Guard K4: runner commands, bounded interpreter reading, OmniRoute management routes - #567

…ds (the #556 criterion)

test_k4_timing judged each helper by one CPU-time sample per size with "100k under 8 times 25k"; PR #567's hosted
validate failed it on two linear helpers at margins of 1 to 6 % (k4_shell_literals 0.1058 against 0.0998,
k4_store_text 0.1408 against 0.1397). It now uses the criterion of examples/claude-native/workflows/
test-child-usage.mjs (#556): the growth exponent ln((t100k + 5 ms) / (t25k + 5 ms)) / ln 4 under 1.5, over the
elementwise minimum of up to three rounds, with K4_LINEAR_SECONDS kept as the absolute bound. Measured with the
minimum of three rounds on the workstation, all 67 helpers fit exponents of 0.975 or less. A new test pins the
criterion: the two failing CI samples pass and a helper quadratic by construction fails from 4.5 ms at 25k up.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…ed macOS runner is about 2.8 times slower)

PR #567's validate-macos failed K4's fixed 0.5 s processor-time bound on linear work: row T-STORE-PRINTF took
0.550 s and k4_runner_commands' whole check 0.562 s on the hosted macOS runner, where this workstation measures the
row at 0.197 s. The bound now scales by k4_host_factor(): this host's time for a guard-independent reference (the
standard library's pure-Python shlex lexer over a fixed text, minimum of five runs) relative to the workstation's
0.0355 s, never below 1, a reference-machine ratio as SPEC CPU reports speed. On the workstation the bound stays the
contract's 0.5 s; a quadratic regression still grows 16 times per 4 times input and fails on any host. The controls
test pins the scale (1 on a faster host, proportional on a slower one). docs/secret-storage.md states both criteria.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…rows final for this edition; keys; Gate A)

- us-equities (the trading lane owner's acknowledgement in PR #574): twelve owner notes replace the provisional
  ones; the adaptive-paper winner is pinned to the #559 merge commit; the final #4983 gate text (a stale v1.227.0
  report for rc5 by source reading; the open rc5 obstacles are #5007, #5057 and #5060); two paid-data user gates
  and one lane gate; three evidence-class changes.
- cross:credential-practice (keys lane): the canary proof tool's review state and what item 3 waits for; K4's
  place in the train; the guard pin after #567.
- quality-evaluation: the OAuth token's store today and after K4 (keys lane); six matplotlib tasks logged the
  pull error and the four in the final task set ran after the widening (Gate A owner, receipt at cd7db15).

Adaptation, stated to the owner: the adaptive-paper winner keeps `name` and a file `pin_source`, because the
validator accepts `component_id` only for a manifests/stack.json component and a pin source only as a file.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

…ews, and the four review threads

- token-efficiency row: the Harbor E2E covers four of the layer protocol's five arms in the short single-session
  regime; the re-aimed Gate A E2E tests the accepted profile in the multi-agent regime, not the per-tool protocol
  (Gate A owner).
- Subordinate ids: six matplotlib tasks logged the pull error; the four in the final task set ran after the widening.
- The Harbor token is a separate credential minted with `claude setup-token`; the native sign-in store is never read
  or copied; its inventory entry arrives with K4 (#567), and until then path R's token step is a stated gap (keys
  lane; review thread).
- The Harbor receipt is on PR #570's branch, not in this revision (review thread).
- us-equities: the owner's verdicts, acknowledged in PR #574; the artifact lands in a lane:trading pull request.
- Unit U6's first delivery is PR #575 (20 foundation reviews, remaining gaps in every layer); a performed review
  that names gaps does not satisfy item 4, so the item-4 cells keep the assessment's reading.
- The edition is PR #574.
- Artifact README: two corrections to commands in the frozen assessment (`--client-wiring`; the Codex skills
  renderer), recorded beside the file because the item-4 reviews bind to its hash (review threads).

