's class and
repair form); its verdict carries the clause-disposition union the
dead-basis read consumes; the residue the tool NAMES — dead-basis
body-reads, the duplicate-id body-read, restatement adoption
checks — is the judgment slice, still desk work. An open [PENDING]
under a claimed [READY] is the premature-call shape.

A declared exemption nets a matching hold out of the blocking set
before SWEEP_HOLDS is decided: both labeled forms VERBATIM
(SWEEP_EXEMPT: <code> lines<=<n> — basis: <citation> and
SWEEP_EXEMPT: <code> line <n> — basis: <citation>) — INTENT:'s and
SKILL:'s sibling, same body-region placement, same field-not-gate
treatment — moves every violation of that CODE at a covered line
into the verdict's exempt_holds field (each carrying the
exemption's own declaring line), frozen at declaration — coverage
clamps at the declaring line itself, so nothing appended after it is
netted whatever <n> says: a violation at any line GREATER than
min(<n>, the declaring line) blocks untouched. An exemption is
OPERATOR authority carried in the mandatory — basis: tail (the
operator's line quoted, or the id of the entry recording their
direction) — the tool nets nothing from a citation-less declaration.
A desk never exempts its own gate's holds on its own judgment, and
an unattended run's unexemptible holds ride the close instead. The
guard VERIFIES the exemption's BOUNDS (code, frozen coverage,
everything outside still firing) — legitimacy belongs to the cited
authorization; exemptible holds are FORM DEBT only. Defang-class
holds (tag-literal-in-body) are never exemptible — the tool
refuses the netting — because an undefanged tag literal holds every
later sweep correctly until a correcting entry clears it by its
own route (The record, the ownership split); LIVE-WORK
holds (pending-latest) are never exemptible — a netting reaching
the no-[PENDING] gate would unlock [READY], the closing
[ZERO-DELTA], and the Verify dispatch in one line; exempt_holds is
enumerated in the close beside the [AUTO-ACCEPTED] entries: netted
is never invisible.

A FORM-code hold — superseded-block-form, basis-missing,
tag-literal-in-body, clause-unparsed — additionally nets against
its own code's MINT VERSION: each carries a rule→version entry in a
table backfilled once from the tool's git history (the SKILL version
served when the code first shipped), and a hold whose LINE was
written under an EARLIER version — the P3 skill_versions
attribution, lines between two markers read under the earlier one —
grades RETRO in the verdict's retro_holds field, surfaced but never
blocking; the same code at or above the mint's marker still blocks.
Every other code (SUBSTANCE, by omission from the form set) grades
every line whatever its age — the over-forgiveness class this split
never widens, the mint's one confirmable per-code decision. A
marker-less record (no Skill: header line at all — pre-P3, out of
this mechanism's scope) earns no forgiveness: the declaration route
(SWEEP_EXEMPT, above) stands there instead. RETRO netting runs
independently of SWEEP_EXEMPT's own netting and the two never
interact — a defang-class hold (tag-literal-in-body) is still
RETRO-eligible even though it is never SWEEP_EXEMPT-eligible (H6
binds an OPERATOR declaration, never a computed historical fact).
retro_holds is enumerated in the close the same way exempt_holds
is. No new
verdict name: SWEEP_CLEAN,
SWEEP_HOLDS, and every downstream gate consult inherit the netted
set with no separate git-tool change.
Record Status: [READY] with the impl units enumerated, each naming
its red-first pin; a pin DISCRIMINATES: red on the current state,
green only through the fix; a criterion the defective state already
satisfies verifies nothing; a renumbering that drops a unit's pin
clause is a silent unpin.

Each unit design also carries the PRECEDENT LINE, one clause of the
unit's design D-line, one per unit, in the three verbatim forms
follows <path>, judged sound, <path> is the problem, this unit's scope, no precedent, first of its kind; written in the design
record and traveling into the brief unchanged — never left implicit:
unstated, a dispatched implementer or a successor cannot find it;
stated, it is a claim a fresh reader can check.

Each unit is also classified by the reversibility of its EFFECT, not
its diff: one whose green state includes something git cannot
undo — a schema or data migration, an external write, a
publish/push/send, a deletion outside the write-set — is tagged
irreversible BESIDE its enumeration as the BARE label line unit U<k> irreversible: <effect> — the label-line class (SKILL: 's
sibling), alone at column 0, never an entry and never a body opener,
so it re-opens nothing under the closure predicate; the record tool
surfaces the set as irreversible_units in sweep and closure
verdicts — attribution, never a gate: unattended enforcement stays
the hold entry; every other bound limits waste, this one limits
damage: unattended an irreversible unit never dispatches — it takes
the hold entry (Implementation) and rides the close for the
operator; attended it dispatches after the effect is named.

(hypothesis) Unit ORDERING is integration-risk-first: where the
design crosses boundaries, the first unit is a tracer bullet — the
thinnest end-to-end slice wiring every boundary — so integration
failures surface in the first landing, not at verify; horizontal
layer-by-layer ordering is the exception and carries its reason in
the enumeration.

(hypothesis) A unit's edit commission is symbol-anchored — the
target named by symbol, with a residue check proving it gone or
changed — never a bare line range (line numbers may cite, never
command): ranges decay as file and record evolve.

UNATTENDED is
the default: the recorded recommendation advances the run — no
prompts, reconciliations surface in the close, the run's one
touchpoint — but [READY] still opens with the desk's own INTENT
re-read: a design satisfying its derived requirements but not
the INTENT is the drift the head exists to catch, and no other
step forces the look (hypothesis). A report is no terminus — a
seam report, a round's graded return, an operator reply, or a
peer-channel answer is delivered mid-stride, in either Mode and
at every seam, the same reply carrying the next owed desk work;
under a live dispatch freeze the QUEUE, not an append, is that
carrier. A turn ends only where the run itself is stopped: a
dispatched leg or round awaiting return with no un-dispatched
desk work owed; a hold or halt the desk cannot clear at this
seam; an operator-owned decision the record cannot answer —
attended Mode's advance prompt and an operator-authority ask
included; a version-mismatch abandonment (The record); a
mandated stop (the operator-authority passage's enumeration); or
the close. The delivered-report-reads-as-done momentum is the
named failure shape.

Mode: attended in the header (operator-declared at run start)
presents the record and recommendation at [READY] instead, ENDING
with one advance prompt — "(y) advances per the recommendation";
anything else is free-form override; design decisions are never
posed as choices — the prompt carries loop control only; supervision
is monotone: an operator appearing mid-run takes over on one
recorded line and the run continues attended; an attended run never
silently becomes unattended. (hypothesis)

Advancing locks the design — the LOCK. Its
transaction machinery lives in the git tool; the desk's work is
the composition, the one judgment instrument, and the record
forms around the verdicts.
(a) Pathspec composition. The tracker plus every LIVE lock-set
path (a re-lock inherits prior locks' live lock-set lines; an
unchanged inherited path is a no-op, legitimately absent from
the readback). Anything beyond the tracker enters ONLY named
by a lock-set line appended before the lock (- F<n> [VERIFIED] lock-set: <path> — basis: <the entry that produced it>), and a
lock-set path — a unit write-set path too (Implementation) —
names a FILE, never a directory: a directory pathspec commits
whatever else the operator touched under it (the tool halts on
one). The design phase edits no other repo file, so the tracker
is normally the whole pathspec.
(b) The judgment instrument the tool cannot run: re-read each
lock-set artifact against the entry that produced it. The
tool's collision check reads staged operator state (porcelain
column one). Two states it cannot attribute need this re-read:
column-two divergence on run-produced content, and every
UNTRACKED add (the tool adds any surviving untracked pathspec
path — an operator draft sitting where a lock-set line points
is caught only by this re-read). What the RE-READ misses rides
into the commit — the attack round's probes are the backstop, the
residue named, not hidden.
(c) lock-check --tracker <path> [--lock-set <path> …].
Verdict routes: LOCK_GATE_HOLDS — the consulted sweep verdict's
blocking set is non-empty AND Status is NOT on the close path
(FAILED/COMPLETE): [READY], in-progress, PASSED, a missing or
malformed status — all fail closed,
the consulted record verdict embedded verbatim as the gate
field — halts lock-check and lock-commit uncommitted: the record
never locks over its own blocking state ahead of close. Its route
is REPAIR, never a verdict on the run: repair or exempt the
blocking holds, re-sweep, re-lock — the [READY] machinery's
ordinary path. A hold the desk can neither repair (not form
debt) nor, unattended, exempt rides the close instead — FAILED
with the hold enumerated, the ending the exemption clause names
(PASSED is a transient pre-close state
this seam never locks over: Close writes COMPLETE before it
pins). Under
Status FAILED or COMPLETE (the close path, Close) the gate PASSES
instead with the same blocking set still carried in gate as
information, never silently dropped — a close-time lock
legitimately carries PENDINGs (an abandoned unit's own hold).
HALT_STATE is the operator's half-finished
operation, the tree untouched — an attended halt re-enters on
the operator's clearing reply; unattended, a halted LOCK closes
the run FAILED (no lock, nothing to build on; Close, Status
written FAILED) while a halted unit rides the close's
deviations (Implementation). HALT_TRACKER_COLLISION and
HALT_TRACKER_UNPINNABLE halt the same way — the tracker is
never dropped, and never force-added. LOCK_CHECK_DROPS records
each drop BEFORE the commit, in the tracker the commit pins: a
[VERIFIED] F-line carrying the verdict line as basis, and the
path's lock-set line superseded — - F<n> [INVALIDATED] <path> dead (collision|ignored) — basis: <the drop F-line's id>
("contradicted" anywhere in this skill means that supersede
form) — surfaced when the operator is present, riding the
close's deviations unattended.
(d) lock-commit, same arguments plus -m and one --drop
per recorded drop (LOCK_CHECK_CLEAN skips straight here, no
drops). HALT_DROPS_STALE or HALT_DROPS_UNACKNOWLEDGED
means the acknowledged and live drop sets differ — the tree
moved between check and commit, or the --drop list was
mis-composed: re-run lock-check, re-record, retry ONCE — the
--drop argument is PASTED from the verdict line, never
re-typed (two spellings of one byte deadlocked this handshake,
and the re-typing hop is the desk); a second mismatch OF ANY
KIND halts the lock uncommitted, routed like HALT_STATE, the
two sets surfaced verbatim in the booking. LOCK_COMMITTED's sha
is the LOCK
COMMIT — the attack brief pins it, and the locked design IS the
record at that commit. LOCK_COMMITTED_EXTRAS is a mis-composed
pathspec: the extras' content is already in history — recorded
as a collision-class contradiction and named a brief exclusion,
never reverted out of the working tree (the revert would
destroy the very operator state the finding names).
HALT_RESIDUE_PERSISTS is a halt WITH commits in history: its
shas field lists every landed commit, the last one not
readback-clean — booked, the shas surfaced, and the run halts
like HALT_STATE (never "no lock, nothing to build on": the
commits exist) — and so does ANY halt verdict carrying shas
(a COMMIT_FAILED or BLOCKED_CONTENTION out of the readback
laps landed its first commit; The tools' override). Any other
lock verdict (HALT_NO_CHANGES,
HALT_NO_PATHSPEC, HALT_DIRECTORY_PATH, HALT_MISSING_PATH,
BLOCKED_CONTENTION — the last two in their plain senses, never
the unit rules' meanings — USAGE_ERROR, GIT_ERROR,
INTERNAL_ERROR) halts the lock uncommitted, verdict line booked
as a record: F-line, routed like HALT_STATE.
Everything outside the pathspec is operator state — never
committed, never unstaged, never restaged. Desk scratch belongs in
the desk's own scratchpad, never the repo (the attacker rule's
counterpart, Verify). A brief asserting the tree claim (The attack's
freeze scope) names every tracked surface the claim cannot cover as
an exclusion: the drop and extras lists above are that list's
mechanical floor, and an operator-modified tracked path outside
every lock-set path joins through the same rule. The attacker reads
an excluded path as outside the frozen surface, evidence of nothing.
A brief that never asserts the claim needs no exclusions. A
re-derived design re-enters here: new [READY], new sweep, new lock
commit.

The attack (forcing point 3)

A fresh-context attack on each locked design by a context that did
not produce it, before implementation. The attack brief carries the
tracker PINNED at the lock commit, produced by filter --tracker <path> --sha <lock sha> --out <artifact path> — serves the sha,
never the working tree (a live tree serves HEAD); the artifact path
is the .A<n>.artifact species in its OWN artifacts/ namespace
beside, never inside, the seal directory (seal-path prints it); what
bars a read is the brief's scope, not the split; the artifact lives
OUTSIDE every repo (an in-repo artifact is an untracked file under a
brief asserting tree == lock commit): the tool halts
ARTIFACT_IN_REPO on any, halts a symlink tracker (name the real
path), and --out alone is cwd-relative; filter BLANKS the two
Superseded species IN PLACE — each dropped line an empty line, so
artifact line numbers EQUAL source line numbers and corrects line <n> dereferences identically — while entry-shaped lines inside a
Superseded SECTION are PRESERVED; ENTRIES are never filtered (dead
bodies are load-bearing for closure questions; a hand-summary is the
paraphrase-drift class). The artifact stays PURE — no header,
nothing the source does not carry: source path, pinned sha, and the
blanking declaration travel as ARTIFACT_WRITTEN verdict fields, and
the brief QUOTES that verdict line beside the artifact; the brief
also carries the question and the read-only tail (dispatch skill
references/forms.md).

A unit carrying an EXECUTABLE mechanism (a predicate, a query, a
parser, anything runnable against real or planted input at design
time) earns one EXECUTED probe, named in the brief, its input
drawn from the source the mechanism will face rather than built to
the design's own assumption; a reading round's zero on such a unit
is could-not-verify at the executing altitude and converges nothing
(the CONVERGED clause carries the grading half). Where no input can
legally reach the mechanism at design time (an authority-gated
prod act), the brief names that absence instead, the verify phase's
named-absence form.

Unfiltered, the
artifact compounds per round; the desk appends nothing to the record
while any attacker is live — an append landing mid-round leaks
sibling findings into an attacker's own record sweep, and the
round's independence cannot be re-established afterward.