Co-Authored-By: Claude Fable 5.1 <[email protected]>

…rows final for this edition; keys; Gate A)

- us-equities (the trading lane owner's acknowledgement in PR #574): twelve owner notes replace the provisional
  ones; the adaptive-paper winner is pinned to the #559 merge commit; the final #4983 gate text (a stale v1.227.0
  report for rc5 by source reading; the open rc5 obstacles are #5007, #5057 and #5060); two paid-data user gates
  and one lane gate; three evidence-class changes.
- cross:credential-practice (keys lane): the canary proof tool's review state and what item 3 waits for; K4's
  place in the train; the guard pin after #567.
- quality-evaluation: the OAuth token's store today and after K4 (keys lane); six matplotlib tasks logged the
  pull error and the four in the final task set ran after the widening (Gate A owner, receipt at cd7db15).

Adaptation, stated to the owner: the adaptive-paper winner keeps `name` and a file `pin_source`, because the
validator accepts `component_id` only for a manifests/stack.json component and a pin source only as a file.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

…ews, and the four review threads

- token-efficiency row: the Harbor E2E covers four of the layer protocol's five arms in the short single-session
  regime; the re-aimed Gate A E2E tests the accepted profile in the multi-agent regime, not the per-tool protocol
  (Gate A owner).
- Subordinate ids: six matplotlib tasks logged the pull error; the four in the final task set ran after the widening.
- The Harbor token is a separate credential minted with `claude setup-token`; the native sign-in store is never read
  or copied; its inventory entry arrives with K4 (#567), and until then path R's token step is a stated gap (keys
  lane; review thread).
- The Harbor receipt is on PR #570's branch, not in this revision (review thread).
- us-equities: the owner's verdicts, acknowledged in PR #574; the artifact lands in a lane:trading pull request.
- Unit U6's first delivery is PR #575 (20 foundation reviews, remaining gaps in every layer); a performed review
  that names gaps does not satisfy item 4, so the item-4 cells keep the assessment's reading.
- The edition is PR #574.
- Artifact README: two corrections to commands in the frozen assessment (`--client-wiring`; the Codex skills
  renderer), recorded beside the file because the item-4 reviews bind to its hash (review threads).

Co-Authored-By: Claude Fable 5.1 <[email protected]>

… layers, none final for install), criterion decisions, program units (#573)

* Definitive SOTA WSL program record: finalize every layer against the closure criterion, then build the clean runtime

Opened on the user's 2026-10-01 directive and the Gate A owner's option-A ruling: the definitive runtime is a new WSL 2
distro bootstrapped from a final revision, each layer's selected repositories installed there with upstream commands by an
LLM-native session with per-layer receipts; the current distro keeps the sealed Gate A measurement. Phases, the per-layer
closure criterion (research-state.json saturation.close_only_when), the ownership split and the gaps recorded so far;
the per-layer gap tables are appended when the closure assessments land.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* Program record: the foundation closure assessment (20 layers, none final for install), four criterion decisions, program units

- docs/decisions/2026-10-01-definitive-sota-wsl-program.md: the foundation table (items 1 to 5 per layer, install
  command, pin currency, the blocking item, the verdict), the cross-layer patterns, units U1 to U10, the pins behind
  their latest release, install readiness and the contradictions for the re-record pass. Four decisions on the
  criterion: research-state.json governs which layers need a comparison (six label disagreements go to the
  re-record pass; scheduling-supervision is treated as comparison required after Dagu's failed preregistered case);
  "frozen" in item 2 defaults to a recorded set with dispositions and is the user's to overturn; a comparison runs
  on a named host and only the lifecycle check on the new distro, with provisional installs behind the checkpoint;
  stage 2 installs origin/main at a recorded commit until a new tag is cut. The production composition is a
  candidate, not a selection. The 262,144 subordinate-id requirement is withdrawn (Docker's prerequisite is 65,536;
  wider only on the documented pull error). The independent review's three findings and the open user decisions
  are recorded.
- evidence/artifacts/layer-closure-assessment-20261001/: the sanitized assessments (foundation.json), the synthesis
  and a README with the method, the evidence class, the limits and the sanitization.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* Program record: repair the independent review's 17 findings, cite the published subordinate-id observation, record the run-to-run variance

Review (evidence-reviewer role, Claude Opus 5.5 at max): no high finding, 5 medium, 12 low; the 200 cells of the
foundation table from "Layer" to "Pin is latest" matched the artifact and the two catalog files.