The freeze defers appends, never work: desk findings and leg
dispatches during a round queue at that round's queue species
path, which seal-path --tracker <path> --round A<n> prints
(SEAL_PATH; pasted, never hand-composed); the namespace is XDG
state under ~/.local/state/statiker/seals/<repo-key>/, keyed per
repo and per tracker filename — never ~/.claude/ (that path shape
draws permission dialogs on every access); the queue exists whether
or not a seal was written — and at the round's return: LAND the
queue's entries, SPEND the queue, THEN record the A-line —
spend-before-A-line,
so a desk dying mid-sequence leaves a spent queue and a missing
A-line (a re-read), never a landed-but-unspent queue (a
re-land into an append-only record). The spend: append
LANDED <yyyy-mm-dd> — at line <n>
(the tracker line the landing opened) as its last line —
LANDED <yyyy-mm-dd> — empty when nothing was queued, and an
ABSENT queue file reads as empty, legally; a queue
whose last non-blank line matches the spent form is spent — and
a [VOID] A-line is a return for this duty: the queue spends at
any terminal A-line. No
subcommand reads a queue file (the tool's own documented scope):
the spent line's reader is the successor desk at resume (the
resume's queue read, The record), and
that read is what bars re-landing a spent queue. The
freeze's scope is every surface the brief claims immutable: a
brief asserting the tree matches the lock commit (the TREE
CLAIM) freezes the whole
repo, not only the record — the claim sets the scope, and keeping
it true until the attacker returns is desk work. The claim
binds TRACKED state; untracked check by-products sit outside it
under the declared carve-out (Verify — declaration, pre-existence
record, removal at the return). In a batched trip the claim
binds each design's worktree instead: a freshly detached
worktree has every by-product path absent by construction, so
the pre-existence record is trivial and removal IS the worktree
removal — no .paths file and no working-repo carve-out for
the trip. The
question APPENDS this block verbatim
(pasted, never recalled — free-composed briefs drop invariant
clauses):

Every severity, closure, or HOLD verdict rests on evidence
whose question matches the verdict's reach: an executed probe
where the object exists to execute, a full source-chain trace
(every hop cited) where it is still design prose; a closure
names what the guarded input meets on the NEW path. Evidence
answering a narrower question than the verdict it closes is
the false-clean shape. A verdict without reach-matched
evidence is labeled unmeasured and leaves its question open.
Judgment findings (design-intent, record hygiene) need no
probe. Attack the design's fit to the recorded requirement
and the factual bases it cites; attack the DECOMPOSITION —
is the derived head a faithful AND professionally complete
reading of the INTENT, where a head carrying a recorded
deliberate narrowing — an entry naming the scope moved out
and the carrier it moved to — is graded against the narrowed
scope, those narrowing entries themselves attackable — and
the design's SIMPLICITY — the
simplest design that meets the head; unjustified structure
is a finding. Attack the BLAST RADIUS — for each surface the
design changes (a key's scope, a shared file, a value set, a
schema, a shared resource), who else consumes or shares it,
established by executed search where the surface exists to
search, by full source-chain trace while it is still design
prose; a co-consumer or co-sharer the design was never
checked against is a finding, and a scope dimension the
design's key omits is the canonical member.

The brief never carries the desk's reasoning — it transmits the
producer's blind spots — and the rule reaches the ARTIFACT: an
entry authored for the attacker's eyes (a weak-spot list, steering
notes) is desk reasoning riding the never-filtered channel, and it
frames the round it was meant to sharpen.

Pre-round self-assessment is a sealed prediction, written before the
round dispatches, to that round's seal species path; any successor
desk re-derives it through the git tool's seal-path --tracker <path> --round <A<n>|verify> verdict (SEAL_PATH: every species'
full path — seal, queue, paths, artifact (its own artifacts/
namespace), report, comparison — from seal-path's computation;
paste, never hand-compose); the report species is the OPTIONAL
out-of-repo
copy of a round's returned report where the desk keeps one — never
round-mandatory, reports travel by message. Seals live out of the
repo because attackers read the repo, and an in-repo seal breaks any
brief asserting tree == lock commit; at the round's return the desk
compares seal against bites and writes the comparison BESIDE the
seal, still out of the repo — later attackers read the repo, so
seals and comparisons enter the tracker only in the close, where no
further round follows. A seal is calibration, never evidence: it
steers no verdict, and a missing or late one voids its comparison,
not the round.

Instrument-seal, widened: the seal grades entries that EXIST, and an
enumeration gap has no entry to seal — a seal over CONCLUSIONS
cannot reach an omission, a seal over INSTRUMENTS can; a successor's
seal therefore carries, per instrument touching a completeness or
population claim: (i) a per-instrument REACH statement — what it
structurally CAN return; (ii) a DEFEAT-MODE enumeration — what would
return the same output as a true negative; (iii) the recorded
IRREDUCIBLE BLIND SET — what no available instrument reaches, named
rather than silently absent; (iv) CENSUS-IMMUNE members dispositioned
by reading their WRITER — the write path, never content absence (an
empty store's content is silent; its writer is not). The form
sentence: a successor seals what each instrument cannot return, what
each fixture cannot express, and which repairs shipped unexercised.

Attack tier: a ROLE, resolved in order — clippy.config/models
(attack: class) when present, else the first entry of the
skill's shipped defaults/models (under this skill's base
directory: the certified-attack register, every entry carrying
its probe-then-certify provenance inline) the harness can
dispatch — resolving only entries under the harness's OWN
ecosystem; a class's entries under another ecosystem are that
stack's certification record, never this harness's resolution
input (st-62) — else the strongest model available to the
harness as a fresh context. Certification comes from the PLAN.md
probe-then-certify step, recorded in the register or the
stack's own config/ledger; a tier resolved without one — the
terminal fallback by construction — attacks as a DECLARED
deviation in the tracker, never silently: the resolution
order's flexibility carries the certification duty. Escalate a
round above the resolved tier only on operator call. Rounds are
sequential PER DESIGN, one attacker per TRIP — that
design's A-line recorded before its next round dispatches. One
trip may carry every locked design awaiting attack in the stack
(one stack per trip: tier resolution, the evidence-source cite,
and deviation lines are per-stack). Each design keeps its whole
round machinery — its own pinned artifact, its own A-lines in its
own tracker, its own seal and queue (both key per tracker) — and
the return carries a complete per-design verdict block: findings,
or that design's explicit zero-delta. The desk provisions one
worktree per design through the git tool — worktree-add --sha <lock sha> --path <path>, the path OUTSIDE every repo like the
seals and for the seal rule's reason — and removes each at the
return with
worktree-remove --path <path> (forced removal: probe
by-products make plain removal fail by design); WORKTREE_ADDED
and WORKTREE_REMOVED proceed, a halt at add stops that design's
dispatch, a halt at remove is booked as a record: F-line from
the verdict line, and either way sibling designs run on.
The tree claim binds the design's
worktree, so every claim holds at once whatever repo the designs
share, attackers execute in their worktrees only, and the working
repo needs no by-product carve-out for the trip. The append
freeze covers every participating tracker until the trip returns.
The brief states the design order — the desk's call, keying the
verdict blocks; frame carryover from earlier designs to later
ones inside one trip is accepted, priced by the per-design
blocks, and is not the resumed-attacker case, which re-reads its
OWN prior round. Death is per design: a queued finding killing
one design aborts that design's member alone ([VOID] abort:), a
premise broken for one design ([VOID] premise:) voids that design
alone, and a design whose verdict block is missing stays
[DISPATCHED] and re-enters as its own round — sibling designs
grade normally in every case. A single locked design keeps the
single-design shape; each re-attack is a NEW fresh context (a
resumed attacker inherits its own prior findings' frame); a
re-derived design is a NEW locked design — it gets the attack
again, its repairs landing as ONE re-lock: per-finding re-locks
split the priced unit (hypothesis). The re-derived design's basis
takes clause (b)'s re-derivation-seam rule (below), never restated
here.

The reply opening a repeat round — from the SECOND
repeat round
on — cites the record
tool's trend output as its arithmetic backstop and GRADES the
series by a BODY-READ of the rounds' findings — trend's raw
per-round counts (the trajectory arithmetic) read every F-line
regardless of class or locus, while its concentration flag DOES
read the citing entry's class (a record:-scoped citation never
concentrates); the grade still never comes from the verdict alone,
since the counts half stays class-blind. With fewer than two
completed [BIT] rounds behind it there is no series, and the first
repeat round is the ordinary re-lock path, never graded. CONTRACTING:
substance
findings fall round over round AND land mostly on ground the
previous round already bit. A UNIT born from a prior round's
repairs (the intake clause's birth test: new design surface, never
a fix inside existing surface) is NEW ground however many rounds
ago it was born: findings concentrating on repair-born units
DEMOTE the grade to non-contracting whatever the counts read —
the location read demotes, never promotes — and a justified
join's first post-birth round is exempt, its findings being the
attack the join bought. NON-CONTRACTING: everything else
(the founding shape: the loop
eating its own repairs — nine rounds, none zero-delta, each
round's findings concentrated on the newest cycle's own work; the
measured variant, counts falling while every finding sat in the
prior repair's newborn units — graded improving by count, caught
only at budget exhaustion).
A non-contracting grade routes to NARROWING, never to another
same-form round:
re-scope the head to the smallest independently shippable unit
(an R-amendment, the displaced scope EXPORTED per The loop's
exit machinery to a BACKLOG ENTRY carrying the successor-run
intent — the named carrier with its reference; successor runs
seed from this record, the
parent's settled entries citable evidence there, attackable like
any basis; a narrowing touches INTENT's reach, so it rides the
close as a reconciliation), drive the narrowed design to its
zero-delta, land
it. Where the head already IS that smallest unit, narrowing has
no move: the series goes to the operator — attended the prompt;
unattended the run closes FAILED with the series enumerated in
the close (budget exhaustion's own disposition) — never another
same-form round.
The budget (the header) backstops this judgment mechanically; it is
never the route. A round dies two ways, one clause (hypothesis):
ABORTED in flight when a queued desk finding kills the locked
design — the round is not left running over an object scheduled
for replacement; its A-line lands [VOID] with body abort:
citing the killing entry, which must predate the abort (the check
against aborting
uncomfortable rounds); VOIDED on return when the round's PREMISE was
broken (wrong sha pinned, tree claim untrue at dispatch, wrong
exclusions): graded as a round, never finding-by-finding — a review
of the wrong object is not evidence about the right one, and
salvaging its findings enters a broken instrument's output with a
round's authority; the A-line lands [VOID] with body premise:
naming the brief defect, the brief is repaired, a NEW round
dispatches; a voided round's observations enter only as desk
findings the desk re-derives itself.

Each design's round records its A-line (The record); at a round's
return every finding is classified with basis: DESIGN-SUBSTANCE
(wrong mechanism, money path, silent failure in the shipped system)
or RECORD/INSTRUMENT (the run's own bookkeeping); findings append as
F-lines with the tag their evidence earns — reach-matched in hand →
[VERIFIED] (a judgment finding's reach is the cited record or design
text itself), else [PENDING]; an UNMEASURED verdict is an open
question the desk completes itself — its own executed measurement
recorded as the F-line's evidence — before the round's A-line lands.

Per-unit convergence rides the same return. A unit that draws zero
design-substance findings across a full round is CONVERGED,
recorded as that unit's own record:-scoped entry; later rounds
aim at unconverged units plus cross-unit interactions, and the
closing zero-delta round runs once over the converged set. The
closure tool enforces the seam: a [ZERO-DELTA] landing is REFUSED
(ZERO_DELTA_UNCONVERGED, exit 2, each unit named) while any unit
carried by a live pre-close D-line lacks a live CONVERGED or
ABSENCE record — an aimed round's zero cannot close design. The
zero converges only at the instrument's own altitude: a reading
round's zero never converges a unit whose mechanism it did not
execute, and the first executing round grades such a unit as if
ungraded (the founding probe: two units record-only across two
reading rounds each drew a design finding from the first executing
round — a predicate proven false by running it, a query plan
proven pathological by EXPLAIN — while a third unit held clean
under both instruments). A
design-substance finding landing on a converged unit REOPENS it by
an entry citing the finding, never by silent regrade. A repair
that BIRTHS a unit — new design surface, not a fix inside existing
surface — is an INTAKE, not a repair: the disposition entry
recording the repair answers join-or-export at the birth. Export
is the default where the newborn carries its own operator
dependency or the run's other units are converged or near
convergence, and it runs through the NARROWING machinery above —
an R-amendment, the backlog entry carrying the successor intent,
the close reconciliation — never a bare note, with the finding
the newborn answered re-dispositioned there (repaired another
way, or exported beside it). A join names why the newborn must
ship with this run (the founding incident: two units born in one
repair step drew every later round's substance while four
converged units waited, and were exported at exhaustion two
rounds late).

The form below is the tool's OUTPUT, never a second route.
A hand-built block raises tag-literal-in-body on the first literal
its builder misses. No exemption nets that hold (Stop rule, the
defang-class clause).
Report quotes the desk retains are pasted, never paraphrased (the
defang is the one sanctioned mutation), and append as the quoted
block the record tool produces — quote --label "A<n> quotes", raw
text on stdin: every line begins >, a blank line a BARE >, the
block ending at the first line not beginning >; bracketed tag
literals defanged — brackets dropped, lowercased in place — with the
defanged names listed after a semicolon in the composed first line
> Superseded — A<n> quotes; <names> (semicolon and list absent
when no literal occurs; the filter matches the label's opening
form) — so the defanged forms differ from every counted tag literal
in both brackets and case — the record tool's tag-literal lint
carries the brackets (the load-bearing half), the case change the
margin; regraded into F-lines in the same sitting.

Any substance finding: the
round records [BIT] — that record change IS the reopen, and the
reopen's SCOPE is the entries the findings cite plus their
dependents through the invalidation machinery (The loop's
dependency rule): entries no finding reaches stay SETTLED,
re-read only where a repaired entry's dependency reaches them,
never restated wholesale — whole-record re-derivation is the
anti-pattern with a measured signature: every restatement is
fresh attack surface, and the next round's findings land on the
newest cycle's own repairs. A
substance-free
return: execute the record repairs now (desk work), then record
[ZERO-DELTA] as the last A-line — recordable only with every
verdict reach-matched, measured by the attacker or completed by
the desk, and no [PENDING] tag riding the round's own appends.
That closes design; record findings never sustain a
next round (declining max-severity is convergence; observed
sustaining rounds past it). Mechanically enforced at the RE-ENTRY
seam (F143: the prose held IN FORCE while UNAPPLIED — A8's four
record/instrument-class findings sustained a ninth round this
clause forbids): before a design's next round dispatches,
sustain --tracker <path> re-derives the PRIOR round's finding
classes from each finding's own scope opener, independent of the
round's A-line summary — SUSTAIN_OK when at least one
finding is design-substance (never record:-scoped),
SUSTAIN_DENIED when every finding is record/instrument-class,
SUSTAIN_NOT_APPLICABLE outside a [BIT] round. sustain reads only
the LATEST RESOLVED round (BIT/ZERO-DELTA); a live [DISPATCHED]
round is not consulted — its id surfaces as the verdict's own
live_round field so the state stays visible rather than silently
skipped. The verdict is quoted in the round-open line; a round
dispatched over SUSTAIN_DENIED is exactly the class this gate
exists to catch. The same round-open seam also runs
tripwire --tracker <path> (The record, Budget) beside sustain —
its verdict quoted the same way; an armed TRIPWIRE_FIRES routes to
the NARROWING route (below), never blocking round-open on its
own tag, and TRIPWIRE_SILENT with reason "unarmed" is silently
informational, never a hold — the breaker fires only where the
record names its threshold (the arming carrier, The record).
A reopen bars the design's UNITS only: investigation, record
repair, and the run's own instruments stay open desk work — their
lines land before the closing A-line (this return's
repair-then-close order), so the post-closure predicate
(Implementation) never reads them; a desk repair arising
mid-implementation is written with body opening record:
(Implementation's bookkeeping scope) — unless it kills an
entry LIVE at the closure (latest line not [INVALIDATED] when
the closing A-line landed): that takes the scopeless
[INVALIDATED] route, voids, and carries the premise-killing
consequence (Implementation, "A missing decision, file, or value
is reported as a gap").