- The stage-2 bootstrap is itself a provisional install under decision 3; the Decision paragraph and phase 3 say so;
  a layer that stays uninstalled is marked in the install manifest; overturn conditions for decisions 3 and 4.
- Decision 2: what the two saturation sources do and do not say; the default rests on item 2's own wording.
- Five unpinned winners, not three; the workers row says only the executed baseline ran; the token-efficiency row
  names its protocol; recovery-portability carries "label to reconcile"; U3 names its eight layers; U8 gains the id
  mismatch and the jcodemunch-mcp pin; smaller corrections to the pins table and the contradictions list.
- Subordinate ids: the 262,144 observation is cited from the receipt block on PR #570's branch.
- The candidate composition: AgentRelay and Relaycast have no catalog layer; Hindsight's holds are unpublished.
- Run-to-run variance: seven layers ran twice after the workflow's resume; five differ in one or two item
  statuses; none becomes final for install. New file foundation-run-variance.json; the README says how far a
  single cell can be trusted.
- Open decisions gain the stage-2 question and the 2026-09-23 live-store isolation breach.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* Program record: lane owners' corrections, the Codex lane's first reviews, and the four review threads

- token-efficiency row: the Harbor E2E covers four of the layer protocol's five arms in the short single-session
  regime; the re-aimed Gate A E2E tests the accepted profile in the multi-agent regime, not the per-tool protocol
  (Gate A owner).
- Subordinate ids: six matplotlib tasks logged the pull error; the four in the final task set ran after the widening.
- The Harbor token is a separate credential minted with `claude setup-token`; the native sign-in store is never read
  or copied; its inventory entry arrives with K4 (#567), and until then path R's token step is a stated gap (keys
  lane; review thread).
- The Harbor receipt is on PR #570's branch, not in this revision (review thread).
- us-equities: the owner's verdicts, acknowledged in PR #574; the artifact lands in a lane:trading pull request.
- Unit U6's first delivery is PR #575 (20 foundation reviews, remaining gaps in every layer); a performed review
  that names gaps does not satisfy item 4, so the item-4 cells keep the assessment's reading.
- The edition is PR #574.
- Artifact README: two corrections to commands in the frozen assessment (`--client-wiring`; the Codex skills
  renderer), recorded beside the file because the item-4 reviews bind to its hash (review threads).

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* Program record: name the Harbor receipt as published by PR #570; the 308 scanned logs are 288 trials plus 20 smoke logs

The Gate A owner revised the receipt after its review (PR #570): the 308 claude-code logs are the 288 trials plus 20
smoke logs of a spare task. Three sentences said the receipt was on that pull request's branch and not in this
revision; they now name the pull request that publishes it, which holds whichever of the two merges first.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* Register the layer closure assessment artifact in manifests/evidence.json (hot-file protocol: last commit only)

Co-Authored-By: Claude Fable 5.1 <[email protected]>

---------

Co-authored-by: Scout <scout@local>
Co-authored-by: Claude Fable 5.1 <[email protected]>

…rows final for this edition; keys; Gate A)

- us-equities (the trading lane owner's acknowledgement in PR #574): twelve owner notes replace the provisional
  ones; the adaptive-paper winner is pinned to the #559 merge commit; the final #4983 gate text (a stale v1.227.0
  report for rc5 by source reading; the open rc5 obstacles are #5007, #5057 and #5060); two paid-data user gates
  and one lane gate; three evidence-class changes.
- cross:credential-practice (keys lane): the canary proof tool's review state and what item 3 waits for; K4's
  place in the train; the guard pin after #567.
- quality-evaluation: the OAuth token's store today and after K4 (keys lane); six matplotlib tasks logged the
  pull error and the four in the final task set ran after the widening (Gate A owner, receipt at cd7db15).