The desk refutes a finding only with its own reach-matched evidence
(the F-line goes [INVALIDATED]); closure still needs the next
round's [ZERO-DELTA]. A design claim a round REFUTED (its D-line
[INVALIDATED] under that finding) re-enters the design only on a
basis of a DIFFERENT KIND than the refuted one — the re-entering
entry names the new kind and why it is immune to the prior failure
mode (clause (b)).

A run instrument the desk builds is unproven until it has gone
RED on a real defect; until then its clean verdict closes no
gate. An instrument's REACH enters the record as its own
printed reach line, never the desk's paraphrase of it.

Implementation (forcing point 4)

Implementation makes no design decisions; at the closing
[ZERO-DELTA], Phase flips to implement and Status returns to
in-progress. Units come from the locked
design; each dispatches on a decision-complete brief (dispatch
skill §1, tail per §2) citing the executor skill AND the run's
live closure. The red-first pin the unit's design named is
EXECUTED, not merely asserted: its red state is RECORDED as a
committed red arm (a commit the fix's own diff reverts) or the red
run's pasted output — never prose describing it, which is formally
compliant and unattackable. The closure
read runs through the record tool at each dispatch —
closure --tracker <path> --unit U<k>
(without --unit: CLOSURE_LIVE / CLOSURE_VOID over the whole
record): CLOSURE_VOID bars every unit — a scopeless line still
LIVE for its id (a later same-id restatement carrying
record:/unit U<k> scope resolves it, st-63; a different
id's restatement resolves nothing), or a post-closure
[INVALIDATED] line for an entry LIVE at the closure whatever
its opener (the mis-scoped premise-kill);
CLOSURE_RECORD_MALFORMED bars every unit the same way — an
entry-shaped line broke the grammar, and the entry set the
closure computes is unsound until repaired. Repair is
APPEND-ONLY, by the literal token corrects line <n> — one
token per line — composed from the verdict (The record). The split
is settled in the executable spec (The tools); its principles: a
violation ON A MACHINE TOKEN indicts the semantics every gate reads,
so the target is
superseded whole and the correcting line RESTATES the content,
re-carrying whatever PARSED on the target — tag and scope
both; a tag or scope change through repair lints as its own
violation, and status changes are ordinary new lines, never
smuggled through repair. A violation in free BODY CONTENT
leaves gate-read semantics sound, so the target keeps its live
entry: the correcting line is bookkeeping (body opens
record: , then the token) and sheds the target's VIOLATIONS,
nothing more — shedding acknowledges, never cleanses, so the
target's tag, scope, and voiding effect stand. Supersession is
ONE-PASS: a superseded correcting line's own supersession
persists, so its restatement carries only its OWN token, never
a re-carry. The token is a repair, never an eraser of live
entries: naming a violation-free line lints corrects-nothing;
a target readably naming ANOTHER id is barred, while an
id-unreadable violated line is claimable by the correcting
line's id — the misspelling class the token was built for.
Flagged text still sits in the file for foreign readers (the
stats reader's unanchored greps) — the compose-time rules are
the only cleanse. Then
re-run;
CLOSURE_ABSENT means the gate is not open — the last A-line is
neither [ZERO-DELTA] nor a [BIT] whose disposition set amends no
design entry (P27: design CONSEQUENCE, not finding PRESENCE — a
terminal [BIT] round's own findings may all discharge without
touching a single D-line, and the gate reads that as SATISFIED, the
same predicate as ZERO-DELTA from there; one design-amending
disposition — a SCOPELESS D-class line landing after the [BIT]
A-line and still LIVE for its id, read latest-per-id rather
than by position (a record:-opened D-line is bookkeeping,
never amending; a unit U<k>-scoped D-line, the held: form
included, is a PER-UNIT concern the ordinary unit-held
machinery below already reads, identically to ZERO-DELTA) —
keeps it SHUT, the over-correction case; a later same-id
restatement carrying a record:/unit U<k> scope resolves
it (st-63), while a DIFFERENT id's restatement resolves
nothing for that id — only a new A-line clears closure
across ids; F118: the presence-reading gate forced an
operator deviation to ship a unit whose round's five
findings none amended the design). Absent either, this is the
normal state during a reopened design; dispatch waits. UNIT_HELD
bars that unit on its
unresolved hold entry; UNIT_UNKNOWN halts on an id no live
record line scopes — re-run with the id read from the record,
never a guess (a typo'd digit otherwise clears a hold
silently); UNIT_DISPATCHABLE lists the live
amendment lines that travel. The brief carries the tool's
verdict line, the closing A-line quoted, the lock sha, and the
listed amendments — never the raw criterion. The criterion the
tool computes — its semantics are what the desk WRITES so the
read comes out true: unit U may dispatch when the tracker's
last A-line is [ZERO-DELTA] and no F, D, or R line appended
after that A-line (post-closure) is SCOPELESS and still LIVE
for its id — a later same-id restatement carrying
record:/unit U<k> scope resolves it (st-63) — such a line
voids the whole closure
(and a re-lock's new entries void a stale closure, The attack);
a line whose body OPENS unit U<k> voids nothing — it RE-OPENS
that unit's dispatch and travels in the re-dispatch brief as the
amendment it consumes (live lines only: an id whose latest
line is [INVALIDATED] travels as nothing). A line whose body
OPENS record: is
desk bookkeeping — it voids nothing and re-opens nothing, and
it never invalidates an entry live at the closure (the
definition: The attack's reopen rule): that takes the
scopeless [INVALIDATED] route below. A clause restatement it
obliges (The loop) takes the scope of what the clause IS:
bookkeeping opens record:; a clause a unit consumes opens
unit U<k> and re-opens that unit — its current-check (The
record's adoption path) runs before the re-dispatch brief
consumes it, never inside the unit: pass → the passing line
opens unit U<k> (the criterion's scope) and the amendment
travels; fail → two composed lines: the restatement dies under
its own id — - <id> [INVALIDATED] unit U<k> <clause> — basis: <the check's failure> — opening unit U<k> like
the [PENDING] line it resolves; and the parent's clause
disposition is re-written — - <parent id> [INVALIDATED] record: clause <c> dead (<the check's failure>) — basis: <the restatement's id> — bookkeeping over an already-dead
entry (the closure rests on no clause of an invalidated
body; dispositions aggregate, The loop) — so no clause list
points at a dead restatement, the re-dispatch proceeding
without it
and the unit's want surfacing as its gap; one bearing wider
on the design is SCOPELESS and voids — the premise-killing
consequence (stop the siblings resting on it, let the rest
land, re-enter ONCE). A unit's write-set is
declared in the record — - F<n> [VERIFIED] unit U<k> write-set: <path> — basis: <the unit enumeration>, one
REPO-ROOT-RELATIVE path per line, latest-line-per-id — appended
at the [READY]
enumeration. Units with disjoint
write-sets run parallel (one shared index — commits
serialize; the tool's capped retry absorbs the
contention); disjointness is computed, never eyeballed — the
parallel decision cites the record tool's waves partition,
whose comparison is lexical over that grammar (the verdict
reports raw spellings beside the normalized paths; an alias
outside the grammar — an absolute or symlinked spelling — is a
declaration defect, the desk's to catch at composition). Disjoint
is a write-set answer, never a scheduling verdict: ordering
constraints (a unit's write-set inside another's created tree, a
pin needing a prerequisite substrate) and execute-set collisions
(shared harness ports, a conftest one lane mutates while another
executes it) are the desk's, read from the D-lines.

A missing decision, file, or value is reported as a gap, never
bridged — and triaged on arrival: a unit-local gap decision is a
design decision made without an attack round, and it is recorded
as exactly that — - D<n> [AUTO-ACCEPTED] unit U<k> gap: <decision> — basis: <gap report> — surfaced by its tag, enumerated in the
close, graded only through the WORK verify checks against the
requirement head (no entry-level grading exists); no attack
round reads it on the normal run shape — a coverage fact, not a
bar: a re-entry round reads the full record — so the tag
surface and the close enumeration are the backstops. That
unit re-dispatches on the amended record, siblings run on. A
gap that kills a locked premise is recorded as the killed
entry's SCOPELESS [INVALIDATED] line (The loop) — the body
never opens unit U<k> or record: — voiding the closure
through the predicate above; that invalidation IS the triage
discriminator: no entry live at the closure dies → unit-local,
one dies → premise-killing. Stop the siblings resting on it;
the commit gate's consult halts EVERY in-flight sibling on the
voided closure, fail-closed — clean siblings' edits stay in
their trees, named as the re-dispatch's write-set, and land
after the ONE re-entry with every return in hand (a
start-sha-predates-the-void carve-out is parked tool work,
never improvised at the desk).

Model per
clippy.config/models (impl: class) when present, else the
operator corpus routing table, else — no corpus on the stack — a
cheaper tier than the desk, the same terminal default discovery
legs take; an unreadable models file halts
the dispatch, the parse error a unit-scoped F-line (body OPENS
unit U<k> — the criterion's scope form). Each unit
commits green; the desk appends its landing as an INDENTED
annotation line ( unit U<k> landed: <sha>, preceded by a
blank line — markdown otherwise folds it into the entry above) —
not an entry, so
invisible to the record tool's tag-first entry parse and the closure
read by construction — that is what makes resume reliable. Nothing
forces the append at landing time: a unit whose record cites the
git tool's UNIT_COMMITTED verdict with no landing line anywhere in
the tracker surfaces as a sweep hold (landing-missing), attribution
never left to a later reconstruction.
Unit briefs carry the git tool's invocation lines with the
script's absolute path (The tools) — desk prose reaches no
unit, and no procedure text is expanded into a brief.
Composition-side, the desk checks the write-set: paths name
FILES and are git check-ignore-clean — a composition error
caught before dispatch (the tool re-checks and halts, the
backstop) — and every unit U<k> id it appends against the
[READY] enumeration: a mistyped id in a RECORD line voids
nothing and reaches no brief, and no tool can know which unit
was meant (the argument-side validation catches only the
--unit flag). The unit runs: START, before any edit —
unit-start --tracker <tracker> --unit U<k> — the write-set is
read from the record's declared lines through the gate consult
(the record tool's closure --unit, run as a subprocess, its
verdict embedded verbatim as the gate field — closure, never
sweep, is the unit gate's consult), so briefs never restate it,
and UNIT_START_CLEAN prints the resolved write_set, which is
where the implementer reads the paths the unit owns;
UNIT_GATE_BLOCKED (a blocking record-gate verdict, the empty
declaration included) and WRITE_SET_NAMES_TRACKER (the declared
write-set names the tracker itself) halt the unit UNBUILT, and
GATE_UNREADABLE (no parseable record verdict) halts the same
way, fail-closed. UNIT_START_CLEAN makes
every later modification the unit's own; UNIT_COLLISION (an
operator edit or draft on a write-set path the unit would
otherwise overwrite and commit), HALT_STATE (the
operator's half-finished operation, tree untouched), and any
other START verdict (HALT_IGNORED_WRITESET,
HALT_DIRECTORY_PATH, USAGE_ERROR, GIT_ERROR …) halt the
unit UNBUILT — no edit, no commit, no landing annotation.
COMMIT — unit-commit --tracker <tracker> --unit U<k> --start-sha <the START verdict's start_sha, PASTED from the verdict line, never re-typed (the drop-argument rule's hop)> -m <msg> — same
gate consult and halts as START — with the COMMIT-side
disposition: a halt here leaves the unit's edits in the tree, so
they are NAMED as poisoning the write-set for the re-dispatch —
plus UNIT_START_MISMATCH: the
start sha is no ancestor of HEAD, or a foreign commit touched
the declared write-set since it.
Verdicts: UNIT_COMMITTED → landing annotation with its sha.
UNIT_COMMIT_COLLISION → an operator stage landed on the
write-set mid-unit (the commit seam re-reads column one — ANY
staged state halts: column one cannot attribute a staged add,
and a blocked prior attempt's leftover never reaches this seam,
since the re-dispatch meets it at START and the desk's clearing
handles it): report, nothing committed, the unit's own
edits left in the worktree and named as poisoning the
write-set.
UNIT_NO_DIFF_VS_HEAD → nothing differs from HEAD: the unit
runs its residue check (the brief's symbol-anchored
criterion — the discriminator, never an exit code) and
reports already-present, the landing annotation carrying
already-present in place of a sha (HALT_IGNORED_WRITESET
re-firing at this seam routes as blocked below, its
ignored-path diagnosis kept from the verdict line, not as a
generic failure). HALT_MISSING_PATH → a
write-set path the unit never populated: reported as a gap,
nothing landed. HALT_STATE → an operation the operator began
mid-unit — distinct by verdict from BLOCKED_CONTENTION →
index.lock held through five spaced attempts (the verdict
carries the error text and whether the lock file remains).
UNIT_COMMITTED_EXTRAS and UNIT_COMMITTED_RESIDUE landed
their sha — landing annotation — but carry a finding the
desk books as a record: F-line from the pasted verdict:
extras are the lock's mis-composed-pathspec rule (recorded,
brief exclusion, never reverted); residue is write-set
divergence after the commit, triaged like a collision. Any
other verdict — ADD_FAILED, COMMIT_FAILED, GIT_ERROR are the
common members, the global catch-all rule covers the rest — is
reported as blocked, uncommitted edits named — they poison
the write-set for the re-dispatch. EVERY non-committed exit
pastes its verdict line in the unit's report and leaves the
tree exactly as the tool left it — never silence. The desk
books each non-landed unit return as a [VERIFIED] F-line
opening record: (basis: the pasted verdict line; a unit
return decides nothing — voids nothing, re-opens nothing),
never through the gap triage (HALT_MISSING_PATH's gap report
excepted), PLUS a hold entry — - D<n> [AUTO-ACCEPTED] unit U<k> held: <reason> — basis: <that F-line's id> — the tag
surface that carries an unlanded unit into the close's
enumeration (the gap path's pattern; without it a held unit
reaches Verify invisible to every gate). Clearing a held
path is DESK work, decided by provenance: where the record
and the task
system show the dirt is the run's own — a stopped or dead
unit dispatch (a sibling OR the same unit's own prior
attempt) whose write-set covers the path, its clean START
check readable in that dispatch's output — the desk clears
BY SHAPE, reading each command's exit: a tracked path
restores (git restore --source=HEAD --staged --worktree -- <tracked paths>), an untracked leftover is DELETED
(restore cannot touch what HEAD lacks, and a mixed call
fails whole, restoring nothing), and a staged-NEW leftover
(in index, not in HEAD) is git rm -f-ed — restore reaches
neither of its halves. ONE clearing attempt: a
re-dispatched unit colliding again on the same path is held
as operator state — no clearing loop. A path
without that provenance is operator state — held; the
operator's clearing answer appends the hold entry's
resolving line — - D<n> [COMMITTED] unit U<k> cleared: <path> — basis: <the reply>, opening unit U<k> (the
natural scopeless phrasing voids the whole closure) — and
the desk re-dispatches on it, unattended
it rides the close's deviations. A BLOCKED_CONTENTION
return triages on the same provenance: siblings still
live → re-dispatch after their landings; none live and the
verdict says the lock file remains → the stale
.git/index.lock a dead dispatch left, removed by the desk
on that provenance alone (the task system showing no live
unit), else surfaced. A HALT_STATE halt re-dispatches on
the operator's clearing reply, unattended it rides the
close's deviations.