Adaptation, stated to the owner: the adaptive-paper winner keeps `name` and a file `pin_source`, because the
validator accepts `component_id` only for a manifests/stack.json component and a pin source only as a file.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

…rows final for this edition; keys; Gate A)

- us-equities (the trading lane owner's acknowledgement in PR #574): twelve owner notes replace the provisional
  ones; the adaptive-paper winner is pinned to the #559 merge commit; the final #4983 gate text (a stale v1.227.0
  report for rc5 by source reading; the open rc5 obstacles are #5007, #5057 and #5060); two paid-data user gates
  and one lane gate; three evidence-class changes.
- cross:credential-practice (keys lane): the canary proof tool's review state and what item 3 waits for; K4's
  place in the train; the guard pin after #567.
- quality-evaluation: the OAuth token's store today and after K4 (keys lane); six matplotlib tasks logged the
  pull error and the four in the final task set ran after the widening (Gate A owner, receipt at cd7db15).

Adaptation, stated to the owner: the adaptive-paper winner keeps `name` and a file `pin_source`, because the
validator accepts `component_id` only for a manifests/stack.json component and a pin source only as a file.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

…d) and its tab in the ecosystem guide (#574)

* New-WSL architecture edition 2026-10-01: 37 rows, none closed, with its decision record

catalogs/foundation/new-wsl-architecture-20261001.json is the install manifest for a new WSL
distribution: one row per catalog layer (20 foundation, 12 us-equities) plus five cross rows
(distribution, runtime workers, GPT-6 harnesses, credential practice, convergence practice).
Each row carries winners at their pin of record, a verdict under the research state's five
closure items, the evidence class every winner reaches, sourced reasons, alternatives,
per-winner upstream currency read on 2026-10-01, ordered new-host steps and gates.

Verdicts: 19 selection_of_record_open, 12 comparison_required, 4 no_selection, 1 provisional
(token-efficiency), 1 new_host_required (recovery-portability); closed: none. The trading rows
are the fallback form (assessment pending, provisional_wording). Sources not yet on main are
cited through PR #569, #570 and #358.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Ecosystem guide: "Final architecture" tab with its loader, validator and tests

scripts/build_ecosystem.py gains a second hard-wired topic beside the token topic:
ARCHITECTURE_TOPIC, build_architecture (run last, so its publication-ref links never move
another section's links) and architecture_row. It enforces known layer ids or cross: ids,
stack pins for component winners ("architecture row pin must match manifests/stack.json"),
public HTTPS links, repository-file citations hashed into the page inputs, structured
pending sources for files that land with a pull request, the verdict and evidence-class
enums, closed if and only if all five closure items are met, and a named gap for every open
row. Catalog layers without a row are listed, never a build failure.

docs/ecosystem/template.html adds tab 05 (Evidence becomes 06), hidden without the edition,
with the edition header, one table per catalog and expandable details; links go through
link()/safeHref, and the page keeps one data element and one inline script.

tests/test_ecosystem_manifest.py: fixture edition, one failing fixture per new validator
message, hidden tab without the file, digest change, inert hostile text, the page script
under Node, and the real edition's coverage and tracked citations.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Architecture edition: us-equities rows from the trading closure assessment (provisional wording)

Eleven of the twelve us-equities rows now follow the 2026-10-01 trading closure assessment
(read at PR #358's head 4d11709): closure items and named gaps per layer, and winners limited
to pins of record from runtime-target.json (engine, brokers, adaptive paper engine) and the
adoption profiles. Verdict winners without such a pin (DVC, pandera, agent-retrieval-bench,
Inspect AI, MLflow, Grype) stay alternatives. security-supply-chain has no assessment and keeps
"assessment pending". The backtesting-engine dispute is read at #358's head b0eb7a1; paper
results are stated only as fills and passed trials. Every trading row stays marked
provisional_wording for the trading lane owner.

Edition totals: 37 rows, none closed; 21 selection_of_record_open, 13 comparison_required,
1 no_selection, 1 provisional, 1 new_host_required. The decision record follows.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Architecture edition: the coordinator's review edits (holds as gates, subordinate ids, scheduling comparison, trading rows from the complete assessment)