Verify (forcing point 5)

Executed, isolated, against the recorded requirement; Phase flips
to verify at dispatch — a dispatch made only with no entry's
latest line [PENDING] (the [READY] sweep's no-[PENDING] condition;
the record tool's sweep re-runs at this seam). A fresh
context that did not build the work runs the real checks — tests,
probes, renders, at the altitude where the work takes effect —
against the tracker's requirement head as amended by its R-lines
plus every late INTENT: line the sweep verdict lists (The
record), and pastes the checks' own
output; a launcher's exit status is not a verdict. The brief
demands a verdict PER R-LINE — met (the check's own output), not
met (with it), or NOT EXERCISED — because coverage failure is a
non-event only the isolated verifier can name: a requirement
nobody checked returns exactly what one that passed returns, and
the desk cannot know what a fresh context declined to exercise
unless the brief demanded the statement. The brief demands the same
statement PER FINDING repaired in-round: whether its red state
exists RE-EXECUTABLY (Implementation's recorded forms — a committed
red arm or the red run's pasted output) — NOT EXERCISED otherwise, a
docstring-only red run being formally compliant and unattackable
short of this leg. The brief demands the same statement for
every F/D/R line appended after the last A-line:
whether its scope opener matches its body kind — a
record:-scoped or unit U<k>-scoped line whose body decides
a design question or justifies a boundary is a FINDING, not a
bookkeeping or per-unit line — NOT EXERCISED otherwise (st-10 C4a).
The V-line's evidence
carries the per-R table; PASSED is recordable only with every
R-line met or its non-exercise carried as a named
[AUTO-ACCEPTED]. (hypothesis) The verify brief
carries the tracker, the code, and the question — read-only tail,
no executor cite, one named carve-out stated in the brief AFTER
the pasted tail and governing on conflict: executing the repo's
checks writes their normal by-products (caches, build dirs) —
still no commits, no tracker writes. The carve-out also states
how the copy's OWN CODE resolves: an editable install elsewhere
on the host silently redirects an import to the ORIGINAL tree,
and the leg would grade that tree while reporting clean.
Resolution is EXECUTED, never assumed — an import (or
equivalent) run in the isolated copy prints a path inside the
copy, an un-shadowed control alongside it prints the original
path, and the dispatching desk checks the pair before the leg's
result counts (st-56). The carve-out DECLARES the
repo checks' by-product paths, and the declaration with each path's
pre-existence (present or absent) is observed AND written at
dispatch, before the round runs, to that round's paths species
path (seal-path --tracker <path> --round A<n> for attack rounds;
--round verify gives the .verify.paths file, REWRITTEN at each
verify dispatch — at most one is in flight, so no count is
derived); re-derivable by any successor desk from seal-path's
computation — never carried only in the brief or in memory.

The dispatch also
records the copy's HEAD sha at leg read-start — a record: F-line
("verify leg reads at "), so a resume can re-run the gate
against it: the desk is an UNFROZEN concurrent writer during verify,
unlike the attack rounds' append freeze. At the
return, after any queued appends (attack
rounds, The attack) and record repairs land and before the
outcome line, the desk removes exactly the declared paths the
.paths record lists ABSENT that now exist; everything else —
pre-existing (operator state), undeclared, or uncertain — is
LEFT, the leftover a finding, never a broader clean. Removal
consumes the file — delete it once removal has run; a .paths
file with no live round is litter. Single-design attack rounds
carry the same carve-out for the repo checks their probes
execute; a batched trip's attackers execute in their worktrees,
which need none (The attack); an attacker's own probe scratch
belongs in its
scratchpad (the read-only tail's provision), never the repo. Model per
clippy.config/models (verify: class) when present, else the
parent model — resolving only entries under the harness's own
ecosystem, the same st-62 ecosystem-resolution rule (The attack)
that binds tier resolution generally, not the attack tier alone;
an unreadable models file halts the dispatch, the
parse error recorded as a finding.
The certification duty binds this resolution exactly as it binds
the attack's (The attack): the resolved tier is checked against the
skill's shipped defaults/models, and one the register leaves
uncertified for the verify role — or records EXCLUDED there —
verifies as a DECLARED deviation in the tracker, never silently. An
excluded tier does not bar the leg; it obliges the line, so a stack
carrying no certified tier still verifies, loudly.
The leg-return seam: receiving a
verify leg's report, the desk runs verify-gate and appends the
V-line in the SAME TURN — a per-R verdict has no gate-legible form
until the V-line lands, and a pause between the leg's return and
that append leaves them as hand-carried F-lines a resumed close
cannot consume. Before the V-line,
verify-gate --tracker <path> --sha <the recorded read-start sha>
checks the copy against that recorded sha: VERIFY_COPY_CLEAN
proceeds; VERIFY_COPY_STALE names every commit and touched path
landed during the leg — the desk's read, never the leg's claim — and
the V-line's basis states STALE-COPY plus the desk's disposition:
harmless (none of the touched paths graded by the leg) carries the
named delta, or the leg re-runs isolated against the new HEAD. The
check is computable; the disposition stays desk judgment. Append the
V-line (The record) with the evidence and set the header
Status to match (PASSED, or FAILED on an abandoned run; after
[ISSUES FOUND] it stays in-progress). Each [ISSUES FOUND]
finding is CLASSIFIED before any repair, with basis, and the
class sets the route — the four repairs differ by an order of
magnitude in price, and the dangerous misroute is the cheap one
(a design defect patched inside a unit is the no-design
invariant violated with nothing forcing the split): WORK (the
unit built the design wrongly → re-dispatch that unit; lock and
closure untouched), DESIGN (the design cannot meet the
requirement → the premise's scopeless [INVALIDATED], closure
voids, re-derive), REQUIREMENT (work matches design, design
matches R-line, the R-line is wrong → amendment or
reconciliation), INSTRUMENT (the check itself is defective →
the V-line's evidence [INVALIDATED]; no work changes).
The same classes scope the re-verification after the repairs
land: the re-dispatch brief lists every repair (site and diff),
and the leg re-runs each R-line whose checks' reach touches a
repaired surface — reach judged by the leg from what its checks
execute, never by a path join at the desk — carrying a V1
verdict forward only with its per-line reason stated in the
V-line's evidence. Per class: a REQUIREMENT repair takes a fresh
read of the reconciled line against the work, no checks re-run —
except an amendment or reconciliation that WIDENS the R-line's
demand, which re-classes as WORK: the widened demand was never
exercised, so
the touched R-lines' checks re-run same as WORK's own route; an
INSTRUMENT repair re-executes its own red-first pair, nothing
else; a WORK repair re-runs the touched R-lines' checks; any
DESIGN repair voids the scoping — the full leg re-runs.
(hypothesis) Verify returns count against the run budget (The
record) — an unattended run earns no infinite loop.