- Pending sources follow their pull requests' heads (#569 344a69f, #570 87c74d5); the program record and the
  foundation assessment (#573) join the sources.
- quality-evaluation: 65,536 subordinate ids at stage 1, a wider range only on Docker's documented pull error, with
  the workstation observation cited from the Harbor receipt; the OAuth token lives in its 0600 provider file.
- durable-memory and cross:runtime-workers carry the holds the production program reports (Hindsight's stale and
  paused pages and held cold seed; AgentRelay's held automatic Codex PTY submission) as gates, and durable-memory the
  open operator decision on the 2026-09-23 live-store breach.
- code-navigation: the carrier names jCodeMunch while stage 2 neither installs nor registers it (gate); the recipe's
  step F11 joins the install order.
- scheduling-supervision: comparison_required after the failed preregistered SIGKILL case (the program record's
  decision 1), with the limit of the Temporal arm stated.
- hosting-services: Next.js 16.3.8 fixes a High-severity advisory above both recorded pins (release page read
  2026-10-01); a gate asks for the pin move before the layer hosts anything reachable.
- us-equities: the rows follow the last complete result per layer of the now complete 12-layer assessment
  (backtesting-engine item 1 met and item 4 unmet; portfolio-risk item 5 partial; security-supply-chain assessed).
- The decision record follows: 20 selection_of_record_open, 14 comparison_required; run-to-run variance stated.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* Architecture edition: the lane owners' answers (token-metric block, Gate A coverage, trading verdicts)

- token-efficiency: the layer protocol's own metric from the Harbor receipt's new block (headroom 0.867 [0.775,
  0.971], rtk 0.955 inconclusive, context-mode 1.181, jcodemunch 1.407, full stack 1.105; paired token ratios on
  tasks both arms solved, not independently reproduced); the gate says what the re-aimed Gate A E2E covers (the
  accepted profile in the multi-agent regime) and what stays open (the Repomix arm, the per-tool protocol in the
  multi-agent regime). Wording from the Gate A owner.
- us-equities: the trading lane owner's verdicts of 2026-10-01. research-factors-ml and security-supply-chain have
  no selection of record for the layer itself (no_selection; their current-choice components become alternatives).
  execution-broker: the #4983 entry is stated as under the owner's reconciliation; the 2026-09-29 paper series ran
  at engine revision b528bb5.
- Pending source for PR #570 follows its head ee06ded. Verdicts now: 19 selection_of_record_open, 13
  comparison_required, 3 no_selection, 1 provisional, 1 new_host_required.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* Architecture edition: the lane owners' verbatim corrections (trading rows final for this edition; keys; Gate A)

- us-equities (the trading lane owner's acknowledgement in PR #574): twelve owner notes replace the provisional
  ones; the adaptive-paper winner is pinned to the #559 merge commit; the final #4983 gate text (a stale v1.227.0
  report for rc5 by source reading; the open rc5 obstacles are #5007, #5057 and #5060); two paid-data user gates
  and one lane gate; three evidence-class changes.
- cross:credential-practice (keys lane): the canary proof tool's review state and what item 3 waits for; K4's
  place in the train; the guard pin after #567.
- quality-evaluation: the OAuth token's store today and after K4 (keys lane); six matplotlib tasks logged the
  pull error and the four in the final task set ran after the widening (Gate A owner, receipt at cd7db15).

Adaptation, stated to the owner: the adaptive-paper winner keeps `name` and a file `pin_source`, because the
validator accepts `component_id` only for a manifests/stack.json component and a pin source only as a file.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* Architecture edition: each foundation row cites the Codex lane's second independent review (PR #575)

The cross-family review of the 20 foundation layers (gpt-6.1-sol, 2026-10-01) was performed and names remaining
gaps in every layer, so item 4 stays open; each row says so with its review file as a pending source. The item
cells keep the closure assessment's reading until the layer records are re-recorded. The crosswalk of the same
pull request is referenced in the sources, not duplicated.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* AgentsView re-pin registry: classify the dated architecture edition

The edition names AgentsView 0.43.0 as an alternative of the observation layer, so the registry of files that name
the pinned version needs a classification for it (`tests.test_agentsview_qualification.RepinLocationRegistryTests`
failed in the hosted full suite on d15d584: "Lists differ: ['catalogs/foundation/new-wsl-architecture-20261001.json']
!= []"). It is a dated record: a re-pin does not rewrite a dated edition.

Tests: python3 -m unittest tests.test_agentsview_qualification -> 12 tests OK (2 failures before this change).