Close

At the verdict that ends the run ([PASSED], or FAILED per
Verify, per a lock halt — HALT_STATE or an unpinnable
tracker, the header written FAILED at that halt (the halt
routes here with no verify verdict to write it) — or operator
call), append ## Close and present it to the
operator —
unattended this is the run's one touchpoint: the verdict with
its evidence pointer; every open reconciliation; every R-line
amendment (what shipped vs. the letter as asked); every
[AUTO-ACCEPTED] entry; every SWEEP_EXEMPT declaration, with any
holds it still nets (exempt_holds from a sweep run at
close-compose — the close's own read, not a stale seam's; a
declaration whose holds were since repaired is enumerated too);
every RETRO-graded hold (retro_holds, the same close-compose
sweep read — P5, Stop rule);
every
entry whose latest line is
[PENDING] (a FAILED or abandoned run can carry them);
deviations and gaps; what was NOT verified; candidate
lessons. The close ENUMERATES BY REFERENCE — id plus a prose
summary, never a copied tag-first line: a copied line is a new
entry, and a copied scopeless body voids; report material
enters as quote blocks, the tool's production. Landed seals
and their comparisons
enter here (The attack). Status flips to COMPLETE when the close
is appended — over a PASSED verdict ONLY: a run ending FAILED
takes the same close and KEEPS FAILED, so a FAILED run's close
is marked by its ## Close heading, never the header.
After the close is appended and Status written, pin the
delivered record — lock-commit --tracker <path> -m <close message> over the tracker alone (post-lock appends otherwise
never enter git); its verdict line delivers with the close.
HALT_NO_CHANGES here means the record is already pinned (a
re-run after an ambiguous first attempt) — benign, delivered
as-is. A HALT here (HALT_STATE on an operator operation in
flight, or any other) never blocks delivery: the close
delivers UNPINNED with the halt's verdict line named in its
deviations — attended, the operator's clearing reply gets one
pin retry; there is no later seam to catch an unpinned
delivery, so the deviation line is the record of it.
Skipped only where the run never had a pinnable tracker
(preflight's UNPINNABLE halt). Delivering the close is then
the desk's final act, so the
delivered artifact carries its final Status. Open
reconciliations survive
into COMPLETE, enumerated in the close; an operator answer
arriving later appends its resolving line to the closed tracker —
append-only has no expiry, and the close's enumeration is what
makes the late landing findable.

A finding entry may carry an OUT-OF-SCOPE grade at booking — the
body opens out-of-scope: <claim> — the third scope class, sibling
to unit U<k> /record:, exempt from the post-closure
scopeless-VOID rule (Implementation) since the grade is a leavings
concern, never a design re-derivation trigger — for a true finding
outside the requirement head, found in passing. closure enumerates
every out-of-scope-graded id and HOLDS (CLOSURE_LEAVINGS_HOLD,
blocking both the whole-record query and any --unit query) until
each carries a DISPOSITION on its latest line: an export ref
— exported: <ref> citing a decision-graded backlog entry in the
target repo that cites this run's record, seedable by a successor
run, or a one-line recorded drop — dropped: <reason>. The printed
closure verdict names the undispositioned set; the desk composes the
disposition as an ordinary new tag-first line for the same id
(append-only, latest-line-wins), never an edit of the booking line.
The disposition line RE-CARRIES its out-of-scope: opener (or
opens record: where the disposition is desk bookkeeping) — a bare
— exported: <ref> or — dropped: <reason> opening reads scopeless
and voids the WHOLE closure, the same trap the cleared-hold line's
warning names (Implementation) — resolvable, like any scopeless
line, only by a later same-id restatement carrying
record:/unit U<k> scope (st-63), never by editing the bare
line in place.
The close REPORT itself carries a LEAVINGS section enumerating three
classes: (1) out-of-scope findings — the mechanical gate above, the
one class that is a run artifact proper; (2) instruments and probes
built in-run and used more than once; (3) world-facts a successor
would otherwise re-derive (population maps, environment overrides,
frame-anchoring) — each with its executed basis. Every enumerated
item carries a DISPOSITION slot the desk fills per the HOST repo's
own conventions (corpus-governed where present, operator-decided
otherwise); the skill mandates the enumeration and the filled slot,
never the destination — statiker owns the run and its record,
SURFACING is run-conduct, FILING is the environment's. Each exported
successor entry CITES the parent close report's leavings section by
anchor, and at requirement-head composition a fresh run reads its
task source's cited leavings section — where the task source is such
an exported entry — before the head is composed: the inheritance
interface is one digest section, not the full record, and the
adoption path (The record) remains the trust protocol for anything
the new run rests on. Skill-evolution and repo-memory channels are
deliberately environmental — this record chain (close-report digest
→ seed entries → adoption path) is statiker's complete built-in
inheritance for a standalone user.

Fire-born and hypothesis clauses

No lens list, no lens pass. When a real blind spot fires in
operation, mint it as a pointed hunt clause inside the section it
serves (usually The loop's brief-writing) — one incident as
provenance, amendment over addition; log the mint and each
subsequent firing in the source repo's dev-notes/OBSERVATIONS.md —
a desk in a target repo without a local checkout at hand rides
the observation on its run report instead. A clause with no
firing since the last review is a cut candidate.
A second provenance class (PLAN.md, hypothesis-patch amendment):
clauses marked (hypothesis) were minted PROACTIVELY as
universally-advisable loop calibrations, each with a validation
criterion logged in dev-notes at its mint — pruned at fire-rate
reviews exactly like fire-born clauses, on their criteria. An
unmarked addition with neither provenance class is still the
tripwire.

Birth-class declaration

Enforcement structure + bindings, with fire-born and hypothesis
patches (above) the only admitted additions. A patch landed
without provenance is the tripwire.

No line target governs this file. Its mass is machine semantics,
deliberately in that medium, so the count moves by precipitation
into mechanism and never by a budget (PLAN.md, Size target).