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* Architecture edition: evidence-class floor and closure-segment rules, with reverse-case tests

- A row with a none_recorded winner must be none_recorded; otherwise its class must be one that at
  least one winner's acceptance carries (rows without winners keep their owner's class). Ten rows
  change class to satisfy it: seven to none_recorded, three to the class all their winners carry.
- closure.missing must start with one "cN:" segment per item that is not met and name no met item;
  a trailing sentence without a prefix stays allowed.
- Tests: both rules (failing first), the reverse direction of the three if-and-only-if rules, a
  reversed line range, a cross: id with a non-cross catalog, a none_recorded install with a command,
  path escapes at the three architecture call sites, the hostile edition through the page harness;
  the real-edition test no longer requires a row for every layer.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Architecture edition: bind the five closure-item texts by their sha256

The build reads saturation.close_only_when live; the edition now records close_only_when_sha256
(the five texts joined in order with newlines, no trailing newline) and the build fails when the
research state's texts hash differently, so a reworded or reordered state cannot show each row's
states beside other texts. Test written failing first.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Architecture edition: pin drift passes, landed pending sources, layer identity pairs, winner roles

- A component_id winner whose pin differs from manifests/stack.json no longer fails the build (the
  token topic's precedent): the page notes "the stack now records <version>" on that winner and the
  --check JSON lists every drifted winner under architecture_pin_drift. A component_id outside the
  stack still fails.
- A pending_source whose path now exists as a repository file has landed: it is hashed into the page
  inputs and linked like a source_path, labelled "landed after this edition's base (pull request #N)";
  a later merge of that pull request never fails the build.
- Known and seen layers are keyed on (catalog, layer_id).
- An optional per-winner role (non-empty, at most 120 characters), rendered beside the winner's name in
  the table cell and in the row detail.
- Tests for each, and both states of a pending source in place of the trivially true assertion.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Architecture edition rows: winner roles, two corrected commands, the Harbor claim narrowed

- Roles on the three trading rows in the trading lane owner's words: backtesting-engine,
  execution-broker and portfolio-risk (NautilusTrader as destination or engine of record, LEAN as
  the comparison oracle, the Alpaca path and boundary, the Alpaca paper engine, skfolio's scope).
- instructions-skills: the separate renderer call install_skills.py --print-codex-config of
  adoption/update.md before the Codex configuration is applied.
- token-efficiency: the profile receipt step names adoption_status.py --client-wiring
  --pinned-versions --json (client wiring is reported only with the opt-in flag).
- token-efficiency: "no tool lowered whole-task cost" becomes the revised receipt's narrower claim
  (no cost reduction established for any tool); every figure kept.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Architecture edition record and README: drift, landed sources, both directions of the closed rule

- Record: the pending pull requests now name #569, #570, #358, #573, #575 and #535 (context and
  overturn condition 4); overturn condition 2 says a stack pin move passes, is noted on the page and
  listed by --check; the validation paragraph covers pin drift, roles, landed pending sources and
  (catalog, layer_id) identity; residual gaps add that pin_source content is unchecked and that two
  winners cite a file that cannot establish their pin.
- README: the validation paragraph states the closed rule in both directions and the new rules
  (missing segments, class floor, closure-text hash, drift, roles, landed sources).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Architecture edition: winner acceptance classes describe recorded runs (review of 2026-10-01)

An independent review checked all 119 winner acceptance entries against their cited sources:
32 classes were not supported, 13 commands were version or status prints and 6 could not be
settled. This revision applies the coordinator's dispositions and the lane owners' answers:

- 55 of 119 entries change (32 classes, 48 commands, 31 cited sources); 20 entries are now
  none_recorded (a check only prescribed, planned, not run or failed) and 13 structural_validation
  (schema, pin, hash and contract-test checks).
- Trading owner (verbatim, items 1-7): alpaca-py, nautilus-trader, edgartools, adaptive-paper and
  systemd re-cited to the files that record their runs, with the owner's classes and notes.
- Gate A owner: Harbor's acceptance is the recorded 288-trial run, its forced-subagent pilot a
  NOT RUN reason; otelcol and loki structural; prometheus as its qualification receipt records;
  the headroom 0.39.1 versus pinned 0.37.0 fact in the token-efficiency reasons and closure text.
- Keys owner: the guard winner is K4 (merged as 2979742) with its verification receipt.
- dagu, jcodemunch-mcp and omniroute commands become what their receipts record; uv and gh are
  checksum checks; huggingface-hub-native, qdrant, openresearch and worktrunk are none_recorded.
- Row classes re-set by the round-2 rule, taking the class listed last in the policy table where
  winners carry several: 16 rows change. Reasons that contradicted their row are reworded.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Architecture edition record and README: the acceptance-class invariant and the dated review

- Record ("Evidence classes"): a winner's acceptance class describes a run that the cited source,
  or one file it links, shows was run on a host and what it returned; a check only prescribed,
  planned, not run or failed is none_recorded; schema, pin, hash and contract-test checks are
  structural_validation; a version print is metadata. The dated statement of the 2026-10-01 review
  and the counts this revision changed; the row tie-break (the class listed last in the policy
  table where winners carry several). Residual gap: the review read one hop from each cited file
  and rated part of its corrections below high confidence.
- README: the same invariant and tie-break, held by review rather than by a validator.
- Test: the repository record keeps the invariant and the dated review statement.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Architecture edition: a none_recorded acceptance may name the check to run

Round 3 had to blank the command of every acceptance it set to none_recorded, because the build tied an empty
command to that class. For an install manifest that loses the check the new host must run. The build now requires a
command for every recorded class and allows one on none_recorded, where it names the check to run and no run of it
is recorded. One test, failing against the old rule.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* Architecture edition: owners' selections, restored checks, all 32 layer reviews cited, current sources

- 13 none_recorded entries get their check to run back; restic is cited to its off-host receipt in four rows; the
  embedding model's command says what its receipt records; the convergence validators cite the recorded runs.
- The trading lane owner's decisions of 2026-10-01 for the two rows that had no selection: research-factors-ml
  (EdgarTools, skfolio; comparison_required) and security-supply-chain (Syft, Gitleaks, Grype;
  selection_of_record_open), each with the owner's sources and closure text; neither closes anything.
- cross:wsl-distro is re-rated to new_host_required now that the recipe is on main: one winner (the Ubuntu 24.04.5
  image by sha256), acceptance none_recorded, stage 1 waiting for the recipe's follow-up.
- Every foundation and us-equities row cites the Codex lane's second independent review at PR #575's head 51cb79b
  (12 us-equities reviews are new); the record names the difference between those reviews' selected sets and this
  edition's winners as a residual gap for the re-record pass.
- Pending sources carry the pull requests' current heads; the record lists which have merged.
- The trading owner's wording of the SPY parity blockers in the backtesting-engine row; two statements the day's
  merges overtook (the K4 inventory entry, the canary pull request).
- The program record names PR #578 for the trading closure records.

Row verdicts now: 20 selection_of_record_open, 14 comparison_required, 2 new_host_required, 1 provisional.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* Architecture edition: landed sources as plain citations; Qdrant cited to its host receipt

- The 27 citations of pull requests that have merged (#569, #570, #573, #358) and five in the edition's source list
  become plain source_path entries: the files are on main, and a pending_source names a pull-request head that is
  not (the Gate A owner's check of this pull request).
- Qdrant has a recorded run: the workstation's host receipt of 2026-09-25 (the running server answered with 1.19.1
  at the catalog pin). Its acceptance cites that receipt in both rows that list it; the health check stays a
  new-host step (the trading lane owner's correction). agents-models-workers therefore reads
  upstream_example_or_native_operation.
- skfolio in portfolio-risk cites the research-evaluation receipt instead of its prose summary.
- The record's counts follow: 125 winner entries, 14 none_recorded, 11 of them naming the check to run.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* Hot files: evidence manifest hashes for the changed files and the regenerated reports

Filled by the hot-file protocol (docs/lanes.md): re-registers the changed files that
manifests/evidence.json lists and regenerates the component evidence matrix and the
new-host grand list.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: Scout <scout@local>
Co-authored-by: Claude Opus 5.5 <[email protected]>